From 6bc36a2c5b0d2c6c06aefdd2ab564e166c83e85c Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 16:38:25 +0800
Subject: [PATCH 01/10] fix: preserve failed native observations and permission
 evidence

---
 .../plans/2026-10-30-permissions-and-ui.md    | 101 +++++++++++++++
 .../2026-10-30-permissions-and-ui-design.md   |  42 +++++++
 envscope/baseline.py                          |  32 +++--
 envscope/inventory.py                         |  72 +++++++----
 envscope/network_facts.py                     |  32 +++--
 envscope/observation_errors.py                |  71 +++++++++++
 envscope/probes.py                            |   7 +-
 envscope/target_environment.py                |   7 +-
 tests/test_inventory_permissions.py           | 118 ++++++++++++++++++
 9 files changed, 429 insertions(+), 53 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-10-30-permissions-and-ui.md
 create mode 100644 docs/superpowers/specs/2026-10-30-permissions-and-ui-design.md
 create mode 100644 envscope/observation_errors.py
 create mode 100644 tests/test_inventory_permissions.py

diff --git a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
new file mode 100644
index 0000000..934b997
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
@@ -0,0 +1,101 @@
+# Permissions and desktop refresh Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Complete the permission/usability optimizations and their acceptance gates, then deliver the complete minimal desktop UI/icon/interaction upgrade.
+
+**Architecture:** Extend existing collectors, Operations, webview and native helper transactions. Keep ordinary tasks in the user's session, privileged operations narrowly scoped and consent results independently verified.
+
+**Tech Stack:** Python/unittest, JavaScript/node tests, Playwright, native C/OS helpers, PyInstaller, GitHub Actions.
+
+**Spec:** `docs/superpowers/specs/2026-10-30-permissions-and-ui-design.md`
+
+## Global Constraints
+
+- Windows/macOS; monochrome/minimal; one main test button; no mobile work.
+- No real system changes during development/testing; explicit reviewed boolean confirmation for product writes.
+- Preserve vendor, credentials, account recovery, report freshness and unknown-result boundaries.
+- User clarified on 2026-10-30: deliver as an open-source project without signing credentials. Formal publisher signatures and Apple notarization are optional, not delivery gates. Keep unsigned build identity and verification honest. Record real authorization device evidence separately from automated fixture evidence.
+- Complete optimization acceptance before the overall visual refresh.
+
+## Review Focus
+
+- Permission revoked while the app is in the background: preserve the failed capability and do not repeat consent prompts.
+- Target/check selection changes while authorization is pending: discard stale continuation and require a current report.
+- User cancels after a partial native transaction: reconcile actual receipts, do not claim nothing changed.
+- Service binary/config tampered with or owned by a different user: refuse execution and preserve recovery material.
+- App upgrade or sleep/resume changes service state: verify identity/heartbeat before claiming protection.
+
+### Task 1: Truthful collection evidence
+
+**Files:** Create `envscope/observation_errors.py`, `tests/test_inventory_permissions.py`; modify `inventory.py`, `network_facts.py`, `probes.py`, `baseline.py`, `target_environment.py` and their focused tests.
+
+**Interfaces:** `error_evidence(error, operation) -> dict` returns a bounded code and operation without raw diagnostics; `inventory_errors(inventory) -> dict` exposes component errors to report/permission consumers. Existing data keys remain compatible.
+
+- [x] Write regressions for denied DNS/adapter/route reads, unavailable tools, malformed responses, timeout and partial inventory. Assert consumer-visible report/assessment outcomes.
+- [x] Run `python -m unittest tests.test_inventory_permissions -v`; observed the expected failures against 0.24.1 behavior.
+- [x] Implement structured error propagation and partial-summary handling in the existing collectors/checks.
+- [x] Run focused tests and full Python suite: 688 tests, OK, 5 platform skips.
+- [x] Commit this independently testable correction and ledger its evidence.
+
+### Task 2: Scoped authorization and automatic continuation
+
+**Files:** Modify `permissions.py`, `operations.py`, `assessment.py`, `web/desktop.mjs`, `web/app.mjs`; create `web/permission_flow.mjs`, `tests/test_permissions.py`, `scripts/permission_flow_smoke.py`.
+
+**Interfaces:** `permission_help` returns capability IDs, scope, affected checks and an OS action while retaining legacy response fields. Frontend `initPermissionFlow({run,operate,recheck,getContext})` owns pending authorization, focus/visibility continuation, cancellation and retry; no permission is granted from a frontend flag.
+
+- [ ] Write backend and browser regressions for every routed capability, cancellation, changed target/selection, missing settings entry and permission still denied after return.
+- [ ] Observe the failures, then implement per-capability OS actions and bounded continuation with fresh audit/repair preview.
+- [ ] Classify OS consent/operation outcomes in a shared helper and wire callers without discarding pending native transactions.
+- [ ] Run permission, native transaction and browser workflow tests plus the full Python/JS suites; commit and ledger results.
+
+### Task 3: Persistent guard authority and actionable notifications
+
+**Files:** Modify `watchdog.py`, `maintenance.py`, `timezone_service.py`, `desktop_runtime.py`, native build scripts; add Windows native timezone service/source, lifecycle adapter and corresponding fixture tests/CI acceptance.
+
+**Interfaces:** Guard preparation exposes per-component capability/authorization state; service adapters implement status/prepare/apply/recover/undo/remove using reviewed plan IDs and protected receipts. UI receives component states from these results rather than inferring authority from a saved baseline.
+
+- [ ] Add regressions proving a matched baseline with insufficient write authority cannot be represented as automatic protection; cover revoke, cancel, tampered files, foreign owner and pending recovery.
+- [ ] Implement native Windows timezone service and one-time reviewed installation/update/removal; preserve existing macOS root service behavior and evaluate the supported SMAppService route.
+- [ ] Implement deduplicated actionable notifications with a direct return to the failed component.
+- [ ] Run isolated native service lifecycle and at least two automatic scheduler cycles on supported CI platforms, with original machine values unchanged; run full suites; commit and ledger evidence.
+
+### Task 4: Release identity, signatures and update verification
+
+**Files:** Modify `scripts/build_desktop.py`, native build scripts, `.github/workflows/desktop.yml`, updater code and release documentation; add signing/publisher verification helpers/tests.
+
+**Interfaces:** Build metadata carries stable `io.qudadd.envscope` identity, semantic/build versions and signed/unsigned mode. Signed release verification requires the configured publisher identity plus archive integrity; missing required signing credentials fail signed release builds.
+
+- [ ] Add executable-package metadata and signer-verification regressions using isolated signed/unsigned/tampered fixtures.
+- [ ] Implement Windows publisher signing and Apple Developer ID/notarytool integration through environment/CI secrets, without storing credentials in the repo.
+- [ ] Deliver the requested unsigned open-source build, verify identity continuity, and document optional signing configuration. Never label unsigned artifacts as publisher-signed or notarized.
+- [ ] Run builds, package verification, update smoke tests and full suites; commit and retain signing/notarization receipts without secrets.
+
+### Task 5: Optimization acceptance and documentation
+
+**Files:** Update `docs/ARCHITECTURE.md`, `docs/DESKTOP_ACCEPTANCE.md`, permission/service docs and backend capability presentation. Create a checked requirement/evidence matrix under `docs/`.
+
+- [ ] Reconcile each of the six source-audit priorities with source, regression and native evidence; fix uncovered behavior before checking it off.
+- [ ] Execute the real standard-user/admin consent matrix on dedicated devices, including allow/cancel/revoke, service disable, reboot/sleep and upgrade. Record observed outcomes; leave unavailable device evidence pending.
+- [ ] Verify notification deduplication, stop/revoke/uninstall and no loss of current features.
+- [ ] Update stale docs and capability descriptions from the actual implementation. Only mark this task complete when all optimization requirements or explicitly revised user requirements are satisfied.
+
+### Task 6: Complete desktop UI, icons and interaction refresh
+
+**Files:** `envscope/web/` screens/styles/modules, native app/tray assets, `desktop_runtime.py`, build icon wiring, walkthrough assets and UI smoke tests.
+
+**Interfaces:** Preserve existing backend capabilities/confirmation contracts. The visual layer renders states supplied by the backend and retains fresh report/repair/guard flows.
+
+- [ ] Confirm Task 5 is complete. Read Impeccable context and the existing design constraints; document the concrete visual system.
+- [ ] Implement the complete minimal desktop layout and consistent application/tray/navigation/status icon set, with original licenses for reused assets.
+- [ ] Improve phase/progress feedback, keyboard/focus handling, stable selection/scroll, duplicate-operation prevention and recovery affordances across every screen.
+- [ ] Run real browser workflows at 1024/1280/1440 widths for Windows/macOS fixtures; inspect screenshots, keyboard access, overflow, empty/loading/error/permission/recovery states and frozen-package icon rendering.
+- [ ] Commit the verified UI, asset and interaction changes with documentation.
+
+### Task 7: Full review, native distribution and public delivery
+
+- [ ] Run full Python/JS/syntax/package/desktop workflow and privacy/publication checks for the final source.
+- [ ] Request one independent whole-branch code/security review; fix verified findings with regressions.
+- [ ] Build and verify Windows x64/macOS ARM64/macOS Intel open-source native distributions, recording their actual signature status.
+- [ ] Update the local trial without stopping the user's running application, preserve rollback and publish the reviewed GitHub release under existing authorization.
+- [ ] Read back the public release, asset hashes/signers and final local launcher. Audit every explicit requirement before marking the goal complete.
diff --git a/docs/superpowers/specs/2026-10-30-permissions-and-ui-design.md b/docs/superpowers/specs/2026-10-30-permissions-and-ui-design.md
new file mode 100644
index 0000000..792cc89
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-30-permissions-and-ui-design.md
@@ -0,0 +1,42 @@
+# Permission completion and desktop refresh
+
+## Intent and accepted scope
+
+Implement the permission/usability audit requested by the user, verify every optimization, then upgrade the complete desktop UI, application/tray/navigation icons and interaction responsiveness. Preserve Windows/macOS support, a monochrome minimal design and the primary flow: target → one check → problems/repair → persistent guard. Mobile remains out of scope.
+
+The source audit is `artifacts/permission-review-2026-10-30/AUDIT.md`; its six priorities are requirements, not completion evidence. Baseline: `ffbdc3a` / 0.24.1.
+
+## Architecture and approaches
+
+Use the existing Python, native helper and webview architecture. Keep the main process and account state in the original user's session. Use OS-owned consent for specific privileged operations and protected, narrowly scoped native helpers for persistent system work. Reuse backup, report freshness, transaction and independent readback gates.
+
+A permanently elevated application would unnecessarily elevate the browser interface and account operations. Guidance-only permission links cannot satisfy the requested automatic continuation/guard behavior. The chosen implementation extends the existing split-process architecture; this is an implementation decision under the user's requested scope.
+
+## Required outcomes
+
+1. Classify collection failure as permission_denied, policy_denied, timeout, tool_missing, invalid_response or unavailable. Preserve the failed operation in evidence; partial inventory never reports a completed pass. Propagate failures to dependent checks. Do not store raw command stderr or secrets.
+2. Describe each requested capability, its affected checks, read/write/background scope and OS action. Provide only actions relevant to observed denial and the selected target. Merely opening settings is never permission_granted. Returning from a permission step triggers bounded capability revalidation and a new report/repair plan, while preserving the user's selected checks and repair receipt.
+3. Distinguish cancelled consent, refused policy, an operation failure, pending recovery, restart required and verified success. Unknown execution must reconcile transaction records before retrying a mutation.
+4. Check guard capabilities before activation. Windows gains a protected, restricted timezone worker/service for devices whose user token cannot maintain the approved timezone. macOS retains its root-owned worker and exposes actual registration/approval/heartbeat status; evaluate SMAppService integration against the supported platform floor. Background workers never open authorization dialogs. All components support stop/revoke/uninstall and readback.
+5. Use stable app identity/version metadata, Windows publisher signing and macOS Developer ID signing/notarization in the release pipeline. Verify signer identity during signed update installation. Certificate integration requires the owner's credentials through an approved secret destination. A pending certificate question is not evidence of signing completion.
+6. Exercise allow/cancel/revoke/policy denial, upgrade identity continuity, restart/sleep/wake and disabled service cases. Use isolated native fixtures for automated tests. Real UAC/TCC prompts require dedicated device evidence and an actual person interacting with the OS prompt; existing mocked dialogs are insufficient evidence.
+7. Update stale architecture/support documentation and derive capability presentation from backend data. Notify only on actionable guard failures or revoked permission, with deduplication and a direct return to the affected operation.
+8. After optimization acceptance, redesign all desktop screens and the app/tray/navigation icon family. Retain plain explanations, visible per-item results, select-all, one-click reviewed repairs and tutorial. Keep long operations asynchronous with specific phases, cancellation where supported, stable focus/scroll and no duplicate submissions.
+9. Verify full Python/JS suites, native packages on Windows + macOS ARM64/Intel, desktop workflows, visual appearance, release contents and public readback. Update the local trial and publish under qudadd/envscope using existing authorization.
+
+## External prerequisites and phase gates
+
+On 2026-10-30 the user confirmed no signing credentials and clarified this is only an open-source project. Formal publisher signing and Apple notarization are optional and no longer delivery gates. Stable identity, honest unsigned-build status, archive integrity and scoped OS authorization remain required. Real device consent observations must remain separately marked pending where unavailable; never count fixture tests as real UAC/TCC evidence. Complete optimization implementation and its automated/native acceptance before the overall UI refresh.
+
+## Invariants
+
+- Tests/development do not alter real networking, timezone, locale, firewall, installed applications, accounts or proxy settings.
+- Every actual product mutation discloses effects and requires boolean confirmation; stale or imported reports cannot authorize it.
+- Native helpers execute a closed set of operations, use protected files and validate caller/owner, paths, hashes and transaction identity. Never run user-writable Python or upstream scripts with permanent elevation.
+- Do not change vendor bytes or licenses; do not run vendor scripts/tests/installers in development.
+- Unknown, unsupported, skipped, stale or malformed evidence is never a pass. A successful setting change is not proof of Claude account availability.
+- Maintain the user's minimal desktop design and original feature coverage.
+
+## Acceptance evidence
+
+For each requirement, retain a failing regression (when code behavior changes), its passing result, relevant full-suite results and the actual native/runtime evidence. Store a completion matrix distinguishing implemented, fixture-verified, native-verified and external-pending. A green build is not an OS consent result, and a SHA-256 digest is not a publisher signature.
diff --git a/envscope/baseline.py b/envscope/baseline.py
index a47b0ec..30a6b58 100644
--- a/envscope/baseline.py
+++ b/envscope/baseline.py
@@ -11,6 +11,7 @@
 from .model import Finding, Status
 from .policy import normalize_ip
 from .transport import response_evidence
+from .observation_errors import inventory_errors
 
 DOMAINS = ("claude.ai", "claude.com", "anthropic.com", "claudeusercontent.com", "challenges.cloudflare.com",
            "datadoghq.com", "segment.io", "stripe.com", "stripe.network", "stripecdn.com",
@@ -34,8 +35,9 @@ def proxy_runtime(inventory, preferences):
     names = {"clash-verge": ("mihomo", "verge-mihomo"), "flclash": ("flclashcore",), "sing-box": ("sing-box",), "shadowrocket": ("shadowrocket",),
              "clashx": ("clashx",), "surge": ("surge",)}
     matches = clients if expected == "auto" else [c for c in clients if str(c).lower() in names.get(expected, ())]
-    return baseline_finding("proxy", "代理客户端", Status.PASS if matches else Status.UNKNOWN,
-                            "已发现所选代理客户端进程" if matches else "未确认所选代理客户端进程", [{"clients": clients}],
+    errors = inventory_errors(inventory, 'known_clients')
+    return baseline_finding("proxy", "代理客户端", Status.PASS if matches and not errors else Status.UNKNOWN,
+                            '进程信息读取不完整' if errors else "已发现所选代理客户端进程" if matches else "未确认所选代理客户端进程", [{"clients": clients, 'collection_errors': errors}],
                             ["进程存在不等于流量已接管。"])
 
 
@@ -47,8 +49,9 @@ def tunnel(inventory):
         up = adapter.get("Status") == "Up" or "UP" in adapter.get("flags", [])
         if up and re.search(r"TUN|TAP|Wintun|WireGuard|VPN|Tailscale|utun", description, re.I):
             candidates.append({"name": adapter.get("Name", adapter.get("name")), "active": True})
-    return baseline_finding("tun", "TUN 网卡", Status.PASS if candidates else Status.UNKNOWN,
-                            "发现启用的隧道网卡" if candidates else "未确认启用的隧道网卡", candidates,
+    errors = inventory_errors(inventory, 'adapters')
+    return baseline_finding("tun", "TUN 网卡", Status.PASS if candidates and not errors else Status.UNKNOWN,
+                            '网卡信息读取不完整' if errors else "发现启用的隧道网卡" if candidates else "未确认启用的隧道网卡", candidates + ([{'collection_errors': errors}] if errors else []),
                             ["这是网卡状态，目标流量关联另行显示。"])
 
 
@@ -236,23 +239,28 @@ def collect_baseline(inventory, v4, v6, udp_result, browser_result, preferences,
     timezone = inventory.get("network", {}).get("timezone_id") or inventory.get("timezone_iana")
     locale = inventory.get("locale")
     def setting(name, title, actual, expected):
+        errors = inventory_errors(inventory, name) if name in ('timezone', 'locale', 'language') else {}
         equal = str(actual).replace("_", "-").lower() == str(expected).replace("_", "-").lower()
-        state = Status.PASS if expected and equal else Status.WARN if not expected else Status.UNKNOWN if not actual else Status.FAIL
-        return baseline_finding(name, title, state, "符合设置的目标" if state == Status.PASS else "未设置比较目标，仅展示当前信息" if not expected else "当前信息与目标不同" if actual else "未取得当前信息",
-                                [{"actual": actual, "expected": expected}], ["地区和语言差异不代表账号风险。"])
+        state = Status.UNKNOWN if errors else Status.PASS if expected and equal else Status.WARN if not expected else Status.UNKNOWN if not actual else Status.FAIL
+        return baseline_finding(name, title, state, '当前信息读取不完整' if errors else "符合设置的目标" if state == Status.PASS else "未设置比较目标，仅展示当前信息" if not expected else "当前信息与目标不同" if actual else "未取得当前信息",
+                                [{"actual": actual, "expected": expected, 'collection_errors': errors}], ["地区和语言差异不代表账号风险。"])
     network = inventory.get("network", {})
     bindings = network.get("ipv6_bindings", [])
     services = network.get("ipv6_services", [])
+    ipv6_errors = inventory_errors(inventory, 'ipv6_bindings', 'ipv6_services', 'adapters')
     disabled = (bool(bindings) and all(b.get("Enabled") is False for b in bindings)
                 or bool(services) and all(s.get("ipv6_off") is True for s in services))
     valid_v6 = [o for o in v6 if o.get("ip") and ":" in o["ip"]]
     allowed = [ipaddress.ip_network(n) for n in preferences.get("allowed_ipv6", [])]
     policy_matches = bool(valid_v6 and allowed) and all(any(normalize_ip(o["ip"]) in n for n in allowed) for o in valid_v6)
-    ipv6_status = Status.PASS if disabled or policy_matches else Status.UNKNOWN if not valid_v6 else Status.WARN
+    disabled = disabled and not ipv6_errors
+    ipv6_status = Status.PASS if disabled or policy_matches else Status.UNKNOWN if ipv6_errors or not valid_v6 else Status.WARN
+    dns_errors = inventory_errors(inventory, 'dns')
+    dns_ok = bool(network.get('dns')) and not dns_errors
     language = inventory.get("client_language", {})
     language_result = (setting("language", "客户端语言", language.get("value"), preferences.get("language") if preferences.get('environment_confirmed') else preferences.get("locale"))
                        if language.get("source") == "application-preference" else baseline_finding("language", "客户端语言", Status.UNKNOWN,
-                       "未取得客户端专用语言设置", [{"system_ui_language": language.get("value")}], ["系统语言不能代替 Claude 的实际语言偏好。分享时可不包含此项。 "]))
+                       "未取得客户端专用语言设置", [{"system_ui_language": language.get("value"), 'collection_errors': inventory_errors(inventory, 'language'), **({'error': language['error']} if language.get('error') else {})}], ["系统语言不能代替 Claude 的实际语言偏好。分享时可不包含此项。 "]))
     rtc_states = {udp_result.status, browser_result.status}
     rtc_status = (Status.FAIL if Status.FAIL in rtc_states else Status.UNKNOWN if rtc_states & {Status.UNKNOWN, Status.SKIPPED}
                   else Status.WARN if Status.WARN in rtc_states else Status.PASS)
@@ -260,9 +268,9 @@ def setting(name, title, actual, expected):
                 baseline_finding("ip_stability", "出口变化", Status.UNKNOWN, "在历史记录中比较检测前后的出口集合", limitations=["历史使用私有 HMAC，不公开原始地址。"]),
                 setting("timezone", "时区", timezone, preferences.get("timezone")),
                 setting("locale", "地区格式", locale, preferences.get("locale")),
-                baseline_finding("ipv6", "IPv6 配置", ipv6_status, "系统报告已关闭已检查接口的 IPv6" if disabled else "有效观测符合指定 IPv6 范围" if policy_matches else "IPv6 是否符合预期需结合实际出口复核", [{"checked_interfaces_disabled": disabled}], ["IPv6 启用本身不构成泄漏；无响应也不是已关闭证明。"]),
-                baseline_finding("dns", "DNS 配置", Status.PASS if network.get("dns") else Status.UNKNOWN,
-                                 "已读取系统 DNS 配置" if network.get("dns") else "未取得 DNS 配置", [{"configured": bool(network.get("dns"))}], ["实际 DNS 出口由独立检查判断，配置存在不证明无泄漏。"]),
+                baseline_finding("ipv6", "IPv6 配置", ipv6_status, "系统报告已关闭已检查接口的 IPv6" if disabled else "有效观测符合指定 IPv6 范围" if policy_matches else "IPv6 是否符合预期需结合实际出口复核", [{"checked_interfaces_disabled": disabled, 'collection_errors': ipv6_errors}], ["IPv6 启用本身不构成泄漏；无响应也不是已关闭证明。"]),
+                baseline_finding("dns", "DNS 配置", Status.PASS if dns_ok else Status.UNKNOWN,
+                                 "已读取系统 DNS 配置" if dns_ok else "未取得完整 DNS 配置", [{"configured": bool(network.get("dns")), 'collection_errors': dns_errors}], ["实际 DNS 出口由独立检查判断，配置存在不证明无泄漏。"]),
                 baseline_finding("webrtc", "UDP / WebRTC", rtc_status, "系统 UDP 与浏览器 ICE 分别比较完成" if rtc_status == Status.PASS else "系统 UDP 与浏览器 ICE 需分别查看测量细项",
                                  [{"native_udp": udp_result.status.value, "browser_ice": browser_result.status.value}],
                                  ["两种探测不互相替代；无响应不能证明没有旁路。"]),
diff --git a/envscope/inventory.py b/envscope/inventory.py
index 8dad26a..3c06d57 100644
--- a/envscope/inventory.py
+++ b/envscope/inventory.py
@@ -11,19 +11,20 @@
 import subprocess
 import time
 
+from .observation_errors import check_command, error_evidence
+
 
 def command_json(command, timeout=8):
     result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace",
                             timeout=timeout, creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
-    if result.returncode or len(result.stdout) > 262144:
-        raise OSError("inventory command failed")
+    check_command(result)
     return json.loads(result.stdout)
 
 
 def command_text(command, timeout=5):
-    result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout)
-    if result.returncode or len(result.stdout) > 262144:
-        raise OSError("inventory command failed")
+    result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout,
+                            env={**os.environ, 'LC_ALL': 'C'}, creationflags=getattr(subprocess, 'CREATE_NO_WINDOW', 0))
+    check_command(result)
     return result.stdout
 
 
@@ -42,23 +43,33 @@ def parse_macos_interfaces(text):
 
 
 def macos_network():
-    network = {"adapters": parse_macos_interfaces(command_text(["/sbin/ifconfig", "-a"]))}
+    network = {"errors": {}}
+    try:
+        network['adapters'] = parse_macos_interfaces(command_text(['/sbin/ifconfig', '-a']))
+        if not network['adapters']:
+            raise ValueError('no recognized interfaces')
+    except (OSError, ValueError, subprocess.TimeoutExpired) as exc:
+        network['adapters'] = []
+        network['errors']['adapters'] = error_evidence(exc, 'adapters')
     try:
         processes = command_text(["/bin/ps", "-A", "-o", "comm="])
         known = {"mihomo", "verge-mihomo", "flclashcore", "sing-box", "shadowrocket", "clashx", "surge", "wireguard", "tailscaled"}
         network["known_clients"] = sorted({Path(p.strip()).name for p in processes.splitlines() if Path(p.strip()).name.lower() in known})
-    except (OSError, subprocess.TimeoutExpired):
+    except (OSError, subprocess.TimeoutExpired) as exc:
         network["known_clients"] = []
+        network['errors']['known_clients'] = error_evidence(exc, 'known_clients')
     try:
         dns = command_text(["/usr/sbin/scutil", "--dns"])
         network["dns"] = sorted(set(re.findall(r"nameserver\[\d+\]\s*:\s*(\S+)", dns)))
-    except (OSError, subprocess.TimeoutExpired):
-        network["dns_error"] = "unavailable"
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        network['errors']['dns'] = error_evidence(exc, 'dns')
     try:
         route = command_text(["/sbin/route", "-n", "get", "default"])
         network["default_route"] = {k: v for k, v in re.findall(r"^\s*(gateway|interface):\s*(\S+)", route, re.M)}
-    except (OSError, subprocess.TimeoutExpired):
-        network["default_route_error"] = "unavailable"
+        if not network['default_route'].get('interface'):
+            raise ValueError('no recognized route')
+    except (OSError, ValueError, subprocess.TimeoutExpired) as exc:
+        network['errors']['routes'] = error_evidence(exc, 'routes')
     try:
         order = command_text(["/usr/sbin/networksetup", "-listnetworkserviceorder"])
         active = {a["name"] for a in network["adapters"] if "UP" in a["flags"] and a["name"].startswith("en")
@@ -69,12 +80,18 @@ def inspect(name):
             try:
                 info = command_text(["/usr/sbin/networksetup", "-getinfo", name], timeout=3)
                 return {"ipv6_off": bool(re.search(r"^IPv6:\s*Off\s*$", info, re.M))}
-            except (OSError, subprocess.TimeoutExpired):
-                return {"ipv6_off": None}
+            except (OSError, subprocess.TimeoutExpired) as exc:
+                return {'ipv6_off': None, **error_evidence(exc, 'ipv6_services')}
         with ThreadPoolExecutor(max_workers=4) as pool:
             network["ipv6_services"] = list(pool.map(inspect, services))
-    except (OSError, subprocess.TimeoutExpired):
+        failures = [row for row in network['ipv6_services'] if row.get('error')]
+        if failures:
+            # Keep every independent failure; the summary uses one bounded code.
+            first = next((row for row in failures if row['error'] == 'permission_denied'), failures[0])
+            network['errors']['ipv6_services'] = {'error': first['error'], 'operation': 'ipv6_services'}
+    except (OSError, subprocess.TimeoutExpired) as exc:
         network["ipv6_services"] = []
+        network['errors']['ipv6_services'] = error_evidence(exc, 'ipv6_services')
     return network
 
 
@@ -86,7 +103,7 @@ def collect():
         if platform.system() == "Windows":
             shell = shutil.which("powershell.exe")
             if not shell:
-                raise OSError("PowerShell unavailable")
+                raise FileNotFoundError("PowerShell unavailable")
             script = r"""
 $ErrorActionPreference='Stop'
 [Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false)
@@ -94,7 +111,8 @@ def collect():
 function Read-Part($name, [scriptblock]$read) {
  try { & $read } catch {
    $denied=($_.Exception -is [System.UnauthorizedAccessException]) -or ([string]$_.CategoryInfo.Category -eq 'PermissionDenied')
-   $failures[$name]=@{error=$(if($denied){'permission_denied'}else{'unavailable'})}
+   $missing=($_.Exception -is [System.Management.Automation.CommandNotFoundException])
+   $failures[$name]=@{error=$(if($denied){'permission_denied'}elseif($missing){'tool_missing'}else{'unavailable'});operation=$name}
  }
 }
 $v=@{
@@ -105,35 +123,39 @@ def collect():
  timezone_id=(Read-Part 'timezone' {(Get-TimeZone).Id})
  ui_language=(Read-Part 'language' {(Get-UICulture).Name})
  region_locale=(Read-Part 'locale' {(Get-Culture).Name})
- ipv6_bindings=@(Get-NetAdapterBinding -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue | Select-Object Name,Enabled)
- known_clients=@(Get-Process -Name 'mihomo','verge-mihomo','FlClashCore','sing-box','wireguard','openvpn','tailscaled' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ProcessName -Unique)
- desktop_packages=@(Get-AppxPackage -Name '*Claude*' -ErrorAction SilentlyContinue | Select-Object Name,Version)
+ ipv6_bindings=@(Read-Part 'ipv6_bindings' {Get-NetAdapterBinding -ComponentID ms_tcpip6 | Select-Object Name,Enabled})
+ known_clients=@(Read-Part 'known_clients' {Get-Process | Where-Object {$_.ProcessName -in @('mihomo','verge-mihomo','FlClashCore','sing-box','wireguard','openvpn','tailscaled')} | Select-Object -ExpandProperty ProcessName -Unique})
+ desktop_packages=@(Read-Part 'desktop_packages' {Get-AppxPackage -Name '*Claude*' | Select-Object Name,Version})
 }
 $v.errors=$failures
 ConvertTo-Json -InputObject $v -Depth 6 -Compress
 """
             encoded = base64.b64encode(script.encode("utf-16le")).decode("ascii")
             result["network"] = command_json([shell, "-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded])
+            if not isinstance(result['network'], dict):
+                result.pop('network')
+                raise ValueError('invalid inventory response')
             result["locale"] = result["network"].get("region_locale", result["locale"])
             result["client_language"] = {"value": result["network"].get("ui_language"), "source": "system-fallback"}
         elif platform.system() == "Darwin":
             result["network"] = macos_network()
             try:
                 result["locale"] = command_text(["/usr/bin/defaults", "read", "-g", "AppleLocale"]).strip()
-            except (OSError, subprocess.TimeoutExpired):
-                pass
+            except (OSError, subprocess.TimeoutExpired) as exc:
+                result['network']['errors']['locale'] = error_evidence(exc, 'locale')
             try:
                 from .mac_preferences import read_claude_language
                 result['client_language']=read_claude_language()
-            except (OSError,ValueError,RuntimeError):
-                result['client_language']={'value':None,'source':'unavailable','error':'application-preference-unavailable'}
+            except (OSError,ValueError,RuntimeError,subprocess.TimeoutExpired) as exc:
+                result['client_language']={'value':None,'source':'unavailable',**error_evidence(exc, 'client_language')}
+                result['network']['errors']['language'] = error_evidence(exc, 'language')
             localtime = str(Path("/etc/localtime").resolve())
             if "/zoneinfo/" in localtime:
                 result["timezone_iana"] = localtime.split("/zoneinfo/", 1)[1]
         else:
             result["network_error"] = "platform_network_adapter_not_implemented"
-    except (OSError, subprocess.TimeoutExpired, ValueError):
-        result["network_error"] = "inventory_unavailable_or_deadline"
+    except (OSError, subprocess.TimeoutExpired, ValueError) as exc:
+        result['network_error'] = error_evidence(exc, 'inventory')
     if result['platform'] == 'Windows':
         from .wireguard import WireGuardReader
         result.setdefault('network', {})['wireguard'] = WireGuardReader().collect()
diff --git a/envscope/network_facts.py b/envscope/network_facts.py
index 2f4f6ec..0776e0b 100644
--- a/envscope/network_facts.py
+++ b/envscope/network_facts.py
@@ -12,6 +12,8 @@
 import tempfile
 import time
 
+from .observation_errors import check_command, error_evidence
+
 HOSTS = ("claude.ai", "api.anthropic.com")
 
 
@@ -29,7 +31,7 @@ def resolve_host(host, resolver=socket.getaddrinfo):
 def parse_mac_route(text, destination):
     values = dict(re.findall(r"^\s*(interface|gateway|destination|mask|flags):\s*([^\n]+)", text, re.M))
     if not values.get("interface") or not re.fullmatch(r"[A-Za-z0-9._-]{1,64}", values["interface"].strip()):
-        return {"destination": destination, "error": "route_unavailable"}
+        return {'destination': destination, **error_evidence(ValueError(), 'routes')}
     return {"destination": destination, "interface": values["interface"].strip(),
             "next_hop": values.get("gateway", "").strip(), "flags": values.get("flags", "").strip()}
 
@@ -50,7 +52,11 @@ def lookup_routes(addresses, system=None, runner=subprocess.run):
   $source=$best|Where-Object {$_.PSObject.Properties['IPAddress']}|Select-Object -First 1
   if(-not $route){throw 'no route'}
   @{destination=$ip;interface_index=$route.InterfaceIndex;interface=$route.InterfaceAlias;prefix=$route.DestinationPrefix;next_hop=$route.NextHop;source_ip=$source.IPAddress}
- } catch { @{destination=$ip;error='route_unavailable'} }
+ } catch {
+  $denied=($_.Exception -is [System.UnauthorizedAccessException]) -or ([string]$_.CategoryInfo.Category -eq 'PermissionDenied')
+  $missing=($_.Exception -is [System.Management.Automation.CommandNotFoundException])
+  @{destination=$ip;error=$(if($denied){'permission_denied'}elseif($missing){'tool_missing'}else{'unavailable'})}
+ }
 })
 ConvertTo-Json -InputObject $items -Depth 4 -Compress
 """.replace("IP_LIST", json.dumps(addresses))
@@ -59,24 +65,26 @@ def lookup_routes(addresses, system=None, runner=subprocess.run):
             result = runner(["powershell.exe", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded],
                             capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=7,
                             creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
-            value = json.loads(result.stdout) if result.returncode == 0 and len(result.stdout) <= 16384 else None
+            check_command(result, 16384)
+            value = json.loads(result.stdout)
             if not isinstance(value, list):
                 raise ValueError("invalid routes")
             # Never accept a script response for a destination we did not ask for.
-            return [{k: r[k] for k in ("destination", "interface_index", "interface", "prefix", "next_hop", "source_ip", "error") if k in r}
-                    for r in value if isinstance(r, dict) and r.get("destination") in addresses]
-        except (OSError, ValueError, subprocess.TimeoutExpired):
-            return [{"destination": ip, "error": "route_unavailable"} for ip in addresses]
+            rows = [r for r in value if isinstance(r, dict) and r.get('destination') in addresses]
+            if len(rows) != len(addresses) or len({r['destination'] for r in rows}) != len(addresses):
+                raise ValueError('incomplete routes')
+            return [{k: r[k] for k in ('destination', 'interface_index', 'interface', 'prefix', 'next_hop', 'source_ip', 'error') if k in r} for r in rows]
+        except (OSError, ValueError, subprocess.TimeoutExpired) as exc:
+            return [{'destination': ip, **error_evidence(exc, 'routes')} for ip in addresses]
     if system == "Darwin":
         def one(ip):
             command = ["/sbin/route", "-n", "get", "-inet6" if ":" in ip else "-inet", ip]
             try:
                 result = runner(command, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=3)
-                if result.returncode == 0 and len(result.stdout) <= 16384:
-                    return parse_mac_route(result.stdout, ip)
-            except (OSError, subprocess.TimeoutExpired):
-                pass
-            return {"destination": ip, "error": "route_unavailable"}
+                check_command(result, 16384)
+                return parse_mac_route(result.stdout, ip)
+            except (OSError, subprocess.TimeoutExpired) as exc:
+                return {'destination': ip, **error_evidence(exc, 'routes')}
         with ThreadPoolExecutor(max_workers=4) as pool:
             return list(pool.map(one, addresses))
     return [{"destination": ip, "error": "unsupported_platform"} for ip in addresses]
diff --git a/envscope/observation_errors.py b/envscope/observation_errors.py
new file mode 100644
index 0000000..0d8962c
--- /dev/null
+++ b/envscope/observation_errors.py
@@ -0,0 +1,71 @@
+"""Bounded failure evidence shared by read-only OS observations.
+
+Never retain command output: it may contain private paths or credentials.
+"""
+import errno
+import re
+import subprocess
+
+CODES = frozenset({'permission_denied', 'policy_denied', 'timeout', 'tool_missing',
+                   'invalid_response', 'unavailable'})
+
+
+class ObservationError(OSError):
+    def __init__(self, code):
+        self.code = code if code in CODES else 'unavailable'
+        super().__init__(self.code)
+
+
+def error_evidence(error, operation):
+    code = getattr(error, 'code', None)
+    if code not in CODES:
+        if getattr(error, 'winerror', None) == 1260:
+            code = 'policy_denied'
+        elif isinstance(error, PermissionError) or getattr(error, 'errno', None) in (errno.EACCES, errno.EPERM) or getattr(error, 'winerror', None) == 5:
+            code = 'permission_denied'
+        elif isinstance(error, (subprocess.TimeoutExpired, TimeoutError)):
+            code = 'timeout'
+        elif isinstance(error, FileNotFoundError):
+            code = 'tool_missing'
+        elif isinstance(error, (ValueError, TypeError)):
+            code = 'invalid_response'
+        else:
+            code = 'unavailable'
+    # Operations are internal identifiers, not commands or user-supplied paths.
+    name = operation if isinstance(operation, str) and re.fullmatch(r'[a-z_][a-z0-9_.-]{0,63}', operation) else 'observation'
+    return {'error': code, 'operation': name}
+
+
+def check_command(result, limit=262144):
+    if result.returncode:
+        stderr = result.stderr or ''
+        if isinstance(stderr, bytes):
+            stderr = stderr.decode('utf-8', errors='replace')
+        stderr = stderr[:limit].lower()
+        code = ('policy_denied' if result.returncode == 1260 or 'blocked by group policy' in stderr else
+                'permission_denied' if any(value in stderr for value in
+                    ('permission denied', 'operation not permitted', 'access is denied', 'access denied', 'unauthorizedaccessexception')) else
+                'unavailable')
+        raise ObservationError(code)
+    if not isinstance(result.stdout, str) or len(result.stdout) > limit:
+        raise ObservationError('invalid_response')
+
+
+def inventory_errors(inventory, *components):
+    """Normalize old and current collectors, optionally for dependent checks."""
+    network = inventory.get('network', {})
+    if not isinstance(network, dict):
+        return {'inventory': error_evidence(ValueError(), 'inventory')}
+    errors = {}
+    for name, value in network.get('errors', {}).items() if isinstance(network.get('errors', {}), dict) else ():
+        code = value.get('error') if isinstance(value, dict) else value
+        errors[name] = error_evidence(ObservationError(code), name)
+    for key, name in (('dns_error', 'dns'), ('default_route_error', 'routes')):
+        if network.get(key):
+            errors.setdefault(name, error_evidence(ObservationError(network[key]), name))
+    if inventory.get('network_error'):
+        value = inventory['network_error']
+        errors['inventory'] = error_evidence(ObservationError(value.get('error') if isinstance(value, dict) else value), 'inventory')
+    if components:
+        return {name: value for name, value in errors.items() if name in components or name == 'inventory'}
+    return errors
diff --git a/envscope/probes.py b/envscope/probes.py
index 65b7fcc..8978120 100644
--- a/envscope/probes.py
+++ b/envscope/probes.py
@@ -8,6 +8,7 @@
 from .browser import assess_snapshot, environment_finding
 from .controller import inspect_controller
 from .inventory import collect
+from .observation_errors import inventory_errors
 from .model import Finding, Status, utc_now
 from .network_facts import bounded_facts
 from .local_facts import local_snapshot
@@ -87,9 +88,11 @@ def audit(policy, transport, online=False, stun=False, ipv6=False, targets=(), b
         network = facts_job.result() if facts_job else {"dns": [], "routes": []}
         v4, v6 = v4_job.result() if v4_job else [], v6_job.result() if v6_job else []
         udp = (udp4_job.result() if udp4_job else []) + (udp6_job.result() if udp6_job else [])
+    incomplete = inventory_errors(inventory)
     findings = [
-        Finding("system.inventory", "系统只读信息采集", Status.UNKNOWN if "network_error" in inventory or inventory.get("network", {}).get("errors") else Status.PASS,
-                "系统信息已采集；虚拟网卡和进程存在均不是接管证明", "native-inventory", [inventory]),
+        Finding("system.inventory", "系统只读信息采集", Status.UNKNOWN if incomplete else Status.PASS,
+                '部分系统信息读取失败；请查看对应原因' if incomplete else '系统信息已采集；虚拟网卡和进程存在均不是接管证明',
+                'native-inventory', [inventory, {'collection_errors': incomplete}] if incomplete else [inventory]),
         Finding("network.route", "目标流量接管验证", Status.UNKNOWN, "当前只记录路由配置，尚未完成目标进程流量关联",
                 "native-inventory", limitations=["默认路由、TUN 名称或 Fake-IP 不能单独证明目标流量没有旁路。"]),
     ]
diff --git a/envscope/target_environment.py b/envscope/target_environment.py
index 877eb7a..56d1078 100644
--- a/envscope/target_environment.py
+++ b/envscope/target_environment.py
@@ -250,7 +250,9 @@ def add(key, title, status, message, data, fix, limits=()):
         '在系统代理设置中按目标连接方式调整后复检。TUN 另查隧道状态；PAC、浏览器扩展及进程流量需在实际应用确认。',
         ['探测路径和配置一致不证明 Claude 进程全流量经过同一路径。'])
     if mode == 'tun':
+        from .observation_errors import inventory_errors
         network = first('system.inventory').get('network', {})
+        collection_errors = inventory_errors(first('system.inventory'), 'adapters', 'routes')
         adapters = network.get('adapters', [])
         wg_state, wg_row = None, None
         if settings.get('client') == 'wireguard':
@@ -284,8 +286,9 @@ def add(key, title, status, message, data, fix, limits=()):
                           or re.search(r'REJECT|BLACKHOLE', r.get('flags', ''), re.I)] if wg_state == 'healthy' else []
         route_ok = dns_ok and bool(addresses) and addresses <= {r.get('destination') for r in measured} and not mismatched
         route_ok = route_ok and (wg_state == 'healthy' if settings.get('client') == 'wireguard' else True)
-        add('tun_route', '目标地址的 TUN 选路', 'fail' if mismatched else 'pass' if route_ok else 'unknown',
-            '所检查的目标地址经系统选择隧道接口' if route_ok else '目标地址存在非隧道选路' if mismatched else '目标选路证据不完整', routes,
+        route_ok = route_ok and not collection_errors
+        add('tun_route', '目标地址的 TUN 选路', 'unknown' if collection_errors else 'fail' if mismatched else 'pass' if route_ok else 'unknown',
+            '目标选路证据不完整' if collection_errors else '所检查的目标地址经系统选择隧道接口' if route_ok else '目标地址存在非隧道选路' if mismatched else '目标选路证据不完整', routes + ([{'collection_errors': collection_errors}] if collection_errors else []),
             '在所选 WireGuard 隧道核对 AllowedIPs、隧道激活状态与 IPv6 路由，再复检；不会在这里改动私钥。' if settings.get('client') == 'wireguard' else '在代理客户端核对 TUN、自动路由和 IPv6 规则，再重新检测。', ['每个目标及地址族抽样一个解析地址；不等于进程全流量证明。'])
     clock = raw.get('extra.clock', {})
     add('clock', '系统时钟准确性', 'fail' if clock.get('status') == 'warn' else clock.get('status', 'unknown'), clock.get('summary', '尚未取得多个可信连接的日期样本'),
diff --git a/tests/test_inventory_permissions.py b/tests/test_inventory_permissions.py
new file mode 100644
index 0000000..514ba18
--- /dev/null
+++ b/tests/test_inventory_permissions.py
@@ -0,0 +1,118 @@
+"""Permission evidence fixtures; no real commands or system mutations."""
+import json
+import subprocess
+import unittest
+from unittest.mock import Mock, patch
+
+from envscope.assessment import assessment, denied
+from envscope.baseline import collect_baseline, proxy_runtime, tunnel
+from envscope.inventory import command_text, macos_network
+from envscope.network_facts import lookup_routes
+from envscope.policy import Policy
+from envscope.probes import audit
+from envscope.model import Finding, Status
+
+
+def mac_reader(failure):
+    def read(command, **kwargs):
+        if command == ['/usr/sbin/scutil', '--dns']:
+            raise failure
+        if command[0] == '/sbin/ifconfig':
+            return 'en0: flags=8863<UP,BROADCAST,RUNNING>\n inet 192.0.2.10\n'
+        if command[0] == '/sbin/route':
+            return 'gateway: 192.0.2.1\ninterface: en0\n'
+        return ''
+    return read
+
+
+class InventoryPermissionTests(unittest.TestCase):
+    def test_partial_values_cannot_hide_denied_baseline_reads(self):
+        inventory = {'locale': 'en-US', 'network': {'timezone_id': 'UTC', 'dns': ['192.0.2.2'],
+                     'ipv6_bindings': [{'Enabled': False}], 'errors': {
+                         name: {'error': 'permission_denied'} for name in ('timezone', 'locale', 'dns', 'ipv6_bindings')}}}
+        unknown = Finding('fixture', 'fixture', Status.UNKNOWN, 'fixture', 'fixture')
+        rows = collect_baseline(inventory, [], [], unknown, unknown, {'timezone': 'UTC', 'locale': 'en-US'}, Mock(), enabled=set())
+        for key in ('timezone', 'locale', 'dns', 'ipv6'):
+            with self.subTest(component=key):
+                row = next(r for r in rows if r.id == 'baseline.' + key)
+                self.assertEqual(row.status, Status.UNKNOWN)
+                self.assertTrue(denied(row.evidence))
+
+    def test_truncated_route_results_cannot_omit_the_failed_address(self):
+        completed = subprocess.CompletedProcess(['fixture'], 0, stdout='[]', stderr='')
+        rows = lookup_routes(['192.0.2.1'], 'Windows', Mock(return_value=completed))
+        self.assertEqual(len(rows), 1)
+        self.assertEqual(rows[0]['error'], 'invalid_response')
+
+    def test_denied_dns_is_explained_as_permission_in_the_report(self):
+        with patch('envscope.inventory.command_text', side_effect=mac_reader(PermissionError())):
+            network = macos_network()
+        with patch('envscope.probes.collect', return_value={'platform': 'Darwin', 'network': network}):
+            rows = audit(Policy(), Mock(), selected_checks=['system.inventory'])
+        report = {'findings': [row.to_dict() for row in rows]}
+        item = next(row for row in assessment(report)['items'] if row['id'] == 'system.inventory')
+        self.assertEqual(item['state'], 'permission')
+        self.assertEqual(item['action'], 'permission-help')
+        self.assertEqual(network['errors']['dns']['error'], 'permission_denied')
+
+    def test_failed_subcollection_never_becomes_a_completed_inventory(self):
+        for failure in (PermissionError(), subprocess.TimeoutExpired('fixture', 3), FileNotFoundError(), OSError()):
+            with self.subTest(failure=type(failure).__name__):
+                with patch('envscope.inventory.command_text', side_effect=mac_reader(failure)):
+                    network = macos_network()
+                with patch('envscope.probes.collect', return_value={'platform': 'Darwin', 'network': network}):
+                    row = next(f for f in audit(Policy(), Mock(), selected_checks=['system.inventory']) if f.id == 'system.inventory')
+                self.assertEqual(row.status.value, 'unknown')
+                self.assertNotIn('已采集', row.summary)
+
+    def test_timeout_and_missing_tool_are_not_reported_as_permission(self):
+        for failure, expected in ((subprocess.TimeoutExpired('fixture', 3), 'timeout'), (FileNotFoundError(), 'tool_missing')):
+            with self.subTest(expected=expected):
+                with patch('envscope.inventory.command_text', side_effect=mac_reader(failure)):
+                    network = macos_network()
+                self.assertEqual(network.get('errors', {}).get('dns', {}).get('error'), expected)
+                self.assertFalse(denied(network))
+
+    def test_process_and_tunnel_denials_reach_the_affected_check(self):
+        for key, make in (('known_clients', lambda value: proxy_runtime(value, {})), ('adapters', tunnel)):
+            with self.subTest(component=key):
+                value = {'network': {key: [], 'errors': {key: {'error': 'permission_denied', 'operation': key}}}}
+                finding = make(value).to_dict()
+                row = assessment({'findings': [finding]})['items'][0]
+                self.assertEqual(row['state'], 'permission')
+
+    def test_legacy_partial_inventory_errors_are_not_ignored(self):
+        for key in ('dns_error', 'default_route_error'):
+            with self.subTest(component=key):
+                inventory = {'platform': 'Darwin', 'network': {'adapters': [], key: 'unavailable'}}
+                with patch('envscope.probes.collect', return_value=inventory):
+                    row = next(f for f in audit(Policy(), Mock(), selected_checks=['system.inventory']) if f.id == 'system.inventory')
+                self.assertEqual(row.status.value, 'unknown')
+
+    def test_denied_command_has_a_safe_machine_readable_error(self):
+        completed = subprocess.CompletedProcess(['fixture'], 1, stdout='', stderr='scutil: Permission denied PRIVATE_CREDENTIAL')
+        with patch('envscope.inventory.subprocess.run', return_value=completed):
+            with self.assertRaises(OSError) as raised:
+                command_text(['/usr/sbin/scutil', '--dns'])
+        self.assertEqual(getattr(raised.exception, 'code', None), 'permission_denied')
+        self.assertNotIn('PRIVATE_CREDENTIAL', str(raised.exception))
+
+    def test_route_read_denial_remains_actionable_on_both_platforms(self):
+        for system in ('Windows', 'Darwin'):
+            with self.subTest(system=system):
+                result = lookup_routes(['192.0.2.1'], system, Mock(side_effect=PermissionError()))
+                self.assertEqual(result[0]['error'], 'permission_denied')
+                self.assertTrue(denied(result))
+
+    def test_route_timeout_is_distinct_from_denial(self):
+        for system in ('Windows', 'Darwin'):
+            with self.subTest(system=system):
+                result = lookup_routes(['192.0.2.1'], system, Mock(side_effect=subprocess.TimeoutExpired('fixture', 3)))
+                self.assertEqual(result[0]['error'], 'timeout')
+                self.assertFalse(denied(result))
+
+    def test_denied_route_command_response_does_not_expose_stderr(self):
+        completed = subprocess.CompletedProcess(['fixture'], 1, stdout='', stderr='route: Operation not permitted PRIVATE_CREDENTIAL')
+        result = lookup_routes(['192.0.2.1'], 'Darwin', Mock(return_value=completed))
+        self.assertEqual(result[0]['error'], 'permission_denied')
+        self.assertNotIn('PRIVATE_CREDENTIAL', json.dumps(result))

From afc8d069734666419015c6a853a55d398aa757e0 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 16:48:00 +0800
Subject: [PATCH 02/10] feat: resume scoped checks after permission steps

---
 .../plans/2026-10-30-permissions-and-ui.md    |   8 +-
 envscope/assessment.py                        |   2 +-
 envscope/components_macos.py                  |   3 +-
 envscope/components_windows.py                |   5 +-
 envscope/consent.py                           |  36 +++++
 envscope/operations.py                        |   2 +
 envscope/permissions.py                       | 135 +++++++++++++-----
 envscope/region_setup.py                      |  11 +-
 envscope/system_network.py                    |   6 +-
 envscope/system_network_macos.py              |   4 +-
 envscope/system_network_windows.py            |  12 +-
 envscope/timezone_service.py                  |  13 +-
 envscope/web/app.mjs                          |   9 +-
 envscope/web/desktop.mjs                      |  14 --
 envscope/web/index.html                       |   1 +
 envscope/web/inspection.mjs                   |   3 +-
 envscope/web/permission_flow.mjs              |  67 +++++++++
 scripts/permission_flow_smoke.py              |  91 ++++++++++++
 tests/permission_flow.test.mjs                |  32 +++++
 tests/test_consent.py                         |  26 ++++
 tests/test_permissions.py                     |  68 +++++++++
 21 files changed, 466 insertions(+), 82 deletions(-)
 create mode 100644 envscope/consent.py
 create mode 100644 envscope/web/permission_flow.mjs
 create mode 100644 scripts/permission_flow_smoke.py
 create mode 100644 tests/permission_flow.test.mjs
 create mode 100644 tests/test_consent.py
 create mode 100644 tests/test_permissions.py

diff --git a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
index 934b997..636adc6 100644
--- a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
+++ b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
@@ -44,10 +44,10 @@
 
 **Interfaces:** `permission_help` returns capability IDs, scope, affected checks and an OS action while retaining legacy response fields. Frontend `initPermissionFlow({run,operate,recheck,getContext})` owns pending authorization, focus/visibility continuation, cancellation and retry; no permission is granted from a frontend flag.
 
-- [ ] Write backend and browser regressions for every routed capability, cancellation, changed target/selection, missing settings entry and permission still denied after return.
-- [ ] Observe the failures, then implement per-capability OS actions and bounded continuation with fresh audit/repair preview.
-- [ ] Classify OS consent/operation outcomes in a shared helper and wire callers without discarding pending native transactions.
-- [ ] Run permission, native transaction and browser workflow tests plus the full Python/JS suites; commit and ledger results.
+- [x] Write backend and browser regressions for routed capabilities, cancellation, changed target/selection, missing settings entry and continued denial.
+- [x] Observe failures, implement scoped OS actions and bounded continuation with fresh audit/repair preview.
+- [x] Classify OS consent/operation outcomes without discarding pending native transactions.
+- [x] Verify 697 Python tests (5 platform skips), 19 JavaScript tests, desktop UI at 1024/1280/1440 and Windows/macOS permission workflow fixtures; commit and ledger results. Real OS consent remains separately unmeasured.
 
 ### Task 3: Persistent guard authority and actionable notifications
 
diff --git a/envscope/assessment.py b/envscope/assessment.py
index fe8a8f3..76ff885 100644
--- a/envscope/assessment.py
+++ b/envscope/assessment.py
@@ -3,7 +3,7 @@
 
 def denied(value):
     if isinstance(value, dict):
-        return value.get("error") == "permission_denied" or any(denied(v) for v in value.values())
+        return value.get("error") in ('permission_denied', 'policy_denied') or any(denied(v) for v in value.values())
     return isinstance(value, list) and any(denied(v) for v in value)
 
 
diff --git a/envscope/components_macos.py b/envscope/components_macos.py
index 9b8b322..5ea9453 100644
--- a/envscope/components_macos.py
+++ b/envscope/components_macos.py
@@ -94,4 +94,5 @@ def execute(self, action, payload):
             code += f'/usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin LC_ALL=C "$STAGE/helper" --{action} "$STAGE/plan.plist" {shlex.quote(hashlib.sha256(raw).hexdigest())} {shlex.quote(str(self.uid))}\n'
             apple = 'do shell script '+json.dumps(code, ensure_ascii=False)+' with administrator privileges without altering line endings'
             result = self.runner(['/usr/bin/osascript', '-e', apple], capture_output=True, timeout=150)
-            if result.returncode: raise ValueError('系统授权取消或旧组件操作未完全完成，请刷新并核对恢复记录')
+            from .consent import raise_for_consent
+            raise_for_consent(result, 'Darwin')
diff --git a/envscope/components_windows.py b/envscope/components_windows.py
index 3921f6d..1a9f5fa 100644
--- a/envscope/components_windows.py
+++ b/envscope/components_windows.py
@@ -242,7 +242,8 @@ def execute(self, action, payload):
                 "$o=@{FilePath="+quote(self.executable)+";ArgumentList=@('-NoProfile','-NonInteractive','-EncodedCommand',$code);WindowStyle='Hidden';Wait=$true;PassThru=$true};"
                 "$p=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent());"
                 "if(-not $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){$o.Verb='RunAs'};"
-                "$v=Start-Process @o;exit $v.ExitCode")
+                "try{$v=Start-Process @o;exit $v.ExitCode}catch{$e=$_.Exception;while($e){if($e -is [ComponentModel.Win32Exception]){exit $e.NativeErrorCode};$e=$e.InnerException};exit 1}")
             result = self.runner([self.executable, '-NoProfile', '-NonInteractive', '-Command', launcher], input=encoded.encode(),
                                  capture_output=True, timeout=150, creationflags=getattr(subprocess, 'CREATE_NO_WINDOW', 0))
-            if result.returncode: raise ValueError('系统授权取消或旧组件操作未完成，请核对受保护的恢复记录')
+            from .consent import raise_for_consent
+            raise_for_consent(result, 'Windows')
diff --git a/envscope/consent.py b/envscope/consent.py
new file mode 100644
index 0000000..7dc14c2
--- /dev/null
+++ b/envscope/consent.py
@@ -0,0 +1,36 @@
+"""Classify OS consent without equating command completion with a repair."""
+import re
+import subprocess
+
+MESSAGES = {
+    'consent_cancelled': '系统授权已取消。请刷新实际状态，已有事务仍需按恢复记录核对。',
+    'policy_denied': '组织策略阻止了操作。请联系管理员处理，并保留恢复记录。',
+    'permission_denied': '系统拒绝了所需权限。请核对授权及恢复记录。',
+    'operation_failed': '系统操作未完成。请核对实际状态及恢复记录后再重试。',
+    'execution_unknown': '等待系统操作超时，执行结果尚不确定。请先刷新状态及恢复记录，勿重复提交。',
+}
+
+
+class ConsentError(ValueError):
+    def __init__(self, code):
+        self.code = code
+        super().__init__(MESSAGES[code])
+
+
+def raise_for_consent(result, system):
+    if result.returncode == 0:
+        return
+    stderr = result.stderr or ''
+    if isinstance(stderr, bytes):
+        stderr = stderr.decode('utf-8', errors='replace')
+    # Only the osascript native error suffix, never the word "cancelled".
+    mac_cancel = system == 'Darwin' and re.search(r'\(-128\)\s*$', stderr[-1024:])
+    code = ('consent_cancelled' if system == 'Windows' and result.returncode == 1223 or mac_cancel else
+            'policy_denied' if system == 'Windows' and result.returncode == 1260 else
+            'permission_denied' if system == 'Windows' and result.returncode == 5 else 'operation_failed')
+    raise ConsentError(code)
+
+
+def operation_outcome(error):
+    code = error.code if isinstance(error, ConsentError) else 'execution_unknown' if isinstance(error, (subprocess.TimeoutExpired, TimeoutError)) else 'permission_denied' if isinstance(error, PermissionError) else 'operation_failed'
+    return {'error': code, 'needs_retest': True}
diff --git a/envscope/operations.py b/envscope/operations.py
index 37aad0c..44d57e0 100644
--- a/envscope/operations.py
+++ b/envscope/operations.py
@@ -604,6 +604,8 @@ def _run(self, action, params, confirmed=False, report=None, preflight=None):
             desktop = getattr(self, "desktop_runtime", None)
             return desktop.run(action, params, confirmed) if desktop else {"state": "unavailable", "reason": "此功能需要打开 EnvScope 独立软件。当前是浏览器兼容界面。"}
         if action == "permission-help":
+            if report and report.get('environment', {}).get('confirmed') and report['environment'].get('fingerprint') != fingerprint(self.store.settings()):
+                return {'state': 'retest_required', 'reason': '目标已改变，请先按当前目标重新检测。'}
             from .permissions import permission_help
             return permission_help(report, params, self.home, self.accounts.data_dir, confirmed)
         native_parameters = {"account-label": {"slot", "label"}, "account-switch": {"slot", "allow_force"},
diff --git a/envscope/permissions.py b/envscope/permissions.py
index 528d7d7..061ba07 100644
--- a/envscope/permissions.py
+++ b/envscope/permissions.py
@@ -1,48 +1,109 @@
-"""Scoped help only after an actual OS permission denial, never blanket elevation."""
+"""Scoped OS settings and manual steps after a measured access denial."""
 import os
 from pathlib import Path
 import platform
 import subprocess
 
 from .assessment import denied
+from .observation_errors import error_evidence, inventory_errors
+
+CAPABILITIES = {
+    'network-read': ('读取网卡、DNS 与系统选路', ('system.inventory', 'baseline.dns', 'baseline.tun', 'baseline.ipv6', 'target.tun_route', 'extra.target_route', 'extra.dns_resolution')),
+    'process-read': ('读取所选连接工具的运行状态', ('system.inventory', 'baseline.proxy', 'target.wireguard')),
+    'region-read': ('读取当前时区与地区格式', ('system.inventory', 'baseline.timezone', 'baseline.locale')),
+    'application-read': ('读取 Claude 本地配置与资料目录', ('extra.config', 'target.config', 'extra.profile', 'extra.account', 'extra.storage', 'extra.desktop', 'baseline.language')),
+    'code-read': ('读取 Code 用户配置的格式与环境项存在性', ('extra.cli_env', 'target.config', 'extra.config')),
+    'hosts-read': ('读取 hosts 中与 Claude 有关的记录', ('extra.hosts',)),
+    'proxy-read': ('读取当前用户的系统代理配置', ('extra.proxy_layers', 'target.path')),
+}
+
+
+def has_error(value, code):
+    if isinstance(value, dict):
+        return value.get('error') == code or any(has_error(v, code) for v in value.values())
+    return isinstance(value, list) and any(has_error(v, code) for v in value)
+
+
+def capabilities(finding, usage):
+    key = finding['id']
+    if key == 'system.inventory':
+        failures = {}
+        for value in finding.get('evidence', []):
+            if isinstance(value, dict):
+                failures.update(inventory_errors(value))
+        ids = set()
+        for name, value in failures.items():
+            if denied(value):
+                ids.add('region-read' if name in ('timezone', 'locale', 'language') else
+                        'process-read' if name == 'known_clients' else
+                        'application-read' if name == 'desktop_packages' else 'network-read')
+        return sorted(ids) or ['network-read']
+    if key == 'target.config':
+        return ['code-read'] if usage == 'cli' else ['application-read', 'code-read'] if usage == 'both' else ['application-read']
+    return [name for name, (_, checks) in CAPABILITIES.items() if key in checks]
+
+
+def os_action(capability, system, home, profile):
+    root = Path(os.environ.get('SystemRoot', 'C:/Windows'))
+    path = home / '.claude' if capability == 'code-read' else root / 'System32/drivers/etc/hosts' if capability == 'hosts-read' else profile
+    if capability in ('application-read', 'code-read', 'hosts-read'):
+        if system == 'Darwin':
+            if capability == 'hosts-read':
+                return None, ['系统拒绝读取 /etc/hosts。请让管理员核对该文件的读取权限及组织策略。不要开放写入权限。']
+            return ['/usr/bin/open', 'x-apple.systempreferences:com.apple.preference.security?Privacy_FilesAndFolders'], [
+                '在隐私与安全性 → 文件与文件夹中核对 EnvScope 的相关目录权限。',
+                '若列表没有本软件或仍被拒绝，核对文件所有者与只读权限；完全磁盘访问只在确实需要读取受保护目录时考虑。',
+                '系统提示重新打开时，请退出再打开 EnvScope 并检测。']
+        return [str(root / 'explorer.exe'), '/select,', str(path)], [
+            '在所选文件或目录的属性 → 安全中核对当前用户的读取权限。',
+            '组织管理的权限由管理员处理；无需给整个应用永久管理员权限。']
+    if capability == 'process-read':
+        return ([str(root / 'System32/mmc.exe'), str(root / 'System32/services.msc')] if system == 'Windows' else
+                ['/usr/bin/open', '/System/Applications/Utilities/Activity Monitor.app']), [
+            '核对连接工具或所选隧道服务是否运行，以及其所属用户。',
+            '进程或服务读取被限制时，请管理员授予所需读取权限；不要改动 VPN 凭据。']
+    if capability == 'region-read':
+        uri = 'ms-settings:dateandtime' if system == 'Windows' else 'x-apple.systempreferences:com.apple.Date-Time-Settings.extension'
+        steps = ['核对日期与时间以及地区设置。读取被组织策略限制时，请管理员处理。']
+    else:
+        uri = ('ms-settings:network-proxy' if capability == 'proxy-read' else 'ms-settings:network-status') if system == 'Windows' else 'x-apple.systempreferences:com.apple.Network-Settings.extension'
+        steps = ['核对当前网络及代理配置。系统网络读取没有通用的“允许”开关，若组织策略拒绝读取，请管理员核对对应权限。',
+                 '打开设置不会自行授予权限或修改连接。返回后将重新检测并保留实际结果。']
+    return ([str(root / 'explorer.exe'), uri] if system == 'Windows' else ['/usr/bin/open', uri]), steps
 
 
 def permission_help(report, params, home, profile, confirmed=False, runner=subprocess.Popen, system=None):
-    if set(params) != {"report_id", "finding_id"} or not report or params["report_id"] != report.get("report_id"):
-        return {"state": "retest_required", "reason": "先完成本轮检测，再处理本次明确拒绝的权限。"}
-    finding = next((f for f in report.get("findings", []) if f["id"] == params["finding_id"]), None)
-    if not finding or not denied(finding.get("evidence", [])):
-        raise ValueError("这项没有明确的权限拒绝证据，不申请额外权限")
+    if set(params) != {'report_id', 'finding_id'} or not report or params['report_id'] != report.get('report_id'):
+        return {'state': 'retest_required', 'reason': '先完成本轮检测，再处理本次明确拒绝的权限。'}
+    finding = next((f for f in report.get('findings', []) if f['id'] == params['finding_id']), None)
+    if not finding or finding.get('scope') == 'not-selected' or not denied(finding.get('evidence', [])):
+        raise ValueError('这项没有明确的权限拒绝证据，不申请额外权限')
     system = system or platform.system()
-    if finding['id'] == 'target.wireguard':
-        if system != 'Windows':
-            return {'state': 'unavailable', 'reason': '此项仅适用于 Windows 隧道服务。'}
-        reason = '本次明确被拒绝读取 WireGuard 服务或所属进程。将打开 Windows 服务管理器供核对，不修改服务权限、启动方式或隧道；打开入口不等于授权。'
-        if confirmed is not True:
-            return {'state': 'confirmation_required', 'reason': reason}
-        root = Path(os.environ.get('SystemRoot', 'C:/Windows'))/'System32'
-        runner([str(root/'mmc.exe'), str(root/'services.msc')], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-               creationflags=getattr(subprocess, 'CREATE_NO_WINDOW', 0))
-        return {'state': 'opened', 'reason': '在服务管理器找到所选 WireGuardTunnel 服务，核对所属账户和服务状态。读取权限由管理员或组织策略管理；不要修改 VPN 私钥或绕过组织限制。处理后重新检测。', 'permission_granted': False}
-    scopes = {"extra.hosts": ("读取 hosts 中与 Claude 有关的记录", Path(os.environ.get("WINDIR", "C:/Windows")) / "System32/drivers/etc/hosts"),
-              "extra.config": ("读取 Claude / Code 用户配置的格式", profile),
-              "target.config": ("读取所选 Claude / Code 用户配置的格式", home / '.claude' if report.get('usage') == 'cli' else profile),
-              "extra.cli_env": ("读取 Code 用户配置的格式与环境项存在性", home / ".claude"),
-              "extra.proxy_layers": ("读取当前用户的系统代理设置", None)}
-    if finding["id"] not in scopes:
-        return {"state": "unavailable", "reason": "系统拒绝了读取。请根据证据检查应用或文件的访问权限，再检测；当前没有可自动打开的授权入口。"}
-    label, path = scopes[finding["id"]]
-    reason = label + "。不会修改该配置或导出密钥；将打开系统入口，由你授予必要的读取权限，然后重新检测。"
+    base = {'scope': 'read', 'permission_granted': False, 'report_id': report['report_id'],
+            'finding_id': finding['id'], 'capabilities': [], 'affected_checks': []}
+    if has_error(finding['evidence'], 'policy_denied'):
+        return {**base, 'state': 'manual', 'error': 'policy_denied', 'reason': '组织策略拒绝了读取，请联系管理员处理；不会反复请求管理员权限。',
+                'manual_steps': ['向设备管理员提供失败的检查名称和 policy_denied 代码，处理后重新检测。']}
+    if system not in ('Windows', 'Darwin'):
+        return {**base, 'state': 'unavailable', 'reason': '当前仅支持 Windows 与 macOS。'}
+    ids = capabilities(finding, report.get('usage'))
+    entries = [(name, *os_action(name, system, Path(home), Path(profile))) for name in ids]
+    base['capabilities'] = [{'id': name, 'label': CAPABILITIES[name][0], 'access': 'read',
+                             'os_action': 'open_settings' if command else 'manual'} for name, command, _ in entries]
+    base['affected_checks'] = sorted({check for name in ids for check in CAPABILITIES[name][1]})
+    steps = list(dict.fromkeys(step for _, _, values in entries for step in values))
+    base['manual_steps'] = steps or ['核对该项证据中的读取位置及权限，由资料所有者或设备管理员处理后复检。']
+    commands = list(dict.fromkeys(tuple(command) for _, command, _ in entries if command))
+    if not commands:
+        return {**base, 'state': 'manual', 'reason': ' '.join(base['manual_steps'])}
     if confirmed is not True:
-        return {"state": "confirmation_required", "reason": reason}
-    if system == "Darwin":
-        command = ["/usr/bin/open", "x-apple.systempreferences:com.apple.preference.security?Privacy_FilesAndFolders"]
-        instruction = "在隐私与安全性中检查 EnvScope 的文件与文件夹权限；仅在受保护资料仍被拒绝时评估完全磁盘访问。授权后重新打开软件并检测。"
-    elif system == "Windows":
-        command = [str(Path(os.environ.get("WINDIR", "C:/Windows")) / "explorer.exe")]
-        command += ["/select,", str(path)] if path else ["ms-settings:network-proxy"]
-        instruction = "Windows 文件读取权限需在文件或文件夹的属性 → 安全中核对。请让所属用户拥有读取权限；组织策略限制请联系管理员。完成后重新检测。"
-    else:
-        return {"state": "unavailable", "reason": "当前仅支持 Windows 与 macOS。"}
-    runner(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
-    return {"state": "opened", "reason": instruction, "permission_granted": False}
+        return {**base, 'state': 'confirmation_required', 'reason': '；'.join(CAPABILITIES[name][0] for name in ids) +
+                '。将打开对应系统入口供核对，不修改配置或导出凭据。返回后自动复检一次。'}
+    try:
+        for command in commands:
+            runner(list(command), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                   creationflags=getattr(subprocess, 'CREATE_NO_WINDOW', 0))
+    except OSError as exc:
+        return {**base, **error_evidence(exc, 'open_settings'), 'state': 'unavailable',
+                'reason': '未能打开系统入口。' + ' '.join(base['manual_steps'])}
+    return {**base, 'state': 'opened', 'reason': ' '.join(base['manual_steps']), 'recheck_on_return': True}
diff --git a/envscope/region_setup.py b/envscope/region_setup.py
index 5e63878..65de07a 100644
--- a/envscope/region_setup.py
+++ b/envscope/region_setup.py
@@ -48,7 +48,7 @@ def set_system_value(system, key, value, runner=_run):
             if result.returncode == 0:
                 return
             # Only tzutil is elevated; user culture must remain in the original user's session.
-            script = "$ErrorActionPreference='Stop'; $p=Start-Process -FilePath '" + executable.replace("'", "''") + "' -ArgumentList '/s \"" + value + "\"' -Verb RunAs -WindowStyle Hidden -PassThru -Wait; exit $p.ExitCode"
+            script = "$ErrorActionPreference='Stop'; try{$p=Start-Process -FilePath '" + executable.replace("'", "''") + "' -ArgumentList '/s \"" + value + "\"' -Verb RunAs -WindowStyle Hidden -PassThru -Wait; exit $p.ExitCode}catch{$e=$_.Exception;while($e){if($e -is [ComponentModel.Win32Exception]){exit $e.NativeErrorCode};$e=$e.InnerException};exit 1}"
         else:
             script = "$ErrorActionPreference='Stop'; Set-Culture -CultureInfo '" + value.replace('_', '-') + "'"
         encoded = base64.b64encode(script.encode('utf-16-le')).decode('ascii')
@@ -62,7 +62,8 @@ def set_system_value(system, key, value, runner=_run):
     else:
         raise ValueError('此系统不支持自动配置')
     if result.returncode != 0:
-        raise ValueError('系统未允许或未完成修改；请在日期与时间 / 语言与地区设置中手动处理后复检')
+        from .consent import raise_for_consent
+        raise_for_consent(result, system)
 
 
 class NodeController:
@@ -265,8 +266,10 @@ def apply(self, token, report, confirmed):
                 receipt['applied'].append(key)
                 self._save_recovery(receipt)
                 steps.append({'item': key, 'state': 'verified', 'reason': '配置已读回；网络出口另行复检'})
-            except (ValueError, OSError, subprocess.TimeoutExpired):
-                steps.append({'item': key, 'state': 'manual', 'reason': '未确认修改完成，后续步骤已停止。按恢复记录核对实际值；权限取消、超时或自动时区覆盖时请在系统 / 代理客户端中处理。'})
+            except (ValueError, OSError, subprocess.TimeoutExpired) as exc:
+                from .consent import operation_outcome, MESSAGES
+                outcome = operation_outcome(exc)
+                steps.append({'item': key, 'state': 'manual', **outcome, 'reason': MESSAGES[outcome['error']] + '后续步骤已停止，请按恢复记录核对实际值。'})
                 break
         receipt['state'] = 'completed' if len(receipt['applied']) == len(plan['changes']) else 'partial'
         self._save_recovery(receipt)
diff --git a/envscope/system_network.py b/envscope/system_network.py
index fdf33a7..33230c4 100644
--- a/envscope/system_network.py
+++ b/envscope/system_network.py
@@ -172,8 +172,9 @@ def apply(self,token,confirmed=False):
                       and (not plan['payload']['flush_dns'] or status.get('dns_flush')=='completed'))
         except (OSError,ValueError,subprocess.SubprocessError) as error:
             recovery=self.status()
+            from .consent import operation_outcome
             return {'state':'partial','reason':str(error)[:240]+' 请查看恢复状态；原备份没有自动丢弃。',
-                    'status':recovery,'needs_retest':True}
+                    'status':recovery,**operation_outcome(error)}
         return {'state':'completed' if verified else 'partial','status':public_status(status),'needs_retest':True,
                 'transaction_id':plan['payload']['nonce'],'scope':'selected-network-settings',
                 'reason':'所列网络设置已读回；现在复检解析、连接及出口。' if verified else '系统操作返回，但配置或缓存刷新尚未完整确认；请按恢复记录处理。'}
@@ -214,6 +215,7 @@ def restore(self,token,confirmed=False):
             restored=(status.get('state')=='restored' and all(r['id'] in rows and
                       all(rows[r['id']][k]==r[k] for k in ('ipv6_enabled','config')) for r in plan['record'].get('adapters',[])))
         except (OSError,ValueError,subprocess.SubprocessError) as error:
-            return {'state':'partial','reason':str(error)[:240]+' 恢复记录保留。','needs_retest':True}
+            from .consent import operation_outcome
+            return {'state':'partial','reason':str(error)[:240]+' 恢复记录保留。','status':self.status(),**operation_outcome(error)}
         return {'state':'completed' if restored else 'partial','status':public_status(status),'needs_retest':True,
                 'reason':'系统网络恢复已返回，请复检实际设置与连接。'}
diff --git a/envscope/system_network_macos.py b/envscope/system_network_macos.py
index 5379c85..553a9a2 100644
--- a/envscope/system_network_macos.py
+++ b/envscope/system_network_macos.py
@@ -82,5 +82,5 @@ def execute(self,action,payload):
             script=self.script(action,path,hashlib.sha256(data).hexdigest(),self.worker())
             apple='do shell script '+json.dumps(script,ensure_ascii=False)+' with administrator privileges without altering line endings'
             result=self.runner(['/usr/bin/osascript','-e',apple],capture_output=True,timeout=150)
-            if result.returncode:
-                raise ValueError('系统授权取消或网络修改未完成。请刷新恢复记录；未将命令返回当作修复成功。')
+            from .consent import raise_for_consent
+            raise_for_consent(result, 'Darwin')
diff --git a/envscope/system_network_windows.py b/envscope/system_network_windows.py
index df43924..74d5982 100644
--- a/envscope/system_network_windows.py
+++ b/envscope/system_network_windows.py
@@ -273,14 +273,10 @@ def execute(self,action,payload):
                       "$options=@{FilePath="+quote(self.executable)+";ArgumentList=@('-NoProfile','-NonInteractive','-EncodedCommand',$code);WindowStyle='Hidden';Wait=$true;PassThru=$true};"
                       "$p=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent());"
                       "if(-not $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){$options.Verb='RunAs'};"
-                      "$process=Start-Process @options;exit $process.ExitCode")
+                      "try{$process=Start-Process @options;exit $process.ExitCode}catch{"
+                      "$e=$_.Exception;while($e){if($e -is [ComponentModel.Win32Exception]){exit $e.NativeErrorCode};$e=$e.InnerException};exit 1}")
             result=self.runner([self.executable,'-NoProfile','-NonInteractive','-Command',launcher],input=encoded.encode(),
                                capture_output=True,timeout=150,creationflags=getattr(subprocess,'CREATE_NO_WINDOW',0))
             if result.returncode:
-                detail=''
-                try:
-                    failure=self._read('failure');code=failure.get('code','')
-                    if failure.get('data_sha')==hashlib.sha256(data).hexdigest() and isinstance(code,str) and len(code)<=160:
-                        detail=' 记录代码：'+code
-                except (OSError,ValueError):pass
-                raise ValueError('系统授权取消或网络修改未确认完成，请刷新恢复记录；没有按命令返回判定修复成功。'+detail)
+                from .consent import raise_for_consent
+                raise_for_consent(result, 'Windows')
diff --git a/envscope/timezone_service.py b/envscope/timezone_service.py
index 9ba909d..5038c18 100644
--- a/envscope/timezone_service.py
+++ b/envscope/timezone_service.py
@@ -444,8 +444,8 @@ def execute(self,script):
         script=privileged_script(self.layout,script,self.worker())
         apple='do shell script '+json.dumps(script,ensure_ascii=False)+' with administrator privileges without altering line endings'
         result=self.runner(['/usr/bin/osascript','-e',apple],timeout=150)
-        if result.returncode:
-            raise ValueError('系统授权被取消，或时区服务操作未完成。请刷新状态；若有恢复记录，先恢复再重试。')
+        from .consent import raise_for_consent
+        raise_for_consent(result, 'Darwin')
 
 
 class TimezoneService:
@@ -550,8 +550,9 @@ def apply(self,token,confirmed=False):
         try:
             self.io.execute(plan['script'])
         except (OSError,ValueError,subprocess.SubprocessError) as exc:
+            from .consent import operation_outcome
             return {'state':'partial','status':self.status(),'transaction_nonce':plan['receipt']['nonce'],
-                    'needs_retest':True,'reason':str(exc)[:240]+' 现有备份和日志保留。'}
+                    **operation_outcome(exc),'reason':str(exc)[:240]+' 现有备份和日志保留。'}
         status=self.status()
         completed=(not status.get('installed') and not status.get('registered') and not status.get('pending')
                    if plan['remove'] else status.get('installed') and status.get('registered') and status.get('target')==plan['target'] and not status.get('pending'))
@@ -593,7 +594,8 @@ def undo(self,token,confirmed=False):
         del self.plans[token]
         try:self.io.execute(plan['script'])
         except (OSError,ValueError,subprocess.SubprocessError) as exc:
-            return {'state':'partial','reason':str(exc)[:240],'status':self.status(),'needs_retest':True}
+            from .consent import operation_outcome
+            return {'state':'partial','reason':str(exc)[:240],'status':self.status(),**operation_outcome(exc)}
         completed=self._restored(self.io.inspect(),plan['snapshot']['transaction'])
         return {'state':'completed' if completed else 'partial','status':self.status(),'needs_retest':True,
                 'reason':'已恢复原时区及此前的时区守护基线，请复检。' if completed else '撤销后的配置尚未完整读回，请保留恢复记录并复检。'}
@@ -649,7 +651,8 @@ def recover(self,token,confirmed=False):
         del self.plans[token]
         try:self.io.execute(plan['script'])
         except (OSError,ValueError,subprocess.SubprocessError) as exc:
-            return {'state':'partial','reason':str(exc)[:240],'status':self.status()}
+            from .consent import operation_outcome
+            return {'state':'partial','reason':str(exc)[:240],'status':self.status(),**operation_outcome(exc)}
         status=self.status()
         completed=self._restored(self.io.inspect(),plan['receipt'])
         return {'state':'completed' if completed else 'partial','needs_retest':True,
diff --git a/envscope/web/app.mjs b/envscope/web/app.mjs
index 33b2c06..f3022c8 100644
--- a/envscope/web/app.mjs
+++ b/envscope/web/app.mjs
@@ -8,10 +8,11 @@ import {initConnection, disconnected} from "./connection.mjs";
 import {initTargetEnvironment} from './target.mjs';
 import {initWatchdogForms} from './watchdog_ui.mjs';
 import {initCoverage, browserEnvironment} from './coverage.mjs';
+import {initPermissionFlow} from './permission_flow.mjs';
 
 const byId=id=>document.getElementById(id);
 const nodes={start:byId("start"),share:byId("share"),checks:byId("checks"),quit:byId("quit")};
-let lastSnapshot=null,lastReport=null;
+let lastSnapshot=null,lastReport=null,lastSource='current',selectionRevision=0;
 const sessionPromise=(async()=>{
   const controller=new AbortController();const timer=setTimeout(()=>controller.abort(),1500);
   try {
@@ -83,6 +84,7 @@ function render(snapshot) {
 }
 
 function renderDesktop(report,source='current') {
+  lastSource=source;
   byId("checks-title").hidden=false;
   diagnosisUI.render(report);
   guideUI.render(report);
@@ -95,6 +97,10 @@ initWatchdogForms(diagnosisUI.run);
 initInspection({run:diagnosisUI.run,operate:diagnosisUI.operate,isBusy:diagnosisUI.isBusy,retest:checks=>runAudit({checks})});
 document.addEventListener('envscope-target-changed',()=>{lastReport=null;lastSnapshot=null;nodes.share.disabled=true;byId('qualification').hidden=true;byId('verdict').textContent='目标已更新，等待本轮检测';});
 initDesktopApp({run:diagnosisUI.run,operate:diagnosisUI.operate});
+document.addEventListener('envscope-selection-changed',()=>{selectionRevision++;});
+initPermissionFlow({run:diagnosisUI.run,operate:diagnosisUI.operate,isBusy:()=>diagnosisUI.isBusy()||nodes.start.disabled,
+  recheck:checks=>runAudit({phase:'recheck',checks}),
+  getContext:()=>({report:lastSource==='current'?lastReport:null,revision:selectionRevision})});
 const guideUI=initGuide({sessionPromise,run:diagnosisUI.run,retest:()=>runAudit({oneStop:true}),isBusy:diagnosisUI.isBusy,operate:diagnosisUI.operate,
   onReport:report=>{lastReport=report;renderDesktop(report);nodes.share.disabled=false;}});
 
@@ -159,6 +165,7 @@ async function runAudit({oneStop=true,phase='check',checks=null}={}){
   } catch {byId("verdict").textContent="检测没有完成";byId("verdict-note").textContent="本地服务或浏览器探测没有返回有效结果。请重新检测；仍失败时重新打开本地程序。缺失观测不会判定为通过。";byId("session-state").textContent="需要重新检测";}
   finally {nodes.start.disabled=false;for(const id of ['usage','enhance-cli','workflow-proxy','workflow-proxy-url'])byId(id).disabled=diagnosisUI.isBusy();nodes.start.textContent="重新检测";byId("audit-results").setAttribute("aria-busy","false");document.dispatchEvent(new CustomEvent('envscope-audit-end',{detail:{has_report:!!lastReport}}));if(!lastReport)setFlowStage(phase==='recheck'?'repair':'check','本次检测未完成，没有据此写入配置。请重新检测。');}
   if(oneStop&&lastReport)await diagnosisUI.prepareWorkflow();
+  return lastReport;
 }
 nodes.start.addEventListener("click",()=>{if(!diagnosisUI.isBusy())void runAudit({oneStop:true});});
 
diff --git a/envscope/web/desktop.mjs b/envscope/web/desktop.mjs
index 0be7c83..049e91b 100644
--- a/envscope/web/desktop.mjs
+++ b/envscope/web/desktop.mjs
@@ -51,18 +51,4 @@ export function initDesktopApp({run,operate}){
     $('qualification-pending').replaceChildren(...(pending.length?pending.map(i=>{const p=el('p',''),f=report.findings.find(f=>f.id===i.id);p.append(el('strong',(f?.title||i.id)+'：'),document.createTextNode(i.reason+' '+i.next_step));return p;}):[el('p','本次列出的关键使用条件已完成核对。')]));
   });
   document.addEventListener('envscope-audit-start',()=>{report=null;$('qualification').hidden=true;});
-  document.addEventListener('envscope-permission',e=>{
-    if(!report)return;
-    void operate(async()=>{
-      e.detail.button.disabled=true;
-      try{
-        const params={report_id:report.report_id,finding_id:e.detail.id};let v=await run('permission-help',params);
-        if(v.state==='confirmation_required'){
-          if(!window.confirm(v.reason)){e.detail.output.textContent='已取消，未更改权限。';return;}
-          v=await run('permission-help',params,true);
-        }
-        e.detail.output.textContent=v.reason||'完成授权后请重新检测。';
-      }finally{e.detail.button.disabled=false;}
-    },e.detail.output);
-  });
 }
diff --git a/envscope/web/index.html b/envscope/web/index.html
index aeb6252..48609d8 100644
--- a/envscope/web/index.html
+++ b/envscope/web/index.html
@@ -20,6 +20,7 @@
     </nav>
   </div>
   <main id="workspace" data-state="ready">
+    <section id="permission-status" class="connection-banner" role="status" hidden><p id="permission-message"></p><button id="permission-resume" class="link" hidden>我已处理，继续检测</button><button id="permission-cancel" class="link" hidden>停止自动复检</button></section>
     <section id="connection-banner" class="connection-banner" role="status" hidden><strong id="connection-title">本地服务已断开</strong><p id="connection-message">请重新双击 EnvScope 启动器，并使用它新打开的页面；旧地址可能已经失效。</p><button id="connection-retry" class="link">重新连接本页</button></section>
     <p id="connection-status" class="connection-status" role="status">正在连接本地服务…</p><div id="catalog-error" class="connection-banner" role="status" hidden><p>功能列表暂时无法读取。环境信息仍可单独查看；账号和维护操作请先重新读取列表。</p><button id="catalog-retry" class="link">重新读取功能列表</button></div>
     <div id="page-audit" class="page">
diff --git a/envscope/web/inspection.mjs b/envscope/web/inspection.mjs
index 24af2a8..4ca27fb 100644
--- a/envscope/web/inspection.mjs
+++ b/envscope/web/inspection.mjs
@@ -7,6 +7,7 @@ const explained={passed:'通过',review:'需要复核',problem:'发现问题',pe
 export function initInspection({run,operate,isBusy,retest}){
   let catalog=[],report=null,phase='not_run',selection=new Set(),visible=[],groups=[],source='current',initialized=false,defaultsKey=null;
   const selected=()=>[...selection];
+  let selectionKey='';
   const output=$('checks-output');
   const button=(text,fn)=>{const b=el('button',text,'link');b.type='button';b.disabled=phase==='running'||isBusy()||$('start').disabled;b.addEventListener('click',fn);return b;};
   const operateHere=fn=>operate(fn,output);
@@ -17,7 +18,7 @@ export function initInspection({run,operate,isBusy,retest}){
     for(const id of ['checks-select-all','checks-clear','checks-select-problems','checks-select-visible','checks-load-nodes','checks-node-group','checks-node','checks-region-undo'])$(id).disabled=blocked;
     for(const node of document.querySelectorAll('#all-checks-list button, #all-checks-list input[type=checkbox], #checks-plan button'))node.disabled=blocked;
   }
-  function invalidate(){$('checks-plan').replaceChildren();$('checks-selected-count').textContent=`已勾选 ${selection.size} 项。所需依赖自动包含；未选项目不算通过。`;updateButtons();}
+  function invalidate(){$('checks-plan').replaceChildren();$('checks-selected-count').textContent=`已勾选 ${selection.size} 项。所需依赖自动包含；未选项目不算通过。`;updateButtons();const key=JSON.stringify([...selection].sort());if(key!==selectionKey){selectionKey=key;document.dispatchEvent(new CustomEvent('envscope-selection-changed'));}}
   const busyObserver=new MutationObserver(updateButtons);
   busyObserver.observe(document.documentElement,{attributes:true,attributeFilter:['data-operation-busy']});
   busyObserver.observe($('start'),{attributes:true,attributeFilter:['disabled']});
diff --git a/envscope/web/permission_flow.mjs b/envscope/web/permission_flow.mjs
new file mode 100644
index 0000000..3b7725e
--- /dev/null
+++ b/envscope/web/permission_flow.mjs
@@ -0,0 +1,67 @@
+// Opening an OS pane is never evidence that permission was granted.
+const key=context=>JSON.stringify([context?.report?.report_id,context?.report?.environment?.fingerprint,
+  context?.report?.selection?.selected,context?.revision]);
+export function permissionContinuation({getContext,recheck,notify,isBusy=()=>false}){
+  let pending=null,running=false;
+  return {
+    arm(id,context,left=false){pending={id,key:key(context),checks:context.report.selection?.selected?.slice()||null,left};notify('waiting');},
+    leave(){if(pending)pending.left=true;},
+    cancel(){pending=null;notify('cancelled');},
+    invalidate(){if(pending){pending=null;notify('stale');}},
+    async resume(manual=false){
+      if(!pending||running||isBusy()||(!manual&&!pending.left))return false;
+      const step=pending;pending=null;
+      if(step.key!==key(getContext())){notify('stale');return false;}
+      running=true;notify('checking');
+      try{
+        const report=await recheck(step.checks);
+        const item=report?.assessment?.items?.find(row=>row.id===step.id);
+        if(!report||!item)notify('incomplete');
+        else if(item.state==='permission')notify('denied');
+        else if(item.state==='passed')notify('verified');
+        else notify('review');
+      }catch{notify('incomplete');}
+      finally{running=false;}
+      return true;
+    }
+  };
+}
+
+export function initPermissionFlow({run,operate,recheck,getContext,isBusy}){
+  const panel=document.getElementById('permission-status'),text=document.getElementById('permission-message');
+  const resume=document.getElementById('permission-resume'),cancel=document.getElementById('permission-cancel');
+  const messages={waiting:'已打开系统入口。处理后返回本窗口，将按原勾选范围自动复检一次。',checking:'正在重新读取权限和检测结果…',
+    cancelled:'已停止自动复检。系统中已做的操作不会被撤销。',stale:'检测目标、范围或报告已改变，请按当前目标重新检测。',
+    denied:'复检仍被系统拒绝。请按该项说明处理；不会重复弹出授权窗口。',verified:'本项已重新读取并通过检测，修复方案已更新。',
+    review:'复检已完成，请查看新的检测结果和处理方案。',incomplete:'复检未取得本项的完整结果，请重新检测。'};
+  function notify(state){panel.hidden=false;panel.dataset.state=state;text.textContent=messages[state];resume.hidden=cancel.hidden=state!=='waiting';}
+  const flow=permissionContinuation({getContext,recheck,isBusy,notify});
+  let opening=false,leftDuringOpen=false;
+  const leave=()=>{if(opening)leftDuringOpen=true;flow.leave();};
+  window.addEventListener('blur',leave);
+  window.addEventListener('focus',()=>{void flow.resume();});
+  document.addEventListener('visibilitychange',()=>{if(document.hidden)leave();else void flow.resume();});
+  resume.addEventListener('click',()=>void flow.resume(true));
+  cancel.addEventListener('click',()=>flow.cancel());
+  for(const name of ['envscope-target-changed','envscope-selection-changed','envscope-check-preferences-changed'])document.addEventListener(name,()=>flow.invalidate());
+  document.addEventListener('envscope-permission',event=>{
+    const context=getContext();if(!context?.report){notify('stale');return;}
+    void operate(async()=>{
+      const {id,button,output}=event.detail;button.disabled=true;
+      try{
+        const params={report_id:context.report.report_id,finding_id:id};
+        let value=await run('permission-help',params);
+        if(value.state==='confirmation_required'){
+          if(!window.confirm(value.reason)){output.textContent='已取消，未打开权限入口。';return;}
+          opening=true;leftDuringOpen=false;
+          value=await run('permission-help',params,true);
+        }
+        output.textContent=value.reason||'请根据本项说明处理后复检。';
+        if(value.state==='opened'&&value.recheck_on_return===true){
+          flow.arm(id,context,leftDuringOpen);
+        }
+      }finally{opening=false;button.disabled=false;}
+    },event.detail.output);
+  });
+  return flow;
+}
diff --git a/scripts/permission_flow_smoke.py b/scripts/permission_flow_smoke.py
new file mode 100644
index 0000000..dfff097
--- /dev/null
+++ b/scripts/permission_flow_smoke.py
@@ -0,0 +1,91 @@
+"""Offline permission-return workflows. No real permissions or OS settings change."""
+import json
+from pathlib import Path
+import tempfile
+import threading
+from unittest.mock import Mock
+
+from playwright.sync_api import expect, sync_playwright
+from envscope.guide import LESSON_VERSION
+from envscope.legacy import LegacyBridge
+from envscope.operations import Operations
+from envscope.permissions import permission_help
+from envscope.service import make_server
+from envscope.state import StateStore
+from scripts.environment_fixtures import fixture, target
+from scripts.ui_navigation import open_page
+
+
+def main():
+    results = []
+    output = Path('artifacts/permission-flow'); output.mkdir(parents=True, exist_ok=True)
+    with sync_playwright() as runtime:
+        browser = runtime.chromium.launch()
+        try:
+            for system in ('Windows', 'Darwin'):
+                with tempfile.TemporaryDirectory() as directory:
+                    home = Path(directory); store = StateStore(home / 'state'); store.complete_learning(LESSON_VERSION)
+                    settings = target(system, 'cli', 'direct', usage_country='US')
+                    store.save_settings({k: v for k, v in settings.items() if k != 'environment_confirmed'}, confirm_environment=True)
+                    opener = Mock(); calls = []; access = [False]
+                    class FixtureOperations(Operations):
+                        def run(self, action, params, **kwargs):
+                            if action == 'permission-help':
+                                return permission_help(kwargs.get('report'), params, home, home / 'Claude', kwargs.get('confirmed'), opener, system)
+                            return super().run(action, params, **kwargs)
+                    def auditor(*args, **kwargs):
+                        calls.append(kwargs.get('selected_checks'))
+                        return fixture(home, kwargs['baseline_config'], system, None if access[0] else 'permission')
+                    ops = FixtureOperations(store, home, discoverer=lambda: [],
+                        legacy=LegacyBridge(platform_name=system, home=home, runner=Mock(side_effect=AssertionError('No vendor execution'))))
+                    server = make_server(store=store, operations=ops, auditor=auditor)
+                    thread = threading.Thread(target=server.serve_forever, daemon=True); thread.start()
+                    context = browser.new_context(viewport={'width': 1280, 'height': 900}, locale='zh-CN')
+                    page = context.new_page(); errors = []
+                    page.on('pageerror', lambda error: errors.append(str(error)))
+                    page.add_init_script('window.RTCPeerConnection=undefined;')
+                    page.route('https://**/*', lambda route: route.abort())
+                    def row(): return page.locator('[data-inspection="target.config"]')
+                    def begin():
+                        if not row().evaluate('(node)=>node.open'): row().locator('summary').first.click()
+                        page.once('dialog', lambda dialog: dialog.accept())
+                        row().get_by_role('button', name='处理读取权限').click()
+                        expect(page.locator('#permission-status')).to_have_attribute('data-state', 'waiting')
+                        expect(page.locator('html')).not_to_have_attribute('data-operation-busy', 'true')
+                    try:
+                        page.goto('http://127.0.0.1:' + str(server.server_port), wait_until='networkidle')
+                        open_page(page, 'checks'); page.locator('#checks-clear').click()
+                        row().locator('input[type=checkbox]').check()
+                        page.locator('#checks-run').click()
+                        expect(row()).to_contain_text('需要读取权限', timeout=30000)
+                        initial = list(calls[-1]); count = len(calls)
+                        begin()
+                        page.evaluate("window.dispatchEvent(new Event('blur'));window.dispatchEvent(new Event('focus'));window.dispatchEvent(new Event('focus'))")
+                        expect(page.locator('#permission-status')).to_have_attribute('data-state', 'denied', timeout=30000)
+                        assert len(calls) == count + 1 and calls[-1] == initial
+                        begin(); page.locator('#permission-cancel').click()
+                        page.evaluate("window.dispatchEvent(new Event('blur'));window.dispatchEvent(new Event('focus'))")
+                        expect(page.locator('#permission-status')).to_have_attribute('data-state', 'cancelled')
+                        assert len(calls) == count + 1
+                        begin(); page.locator('#checks-clear').click()
+                        expect(page.locator('#permission-status')).to_have_attribute('data-state', 'stale')
+                        row().locator('input[type=checkbox]').check()
+                        begin(); access[0] = True
+                        page.locator('#permission-resume').click()
+                        expect(page.locator('#permission-status')).to_have_attribute('data-state', 'verified', timeout=30000)
+                        assert calls[-1] == initial and len(calls) == count + 2
+                        assert not errors, errors
+                        page.screenshot(path=str(output / (system + '.png')), full_page=True)
+                        results.append({'system': system, 'same_selection': True, 'single_auto_recheck': True,
+                            'denial_preserved': True, 'cancel': True, 'selection_invalidation': True,
+                            'fresh_readback': True, 'real_os_consent': False, 'page_errors': errors})
+                    finally:
+                        context.close(); server.shutdown(); server.server_close(); thread.join(3)
+        finally:
+            browser.close()
+    (output / 'result.json').write_text(json.dumps(results, indent=2), encoding='utf-8')
+    print(json.dumps(results))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tests/permission_flow.test.mjs b/tests/permission_flow.test.mjs
new file mode 100644
index 0000000..465d71d
--- /dev/null
+++ b/tests/permission_flow.test.mjs
@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {permissionContinuation} from '../envscope/web/permission_flow.mjs';
+
+function fixture(){
+  let context={report:{report_id:'r1',selection:{selected:['target.config']},environment:{fingerprint:'target1'}},revision:0};
+  const calls=[],messages=[];
+  const flow=permissionContinuation({getContext:()=>context,isBusy:()=>false,
+    recheck:async checks=>{calls.push(checks);return {report_id:'r2',assessment:{items:[{id:'target.config',state:'permission'}]}};},
+    notify:(...args)=>messages.push(args)});
+  return {flow,calls,messages,setContext:value=>{context=value;},context};
+}
+test('return from OS settings rechecks original selection once, never grants from focus',async()=>{
+  const f=fixture();f.flow.arm('target.config',f.context);
+  assert.equal(await f.flow.resume(),false);
+  f.flow.leave();await Promise.all([f.flow.resume(),f.flow.resume()]);
+  assert.deepEqual(f.calls,[['target.config']]);
+  assert.equal(f.messages.at(-1)[0],'denied');
+  await f.flow.resume();assert.equal(f.calls.length,1);
+});
+test('changed target, report or selection invalidates pending continuation',async()=>{
+  for(const change of [{revision:1},{report:{report_id:'new'}},{report:{...fixture().context.report,environment:{fingerprint:'new'}}}]){
+    const f=fixture();f.flow.arm('target.config',f.context);f.flow.leave();
+    f.setContext({...f.context,...change});await f.flow.resume();assert.equal(f.calls.length,0);
+    assert.equal(f.messages.at(-1)[0],'stale');
+  }
+});
+test('cancel is final and manual continue can recheck without a focus transition',async()=>{
+  const f=fixture();f.flow.arm('target.config',f.context);f.flow.cancel();f.flow.leave();
+  await f.flow.resume(true);assert.equal(f.calls.length,0);
+  f.flow.arm('target.config',f.context);await f.flow.resume(true);assert.equal(f.calls.length,1);
+});
diff --git a/tests/test_consent.py b/tests/test_consent.py
new file mode 100644
index 0000000..4d949af
--- /dev/null
+++ b/tests/test_consent.py
@@ -0,0 +1,26 @@
+import subprocess
+import unittest
+
+from envscope.consent import ConsentError, raise_for_consent, operation_outcome
+
+
+class ConsentTests(unittest.TestCase):
+    def test_only_native_cancel_codes_mean_cancelled(self):
+        for system, code, stderr, expected in (
+            ('Windows', 1223, '', 'consent_cancelled'), ('Windows', 1260, '', 'policy_denied'),
+            ('Darwin', 1, 'execution error: User canceled. (-128)', 'consent_cancelled'),
+            ('Darwin', 1, 'operation failed; cancelled string PRIVATE_CREDENTIAL', 'operation_failed'),
+            ('Windows', 1, 'cancelled string', 'operation_failed')):
+            with self.subTest(system=system, expected=expected):
+                with self.assertRaises(ConsentError) as error:
+                    raise_for_consent(subprocess.CompletedProcess([], code, '', stderr), system)
+                self.assertEqual(operation_outcome(error.exception)['error'], expected)
+                self.assertNotIn('PRIVATE_CREDENTIAL', str(error.exception))
+
+    def test_timeout_is_unknown_execution_not_cancelled(self):
+        value = operation_outcome(subprocess.TimeoutExpired('fixture', 1))
+        self.assertEqual(value['error'], 'execution_unknown')
+        self.assertTrue(value['needs_retest'])
+
+    def test_successful_command_still_requires_callers_independent_readback(self):
+        self.assertIsNone(raise_for_consent(subprocess.CompletedProcess([], 0, '', ''), 'Darwin'))
diff --git a/tests/test_permissions.py b/tests/test_permissions.py
new file mode 100644
index 0000000..92caa1c
--- /dev/null
+++ b/tests/test_permissions.py
@@ -0,0 +1,68 @@
+"""Permission steps use fixture launchers only; no OS dialogs are opened."""
+from pathlib import Path
+import unittest
+from unittest.mock import Mock
+
+from envscope.permissions import permission_help
+
+
+class PermissionFlowTests(unittest.TestCase):
+    def report(self, key, evidence=None):
+        return {'report_id': 'current', 'usage': 'cli', 'findings': [
+            {'id': key, 'evidence': evidence or [{'error': 'permission_denied'}]}]}
+
+    def call(self, key, system='Windows', evidence=None, confirmed=False, runner=None):
+        return permission_help(self.report(key, evidence), {'report_id': 'current', 'finding_id': key},
+                               Path('/fixture/home'), Path('/fixture/Claude'), confirmed, runner or Mock(), system)
+
+    def test_inventory_denial_has_scoped_entry_on_both_platforms(self):
+        evidence = [{'network': {'errors': {'dns': {'error': 'permission_denied'}}}}]
+        for system in ('Windows', 'Darwin'):
+            with self.subTest(system=system):
+                value = self.call('system.inventory', system, evidence)
+                self.assertEqual(value['state'], 'confirmation_required')
+                self.assertEqual(value['capabilities'][0]['id'], 'network-read')
+                self.assertEqual(value['scope'], 'read')
+                self.assertIn('baseline.dns', value['affected_checks'])
+                self.assertFalse(value['permission_granted'])
+
+    def test_native_network_denial_never_opens_file_privacy(self):
+        runner = Mock()
+        value = self.call('target.tun_route', 'Darwin', confirmed=True, runner=runner)
+        self.assertEqual(value['state'], 'opened')
+        command = runner.call_args.args[0]
+        self.assertTrue(any('Network' in part for part in command))
+        self.assertFalse(any('FilesAndFolders' in part for part in command))
+
+    def test_file_and_service_requests_remain_read_only(self):
+        for key in ('extra.hosts', 'extra.config', 'target.config', 'extra.cli_env', 'extra.profile', 'target.wireguard'):
+            with self.subTest(key=key):
+                value = self.call(key)
+                self.assertEqual(value['state'], 'confirmation_required')
+                self.assertEqual(value['scope'], 'read')
+                self.assertTrue(value['capabilities'])
+                self.assertFalse(value['permission_granted'])
+
+    def test_tool_launch_failure_is_actionable_not_a_grant(self):
+        value = self.call('extra.config', confirmed=True, runner=Mock(side_effect=FileNotFoundError()))
+        self.assertEqual(value['state'], 'unavailable')
+        self.assertEqual(value['error'], 'tool_missing')
+        self.assertFalse(value['permission_granted'])
+        self.assertTrue(value['manual_steps'])
+
+    def test_policy_denial_is_manual_without_retrying_elevation(self):
+        runner = Mock()
+        value = self.call('system.inventory', evidence=[{'error': 'policy_denied'}], confirmed=True, runner=runner)
+        self.assertEqual(value['state'], 'manual')
+        self.assertEqual(value['error'], 'policy_denied')
+        runner.assert_not_called()
+
+    def test_stale_and_unmeasured_requests_do_not_open_settings(self):
+        runner = Mock()
+        report = self.report('extra.config')
+        value = permission_help(report, {'report_id': 'old', 'finding_id': 'extra.config'}, Path('.'), Path('.'), True, runner, 'Windows')
+        self.assertEqual(value['state'], 'retest_required')
+        for evidence in ([{'error': 'timeout'}], [{'error': 'invalid_response'}]):
+            with self.assertRaises(ValueError):
+                self.call('extra.config', evidence=evidence, confirmed=True, runner=runner)
+        runner.assert_not_called()

From 6b10bc883c9bd5c6412551b8e1dd6cf61a0a6ff2 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:45:53 +0800
Subject: [PATCH 03/10] feat: add protected Windows timezone guard and
 actionable notifications

---
 .github/workflows/desktop.yml          |   9 +-
 envscope/_desktop_test.py              |   6 +
 envscope/desktop_runtime.py            |  36 ++-
 envscope/guard_capabilities.py         |  48 ++++
 envscope/guard_notifications.py        |  45 ++++
 envscope/maintenance.py                |  18 +-
 envscope/operations.py                 |   4 +-
 envscope/region_setup.py               |   2 +-
 envscope/timezone_service.py           |  19 +-
 envscope/timezone_windows.py           | 339 +++++++++++++++++++++++++
 envscope/watchdog.py                   |  31 ++-
 envscope/web/app.mjs                   |   4 +
 envscope/web/index.html                |   9 +-
 native/timezone_windows.c              | 194 ++++++++++++++
 scripts/build_desktop.py               |  16 +-
 scripts/build_windows_timezone.py      |  55 ++++
 scripts/windows_timezone_acceptance.py |  84 ++++++
 tests/test_guard_notifications.py      |  43 ++++
 tests/test_watchdog.py                 |  19 ++
 tests/test_windows_timezone_service.py | 123 +++++++++
 tests/test_windows_timezone_worker.py  |  73 ++++++
 21 files changed, 1143 insertions(+), 34 deletions(-)
 create mode 100644 envscope/guard_capabilities.py
 create mode 100644 envscope/guard_notifications.py
 create mode 100644 envscope/timezone_windows.py
 create mode 100644 native/timezone_windows.c
 create mode 100644 scripts/build_windows_timezone.py
 create mode 100644 scripts/windows_timezone_acceptance.py
 create mode 100644 tests/test_guard_notifications.py
 create mode 100644 tests/test_windows_timezone_service.py
 create mode 100644 tests/test_windows_timezone_worker.py

diff --git a/.github/workflows/desktop.yml b/.github/workflows/desktop.yml
index 17aed4a..a42dd83 100644
--- a/.github/workflows/desktop.yml
+++ b/.github/workflows/desktop.yml
@@ -44,6 +44,11 @@ jobs:
         env:
           ENVSCOPE_TIMEZONE_ACCEPTANCE: '1'
         run: python -m scripts.timezone_acceptance
+      - name: Actual SYSTEM timezone task lifecycle (fixture clock only)
+        if: runner.os == 'Windows'
+        env:
+          ENVSCOPE_TIMEZONE_ACCEPTANCE: '1'
+        run: python -m scripts.windows_timezone_acceptance
       - name: Actual local Mihomo routing and rollback (isolated fixture)
         run: python -m scripts.routing_core_smoke
       - name: Actual native client lifecycle (owned disposable GUI only)
@@ -121,7 +126,9 @@ jobs:
         if: always()
         with:
           name: Timezone-evidence-${{ runner.os }}-${{ runner.arch }}
-          path: artifacts/timezone-acceptance/result.json
+          path: |
+            artifacts/timezone-acceptance/result.json
+            artifacts/windows-timezone-acceptance.json
           if-no-files-found: warn
       - uses: actions/upload-artifact@v4
         if: always()
diff --git a/envscope/_desktop_test.py b/envscope/_desktop_test.py
index 9a51037..f170fb8 100644
--- a/envscope/_desktop_test.py
+++ b/envscope/_desktop_test.py
@@ -130,6 +130,12 @@ def execute(self,*args):raise AssertionError('Frozen software fixture must not m
         result['native_pipe_transport']='not_applicable'
         result['native_wireguard_bindings']='not_applicable'
         if platform.system()=='Windows':
+            from .timezone_service import bundle_worker
+            import subprocess
+            worker=bundle_worker(cache=directory/'native-timezone-cache',system='Windows')
+            info=json.loads(subprocess.check_output([worker['path'],'--version'],timeout=10))
+            assert info=={'format':1,'release':__release__,'fixture':False}
+            result['native_timezone_worker']=True
             from .wireguard import WindowsServices, command_identity, PREFIX
             path = 'C:\\Program Files\\WireGuard\\wireguard.exe'
             args = WindowsServices().argv('"'+path+'" /tunnelservice "C:\\EnvScopeFixture.conf"')
diff --git a/envscope/desktop_runtime.py b/envscope/desktop_runtime.py
index 864ba67..1c3018c 100644
--- a/envscope/desktop_runtime.py
+++ b/envscope/desktop_runtime.py
@@ -73,6 +73,35 @@ def __init__(self, server, window, updates=None):
         self.preferences = {k: saved.get(k, v) if type(saved.get(k, v)) is bool else v for k, v in DEFAULTS.items()}
         self.icon, self.quitting, self.next_executable = None, False, None
         self.ready, self.stopped = threading.Event(), threading.Event()
+        self.guard_attention=None
+        from .guard_notifications import GuardNotifications
+        self.guard_notifications=GuardNotifications(server.store,self.notify_guard)
+
+    def notify_guard(self,value):
+        self.guard_attention=value
+        if self.icon:
+            try:
+                if getattr(self.icon,'HAS_NOTIFICATION',False):self.icon.notify(value['message'],'EnvScope 守护提醒')
+                self.icon.update_menu()
+            except (OSError,RuntimeError,NotImplementedError):pass
+        # Details remain in local records. The fixed event only carries known IDs.
+        try:self.window.run_js('document.dispatchEvent(new CustomEvent("envscope-guard-attention",{detail:'+json.dumps(value,ensure_ascii=True)+'}))')
+        except (OSError,RuntimeError):pass
+
+    def show_guard(self):
+        self.show()
+        self.window.run_js('document.dispatchEvent(new CustomEvent("envscope-open-guard"))')
+
+    def poll_guard(self):
+        operations=getattr(self.server,'operations',None)
+        if operations is None or not self.ready.is_set():return
+        lock=getattr(self.server,'audit_lock',None)
+        if lock is not None and lock.locked():return
+        maintenance=operations.maintenance.status();timezone=operations.timezone_service.status()
+        self.guard_notifications.update(maintenance,timezone)
+        if self.guard_attention and not self.guard_notifications.active:
+            self.guard_attention=None
+            self.window.run_js('document.dispatchEvent(new CustomEvent("envscope-guard-clear"))')
 
     def status(self):
         installed = self.server.store._read("desktop-install.private.json", {})
@@ -156,13 +185,17 @@ def run(self, action, params, confirmed):
 
     def background(self):
         # This is update discovery, not implicit diagnostic/maintenance consent.
-        last = None
+        last = None;guard_checked=0
         while not self.stopped.wait(10):
             if self.preferences["check_updates"] and (last is None or time.monotonic() - last > 24 * 3600):
                 self.updates.check(self.preferences["preview_updates"])
                 last = time.monotonic()
                 if self.icon:
                     self.icon.update_menu()
+            if time.monotonic()-guard_checked>=30:
+                try:self.poll_guard()
+                except (OSError,ValueError,RuntimeError,subprocess.SubprocessError):pass
+                guard_checked=time.monotonic()
 
     def start_tray(self):
         import pystray
@@ -180,6 +213,7 @@ def ready(icon):
             self.ready.set()
         self.icon = pystray.Icon("EnvScope", image, "EnvScope", pystray.Menu(
             pystray.MenuItem("打开 EnvScope", lambda icon, item: self.show(), default=True),
+            pystray.MenuItem(lambda item:'守护需要处理' if self.guard_attention else '查看守护状态',lambda icon,item:self.show_guard()),
             pystray.MenuItem(lambda item: "有新版可用" if self.updates.status()["state"] == "available" else "软件更新与后台设置", open_settings),
             pystray.MenuItem("退出 EnvScope", lambda icon, item: self.quit())))
         self.icon.run_detached(setup=ready)
diff --git a/envscope/guard_capabilities.py b/envscope/guard_capabilities.py
new file mode 100644
index 0000000..e076f89
--- /dev/null
+++ b/envscope/guard_capabilities.py
@@ -0,0 +1,48 @@
+"""Read current-token privileges; never enable rights or modify policy here."""
+import platform
+
+
+def write_capabilities(system=None):
+    system = system or platform.system()
+    timezone = {'state': 'authorization_required', 'source': 'system-service',
+                'reason': '系统时区保持需要单独授权受保护的后台任务。'}
+    if system == 'Windows' and platform.system() == 'Windows':
+        try:
+            import ctypes
+            from ctypes import wintypes
+            class LUID(ctypes.Structure):
+                _fields_ = [('LowPart', wintypes.DWORD), ('HighPart', wintypes.LONG)]
+            class Entry(ctypes.Structure):
+                _fields_ = [('Luid', LUID), ('Attributes', wintypes.DWORD)]
+            advapi = ctypes.WinDLL('advapi32', use_last_error=True)
+            kernel = ctypes.WinDLL('kernel32', use_last_error=True)
+            kernel.GetCurrentProcess.restype = wintypes.HANDLE
+            kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+            advapi.OpenProcessToken.argtypes = [wintypes.HANDLE, wintypes.DWORD, ctypes.POINTER(wintypes.HANDLE)]
+            advapi.LookupPrivilegeValueW.argtypes = [wintypes.LPCWSTR, wintypes.LPCWSTR, ctypes.POINTER(LUID)]
+            advapi.GetTokenInformation.argtypes = [wintypes.HANDLE, ctypes.c_int, ctypes.c_void_p, wintypes.DWORD, ctypes.POINTER(wintypes.DWORD)]
+            token = wintypes.HANDLE(); luid = LUID(); size = wintypes.DWORD()
+            if not advapi.OpenProcessToken(kernel.GetCurrentProcess(), 8, ctypes.byref(token)):
+                raise OSError('token unavailable')
+            try:
+                if not advapi.LookupPrivilegeValueW(None, 'SeTimeZonePrivilege', ctypes.byref(luid)):
+                    raise OSError('privilege unavailable')
+                advapi.GetTokenInformation(token, 3, None, 0, ctypes.byref(size))
+                if not 4 <= size.value <= 65536:
+                    raise OSError('invalid token size')
+                data = ctypes.create_string_buffer(size.value)
+                if not advapi.GetTokenInformation(token, 3, data, size, ctypes.byref(size)):
+                    raise OSError('token unavailable')
+                count = wintypes.DWORD.from_buffer(data).value
+                if 4 + count * ctypes.sizeof(Entry) > size.value:
+                    raise OSError('invalid token')
+                entries = (Entry * count).from_buffer(data, 4)
+                present = any(row.Luid.LowPart == luid.LowPart and row.Luid.HighPart == luid.HighPart and not row.Attributes & 4 for row in entries)
+                timezone = {'state': 'available' if present else 'authorization_required', 'source': 'user-token',
+                            'reason': '当前用户令牌具备更改时区权限；每次后台运行仍会复核。' if present else '当前用户没有更改时区权限，启用保持前需要授权系统时区任务。'}
+            finally:
+                kernel.CloseHandle(token)
+        except (OSError, ValueError, ImportError):
+            timezone = {'state': 'unavailable', 'source': 'user-token', 'reason': '未能核实后台时区权限，不能声明可自动恢复。'}
+    return {'timezone': timezone, 'locale': {'state': 'available', 'source': 'user-session',
+             'reason': '仅在原用户会话中恢复地区格式。'}}
diff --git a/envscope/guard_notifications.py b/envscope/guard_notifications.py
new file mode 100644
index 0000000..e891a73
--- /dev/null
+++ b/envscope/guard_notifications.py
@@ -0,0 +1,45 @@
+"""Notify once for actionable transitions, excluding logs and private values."""
+import hashlib
+import json
+import time
+
+LABELS={'timezone':'时区','locale':'地区格式','proxy':'代理','code':'Code 配置','scheduler':'后台巡检'}
+
+
+class GuardNotifications:
+    def __init__(self,store,sink,clock=time.time):
+        self.store,self.sink=store,sink
+        self.clock=clock
+        self.saved=store._read('guard-notifications.private.json',{})
+        if not isinstance(self.saved,dict):self.saved={}
+        self.active=False
+
+    def update(self,maintenance,timezone):
+        saved=self.saved
+        expected=saved.get('timezone_expected',False)
+        if timezone.get('installed') is True:expected=True
+        elif timezone.get('intentionally_removed') is True:expected=False
+        waiting=saved.get('waiting_since')
+        if expected and timezone.get('state')=='waiting':
+            if not isinstance(waiting,(int,float)) or waiting>self.clock():waiting=self.clock()
+        else:waiting=None
+        issues={}
+        if maintenance.get('enabled') is True:
+            for name,row in maintenance.get('watchdog',{}).items():
+                if name in LABELS and row.get('state') in ('attention','paused'):
+                    issues[name]=row['state']
+            if maintenance.get('state') in ('failed','stale','schedule_unverified'):issues['scheduler']=maintenance['state']
+            if maintenance.get('restore_state') in ('blocked','unverified','paused'):issues['code']=maintenance['restore_state']
+        if expected and timezone.get('state') in ('attention','conflict','recovery_required','unregistered','outdated'):
+            issues['timezone']=timezone['state']
+        if expected and timezone.get('state')=='not_installed':issues['timezone']='unexpected_removal'
+        if waiting is not None and self.clock()-waiting>=180:issues['timezone']='heartbeat_lost'
+        fingerprint=hashlib.sha256(json.dumps(issues,sort_keys=True).encode()).hexdigest() if issues else ''
+        changed=bool(issues and fingerprint!=saved.get('fingerprint'))
+        if changed:
+            names=sorted(issues)
+            self.sink({'components':names,'message':'、'.join(LABELS[name] for name in names)+'需要处理。打开守护方案查看原因与恢复入口。'})
+        self.active=bool(issues)
+        self.saved={'fingerprint':fingerprint,'timezone_expected':expected,'waiting_since':waiting}
+        if self.saved!=saved:self.store._write('guard-notifications.private.json',self.saved)
+        return changed
diff --git a/envscope/maintenance.py b/envscope/maintenance.py
index bc9a837..ff21a04 100644
--- a/envscope/maintenance.py
+++ b/envscope/maintenance.py
@@ -150,6 +150,7 @@ def prepare(self, report, interval=15, auto_restore=False, watchdog=None):
                 return {"state": "blocked", "reason": "基线代理的 API TLS 连接尚未验证，不启用自动配置恢复。先测试并修复代理。"}
         baseline,guard_effects={},[]
         timezone_plan=None
+        needs_timezone_service=False
         if watchdog:
             from .regions import region_finding, PARTIAL
             if (not self.store.settings().get('environment_confirmed') or not self.store.settings().get('usage_country')
@@ -157,10 +158,13 @@ def prepare(self, report, interval=15, auto_restore=False, watchdog=None):
                     or self.store.settings().get('usage_country') in PARTIAL
                     or not any(f['id']=='target.region' and f['status']=='pass' for f in report.get('findings',[]))):
                 return {'state':'blocked','reason':'请先确认官方支持的实际地区，并修复环境后保存守护基线。'}
-            baseline,guard_effects=self.watchdog.prepare(self.store.settings(),watchdog)
-            if baseline.get('timezone') and self.timezone_service and self.timezone_service.system=='Darwin':
+            baseline,guard_effects=self.watchdog.prepare(self.store.settings(),watchdog,allow_authorization=self.timezone_service is not None)
+            if baseline.get('timezone') and self.timezone_service:
                 status=self.timezone_service.status()
-                if not (status.get('installed') and status.get('registered') and status.get('owner')
+                if status.get('state') in ('conflict','recovery_required') or status.get('state')=='attention' and 'installed' not in status:
+                    return {'state':'blocked','reason':status.get('reason','系统时区执行能力无法核实，请先处理。')}
+                needs_timezone_service=(self.timezone_service.system=='Darwin' or status.get('installed') or self.watchdog.capability_reader().get('timezone',{}).get('state')!='available')
+                if needs_timezone_service and not (status.get('installed') and status.get('registered') and status.get('owner')
                         and status.get('target')==baseline['timezone'] and not status.get('needs_update')
                         and status.get('state') in ('active','waiting')):
                     timezone_plan=self.timezone_service.prepare(report)
@@ -186,10 +190,10 @@ def prepare(self, report, interval=15, auto_restore=False, watchdog=None):
         if baseline:effects.append('守护每项至少间隔 5 分钟、24 小时最多尝试恢复 3 次；失败留痕，反复漂移暂停并提示重新审核')
         token = secrets.token_urlsafe(20)
         self.plans = {token: {"deadline": time.monotonic() + 90, "report_id": report["report_id"],
-                              "settings_hash": fingerprint(self.store.settings()), "file_hash": file_hash,"timezone_plan":timezone_plan,
+                              "settings_hash": fingerprint(self.store.settings()), "file_hash": file_hash,"timezone_plan":timezone_plan,'needs_timezone_service':needs_timezone_service,
                               "config": {"version": 1, "enabled": False, "interval": interval, "auto_restore": auto_restore,
                                          "approved": approved, "watchdog":baseline,"schedule": schedule, "created_at": utc_now()}}}
-        return {"state": "planned", "plan_id": token, "effects": effects,
+        return {"state": "planned", "plan_id": token, "effects": effects,'capabilities':self.watchdog.capability_reader(),
                 "reason": "审核后确认启用。开发或试用不会自动替你安装后台任务。"}
 
     def enable(self, token, report, confirmed=False):
@@ -216,7 +220,7 @@ def enable(self, token, report, confirmed=False):
                     except (OSError,ValueError):pass  # Root-owned transaction evidence remains authoritative.
                     return {'state':'partial','reason':'系统时区守护未完成，尚未启用本次巡检。'+result.get('reason',''),
                             'timezone_service':result,'needs_retest':True}
-            elif config.get('watchdog',{}).get('timezone') and self.timezone_service and self.timezone_service.system=='Darwin':
+            elif plan.get('needs_timezone_service') and self.timezone_service:
                 root_status=self.timezone_service.status()
                 if not (root_status.get('installed') and root_status.get('registered') and root_status.get('owner')
                         and root_status.get('target')==config['watchdog']['timezone'] and not root_status.get('pending')):
@@ -263,7 +267,7 @@ def disable(self, confirmed=False):
                 self._write("config", config)
             try:
                 self.scheduler.remove(config.get("schedule"))
-                note='已单独授权的 macOS 系统时区守护需在下方预览停用；本次不改系统时区。' if self.timezone_service and self.timezone_service.system=='Darwin' else '不恢复系统设置。'
+                note='已单独授权的系统时区守护需在下方预览停用；本次不改系统时区。' if self.timezone_service else '不恢复系统设置。'
                 result = {"state": "disabled", "reason": "持续维护已停用，用户巡检任务已移除。保留检测记录和私有备份。"+note}
             except (OSError, ValueError):
                 result = {"state": "partial", "reason": "自动恢复已停用，但系统任务未确认移除。保留任务文件供核对；后台再次唤起也不会执行恢复。"}
diff --git a/envscope/operations.py b/envscope/operations.py
index 44d57e0..ac3c608 100644
--- a/envscope/operations.py
+++ b/envscope/operations.py
@@ -151,9 +151,9 @@ def __init__(self, store, home=None, legacy=None, account_manager=None, discover
         self.remedy_opener = remedy_opener or self._open_remedy
         self.config_remedies = ConfigRemedies(self.home, self.accounts.data_dir)
         self.maintenance = maintenance or Maintenance(store, remedies=self.config_remedies, home=self.home)
-        from .timezone_service import TimezoneService
+        from .timezone_service import system_timezone_service
         from .inventory import collect
-        self.timezone_service = TimezoneService(store,lambda:(self.environment_reader or collect)())
+        self.timezone_service = system_timezone_service(store,lambda:(self.environment_reader or collect)())
         self.maintenance.timezone_service=self.timezone_service
         from .process_guard import ProcessGuard
         self.process_guard = process_guard or ProcessGuard(store, self.home)
diff --git a/envscope/region_setup.py b/envscope/region_setup.py
index 65de07a..0a0c91d 100644
--- a/envscope/region_setup.py
+++ b/envscope/region_setup.py
@@ -194,7 +194,7 @@ def prepare(self, report, components, group='', node=''):
                 changes[key] = selected[key]
                 effects.append(label + '：' + before[key] + ' → ' + selected[key])
         timezone_plan=None
-        if 'timezone' in components and self.system=='Darwin' and self.timezone_service:
+        if 'timezone' in components and self.timezone_service:
             status=self.timezone_service.status()
             if status.get('pending') or status.get('state')=='conflict' or status.get('state')=='attention' and 'installed' not in status:
                 return {'state':'blocked','reason':status.get('reason','先处理系统时区守护状态。')}
diff --git a/envscope/timezone_service.py b/envscope/timezone_service.py
index 5038c18..eed7a54 100644
--- a/envscope/timezone_service.py
+++ b/envscope/timezone_service.py
@@ -64,22 +64,22 @@ def daemon_bytes(layout):
                           'StandardOutPath':'/dev/null','StandardErrorPath':'/dev/null'},sort_keys=True)
 
 
-def bundle_worker(root=None,cache=None,*,component='timezone'):
+def bundle_worker(root=None,cache=None,*,component='timezone',system='Darwin'):
     if component not in ('timezone','network','components'):raise ValueError('不支持的系统辅助程序')
-    binary=component+'-helper';label={'timezone':'时区','network':'网络','components':'组件迁移'}[component]
+    name=component+'-helper';binary=name+('.exe' if system=='Windows' else '');label={'timezone':'时区','network':'网络','components':'组件迁移'}[component]
     root=Path(root) if root is not None else Path(__file__).resolve().parent/'native-runtime'
     try:
-        metadata=root/(binary+'.json')
+        metadata=root/(name+'.json')
         if metadata.stat().st_size>65536:raise ValueError('oversized helper metadata')
         manifest=json.loads(metadata.read_text(encoding='utf-8'))
-        payload=root/(binary+'.payload.zip')
+        payload=root/(name+'.payload.zip')
         if payload.stat().st_size>2*1024**2:raise ValueError('oversized helper payload')
         with zipfile.ZipFile(payload) as archive:
             if archive.namelist()!=[binary] or not 0<archive.getinfo(binary).file_size<=2*1024**2:
                 raise ValueError('invalid helper payload')
             data=archive.read(binary)
     except (OSError,ValueError,zipfile.BadZipFile,RuntimeError):
-        raise ValueError('请使用完整 macOS 独立桌面包，本入口需要随附的原生'+label+'辅助程序。') from None
+        raise ValueError('请使用完整 '+('Windows' if system=='Windows' else 'macOS')+' 独立桌面包，本入口需要随附的原生'+label+'辅助程序。') from None
     if (not isinstance(manifest,dict) or type(manifest.get('format')) is not int or manifest.get('format')!=1
             or manifest.get('fixture') is not False or manifest.get('release')!=__release__
             or not isinstance(manifest.get('sha256'),str) or not SHA.fullmatch(manifest['sha256'])
@@ -448,6 +448,14 @@ def execute(self,script):
         raise_for_consent(result, 'Darwin')
 
 
+def system_timezone_service(store,reader,*,system=None,**kwargs):
+    system=system or platform.system()
+    if system=='Windows':
+        from .timezone_windows import WindowsTimezoneService
+        return WindowsTimezoneService(store,reader,**kwargs)
+    return TimezoneService(store,reader,system=system,**kwargs)
+
+
 class TimezoneService:
     def __init__(self,store,reader,*,system=None,io=None,uid=None):
         self.store,self.reader=store,reader
@@ -486,6 +494,7 @@ def status(self):
             return {'supported':True,'state':state,'reason':reason,'target':base.get('target'),
                     'observed':heartbeat.get('observed'),'heartbeat_at':heartbeat.get('at_epoch'),
                     'installed':bool(base),'registered':value['registered'],'pending':value['pending'],
+                    'intentionally_removed':not base and value.get('transaction',{}).get('owner_uid')==self.uid and (value.get('outcome',{}).get('state')=='rolled_back' or value.get('outcome',{}).get('state')=='committed' and value.get('transaction',{}).get('operation')=='remove'),
                     'original':base.get('original'),'release':base.get('release'),
                     'journal_path':str(self.io.layout.root),'owner':base.get('owner_uid')==self.uid,
                     'can_undo':not value['pending'] and value.get('transaction',{}).get('owner_uid')==self.uid
diff --git a/envscope/timezone_windows.py b/envscope/timezone_windows.py
new file mode 100644
index 0000000..51de761
--- /dev/null
+++ b/envscope/timezone_windows.py
@@ -0,0 +1,339 @@
+"""Reviewed, protected SYSTEM task running only the compiled timezone worker."""
+import base64
+import hashlib
+import json
+from pathlib import Path
+import re
+import secrets
+import subprocess
+import tempfile
+import time
+
+from . import __release__
+from .consent import operation_outcome, raise_for_consent
+from .region_setup import current_region
+from .system_network_windows import COMMON, powershell, quote
+from .target_environment import fingerprint
+
+# Reuse the existing reviewed ACL, reparse and atomic JSON-write primitives.
+PROTECTION = COMMON[COMMON.index('function Assert-Protected'):COMMON.index('$Root=@ROOT@')]
+HEADER = r'''
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=[Text.UTF8Encoding]::new($false)
+$env:PSModulePath=Join-Path ([Environment]::GetFolderPath('Windows')) 'System32/WindowsPowerShell/v1.0/Modules'
+
+@PROTECTION@
+$Root=@ROOT@;$TaskName=@TASK@;$Fixture=@FIXTURE@
+$Worker=Join-Path $Root 'timezone-helper.exe'
+$Baseline=Join-Path $Root 'baseline.ini';$Receipt=Join-Path $Root 'transaction.json'
+$WorkerArgs=@ARGS@
+if([IO.DriveInfo]::new([IO.Path]::GetPathRoot($Root)).DriveType -ne 'Fixed'){throw 'local fixed volume required'}
+function Hash($path) {if(-not(Test-Path -LiteralPath $path)){return ''};Assert-Protected $path;return (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()}
+function Ini($path) {
+ if(-not(Test-Path -LiteralPath $path)){return @{}}
+ Assert-Protected $path;if((Get-Item -LiteralPath $path).Length -gt 8192){throw 'oversized ini'}
+ $value=@{};foreach($line in [IO.File]::ReadAllLines($path)){if($line -eq '[guard]' -or -not $line.Trim()){continue};$parts=$line.Split(@('='),2);if($parts.Count -ne 2 -or $value.ContainsKey($parts[0])){throw 'invalid ini'};$value[$parts[0]]=$parts[1]};return $value
+}
+function Read-Task {
+ $scheduler=New-Object -ComObject 'Schedule.Service';$scheduler.Connect()
+ try{$t=$scheduler.GetFolder('\').GetTask($TaskName)}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147024894){return $null};$e=$e.InnerException};throw}
+ $d=$t.Definition;$a=$d.Actions.Item(1)
+ if($t.Name -cne $TaskName -or $d.Actions.Count -ne 1 -or $a.Type -ne 0 -or $a.Path -cne $Worker -or $a.Arguments -cne $WorkerArgs -or $a.WorkingDirectory -cne $Root -or $d.Principal.UserId -notin @('SYSTEM','S-1-5-18') -or $d.Principal.RunLevel -ne 1){throw 'foreign task'}
+ return @{Settings=@{Enabled=[bool]$t.Enabled};State=$(if($t.State -eq 4){'Running'}else{'Ready'})}
+}
+function Snapshot {
+ No-Links $Root
+ if(Test-Path -LiteralPath $Root){Assert-Protected ([IO.DirectoryInfo]::new($Root).Parent.FullName);Assert-Protected $Root}
+ $task=Read-Task;$base=Ini $Baseline;$status=Ini (Join-Path $Root 'status.ini');$receipt=@{}
+ if(Test-Path -LiteralPath $Receipt){Assert-Protected $Receipt;if((Get-Item -LiteralPath $Receipt).Length -gt 65536){throw 'oversized receipt'};$receipt=Get-Content -LiteralPath $Receipt -Raw | ConvertFrom-Json}
+ if($base.Count -and ($base.format -cne '1' -or $base.worker_sha256 -cne (Hash $Worker) -or $base.owner -cnotmatch '^S-1-5(-[0-9]+)+$')){throw 'invalid baseline'}
+ if($task -and -not $base.Count -and $receipt.state -notin @('pending','partial')){throw 'orphan task'}
+ return @{baseline=$base;status=$status;transaction=$receipt;registered=($null -ne $task);enabled=($null -ne $task -and $task.Settings.Enabled);baseline_sha=(Hash $Baseline);worker_sha=(Hash $Worker);pending=($receipt.state -in @('pending','partial'))}
+}
+function New-Root($path) {
+ No-Links $path;if(Test-Path -LiteralPath $path){Assert-Protected $path;return}
+ $acl=[Security.AccessControl.DirectorySecurity]::new();$acl.SetAccessRuleProtection($true,$false);$acl.SetOwner([Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))
+ foreach($sid in @('S-1-5-18','S-1-5-32-544','S-1-5-32-545')){$rights=if($sid -eq 'S-1-5-32-545'){'ReadAndExecute'}else{'FullControl'};$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new($sid),$rights,'ContainerInherit,ObjectInherit','None','Allow'))}
+ [void][IO.Directory]::CreateDirectory($path,$acl);Assert-Protected $path
+}
+function Register-Guard([bool]$enabled) {
+ $action=New-ScheduledTaskAction -Execute $Worker -Argument $WorkerArgs -WorkingDirectory $Root
+ $triggers=@((New-ScheduledTaskTrigger -AtStartup),(New-ScheduledTaskTrigger -Once -At ([DateTime]::Now.AddMinutes(1)) -RepetitionInterval (New-TimeSpan -Minutes 1)))
+ $principal=New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+ $settings=New-ScheduledTaskSettingsSet -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Seconds 30) -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
+ Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $triggers -Principal $principal -Settings $settings -Force | Out-Null
+ # Ordinary sessions can inspect the task; only SYSTEM/administrators can run,
+ # change or remove it. Do not elevate the main application to read status.
+ $scheduler=New-Object -ComObject 'Schedule.Service';$scheduler.Connect()
+ $scheduler.GetFolder('\').GetTask($TaskName).SetSecurityDescriptor('D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GR;;;BU)',0)
+ if(-not $enabled){Disable-ScheduledTask -TaskName $TaskName | Out-Null}
+}
+function Stop-Guard {
+ $task=Read-Task;if($task){Disable-ScheduledTask -TaskName $TaskName | Out-Null;Stop-ScheduledTask -TaskName $TaskName
+  for($i=0;$i -lt 20;$i++){if([string](Read-Task).State -ne 'Running'){break};Start-Sleep -Milliseconds 100}
+  if([string](Read-Task).State -eq 'Running'){throw 'worker still running'}
+  Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false
+ }
+}
+function Zone {if($Fixture){return (Ini (Join-Path $Root 'clock.ini')).timezone};return (Get-TimeZone).Id}
+function Set-Zone($value) {
+ if($value -cnotmatch '^[A-Za-z0-9 +_-]{1,100}$'){throw 'invalid zone'}
+ if($Fixture){[IO.File]::WriteAllText((Join-Path $Root 'clock.ini'),"[guard]`ntimezone=$value`nat_epoch=live`n")}else{Set-TimeZone -Id $value}
+ if((Zone) -cne $value){throw 'zone readback failed'}
+}
+function Record($r) {
+ Save $Receipt $r $true;Save (Join-Path $Root ('receipt-'+$r.id+'.json')) $r $true
+ $log=Join-Path $Root ('lifecycle-'+[DateTime]::UtcNow.ToString('yyyy-MM-dd')+'.jsonl')
+ if(Test-Path -LiteralPath $log){Assert-Protected $log}
+ $entry=@{at_epoch=[DateTimeOffset]::UtcNow.ToUnixTimeSeconds();transaction=$r.id;state=$r.state;action=$r.action;fixture=$Fixture}
+ $bytes=[Text.Encoding]::UTF8.GetBytes(($entry|ConvertTo-Json -Compress)+"`n")
+ $stream=[IO.File]::Open($log,'Append','Write','Read');try{$stream.Write($bytes,0,$bytes.Length);$stream.Flush($true)}finally{$stream.Dispose()}
+ Protect $log $false $true
+}
+'''
+
+TRANSACTION = r'''
+Import-Module (Join-Path $env:PSModulePath 'ScheduledTasks/ScheduledTasks.psd1')
+$planPath=@INPUT@;$expected=@SHA@
+New-Root ([IO.DirectoryInfo]::new($Root).Parent.FullName);New-Root $Root
+$lockPath=Join-Path $Root 'transaction.lock';if(Test-Path -LiteralPath $lockPath){Assert-Protected $lockPath}
+$transactionLock=[IO.File]::Open($lockPath,'OpenOrCreate','ReadWrite','None')
+$stage=Join-Path $Root ('.stage-'+[guid]::NewGuid().ToString('N'));New-Root $stage
+try {
+ Copy-Item -LiteralPath $planPath -Destination (Join-Path $stage 'plan.json');Protect (Join-Path $stage 'plan.json') $false $false
+ if((Hash (Join-Path $stage 'plan.json')) -cne $expected){throw 'plan changed'}
+ $p=Get-Content -LiteralPath (Join-Path $stage 'plan.json') -Raw | ConvertFrom-Json
+ if($p.nonce -cnotmatch '^[a-f0-9]{32}$' -or $p.owner -cnotmatch '^S-1-5(-[0-9]+)+$' -or $p.action -notin @('install','remove','restore')){throw 'invalid plan'}
+ $now=Snapshot
+ if($now.baseline_sha -cne $p.before.baseline_sha -or $now.worker_sha -cne $p.before.worker_sha -or $now.registered -ne $p.before.registered -or $now.enabled -ne $p.before.enabled -or $now.transaction.id -cne $p.before.transaction.id){throw 'state changed'}
+ if($now.baseline.Count -and $now.baseline.owner -cne $p.owner){throw 'foreign owner'}
+ if($p.action -eq 'restore') {
+  $r=$now.transaction;if($r.id -cne $p.restore_id -or $r.owner -cne $p.owner -or $r.state -notin @('committed','pending','partial')){throw 'foreign receipt'}
+  $backup=Join-Path $Root ('backup-'+$r.id);Assert-Protected $backup
+  foreach($name in @('timezone-helper.exe','baseline.ini','state.ini','status.ini')){$old=Join-Path $backup $name;if($r.hashes.$name -and (Hash $old) -cne $r.hashes.$name){throw 'backup changed'}}
+  Stop-Guard
+  foreach($name in @('timezone-helper.exe','baseline.ini','state.ini','status.ini')){
+   $old=Join-Path $backup $name;$dest=Join-Path $Root $name
+   if(Test-Path -LiteralPath $old){if((Hash $old) -cne $r.hashes.$name){throw 'backup changed'};if(Test-Path -LiteralPath $dest){Assert-Protected $dest};Copy-Item -LiteralPath $old -Destination $dest -Force;Protect $dest $false $true}
+   elseif(Test-Path -LiteralPath $dest){Assert-Protected $dest;Remove-Item -LiteralPath $dest -Force}
+  }
+  Set-Zone $r.before_zone
+  if($r.before_registered){Register-Guard ([bool]$r.before_enabled)}
+  $r.state='restored';Record $r
+ } else {
+  if($now.pending){throw 'recovery required'}
+  if((Zone) -cne $p.observed){throw 'zone changed'}
+  if($p.action -eq 'install') {
+   Copy-Item -LiteralPath $p.worker.path -Destination (Join-Path $stage 'worker.exe');Protect (Join-Path $stage 'worker.exe') $false $true
+   if((Hash (Join-Path $stage 'worker.exe')) -cne $p.worker.sha256){throw 'worker changed'}
+  }
+  $backup=Join-Path $Root ('backup-'+$p.nonce);New-Root $backup;$hashes=@{}
+  # Preserve a durable receipt before changing task registration. A captured
+  # pending worker state stays pending on rollback instead of pretending success.
+  foreach($name in @('timezone-helper.exe','baseline.ini','state.ini','status.ini')){
+   $file=Join-Path $Root $name;if(Test-Path -LiteralPath $file){Assert-Protected $file;Copy-Item -LiteralPath $file -Destination (Join-Path $backup $name);Protect (Join-Path $backup $name) $false $true;$hashes[$name]=Hash (Join-Path $backup $name)}
+  }
+  $r=@{format=1;id=$p.nonce;owner=$p.owner;state='pending';before_zone=$p.observed;before_registered=$now.registered;before_enabled=$now.enabled;hashes=$hashes;fixture=$Fixture;action=$p.action}
+  Record $r
+  if($Fixture -and $p.fixture_interrupt){throw 'fixture interruption'}
+  Stop-Guard
+  if($p.action -eq 'install') {
+   if($p.target -cnotmatch '^[A-Za-z0-9 +_-]{1,100}$' -or $p.release -cnotmatch '^v[0-9a-zA-Z.+-]+$'){throw 'invalid target'}
+   Copy-Item -LiteralPath (Join-Path $stage 'worker.exe') -Destination $Worker -Force;Protect $Worker $false $true
+   $original=if($now.baseline.original){$now.baseline.original}else{$p.observed}
+   $ini="[guard]`nformat=1`nowner=$($p.owner)`ntarget=$($p.target)`noriginal=$original`nrelease=$($p.release)`nworker_sha256=$($p.worker.sha256)`nnonce=$($p.nonce)`n"
+   [IO.File]::WriteAllText($Baseline,$ini,[Text.UTF8Encoding]::new($false));Protect $Baseline $false $true
+   foreach($name in @('state.ini','status.ini')){$file=Join-Path $Root $name;if(Test-Path -LiteralPath $file){Assert-Protected $file;Remove-Item -LiteralPath $file -Force}}
+   if($Fixture){& $Worker --once $Root}else{& $Worker --once};if($LASTEXITCODE -ne 0 -or (Zone) -cne $p.target){throw 'worker failed'}
+   Register-Guard $true
+  } else {
+   if($p.restore){Set-Zone $now.baseline.original}
+   if(Test-Path -LiteralPath $Baseline){Assert-Protected $Baseline;Remove-Item -LiteralPath $Baseline -Force}
+  }
+  $r.after_baseline_sha=Hash $Baseline;$r.after_worker_sha=Hash $Worker
+  $r.state='committed';Record $r
+ }
+} catch {if($r -and $r.state -ne 'restored'){$r.state='partial';Record $r};throw}
+finally {
+ # Keep stage and receipts for recovery; never recursively delete system paths.
+ $transactionLock.Dispose()
+}
+'''
+
+
+class WindowsTimezoneIO:
+    fixture = False
+    def __init__(self, *, runner=subprocess.run, worker=None, root=None, task=None, fixture=False):
+        self.runner=runner;self._worker=worker;self.fixture=fixture;self.root=root;self.task=task or 'EnvScope-TimezoneGuard';self.clock=time.time
+        if (root is not None or task is not None) and not fixture:
+            raise ValueError('Production task and path are fixed')
+        if fixture and (not root or not re.fullmatch(r'EnvScope-TimezoneFixture-[a-f0-9]{8,32}',self.task)):
+            raise ValueError('Isolated fixture identity required')
+        self.executable=powershell()
+
+    def worker(self):
+        if self._worker:return self._worker()
+        from .timezone_service import bundle_worker
+        return bundle_worker(system='Windows')
+
+    def script(self, tail):
+        root=quote(Path(self.root).resolve()) if self.fixture else "(Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) 'EnvScope/TimezoneGuard')"
+        args=quote('--once "'+str(Path(self.root).resolve())+'"') if self.fixture else "'--once'"
+        header=HEADER.replace('@PROTECTION@',PROTECTION)
+        return header.replace('@ROOT@',root).replace('@TASK@',quote(self.task)).replace('@FIXTURE@','$true' if self.fixture else '$false').replace('@ARGS@',args)+tail
+
+    def _read(self, tail):
+        encoded=base64.b64encode(self.script(tail).encode('utf-16-le')).decode()
+        value=self.runner([self.executable,'-NoProfile','-NonInteractive','-EncodedCommand',encoded],capture_output=True,timeout=15,creationflags=getattr(subprocess,'CREATE_NO_WINDOW',0))
+        if value.returncode or len(value.stdout or b'')>131072:
+            raise ValueError('无法核实系统时区任务权限、归属或记录。')
+        return json.loads(value.stdout)
+
+    def inspect(self):
+        value=self._read('$value=Snapshot;$value.current_owner=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value;$value | ConvertTo-Json -Depth 12 -Compress')
+        self._owner=value.pop('current_owner');return value
+    def owner(self):
+        if not hasattr(self,'_owner'):self.inspect()
+        return self._owner
+    def authority(self):
+        value=self.inspect();beat=value.get('status',{})
+        return {**value,'registered':value['registered'] and value['enabled'],'foreign_owner':bool(value['baseline']) and value['baseline'].get('owner')!=self.owner(),
+                'status':{**beat,'at_epoch':float(beat.get('at_epoch',0)),'initial':beat.get('initial')!='0'}}
+
+    def execute(self,payload):
+        data=json.dumps(payload,sort_keys=True).encode()
+        with tempfile.TemporaryDirectory(prefix='envscope-timezone-') as folder:
+            path=Path(folder).resolve()/'plan.json';path.write_bytes(data)
+            code=self.script(TRANSACTION.replace('@INPUT@',quote(path)).replace('@SHA@',quote(hashlib.sha256(data).hexdigest())))
+            # Keep the reviewed source readable. The bounded elevated entry point
+            # hashes one in-memory snapshot, then runs precisely those bytes.
+            # No mutable script path is retained by the SYSTEM task.
+            source=Path(folder).resolve()/'installer.ps1';source.write_bytes(code.encode('utf-8'))
+            bootstrap=installer_bootstrap(source,hashlib.sha256(source.read_bytes()).hexdigest())
+            encoded=base64.b64encode(bootstrap.encode('utf-16-le')).decode()
+            command=[self.executable,'-NoProfile','-NonInteractive','-EncodedCommand',encoded]
+            if len(subprocess.list2cmdline(command).encode('utf-16-le'))//2>32600:raise ValueError('时区操作超出命令长度限制，未执行。')
+            launcher=("$ErrorActionPreference='Stop';$code=[Console]::In.ReadToEnd();if($code -cnotmatch '^[A-Za-z0-9+/=]+$' -or $code.Length -gt 32500){exit 65};"
+                "$o=@{FilePath="+quote(self.executable)+";ArgumentList=@('-NoProfile','-NonInteractive','-EncodedCommand',$code);WindowStyle='Hidden';Wait=$true;PassThru=$true};"
+                "$p=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent());if(-not $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){$o.Verb='RunAs'};"
+                "try{$v=Start-Process @o;exit $v.ExitCode}catch{$e=$_.Exception;while($e){if($e -is [ComponentModel.Win32Exception]){exit $e.NativeErrorCode};$e=$e.InnerException};exit 1}")
+            result=self.runner([self.executable,'-NoProfile','-NonInteractive','-Command',launcher],input=encoded.encode(),capture_output=True,timeout=150,creationflags=getattr(subprocess,'CREATE_NO_WINDOW',0))
+            raise_for_consent(result,'Windows')
+
+
+def installer_bootstrap(source, expected):
+    """Bind a foreground consent request to readable, byte-exact source.
+
+    Loading the snapshot once avoids a verify/execute path race. OS application
+    control and PowerShell language restrictions still apply; no policy changes
+    or execution-policy switches are made here.
+    """
+    if not re.fullmatch(r'[a-f0-9]{64}',expected):raise ValueError('Invalid source digest')
+    return ("$ErrorActionPreference='Stop';$path="+quote(source)+";"
+            "if((Get-Item -LiteralPath $path).Length -gt 196608){throw 'oversized installer'};"
+            "$bytes=[IO.File]::ReadAllBytes($path);$hash=[Security.Cryptography.SHA256]::Create();"
+            "try{$actual=([BitConverter]::ToString($hash.ComputeHash($bytes))).Replace('-','').ToLowerInvariant()}finally{$hash.Dispose()};"
+            "if($actual -cne '"+expected+"'){throw 'reviewed installer changed'};"
+            "$source=[Text.UTF8Encoding]::new($false,$true).GetString($bytes);"
+            "& ([scriptblock]::Create($source))")
+
+
+def stable(value):
+    return {key:value.get(key) for key in ('baseline_sha','worker_sha','registered','enabled')} | {'transaction':{'id':value.get('transaction',{}).get('id')}}
+
+
+class WindowsTimezoneService:
+    system='Windows'
+    def __init__(self,store,reader,*,io=None,**kwargs):
+        self.store,self.reader=store,reader;self.io=io or WindowsTimezoneIO();self.plans={}
+
+    def status(self):
+        try:
+            snapshot=self.io.inspect();base=snapshot['baseline'];beat=snapshot['status'];receipt=snapshot.get('transaction',{})
+            owner=base.get('owner')==self.io.owner() if base else receipt.get('owner')==self.io.owner()
+            stamp=float(beat.get('at_epoch',0));current=(beat.get('format')=='1' and beat.get('guard_policy')=='2' and beat.get('target')==base.get('target') and beat.get('release')==base.get('release') and beat.get('fixture')==str(int(self.io.fixture)) and beat.get('initial')=='0' and 0<=self.io.clock()-stamp<180)
+            state=('recovery_required' if snapshot['pending'] else 'conflict' if base and not owner else 'not_installed' if not base else
+                   'unregistered' if not snapshot['registered'] or not snapshot['enabled'] else 'waiting' if not current else
+                   'active' if beat.get('state') in ('healthy','restored') and beat.get('observed')==base.get('target') else 'attention')
+            reasons={'recovery_required':'上次系统时区操作未完成，请先预览恢复。','conflict':'时区任务属于另一用户，未覆盖其基线。',
+                     'not_installed':'尚未授权独立的系统时区任务。','unregistered':'时区任务未注册或被停用，请重新预览。',
+                     'waiting':'等待当前基线的有效心跳，尚未计为自动守护正常。','active':'系统时区基线已读回，每 60 秒检查；后台不弹授权窗口。',
+                     'attention':'系统时区保持需要处理，请查看记录后重新审核。'}
+            return {'supported':True,'state':state,'reason':reasons[state],'installed':bool(base),'registered':snapshot['registered'] and snapshot['enabled'],
+                    'owner':owner,'target':base.get('target'),'original':base.get('original'),'observed':beat.get('observed'),'heartbeat_at':stamp,
+                    'pending':snapshot['pending'],'needs_update':bool(base) and base.get('release')!=__release__,
+                    'can_undo':owner and receipt.get('state')=='committed','release':base.get('release'),
+                    'intentionally_removed':not base and owner and (receipt.get('state')=='restored' or receipt.get('state')=='committed' and receipt.get('action')=='remove'),
+                    'journal_path':'%ProgramData%/EnvScope/TimezoneGuard','capability':'protected-native-task'}
+        except (OSError,ValueError,TypeError,KeyError,subprocess.SubprocessError):
+            return {'supported':True,'state':'attention','reason':'系统时区任务权限或归属未能核实，未报告守护正常。'}
+
+    def prepare(self,report,*,remove=False,restore=False):
+        if type(remove) is not bool or type(restore) is not bool:raise ValueError('时区选项无效')
+        from .remedies import SolutionPlans
+        from .regions import region_finding,PARTIAL
+        from .model import Status
+        settings=self.store.settings()
+        if not remove and (not SolutionPlans._current(report) or not settings.get('environment_confirmed') or report.get('environment',{}).get('fingerprint')!=fingerprint(settings)):
+            return {'state':'retest_required','reason':'先按当前目标完成新的检测，再授权时区保持。'}
+        if not remove and (not settings.get('usage_country') or settings['usage_country'] in PARTIAL or region_finding([],settings).status==Status.FAIL or not any(f['id']=='target.region' and f['status']=='pass' for f in report.get('findings',[]))):
+            return {'state':'blocked','reason':'官方地区条件未核实通过，未生成环境修改。'}
+        snapshot=self.io.inspect();base=snapshot['baseline'];owner=self.io.owner()
+        if snapshot['pending']:return {'state':'recovery_required','reason':'请先恢复上次未完成的时区事务。'}
+        if base and base.get('owner')!=owner:return {'state':'blocked','reason':'时区基线属于另一用户。'}
+        if remove and not base:return {'state':'guided','reason':'没有已安装的系统时区保持任务。'}
+        observed=current_region(self.reader())['timezone'];target=base.get('target') if remove else settings.get('timezone')
+        from .region_profiles import profiles
+        if target not in {p['timezone'] for p in profiles('Windows')} or not re.fullmatch('[A-Za-z0-9 +_-]{1,100}',observed):
+            return {'state':'guided','reason':'请先选择可核对的城市与系统时区。'}
+        worker=self.io.worker() if not remove else None
+        payload={'nonce':secrets.token_hex(16),'owner':owner,'action':'remove' if remove else 'install','before':stable(snapshot),
+                 'observed':observed,'target':target,'restore':restore,'worker':worker,'release':__release__}
+        return self._plan(payload, ['申请一次 Windows 系统授权；仅运行受保护的原生时区任务，影响整台电脑。',
+            ('停用时区任务；'+('恢复安装前时区 '+base['original'] if restore else '保留当前时区。')) if remove else
+            '保持 '+target+'；每 60 秒检查，每次修复前留痕，至少间隔 5 分钟、24 小时最多恢复 3 次。',
+            '失败或中断时暂停自动写入并保留日志、备份；主应用和账号操作继续以普通用户运行。'])
+
+    def _plan(self,payload,effects):
+        token=secrets.token_urlsafe(20);signature=hashlib.sha256(json.dumps(payload['before'],sort_keys=True).encode()).hexdigest()
+        self.plans={token:{'payload':payload,'deadline':time.monotonic()+90,'fingerprint':fingerprint(self.store.settings())}}
+        return {'state':'planned','plan_id':token,'effects':effects,'transaction_nonce':payload.get('restore_id',payload['nonce']),
+                'before_signature':signature,'reason':'核对后确认；Windows 仅在实际系统操作时申请授权。'}
+
+    def apply(self,token,confirmed=False):
+        if confirmed is not True:return {'state':'confirmation_required'}
+        plan=self.plans.get(token) if isinstance(token,str) else None
+        if not plan or time.monotonic()>plan['deadline'] or plan['fingerprint']!=fingerprint(self.store.settings()):return {'state':'retest_required','reason':'方案已过期或目标改变，请重新预览。'}
+        payload=plan['payload'];snapshot=self.io.inspect()
+        if stable(snapshot)!=payload['before'] or (payload['action']=='install' and self.io.worker()!=payload['worker']):return {'state':'retest_required','reason':'服务或辅助程序已改变，请重新预览。'}
+        del self.plans[token]
+        try:self.io.execute(payload)
+        except (OSError,ValueError,subprocess.SubprocessError) as exc:
+            return {'state':'partial','reason':str(exc)[:240],'status':self.status(),**operation_outcome(exc),'transaction_nonce':payload.get('restore_id',payload['nonce'])}
+        after=self.io.inspect();r=after.get('transaction',{});nonce=payload.get('restore_id',payload['nonce'])
+        good=r.get('id')==nonce and r.get('state')==('restored' if payload['action']=='restore' else 'committed') and not after['pending']
+        if payload['action']=='install':good=good and after['registered'] and after['enabled'] and after['baseline'].get('target')==payload['target'] and current_region(self.reader())['timezone']==payload['target']
+        elif payload['action']=='remove':good=good and not after['registered'] and not after['baseline']
+        return {'state':'completed' if good else 'partial','status':self.status(),'needs_retest':True,'transaction_nonce':nonce,
+                'reason':'系统时区操作已读回，请复检并确认后台心跳。' if good else '实际状态未完整读回，请保留记录并恢复。'}
+
+    def _restore_plan(self,*,pending=False,nonce=None):
+        snapshot=self.io.inspect();record=snapshot.get('transaction',{});owner=self.io.owner()
+        if record.get('owner')!=owner:return {'state':'blocked','reason':'恢复记录不属于当前用户。'}
+        if nonce and record.get('id')!=nonce:return {'state':'retest_required','reason':'已有后续时区操作，未覆盖。'}
+        if (pending and not snapshot['pending']) or record.get('state') not in ('committed','partial','pending'):return {'state':'guided','reason':'没有符合条件的恢复记录。'}
+        if record.get('state')=='committed' and (record.get('after_baseline_sha')!=snapshot['baseline_sha'] or record.get('after_worker_sha')!=snapshot['worker_sha']):
+            return {'state':'blocked','reason':'事务完成后的系统基线或程序又有变化，未覆盖后续修改。'}
+        payload={'nonce':secrets.token_hex(16),'owner':owner,'action':'restore','before':stable(snapshot),'restore_id':record['id']}
+        return self._plan(payload,['申请系统授权，停止当前时区任务，并恢复最新事务保存的时区、辅助程序与后台任务状态。','保留完整备份和日志；恢复后重新检测。'])
+
+    def prepare_recovery(self):return self._restore_plan(pending=True)
+    def prepare_undo(self,nonce=None):return self._restore_plan(nonce=nonce)
+    def recover(self,token,confirmed=False):return self.apply(token,confirmed)
+    def undo(self,token,confirmed=False):return self.apply(token,confirmed)
+    def rollback_latest(self,nonce,confirmed=False,*,unchanged_signature=None):
+        if confirmed is not True:return {'state':'confirmation_required'}
+        snapshot=self.io.inspect()
+        if snapshot.get('transaction',{}).get('id')!=nonce and unchanged_signature==hashlib.sha256(json.dumps(stable(snapshot),sort_keys=True).encode()).hexdigest():return {'state':'completed','reason':'时区任务尚未变化。'}
+        plan=self._restore_plan(nonce=nonce)
+        return self.apply(plan['plan_id'],True) if plan.get('state')=='planned' else plan
diff --git a/envscope/watchdog.py b/envscope/watchdog.py
index e189070..e696046 100644
--- a/envscope/watchdog.py
+++ b/envscope/watchdog.py
@@ -28,7 +28,7 @@ def native_write(key, value, system=None, runner=_run):
         command=([str(Path(os.environ.get('SystemRoot','C:/Windows'))/'System32/tzutil.exe'),'/s',value]
                  if system=='Windows' else ['/usr/sbin/systemsetup','-settimezone',value])
         if system not in ('Windows','Darwin') or runner(command,timeout=15).returncode:
-            raise ValueError('后台没有修改时区的权限；请在持续维护页授权 macOS 系统时区守护，或在系统设置处理')
+            raise ValueError('后台没有修改时区的权限；请在守护方案中授权系统时区守护，或在系统设置处理')
     else:
         set_system_value(system,key,value,runner)
 
@@ -86,19 +86,28 @@ def launch_proxy(client,system=None):
 
 
 class Watchdog:
-    def __init__(self,home=None,system=None,reader=None,writer=None,controller=None,clients=None,launcher=None,listener=None,tester=None,sleeper=None,authority=None):
+    def __init__(self,home=None,system=None,reader=None,writer=None,controller=None,clients=None,launcher=None,listener=None,tester=None,sleeper=None,authority=None,capability_reader=None):
         self.home=Path(home or Path.home());self.system=system or platform.system()
         self.reader=reader or collect;self.writer=writer or (lambda k,v:native_write(k,v,self.system))
         self.controller=controller or (lambda:discover_controller(self.home,self.system))
         self.clients=clients or (lambda:proxy_apps(self.home,self.system));self.launcher=launcher or (lambda c:launch_proxy(c,self.system))
         self.listener=listener or proxy_alive;self.tester=tester or proxy_works;self.sleep=sleeper or time.sleep
         self.authority=authority
+        from .guard_capabilities import write_capabilities
+        self.capability_reader=capability_reader or (lambda:{'timezone':{'state':'available','source':'injected-writer'}} if writer else write_capabilities(self.system))
         if authority is None and self.system=='Darwin' and platform.system()=='Darwin' and reader is None and writer is None:
             from .timezone_service import NativeTimezoneIO
-            self.authority=NativeTimezoneIO().inspect
+            native_io=NativeTimezoneIO()
+            def native_authority():
+                value=native_io.inspect();base=value.get('baseline',{})
+                return {**value,'foreign_owner':bool(base) and base.get('owner_uid')!=os.getuid()}
+            self.authority=native_authority
+        if authority is None and self.system=='Windows' and platform.system()=='Windows' and reader is None and writer is None:
+            from .timezone_windows import WindowsTimezoneIO
+            self.authority=WindowsTimezoneIO().authority
 
     def options(self):
-        return {'clients':self.clients(),'note':'仅重开已安装并明确选择的客户端；不安装、强杀进程或回退直连。macOS 时区可在本页单独授权系统守护；用户任务不会弹出管理员授权。'}
+        return {'clients':self.clients(),'capabilities':self.capability_reader(),'note':'仅重开已安装并明确选择的客户端；不安装、强杀进程或回退直连。时区保持按需单独授权系统守护；后台不会弹出管理员授权。'}
 
     def validate(self,baseline):
         from .region_profiles import profiles
@@ -115,7 +124,7 @@ def validate(self,baseline):
                         or not re.fullmatch('[a-f0-9]{64}',client['sha256'])):raise ValueError('批准的客户端基线无效')
             if any(k in value for k in ('group','node','identity')) and not all(isinstance(value.get(k),str) and 0<len(value[k])<=240 for k in ('group','node','identity')):raise ValueError('节点守护基线无效')
 
-    def prepare(self,settings,options):
+    def prepare(self,settings,options,*,allow_authorization=False):
         allowed={'timezone','locale','proxy','client'}
         if not isinstance(options,dict) or set(options)-allowed or any(type(options.get(k,False)) is not bool for k in ('timezone','locale','proxy')):
             raise ValueError('守护选项无效')
@@ -125,6 +134,8 @@ def prepare(self,settings,options):
             if not options.get(key):continue
             if not selected or settings.get(key)!=selected[key] or observed[key]!=selected[key]:
                 raise ValueError('先将'+label+'配置到已选城市目标并复检，再保存守护基线')
+            if key=='timezone' and self.capability_reader().get('timezone',{}).get('state')!='available' and not allow_authorization:
+                raise ValueError('后台时区权限尚未核实或需要授权，请先预览系统时区守护方案')
             result[key]=selected[key];effects.append('保持'+label+'：'+selected[key]+'；漂移时读回核对并恢复，权限不足转为手动处理')
         if options.get('proxy'):
             url=settings.get('target_proxy')
@@ -181,12 +192,11 @@ def mark(state,note):
                         if controller.identity!=target['identity'] or not row:raise ValueError('节点控制配置变化，需重新批准基线')
                     drift=not good or row is not None and row['now']!=target['node']
                 else:drift=observed.get(key)!=target
-                if not drift:mark('healthy','批准的'+label+'基线正常');continue
-                if key=='timezone' and self.system=='Darwin' and self.authority:
+                if key=='timezone' and self.authority:
                     try:authority=self.authority()
                     except (OSError,ValueError,RuntimeError,subprocess.SubprocessError):
                         mark('attention','系统时区服务状态无法核实，未并发写入；请在持续维护页核对。');continue
-                    if authority.get('pending') or authority.get('legacy_registered'):
+                    if authority.get('pending') or authority.get('legacy_registered') or authority.get('foreign_owner'):
                         mark('attention','系统时区服务有未完成操作或旧任务冲突，请先在持续维护页处理。');continue
                     if authority.get('baseline') and (not authority.get('registered') or authority['baseline'].get('target')!=target):
                         mark('attention','系统时区守护与用户任务的基线不一致或尚未注册；未覆盖，请重新批准本次维护方案。');continue
@@ -194,8 +204,11 @@ def mark(state,note):
                         heartbeat=authority.get('status',{});stamp=heartbeat.get('at_epoch')
                         healthy=(type(stamp) in (int,float) and 0<=now-stamp<180
                                  and heartbeat.get('state') in ('healthy','restored','repairing','cooldown') and heartbeat.get('initial') is False)
-                        mark('delegated' if healthy else 'attention','时区漂移已交给获授权的系统守护，等待下次 60 秒检查并读回。' if healthy else '已注册系统时区守护，但心跳过期或恢复已暂停；请在本页核对状态并重新批准。')
+                        mark(('delegated' if drift else 'healthy') if healthy else 'attention',('时区漂移已交给获授权的系统守护，等待下次 60 秒检查并读回。' if drift else '批准的时区基线及系统守护心跳正常') if healthy else '已注册系统时区守护，但心跳过期或恢复已暂停；请在本页核对状态并重新批准。')
                         continue
+                if key=='timezone' and self.capability_reader().get('timezone',{}).get('state')!='available':
+                    mark('attention','后台时区权限尚未取得或已撤销，请在持续维护中重新审核授权。');continue
+                if not drift:mark('healthy','批准的'+label+'基线正常');continue
                 attempts=record.get('attempts',[])
                 if any(not isinstance(t,(int,float)) or t>now for t in attempts):raise ValueError('守护时间记录异常，请核对系统时钟')
                 attempts=[t for t in attempts if now-t<86400]
diff --git a/envscope/web/app.mjs b/envscope/web/app.mjs
index f3022c8..f756bea 100644
--- a/envscope/web/app.mjs
+++ b/envscope/web/app.mjs
@@ -28,6 +28,10 @@ const sessionPromise=(async()=>{
 })();
 initConnection(sessionPromise);
 initCoverage();
+document.addEventListener('envscope-open-guard',()=>{document.querySelector('[data-page="upkeep"]').click();byId('guard-alert').hidden=true;});
+document.addEventListener('envscope-guard-attention',event=>{byId('guard-alert').hidden=false;byId('guard-alert-message').textContent=event.detail.message;});
+document.addEventListener('envscope-guard-clear',()=>{byId('guard-alert').hidden=true;});
+byId('guard-alert-open').addEventListener('click',()=>document.dispatchEvent(new CustomEvent('envscope-open-guard')));
 const environment={timezone:Intl.DateTimeFormat().resolvedOptions().timeZone||"unknown",languages:[...navigator.languages],
   platform:navigator.userAgentData?.platform||navigator.platform||"unknown",automated:navigator.webdriver===true};
 const envRows=[["时区",environment.timezone],["语言",environment.languages.join(" · ")],["运行环境",environment.platform+(environment.automated?" / 自动化会话":"")]];
diff --git a/envscope/web/index.html b/envscope/web/index.html
index 48609d8..2941361 100644
--- a/envscope/web/index.html
+++ b/envscope/web/index.html
@@ -20,6 +20,7 @@
     </nav>
   </div>
   <main id="workspace" data-state="ready">
+    <section id="guard-alert" class="connection-banner" role="status" hidden><p id="guard-alert-message"></p><button id="guard-alert-open" class="link">打开守护方案</button></section>
     <section id="permission-status" class="connection-banner" role="status" hidden><p id="permission-message"></p><button id="permission-resume" class="link" hidden>我已处理，继续检测</button><button id="permission-cancel" class="link" hidden>停止自动复检</button></section>
     <section id="connection-banner" class="connection-banner" role="status" hidden><strong id="connection-title">本地服务已断开</strong><p id="connection-message">请重新双击 EnvScope 启动器，并使用它新打开的页面；旧地址可能已经失效。</p><button id="connection-retry" class="link">重新连接本页</button></section>
     <p id="connection-status" class="connection-status" role="status">正在连接本地服务…</p><div id="catalog-error" class="connection-banner" role="status" hidden><p>功能列表暂时无法读取。环境信息仍可单独查看；账号和维护操作请先重新读取列表。</p><button id="catalog-retry" class="link">重新读取功能列表</button></div>
@@ -204,15 +205,15 @@ <h3 id="process-guard-state">未启用</h3><p id="process-guard-status" class="n
         <div id="process-guard-plan"></div><div id="process-guard-output" class="solution-output" aria-live="polite"></div>
         <details><summary>进程守护记录</summary><p id="process-guard-journal" class="note"></p><button id="process-guard-logs" class="link">打开守护日志</button><div id="process-guard-events" class="note"></div></details>
       </section>
-      <section class="tool-section" id="timezone-service-panel" hidden><h2>macOS 系统时区守护</h2>
-        <p class="note">首次配置申请系统授权，之后每 60 秒检查批准时区。影响整台 Mac 的所有用户；修复后读回验证，连续失败暂停并保留记录。</p>
+      <section class="tool-section" id="timezone-service-panel" hidden><h2>系统时区守护</h2>
+        <p class="note">首次配置申请系统授权，之后每 60 秒检查批准时区。影响整台电脑的所有用户；修复后读回验证，连续失败暂停并保留记录。</p>
         <h3 id="timezone-service-state">尚未读取</h3><p id="timezone-service-status" class="note" role="status"></p><a class="note" href="https://github.com/qudadd/envscope/blob/main/docs/TIMEZONE_SERVICE.md" target="_blank" rel="noreferrer">权限、旧任务冲突与手动处理说明</a>
         <div class="actions"><button id="timezone-service-prepare">预览安装或更新</button><button id="timezone-service-refresh" class="link">刷新状态</button></div>
         <label class="checkbox"><input id="timezone-service-restore" type="checkbox">移除时恢复安装前的系统时区</label>
         <div class="actions"><button id="timezone-service-stop" class="link" disabled>预览停用并移除</button><button id="timezone-service-recover" hidden>预览恢复未完成操作</button><button id="timezone-service-undo" class="link" hidden>预览撤销上次操作</button></div>
         <div id="timezone-service-plan"></div><div id="timezone-service-output" class="solution-output" aria-live="polite"></div><p id="timezone-service-journal" class="note"></p>
       </section>
-      <section class="tool-section"><h2>维护方案</h2><p class="note">先完成一键检测，再以当前设置生成方案。Windows 使用当前用户计划任务，macOS 使用用户 LaunchAgent。macOS 系统时区守护在上方单独授权；移动应用目录后需重新启用用户巡检。</p>
+      <section class="tool-section"><h2>维护方案</h2><p class="note">先完成一键检测，再以当前设置生成方案。Windows 使用当前用户计划任务，macOS 使用用户 LaunchAgent。需要额外权限的系统时区守护在上方单独授权；移动应用目录后需重新启用用户巡检。</p>
         <label>复检间隔<select id="upkeep-interval"><option value="5">5 分钟</option><option value="15" selected>15 分钟</option><option value="60">60 分钟</option></select></label>
         <label class="checkbox"><input id="upkeep-restore" type="checkbox">保持已批准的 Code 代理和 TLS 配置</label>
         <label class="checkbox"><input id="upkeep-guard-timezone" type="checkbox">时区漂移时恢复批准值</label>
@@ -223,7 +224,7 @@ <h3 id="timezone-service-state">尚未读取</h3><p id="timezone-service-status"
         <button id="upkeep-prepare">生成维护方案</button><div id="upkeep-plan"></div><div id="upkeep-output" class="solution-output" aria-live="polite"></div>
       </section>
       <section class="tool-section"><h2>最近事件</h2><p class="note">此处展示最近 20 条；完整事件按日追加到本机日志，不随界面记录轮替删除。先记录漂移与计划动作，再执行、读回和复检。备份仅存本机。</p><p id="upkeep-journal" class="note"></p><button id="upkeep-open-logs" class="link">打开完整日志目录</button><div id="upkeep-events"><p class="note">尚无维护事件。</p></div></section>
-      <section class="limits"><h2>仍需你确认的项目</h2><p>浏览器 WebRTC、账号登录和系统授权需本人确认。只有单独批准进程守护才会自动停止 Claude。后台不弹出提权对话框、不安装代理、不切换账号；macOS 系统时区守护需先在上方授权，其他维护任务没有写入权限时保留失败记录和手动指引。</p></section>
+      <section class="limits"><h2>仍需你确认的项目</h2><p>浏览器 WebRTC、账号登录和系统授权需本人确认。只有单独批准进程守护才会自动停止 Claude。系统时区守护需先授权，其他维护任务没有写入权限时保留失败记录和手动指引。</p></section>
     </div>
 
     <div id="page-coverage" class="page" hidden>
diff --git a/native/timezone_windows.c b/native/timezone_windows.c
new file mode 100644
index 0000000..d277448
--- /dev/null
+++ b/native/timezone_windows.c
@@ -0,0 +1,194 @@
+/* Restricted Windows timezone worker. No shell, user scripts or network. */
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x0A00
+#endif
+#ifndef WINVER
+#define WINVER 0x0A00
+#endif
+#ifndef UNICODE
+#define UNICODE
+#endif
+#ifndef _UNICODE
+#define _UNICODE
+#endif
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <shlobj.h>
+#include <aclapi.h>
+#include <bcrypt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <wchar.h>
+#include <time.h>
+#include <string.h>
+
+#ifndef ENVSCOPE_RELEASE
+#define ENVSCOPE_RELEASE "development"
+#endif
+#ifndef ENVSCOPE_FIXTURE
+#define ENVSCOPE_FIXTURE 0
+#endif
+static wchar_t root[MAX_PATH], target[128], observed[128];
+static int fixture = ENVSCOPE_FIXTURE;
+#if ENVSCOPE_FIXTURE
+static int live_clock=0;
+#endif
+static long long epoch;
+
+static int system_identity(void) {
+    HANDLE token=NULL;BYTE user[1024],sid[SECURITY_MAX_SID_SIZE];DWORD used=0,size=sizeof(sid);int ok=0;
+    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&token))return 0;
+    if(GetTokenInformation(token,TokenUser,user,sizeof(user),&used)&&CreateWellKnownSid(WinLocalSystemSid,NULL,sid,&size))ok=EqualSid(((TOKEN_USER*)user)->User.Sid,sid);
+    CloseHandle(token);return ok;
+}
+static int drop_privileges(void) {
+    HANDLE token=NULL;if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&token))return 0;
+    int ok=AdjustTokenPrivileges(token,TRUE,NULL,0,NULL,NULL);CloseHandle(token);return ok;
+}
+
+static int path_for(wchar_t *out, const wchar_t *name) {
+    return swprintf(out, MAX_PATH, L"%ls\\%ls", root, name) > 0 && wcslen(out) < MAX_PATH-1;
+}
+static int safe_file(const wchar_t *path, int optional) {
+    DWORD attributes=GetFileAttributesW(path);
+    if(attributes==INVALID_FILE_ATTRIBUTES)return optional && GetLastError()==ERROR_FILE_NOT_FOUND;
+    if(attributes & FILE_ATTRIBUTE_REPARSE_POINT)return 0;
+    if(fixture)return 1;
+    PSID owner=NULL; PACL acl=NULL; PSECURITY_DESCRIPTOR sd=NULL;
+    BYTE system[SECURITY_MAX_SID_SIZE], admins[SECURITY_MAX_SID_SIZE];
+    DWORD a=sizeof(system), b=sizeof(admins); int ok=1;
+    if(!CreateWellKnownSid(WinLocalSystemSid,NULL,system,&a) || !CreateWellKnownSid(WinBuiltinAdministratorsSid,NULL,admins,&b))return 0;
+    if(GetNamedSecurityInfoW((LPWSTR)path,SE_FILE_OBJECT,OWNER_SECURITY_INFORMATION|DACL_SECURITY_INFORMATION,&owner,NULL,&acl,NULL,&sd)!=ERROR_SUCCESS)return 0;
+    if(!owner || !acl || (!EqualSid(owner,system) && !EqualSid(owner,admins)))ok=0;
+    for(DWORD i=0;ok && i<acl->AceCount;i++) {
+        void *raw=NULL; if(!GetAce(acl,i,&raw)){ok=0;break;}
+        ACE_HEADER *header=(ACE_HEADER*)raw;
+        if(header->AceFlags & INHERIT_ONLY_ACE)continue;
+        if(header->AceType!=ACCESS_ALLOWED_ACE_TYPE && header->AceType!=ACCESS_DENIED_ACE_TYPE){ok=0;break;}
+        if(header->AceType==ACCESS_ALLOWED_ACE_TYPE) {
+            ACCESS_ALLOWED_ACE *ace=(ACCESS_ALLOWED_ACE*)raw; PSID sid=(PSID)&ace->SidStart;
+            DWORD writes=FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES|FILE_DELETE_CHILD|DELETE|WRITE_DAC|WRITE_OWNER|GENERIC_WRITE|GENERIC_ALL;
+            if((ace->Mask&writes) && !EqualSid(sid,system) && !EqualSid(sid,admins))ok=0;
+        }
+    }
+    LocalFree(sd);return ok;
+}
+static int read_value(const wchar_t *file,const wchar_t *key,wchar_t *value,DWORD size) {
+    wchar_t path[MAX_PATH];if(!path_for(path,file)||!safe_file(path,0))return 0;
+    DWORD n=GetPrivateProfileStringW(L"guard",key,L"",value,size,path);
+    return n>0 && n<size-1;
+}
+static int text_safe(const wchar_t *v) {
+    size_t n=wcslen(v);if(!n||n>100)return 0;
+    for(size_t i=0;i<n;i++)if(!((v[i]>=L'A'&&v[i]<=L'Z')||(v[i]>=L'a'&&v[i]<=L'z')||(v[i]>=L'0'&&v[i]<=L'9')||wcschr(L" _+-",v[i])))return 0;
+    return 1;
+}
+static int replace_text(const wchar_t *name,const char *data) {
+    wchar_t path[MAX_PATH], temp[MAX_PATH];if(!path_for(path,name)||!path_for(temp,L"write.tmp")||!safe_file(path,1)||!safe_file(temp,1))return 0;
+    HANDLE h=CreateFileW(temp,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+    if(h==INVALID_HANDLE_VALUE)return 0;
+    DWORD written=0, size=(DWORD)strlen(data);int ok=WriteFile(h,data,size,&written,NULL)&&written==size&&FlushFileBuffers(h);
+    CloseHandle(h);return ok && MoveFileExW(temp,path,MOVEFILE_REPLACE_EXISTING|MOVEFILE_WRITE_THROUGH);
+}
+static int ascii(const wchar_t *in,char *out,int size) {
+    return WideCharToMultiByte(CP_UTF8,0,in,-1,out,size,NULL,NULL)>0;
+}
+static int own_hash(wchar_t out[65]) {
+    wchar_t file[MAX_PATH];BYTE digest[32], buffer[16384];BCRYPT_ALG_HANDLE alg=NULL;BCRYPT_HASH_HANDLE hash=NULL;
+    if(!GetModuleFileNameW(NULL,file,MAX_PATH)||!safe_file(file,0))return 0;
+    HANDLE h=CreateFileW(file,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+    if(h==INVALID_HANDLE_VALUE)return 0;
+    int ok=BCryptOpenAlgorithmProvider(&alg,BCRYPT_SHA256_ALGORITHM,NULL,0)==0 && BCryptCreateHash(alg,&hash,NULL,0,NULL,0,0)==0;
+    DWORD count;while(ok){if(!ReadFile(h,buffer,sizeof(buffer),&count,NULL)){ok=0;break;}if(!count)break;ok=BCryptHashData(hash,buffer,count,0)==0;}
+    if(ok)ok=BCryptFinishHash(hash,digest,sizeof(digest),0)==0;
+    if(hash)BCryptDestroyHash(hash);if(alg)BCryptCloseAlgorithmProvider(alg,0);CloseHandle(h);
+    if(ok){for(int i=0;i<32;i++)swprintf(out+i*2,3,L"%02x",digest[i]);out[64]=0;}return ok;
+}
+static int read_zone(void) {
+#if ENVSCOPE_FIXTURE
+    return read_value(L"clock.ini",L"timezone",observed,128)&&text_safe(observed);
+#else
+    DYNAMIC_TIME_ZONE_INFORMATION value;
+    if(GetDynamicTimeZoneInformation(&value)==TIME_ZONE_ID_INVALID)return 0;
+    wcscpy_s(observed,128,value.TimeZoneKeyName);return text_safe(observed);
+#endif
+}
+static int write_zone(void) {
+#if ENVSCOPE_FIXTURE
+    char zone[256], data[512];if(!ascii(target,zone,sizeof(zone)))return 0;
+    if(live_clock)snprintf(data,sizeof(data),"[guard]\ntimezone=%s\nat_epoch=live\n",zone);
+    else snprintf(data,sizeof(data),"[guard]\ntimezone=%s\nat_epoch=%lld\n",zone,epoch);
+    return replace_text(L"clock.ini",data);
+#else
+    DYNAMIC_TIME_ZONE_INFORMATION zone;int found=0;
+    for(DWORD i=0;EnumDynamicTimeZoneInformation(i,&zone)==ERROR_SUCCESS;i++)if(wcscmp(zone.TimeZoneKeyName,target)==0){found=1;break;}
+    if(!found)return 0;
+    HANDLE token=NULL;TOKEN_PRIVILEGES privileges,previous;DWORD size=sizeof(previous);
+    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&token))return 0;
+    privileges.PrivilegeCount=1;privileges.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
+    int ok=LookupPrivilegeValueW(NULL,SE_TIME_ZONE_NAME,&privileges.Privileges[0].Luid);
+    if(ok){SetLastError(ERROR_SUCCESS);ok=AdjustTokenPrivileges(token,FALSE,&privileges,sizeof(previous),&previous,&size)&&GetLastError()==ERROR_SUCCESS;}
+    if(ok){zone.DynamicDaylightTimeDisabled=FALSE;ok=SetDynamicTimeZoneInformation(&zone);AdjustTokenPrivileges(token,FALSE,&previous,0,NULL,NULL);}
+    CloseHandle(token);return ok;
+#endif
+}
+static int status(const char *state,const wchar_t *attempts,int pending) {
+    char t[256],o[256],tries[512],data[2048];if(!ascii(target,t,sizeof(t))||!ascii(observed,o,sizeof(o))||!ascii(attempts,tries,sizeof(tries)))return 0;
+    snprintf(data,sizeof(data),"[guard]\nformat=1\nguard_policy=2\nrelease=%s\nfixture=%d\ninitial=%d\nat_epoch=%lld\nstate=%s\ntarget=%s\nobserved=%s\n",ENVSCOPE_RELEASE,fixture,!system_identity(),epoch,state,t,o);
+    if(!replace_text(L"status.ini",data))return 0;
+    wchar_t prior[64]=L"";read_value(L"state.ini",L"state",prior,64);
+    char before[128];ascii(prior,before,sizeof(before));
+    if(strcmp(before,state)!=0 || !strcmp(state,"repairing")) {
+        SYSTEMTIME now;GetSystemTime(&now);wchar_t name[64],path[MAX_PATH];
+        swprintf(name,64,L"events-%04d-%02d-%02d.jsonl",now.wYear,now.wMonth,now.wDay);
+        if(!path_for(path,name)||!safe_file(path,1))return 0;
+        HANDLE h=CreateFileW(path,FILE_APPEND_DATA,FILE_SHARE_READ,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+        if(h==INVALID_HANDLE_VALUE)return 0;
+        snprintf(data,sizeof(data),"{\"at_epoch\":%lld,\"state\":\"%s\",\"target\":\"%s\",\"observed\":\"%s\",\"fixture\":%s}\n",epoch,state,t,o,fixture?"true":"false");
+        DWORD size=(DWORD)strlen(data),written=0;int ok=WriteFile(h,data,size,&written,NULL)&&written==size&&FlushFileBuffers(h);CloseHandle(h);if(!ok)return 0;
+    }
+    snprintf(data,sizeof(data),"[guard]\nstate=%s\nattempts=%s\npending=%d\n",state,tries,pending);return replace_text(L"state.ini",data);
+}
+static int once(void) {
+    wchar_t file[MAX_PATH],value[512],hash[65];
+    if(!safe_file(root,0)||!path_for(file,L"baseline.ini")||!safe_file(file,0))return 72;
+    if(!read_value(L"baseline.ini",L"worker_sha256",value,512)||!own_hash(hash)||wcscmp(hash,value))return 73;
+    if(!read_value(L"baseline.ini",L"target",target,128)||!text_safe(target)||!read_zone())return 74;
+    if(!path_for(file,L"run.lock")||!safe_file(file,1))return 72;
+    HANDLE lock=CreateFileW(file,GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_ALWAYS,FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+    if(lock==INVALID_HANDLE_VALUE)return 75;
+    int ok=0;wchar_t attempts[512]=L"", pending[8]=L"", state_path[MAX_PATH];
+    path_for(state_path,L"state.ini");
+    if(GetFileAttributesW(state_path)!=INVALID_FILE_ATTRIBUTES && (!read_value(L"state.ini",L"pending",pending,8)||!safe_file(state_path,0)||(wcscmp(pending,L"0")&&wcscmp(pending,L"1"))))goto done;
+    read_value(L"state.ini",L"attempts",attempts,512);
+    if(!wcscmp(pending,L"1")){ok=status("attention",attempts,1);goto done;}
+    if(!wcscmp(observed,target)){ok=status("healthy",attempts,0);goto done;}
+    long long last=0, values[3];int count=0;wchar_t *cursor=attempts;
+    while(*cursor){wchar_t *end;long long stamp=wcstoll(cursor,&end,10);if(end==cursor||(*end&&*end!=L',')){ok=status("attention",attempts,1);goto done;}
+        if(stamp>epoch){ok=status("clock_changed",attempts,0);goto done;}
+        if(epoch-stamp<86400){if(count==3){ok=status("paused",attempts,0);goto done;}values[count++]=stamp;last=stamp;}cursor=*end?end+1:end;}
+    if(count>=3){ok=status("paused",attempts,0);goto done;}
+    if(last&&epoch-last<300){ok=status("cooldown",attempts,0);goto done;}
+    values[count++]=epoch;attempts[0]=0;
+    for(int i=0;i<count;i++){wchar_t entry[64];swprintf(entry,64,L"%ls%lld",i?L",":L"",values[i]);wcscat_s(attempts,512,entry);}
+    if(!status("repairing",attempts,1))goto done;
+    if(!write_zone()||!read_zone()||wcscmp(observed,target)){ok=status("write_failed",attempts,0);goto done;}
+    ok=status("restored",attempts,0);
+done:CloseHandle(lock);return ok?0:76;
+}
+int wmain(int argc,wchar_t **argv) {
+    if(argc==2&&!wcscmp(argv[1],L"--version")){printf("{\"format\":1,\"release\":\"%s\",\"fixture\":%s}\n",ENVSCOPE_RELEASE,fixture?"true":"false");return 0;}
+    if(argc!=(fixture?3:2)||wcscmp(argv[1],L"--once"))return 64;
+    epoch=(long long)time(NULL);
+#if ENVSCOPE_FIXTURE
+    if(!GetFullPathNameW(argv[2],MAX_PATH,root,NULL))return 64;
+    wchar_t stamp[64];if(read_value(L"clock.ini",L"at_epoch",stamp,64)){live_clock=!wcscmp(stamp,L"live");if(!live_clock)epoch=wcstoll(stamp,NULL,10);}
+#else
+    if(SHGetFolderPathW(NULL,CSIDL_COMMON_APPDATA,NULL,SHGFP_TYPE_CURRENT,root)!=S_OK)return 72;
+    wchar_t drive[4]={root[0],L':',L'\\',0};if(root[1]!=L':'||GetDriveTypeW(drive)!=DRIVE_FIXED)return 72;
+    wcscat_s(root,MAX_PATH,L"\\EnvScope");if(!safe_file(root,0))return 72;
+    wcscat_s(root,MAX_PATH,L"\\TimezoneGuard");
+#endif
+    if(!drop_privileges())return 77;
+    return once();
+}
diff --git a/scripts/build_desktop.py b/scripts/build_desktop.py
index 1412efa..2249b4e 100644
--- a/scripts/build_desktop.py
+++ b/scripts/build_desktop.py
@@ -29,6 +29,13 @@ def main():
                "--distpath", str(root / "dist" / "desktop"), "--workpath", str(root / "build" / "desktop"),
                "--specpath", str(root / "build"), str(root / "scripts" / "desktop_entry.py")]
     environment = dict(os.environ)
+    if platform.system() == 'Windows':
+        from .build_windows_timezone import build as build_windows_timezone
+        native=build_windows_timezone();name='timezone-helper'
+        with zipfile.ZipFile(native/(name+'.payload.zip'),'w',zipfile.ZIP_DEFLATED) as archive:
+            archive.write(native/(name+'.exe'),name+'.exe')
+        for file in (name+'.payload.zip',name+'.json'):
+            command.extend(['--add-data',str(native/file)+os.pathsep+'envscope/native-runtime'])
     if platform.system() == 'Darwin':
         from .build_timezone_worker import build
         for component in ('timezone','network','components'):
@@ -42,15 +49,16 @@ def main():
     environment["PYINSTALLER_CONFIG_DIR"] = str(root / "build" / "pyinstaller-cache")
     subprocess.run(command, cwd=root, check=True, env=environment)
     app = root / "dist" / "desktop" / ("EnvScope.app" if platform.system() == "Darwin" else "EnvScope")
-    if platform.system() == 'Darwin':
-        for component in ('timezone','network','components'):
+    if platform.system() in ('Darwin','Windows'):
+        for component in (('timezone','network','components') if platform.system()=='Darwin' else ('timezone',)):
             name=component+'-helper';manifests=list(app.rglob(name+'.json'))
+            binary=name+('.exe' if platform.system()=='Windows' else '')
             assert manifests, 'Native '+component+' helper missing'
             for metadata in manifests:
                 expected = json.loads(metadata.read_text())
                 with zipfile.ZipFile(metadata.with_name(name+'.payload.zip')) as archive:
-                    assert archive.namelist()==[name]
-                    payload=archive.read(name)
+                    assert archive.namelist()==[binary]
+                    payload=archive.read(binary)
                 assert hashlib.sha256(payload).hexdigest()==expected['sha256'], 'Frozen '+component+' helper bytes changed'
                 assert expected['fixture'] is False, 'Acceptance helper must never ship'
     manifests = list(app.rglob("VENDOR_MANIFEST.json"))
diff --git a/scripts/build_windows_timezone.py b/scripts/build_windows_timezone.py
new file mode 100644
index 0000000..213e992
--- /dev/null
+++ b/scripts/build_windows_timezone.py
@@ -0,0 +1,55 @@
+"""Compile the closed Windows worker; building never registers or changes OS state."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+
+from envscope import __release__
+
+
+def build(destination=None, *, fixture=False):
+    if platform.system() != 'Windows':
+        raise RuntimeError('Windows compiler required')
+    root = Path(__file__).resolve().parents[1]
+    folder = Path(destination or root / 'build/native-timezone-windows').resolve()
+    folder.mkdir(parents=True, exist_ok=True)
+    binary = folder / 'timezone-helper.exe'
+    source = root / 'native/timezone_windows.c'
+    environment = {key.upper(): value for key, value in os.environ.items()}
+    compiler = os.environ.get('CC') or shutil.which('cl.exe') or shutil.which('gcc.exe')
+    if not compiler and os.environ.get('RTOOLS45_HOME'):
+        compiler = next((str(p) for p in Path(os.environ['RTOOLS45_HOME']).glob('*w64*/bin/gcc.exe') if p.is_file()), None)
+    if not compiler:
+        finder = Path(os.environ.get('ProgramFiles(x86)', 'C:/Program Files (x86)')) / 'Microsoft Visual Studio/Installer/vswhere.exe'
+        if finder.is_file():
+            setup = subprocess.check_output([str(finder), '-latest', '-products', '*', '-requires', 'Microsoft.VisualStudio.Component.VC.Tools.x86.x64', '-find', 'VC/Auxiliary/Build/vcvars64.bat'], text=True).strip()
+            if setup and Path(setup).is_file():
+                result = subprocess.check_output(['cmd.exe', '/d', '/s', '/c', '""' + setup + '" >nul && set"'], text=True, errors='replace')
+                environment.update((key.upper(), value) for key, value in (line.split('=', 1) for line in result.splitlines() if '=' in line and not line.startswith('=')))
+                compiler = shutil.which('cl.exe', path=environment.get('PATH'))
+    if not compiler:
+        raise RuntimeError('Install MSVC C++ Build Tools or put a Windows GCC compiler on PATH')
+    environment['PATH'] = str(Path(compiler).parent) + os.pathsep + environment.get('PATH', '')
+    defines = ['ENVSCOPE_RELEASE="' + __release__ + '"', 'ENVSCOPE_FIXTURE=' + str(int(fixture))]
+    if Path(compiler).name.lower() == 'cl.exe':
+        command = [compiler, '/nologo', '/O2', '/W3', '/WX', '/MT', '/D_CRT_SECURE_NO_WARNINGS'] + ['/D' + d for d in defines]
+        command += [str(source), '/Fo:' + str(folder / 'worker.obj'), '/Fe:' + str(binary), '/link', 'advapi32.lib', 'shell32.lib', 'bcrypt.lib']
+    else:
+        command = [compiler, '-municode', '-static', '-O2', '-Wall', '-Wextra', '-Werror', '-Wno-misleading-indentation'] + ['-D' + d for d in defines]
+        command += [str(source), '-o', str(binary), '-ladvapi32', '-lshell32', '-lbcrypt']
+    result = subprocess.run(command, cwd=folder, env=environment, capture_output=True, text=True, errors='replace')
+    if result.returncode:
+        raise RuntimeError(result.stdout + result.stderr)
+    version = json.loads(subprocess.check_output([str(binary), '--version']))
+    if version != {'format': 1, 'release': __release__, 'fixture': fixture}:
+        raise ValueError('Unexpected worker identity')
+    metadata = {**version, 'architecture': platform.machine(), 'sha256': hashlib.sha256(binary.read_bytes()).hexdigest()}
+    (folder / 'timezone-helper.json').write_text(json.dumps(metadata, indent=2), encoding='utf-8')
+    return folder
+
+
+if __name__ == '__main__':
+    print(build())
diff --git a/scripts/windows_timezone_acceptance.py b/scripts/windows_timezone_acceptance.py
new file mode 100644
index 0000000..1a68ff1
--- /dev/null
+++ b/scripts/windows_timezone_acceptance.py
@@ -0,0 +1,84 @@
+"""CI-only SYSTEM scheduler/ACL acceptance with a compiled file-clock fixture."""
+import configparser
+import ctypes
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import secrets
+import subprocess
+import tempfile
+import time
+
+from envscope.state import StateStore
+from envscope.timezone_windows import WindowsTimezoneIO, WindowsTimezoneService
+from scripts.build_windows_timezone import build
+from scripts.environment_fixtures import report, target
+
+
+def main():
+    if platform.system()!='Windows' or os.environ.get('ENVSCOPE_TIMEZONE_ACCEPTANCE')!='1' or os.environ.get('CI')!='true':
+        print('SKIP: opt-in Windows CI fixture only');return
+    if not ctypes.windll.shell32.IsUserAnAdmin():raise RuntimeError('CI fixture requires an administrator runner, never prompts for real authorization')
+    folder=ctypes.create_unicode_buffer(260)
+    if ctypes.windll.shell32.SHGetFolderPathW(None,35,None,0,folder)!=0:raise RuntimeError('CommonApplicationData unavailable')
+    parent=Path(folder.value).resolve()/'EnvScope';nonce=secrets.token_hex(8)
+    root=(parent/('TimezoneFixture-'+nonce)).resolve();task='EnvScope-TimezoneFixture-'+nonce
+    if root.parent!=parent.resolve() or not root.name.startswith('TimezoneFixture-'):raise RuntimeError('Fixture containment failed')
+    tzutil=str(Path(os.environ['SystemRoot'])/'System32/tzutil.exe');before_zone=subprocess.check_output([tzutil,'/g'])
+    summary={}
+    with tempfile.TemporaryDirectory(prefix='envscope-windows-timezone-test-') as temporary:
+        build_root=build(Path(temporary)/'build',fixture=True);binary=build_root/'timezone-helper.exe'
+        worker=json.loads((build_root/'timezone-helper.json').read_text())|{'path':str(binary)}
+        class FixtureIO(WindowsTimezoneIO):
+            interrupt=False
+            def execute(self,payload):super().execute({**payload,**({'fixture_interrupt':True} if self.interrupt else {})})
+        io=FixtureIO(root=root,task=task,fixture=True,worker=lambda:worker)
+        def powershell(source):
+            value=subprocess.run([io.executable,'-NoProfile','-NonInteractive','-Command','[Console]::InputEncoding=[Text.UTF8Encoding]::new($false); & ([scriptblock]::Create([Console]::In.ReadToEnd()))'],input=source.encode(),capture_output=True,timeout=30)
+            if value.returncode:raise RuntimeError('Owned fixture operation failed: '+value.stderr.decode('utf-8',errors='replace')[-1500:])
+            return value.stdout
+        def reader():
+            parser=configparser.ConfigParser();parser.read(root/'clock.ini');return {'network':{'timezone_id':parser['guard']['timezone']}}
+        store=StateStore(Path(temporary)/'state');settings=target('Windows',usage_country='US',country='US',timezone='Eastern Standard Time',locale='en-US')
+        store.save_settings({k:v for k,v in settings.items() if k!='environment_confirmed'},confirm_environment=True)
+        service=WindowsTimezoneService(store,reader,io=io)
+        try:
+            powershell(io.script("New-Root ([IO.DirectoryInfo]::new($Root).Parent.FullName);New-Root $Root;Set-Zone 'China Standard Time'"))
+            r=report(Path(temporary),store.settings(),'Windows')
+            plan=service.prepare(r);assert plan['state']=='planned',plan
+            outcome=service.apply(plan['plan_id'],True);assert outcome['state']=='completed',outcome
+            first=service.status()['heartbeat_at'];cycles=[];deadline=time.monotonic()+165
+            while len(cycles)<2 and time.monotonic()<deadline:
+                status=service.status();stamp=status.get('heartbeat_at',0)
+                if status['state']=='active' and stamp>first and (not cycles or stamp>cycles[-1]+1):
+                    cycles.append(stamp);print('Observed SYSTEM fixture cycle '+str(len(cycles)),flush=True)
+                time.sleep(2)
+            assert len(cycles)==2,service.status()
+            summary['system_scheduled_cycles']=2
+            # The ACL change is confined to the disposable fixture baseline.
+            powershell(io.script("$acl=Get-Acl -LiteralPath $Baseline;$script:original=$acl.Sddl;[IO.File]::WriteAllText((Join-Path $Root 'saved-acl.txt'),$acl.Sddl);$acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new([Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'),'Write','Allow'));Set-Acl -LiteralPath $Baseline -AclObject $acl"))
+            assert service.status()['state']=='attention'
+            powershell(io.script("$acl=[Security.AccessControl.FileSecurity]::new();$acl.SetSecurityDescriptorSddlForm([IO.File]::ReadAllText((Join-Path $Root 'saved-acl.txt')));Set-Acl -LiteralPath $Baseline -AclObject $acl"))
+            summary['writable_acl_rejected']=True
+            plan=service.prepare(r,remove=True,restore=True);assert service.apply(plan['plan_id'],True)['state']=='completed'
+            assert reader()['network']['timezone_id']=='China Standard Time'
+            plan=service.prepare_undo();assert service.undo(plan['plan_id'],True)['state']=='completed'
+            assert reader()['network']['timezone_id']=='Eastern Standard Time'
+            summary['remove_restore_undo']=True
+            r=report(Path(temporary),store.settings(),'Windows');plan=service.prepare(r);io.interrupt=True
+            assert service.apply(plan['plan_id'],True)['state']=='partial';assert service.status()['state']=='recovery_required'
+            io.interrupt=False;plan=service.prepare_recovery();assert service.recover(plan['plan_id'],True)['state']=='completed'
+            summary['interrupted_transaction_recovery']=True
+            assert subprocess.check_output([tzutil,'/g'])==before_zone
+            summary.update(real_timezone_unchanged=True,real_uac_consent=False,fixture_worker=True)
+        finally:
+            # Exact resolved fixture root was checked above; only our unique task
+            # and this owned directory are removed, using PowerShell end-to-end.
+            powershell(io.script("Import-Module (Join-Path $env:PSModulePath 'ScheduledTasks/ScheduledTasks.psd1');$t=Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue;if($t){if($t.Actions[0].Execute -cne $Worker){throw 'foreign cleanup task'};Stop-ScheduledTask -TaskName $TaskName;Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false};No-Links $Root;if([IO.Path]::GetFullPath($Root) -cne $Root -or [IO.Path]::GetFileName($Root) -cnotmatch '^TimezoneFixture-[a-f0-9]{16}$'){throw 'unsafe cleanup root'};Remove-Item -LiteralPath $Root -Recurse -Force"))
+    out=Path('artifacts/windows-timezone-acceptance.json');out.parent.mkdir(parents=True,exist_ok=True);out.write_text(json.dumps(summary,indent=2))
+    print(json.dumps(summary))
+
+
+if __name__=='__main__':main()
diff --git a/tests/test_guard_notifications.py b/tests/test_guard_notifications.py
new file mode 100644
index 0000000..943da5e
--- /dev/null
+++ b/tests/test_guard_notifications.py
@@ -0,0 +1,43 @@
+import unittest
+import tempfile
+from pathlib import Path
+from unittest.mock import Mock
+from envscope.state import StateStore
+from envscope.guard_notifications import GuardNotifications
+
+
+class GuardNotificationTests(unittest.TestCase):
+    def setUp(self):
+        self.folder=tempfile.TemporaryDirectory();self.addCleanup(self.folder.cleanup)
+        self.store=StateStore(Path(self.folder.name))
+    def test_unchanged_failure_is_quiet_across_restart_and_recovery_rearms(self):
+        store=self.store;sink=Mock();notifier=GuardNotifications(store,sink)
+        bad={'enabled':True,'state':'attention','watchdog':{'proxy':{'state':'attention','note':'PRIVATE_PROXY_NAME'}}}
+        self.assertTrue(notifier.update(bad,{}));self.assertFalse(notifier.update(bad,{}))
+        self.assertFalse(GuardNotifications(store,sink).update(bad,{}));self.assertEqual(sink.call_count,1)
+        self.assertNotIn('PRIVATE_PROXY_NAME',str(sink.call_args))
+        self.assertFalse(notifier.update({'enabled':True,'state':'active'},{}))
+        self.assertTrue(notifier.update(bad,{}));self.assertEqual(sink.call_count,2)
+
+    def test_unconfigured_waiting_and_cooldown_states_do_not_notify(self):
+        sink=Mock();notifier=GuardNotifications(self.store,sink)
+        for state in ('disabled','waiting','active'):
+            self.assertFalse(notifier.update({'enabled':state!='disabled','state':state}, {'state':'not_installed'}))
+        self.assertFalse(notifier.update({'enabled':True,'state':'attention','watchdog':{'timezone':{'state':'cooldown'}}},{}))
+        sink.assert_not_called()
+
+    def test_disabled_or_unreadable_previously_approved_native_task_notifies(self):
+        sink=Mock();notifier=GuardNotifications(self.store,sink)
+        notifier.update({}, {'installed':True,'state':'active'})
+        self.assertTrue(notifier.update({}, {'state':'attention'}))
+        self.assertEqual(sink.call_args.args[0]['components'],['timezone'])
+
+    def test_lost_heartbeat_and_unexpected_removal_need_attention(self):
+        sink=Mock();now=[1000];notifier=GuardNotifications(self.store,sink,clock=lambda:now[0])
+        self.assertFalse(notifier.update({}, {'installed':True,'state':'waiting'}))
+        now[0]+=181
+        self.assertTrue(notifier.update({}, {'installed':True,'state':'waiting'}))
+        self.assertFalse(notifier.update({}, {'installed':True,'state':'waiting'}))
+        self.assertTrue(notifier.update({}, {'installed':False,'state':'not_installed'}))
+        notifier.update({}, {'installed':False,'state':'not_installed','intentionally_removed':True})
+        self.assertFalse(notifier.active)
diff --git a/tests/test_watchdog.py b/tests/test_watchdog.py
index c2138e1..427c7fc 100644
--- a/tests/test_watchdog.py
+++ b/tests/test_watchdog.py
@@ -14,6 +14,25 @@
 
 
 class WatchdogTests(unittest.TestCase):
+    def test_windows_missing_write_privilege_cannot_approve_automatic_guard(self):
+        guard=Watchdog(system='Windows',reader=lambda:self.inventory,writer=Mock(),
+                       capability_reader=lambda:{'timezone':{'state':'authorization_required'}})
+        from envscope.region_profiles import profiles
+        selected=next(p for p in profiles('Windows') if p['timezone']=='Eastern Standard Time' and p['locale']=='en-US')
+        settings=target('Windows',region_profile=selected['id'],timezone=selected['timezone'],locale=selected['locale'],country=selected['country'])
+        with self.assertRaisesRegex(ValueError,'授权'):
+            guard.prepare(settings,{'timezone':True})
+        self.assertEqual(guard.options()['capabilities']['timezone']['state'],'authorization_required')
+
+    def test_revoked_windows_privilege_is_detected_even_before_drift(self):
+        writer=Mock()
+        guard=Watchdog(system='Windows',reader=lambda:self.inventory,writer=writer,
+                       capability_reader=lambda:{'timezone':{'state':'authorization_required'}})
+        stats={}
+        guard.run({'timezone':'Eastern Standard Time'},stats,lambda *a,**k:None,lambda:None)
+        self.assertEqual(stats['watchdog']['timezone']['state'],'attention')
+        writer.assert_not_called()
+
     def test_authorized_mac_service_owns_timezone_repairs_without_duplicate_writes(self):
         from datetime import datetime,timezone
         now=datetime.now(timezone.utc).timestamp()
diff --git a/tests/test_windows_timezone_service.py b/tests/test_windows_timezone_service.py
new file mode 100644
index 0000000..20571a1
--- /dev/null
+++ b/tests/test_windows_timezone_service.py
@@ -0,0 +1,123 @@
+import copy
+import hashlib
+import tempfile
+import time
+import unittest
+import subprocess
+import platform
+from pathlib import Path
+
+from envscope import __release__
+from envscope.consent import ConsentError
+from envscope.state import StateStore
+from envscope.timezone_windows import WindowsTimezoneService, WindowsTimezoneIO, stable, installer_bootstrap
+from scripts.environment_fixtures import report, target
+
+
+class WindowsTimezoneFixture:
+    fixture=True
+    clock=staticmethod(time.time)
+    def __init__(self,inventory):
+        self.inventory=inventory;self.value={'baseline':{},'status':{},'transaction':{},'registered':False,'enabled':False,'pending':False,'baseline_sha':'','worker_sha':''}
+        self.backups={};self.cancel=False;self.interrupt=False;self.worker_hash='a'*64
+    def inspect(self):return copy.deepcopy(self.value)
+    def owner(self):return 'S-1-5-21-1-2-3-1001'
+    def worker(self):return {'path':'C:/fixture/worker.exe','sha256':self.worker_hash,'release':__release__}
+    def execute(self,payload):
+        if self.cancel:raise ConsentError('consent_cancelled')
+        action=payload['action']
+        if action=='restore':
+            old,zone=self.backups[payload['restore_id']];self.value=copy.deepcopy(old);self.inventory['network']['timezone_id']=zone
+            self.value['transaction']={'id':payload['restore_id'],'owner':self.owner(),'state':'restored'};return
+        nonce=payload['nonce'];self.backups[nonce]=(self.inspect(),self.inventory['network']['timezone_id'])
+        self.value['transaction']={'id':nonce,'owner':self.owner(),'state':'pending','before_zone':payload['observed']}
+        if self.interrupt:self.value['pending']=True;raise ValueError('fixture interruption')
+        if action=='install':
+            self.value.update(baseline={'target':payload['target'],'original':self.value['baseline'].get('original',payload['observed']),
+                'owner':self.owner(),'release':__release__},registered=True,enabled=True,baseline_sha=hashlib.sha256(nonce.encode()).hexdigest(),worker_sha=self.worker_hash)
+            self.inventory['network']['timezone_id']=payload['target']
+            self.value['status']={'format':'1','guard_policy':'2','at_epoch':str(self.clock()),'initial':'0','fixture':'1','release':__release__,'target':payload['target'],'observed':payload['target'],'state':'healthy'}
+        else:
+            if payload['restore']:self.inventory['network']['timezone_id']=self.value['baseline']['original']
+            self.value.update(baseline={},registered=False,enabled=False,baseline_sha='')
+        self.value['transaction']['state']='committed'
+        self.value['transaction'].update(after_baseline_sha=self.value['baseline_sha'],after_worker_sha=self.value['worker_sha'])
+
+
+class WindowsTimezoneServiceTests(unittest.TestCase):
+    def setUp(self):
+        self.temp=tempfile.TemporaryDirectory();self.addCleanup(self.temp.cleanup);self.home=Path(self.temp.name)
+        self.store=StateStore(self.home/'state');settings=target('Windows',usage_country='US',timezone='Eastern Standard Time',locale='en-US',country='US')
+        self.store.save_settings({k:v for k,v in settings.items() if k!='environment_confirmed'},confirm_environment=True)
+        self.report=report(self.home,self.store.settings(),'Windows')
+        self.inventory={'network':{'timezone_id':'China Standard Time'}};self.io=WindowsTimezoneFixture(self.inventory)
+        self.service=WindowsTimezoneService(self.store,lambda:self.inventory,io=self.io)
+    def install(self):
+        plan=self.service.prepare(self.report);self.assertEqual(plan['state'],'planned',plan)
+        self.assertEqual(self.service.apply(plan['plan_id'],'true')['state'],'confirmation_required')
+        result=self.service.apply(plan['plan_id'],True);self.assertEqual(result['state'],'completed',result);return result
+    def test_install_stop_restore_and_undo_preserve_original(self):
+        self.install();self.assertEqual(self.service.status()['state'],'active')
+        plan=self.service.prepare(self.report,remove=True,restore=True)
+        self.assertEqual(self.service.apply(plan['plan_id'],True)['state'],'completed')
+        self.assertEqual(self.inventory['network']['timezone_id'],'China Standard Time')
+        plan=self.service.prepare_undo();self.assertEqual(self.service.undo(plan['plan_id'],True)['state'],'completed')
+        self.assertEqual(self.service.status()['state'],'active')
+    def test_cancel_and_interruption_keep_the_correct_recovery_state(self):
+        self.io.cancel=True;plan=self.service.prepare(self.report);result=self.service.apply(plan['plan_id'],True)
+        self.assertEqual(result['error'],'consent_cancelled');self.assertEqual(self.service.status()['state'],'not_installed')
+        self.io.cancel=False;self.io.interrupt=True;plan=self.service.prepare(self.report)
+        self.assertEqual(self.service.apply(plan['plan_id'],True)['state'],'partial')
+        self.assertEqual(self.service.status()['state'],'recovery_required')
+        self.io.interrupt=False;plan=self.service.prepare_recovery();self.assertEqual(self.service.recover(plan['plan_id'],True)['state'],'completed')
+        self.assertEqual(self.inventory['network']['timezone_id'],'China Standard Time')
+    def test_foreign_owner_changed_binary_and_revoked_registration_are_visible(self):
+        plan=self.service.prepare(self.report);self.io.worker_hash='b'*64
+        self.assertEqual(self.service.apply(plan['plan_id'],True)['state'],'retest_required')
+        self.install();self.io.value['enabled']=False
+        self.assertEqual(self.service.status()['state'],'unregistered')
+        self.io.value['baseline']['owner']='S-1-5-21-1-2-3-9999'
+        self.assertEqual(self.service.status()['state'],'conflict')
+        self.assertEqual(self.service.prepare(self.report)['state'],'blocked')
+    def test_stale_heartbeat_is_not_running_and_target_change_invalidates_plan(self):
+        self.install();self.io.value['status']['at_epoch']='1'
+        self.assertEqual(self.service.status()['state'],'waiting')
+        plan=self.service.prepare(self.report);self.store.save_settings({'timezone':'UTC'})
+        self.assertEqual(self.service.apply(plan['plan_id'],True)['state'],'retest_required')
+
+
+@unittest.skipUnless(platform.system()=='Windows','Windows PowerShell transport')
+class WindowsTimezoneTransportTests(unittest.TestCase):
+    def test_verified_source_is_snapshot_and_tamper_never_executes(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path=Path(folder)/"installer with 'quote.ps1"
+            source=b"Write-Output 'VERIFIED_FIXTURE_ONLY'"
+            path.write_bytes(source)
+            io=WindowsTimezoneIO()
+            command=[io.executable,'-NoProfile','-NonInteractive','-Command',installer_bootstrap(path,hashlib.sha256(source).hexdigest())]
+            result=subprocess.run(command,capture_output=True,timeout=15)
+            self.assertEqual(result.returncode,0,result.stderr)
+            self.assertIn(b'VERIFIED_FIXTURE_ONLY',result.stdout)
+            path.write_bytes(b"Write-Output 'MUTATED_SOURCE_MUST_NOT_RUN'")
+            changed=subprocess.run(command,capture_output=True,timeout=15)
+            self.assertNotEqual(changed.returncode,0)
+            self.assertNotIn(b'MUTATED_SOURCE_MUST_NOT_RUN',changed.stdout)
+
+    def test_full_installer_is_parseable_without_running_and_command_is_bounded(self):
+        seen=[]
+        def runner(command,**kwargs):
+            import base64
+            bootstrap=base64.b64decode(kwargs['input']).decode('utf-16-le')
+            self.assertLess(len(bootstrap),4000)
+            self.assertNotIn('ExecutionPolicy',bootstrap)
+            path=next(Path(tempfile.gettempdir()).glob('envscope-timezone-*/installer.ps1'))
+            source=path.read_text(encoding='utf-8')
+            self.assertIn('function Record',source)
+            self.assertIn('transactionLock.Dispose()',source)
+            parser="$e=$null;$t=$null;[void][System.Management.Automation.Language.Parser]::ParseFile("+"'"+str(path).replace("'","''")+"'"+",[ref]$t,[ref]$e);if($e.Count){$e | Out-String;exit 1}"
+            check=subprocess.run([WindowsTimezoneIO().executable,'-NoProfile','-NonInteractive','-Command',parser],capture_output=True,timeout=15)
+            self.assertEqual(check.returncode,0,check.stdout+check.stderr)
+            seen.append(True)
+            return subprocess.CompletedProcess(command,1223,b'',b'')
+        with self.assertRaises(ConsentError):WindowsTimezoneIO(runner=runner).execute({'fixture_data':'no system writes'})
+        self.assertEqual(seen,[True])
diff --git a/tests/test_windows_timezone_worker.py b/tests/test_windows_timezone_worker.py
new file mode 100644
index 0000000..1ce328d
--- /dev/null
+++ b/tests/test_windows_timezone_worker.py
@@ -0,0 +1,73 @@
+"""Compiled fixture has no OS clock-writing branch; only disposable files change."""
+import configparser
+import hashlib
+import os
+from pathlib import Path
+import platform
+import subprocess
+import tempfile
+import unittest
+
+
+@unittest.skipUnless(platform.system() == 'Windows', 'Windows native compiler required')
+class WindowsTimezoneWorkerTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        from scripts.build_windows_timezone import build
+        cls.build_dir = tempfile.TemporaryDirectory()
+        try:
+            cls.folder = build(cls.build_dir.name, fixture=True)
+        except RuntimeError as error:
+            cls.build_dir.cleanup()
+            raise RuntimeError('Native worker fixture build failed: ' + str(error)) from None
+        cls.exe = cls.folder / 'timezone-helper.exe'
+
+    @classmethod
+    def tearDownClass(cls): cls.build_dir.cleanup()
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory(); self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.write('baseline', target='Eastern Standard Time', worker_sha256=hashlib.sha256(self.exe.read_bytes()).hexdigest())
+        self.write('clock', timezone='China Standard Time', at_epoch=1793400000)
+
+    def write(self, name, **values):
+        (self.root / (name + '.ini')).write_text('[guard]\n' + ''.join(str(k) + '=' + str(v) + '\n' for k, v in values.items()), encoding='ascii')
+
+    def read(self, name):
+        value=configparser.ConfigParser();value.read(self.root/(name+'.ini'));return dict(value['guard'])
+
+    def run_worker(self):
+        return subprocess.run([str(self.exe), '--once', str(self.root)], capture_output=True, timeout=10).returncode
+
+    def test_drift_readback_then_healthy_cycle_without_real_timezone_change(self):
+        tzutil = str(Path(os.environ['SystemRoot'])/'System32/tzutil.exe')
+        before = subprocess.check_output([tzutil, '/g'])
+        self.assertEqual(self.run_worker(), 0)
+        self.assertEqual(self.read('status')['state'], 'restored')
+        self.assertEqual(self.read('clock')['timezone'], 'Eastern Standard Time')
+        self.assertEqual(self.run_worker(), 0)
+        self.assertEqual(self.read('status')['state'], 'healthy')
+        self.assertEqual(subprocess.check_output([tzutil, '/g']), before)
+        self.assertTrue(list(self.root.glob('events-*.jsonl')))
+
+    def test_pending_and_repeated_drift_pause_before_write(self):
+        self.write('state', pending=1, state='repairing', attempts='1793399999')
+        self.assertEqual(self.run_worker(), 0)
+        self.assertEqual(self.read('status')['state'], 'attention')
+        self.assertEqual(self.read('clock')['timezone'], 'China Standard Time')
+        self.write('state', pending=0, state='healthy', attempts='1793398000,1793398600,1793399200')
+        self.assertEqual(self.run_worker(), 0)
+        self.assertEqual(self.read('status')['state'], 'paused')
+        self.assertEqual(self.read('clock')['timezone'], 'China Standard Time')
+
+    def test_tampered_identity_and_invalid_target_cannot_write(self):
+        for values in ({'target':'Eastern Standard Time','worker_sha256':'0'*64}, {'target':'bad\"; command','worker_sha256':hashlib.sha256(self.exe.read_bytes()).hexdigest()}):
+            self.write('baseline', **values)
+            self.assertNotEqual(self.run_worker(), 0)
+            self.assertEqual(self.read('clock')['timezone'], 'China Standard Time')
+
+    def test_malformed_pending_marker_never_allows_a_write(self):
+        self.write('state',pending='unknown',state='repairing',attempts='')
+        self.assertNotEqual(self.run_worker(),0)
+        self.assertEqual(self.read('clock')['timezone'],'China Standard Time')

From 340a0b94658408c19a3dcae35065edede04bdbb8 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:51:08 +0800
Subject: [PATCH 04/10] fix: handle Windows PowerShell INI parsing and
 platform-specific permission expectations

---
 envscope/timezone_windows.py           |  2 +-
 tests/test_assessment.py               |  3 ++-
 tests/test_windows_timezone_service.py | 15 +++++++++++++++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/envscope/timezone_windows.py b/envscope/timezone_windows.py
index 51de761..4f1dde3 100644
--- a/envscope/timezone_windows.py
+++ b/envscope/timezone_windows.py
@@ -32,7 +32,7 @@
 function Ini($path) {
  if(-not(Test-Path -LiteralPath $path)){return @{}}
  Assert-Protected $path;if((Get-Item -LiteralPath $path).Length -gt 8192){throw 'oversized ini'}
- $value=@{};foreach($line in [IO.File]::ReadAllLines($path)){if($line -eq '[guard]' -or -not $line.Trim()){continue};$parts=$line.Split(@('='),2);if($parts.Count -ne 2 -or $value.ContainsKey($parts[0])){throw 'invalid ini'};$value[$parts[0]]=$parts[1]};return $value
+ $value=@{};foreach($line in [IO.File]::ReadAllLines($path)){if($line -eq '[guard]' -or -not $line.Trim()){continue};$parts=$line -split '=',2;if($parts.Count -ne 2 -or $value.ContainsKey($parts[0])){throw 'invalid ini'};$value[$parts[0]]=$parts[1]};return $value
 }
 function Read-Task {
  $scheduler=New-Object -ComObject 'Schedule.Service';$scheduler.Connect()
diff --git a/tests/test_assessment.py b/tests/test_assessment.py
index a6d4277..12d1b03 100644
--- a/tests/test_assessment.py
+++ b/tests/test_assessment.py
@@ -35,7 +35,8 @@ def test_real_permission_denial_is_distinct_from_io_failure(self):
         self.assertNotEqual(rows['extra.config']['state'], 'permission')
         runner = Mock()
         params = {'report_id': 'fixture', 'finding_id': 'extra.hosts'}
-        self.assertEqual(permission_help(report, params, Path('/home'), Path('/profile'), runner=runner)['state'], 'confirmation_required')
+        self.assertEqual(permission_help(report, params, Path('/home'), Path('/profile'), runner=runner, system='Windows')['state'], 'confirmation_required')
+        self.assertEqual(permission_help(report, params, Path('/home'), Path('/profile'), runner=runner, system='Darwin')['state'], 'manual')
         runner.assert_not_called()
         result = permission_help(report, params, Path('/home'), Path('/profile'), True, runner, 'Windows')
         self.assertEqual(result['state'], 'opened')
diff --git a/tests/test_windows_timezone_service.py b/tests/test_windows_timezone_service.py
index 20571a1..f81b620 100644
--- a/tests/test_windows_timezone_service.py
+++ b/tests/test_windows_timezone_service.py
@@ -88,6 +88,21 @@ def test_stale_heartbeat_is_not_running_and_target_change_invalidates_plan(self)
 
 @unittest.skipUnless(platform.system()=='Windows','Windows PowerShell transport')
 class WindowsTimezoneTransportTests(unittest.TestCase):
+    def test_windows_powershell_ini_parser_preserves_values_and_rejects_duplicates(self):
+        import re
+        from envscope.timezone_windows import HEADER
+        source=re.search(r'function Ini\(\$path\) \{.*?\n\}',HEADER,re.S).group()
+        with tempfile.TemporaryDirectory() as folder:
+            path=Path(folder)/'fixture.ini';path.write_text('[guard]\ntimezone=Eastern Standard Time\nvalue=a=b\n')
+            command=[WindowsTimezoneIO().executable,'-NoProfile','-NonInteractive','-Command',
+                     'function Assert-Protected($path){};'+source+';Ini '+"'"+str(path).replace("'","''")+"'"+' | ConvertTo-Json -Compress']
+            value=subprocess.run(command,capture_output=True,timeout=15)
+            self.assertEqual(value.returncode,0,value.stderr)
+            import json
+            self.assertEqual(json.loads(value.stdout)['value'],'a=b')
+            path.write_text('[guard]\nvalue=1\nvalue=2\n')
+            self.assertNotEqual(subprocess.run(command,capture_output=True,timeout=15).returncode,0)
+
     def test_verified_source_is_snapshot_and_tamper_never_executes(self):
         with tempfile.TemporaryDirectory() as folder:
             path=Path(folder)/"installer with 'quote.ps1"

From 5a08dda10da5b8f8237ed2cb0fd20785eb2be26d Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:55:30 +0800
Subject: [PATCH 05/10] fix: retain Windows task receipts across PowerShell
 scope lookup

---
 envscope/timezone_windows.py           |  6 +++---
 tests/test_windows_timezone_service.py | 10 ++++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/envscope/timezone_windows.py b/envscope/timezone_windows.py
index 4f1dde3..5829045 100644
--- a/envscope/timezone_windows.py
+++ b/envscope/timezone_windows.py
@@ -25,7 +25,7 @@
 @PROTECTION@
 $Root=@ROOT@;$TaskName=@TASK@;$Fixture=@FIXTURE@
 $Worker=Join-Path $Root 'timezone-helper.exe'
-$Baseline=Join-Path $Root 'baseline.ini';$Receipt=Join-Path $Root 'transaction.json'
+$Baseline=Join-Path $Root 'baseline.ini';$ReceiptPath=Join-Path $Root 'transaction.json'
 $WorkerArgs=@ARGS@
 if([IO.DriveInfo]::new([IO.Path]::GetPathRoot($Root)).DriveType -ne 'Fixed'){throw 'local fixed volume required'}
 function Hash($path) {if(-not(Test-Path -LiteralPath $path)){return ''};Assert-Protected $path;return (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()}
@@ -45,7 +45,7 @@
  No-Links $Root
  if(Test-Path -LiteralPath $Root){Assert-Protected ([IO.DirectoryInfo]::new($Root).Parent.FullName);Assert-Protected $Root}
  $task=Read-Task;$base=Ini $Baseline;$status=Ini (Join-Path $Root 'status.ini');$receipt=@{}
- if(Test-Path -LiteralPath $Receipt){Assert-Protected $Receipt;if((Get-Item -LiteralPath $Receipt).Length -gt 65536){throw 'oversized receipt'};$receipt=Get-Content -LiteralPath $Receipt -Raw | ConvertFrom-Json}
+ if(Test-Path -LiteralPath $ReceiptPath){Assert-Protected $ReceiptPath;if((Get-Item -LiteralPath $ReceiptPath).Length -gt 65536){throw 'oversized receipt'};$receipt=Get-Content -LiteralPath $ReceiptPath -Raw | ConvertFrom-Json}
  if($base.Count -and ($base.format -cne '1' -or $base.worker_sha256 -cne (Hash $Worker) -or $base.owner -cnotmatch '^S-1-5(-[0-9]+)+$')){throw 'invalid baseline'}
  if($task -and -not $base.Count -and $receipt.state -notin @('pending','partial')){throw 'orphan task'}
  return @{baseline=$base;status=$status;transaction=$receipt;registered=($null -ne $task);enabled=($null -ne $task -and $task.Settings.Enabled);baseline_sha=(Hash $Baseline);worker_sha=(Hash $Worker);pending=($receipt.state -in @('pending','partial'))}
@@ -82,7 +82,7 @@
  if((Zone) -cne $value){throw 'zone readback failed'}
 }
 function Record($r) {
- Save $Receipt $r $true;Save (Join-Path $Root ('receipt-'+$r.id+'.json')) $r $true
+ Save $ReceiptPath $r $true;Save (Join-Path $Root ('receipt-'+$r.id+'.json')) $r $true
  $log=Join-Path $Root ('lifecycle-'+[DateTime]::UtcNow.ToString('yyyy-MM-dd')+'.jsonl')
  if(Test-Path -LiteralPath $log){Assert-Protected $log}
  $entry=@{at_epoch=[DateTimeOffset]::UtcNow.ToUnixTimeSeconds();transaction=$r.id;state=$r.state;action=$r.action;fixture=$Fixture}
diff --git a/tests/test_windows_timezone_service.py b/tests/test_windows_timezone_service.py
index f81b620..0afe050 100644
--- a/tests/test_windows_timezone_service.py
+++ b/tests/test_windows_timezone_service.py
@@ -88,6 +88,16 @@ def test_stale_heartbeat_is_not_running_and_target_change_invalidates_plan(self)
 
 @unittest.skipUnless(platform.system()=='Windows','Windows PowerShell transport')
 class WindowsTimezoneTransportTests(unittest.TestCase):
+    def test_snapshot_retains_transaction_receipt_in_powershell_case_insensitive_scope(self):
+        import json
+        with tempfile.TemporaryDirectory() as folder:
+            root=Path(folder);receipt={'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','state':'pending'}
+            (root/'transaction.json').write_text(json.dumps(receipt))
+            io=WindowsTimezoneIO(root=root,task='EnvScope-TimezoneFixture-12345678',fixture=True)
+            value=io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
+            self.assertEqual(value['transaction'],receipt)
+            self.assertTrue(value['pending'])
+
     def test_windows_powershell_ini_parser_preserves_values_and_rejects_duplicates(self):
         import re
         from envscope.timezone_windows import HEADER

From 4843f188f710b47abaa36f37d8e07de42ef26516 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 17:59:02 +0800
Subject: [PATCH 06/10] feat: validate stable open-source desktop package
 identity

---
 docs/OPEN_SOURCE_BUILDS.md                    | 26 ++++++++++++
 .../plans/2026-10-30-permissions-and-ui.md    |  2 +-
 envscope/_desktop_test.py                     |  8 +++-
 envscope/app_identity.py                      | 42 +++++++++++++++++++
 envscope/desktop_runtime.py                   |  4 ++
 envscope/updates.py                           |  8 +++-
 scripts/build_desktop.py                      |  5 +++
 scripts/package_identity.py                   | 32 ++++++++++++++
 scripts/update_package_smoke.py               |  6 ++-
 tests/test_app_identity.py                    | 35 ++++++++++++++++
 tests/test_desktop_runtime.py                 | 22 ++++++++--
 11 files changed, 179 insertions(+), 11 deletions(-)
 create mode 100644 docs/OPEN_SOURCE_BUILDS.md
 create mode 100644 envscope/app_identity.py
 create mode 100644 scripts/package_identity.py
 create mode 100644 tests/test_app_identity.py

diff --git a/docs/OPEN_SOURCE_BUILDS.md b/docs/OPEN_SOURCE_BUILDS.md
new file mode 100644
index 0000000..295502c
--- /dev/null
+++ b/docs/OPEN_SOURCE_BUILDS.md
@@ -0,0 +1,26 @@
+# 开源桌面构建与更新身份
+
+本项目发布源码及 Windows/macOS 独立软件。当前无需商业签名证书：Windows 构建未进行
+Authenticode 发布者签名；macOS 使用本地 ad-hoc 签名，不具备 Developer ID 身份，也未公证。
+SHA-256 和应用标识用于检查下载与版本一致性，不能证明发布者签名。
+
+应用固定使用 `io.qudadd.envscope`。Windows EXE 的内部名称、文件版本和产品版本，
+macOS 的 `CFBundleIdentifier`、`CFBundleShortVersionString`、`CFBundleVersion`，以及
+包内 `build-identity.json` 都由同一源码版本生成。升级保持这个应用标识；用户资料沿用原路径。
+首次从旧版 `EnvScope` macOS 标识迁移时，系统可能要求重新核对相关隐私权限；打开设置本身
+不代表授权成功，回到软件后重新检测实际能力。
+
+更新流程依次核对固定 GitHub 仓库、系统架构、版本、下载大小、GitHub 摘要、发布校验表、
+安全解包路径和包内应用身份。新版本安装在旁边的版本目录，保留旧版与资料。主程序或身份
+记录在安装后改变时停止启动该更新。现有旧版回退记录仍可用，不会因新增身份文件要求丢失回退。
+
+目前不接受包内自行声称“发布者已验证”或“已公证”的构建。若今后启用正式签名，需要单独
+提交并审查发布流程：证书通过仓库秘密配置、固定签发者/Team ID、公证结果读回，并在更新端
+校验真实操作系统签名。只添加环境变量或 JSON 标志不能启用此模式。不要将密码、证书私钥
+或 Apple 账号凭据提交到仓库。
+
+可重复构建入口：`python -m scripts.build_desktop`。最终包运行
+`python -m scripts.packaged_smoke <主程序路径>`，更新路径运行
+`python -m scripts.update_package_smoke`。测试使用临时资料，不登录 Claude 或改变真实系统配置。
+
+构建依据：[PyInstaller 应用标识与版本资源](https://www.pyinstaller.org/en/stable/usage.html)。
diff --git a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
index 636adc6..49361c7 100644
--- a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
+++ b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
@@ -67,7 +67,7 @@
 **Interfaces:** Build metadata carries stable `io.qudadd.envscope` identity, semantic/build versions and signed/unsigned mode. Signed release verification requires the configured publisher identity plus archive integrity; missing required signing credentials fail signed release builds.
 
 - [ ] Add executable-package metadata and signer-verification regressions using isolated signed/unsigned/tampered fixtures.
-- [ ] Implement Windows publisher signing and Apple Developer ID/notarytool integration through environment/CI secrets, without storing credentials in the repo.
+- [ ] Under the clarified open-source scope, ship unsigned/ad-hoc builds with fixed identity, native version resources and package identity validation. Document publisher signing/notarization as a future optional release mode; do not claim or silently accept unverified publisher identity.
 - [ ] Deliver the requested unsigned open-source build, verify identity continuity, and document optional signing configuration. Never label unsigned artifacts as publisher-signed or notarized.
 - [ ] Run builds, package verification, update smoke tests and full suites; commit and retain signing/notarization receipts without secrets.
 
diff --git a/envscope/_desktop_test.py b/envscope/_desktop_test.py
index f170fb8..a67fb17 100644
--- a/envscope/_desktop_test.py
+++ b/envscope/_desktop_test.py
@@ -128,6 +128,10 @@ def execute(self,*args):raise AssertionError('Frozen software fixture must not m
         result['native_components_worker'] = 'not_applicable'
         result['native_language_bindings']='not_applicable'
         result['native_pipe_transport']='not_applicable'
+        from .app_identity import verify_package_identity, build_identity
+        result['build_identity']=(verify_package_identity(sys.executable,platform.system(),__release__)
+                                  if getattr(sys,'frozen',False) else build_identity(platform.system()))
+        result['identity_source']='package' if getattr(sys,'frozen',False) else 'source-fixture'
         result['native_wireguard_bindings']='not_applicable'
         if platform.system()=='Windows':
             from .timezone_service import bundle_worker
@@ -253,8 +257,8 @@ def exercise():
                 ids = read_js("[...document.querySelectorAll('[id]')].map(n=>n.id)")
                 assert len(ids) == len(set(ids)), 'Duplicate DOM IDs'
                 # Exercise the actual menu callback and its CSP-compatible JS.
-                runtime.icon.menu.items[1](runtime.icon)
-                assert read_js("document.getElementById('page-settings').hidden === false")
+                next(item for item in runtime.icon.menu.items if item.text=='软件更新与后台设置')(runtime.icon)
+                assert read_js("document.getElementById('page-settings').hidden === false"), 'Tray settings action must open settings'
                 result['tray_settings'] = True
                 assert runtime.closing() is False
                 result['close_hides'] = True
diff --git a/envscope/app_identity.py b/envscope/app_identity.py
new file mode 100644
index 0000000..deaf142
--- /dev/null
+++ b/envscope/app_identity.py
@@ -0,0 +1,42 @@
+"""Stable open-source package identity; metadata is not a publisher signature."""
+import json
+from pathlib import Path
+import re
+
+from . import __release__, __version__
+
+APP_ID='io.qudadd.envscope'
+
+
+def build_identity(system):
+    if system not in ('Windows','Darwin'):raise ValueError('Unsupported desktop platform')
+    return {'format':1,'app_id':APP_ID,'version':__version__,'release':__release__,
+            'build_version':__version__,'system':system,
+            'signature_mode':'ad-hoc' if system=='Darwin' else 'unsigned',
+            'publisher_verified':False,'notarized':False}
+
+
+def validate_identity(value,system,release):
+    expected='ad-hoc' if system=='Darwin' else 'unsigned'
+    if (not isinstance(value,dict) or type(value.get('format')) is not int or value['format']!=1
+            or value.get('app_id')!=APP_ID or value.get('release')!=release or value.get('system')!=system
+            or not re.fullmatch(r'v\d+\.\d+\.\d+(?:-(?:alpha|beta|rc)\.\d+)?',release)
+            or value.get('version')!=release[1:].split('-')[0] or value.get('build_version')!=value.get('version')
+            or value.get('signature_mode')!=expected or value.get('publisher_verified') is not False
+            or value.get('notarized') is not False):
+        raise ValueError('更新包应用身份、版本或开源构建标识不符合当前发布规则，已停止安装。')
+    return value
+
+
+def identity_path(executable,system):
+    executable=Path(executable)
+    return (executable.parent.parent/'Resources' if system=='Darwin' else executable.parent)/'build-identity.json'
+
+
+def verify_package_identity(executable,system,release):
+    path=identity_path(executable,system)
+    if path.is_symlink() or not path.is_file() or path.stat().st_size>16384:
+        raise ValueError('更新包缺少有效的应用身份记录，已停止安装。')
+    try:value=json.loads(path.read_text(encoding='utf-8'))
+    except (ValueError,UnicodeError):raise ValueError('应用身份记录无效。') from None
+    return validate_identity(value,system,release)
diff --git a/envscope/desktop_runtime.py b/envscope/desktop_runtime.py
index 1c3018c..1fa8de6 100644
--- a/envscope/desktop_runtime.py
+++ b/envscope/desktop_runtime.py
@@ -261,6 +261,10 @@ def native_main(server):
         except (AccountError,OSError,ValueError):
             pass  # The read-only catalog exposes unreadable records for review.
         url = "http://127.0.0.1:" + str(server.server_port)
+        if platform.system()=='Windows':
+            import ctypes
+            from .app_identity import APP_ID
+            ctypes.windll.shell32.SetCurrentProcessExplicitAppUserModelID(APP_ID)
         webview.settings.update(ALLOW_DOWNLOADS=True, ALLOW_FILE_URLS=False, OPEN_EXTERNAL_LINKS_IN_BROWSER=True)
         window = webview.create_window("EnvScope", url, width=1180, height=800, min_size=(960, 640))
         runtime = DesktopRuntime(server, window)
diff --git a/envscope/updates.py b/envscope/updates.py
index 8cdeceb..b2c5263 100644
--- a/envscope/updates.py
+++ b/envscope/updates.py
@@ -17,6 +17,7 @@
 
 from . import __version__, __release__
 from .legacy import UPSTREAM_COMMIT
+from .app_identity import verify_package_identity
 
 REPOSITORY = "qudadd/envscope"
 RELEASE = __release__
@@ -266,6 +267,7 @@ def install(self, tag, confirmed=False):
             except (zipfile.BadZipFile, UnicodeError, RuntimeError) as error:
                 raise ValueError("更新包不能安全展开，旧版本保持可用") from error
             relative = exe.relative_to(staging)
+            identity=verify_package_identity(exe,self.system,tag)
             digest = sha256(exe)
             archive.unlink()
             os.replace(staging, destination)
@@ -273,9 +275,9 @@ def install(self, tag, confirmed=False):
             previous = self.store._read("desktop-install.private.json", {})
             if not isinstance(previous, dict):
                 previous = {}
-            receipt = {"version": tag, "executable": str((destination / relative).relative_to(self.store.root)), "sha256": digest}
+            receipt = {"version": tag, "executable": str((destination / relative).relative_to(self.store.root)), "sha256": digest,'identity':identity}
             self.store._write("desktop-install.private.json", {"active": receipt, "previous": previous.get("active")})
-            self.state = {**self.state, "state": "ready", "reason": "新版已核验并安装。可以重启 EnvScope；账号、网络与检测偏好没有修改。"}
+            self.state = {**self.state, "state": "ready",'identity':identity, "reason": "新版应用身份、版本与摘要已核验。此为未正式签名的开源构建；重启后使用新版，旧版和用户资料保留。"}
             return self.status()
         finally:
             if staging and staging.resolve().is_relative_to((self.store.root / "updates/versions").resolve()) and staging.name.startswith(".stage-"):
@@ -295,6 +297,8 @@ def installed(self, previous=False):
             raise ValueError("已安装版本的路径无效")
         if sha256(path) != receipt.get("sha256"):
             raise ValueError("已安装的主程序发生变化，请重新下载")
+        if receipt.get('identity') is not None and verify_package_identity(path,self.system,receipt['version'])!=receipt['identity']:
+            raise ValueError('已安装版本的应用身份记录发生变化，请重新下载。')
         return path
 
     def rollback(self, confirmed=False):
diff --git a/scripts/build_desktop.py b/scripts/build_desktop.py
index 2249b4e..c5c3186 100644
--- a/scripts/build_desktop.py
+++ b/scripts/build_desktop.py
@@ -10,6 +10,8 @@
 import subprocess
 import sys
 import zipfile
+from envscope.app_identity import APP_ID
+from .package_identity import windows_version_file, write_identity
 
 
 def main():
@@ -29,7 +31,9 @@ def main():
                "--distpath", str(root / "dist" / "desktop"), "--workpath", str(root / "build" / "desktop"),
                "--specpath", str(root / "build"), str(root / "scripts" / "desktop_entry.py")]
     environment = dict(os.environ)
+    if platform.system()=='Darwin':command.extend(['--osx-bundle-identifier',APP_ID])
     if platform.system() == 'Windows':
+        command.extend(['--version-file',str(windows_version_file(root/'build/windows-version.txt'))])
         from .build_windows_timezone import build as build_windows_timezone
         native=build_windows_timezone();name='timezone-helper'
         with zipfile.ZipFile(native/(name+'.payload.zip'),'w',zipfile.ZIP_DEFLATED) as archive:
@@ -99,6 +103,7 @@ def main():
                 shutil.copy2(dependency.locate_file(file), dest)
     architecture = {"amd64": "x64", "x86_64": "x64", "arm64": "arm64"}.get(platform.machine().lower(), platform.machine().lower())
     archive = root / "dist" / ("EnvScope-" + ("macOS-" if platform.system() == "Darwin" else "Windows-") + architecture + ".zip")
+    write_identity(app,platform.system())
     if platform.system() == "Darwin":
         subprocess.run(["/usr/bin/codesign", "--force", "--deep", "--sign", "-", str(app)], check=True)
         subprocess.run(["/usr/bin/ditto", "-c", "-k", "--sequesterRsrc", "--keepParent", str(app), str(archive)], check=True)
diff --git a/scripts/package_identity.py b/scripts/package_identity.py
new file mode 100644
index 0000000..fc76eec
--- /dev/null
+++ b/scripts/package_identity.py
@@ -0,0 +1,32 @@
+"""Write native version resources and honest unsigned build identity."""
+import json
+import plistlib
+from pathlib import Path
+
+from envscope import __version__, __release__
+from envscope.app_identity import APP_ID, build_identity
+
+
+def windows_version_file(destination):
+    from PyInstaller.utils.win32.versioninfo import VSVersionInfo, FixedFileInfo, StringFileInfo, StringTable, StringStruct, VarFileInfo, VarStruct
+    parts=tuple(map(int,__version__.split('.')))+(int(__release__.rsplit('.',1)[-1]) if '-alpha.' in __release__ else 0,)
+    value=VSVersionInfo(ffi=FixedFileInfo(filevers=parts,prodvers=parts,mask=0x3f,flags=0x2,OS=0x40004,fileType=1,subtype=0,date=(0,0)),
+        kids=[StringFileInfo([StringTable('040904b0',[StringStruct(key,value) for key,value in {
+            'CompanyName':'EnvScope contributors','FileDescription':'EnvScope desktop environment diagnostics',
+            'FileVersion':__version__,'InternalName':APP_ID,'OriginalFilename':'EnvScope.exe',
+            'ProductName':'EnvScope','ProductVersion':__release__,'LegalCopyright':'EnvScope contributors · MIT License'}.items()])]),
+              VarFileInfo([VarStruct('Translation',[1033,1200])])])
+    path=Path(destination);path.parent.mkdir(parents=True,exist_ok=True);path.write_text(str(value),encoding='utf-8')
+    return path
+
+
+def write_identity(app,system):
+    app=Path(app)
+    resources=app/'Contents/Resources' if system=='Darwin' else app
+    resources.mkdir(parents=True,exist_ok=True)
+    (resources/'build-identity.json').write_text(json.dumps(build_identity(system),indent=2),encoding='utf-8')
+    if system=='Darwin':
+        path=app/'Contents/Info.plist';value=plistlib.loads(path.read_bytes())
+        value.update(CFBundleIdentifier=APP_ID,CFBundleShortVersionString=__version__,CFBundleVersion=__version__,
+                     NSHumanReadableCopyright='EnvScope contributors · MIT License')
+        path.write_bytes(plistlib.dumps(value))
diff --git a/scripts/update_package_smoke.py b/scripts/update_package_smoke.py
index 505d310..e4ee7d2 100644
--- a/scripts/update_package_smoke.py
+++ b/scripts/update_package_smoke.py
@@ -6,6 +6,7 @@
 import subprocess
 import sys
 import tempfile
+from unittest.mock import patch
 
 from envscope.state import StateStore
 from envscope import __release__
@@ -15,7 +16,7 @@
 def main():
     archive = Path(sys.argv[1]) if len(sys.argv) > 1 else Path('dist') / asset_name()
     digest = hashlib.sha256(archive.read_bytes()).hexdigest()
-    tag = 'v99.0.0-alpha.1'  # Synthetic discovery version; not a published release.
+    tag = __release__  # Actual artifact identity; discovery stays entirely offline.
     prefix = 'https://github.com/qudadd/envscope/releases/download/' + tag + '/'
     metadata = [{'tag_name': tag, 'draft': False, 'prerelease': True, 'assets': [
         {'name': archive.name, 'state': 'uploaded', 'size': archive.stat().st_size, 'digest': 'sha256:' + digest, 'browser_download_url': prefix + archive.name},
@@ -34,7 +35,8 @@ def fixture(url, limit, destination=None):
     with tempfile.TemporaryDirectory(prefix='envscope-update-fixture-') as directory:
         store = StateStore(Path(directory) / 'state')
         updater = AppUpdates(store, fixture)
-        assert updater.check()['state'] == 'available'
+        with patch('envscope.updates.RELEASE','v0.0.0-alpha.1'):
+            assert updater.check()['state'] == 'available'
         assert updater.install(tag)['state'] == 'confirmation_required'
         assert updater.install(tag, True)['state'] == 'ready'
         executable = updater.installed()
diff --git a/tests/test_app_identity.py b/tests/test_app_identity.py
new file mode 100644
index 0000000..dcece88
--- /dev/null
+++ b/tests/test_app_identity.py
@@ -0,0 +1,35 @@
+import json
+from pathlib import Path
+import tempfile
+import unittest
+
+from envscope import __release__, __version__
+from envscope.app_identity import APP_ID, build_identity, validate_identity, verify_package_identity
+
+
+class AppIdentityTests(unittest.TestCase):
+    def test_open_source_identity_is_stable_and_never_claims_publisher_trust(self):
+        for system, mode in [('Windows','unsigned'),('Darwin','ad-hoc')]:
+            value=build_identity(system)
+            self.assertEqual(value['app_id'],APP_ID)
+            self.assertEqual(value['version'],__version__)
+            self.assertEqual(value['signature_mode'],mode)
+            self.assertIs(value['publisher_verified'],False)
+            self.assertIs(value['notarized'],False)
+            self.assertEqual(validate_identity(value,system,__release__),value)
+
+    def test_identity_release_platform_and_signature_claims_cannot_drift(self):
+        original=build_identity('Windows')
+        for change in ({'app_id':'another.app'},{'release':'v99.0.0-alpha.1'},{'system':'Darwin'},
+                       {'version':'0.0.0'},{'signature_mode':'publisher'},{'publisher_verified':True},{'notarized':True}):
+            with self.subTest(change=change),self.assertRaises(ValueError):
+                validate_identity({**original,**change},'Windows',__release__)
+
+    def test_missing_changed_and_oversized_package_metadata_is_rejected(self):
+        with tempfile.TemporaryDirectory() as folder:
+            app=Path(folder)/'EnvScope';app.mkdir();exe=app/'EnvScope.exe';exe.write_bytes(b'MZ-fixture')
+            with self.assertRaises(ValueError):verify_package_identity(exe,'Windows',__release__)
+            path=app/'build-identity.json';path.write_text(json.dumps(build_identity('Windows')))
+            self.assertEqual(verify_package_identity(exe,'Windows',__release__)['app_id'],APP_ID)
+            path.write_text(' '*16385)
+            with self.assertRaises(ValueError):verify_package_identity(exe,'Windows',__release__)
diff --git a/tests/test_desktop_runtime.py b/tests/test_desktop_runtime.py
index 0159b0f..bafff33 100644
--- a/tests/test_desktop_runtime.py
+++ b/tests/test_desktop_runtime.py
@@ -15,6 +15,7 @@
 from envscope import __version__
 from envscope.updates import AppUpdates, API, RELEASE, allowed_url, asset_name, safe_extract, version
 from envscope.state import StateStore
+from envscope.app_identity import build_identity
 
 
 class UpdateTests(unittest.TestCase):
@@ -25,14 +26,19 @@ def setUp(self):
         major, minor, _ = version(RELEASE)[:3]
         self.future_base = f'v{major}.{minor+1}.0'
         self.tag = self.future_base + '-alpha.1'
-        self.data = self.archive({'EnvScope/EnvScope.exe': b'MZ-TEST-NOT-EXECUTABLE', 'EnvScope/data.txt': b'test'})
-        self.size = len(self.data)
-        self.digest = hashlib.sha256(self.data).hexdigest()
-        self.checksum = self.digest
+        self.refresh_package()
         self.release = self.metadata()
         self.calls = []
         self.updates = AppUpdates(self.store, self.fetch, 'Windows', 'AMD64')
 
+    def refresh_package(self,change=None):
+        identity={**build_identity('Windows'),'release':self.tag,'version':self.tag[1:].split('-')[0],'build_version':self.tag[1:].split('-')[0],**(change or {})}
+        self.data = self.archive({'EnvScope/EnvScope.exe': b'MZ-TEST-NOT-EXECUTABLE', 'EnvScope/data.txt': b'test',
+                                 'EnvScope/build-identity.json':json.dumps(identity).encode()})
+        self.size = len(self.data)
+        self.digest = hashlib.sha256(self.data).hexdigest()
+        self.checksum = self.digest
+
     def archive(self, values):
         out = io.BytesIO()
         with zipfile.ZipFile(out, 'w') as z:
@@ -71,6 +77,7 @@ def test_verified_side_by_side_install_and_second_version_rollback(self):
         first = self.updates.installed()
         self.assertEqual(first.read_bytes(), b'MZ-TEST-NOT-EXECUTABLE')
         self.tag = self.future_base + '-alpha.2'
+        self.refresh_package()
         self.release = self.metadata()
         self.updates.check()
         self.updates.install(self.tag, True)
@@ -87,6 +94,13 @@ def test_bad_checksum_does_not_change_installed_pointer(self):
         self.assertIsNone(self.updates.installed())
         self.assertFalse(list((self.store.root / 'updates/versions').iterdir()))
 
+    def test_archive_hash_cannot_substitute_for_package_identity(self):
+        self.refresh_package({'app_id':'another.application'})
+        self.release=self.metadata();self.updates.check()
+        with self.assertRaises(ValueError):self.updates.install(self.tag,True)
+        self.assertIsNone(self.updates.installed())
+        self.assertFalse(list((self.store.root/'updates/versions').iterdir()))
+
     def test_corrupt_archive_and_traversal_are_rejected(self):
         self.updates.check()
         self.data += b'corruption'

From f347ff335afd0c704cd7794b4d12f4916b777890 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:06:25 +0800
Subject: [PATCH 07/10] fix: retain guard attention after restart and document
 permission acceptance

---
 docs/ARCHITECTURE.md                          | 21 ++++++++++---
 docs/DESKTOP_ACCEPTANCE.md                    |  8 +++--
 docs/PERMISSION_ACCEPTANCE.md                 | 31 +++++++++++++++++++
 docs/TIMEZONE_SERVICE.md                      | 21 ++++++++++---
 .../plans/2026-10-30-permissions-and-ui.md    | 24 +++++++-------
 envscope/desktop_runtime.py                   |  6 ++++
 envscope/guard_notifications.py               |  6 ++--
 envscope/web/watchdog_ui.mjs                  |  3 +-
 tests/test_desktop_runtime.py                 | 11 +++++++
 9 files changed, 105 insertions(+), 26 deletions(-)
 create mode 100644 docs/PERMISSION_ACCEPTANCE.md

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 3cc4325..0bb3a87 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -14,11 +14,11 @@
 
 ## 使用流程
 
-Windows 双击 `EnvScope.exe`，macOS 双击 `EnvScope.app`。本机服务启动并打开默认浏览器。用户点击“一键检测”，页面自动合并系统与当前浏览器观测，可导出一份隐藏地址的结果。
+Windows 双击 `EnvScope.exe`，macOS 双击 `EnvScope.app`。桌面包启动独立窗口及本机服务；源码网页入口才打开浏览器。确认目标后点击“一键检测”，自动合并系统与当前浏览器观测，可导出隐藏地址的结果。
 
-源码入口为 `start-windows.cmd` / `start-macos.command`，需要 Python 3.10+。桌面打包版本自带 Python 运行时，不包含 Scrapling。当前 Windows 打包已在本机验证；macOS 的采集代码及构建流程已准备，真机验证另行记录。
+源码入口为 `start-windows.cmd` / `start-macos.command`，需要 Python 3.10+。桌面包自带 Python 运行时，不包含 Scrapling。Windows、macOS ARM64 与 Intel 的冻结包由原生 CI 验证；真实用户授权交互另行记录。
 
-不提供手机端适配。界面使用桌面单列布局、黑白文字、细分隔线和折叠详情。没有分数、卡片、装饰图标或大幅口号。
+不提供手机端适配。界面采用极简桌面布局、清晰的层级与折叠详情；图标服务于导航和状态，不引入风险评分或装饰性大幅口号。
 
 ## 数据流
 
@@ -95,4 +95,17 @@ STUN 验证消息类型、magic cookie、transaction ID、消息长度、属性
 
 ## 仍待完成的边界
 
-没有权威 DNS 服务、目标进程与套接字关联、抓包证据或原生系统防火墙保护。Windows 的原生加密快照、临时浏览器、系统地区变更以及整个产品的签名更新尚未实现。没有位置伪装或账号风险评分。完整能力与平台差异见 [功能对照](FEATURE_PARITY.md)。
+没有权威 DNS 出口测量、完整目标进程与套接字关联、抓包证据或原生系统防火墙保护。Windows 已具备加密快照、临时浏览器、地区变更与受保护的时区任务；这些能力不能替代服务端账号验证。当前发布采用未正式签名的开源构建，参见 [构建身份与更新](OPEN_SOURCE_BUILDS.md)。没有位置伪装或账号风险评分。完整能力与平台差异见 [功能对照](FEATURE_PARITY.md)。
+
+## 权限、后台能力与结果证据
+
+`observation_errors.py` 保留每个子项的拒绝、策略限制、超时、工具缺失或解析错误。
+读取失败会传到依赖检查和汇总；部分采集不会变成全项通过。`permissions.py` 根据实际
+拒绝和当前使用目标返回用途、作用范围、相关检查与系统入口。`permission_flow.mjs`
+仅在返回设置时复检一次；目标或选择改变则使等待中的续检失效。
+
+`guard_capabilities.py` 只读检查当前令牌能力。Windows 用户具备时区权限时继续使用
+原用户任务；缺权时前台申请受保护的 SYSTEM 任务。`timezone_windows.py` 和 macOS
+`timezone_service.py` 均提供预览、确认、独立读回、恢复和撤销。前台授权与周期心跳分别
+记录，后台不会弹授权窗口。`guard_notifications.py` 对需要处理的状态去重，正常巡检和
+恢复只留日志。实施与验收范围见 [权限升级验收表](PERMISSION_ACCEPTANCE.md)。
diff --git a/docs/DESKTOP_ACCEPTANCE.md b/docs/DESKTOP_ACCEPTANCE.md
index 036f0cc..0077465 100644
--- a/docs/DESKTOP_ACCEPTANCE.md
+++ b/docs/DESKTOP_ACCEPTANCE.md
@@ -1,4 +1,4 @@
-# 0.8 独立软件与功能回归
+# 独立软件与功能回归
 
 产品流程：首次教学 → 一键检测 → 问题与权限分类 → 合并修复方案 → 确认写入 →
 自动复检 → 实际 Claude 使用 → 可选日常维护。普通检查无需先配置比较目标或维护核心。
@@ -12,13 +12,17 @@
 - Windows 系统信息逐项采集；某一字段失败不丢弃其余字段。
 - 使用条件结论与严格隐私判定、账号启动门槛分开。后两者未放宽；
   DNS 权威出口、进程流量关联未实现，IPv6/UDP 无响应不记为通过。
-- 只有 PermissionError 才给权限原因。一般 I/O 失败不会伪装成权限不足。
+- 仅真实拒绝或已识别的系统拒绝代码给出权限原因；组织策略限制、超时、工具缺失和一般 I/O 失败分别展示。
 - 独立窗口使用 pywebview，托盘使用 pystray。默认关闭时驻留；托盘未就绪则保留
   正常退出方式。执行中不退出；重复启动唤回已有窗口。
 - 更新只信任指定仓库、HTTPS、目标架构与合法版本号。下载同时核对 GitHub 摘要、
   SHA256SUMS、大小及归档路径。安装在旁边的版本目录；校验失败保留当前版本。
   原始下载目录始终保留，应用内回退针对已保存的前一更新版本。
 
+本轮权限与后台升级的当前证据见 [权限验收表](PERMISSION_ACCEPTANCE.md)。更新还核对
+`io.qudadd.envscope` 应用标识与包内版本；当前构建未进行正式发布者签名或 Apple 公证，
+详见 [开源构建](OPEN_SOURCE_BUILDS.md)。
+
 ## 可重复验收
 
 | 范围 | 验收入口与证据 | 边界 |
diff --git a/docs/PERMISSION_ACCEPTANCE.md b/docs/PERMISSION_ACCEPTANCE.md
new file mode 100644
index 0000000..015fad4
--- /dev/null
+++ b/docs/PERMISSION_ACCEPTANCE.md
@@ -0,0 +1,31 @@
+# 权限与后台升级验收
+
+本表区分实现、隔离测试和真实用户设备观察。测试中的允许/取消/拒绝响应，不代表已由
+真实用户点击 UAC/TCC。开发和回归测试不修改用户的实际时区、网络、应用或账号。
+
+| 审查项 | 已实施 | 验证入口 | 设备边界 |
+|---|---|---|---|
+| 子项失败但汇总通过 | 结构化子项错误传递到汇总及依赖项 | `test_inventory_permissions` | 模拟 Windows/macOS 拒绝、超时、部分结果 |
+| 授权用途及续检 | 按检查和目标给入口，返回后一次复检，目标变更作废旧续检 | `test_permissions`、`permission_flow.test.mjs`、`permission_flow_smoke` | 系统设置与授权响应使用夹具 |
+| 后台写入权限 | 原用户能力预检；缺权时前台批准原生系统时区任务；每轮重验 | `test_watchdog`、`test_windows_timezone_service`、`test_timezone_integration` | 原生调度的真实周期另列于发布 CI |
+| 取消和半完成操作 | 区分取消、策略拒绝、执行失败和超时；保存受保护事务供恢复 | `test_consent`、时区/网络/迁移事务测试 | 不由退出码假设没有发生写入 |
+| 应用身份与更新 | 固定应用 ID、原生版本资源、更新包身份和摘要核对 | `test_app_identity`、`test_desktop_runtime`、冻结包与更新烟测 | Windows 未签名；macOS ad-hoc；正式签名按开源交付范围延期 |
+| 权限变更及异常提醒 | 停用、其他用户归属、心跳过期、文件篡改、反复修复暂停、去重通知 | `test_guard_notifications`、原生服务与后台测试 | 真实用户授权撤销、重启及睡眠唤醒尚待专用设备验收 |
+
+Windows 原生验收 `scripts.windows_timezone_acceptance` 只在明确启用的 CI 管理员会话中
+运行，使用唯一任务名与文件模拟时钟。它验证 SYSTEM 自动周期、可写 ACL 拒绝、移除与
+恢复、撤销和事务中断恢复；执行前后比较真实 `tzutil /g`。macOS 的对应入口为
+`scripts.timezone_acceptance`，使用唯一 fixture 路径及真实 LaunchDaemon，并核对
+`/etc/localtime` 未改变。fixture 辅助程序不进入发布包。
+
+当前本地完整回归：720 项 Python 测试通过（5 项平台跳过），19 项 JavaScript 测试通过；
+真实 Windows 冻结包和离线更新包的窗口、托盘、隐藏、恢复、退出与版本身份检查通过。
+跨平台原生验收以本分支和最终发布标签的 [desktop packages 工作流](https://github.com/qudadd/envscope/actions/workflows/desktop.yml)
+结果与对应产物为准；未成功的运行不计为通过。
+
+后续专用设备矩阵仍待执行：普通用户首次允许/取消、组织策略拒绝、运行中撤权、升级后
+再次打开、系统重启、睡眠唤醒。当前开源 Alpha 可继续交付，但不得将这些待验证场景写成
+已通过。正式签名与公证不是当前交付前提，也不替代任何 OS 权限检查。
+
+权限无法补齐未实现的检测：权威 DNS 出口、完整进程流量关联、Claude 登录、账号额度与
+实际回复各有自己的证据来源；超时、未实现和缺少认证不应一概显示为“申请权限即可修复”。
diff --git a/docs/TIMEZONE_SERVICE.md b/docs/TIMEZONE_SERVICE.md
index b97ebe9..557cc41 100644
--- a/docs/TIMEZONE_SERVICE.md
+++ b/docs/TIMEZONE_SERVICE.md
@@ -1,16 +1,23 @@
-# macOS 系统时区守护（0.16 Alpha）
+# Windows / macOS 系统时区守护
 
 先填写实际使用地区和期望城市，完成一次当前目标的检测。在“保持本次设置”勾选
 时区守护并预览，所需系统授权会合并在同一份方案中。也可在“持续维护”的系统
 时区守护入口独立安装或更新。普通检测不会安装服务，应用不接收或保存管理员密码。
 
-确认后 macOS 申请管理员授权，此改动影响整台 Mac 的所有用户。仅完整 macOS
-独立桌面包随附已编译的辅助程序；源码安装缺少该程序时会给出获取完整包的提示。
-Windows 继续使用用户任务恢复批准值，权限不足时标红并给出系统设置入口。
+确认后按需申请系统授权，此改动影响整台电脑。完整独立桌面包随附编译好的辅助程序；
+源码安装缺少该程序时会给出获取完整包的提示。Windows 先检查当前用户令牌，具备时区
+权限时使用原用户任务；缺少权限时将系统任务授权纳入同一份守护方案。
+
+Windows 系统任务 `EnvScope-TimezoneGuard` 使用 SYSTEM 身份，每 60 秒运行固定的原生
+`timezone-helper.exe --once`。固定目录为 `%ProgramData%/EnvScope/TimezoneGuard`，
+只允许 SYSTEM 与管理员写入；普通用户可读状态及任务定义。前台安装脚本是可读的固定源码，
+提权入口核对一次内存快照的摘要后执行；不会降低执行策略，也不会把可写脚本交给后台任务。
+辅助程序执行前核对路径、所有者、ACL 与自身摘要，仅在写时区期间启用所需令牌权限。
+事务日志为 `lifecycle-YYYY-MM-DD.jsonl`，周期事件为 `events-YYYY-MM-DD.jsonl`。
 
 ## 自动处理和撤销
 
-- 原生 LaunchDaemon 每 60 秒读回时区；有漂移时记录原值和目标，调用系统时区接口，
+- 原生 Windows 任务 / macOS LaunchDaemon 每 60 秒读回时区；有漂移时记录原值和目标，调用系统时区接口，
   再独立读回。启动安装时的一次读回不算周期巡检成功，界面等待新心跳。
 - 尝试至少相隔 5 分钟，24 小时最多 3 次；调用超过 20 秒会停止等待并记录。
   未完成写入、反复失败或系统时间异常不会计为守护正常。
@@ -25,6 +32,10 @@ Windows 继续使用用户任务恢复批准值，权限不足时标红并给出
 
 ## 权限和文件
 
+以下固定服务路径说明适用于 macOS。当前最低版本保留 macOS 12，因此仍使用受保护
+LaunchDaemon；[SMAppService](https://developer.apple.com/documentation/servicemanagement/smappservice)
+适用于 macOS 13 及以上，后续迁移需一并验证批准状态和旧服务移除，不能仅替换注册调用。
+
 辅助程序是独立 C 程序，只链接系统库和 CoreFoundation；不以 root 运行 Python、
 PyInstaller 入口、用户可写脚本或上游代码。打包时以压缩数据载荷保留辅助程序的原始
 字节，避免打包器重签名改变摘要；先在普通用户的私有临时缓存解包并校验。每次前台
diff --git a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
index 49361c7..0fb83e2 100644
--- a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
+++ b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
@@ -55,10 +55,10 @@
 
 **Interfaces:** Guard preparation exposes per-component capability/authorization state; service adapters implement status/prepare/apply/recover/undo/remove using reviewed plan IDs and protected receipts. UI receives component states from these results rather than inferring authority from a saved baseline.
 
-- [ ] Add regressions proving a matched baseline with insufficient write authority cannot be represented as automatic protection; cover revoke, cancel, tampered files, foreign owner and pending recovery.
-- [ ] Implement native Windows timezone service and one-time reviewed installation/update/removal; preserve existing macOS root service behavior and evaluate the supported SMAppService route.
-- [ ] Implement deduplicated actionable notifications with a direct return to the failed component.
-- [ ] Run isolated native service lifecycle and at least two automatic scheduler cycles on supported CI platforms, with original machine values unchanged; run full suites; commit and ledger evidence.
+- [x] Add regressions proving a matched baseline with insufficient write authority cannot be represented as automatic protection; cover revoke, cancel, tampered files, foreign owner and pending recovery.
+- [x] Implement native Windows timezone service and one-time reviewed installation/update/removal; preserve existing macOS root service behavior and evaluate the supported SMAppService route.
+- [x] Implement deduplicated actionable notifications with a direct return to the failed component.
+- [x] Run isolated native service lifecycle and at least two automatic scheduler cycles on supported CI platforms, with original machine values unchanged; run full suites; commit and ledger evidence.
 
 ### Task 4: Release identity, signatures and update verification
 
@@ -66,19 +66,19 @@
 
 **Interfaces:** Build metadata carries stable `io.qudadd.envscope` identity, semantic/build versions and signed/unsigned mode. Signed release verification requires the configured publisher identity plus archive integrity; missing required signing credentials fail signed release builds.
 
-- [ ] Add executable-package metadata and signer-verification regressions using isolated signed/unsigned/tampered fixtures.
-- [ ] Under the clarified open-source scope, ship unsigned/ad-hoc builds with fixed identity, native version resources and package identity validation. Document publisher signing/notarization as a future optional release mode; do not claim or silently accept unverified publisher identity.
-- [ ] Deliver the requested unsigned open-source build, verify identity continuity, and document optional signing configuration. Never label unsigned artifacts as publisher-signed or notarized.
-- [ ] Run builds, package verification, update smoke tests and full suites; commit and retain signing/notarization receipts without secrets.
+- [x] Add executable-package metadata and signer-verification regressions using isolated signed/unsigned/tampered fixtures.
+- [x] Under the clarified open-source scope, ship unsigned/ad-hoc builds with fixed identity, native version resources and package identity validation. Document publisher signing/notarization as a future optional release mode; do not claim or silently accept unverified publisher identity.
+- [x] Deliver the requested unsigned open-source build, verify identity continuity, and document optional signing configuration. Never label unsigned artifacts as publisher-signed or notarized.
+- [x] Run local builds, package identity verification, update smoke tests and full suites; record unsigned status. Final macOS package metadata readback remains part of Task 7 distribution verification.
 
 ### Task 5: Optimization acceptance and documentation
 
 **Files:** Update `docs/ARCHITECTURE.md`, `docs/DESKTOP_ACCEPTANCE.md`, permission/service docs and backend capability presentation. Create a checked requirement/evidence matrix under `docs/`.
 
-- [ ] Reconcile each of the six source-audit priorities with source, regression and native evidence; fix uncovered behavior before checking it off.
-- [ ] Execute the real standard-user/admin consent matrix on dedicated devices, including allow/cancel/revoke, service disable, reboot/sleep and upgrade. Record observed outcomes; leave unavailable device evidence pending.
-- [ ] Verify notification deduplication, stop/revoke/uninstall and no loss of current features.
-- [ ] Update stale docs and capability descriptions from the actual implementation. Only mark this task complete when all optimization requirements or explicitly revised user requirements are satisfied.
+- [x] Reconcile each of the six source-audit priorities with source, regression and native evidence; fix uncovered behavior before checking it off.
+- [x] Record the dedicated-device matrix for real standard-user/admin allow/cancel/revoke, service disable, reboot/sleep and upgrade as pending. Under the open-source Alpha scope, do not block the UI on unavailable human OS-dialog evidence or count fixtures as that evidence.
+- [x] Verify notification deduplication, stop/revoke/uninstall and no loss of current features.
+- [x] Update stale docs and capability descriptions from the actual implementation. Only mark this task complete when all optimization requirements or explicitly revised user requirements are satisfied.
 
 ### Task 6: Complete desktop UI, icons and interaction refresh
 
diff --git a/envscope/desktop_runtime.py b/envscope/desktop_runtime.py
index 1fa8de6..1fa9f2a 100644
--- a/envscope/desktop_runtime.py
+++ b/envscope/desktop_runtime.py
@@ -99,9 +99,15 @@ def poll_guard(self):
         if lock is not None and lock.locked():return
         maintenance=operations.maintenance.status();timezone=operations.timezone_service.status()
         self.guard_notifications.update(maintenance,timezone)
+        if self.guard_notifications.current and self.guard_attention!=self.guard_notifications.current:
+            # Restore the in-app state after restart without a duplicate toast.
+            self.guard_attention=self.guard_notifications.current
+            self.window.run_js('document.dispatchEvent(new CustomEvent("envscope-guard-attention",{detail:'+json.dumps(self.guard_attention,ensure_ascii=True)+'}))')
+            if self.icon:self.icon.update_menu()
         if self.guard_attention and not self.guard_notifications.active:
             self.guard_attention=None
             self.window.run_js('document.dispatchEvent(new CustomEvent("envscope-guard-clear"))')
+            if self.icon:self.icon.update_menu()
 
     def status(self):
         installed = self.server.store._read("desktop-install.private.json", {})
diff --git a/envscope/guard_notifications.py b/envscope/guard_notifications.py
index e891a73..fd205e8 100644
--- a/envscope/guard_notifications.py
+++ b/envscope/guard_notifications.py
@@ -13,6 +13,7 @@ def __init__(self,store,sink,clock=time.time):
         self.saved=store._read('guard-notifications.private.json',{})
         if not isinstance(self.saved,dict):self.saved={}
         self.active=False
+        self.current=None
 
     def update(self,maintenance,timezone):
         saved=self.saved
@@ -36,9 +37,10 @@ def update(self,maintenance,timezone):
         if waiting is not None and self.clock()-waiting>=180:issues['timezone']='heartbeat_lost'
         fingerprint=hashlib.sha256(json.dumps(issues,sort_keys=True).encode()).hexdigest() if issues else ''
         changed=bool(issues and fingerprint!=saved.get('fingerprint'))
+        names=sorted(issues)
+        self.current={'components':names,'message':'、'.join(LABELS[name] for name in names)+'需要处理。打开守护方案查看原因与恢复入口。'} if issues else None
         if changed:
-            names=sorted(issues)
-            self.sink({'components':names,'message':'、'.join(LABELS[name] for name in names)+'需要处理。打开守护方案查看原因与恢复入口。'})
+            self.sink(self.current)
         self.active=bool(issues)
         self.saved={'fingerprint':fingerprint,'timezone_expected':expected,'waiting_since':waiting}
         if self.saved!=saved:self.store._write('guard-notifications.private.json',self.saved)
diff --git a/envscope/web/watchdog_ui.mjs b/envscope/web/watchdog_ui.mjs
index 23b3b7e..39400e7 100644
--- a/envscope/web/watchdog_ui.mjs
+++ b/envscope/web/watchdog_ui.mjs
@@ -14,7 +14,8 @@ export function initWatchdogForms(run){
           const select=$(p+'-guard-client'),previous=select.value;
           select.replaceChildren(new Option('不重开客户端，仅恢复可读取节点',''),...(value.clients||[]).map(c=>new Option(c.label+' · '+c.path,c.id)));
           if([...select.options].some(o=>o.value===previous))select.value=previous;
-          $(p+'-guard-note').textContent=value.note+(!(value.clients||[]).length?' 未找到支持的已安装客户端；代理离线需手动处理。':'');
+          const capabilityNote=Object.values(value.capabilities||{}).map(c=>c.reason).filter(Boolean).join(' ');
+          $(p+'-guard-note').textContent=[capabilityNote,value.note,!(value.clients||[]).length?'未找到支持的已安装客户端；代理离线需手动处理。':''].filter(Boolean).join(' ');
           $(p+'-plan').replaceChildren();
         }
       }catch(e){$(prefix+'-guard-note').textContent='未读取客户端：'+e.message;}finally{button.disabled=false;}
diff --git a/tests/test_desktop_runtime.py b/tests/test_desktop_runtime.py
index bafff33..5ab2349 100644
--- a/tests/test_desktop_runtime.py
+++ b/tests/test_desktop_runtime.py
@@ -183,6 +183,17 @@ def setUp(self):
         self.server = SimpleNamespace(store=self.store, audit_lock=threading.Lock())
         self.runtime = DesktopRuntime(self.server, self.window)
 
+    def test_guard_failure_survives_restart_without_repeating_os_notification(self):
+        self.server.operations=SimpleNamespace(maintenance=Mock(),timezone_service=Mock())
+        self.server.operations.maintenance.status.return_value={'enabled':True,'watchdog':{'proxy':{'state':'attention'}}}
+        self.server.operations.timezone_service.status.return_value={'state':'not_installed'}
+        self.runtime.icon=Mock();self.runtime.ready.set();self.runtime.poll_guard()
+        self.runtime.icon.notify.assert_called_once()
+        again=DesktopRuntime(self.server,self.window);again.icon=Mock();again.ready.set();again.poll_guard()
+        again.icon.notify.assert_not_called()
+        self.assertEqual(again.guard_attention['components'],['proxy'])
+        self.assertIn('envscope-guard-attention',self.window.run_js.call_args.args[0])
+
     def test_close_hides_only_with_a_working_tray(self):
         self.assertTrue(self.runtime.closing())
         self.runtime.icon = Mock()

From 37e5cabf016e32a4d3ba734e3699cae40e5b842b Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:42:24 +0800
Subject: [PATCH 08/10] feat: simplify desktop workflow and refresh application
 icons

---
 .github/workflows/checks.yml                  |   7 +-
 .impeccable/design.json                       | 124 +++++++++++++++
 DESIGN.md                                     | 131 ++++++++++++++++
 PRODUCT.md                                    |  14 ++
 README.md                                     |   6 +-
 docs/DESKTOP_ACCEPTANCE.md                    |   9 ++
 docs/SIMPLE_WORKFLOW.md                       |   4 +-
 docs/UI_DESIGN.md                             |  10 +-
 docs/releases/0.25.0-alpha.1.md               |  16 ++
 .../plans/2026-10-30-permissions-and-ui.md    |  10 +-
 envscope/__init__.py                          |   2 +-
 envscope/desktop_runtime.py                   |   9 +-
 envscope/web/app-icon.png                     | Bin 0 -> 26569 bytes
 envscope/web/app.icns                         | Bin 0 -> 64260 bytes
 envscope/web/app.ico                          | Bin 0 -> 19461 bytes
 envscope/web/app.mjs                          |  14 +-
 envscope/web/controls.mjs                     |   8 +-
 envscope/web/desktop.mjs                      |   6 +-
 envscope/web/diagnosis.mjs                    |   4 +-
 envscope/web/icons.mjs                        |  25 +++
 envscope/web/index.html                       |  16 +-
 envscope/web/inspection.mjs                   |  12 +-
 envscope/web/mark.svg                         |   1 +
 envscope/web/scan.svg                         |   1 +
 envscope/web/target.mjs                       |  12 +-
 envscope/web/tray.png                         | Bin 0 -> 2751 bytes
 envscope/web/workspace.css                    | 142 ++++++++++++++++++
 envscope/web/workspace_ui.mjs                 |  21 +++
 pyproject.toml                                |   2 +-
 scripts/build_desktop.py                      |   1 +
 scripts/build_icons.py                        |  27 ++++
 scripts/desktop_refresh_smoke.py              |  81 ++++++++++
 scripts/desktop_ui_smoke.py                   |   4 +-
 scripts/region_lookup_smoke.py                |   8 +
 scripts/simple_workflow_smoke.py              |   8 +-
 scripts/ui_navigation.py                      |   6 +-
 scripts/verify_package.py                     |   2 +
 37 files changed, 701 insertions(+), 42 deletions(-)
 create mode 100644 .impeccable/design.json
 create mode 100644 DESIGN.md
 create mode 100644 PRODUCT.md
 create mode 100644 docs/releases/0.25.0-alpha.1.md
 create mode 100644 envscope/web/app-icon.png
 create mode 100644 envscope/web/app.icns
 create mode 100644 envscope/web/app.ico
 create mode 100644 envscope/web/icons.mjs
 create mode 100644 envscope/web/mark.svg
 create mode 100644 envscope/web/scan.svg
 create mode 100644 envscope/web/tray.png
 create mode 100644 envscope/web/workspace.css
 create mode 100644 envscope/web/workspace_ui.mjs
 create mode 100644 scripts/build_icons.py
 create mode 100644 scripts/desktop_refresh_smoke.py

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index faaf9df..0d6ff72 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -28,7 +28,10 @@ jobs:
       - name: Detached browser cleanup after parent exit (owned processes only)
         if: runner.os != 'Linux'
         run: python -m scripts.browser_session_acceptance
-      - run: node --test tests/browser.test.mjs
+      - run: node --test tests/browser.test.mjs tests/permission_flow.test.mjs
+      - run: node --check envscope/web/permission_flow.mjs
+      - run: node --check envscope/web/workspace_ui.mjs
+      - run: node --check envscope/web/icons.mjs
       - run: node --check envscope/web/app.mjs
       - run: node --check envscope/web/controls.mjs
       - run: node --check envscope/web/diagnosis.mjs
@@ -62,6 +65,8 @@ jobs:
       - run: python -m scripts.browser_smoke
       - run: python -m scripts.usability_smoke
       - run: python -m scripts.desktop_ui_smoke
+      - run: python -m scripts.desktop_refresh_smoke
+      - run: python -m scripts.permission_flow_smoke
       - run: python -m scripts.target_environment_smoke
       - run: python -m scripts.coverage_smoke
       - run: python -m scripts.browser_recovery_smoke
diff --git a/.impeccable/design.json b/.impeccable/design.json
new file mode 100644
index 0000000..b21db2e
--- /dev/null
+++ b/.impeccable/design.json
@@ -0,0 +1,124 @@
+{
+  "schemaVersion": 2,
+  "generatedAt": "2026-10-30T10:37:02.2768526Z",
+  "title": "Design System: EnvScope",
+  "extensions": {
+    "colorMeta": {
+      "paper": { "role": "neutral", "displayName": "主画布" },
+      "rail": { "role": "neutral", "displayName": "侧栏与筛选底色" },
+      "ink": { "role": "primary", "displayName": "正文与主操作" },
+      "muted": { "role": "neutral", "displayName": "辅助文字" },
+      "line": { "role": "neutral", "displayName": "分隔线" },
+      "selected": { "role": "neutral", "displayName": "当前导航" },
+      "panel": { "role": "neutral", "displayName": "目标与守护摘要" },
+      "expanded": { "role": "neutral", "displayName": "展开行" },
+      "danger": { "role": "primary", "displayName": "手动说明与检查错误" },
+      "manual-danger": { "role": "primary", "displayName": "现有手动徽标与左边线" }
+    },
+    "typographyMeta": {
+      "headline": { "displayName": "页面标题", "purpose": "主页面标题。" },
+      "title": { "displayName": "分节标题", "purpose": "常规功能分节，继承系统字体。" },
+      "body": { "displayName": "正文", "purpose": "默认正文。" },
+      "label": { "displayName": "操作文字", "purpose": "按钮；主按钮单独增加字重。" },
+      "field": { "displayName": "输入与导航", "purpose": "输入框、选择框与导航的字号和行高。" },
+      "note": { "displayName": "辅助说明", "purpose": "范围、限制与状态补充。" },
+      "link": { "displayName": "文本操作", "purpose": "带下划线的次要操作。" },
+      "mono": { "displayName": "原始证据", "purpose": "可换行的原始证据。" }
+    },
+    "shadows": [],
+    "motion": [
+      { "name": "button-state", "value": "background-color .12s, border-color .12s", "purpose": "按钮背景和边框变化，沿用 CSS 默认 ease。" },
+      { "name": "reduced-motion", "value": "transition: none !important; animation: none !important; scroll-behavior: auto !important", "purpose": "在 prefers-reduced-motion: reduce 下应用。" }
+    ],
+    "breakpoints": [
+      { "name": "compact-desktop-max-width", "value": "1100px" }
+    ]
+  },
+  "components": [
+    {
+      "name": "主按钮",
+      "kind": "button",
+      "refersTo": "button-primary",
+      "description": "当前主要动作使用深色实心白字。",
+      "html": "<button type=\"button\" class=\"ds-primary\">生成方案</button>",
+      "css": ".ds-primary{font:550 13px/1.45 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;min-height:40px;padding:10px 22px;color:var(--paper,#fff);background:var(--ink,#202322);border:1px solid var(--ink,#202322);border-radius:var(--radius,7px);cursor:pointer;transition:background-color .12s,border-color .12s}.ds-primary:hover:not(:disabled){background:#394038;border-color:#394038}.ds-primary:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-primary:disabled{opacity:.45;cursor:default}@media(prefers-reduced-motion:reduce){.ds-primary{transition:none!important}}"
+    },
+    {
+      "name": "普通按钮",
+      "kind": "button",
+      "refersTo": "button-secondary",
+      "description": "次要操作与工具调用使用白底细边。",
+      "html": "<button type=\"button\" class=\"ds-secondary\">预览所选修改</button>",
+      "css": ".ds-secondary{font:400 13px/1.45 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;min-height:36px;padding:8px 14px;color:var(--ink,#202322);background:var(--paper,#fff);border:1px solid #bdc5b9;border-radius:var(--radius,7px);cursor:pointer;transition:background-color .12s,border-color .12s}.ds-secondary:hover:not(:disabled){background:#f1f4ef;border-color:#919c89}.ds-secondary:active:not(:disabled){background:#e8ede4}.ds-secondary:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-secondary:disabled{opacity:.45;cursor:default}@media(prefers-reduced-motion:reduce){.ds-secondary{transition:none!important}}"
+    },
+    {
+      "name": "文本操作",
+      "kind": "button",
+      "refersTo": "button-link",
+      "description": "设置、查看和选择等操作使用下划线。",
+      "html": "<button type=\"button\" class=\"ds-link\">调整地区与时区</button>",
+      "css": ".ds-link{display:inline-flex;align-items:center;gap:8px;min-height:28px;padding:2px 0;font:400 12px/1.55 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;color:var(--ink,#202322);background:transparent;border:0;border-radius:2px;text-decoration:underline;text-underline-offset:3px;cursor:pointer}.ds-link:hover:not(:disabled){background:transparent;color:#000}.ds-link:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-link:disabled{opacity:.45;cursor:default}"
+    },
+    {
+      "name": "输入框",
+      "kind": "input",
+      "refersTo": "input",
+      "description": "带可见标签的白底输入框。",
+      "html": "<label class=\"ds-field\">查找项目<input type=\"search\" placeholder=\"例如：DNS、登录、证书\"></label>",
+      "css": ".ds-field{display:block;font:400 13px/1.65 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;color:var(--ink,#202322)}.ds-field input{box-sizing:border-box;display:block;width:100%;min-height:40px;margin-top:7px;padding:9px 11px;font:400 13px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;background:var(--paper,#fff);color:var(--ink,#202322);border:1px solid #b9c1b5;border-radius:var(--radius,7px)}.ds-field input::placeholder{color:#6d7269;opacity:1}.ds-field input:focus{outline:2px solid var(--ink,#202322);outline-offset:1px;border-color:var(--ink,#202322)}.ds-field input:focus-visible{outline-offset:3px}"
+    },
+    {
+      "name": "侧栏导航",
+      "kind": "nav",
+      "refersTo": "navigation",
+      "description": "文字配原创线条图标，当前页面有浅底色。",
+      "html": "<nav class=\"ds-nav\" aria-label=\"主要功能\"><button type=\"button\" aria-current=\"page\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\" focusable=\"false\"><path d=\"M8 3H3v5m13-5h5v5M3 16v5h5m13-5v5h-5M8 12h8M12 8v8\"/></svg>检测与修复</button><button type=\"button\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\" focusable=\"false\"><path d=\"M12 3 4 6v6c0 5 8 9 8 9s8-4 8-9V6l-8-3Zm-4 9 3 3 5-6\"/></svg>持续守护</button></nav>",
+      "css": ".ds-nav{display:flex;flex-direction:column;gap:5px;padding:16px;background:var(--rail,#f5f6f4)}.ds-nav button{display:flex;align-items:center;gap:10px;min-height:42px;width:100%;padding:10px 12px;font:400 13px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;text-align:left;white-space:normal;border:0;border-radius:var(--radius,7px);color:var(--muted,#626763);background:transparent;cursor:pointer;transition:background-color .12s,border-color .12s}.ds-nav button[aria-current=page]{background:var(--selected,#e5e9e3);color:var(--ink,#202322);font-weight:600}.ds-nav button:hover:not(:disabled){background:#ecefea}.ds-nav button:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-nav svg{width:19px;height:19px;flex-shrink:0;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round}@media(prefers-reduced-motion:reduce){.ds-nav button{transition:none!important}}"
+    },
+    {
+      "name": "目标与守护摘要",
+      "kind": "card",
+      "refersTo": "summary-panel",
+      "description": "浅底细边的状态容器。",
+      "html": "<section class=\"ds-panel\"><h2>尚未启用</h2><p>后台任务需先生成方案并明确启用。</p></section>",
+      "css": ".ds-panel{padding:18px 20px;background:#f7f9f5;color:var(--ink,#202322);border:1px solid var(--line,#dde1dc);border-radius:var(--radius,7px);font:400 14px/1.65 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif}.ds-panel h2{font-size:16px;font-weight:600;line-height:1.5;margin:0}.ds-panel p{font-size:12.5px;line-height:1.75;max-width:80ch;margin:6px 0;color:var(--muted,#626763)}"
+    },
+    {
+      "name": "逐项检查",
+      "kind": "custom",
+      "refersTo": "inspection-row",
+      "description": "原生展开行保留选择、名称、状态与证据入口。",
+      "html": "<details class=\"ds-inspection\"><summary><label class=\"ds-inspection-select\"><input type=\"checkbox\" checked aria-label=\"选择 所选用途的域名解析\"></label><span class=\"ds-inspection-name\"><strong>所选用途的域名解析</strong><small>所选用途的域名解析 · 目标验收</small></span><span class=\"ds-inspection-state\">尚未检测<small>查看说明</small></span></summary><h3>查什么</h3><p>按已确认的用途和连接方式，核对本次证据是否达到目标。</p></details>",
+      "css": ".ds-inspection{margin:0;padding:13px 12px;border-top:1px solid var(--line,#dde1dc);font:400 13px/1.65 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;color:var(--ink,#202322)}.ds-inspection[open]{background:#fafbf9;padding-bottom:20px}.ds-inspection summary{display:flex;align-items:center;justify-content:space-between;gap:14px;line-height:1.8;cursor:pointer}.ds-inspection summary:focus-visible,.ds-inspection input:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-inspection-select{display:inline-flex;width:auto;margin:0 12px 0 0}.ds-inspection-select input{width:16px;height:16px;margin:0 8px 0 0;accent-color:var(--ink,#202322)}.ds-inspection-name{flex:1}.ds-inspection strong{font-size:13px;font-weight:550}.ds-inspection small{display:block;margin-top:3px;color:var(--muted,#626763);font-size:11px}.ds-inspection-state{font-size:12px;min-width:120px;text-align:right;white-space:nowrap}.ds-inspection-state small{text-decoration:underline;text-underline-offset:3px}.ds-inspection h3{font-size:14px;font-weight:550;margin:16px 0 4px 34px}.ds-inspection p{font-size:13px;line-height:1.75;max-width:80ch;margin:0 0 0 34px}"
+    },
+    {
+      "name": "问题摘要",
+      "kind": "custom",
+      "refersTo": "problem-row",
+      "description": "名称、观察与手动处理状态排在同一行，原因按需展开。",
+      "html": "<details class=\"ds-problem\"><summary><span class=\"ds-problem-title\"><strong>配置读取权限</strong><span>操作系统拒绝读取现有配置。</span></span><span class=\"ds-problem-badge\">需要授权</span></summary><p>展开后查看具体影响与处理步骤。</p></details>",
+      "css": ".ds-problem{margin:0;padding:18px 0;border-top:1px solid var(--line,#dde1dc);font:400 13px/1.65 -apple-system,BlinkMacSystemFont,'Segoe UI','PingFang SC','Microsoft YaHei UI',sans-serif;color:var(--ink,#202322)}.ds-problem[open]{padding-bottom:20px}.ds-problem summary{display:flex;align-items:flex-start;justify-content:space-between;gap:24px;list-style:none;width:100%;line-height:1.8;cursor:pointer}.ds-problem summary::-webkit-details-marker{display:none}.ds-problem summary:focus-visible{outline:2px solid var(--ink,#202322);outline-offset:3px}.ds-problem-title{min-width:0;flex:1}.ds-problem-title strong{display:block;font-size:14px;font-weight:600}.ds-problem-title>span{display:block;color:var(--muted,#626763);font-size:12px;line-height:1.8;margin:5px 0 0;max-width:82ch;overflow-wrap:anywhere}.ds-problem-badge{font-size:12px;color:#a92828;white-space:nowrap;text-decoration:underline;text-underline-offset:4px;padding-top:1px}.ds-problem p{font-size:13px;line-height:1.75;max-width:80ch;margin:12px 0;color:var(--muted,#626763)}"
+    }
+  ],
+  "narrative": {
+    "northStar": "黑白极简桌面工具",
+    "overview": "面向 Windows 与 macOS 的日常操作界面。文字、细分隔线和少量浅色容器建立层级；检查、修复与守护沿同一操作流程展开，技术证据按需查看。",
+    "keyCharacteristics": [
+      "固定窄侧栏与单一主内容区。",
+      "系统字体、可见操作文字和原创线条图标。",
+      "中性色为主，红色提示需要处理的故障或手动步骤。",
+      "桌面布局，不做手机适配。"
+    ],
+    "rules": [],
+    "dos": [
+      "Do 保留可见文字、明确状态、键盘焦点与原生表单语义。",
+      "Do 把完整检查与技术证据放在可展开区域，保留访问路径。",
+      "Do 在 1024、1280、1440px 桌面宽度核对布局。"
+    ],
+    "donts": [
+      "Don't 引入手机布局、营销首页、大量装饰卡片、渐变、发光或 emoji。",
+      "Don't 用颜色、图标或“通过”文案掩盖未测、未实现或权限不足。",
+      "Don't 把静态预览或视觉状态当作检测与修复已完成的证据。"
+    ]
+  }
+}
diff --git a/DESIGN.md b/DESIGN.md
new file mode 100644
index 0000000..c71770e
--- /dev/null
+++ b/DESIGN.md
@@ -0,0 +1,131 @@
+---
+name: EnvScope
+description: 面向 Windows 与 macOS 的黑白极简环境检查桌面工具。
+colors:
+  paper: "#fff"
+  rail: "#f5f6f4"
+  ink: "#202322"
+  muted: "#626763"
+  line: "#dde1dc"
+  selected: "#e5e9e3"
+  panel: "#f7f9f5"
+  expanded: "#fafbf9"
+  primary-hover: "#394038"
+  danger: "#ad3030"
+  manual-danger: "#a92828"
+typography:
+  headline:
+    fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei UI", sans-serif'
+    fontSize: "24px"
+    fontWeight: 650
+    lineHeight: 1.4
+    letterSpacing: "-0.5px"
+  title: {fontSize: "16px", fontWeight: 600, lineHeight: 1.5}
+  body:
+    fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", "PingFang SC", "Microsoft YaHei UI", sans-serif'
+    fontSize: "14px"
+    fontWeight: 400
+    lineHeight: 1.65
+  label: {fontSize: "13px", fontWeight: 400, lineHeight: 1.45}
+  field: {fontSize: "13px", fontWeight: 400, lineHeight: 1.5}
+  note: {fontSize: "12.5px", fontWeight: 400, lineHeight: 1.75}
+  link: {fontSize: "12px", fontWeight: 400, lineHeight: 1.55}
+  mono: {fontFamily: "ui-monospace, SFMono-Regular, Consolas, monospace", fontSize: "12px", lineHeight: 1.8}
+rounded:
+  control: "7px"
+  link: "2px"
+spacing:
+  xs: "4px"
+  sm: "8px"
+  md: "12px"
+  lg: "16px"
+  panel: "20px"
+  xl: "24px"
+  desktop-compact: "28px"
+  section: "32px"
+  desktop: "40px"
+components:
+  button-primary: {backgroundColor: "{colors.ink}", textColor: "{colors.paper}", typography: "{typography.label}", rounded: "{rounded.control}", padding: "10px 22px"}
+  button-primary-hover: {backgroundColor: "{colors.primary-hover}", textColor: "{colors.paper}"}
+  button-secondary: {backgroundColor: "{colors.paper}", textColor: "{colors.ink}", typography: "{typography.label}", rounded: "{rounded.control}", padding: "8px 14px"}
+  button-link: {backgroundColor: "transparent", textColor: "{colors.ink}", typography: "{typography.link}", rounded: "{rounded.link}", padding: "2px 0"}
+  input: {backgroundColor: "{colors.paper}", textColor: "{colors.ink}", typography: "{typography.field}", rounded: "{rounded.control}", padding: "9px 11px"}
+  navigation: {backgroundColor: "transparent", textColor: "{colors.muted}", typography: "{typography.field}", rounded: "{rounded.control}", padding: "10px 12px"}
+  navigation-current: {backgroundColor: "{colors.selected}", textColor: "{colors.ink}"}
+  summary-panel: {backgroundColor: "{colors.panel}", textColor: "{colors.ink}", rounded: "{rounded.control}", padding: "18px 20px"}
+  inspection-row: {backgroundColor: "transparent", textColor: "{colors.ink}", padding: "13px 12px"}
+  inspection-row-open: {backgroundColor: "{colors.expanded}", padding: "13px 12px 20px"}
+  problem-row: {backgroundColor: "transparent", textColor: "{colors.ink}", padding: "18px 0"}
+---
+
+# Design System: EnvScope
+
+## Overview
+
+**Creative North Star: "黑白极简桌面工具"**
+
+面向 Windows 与 macOS 的日常操作界面。文字、细分隔线和少量浅色容器建立层级；检查、修复与守护沿同一操作流程展开，技术证据按需查看。
+
+**Key Characteristics:**
+
+- 固定窄侧栏与单一主内容区。
+- 系统字体、可见操作文字和原创线条图标。
+- 中性色为主，红色提示需要处理的故障或手动步骤。
+- 桌面布局，不做手机适配。
+
+来源：`envscope/web/minimal.css`，随后由 `workspace.css` 覆盖；页面整理见 `workspace_ui.mjs`，图标见 `icons.mjs`。记录以当前实际级联为准。
+
+## Colors
+
+### Primary
+
+`ink` 用于正文、实心主按钮和焦点；主按钮反白。`danger` 用于手动说明、检查错误和检查状态。当前手动问题徽标及检查行左边线仍使用 `manual-danger`，两者均为现有实现。
+
+### Neutral
+
+`paper` 是主画布，`rail` 是侧栏与筛选区，`panel` 用于目标与守护摘要，`expanded` 用于展开行。`line` 分隔内容，`selected` 标识当前导航，`muted` 承载补充说明。状态始终保留文字，不仅依靠颜色。
+
+## Typography
+
+平台系统无衬线字体覆盖中文与英文；原始证据使用等宽字体。页面标题用 `headline`，常规分节用 `title`，正文用 `body`，辅助说明用 `note`。较小的状态与版本文字使用（11–12px），结果摘要标题使用（18px）。主按钮字重（550），当前导航字重（600）；其余角色沿用系统字体。说明通常限制为（78–80ch），表格与运行状态使用等宽数字。
+
+## Layout
+
+左侧栏固定，宽（204px）；主区留白为（26px 40px 48px），内容最大宽（1024px）。主要入口为检测与修复、持续守护、账号资料；其余功能在侧栏内展开，帮助与结束本地服务位于底部。
+
+窗口不超过（1100px）时，侧栏收至（184px），主区留白变为（24px 28px 40px）。最小页面宽（960px），不设置手机断点；视觉检查覆盖（1024、1280、1440px）。常规表单为两列，检查筛选区为三列，操作行可换行。
+
+主流程展示目标摘要、问题、修复方案与守护区。当前流程进度条隐藏；详细检查、证据与高级维护使用原生展开控件。间距采用 frontmatter 中的常用步长，局部内边距以组件记录为准。
+
+## Elevation & Depth
+
+不使用阴影。浅色填充、细边线和留白区分层级；展开行使用浅底。固定侧栏和检查工具栏通过位置保持可用，不添加浮起效果。
+
+## Shapes
+
+控件与摘要容器使用 `control` 圆角，问题与检查列表保持直边分隔。边线通常为（1px）；手动检查行有（3px）红色左边线。图标为（24）单位网格、（1.7px）圆头描边，常规显示（19px），底部操作显示（16px），始终配可见文字。应用标记使用独立的（64）单位取景框图形。
+
+## Components
+
+- **按钮：** 主按钮深底白字，普通按钮白底细边，文本操作带下划线。普通按钮最小高（36px），主按钮最小高（40px）。一键检测保留扫描图形、最小宽（140px）及具体忙碌文字；禁用状态降低透明度，防止重复操作。
+- **输入框：** 白底细边，文字框与选择框最小高（40px），复选框保留原生语义。键盘焦点为正文色（2px）外框，偏移（3px）；输入框聚焦时边线加深。
+- **导航：** 图标与名称水平排列，行最小高（42px），当前页面浅底加粗。切页保留滚动位置并聚焦标题；“更多功能”可用 Escape 收起。
+- **摘要容器：** 目标与守护摘要使用浅底细边，信息输出框为白底；工具分区使用横线分隔。
+- **检查列表：** 左侧选择框，中间名称与说明，右侧状态与展开文字。展开显示依据和操作；刷新保留选择、展开状态与焦点。批量工具栏保持可见。
+- **问题与方案：** 摘要列出名称、观察与处理状态，原因按需展开。修复先展示影响与改动，再确认；结果与证据归入同一流程。
+
+按钮仅对背景色和边框色做（120ms）过渡，不使用进入动画；减少动态效果设置关闭过渡与动画。
+
+## Do's and Don'ts
+
+### Do
+
+- Do 保留可见文字、明确状态、键盘焦点与原生表单语义。
+- Do 把完整检查与技术证据放在可展开区域，保留访问路径。
+- Do 在 1024、1280、1440px 桌面宽度核对布局。
+
+### Don't
+
+- Don't 引入手机布局、营销首页、大量装饰卡片、渐变、发光或 emoji。
+- Don't 用颜色、图标或“通过”文案掩盖未测、未实现或权限不足。
+- Don't 把静态预览或视觉状态当作检测与修复已完成的证据。
diff --git a/PRODUCT.md b/PRODUCT.md
new file mode 100644
index 0000000..ed10e55
--- /dev/null
+++ b/PRODUCT.md
@@ -0,0 +1,14 @@
+# EnvScope
+
+EnvScope 是面向 Windows 与 macOS 的开源 Claude 环境检查工具。用户通常不了解检测术语，
+需要确认目标地区与时区，完成一轮检查，看到具体问题、可审核的修复方案及长期守护方案。
+
+已确认约束：极简界面；不做手机端；保留全部逐项检查、全选、账号资料交换、工具、历史和
+设置；首次使用提供教学；真实修改先展示影响并确认；普通检查不要求永久管理员权限。
+采用未正式签名的开源构建，不以获取证书作为交付前提。
+
+界面不能用视觉效果掩盖未测、未实现或权限不足。时区、出口和语言的一致性不等于官方
+地区资格或 Claude 账号可用。Scrapling 用于研究收集，不是产品运行依赖。
+
+设计场景是桌面日常操作：清晰文字、少量常用入口、可展开的细节和明确的操作进度。
+不采用营销首页、风险评分、大量装饰卡片、渐变、发光、emoji 或夸张标题。
diff --git a/README.md b/README.md
index 013062b..4fa7f6c 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,9 @@
 
 面向 Windows 和 macOS 的极简桌面环境工具。以 [claude-switcher](https://github.com/YOURSJEYO/claude-switcher) 为功能底座，保留原版维护能力，增加独立检测、事务式账号管理、代理诊断和历史对比。
 
-当前源码 **0.24.1 Alpha** 按“地区与时区 → 一键检测 → 问题和修复 → 持久化守护”运行。复检后自动更新修复方案，保留重新生成入口和上次执行结果；方案过期、权限拒绝或检测失败会说明原因与下一步。时区、地区格式和 Code 配置合并审核，确认后修复并复检；守护状态显示具体恢复结果。地区预设覆盖 **247 个国家和地区、417 个城市/时区**。账号、全部检查、工具和历史统一放在“更多功能”。参见 [操作流程](docs/SIMPLE_WORKFLOW.md) 和 [完整功能对照](docs/FULL_PARITY_AUDIT.md)。公开安装包以 Releases 为准。
+当前源码 **0.25.0 Alpha** 按“地区与时区 → 一键检测 → 问题和修复 → 持久化守护”运行。侧栏直接进入检测、守护和账号，其余检查、工具和历史集中在“更多功能”；切换页面保留位置，筛选保留展开说明。地区预设覆盖 **247 个国家和地区、417 个城市/时区**。参见 [操作流程](docs/SIMPLE_WORKFLOW.md) 和 [完整功能对照](docs/FULL_PARITY_AUDIT.md)。公开安装包以 Releases 为准。
+
+**0.25.0 新增**按失败项目引导系统授权，返回后复检原选择；明确区分权限拒绝、组织策略、超时和本版未支持。Windows 增加受保护的系统时区守护，与 macOS 一样先审核授权、每 60 秒检查、失败留痕并可恢复。异常通知去重，重开软件后仍可查看未解决事项。应用、托盘和导航采用统一原创图标。项目按纯开源方式发布，商业签名和 Apple 公证可选；包身份与完整性校验不等于发布者签名。参见 [权限验收](docs/PERMISSION_ACCEPTANCE.md) 和 [开源构建说明](docs/OPEN_SOURCE_BUILDS.md)。
 
 **0.23.0 已加入**可恢复的旧软件清理、临时浏览器独立清理进程与重启恢复，以及 48 小时不同出口集合统计。清理支持单项 / 全选，先预览、再确认，保留账号与凭据。参见 [旧软件清理](docs/LEGACY_SOFTWARE.md) 和 [临时浏览器](docs/BROWSER_SESSIONS.md)。
 
@@ -45,7 +47,7 @@ Windows 桌面包解压后双击 `EnvScope.exe`。macOS 桌面包的入口为 `E
 1. 确认实际使用地区、节点地区和城市。出口 IP 可建议节点地区与时区；不会代填实际所在地。需要时展开用途与连接选项。
 2. 点“确认并一键检测”。首页列出不合格项目、缺少的必需证据和下一步；展开对应问题查看原因与手动步骤。
 3. 核对修复方案，点“确认修复并复检”。写入前保存恢复记录；代理连接未验证时不会写入。需要先启动客户端时，完成并复检后再审核后续改动。
-4. 在“持久化守护”勾选需保持的配置，预览并确认启用；同页可停用。账号、选择检查 / 全选、备份与高级修复从“更多功能”进入。
+4. 在“持续守护”勾选需保持的配置，预览并确认启用；同页可停用。系统守护与高级修复按需展开；选择检查 / 全选和备份从“更多功能”进入，账号资料可从侧栏直接进入。
 
 复检区分已消除、仍存在和仍缺少证据的问题。“详细记录与使用帮助”保留打开 / 正常重开 Claude、实际试用指引和技术证据。Code 配置修改后需要重开会话；实际账号使用仍须在自己的 Claude 中确认。
 
diff --git a/docs/DESKTOP_ACCEPTANCE.md b/docs/DESKTOP_ACCEPTANCE.md
index 0077465..5107d1c 100644
--- a/docs/DESKTOP_ACCEPTANCE.md
+++ b/docs/DESKTOP_ACCEPTANCE.md
@@ -1,5 +1,14 @@
 # 独立软件与功能回归
 
+## 0.25 权限与桌面刷新
+
+- Python 回归 720 项，5 项按平台跳过；JavaScript 19 项及全部模块语法检查通过。
+- Windows/macOS 离线场景各覆盖 1024、1280、1440 宽度的 8 个页面，检查键盘菜单、滚动位置、筛选展开状态、单次检测提交和无横向溢出。
+- 首次教学与 IP 读取、原生设置刷新与保存、修复中的复检按钮均加入竞争时序回归；仅只读 IP 查询可在服务短暂忙碌时有限重试。
+- 浏览器回归覆盖权限返回、原选择复检、取消、仍拒绝、目标变更，以及修复预览、过期、部分失败、恢复与守护。Windows 冻结包核对应用图标、版本资源和更新后的原生启动。
+- 专用 CI 使用隔离时钟完成 Windows SYSTEM / macOS root 时区服务生命周期与两轮自动巡检，不改测试机器真实时区。最终标签的构建结果为分发依据。
+- 实际人工 UAC/TCC 允许、拒绝、撤权、重启及休眠仍需专用设备验收，未用上述夹具代替。参见 [权限证据表](PERMISSION_ACCEPTANCE.md)。
+
 产品流程：首次教学 → 一键检测 → 问题与权限分类 → 合并修复方案 → 确认写入 →
 自动复检 → 实际 Claude 使用 → 可选日常维护。普通检查无需先配置比较目标或维护核心。
 
diff --git a/docs/SIMPLE_WORKFLOW.md b/docs/SIMPLE_WORKFLOW.md
index 48a3997..afbe6d8 100644
--- a/docs/SIMPLE_WORKFLOW.md
+++ b/docs/SIMPLE_WORKFLOW.md
@@ -5,9 +5,9 @@
 1. **地区与时区**：填写实际所在地；读取当前出口 IP，建议节点地区及对应城市。选择城市会匹配 Windows / macOS 时区、地区格式和语言目标。手动选择和已保存目标不会被迟到的查询结果覆盖。用途与连接方式按需展开。
 2. **一键检测**：完成目标确认后开始。结果说明必需项通过、不合格和待完成的数量；所有问题标题、实际观测与处理方式直接可见。需要权限、缺少证据和本版不支持的检查分别说明，不计为通过。
 3. **修复方案**：先列出具体字段、原值与目标或可执行操作。时区、地区格式与 Code 配置合并审核，确认后才执行，随后自动复检。复检使旧方案失效，再按当前问题生成新方案；重新生成入口始终保留。方案生成失败可重试，检测失败时说明需要先重新检测。上次执行结果、失败原因、备份和恢复入口独立保留；部分失败不会重复自动执行，需核对恢复记录。需要先启动客户端的操作仍分阶段复检；无法自动处理的项目标红并给出步骤。
-4. **持久化守护**：选择周期以及需要保持的时区、地区格式和代理；额外客户端与 Code 选项折叠。预览具体基线并确认启用，同页可停用。后台仅执行已批准的范围并保存结果，未获得权限的修改保留原因。首页显示最近完成时间和各项基线的实际恢复结果；失败、过期或暂停以红色提示，完整日志在“更多功能 → 守护与高级修复”。
+4. **持久化守护**：选择周期以及需要保持的时区、地区格式和代理；额外客户端与 Code 选项折叠。预览具体基线并确认启用，同页可停用。后台仅执行已批准的范围并保存结果，未获得权限的修改保留原因。首页显示最近完成时间和各项基线的实际恢复结果；失败、过期或暂停以红色提示，完整日志在侧栏“持续守护”。
 
-顶部“更多功能”提供全部检查（选择 / 全选 / 批量处理）、账号资料、工具与备份、守护与高级修复、历史、设置与更新、环境全览。详细测量、帮助和 Claude 启动入口放在首页末尾，不妨碍主流程。
+侧栏直接提供检测、持续守护和账号资料。“更多功能”提供全部检查（选择 / 全选 / 批量处理）、工具与备份、历史、设置与更新、环境全览。维护页的高级系统功能集中在可展开区域。详细测量、帮助和 Claude 启动入口放在首页末尾。
 
 ## 地区覆盖
 
diff --git a/docs/UI_DESIGN.md b/docs/UI_DESIGN.md
index a021d9c..f62c48e 100644
--- a/docs/UI_DESIGN.md
+++ b/docs/UI_DESIGN.md
@@ -1,8 +1,8 @@
 # 桌面界面
 
-0.24 将首页收敛为一条流程：确认地区与时区、检测、查看问题与修复方案、启用持久化守护。面向 Windows 和 macOS，暂不适配手机端。
+0.25 保留一条主流程：确认地区与时区、检测、查看问题与修复方案、启用持久化守护。面向 Windows 和 macOS，暂不适配手机端。
 
-顶部仅保留 EnvScope、版本、检测与修复、“更多功能”。原有账号、全部检查、工具、历史和高级维护完整保留在菜单中。首页不显示空的结果表；首次使用以简短行内提示引导填写目标，完整教学可从页脚重看。
+固定窄侧栏直接进入检测与修复、持续守护、账号资料；全部检查、工具、历史、设置和覆盖说明从“更多功能”进入。维护页优先展示状态和方案，系统服务及高级修复按需展开。首页不显示空的结果表；首次使用以简短行内提示引导填写目标，完整教学可从侧栏重看。
 
 地区设置默认显示实际使用地区、节点地区、城市 / 时区所在地和目标时区。选择城市自动匹配地区格式与语言；用途、连接方式和其他要求折叠。节点地区依据出口建议，用户手动选择优先，实际所在地独立填写。
 
@@ -11,7 +11,7 @@
 修复区先列具体改动，只保留一个确认修复并复检按钮，并保留“重新生成处理方案”的次要入口。复检清除旧方案、刷新剩余问题；上次执行结果独立保留。没有自动修改或没有取得本轮报告时，入口置灰并说明原因。持久化守护紧随其后：选择间隔与需保持的配置，预览、确认、启停都在同页。后台权限或修复失败必须显示原因，不能仅凭写入成功就显示环境合格。
 
 ```text
-EnvScope   版本                       检测与修复    更多功能
+侧栏：EnvScope / 检测与修复 / 持续守护 / 账号资料 / 更多功能
 
 Claude 环境检查                                  一键检测
 地区与时区                                      调整目标
@@ -28,7 +28,9 @@ Claude 环境检查                                  一键检测
 详细记录与使用帮助（按需展开）
 ```
 
-视觉使用白、灰、黑及手动处理的红色文字。系统字体、细分隔线、可见键盘焦点；黑底仅用于主要操作。无渐变、阴影、装饰图标、营销标题或状态卡片。正文居中、最大 1040 像素，桌面内边距 40 像素。
+视觉使用白、灰、黑及手动处理的红色文字。系统字体、细分隔线、可见键盘焦点；黑底用于主要操作。应用和托盘标记及导航线条图标均为项目原创，有对应文字标签。正文区最大 1024 像素，桌面内边距 28–40 像素。具体色彩、尺寸和交互约定见 [设计系统](../DESIGN.md)。
+
+切换页面保留滚动位置，检查列表筛选保留展开状态和选择。检测重复提交会被阻止，修复复检期间保持操作锁。原生状态读取期间暂停设置输入，避免后台刷新覆盖刚修改的勾选。IP 读取遇到短暂忙碌时有限重试，配置写入不自动重试。
 
 主流程和菜单在 1024、1280、1440 宽度通过隔离浏览器测试与截图检查；代理、时区和守护均使用一次性模拟数据。截图不能作为真实 Claude 登录或网络可用的证据。详见 [流程与地区覆盖](SIMPLE_WORKFLOW.md)。
 
diff --git a/docs/releases/0.25.0-alpha.1.md b/docs/releases/0.25.0-alpha.1.md
new file mode 100644
index 0000000..f63af7e
--- /dev/null
+++ b/docs/releases/0.25.0-alpha.1.md
@@ -0,0 +1,16 @@
+# EnvScope 0.25.0 Alpha
+
+本版完善读取权限与后台守护，并简化 Windows / macOS 桌面操作。
+
+- 读取失败分别显示权限拒绝、组织策略、超时、工具缺失或本版未支持。根据当前失败项目提供授权入口，返回后复检原选择；取消与目标改变不会沿用旧证据。
+- Windows 增加受保护的系统时区守护，与 macOS 服务一样按批准基线运行、读回、限频、记录和恢复。后台权限不足不会声称已经保护，也不会反复弹出授权框。
+- 守护异常通知去重，重启应用后仍可查看待处理事项。
+- 首页集中显示目标、检测、问题与修复方案。侧栏直接进入守护和账号，高级系统操作按需展开；保留选择检查、全选、备份、恢复和工具。
+- 更新应用、托盘和导航图标；保留页面滚动与展开说明，防止检测重复提交。设置刷新和保存、教学与 IP 读取之间的时序冲突已修正。
+- 安装包使用固定应用标识与版本资源；更新校验包身份、摘要和发布版本。
+
+这是纯开源 Alpha 版本。Windows 包未作发布者签名；macOS 使用构建所需的临时签名，未作 Developer ID 签名或 Apple 公证。完整性与身份一致性校验不等于发布者认证。
+
+自动测试使用隔离配置和模拟网络；原生服务测试使用独立任务和时钟。人工 UAC/TCC 授权、撤权、长期休眠和真实 Claude 登录仍需专用设备或用户环境验证，未计入自动测试通过。具体范围见 [权限验收](../PERMISSION_ACCEPTANCE.md) 与 [桌面验收](../DESKTOP_ACCEPTANCE.md)。
+
+请下载对应系统的 ZIP 并完整解压：Windows x64、macOS Apple Silicon 或 macOS Intel。旧版可保留用于回退；如已配置后台维护，移动应用目录后需重新核对任务入口。
diff --git a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
index 0fb83e2..91acfbf 100644
--- a/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
+++ b/docs/superpowers/plans/2026-10-30-permissions-and-ui.md
@@ -86,11 +86,11 @@
 
 **Interfaces:** Preserve existing backend capabilities/confirmation contracts. The visual layer renders states supplied by the backend and retains fresh report/repair/guard flows.
 
-- [ ] Confirm Task 5 is complete. Read Impeccable context and the existing design constraints; document the concrete visual system.
-- [ ] Implement the complete minimal desktop layout and consistent application/tray/navigation/status icon set, with original licenses for reused assets.
-- [ ] Improve phase/progress feedback, keyboard/focus handling, stable selection/scroll, duplicate-operation prevention and recovery affordances across every screen.
-- [ ] Run real browser workflows at 1024/1280/1440 widths for Windows/macOS fixtures; inspect screenshots, keyboard access, overflow, empty/loading/error/permission/recovery states and frozen-package icon rendering.
-- [ ] Commit the verified UI, asset and interaction changes with documentation.
+- [x] Confirm Task 5 is complete. Read Impeccable context and the existing design constraints; document the concrete visual system.
+- [x] Implement the complete minimal desktop layout and consistent application/tray/navigation/status icon set, with original licenses for reused assets.
+- [x] Improve phase/progress feedback, keyboard/focus handling, stable selection/scroll, duplicate-operation prevention and recovery affordances across every screen.
+- [x] Run real browser workflows at 1024/1280/1440 widths for Windows/macOS fixtures; inspect screenshots, keyboard access, overflow, empty/loading/error/permission/recovery states and frozen-package icon rendering.
+- [x] Commit the verified UI, asset and interaction changes with documentation.
 
 ### Task 7: Full review, native distribution and public delivery
 
diff --git a/envscope/__init__.py b/envscope/__init__.py
index e54e6a8..987cc75 100644
--- a/envscope/__init__.py
+++ b/envscope/__init__.py
@@ -1,4 +1,4 @@
 """EnvScope: evidence-first environment diagnostics."""
 
-__version__ = "0.24.1"
+__version__ = "0.25.0"
 __release__ = "v" + __version__ + "-alpha.1"
diff --git a/envscope/desktop_runtime.py b/envscope/desktop_runtime.py
index 1fa9f2a..dea75a7 100644
--- a/envscope/desktop_runtime.py
+++ b/envscope/desktop_runtime.py
@@ -205,12 +205,9 @@ def background(self):
 
     def start_tray(self):
         import pystray
-        from PIL import Image, ImageDraw
-        image = Image.new("RGBA", (64, 64), (0, 0, 0, 0))
-        draw = ImageDraw.Draw(image)
-        draw.rounded_rectangle((4, 4, 60, 60), radius=12, fill="white", outline="black", width=3)
-        for rect in ((19, 17, 25, 47), (25, 17, 45, 23), (25, 29, 40, 35), (25, 41, 45, 47)):
-            draw.rectangle(rect, fill="black")
+        from PIL import Image
+        with Image.open(Path(__file__).parent/'web/tray.png') as source:
+            image=source.convert('RGBA')
         def open_settings(icon, item):
             self.show()
             self.window.run_js("document.querySelector('[data-page=\"settings\"]').click()")
diff --git a/envscope/web/app-icon.png b/envscope/web/app-icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..4ef8ed7d4be59ee4801e3c8d74eecce6cbda4a90
GIT binary patch
literal 26569
zcmeEuXIPWjy66``(6InEP(%>Mk^u!oz)%b`f;gdRP(iv_5JFJ`(n%agjVK_RL8U4Z
z5H%DrAT^AFC?!aZ(xn9mMF<c|lJBlBo^$S;v-jC&@8{m<xqmLtWBkgy-nG`-*Sp^J
z-8yDtvG#|pKR^()_Sd6kcnFdLmr~G5Y49IOS>qZ6dEWii?B^399pl2t<X%sg-Al||
zF7MHg)`_LRIN>b)c6rs_*nIt%!_SJx^7|*BCwHqxr=Fzdgg;&V!joN)`m{1fa4K#e
z#h_I7SW{X~*T<6deJ9Meno#g+$8bI^=XPx<SxYnUy0^>Mvm%XaNU9IcY&lS#W;MK=
z!r@J?-0PKiA!m^lft_N{RrJ{Z&^MhSawD2$xRhR@m51}&DbM7aOnR7Qp}gU>-HH2(
zvN{+|2O6!jsgArAdi^WpcQyzPg`SNLITPck?v0brKGM2z^h<nm!P9obsYVo(*V=j%
zZB8#@KPzfHRA-ivs7Bj5T_is=QqQx>LHF~}e}sECU`i&3d&YWh4WF~ywR`teqy$VK
zUekE){A44_*zb&_@vL6_Ss%?9^Qu&n@Y*s1s>Pe}S9L5x;)U}q2RcisEL+AQY{1L7
ztx4+5nUv<%qm7mfeLW9zR%mw@X^)AZ&Oh@#_Fbvh+#zXb&4+6zaJC~H4z`zykIkZF
zC*mKZM`6^0<>xMCJiN2M#v5m#&*)(XbzjZlZZDfC?3^Us!Tz#cNvSSeO>KVs(OPL^
ztE&)nAzGN9pZ}VZ->aH9(OKm7$+DdJz`G=`HR5FSD-6EF*|K{(nqG&d+oH`gC>ux5
z_<I+S+@8+Ep8HaAZ2P!6i-s#8kGqB_mcaO=%G{RS=C}fqk=CB0=!QdBbGjamUX$KF
zfX<RU&OH}n{K#$*Z#~B<EF=Z@RbCD6ukU_jJNrmh3exs5T8{fe+P`G%c}znj-&f1J
zWWTx3i=8<(=+q5p6C?B4+k%ZcPOa=HbFAGE`x&Etc8q_Y{Lsj-kFXBvYdU=G^!Y2C
zj3X(bmvCtQ+25$cH>HH0uSC4h`OoI&9S1bfHEZ?y-6zMayB9es2L&`O<;draH&h|=
zpIzM~v#n)kYhpcZ{+KCqtX+-AHO5gi)W_zj&F>elM@_&FBhNl#w1=(`2~;2`SvdKd
zp@Q73?p4YMH0|I!-L57|psJeRb4Jg@0FfX%nOR1HMWw87%LXM<a!_U8CPCc6BGShk
zmlyWROinGng@?y!#o^Nw<c;t+r3-e0OP_K?<2F$#{LJ(ZGLRzqlKX{%UHA;@a$|rF
z9Gcr6=5ID0mt5gY5Y{D+Jy3B7{?poGe$r%<XX0*EIa3I->}MnmN7_x=D6xWncFpf!
zf$3LLYg0Ia)56845<3iF3I$Kt%j?<lDt9$Re)5BKZT&i1vqX%|w_`<>UGc1?Kc3AI
zkGJ$DP#US(*^RwdI(_+7kBp>h&(<44C`fZ0BRZPDJB$bax$}YZtFY>^Hn#_OVf(YW
zA^Fi2XwK^9cTSbwt&YPv*~iBvAx-Wv)#0EY>bI*rV;tE#luB7zJUXgHuqGJ>jkPMo
zZNtobTX!}8;#u2~bztnP_tboLh_#rUF-X#4Mp(2?CZ6Edsn6WTM_Xe!#oa<jZvCXF
ztl&(-28gU1a<RR|N>!V^^BC@y<G>}eMQ7_#Ep<J%bx#;q)RJbsEV)93_k$N8`qS>-
zunvPy8aZz~Ca#tD7?@W9e(K5Rt8==l4(}B*+B<fZE<;dN%hdW28Honxo2F(|d<o^V
zN_@_33fI1HBCR)|Ztw2xQ>QmeLEk>4i2R~fx6y!lv>yo#ik_8y+N!|W<+d4ZzW03L
z$kdmwGLY)#+{2Hp(dM<7^!7b2#d`ymd}5Yr%0HwnxXG;Rn$HU(_`Gb|LWZF2KXs^F
z@$=>lJ%Gzk)M6<V|J%>BSk|sedN%&t#$7x~NRBh|{^}Rc<}U*h@oG4G8?%hYBULp7
z7HNMdmrmk`G*+lW?wF0jpr{{8yq4!virf9;PPi%Qx!z04yyf_my8bvpL8#<BJ_Ar$
z<{7Da#~jW6h_T4nNaL0qoi;e$qC%yLIA0}Y=Bovh>_?tXXCMja2EGL*7%<C88SQMd
z=U6#C*W{#3I>T(QEMX!zK?Nc!R(?VG)}ryX$4hb)(1(=tgzbSi6{CrVmFlVYe}*be
zD=OZ<f1hZ=W6kkp7R!I4EgfdOe-XeUoW1ZcIvpT*vQ{#HRd86!He+Mjb3Nhv+CpJ#
z8S1yVkSo$CNQY7?Oe*vZ_qsnO+qyOPBgReNX||CtWj`wkX}6xKd>6Z_-dMIb0Uz=5
z#c0tw72^f_5(zm-`(Q4uyObEQ@Q%oNxU^T43kZ><R(^nXz~DnJOxP%dAk9W?Rken7
zaxWQ2VwUW|<gK!1uZCJkZJ)lgRs!-^<=o3o65gVB7F8IkMUv>#DHu+W&V9f3mQ21R
zRQXC)@<LiXk(CX1MHtf--cgo}HpuKcq{G*!dGE+xr3R@c{E`H>)19<(FeHnNCCP$P
zVO9#)Uvmot89(<Em61bTP|QDYiz8K4Rm!n4s!*S^^H&4*Z-HM%M*dL8h`eHEg&5B5
zWqbaY2^om&K+YjQieVVxTYDevo9--%iR+!c*f<Or{={{+wOKuZ*DD&M%;b8<_yf0L
zj^2qwcbB0>5LDS>=S|n+bPXmy<(6bq`v>F~?RTx)wop~(#(r;QK~@EtY#Uy~yiNIB
zOyor0x8sxCqGu0#UgY_gr9zM@>y*7|@X|DS>zqOR%Y#$F{E1G3O|r_epXA99dG}(8
z;_Y4Y_2UcJzzS@XW>(<&7>Xk<#?kU34-C4x^ykO$n$!RruT1m4%xBY+Hyc(d-qxQV
zS!oJY-q#dZvS2{F_+(x+gZhjX_@n`tQ5Iu8qn%2;9}tVLRc5>=HP8eKKLa^TJ@s`e
z0t?tSfkFKS!VBZ>x4nx|5JdU&;fA|JzZIyJP)O_7s2@lW<Z$F?@|mj=P(sXw!fz_d
z$}YXM+0ECHwsESDv*%I<1_o+ua@PVWiMURRq0D>=idyU)N)DzroA1p5%0Yfo{)={&
zK4%vWy-c8{B?U+JjniF!1B5!<cgF2gl7$6x_t5MV5oh1-II#ePA%MH`C>lpMXv6pF
zU=E2y2Yugt!mol9zoAG^pFZt%#xDh9vh3NEXD%E=FbvB1ut@io186l|cG?GqsB2+i
zVYm9*$EHBqD>;H9zwVN!g^RoGVpOcq=4e_ycMS-n5(si~@)(XYAttduGTUC%0>mbY
zhmwM-Dqk<xjALLsS>td1>RD+Q16+H9y2q)F@Aso1DAL6&BhxFuzBYf)oWiMG$2lHv
zSn~I?D4i2V)m6u&Fhu)MpY6(#k-34)q$I(T<Jj|1j$mR*5`r!-)#m|!Wd4%nE6U7v
zonmkee2l}!N1C+0n6;uzH5;zLbw@06eTYko$;||BGir`*pDdW$ZoNHuUL70dY3*@y
zIAIYYsDlosYfjc3)FFRunC!MT3p5Izbj}a$Y%eNA&ks{w?Qm!Y^&Z}P6AYwv16>D?
z^WCc(fXnr=8}Baj<vImVb``6sl|-#gfBy+(ntaU#-rHH|vLRdK!D`^)*yb>YF#;%*
z5AjfmT?dZi_(RV|Yh;y;LsI+z%Wm@*Ye9g=!8C?mDe$N!S)rq})zTB1S5F|y@%H&~
z!h--mPu9w+<&x}dn5*HoSUbVv+&!JCEp>NA8%t$|edjeZElCh<NTj=+6d;t**WY1R
zTfjK#m#8qji`2NZR>^-#c2%<5i^r1W72R`g#r+CITy8Go2&sfbxCH^_O-5fWPbMbe
zqw!ps5}B+hX9Lp_pjxaP60Y|cZgfe~FanH*>`;ZiT1;{>{fNP04PyKtWk|D<v(wxx
zp9?5k<sKwC7`2=1NB)GW93a_@BV5wy>xN?F+`T>~xUbrxL{Lvx0^-g*zdRD2R2WJ!
zGcM(pxWczBYCtTW*IM!*DXL*+Jkz&F3}Inm!L~4C=U%=fMGiS9XQv+%TcOFBO~TNW
zg)Z<o4}|ems?J*!j|Z@<vx7+JxtN<ZHCPj7PrljLmE^`ht?J-}iKp26_@xGF^L5}u
z2EBoBt4edF3-GuH#0qWNLa%{yo=$IgV-t7zD_I?72zeCSE>8J&ydJ%G!F;(QIf+n`
zb3014F9eKF`x(w`Fw-lYI$7fPoPX`6tjeMNPLij$16iv{Kv?d4AJ40xHt(cqlpke@
zC%?@?!aK0|qc45#D7{;DyJ5(Pp@qa-dGdM85DAFaaF-~|>?NHRs6#AI>sJB7`Q-B@
zn|K1+1?S~b+rX#yzB#096gHK$ZPh1~T;1y-=9_q+GnB8`^>WrN=PV?opt>_DEl*zy
zN;d;qQ_ctMdCcDf`W%s7X#w5H9wIG|BoY0h47T^o00zm`og>VCwUF5N`O^4j6AP?v
z?v?ctBaq@qKeMzyTBH5YXKwimuNkG%M>;V2H6ls*FXN<IGrbaXG?>M&e0wA6_7){S
zq(9NLO>Xm=)qLHptJT%i)KsT39+u{lD0uIh%jPm4(~STxy9iC0Z0=m*F6Q)~IsA_Z
zlzKXsjb8~#zx({zK}jXnuVrMU4rfD3u`4M7koOWuK)^6)S|PXzz}Y`Y7KI@Y{qLG$
zVq&sWwxJX$bM^8~zF!K5tkHVR&GNpFFav7U5)gFonj_%>(N8Vip1{{yr))gi^U%Py
z;fL!x$oaD+Xm7Jtz?%wP&b%jqj#hh)&{=i+iw&y$+rnfbPnm0w(|c*EDI9ynk$!z0
z*<t@Xkv<TB{L@V$HZ_U;M~((B2L`lIO|3M)Dz9f?okLqbX3(}A{|-oi-nL^<UPd%r
zx36^kw<~S6aRwN-Zth&B9Zo#~h)f?^dDTO|&MO%jLpORPWurQMi@LAG$*HbE8E3su
zkD*MyqC4gK+0&D;<F?ZXhin&*R(=@2R0&WqD}1=^FA$=+k3a`ys^QcT->u4#r|-9@
z(5U(eIo!9Q2*n&8pCa!wu(l(Zbo{Xtw=OP@6jr#o;NTNUcb)ML2I0qfGyl56z5d<-
zC5P1XuSAQR^qnGSa!dB9>FZ;FE_NmuRHu$ibTBO0jCJJd@?kB`ya|oERrlIYzoUWO
z^0c@`p%QIqvpGT5?r)?o$w$K*<<Ij9>HZDH!fHp{BL!q>eQC2nE`hGs;Jo2sta3Tu
z&RYjn`K4=73pk_Rme@Ojr2Q>7?gbqOkeVJc;dGj>g)75PxMUfpY_fDbhz`Qg5Sw3O
zDSo_>k?@YfP&+u0c?uy(-a=9Vjhoq7SRU5Bw3c_6Ja~`{^^I<ZcdCsIPduISN*cCK
zApqk9vF7xyTJNQ?3n$vR`hIU_5fL}^*G~c~jc={dusEddSgRzmY&n2+4l8%9A4f#|
zlAj&f*>Y6RI(!b;NduRNCiAqC<;hZ&jS_EG^r1JwNkAGN+TU?z4@LxKEyw`x9p*iu
z=i7OO)^#j1GZz!F@U00fbCXYv%qUiqSc_w>xdwCujzasq>eGB!`Dik)EwuVW5Q6Bl
zmZ+`N5K6V0PRp4LbJ0SJfIfS88A!Ccw&?q!PwpnKgQ~F*WV&X`y|R!SRGxg_1_IVJ
z_Z_l=F^sE!E!04oNb5;`u;;|bbN3Yw-fQ!ALsgE}sN&72n_k$%j(#(3F8?+L#a6k;
z1}RAqbJ1-tNc7$n+D`oI1n5EVbeej4r?KHuDzLQ<fEGBfst0R<yQ#bZAtZd=u$oQp
zy)>Ht)B^il<kGWRyNJgO4V*Rc?JUa<OnHHj`-b|84~%x#PJR2v)u@CZ1wnwYuLY>K
zE^}cDU^Lr<jPr&?=UiBMp>NM?q_zC<C5C%5D$fd$%t76>MJs<qjC?JQh^+mG>zRd!
zbShTZkny#FM*9QiO4f3l6|nGiY%hbr{t&NjQ5)cM&CRcaGV<LD6isE*W<7ST{Iy~~
zG9Y{mW#3R&dvodhr#}x*rO?;DlPB-c({Ddw=HCKTpjNk<bR1!MRlsL~pEr6Z5OWZ@
zhuWFVF6pJOBP+57)^!j2CNXzp&9^Yx$9`IgsFz;~q(`ITCdz$g`UX8O5UM|+w4JMA
z;t>lss@-yp&^AmwQ4fsYZ|vj_Y!qu`<n~fE>8YgZja`F##KL3IQI6rzX;hZ-T`<hL
zQ@~c?&>PN|6mh?OeP`iGuuz6{KBH<ft&{YJH>tCSl8X{@?2v(K`dg2d?BkT_<ti5Y
zwPac=J$SckQCkM`V&}N{no*6LD~diYj^%K};_r#AT7qznY|RcT-^F>sJG$IM*(2N<
zaPcttfPgLZjr8>EFnHkVZ;0PI{S%N*cN=<3v9AS=9nOAoZG-=oVJ<4^%s!EUZ|6+r
zt|F`xZd5Fr6x~3HR>yFRftE|@<?e}^*q-I$DC^UK(C=JC2v)KsZ)|}$O9P{b&D1NN
z1R6^Y31CZRwu+{~gbL?x!%v<+;^jrY6-z46gPQ?3h1p=ZfQ|4h&R&J>NU$0Gt;}Qa
z@B`<7k7H*#kFgH7FS(t1={iTia1?@E*u-uX0BW0=GhUMOfEd*TWI2kCm2tl~R(s*$
z4UsR14~d<HaL#O4%g0YZd7%D}EGetvg#F!x6Jj|Y|J?MHq^Efp)snYH7|v>^=lXRH
z+Y-<PMleeV=qzV@d5=4Yvck(JotXP|rf;25{Ndq^zLkf&OM<xOjE`<s@(LI}m|CU8
z9yINQdPPFXOwfi68{D|;Pt|M42R%_o_F{xKHlzKH1hItWnI1-2g4=s7Q?sQK_jZsu
zm59@m2jb<_+i{@b#ag6WRo2^Mm6=|y<w&S`1Oz(fKwyc%lT0!5FC_$`ITt>0P(N}I
zO;WuPwY^exa|1^0Z81<2h}C3FzWOqY2c<4g`EF4bdWoSZL~U93x{(oE3p4*u!>A0@
zYK_|Ah9o#@s~4>1-5^Y}biD~0YyP%XekcB?pb~!c$B!SGsq~XUP}N)MO$u%TfnK(+
z$O-3_0TU5t0c|eOw?@<ATlL|I{@ZEH3wQO|GCQFU^2b?5aFrG(bIXLSFnAI$h+Lf}
za}4(&>B4Lo&sGpX;$vlNgTk(T^Bgbq>6|I)x+Cy;gyHvwHGs)nT6a@oKA>gNk$I-O
zw>x~cCuxa6SgQ-Ay54*{GBToTY2${IZ%i(pZk$B;c{wLn`p(wN_WS0ZPft&mULf_z
zlS6QJFwu;<Z!C8(S?ed-3B+nbmQPam(OQ#v<}R&nw<yiIXAaAl8q?chS#KdC@~g&%
zGQBJfgxxpSZD0E2vsVLJNryqR-=9LU(C_UeaQXH)*<rIX<OqXNuCzeiFalGRPcrbY
z*c0>Gt#t{=fa#jg$H|7>%O!wvxqBH;A<GweJ>^E`X1Da=tSIhx6C-!+^2WztVA0?i
zqJ{>6P}L(R*ub}YX|MJD+!wk|a12`x^e35NiKgXfu(zc?TqvLgZdBEJqMAO5IPRg@
z7id~pRqh@T=8|>Wi_o;>fTcE&6pk@7bNOk`*L7<OTnZ>qI$6%iO3eJy6y%aMrvhM6
z)Y2R-cyO6r&KI08qee9-#X|KPmxAgN_8O)8R%~SG3$YK@fzBc6<1v)2=%6NUj$z=)
zCs9<4Q$o0mX*9)=7!_>e^((^yz*O4NiA0>b9w%7q4?_d3>wl7*iu}8~4=g%aqEr4v
zXtw5RCbe15TGS455tEa$5<UrBdGbd2P!21lAzNmOi5|KTzL#dWj406EJ!sAe%V77p
zT3$|9k-r-oD}C(jqabLIGGcQm1hyT_EH4Xm5i60lS-@z?y`=e>`?5Xo2H`$(S(hOc
zVAjg<={?lZIs*v8BhaN0Mrr$a<FeZwr?~j2ulDP<DPrv<Q9O(?<ycADN9%$dDt;rv
z<uy-E;Lych?L*DN`r>UXAF`VIn6J(+C)j6PJan3{_8J1C7~q0Kdk6MLj8r~hQbhR+
z4${hy9xjZ4`}Hd_{8xAJ-su@d`yT8d6WJnKW+;t-G^3mk-0SY0XrKCmfND{Li<;*r
zIxR8@eA+I92mD4+k^pHNa4djTtkF$Z&n_OTyeiqE)3Wy1O}eD2h1qCZPq2Y?cqlt4
z1+nAg^FIc=ut7u;nmb=nO4?w$y>K0%r&nNLpzp8w2DAf?o|*6}&@JR(gG(${xMa-!
ztas>8l-lO()$aK}eA^~Zvz*&o>{U3|C=y2t4t@b>TAg(P9X!7MWyRgiT;}vR=Mew5
zO)Yi?S=4>c7@5SNsT}}e^4XxwRgZgg^<MQC7xhN)Oo#@<)$YN7J<rrzWJMSK5<L^}
z;t-mAUh@yUH@J_r!Y(`&zQxLh$y5ruVW*{17{LUo2BOTEtNWs>M<fn*u6hSvdCukv
z#imWJ1j2o^=H00tlQ?>Y4`vK`d@hAp7fRf}-*^S0GV%~{fpo@QAWx0c-*55*OQ7a2
zOD0-h@&~qPl=grXK489T>M@1NYu3wM>dXAzNc|Fsb>#UcGc)DUOlF<fdQ@$gk{HQk
zzHnPGuq>BUH8&gYDkcuLUXzW`8HzC9OWXH0=o;us`va~P(}wpuT^`WJ1{(_ghMV84
zc7L*(w@rR-P*OI+-!GBV{-~QIHZ;aICN7>OP-^(hRhbIDPrZc0NPonxM@Q$}j=+6b
zfbE;vi!n#_Hd1k`Cv-smxIs*8lpU*Kb)6NLG*AF+5oG%^2QgJi3VvIag_+k=SLF36
zLzp%dTj5jaP%whwM}H~G2k^vgq{MLV;1{^zft#r7L|xCbptjRx7ZBrdLmzsWo!KI(
zH{^1^s3(lbEZk?AF6r*$qiJDg%~<}L%nN0-+aOUiWb62xaRtNS;U}UFs(CYqUDqo^
zXtn-(%0{XAuL9j{<Q3*Q-(^ZQ^{oz>ntr5f(cLdK_#D^~Q1IB}?)vO2NuzX<0WyBI
z^=%}vYY6eiqiMj%IerPsb$ND%yjmWjQYc&JtdA3{f1MEbs)0I+PH%U7THzHn5xGy2
zyi2Wi*tgU55wT}z3?UO`McI1osg5$=PK{-hDUl^X?k)|sFf)q|@Wr9oj<*}-0g!Pd
zqx~Mf7G2BW5xyOiISkpEwSrj5<(@@{5KYs&fk;86gskMtxpR*uCk}#uJpPNL@#X@A
z5<Z!8?msej7&I)>HrgYArkW$#mHWWG&b{7md5#hBM!=?24L8wAZ3h}Gmr!IL47$v_
zRFX_=3F_{(inT2}kow-Va`wOtILN8UuiP*Zgj4Mx{Qy>;(CVBFs#?hmfA_9keh=v%
z&+6QS5>DiT9f0d^V!>-DggRryamJVHZw_7Q9!&|W-emtW^07fA2zmMqTO|4f2ob7I
zZ;^h8qX)nAw%ErUN^r6<{^JbUmWEh{u3qbyp=7N|H=%gxK`u~lbF^eF_Ai%a=Vv)K
zV*h~Lhbu|e*n7i562PR&a#b*8ZjQ@xxSf^tjm!O>-tA7rJH8OAfcKj@il+2Av!CW>
zZr!?Nlsc|M7HrIfEgBY$0$N_u8RF$3M5#U~{b?xkv=dPjyQsJH<p&7lJ+{u>d^#oo
zf=f0(NoakB?aJlUeKC}{tDf!yf+UNEQA>Fp53%-cHjtoDMo)~L1Od`=nw8wQ-;E%U
zUk`vk{TV!*dAi9TM#O(J9rgH1vDc|qY6UThzTNYQq^f?LpYR0;hw!-3{$EoK01%X#
zu#eLf=)yO+Kd?b7=4LEc%K>^Uo{7h$IMm?oHc@W|+Z#bh-g#-w<6m<l_t!wFCuAxU
zn&@e@);!z<!b~~NtfJ{?30F48w#<8n5d_vr4M_&r7sG<z42eRw!X5x~$!5@z(3<R)
z2X<LK=WfHZuO-P~d+||<D1KPan#El%g;_`zpt3j~hjzKoTT=9L<>hq<N2Q?f`SEOd
z`Qu~3N9ghQIuJ6myd>`8&FH#}B|(SKOA07j39|b1#f^G@ACTp+qA6~4O#INy*sn-5
zu!)CJ>lgWXYYqv<9SKb$M0+^S&lw3+UcuB<=KIv6F=;9s0V#3OWxxrKYeL>b<bxbG
zDuIg6*xI|Fd4u$v4P~Yn1;-|b^@+5Glhd3oNI(_{Twj+4hUSbb4xM|>tMKcsh-{HR
zo`#b#jirRm41R1n>h-#Q4Rj1yaa1<nt*cihH{IWD8w)~rLB@9~ko51l-A}q;PG=Mp
z0(^3oql%^=(lfs^$TohNK-!P09N#37U8S+ahPQ|i_U32gNLn4|T1|)!vQfh|C8DW&
zmitaC%ZoE9WQP(q>PS_aaI5Heu4H}OrZq1e%9pr!R%3vew^jIxb>B{FoXQoI)I6W#
zoppf~j=SCu@N*VRPJSS0Q+#VrZs<!c)N(cuLee{;)2s%AKfp%VMNJLRy(Y$mRg9)B
z^A5}GuAsSbAM9>M-Bn9>zVhX~l6o`S2u8@K0}-KSc4O<z<@aX=o<EHf&CHNJNHix#
z%xTj#Z?}<SLaU<{j2+9<R3-!@+}uuJ@4l;SbDHE`JTALpuxS`FR)Zdv>uQ^iM>~2>
zZbXU;5?)gA;Kq9~lp#F30^$E^t+H=|XVdFBVwWZDxz04^fpf^$>l_QS;HAqV-4)Q~
zo{}IVHI8SSXd{XXmYz_4D+g-*uy~q7cPbjNGJuC#STHBb=h8`5@nsPrW*+Xt&|q?s
zGxsEqAkdYD6kGy9JooH4(`&xB=yw31t+=I9kQi0?K2Db*ISZ2t&IfWmi7jQ1srY*E
z8X{jsLXyC44x$+cFAPJix<OC|<r#2(y$*I;fe8=%kB-c&y#kl#CzO_}NrraNU3InX
znnTgaybjSK30PGSUD-eY89@a+ZQ+WH{UKoPF5<&}#-WuUWHvgNu0eLV;$KHs@Cd@2
zD<IjmkY*{e*#xbbIZ*kiBTA%Nxwuz^ENv&cEv6QgBq7APONYtz>FT?Fy9X*E<}b*g
zh8HEFsWKjmr%u}|4R&2XI6kggdDN>eCAcS4B>0)klO!M2u=k6lvT}7-kpX%T<!V9C
z;+q$}hH4vl1kpBm9esWM4N|Q=tBEZ2|BWM=cN9G0umy{+(J1?Rp)zQx{ZJQDaUG~}
zhVnccQ`gJKtL5BrRHtQ##Z>wj4%AiX>WRt{NrjS+{d&qmPlBqCcN0jTmC$)e$h^Y>
zONMR<AbR@N1^d+Y1pyTU6aLd0l7BEy5N?%6H(o)_s_nDI<c`Wh8^sO#q@kTdWtj?>
zLt#!ps>VFAJVQlV@jDH_U4w|s_BhJXP(UW(GStF)gh8D|nnBkhH@Smd+}PK;Y98Pv
zdaAp$h-6~gJqFT{z|TG@UZv{Yy;VLxc&f*cJ>y33VVHsEa)(=2Y1?zz+vLxKXq{tG
z^-Ku?SG_U1i`*2|;0D5Nne8EuZ&B9DGPRJ9L$MWl471k?6Pd#zTjx~bp~g*Q@L1c}
z9yOfYcw2Omj8RLs92HRUgh=q*{n-svp$m@FxB|*<=ahntPaw7<ITBWkL!^BWg%VT%
zcdbX<_oZ_X;7u3&sDaV`C|m+OA}jtj51$~!Y|USM0;#fnk$ft2qtT}!O&wIQRNn)4
zrfa?iLC4k9XdoK!wNjtx9ir}=ltl$1`%#dz8(6pExyoRX%MZY1AECztAy}W3t$X|{
zx-A*+sDh4hK*9^knPlmM_wbHsgd8Ixj>{06`Mb(+E@PP5&UOwS-Zgfu9ntC=_8aE@
zbjDZY!SIWnVqAE2HC(O2uw%<@JPrv5AVpRZl-@p@z71{21rX3-O>=f8HSCl`0$2MO
z5qpamq7?I97dX*~`6&jYeRYHA=GT2Q9QYZ7waK-mr6pRM^(fQp_hXt)7|+|4>p!ot
ziVuh$!75Qh8&{gH85pj+?n}QM1h4M4Q(SYr3A=m=V`8E#YrNn-o0$c+PcL>}$^2G}
z-dFNXZG|GIKHDzKBP^_gaQFNdVZhAbuh%zooY6Zov$E7V+k89U*Z!e#wmNzfQAwJ%
z@wU`E;wJajt@cI|kdCtv4owT`yDHN!TAqqaCK?ZHX{2bR@ykMbc&Q2sE+NN#dde{S
z%4eG|2E-~GT`_ApaC|3Ob4JpWg^60|APg*-uxmi-B%OQb>6y^q3(8%!+H+i#n4(nv
z`$WALPuo{+QOqCN(OS=){G30K@84T-Fm&u(SIEGF{>nckFE7Wd>zL?m(y-6D)AqvN
z0{4-BQ87~;lGh8Jz4`UxPLs?1pyt5?1UJ*s5148dLrF|@DyfY(&}^y2II4+JS69Dc
zdOD#L1{c%M?JM>tX6CCV6ML^T=n+YzsdE1N2mDA(PH(~PLyI46-}iP$5Us3jt2=n?
zBb|l6L5jcCL5@l!Imz;*)&thtuu;Z|nYWlQAC8LX<wyBPEE6hBSXfwaQ`nKiO>bYy
zyF&0hc8mBK^?1P(a}%nuO{N49*oXR;_b1<G4~!>2UaO>ERp+|&D&&i$+h**dKkO2*
z)RGp<7tZ_FxQUpgEf#UxV*pTnq>7AmLBvHujF&uAWxDQIQfg}KQ;WFw1{LE<1MtGF
zG>UzhU`SSDfupiIucZpFWVNbpDLjOwYmp}fY36IY7ryaN+~qnQZC|AUem^rwBtf$l
z)98?3nW+N!ov24hXA`3prN1pS2C~q;iAqvGtogmrcVJ<9Am6*~`9ihZ!u16eSjeo=
za23q}nVgt4us&OB2ohw41(&Y0Jf^O9VOIl=_uG>e?fb7ykw`whg?lF}mi-zPwJ$!1
zGBdOBva>;(bnb<;9sKKqdn1F(W|dsGs=#R~w+%#<vPW7DGzE2cVfi=KKvfd;ir$GA
z_N@$Q({S4a^Wxwidls(w-+5{=m15MqV$J)#5Sr%68I#+!#%fwc{&J%UzX}`P!kCVi
zB^@mE`?8-smRqd?9ZdS!lpS<gw8*K^5(pY=N_*#WM&`nF^z??dNO`!&F1Gq`RHUCS
z<TBnz^1Bt70?VmbxYwu$Y*z1~g|vVgu>4`!hV2Fs?*MlNUsVJ@zjP_pw@EP^3YC)1
zc=@S7Qt}m#)EmjK2AD0UZ%he$ZmtEJ>JH-r6d>4F$}ibReB<}1aM`(Wz*d^Bgd|Pp
zAjwZxf)P<eMiU|oCI!!inQ#Os@<F!bt?+VJ=b*Ne(@*#$)l)eRTkP!Y^mm(rbxw)_
zyL76;NVFIy;4P%GNw%|L<rh2K--5)}Pf`n{C=q7>C}hzdRgmIDrxqAp8F#o-?x86f
z=<MC@!uFy|LJ8+qeq)x;Gp2J%vo-yx;gk8NQ4(N@Jh)ggIy(9}FY2&hMoZY-)#$Y>
z14>Bz90OexV2-WmoS02DaVkY#0KV_zqzImcg`{d?DsLNqTmr-*GMf#oH^7aJLg$wb
z`D!IO1(y-PTN`1}DDDAipl)EUSGY7%f-E=Jm?>1UQj7*}_ADH}JpNh71p*`9ZcEn-
zU`><YR@;V@C-)yqLf0-4kE3_?%nXy1L53|B5U)~q%}S6zzB4PRy0u~Yo&xhnS3$pm
z1=>7p9aQyr+loE3s-+<ASw2>@`vQs#mRH6!>OzG<*$%Y}CBWQDXRm(TzBM<zdopBL
zH*E{BrzH@eYt<G!4<J`9^y}UV_jNKOC-(r4^LPc+S>zjMA5*^HCi&pkP-!X1H2H}T
zZq2rvex7gtK9rN9K-+i=1Ib<c+~7cnVV4beYD$ZT_mz|zHCN=Y281V}cIvc^TJZY^
zHP;nfM-VqnK1dgm!omzw7wbLWpR{+;WB(!pX;T{Y813Rw*^j?@>x&SC6(}Mt7fxJm
zx~^bOZ&TU{Y3G5>=44{ow-s6x8I_1n?~&dXC5gab57cVpCYK&ofZRWsz>AG>g}&WB
zQh>2GmbF^N3#aA3E@8o7DoS<K`cF5OgiKyQ<~_Sw6dxZSGEZxa`kb^2s#KMM6b|v;
zI+R}V4Rqlwf(cjpK%WYIeZIW<;sJcs1_&hJcM?&^;D)b5fP9-JfOj<PzsOMm#4!$Y
zTnA~7G#;Q)5ftNZB5o!j-GG25T&{03g!pzS-#8W{A%R?(B0u7=1wtY@5L6&Pf4xL}
zDnv$pzPClfx&PG86uJLf6o0>+9OQtsSB#?Xgf?5!+tlP3r*c;y9ctI(ahtDROnlG1
zdOnxBo<@DfSaMXw<6LFP0Dj+Y+tfR*xttvqUpHVl4^va;9o@fd4kxs~yp^0%C1nbx
z=k+Iln8fq%w_}rj0!wNI7xw9g=O=-n<cH09=dSR;D3iPrciE&GZ|UU&qkF(wNnTG)
z>P+297J8Biixy=4!^4rJ)1+`cg05_!Ca$JCxL3K{)wapvfb~;JvO{bs4Cp<b&CNAf
zeeDCL=GOA$?V_^92Kh6m)~SNfV^qne^ZkbpNAKLZ^Z9G#wS9GlQVvB|e1C_mpu5Ba
z)*F1e@!J3c4jT%)H-@+ub8-1A&FFe1IlR=Bnp>SNLH|zvzfU_bD)5Jd>Ho%{zg(({
zpZ=qE|CMe3h{t58ay>vu79$l)%-?YRZ<?!$f&bA6{xaOZT>j7P{*{q`ALl<gWb(f<
z<nQDBi;n!ip6d6}|4UO%h-qIBk|PiBTgT#Z+sE#&LCE!(&0QN5-*uqj)6H#S_3xj)
zQo{xcWZkl6q9$alH5;fKurWw~30cX+WaH5NQ9_fcTMBN%{*e;DXTOp0xWVLso4Mus
zIlaWlmrh0dfJonxK}4kL)db`KYSBJL-2s8#@OPPdn1a%NsSJViBr<v(;_6C)%Def?
zD2U@)h)`7({QF-2FYffeGd$l#P%KL1C(Vu$4u&{15sSwip1W*r*6J8}4^_F01-Mv7
zQ)M487OZz|$-2wauYI{YAgBzMlz<#6yy^J?L$wQ|X^W4*C?i{+#jCAtu~3vpgRKFD
z7xuZSonY-T1^2)xP^ergLk3|OF`R#d9i&rlwCxHC5_dp856k6UXh?iwxUArLaP<hN
zKNO>1d6@kAJ&MdHkuR+U!}#m8klTNHhTnk!G5-?^GIIZa$0Q?&{uL!7BMttWuD>%y
zRSY54kiT4##ZUi{#QsZmK@9A^<>FpYdTP$vKX~1-CYhK)O{lJUM2vNOVJm1kL14rp
z2Gb$Ae_-(A{U7eG`036R2;M;Cd02S4hXe~R_g5^ZdnJyPuy%{Q9E$_a1Mwipk$3O(
z{h~jXB1zsopBaw_0UqK@1<gjin}ElObyU9*!CUgl^#*a7y-U#fmu^Leyy=JA)@m<L
zM}&fPQrK+j#Uy?2klB#uxa@dhG`tWST-8$^ezqY|?>H`B8~Pn=?6Gh^8|>e|J~wPg
z<Ehuy)d8D-NjM`2Ni8B~*-lE7xDTvo;?CU=jjTjilVG~?5{R~dGnx1_;ZTDy{z1E*
z>ws&@sW9a}B%TsT0xG*tAHZ0&9FTzCe){0h8XG;NePBJr7BluQ%>B#dKS}I=#IL_$
zu9)TjGoQb=`&UHzFUtNmBKF_(_m8H^x&bWVw-Z!+Iu#TOA4Q+On}wzwXazK#{?)ZI
z=q1B(4Fu+*X_H?9H2cG8^)0q{*tKtS&UP050y5qL-L3@Rr#&W6$Xjo^4&b6z#Gk9v
zy*j`tpeK@j*$RRGDWuTFp%0(bY`j7djDr<TT4$+2doptuE=#G;>*YnWjL%?)wTn2r
z{bvYz0?LLDCjCd0VIQLTDR%PTqm08}I!u(H2*0VGh0itE%}V+{lpJnEe_AGwWdsV-
z02Rp9t5EH97p1S`@NZI(b&FZ&I=<5kSW$YsyRkMuN*D&JAnP@e+9g1n&E}rZoHSe4
zfep>WZuNiQ)43(ZDv;?LX@uc_!}Nbd%>T;t{~ta;rhtb3DOUUD;Ajb1THw5%VJm=b
z+7E@mG9X;fWh;#te9ZK^A=)7Wyhb=IgM#GZ9>nGXCz_bKr6X<{1h6_LCKEgU-Djl+
zur7oBfQ31J*>2Z}x!WM2^dwAf56$eqW_1kHLcU{^0yU*qWZc0H(BWmB*gJO)%B+OM
z9!)!3`jSI1RJJGyoD>*wRsF`kMeL1<0SUx`acurioH2Be|6jc^=mAOw3E+5QZ1T+)
z82|YJug+7z2m#UhCp<BdZ3lvuH!ks4FRZ+-1QHXw?vRv2!G(rnDZ)72dI_*iLI%CP
zl{2MJ|6dYmfbMU#;_sVKRRk6pEYL{g=O4CP327pB@b6<HBd!0o`M;)&e;38y?@twh
z{bxu19r#}{;-(1pe|D;WV}kzvkjY}4V&K1AirwDdYN4taSj?HfT>j7P{>QGN)lV1z
z?QIR(Ie7~89$NySzhTD;owT60{iaC-i(JVB`sk?FZPUTzvmo2c|HTxnG1Hc(m{^;x
zU^lQf1k2UC=lzCi|7a?t%eZ-9CYN0EE}#89#SLZ3LV{GqEnD&x!AKQzPO*!a6TZ_4
z1~3<iGWIMbyuf=8Cii1229%MV1E2@iRJ`Vzy8iI5v$KIdU2k+mgCK8*cm~F)y?sxV
zyg?iyFW+<^W(7F<QF%!UYV0g-@zCb{7NcO6%eE8b`4~Z`a$S9O5Yf}gFk+gQ8XU*n
zN-pS6bC}eHE^yoz3@ZuZmv=mschELsJY~xsihAI!-xyG3x=EZ9BBB2h1OG{FQ3ZJa
z+4O{F!*A*u7*mk4`voK#z_NSV>OMXiY?{7bSO@|6vA4u^Nb07ekg*b~Jcb;<)tfX5
zbsJ1x0jYwMtG%k0=*x{wPeIW><;<wJaa6yVm8~sEbf=Rc=;2x@Gc&V4A<6$T*bq`o
zg!;aH{rCn{B%eKZu8Ox-oDvEE8LKlpz-Go}!NRKRSS0DRcc;phEw{9KLY{gRLzSNb
zA&^dwLCpIXB+v5_k9+A{yno#`V>y0Lc<#>_Q0g13-|jfD+D(u?PXhG3?1-!IsE&Rk
zobMbMcJfPI4N@o4)5RC&FAi9{RiIDN9fyh$OryUpwzi%a|H4y{1_?l&4=FK>_Rq^j
z;RExX{&AZ$PKD%v1<j?Uq@m|0U-a8zr*Dmv0C$tW2W-}it+h~D{#=uSc%p9?QI%tD
zFV6P%PTXcLj`y0GnX!X5OGA{O2{02(c3?xApx_`Z;F&Z6noul$t;+&LF^J+t#^Yb9
zf<t?tFcy!SmVpOIRS3-;8MtMH4i@1p&LE(6W^$Ge296vXOkNA>4L$B&fx}(24lO*9
z1!q8CnA8B2A(|i~Ue51PVtz}5L2REf3`SUc`8~+L!9o>EISGVPFHfr@5+N7YvLf%y
zyBiCAHxDVMiDt7vQ0>V9B?oSTENcH`=~Qgm@?x63;2OZX|HzRe{kuU5J#KjlyGcH0
zg%p$^nuMKtMTG}v+SFMhF_3>cl3vo9S`H|i^Yv!~Qfr<Dx#W(*n7D{R^=Xl8gsQ$@
zmtwhV<6C5?`~5Q&oG<+>Sn?MgiRinga;MO@{1K9rjonx1t7Om}Xea1|dAk`1a!OXy
zsyx4mj)iG>V0S;lUcg)jd?VVrrD}ShW}ri5G5%oa%sG%qx+p|K0^2#ml+0Vn#E3?v
z3WJJSn${{5D0}|F2*z*@MhQY98u{fr5V;|+bAryvBYD7vz(`<BKw>vPq?=!M$WPE5
zL)=0BT^XVfFInY#B_6yYa1b{;#AB0`L0-J*XO!f6=$Wc&LR4)<*xcAbu!B=JuL2J&
ze7cDRJ5ek^B`AMo%B=!Vk$>6r`;Z3gg3RT2YYnP&_q{QlmX(}2pKOQwXjtj~JM`id
zJsPC47woa~XQvC{Z}ZP+M_8DWoEA{Np4`T{OT`0=Hw9P9^piS;wjL1?T`cSx@U)iE
z-nqPmJcg3)YY0Af?#K2V6KvFI_f#xt)}?og+rnD~uvi0{n#*nh3-hX9CKmW5kNPXT
z65k9Ef~%N<CekMCJjhgoWIeLipdmVAS^)-ioKSA^z)`kQlo51Qk@5(lQA6JArh-U(
zxp*O#9c3?=Z4_8_1+iV43Vp!|M`}7KPY9{?6%`nXd|TcF8(KD1)T7WlL+{<HvhYdf
ztZ-=#Sm~=IZBw@nd2mMUoi9$u!$eg&0BRh6-R-u>aErl;?qhFFE#*wznTqNTuGwUC
zrD`-qa{3t8wmwyGSz={h*QV12SXI{a`?p;Uhe37%12(WI6r-sUjYBi>aa9(gWs81)
zEWGGY9v0-B*Az;kTs4u9Q>UkZi$m+><S+lZLZK=pxO)q{m@;(-hNlEJW&J~1asH*l
ziQ-MH2d-hGT}q2j%SYc8hkgEi$ot&6!82DilQpui>f6fs7b7N#X}9Ad1tklub7|3_
z)ClPbaTYjqG)d8i5py)P(*5WKNu&S*m?&ix;ZtlhRxn~Q@OHJ<9pwjZ+uh(fH<d=_
z*y82sYK7{8)SzFT1HWDed!b-!?X>Y`7nZI8NL*`3xqq1y^%7@Cx`J|kfmqc9ZQ4eD
zcd(n4l~q+Fu*NY4J&JB`rf*LVB~@%IBF)W@So1xAhr0arx&ljiuavaQbFY?>cBXGY
z)X#LrZ0-sv>F^Sc^Hsfn+f}tPS?KF}Tp7e|uU;gu;xfJZXOtgU+)s*9zbkWWGf&Ym
zI&yiw+Qec?UMf$MX`5>T3szpoay|nK*#$P6j;niwdH)0~f=Ao)llj290{KE$^F0;U
z?W9pl@rQadHyUJ6U5`Zuy*svc>efRqt`P|=2?=ag`Bi>c`5VrNiM;&uAE55+cdbZP
zym&Fz_-YcUr-brpppPlb%Z}Wxyff|#exT0I@1h+p*ilw-a)%wS_k*X5z|0KT{AM+I
zPQYd|aIawB*&W?*{`l-+&71398+AGoUhotW?DxodzEOtAL|(Zfw0X2VtKs<5e54XV
zyY=kD#ALkC8GF4QDd~Z9&JDnX80r`&Am{uQX<(PY-wjQ$iT{Do^{Dh{CK<$Qm2zA)
zdVO|AB(41{nzm8*fvzNg(%EPaW#YN{Cz`>x08BPBY@8IpQ^i^hD3d_1383ql<0d5l
zAo&axZ%?pZ1ji!yM_Q9E*g$6a$SDEsjX3x<Yz@v^RTx;9(b2EOJNb%le}>}K(}yXP
z6U{$cB4NQh&%)tGp(ScJqL)Fd!4s%TyI%A{kG2u*5rEVi3>5rH-U&d-Pwo!01;r$t
zKH$EN3V$U7(8|ZMux)nxRy~>$M}nN$zU)mmsS^+1ss;+Prt=%H5|;?*Arbg&#Y!TA
z-2Kx{IE!kD=37+J3s9zx4DXW)@_d#^jf=z_*OZ}IILx0pY>QEwsfYv#eaf_GCGaQU
zZ%vepsaaJBa~K@@{K*}sa|S7vP`z<cuFsjCHk0F0iibUStI?h@#t>+-;>cH$9zHR9
zPW?Y>JC2x9pDjDDK*C3z1NKnDvt{scjLB{%mBb~t=6K4U0t<v9<UboAwe(qnkU~jZ
zHYdH7FKWlzl>C6iPab`_&`Vmf&$2yq#O%@Dc{_Gcje0++SX@|qqhFc~x8=^Y_<(Vm
zB_=0FsHVrJU2#(d4Yl1-rm)t4E<;p*92Qs8BrG%gcNriPtL*EAj;Z@4y74$63ly@`
z@LDk!JiyiyD|cGu)Ch;N2YfF<z_r_(7USr&12h5WMz^DmX4~6EO%KwGqRs#o@)~7Y
zWmJ;yI8IsWwn%J4ctHMB33`~`zC3nK)`pe4$dQ3YfvqUh@-`XVg&<MvQ-ZurfQ?Y-
zF$kBee0KpF2Sxdy2qw5B^G!Z>Wu604P^kC}Mc#>zPV9dV%86{IK;A58GHp32H*$i2
zR#P+YA$$Zts?s4p^jZ00ow#X-CYZM<lNfMB`m=th?cSmIB5^QjdHPq3MXttKw=F6#
z$&(;#SuI#EpTD2ughTJf<1qCICCG}8d2lf`z~elts6KbjRu=L$%aD{=x6PUnt0aZ6
z?V16k-DVgCJ}2@NoJBvBUd_aAdu*>>aZXMZyj{}=RZ_If&HP1BrG*qImy)m|ZI4Sv
z3Ra-1^{GOG+{`pA^v!BTR4nC{S7)KZ@J2w<0&!$4{YwlLmp$G8PDWNV;S)o8zmEK+
z0L53qR$y_9-iceJ+{M-ZnnE6o#x0HsYvQKT+y=0xpif<3*OPA^%^a1LI3QMfk6Ui=
z1H4%@vlv*PDXtsLe~2=@6BE+__Ru?3q@E$XfjoYdg<c9#<Zupqep*o%N>5uKm~_N~
zS?o2l+Z#P+^)o^cIm;|bRZeTrP#bbe7vt1fb2bR7FBCigU+!SzV>79*FbFO=%S8bx
zhqi66on2a*TPM~P$delKWe*GWF@^7xby(uSPovIcCdBFb4W{KYNaBKLx_p}c_aV!%
zV3Hvya?Xs~y<bu_opj2bSLoY&*G_PruJ=eh;QSLtkaza<%*SgoSYjp*o>nxEyhV8k
zKJ;;$LCsD44nu8(N#M&L*;<D>7U7y70RIkH#BRfEk~etx9pLvyxMr<zYenemwE_!Y
zZd$o+-tfX|v1L$Am|TRnk#v{|al3US-SxNa0Xy7Le%?u1N2)#y2*SWb-Q#u1l!rOx
zlU(q{9sgANP}&I@Q`qe&hzz&HIo9y3Y_Fb02$FYznhc5wYuGPO>-O}%){0})sl;7g
z^Y{xW(mP>&*=2AW;}k+)sOsKDSSy~`x=~!c?(O6A@>Y!(k8}d5Pt{dlG0=D+cGHjc
zAZQ0$aCeb-=own%6SWqmN{~m2)+MuFezvnL?hYaYRG`3fiP_mmI5iH6EaB9PfCuTt
zNM&-XqYFs!fM6{!2Y$imxr7`D4*3r9?b9X+jPML>Xj+HVUtP9oge@`-*uB8A=19|0
zIjCfqFb0kyrEOB5Xux<xru>R>UWK6IWD2o=P|oUfhffX;4%&MX_#uYMkg!+P*2X4E
z?~j?#8UO?;n?sjLKMnDO{qU*=Zul>D!WyKeSh2EZxduu`_(49ndje+kis0#+ZR69k
zaZtVViu0gI$jIBqEt(>4fne$DItR(?q~OZEJv=;MpN0xmq^CW$R#w}dF`^D}lGV}+
zz)ljB_Y9POKW9Wmd3f|!ZrCeIvx2lc@yGBPaR;RlJeOG=uw6!+nOSK11T1fx6Vt1M
zJXWlnhj+K3zU7^T<lQcbtI#~AJ7M*TZ|6GUG#^Ntz2dH#Fzm-9q$)Y@*@X_66nW*o
z=;P*D+an6{@wml{qa_>Av|Xu{F4q7=WeeU82TlNP$fm}za+?}YLC3&kCn*%>QC%0P
znuBni^}IRvPdMG}K4*97j<mG5q`=HE+c{?YZtPLS6omZ12$^8_Pj4hlXRSx7^LdGz
z!g1)}4C*VfaLIWVfU`jO$%DD4^F5<{qY5R-Tjd+}7Ig)vc`rVt5`XUmNT5ESQ9MhY
zA!ri6P)lt#t`G!@q>3~7t@zp&A>zBpHG7zrXz;|C-aCjEg}aax`+D%TYcZUcVh^y{
z`2mqdqblv%wQGK!yWpoINmc}3bdo>r{hX-+*2itzkd7Qo8SPuq=GJq3b>Ot7vj#`4
zzS)A)6TTgRzi#*9XHnZ{b)h1}u~oiZ1K)P!e%#;Pd3oX6SM>r$h~@?0t6G7@H_#=K
zmn^_JBSMgv2b(YOnU<I=%8~_gX8%<<e{y)V>n%Spn43fy(f9A1uT5^*O+d>_BZUi<
zzkm};duUO-!9TCD8{7LhKS2-oF4PVCK1~Br;_*ktn;uVx0yuJr<2$$nf5;&8lAyYP
z!7m1<h2@zR(X%~A(T~J#c{&iV9*;vehbugfa-%?xZ&PO7TLeF&hX_Iq6b+g0w~bs_
z)JAd(&+`&J?k(@#dmVZl8xx~vF+auBNEhXtAp@X1)pu|d|AR;v3=YEUt<G<%IA%XT
zM0tkz(c<ic^5fj+D?~yd4DP2}VcoXCu*aEYgqe0H|4DZH&ID5#(^*(G6x_r6ycbWf
zLVp%rLXg%|lZnxehxCvy^AyRwgEt#O5C6bfGaWodm&E64`hIP1(@Uo&MqPfw9lO4-
zdD&jVul&i!hJE%3nM{p8zJN>0@5}7YasAK@7c`^f<mL5*-WeH)E`l2TlPUPt*%zK?
zTcVywlGn?7H9SAbv<F`qJ3!p|_%s6Y?ciKsE#^T^X(;ll=-4%wbpf$6V!L*0={7iM
zNuVE!Lm(g8!);XjPsd4@LG8Moa9}nFEd$BRgHMNyUKk`%b4raG15qmxb?7@j1{)VF
zllXzUGgxpE$tC&vlSt12*4qf=Ad7da+pm}`#}{JJzckzp-wUwO8_V7Hg$d_G(OqSB
zK$MY2iHF-yFV=zFFTl2HTom_GFjR1P9`=!e^wef140<Dq_95>=z=5Vt|BA)Q0>&~)
zUy{7i1$mnH;}y8^3iMbk^9hxc@RxOvS|BpAN=&cN?G9v$M7~h+KsQ{y5>ngVv*MCH
z3p0vHwELqeQC4$M@ZR=G*kc96D}|!;hLQ>Nltv_SsS8A8n6q`xUV*?T<x7w$kA74)
z&?_$p?EW*ESfDtH*d<M!ot!Rej?w4VSyq%w#h$rofJjfR8GOGbpE5Hq(uBmelybgs
z+0BlHPA`khJQ8bev@1<vdO%Y?zOywdj~iB`Z~YV*K6xnPfOSit%T&8QL&dos40zqY
zg)qhs?F1(xM>qgTHNjlc)NF7gHVA|<G73aKb_vd}ZZ|V40;T3z0WD>(sLgXEB-*%f
zl8s#^37<^gvTtaAe|u5p17}3iHlFL$jf~t>^XVuIZW@~|2r#Rl63U00>$Y{+;TFrg
z4p`F}97J0x?`{?$x9B1MI^~0}v)pb6*X@8FCdnKN;1xCp)eu=<i~$&QBVW{r;eZF0
zem#YsIii8ryak}e7h`*gjon<W&v%I}5#Z1zFoA5O>%*^?-2z$;&=QJN4jmLVMJc-`
z)X9?{2Jdw*xG)sTJXX>}FZOyx09h?aQEjJz^*%rmJ&nfY>%`N7n)MGW(vWiWp7)+U
z0&m=65TiXH_AnAcJG_BZY1@v&i}a$dC0bN@I5^w%T55B~E%7G~f~@Z|+Zbd3S9RBU
znH@A_ySt_)7o)%yRj)UckmJcnWa6V<wi-t6lTiaemA|d6$PF_5W9F<SjpgzK%JfTl
zc<>=`WOFYgA$TzJqwpyJ0v{;31_#iGly9z6E;-Mi?6&k6c5zhW-d9rtA9r|B%<Xw<
zpof{-LwhI#fKAtQ6~oCy`&yBw-{+7a5DJ%yCP|y1s&}3!pN^6_r^H=u_5}I`M0T~^
zOQ`s<l7NP<w{Bsbe(;3Pu2M!lbjtW#UWzf+nf9b5^nSE%0msB$!KXh!JpWq67gMxX
z{5C(Fe-ABEPdEk4GxqLh@Et>QuMD9_bjYxkI$1n$O|PA_je7k#|9+~rK_s~M)0+p)
zznLRT4}o{<qy<QLqxWtG*p0nG!BcF9a0Ce!mX#*Yf1G%urPB?LSBH=EJ&_G6@3~2A
zdCh2N5das+4vBQw#V@gtJ9j7oc?~Qm!!mmgn=k@ctYUR1Hug}#;OtHdWR{ejJxghp
z<=znyf*e}=5|e5K4aZ8{0bkT;I1XMz(og0{;2ps-e~y$5>`yGBwQ`Q|*$;8Z31aZ~
zdpmr-3Dvg;xpssVj_N|U9YNs4A1ODW_vS?r{W@F#r^Ke^ph8L40pHQEDWkw|pNy6m
zbN8^X4(%}yyhVwCBMGF}f!!gs#Z8DHRbo08{c-G=UQ%zz|7z>Z<C?m*Jsv>BTU&uT
zfKmvBIz&`ZW*I`uC<tgkQ6zvkPzZxSn1`TNh*sfJqsUy;BvK`y5Rfrg85AMNEK@+H
z5JBcCgd}$zU*CK8-cSF{nf5t*?cZ8^?Y+K1f9~#-I+?S@772={Uyjt@Wp-EPb{!oM
zmwjSFuhyt_(U@IF@zDcHUyd#iPD|AMiMep$!e{tg9@cr-j0{?k2GYJ?jh9$Aaip-|
z;Q0c9lURmkWb(~WdMN-_IC@b~;PliEga5kzfE1kS72hI+GAwG0*Zk0`uJCBFz74uY
zbxWIuynI>5j3$$lf(zD0?&&RPWV!iPsi&?9?S$p5^P5rg2s{k$QVn}&&Lh2t3fj>k
zqEpHlF=FJ%b)D6~_fqj>asWiD!p7R#y|z3~SB}j4g>;x`d0uT1ela9spa40x#udo~
ztKfIdwph03$js8mkzSMYp6M5tvb%o2zV>QVaa}|4w@BnUwLK;)*x7~_855L2yK%hN
z9^}WlMZJu7TA706cGro-k6YVSSSuVUz(yH#l{A-j;{c=Zr5la!T^Co;{H@Cwm1DED
zwKL7`)@bu932}-P^3Mpa#AQ<N*<f$+=goGQDp3k@<A^`a#g}i1If0Hzj_Vg$tLR&~
z3$LA3!{t-x4kojjwwN4Xp6&Z~7o57IfZ>-;J4lTQ_|zc<ft$9hJw7dQ>bBK)hQXuG
zY3XtJyrt~L_s5ajk{foerP}7NQ1W=)%5b=2-PH-^1Idy)5XfXdVXnxI<Px@ggJe%t
zRS4#WYPkF=QUruUH$^G@+};xb35#31Rg9vhX3OtP1_lN%C^NebC1_5;tv$~Z4Y{<Z
z16ZS&EAz66mnH^-!5@t$NCMwsNvS*VjlH1FwXrzk%fLu<6lSpf0s6SYczZpObNINq
z*b9ulsT*{KF#7)0%~A?OVAEcr&g{x|LA=$%UQsGT@CE@(^dRUCE!n${<|6)a`4j{b
zVG1~lLv&&&uiRlToLuvwKvV&`p0|{6L^rni<LkuarDTeWgxS}`RP&x<pZ0p=w&`ZW
zz=Oa^s%$_CpU4f^1rOV_eeG3vB%(Wd&S*<?knz;zz>NmIoe}s@6IH~ctW1i0^H+$v
z?%kTAjIk5yv`dS}020(!>A#>q+7VaY<?5ZhDFOj8)CQML7tkoUysA`tmCW@fzkJ1a
zk4@srCcONfWf>dr(->jm1Ki9+VGN?2vYMh0b{TxS4CIia5+T)Y4*lFXoYnVVT#~sj
z<5#P)js$E80uPS})XJ8HP*Sdxr$gX)RE_z}L2C55_LBTb#JePj%2_3pX@7tdL<Ne=
zS(jX74!t|J3UkgpWB`8wp?H+W38_#(i?`!h+V-S^|Ef80N?cXqZyi-NT?JK=SW`W{
zt~l8J%)38=JHRbj>5+)P^uJ6UK!ZH+k%C8g&Mu|Xe7tXo=Li>Qo8x-e*9es=4-LZ>
zC#(_fi%+}WQKaL&48lY}))+9aBNg?_yxNQ!Pedu{1^D-l-=I=>l;4<el46s#xZS=l
ziHPTaemggZ{?uK)`#%5Rm9TQOZTviJF%Ul_jwQfo`WjY`P>LU}lGLdh`p2`5E@|G6
z?qi{bQfw`10qx>&kH;g}V)S+VN5bII@mDoO86}ip^R(>haX`P&$Gc-Bk>?}HLF;!N
zi@H?j@8P_fn(gBMx0_{xdmY^JW&+Cp93iVj2TrhCYhn#!-J}#94=ZB+o#g|VDYe}$
zu!$N<Cw#>AKx~8Lv@&Y0_^8Bbz0dmLcz$z#iN667yA&=m)+QSR8GgNir`Hp=#7CrO
zLHL<bnp{n9Zq6Vge&9e>me`%gF^cqD?`<a-sJz9mB$F&XlgKes*^kip(zw@Oy3IDt
z0dp3dWPAv5oaNt_;$9FvGx}<dAYl6A);FVesBIvVe@;^VoQP6acj?BJi#8uufYqUz
z;ZAR=@=hNBlt3qk)REF$D!xaZk>dl{1a5vF-&huTs>4+o36stg53^{Q8H~v)|KOP6
z27z+lsX0xQ0f7)UHBpt*TL=^vL;b<l7Stce1W}be{`)c|gw0%JWEn?HU{@y3){$OH
ztFpa@JN_Eoh?R!>+veF}##{;Bh`R1ruOy{HK{k~^;V=<%oq>#{mD)q6^~7_i9d&1l
z0lEtLACIolMQaT84v^Qhkj=@SxqpcN9#z#kb<_Q}WpqT$dV4#*jMfoF5Z~b4fb78R
zVz?-}%qJZ;nGXl7=FmWB^JzLc0l2Lfn|n`bU^zf#D(KE|fLbn4*LXVAthqFPQzfIa
zUeXs(@j1Jv_uVH&$p{8lQU?kZu*~UoCMzenH$7vS&+JmW2nHN6e-|vxpTIM9rbQKq
z8(pe{oxePXr%c}`FMqBC&^hep3_DEGR*W(e-k!Wyhljn_RyBzTU#2@j9@@nF;S@$K
zJvx~qcn<10kc|^9Q*hcw%r>OBEi<x>#4bCA31x<1gFyqro1VJZugRLDQm1sUB11bD
zM78hUTH~%D#|s9k(A|%=2ngx4JoyzOwR#?b87V6%5%3ENNvN-H546@MJ_3qfRpsd7
z;M!}6XbiP$7@F0zP3(^tvHmD-Pzz`flYR#;g>C>oss0AHpt|h@^wbikQ-^;C-yJFp
z?T&?Z)gCdO@yMY0lrz@H8%tsrklFp8g;<H26Tkdr-iGvb_7h!S4F2)Oji8fq@BI2;
z7NVbmqquU8fT`o@-3~x>i_LPfpg<MwzXR|-+CZBM-DtF>;JbaUlPRthXk!R<LJzkq
zn?zsVB^jUFig1}|_Nh7=y(?q=ZtbD?!~c|r&-*cu4=XLfn1Rp%=NTE$_n3<%RxgY{
z?yC7dwpG6Y%8%k^Osq-a0|`qQ?l^pR%Y6LH{a|0@kA8edLpp;PXhgg+oR|!iX*u`B
z2sv+Ztxj9{A3w*qgNfw+yjsv|V*5_)=7N%pKT~fld6^|gMB<#oH3KbRYwzdLNr28(
zmzdNKAlvYioY;WGvP(iTzlVQT7Bk<$?l+5quK8tinfk%UV^|_A5F313=tEq*WJn)u
z!hGIGB??L72%hkO@V=P*8{nSu1$KFX#>S>1pMzq%g4rL~k$cT<K7YPEyShpb$<sW<
zT#pJ!-$SMN=DS{mHc~4m2VshWIK{DUIBp78^1#z@KPf{oNl?Otop^*<(Av$-j5|zS
z^c#S-)!;Zw1x${+t#A%>ST@tW&vPRxStLzSQ$rg?E!q*fGsRasbW))(94()h^NiOI
z7qR&aFwM7y-2dS|ir#*F`?lq0zN|8;)~R~8>Q9I>*OIFc(LnZ~=BQ<(jeP3_GHbd&
z%OG9oM&8}KKuMMBoyySIcoc*%Xjy-+I>N~Numm?b5T<X&R)8h02RK-f(Zt#Qqzsa?
z<HZ20>(H2Si22#PnMoS0x`9Cg+T;!)Egp>MKfsyNpp`Z4ot74NGxpf>s=w0}uI65s
zDbW5%y5ggR?$@l{2I(G9pvr)yTc<Rq$~k>%Ui-QIzeMZ7B6fu9Km*m|-0@KSjQ>-Y
zXHg%KOMe}x$Pih*7)F}TWhf23Xl>Q#%ZxLnFQ)I3r%py;sP){PUk3R|0RRgA6BK%}
z+XG7E*Nn$|H0zrmJt}ZC6gsncjcxZP26w!7g&1?Fl_sE5dizKBQ8~_b!k$QT(dCNU
zPw#zYjyiiJJZPM3(~zVhY%9tMeH(b(-rmvDp`w>|7Ej1B*)jA1f(yBYBn9if68k#_
zrz_Tqp1LsB=rYSQ;$gqoj}bxejW!OSseuZVaKJHL{A2DqhPsdXQV&f3L0OmPf3a6T
zizHDS=R%Bj*iWUEC5I4+iy3yd;zQiUPrKxqljS1j)oaj?XB=*j@^y9X@2Wkdtle~*
zY`FvTog->$KqoY5^;uCs$w@`Go2ToehoW%~VpHJf0vR2%QCboLth*8<L!j{NW5TP(
zHjJ*W3Py63#eWP8>c-dBlr9s6niIwdZMIY6^z<j+6?0uLQhSO2V;hJPDNul)@M3nx
z@>WN&|2g&LaHb&l%V`SYNcReG*w8z#4bh%}yopV1JBPc42C%Z5T`TAV>UGITP6!1z
z{X|zpaGEq~XlO__<Z43x#9iqntknJr&|WvhwY@&O%EgJ^A@dBzlG7%y6P}L9&*tu{
zO0#rS@do2ps=wO>z_x*SDy_qnz%Dzvs*dvf@p`=Ltw{)yJoDVR^jT|22+Bz4a%aff
zu=kzHUszcjq*~?g#x=TIgS_n<&wd4olx9Ei;5J=OmM#CupJ)lxX1xPfpqg64!C^og
zi)oXk+Gs*$HfFbP{y1nt%~{jI9Gq_m`y|vhFBSN944x?(t{fad()o(hiKuw#m@FN6
zZDk4YJ*9!9Pz$~bv%XZ<zUbkDt<e0S67~xBZ&1lrALgK~J-kg1?6zwvDOUym(16WP
zsm5|+f;x6lDXxTrZ|C50GQF_R1J<axnO?NX<)m#(;WWGTW&e>8eUsiI!%ZlIbLk?F
z3Nk-L@{?@l#|X3Z6{us5xBldtzqF_)e!?qN39A+tbFavu3LgaDzBBfr$eS}4pI?w<
zGw4Bx@n%QjEhYd586S~3AWGwok6`N1RzQR{(3(4uAqE6m^fE=11RHe>8vc)eeb6Q~
zU@)%7CLdv78})5JLAc{OIaMGJGE=y|hu^Yo4nw7Ivs1jo1Y*ylRN3_cDVc!iVsAe=
zWU(j$)=_B?5%&VZnpsZ>W~bI2FW(6uam)=ZMC~=#2na<y^77>{%vcF!_yXRZ6}md~
ziWT*Y3&8clQ4bGr!Oif$2IG5vbN|axy5GYIb6rPH8FHCL=W8k>CH{m@m+){Rhs0os
z`=iyUtIqj6{nI6%=>f1TvNd^m>T4i!pDCAIv)<qi;9s+jh#<&1bbZToJ`Yz)c`VX1
z)u`Wryrc{looo-Zr!PK_JSYki$fF7mFur}ZAoIYlw>s9FvDByD*==<v6*#kNE?=>+
zd$a^Ik|6DeLrh6=(Ii_ynE$$sv{hI5<1rpd#q^4&M-%$7$%5ac9~N-Zc*WVmz!)Si
zJVV8aezb@=XAv6|FyH&+u)f)Bao>i@1PK(`k~5Z*!ND56(ZpHs8gG&pd&sL1&3wl_
zfmKU0Dl<I_fNVZe?J#@ZJNwW;weW>r<5Q={Bt>eqfj<9*4dzo*Q#{{Vnuv&%cStIU
z!NgK+46VV&G)gTUa`I1#Un=mo(wQrC@K<hwiBR~d{xy>7k9H7P^`KQ(?d9hh$x-$e
zQ*R9Q<wFJ}0BN5FUcu}@|5?$V<_F5d-Ilc?G7)d##(Lo|j^U`XtYhy>OQ4MB*zvn$
z(YM?Ds@Lb0PgW3c`I^aZU~a89mg)UEp5Gu%gn&`b@k%0zk&mTzu=4kBv8J?iQbb2^
zAp@|qJdG9h=+xK$mKC=FRrp?8s$LDSr_ExSFW5l<XOi%?OXnVSrCL8$c$}#TTQ!Wg
zZR&UuI^J~e5V9kRT_J!GOWvkkCu+(*X{+6GhuXjOBo>VkUdrb=(jBtahLLHE$yE4G
zAc!}8QxZl4Eyx_}4)|2+lEqP$OT~xvNFzLvQF0*J*+UUiwa+q&4UkvAR5KRyX;c4U
zRb<0omlum|JUvE!&^M41edzYz{l`J(a<ncOZQfw7$9CZ+)X;a~GED;7dSTa7yRgr$
zRi9Q(T<)i5r{ba_DQlJF4=K1_EpY}(T%hZFQ1>C*$aJV4UTC*z8i{d-#9@of1;!y6
zW-C^;qBp#E%q~__UL5~ws6s#S;ta<rXuQlhj4zL>K}ky{PsowUAD&-m(5Bl)x*r^q
z#!vwnaZf%p+SX^pZ}W%B5vjStqVtCrO4MLE=ghhq*0<wm$R8oVr0-{lUgvyFvU)5f
zALNw3R8Lvpx{R)m34z%anlQ*pTbX(?1d4hci}gHEcOk}Ukl1-jDMK*b=blcybnC-u
zJGU&H@m^e1*sU{IvHe)?{pV%NS9{o3A1KJx`n;Bjg<XEeFA9?*U$1&GYI1t2TZBbx
z+MRJEeewAlakbA^#l00dU3(tx`)Y{WuR!sA=6c2HT2a~!wXf1;-_Io1UOP!Ve2A9d
z_e)n7X<y{b%Lk8t_@~Y({ZlQ0@_*L+(9=}8FkPXkZoj+Id#EfvJY{MBilDhQB4)m#
z=Y5kjs)$r-=h=P-+ZkG=KQi@wU9{!ggMHiI*jnno8BpccT@B!{J~+gW<x9U`zeK%O
z^*M?del;yEO?c<&qJsUri}sdRb>(mQqj93R>>Sm9SRTDWtoM}4+y3yI`_G@qnk;d2
z>_cwr;&WL4<TtsYv;-bT(pyk|(Q%WWS|5&K@Q#?yv?-^kYc>9xw$}*Ej!B|V+DbAk
zYp3UbFFCT`S7=bodkIhLxwjcNN=?$_X5bokUPY^E=XRT2G_zK9-IjSPChak#%=d8D
zV~?c8R1EC}(u+jIr9tG?uw@RCsKnRbTR&=jSe{jy<#wtwD@NOThA^`O7iD%I#!x)n
z?EH#hP->0#j{_uG$!)6F1ga}7Xr~L8FJDg3D4%!yw$1rHG365Kma23ms_|H=_fH$P
zybV5Jsmd)aQYv!f+3ol5i>s^+r|PCX^PAAoD%y>e&>T!}>wm*k0rf;3vvjav{N#D<
EU)xGTJpcdz

literal 0
HcmV?d00001

diff --git a/envscope/web/app.icns b/envscope/web/app.icns
new file mode 100644
index 0000000000000000000000000000000000000000..8b6d9e287a7ac9a639cbe36259fb4545650d743d
GIT binary patch
literal 64260
zcmeFZbyOYAwlCVSu;2uDLJ}aj1Wj;aIKkZ)1PSi8fDj}Bk`UZUaCf)h?y_)qcVDmh
z_TFcobN0LU+;_%!<K90mV<g>FS69tBtLCiVl;(r+M+X47Mp03aqyqrp?FVB{egMFf
z1+M}CKvV%<1p(k$=m%piP5`h_2CrNI0Qm!6xd8yR54`gHtsmF(zxDgu`@xFxZ*VXv
zFu^f#-o2H24_;yS|1i+N|64>1d%#Js-bsn8xF+l-%2?@)k#`{GPbd2)4GGXSH9`+w
z<}qQ>F<U3aJjs$KQrh_Z>Xj-6OB(%m_P0_b-^!jm7ax?ieu^AV&#00X@KGyHsyOHK
z(n}=&?6?44ym&Nn%@04B&c1fg%oko22uFnqFOy$43|v05--&&(p5%Z)c+AaH`$@JM
z6+82NMGr0_SU?9tAm*lPwLw|U*~e()P#VUx7r<wve&my<JOw{KoZ(_)V++~Im+%z3
zzHA^tqcJ86N3Nr3nw3({G$^_mRDpCgZf>`azp6!2q-}nQLr4oPg?m#flv{m0GqEQn
z*he*HB;XzBu4-q1etfc~gkKZ8x!de`MFlu$ZnCep>~^hur1$<V_9BC)GGXPpDtE4$
z@PKR~PR58?bi(+1k<p={@2uRks23elQd+M2Uz^6;GDTkn=}D)*-;5i{I)xNV8Q~Fx
z`ESs$)rDK2tl7la+0sR9=4_UZ(M*nykB?3gc_juVMKqRQH0(aE)9hTu!^Xi`&AHOy
zMSuD*SdAe8d5E3Olg`55q1BZ+q6?eD{l*C0GxL|R+^4=qGAYXPi)Jq0F3<9}?S%T7
z?<ZJjY9|v#-(AF$h*mLV8NbxaX5eHlzhqd{W%K6zKBZMgi1Vr^4rdUY)<4L3%R;m&
z$T=<5TvM44Uxp!>{?9u$@0c~LgA*|!FN-;kdGE!!a?9oRl@(KZ%f<F`Sqm!urXo%C
z%FEolJF7MZSV-Hl)(s~gsyVSW%Q$ctb|DWH($2O?dGMTpV81`3WHy}?`f0Ag%cIrA
zJvON9;?b)z;?P&y!<IZoczTU@5M-w<XVDcoq%7sKBr^bdM;__?$Xw!!Ijh#d4V&nX
zE|ZQYRd{0X2N1ce&N1Kd%#qEXst_W>yC86^5IU_dYe%(YV&mc78%`O|_qg)~mFT}$
zO+4|$O=(+wX<oOQ(R@+B^}ti%OW_l?w0fi^x%Am56i!9Y8Rty!Z5t<Ihg|*5ZQizq
z=^ZJBKkIwOuI!gzqO!u*W<)?pNLZ0sYt$AJi}ORi_ct*n>NJ1rYkGpwiHR1~jP5~-
z*sw8&)0ySvWsS;@)D<7$eq*`n(@`G{^I*z8o}`Z-Kdy*}#S(<RKI|Rw$V22SR+`eg
zQIV6kMY2R6CR<Jn4laD`{GIN_8f#G5hUkh=SUTtlEV5sf_84LRy1e+N!r0s#!^z31
zB12eEFnD}i?Pfc9eQ4BVKLNh6!K5ebjIGO9tHbZR=v>a>a>vqmk-ocxby-~Z>kzZ|
zYjH8x^oaGxkL`<+fwl;*bHQQOt9IahRba)(@*KrJ9STZ{qTNO7ak(Xig2LM`)4W)v
zIi|!j?M{%5TeQ0xzSOB(LR|tUD-5Q$Q{27Sggn~*H%*Mm-hRilUS%s>#n_PaH`ZjI
zA1|#t2qw60vsn@q{WLVNOAErG<TL15>pQ?|;BHFqiMCtW7&65vO^Czb#)kZ=rkcCx
zD~#4rT|aW8a$Q8VhDq}n(KqP7d0-+*xN!9~S=tMb+ck$Uh4I0b{)d;sapW1XwL>|F
zMRcnOaZVzSmwxZjn5=hLD<^*rtbgxWrP6)>c?&Je(Jry!pd|e|R@kFx|I#bnddQ*w
zHqd3RSnWDN=lHzjCW%rElPR9rX1+o94A=39{-*^jN)^kd-a-$)vr#}**t1`aL_tY;
zxPCt0u{mP4W}WrTsK>pQYWYbd3SZ9&&L0);0ZZ8TA*GpWhs>R8`JJ^xtd*9d+BtO2
z-yx-f=8xZ!iLm&%+VIP%{*xJbCMa@l=ybF-JkpQjOIw;#Z(8TxLVLSnFB#e#P~N)x
z<suQ!Day;I<(yyR`i#YTHYzYXjJQ4Tunr{^WfrACl(y+(!q;hzz)`+w8u((T1I7#k
zkr$A;bk_4|9aH9;B@=dvrqC1+@(U+LAe9p~ZFjANPWx(|&zBZ${9$FIhNt)bdi};`
zHSDd|?<Gz}n%Bgi9~m%VE6U8=8692<ld><Qw*(HBX}DgUNGXy<6+moYTJbRHh?fLz
zBI3`trq>At#1Gi=G)ewG2Y6X_XH-1xq&m~Q)a8Y3eHYvTrC<S!J$AqpVQS>C08}44
zOfDZ?XW*sSo8WqA+zs}lpb2t!SpMXO(LQ#ld(BpBxt0o&`_B>YiT{tkHN;^S2#L)9
zs`84W8<jAed;hV#Q>$@WAD5a5qC%LwuR0^bqfIGzCUVUhmnL())EOL1Utu+eBD%-|
zdE3-(-=M0@r;{M!(5|&x`r_mKbGaTs)W<v7a^R7zzv3xULfEufbh0GAG~|<0qrPHc
z=r-E7uy0VqkFzxaij;Kk^~1kJv&)_S=5_cs)Z8H~tmbKCj-yB$yf9U6>AKoUU<rW^
zE}eCyuH(OLTpBZOl+f2t-qvTQHe9o#x3Jy*goA^#Ap{SYn;RH}!-J!uNVJEYgg(x5
zV&`67?e6<jt{5&zxHa%_`+?KQ2hT6WVUt9i6`L%f!N&Ad+_(>oSwxaCm;+U=X}t1p
z5Wkzr(S|H)vC7Hb8-!!ln*?=QKqY)<p7ge$HE9ZSDucF6(311OrjX~?A=;1#at4dD
zqxtjZKXF{9HAbUI$w*b3PM@C_I4GC#bI11jAl*qQ4CS=^9KQ)L=O7e+PkuAIE&E}{
zRLh|Piu{=KuDjR$haQ2H<&chdCH6P@Oy%B<@jkH&g3wo%L!SLw070UGFcpSyTCutA
zl}9_UYdL=7-z;21f^j*Ew?~j~rWfxeR`<9eBDVjtb>=rHT11eGnKFED7|Y>P6o1U2
zZvm>r^qCK*wkNA&ro$8aZ{#ggD5-=#8fCX<9>>@Rsy;p>P2LmsnRZ`pN2dA>n=8EO
z5=Gj286Da1qiT~Cf-<n`^(#u%J6F$nN|Put8ZKtjOskE%DGbcbnanu7Ex7f^c*PI!
z`=nkBDVDLi=(H{BF+`BF|2X`_C(hYMx+~Qp-N7z2hY*Ua(d%%f>Roq~Tkv5GjTs1r
zrp=~xsK?uCYilbTE1x*gyUX9<_NZrm4jAt1>a`)Uzl22Q+zKY=o=W}OId6@uKYKdQ
zxx668FrwOHW|?#pNjUm_sO#%_t8I<uLD;4x$N8d1+PnNE?GLPskbeUh(t<-(8ngZb
zJR_F=n<wz6nWmE7{~n`g$Bsa4b3$oRQ{!XjXk;@7x{wD-h66%dmk-N156D_vi55<Q
zy`)t&OWGe9nC8q@R^y?LkQ5O=Hwp%kUTEnpUs5-@QL)Ag%65OLNsI#s(1ujTeXRSj
zogVE$Qpm_p4j!_o6dYKCNxLd{-<+?nuQ+4>rBBB6Pqib#ay}3p0`FeQOBF~M`27Qe
z{wtP50(&6=e_=@-`z$C3K%M@MC1)+I64YbS4-gJePX(incjiVfmU{$HnbodS)8tsh
zr-pTh1M&@qGBztx1MpZ{b83x{9y}r*{gQJ#NUT-d6oO|p(lp%TM`uy_>WlP9+VGbv
zUtJYC8ndPBT?T<?)q=&#vFDn?%L3a^<adhA*6I@w3ME<!JFz@T=a-G^^$89rToWTB
zBg2!ElY~LoO^X&detCq^4^(PVHSi2@U}``gpfkCfu7Lr_A_?Fud_sPc(5aCkE}lU7
z8g?sx+5|5(djtLq(6ys*jZ9BZf47kK5|gnPRuRqevjnWr2HELJ>u6PR3R8cQ*)Kv(
zrz5R3I*{tvLMrKwKL0)`A9md22T?%>{^Mc{SZ@>?<Qdx>N~beZfpUt=UEm*yOwP_%
z(<#7X{5sr?<EQT$HOMH0@J|&ON|3&}=|dxkMy63GkvegZ%LZ;Kv6AR%F^XvX?xcM)
zpX+)y9Mt}K5tP!2D#jOIU(8hXM#YBod*~S%R?-p`MvnX2S7#Z-wSj?w`r@CY=z)Uz
zv#HOI8N<C~rLWw8%AmI)uN2;4K~&k0T*Z}-c29F(BzYb8@taB5sCO17@6l4-e4@Yb
z6Z=?(u5q#Qst~veY4UoU+;fW}##MIq>GaR7_LWUQw>nZayuoZSB6%I_gcRTFiRe#+
z8`EyqITi@Fo5fDNRcG1?L@wp~sVRaM(B)TC7Z(?GboCqcILfT2D;y0SPaK%5^kL_=
z;R=pQ_<#?7n`CTKlFxLdjXoC_(qOG=&$TZ84G&6X@j)<&;B&>7qypz{-&0fP>GzNZ
zqx<&!7L@i*gPFH+#17N_TUtEuJAg^sKHl7^e)-!7vAh0;^`vBTO?9jWUijoqWN_u2
zkZQz4c3T9rp#P+n?pD}$ru7e_)(0CgeQce>(tz6l&#~mjDTT=w0#&N`I|Q9{Uy`#d
z9(_};(tTV#lbe;6gB!j}yMw4QKfnf`xI@t?x>ClX#x$NlQaIvgQ<)WlI)(NwgDvop
zSEqh3=8e-61NGWyd#ERNfHkXk+LVC0wzZmNDKDw7190o_?~_k4nI4j1@jNIf%0#Pm
zw|m`Q;c*^Nv`n!5Lu?RA${w60pJz`TL0`j@+#_20BU3Z#j_r2h1KmLITgKX3snpQN
zuIdSMQMBESdX)}9tZarp<PwiWRB3||?L|IGKEw7yz&SAa`EP`-RLRUS;VXKS6151m
zcwRi9wthko-oC^bf|mO#_g!vZToPo1cBhfjHayp2lIH=z&?_k^--VG&ox5v|w5O!@
z`ug)8-|aahi+s&)g6Ta>4Up3pB+>C`ZoI~Dk*tR0<!XHh2*8<DK2(zyHCv2XR9GM#
z>=hgPY}3)M+KDP*_oIu6Snz5`O2T9rcoryz3rn^Yhzccr4Kk|A6`80sl<=B(f72RF
zBr|yjBCFN1Y$2JTp?$RTTSsEuboC3OH)T+?;-C^ZkZ2PIUIf$m6$WE`NoM+-=bZn!
z&{5)`1c}q`W_CL9;4^KSMlwDT99piU1YqOh@(D(AjFmY_sgSDmsEuIVO-taBs8)XI
zRMR_qEZwT%o3Az^g99UiU0cjQr_cFy-9L5~2}yCWJ@AKl$9VXpnZ)Fq-X2(4b36pt
zF+_TJ5K>)6yw>GjUCYOfoBR8X(up@(bn4IE+~7a`oKjcOWcc7j;rQ}q5!C|_m%fwu
z)TZ$Bd4*)<R0TycqN+BF-}cRI{A(#E$BvsM#3j(FleifnX0y^InuenP5c}kH?x_qi
z9r5!y*8Y6le2{7fwPm&KXcU-*t@f^dQqUj1#_=AcLC_E(jcrR>6BCRDZk?{iC1U~W
zGs$AV<2yj|)C%mr@7ebyi=x=>2@zy(y<e0fl3Ues*%P`(*bkwnt=a^2;yLi{ySuw<
zp&Z>6QA$aj8uQweC%;x!=2zi&u+yg(O?WX;3AdO}_hp6g8uEt(ZCQklH6%i+;uwM8
z8~cK_Lgx?z&YgCArCZJ27mPn1ES3i|nW$Z}D>??u;?w7d=H8Y8+g^2$!MWoZ^`GhQ
zqh*&#Sj6$^wxoXFtj>0d8F)=qvH<DtAMo(-n46o6X=_tzX=y=4Z?aZlyw5OfZ(4&j
zh=wF~_G@zT^Ka&}ZrwsB&+t(Mysn;SWMmFa4&q-o>9$7#Wq$}k>ptl^_S*9(BDtxL
zfA;I%-p4%6`l*UhIO-TZU%*JVa%RzTe<B$rrKFHGt!ka0v+lak%Z6*Nyj=~-zN9E1
z-RQwSmCz?Ij@_1U?;GQ<VPR?2)#OR$<@w!TTr3~>Y`+ol3#4(y_o}ZCf@~)Wkj_7%
z7(bI`@IT|-4Jv795Sb}*VsW1J;-_&v5Px~RQ)+IZWlJ6U`$Gi~v`?beoP-$H7V+En
zUVmZ!;X~+{-t)bXHu|Ns+FZ){tF^``|LshV^Q%F^pu@d%Kl+-joZN%X7QBv}i)U0I
zd|Y=A_A16KT$T0&5)xyZGw-&PC+plCCgoCNCW{Oqdo$Igo+SdC4`~5s=y_E9fP(Mq
zvM19O){>T%md_RR)RfX7P3+0=^o9bt_&*;p+rC=!?C$Os*Q3;`1mgn6jE=+Jy3^^*
zy1pMid@#hLd+=j6__0<)>p2j#aYP14(HH~xZeNk`4d0Q)JY3g~^};VCU~n>-@Cm0D
z{hUJ7t1VN0=kL4ZN#1?;nNcB0O0wor!h|UQQek;MaafNYYY>txIiJ)?L9L6Sl_&P5
ziqPm{lO5#)fe8;m?<E1}otfaD4yii9Lt;H`jb`T`9j%w@__2cLqf|TUCx%?Yjf{-w
zN0GlC8^TWY+B-TVYok6EHd>r+9evZ+B7+!wUy8p@TYYeBV}{fe-&F9`%sl92J3x0t
z27z@NV*~WzT)_Vi4R(h3c$3KFJ(`JuSZPmaA#{sUD3%iiiEPk(Pu)KP9P-j%jDaT_
zZq{`bd^>Jd{57?;sWP&#>d0W1nQB5~W8-3-gr8BLldXn>4Rp;Ig<ia1xhe;J1Az`@
zsdwvbjCBb(g6}AOK9J8|yniOhvUPQL*>X+;b28h_9iD$+scD(R?tPbp21~z)<uS7z
zFxz8GM#){EB12Y{m6biX;BUXU^q>LS&z6?=>y!`YX8MzkxixMMkI!EM*jR9zn;VXS
za2{%@GCDNid&fW5SZsysf7;OdrCH4GeV^dPPPN*Rr$eKDAKxYS&}$t|fWGxJ-87Z=
znSTCw0xVZeJfY84vAUvyFHf%=Gn={hfjL{zxydn)ZCd2Uw}u@cvpyJz_p|(`7HUV*
z7n|AAPgdC(w-Lr`xKar@Vzj+4e)(=gS~Dv#E`e2{pIbzvKUj_4PZ)+#yl2M{A$}cq
z_O>iNH#awDK#-TWt@x6l1yU09jO5GPoF|QyRYrep+y9CsaAR}5qhX6)IVVx4!oq*V
z2W+f#MVP<kS6RR85B+0lZ5cqQZl^7uED}nm*xB8I9BJ2ey0K{96tw$@-)a)}(?OLS
zH_tcfi_gH`?8cM|yeX-x>)p)lrY;$+4|=wvMVobO<4R4a=WlZZJUR(0i~^j<{BhUI
zBTpb#{g(<Wn}_D^pXq=coY~bM+e0nD+k^MxB)}%|%jEL5kVY*ev7wey?tkduf6dI_
zd(@Gw8u}YW@%$->gE%m~ytxs^1t|S$oOh?-MtT-#L80k*_xAOuUGlJPV15~33J<ig
zY)R^H{#9E`S<{MAv|40+7Dw%}*E%^#7TD5GB<eE&Ns&d_7J4xRhieWMmY0>;;?_P{
zSoe9Qmw>{`_KPz4_lMjl9&)oE3<oE-$LF=^Vyi9W*EuMR2PY5+U9%O3_gXLc%yFzo
z52LsfIiah)P>~6!BQrBANs)SJt0+m{27oK<oM&+L$+|2af$CSJ|7C9f*EjHg7<Bm$
z-4|94;dA1sDvn|DHTw9o>dTVOb$c$LASFK^Cs#dRf>{?K8j(L>_Qef8<sHesO-x)-
zH(BGf4V7g5REck{c!#}AlUCjeRDA{GboYuLl1~3yC+w6XNjV~7H9)wdqr<rJZRW09
z{zbC)(KE*aT`Zi(NRDUwlS4yFh>5UZS8G)#6OYh>f&#^9PF`N(ZKvA=fjs?2T<Trc
zrYxg*ra$)wMOeqe(7zb9s0%<5M-lVzHBCrncJ?#b#8_ti*RtHvCo*mk5t()u2dPEz
z5?l@&gO8|0?Oq=86Fj}1MT$vEYH#r32$;nViH-KTlt~criW7!aSz1}Oj)-0<P>Fa7
z>|`j)-W-PewBjXS81C#f=!Ahs!H#^*P%+mG;<V5Z3T4<?Q*1>QhXvAjlSx)5@FRV@
z;4$fwlXG2zo7v5af}5=^i}Bm1<pF`&ZqJhqCC|ei{dPhH(SWrzs4HDjP<%--$J?rm
z42B!WeZ8Bj355TPy-DAA@Wh(PU@t4H_{2SF_Dnueh<N%t%;DEz7?og13ehJXGIIjt
zXLx5NEiKV{?&Jz0rzUO#`|l3ppKbQw$^sgA;d_OZg`g2FE7bIl8XrHFwE5LKMU-`a
zfK;51Og}9<J3AZv4B?Q5rKtP~j$rIzyvgg?m#p+jdQ1Ye0B8&3)1^~~dOy#L)Wqzz
zBsiYnF0LlX+`#X81iq;)1QC)4**_YUco@Qhd%+*JcSf5<V<*o^<7^z1b(eRho1%sB
zcLXHAU~kC(DQIiJVxIl^zB(nBq|}^%`th|cK~XNi_~#=&!PwY?T(7{*O|GE2-Az+`
z`u(4lx+~VXUi?Br?yplDacY&MR7BN|)vj0L`x3jiojk4SG2uFW17Um*{3hJ!zjflR
zYT@}I@L+TpcceMSFY&~FTCGy3Q?pFm=m1~8ex>s7v^3-o3)&J}DYx$%NXD0H6;=<Q
zU`Vs=D?B|$QnWYoNfo!{E>j~=>eCF>&ewkkfR2y<)(UYFI-N8_u63?m?rC+$+JK<x
zvTrhW<_9SiMz!VjjyrwM%><TBpX{y0Ecx%Rq<V}&7;Mcef;hxNrb`~6C27+e7ghQ*
zIolXgueN+l+h8&UZ>rwUW?mm)kjBsbkh}YZw($w@+P<0}a0_OH1phFsh+0jDPc;lm
z5DrYUhRx?Gj0AxWPX<S9s#9|$<1qa|?pE#&D*n@j;pDAc5WL@B`yqYnS<Qe9y|J7V
zqR$b`HO<`&xZ5qURIoPRpP|g!Gv<IXjVt@?mufZa4Crh=;D$gd1$>>TDJ+I1=yTFz
z#fs}~7n-o5uYFkxMBMgBlTE-E^!mqkBGj3^OE->6n`IBTbA+1X{ez6sUasgf<~fsI
z550n<fG!GtC!|g|hKVLmEgzZ>Hp8E?iOs`@4rhTY9vV#iwuM&O6En3^nXAim5xal$
zmmd9)5hlEp?_R!PP{b5*JXmO+=U7#b8ijD4eWJe#H<H8*VzSTU%YPlMbwi8_>smjW
zSKp{?v#a7%`l%tOWvvyecH{v*h_$l1lg2+ldzAK;`W(Gxz@l_%Ubi0$${p)H@$Jrr
zpeyGn2*$MHaU19#yOd0f8Q_`TsBeeYG>H{F(x^1%;${kC8eQ_4u&@(sYuo`iFH>)}
z>D|L~<c}C0r73<qi!Gxl)6&@+VSNF}ibVUoZuLS7L489(pcKlKk$;wlrhfFC1rvxE
zSWQw396-WGN)w8$h%24a-Xv7rb=TA9tAz~i2fw9Mz<xNk6XWyn+W-v}jdu?7Krr*x
zy~mvMl7W7k3|UH*<L(!|`@VGTE$K^+oIDp>+g!TI$KS+114@x0v~mCDX%i<ys$zIK
zZQDfEH@?(Ky;X@^@)@$onQGII064+@dShaItj~O+eTGJcA{7~%OPTv9_i1i+Tpg}O
z9_WgrHvdAd3k*b&`V!CPd4m+fK}|(7=TDLI4$nZu1H!z=z?5XH0Nd#9=1p_$x5yZ8
z(~kx?A4^I$_MM!};I?_;Uqbw08xpH=_{H^iUTQ3AJX!uV;oE)CQh(o#+ng#HsrN5g
z>5{v4R_lLYcrU2XP|(oykDZ<p`~V&FN{Q86*o@UY4@M^=_Y2EH>&r&i#$!<61Ck%m
z|3v=#*a{iSisT~839;|>Ymw;d2QVY^U2zm0kKJ;dH}W*sF+Wd^fsc!+NKeai@fJ|!
zx+*6M_gv5V_~#QI)awStSn+unE7^u;&9T!{?sA=BGL3t9j7c(=@aInozkGRvN&mzi
ziIefTp_k!VMkQ7e<QpZ5dGa+s8uF{}38Dp+>>^>1D;CtGVaLPEKl_;bbbj=dz_DqC
z75Uo_hYVsBl6Hy6^`tk&f^6ggV(e3BsARqiPGZR%@2=YZ3=XD&aa=YMBu;%B8=E&d
z&rXrpx=s~uQ!opVipa%kbsYVX{C#u8*=O>sYD<DS!y&HPL^k3pIPW$s(>I50UcY`F
z*0xzlQwvmSC@3h%fUsDBjvENf<;5tG*I`iHB{2|&@d8>%&nLFq8AIxUCL-7fAkSpm
z8vGTNf~d9H5M^>-1usF^!`ac%@kDkqR5us_(MrlWd>HPX_@APde`U=7HEM|rc0>MK
z)bhl2^a@Ou%l;#3iS<oq%xnE{9^pJ7iSh1hQ&W@1<G!zSYo_!%TqvC3A=DP7eDcVa
z9-&?BdgGLghW??6eJzoFQ(Yg8jQBKVchacTt!=-Cy7YuhXwu+@1FsF@1z>HG!aNj_
zzZcm~jA*t*5cwmI4auLRx;f78c{C(5YZ~c!d3x0NG<xjSug4AMl+4Y|?Y;U!Lj7!0
zfagW=mUkUD^**m?!B5kUo)d;@+Rcn#v*k}BX3}Zi>AK<3h%L&-ma)BsW+bk;D?w{l
z+#5*#@TirT5ueDycgS7l={MoQ!NIy<<}%`k#GHS}HXKRhGsE`wwzdj;bU038qNHZI
z&~MpXp3=L8hCjNDF=eB@LbLTPz0&Ac<TSr%fjBxon13DKSg%!htwL>Ci>x+Jsa&&{
ztT?4awN6(?Cd-(`X?0&bzrumZ>KEielgtEr>GjdkQ9IT15!R8-*lF^QXC&uE(!<}Q
zOsP+AFK+SofT@NjF<p|Ak3U3f@>%RDpd7yu-Y71CFYD^+4ixA&dJ7dEW&|M*nwuq#
zaTQr>+i<?n9)?GK2o1E&=?Z%v6=^&<v799A3S@J}KS<ViD3MijW7<<f>oNHF$GGX<
z_G@?d_R|*H_CGMRRNy(dh)pGN@Hp8Tv5e!{TWp>e(D`-vFLapy09n;F7W6Dj=Nxr&
z?#DG4uYEiXhhlv}E)rAA*K$gbPCxd$NsQe_j>a?5Bnh7;yZ|_-Z9_^?pqP(j<E@^=
z?Dd(r<fzs9fICr>Z{tP@SW7J|v~gQc>&KdP%9bIG&9j;3Gv%NKNIaeC_TF3bZGPm*
zPfUtwFgsrB<0wvC|BTEjBPl7VtExH>70n)bS=+~3wO<)Ahz?_jL~?N%DVk|u%gtxY
ztt)t+En9qxM~k|^iGz)uhcWCC3178G2xgokr8wadcJ3IWHu6R^@N#pP1h21!Dgn6p
zWk$9KyRnV|T^y0{2Z#PUn-H;{erziz_!Ql2-3Ql;NAJq(I>vLD0QAB6`T6{Uqo<mK
zs`iZ<(AmRf6j7i|jv(eIT=&t4TwKl^A0Hoy`jb{~Cg7T!f<mk2O-<etgi~~X=yV`R
z>si_U32OvRR#(IDBd^l;**l#cI{ALcMf?|*!>d0;7%t;3xcq2=5NBfFwt&wcS>IK@
zM|sEr)YsR)apcgu@qX7RNO*G?cU$)c6)^u4OJi^y(nQMOvfp6p>3I{WQt6z7nljqx
zzVP0mw*B`phBxrG5TnYmF<xJ^!qCJzgb|BD9YB+(5a2+$_Iejh)^UMEw<!ssIS10G
zOL`HGE1Tc1BfptoHieAkqH~{HuG|^+>|o%{BvAl#no(W;jr66B51<n^Q$>bP0(Om_
z<;|!&G<I`e|E?`uSP=o59+8kttu%|ObJu2XuwaqY04I33NyZriagKI3Hh*XVTLE?K
zD#z&BJ6kK)i{`YCTr4}LUVF4Im%Px5pI}8x@6`=(PR&r;U~+azug9lRh0MvxY5TEr
zXFygc8hp;$6zqp*((L16VzS~(Z{7EY2-eWh@M?8$&vJE9>+A{%z!IjU>nX^Um)EOw
zJ6;Q>x0;n8f;BfcD_ahqM!{bQ*3trlO}VIhtnVhU@$e8;vz7K4d=sF=AmZNfu^2vp
zSc@x$9YLx~dv7p&WG}wP+6?&oIf^5HGfP3{>`=o*U=9y3Uy4K)KN^TWIWl98jGj6|
zX|7-eSQPZ!N>ocZx^|Gk75t`60M=3TEP|fj)P+i|FqX9ohJmf^!9%R{ef&EB_R_7+
zBLR-e6=B3zK3zJbhH5ajuwa9_saA~!KSl>u`ivjg;<Q_Zkf-wvlLP`+*VnbBVPOMr
zz1f<<`DYy<J2gdS1DPG|?F?f}S`ENSlH)L!Zt9sjgBR=o9Vl!5Bd#CcEv+6ddV7Lp
zVaTQns1@o7E1ph8_myBlT=pSAnJ;Sr>B3@CNu)?gYQR40WC^N4+u-1{r{{&;jtm|k
zjn3Q-0WfbBp6i7SY14WwMHvzpvA@41cWGg~XVCp5`-?y>%K5o91&y~9TgGYuvPQN0
z>9ov|%{_<CYkMJ@Bs^@;cr95OVwkF=<o?gVa_(hrQ9w*-9Fy!TTy3C=WSBb;So&;-
zrymKAC*mgqfLDg6s*q&<9uWbp?3rwm!H1|RBD_nB`>WnobH+$OieYb3gy}xK%CJRJ
z`WC-wVPSy+tGtk65f5Mza1iB#>h(6vbo^NN$HT!%e9xQDyKV)psf0RujB0m*42z&1
zeatj=Q%HnbUXELk$DPg=I`DRT3ph`W@#VsbU<Ngfky;sZwNVMmdISO99&f>V`@d?E
z@o)tr4^B)}W;rOGqA5G4qW7Pn1HZc@br|VtIiW_q?P;U{i;IglL(h&^vt$G<1ppg=
z_>$@V2{bu+VidW^!gj1f))}Yg8W|`;g!nqk^}gj*8kuVEZf@3pKEnT$`W=`eT;S!$
z`{7)@T@u>TQklzyYOvZJ$(Z}|*8d%Z>J%MVX!6||4zgI(x1Omwd{%z_2=+@s#637#
zTA!N-)GnBR(2LH~Jl4ntqEh8uJs@f{>Q)I_1N-0u0Jv;W)85{gL~AdM6d!|y+bH;a
zcl}If2Pjd+-W-}6N#n<lE1&N?qB!+e$Hqzg;Z`-$D{rt54ywscy3@d`an>(~qs3nJ
zC=hV>@CfgmLHq!BfI(O^T3jN2>2qk#R65|urg!py=N1{<J3wzH$_A-XMh-PD5}0DR
z^Xzl1wW}8efMZc2x?SdKZ#!4l3lEDia##e&!8=X_6}W&+68R6a9vfG*e^t#Tfo*On
zC4bvlkG%q?G3+(TxxJBXuUL2lySuw9&Hv>Y_)dliL?^5lsj$R`%&UUp;$kN@9>~3c
zwx(VceRP8am`|p{o^n|luT{t*9oU}{M6g2#K!!d?!M=cPt$z&_sm4BUmLYOq^%tr~
z_cp#>OW4QC%F4Ka2N+kX8Rvd{KTbQV7}Sf)!yyq#g9|iA&q`mcc%xKaq5>(0Tg}#I
z(rg#Ce4$@oe(S&%d-JSR^qbTL1Q>kc;ZhYo8Q)AT#{sZ>R;zzATr04L2Z%ZB_RYEM
z_ARXu!<PF6jO`e%t9}pb(1KgPSLPYiu6HGa7*?R}+%RvlUUUxjPl`sJ66A`Ae-A|A
z;jpo}olS>Uea8oY7~(InRHfC6s0(k$*wvvnruU2GIaVrAS~*@?{T<c7e0~nm+l3AQ
zbT)e-a4Mb}LsWxsi|FF}LAU#mM|o-pP*cD|_<QyV!Py<iCf6w;vJ7poX8i(qh>V?n
zVMy#N2DgsZ(Q9$Djy$~$WJSIa)slc}4>|zQFv!SD8hd|f+i+8aT<>GPVQt^oDH(Hq
z0RT;Za?Q%FU!C^qWg#1^sY5lLCp(A%K<v0JFD%weL;w1<KId~sqvYy2%E@bVASM02
zox0Rx4wddxfj)2P94aL>0GP+bz`1JI)q&5W#N4$BJP43LJg!n>=ML;-2P6$u?NbMP
zA4*iPK=Vv-!0NnmjK{M8wW)MRowWxS4iYG484Rc9@stORS_rZ5kH+{&1UM+qsmIwx
ztyzg@6lzmVH)$-KIpcodmPn*NwKmpdYowyQ44HNNS_1$Wd{|Pi`4RnQ#aE=tVl2ma
z){$!j9HQ)*OB-u=tapk6trZ^PCC`gTG~xgN>@q@Kdyir^19gFyJ>KF_Sp>KR`g=><
zGiaN(CA`55PWC%eu3J#_@$uDi2d}uM=Zk<HJN@M&r2acl2=(`a(v;qoCwtsJ_rV~I
z(|l8k2Cf}NX42*(9oG$H+bE&l9cmmZu+6;0y&^e1%%242YYnOAPMq8EMFL=G+=+Sv
z7yiUBgGDPI?fye><uJ>c7mi{M0|n6OUc~o+#52WQrQgDRv6`M`CJcWVreFuDO!*cK
zDG1g?)F2mmU7s223PpmbU#xkQ1AR1`Yg=C(sHv%u=hwvRK_CN)O{Tu4!hf~;IezA5
zS>+P~1tkz0xuw~-FM57w%?$r=&$*)FUXI!A+%#kYOU%Y*pB^iO76q)mB`y_#-sPei
z45hv5s4Ao1zbCsrSd*3q!59d1Yq4EEBmv!xlo%-YTy(F=-5fH0jv>=BniyCuq1Ag8
zb9w4B;Q2(GEjO7Elz0d;)T{TV9+fUaQ}ljeh_r>b`>wWY??A9LYu^U80I$}!!r{qI
zE-oBO7>p~zG$5@gj}q`p8?B%nHNh-kkGISCO%Ef&`YfP~aqwIhbddEnVjfYb55xKL
zQ>FV3l4iYkvaw<Fhzv0RNEzIMCu<Joo}+<9!EL0aqCCfQb@wmDF+zRThU4QdVnB5>
z<GSu)&`vlP8}z(Z^TvKubh-YhXGtQC^;aUP8mBJV4Q?jb9X=br*rm{tB<!J*uNtYD
z(H|!7<mB?<aH)-l<1SVN)<Vo5TkC8!UqJDcnV*`P`qRYA-Pok@(NPsIvlJcn3B<Pt
zAO(#(P?<6p8~ipR{TVw2r_-%5q4iy}?OvYw971^kr4A~GuVH!(b$5cj@}B+)F)@S0
z>U!DTw&`~n!E3>WV<RKKIBri#%dOz=p~!2!WnR}kQ#DRH;lg)SG@b_@?n_;a+xz6R
zv$I&2KT`u*6Qg5pO(S9;>{(j*YKY^o<AI4nUAOdp(S1*9x0Ua1c)6TQ@g~_S^q%(a
zkT27BX7VDMJyC2u#ux#|ER8okr}LZW6Zs>3`t_PFGj3+}=53lJL<+rkt{4V_Bf@Pw
z!ovB#!bP-_YtFRl5nlUdc;!d}KJ;ens<~rzZ<Lror>Ew?4{OWkZr`Qh*TCIovbog=
zgOiKXs_=8xqL|y**u!3u-j&hcb4NTjL+Xe#sP17i3kd2;&kB7uqfg4?8*>~61m8qN
zL|8TZ1;YoL=lz0}T{9b2iM%c|;vKI(WUdNR0oGPyIjX0}tV@fM(qe~-0Ok{#eV-97
zn_<Mo&FR+u{(y%7fJsLqee-3&OWq&if65Z9NJRwmBZkf2jxst?faf2{VEp_I^man@
zZux3aYFv*A7gJ1JR!(7?dc9FHTGv@~P7+B`j8xY(b<ShcV>^&s37ZH;e-KN&c{dxW
zK2Cap1PdT3B)KkU5&iu*Ou$bQ=9dBxiRsMl|4x0B=rZT#hKDNVo9I2Y={~J#Hpap8
z`uZ36{3X|Vf<u2c$2Jxa`fvcLYJr-x2<^2v$O4@_qVY7}Y)u#&co4)$-ht{rc*g{w
zf<<@P4TK849%R5n{CUeIHz4m59DHESuJ?lwtLZ2ysV)$i4(ScGlgh2_<7h~QD9DGv
z`7!Ds$|1XNPZT>iD*zf{&fFfPWm+gOMSE|NQU1~#{QqyaG234lmscYytDdmIs-F!U
zUVkg9Lc2KIody^Gr~Lt#xf`uSdi0ZYVs!K;10!REesn`_?iYy=&0m1Q_)`4dn}Ql?
zN@mJYrM<TfSW~hDQ^j7j-KKi4-Fh3W=8Gi}XCW*q%#lBHE?!IyDUFBndx}FK5H~z@
z>(4Iiy_<6D>DJRHH^&3Hza9@E7wO}3K?XhT;?;9iRhcP&G!Qs@vN=0DTi9E0@295V
zC;^;|>8!c?Zs~RB0XH&Yf``aLAodV{(3W6J0ve|WX`t!&Mt6@Y{_pL-%7J-Z7({}k
z65ne1t(Bpg3_O-o%SaloL_i7vmRx|V^!v37pj>ahGufb9j!$u808j)Y17*cz?TLwr
zS4*M%TffH`c|A$!_D&UKWj8`t3RO(2((Gd^@l$jUw@@*;Aw`~-M;R~wGL{vov4K<o
z>q~iL6ij<uF#=jFv1P@3%l;qsX9``Mo1AkU8kN}g!fAN*0yE4n$PB6=FVDBhU34Lk
zfPq$qsfUQc!W4`D;;WOdb~>%DpWokKkns|Fkiw>2VT&X1jR)+2hbe~CT7NebN*V8>
zTM^rx{!peFnGH4}x)y@0h@aPq_WKKX?^jy=p9%Qys?C2>+y3XTDGKf*0r|bNV_VBT
z#$T^#D#t3rV^@VyQcRTqnB>OBhWRFbFwzVh4nN^)-+f5Se>Yn)qnbaa)$ki|D~|Ms
z)Cs{RFdk)PX1>wC+UBr;m!z{%(=&{8tFnyEj?Mn;z}lmrrXCv|HR*}^RVBy3nCW=B
zuagf-O_ja05K>1{h`9h5EksK{z3uH{w1k(KTK&2;fl^SBnO|CSgQo;2`6zZ9u_S>9
z_yT0nIb+PznQ~(m<#mBT+4KMHS{G;lwMyoTG_9*g3VbiJV&?n1IwK?FxuD=P7j>5H
ztt|_S1vz=SZvRS0yZD%(0qsr?Cb6CpP-^+t%xLxxA&olh+kIX(YS}6ln|98QKb@9w
z^aq=o#FS}xqS6o-#q)!m8(Bi#)E27E{uSWKP0PU}*tE?B0jR{Vzgm>%NSpd=RX^%L
z293Ms{9~Iae81Ok__w+klU3fl*(L#EvvrsW?wY_;0VeqqX3v5?lgk58%i&cEym&}k
znT`cEFR_vXz(Xm}Bc&530(Is8v|E*a4?u(L5lXek2%lM$DR*gxFb&Lq8B|>Gl$26X
z2$xR(F}i_kkV6_uJzbegBH>R9R<_<Nb_!5d{a=|8{YP{hb$48}bsnVVcm|h8t8#96
z+1c4wR+2n;f`EX)y&aH8W*y{eq8A~7@wac&I*9+Ps8WEqY6eLi2(sAqGBaq|mLkbP
z+#y$k{agf>(GPhy>@SPfIcA~S=yf`_wX<W<ZH$IDRbq-|DF#^IKdr8s5UsH@J{~va
zRIXMrdS;%|2dW>k!K>FmX&d|{06Yo0hw6U!e(?Xj{Z~0;C7c6;Ni(-&qR)6r>jJ-(
zY2|19Y@5)ZLCbE$<>Ds-df&Zy69`rpZTm3x=&H_nI<V=#0YBs^VU2j$CmKDW@4w1z
zvl=7pZOLh=J3D*z2Z!I>!h#zvY!LCm-d<WA(LY8pTlJlPf#HisJ=cv*{pz+>gQwe(
zM-zy7Ezgu;$SEK+;pV}?#eUMbnvt0~28Ty_UaUMV&C^2$54s-+U6eJy2*6iR`u4(s
z1>?~QXko4YJJ{*(*1YuR#x5z=XJo~c+7TqNUvl#D79C-UJe7v8wU^1Q91fl9JkEB8
zdZsJag^7R%lMTkT&iiwbJNZptJ|Qc9n;s4e4`06rh+qwePOZLM0Qo%!L@O0#pg*87
z*8+TlohsxN(xQp|1vaa7#{K6#6qS{g{{o`{_>S{l=RE><`WPS<CIY*Pq=F?70{f`|
zQ&A?r)u1Gv=<oipu)07$R52tbm@BvZOS}aen}+JSL8KIdyFE*v%xHb@*kuH&I1*D(
zK>_=$cgJqc?%DJ)4JHivsu|BaMf>BW`)xg18~FYptJp!xfae*{lmK7Uxh+7{SpfpL
zO~lcgsoU<4XLnd2OLWw$VeS|D*VzhNZKV3Wf5G;oLxhLV1^U&x&z+f*v-6rT6)PR4
zShJ&x%eF5%&7jTATF3KtSpeqdx)?y}*vBYRP;NP40eY-fJ$_v?iIyFh3=N9=wFqyo
zgKoUdTEs;-h#|!&-7l`^Cjz~9rM)b7r>??KL!N>jUa#Jd(fD(NBHNkzJHJpK0C6X(
zlP)uVOXCG%7RR+%vvCgc);|VpCpU*wta+})LxiBrv_DqAs+_sPsV})E{?nLZbQZ1K
ztua&`V>H>peGqChm$QG<=rb6Xe5<K@5QgQrm7SSWSg0T@{N{twIsN!a((=1#Lc$39
z^^%^t)(E}jYW72ymv_xGJCoJQ+La&22o+wYdhA~_dLcl9L3F*{aV@x}uXDPiFIZ&Z
zZwklfNHO{{U{m)&QHM`Juic@Q;Eg%xlWNsCZuaUC?I$~6-ou?yb%T|5rascj%M#O`
zi`&G^uIzWaQ}x<lUC*gCd}ye-R~osH8ZXr-7Y&`}Cmc=$JIT0Oa-dmCBJ@yjFwU^g
zmbzGHBGKv<#Xh?gr`Q@Ozpg3iadF_dbPP|7I-<eg#7lqJ*xaPkx)a`kNKPJcfdH@y
zqEb-@{*O<<Ac}<1nOV|i^}qSv87XE<f`)RQIw0&$#xE6(&}0Qh1aZNj!}9^h-n+b&
zhPK&f_hym~>J7S^9I*A3h6qbBB;c(P4lI%Dy0ojSE3vyI-wh8$56{J;tV7|+q2b{Q
z-OtCrc7US@@`SeSg!eSJ@fvmrfWM191jE+yJ~5hje4lXg&_Rlt+dLXud&A!#Zy}WX
znVY>7=9WR@97+g=JiKqtd$Gk-DW5D$gCt;DtSL6`CUk+J3j-sgCDaJMRbheqC<@oM
z@mix609J7_z8qP`@stI5DUCVhI`*;0pqrzpS_{t=0dX^c$q4nlkA_?m!!E+#5Z6U*
zFMtFYqZE#ndKao=HGvsLWA^!WDzIzY!&2e<&J)Bi)1D|{v*B<-Y_M;0OxweQ<(Sh#
z7GQg#Fxh#N;2txf8k6ANh(0X6b3!$Et-*Nytz{7G`)jmRIByyuDXI!^4~$n|%gm61
zP}L|13|0w4Z^W^h-VStD=@cf>fg@lxooWa#pC69|0^V7|dv^+bG+<}*1osMrqNvkA
z@<ajzU-ZZ9@(dXU0F%fvbB~%mo(gX)032h4jY<gmAz*~%AAv9&EV1<W@WtU-9b61R
z>=8Sn_679XQZ$nKU|aHnJsN@x46e;c3Xk9|z);18Z}%D^O~G)I`SPmIY-PKw=ngWc
zkkC~^_1+Tr5jbGYOoMQlCFb$s;{j--wJ4*}tadg)=KMd^Yw9)L?k|!6mnx?pU1(P=
zz}{2#r;S4~tLWEpV2DjFp3gdBXPOEO_@wk{yo5A02uG}zvI3|3c#8;E3}qa0P|)T<
zF|%APc&EI9tiZ4Ip+M6!2rkIXAk9{+^_jo>=Yet{D=nM#BL5ytO-c6d+;?Bs1GXyB
zVy@=*?v!2d!OfEY4C>sw$A4AB&k96#NA-QYQj4lzj7A1vRDTPRUgI>L*?Onc-WKBj
zY4!Vx3vN}Z-mMsT;Bk4ND$vdxN!z*e(U=5WpD2|9^U~VwST8bM7rn-<g7}p@Y*36c
z_5to{GGi^5M=c^n`tfl!v*}Jc1fU?W3T_zlzi4_@%{xq@8h|NR!h)%2O>%qyMxx9C
zlyh|CiOkr<j%D9cGkYmFBLXx*KC~o-Bm5CE!oSQ6)lgHwTxOQ$MRG65#~^(#QK=yG
z#Hzu1ob-JE{iYfegh%Fy^$2&qf#E!?CYfs}60W_EA=vdf4UZu7*s9S^zUNwwx_E^o
zTC@}Njer%mwMJ1g9yj)R(M;rnonPU5xJLsWxsdgvTL3Vav*7w-%rLMTzh2jb$mrgf
zm#Oi;Cn?U-=4`H*|I50Gh|2|B8S9Smhh8=wxDwB2=6bzMZP4~(w+CV;*zWGb^$SOZ
zK^~wk4^kb5`5YCtVkb?6$L<SwD(nj3HN;ASBtKtlZCr>qKI=a>>#GI6hK5>WV<Nm7
zM8OzrU2#k`mq(-vQcxa6!_KhoUwjWz-pvs6xQKfvk-YWsLBPkA8d`oo-OD3D0h*8l
z5%TlOUK8MFRy6?^u~^&?{5GUmmI54*Y!Z#$$pB0QDjT3=cDdU4?Z$%&RLH-w9zHe<
z#-#mzB(TgRcRRDSvv<+XN}z}}zGWkHxwMVjb5ya!o`aPv!d(c@R3CN#_;4he+%+Ch
zzJN*>Hzj;Xx_8B13Qo~$ygz?B8<TAT`%DBoJUmqQgZtQ@=l=vBtv$SJ;DvtZRVkN2
z3gS~`-kv>u5S<h14qA$k&UB03!I<<=_phIcVdhpQD<oZrANP`mI*lXr`%TQ3pO*nr
zFJz_>0#$qIpfGLCxmb*$?K>*|ymdg`#pst8`D)i$wc)nY24E5@uVJ3Hv_$RNyjQ;5
z1Dx#R%*9U=+6eM(aET5mPBraIb-7r~xJwV?-UDg(Ik27<pMv>L3;@{SX#JXJW*YH4
zACUUh@{7Ob#=Re01_Q*{-OW|ZcZ;+P5}2#&FCoF(P5hhfSl;VY&=|1Anuf%ZmD;Us
zHLi87*453;MTBkY>C~%2N!=I5n*rE~2J|qm(SyMynuC_s=PCdy>djuec!)4(%k|c1
z_Gw)NRl|Zc>4fy=4Hwoi27;;5?Ltn$hJsD=Oq@Sg5nPCO)W`g}t=L~RW2OaumV$|9
zUh%uo3k6)zT!i#O?<o3B5Ku7H^__%Fra`Sh@7CGv!lRlt{#*l82(r?36SxQ8$H{|l
z_TvvTmpX6^OIV%=7hX|xg5m6-vC`ek7^i&vJ2qt?ZAf}mzI4a`N78BnNR!f}?1d;L
z4?8qbOR9$mmepX$TC1|x0<NZ5Z7JE^UJKW>*0Y;mQ3>EzVggkRJl8c{fir@<_`qNR
z%Z=vKszw{-e#V>f8|)?#J4w{d_thGVpdMs+++8X4mZ)JPqS$~TFz4$f*yF8w<WZ7m
z8u$QcQi$zhZDfRM^m3PHMZH8RYMhIZ7s_B6z3cvsXM2BwU5(sbO{u8WxZiAgs$IO$
zVQaLc=1<wr_SPub7T^LW&&l(yXw)U;$sKEHWP<`{l@_)Kl}~Q@W5Z0q&nO2aI<8&b
zUDXdQE>ey%OyvMl{{H^apJe$vdEY(&EdtG5#v<!R<>x@K7(3JK*Dj`5+0jZQqc-pL
zk6!i^aPQgIwIlR60>eLgS}ZH?p0SqQ2m<I2`5n9Tyu()x>tIdQV7>v$ReHhLiXEak
z8n!rJ!2?`x>kA+FvTh8Rj(1prHvWOfZM<ZLLZ~&_rPd3Z-HHUHNqtXbZurx^nh^~S
zkV?8J(-2KUp3K>nMttz~lhac+W)~NI7QBf#Fo+IrWGrXv#%o+nXI&@zqni72A0opZ
zk_=#n=bxnv4?zuv1$fbP`XTl@J3Aq-rs4uvfT6*`!Qr^;4qb1YQjpT>z0>%es~_-n
zmdNg~H0w4A5}4N&I{E<Dh?!iCz#TsicrZv7Us-tD>C(=w7Kl<&(s&nTY3B{1(os-Q
zY~@tzo5p$#&#K>V)4-}an+SA-PS;L`bUJrBGK(kDq*>e67$o+Z*B()1>ijA2+xa)}
z2(owfIZ!t_<8R)%lB4AN%7oNK1oQf5#YihERV)Dj`>k-`@UGG{7O~km^7x$PQ5P|+
zUivl{ot?MRQdWpV1VQ5i27d$i9b)E<j^_8*Cc>@BG+DAUT7PQ+Tle|n4ZXUH+aKP_
zN4!Kx0F(ED%vsQH4%xjqubzvG3l?dWVbq08cFLdZ(I>^R^i9NIMu|wYT3=T9!Uimf
zAvr8*fTsa<85ld?*;%@LX44&(&lagbh2LIq`A2b0!~)_0W)srM`MFDOuID=v$H*Cu
zC{33e0aNe<HnExadJlC8kmdi7<30_VWRp2#OI{+FBuhRSm8S=TuHli4sk6il-7D~z
z<GZM=v9kX5aqjuc8^sXDb82?XCPNA`G7W;?=gg%&t9K5XQBLjjV&ni!hjdQ~!%z!~
z$8wP$dy@bC`**pQj5c49IRhh6b90i|ICPnhUE(bd#vpP!G8jPL)QAf|PS5Ui$<$Oy
z_jX8w{k+64pjQ$sjXmmrl}K8%{XUwVTXVj_S{fWYK;(-kJA5f#u4Y=+GLtc5A71Bn
zEMv7^oeHpiQ_WSQ&V0XFN9SX<R@1Z!p<)1FmkRs;x%8@H8!Ww|FaUov`>f;`bm>Me
z_q;!Y+1LH!UR<C_{QPLyW99#~(CdF(Vzy1Fb+|16R#`AF&E3v55=)G&a%e~0PWmrN
z2yb(rJ3ST_29qFo=PSaa^uK`T@cY~&_(h77&e-kq9!K{z=g;x=ZNhm!9Dkc?c3AcR
zJZQj_Te$Z=`pTnLv3b*|(70>D<{KqE_dKgJS9SG?(tFI>Z&~*&4Ji9t`H%hO<RDz|
zr)sWbcbO2+Hr^h~jFaCxnLbuM=Sf3oI^-5x8W}e8=az9_l9y+Cd2fV$mvdyi*Gk!z
zR(bHVBD;FY=B9MHme<F7;PcY>5*)Z7ud=ez19bb|NDKA%%IDS47Rq*b^o6sS!VkIY
z-|fAr*)(@y>w@AwIeEL)?QsBLnsxuSHe^7!#BINd-TkqBsf971(Uqh+$YWY+Hskf>
zw;3Y?gEQz;bP!*F)rEn2>j;S2yv!%EYBM(QJpFf{kpJz^7X526CTQURl)n{Y`cSj@
zgMZuT;oplfZ?WnU&BPh6L<f!w63gC23`_V*bjdpplgNCLKp{fo%hDJk=P;8ew()rt
zu-r>dE#OWyAn>Ni?joFu`oMh+!hGe@Z%f&J$fx){b;zHT4mn+Fis1z*bELKmh<-~a
zu0;?7$9v_@F2le3O!w>A_s?_V87%jA>O9PzZr|P}X=67T2m2#3j+SR@T{`ML&e!lI
z+;VBRNeBA-MGEG0GUtltq7+pX!izuH%SW%_ClO01i@4xE(tRlD>WnKG_{|vmQH3bR
z;j>5WnV)oM^c!#im|cYASFV*CIMtC^;5qlIC|B#zawAS^wa2D6!z$UI4kN3*ZozcL
ziR3+-E!zCO!nl?|JfBN!@4_vjbCbR!r~ik&_W+72d-p|m6Ac6dBOn4Y3@VCb2@;x-
z5l4b3h@gaSvM5QA9J(D5MnzC0gMcE91j$Gc=oS<tqbM1goS~c8G<5fVYcuD6-m6#j
zs&2ho=iGDa9;(Kg-s{^de(PIb_<d_b*-}?YlJJ$c@@VlH-95nZ;c}xUL$m%DbE|u{
zW@aLJxdUcR{@2>*NfM8q>hhIJe0GyiHsf0nR+u>*Q6!O7=0jIKt$=%!6$$^D9dr!B
z4y6X;ysMkcN5CB!-X1(-{!ztI61dZ0*CU=shY9gToEUm(UsKgWud6Pg_4+WoME!<V
zNSRg_lGD?TgIc0D7ln_oyA!ZFD4p5BzV!6;=pZpB=NoWMMsF6g4}Ow3;b?TF_e)n>
zxRA5=OTR}#6$BwUcTC>^EH_1KNO#(ru+sL~K|f5_UZtJ?Np4zABxXaTw`xDNI;bnA
z<cU~mwg&NnQ~L(?avIQ#mzdXIu4zfk1ld2?(d~%v{xibVRXfR^bwQ5Ca)((=zgJGa
z(@7(1pMD&cnH~Dd$}ImhSnzQ<X1;F6_ncXcN_dfy>X^Dhcy^r2mO|L?U!$kY-Z8gU
z?PA5R&>gvOrOM{GE)LC_``9TTpt%*r(Hsnv<OY3S1k5!`H~I=Yxp0iP#9%#*RVu~L
zOp%<u`O+Ut2mcn~dHg3me*4YSO>z3<Ns4xFkZz(%{hsdmNdoPl8`aF*dLwMYXf1L`
zx$}vFwo;g<+nxaP$d#D5--#jDZti0&?bj{-b+j;;9l|a-3r<e`h3(oKyHmH?U^>(=
zEP7!`{6eMFOt81%oV|$2_7As;;mt3m!K@Y;6ya4@y)qZ;QvM(@n6_*rI26=dZWPt|
zw?dt~GF>=}{ci<r_r71{jDKPR%TGzt1HL?c@|+)%M@^BwV~sTIGh*2uUgqE@Q>Ic|
z^&VC{5<tg!vz`j9Ws403&YksJ9u8WJ-PxNcK@tFg!JGk|x^eNT!+KkVmE%tgy2E)p
z^(BJc{-*a!G!{llXfM6RF<SXkQoT#Z<7{1?2t!ae)+G?9QQtkXoORe~zl_{mTl!vg
zobu#Wh0z||&tqs-vBq*`=AyJ`t}t7}6k9xx{5=lQ6V2H7H~zLYo-GV+no7Xbxik=r
zFv9k%#^-DMb^q>sB5i%tIF+p@YEe$yRC19Wx?e4@=Zw=no&^4~ibx}G^F4HXiALgA
zb=KU9eUtXRnOA;kYPwkM_4>3a$vtr>Lk>=8qQJEyre5+AJ+J>vVa@5u?d?7;*7{F{
za5w3!sc%fh5^~gXp@oP_eIanptZYzij13-<R%IR#q^*BfJ9J^~+p!5un8mRF*5;sx
z27Tmy(d*GnF$vyG0)#!r+iUrX%0K(l98){>Iuu^Gut$zh0)y$HX2<5P){X7KbySIQ
zgqqS(ked0@S60S>ck#}9V!2ZY9Pr?Uzg5EzxDWI#FrzI!YBy%>hg<8_u0rzelFW@3
z>FdVB<qJ=2ZrdEyWi-8R?ldy1e)B5%r%JKgEJb7tfXPIi_pA@}qom6Xj8dwrB;Rh0
z9a|Nr=?21N3K`e*1S8nM2zGRWCN7{z@6vH|lRl=U<~H<Sie2iY!l*_PWv_7t0hG(#
z+YyqCv<3*u&mMDOZ*Q4mn<^;FNy(J>%pY-JB*Aq1WkUs-<rnQk*}rhv->#My9usj-
z{66sEZtpqi84o@M+@-H$0Xez3AFjD2uXf%YPMf(SiiV&GXX&m4El&IVmbB|rBjq^@
z=RZ?bC7Q?{b_~j;O$xbUyqAZ&G!~VAh7(%Ivd$xVmBuR8;!eyYJW9mLPf~}jo7I+F
z#<^cf9Pl^`>U&w~rz1z$eEz_MYh9N|oKKzAVHZi!a!DddF2A&We+sfNxEC5)H&AM4
z4PzyV37->jYBSWB*zfVHTi=&+FMuk#Z*r9>vBxh5MK=m*Cwep9KdT+#Hg`R~^>>i7
zh1));r(W__o12E8Ht`9a+nZ0$K-&76n1)Lr@kJ;E5q^GO?Tu^Yh+mGN{H;(^(Xrwe
z1uiK_IHNt15A}qx;eQ6n4twhEqlD5{&l5fgzzGRHOoh)g3Bt^VXACZJ$#npvI@eHJ
zH15g%X;Vynk|?voDbu(W^@{<A*u7}p8C?|VjwrcTT)W7=H!30g01-Vy1q}Lrs+i#7
zjD9~<D-J=`?sPHrtREwisz7u{j`3gkO7!!DKhflHlZ@cbdw-?M{T}J<Q(yL0RKr(O
zI(z-Sqb_mmHhg(uJ3^cvf;3HPy@>c<O4&kBs<exXY5G&Wv#a?dN?${xuIX|oQ>_EP
z3=NelNi%f#R(4GFjgKB1b}j?W-mt$x`c4{{vHMD_=nEs)+S`uBcMqpD*k6M@PlQWu
zogvUEfi8R6!8Qyw1!q#rZCtnV#*@q);K5nzj>^x99eBpRP^~Ry?~mCt*UPs|hN-Lg
z1Az~PQBNSTI5vD!VCdVi^*475s+<~_P2yX1LgW1DcF8#DJ(}sjINpd8%g_!8(BY$3
zsCZOT(My9Bl&#T;7Og5_RBAk_F(+Mc?e)H(cs+)=4Ou)?^NYV*&M)5Gu}h2;tSMM{
z3%OR>s6v+SyxYsQvl0;)b=!12y=#9^+n&)E0+8k%s)xz8vqHG|*@Yc%;U$mc>SGpm
z$>6=n>l(kP60U!V9SC9b;)4~=wZrfCjNTW3Qm;`f>cGS_2Bkw6q3DaKE;r{xjQ137
z2*0=g<ngQ@rW~H<_u<{o+j^rv0lM?oIr?OZN(G={Q{IR0(9qBqpU6Umaj+!Ar`U2+
z$z?@Fo}JD8c=xN&{Y&&#YZa=8n0AL8GcWeLnInccq}BpR37dO9U5`4DuYb_flCNDZ
zUrk${*X#AK8SDa3HzkbNRqE|c7Byw`F5L@Nx10bkSf?C3U>_8Wbzc?Xlar}oPNEtP
zVou)u6V>&Cmo+^-U03&b1(PL!xy8CMQ|+4y`gwn2i<FzIFXWocV8yP<$;ikAXM|9K
zXCG-TjoLouH5BF~-M?kiT58`EmFFeLyx%tVi(7ZEa{H4c;APTLEw4JB72DD_daPm4
zj!370OG9ehsG&RTh7#aC;qYzWS8y@6I3wrzxbY2XYpY%#rQ0hl7ze;5@<M7dhuKVq
zm1$uo;Bmr!S^tSAOw>T|nB_T90m#%ppS(CU)N20({nDi7L(ZVEHdDyn<A)$Hrz5j%
zo&GdaSI8I^A0><0Sok-M4m%#Wr<U=R!xS>Co61o)Z)>+6G+22i-I!4R(eH;3-N0&u
z(h1HhwbEy7dAYsI{Lj~dc8pj#8b^+}tE&geC*`xJTPX~A>h1^@8Pd{+t0sJEg*M}<
zm>&8J!G$Z6RS$T>Q%^Y4;qMr!CoyOB8&BQLbcj-6$T=Pmw!c7sm}1!4KDhZxqmW+#
zHqrm7lw2M1juGv{0+>?zozjcBxn0T|*%zYF_hv~CM2tIrGvwnWg%xbz2D;NWWA8MC
zr$;N)yr}`39GwV|worb-F|Pu9{iQTJ^@xg}P0?^lXYjOAdbuiT@)~3qwJKPE9-5TP
z+A>hc%2qb`xFZ<v4OHyAL9SS{tRdxew`9iQGb($nI!;Hba+2OY+x8fu8i2`2C_SG-
zDE<h>QdE%5`8GCCp|RxhsK$Im6dcwMz0^g?yJWHyw6k221F!DeS_2+|9?PIv3;moH
z^%P$D-#NanFuh%jN95;07Y+Md@ye(6wuspOfszl6_v=>PeM)tOPI5*Hi!?oZNvA7L
z5z|sqKKkzzR8`!lonMj&%l_eG9gkA;07xUDrr)RTJinP{qG;HxDAirYo?;*zp<v5J
z^8ZDl{X<oi;9CKl#uxv%a%2*J>)^WWRrlUym0$Fx#a35KjneqSf~FFrS9p|h@%9Hw
za*&(;3PEVX%*Q&x5z=D<C&c9x-m3|QrX@zrY7I3?UsWTY3q$rrtuP3-$rh@tkHnk!
zFin;{V6RiofE_RYbV|<6z0mzbwWn#PP|a)d>#H-y=k1x&ke+?OzP8O*gN4z>ftHag
zs|5FLfHemmJi-M&^&dI<wW({b)O!on?vHjoi|2@px;B0A3VoM_6gEZ#FI3h@>%zru
z4YA+~SCaDIQWIr2PlmM`Y)T7%jlq9AsB#HCg{wRmt_a+2i8tJqb8=7LJR}b!$;OU$
zQ@0`APX-ip@v5&Im;QE~f5bvp?^UmJ3ohtb<6=RTdAeN-SWF$&)SBP0y+e82rR@4n
zUize?O6*v-xRahBI&ba~@Q#f0Hp>z}dW>RTM`;0Jjf}j3E{vI(S#P_C$Kr-f$in*y
zF;S;?*Dyn6hc5KC@ERBoRaI4;5zpNbKQ%@qQxYa*TPEr#prM2~!|QR8*Go*A4W%^7
z$8gdH#atZU&dH<E<oy)B4P@1nrCB~tR@A2+i`pws0Re-}aCjRNr|)#SKgZ!+OxA$m
zm)ueg>;^GC>v~QFWr)=xlt(_L0jnCBHVKsj-y)R#+`GV3UrK4iy8x!YW{()D9^d1W
z!d`Gl3A)kgInxrj(;@1ipF@jJ^^Ws)55s}Q>pqi|<B%QmT0j1D(w!nfon{NKh0_Y`
zSf8>5W`*0J@8$B>G;#afy3(8lr!NS+7}ET(sYbePCat>haejg+t_9Y6ScTh4w0`dN
zBlt`~<@k4i<tCeFUGLeEYZP+6G3E_6!~H8A0mZ!w?LUmxUa%hWhjar&>0ZL2QAU#f
zJ?&}T{=_$Rc1=+;>#}{7UZv<UF!<49afauHjukn)kEt4vLKz50dOL8Ds!ki%XuZbx
z=H#0&GKD6jjI4V<IU&8u%XH<lFmuG=KQ5erUrO%ZFMiZXfjnO7%tcb~1IDRgKz-aR
zR-S;zJ_#$6{V?*zna14qTi{oTc{5h(X?ap)sS_6|;MkhEZ?<bPVfgKZB;Z3UavCt|
zG1V`2*)H@l9IaAdA8q6HTQ79>TlTlM+6PZvp4|bC>Y@(=i?<Xln(d@s@<#2wzdCSJ
zo_$p263cmJdgOb`Ty4oRZQ+xBT?A-$A+xQ{J=dmiUT%{d=x;k__OKh3{AtHuzzIt2
zr_GL0$$2*Y7%Qt|n$5clv|*}fVWxPq*-0vs*NKhCTO|4dKIHz?-XB-i(udE{;%#zU
zzT(iIXJ>(U$6sry!fXWAhME#Ls4U+Tq`ksXmrS5ko1M>9+w*x9nm;H+b+fsMqsRnf
zgC~cKYi$a1Qph8H3$@!lmL6KU9BNveq|7iFTtj9ZqtZ5Hk+ptI5}B<Djl&u4$<fM9
zf`w>g#r5%~rF!EE^*H@Gb!I5;TNzjcyn=vzp~HumVg2wkH{FYPbVjru3q#RISrgv#
zp~KNV48RDH<wG4D?*ffpwsWZQKKuHZynnYZY;g|;74eo_Uf}ULPSO)f17hAtx62sq
zsICH$DW4;y6L_WBS89THBu+2b#r~73t&8v<0e4kg2i8S$?x->>m6wn~nHb<%cDr<&
z?0?6T&OqZC9687`n3&CRw_L+1G$vg`yMO~&O;xHp&edGera4e*?NQcZ?_3DAn(;+0
znvrnwk3#d>l7fZMJ+D>g_k&Jj&DQgB=QnmXEct<IaOW!9<R{CS`#yVhQq$85uk3-D
zbyTE})-7K6(B|M$10_`Q??)CVvHmBCv%ophxd{Hb=Q|VCyAh~VxFjbVe-0)vLA{2r
zQ`hV~oSX<`OfYkdog1Ut7WUe{+5(D|W-*sEDu{}N5lgS`*cWhziVj!=(dVt&kV2M?
z`*z`ZATuo^`sMHcSrHGlbyna=gTC%K$6NbgN7X-fr?ff_Mb32~#c&#&aBYB1^cEv!
zp9LmlU^<smnF9hr;w|b4TwlTMazL$m(P|l~pi%|@)xgaM|CB!y&Nth_gWu#|ck%Yd
zyt1Q2n=fwlWw8NYRK~*iD6z_+A?6_W7}23IM^MAWOBvj&^zpa$^-V&oud-2h5*iEY
z6nlL|+RUi?nCp?9kI~1}y=d|pSJr5!eO`~=Zh*s+L<XstUPLp{sW6igiI21>v1^XB
z7WyrHn(g@VNbN`0*{-)qBbIrwX{NnC=+Cz&!P;gl*yZc%$=ob<Xp9l%7WTShfLCKS
zF_-*Ja{~+Ax0zoKOtig|12HtbLd=@o{DxC<H9W1$%~$7?9L=5D!-l0-5^d&d!4bV0
z(VH^?(oG;WduFUjA$c9+Gf8?~apmq_`DdK?32<scY9dwpo7k@mia}EgIY1D8kUWoQ
z7x+?5G5N+3@dQKlJ+Nt9Qg<2ifpsW-D&>24l3$jPT)X;=^v+ShUKS!b4qs!W3<xs)
zUIR`Y#-?hr-Ac*4DY9G7V!xYLXt3n8!07}zztIxTaA=7+YtWcVuu?zEsq^vo2B5v=
z1({K}TcThEy%dn719{%Ci>!^2HuxYT>|G>0dVR9hC9$Q;y^UHXs$ny*V1`Rh@MRPd
zChsE5%AAT(vR4<*z~CmF`NV=@W!HT|*;p>!kz)I%!`^Y)2X+15_`sm?{J#jP`=0A=
z1?Q&}0`q2chFiE=W`E+JFY7omg4euXj#ILP(qp~d38Qy`B*bc}aJuUE$Rv5opTWN2
z{&rGDrn9p%;hfOMVuxrU*dJLc2v1|rs&M9mA5uZ_Jm<f@IV^ppxf%{k_H_c>gU$b;
zkag!fjXm)*8>t!xy3k{)#Jhts96yBLOnwjYf*|Z4;HN`c+PnQ?`Q@`7=_xxm7myhc
z`VtBa&P<1XaOl1~$bbBb#m#SR9UY-YsdLPLuT>09qrP5H9ci*<sSFlMsp-Rg8*7Mw
z0~5^}I1*!pA-Au%?=RD;)HieClZ|Rh{)SsfTeY88Zz#Gn6QnW={DT*b^if?Zrv+{9
zubZ2iwe$Ki(_`-<RDo|}E*q$v750(eMjxc#KXmKKrvD?bJ8{mrP9yz4e9&R?*A`?z
z>xt)?zz!$aFbV+I)!sc6#dVCv2C!YgdPwVfyVWdIf7nabK=wqYH5d>!H=2t_Jxq>p
z0#i{`MEx>0VQcuz=XqLsx<@vvR|3AJKlj+Ed-5L93DkUEA};b)$(`nWsgHb$i+x9D
zgdqY8Ot$>;_RA6htkr(V6l63(i5%^3WjKXe=l1?nD)Alp+4L`Bm+gr<0qoE|{0FI|
zSFb|sQs+YI3lK&y95BJx^uaBNH#Kz2U+D0}xwB*8BKi{F!fdu_53S*p;*WZOPHn>k
zPjKjuaT#>|7<;d&QO(*=L(6V3N|b!nY_2iYTTBz->6dS!6dJ4D3(#KF(e!8CCU|AN
zi+_wDXRzT)uYIITTMIa<Ahp9%aCVHFLF3t*epahX76OneFe0j=rk`T!7Myc)t8)t$
z0<Cr<<sBDJCw*`jjJapfBkC~nLL}nIn_$UR0AniLS3CbwV&;yg^@OJzsMGU9%R3yO
zLeFaq#&5Rk^&pq9-&+wj!o4I`y6JYDz=VZSG@!zJw^vC`#OG_ss{8!_8&0@B%38zy
zUGDlbqwd%oSOu9_>~}MS#8Q!hl_b5G9#$JCYgl`?pZi%HAyz3xxMS{~tjUFhzM=f^
z69fToQwq6krT#8$Y0#WM9u>Rzaam9JLo3Ca40o}klX6GmjI0wp{z6U(QrVwU3-N81
zB^2xto%sPCyzc}tduiaD`P8(BeWc)2sv83^9jUBY0ZeFJVbolIdOs0odmW79h5O%K
zKMIY^%FA7nosOyefsDoMh{5#P{tAcDYwmm0o{-C21G`+w<;;r;*Tuh9S#M(}(140?
zQ`DYE{Rakj8-9%zmwig9=fNLK-l`VL90fhnIr%x}LCRKjfh${O@FFHZS5RXU5p}Yn
z`-Sr6zhs_2;;EGYm8CG2fZy6lp*KC>#Agb-M0|y?-0WW`vSQ~6bs;Bi^e&N!xO?&<
zSZgPaeCI7$qIq{GladPt?_(Xk4zeSGRCLa97>jvqpdyya@toksrK7QpR#mOYdTi?v
zd9NV#K?b0KGVGHp@5_!}XtAZ$*VljBNalRr<GoIdqMysj_2uhfi7>$gW!yDs{wyVu
z5LuH}3XKOc#f$^CyXA(9{2AQ}jRxKw_g;m1fVzZK16&U2)Gchag=gb7yVL9LZf)IS
z5f;8F#*!sFWwh7rb8^$Vl#S?rA<7n1eLCLNO3|yi<>4rCnyy(eF$=$c_zm9J3PE=4
zkTWXmlMFtu*Zzpkt)_2q6Mq!*Fe030t1Xb17S8R*o^7c7hSVhV@+Ne*Used|D_$Xq
zv*?Br6p3&aNvNI8BG2j5EV3|>-(>KWH`3Qu^9lkPjn%M=2FRm>NJ;H%{_p0sm>q-e
zJKw1*MNfL(n7tc#1uuN@s8~bZOZ_5)4_q1K{zP<GC{9Clh1Mb7py@tc{?K0u_kG-x
z&!JlY8Fa$xu<4U37x&?^mA?vyDm=*JcRJbryj#2pvw&+M?Yfz9r&0GF7*J9ZO`5x;
z3=#}$j|8FeeNja}3_ml7@n81mF+czv!d6eE4uVK*f8`NqX#jQudO?E8#-fwUJe*sI
zKtu4-W^ppsiayOfd9{M1+)n6E1^AC+GMpAuoe0>aTQ<Sax@6<d%>2&*jv`(L;#^%%
zOsSQa*?)tMSj#$slbbmEVELx99qLjAF7WyLR<WSWbQEGA9f1^j(J>~~@-tSun!9I@
zUGonq%Y;bllFj4Z=@pf?(kK3zK?3VK&sfPP7ETZ0&C$gvA^W6#)JG8}8<83wAD0Xo
zni>NB%qypp8>?ASvEL7;WM#s;3$LbH?6441Y|vx#z8x~pgl_jrOg_ilj5>4bEQo1C
zp34KSuUZ+~jFwNjl4SM_<pb@D9k1lBNH6)Wi-Yp~=@)nxzviKbY#B#yqC6XTRm<RK
zuLH~?6{b=<KfVAI(1j$ZD>mO+k=DW!S}-2K8mIwEMQgVq<%7_KQwq{u(rFK_#5HES
z9h@t9DQZZ)ZG7Q8J2o^l)MfsY;r7UNGr@C46T56<G29L<#8eq<YD+v#Z#}6Iz2Bwv
zVSkk<?xxw#H7-t407V}dC6G*>slJ(YFV5S4Y;=t~`rN`zC^iE_=_{U4f31(xO57$M
zJqgq$2s(K>2o-i!72^%AVT$Ha3Q#kc`DGv_5%Y`b>GXza9H1ytNsg&C;6kSxd&w$6
z1H9Y?b=&i2`8NeUj1{zVw34Zec;J@+7AToVUPT?Z{MSfZT*XM>!Z+`J9;%fSR7RYB
zu)P(mpA!ZvZp$Ht0BPWFsh|WNo06@nX}Y&G6n}&<vz7Vq2kuG}5I#UNl4<(=h&W3#
zHLFy#$|GB75p?^q`j<ibNJ~Q)*;E@hxt@D#A596K`t*<+?f0P->hR^#32MV!nX@!C
zi=$$EMU|Pz;`H3u3;U#eG2QNo6ApR54_`8Zo_db^O-2;in^1m2s%}bi!YbqDtFL}4
znY5*oWS}RRsedsJKj8Gwj;%hOx$?BQxmOe@Ngqn3**g5WNDM~sPO*BUhk;qSt^95?
z7AGG%LL&Mqn53V*c3e7%uLf5V%*?b3U6Qw5dqt2T&13<c*vA@fAA9t$Q(Utr-wB1?
zMuP%Fsv`dWjczz^OO&uH0EA@N-;MjFwkzUGlTk$>?oHgLX0?6m$Vvz;DdGtQ9_PzE
zsZx3B>>05f?Td?xFTM3UTMU}uS4%4o01;{aPpOoINSl)F;|%mP1lx1b!C%%hmQ!wm
znY6X05EGr!&JK7E|MRecikxt*!^Yu~9l8L7L`)+Xx-W@mCy&|10$&h>jU8~cahgrY
zuT%V(ehGE;d+4rf<gtQw(?9)5cZ8(!654D^cI?}GaQSQ*Au#*K3O(_=saJ<{Spnz`
zWMNwDupaZ%zzO{_5`ISkR+C3VXxo@b%lcnP4h4{d7M9TGKBvt%Vb*=IyUJ)AaMUU_
zi3N`ymd?snHQ>bWG8c9|S-}2I@^p8KY$f#!IBP2`0v~jTP%|IVSL=ddCav?4&`fd`
zFSNU*h4^#Y=M_52`$MD|=_(cJo1$xLYX+2*%W`1NBxbBs5LhPE_($`+RB6Iu=!JOn
zqwYF;|1cfb`lnn?a6bcK!^S^TK)2=knF>+thS9zZ@~&ALHoAo@o6y7rWZ*0Au+=Tb
z?OzQB9=sclGYu@6fI%@fKbk$*tC<=dzhO)tZMej(EcaB}EDBj*{EG4^C^u$Id`XS8
zb^9dbO0JsdG|8<ia7k8tlyR&345CK?Fo;QRGJz!?!FP-i{(Fx{hXVlNKLDZZFH#bp
z3y<bYc{0QSUF3!~w2~KJ5-h?JR~W_RV#(U^Dz5%F4Cf9lAaVu!>n5u5tpmM#ig`&>
z-s;Q&`%oM8E2QmRZt`$Lb+vSA3~NKtr=W0WuEqnt70!F(l{gXRDE{e0iy1SB$Glh)
ze-E9qCDtvLw94*N*X-PVIWZ#y^76MynbSR$LT_q14b?xgtg!jTB+yH2@z<h)1b`)k
zQs0+^p%Y}tPTQaCv(G})GcyS)P#eA4D-6GZOp?5?ez@GtI*08zVccw3y5`DbW7pn2
zlh29nTMNA_w~$_V`&}T2J276r%%&xzn-9+T2CJF<EKMf3T=Bks9I3(v7^^>iY&7wm
zJr=x-6~|8<I{r$4wN_yLQMOs3gI5JAV<Gc&!dV=DRWYP_^C4B-*bFK|hrV+uxFYQ)
zoDZ9WVqiQ7K#oU9@i9xr9n4mA;x3o|GEr(5>2eh*hYr7SpvTM^e841a7@vZ~Mxdg8
ztv3sZ5_sd2{9xhG9?vNOxH5>gJd&_nx8UIlAwu|N?ZMFrxvKR5@O+71mCf*sD#WN4
ztn<9~_q~t25VAgAs%$d-b?sYcRM@O;LSdEnCS3nsc~kQP>VpvT{6r!2Rcf$87)R{`
z_m-j2#OoZBtWr~bB^3y?jc-;~+lwVQFyfMMQwn%TI}$Y!KV<|AHVFSX#<*q6whHPi
zbv6!~#PEy_bae>){f~&@xT6H7LTaM$E2BXe3h?#a{OiE@5Ov~`Zx(o!L>F?{R;!5J
z5ZC6+&_ZS8=Dr6W=<}erK${%>4Syi*{MYRzJ=jHUe};H{oI+OnLtgOB0Pu%zJ_{ws
ztQho&YsQBwK^Oj{ul_EKW!C{kiLO$E*}wP5*$n_=U{sUj-~L@2Ww3@!Ainu}Nl5dS
z)Ivgf!eaX7^00=Q*l~&{G78AB^D^Yt!!HrLNYtD{&va=c(`p#;%S|F^3Ftl3Zw}O_
z{v#lAudpSGIIsw>P}I?f{5K@Rnt0K-%X*O)QnPJ8;D(N`RVYDE&Y0>8o@YbmmN0XQ
z6tiJ4EyrKRsUtdZQK50<T_J#2Ll#<~FKt9C=yPiN+#Vh9B(W|N0)#++M)jQ!hG%6F
zy~g5VfaA2se*Cd|*M89=t&>QdiT+X(3HcaBxPeorMdMP4EqF$n7ja^lK%WzJOSy>1
zu_JHyuuXgdai~95swEnLL)7&^(RjWND8hQh8A0|h*Jf7j;4>yS4;}C-&<im`DmnVK
z>U2L*01}K4a_$+Yfk%*@Ok+|E)AR~GSzzMJKP!7(IvWBmqo;$5m`9ARcZJC4Ei|Nd
zvQH3NxzKVV5HhRXneE%)QR;+wQ=dDd5UC13r?K~V>|*)_o{e{fhyb$CRrpaWWRE+G
z<HrW`I>DqrCtb&dAyS}pKQY0(PUb5l|5E}tWx3b7VYIxm@>H0DqM4cW>)HI+@9*SL
z7i8cBI~Rw+od-@|wAkcB^fxI}$I_Ixo)&Q7rLX<PqE45DF}TG8Ppu0I>RR`{?p-*`
zSt!tOST5)d)cEz7hHrjIX!7F=y|Ft5I}{?O%We{Ed014I#xupjPBcEVZ3yRWW#^h=
zl71ZHw5YC|v0#Ht-`3z01edtQgXJ};B=)6Fad@jK;%@p%BsJ1mGZW~YrKMvz#vym!
znd~#S_A#^MirsgW{cE7KYV1@MU9vFHtkR{^$abOUy_-5`cL8H(h(c?KKWka<Q8)G8
zc5T{d%1OrJ*_S{OZOU@h%t#UVT#_eTywlLGic?%f7omeUJ2V=`S0>zqi(I-1n*j^t
z+lg<aAV*!D3YL6-cqa2ww3u7N&nQui`lmKqZ>YQ&*k>%MSF4nlA@A<w<P?ejuI|V|
z(4=8j#|0}mWg-Vut#QoNXd+`uF2Z<e=Q`+K8ubBx@Nvd)Hd-`FPK@7DcHn!*fvX&(
zx2?s_qx>h#U8Y)jCu?aVgDl$Jy6L<1w2)3(m`7;8YQ$67>e;a9vvLDdjowrD@7}#C
zJjDYo7|!Lc4iRay-->)%<1aBj@?`pJ^U?MO4o!#&+E5vSWgcjzDSSG3R#$wV$IdXB
z7q<elE>`X=e;lL<#&eNAKXK&8U-ZV=uEvruJxg(dleqQ2Z~`n^I-{BT1_(MjvmrjT
zQik;B;R!qc%)Qn(;%&<fiUgp@7jX-$*0r^Za)H-&d<Wes9${ENF?%U2IXLUp-Xd_5
zm#_MM`J4Ki#?p;$57R%2JluQDCb;z-%qeJfAaqU;r@*Lyw=uwzXj2&>$((vLD7ye`
zr=xsAJlwqc!dI8iw50t`WaSZ$jL<hLBCIw1!sSBd43-tJC1p2>4zPfI@Do!ATVj*g
zx}UN}+@z0%z|7jQh*0V;OZHQofm@-Oc|Z`JF5S}_@}+2xfAdq!A=ZvKe0l4&IpZpr
z0696iIkpoM0(h_iKkPYtqF(+7*{9cf3>Pq!S06OOTrRTT*__H@5rFM`_a;YdP*h1%
zmt5V-voZ4##<Z_6X=S2m_#r9mR6p^$FM-vND3aC`1k&jqVVF~xy)ap|=5>gIZ2L!G
zq~}MB)%}vSXKRE)Por`Z;hm-8_@*dPZ#3IWiR4oD!-}hzdbqHLo-iml6eq$!LHRQw
zm!;WSX5nRL3Lk~h>A^3E3BKn~{lpyyAWm<&g}kLE6TAajuYXLy_4<{|Rrb)?q0Euz
zl|wJB{DytTtUYj-`YLVhKOQ5Ea)3}M6iI)2x1UN$XU?MclbNd&cg*cpdk`16&c?ua
z1l#+MKH%01xlFRZ3Xu{|XEJC*-o}ZzZ^2vi^qnf-0pbP=BB{kgaJOIZrL6??=ERcI
z7p^ndU}*?z*xP$nRyMrJno&v31NVirMyrGC)`V0W4zsbM(^+$yiQ_?(+TIM#NNLcG
zm07rxl@6cKTyin??vRD#KZLUjOtGfm?MIkBA}X%8_oLVa<wFG^d8d}A&MqC8t!Nt|
z8<w@42S&&39Xn)LFM|h%#t8<MpXsUb+;;BQNN{~cWRh2%`(6e-)5&OCJ$jz^JaDbG
zFb%qu$Icb95^Q~aKWH88(&C8}1f(y%$BJtODr-`zI`?;mEPD?MURzR!<oD|L$<bs5
zJ!;j4sK&5!5Q-#Z0_H+mE|pBHC4bZeCIB|Z2^G7OKw)%<)E`cxhWVP>mx4IVDKH1I
zf=!BM?qEsBEbHhg2_XLmGQ5Q<x;s-qjiC!xD2WVrlD3}90>T^?pt_5Zk*lHB`<}pq
zl&?hPDKSDUBp1}L`fS?-{}QQ>=Mn?6{oO-o1Dximy%~DKpHH1UYVF(a7!Ue&4R|3=
z$;CK6v$}Z(EOu{sbdoGLWH=vUB;0q3cFr8*Q{D|>BSAfpJ#fN?mvPPF<E5vBIT&CM
za~G;b+x$06(|!>PoRwe~kv{>ZnyY2MLlVk!sk~P<{q=rGelCsP<{WNQIO8BGba)>m
zlu2N$p46&h76Zi?e_189d28|{+J)`_Vb^!xemdUPX6WByn*N<N1gr{d3@^n|HmKgw
z7Ua|}=|t>^2x)<dzl^#{XmTTKYs?z}gqTM|5sp5UASVcsW&syP>f=j*#!f1eU*(^;
zh=S}t|4@Ulx0YR62#t>GaPFBxuR~DeUc{O&a=M5I8z0O&IP}g<a6m%hyJqk#gp@+}
z@w;lrd5|aw{zNm7fAM^~DxeNG@(zTcNWfng>OcCmb-fUjj^AYJrI5Xm&1)oY6!7j#
zLwKLV_UpqZuA5EKb!N^Pb=Soywh^Dj&fsTIMPdRFsk#bg?dTH8elNT4Nv*$)tsftM
zGsE`k`d=f{?J0vm{U}O9s5tA)VGr1HYt%@b2PBE|`dIID_zeN$x1L~>qA55VsW^af
zBE>4M@37Eh@!Z^@@VKmNPM3Vl^c9f9b&OocnyEk6YgNh!+*@>Gw_VyuP(wo9dY11I
zJRAN{m|;NH-4^e<wov-0k!t_`hboKWwUjz)vN^Gu>E0*KX>oTSgdJWFtd&<%>aG(W
zBR!L~mPLWjN1BAn&l}i&Zn<kKt=qaFNeZME@)j+BBo1<l%~n^t=z-~Yuo`IL^jZ3k
z2OD-TKr-8ZrB(aS<&pnx?SJtm{m)$hL?l2udlVXTSSq`M0qP0>Vn~P`MB#IFz0Ax^
zF<ua<(iDiozvD)UJ_|i6zZvHN4BDeFUoJ`kZ^3gQ-Skdn2`m#~7B$5qz`%dmJ56N1
zIxY9t44351yNnm+wWo*5W(Xf<PhljXA{LN!@+Xv_mcg>*q@<*IDL!!4A<y)JAj1V7
z2n3t;jDe`M&v1QSvFdiqaIlvhdMWd48<C>;@@zy>{{I%Av!EJ$#5to<#u59}WDg^H
z;FHv~cXFIiV^l8=TZ^1fRv>3zBI`$;(aW*k?uCt5;H^DW2$KSL4>`#R5mk2{^v*zU
z_<Kt^KK0214eM>tp4X9#CPaBhwDc)q6x8Kt13%ax08f1t>Qv^0`0z*7A3malfUpJ-
z*RvSk5V!C^PO%g`lG*ih0Dc+w0tfJ#q=p(6`vSPb6C5`F(5x8JY*N9iMr6dMCdk15
zvk#2_TweU&y)_+xiiAiG`j;bWZh_>ABlbMjTjyIXI|6<rD6O>6x@ZUSr9gig&5s+s
z2i%MMkLP7@j03|*ZheQD6M8}$IR$5dz7EiD*1ef^sgEn}O*D2bY%oMQM)N-}Y0Uhf
z0#MIWy-2sK!zGReTT`mF>aHU-(y^b0q{VA&?2CCn_gee8Rr)V{amz>{^g|7WGp0M6
zk3LfB&aCI!eEsyksp?MhF_R}_Gh}LbksoCQv5LBs+jCh-DEZnpq-*TMi0TAvlcA{T
zl4^o9qmU7pcCY<hW?gKK*PK+s2gji@EevE~34}yP4oBs`8G1P)#bR+TWbTYe6U)-N
z^I-H=2U#dJL4@jZoQVdz4vLgi<T5#bO6pr#!bK=w)KU!z)BGnZK>xdQ*#Cek8JJlI
ze0-+e%1f3V>Ys%!g{U7c4Cc?K?^vXr$seH=GiurY#f2HwVELcNJa$MG?u`4%)ZPr#
z0utT%tUFmf`vTW!WZa7;Afc&?&RS=#o6WswZT-3)WmQ-nYlm28^~4Zn=ObYH5Jbmb
z5sEZZB~~dT)Ntyz+MtH%rz#Ny6_HWRy38eV1-KFP(Z}UFgM$$1Cb(b<Uusf6G(K(z
z6h&3x2UeU?|E|Rap3e5=-;Y1UBJb4E!ke^~@4YTqxQ6NZ{E=F}{}B%ANCw%er8n4y
zd(K+6@CVawyoTQ8=JI-X=gSC7kHO<l<!%5F${0%o@>C)0xU=KWnGXJNGmAZ7uJ<`x
zt1XUntFB{A1ROyG=NA${ntI;)k5;(<58$`|Fw><=WP=mpf2we0qe5~<bKU^N4<^9L
z2@qLAlK-xp;9jyr&aDgRA{$`%ozSO}t9|Z@#AN?O%no3tfE;PAf1Rnv|A%#y`$>p0
z0F1ykz5l10;`!lURaJ6%-g1UOpqu(9a?rm42fc~PS4+CeS;Eo+3jcEw>8HzZ=t;n2
zScm_)8LGX8fuI8yx|Lf!fRaX!k1fppsvf;<0%fcrS`(Knu-l)T+#wU1sS9%(f%-sq
zQvh~n<W*r|GWgWnR)24uitBLTy{{4xLIh_nojs0|=x}69f=fxxcJ2Z3%ydM9vw~v3
ztwb*mBbwX1Fdw*VgLGRO^qxom|E;9_^EmM+@FJDZ4Y+_BAT=q_;(yyr|8ood-?Hex
zygGoG4*=D3qET($0Be}WowlD82=wxW6Io@9c<;?ul*-j(RLzXMBZ7j6iv{s1r0r*&
z<>-0J23e@`Yf^R80?8q-b91lumQ#Y8zzzHg>w#LTb@#6buhg!`7_{)~g-A#Kj=IV^
zo0^m)44iGEufYZ#@(i5ltYvNNIuBo)Z(QJWg6^AjPd+!{LBrvyVIce!4lIcX0`O$q
zERuzf#D5zxkgfWS(G0xHebtTzmiQ#L5w|Jzt1M9&{onbD;(>Q1S!85Ldm{O6aK%ku
zpx1?m66F|O{lXAP);<av?ovQ}DY4gV7LG}GK2%&X+sbYYU#M$`GUWGjAVL@vc5zSX
zRcHzhQNKH$@x#&lQ232;cW{#t^k2c(_5XSF7WqDqe0)q^mf;qr5aTVj0aTv+7A>Pl
zg&`cww6(RBaP2Gl6v7vYLVU9}g{t7>fh>N>f=*o|h0w^o9c=PlsLX62@&g{YCZ8Dc
zp$%u&34mNX6`mcMnATCS_Jcv9|L%wcKKX|C>2>AIs&L?0b!Z4mlDxzhfdme~SN<BA
zyt~ajRy?;n`z<rGjt3y{yeYMpIB`Of;GBCIU!y#cUP+(cobhetgb21=;M=?8Az75C
z2m1toI@o9A!-$aY!(nk-s|iHcOps&#hF6ujvvpG2b{ide5RBo$D%;JdCi<c?T0}c!
zAv*y$JMouIm+yufh<MO{oE`gXzpN*Q-Tnfo?oG|r_-7Dpk-oM$qXO{RC$0fMFHIo`
z_Vv)HyvC(I)JyUQ4tb$ki}-McF&SoE?e%$=d*??22jtmt@>ngcmQu<RZ;WJv8s9;E
zWiF<DG{2pCa`2YNK$AZ3s>!=_!>!+N6quC$2t<#*GI@4;c+=7*9>wVKAiifRfCMAy
zhk{dL(=>Pxw;%j1E$Vf{wun=^%|^Mxwf~U&fVZjI{n@L78G}3rpv1S|;Lu@yN^tMT
zfuv{4_ShPP68Hc&PmwSTe)zRpSNSxk6rc?RAP?M*#sDv*>H*S5@d}yXzf?|YWs{a{
z&6+iZM|`_0VxS#bLQc=1Eje~U$0b;<X60EudN)##gXqHDAVL(uEvDAP8Zrc@qZRKZ
z7(??e<o9DWyy^iV7sN$h_jkODclrP=hg#hWrvfw^sc)XPvvjDDRx_hDwnXv2R5=-A
zFwlfwL3&_jqb66o{+*gaWLl1iQi7d#>gT@*Ktd-SlkBQ4RZYcP)*Ca$(QfnTNOiE9
zbVK}m%MW4cTV$MKFynCgRUnY;ebP-fPgf(}(!9|1OASmKnJjBt=6bLZ`28E1YOiwd
z^!^B;(L#+8KY0!akT=>*5{J@bsqioeCfLFcm`m3hRb<0gfXia<?Os*)At4ZtOryR6
zkr~gmlO8s*DCI>Es69hF?l=jj1yNiYU<`8u6Y*58uFvFR;&Zm+(c8b`FPRUl1Fhmw
z=B4Ox%2qb4T(dAtaW}x*{tlevJuRdL&vqE_?=hRrv*bhCt1qI%nlOPmRQ{I|*%o|@
z9E~;spK3?{+7A>ryDdR*>-pFQyg75h-AjX6P}AuOru!^KSKsxNB<z?C!*k)VI>?a}
zqDSmCDZ#a<<9xeNiF={L)NxCd-u{xQH`G?*>Y1_h;GK#`(KyD$($jnNAS=QoxOxVF
zY!xfJ3KOE%&d`pg?=WWS;ca{PSH@Nz?5GyX@UNVG^E8st;P6%I42WMRr$+OLA6vPI
za?apjtZr^Kp|ykWQ!X`Bgf>+~q=zisZ4e}Geeu<|Nji9S#N!4qD+;<95t6Lh+};lD
z;6X~w+297%P<#KTk0bq2+X+E@BCJoJZ<mHPvucGJ+CXSrEy%G9S2?&`$ZRZ(K(k(=
z_mWvl<Rf(p8pJbJAwSJd1~0Y<&aT>NThZ+~50GXr^iX;AT-3aav;t0LZN87(6vS+e
z3pNCetff)Y;O#VOh4_xeNAYi22^JLom$?pb$<su0vBawlSlnDzLbzP;%KkBQ&79E~
zOba3k+N{?LhI>@AwyA&35RYqa<QQ9rN}!Xb*dn)`4p-;O%-p*9wf<ddaI_~afx;)w
zoW0Z#ME0}ab@PKHQ`d*ERD#ua){ZsTas1=BAc;Txu<}wt>{cK)w4_{%W@MuG;iwU~
zJ{AMSOn5LGW|&{n0)~|uUZ$;orcR#3h^6`WJ4z6QfSdmOyg~NEmRXZ)gy_?#**B{-
z#D(RL3DMqWZ1PWLumK~(e&i505|P5%8MJ1iL)T8$XS>s{Z!MyORn`S}Ks>#DsrIv{
zi-i1~UDV*TFT*YFd#P84<DX7*1w4rsQ=B0}Mf$?jQC<E=6Z~3bHP=Ra-di?YOp&{T
z3!O4E4?i6@O<c$8y|$1u=={HpR-Ktx+|vrH``0uC59{T)PSUdELUNeq0V`W8zVfeA
z)ye>HU^C#>U&J>@2p3HGpm!<L_8@{C{aMHWg*^coew)_1xR);IHgfDc_=thrsN?6H
zu!3<V9PSdGQ?k~kdZB*5oB(TXod*&sSHxc3JbaW@si_)~!pq+6w@(LQk_kb*kaMH~
zA$R%m)kndVpNxy|P3VyW^%}n(vc92r%k~%#<zQH7VyM&(&8tI83HMs##+A+DG=8kI
zVGReiHV!~A__9aDkb^mqPyM=dBjele``u0+MSjcPn_G`&e2eu`8UijF@C544+C_4l
z|KlSb{3Z#U=|_J#v3%F7?qs|-DxS|7L2?i#_K^CVSSOYZ)MtV&bUe+hI}M&<c_(Wu
zN^sJU-QUGFPszZ&0|^xiEyOUpUr1i6J9eSY(S=jzwqA%eC?MtD=E`GwNcW@5U!v?z
z!HE4pXgj_(qq5a>LQH4_!HYq89*OjXefR@>2`(sg=UvY)N#K+)(SaF5Z|#gQg(;$p
ziebb60U()s{{Uwu+8wFHRDQMZ21xriF7ASW5a7*qb#j9Da$$!DQgh@(1f_$i;uzf|
zxQP9&@Iiw;YI7A7;McDAfINa-2v00YT&{BTuk&HlsWI+X6bj;ij{G4%hzod5A3O+`
z0f(=mDAu-!^B=Fw3Ckcho#yR_ZRrET(9{c|hELZpNK#Ny;0*_6BDf^CwrmX-$=w>%
zqW&OnD+uYvLVo+EBNuo{A`HwD$Y~fPk;7^_ui-(Nyw)WsJ|7cmQvx@9WT~!neBc(6
zK{6en6E~VS+m9~@x}mOKz|B7L402E25#>at;U$g(iwu}w>@L7c*;)6}!Vj=UE+a3=
z|8f#yFpn=Zjq%`r71Ivh`gCBmp8D{T-z!i^3IOn|nxfc^g!t_W&RsAn`B?qgE69lP
z&1h5x0Fx=go?N6DA$MyQ5+0L(Jbqai_vN9%MIEJ}sW{9p-fLsey^VMKcQ~gFnw?2Z
z3j%j`ptai=E>qihMwf1cZU-%Hjco~87wB*m3cCwZd)U+h=gUCjj^Kk9n6LEbFOgF0
zU&hc^`qh*b?vqez5jTlfb?7+&aeYj*uM8+Uh*kP-unTC^Pnj|xM2}7H!o%u3=-lZr
zV`h*E+5H*Rx!jGkGvSc96mb(bR~%s`5w;D|&)|3FSz1*tVgbNT2BYXmPBfYAZD%+i
zIl>~__Mp{AD<0$Q^($12yp<ah!*{`W_{SD-x;{a!Ka|?Hy2^?JDINz$S<D?ul)7Bs
z9t5Fv!h@Z(3*@UpjY<->_*J-PXAWq)Na}#HL=rD#K;VB(^kOHC13+TUK`cW&yH64n
zK|+|50H`Pe$r9JzUdZVG;5}1nirlV|kbVZ?4lHBpfPFW(jYE=~kFg{_!A}lYm4%lE
z@Z8I_v=3d%@PPyswxWZ_0cj+>4O^51r_6Cjzh~f0e}R4q)=?krT;Rbe_3iPjItxgk
zMw4!*Eg=@6eH{RMweFw}0Py7Ck96HWjlMlyJP3u5y_+v)0P>`?xDvnT^w1LGGe%TY
zX&Yv7Bk8U44@?D+T}tY^ZKq#ckdhz<(!WUnrwH2P-0^L}c{8?}yt;=(?PbJ~>q9}O
zDBJLL#o*@EhfQL|sql499gT5Z6UfvRy}+srK`5|nJ#YkLB}+#9iu!Y0OAZr2YL~dd
z+&LfsODOU04Osj%TGV0N^F$C7Hg@Yl|0@lm$``7j`poLRO=OPnE2*gGDaUO5w@43&
z=YMX))KjnPtj~Bd`ihMw33P4{RRLYLD1_mNm@(rD7W@qWwr^xquXSidKRTdox7&`;
z%mzFr`H%<m%3TufzOo>mCY)%x<^9jQLWQtgf5^pnbR2;5Ugc8;kT2ut+FV1)#DK_X
z1bWwFF1&<kV{V_}7uROY*~X)Pa%&GXhE5571~!>oSgPRn@2P*8h5}a<u$j)e-RKN>
z-M(z_a5KAoDZ0882FUMnAW0_F!$oxU9q&9q_8ioxlk&~rM)X)?%&<W?t}Gh&gALo6
zrnS_FQV&O4-nwz%pZ#v1G0a5IsFW7AQM1=99@L4h5Q_$iPO7#$i*h6Kz}|;Jb~bPV
z*zi<iR2M)MBl+d+>Kc3q*EY^>5fKnIu51Dh7xUJKSHZWxS)WGLNM<!QpnTM|yuW7g
zC#GcE{ur!!|3uSvTy!%sdOoFE<Lm>n?w!K-e>)BcBkyeETrX6fl-W!V-J*`+gq&!X
zb}l-X<Y4F=Il=XP%Ho#idAsi60jYe;94wW|Uyp0vj8?aXBYii(C03a2N&&K}1s4{P
zmQbV)fX@?PA|<S?Zl3}4WVJaNT&Q9dXUcHcW7~+#A|&)!@f1-gC3qMh^*uzKHk-CD
zI{!GtqkZi>$U0=Dt~HtHXQ{pGgp&b>;7h^P12!cA&9lx&S)Bw(=!*1hyT2*Ly9}?V
z$|SZ=ODH>^XTq-WkU%`bQY4Nmuv|x_w3@B3&K~iKe+cE7=&<PYrFFRUEEFz|0p^O+
z$BE;Bx+pZB0K?Os&snaabNwKjr4d)`!YayH$W&;YH|#iypiw&vWQA+m$Bot^9yZOF
z%RsAGVbaWnJvgxhCsgXneMC@=rYb+=Va+@=OzZH~VY%+d+evRUF~qrvFUvtGNC<Bk
zfK{G?bh;1eqgMOyzMtXxI}K?B7i~d%&4nJM+iH1paE=2t<_nUUaSe(s!VCv4yuYOD
z&N@Z7-?M;#Q1MDPD*824aX*|^4s^Jn>p+@>80(9Aos??(O^PPMFsa4YOZ=KgXErW(
ztn~hT*bdQDK!$znfD44&z6)Tdxdzj+{U05uzel0786h2#G_Yf*dR5e?VUrGtHuXVd
zLqIpKrIaId8evY)zjQX!7e_InZX*DkI^{y}vy8mAmcj0cC=5`3$22aBqmp=Y5oFAM
zeW4L?lVPRZPtPCjM3VQ)@1v?*xrDqs{#lmOr-VN`EFozsvcinuD`OhuZ`-RWy`>s{
zb!u5#4~CYxZ|mxSN-a2z`k6$RRdAb+=O{3l(Y?kWj&^Sh)<RBx9U+zab9pIQrl=Nx
z=>aJe#dOTDvba_-cC4ylQM9As&M|UtXq3>nrEa97FzIwKa!kw?Se5vI4|ad9D7X=d
zdB&Dui2j@3>?cLlXpR2q1^yNw0qNfXp6lcpgC4QAk;10e&{r@oKVKo2haFhOl?WdP
zB>64VIIu!s1m^Y`A>~nvcP}xW3u{*A6jXzBI|TDrXTap)Wxp=Lja%3#7uwjM2fTjV
zGQD>j{+WzAz$F;NM-JT~KN<>_FE{!^#~}LLeZy|2`Jv#V_P)F#I{A(uq+8s)lCb*y
zi|}ruSm|K{f^2_ax%bAMh;`6a4Q-RGI~9^BF!WK^XjUFgOxu&Ho~OP|1OfR0xP7I!
z^&aQHGPJ%3?Ph4*37!8b3k~GJDL@%QtNJkKD)0Z6Q41P}M!%ht(oFzqS{rxV7!~oH
zI{oj920&KW%85zL6OeDX79ft`jG=CsnN)*t*_+i4^D*zuCuWIY4?L+>{^jY<Hr(C$
zZ39PU{T+-lAT)eoRpO20jq&Tj1|Rq)YycalFV`%6kehyvJ4?9kgt9;mekl8@qIb$G
zT~>Ka7WYjp;|r*w8bQ){TO;P&ex$eqyN+|3C@lCg0GETV--Obc>)Awy-9t%pa~9X!
zb@$vh5%kygpL6QdEPPAw-#A<-l2zz~x|)a_b&#YO6BErwl0p7o2p|Om1)!6iY+H8v
z(ghm;x(5WT_O`fzo=qXh={pVG=wRF0NHl3t?_HpRFLZ*FvRS>?O@)u%+k1B%SGx}{
ze_PQcZUWqxt^M32w<mKLRDf6Ljy1F@x!3&lp;etM-5*eWcliA1(W9UXw?hl8XP%cj
zB8}hI?@&(wbSox$?%D8+%V{Xy8MSUldF3-qtj#@LiqOo)5dKMqwCM!h*&X)|je<M%
zg{t&05CI+l&*iTbDU;y0lt|&sEKZ2wwD3NX(Tk)&$eaCqnnK9ojs~njD$C`*3;&Z6
z)Zki^CRmgPF8p{RG1aS%VASyiU#I@4iN&bC`LqRYaLO9{Gh$PGpj){ecg4(XDs@M)
zau@LKEwvWEXsPJgT>ns}t{@Z6Oht7qb9cR+-!QT!r<mMIP~rz|VP8$f1Q=|d751;~
zWk&0wy3+PglbAdFlh1JygjlbRg%4{Ipw0Y<7@xs5kyW`^o|+L27!V%d!g!VkOgtj?
z{a_B7nmt=gK?Zm?L;7Zg!$?dBw+Q@9h89%<-Okor1UFXsM~*p<@5%lh&;Z!`zh%r)
zi{*cn><^&+w)Bk~T;Qa7!)#lxi4Clr{MjbfPoK5y2*D!-;$Mn!6UywPVZ12&ZifHM
zweeG`e}HQ6W`kSWGhbqSnxtl;K*xtbn%-R3Yu$?Jp_<qE(M1x+0ny9TGeZSTIpGS2
z;h2CX+s=>oEZF30qL8GH`KOq=o%qvPc>soPyiaK35i;{PZ?_cVe7c7=!<wwUmViO9
z0C@AOGZblnIuO1f@nNZNh1V?3y-j`QlRc<jUV2{0K7V0)Tauff)vuP%6hE4MaPvHn
zoo02v8@Y$dnVH3TFGp{`0korru{@R~uFYj`Tg0*O;=S;M3OlyydE&oiZvPri4a<5A
z*_&Mlw4~-_uMrI2*wcVwI4*);oW-E7$e(CDYmwk#s2RLPMTc3z7KSb|Du{T*H+7W>
ztMsCKoCdN`wBnZ1i5rl>22g7#T@Q3AxjRh1?A-aO)F!7E<Sfj;u6Vb(K&l~L#!_)f
z&4?-9D+QetIPC51ZG78=@iq&PK#@B?;2)C<M~)n+Qw!FNOuCl}Hn;%R)^=<y9;^<)
z3z@=#`r)DtIWQ0r0{=Ywuo`B_6sJi+y8rx+O1_-5jozyS?E?-^uzfGJzcmCY_-w~{
z2*%eP&tEj9k#7*pBiCa0fl`8vb%{&!JE^?*w)1<{eGVae_1brKnj5{CP#|ch|FcpR
z`O>4|(pQ`rLio^13#9Iw?895JX1vos(pf`=MAexZHUIn&L@f9GZZohWCl~K}OL6{5
zQ`5*>0qCNs?{#GAFcByIFZSL#tg7$p7hQCRN-2#>NQ0y_CLkf*-5?Dju{WR+qM&qx
z3P^W1NOyNhclT!RJNf?J_dW5Rd(OG%dG2%nx%|bm_FQw#7-P&a<{0BMP&I1m>XS}R
zBR3*MD%1VCK#rMn(zS34^)wWz)XWBD4(+1x)VS=nJxY%ed_BB-i)Rx!5I~CmC|i2=
z+xRm8Q|EZi5O~^x8TachBx_&uJsxrWx-SLzN_*blNI>S(js`V8tIi)S?ad$JM$j2<
zQVm_)X1!soINXXI|7!DwYqG>_;QKQc>!pTQ+(01bmYw%B1?)M*U!DY9L(DdtHxh1%
zdu@h0uEebWyEM)glEqoF`qd1EQTl0a>tvD(%tjJ4fyNwXQ9{K0>%V+sSlqB1mE$fA
zDNH7A^4;KNdS~=3J{K3iD51<LlGM0k$r~rx^G6kv&iG^3N~(a5hq<FqF@7hEtErC?
zoc^N=>8;FgPZpc?d>068A5^*&aveH@w6YL>#{eehJSltgT55Lh%rta`7jz}O^cn@=
zZ#2iR=f%Aj7D$LoEMn1zc`%HAm-23$7vZ2hhac11TcRsS%YwcetFxxRp)xM4I->)6
z#009G<AE+Ui@GU>m@86$p7grUqc!mChECz_Q^(xV9NK*5plN%iMOYOOy3GvRnlHZ6
zh{U>}=nJ&|@(93;K-1i6F#sv8U2N9X^bMvekSb=6)p(cz4<w;M=7^4?<mIfhGweXS
z!p+U^wDO-gw4HSXueW5t)TtjI102KSv5c(w#AroqEt-=Xt%S$I*?=Ri$gKT4W2W_R
zLp~rL;NjVgyTKmG$l5wntD94p?EM${G-~afORDmjc7A;*tGLvGdQ6A$uDXEx?R5Fh
z-%{h%HnJs``09M1%y8alX8KVsN!i&p&d8T8-UpXAS;71h1V%Pz;R&bcM#9}`lR!s%
zXq{0ZlwSJNI(}%K^@ek*YgQXTmZVY1#Jmqs(rN-Hc@>JR4bUAAJ0Xv85pPR(F$O@#
z>z7V2k+mAR=QJNsS<?p%pdQ$#E_y5R8kbXB)omZvwZuSq%;*1PFXevLn*-n&%SZz3
zC&&uzB7%7oR}Vy$-GV@L0+5uG%bNovdgai)*$H-Zr0O{{zv1e1Tq8bYeATy85DEaN
zW*%QlFAcZu-7t`5GmKVsb0q_nEvxE#)6^P}AZ+7ZqpX8HAZ7J}ahIC`HjdDrjkDh^
zG;3;df+gXj^f{qsAYiYKcAVh>1zP|<X=>}lLZ&b2ss$`n?0b<j`PG}JI($Z*{txeb
zBHlbKJzK<v_X0Q--S>5y0EOTTXIKi1G}ik%JNx~$@AX&<0YSk%LVpi;?n=czh>8lC
zrnwTVoJ^XP{odk6a4GmDUTyr@H*^z0c=%v9cI`>C$!r3f7M7VkL^5)XGzl%r#RF?@
z)V!QXnPcFPk)Low)r};?&9LE>{rMBX?Jd}>w36=IDMD^X-wvM^@!m}B&)ah$)nfh5
zcls%(4d2m?URnD$|3lN-dbRb|a(K!jwBYMTf16>W>~Z;KHQx_3Eb8-BA+cOB#vyPy
zxBK>M%x#8$E*+S;5NlzP3Yx{U3`h7V419Py2ikjc=ElFT=)tlyzRSCyMA8SmhLrN`
zg8{X;znbE4F^w7mh)fOiCazC!MkB1Pb2OjRT?)I83InN>?Xh@;MVmf8`a%s!@5NtW
zf`tg3R)IZ40MN6TZHp<?PkxMrLCyloxPReK8CWxe!8V?UBF+*n^8(MfYi;&_3!uVe
z(Do;W7OvF#`+Dor#{sI<-WjE7D8J>tEm$$F00C4TSg`p5fP$4qgc@Clm83?B<6||(
z!BU2t@py*W`O!AXS3u8@Z2{4RdV%H%<rRAijQ<^dSTh}DX)*C2{Sb5OjM9)^^`4+Y
zve`ckdkr6cj#3cBMYXV@oG0({y!ZLak5+zzl@|Hl0ib4Rp|gU>SZM4y-UV+uS;7qs
z0;rbJ4%Flwoqk2U%M);EW!ZHnU+lmn)a@pFzx(^m2sBhWbsoAzZ3_^h9!5mjSuCTr
zW6>P*S7o`k@vZ?F0{8F#fFomUE56Z;;Ya_lZkNcszR*Pq%?<J%&*zKPWO06|Pu;V*
zH_*TnoolT3<aJ*KNpfs*5O`%R%Pi-6k=)p$IQer)7=Qz7;QMQ6=+sIcbILVwUjHb4
zO_&+n11uoIE^-o9?_cB4UuFP|;H7-y(?cI|kDC_`F>|}_6pPfq^BEr5%YI*1OxLOy
zdDFFf&%8pX#zRv)R8Bh~e3W0zm+2<w_%)k)fx8T7&{(y7Y}jxy;1^IJB4X?0O9t7#
zQ!ol0b@)K~9-yM=v)hA$Jdk6267t{i<*H1PW1k*EwvGx5Ky@e(Gu~ou5Ds+IG<T5#
zvsVrLop@z$fxnplFKD?gURX{)A-v34_IGoQthkVnhk3+b6#oQGA-ySw64*O<ANyj%
z_|{361uUy`z6L;iUh&AgArnfl!BBE$(+@Xu3g!-#8&Ip+a*}G}ZgnPEVAxWWWeFKE
z-%!<WeZ5Qz&Ngq5fqy3<$D`4Wb~x$Pd24KUN7*ujJ|@b(jTfDu1aGXzCvIttUA0ri
z&(yB&BR>j}%q_(>2xLH74SO!0wt!T8eL_d4O+sUY+=fYbwQlY&TxE%`)zS_6F8UI;
zG-*T~*V~%5*TvqM60w21B)qHZ8?ZD3`}I1`^v%oa{J?hYf8J8a5j;~<kBZNzFOryp
zwcc<ojm0k&Lp@Da=y}xxBLD}Mu2wg8Ltm+PRFMgnC*T0`o?Q^nKosy}HChqAxKb*6
zkcxP?zXmu^p_<0|w-WzK16AKAizM9mrHThe=afx1ZyUWSi_6H)=G%1WLd7aWp>v0&
zF*`M@2GlYLA>K9v0HEc1qxSI_JNLQ0LW->U;$Ezg>=?egUeM1#gvFv8iE$|TO@ezv
z|H!`pXraKSOT|xq?`RF2s-ZQ-pJ5Ro3q8@nHXb4Sf`UTAtP6F{)9dY>(f-)jw_X$J
z|BG3&qO;c_dW@ruDkh#EY~_I(pL{3R!<JI*jLv@h78JtUL1d4|`FV8vMI^kcDkhT*
z#@2RD2FhIk#CN)rei2x?^`R2YKX9ZzU`PNs^&D9hS+Q!Z<Ta(5{e{|>t@Zpc(Zwo0
z<FRe}GoThwZTyDGWl?q?_=+_A^j$w!x`Ft-*fz@Wq^sq9P6pj^l#{yfn*_6N#0<UU
zwxntcLpS0>hROwKB;1%pq2PT1tu==cSSTCB>?tTEr)0hPzB29;5iM}Gmkq6cy#YA<
zqJqLphhmo}A!<Q{cjzMd3T>73C1cxA^#wmT$TZ}MMaBV8E`4!g%k<__I|{V#e88cY
zu`>G@z%zRK1YN|u$xa>|*^xb2xCUQc``Js8bpw={f-i#nlZJuwR!k&<M?`@-MPY?o
zhfrunIjRAkAgH&$UA@~N@xigy?$2W4YryehnO7AFh^SDN;^&<-|Cj@dxu%OSbPxo5
z5uH%MzPg&flYS0#hwdqRk*#W)yH+=lERM|1eN~F;qqhAI`Y-CPnNcIO1Oyd{iQ=&e
z_;9vqYNN_mMhXX(Z$ice-G+BZ?wZ<-Z-dto?PBk~iIN#!)^(0R&4&EE-rkpd2vBpY
ze*LUkjkgt~@!D@n!DmC7MGdu{3|XU@o4{{yBH(wTDK*ujHZ!VN9$!!j={q)21B3<-
zZ}a;7op@q=_(rLifF;OW(_AsQ+=y*qp8|lYZAE@yhlYxL+0qkTI(Tb2PZMA;fI%{?
z*hi*7g4K8&Vl1Hs(9UC0dU|_(eC{kY$g$OzDqwWD=?4zsPT&IOtp25cU+)uQ+70>I
z7uIz_32YFFfqIV{NOQsSn2E+n0Q%Zc>KxNISyi?7l?}N?wp5nBVH@A}9DI5piU|2;
zvy4B$rKS%>1dPYIdXqm5v+~}5#yjsh6D}Ovep>U0mfSm}^dA27rDjVH<w(3(o;|+x
zk;-K9ShgD+u&Q?vS1ZX4GgmQ$%EeNhm;w7K8VYBW$jrpM&}>O<wB_5kyMIO7#{W?H
zK2AUWHS^d4uvKH}m-Ecx64+5yVhb$S*>@P=9Ek^n74<ck0@P#I<|4l*?%VI)L<~u)
z-n4ebMvXj1o!!8k2%S^4U%Ex2r%o$QuqxjI+oei_u-_jCDIk5NxW9j@0_HH9dHnDq
zGxAYWO8XBGARYprdHj_G6R?^{pVIys2P-7}lZgSqT{C{7cL*clIQksV9GI9uy0jlF
z4PLhAoDXP^G^xVlZol|Q<NFX`U&n9uo8FocUg||J02DxUMh{!KG6|BTk@fcV^0kU1
z4|kDl(-ORW;0>aE1$5@=O}7ECv69@K{TPwu`Kj8)=6_soO95deRrFzUMoS7QEGzU8
z?$4!)Ovm$MJ`Er~C$<QwtCyvbp`8MU6ueA(-q0VWKi+OixJSTvJ=Ju5HQ(@e>3x87
z4WBlpqC8q-RS&M!Csd^#uaL)%0={IpECN}qB-K$xhPE=F#jHaI*2U8H!ay{gtYs*7
zy1z9X=1_#!;MLyT%$Zpu6nL{PdQo@Lj4Q<!7JbkUNs>)G8y&F$6+7Ah5y_%-L;?`g
z@wTp%{tfWkJDo=|r8!xgJsM~Goi*;kl?(BF^qVOiI{q6glg_jhwo!jEN7X|AAsn{1
z002&vj#5(gK8kw*aBt55mmiQ(*&lG-z*c)T+pQX&Tx~l}&M(p+_6I@RqK#%Bq3zD4
ze@VpxPS^o~6^Y6jl9=FP>kB$h>rxa@nY`Qo!KmNZEm{OoHChB=vC*aWYkg~)yeOl-
zMRT@v_AXQNU@&{Gt@ubV2L+$?{;EGnciDy?*6~kF2>0?_5J@*Ksg;m0q23gMG!U23
z3gBRDfP<p@$#(;Q=b}rud1iRq6uFq#BL7BCw`+-IhtkO6hPrNDYUXco$7hJ#Gd(xz
zJE#ymeNSI|GNv1rygPSSBLN+Lau`J6QuuVi+<d7qyv0RT{iJIXK2zF_`Oi>X*TZ(0
zk!+9MW=VLxEA7@RsFu7m6%M#VPfOmCLAe!+xG2XRRom%&{qbLk4OQEeqySI^SUiru
z7P`#QTMU75ykuhSgY4S4UU`}e3?o9A>ez`8FY@d@xGU2=0B%!*yd6t@Hi#-+HCbQu
z#<h7XVO3WKcb-hf_iZ)+w4YnV_HRjggVQkQLIqHRA~kpCBxgDbW}*b$TpoWoUnFh5
za+ZTR1K%fVw`kYLSR79&blS<ECD-#&H|F~^Piw*h`oIiMjC|HFHU?AtMk{a7N&uH>
zvD;f2CQs3u2AThA=+Vkccp?)*-^Yk@lKgd+0^%q>U0ie>_=FOGiVCc~{r#EZEJ-e+
z6H@#CR`dW=t$36^k{@?3678A&eZY7cPMk3HUGA8+#HrVaF8HWD;~#2STp|1I6J&eH
z7lfi0H^Gt=TH~)C!VY#JQjUc59s|!6b;j}W_C!M}nafS8mh$3N8)fWVJuah9H}o&s
z+#r_MP|KO5LH_l_fcN9}b4o@HA-ekO(`m(eA)=$B!IzRtifD}wwBuJL=}ji?T(ZwQ
zfrMIzDUcPV*%sTtTl!JT8=%Mx30_I+;YOmgbzD{|rNMQg&Qxgi40ZHXcY0yNV+*zD
z_-Ng>j4JjIh$7M@!(|%O@p+MHO685mE@@x;Mn~43o0y9CW%fr0SkYfMNisB(#GWt!
z7#s4K3?k~}D4Fvq(xVdDP(xZ-?<vR4F~{geBOA>U*EXrEzQt94K+!4_4#UWy=R@5;
zue#4ZGQyab5rg4N^MZ^B^&2lHP=deKC|>G~0!@@gVaGuTou*S0b4_}{Sf_N+r&Y3x
zCAXsbe^3L&oWu`c_-G)PB+nh5sHW106`EYY?*OUZHqH~y{d&oex7cvbbBJLeW?BHj
z=KE+3LCLnNBwl$kq`Ny)bN1&JGI0Emdd1R)6<U{J+z+~o-ui!A&Sa6Skh~j5QIA?f
z!skk|3#b_<#1|_l;7p&{vi4L%{qd@-kqx?%#jRLQbok2VV<#(@QoU0?UH>kmUy^2#
z@;nYCKZusYq-sREtx+oT?z3(&YG<<*Iaz<pct0dn;q?deigErqkECjDWj9o#OXe#V
z^Dz>3VaR304RIZE`}c}1CBlJd4Ru~NnLF((rIJ*=l8oztj!GRDB_e_Sf5;@h%L<2Y
zddvF^KD!F@K8)~4*{Wkypf>)%^~5u}aRa$n;J!2EW-WQzz_j{KJ7U<4_i+hh+vLo$
zK4V)RTbr~<VdPa{H=d%Fj<Uo_Dz|WNb&=||Pw6o*x*uffQp2*ZlGD9XZtnz2(tNsV
z3d8wV(Ha-Li?cSev%o}>wQ%Ch32(l3#7BeO>)9Kpz36Cee@W$9Ko*GL94>7-0+=qM
z4JRQ0Xu2>v`-{5zPPS<+>nfrryt$PzaFX<IIcfZ(!1K^pmnhkZ@HbP{2<p6de(W02
z*p`RFATLtn0=eoMR#4ku9ltt9)qFr>N-K+0!_6XQq{ri>A%0!S(*DjR>d41Uf3INc
zGVR8`@_SMBA>Hk2<wdiEm_Is1H{F$ma5~$abpjD0E$&xpoJV*TmX`FI4*9BkS`PBR
zvoqT#9*bnkyWsZYr-{QE0>in28O3Unb~H}u{;lMZ`9;$quK<v3)*G=ad_<DV{lt6b
zU9c_)M!e`CYt^NOppto%aO}g;wwj-)iVu7^$PDD*CNf*Z``mFdb+1S*vyz3Hc!EmA
z&+$D9R$&*IAYq1j1laz+E-3}B+c28{b4e+P0W@R4y>ZOAynhe22E*@PC8b(5<&{*W
z$&h_BX)DIfrh#G)u-yMneHg*i3i|s-pDhSG6ehE;$$Aeh4J9S>SLP#CsI77L>_A6$
z+Cwd?G>@LRIqUqLx)=&lCBCYNDwox()kFsa%rH=JS+L`!8O<*`*+uN2e25{jpDa=o
zT4W*POj$mX?=(9cKs-<lZZ*Lm9<*g5wBb&7{PtY!!y9~RnJmh3dxvP;KPE+6#EW-s
z>DO5qNixZ08Okhzs|?+dxw$zid#iH=|F=ln{f3vqn=f|v9iKj@rl!BOIMg^v^_it-
z;<nuD=3XV`wN&rq%z`Z*HfgGTmt{e&L95aq*UQU)JZh_}t3%4YB??|e-WiPjfQFaK
zW+hm{ZAlu|uEJ8KJIHr+S3yCMDN3%Xm}6Fhm26;a>{IL6k=0x4LH4jO!Ef!n+k0{*
zQ(ry~X4rrEz&|aG@%ZHQQ{bS$?tKn|Xwt$DSk|wO&rVFu-f6wyeQC;Pr<_g$0NWP&
z>Wbd5zQ*s_o~%q(%ydF61`J^e)8??VlP*7L-^7h=qM9K!A_&1f<CVxrED!4{Op(FW
z4-M+_3;X)@xT3zk-al3`cnfBM?&W2jG|b@KpP4Bz;LMcvQR_1-*h<NP!x6`3FyvET
z0q-3haBiQtaaK0zI?b=Ft{JLgzR8M2MiYFMj+Nqy8OE%98zl1e&L()?^~I&nIE9KH
z$8TV8Fs<`J#48DxqSD$>As3g2uhmR%3*5sv%&l8oy?eN=r0XmIs)^CmWqN*GevMY(
z!ptw~u4xN@^{#dO<`X))x+i>!mVD`gb03ZycSV{osS;0&qU~Z~>X?x^hpiW$xW*f_
zeL2o|4lDNNHVR#4*-Lp)@%I@%Hu#I+a|o9+41T=Od<MQiraXhH3k;5XB~rMtr2l;z
z%-Qa_<0Zusdf+ThkDvKwW*p(ws|N$4qaR1Z*ms*`Ci>0xmnT){uNnhCJ}Z4JL~W_J
zwL6w+9g7Du8v3EFs~ccHtuss5)*alB$W~ypb8rBLlV+Wa{|{;Lx+07QU6p~T(4F)1
z2@f7NbF6SQ5{7+U8ROwSxwkYuclXW;?wLq0?2dXzczng09~A3bS^06vU*2I}g6I1{
z?dJpmEY_?9uc)RbfxMASGKMSQ>4r77Le+#(x&z)v6<^`xd*v<=Wz&UIh)UbY&YU7@
z$rFk5=;W^r(W3t|z?1(q2lIgf&AtBv4weGVr2gUHY-^`E&?xlZio)skI^20dhN?Rd
z7BOmn5E$~E74H=nmpXBf>@D@?kMgZ~zgD0(>CxGbo;{MzPTeT_P5<VeQ|e|BdC)3}
zRNb-;88O?NrwOX(#d>6C15_+>krQ*8b#8)oq2rSzu#Y=R<tt^DmaAv0y**dGeWZG+
zYhRMN>IQwk$IUY~t61zZ{-A<Bj=`IHa-K$7w9(wU*07q7eZ~C?HM{dX`_vMYI7G8L
z!Sm}wr+UD|Lv?8LD!dlA#{!F<@0<d^O-U(5LO<JC-u#$^I2mJKfbBRwQ9f?>?n_g=
zCxYSV`=b$oBn}!1fqaBSL}ipl3b)t&_4Wk*k`pnCH3~f*S!r!;{Xz@emSU7J=JdY8
zqKe>{05U%!QytZ1jG9}K;wnu%%&(pqh#aCXKA8Dn`iw;QvFkcV>f2qn7?1IXp)O&R
z^z(cLE2c(93jzU-DM8gOMvw(km-nmK`{Q-`5(2VdNg@nSKS#3s=DQ~0K=vq-j}Bd4
z8}q<>36iNUns4R(7>sy|OXQhAc}(EZ+LKB8hUbXwS>xb-=`{haCHhwz?6YtZ0<zD~
z$ndeAGTqYLC>u*YjH#V<m2ctcshu4&rRK=~<aHdKeWXx-wIHo`iMU-|Q`1{Dl9hcp
zzq$FSzS0@1d(xaW-Th(Y%Ln_tWwt@>PqLTwy2K;2n@3KzUS<v_f0261TbID(YLj$u
z;1pWtHKl%8RwhtdR#s)B^6I{|QfOjh{e*<(g)MFC$ImIAXXtS64NvRVaS|FSapSJH
zF{Ip)Zx<|?hxhTE)Cu}sL=YDXe&>;<loOy1kA}r4gY{v8Cjj1Nnq$;oFz2Cu$s93}
zGJ$%df6oE}6=5iN+*f^u`4eBt5$ueiu)Z@_d~XS)Pw`NQ=wIXYxe|Q-;`uEyQAc9k
zJd0bd!(DGve@Q;6bmi<Gv{H#Zrg=FQBBo=dQev%)E8<#$AN_4QzWh)6EMYjOIb@zw
zn9?O*O8Mn^#fy`usHjiT^b=5(9`U4|`&A7kt}&ilSe;u>ZE_6?M?w@fH@r^w3(<%j
z^!#U~D6jFSTnfel<KOS3G&N%`X7R1=Y5N+HbXb)5T^5SJKf2S2#o3TyD#fpyb0}~R
z?rhJ^W!n(FcbMQqSoov+eE=xGx>?S!{A*{0v2}l+NA$^)-mUGUHGmH|AA*#lXG+ai
z^tP^kFJAY0oYRtI$`{7uH~8%vZ9`r`!Oyz9y4`+e@_P{Xl<!qCcHWz<_ZGXqcDhe$
zdzN6F9Cp?zLsSdqL}}*j(A7N?0dYyMJvzk(q0=`E%N}nXs<fq|tgoDZjENb@C(VaH
z<aNIr6lr@U_h3b6OMmNd%LM*3qE%tw5aTYxycw_R=R@1SX!@_o_@%oFE{ZD$F?sKl
zA~FhavzR}#5#Tch%5<cWI<M=Py?NC?z4&69G6bugW$Eo1@#7w-)9m(e1*~kt^GU6>
zmo3ral|zH<3o(O1Y#C&4OQ5Za+lbk#-0#U}IXig*A1cD=UvN<5T!sEX%sj}8>@?GP
zJ}v2W+OtjJ`ytY|$grd3wT`K?O;_z}L6&Xof-8&%J9{2`qV9f_)_&>fgub!yhc&((
zBSMa>FP=IzB>bA8*cKSc6U2=kZy9IK`fizTg`O@Q>H3~x50g!K?!?)F*2z+9p1qx^
z?yhxfqh9z!+?uZir*8%9cI*;VpSt2OV%?fmc`hM&pE^*tC~C7oTU7Gro2(JO0GM<K
zL!xTdNby~qr?I|~vY5vE=v$2+96yocc6Q=1)%%A_RpMJt+?N&sUYhw-3hm#&aXutC
zmi7_gxfhPg>0A61=6um(AQ1Vrmpt?1&ub6!hVUa-=lrj64yBuj9dZhiMKxaw<$ctk
zwwm;B5~Y?;niuB?nDDPXXLsH!V7UA@!W>+Ul9m5wVGb;I2<=}LKJ}b`1EZVF?cap?
ztgT(5W*p8w%EiK4$)x?2mC2K(ZegrP8dqsQUb9P24e1Yk%rhFy*eFl?NW%UnyT$|!
zkCA-jbN2NBxlU1I2#MWr<50IhgH6S=&vL^*hCW~V>8ml&S^mx1VHReq5-D1WJJS|l
z65e{CxLstqT9=4YD%Mfjj^j^0yJ%ReOLW2H9UmSZ9s;Fu?*tJxF4_?J=iZ6IQ>($!
zA~7O@YXHDUy@{Q4EnG+eO_*rm1Nw`^4y{ya=|t-1@N31B#>o=P7vQg-p$(IFczSyJ
zn~j_gs75cYCi&an7P7-0;9{bzrB^2^NQ<O$UbHZuj<VNkN2}!wsbDz#^y|26$aO>L
z{{8#yr1y((;XTou7;Kz#m>uq{`KqZN$iQZqOrDNs)2YyX(puv6qld2=w5aZhlAb6r
z7o&xH8d^k<4NqfDpmh+Tm-b&%6C^Xy;}+8SBjx-uAM1P9@7FXx2}<q2k`hd)D`KsD
zq2@sO?aL_@LGoW3-0b%+pPgoq*8~Oz8cKh7$^_-tolbqa&l2XNAb05rRRp~Zd8YJ=
z07IP<?VYsh;m%3UlVqQxULi{v2hEOxlwEon#0RExf2p^nI9lh+&kCT+kVc>TDc#qY
zQoN<7A5NODbuS%0c4?wjP1aj3Mx?9}98;3|Jdlh;d9v>OJ|nOwnQW3e_En#0&6l`P
z?4!LGw1A_ylD4?GsHbn(V8C4p91gC=uE#EqDh=Uhj$ul!po|BMv{g1PIT<!x0m^^#
zq7BrTcVFp~BKR>YiuQvkL>?=PQ3{{6eoIT6XWB&@i0R$+Ur^aS34XLiBz2G;(9+^X
z+73-P_6p=o^(kIQNFn>`*OF7Lv^5Fp1tupDQNa~+qUsUjS*;Nk`F+PV4A<g*Gk=;{
zbgUhu3<>oPN<LnH^d3!Vm{OW}B3!9Xx_zsI;d9Dw8^&<eO8xs)GdaJ1WD|$&&~KwE
zt@a7QFYhgI?scY)MvrPez)0mzm`!`66x1QQdl76yioP=Soh5gSi5#la#oom_c7p6V
ze1A*{YwFr-*p>)T`nf>Y0RgbQdlTs)88(lDf}+iI{_J$EIV;`Ig$kE$ZGD#-u%P4$
z{;innOdi2h&7aaOS@JzoI~vJ(J#Nj=AN-P~=K5*cm;3KD6X&AoyBZ8CT%b6G3`2|y
z5(-I`br$R=c@%lfTel(iz?8?oQ2I}cXO8YXW5O)fh|ow7Ac1P?#ziLE{<4H%=RC`K
zmD3xajImC?-9YUamSZ!)k9TYE+0&<f3&R(B$SbWM4=J62+T-=jnOnBd&k_;L<YjJz
zp1vRpQgIMIqr_--LyE6!V7G38FRNKsQ5H7YjM|jjpzZG#nZmXh=vSO1RS5fVq$F$v
zbfaY93e5Zq_l63Jx0J{VWc`dXD$A5vX|z;G8U=pQ8;z&1`UawF)Ua=&nPFqUb@E?B
z<JfrTAH-zNtZc^(>MzQ)ibGF=8T<=^aX+W9e#&*v`&8g6vtNwH<Aj)<PTK!O|3fQ<
zlx)(XOiu+OBqkOViQ*nDb$hBtsnM-5On{u0A)!#O_}rmkaC%?vkCtDa#;`mQoD6<t
zGyj+=`{z~P=xG#2s)yr#0Ngj$3--e-HqZQe-_D-<HpGQ1(an!~+G!$SU*^-fbkwl1
zx7Q$-gwSEoWP5=iefTN0w!G08?^x;R0<nnY1xd>xWj?ejMLsT<t(Ypmmx8LS`7Px5
z;yU5^Q#aRkL^A3E>d;Hth>&tv?v(t2X?UCP_<7EWJURpU<2jDLJmNesY8Q<qjjb3=
zxQ(Okj$v|8vtYwmH`)LYL};U1vi9V+MguobR^n3#ptYG4sb2~0V0aq&PTzK&ds8Ga
z9d|`<Wo^D$d`k9uMaN@T^a|xXi1TB`A*h4IMPTp!`}aDShsZ+er%z8z1suv!o~x<~
zsR_9_88S&GJ{hl=w3$!$<A4ho3xx!2+I$(UPr|5-XMutd&iSha?jc4z+ij#O*V;Qz
zSia*emIbq#X<TtByMCM{Wy+S!xh{pad}=WU=8k4GBh%l+C@fL1OOrBeKK+GQneC7=
z@|mh&htl8R@$>UrSy@Tx>Qd|I=vYW1ey_j<*l-;Ye}c8h24%MQs<ZR*5c9vUJ-<wx
zl41(`Tt3do$Q+y)AiZkTZ;OITo9_VWKJjk!Ik@Oa0g0-!p}V_pbG7TH%10)#MwtXZ
z4ri%m7B2NAQBhONirUkw*ZRBbuZfD)U-9PdXi@hjM?>i*czZOWAAGoXTEcu0rlDWI
z{-~<Dn`~8<*Y(-M77w=dLc%|g?j5O5U0o2yR+2E~JmbBwQw8RLQ-PhJ;`(}tnL;;q
z_gNnyx_A51Vn^F0RyI10v|oN%mqS5&6dFy*s4-m$|2^NeCsx+hUq%fc?}oH8{ryps
zLp^`F+7KPEmFabMIdCWFU^m^Lsd_UzXTPI`q&@qbjfRMbXzhKlPZ55>ikvr;m=xEP
ziQH73sP%N2c%2qIQD}^@J5yEST`atDn;vqvIEzl`SMqya`T!I&lC`z9eXL}lq4EQx
zkt<~~y*~eSLi1bv)=+!?ot>ScI?NiiU}DIW#dXM6e>(k<zMr+VwJ`|;-uKzy`#SZ1
z&Y+<6Ln`Pgohd}>8Hz?~{E8~}_L^>-4{5<IW;e5OSQxG3r&O{YUHLL(fZt#5yIsgn
zEK12wWvdwz$0ddS7L?_Yf9*El2tsqbEBN#{zsAGZ&YN&UO>|_j(TN&Qc-%|G_ph+~
z_Dpc3OPXHrpj3BjgXP&<SNp%ULIlC{(dzAW<AWYyCMG6KBj}+=#_$t^w)S?}n&`I$
z4K^p6hv9}gR2W9z{w7@gSiw7TutaN2Xv`0_v<ebygBT8}FyI}ggb-60FZBPy11Dor
zk_q&?-P%ck1V0|oV=yc}#k3vIPvW%5^VV+`=2n#ZYzjTl^0col7u@!=69V>6n!EzM
zDk|7xrs|HVscDg3Vr2BE6uY5dBYjI2po_C#mPJQX2)C;~eYMugQkzI5@`@T}eRuZ!
z4Vwu2<|Xo?<%|yQX1S9yG>>PiZJW*Ii%iCbr=Q31TRQez?sBGJ<}A=qp{pw>DD0mL
zwVhvh(Lrsef0y=ZRS)K7`jU_Mv=9eJXJQZ`!K4EM!QCImPy4i#0UP?({$KW3YMJ+c
z`k?1?la$k&UXk<dDvd*Lmj=UL!3(~@=XyL4)1OZa(=@)PhIwO&@Ei^4#9l|`s`7Hd
zT!S+FtVca~R-A=rW=H&vKcd#d>$joIx?m{5-}b+7p>7mYk)<Qk1V}1xy_2Bzjz-iK
zxAjet*sFCp?cYi9i5yCOd=e6U!5U2d;&9xeT_@%U>8tqDm!;`BIXT(=A_4-fMHjbP
zFp7iNC_cZ;e$Y@+Y4Q)*{;#G42%Gm69cRq)8HFYd0V$&(w7%RKVf9i-ZSA7(OS7%L
z?Z-QsPP&RI5?>gUJG$D@qntWV))%cBgLW8&>?YumF6wuQbN!+}!}@n;*QeAb8<RUb
zU(H-^=u^?daI#!&TJ7T+maD&b|FSY7VUV%I%_oY=8+&(g=nds){#4`O^wQpGp8l9k
zG`sSBYp?}+x&LO20@@%KODSs&Y0yEF8f+=y`*$AvUr*-WTGUdl7zda{^Ec<mW4N%2
zArRuk5Ve0bxb&VhF|ff7`jSp^BVP~OWDi>V=a(SXus{dfmgIK#pEWhq)qgMxR|@S<
z<7qv1|4d9!1-7)2Ny7RuQWY?_M4t>!PHGPpl$Dk`64yLfSc5$?NW|pe{7Iei%Q`2T
z|E}eC=KbUAqq7<usg;(ySJ{{>`^Oj<3{7_2zN<ZVXO7~$x>=;%?%sLlELvy=cw}Z~
zIXTJzdj&Ju*9dwCKjR-*d9bEHa!WlF?SFf=|N8{|-*mdv%<!3mTl|bXx{`b7?kZEl
zY1Kt>$C@)Ql%JZHN0g(PC-X=jB^i;|Z~57Ca>_S~Ym1z`ymq46ZOcNI<3k0hl`@iW
ziS9?)AE+{PY)s>Z(L>Uie(8NZ;Z9bKh*<e3-rnABTJbV-$20Fd#rKfSHD8~A=sue3
z>E6WPpbBdIYw$aJbvHAwFZucT%F{do0_0n6*NMWph7H8DI~<L_P3BpfZw`vD?F)nd
zNvK7iL&`+T_y^DFLNc?m*c6iD9vMDY;EOqy_l$_hbUNQpD@>5#by*)^q>*$II}p0{
z@M;z<HaWSi-iQ0+EMZ7o4D3QaQNkx)9A0T_XZL4V@=}RL!drMdLs<cF5C;20l5%dm
zy<4yM6&wZIiq(Tfyfdhi0stSuyuGUY2TK|rNasr>Ta_q;7Jkle*8BSPyVXfcr+G<0
zY^}dp!apqa3(t0WAFr!;A9NeG-BFVKxVmcbj-fCpp}2_qWo1SNGs1Px0C72v3V5<R
z;g<kTtnm!4($ew|d=r*zib<m6)8F7OKMz3QYe*{D2YxCmkSIoSTHMkSWAOg2lEjIb
zXaC--g9NsXZej&UizIBfprQZ>(b59#fatNYBUy)^f2PQO-y9(2XT#GEOHWTv2R>nN
z%fVCCnu8-)x>*pp-FvbXu;lv`Pz!{;aCf?7>cAlKtWZPBX;X&#0rBEWqC8>}*)1Hd
zu@H3UZjdwMh|KK}cH(oPue+!8zv-M5dFb3tgMK4(PxVuEaQ{sMQe1F07Wxph*>5w?
z^>|N{npgJeoUrE6mHw^59Ehd)E$OY%QM??Vz>N*wpxT`cb5f?gNL&47`y3x3QPKC$
z(;A3sRGz9yY8+`?tt9j&b#1wM+cV)$>h<=26~yx&_hbt1AX(8N@kf!s8E}!5*`{J7
zQjvBm_cUqQ#}Rr^XlN)+K!>fd(AS_%spT@~-u@KQr+>sX!^W9^IQABt9HA*YTf)+$
z9r;Q%ZmINYf6>h|ybS@vCt!1#JQ;^UjycCZ$0_Hes(rOz#C*vwg)r0lsTzyM(po#x
zkY^*2eFK)Yx%gZ0+q0+Lra%q07mz?55TG-p^wU$c8jMM*G*8Sngw$y)9nsgDO-(jd
z?PWb$>t~iD&9Tne`ApyN0DA6RB?Nf}vtR^&H!hD}NuQjmACS4zKh5!VK38ct2pBvW
z+;M4cO;IdEO#L~VIonvI4;O|~HgkaTetqSS7T&#*fid{Pc21NjTO`LkXX7Jsr`T4>
z-fC}#`uDCWH=K1$6}DHRQ@`D>w}Hopfl(ps=SF+aW=Mu9J3UUSsLpYrks#*Ek3C<)
zbC)v347^~_H@Y36`N+3q{jj7-;b1FUv?(DV$mECEvLQ>ZJLT2jGmKPVqL6lA)QZQl
z(&cL8S>%DolMgwi<|hXaW}!=dI(*XBg+KJimKr7Umlx?0PXA#qF@Bd9zjLA3wS-_+
z#+PsfkwNp^E1J<G7(AyRm@dOiWbuPoopS~Ap2z4Q$g$v^Ylrii>lLj|l{_kuTCa8N
zb-rjEdVwF}?Cg+or2E*6KVH(F;Z*nAl>D97?<26_i}M{1M>^c<%svc)vo3pG2L{Cb
zO(Dns=$+nR=tR;uK@dFLpfc*=X%1%{`3oDjaS~~5*oJs6(hyrr@58bc51AQ%D8D_8
zE4^2$qqjQ@a?TVaVqnkz_+W=%y|{Nv<qK;@-f1qj=HX*@d?=!SC0Qe|AB_<0hiF`R
ze94sV#vS#Y_XdW7H5dbX!7r(m2yc&W$HH!h_tVkP`DQ=r4}P?HV=-roF*9vZp+8mU
zM*d`azb997O)18mo$KM~n8Pq}KV13~q!JZEAO9bgHhBt0Wvl>?W2>a*`sdoGFV&*{
z!Uk=!r&<joARa)k2s6_o!$-%ur`S}OPov^;sB;)|9_D1l*Am<00#h8T=_h(^U?Aqx
z&k3B~2(%DxS{k~!fP2}mNQ@-BFdpqPvnHD=!PmRG1b)2hv&k51HH?9H?#s$H^d2A2
z5V!h}USI^k*JW1XNsH=`J{s&A{J#UL!?t=YN&@`Wud^%VpS}^}U`XlQUa9+z>${*v
zcaM&)Z}jBk)^}i_SIDg7z-R2{`Eff~_@3An*k3fj*YAS`@0Yd4X^#4@?^dWVmt_~(
zkIDV6o=e1B;lWL;cBC=&ymrcnUMSLC#YP?<L2nn+&>oiMkSt)m?yMLu*nM{j;7k(n
z>hyzR?F79{RUE^9&v7wP@9>`DvyORrjmkbM7Rs9t7ZXF^Gd%#sR#=YedzjfWDhLWO
z!l^N>Qm%xs(Vu-wl+3T-lK6^o$&Qsg<a%(?yobNX;Lk)29hsNg-F<0&z${fR>y(6E
zM~NsB;k^4%ifalRi^^}oO)7=^)n#k*z`zdzmk*p2Xgr1v4h}D}*-p?nJ5Q9aQ}OfB
z3hzqQ=(z@<1^8u4bIs)1)f5NwgkikXC3BEoCVI7Do4zsR@cjAnudN#ebTv?=mXeZ^
zJWz|382F&T90A;7MLlNa9SS3HxB#Ss_IP}&jU}WGfI`5BAw^clKf$3`_sITK8DmcD
zsgWd#d%3&1x*jV`e9;d^Vdx}hAKVV}P5SR{EkQ6d+n4`*YY9S9A@qOUS{}a}xde?A
z{{7aHAY5<MXYF7f<=!ug`zo}tu~F-OZz#j6Ig=hQCQn!htxbubBD$^Dm(DhWF=`g$
zfG<hCEm6Hwoo`J{1ho~mf6!>!JBEJo=nfgzrXvo6o*N|y!&_y=`R_&jTI4)7q1%)|
z<qh9AzWX4}({+B=t3KtCwuym{w^uc+!E3i}Eq)-o7<gxPpM9pFW!n(ue^RvRTgykg
zCm@+0Y2My_%v?pkk@0i3>_Nm#I^8RMPZBz*MTNLh&X*P$NvrQwENYhD*Hbj}YZP0O
zA1h35-}RVh+L#Ou4%S~<T8j8CGZ)alHHjwiiFs>lOIM96CX6U4Nmjc|^p`>oe+hD-
zzFD6owsfRNbhfUgM-J!mF5ORhD4szO9#Bg%+G7`1qf}GcqM*xP^18`KL7G~oO0P2`
zlYP|Yr0ND+c;9U0Gx~s8W}>s)+Q`U=lls{($M8nn^xe0o6laBUL*Js!X-}@tuSs{I
zsrm=8ow5`6tz)zWZFZF~k6wtc7Zpz~>FewF=NmToiWVGX1fdUDStgD07TW7N@I28S
znvAyo66l!S`Sne7l<CCyQnL6vD2pcnFGcIN%<pQ1d3Q0r*TDVnW9GYC&)>gqJ87YB
zYldT|L65;EHWtTE#w%1yWgN|36Y@W?m|vUxi31Plr>eXnusHp#cZRhw_x%do*WRC=
zv>^D5UMQuJr{k6=mwx1rNQ&D+k0CMBrU;w9a}M!LJBE~CTHrG(B-lNO-R(8=$kwQV
z0ZP;sTt}!tt7!!V4xVd2`Uqy-vg9e_avkOc&AI6z3U7CY-8c4v8*lmZl9FTVEdhQE
zcTv*XCv+ZpSy@?qb@l$}7_O*`nqGm*y^4qd95{0nnuo`5;Y>YeP9A4YZT_1qg`#T`
zdaMN=B0|Dk+##>1$rWdmNX8jjsvGg0j%{PC27!or0Y1Ls;I-8+DiCpAsfpwMPMqt<
zPVT5lyn}%44GgL7K0-UU$ti}}TI+Y`jIYXS+sCq5A)JBv`T4y3!-v`f>dp;X7PALS
zn37QG>szsrllqLquj8}l1O){tG#~u&WreQp-n*w${h~Ve0m?0=@5^)`80%^2-Z4i6
z-S5u&Ax58)H(A>qUV3@{=!HV(wnHo5C73Vb&w2gnp%8a+zt)eR-g3OEc!PPH8>*|T
zd*RA$fbf0QAaVzB5Px0!0t>SG5JzWp71Bt_?6FsG?(L0;Qmb&!#!4M&c)#$*rKauI
z5w0)vvH-WzwIRV!vfS9rK7@sUSrfumyeG_!dFAsehN}G>jbTF;gYFDUpDyk}xh`*f
zyNU`o!*2{3&B5V2vt33ScW>j8%p~7~7__510~(l08t^Q}LGYOIgO58VY`HU<E)89L
zSHEfs7M3NTMn(#XspTd~O}?6}b#?-ZYUswvYnss?@9KnbXr_l8g*6E)U1MsHj&|?P
zn|{3IW#2aU*`@cm5U?nZT)=^PE)mcfEptu1+35w7fuL3;Iu8$z<J*qyeg)AO@H<Ci
zus?}e6U@WRY}t>=zPFhS4q_ypt?cgFt}N=DUZOz+;?xY?`8kS;1{DBBH<-z8R)!4T
z)YPPEJ9H8~`9!3K9vW!O!P@0`HBLxEf~uUYaLy1M2P=jl?VAvX3xlLu-r+jkO7m#z
z37#C@O{liFgg$+W=FZ#rtt5YXpk*cus+L&&jY5|`?2kD<w0sm5Gj)jBRL%jhD;ane
ztCw(hZli-84A;Ho*f8F`2rR#;bF~_A0(%c!BS**m+XU%*q(}%Z=2`2NIElp@VIo*I
zT{5VFWi-05;DEKEQH4Eugaa-2n&LSUwb_N-O&1)Z2!t-Lu4+oYe(ith%h?3JKkI_A
zU0rC|pV{8l#yt90rye>^b{*o?Pdn9Q_JQx?K&4I1(uN6La++b1*T)1l#+>?)MuCC2
z^2t<8Z!rOe#~ub$>c^2!xv-dA93@el_HmD6q8Q7lbzp$);aNeKE3+3EqdT9=N4T#V
z|J6c<oOzv&vOEQxJRrc9ucRQsJLu*kdy7yG=GmG3Jv!f~oEa<m=vr0pPp0J$9d2gm
zzPcNtO~KD;k)Wd>PYzd?mEDUBEaO|^lZ2#H#_*{^CpG#jDTeq0p}(J;NDQMU6Uc<9
zAn2L#i8@A#P`8AzPS#8o#lUT>R0)B<i+d}+c5|j^P^xiHa)kNbWTkP7tlTwe<HEwi
zJ%X}=dy6CxtFVitpoKwC{Y?A!wEz+#qNFzhc>-&8U{7T<abnfG^5xk@447i42^&Kq
zG;*^&gS?P>n>f(Rtxf1GE!K~hAmS0=G!|M_{FMe33ywn!=;hHSyr(Zzn~I+|7=2)T
zyyCZu$_cirdm2vPDGv0jQ&x|Kp@zr8q^Io%CB*LG;mh2;?b9S1L4OZ|kKGnyz4^r=
zC1!jCz0k&Sv|YiSs2il97otM^++X*+6i^wSYU^rhGJHHN^pF++%tH$TLL}eatG0^2
zw6s*@uwoglbVae`L|zBH!k{_9ffgG5wugdj77YPJ<pEpS6(jtolEnMq7&${ee!yMu
zfS@NGC%GI^^<*WgI|fknNc6ReMK#<S20_G}7Un%Yu}StmxT!Fsh3n|a`L4Q|j&`u3
z%01b12wBtn_bVQ6Gu}H1&?F>E`tDgd+@ol;2RhZ}qTH?*&^qmVO{BwB$ruQ|_wows
zm_dC96kzl<20K29wB)fx_Eb9L%4u+n$A66uXb0-a#9XH|$;hT9MguMeq<61tjZ+;+
zOFfb#W7v6A<?HnB-MN>|=v{aOn87O^6b;zGMwz_Zzweutw}q<bP{21fRZ_yY*Wxb0
zXN-Hyvab;eZRHD$a3m60lK0a)@Rd9(&`vnc)8I+<nV0!RMMZ9${1`U^+Maerk`Yu#
zvYJSPKjgJFT`gBY+jl;_6~SfE4<_^}8vYqP`}0p%Q5szHmKhQ^*~VWC7+xmS>4?MZ
z?CebQ`JpkD>M_3iH~qA6NLl#sdbuQ_Y4HMa#8&cT*%!0o0t-q#*le;tmE%0G5&RM=
z7T!)M^@6QLGW;nh1vT)%%cC-EBB6=)H8;fmNu%z?P>nDsE-&S>(>v#})BAUo9KO^i
zZ0f{(Rrza3j~<YIk35@&Q_pe+IXqv}y?)+ot?&%APmaNw65)+VcmqX~5OH#Po=$(M
z{01__V#z<p(UepzVlBKJ<<hipFu&O>@6i(Bl8UjCs&80ER`YYHo=y<w%HXgYGD*W<
zZH#3UW)o9%)9F?(`UrpZEv!^<2!G2uzI6%;99!|8+(DP857w?*0Efuv$!F%I-XcIc
zI)~4tE!%Sq*3p#(ht-QeR(Uaiz-Xh4+~m<W7moFaLi9SA)w;cNLx*ha**OF?Hs@HD
zUOhYMG5C#cw5n;L?LN^?4kDS3T64d~`DhtlJvZce>}rxyHAg*hg#)Fg-#n)+@tVV8
z_>gZXP%?)_4e}zbVq+(HYt}TOPb1`fHHrM7#-$YrZ;7dUJ7J0onwGlmiHkFg8YJkz
zPnG-a&MHRvz4NgeOSUyRx``*j0Hth$Cu#Y;6@gF-As7GNkPw9eo${Y}ou1cN7JEly
zHCA^~#!WuTxaqhh3awY8l_SL-tuQx3e$BbY2n6ZhF0Rvli-TD9lc=;A%{HBN<sAlH
zl(KoWa)ibCrYh0fk)Xu*pD@yaxNc~N#o}GhVeCerJ|x!dD{Y|w3V;su^%TF)pl{rg
z@dX~7tXGu0*I?-r5~^PBKjWRAFNC(843`ek`jB7|>TWuvE4eO9@w$Et!=;SZeo=xA
z_U>M0@&=>cyLEKOXwjZ+S|S?o%&Pc(c}n`%01CLDJw_d0(%iNm2sFm#OETy`4<Lsd
zE!y$x_8owo!!LWZa2R_KD2&7KB%vD&o;CI|{d&@mpph*zamae;9v2v8YIqDrey}#G
z8odzUPn+tCMggr~s%eB9XC#Yv%TN;np_7V2+9cg5bV#|;+|OM6pQrw=pZM5U1VzC@
z3CBfkYB%gjo+0fYO<Lc~Tv>TH+wyvD8e^P5%E4iei6Dd?q_|*_mq=J3bFhpCe>`ii
zEM?le8FpK+Ha$OzB@pV;;k>v_0nClmSPQ<nm>x6a96D*XG3yex6o{74>A8%(IDz$h
zKhWjONx1`7JmisuPY<FFiy=Z=@@8Ymbj7!NFSlxtKv|k~ZUs-EXKR~blPPW<9^5Lp
zEX(2`VPpW4F_E;S!Oo(+I`}53<K+@*<L!vAy*3ss@sl|oIAH3n<ouErFy^zRhblJ>
zWG#D;3UOcOQ5jMog>PVUGDUkJ=L{Rf)wWWWNb(=e)!w`m&td^v9ZHBlj|J>z$$Qn!
ztebcyHQ;@v;Y-L^c(KOV{Z}TQ<7X1329G`!f;ba2pPUU_>{Mz=7WY!iQ;*Wl==-YZ
z=H_92@VAwp8yP17Zy^_ot8urR&%gKZkq|8{?T2x(ow($&kr6c?%TztCaa1@S7(v6f
zg?y=p18FOn;f#}#+sWpr=-Q6uRuBJt_8moGm3A7J(60vdwMda3Mel&b*w_JbO@pj1
z$8=;y@M^H}=<x7Q?&}lEGP}t)7U-)zr9M~PQ`K&IVdBV2I`4h2_kTNCw)XDM&dw5C
zM5cZGlN1wsZ5|Pe!S!1wPXl%I^{9WmK;JXHPjb(j)^qurCrJ*^-vqNPH70N8_ZXk2
zk(P=Q+Mu{sw<+$&BX&^q?PPufXFPAX*RW38W5(06&Z<?Lf=sCg`3~1eWLUhFUtB!z
zXPAUeO7*Eu9m;3VlB5hx7{+ADrJgfd`$B~k7(Lbd{sfya<eo?U&wk`aik00kvzv$8
ziuhxW!r1G$xPu;wp5>8WbBFv6gPN#Q3;ly8cA(UioEE?~Vvfra8nRvbMP5WiMA$X?
z2T%4l&HD$dzRRp%A@jM&NN~Nh&Rh|vf$Z%@v(-<IIQ}lm%1Iq4L--Hq_F%)j4nwGO
z#L4E~UcZ+xgwH@Hhxpv@qZoh@aKav}OhX3uCx_2pkFdDi1Lq&bK*Bu2;(8pwrCu&R
z9W!7h#+Q;-c&)TWyVf8JF!i+OWYLtRDD~f^&3SEjZ3W&{AtZw{?Z=UCAZMdA$0*Oy
z;2$XpD6Y!bC4b%jD(tTf_fLh$r1WO@ex)(q<dA!kU`hEU`A%)TpVqb<<>r5W^%MLq
z#=Dm2(wD`(MF4%d-H%qeKucMO{ahMMfk6?~aFS=aDozOD1+m<1#|jugvO-t`lapEX
zca(a(sG!@V^R|CIq1+FX;0JpygYS0;8V{3`YXi|4&|c8Gsa-qXkHILH1oIF+JHi^k
zJmB){j^+Yig@6#|$>~O0qPKviK$SfRj`<Jgkp4gWH+JhY%hF0jMdbrdcokd!!Bu!+
zCHDF0&NSHkNauavxf`iKV~nI69~p^cW?_jijH%Db`79Hn{Sz`8`<t-)BEMRW`VsYr
z%I-@Sf+>YtQ$;>CUFHVQJ$vfy=8I%ery=ZWkD?;8&!0>Ts*HUR@|MQH!0;r&vH#@3
z)wA(>E!}?l7;)5}^Yi{7dZ8gHFUEkkQ-WrWy80vP@AbFby*b_8-EEw0`1aCLiBupS
zmUNDsJ<s&ovyTXQDUkzoQJ{NB<FzI_QUKwE_XCKIaE2SL;{X5mKd-~1HF2N`Qp$wa
z2-&MzXfyNMPA#Eny(5ECArNu_cInr14@kAnYI~wyzl`)A!U(z-j1H9+QMDx{C0+jg
zBDDEyltsXsf?@YWNkL&fguOt`yz+;0Tm@;W{=p^|J|9M*_r+m`*gwLuJS{Ge2I3G?
zM90K;CYHKIPaw6Vd?VTa8~RLTi1&Q$UW-j5wY6{(R<-a5?jK}np`@rNxWQL=E}V#q
zU5amjiY368O8D%jm#1+ut!bFo*O#9mX0e~jsax(yBpl8U8j#>iq5Y{t4t}9d@X#-h
z>q@^Z--ONyAD3JWL02Zt?ZE!^8T{{GQuW^t;Qy3u{tvnBfBu@X$Q~M$*E2i1xzueM
zdPP?;S`ikvB957At^&bj*VosrHb{ffW+o>mk9pg6Zqo}PXNzal^G0>*e?gu_Q2`jW
zqVREC#^0HlFAOiYxNRnj(>ZCGn1{R6*+*wbXCvDQcJI;Bj*g6&bw~fKe9g>~>3XuK
zmj_l&ovWk(qn4roe*rRCh>?4E-P6fpJ6UXQ_w(A!;vNl^)rCDDI3>W!M{_wyB@5$`
z3RA^ok3O2td_8JYRvQSFKK}ol>jI4|>{0}y%xmk=0^dk1Tl)Q~%E-ugEF!|@p~=3r
zxoKmw@LKV8S3rfUQ$lP|zix*Yt5kO}Shc*XN7&A{F&gx^wt9UWG_ureHk{mDBi)vW
z3<nw;rBvzoqko{zi{=M9)_;q3(b}jt1(bu6o1U9rq;U(>@S%|+47DlCmNO5~sbXwL
z2f|%@{=P#rssHmALYti|DQYiXY*9dQS$dCdAsfM|0GEw~JG0}=08kj(*CbWKPj1s!
zq!avK?Okb9Q`wfjK%o><P?<yo^jV-X31PGhLD5Gss|W%zV*)ZNAQ1u~1tKn$L6A{J
z6akURA|i$<P=HKf5*flgBP7gIAXA_Cy6dgguY2`c{i}a;e%&PJ-n-AacklD<y}z>$
z_<2g@Fa#aE2s~1S^Ws2P{;wTg>%>BK(#L)xVtaKwQ&F0PJcJxRdKxG$m?bY-StXd}
zCVl%Z>iS+P?&xquq2z^VdBAMtDt0#Xk@!EE5tm~M>eXxw`D(0`7tD2cebyqhsGy)=
z&({bJ(}(o*xOTvjSEXB{?zn*@UiS-CKIr_v4plakNmMj)<l{ADOrHjpZ7St3z#SHq
z!deERN>RK^@jonDOP{w539QXsq|v<FJodqc%1}Z+hL9ikU*hKhWaS-?jegV_YvMKc
zQ(oB}K>c`KFZ~@NG*Qk$(20j!s2;`jga7~VU&rCyiyf#tYlPK@JOw9I$0mMsD9(G<
zG~hC_uYe?~p(_rNO^l6W0lSDAsnqUdGZr4C>S8P(@v%%L`Ctb!ZNMdZRx@BW9f9*X
z<Kr|sy7#Auu9vsBCI#V|d@C@}^g5@rPiFM<Q{4&0$JiPTW<bp>)uA>#bRAm<Ft5+H
zHJ&#cKod>4h^X)h(rjLSejkOB5>B7_g;3<o3nscGj?+(bQOVHn`lc*;kg~wB8DL@k
z{x{g^->o^}+4m(Wp$EK|v#WY}409|jExnuLU&1Tg{(fWnuy4>>NHunw*3&**F^>?3
zejcp#r~>t`Q)tC?kMHwdP8|LkpO7%m1&Dyd;aKGo8grQ21M!(pAAvt$H`V|p;<v1d
zO6B(%{s5aq$NuPX>}6|f>mOh=Ml2ZYYTd5Kb`bzrSR6Dpcnv5JdMmG?lOOVReY=fd
z$hV#G@zt?W{DwRy@%J<>&%q`F0&0n4-8|U`*vmeV`Dre=jA;)4d7hIGOG?y6am`DW
zOWVU6a)Nl?y?Pif`-cB+7^`Mq6F9$H#c(ydD|{P1q^Fa*a~l$G0gDAU7dY$2L##Ic
zZMG2TlETs1_%ON)qrhshNy>%%1GZ<aaj=o}{d@C~Y)`OeaSkD?q9ABkAB@3Jf8Q_H
z9l)Gx*7{-&;X}cOlTyJQN(Lq6J_FvsWA$y1Y8`p$(=4c1dwHdbgNs;ggDq5X=m`Kr
z8XgIwGsXvEaZ9EVK1)M;@%)c|0UjRNIqBQ;9oG-HM{3wnad3#kMmpx2jkDw;0A>lE
z%kb=1Kiv4ItLi3mO;)Aoo<z?fFlIOWiI*xy_C#vR7!rSyvfa1SoZ9Sqi0STw&6=xm
z0b}o1n54+=%vUUXr`33&;KhRc_oby)2!!#iD?7*gH?yWq(heO;4xBG*uWn3so+hfT
zVa~DZM`(jYYq0-s-yy4Wudyo(r3elX7@%uvGedvQ#c_+~qW{4=8buLP&vt*@6;OTa
zvZIck^OvB;1IAv!Cv~U{ULZS*ue=Hp<ieeA*Ij46oa~UQ*eye~(^)U`TMJB<hH7pA
zUeA^vrKhK!Y|2}D6!zM^aNmBpXB3J!elu@xDoAcB>k!r|$RjVX;39qgq@)8GDZI@(
zFSFQH&ZsPF#{{YG1}D5sU6&I$1Is-~s;_fwq$M<SUcKtYfF0^Si4%}Py8b6X5aojV
zwrAD?@h{&yFWYlU-_0W25y0+OVgzKey$aN;FA9PVT3x|pcF|02)95L#nN&dIfV-)V
zpP#8s_A%svesdSWztmt5T3cIRwv`o!!T@^EI-lwnM|l;OkYLrO)&Ha!Tty!q*F;Nb
zuW!<JYt{qb4G)5_wPj?wJxu4mNYQ>EQGFAZ)JRS+=3V4icb=|~uo{~N#yRc~2zlU`
zJ7i%)n<FQtO@Ro4-gB2pOD|eM=)%?AeTqL>XBMHyjiP8!J?2Ob5MXgCo$H+z2{#9Q
zA*63<Y(xeMD2&N`o=Ye+0Js?vR6>Vyqah3lJUzi!qB@m20R-~+skD!PE4?mM2QrEt
zYU5zXa1f$6NI-BK4@lrq?WqXQuL=6XplyA6)4|p0^sQ25h&oXEDrDgR7c=pDNWz%N
zg9P?ne%HU-DeWXSbc41z-w24JVU7{f2GZ>6Co;@NK!GK^`$G_{LZF%Fh3bCmYWeI~
znxz1)AXv9$hnU{k=#7PN?-0vus}4EP*y}~uC(dQ$-L6*yFZjfeNu$#v(gG0v!aL8f
z)X|Nh1X2kUoQ`lWJJ1OVF8mb;6A?1Zy-Jz<I_d~&QW+jo<5c~MX80gej;>OT=xS+v
zyioVth!LU}Hi73i{K{IcO+kThlGpTX<Y>hgb0m%T%-OShFNn)iXMkXSr{y@9Q3-g2
z4jhs*bvTl?&zJTcbT0aSjlDC8wK6FQ?OxmR$H>omgVsZVTcn=!+5L=65Ml#6r}!n)
zhGjv(C%eP$9A8~6B6*ge0&T6pCOP*6tVIrkf%bZsKC00G+tQ9zfpT(tVo}?CqM$R~
za*G*$+tFbUy2_z<ZwgfC#au8oWJIQMo6kE#ixvCQ_r{mm))+DHvJ{^}hme<b_bPQ&
zpp>@M4*xyd)S5}KSqxtGA0bkP2x<E^F1w0VD)wh%)DuvTPwOIiF`W{-Q66gpeL0;X
z-$L`}R(Z##UhDEAR8cb`q(w2#q{WiwGeyE+7|jA>!feg@8g|zk3_iGklDDI|cO4Ia
zfe<QTDiuGrkN7+uG|2A?Qm%(ehSKa0i$QovYjvnxy}8I>Bp{=&fOYhAgmpb9hFf{a
z!3dEY%`rpdc)Hp0XM<ekJA3*oGU!M5ak4l;AHC^Y>(?)}vvPI8mRqLU>tzimOsDH>
zkx-o(1I;5E80iL@YRSR%(Hp*`JC^MXi=%(cNTwlMfNuoNgwBzW((q8Vab!O4DlI2r
zS#-UtxsY#uodwF*jCpH3_E7AaeLi1Z$H{B^K5kYS%@rxrCt!Q*58cP}Hw`d!inS11
zDapA22A+i0$QU^S6|iq5gW8obpvvZk>nGMrA7X(ncgwEDN3NGP3TF)@WUT0gTP>Z1
z)n*t0k+mipNfXaKwmWw`JF1{3adCdaf}Dt2B#6OQ|B+7Az@}h$9u~>e(!M(V=y&%K
z_J{-=a~_u^`CDWphthwgw&CqB%S8u%g6eo<IhNzr5d&bERb>o4Lr9ZPtcfQ>xrAG&
zO45!z7$eBxSB0*4?#_}DnOIq%kUz2>kpYSxQk_wf`24J}JDzjfCTSs8z!2Ld7I2(2
zZg_loZzE)=1(+;|R!;cqNHqw$wT^t%+8<Ls!LN`xgjkbW-cuuhTaZ0g#<xb(3%v0U
z#PMruYuBSFk%2qK&%j@E2idjS=v(A#<z_q&b!<*kN4I`Xdmk4DEXAXiTyJuBdTw0U
zlLr!bFW;LplC7L1?ntBW_H$f1Z+cB@eS|LlYBtQ#`@EbB2J^O;hO!6x3+-C8b~RK@
z|MvLTVq3<$s)XCat{@3jR68zDD6?gFkuA%y;AZ|K^k+BalMhqDBU+W&vJWIUX()SY
z64o-WLT|V^u=a+?lJOP+2%@PsJ}L4<C2JK!7jqhNbSs%*o!~LJa{AcJz4WKvZ}KGZ
z_wMDK)n_e;F{v5ajMu;zsAixZWk?h5%q^1UT4$@P$HtQ57n~hyY|v6+6aDoNe$x)U
zRz$)oV$#&*<s<iE&`6wG)#Mt-OSKSZS0C9p2~@*dC2LcPX{;f%A;39V5lXkP3XoB?
z-#)Kf$lc`0<miTOVWaR9`}ASGX9SRF);`aUqg#mrbMc6bX3KQm<e)*S>#3x)S*>k}
zGb<#NjwQ-J-?0M<Ax)USNx|y)53VK#_8-ijY8G)TQ$B$x-IHkn;p~Tfgr(i|yTxK`
zRcq)?kLj!>ffk*VHTwd{bY;+-jywWaL%(#m*e;HLSL>!yb#1u;JWazYf;4-%L1WnA
z6f-CF1z07f_gN9nsBDcL(bpD(x=WOq_P=~41z2|~G0U04bq05g_!q7c?UaBX<YC!+
zSIA|y!kko9s0ZYHBlO#GHtX23B2?_pP@Ppqs|ra8ZAaEDf0ughrw^pDWXrR8%HP;+
zZ(+B&GuU1)dvEBPZDkm9A>5Y!tD`E(=csP>N&(KUjH;&rZvMUq_le{r1uyJtAgQ9E
z?F#SPs}(0$x*72|b-?)-ni&|Ay_%lM$s^wshu%XMqobqK?wjkjX#WNZM$O2v^Cnfk
zS3HOXWbAy;oFzfSkLxojN;k9_No2Kb@a_dxf8jW*$0qoPdrw<0ZL54_>O=bv>ISzu
z;}T}ps_}J1kZ(Y15a>#c!jJ5~#ZQiZf<p|d3u5(mmG51s{$^ib<A27oo*U&^#ra9^
zI{X^2^yvl9pi4NfCgqpq%3eElAf-Yo>XH2+c>ZVuNerC6xwWNw8iR3Bh7DwbAUb%F
zg+lyD3{m?Kr@Mjcm0Y@yxLdnq9z=uxlga=}n%UuFBIH`4ILj?9Eqs@TGGmmXp6>4M
zubGTyC!7eVnujMYZ#}2&B~j*;Q`+L+_%&US#7BTt%3T`0o)(pQY+X2*7>xed^TyqA
zk{_KdLCPMH!+m&nqo|u-K}JSq@jcN6l@alE^g8!7js095ki4Jc*h<SY&DG51RSxGF
z^lVz}<I7-Z2Xa23Lhi>V?j(XKC@>^)_4>_i-Fn)d#Sxt+CwW@M@e%)Ij5PAgf}OhX
zZ>?5?Oe#<roQ0O&zwIa=Yn8y)n6e7@t7%vGn4eWQ;K)US;BSm>Q2Mz0`uNJ+K!TsN
zy>dZb<68%4k()pM?p#f0CE={swZ(a$leks0?T2sG&6md_+Uaz<vgx(2{1f?VN1myr
zZT^vQyiNjSl*Exl7jp!t=xb6TxmH$7c>`7F3DBOZDYr(B<_1k~Ps##?r%qu0gItq5
z!TDLRj%Rac2UA!WZXy|+GNPVpk74SezzlpdU_9a~8WUr#d+UAJFfhqC$2@$r#qmbU
z#nQ6jSVbqdbu(1R1*XC!FwN=ED=K~c68*=t&M_}PQrbDHCRpbtBQ0%r;O)+7Li;Q`
z$UgP%m*a+qA-tp1@)ZF$2Q*BXUYxO6{PgKli*rf=Pk7J7rtlZO&r(%)I=z8;?z7s*
zXW?ij0Cf!YVsu5?mxjxRhRWKgk7@(QFXTXEBS4K^@4WO<s*-v&O-<8&yw=YYTs+3$
zF;a~(_1vOz*xV;yDQ|^R9lBxWJ5PKKsU+GI+8)inx=^hU={Z+fH_Ioh2;q0FR{k^f
z>Jt@EuVh@o$G*eYLeWW~cXt{00AycRHprq--T9sMY3$5@N%Z>fDQ46|4r^3Bz_K_!
zHO3kvNnGfgRlkwS8jPO0fS_vb-2EE@0g@oFof*Wp<2jHPg`0Z>D^l({_OZ0ugTv-R
z9z3sULKGzhzeU+M`?N#web7*70&Zph%&|tpaa3wtCgV^&^9n4i$ankR_3Hx!E@tiY
zsXp}v`uGp}PvGugH%0%MO`%cS$Fp!MY*~5aZj^~xhl+E^pc^`uk0or%iy!%urL<zC
z4IiFf?p0el)7ww>wZ1KH-TmOQ+V!%91=Dhe2!Af{Ip?tpE?iPnQBi>fZlAH~*-o-$
zQKfvTc{8>nK^a9^)2uOBHm+Ro!l<^QMNe%0w%CSUg#<m@-uk&Iaxj_HOBqW^)LjRG
yF1yw&n{GIY;5icU_^qdsqGAZ}DVindfL$2tJkQ~?9XGo#P4rX+^XXspK>iIGL@J5^

literal 0
HcmV?d00001

diff --git a/envscope/web/app.ico b/envscope/web/app.ico
new file mode 100644
index 0000000000000000000000000000000000000000..ccf339a970127d68ce4ab961f21081a3e5b4be5f
GIT binary patch
literal 19461
zcmbTdbyOYQvo_ecJ3)dSEVw7QyL)gaxI=I|I0OyuPJmz`xVyW%yAzyXbKc*3XXgGf
z>$~%Pz1CT$tG9G_bv^spRl7C-KmkYqCMEzmK!6W403<`saB=^YsbByA8}cI{_*c$^
zoO8lMYJ&cipCIxy5&+QB{wotg%Er(DfR*)MnE?R+_Hh6}SomMr86sm50RR~MuS|gs
z06`T0od0ux03%3Q5u|N|vZ53k@_S^+MKl>{aaG9wKTn8>2<aanyM8kU0BA88aS?To
z%p$cZMH~@a0e5pVSN9P<eoI|6>uueq+4qasYUIh6SesnoLZDmx)%H?D;2m8$9;^>V
zI{{jROa#U=xFtH8&wFfD2L>xUbL@-xMW(mKc+)*Lu<NjQ(%U?==?xGA!I20s(nvRH
zL*-dMd`HT8${s)kC!kk{SWye&7>_ecJ55qmF6`ZSu7-L*N?=lH*LoKHcD_8=vo#s9
zqeUz*5p?ksC?5|S)FliJCju<Esy(TWKa|0AlMpTQZe*u*b$3Iz+K{3Pk>)ov(CF>k
zd{U=>hxB{xX!GG=(Mdn0qUyI#o$3u`%#_D$XO9<&6ZVLmI4q`!O*9qZ;F4+qROFn_
z%HkKe1mmX1fLQyguwtco#{w;Ift1%N8S&=rh-PYPW1t?hy9R<ZIEpafAg`eXr2@AS
z|B72cpzrwjTlhW2w_dleU#YBqEmn6Xc4*gfdY(ISC(bz$Gcq%8{~7-FELDNGZfi%b
zpvGGBPDNt~lbNufcIr?qrF%1~>kp{Qhv1tL+1))>9R(|aELJ{k_v|e0zPZKT{{0#=
z^alQWYjxUSZW+u_^5H%9_Io8(0fA^Yi0Y#imUMMX)kP~baLUJ~d60GJ=u#b-du#T2
z&o#@WqrYocXjH$p(%r`OMi@<~8f7HwVNRO2pe4MQ-~aI4>{*lcX|@w%a%rh+<;*TJ
zgw34l^)30TZ%n*E_s#BuuH(KQN2y=OTa0mX*F*1Uhiby_vHL|&dGb%CS+;C}A=>rr
z9Z*~wjOp+9(qAD~1;|J!idTvn1^$27-alx-{g3TMN030w8~Ws5+pGAjpoF7>D{xT|
z>87KWRH)V?HFC+|*oD3#u0he&cv(Qv0p$;tWIGLq3z3CpWIgRfwE4@jY=oRQ0~>;-
z7MJF^FPJ(l%Es6_BxiWA=Dp5yzuwdXumaM$^RT(j$cONtz=JndxK2}HI3t&py(>Pi
zL3nuh-HEI$YVyADD_>d(KQ69*0)m4}JqPN!x!c5Bts^A5UEPUmJ(GSOi_B|D@PTKv
z9IX~2g}-_G#muyP2<G(dDi`Bi#=2Q1O_FL<xj|JB9#jC^YRmw6(JWATvb}kUsf?_L
zDBf)x++*Av7npSQ@)Oqd{!pmenHb^z>51*e5%IgUc=6HBEbiUi-A5z#wBFq(jIS8P
z#W8gkC$xBxyCXgu7QuZ%yEvQQU4plydIrtey(XF_osSr$VX7<0$S5<$jJ`blX)>gg
zkgrcvK;W>owcqZmIS6-O?W@p2WggN*uG2v?-Klc=^@b7>0-Y~;DvPBHz)&{*iQ$t@
z|8P9uswE(xBWdQ2@WV<}q$`}@tStMt*JouBS>6C;ywmgwhGu<wQzuWXKskOw5{c%C
zX*fA5Y~CL_6~`Yx@{$9n!b(a?w=8hC+IY@QnasGR#JYV<qhk{V>hwn=h*Y@9b%Xn7
zo`$w?2Nq-A?GEkFlJN>mgv~&}ZqXjK{-2TfA=?#umNZh;_4d(G(P2!3=vZ>A53VZB
zd@WxSH0j^14SsI<wxs0Aw6~{)Zr(lnWmzLFRW*q0{B0g;mb1v2Fj~$|H;04=Jzw(X
z+io(k>W}cho13706gZ#pgSwB<`4Ue{&#1^KhTnbTpwMvK=u&#)sAkGwdRQ;*T;I{q
z_+v))-C)5@Y8x%Hm~0O8!_Utz+_WF*=?fA2D7m!Tb1QdspM?gQq~c|s{3%MrzR8y=
zz;Ci5HH5Xz*5ooGieedW`kEv(rk1sqP<c|}NKVB@MPq_pzW<}h_nPog6}1l=-dIKQ
z?Sy8NB{M3;-T^kC^nbv}KMX<eAB=3e3p@Y-jOo7^snbwUQu}9oUOx$&)HJb*f(^pu
z{KlY#sqm4aTwG!Hq1uh*0R|V%P)K-I$T$&gI)u5GKwp}oe3C@^<9nn}lgYvx-W>Y|
zf2~WI{Q6{;+dW<OSJPZ3R_UOA0S`<}Omy#lJ77;bfPMS!{il7P+uwsK^c{RWJw3nk
zgiEQG&LU|YlVhDN=<FD#t0MQOvRvLK_4W0o%q}l`VJ3T(CCWauUtnQX=|R6qaP$*w
z{ASd($qJ}yvDNw-HdHq+Z;wz0`is>=5Hy@M*NN%En&Q~KniphO`i{byahm`f9gT*&
z+Ra%Cbs87lh=U(bfp~Iqa>-wX%Sen~P+7^`Y3ol|V~syV2kc*a>a{vz9gJs-P+^Cd
zX?xti3P=t}Vnv7tJKETwQ1(zBa{C~*U&#6MX7%q3$;>V+j3|CXu~Ogjx*jI*d7P%c
z$v#f9`20bviMW+u<@Z)I>0hrW$J^o0w(pSnzL?6kEPtu+9c}dpczvCbrb+-wIGQM0
zv0r>Syu++z8!RseWhqj=UxQKW3-}Ck$;mX*zuqrNl^`>fzH#8pLqO1bY#KhW^UF?G
z8Ycoayf?cA!AO`ExBK~-Uz+ZF*LAC^Jv;(@@ZoFF)9-L2TYG!OOa2CS#Jc*1GY_2I
z03yDir;Ln@hvz>y25o+DMU2FJUbqSf=~&T{A-|Mq6AQ~wl|ScqGRbF;nK|wJ1vR&{
zOs&r|Ut|k<hjP`_G<rKgD>7<yYbJ#2-;7AgM(9%yiC>k^UXa}V#IC05N<QMELZ(9d
z`-yrxxT2!M_^Ss&A>-=%=8(`(co|DIml~}U7<SJ;!b1_2y(uY4Bv2l|Pnr);PjNHY
z<0=O2BhDkX&wGP6p`A&0HXvWc34fx3+fs-o4a!z#;`)!B>*v4EPQ(b+TJo&FuWU8O
z0aNz0DB@b#t8^%>gY1NXKf6P<am=l{or@11Lrk_K)mvD^M~A}9IRmBHq)zWL@^pZ4
z<RsmjsU4|!?#h@IsInYY{a&G*w63pS@4q`XVp~`z+sx0TINKS8iH7ryk2`0Lb-U<m
zrzf5$k2y!v70rHXr}B^zVOl=xX6w%-C*45XVJNb#cqx7JGy7RoRD@AD=Gk82xk)zI
zgyq7D?}B{)_PTOKQcAwZuNJ~g_CH_~1Stpo2b(TlUN;bIcK?gbK1~G&94P`nb8`|J
z`g-D0d>r~rt<Q7nTeB$8KB!w5>dK#`gR_s?&Z^JqaK~Xwf70&ZUpmq57PQ?=a)$l<
z3AhYWi=y|IV%Myv9jBSqpWJ%v2vZnX)fQxVZXCR169%MG0cfC-xsz)^5NebSFaw~g
zq~JS0fL>uQ#jdw{-~jzFy4Bso7O9OCNqrnqQm%fmsgMk!aTwcQO{V-vrB}}@{OStV
zI-N5C+9t*#A6+TlK(LyvkW5dfG<DMaUpflk-%GZyOh1Z?rC!f$t7uCFqw;BSMR6U$
zU!stbR70etI@&%H^N~03tsEd#*2SQ|&lE>B!Ae-1CSY^e2H#T?nI=!Yeg@h)B4lil
zQVGX@v(YS$k1MjfZ+gmFR(QjsfZ6%^+510oKm~K}&NR;)ZDv%pOBPHC=V1yX55d{i
ztvnpAYS-#8;UYWrHm@<$Cn5Va|DlvEiiex+&m{`gGSKciF!T#Bsa~uK#|&#t8;}0N
zEx;F9IwV7s#ecxpC0qIhRyNO|YG-scGwGdoVNM{wd#G`EUEQZl+e}&hopupSs?N-Y
z6}!>ww397Ezh9O~gs|CVU>Il0mkF$pgnZiJy@>*lI~yW)93!`tscDbj$e!~?^R;Ta
z{{%9>_bajNUm}XNx1}OEPM#`#!$l7Ne9H>KPplo8W)Q^s+C-fkU-)aG2yt`n+$xj4
zDU({(>HPVz`DRy1qYM=){3BjocBvpZR!ELr32MHn%vDELZl6W3b9fs&`CO>8w-**&
zvrOyxQP59Yr@#0b|BMv>{^J{iCrDwOT}KA+>UvQV(R-p0)N>zu&T|2IX&WrbyOHPO
zH@f9J4eL4wJ%rr}7pYboauSk7$Hvlh&yW%(3u!{>46ct;@xA=+DdHm+bJ{!peBw5K
z-z}5~Jq~^Ml}u%^VMG6%j*INg=2O0XLx%S=JM5B1CVHR!a|?Z3<)bb2mw>g`j~lEh
zD@K#hB3eCj)^pj`%p)thy4+8Hcvgb-g0@O!99Ek>af(!Vp!^O7vC6BebhU#N#gCqj
zn5o<^*2HR-PI(Syv~!f;V@ZYj&syAn%^Z2)%$dyn_^{Hhiv?v6OfD&q5+M@(p)B#!
zt^@*Q2$oPRn{KN`1v2^IQjjP-nFndn$gH3!5QQh@yUE*+Tc(Ow1KK9>6?7%cBI%(u
zJ_r&s3zxCw(I9@xj)kQw+Ae@XknaWIu|>S}=a|O}XA%&8dT`u@C-*?uFwB=9{s3Pc
zp2n}Zv3vb2G^~N7>uuvt{69edAIFULKhTeQZL|XbxXpi|Kc+3`f+K}_o~`{TvZc%x
zKh*WRGf~WEBtXoTnT}hf2~H6T!DovMll~d%8^t3W9Vrw{SfR7rJ93F}o<deGlMI4F
zHQOPA5hLB{bJW{gYdr1wW2pV9y$X`CaX0^!i8Rg`237GdtOTT_f|j^hALPO!ELpH_
zF|lUu;;Hk|D7-}F{prLO_74u;N(Z{@aKyyK$WE9q^6PFYRDZ7M$ThBiV5`yVPsQfY
z#~6NX(qnEoWpzSp^yS@psjMYM3j{9U=PXt#n!J90wzI1Elm_x3P=Bs+Zdx@R#0RIz
z?^Es_b!eBuh+wLx@`zjnl-IqhaP5B2VfwroY0IgLYFBYfU3BXWhY)CM1mGEA<5)<t
z=hRF&Dq5Ul1VquQ!yyQ8{*6+VB{J>(lg{HTrYIT6l#I*p`wOL1XphtFIu&3S9x?8b
zd?@W|EOrJ(5cos2^y6-#G?g^nJCyd_lm>CaLTY{t6)Xf*8F+Hu?eBGI$Jq9;=$&ro
zt1_kPvZ;3Suxf%i#dWuJOrYxehK7{sAu2!dQ;Cex+S*$2i5#I63|k=HY<xLtV03Nl
zBZ6bc%N0X(RFwF&BA<>;I=Ab$^H<Llx3gvH6OmLyZSA~2)ojgvXBOHgf`IAegM(jo
zyP#i`L8}K=nT$~+8geK2F1KlFO67{5WgcS(@r1nf4w}sJtOf?*FhRh(M30$k@1zdf
z2%1v9^QN~~#_M?(>GtL(I6Zf=m(T4qycVIGz~#QU_-KSOtgja_S+z+#D9Eb$)2DYj
zB|pc^XK`~WEwXKyrD911us58iGQyFtM<F~twYsYJkdekIOMUfnDYgxLQU~xJpP%D7
z)&U9%=>bS0iWxva9Xg1Cnx8kX9^f4ar8GUQ)aiDBg)gb9a!^x73?T{(muh)k#Rd_$
zy1Gj2Fik}CreK~8#F9{&OSr!_iuIYOK<5kc>i)4I%B|Lb-9_=_Wn&{B#lyqn++&hV
zq?g!}4T*0_xY;Qp`||pF<Evv}falV^YQHl7%}@#uVV&vk58dU#q`+~BF~)?&-YQa!
zm|s}fLl^2LfP%{DK^Ww-yF4MtoxzU(1%qqVXg$C7@&avc$x5=<{FPS$GF<~Ve%tb4
zk1;HNZhH#jTW5#qoheqby1Jp#Z*>%bZK6WGg2{mv%6xi#_H6dKMZUeiZ-6_Do|YG2
z>yTwSXErU0xGerueHyVLEXnu2e8OS8*VorKQT9V$?@`yswRTT6`NuIC^~{0Ul^MAZ
z(d=(!Wf|BmlzvqeBHWj<P7?Jj<E0{v_>mG`^{vDj;on&N5Vn9YWN5P9W}UPCKi*8>
zN$lXL=xCX>EI(GJy^%9P{?ntlnN*3?GHikZgB|@8^X07tEaAi-zc1A2)ACo;xXjQ)
z{N3C*Wjp7WX@!yH;CQ{y`68yDxARBm0&T(!2j0VON$fT^R@HuXp-j?icb3@S%&0!m
zg{TSi8EP}oZB?Jygq^dzE>()Y)ctkP!e-s|xn5w*NGOb6<qTHb0)?hrkbX~Im0kkC
zl0Uz%zc4QpMg2in@-P*elv=7xEB*MB<(V18E=I@`1{js<;gOy{62Sz=(pKcJ4O9@R
zWdO8AhqJq1dN`1Lt|lM274$pEucNO($6pzQqFiCw3@ONU|N2{)i%S=9z`J`WLV<SW
z#4p}ZP_F)r2|Js6Y)IB5kf1Au4+k7qs~zjo%JfG@M#hgEXRW7sfIj`Y-868Go|~Kd
zvBG3y7s2rqW`TQM%&FJ6;_F!T(X&eCXZ7f4|FU*$#JLlqvW^j2yUC1V5mq?&Pl1G4
zwaE1XWAm~3^{34YDSEyXUn3^{Ih_Ks=|$3ucBv9D(qb-~goxujY**Arj15X@T{|Oa
z6xN88O%cuvUp)2ag89_2?1Luw5Ao@~_>HuQa6(e<@0d0VI@MPcG!Kyw-o3@Kbt#ot
zA5M_RuXFO6n-2!cLqY-zIc^GHrO0+W$PJ)_uVZkO0(s>B2V(dqLdW_aV$g(s3<Ci8
ztAB}MO=nC=?=!B@eLEKn6D=9qM{BtuVc3&=;q6HwVYR8n$=T>g9ev9qDaRdA{SuUv
zbKBZlhKiS8)iNgt(Ge@6rX%vrxva21jFA<LRLa?L*IV7I9`)C$9e!N@F%QK)W+B{n
z+VDMi9dA3x^oB$`Xh}w2k|9II1Tr=PwMrH4tV~orj!GOSJf2LtX=Z-ZAu^4hr?c}F
z8B2$JH$X!X5UF30C-~vWblfxYn2uVe>25R>%oZy2Ef>>7mi@1n7rP&Q0>d@u>0))k
zdU-jwjpJ)5CUoIvnuZ+BrD*Uh#~8s*ri*hhL2ZgA`q=0w|72#GH+e>Sy0z!zbArqI
z-lF0+HuJ`NPMF}tX*PLEP;fZnh~KC0($8pXjoI4f>G<4SA0InEP+&MZLUTF7YR(<g
zZ+>j3^)X8C7aXYn^r(RJBk`BoCi3{^`10~{wzi^nLFP5Sp46H=M-Cb^I&*Mp1uCrJ
z{z&QUN~rOvkL(}}v0fM9szU!^?!wMB)OX>K24b+0c$H7*b(~rZs`F!Di%dLkQ6lgA
zJreGwTJh3EiSTg)yEHyW2?@B*8XEhn93WFq&osu7VV)SP^jg=GdC@0y4JayJ1(VrB
zw{f020uM8@kY-+9OAECG?Dpoq#u@UE^tsYf?&#=P6;=YDDBuhDLGJ7f7db>4Q6|be
zG+4gh^6u5Q+4reFJ&IqJ)iqY70IBHu=P(b%-&PsO7PvW?Gc@w%dCGoIkgFv4l=%Mr
z`@#CNT5k_~C#Ub|#N5I(F(eaoJx;{S8!K{@-?4uF{7L^s(Ojf>j-#QhN&EX?!?R!9
zL>S|Us%fx}=rOOMA==DEE`%4EtU#E#0W-x%e<xibjWjrRKjj@CTYrj76DB&>Z}Li#
zl#-friE?reNx(%9E4}EUv__5E3u|?NtHstiyo@ILy0tCwv#N?_#mR?<ZF!RjL>3{g
zo-c_Q_Co{(1*O(R`|FML#<7+}p?>?jOXzxSO--q~x;m>GeOlP<*JLJL^~5PwR57gn
z<HW#tTtEhMAxHGj`k3uPCC3(bOwOWVHZ&-gQZCOO=8Pl!5g0{oPq^UG4t~ymH+dJS
z06&O#(6%cAn}^Fr7T)*4(%z4`82dNkqXa{4mWzo=U^|beY8_;fd+=2wRe?RNFgu&{
z{lgvKoLhcJ&bT3WRi@y~?w9XZks3ffl5w?Gl;GP{<R==*j0O9;u^u|MgvR2F9U?m~
zoY9*IS+XlRjn0<da1dZV#mBd7`^z+ls+*#+4rk}R-C>vo`GAe$Z}9W)cauS1ejpfx
z+1Xm=R#sNd6|yvmd$-(I-X5WceZ~$?3(1uJD0_W<9ZUCJ!H@jcezLOm9{lJ-PZ-A0
zt?$#}>Alc{*Z$?x#nfh<jk=mz0tf0-Uvq0`$?5FDJVx$?SCW-h6GN_orT2~-a+smY
zThIRYmBZQ1n>3D(ANgy|Mg7-WWn5gEdaT)K>G7vkdQZOac8O)a9ZgfS%O~LBkrwW8
ziuLr|>@>Nkci0i})K{oR$X_vrJ-ez17te-Y0Or#zOP17eWEK0Ih0a7I@FE1>!dV%7
zo;@XGk7jgW<?zJZwu<Pxjyl7-7tV*4VS22)k20t~NU*1RGf=jO?3SEq&ei;ekPq({
z@mH1)3ts)^IN!z23=T@`Xp{y(u?02QujPw{ZG5&f-Pz&UsMPvL{SdwKDjs<2cFP(q
zNMtHeVYkQgXaqmU<4y)0ekqG{Ji{4u0?TKxX!<Q(!0;Xn`E;cW`t!$R*(D5@GZ9v1
z`qbsSY64T;87r0`XWXAC0$w-LNtUzblHxxy_?Vip4kPFQ)%4VHyIB<eQ8DT5OqJ(z
z{iM(PWhiIsZ5cYcI@1Qn2}4w_?qM_CSIzXfb~*{%%L~PV)N>(T-bW8prrHD5jB<2j
zh<`WoP~K-Ny5h{tSkF7Y6k>kWJh$gR_oftMPNc8JZmwNini5g4x0=$8n03t?8lr3F
zaHFY0s%vN{PK$&8+k<LhZbA1x8jqgIda;}bH{C2#fQ3WbOqj+>diD3J`X|zkKK&{j
z8`jv;zqIGF{R9c3>rzf!!vx;r0+S=!55dBxKlTzAYUV;@8LM{Ug5*9F{7C$o7QTMt
zf~;+QX5MBN=WUIA-pY>ou;i5KeLh+lc@xcT;!J!%+IX$Sc*kP;%s||`O`E{UQ<#X}
z7+AA?zTCF>4q2ar^HHWKk=-oyLyYcQYRrJQx_SOYf1zCmWiU>cF*~n4y9;*NuG8e1
zc;}p5%3m%7#_!UMizD+kqJttcA7L(??@0xTp2Q+POA81#f^ixHC>xt&%KfY_J07YL
zjt*8YiuVsV-=Hk_qQ6=TIHUXzR4EK87yb`b{<Lyh2LJ?~f2s0Jcg;av0$0f5{Oii^
zmvG4-CXm@mp-kjf2)@s+P<(1Mj0dBr;17~Hy_Wg7mn@iZG^UZg5BXCBIkUkfv8k9o
zC4xrFg)+J#n3inPEibF<e5QU4?#U}=?%qOfEhqDa&NF9j=Ht)fSv)S|M}$ARe}xZr
zg+Wk^7j_6&aZ66ITqPqkCO#%kRl=M5Q6)X%jVd3@{I!eXua$|333G}Zb7Lpi{+|Xk
zBo(nZM^Gl~J)?znZaLPl`xg7sI&UJqIl7}_I5;@>$aDcH&y{?<e6eg(+Qt!_MY!;A
zHhXn!N}oiYNV`TEgF$;GeCda?w?jiL&(HEScW6e^M=|5G1ES$vUD|YJ95tUqg1MmA
z(<p=EwBE^<Zk;5kIS|H3BAtFRcMvLDE1g|X)nVa_G4<Z~JR%s2T&`oLom^{okU^xT
zRz*-LUWmr?{FPU=lsvA%&O0gm3tAjaY!EDsBaGApUgPQ_K^UZmvSeIC`W0>JecqoE
zmTmNfpAQy~52H&<t2)=#?)kjEND~-Fc1E8YEw*g7#twq66eFJ8e8ui7s;m8l)pZ%<
z98gBQM7vfOm_3ETl#PKLSXSrf=k^8$V^K)tZXQzlObngn&>FHYbIK`)ScC(fDu~rC
zk#PvHje#!kt4Z@OqnQHu4TvAP87iKrZR!kdu$F6r*aC{*%`zEquyh4f2aWe!tM{Nz
z=-8APb<B#l&=&56P0D`|8yOj)qFxP&o|>H8yhDMGOEXNxsQo}P;548}g>9S&wgYdu
zcPWUgOBoL}2+T>+ASg}7+>xB~Uw;q6^yz49l)lLJh$ZFs*rYF?6rY-}x3jjg%2Nsr
zrCUn8S>9J6ZnyZ6mS)B4{>s1B?#ow>4XV-()&HxNE+;2<^LjLMGyR=1;BWadCuB+s
zmrlH#d)5_%pf4&CCp|l3<Is9u30oeHxjCsphSRIN+V0!JfLfMEjF`_j*iXE?vP_Gm
z+|?9^b#TD^dF1!186Ovy)Pi4!Wb&_hJKZ-tE&Y(Nwm&9fM73?sd&txo>8)(@b&fLk
zcQ?u|E;TI_c3k$6@Pu^*<UvSLG101TTRn;LA5e6>8I@?u7j?TgCe8i)vSZMRM^@mk
zrjI`QzMZ+>_!w?9H`)G#cBYw|ofTiHw__*)vkrg|jmv!;6NqKu1V3;|Kmi}jvQ={z
zxr^dObbD{tGT&k1H9gg<Mrc58Cd5Z<cEv3rFGLH|@4&G)paHJ^a>oSk8ivMd?BV@`
zED>sitUrC=dxt&oHvmy_qIhiwkyR)NnD;g|4q!$_o2fxSZ`_D}zGEOEBFOFU?-zz=
zj(J{0R+eqD_`6w}P&s0~ZUphsj81Gdgl%lfp1f`3<Vs4|E1%=b!Ana^THcEeFqfV+
zdjkzn&b|vK4wDzPn>C)#>xG`rw0Dv{gDfj_nAG)LmE~_0I~?sJu7yT8$b|i>BpLC;
z!J^dyHK2idtBrQwrTR93wn~Q%JO<i^i|%b~v~1$9DPGmYqM!Lhd5vr_Of8{_{L#s6
z0}HJ6jY$G}%{@bZX9gX_o{{xm?-OLoO-vmg(jx8Rv~r@5J0n)_FHWV=m;Ds6G&3u*
z<oCZ#Df?Q|@%G&Zdi>6rK{%N&btwAmy6^e{^{VMH*kr({G?0$4RCCbiLrVD2&Qnm@
zugBoVE_Ft@Lu3SwqPUzagb?wfpfuG%mL+7%3T0LtDL-vnuzrBihnVO1Ea=m-CTVXL
zb5<NpKQ~f!a&@`tqFg3)?QbIT6~fj28i_vzL0l=y?~s3?^j`bnMxI^UVGz4M0$1GE
zI|S|VAH)+?dHy^%`^ScUJA2^?R$?(I{BmUsB-z1)@SzLTxI4@jRm$t=$#VVdNnpv2
zeZP`HEV|+1OEizLxv`_%>>Ygdfl%abeR{NwP}4DvBGg&i2V&3X>sdeKKj<7XwjKZK
z6sSJ^l_SLM5?VVwyS~2fb`bcPam&OzL9FrldaqS?b8FGY6=r6J<Lh0I%k1JLCN)!~
zr@Qq8BS%B<(H=`Y`}wIPBF;(>aX&hAc|W3rs^oa)m;8*;)w1u=sEyPhL}>CxVl!uD
z+$$I}#sslC+VTU1Qtc?jebOq`kF1mYUqn=C6Mw_!8s$+%Vv(n^<XK({c~DZJuZqfa
z`N&W)o=6qVGT~x+H_%!};>vA6yR!)jW`FoGp@nE!wEqr>fjAgDJ3Cec0&d4dLaH&>
z4O%XpHrhzY#9i+)hZquZ8~XdtZ4@qkIWn0(GU^uP)xrGJBzUsBMfl4Wdi3u(IJsfo
zicic6bGV&ItDRG;_!JZeZ#FKwbc3tNeQmr0PN8imVYCcVtJ)+-8IE9^Ai12yJM7F>
zzM%bD@7);TyZOP}q0$}MBdF=GQnE-AsVm7b9WF^-t>ObNUkO|g5FDXs3|m??EnXIX
zrxXu`F**6Z8d6pE4E(mf()k}47Yr!}|A%pV1dT@^Ngzl6#kl(Vw#0Mq1P{h-O)?hk
z1FZ@<J?yH=Gz#~~OUSWQh_R@k-(mOyq|53zr6Se=f#OKHh>2uSNwh^6my@{^-yTYp
z=Y*|<sb-;c=z1k(W#?oKR$2-r5;4QO(1*@f)w1|pxW@aRcGi~CmeQWEGF}KTMzbzj
z4zj(^dEBv{1K<EyK(&LFpTG5|^jA1g1zg}rfDtC3fvwC%!F+qvS`CerCDJ(owMi+Q
z3LRV^?6D|GoRON!EqI{}1t0>7H3z#GR>>Ym-!anU&9x}jg~b<OCf|$e1%#hxh<Cm<
zDWTFsKa#zvc4*^1yI=zYSbsi?+&FV)WO2LKVh7>W0uP0`-afnuOB8YSSY3F=+Hz^O
zGVw$68X`FezL@%}BF$o+Z}{bi0iqG2yyJx8i!4Yvqh>Wv_}ivzo$%gms;j~uT$rHO
zB1LW0EmGp=bi~i^4n`A2u9Zn5!V$6T$o1M~hQ(kTEqF70D>5^@stE#R_djGQVuUB&
zVgl=<dUEClWpi=s)`{gmF-0#ip@dlm16`DuQ!<#zl3%a^oU-wcaYMEexl$_O?Vi2Y
zGH8KeYS@8^G>DhuN49rqo?;a@Vt{;mFxD@G7z<K-Xa}=78M>v}mDk#yT*Av=48gzj
zZRC~YtA^L%3zQk17J`9Ugq!<&7W~rL$YknDC*tD6TMv$QDHPiXl9AuG1K%A6MYn$V
z2)<b{VX0H9ylhQQPHGl`I}mYghzICECO<zdIBX(>ml$bl$i@@nV^?NmW<DE!!ZNC3
z6UtJ&HyP&L{O%y{M}&rCi=+js?#OxI+@zM|11;d6iLoaf6&0mrxxzwtwSsY);S^?e
zo+`HgTNQO*6si${uW9FT15r-zEX{Z4w5}Ktd6e9x)Et$$;ebr@PVf7M5dQ-VQN@Ow
z+XL$38Co{ER<b_TLD*wNsl`Z;gqGkr1_p-z8Wb-)tbje0dzW!{t}ke<4lcDC=-^;u
z`;+td+Uesww=5<yJb?L!L0nbp4t1F*u<46pnyy2$*73vN0Cp5e%v>{}6GpuEL$~<-
zHXH&LQ)2Bup_1Hvy?e(ZWTe^={Q<UcO7%ia%ar=N=X5a9T3=9?1FAh<a-9J$eY=B~
z|FaQW!zi0eg%6mh3;Pn`UO(QWMHMcx7nJSTL>+5mbe`09adAP0OZQ|5<o2|h6Nl5>
zU^|K6ecKp5xK<lR=uEuzg;*i~!9*OHA;@J^kK^DukO9El*!jrJk}v@3S0?6I808V_
zxXDQIQ@~Yw69=zf@#Kpz=5c=jt4%ZOeGqpV(h0B}R6?J{jpMm*EUwGm<68H32Bo>|
z8#qpd%FHQ|uIivQuEGaGxgiI}Jh@ocl!?CSp^tz5n)xHr>}U6H#*M0_k?LT89QObg
zh7(jC4DRA`vbRTXf4-8N^XTa8y}7x0ke&3otjp&2oW8d?KRg6O=ETX7_uUCSvKisc
za!N4AkHv~vfeuv$XhfX0;7FGC#>XavCa$Z|C63FM;+)W>C2dzyA@ZVN$kO1$AEpN3
zfoXJ2SOo))Hv#ux_w`32VgWbx2riIZ=O4gcj0^osDD7bO#O|BriN<1^ONwgy#>06t
z!&VQ5P%yPz^259u78Y^{^v&&U*TZ+V4e#Nl8VlnA7>v&K;yY0X2Z!8b&@XkC^Y7(%
zb14;}hJw%GUIvWLp`O=9`Ds+=kACR~vSPvxN=iqWW1Z1Mao8tf-gljgi&zf>PZwod
zAle*|GE}CZ?|V+W_jKPKR$em=61wny%>81N({CVyo}9clxt`0|8eAk`)U9V^g@Vog
z)3amA;BCcM(2%m@)J1V=yJ0O5_IV@x>ed3D&5bvvz{|D(4_skLjW9RTg^K%K_P)~1
z<@ijbLT^G;T&vndq8v|-f*d%%m49xLS`UFiz!256NNMR3hnW#}gZ0e3b4ewqaP=i_
zc$hPd6|orDE)Ez*NasU4nXd@CJ(*8hCg!A|1~;tx5!E|vp!=riO;4hVAOz|-nT8zn
zLY%@fa;NG9_wAin<AE3wNg%0nhU`Pm!Adk@?p&VHte7xNPgM3Fy{}UenAGCk(4!5o
z@~y8C6qz4j`|Xgq_YHBjFht?=x)DKJtkBZjQ2;hNB{;a}{}p4T;Q|9i>!eAkZA*Eb
zpiAm^8PoNmZKZ-KfGp$+@0I6)3PBc{LdL|zz;NrjSbQHHeF{R2CrWZaAEh&r@~`B{
zK*g!APmGe_qqy1a>+>C-dVKL7(<FBvMWHI)!<m}5@xu8Uy;{>}8!Y2GA#CVPNoV*|
z{F)kNMqF8jFZ49bNvZ<BlG>DX0R#5R+V?U{rxC^tLh4YCl#l&F_s`dt#lBConuC{I
zMzkKWOV3wq6?#ZF?X%mhg|qqhjY)DtDpvl7cwi1Ub8~Y%pBxU)K-QpT)B-8t$LmH&
zKV)DcZ6;s7^BGnKlQRrz2JWHU@H!#w1cM+HBiJ~{-VfMXW%fC3KCh+wUy#UU2SVB~
zM3lorfaB7Y1*@eRmzsC6X?z03F~;f{-|D=`0zp%E&?OD_Io@1KU7U8S>Ry$3WK|u`
zZNn=EvuAJ%D2IBi2Tl0d4nu;lB9xOaP|uQOCwD>XVIb7nHn@@&`y9h-*;e{nol;HY
zHq)NvFpzYwDBw4D7WsapOXOS(6L;Ag;IMpOT@BpMpDlcX6*nRa%*8~3didPHay*J?
zeGBO~zXI-8YV(Wr?c=mJ|LZz;R19h0c;)!d8R7LXFjwn#hn2g<um4u(d0|SW@uafF
z`dld&M#RYxe#PKFy{qMHd_H)E{eVj>GP{#H_j4k}?w3%&2J1}ce=G#C4?)_?3|+G1
zB>)9<l*GdhQJ^{?Q#G0wUMqwPMb*YW5F`D>(#VX6`On3;6*59H&=90v;hmH{Ufk|5
zF>2{cH5y!li<#o0bS4ll>B!XUJ#D9qBMBgdVF`B|Lp}fj6czD*6UFH<)g65OQiswt
zqJ0t5mvVr3X0X@Eb<fY0V%|IQk|v=p+r1YgYzA=i$u$ExxY_sUOzhVg&C2_yZE0ND
zO`^)?VP8@#IZP%fkI#H#MjH$)Wpjc;9Rj#ma?lTbYwl0KF#@oJVQwFjFxA%t=V~xS
z(8QT8*b>L`8NSaRjv@WF-?%a+3zS8qBm+6pg;tY0w;25p&6j0l1e1zMVUVb{g?WF!
zy3s~a&^ZI0+-33JlWU>g)ZTAqIEYF~N#z={5H$iZBz*8I7cCfWf)BaF!M8XSl`B#?
zcjQ{q>KNy%NIMs82yJTun}eIqFm@EYLE&;i*iaKQ_kwl!{rv+*Uv?17wc1yGYtmYl
zx0`*h?#MR_r^3iQ3-hduifmp@?od2VDjMcq4$sfg6Mgz#gv}34#ZM{kW8m1iYbg6j
z`JQ0>D8hv&M@OSBIM6tsh@TKy8B#H^A`XMmV9B6F$zT!fX%9MCbn8bKChS~k2~HNn
za#cnMhTFwp$(F#ZXyIi6;R3Op^{pj!<Z9|$y{195Na1)O1r%X!>kno_LEFSzB?`e|
zLs?-GH2h|h)`$%tJPZ`890A4%MbCUznd?7c&UgQin9t<}#%m<l)Bv&m1>P*EPm~=(
zh%QxHG;#j>a0CwYmYAlrF=;mYda+OHj<2*N2aLZhEJFjhgAU&CT*fkOptK%+{Ez{I
z`_KTbQ5RIa;2o#u=7A>aP04!_+#8!c#P~F{UOeW8LnpM+Hgu><qK~W}A7Xx$->Uuu
ze|@?LvQ}P)Bon^*dO3f)o=){HJ$SW7rUfpz{EU3^@alkz1vL>r$Xne$3=IthsZPt4
z<AT`Rh4qAY@BCy~*aos)-G>YOW#7?}pM&xzFhkg}w)E=)l;TFIU4~ba5uW!^z(aVD
z5YhlioRGx0sT+Pc>N25t{C{RDvDesDdw={9BqdLuduMA@d6ke?_JhBRUTWHHBBb)|
z$Nf`l<;v<c1Vy-@V3<t0>i8|~>#oSiZ&mTcsJ0nX*!`#`Q}i^sPv<SG*<rE_UDi6O
zipAb+W+a%j^V~6N;=R(i@dUFH?MyN;YF$g2BYQU{8*pM?Mbt)um@ZAL7NXs*&mzwO
z=G@_esgw$WE(63G6gesk_~JaMFE1}667;wEW)U`v*d8;82~yZhzbr0TA7dyt;zGI=
z9(`VCoQtc7Z{rUAIuRFP1~_6-0veo!MP#i)gAvnw$b--3S*LMk%6>O=(c;>C$A~=a
z8>Ug-+LkwGfEM^BdLzSC8f(a9yyMuZNP<ibE8_`CTF4wX&-vp~!4OkJz!8&;nfaAh
z0HiuE26)tH@|1<-;t{3WB#5BJ-A&>Cp$`c%h=V)GhAhpWxk`>nDSQ;wpo`*;8`6su
zzR$-bIyeg+6AQwN#0rWnbYVxB==}=CB;y$l+{;_kR3*8nvAn02o*+$(kg;Ibg`MW4
zSfpUIp-XX-L#LSLsT=3Z!IE$-VHUWk9^TmQWVE=F9^eT=e4^e;XtH&C6ZK()AB%U&
zZW{W+-h=%Io}!r)JP+DN{)}Fk-fay^a8O4Xe0xawThTGTPX)wKZkGif?%8tksR%N1
zIq@3istw5^6O)n}e5PuKj+=+>+7o6)1Q?J?_)2to-C&$5NH-6FpE@?*uI~aae?@ce
z_x<^FbGdx;?d%Oo5OoP7M%KIkf9)YcL5d+B)j!(-^qfn~0f30+zdXb&6k9#bw1JKb
zy#bsRC)==O{&em?Q3)ZrW<|+G3hs~~Q+P@;c2aF^;(%aDZEG(xgT^ErtYwH+uNXhI
zo2E(L=8q*&wO(j!l&tB!Qc+`xL*6@XCsi8i*dNiR19z(~8XHabiZn4~9Csf3>)x+I
zR>%F>)fb}zZ*Py|?&FW>YV697J_hfQ;l#xK_Ass<eMScV?CA0f%qU5ou@*i>sIw5(
zM5Hp)<TF!Pqmcddbbz8lR1i<t+972B8lO54enXq^o?<?zUFXwmgVWBGXr6NVtqx1h
zgiD@s+y;59Ru8UW>Ro*P%NKf~!7M)a%Cz)!uWIx5WrAx}3NI|ewxlE-xzRhcA(X+z
zw|Jxu=wF4BgL&fSbxZ}fHND4(ST8YY{&`W4o*xn(|A_<+Fc?%?vap>soN*<ivBkjW
zcAwDS-?Z_0J@KzKXM`IVN3HjbW@uNxNK0(y4J!0edKuPqKr5q|$5asu^b(hgNUP1(
zlaQKf2vO%>JX-&iDhMi|eAh98Vn|k20#fXb!zejTT(Z4;EIgbGJ>)b!G?OhwfApjE
z=xT7!-46Zuga#C|PKg<rD=nMivRPJ4aLmM}9r{h*WSLYygk8E4yE)^dnPtEYh(GLM
znA$Km$g#Ec5!6W0xq3br$CK|Mh-f{+z=G@#9l^r#r*!W=s#V;|n7<}--Xu}>^k9>Z
zF5T&KfFr%0?V47ZdT-D_G|TACeiJ<0V+ex-sNg8ibSX3<(0fsBZ)9&^*l!+tdU_DH
zF|izL1|EE0UK+5cyi=`Go^@>=N2AQm!$}L_aO$jzs65SjU?X4!dDuVR2y?i=MstFl
z2NTx5w{=<GLYX%kID7OT(!P&70OB;BK>;O+unql_J>@r2kwJZAoTgfnv@psl-BhE8
z{;7klQ=xy`=eIr^>0#)JMp7getFuP-8D7ubgmtF{(Uw-s7y)KdCnJ07it=Q}`>xo>
zVGfuAf{uiSyh4QU2~5Z1@-SjhG5qsXraEQc3-dI6A2V+tDiR!!XTfin(UEh;=tcmE
zW3S87rO755cin5BxZ_3kiPa?R$*=+MLRcX0=uXI<^LbRD{USwli?RTtvuN>_Df^(#
z(lpzA+dUc;ZH-S??e+_Guw_p&#NO%^<rRE&==?I|kG``B<}Dx?If+&b&gRYUN1mmP
zZjkVMIC@cs!rpQM-T_T|_L1hznslyN7f)_cK?Y>t^j|#e6W9C|x0J(^`Vdu1o!CLU
zj<z1?o_f5+{$`o_4IBT++o2wxrHc3nrKNLl8WAckmrpmP0rD%WBai?*t@EIh>dkAa
zzWneVUA3yE!%|yg#sw_c)J^)B`cqx{C(oq5^<7A&+xWr8O{}0Com{khrt=&8wh?0t
z@&k^c6T%J6$9W}8^FJ~8O&O@6b$;tmUQQlqi;zB}G3D333UBfSjums6O!=qM=Q43A
zwSOQn`XXY6f*=9khWO%FwSAWEUO0^#s9(;~2t=oRcef{!l9Hra<Bmq9@J1Zp+4nWS
zVGx|i;)RoelLjggjLZ#fTq4Ji7@gdV=-`dslpUDeizw(Z)ugoI5w;O>oh)@@1}8lg
z63IwNU*}Zib2X-xi`rHi96Cg+J>$~m2RQ{HJ%v)j!Pi<U*V3j(-MyQ=llwVvt{nf)
zk3;7|t-OBGR*3T&m>liRWzoS^_{M3&6ss8twRmY_a@=i^So|tKe=GJ3d?ZnVG{?0I
zRS}*eI&17N+#oTC{2O{#7fu%G1B7FkKr{KtY<L!G5tne1b<W{kAFi#h6pzx&eEb^v
z>Hhl-49Gx6<k3s<dNipZY&b*$Z&gGqI{eHNQP$f~V^n|e0R~gfc1~rg#L{*CkpQK&
zBz>}@<HBy(rb)$y=x;$B0`N!N4Lw=BEPu)R3aVA>FlS_s^GW_q?hCJ7lMC)O02&XM
zMZ?OuMt%8nd3jkK5(;fyJ-I>i;)KKyg-(xOx#|i790QRW5;gg2eWB2;%7-0xPxU8@
z9&n@gFmc?rYYIJnua|i}v7=lJtcI|djiD1{3^_5#fHbZ~i=aQ_xBUaJaXomWvN-#(
zJ$sdG_lmnu8c$Gh{QOgumRhy^hDfhXsGXArSE)Aw#-dO_oH+E^`?9^Zy@CNeR`8~b
z*GScqK~ds;{N*LOJfz*Kl?bH{p27+(X!3y{{+Ey=qSEz7m_{{47#0A$56x=FQP8yJ
z&u8y!(C%(0@%5M0dEqa=4BBf4sK|KIQe}?Hq~IYja~{ge%+7mw!>Ik1rEJ~hMbmFk
z07EFALS#KdodF@#qE(;*i$~YBj>Qjzy~}Y{Xklbb@UAHpbX<>Av1Z*lf%kUA%$|VY
z7LKinQIgOLzAPP2(?YiK`l<~)FpKn0KN34h>9MGtp--|iBzd~CCm1k*iExP(j`ed>
zcm7mq!IEvgCdW&5_;T5rEFvI{`uzt@VjezZlu(&!heUZeky&Ne$`h?I7G5A`RERPJ
zHOQK)U(39Kc~&NxXLJA;{m1Y#7Ciu{N*10;pXB@M?mt~+@hxEfsT0{IYZC(KVxV_N
z>H_wM8n*mbLQwp>M~QwtAb`~i#CP&tr&?b^p9f4`&=_=8%l8XH0AQ#qo4q`7&Sweu
zcr9nv_e-A{@=#0~JN>Zf_%MyfKg%@OrXpEi5jwN@!IlQK8_w1~&&cyX7GQmaAUg^5
zq+#FBFf3~h-#65#W@$acfN>TDfPBxX_Ajq);v=vbzGeV86qE6u%RG#|@TtIobKe05
zNSFWh5c{=*LZeMt5U|H$d{k>=DjfUasFdr1)JZk!6<Wg)0hi;%SgjV2|AJ@I-1@A5
z@GI$ipoEe-eUkKv2fm=SmCPO8X*=0lomuw55+}JG`BA7Y^;G7@-gI;GAl9xVWW&+S
z!vlAnIeTq=O#)<P&D6$snqXieI)U>KXK9F5o0n^O0Z>tAhk?(mmm3p<KKz9}g0+Ho
ziW+`$zncPt^~N#5FGe))klXNjyD@pb)?ziXKQ=q}PUtP+iCkcMcbBToe8R@c);3B<
zR~Ki7FJjZe+`Oc?IP4B>RZ3sqM&`-c$9FWH04GUSkVHsOQpoGUxY_^BkJsyl*45p;
zcn!8&L1fk(4Xhdy{&u=l^YvPRYo^2Jc}L?xCbz9kfS{7<YoKJM?@6+O^+nu!jz4BL
z4lMdEx1Vk_9UkSp-h|e~5J<fS;c#e)z|MIG9gjaU4%e&v=3aICU#Gc47H?&ZVKHy>
zWh|_{zAZ1W3}4XM6FiZbhC!b!R2BQbE%;OJw;XlBU^E*+(=QSJkcfk)F@3$AFjUHU
zoGq?+*bDtYUj1Q#RH}>dz_<6$%dZ!uID+JQazmlV2&KuLSRqB4Y~JrBc?+u2t`{s^
z*Q-q~Uk6CswcJy(4dnrF(`7fh=#{90-%Q5g^W$}?14}6<;AB4}y5Z4tz8IPdGAMEU
z_VD+ls`!)5e4#I5oB<4G^~l)C>1m+?5m(Z|8<bZ08Y_q0a^uvviS%shehlT@x9}e`
z)1>_YNofIA4h}RM+20ckR3SOm;E(_)VDq0nu*4r;akdo-wXZv-HWYfEYg)q&rx>R*
zdv%#v!33O{hZmJPb>HG+sElTQm(WFb0{bFfjN0O}QD@yr83DT&E`j$}3i9%cb6@X#
zKMuiew^LT9bpqyCOa$ra>G=z5^(isY(JDV=MnnqEI<b+cthhl7^dl90!VXI{VOmZz
z^8w)x7i5jGoVJVLJ|h<ZMk^Of$oGyhOVIZldqvt0Bvzy+ynQjR7n*@=R6)KK7_M`U
zFB-ckvTn?Vc-P=28T%9KxQD`fJ9CW8!fbzLs%HmyPUuVir+ci|2@KTSVN|#2kVVGy
z$EK}zCiMCL`=#OG0dP+z066}$Z5SN}2Iw?40swAQQ~(J3e>C%dT1gpi6)IT=pR8zd
z1_QMdYWGWKQ8>>~F?PUlCy5&vvY>yJ`18o9@=#CI?!7-Zy(KX#I8oJ;d%ryZYPt3Z
zdAhyh&@uPw%l5*lClh23>e5afE3q_<B7rc|fVaeij9d_Y*ZtRf<%Q+CPi>0mbGVeO
zX#A5dMUIcJETK5?o1WS4L_ZDvI^?-ZuiXRk3nuU>yv9dIQH$UfE`*xw0f;C3b*mfB
zThFzQ{IYlV3kcr&dFk%<$L~Ly41piBN>2X1xK9K5L_7il3RV6+S+m=opJ=)ivv|!o
zwkm^ztf22VoM1|95eH()FvM-w{Mp!QS_kiNDPBL`1~UgfT{J==#`hT@A3n}Nop<cO
z1LQ4e=WowOEdN`I&eTHAq&lv9q+OnF$=uM4-C!eP9Erwf1*ejmwH|9@+wyd<c(w5#
zQ|m3|qiw^Wg3P7SI=pTglRiPE{C(Q3v$L~Hv>Kc319sh|i^#>H{sc7a{Vs8vI?cdL
z-aI}!%JYS}SJ7P1nSR}#v-$b520?gLQ*ToEO=)p<e!QWM+vm(-(E`;>iDQo3NlSiV
zSWHTBD&2+~Rc|Tp8kWBI1EFX{$A9^#DXQNkt14T5Wa<P=`e$!&>*^Xlf9~X<qk)mQ
zFtfHs-tr#>Ls7MY4`dDH1pGB?HZU4-3%@}9ukG#x!1hUWjmLwYyS@+j3k4&6sWQ)?
z(56Yz?7Zt14~FW!q_tV1RU1>8pZh&a65w3u*5(G){1sBxY2QgePSJGgnSxdJ*B+tW
ze^aofx;Xs>Zpuac+1sHbt3M`o&hEhA>u$52CNTvu7!jl)UG=uRnDB|%Oi*a_+p}uK
z^2$o7I{n<UR}(ze+u@YT@E45)Hm{+DK+1(3lu&?<XV_~TvGe-$Lf6`Xp=#_4dt#{?
zEC_@}z+wcj6=XwepWBM=MZpGVDE@-%o&Vo}lOiLWy_*Q?q@Lp&2^X-0)_}`4!s7;d
z+<cvg#bIh~Y02O(vR>9>2xarL&%F6v-xbIWe!9qoQpf9E<YE=h;M5ms{w9i>B&FT)
zADSumgJTok>3nft1?Y)HmE190EA(||P732f2}It<{H`>Ub67_9*nZ`+2a-%Xb!1H-
zxwdhUA(As%oin#jN|i*y6;k#CMf45=DABUf9oERvKdQmSC-*seTmXJVF#mtYhe#2)
zcr>`sj2mEvgO76-Z-t<vDsPf@B+?dxcH6y(=Ic8GFbreeB(2x$4GfGUfJiusa0mTg
zWAOj!Nb~<|%u>c{{YIIe?#V4VE$78`QWM$JCI`(5hKt+jE0C%QrXBF6PBSO@O-O>l
zTuc=3*i~EulxbG|sITW7t~F0L0j{_tgk_?k#e*R$AvUrs#Dw70p2CbnS!kG4iCL|p
ztyLjMvZQC#9;Lx(^t;T=%vuD<Vv(P7tEOrch}S^3_iZu=p`@j(>}NuR=AntDorT3?
zb7$W_O!9sNf})Z%aq{xgBfSj|-_Qx&hM4(s?U_?KsA~unfX#0kuiPd0)zs7?j&2Vq
z-*<~&loIA1<d6{v%M&T;urDTEP@-MX*n#+<|J!h$-~|(RL}PejZU`?;kdTmYm&d(^
zEpyhAP+lXS2gz-niNK*b?dU@VAbd$+YMbHt_oz6?YB6}Cm)i;mG^uAcpvAR?=N;q1
zo<*<=gp(8UyHVkFKi4}>!7g3~sBTguXbs68;2|k*{p<4LP)35a^SgAh<2gb~hL6Yo
z%HC2f`cX;d5SpFdv0x|Ubvq?^>G9sM>7bFbl`D#GTT*GnKaiTXx;xMu6SJ{f39dyu
zdfD)w5ctT=Ep1n}qUwZ!#{pKyi0bQVX=ypia}W}DXnV5fb^Ti#4V#}qG9dNUF8e@b
zTD#7APU3<t2BRp^4rfB}iLvcu?V=vbRLR}_*xP@q9o6weL`e`aYk&iZN1WeF#=ub}
z--d9DyP;A>)uQ|vB$=8ke@qxBA)yO<8QwwiC%*Gp@kC~Ij{giN3==HJV^RE??Prf&
ztiOM`+7;ipxTOUI1en7OQ+Mr}PG!v7M`5cKN6(dgzyDtWWeA%09`(Y73p6n?K^+|(
z_D09i03zg;oH}*NHpbYArwZhnJ3BjLeeGInI(zo4oh_2B-|}!k{Dzs?7;{PtV2GJ>
zE*O9ig?!Pt&*lQ`PvSJzV^P1oRtZhxETF}Z&p6I-IMk9yloxV<$N+|Aujxr*%7qF@
zZcD2YxxtacCt->w=?zkH07+^Sju2?w(8(53JSJnI#J991;NV+sIQWcXiG-Ij1u&+_
z=+V@7`v8E8u$nh|R57Wc%I^UHQjgWTXkR902g5K81^|E?NCHqYpo2<#-XWv)xzGSG
zC<efR1fXbMw688(v*t-sJQ_|l!2keA{}iC?lp7W8tH&ODY{n4%4h8^#I|d+{7wy~4
zK+2e3$h1JX7zhB6Qmn>hF`Q^V+70L%{+S8ZYA1j92>@VTMB}1$(R|qeCReZijWOng
zEDuck?mz$>Mu$s)Pl)Ct1Mp5BJUC8deu6vz01hMo$^0bHJb5ag&j*VF*!wU045R@7
zNF|ZBBdv?}IVuX0&1QQw)9;C>-Ia|&060XX=?P`%g~eiV)E3AJ$NWmZ!9<TLrR0go
z0|1aNv}jv29*N(6FZ`kXsuc~Cmk9y@QbV-dKh(GoECC4rVK+n1c&*>oTAxu$$#fuG
z0DyF0MAM>e(RiiiBLgtBm%Onjo;XcR-(+Qn|4vm%03gNqR?|%1v>M+_<qrP2vf%rJ
zFRaX$jkfVZs!N6g;1EhQE!wWsy8S`LlcdL2BZDKqG};tc3g;mT03hl3qGi#vXgkz=
zIl8~Nm){#q{rSp#Dx3qvR3HG!#?JMNrYkjG{^1-iQ1Ya0zv}y$Qr=ZMI7<tA1OP}L
zzEVnQ?LT(-%8_emKV34#Ki4>)X+Qaf)IW!nLjeFuBwYAswY=Yk{g-t3^M&|g3}#!l
z?@{G>*J`ch#fSm`NLKIfY2W|J;o``jhg!d6f!}<Y{-8XVXWoZJK>#EZt6k5$Z=t3A
z^BI8c@edz5{D?7nK%B%FgLMG_BmmKBpjka28V;lPIrY2HT)%Y<kJLYEW1e9Z>?2&c
z%LV|{0V7%!&5CvxEB3pP0oYAK!^6Wz4e9qQ<zZa_0P)8ct%_zvyV0hf`JP<OJiiSe
zw&nVMpp<tb5`qB4Jn^Uf|2{lCa??Vge?&FQeeF;{EB|f@E5f5{v0WH|cwviribh4N
z)t>WFjRDx9!04gTqS5AWmEr|M3IIS;(4tMzsAzSu&_ANu4L=e_v>YiG2ehxhq&%<1
z7!&V<-vMw0V@ydjDcTf`idL)L$5YFWKRY$po>~2F?d$*XJg@3M0svSse9@w4QnXpk
zxWAHGH~ZMIV*B>(SIijyr%b#hTpxf{f&erg-`4pjb95DZyAB;X^klW6f5cLD`&ozS
z&E>9CL<M5%2<r`@egFUsPWq9d^O`6>Iz0TVT6=$5qG)Z8FMrS&a~l&yxd0>v0cZ?X
zYoa~T;8Mj;%jmUz%G;#icgfdxFx!~{Ob-Ik81c&iKT5P`HJGnH={K9DhwTL_Q9j=?
zGBWajG4y7MMr_qFL;?V;6k0T9BY#707VU`!trnNa@+<z>3n-NO`ulDrQuoOe1QLS)
ztW3g>?2uc(eq<;Te_>hE@%1VBB_T+GN?WtpS2EK+X6`iFl!$F;0svSJhDxkhI@WW>
z(Cy{0e;GZ0M13;%_CoSDC!kvB1|mA5Jk>&2ECj&vu#0?@bfiZ_TUPwEys*ELdKdk)
znaEr&w?#AEtCYIV_kCM!7zIWFs0mxY&+|Mv(Blzh=&o>g-;%QZ^HJ})dpkua7uwdE
zx!L#i7sFGABx`|Hg8)=RpcSd+?TLm&ODiG%l`Q*RUX9e(-+z}O^I65*<NJOoOk|+k
zH~^PoB!O<1_8Rjv6TfR@Xz1SXXDhM^ZzY8o9X;-6v)S!Nsn0Rf%Vp7^)D#Gf002PG
zmGKIv_`c6tzq42@9twMXy;9Y<8qpJ%!<N2W?(M|%5oTVewT^0(!w7)O_|j1-rQ}rZ
zGi2z4Bg4aA2!B@hkbgFf3dL=iae4Ia=<V}#>xYTV8^!IkuXT78*h>IhLW?4lr&O?&
zhQH>k=?{$#j*f)7Y{;UzMvukIj+Wh#y}@Yp0cN^h-oG*S1S0t)5D|bh;|EK5l`XSt
z3_Z+Bf3!GQ{9&Vd{YsjVjEklOgJD5`|E)yy9%kAl|CXVFF-BMHF90Cvn5a!ls2_ZT
zeo92292pvVAbd`AWOqY1)iqOK7bQ2g<#M+W(>s{xCOb6H+9pPV5`<Vs01}6h_ATMP
zB)sLYZTWvg^aC>V`NPA*2WBVBn{knG=wUAkdA8<qyA;z~j4^wZQkTp3tQnB;?RKN*
zJ}>~{h7LM+Lrj6_?KibP$;{u<hQ4xScvyOVYDTypR|A+cBFJX5&nHE%Hbl1>LoZWG
zb;$Rviv~z^5G6~Z2LO%2L=QoFd1;Sf#44gc&rCmNqWekHcZ$X0AL7vC&nAwdxhO{<
zgfj=biRcx^=v~abnPn(t%7$>!4XJovv%dmR3ucb5<qpSgffvC`Q`EK{9%EM0!++0L
z(?1F``qa!Z{$j*g7)*Of%|6q7=gysLrlzJ|teLMi#=Mk>UPMN3Wu?|qP?I3ITY)J=
z<^aIb8X<=gnbo$8*3S~FBSiE&X8wgT=I5DA=C=nA9vrWDxuU(qw14Fm@}$`SDpC1-
zUKI)jGdpz3OHq>J$G3QTrk{-3VMzBAsa`T>6ER5+p^J#x!Uu8(pc*t0O@@zW$k0h*
z9wXADOlpW&5Bh4=P~XOlM+=wk$M^F2JQoTD`5m$9?dRhE0dRH^#a{OPV*mgE07*qo
IM6N<$f>k+1jQ{`u

literal 0
HcmV?d00001

diff --git a/envscope/web/app.mjs b/envscope/web/app.mjs
index f756bea..9ce71c6 100644
--- a/envscope/web/app.mjs
+++ b/envscope/web/app.mjs
@@ -9,6 +9,11 @@ import {initTargetEnvironment} from './target.mjs';
 import {initWatchdogForms} from './watchdog_ui.mjs';
 import {initCoverage, browserEnvironment} from './coverage.mjs';
 import {initPermissionFlow} from './permission_flow.mjs';
+import {mountIcons} from './icons.mjs';
+import {initWorkspace} from './workspace_ui.mjs';
+
+mountIcons();
+initWorkspace();
 
 const byId=id=>document.getElementById(id);
 const nodes={start:byId("start"),share:byId("share"),checks:byId("checks"),quit:byId("quit")};
@@ -167,11 +172,16 @@ async function runAudit({oneStop=true,phase='check',checks=null}={}){
     }else{byId("verdict-note").textContent="当前仅检测浏览器；Windows / macOS 请使用本地启动程序完成系统检测。";}
     nodes.share.disabled=false;
   } catch {byId("verdict").textContent="检测没有完成";byId("verdict-note").textContent="本地服务或浏览器探测没有返回有效结果。请重新检测；仍失败时重新打开本地程序。缺失观测不会判定为通过。";byId("session-state").textContent="需要重新检测";}
-  finally {nodes.start.disabled=false;for(const id of ['usage','enhance-cli','workflow-proxy','workflow-proxy-url'])byId(id).disabled=diagnosisUI.isBusy();nodes.start.textContent="重新检测";byId("audit-results").setAttribute("aria-busy","false");document.dispatchEvent(new CustomEvent('envscope-audit-end',{detail:{has_report:!!lastReport}}));if(!lastReport)setFlowStage(phase==='recheck'?'repair':'check','本次检测未完成，没有据此写入配置。请重新检测。');}
+  finally {nodes.start.disabled=diagnosisUI.isBusy();for(const id of ['usage','enhance-cli','workflow-proxy','workflow-proxy-url'])byId(id).disabled=diagnosisUI.isBusy();nodes.start.textContent="重新检测";byId("audit-results").setAttribute("aria-busy","false");document.dispatchEvent(new CustomEvent('envscope-audit-end',{detail:{has_report:!!lastReport}}));if(!lastReport)setFlowStage(phase==='recheck'?'repair':'check','本次检测未完成，没有据此写入配置。请重新检测。');}
   if(oneStop&&lastReport)await diagnosisUI.prepareWorkflow();
   return lastReport;
 }
-nodes.start.addEventListener("click",()=>{if(!diagnosisUI.isBusy())void runAudit({oneStop:true});});
+let startingAudit=false;
+nodes.start.addEventListener("click",()=>{
+  if(startingAudit||nodes.start.disabled||diagnosisUI.isBusy())return;
+  startingAudit=true;
+  void runAudit({oneStop:true}).finally(()=>{startingAudit=false;});
+});
 
 function download(value,suffix) {
   if(value?.format==='zip'&&typeof value.data==='string'){
diff --git a/envscope/web/controls.mjs b/envscope/web/controls.mjs
index 2d5fc11..9c158df 100644
--- a/envscope/web/controls.mjs
+++ b/envscope/web/controls.mjs
@@ -24,15 +24,19 @@ export async function initDesktopControls({sessionPromise,onReport,download,rete
   const session=await sessionPromise;if(!session)return;
   $("desktop-nav").hidden=false;
   let catalog=null,busy=false,lastReportId=null,statusRevision=0,statusPending=false;
+  let currentPage='audit';const scrollPositions=new Map();
   document.addEventListener('envscope-audit-start',()=>{statusRevision++;});
   document.addEventListener('envscope-operation-state',event=>{if(event.detail.busy)statusRevision++;});
   function page(name){
+    if(name!==currentPage)scrollPositions.set(currentPage,window.scrollY);
     for(const n of document.querySelectorAll(".page"))n.hidden=n.id!=="page-"+name;
     for(const n of document.querySelectorAll(".tab")){if(n.dataset.page===name)n.setAttribute("aria-current","page");else n.removeAttribute("aria-current");}
-    window.scrollTo(0,0);
     $('more-menu').open=false;
-    $('more-menu').querySelector('summary').textContent=name==='audit'?'更多功能':document.querySelector(`.tab[data-page="${name}"]`)?.textContent||'更多功能';
+    const selected=document.querySelector(`.tab[data-page="${name}"]`);
+    $('more-menu-label').textContent=selected?.closest('#more-menu')?selected.textContent:'更多功能';
     const heading=$('page-'+name)?.querySelector('h1');if(heading){heading.tabIndex=-1;heading.focus({preventScroll:true});}
+    currentPage=name;document.title=(selected?.textContent||'环境检查')+' · EnvScope';
+    window.scrollTo(0,scrollPositions.get(name)||0);
   }
   document.addEventListener('click',event=>{if(!$('more-menu').contains(event.target))$('more-menu').open=false;});
   document.addEventListener('keydown',event=>{if(event.key==='Escape'&&$('more-menu').open){$('more-menu').open=false;$('more-menu').querySelector('summary').focus();}});
diff --git a/envscope/web/desktop.mjs b/envscope/web/desktop.mjs
index 049e91b..39e2b8e 100644
--- a/envscope/web/desktop.mjs
+++ b/envscope/web/desktop.mjs
@@ -40,7 +40,11 @@ export function initDesktopApp({run,operate}){
   $('app-update-install').addEventListener('click',()=>action('app-update-install',{version:desktop?.updates?.version}));
   $('app-update-restart').addEventListener('click',()=>action('app-update-restart'));
   $('app-update-rollback').addEventListener('click',()=>action('app-update-rollback'));
-  document.querySelector('[data-page="settings"]').addEventListener('click',()=>{if(desktop?.mode==='native')void run('desktop-status').then(v=>v.desktop&&render(v.desktop)).catch(()=>{});});
+  document.querySelector('[data-page="settings"]').addEventListener('click',()=>{
+    if(desktop?.mode==='native')void operate(async()=>{
+      const value=await run('desktop-status');if(value.desktop)render(value.desktop);
+    },output);
+  });
   document.addEventListener('envscope-catalog',e=>render(e.detail.desktop));
   document.addEventListener('envscope-report',e=>{
     report=e.detail.report;const a=report.assessment;$('qualification').hidden=!a;if(!a)return;
diff --git a/envscope/web/diagnosis.mjs b/envscope/web/diagnosis.mjs
index 2a4830e..dc9de31 100644
--- a/envscope/web/diagnosis.mjs
+++ b/envscope/web/diagnosis.mjs
@@ -41,13 +41,13 @@ export function initDiagnosis({sessionPromise,retest}) {
   const busyObserver=new MutationObserver(updateRepairEntry);
   busyObserver.observe($('start'),{attributes:true,attributeFilter:['disabled']});
   busyObserver.observe(document.documentElement,{attributes:true,attributeFilter:['data-operation-busy']});
-  function setBusy(value){busy=value;for(const id of ['start','target-edit','target-confirm','target-cancel','quick-proxy','flow-upkeep-prepare','flow-upkeep-stop','flow-upkeep-interval','flow-upkeep-restore','enhance-cli','workflow-proxy','workflow-proxy-url','usage'])$(id).disabled=value;for(const node of document.querySelectorAll('#desktop-preferences button'))node.disabled=value;document.documentElement.dataset.operationBusy=value?'true':'false';updateRepairEntry();document.dispatchEvent(new CustomEvent('envscope-operation-state',{detail:{busy:value}}));}
+  function setBusy(value){busy=value;for(const id of ['start','target-edit','target-confirm','target-cancel','quick-proxy','flow-upkeep-prepare','flow-upkeep-stop','flow-upkeep-interval','flow-upkeep-restore','enhance-cli','workflow-proxy','workflow-proxy-url','usage'])$(id).disabled=value;for(const node of document.querySelectorAll('#desktop-preferences button,#desktop-preferences input'))node.disabled=value;document.documentElement.dataset.operationBusy=value?'true':'false';updateRepairEntry();document.dispatchEvent(new CustomEvent('envscope-operation-state',{detail:{busy:value}}));}
   async function run(action,params={},confirmed=false){
     const session=await sessionPromise;if(!session)throw new Error('请打开本地桌面程序，再使用处理功能。');
     const controller=new AbortController(),timer=setTimeout(()=>controller.abort(),240000);
     try{
       const response=await fetch('/api/action',{method:'POST',signal:controller.signal,headers:{'Content-Type':'application/json','X-EnvScope-Token':session.token},body:JSON.stringify({action,params,confirmed})});
-      const value=await response.json();if(!response.ok)throw new Error(errorText[value.error]||value.error||'本次操作没有完成。');return value;
+      const value=await response.json();if(!response.ok){const error=new Error(errorText[value.error]||value.error||'本次操作没有完成。');error.code=value.error;throw error;}return value;
     }finally{clearTimeout(timer);}
   }
   async function action(fn,errorOutput=output){
diff --git a/envscope/web/icons.mjs b/envscope/web/icons.mjs
new file mode 100644
index 0000000..4484179
--- /dev/null
+++ b/envscope/web/icons.mjs
@@ -0,0 +1,25 @@
+// Original MIT-licensed EnvScope line icons. All symbols retain visible labels.
+const paths={
+  scan:'M8 3H3v5m13-5h5v5M3 16v5h5m13-5v5h-5M8 12h8M12 8v8',
+  guard:'M12 3 4 6v6c0 5 8 9 8 9s8-4 8-9V6l-8-3Zm-4 9 3 3 5-6',
+  accounts:'M8 11a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-6 9v-2a6 6 0 0 1 12 0v2m3-15a4 4 0 0 1 0 8m1 3a5 5 0 0 1 4 4',
+  checks:'m3 6 1 1 2-3m-3 9 1 1 2-3m-3 9 1 1 2-3M10 6h11M10 13h11M10 20h11',
+  tools:'M14 6a5 5 0 0 0-6 6L3 17a2.8 2.8 0 0 0 4 4l5-5a5 5 0 0 0 6-6l-3 3-4-4 3-3Z',
+  history:'M3 11a9 9 0 1 1 2 7M3 4v7h7m2-5v6l4 3',
+  settings:'M4 6h16M4 12h16M4 18h16M8 3v6m8 0v6m-8 0v6',
+  coverage:'M3 3h7v7H3V3Zm11 0h7v7h-7V3ZM3 14h7v7H3v-7Zm11 0h7v7h-7v-7Z',
+  more:'M4 6h16M4 12h16M4 18h16',
+  help:'M9 8a3 3 0 1 1 5 2c-2 1-2 2-2 3m0 4h.01M12 2a10 10 0 1 0 0 20 10 10 0 0 0 0-20',
+  power:'M12 2v10M6 5a9 9 0 1 0 12 0'
+};
+export function icon(name){
+  const svg=document.createElementNS('http://www.w3.org/2000/svg','svg');
+  svg.setAttribute('viewBox','0 0 24 24');svg.setAttribute('class','ui-icon');svg.setAttribute('aria-hidden','true');svg.setAttribute('focusable','false');
+  const path=document.createElementNS(svg.namespaceURI,'path');path.setAttribute('d',paths[name]||paths.scan);svg.append(path);return svg;
+}
+export function mountIcons(){
+  const names={audit:'scan',upkeep:'guard',accounts:'accounts',checks:'checks',tools:'tools',history:'history',settings:'settings',coverage:'coverage'};
+  for(const button of document.querySelectorAll('.tab[data-page]'))button.prepend(icon(names[button.dataset.page]));
+  for(const [id,name] of [['learning-replay','help'],['quit','power']])document.getElementById(id)?.prepend(icon(name));
+  document.querySelector('#more-menu>summary')?.prepend(icon('more'));
+}
diff --git a/envscope/web/index.html b/envscope/web/index.html
index 2941361..40d2ac7 100644
--- a/envscope/web/index.html
+++ b/envscope/web/index.html
@@ -7,19 +7,23 @@
   <meta name="referrer" content="no-referrer">
   <title>EnvScope — Claude 使用助手</title>
   <link rel="stylesheet" href="minimal.css">
+  <link rel="stylesheet" href="workspace.css">
+  <link rel="icon" type="image/svg+xml" href="mark.svg">
   <script type="module" src="app.mjs"></script>
 </head>
 <body>
+  <a class="skip-link" href="#workspace">跳到当前页面</a>
   <div class="app-header">
-    <header><a href="./">EnvScope</a><span id="app-version">正在读取版本</span></header>
+    <header><a href="./"><img src="mark.svg" width="32" height="32" alt="">EnvScope</a><span id="app-version">正在读取版本</span></header>
     <nav id="desktop-nav" aria-label="主要功能" hidden>
       <button class="tab" data-page="audit" aria-current="page">检测与修复</button>
-      <details id="more-menu"><summary>更多功能</summary><div class="more-menu-items">
-        <button class="tab" data-page="checks">全部检查</button><button class="tab" data-page="upkeep">守护与高级修复</button><button class="tab" data-page="accounts">账号资料</button><button class="tab" data-page="tools">工具与备份</button><button class="tab" data-page="history">检测历史</button><button class="tab" data-page="settings">设置与更新</button><button class="tab" data-page="coverage">环境全览</button>
+      <button class="tab" data-page="upkeep">持续守护</button><button class="tab" data-page="accounts">账号资料</button>
+      <details id="more-menu"><summary><span id="more-menu-label">更多功能</span></summary><div class="more-menu-items">
+        <button class="tab" data-page="checks">全部检查</button><button class="tab" data-page="tools">工具与备份</button><button class="tab" data-page="history">检测历史</button><button class="tab" data-page="settings">设置与更新</button><button class="tab" data-page="coverage">环境全览</button>
       </div></details>
     </nav>
   </div>
-  <main id="workspace" data-state="ready">
+  <main id="workspace" data-state="ready" tabindex="-1">
     <section id="guard-alert" class="connection-banner" role="status" hidden><p id="guard-alert-message"></p><button id="guard-alert-open" class="link">打开守护方案</button></section>
     <section id="permission-status" class="connection-banner" role="status" hidden><p id="permission-message"></p><button id="permission-resume" class="link" hidden>我已处理，继续检测</button><button id="permission-cancel" class="link" hidden>停止自动复检</button></section>
     <section id="connection-banner" class="connection-banner" role="status" hidden><strong id="connection-title">本地服务已断开</strong><p id="connection-message">请重新双击 EnvScope 启动器，并使用它新打开的页面；旧地址可能已经失效。</p><button id="connection-retry" class="link">重新连接本页</button></section>
@@ -213,7 +217,7 @@ <h3 id="timezone-service-state">尚未读取</h3><p id="timezone-service-status"
         <div class="actions"><button id="timezone-service-stop" class="link" disabled>预览停用并移除</button><button id="timezone-service-recover" hidden>预览恢复未完成操作</button><button id="timezone-service-undo" class="link" hidden>预览撤销上次操作</button></div>
         <div id="timezone-service-plan"></div><div id="timezone-service-output" class="solution-output" aria-live="polite"></div><p id="timezone-service-journal" class="note"></p>
       </section>
-      <section class="tool-section"><h2>维护方案</h2><p class="note">先完成一键检测，再以当前设置生成方案。Windows 使用当前用户计划任务，macOS 使用用户 LaunchAgent。需要额外权限的系统时区守护在上方单独授权；移动应用目录后需重新启用用户巡检。</p>
+      <section class="tool-section"><h2>维护方案</h2><p class="note">先完成一键检测，再以当前设置生成方案。Windows 使用当前用户计划任务，macOS 使用用户 LaunchAgent。系统时区守护需单独授权，可在下方“系统守护与高级修复”中配置；移动应用目录后需重新启用用户巡检。</p>
         <label>复检间隔<select id="upkeep-interval"><option value="5">5 分钟</option><option value="15" selected>15 分钟</option><option value="60">60 分钟</option></select></label>
         <label class="checkbox"><input id="upkeep-restore" type="checkbox">保持已批准的 Code 代理和 TLS 配置</label>
         <label class="checkbox"><input id="upkeep-guard-timezone" type="checkbox">时区漂移时恢复批准值</label>
@@ -268,7 +272,7 @@ <h1>工具</h1><section id="opensource-tools" class="tool-section"><h2>开源方
         <p class="note">仅经指定代理检测 Claude 网页与 API，区分连接失败、需认证、拒绝访问、限流及服务错误。代理失败不回退直连。</p>
       </section>
       <section class="tool-section" id="environment-tools"><h2>环境信息</h2><div class="actions"><button id="cli-info">CLI 安装信息</button><button id="device-info">设备信息</button><button id="browser-info">浏览器信息</button><button id="support-bundle">导出诊断包</button></div><p class="note">点击后在下方显示，不会打开额外窗口。设备和浏览器信息用于排障，不推断账号风险。</p><div id="environment-output" class="information-output" role="status" tabindex="-1"><p class="note">选择一项查看；无需先安装维护核心。</p></div></section>
-      <details id="project-comparison" class="help-section"><summary>与 claude-switcher 有什么区别</summary><p class="note">EnvScope 原生提供逐项检查、配置预览与恢复、独立账号资料、加密存档、临时浏览器、托盘和完整软件更新。持续维护提供基线恢复、单独批准的 10 秒进程守护，以及可授权的 Mac 60 秒系统时区守护。</p><p class="note">Clash Verge 置顶路由、Mac 系统时区服务和原版加密 DMG 兼容已原生实现。系统网络修复、客户端适配和旧组件迁移提供原生方案；不支持的操作会保留具体手动指引。</p><p class="note">上游功能核对至 92cd62f；随附源码固定在 870c4ca。各平台实现方式、需手动处理的项目和验收范围见完整核对表。</p><a class="link" href="https://github.com/qudadd/envscope/blob/main/docs/FULL_PARITY_AUDIT.md" target="_blank" rel="noopener noreferrer">完整功能升级核对表</a></details>
+      <details id="project-comparison" class="help-section"><summary>与 claude-switcher 有什么区别</summary><p class="note">EnvScope 原生提供逐项检查、配置预览与恢复、独立账号资料、加密存档、临时浏览器、托盘和完整软件更新。持续维护提供基线恢复、单独批准的 10 秒进程守护，以及可授权的 Windows / macOS 60 秒系统时区守护。</p><p class="note">Clash Verge 置顶路由、系统时区服务和原版加密 DMG 兼容已原生实现。系统网络修复、客户端适配和旧组件迁移提供原生方案；不支持的操作会保留具体手动指引。</p><p class="note">上游功能核对至 92cd62f；随附源码固定在 870c4ca。各平台实现方式、需手动处理的项目和验收范围见完整核对表。</p><a class="link" href="https://github.com/qudadd/envscope/blob/main/docs/FULL_PARITY_AUDIT.md" target="_blank" rel="noopener noreferrer">完整功能升级核对表</a></details>
       <section class="tool-section"><h2>配置备份</h2><p class="note">最近 20 份可识别恢复记录，关闭后仍保留。撤销会先停用持续维护，并校验备份和当前文件；后续已有修改时拒绝覆盖。原文位于 ~/.envscope/config-backups，可能含密钥，不可分享。</p><div id="config-backups"></div></section>
       <section class="tool-section"><h2>临时浏览器</h2><p class="note">独立资料，不带入日常 Cookie 或扩展。关闭后清理，应用退出后由独立进程继续检查。</p>
         <div id="param-url" class="parameter"><label>网页地址<input id="safe-url" type="url" value="https://claude.ai/"></label></div>
diff --git a/envscope/web/inspection.mjs b/envscope/web/inspection.mjs
index 4ca27fb..720e2c1 100644
--- a/envscope/web/inspection.mjs
+++ b/envscope/web/inspection.mjs
@@ -8,6 +8,7 @@ export function initInspection({run,operate,isBusy,retest}){
   let catalog=[],report=null,phase='not_run',selection=new Set(),visible=[],groups=[],source='current',initialized=false,defaultsKey=null;
   const selected=()=>[...selection];
   let selectionKey='';
+  const openRows=new Set();
   const output=$('checks-output');
   const button=(text,fn)=>{const b=el('button',text,'link');b.type='button';b.disabled=phase==='running'||isBusy()||$('start').disabled;b.addEventListener('click',fn);return b;};
   const operateHere=fn=>operate(fn,output);
@@ -86,6 +87,13 @@ export function initInspection({run,operate,isBusy,retest}){
   $('checks-return').addEventListener('click',()=>document.querySelector('.tab[data-page="audit"]')?.click());
   for(const id of ['check-search','check-group','check-status'])$(id).addEventListener(id==='check-search'?'input':'change',render);
   function render(){
+    // A native details toggle event may still be queued when a filter renders.
+    // Capture the live state before replacing rows so the user's click survives.
+    for(const row of $('all-checks-list').querySelectorAll(':scope > details[data-inspection]')){
+      if(row.open)openRows.add(row.dataset.inspection);else openRows.delete(row.dataset.inspection);
+    }
+    const active=document.activeElement,activeRow=active?.closest('[data-inspection]');
+    const focused=activeRow?{id:activeRow.dataset.inspection,index:[...activeRow.querySelectorAll('summary,input,button')].indexOf(active)}:null;
     const found=new Map((report?.findings||[]).map(f=>[f.id,f]));
     const known=new Set(catalog.map(c=>c.id));
     const items=[...catalog,...(report?.findings||[]).filter(f=>!known.has(f.id)).map(f=>({id:f.id,title:f.title,label:f.title,group:f.id.startsWith('target.')?'target':'measurement',why:f.id.startsWith('target.')?'按已确认的用途和连接方式，核对本次证据是否达到目标。':'独立记录测量来源和范围；检测目录与补充测量分别列出。'}))];
@@ -99,8 +107,9 @@ export function initInspection({run,operate,isBusy,retest}){
     $('check-count').textContent=`显示 ${selected.length} / ${rows.length} 项。基础 ${basics} 项，扩展 ${extras} 项，其余为目标验收及补充测量。`;
     const nodes=selected.map(c=>{
       const row=el('details',undefined,'inspection-row');row.dataset.inspection=c.id;
+      row.open=openRows.has(c.id);row.addEventListener('toggle',()=>{if(row.isConnected){if(row.open)openRows.add(c.id);else openRows.delete(c.id);}});
       row.dataset.manual=String(!!c.remedy?.manual);
-      const summary=el('summary'),name=el('span',undefined,'inspection-name'),state=el('span',undefined,'inspection-state'),disclosure=el('small','查看说明');
+      const summary=el('summary'),name=el('span',undefined,'inspection-name'),state=el('span',undefined,'inspection-state'),disclosure=el('small',row.open?'收起说明':'查看说明');
       const label=el('label',undefined,'inspection-select'),checkbox=el('input');checkbox.type='checkbox';checkbox.checked=selection.has(c.id);checkbox.setAttribute('aria-label','选择 '+c.label);checkbox.disabled=phase==='running';
       label.append(checkbox);label.addEventListener('click',event=>event.stopPropagation());checkbox.addEventListener('change',()=>{if(checkbox.checked)selection.add(c.id);else selection.delete(c.id);invalidate();});summary.append(label);
       const statusText=c.finding?.scope==='not-selected'?'未勾选 · 未检测':c.remedy?.manual?(c.annotation?.state==='permission'?'需要读取权限 · 需手动处理':'需手动处理'):explained[c.annotation?.state]||states[c.status]||'未取得结果';
@@ -123,6 +132,7 @@ export function initInspection({run,operate,isBusy,retest}){
     });
     $('all-checks-list').replaceChildren(...(nodes.length?nodes:[el('p',catalog.length?'没有符合条件的项目，试试清除搜索或切换筛选。':'检查目录尚未取得，请检查本地服务连接。','note')]));
     updateButtons();
+    if(focused){const row=nodes.find(n=>n.dataset.inspection===focused.id);row?.querySelectorAll('summary,input,button')[focused.index]?.focus({preventScroll:true});}
   }
   const applyDefaults=config=>{
     if(!config)return false;
diff --git a/envscope/web/mark.svg b/envscope/web/mark.svg
new file mode 100644
index 0000000..f7e3677
--- /dev/null
+++ b/envscope/web/mark.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect width="64" height="64" rx="15" fill="#202322"/><path d="M26 16H16v10m22-10h10v10M16 38v10h10m22-10v10H38" fill="none" stroke="#fff" stroke-width="3.5" stroke-linecap="round"/><path d="M25 32h14M32 25v14" stroke="#fff" stroke-width="3.5" stroke-linecap="round"/></svg>
diff --git a/envscope/web/scan.svg b/envscope/web/scan.svg
new file mode 100644
index 0000000..4f66185
--- /dev/null
+++ b/envscope/web/scan.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M8 3H3v5m13-5h5v5M3 16v5h5m13-5v5h-5M8 12h8M12 8v8"/></svg>
diff --git a/envscope/web/target.mjs b/envscope/web/target.mjs
index bd7d3c9..04f145f 100644
--- a/envscope/web/target.mjs
+++ b/envscope/web/target.mjs
@@ -69,7 +69,17 @@ export function initTargetEnvironment({sessionPromise,run,retest,isBusy}){
     const params={connection_mode:field('connection_mode').value,target_proxy:field('connection_mode').value==='http_proxy'?field('target_proxy').value.trim():''};
     lookupBusy=true;controls();$('target-ip-status').textContent='正在按所选连接读取出口 IP…';
     try{
-      const value=await run('environment-location',params);
+      let value;
+      for(let attempt=0;attempt<4;attempt++){
+        if(revision!==lookupRevision||form.hidden)return;
+        try{value=await run('environment-location',params);break;}
+        catch(error){
+          // Only retry this read, never a configuration change or consent action.
+          if(error.code!=='audit_running'||attempt===3)throw error;
+          $('target-ip-status').textContent='等待当前操作完成，随后自动读取出口 IP…';
+          await new Promise(resolve=>setTimeout(resolve,300*(attempt+1)));
+        }
+      }
       if(revision!==lookupRevision||form.hidden)return;
       if(edited!==editRevision||manualTarget){$('target-ip-status').textContent=`${value.country?'本次出口 '+value.country+'。':''}已保留手动选择或已保存目标。点“重新读取 IP”可重新匹配。`;return;}
       const country=countryCode(value.country),actual=countryCode(field('usage_country').value);
diff --git a/envscope/web/tray.png b/envscope/web/tray.png
new file mode 100644
index 0000000000000000000000000000000000000000..d02214a3649e6cd4a5c54a56400a5be571e9c078
GIT binary patch
literal 2751
zcmV;w3PAOVP)<h;3K|Lk000e1NJLTq002M$002M;1^@s6s%dfF000VxNkl<Zc-rM#
zZERcB8Gg>W$DfJgB+hr;1lNuo+)9W=G%d6Z`!Pye1WaNo13K6bq;1kvm?rI`Y}$qx
zU((p7{QwDQ2OBLgX^5t@)h2D^*NSFn1C*wuRYj|46LOQ(U%B_5kNrrlaY7tlJ5HQv
zuXJR~zW01Q=Y8MvKJPgPC{MJ(!9fN<!|D@S&^KcDCA$x503-lq{jg=r7EdmhbFGGv
zyId~$-h1y|E7j*p0I>d701(@_@n%SQ8<*l{ZkpE%De9F}<p5c2Q2+>~lslcSj~Ub6
zR|@}Rgd9J6_N-xP#w-wJ1CW2Qx3BM;Q0n{XY-X!z7@(BG=kuYyz8+8tAf%=mU>F9H
z$t1WCaJgLYdORO7jXgK|$tSM@FlV(vlmmbUK&)TCzRO)#_hL4i*`@0`HpVxq+i%|~
zwr<%%)~ySY)|Qr;_iF`!n$hk|HiNOT3-a`t)9To<cgV<xBN`zDzWVx8hLHO&efsGs
z3=T59`!2U@?+AuMH}%G%<IQcYYTJ(O{Eau?<hrh_)h?WKH9R~l?zrntv#}+hHuOf!
zaBukG!m*)*+9MPSZH~mER|9RW>O0^2t~oI|Ii~^6xe`JsDdnmuR=*1S`J3mS;~nd|
zWGE6=c0iy2Xira1M{g|p-#}Zd`q58*oUhR|O|@2pbFQQmN-3pYJA7ESb$0M@v{!{9
zk*_TV0tJBHSoEYd^VYzH5NfT7lu{Xnp_EeU<%0)Bb8Cx?#G?P{?(S}y^?l?^b{~yK
z_pa;dR<~^5W=>8{Dj~$09DE@Nmge5SZy#^#>Qs?f><<fR0R=!J(cVO$tyTT?t+)7E
zQ~P3KP2k0g7iB0Cme++h<huL%I;~ZZS`ky<roJtiT<(TVn>NYayLM?(N@&_@jCjk8
zk12%^0-;cdeEsgbMLL~!y9wC`0R8>_jQ02UQvi@0yA55}?%2IYI-O2PDM3oC??MPj
zDQy*{R9PM8oZBiw2pi#of>H{*ckL#G5D39{10ab+Lb606Apt;2ag(NL7#J8JGqDXR
zS?O|W2xF{jb!nOgLI~pVIBjZbLN1rv6pO{`M@L6f41kQs<Mo+bc9YNNLuY3vEd_v-
z5|mQBbNo0Cz4Avm7@HvrY9SRQ$mMc){FlE%JRZ-#yO`*@j)R8|A(zX6YII>bLjZ1a
z1Ofp(^x%W}Nm;1hgb*mD5C{ZFPj|Qa=;MzY9rcbFfPXUpO4Bq47owp#5I{#q2NnZB
z2mwvgaN^_%Jn*f3d2|V-3&z!yQlwHT{NT|?^POBws|X>Oo}R{2&peG}G6{#nQS==`
z2(sBME?>Tk#||98Vtz|01*gM-_V#vlW@JPYLihoI&2~}&5K>BT&P%F30E~=$2q`7n
z+uLCn1~S=93F2vA2qEzM{SZPF1%OftP1B(3Iu5^n1dr_B51-FhR0|4y%dA=OJOG8n
zh}a}HZnqnR5SXS3N+|}n?|`N;i=lqW1ezL~V7Gok2pW7o2qC~2TMz(U*P-kB%*;BS
zww<iizEX<J2cS$Mrt&7?_xtguS6+p~;jpzVmFir5eLap19fMk6CE}ceF^1<~cmYp6
z^ECW^f7vU{9A{e{R;rN6WYEyiu&5)lt6i1`EG8b0XGsIEDgf5ZQc6qOV7VH$kPS1&
zAf>F%a=Th1xMCodqe-hCfWlcOHOeZn)i}#*0sult-tJ39cEzH->FMbi5N7gsWdX9(
z_U9x)D$T^EQYoa<X=E}P+aB2pL=GN0gd4tcBevf<h&^}gK{}l-87Wqy{UvLF6>8qQ
zcP|D8HiIz+O=GC5t1C;bbGaOn$s~jj;GEkYK(*Sh7yzq*U@(YaFu0^;)8TOB%SyMu
zWFMfE`eH361ll5YSjaD|?^ce$Di*&lj3X?fwbb^P%?aAg2NZI9>$}(M&8s~j1kKIO
z%hrBPm%;hmUW%D~z`stNg2&?l08CF$<C$llh0EoFf&wKJhGF2|y?YT12CEibt|$OS
zx&7>xmfP*l$Me=RmPSyGB9%&GU|=(X!6241Kgm`i*eS;C3r)c9_s?;VOk-6|i`5i>
zg}8lTAT+y?ncrl!k{xRrfMVQ!AwF+C(@>DnQA*|4_GL}JE;pGe#_bFFJRt<lO-=B6
zy(><p*h-L@!j2Z>^QLL$V*;z*QuSA3WnfEL-t3Z@!rv{MpHF5AdA^;2EtO1FOonPr
zW~$Zxk~N^#WTw*gs|G-=$xNl~SA7+*%5sva<!Ha=DY0sinWYNF|G8960~X@*3vE%`
zm124SO3xcCD*%=7`AWCYoK9!{v!**kq=2~0=ko+}10TEG-uf?_&0_zfkKo$16d2P`
zI8N)CD_1U~p`ignh$TgY%<h)dd@(r(Aq0#u=(;|K&(E333b?&#ns|437|E+w;ViN}
z?sPiga=BodCJe){-EZ~9#HcTAkC)?_TLJ-Ovsvi64k_gvK0jZTmxJ3+Pfx=z3`|W;
z;T!kdgSxspTc=N~<yHv6@&GW#6s6SEbsgz+dWM@XlHZe3;{N;Y!)KR2!{H-G;F`5Z
zRRn-?xxK^Tz~GJ@3z|ToX>rcc)YOP4pZImra|DIY3n7qBrwJj1YnnD?9g5HZ$Z&6D
zIF(Ls`^y_|itXFBY1UDgQj$ugN}edQxcy2bI2Q9QS0^Ua;8$-YlarIz+FM$?6N$tW
z>+kQUi9|wZjD5g4zh&gZ5w(5WHd{6&rG&4<K7OTQcl%o@m1mQs4t0%<jj3cZ36IBp
z0YDZ2rHMph=E{due{;FrWN2uJa4u}^w^`=_?37B+8<Z+`;|oFv-ah)aG)$9djQt~#
zNSOWo{Tc<p0gy~4^LLNiJ^I1v)AarK6Vf_iX{Ta41vT7)Cxl>XYDyg)8loPzTUSJT
z2>=p_gs`TWUb%85r)lg-N-25#i6^8L)m1Cvs+DlgK`F&=fB!o%K0Z#pZqMsuXV0Fs
zd|#oLqs@(tpSWD^J?GAkuB)r_ikr7?rJVCMduG@$3^<)moH%(>{q(>AG&D5il#usL
zOiWD73k$v=Mm>?pjp5#2*|DxmymsWUv@Rg5rDOAj$K=n9jL2C0dZTAUNJV0iZ<o3?
zq5(j-H~erY5>{<p9sI?YUJ~=K%UIV`R@<P35Oc20932{xeH-Iuu%}x^qS5E=-Wy^T
z2;pe2YHn>&_wRea9335%3!TMZ4Q2jheE#|8@@K#Jx!Km)p?WriRHSdt;OBT`vIq$L
zx^Q?Wb7(JLyO!#z^LlaDop<ruciu+g@r|^rvy-eQ-;hiu)#&;2>gds<@|_dM+4%T4
z{C@uwDEZ-qbLU?yc9WEpxIQP^H*9G0yPS_1hVf83lkrhP(Ae0B?)B?cOKYows_nHw
zLV!#*OD<lxK$2Il!Zb~|-EPC{_5Rt&O+S6<(xuVGZjTZhcL)UlL?V%(=5X9AB;REi
z<_)H42JFNME0tbzI31Hthx1d$9K%$pL+8$&`)K|cD!n{SW)aL+64|`DLCa>NOw;PY
zd2L6}7>E#QP1DBCoH;W&Z}QY)_l7IIp1zv%h@{*;{tvPj9q)Gq2>$>8002ovPDHLk
FV1oZOMLPfh

literal 0
HcmV?d00001

diff --git a/envscope/web/workspace.css b/envscope/web/workspace.css
new file mode 100644
index 0000000..3341f5e
--- /dev/null
+++ b/envscope/web/workspace.css
@@ -0,0 +1,142 @@
+/* Desktop task surface. The existing modules retain their semantic states. */
+:root{--paper:#fff;--rail:#f5f6f4;--ink:#202322;--muted:#626763;--line:#dde1dc;--selected:#e5e9e3;--rail-width:204px;--danger:#ad3030;--radius:7px}
+body{font-size:14px;line-height:1.65;min-width:960px;caret-color:var(--ink)}
+::selection{background:#dce4d8;color:#171b17}
+.skip-link{position:fixed;left:220px;top:-60px;z-index:80;padding:10px 16px;background:var(--ink);color:#fff;border-radius:var(--radius)}
+.skip-link:focus{top:12px}
+.app-header{position:fixed;inset:0 auto 0 0;width:var(--rail-width);max-width:none;margin:0;padding:28px 16px 180px;display:flex;flex-direction:column;align-items:stretch;justify-content:flex-start;gap:36px;background:var(--rail);border:0;border-right:1px solid var(--line);z-index:20}
+.app-header{overflow-y:auto;scrollbar-width:thin;scrollbar-color:#bac2b5 var(--rail)}
+header{display:flex;flex-direction:column;align-items:flex-start;gap:10px;padding:0 8px}
+header a{display:flex;align-items:center;gap:10px;font-size:19px;letter-spacing:-.5px;font-weight:650}
+header img{flex-shrink:0}
+header span{padding-left:42px;font-size:11px;line-height:1.3}
+nav{display:flex;flex-direction:column;align-items:stretch;gap:5px}
+.tab{display:flex;align-items:center;gap:10px;min-height:42px;width:100%;border-radius:var(--radius);padding:10px 12px;font-size:13px;line-height:1.5;white-space:normal}
+.tab[aria-current=page]{background:var(--selected);color:var(--ink)}
+.tab:hover:not(:disabled){background:#ecefea}
+.ui-icon{width:19px;height:19px;flex-shrink:0;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round;stroke-linejoin:round}
+#more-menu{margin:18px 0 0;padding-top:12px;border-top:1px solid var(--line)}
+#more-menu>summary{display:flex;align-items:center;gap:10px;list-style:none;padding:10px 12px;width:100%;border-radius:var(--radius);font-size:13px;color:var(--muted)}
+#more-menu>summary::-webkit-details-marker{display:none}
+#more-menu>summary::after{content:'';width:6px;height:6px;border-right:1px solid currentColor;border-bottom:1px solid currentColor;transform:rotate(45deg);margin:0 0 3px auto}
+#more-menu[open]>summary::after{transform:rotate(225deg);margin-bottom:-3px}
+#more-menu>summary:hover{background:#ecefea;color:var(--ink)}
+.more-menu-items{position:static;display:flex;align-items:stretch;border:0;border-radius:0;padding:4px 0;min-width:0;background:transparent;gap:3px}
+main{margin:0 0 0 var(--rail-width);max-width:none;padding:26px 40px 48px;min-height:100vh}
+.page,.connection-status,.connection-banner{max-width:1024px;margin-left:auto;margin-right:auto}
+.page{scroll-margin-top:24px}
+main:focus{outline:none}
+h1{font-size:24px;line-height:1.4;letter-spacing:-.5px;font-weight:650;margin:0 0 10px}
+h2{font-size:16px;line-height:1.5;font-weight:600}
+h3{font-size:14px;line-height:1.6}
+p{margin-bottom:14px}
+.note,.limits p{font-size:12.5px;line-height:1.75;max-width:80ch;color:var(--muted)}
+.subtle{font-size:13px;line-height:1.75;margin-bottom:24px;max-width:78ch}
+.connection-status{height:22px;margin-top:0;margin-bottom:22px;font-size:11px;line-height:22px}
+.connection-banner{padding:16px 20px;background:#fafbf9;border:1px solid #aeb6aa;border-radius:var(--radius);margin-bottom:20px}
+button,input,select,textarea{border-radius:var(--radius);font-size:13px}
+button{min-height:36px;padding:8px 14px;border-color:#bdc5b9;line-height:1.45;transition:background-color .12s,border-color .12s}
+button:hover:not(:disabled){background:#f1f4ef;border-color:#919c89}
+button:active:not(:disabled){background:#e8ede4}
+button:focus-visible,a:focus-visible,summary:focus-visible,input:focus-visible,select:focus-visible,textarea:focus-visible{outline:2px solid var(--ink);outline-offset:3px}
+input,select,textarea{border:1px solid #b9c1b5;padding:9px 11px;line-height:1.5;background:#fff;color:var(--ink)}
+input::placeholder,textarea::placeholder{color:#6d7269;opacity:1}
+select,input:not([type=checkbox]):not([type=radio]){min-height:40px}
+input[type=checkbox],input[type=radio]{accent-color:var(--ink);width:16px;height:16px;flex-shrink:0;margin:0 8px 0 0}
+label{color:var(--ink);font-size:13px}
+.checkbox{display:flex;align-items:center;gap:0;min-height:34px;margin:5px 0;font-size:13px}
+.checkbox .note{margin-left:6px}
+.form-grid{gap:16px 24px}
+.actions{gap:12px 18px;margin:18px 0 14px}
+.link{display:inline-flex;align-items:center;gap:8px;min-height:28px;padding:2px 0;line-height:1.55;text-decoration:underline;text-underline-offset:3px;border-radius:2px}
+.primary,#start,#prepare-solution{min-height:40px;background:var(--ink);color:#fff;border-color:var(--ink);border-radius:var(--radius);font-weight:550}
+#prepare-solution{padding:10px 18px;text-decoration:none}
+.primary:hover:not(:disabled),#start:hover:not(:disabled),#prepare-solution:hover:not(:disabled){background:#394038;border-color:#394038}
+#start{display:inline-flex;align-items:center;justify-content:center;gap:10px;min-width:140px;padding:11px 20px}
+#start::before{content:'';width:18px;height:18px;flex-shrink:0;background:url('scan.svg') center/contain no-repeat}
+#start:disabled{opacity:.7}
+.intro-heading{align-items:center;gap:24px}
+.intro-heading .actions{gap:6px}
+#session-state{font-size:11px;line-height:1.6;font-variant-numeric:tabular-nums}
+#mode-note{margin-top:8px;max-width:64ch}
+.network-note{font-size:11px;margin-top:9px}
+.target-environment{padding:18px 20px;margin:22px 0 24px;background:#f7f9f5;border:1px solid var(--line);border-radius:var(--radius)}
+.target-heading{align-items:center;gap:18px}
+.target-heading h2{font-size:14px;margin-bottom:5px}
+.target-heading .note{margin:0}
+#target-form{padding-top:18px;margin-top:16px;border-top:1px solid var(--line)}
+.target-primary-fields{margin-top:0}
+.target-ip{display:flex;align-items:center;justify-content:space-between;gap:16px}
+.target-ip p{margin:0}
+#target-form details{margin-top:16px}
+.flow-progress{margin:20px 0 14px;gap:20px;border-bottom:1px solid var(--line)}
+.flow-progress li{padding:11px 0;font-size:12px}
+.result-summary{align-items:center;min-height:34px}
+.result-summary h2{font-size:18px;line-height:1.5}
+#verdict-note{margin:9px 0 20px;max-width:78ch}
+.problem{padding:18px 0;border-left:0;border-right:0}
+.problem-header{align-items:center}
+.problem-header h3{font-size:15px}
+.problem p{font-size:13px;line-height:1.75;max-width:80ch}
+.problem-actions{gap:12px}
+.problem .cause{margin-bottom:10px}
+.manual-guidance,.inspection-error{color:var(--danger)}
+.inspection-row[data-manual=true]>.inspection-state,.inspection-row[data-manual=true]>summary .inspection-state{color:var(--danger)}
+.inspection-row{padding:13px 12px;border-top:1px solid var(--line);scroll-margin-top:20px}
+.inspection-row[open]{background:#fafbf9;padding-bottom:20px}
+.inspection-row>summary{gap:14px;align-items:center;font-size:13px}
+.inspection-row>summary strong{font-size:13px;font-weight:550}
+.inspection-row>summary small{margin-top:3px;font-size:11px}
+.inspection-row>p,.inspection-row>h3,.inspection-row>.actions,.inspection-row>details{margin-left:34px}
+.inspection-row>p{font-size:13px;line-height:1.75}
+.inspection-state{font-size:12px;min-width:120px}
+.inspection-state small{font-size:11px}
+.inspection-toolbar{gap:10px 16px;margin:20px 0}
+.check-filters{background:var(--rail);padding:16px;border-radius:var(--radius);gap:16px;margin-top:20px}
+.check-filters label{font-size:12px}
+.check-filters input,.check-filters select{margin-top:6px}
+.tool-section{margin-top:26px;padding-top:22px}
+.tool-section>h2{margin-bottom:12px}
+.tool-section h3{margin-top:20px}
+.tool-section .actions{margin-top:16px}
+.upkeep-state{padding:18px 20px;border:1px solid var(--line);border-radius:var(--radius);background:#f7f9f5}
+.upkeep-state p{margin:6px 0}
+#upkeep-setup{margin-top:22px;border-top:0;padding-top:0}
+#upkeep-setup>label:not(.checkbox){max-width:480px}
+#upkeep-setup>.checkbox{display:inline-flex;margin:6px 24px 6px 0}
+#upkeep-setup>h2{font-size:17px}
+#advanced-maintenance{border-top:1px solid var(--line);padding-top:18px;margin-top:28px;font-size:13px}
+#advanced-maintenance>summary{color:var(--ink);padding:4px 0;font-weight:550}
+#advanced-maintenance .tool-section{margin-top:18px;padding-top:18px}
+details>summary{max-width:100%;font-size:12px}
+#opensource-tools>summary{font-size:14px;color:var(--ink)}
+.account-guide{margin-top:20px}
+table{font-size:13px;line-height:1.65;font-variant-numeric:tabular-nums}
+th{font-size:12px;color:var(--muted);font-weight:500;background:var(--rail)}
+td,th{padding:12px 14px;border-color:var(--line)}
+.information-output{border:1px solid var(--line);border-radius:var(--radius);padding:18px 20px;margin-top:18px}
+.information-output:empty{display:none}
+.information-output dl div{grid-template-columns:160px minmax(0,1fr);padding:8px 0;margin:0;border-bottom:1px solid #e8ece5}
+.information-output dl div:last-child{border-bottom:0}
+#check-preferences-panel{border-top:0;margin-top:26px;padding-top:0}
+#check-preferences-form{display:grid;grid-template-columns:1fr 1fr;gap:4px 20px}
+#check-preferences-form>p,#check-preferences-form>.checkbox:has(#optional-failures),#check-preferences-form>.checkbox:has(#diagnostic-logging),#check-preferences-form>button{grid-column:1/-1}
+#check-preferences-form>button{justify-self:start;margin-top:8px}
+#check-preferences-form>p{margin:6px 0 10px}
+.desktop-preferences{max-width:none;padding:22px 0;margin:24px 0;border-top:1px solid var(--line);border-bottom:1px solid var(--line)}
+.desktop-preferences h2{font-size:16px}
+.desktop-preferences h3{margin-top:22px}
+.learning{max-width:780px;margin:24px auto}
+.learning-top{font-size:12px}
+.learning h1{font-size:24px}
+.learning-inline{margin:0 0 24px;padding:14px 18px;border:1px solid var(--line);border-radius:var(--radius);background:#fafbf9}
+.learning-inline h1{font-size:14px}
+.learning-inline #learning-body p{font-size:12px}
+footer{position:fixed;left:0;bottom:0;width:var(--rail-width);max-width:none;margin:0;padding:18px 24px;display:flex;flex-direction:column;align-items:flex-start;gap:12px;border:0;background:var(--rail);z-index:21;font-size:11px}
+footer span{margin:0;text-align:left;line-height:1.8;font-size:11px;color:var(--muted)}
+footer br{display:block}
+footer .link{font-size:12px;min-height:26px}
+footer .ui-icon{width:16px;height:16px}
+#quit{color:var(--muted)}
+@media (max-width:1100px){:root{--rail-width:184px}main{padding:24px 28px 40px}.app-header{padding-left:12px;padding-right:12px}footer{padding-left:20px}.tab{font-size:12.5px}.check-filters{grid-template-columns:1.5fr 1fr 1fr}.inspection-row>summary{gap:10px}.result{grid-template-columns:135px minmax(0,1fr) 80px;gap:16px}.form-grid{gap:14px 20px}}
+@media (prefers-reduced-motion:reduce){*,*::before,*::after{transition:none!important;animation:none!important;scroll-behavior:auto!important}}
diff --git a/envscope/web/workspace_ui.mjs b/envscope/web/workspace_ui.mjs
new file mode 100644
index 0000000..87dd12e
--- /dev/null
+++ b/envscope/web/workspace_ui.mjs
@@ -0,0 +1,21 @@
+// Reorder existing controls without duplicating their state or action handlers.
+export function initWorkspace(){
+  const setup=document.getElementById('upkeep-prepare')?.closest('section');
+  const status=document.querySelector('#page-upkeep>.upkeep-state');
+  if(setup&&status){setup.id='upkeep-setup';status.after(setup);}
+  const advanced=document.createElement('details');advanced.id='advanced-maintenance';
+  const title=document.createElement('summary');title.textContent='系统守护与高级修复';advanced.append(title);
+  for(const id of ['timezone-service-panel','process-guard-panel','client-panel','language-panel','network-panel','routing-panel','components-panel','software-panel']){
+    const section=document.getElementById(id);if(section)advanced.append(section);
+  }
+  setup?.after(advanced);
+  const tools=document.getElementById('environment-tools'),heading=document.querySelector('#page-tools>h1');
+  if(tools&&heading)heading.after(tools);
+  const sources=document.getElementById('opensource-tools');
+  if(sources){
+    const disclosure=document.createElement('details'),summary=document.createElement('summary');
+    disclosure.id=sources.id;disclosure.className=sources.className;summary.textContent='开源方案使用说明';
+    sources.querySelector('h2')?.remove();disclosure.append(summary,...sources.childNodes);sources.replaceWith(disclosure);
+    document.getElementById('tool-output')?.before(disclosure);
+  }
+}
diff --git a/pyproject.toml b/pyproject.toml
index 290eb90..e2293bf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "envscope"
-version = "0.24.1"
+version = "0.25.0"
 description = "Minimal desktop environment checks, guarded accounts and practical maintenance tools"
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/scripts/build_desktop.py b/scripts/build_desktop.py
index c5c3186..c18cbe0 100644
--- a/scripts/build_desktop.py
+++ b/scripts/build_desktop.py
@@ -31,6 +31,7 @@ def main():
                "--distpath", str(root / "dist" / "desktop"), "--workpath", str(root / "build" / "desktop"),
                "--specpath", str(root / "build"), str(root / "scripts" / "desktop_entry.py")]
     environment = dict(os.environ)
+    command.extend(['--icon',str(root/'envscope/web'/('app.icns' if platform.system()=='Darwin' else 'app.ico'))])
     if platform.system()=='Darwin':command.extend(['--osx-bundle-identifier',APP_ID])
     if platform.system() == 'Windows':
         command.extend(['--version-file',str(windows_version_file(root/'build/windows-version.txt'))])
diff --git a/scripts/build_icons.py b/scripts/build_icons.py
new file mode 100644
index 0000000..431c696
--- /dev/null
+++ b/scripts/build_icons.py
@@ -0,0 +1,27 @@
+"""Render the original EnvScope geometric mark for Windows/macOS packaging."""
+from pathlib import Path
+from PIL import Image, ImageDraw
+
+
+def mark(size, *, tray=False):
+    scale=4;canvas=Image.new('RGBA',(size*scale,size*scale),(0,0,0,0));draw=ImageDraw.Draw(canvas)
+    def points(items):return [(round(x*size*scale/64),round(y*size*scale/64)) for x,y in items]
+    ink='#202322';paper='#ffffff';line=paper
+    if tray:
+        draw.rounded_rectangle((2*scale,2*scale,(size-2)*scale,(size-2)*scale),radius=size*scale*.22,fill=paper,outline=ink,width=max(1,round(size*scale*.03)));line=ink
+    else:draw.rounded_rectangle((0,0,size*scale-1,size*scale-1),radius=size*scale*15/64,fill=ink)
+    for path in [[(26,16),(16,16),(16,26)],[(38,16),(48,16),(48,26)],[(16,38),(16,48),(26,48)],[(48,38),(48,48),(38,48)],[(25,32),(39,32)],[(32,25),(32,39)]]:
+        draw.line(points(path),fill=line,width=max(1,round(size*scale*3.5/64)),joint='curve')
+    return canvas.resize((size,size),Image.Resampling.LANCZOS)
+
+
+def main():
+    root=Path(__file__).resolve().parents[1]/'envscope/web';image=mark(1024)
+    image.save(root/'app-icon.png',optimize=True)
+    image.save(root/'app.ico',format='ICO',sizes=[(n,n) for n in (16,20,24,32,40,48,64,128,256)])
+    image.save(root/'app.icns',format='ICNS')
+    mark(64,tray=True).save(root/'tray.png',optimize=True)
+    print('Original application, Windows, macOS and tray icons rendered.')
+
+
+if __name__=='__main__':main()
diff --git a/scripts/desktop_refresh_smoke.py b/scripts/desktop_refresh_smoke.py
new file mode 100644
index 0000000..47a0cdf
--- /dev/null
+++ b/scripts/desktop_refresh_smoke.py
@@ -0,0 +1,81 @@
+"""Desktop navigation, retained inspection state, keyboard and visual fixtures."""
+import json
+from pathlib import Path
+import tempfile
+import threading
+from unittest.mock import Mock
+
+from playwright.sync_api import sync_playwright, expect
+from envscope.guide import LESSON_VERSION
+from envscope.state import StateStore
+from envscope.operations import Operations
+from envscope.legacy import LegacyBridge
+from envscope.service import make_server
+from scripts.environment_fixtures import fixture, target
+from scripts.ui_navigation import open_page
+
+
+def main():
+    out=Path('artifacts/desktop-refresh');out.mkdir(parents=True,exist_ok=True);results=[]
+    with sync_playwright() as runtime:
+        browser=runtime.chromium.launch()
+        try:
+            for system in ('Windows','Darwin'):
+                with tempfile.TemporaryDirectory() as folder:
+                    home=Path(folder);store=StateStore(home/'state');store.complete_learning(LESSON_VERSION)
+                    settings=target(system,'cli','direct',usage_country='US')
+                    store.save_settings({k:v for k,v in settings.items() if k!='environment_confirmed'},confirm_environment=True)
+                    ops=Operations(store,home,discoverer=lambda:[],legacy=LegacyBridge(platform_name=system,home=home,runner=Mock(side_effect=AssertionError('No vendor execution'))))
+                    calls=[]
+                    def audit(*args,**kwargs):
+                        calls.append(1)
+                        return fixture(home,kwargs['baseline_config'],system,'permission',browser=kwargs.get('browser'))
+                    server=make_server(store=store,operations=ops,auditor=audit)
+                    thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
+                    try:
+                        for width in (1024,1280,1440):
+                            context=browser.new_context(viewport={'width':width,'height':900},locale='zh-CN',reduced_motion='reduce')
+                            page=context.new_page();errors=[];page.on('pageerror',lambda error:errors.append(str(error)))
+                            page.add_init_script('window.RTCPeerConnection=undefined');page.route('https://**/*',lambda route:route.abort())
+                            page.goto(f'http://127.0.0.1:{server.server_port}/');expect(page.locator('#target-edit')).to_be_enabled()
+                            expect(page.locator('#all-checks-list details').first).to_be_attached(timeout=30000)
+                            open_page(page,'checks');page.evaluate('window.scrollTo(0,650)')
+                            open_page(page,'settings');open_page(page,'checks')
+                            for _ in range(20):
+                                if page.evaluate('window.scrollY > 600'):break
+                                page.wait_for_timeout(50)
+                            assert page.evaluate('window.scrollY > 600'),'Navigation lost the previous scroll position'
+                            page.evaluate('window.scrollTo(0,0)')
+                            row=page.locator('[data-inspection="baseline.timezone"]');row.locator('summary').click()
+                            page.locator('#check-search').fill('时区');expect(row).to_have_attribute('open','')
+                            page.locator('#check-search').fill('');expect(row).to_have_attribute('open','')
+                            for name in ('audit','checks','upkeep','accounts','tools','history','settings','coverage'):
+                                open_page(page,name)
+                                if name=='upkeep':
+                                    page.locator('#advanced-maintenance').evaluate('(n)=>n.open=false')
+                                page.evaluate('window.scrollTo(0,0)')
+                                assert page.evaluate('document.documentElement.scrollWidth <= innerWidth'),(system,width,name,'horizontal overflow')
+                                assert page.locator('.tab[aria-current="page"]').count()==1
+                                page.screenshot(path=str(out/f'{system}-{width}-{name}.png'))
+                            open_page(page,'audit');before=len(calls)
+                            with page.expect_response(lambda response:response.url.endswith('/api/audit')) as received:
+                                page.locator('#start').click();page.locator('#start').dispatch_event('click')
+                            assert received.value.ok, received.value.text()
+                            expect(page.locator('#start')).to_be_enabled(timeout=45000)
+                            assert server.last_raw_report and server.last_raw_report.get('report_id'),'Audit must produce a report'
+                            expect(page.locator('#session-state')).not_to_contain_text('系统检测未完成')
+                            assert len(calls)==before+1,'Repeated click must not start a second audit'
+                            page.screenshot(path=str(out/f'{system}-{width}-results.png'))
+                            page.locator('#more-menu>summary').focus();page.keyboard.press('Enter')
+                            expect(page.locator('#more-menu')).to_have_attribute('open','')
+                            page.keyboard.press('Escape');expect(page.locator('#more-menu')).not_to_have_attribute('open','')
+                            expect(page.locator('#more-menu>summary')).to_be_focused()
+                            assert not errors,errors
+                            results.append({'system':system,'width':width,'pages':8,'scroll_retained':True,'disclosure_retained':True,'duplicate_blocked':True,'keyboard':True,'errors':errors})
+                            context.close()
+                    finally:server.shutdown();server.server_close();thread.join(3)
+        finally:browser.close()
+    (out/'result.json').write_text(json.dumps(results,indent=2),encoding='utf-8');print(json.dumps(results))
+
+
+if __name__=='__main__':main()
diff --git a/scripts/desktop_ui_smoke.py b/scripts/desktop_ui_smoke.py
index 66d4241..ddd1f10 100644
--- a/scripts/desktop_ui_smoke.py
+++ b/scripts/desktop_ui_smoke.py
@@ -29,7 +29,9 @@ def status(self):
 
     def run(self, action, params, confirmed):
         self.calls.append((action, params, confirmed))
-        if action == 'desktop-save':
+        if action == 'desktop-status':
+            time.sleep(0.3)  # A real native read may overlap a quick Save click.
+        elif action == 'desktop-save':
             self.preferences.update(params)
         elif action == 'app-update-check':
             time.sleep(0.2)
diff --git a/scripts/region_lookup_smoke.py b/scripts/region_lookup_smoke.py
index f18653f..16ff36d 100644
--- a/scripts/region_lookup_smoke.py
+++ b/scripts/region_lookup_smoke.py
@@ -29,6 +29,13 @@ def lookup(params):
                 thread=threading.Thread(target=server.serve_forever,daemon=True);thread.start()
                 context=browser.new_context(viewport={'width':1280,'height':950},locale='zh-CN')
                 page=context.new_page();errors=[]
+                busy_reads=[0]
+                def first_lookup_busy(route):
+                    if route.request.post_data_json.get('action')=='environment-location' and busy_reads[0]==0:
+                        busy_reads[0]+=1
+                        route.fulfill(status=409,json={'error':'audit_running'})
+                    else:route.continue_()
+                page.route('**/api/action',first_lookup_busy)
                 page.on('pageerror',lambda e:errors.append(str(e)))
                 page.route('https://**/*',lambda route:route.abort())
                 try:
@@ -37,6 +44,7 @@ def lookup(params):
                     country=page.locator('#target-form [name=usage_country]')
                     city=page.locator('#target-region-profile');status=page.locator('#target-ip-status')
                     country.fill('US');expect(status).to_contain_text('仅显示 US')
+                    assert busy_reads[0]==1,'A busy read must recover without another user click'
                     assert city.locator('option[value^="us-"]').count()>=29
                     assert city.locator('option').count()==city.locator('option[value^="us-"]').count()+1
                     expect(city).to_have_value('us-new-york')
diff --git a/scripts/simple_workflow_smoke.py b/scripts/simple_workflow_smoke.py
index a2bc965..afa2236 100644
--- a/scripts/simple_workflow_smoke.py
+++ b/scripts/simple_workflow_smoke.py
@@ -81,13 +81,17 @@ def auditor(*args, **kwargs):
                         expect(page.locator('#audit-content')).to_be_visible()
                         expect(page.locator('#learning-panel')).to_be_visible()
                         expect(page.locator('#audit-results')).to_be_hidden()
-                        assert page.locator('#desktop-nav .tab:visible').count() == 1
+                        assert page.locator('#desktop-nav .tab:visible').count() == 3
                         expect(page.locator('#target-confirm')).to_be_enabled()
                         assert page.locator('#target-country option').count() > 240
                         page.screenshot(path=str(out / f'{system}-{width}-initial.png'), full_page=True)
                         page.locator('#learning-skip').click()
                         page.locator('[name=usage_country]').fill('US')
-                        expect(page.locator('#target-region-profile')).to_have_value('us-new-york')
+                        try:
+                            expect(page.locator('#target-region-profile')).to_have_value('us-new-york')
+                        except AssertionError:
+                            print({'location':page.locator('#target-ip-status').inner_text(), 'requests':requests[-5:]},flush=True)
+                            raise
                         open_details(page, '#target-connection-options')
                         page.locator('#target-form [name=usage]').select_option('cli')
                         page.locator('#target-form [name=connection_mode]').select_option('direct')
diff --git a/scripts/ui_navigation.py b/scripts/ui_navigation.py
index e633a7c..4ff28bb 100644
--- a/scripts/ui_navigation.py
+++ b/scripts/ui_navigation.py
@@ -2,11 +2,13 @@
 from playwright.sync_api import expect
 
 
-def open_page(page, name):
+def open_page(page, name, *, advanced=True):
     expect(page.locator('html')).not_to_have_attribute('data-operation-busy', 'true', timeout=30000)
-    if name != 'audit' and not page.locator('#more-menu').evaluate('(node)=>node.open'):
+    if not page.locator(f'.tab[data-page="{name}"]').is_visible() and not page.locator('#more-menu').evaluate('(node)=>node.open'):
         page.locator('#more-menu>summary').click()
     page.locator(f'.tab[data-page="{name}"]').click()
+    if name=='upkeep' and advanced and page.locator('#advanced-maintenance').count():
+        open_details(page,'#advanced-maintenance')
 
 
 def open_details(page, selector):
diff --git a/scripts/verify_package.py b/scripts/verify_package.py
index e4cbc24..adaf76b 100644
--- a/scripts/verify_package.py
+++ b/scripts/verify_package.py
@@ -26,6 +26,8 @@ def verify(read, names):
     assert read('envscope/web/components_ui.mjs'), 'missing component migration UI'
     assert read('envscope/web/check_preferences_ui.mjs'), 'missing optional checks / diagnostics UI'
     assert read('envscope/web/workflow.mjs'), 'missing single-workflow UI'
+    for name in ('workspace.css','workspace_ui.mjs','icons.mjs','mark.svg','scan.svg','app-icon.png','app.ico','app.icns','tray.png','permission_flow.mjs'):
+        assert read('envscope/web/'+name),'Missing desktop refresh resource: '+name
     print("Verified full pinned vendor bundle and all desktop UI resources.")
 
 

From 8344ac595e5dc45c1479ae375aa0d3de5387c14e Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:43:55 +0800
Subject: [PATCH 09/10] docs: refresh desktop preview from isolated 0.25
 fixture

---
 docs/images/desktop.png | Bin 97214 -> 77117 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/docs/images/desktop.png b/docs/images/desktop.png
index 5c92f13af7035662b2cce0937b3ff6f0c1c72aa5..71329843507e72e34bddbbe8d177825a15ae7a8f 100644
GIT binary patch
literal 77117
zcmdSBWmMGP7d|?opc0}WT_PpjAW}*<N)3&4cS#K>0@BhkgtX+)Jq+CqLkuO&&>chl
zLBGGd?p^D?yl?Kj;jH0&&gbmCPweN}dr$C3C21T?QcM5<fFmm-p#lJ)-!&h8e}Z=R
z$I%^24FGr!kd^qL_9bO|4og>EeO~ltl`bjSgg(meEeFk1%;RF|M)Hr?$uHv`sSf2g
z3WXD0JyrALd3ue(@iNi(Gd>#O9~%AKgXo7A-!jCG9)+OI|9-ih@aIvA-v=8?7BYn+
z*hEvRkDUX@i&gJ=b_0(=5if|3z*OkaO-a@1@E*iR8h}!;_9_Gy3O=}-5&*Da@Bj2~
z1K>yS9)R($S?CAA{@2oY@PPPVs|XE^<6lb?{n6)tty0V<&Hq}T37-4?8?c$_72x6D
zFa6a2|2d%H8|1^wvprFbPY3Xh&;+*Y<+TAY6yetWlR8W4`cza(RKzxU=x9h(`Je27
z-R~b33@#&P1rh{H8c!y4(&OWz1PxIYL-ZvEXN3mWA<aI8RZ#c<JoVoL$2Ee}=qL$O
z_&0Q{T{TpW$i?LXk%j(SpEc}%Is}}1?3w@uhlaLlodRY*6&DvbxbM*e&dMjQHm0r!
zopd&;N#LUm@jjfE3{Pj<v=5EOTnrL#CLiCAe^x6vfsR^UTH+ny%(l0YQS@MY<=5=9
zk%mN5bnc^^TzM1MvJ_)EGJvJJF8I{mGHrS*nv}X&J(aNjg4~OfkG6%EJ)>5<CP(kR
zSV(7-y@3AB1AE>5_}@Lc{!crpoMwjPR?g(b_b5B860Ye<Urcbm?T)c*VeodMQCmqf
zx=|1?7XK!zwCgcCfH}QAlRx;w(mM)P+L;Y$dl{*21_{2I?A_)12~W;FPtm@R8zs_C
zC7h|`&|=lM%StCNsd|%eRom8Sp!pteX80Gn=M;g+^ry2aqWh)!Ied4DR@3Y3Cj6KL
z@fMBan33AOEP+6`7jOA_D32<$(OIdo%ZpGf$%w1K19*GHm*1|)P>k{G5-bL12n9TU
z+6w>DI7#CRlE*;NDDslleuVguUY2oe2kfXN102jE38oHkrq(BAO~?_+cl4)~RSv=`
z5#E;HQ&3#6`>050Kr(N!abx1K{V}V2n*Q)-|D1?SaI#Hh+_ccFiet#{)>N4omt6^q
zvConR?McIN0;2>DYSuCe9kH>q7Z@KVH^{j(<VY^bC%+~Bytni(-`O%i5!^~P9XZx%
z_$zayyHu(x=y_UK=mT4?y641Hvz1KWU0yO2v6xX!<>OVKZ}WzTqj4IIcz4jHgfQx;
zFgP1BRtJan9&|h_bc)H@FwH$Ik|yXVHt@+*Kgo>w@b;y+n)iObU-q`TS9W^`WI_*>
z1N>|}*2r2HQzswwsd!ZKc$wB)zJz8{#;gf<;TN)9Gqrkwmr*c8omZTHO_37_hQr<p
zA+50Thf383&A(7GC*pHDjIw{Ti-vZ{zQyur-+2mScXMRIe(mC5AtK+n@}<iE9Xu*=
zx0WSvzINEE-pP)S^8%;fwaU~?3;}Bl;X9I|Uz4rzKcOlb>p*eT{Q<e5?9Ku(*yR|x
z;N%vb17$<Kd-6<8r@^iyv@Yu1+#t{)0fN0INLosJ^zHkzl(jL^)cs`KHYwizB<~U4
z5SuW;e)z+u@^Pdd?>65=V6mDJs4YT6*u^mIUsvzj7bvGNP^{PSK6QK*zkI|xX;5FE
zsaW+hKm|%L#by$>_}hbE<WgH@oj=Dk`uEDNAiP?QC!cU|ojt%)*Fuu_(^E194eN8F
z2)0T*gdQ0Kb9dvL-RQdxy~=_knMgh-aDhWPSN?f2v&0r&)5i~VJWJ(SA(>jx8Ma~Q
z5`G*7U1RK=>hHl{B;EuyYW1tsl=TkSSD)&(pX!mY_`Lb<(EtcHcAWRPG5hM!_H85b
zW}>QDFX)M@qzy>Eyq?jR=Be@rc8fbL`Q5m7q3xe+O@<SBMx430xy7?vTEZ`P=G(-P
ztE+SdM&(o1<&FUPR0VmOO+W*t7+-EG&nNlpPXgIJ3O&Gi^m@07A`97vM^@2{u{@UF
z2EvDTlr+OTXo<uI*SndAMo%lId@Y+?7nc`$LY!5;6BcHv8120!r}EZBsC^mG*e#K_
zRaFHaBRV<;+euk34|V8^*EV|;S*to`l}_Ga)bP~c1?(ea7iE%z13cf%$N@(OSB5dh
z{LN0}P@dDSrVebA8sD@V4O`fnf{iT(hO8?p@OM9M*m(@w6iuQh^NLlV;@?;XZ&Q9Z
zBcJ<DVIpbUC4l6>_IxWJ)bc{VBJPBZ{Z0*lS<}1K0v3O`!y{_ooGw+QuXrnC9~l>i
z?<Xjq$kj`?_tG&neJQz&E8GTIB5JDxa@kmWmTVHH8qzi8Xj_66FyH8<OOdM9qw`&*
zppl9N*z>ZAI2=Y0!Gw6FAg6<L{hB*al1-wc(ZDB~rNYk8W#myVn@ZNg%N+j4)LAR1
zPMgbkY$z#Ie#4HH{TY_++PK@#?;+1sAHRw_ZXkPDw1uWPX|NL=wZNt2=Km}B_u5D=
zs~4k-G2veKfqg*O0I4Ct=j$25<EDq{Ndc_wO#n~5UzS)cVpy%93(#S_+v5FE=hrm8
z{($%wRoS!7??c*RqUzd?bR^9F%8BWmQy)^9_O$ObhA>~uz7l4De=<=%$qvwc&c(f1
z)g`vD@>>lmVPfXZ()a0VMbq<S$T_ghTG7eT@#m7Ms_J9MI3Fp9LYjQ$PtYoPUct6Y
z&PR=txMyW`ahgT>!L<sUw`KX598}%nLfT{o+ajPEo@#-5Z8ZtkQ3XpA;m#bIq@sz+
zwJ`uodRoYa6itPFcsio@7o=fcVzzi`q*ppo-X}YUaAnMB@{rd`?Bj!bX*Ph@_<qu1
z#2;?GRwG1sG%s7QxK&|1+E)_&8L;d5q}c~unO%VtqXs;J>!IV8k9I$Kud?O~NKM)&
z$ulm0tNEUyNs{v69J}9>C>`?&2YGED&N4Owt1kbVP!kr9s4+Jgsa$Bix64c8Xpq2o
zdu(gxF%wjYG(XYCEYL*bR&C?dDAO0BznWybC>NroYaa7?HT~#Uo!)QChV9T7Yr9--
zPRg8)ibh{k!nNSFwbdqvlH;4gLBUKdJy*Lwc)$so-FnmQoqUA~Vd{M956l?4+4Mw^
z`dbH9OPj{Ks#-)AH?O8GN$K1T_uZ^Pi22U=YK=VE!YqX_+uhv*$?_L#W@`e*lCDI0
zSi;KQIQOgAr^FX+e-QUZ?v{*WUBJnA_(l@{=ONwK%h2ae^hX~gMROE#sSco_(;t<0
z4=Oqc6pO?XdvRB7ZLJ&~9IXmAUa@(GkFL%dgcnQD;l$>2G^-ZSPWKO$<K@H@`p@^i
zQw(o6W$ODJB=}B7`(!1}ivozBKFdf@zt|#tQlKtbRPbcgDzfNf|Dej0vuame8;ZAw
z9vLNi{H;`EUJO5C^S3OgcXl@aGnO}chdDOLf^uj#%6=<QT;83oy)#%+Q>#il?x&F(
zJ)0KM2IaHZ+lf}au~QTaEtx;}xKt|I#vD#`4MZ|0AzbH>D|DL3O$F`@S&M0Bn8_34
z7a~Ry-KpSL`iU(-M92BGGaTI67bJS+0GZf}W5^7}(r=>SHTZh!4>v-^C3sshDKR)u
z#SrLOP9$;hF#vnNV-I-284e%j@;nv)_H@#b|7)Zhi_qg3ziwGLa&~33u7`yN`EJ4q
zR~Aplt$zeuCMy<`r+P9kg=6~@gYWu9-YAbYwFx)BVkQ2<TZ5LhkowB<Il~*vn%2P+
z)PbCRM^B+EIZk0$^2*D_I2*2=-6xT^84Ml5pMw{uYG~YkmmOoYsExH{Tv+i@8>JiO
z11ra&Db+o!pP7gI-~+n7Mpe_FYNM!K)p8f2Y^rh_rv~6Lwf4ol25+VLT(u-+IC^?a
zV}wGZfH@iJXCK|H{Xpommb;5-EFIT?Zjg36+pw`K>pl@Jkj35Ez%eL^`F_Cw+`E3=
zJMg>T%alb-FM6*`fO85FrrTFU>F%&^<LC$pK)fgW5a{-5)0ZWY)h#a9o?l_i2PJVF
z)p+Z~hoB8=#Cz>MuUIK^+8G1s7K>nEB0El9bGLHoPco?*514U~M!+^BE}pq<HZg0@
z=*;QP{X+)teaRGd34y@L+1vSY^K~{<S6Uk^7Yix9vitV9cWS!)Yip3c*8bOc1u(N(
zO4HQ_{sD<Xmk8c#>*k{|DdCgv`yQK{u*5Gi_<d!@C!>(TGG1kp2=d&n{S_>X9q%O4
zS5(ak3*`@ENE4{IFStxkRqe@X{z?oOW_D)>%ped-sazeQ++l67)6+vz5%0Hk&K928
zs}_rqYY>cJ-d9`B+6p3gtY(PFn;`l>9u)!Z=>|&%<TLEwC#H{bU#y#_`-<6s1C<d)
z`Zwb@yt>_am3)1qdA?4y7?y6U@?AyM{j8$tygC*PqsL!UMQO>W6Y`N=E8$qIFS{J5
zh=L?((EdT1<K8)}=Jml;)d(^{t4hJ^tkr!;m&nP=#nF1t+<}D4%gM{Bi&dGj%|5QZ
z%JqOpx>qj}m?J6P5Nbr46bjw~zb48Dz+2Oz3u?RgFc0`&$xm{7AOgoNB`$lUjX0Eu
zyfl<U!(O13lpy;1LAMl5I+aJhP&V?ujO(uK&K$y&JS@X275{u~o`32|9IJ`>98h9}
zt2{8DGA6wR9-ot$`vl{?ez1k^^CMth{BeYBBHt#S!4r_te8tix&qLn>1C+6&CGR=9
zlLgI-kWOVG-rip$^66NG5l&+}@agc9&iINIVZC=|)15_KC)6N$+cr8&1Ld3z-a+)U
zOLN+P81Ox8YX)=QmsLybmYDtatMLWO$6i~lQca71xkgz?bnca5IdRcej)LmO4Xh?=
z#)LfaAF%m_dv_c8P14iOHhTEa%1^ytP}82fcDn6!dA+i*kW^AyuHT#A`bU516=Y*G
z!9<I(Cef$8o>>`RBs!%2u)NgUSg#A2CndYObZN6@{#OZpUc+-_4_VwZ4<$}|Vph_Y
zt{Oaa4bS?-y>E^6Zq0Wdv&%ShIq%(~O5Q>$X5N_3oiB3C%?@@=NKlQ1PhNAGE_0SK
z9z?ZPtSiOrU4N`E-6?Z1L@&8v;VTifj6a3gd;7g;{-<u}m?*&?kq)!3N^q#D_&3%~
zoBl(qkX_3L&+Bv?L~Qa}?zr4QlFtw3Cw<bJgM-uWQw-*bk3IpgDueV%3eQ+*QAi&D
zEI#5@veMygf~x;<0m<MKtK_NkgnaIFg}9vy_ecNU=9xA0kmI(|0J(GL3m*!UhyeqH
zme&~!>Y&inWBf8A9-6(|Z6UdhA1p*aPc8(F0#mCOkB)|<w}khA#EV;3myJVtzWd*<
zNMI(Xm+LrV>^PNsLzf!_8K;E{i%EQ-6~=4A?(InfDc^hN^3LO!Cpo^Z+Uri`IPJ*`
zBcfzxc6XZywYn5Vz1hTt$lG)C*<oX1M?-$Wt@17|NcmlFLWg?%vIr_1-MN7a>;KOa
zqrsTqPhOh$;SqZiho%KrZ?ELNoAw-wl;NLn0MRxI@FVMfd}En=?DHRWKza{{CRm7t
zYL(Ywa|fEvzXkr+{R-Q?2<y1E%s7EX`?zH=bww#_fJr#k<dqZX!hYR={$Do-qS>D0
z9cu`5b7Mnh_qQ~a50B6l?>+Z&_t`(1?Ezfvx8V}4T-)A(^Ju{p5>Z&>DZ$lY0*v-w
zAAsl(g%@`8?A?<t+nOD>4d?J2`P*8LBQr=f1(!+p?@urv@8b<i5s{;{0UC$&Hshav
zAN)f(!tj9j{kQ*Uld~TpNi`(@hWw-N|Nk|a!V&v#XzY)IqF2^h9@9C#x~Ln(*&|dN
zI~8j6_ou9@G>}=3yu6Gr*}X}hyid2ZwRd%P{il5QNzs|xIxd#PwRtMg`PcWpUi&SN
z?^=tjd+UhEN`~vldcXb}<nyl)EAZ`5;qAIpmudEb*Q4v#h?$w&A!cSB?I!ALa{$n9
zsFA8FE8^z5`?$8snIgNx_VK*uWeoG-s(E><Xl=9aZ*PI?xTp2>h>!_7$1PG8{^FhH
zO9rU^Qx}el5uHndEiq3Uv3I9M`>)NRZB6zWXn%Pp_XS<W=ZdgLyTXwO(R$xK>Fjju
zDbD6RXUx<E1>cUZO+UP0-PWmz^2+J7kn9{mheZu-yLStt?+bBy6~N7=Yei%Dt@P0i
zzjm@te3@K{v;LXaLD0#4MZdu<yjd7|xd&T7B@{D*VBd~|zK)<L2X?wrRmnmslw!Em
zX*WFBj+9dPQ=6>ufvLoAV$~@qy()vGl&u*0myOEWX6uaE)KWQhze;WGzd2nm&g8pZ
z-4c1{{D*ZnYoFY*Vl8sQS$=}*&qOY|704Oc?eS~~qBw+o@cOUa9CUgkK%P5~AN}zf
zKbvgIGkA_<ct`^f{G$BIT**nGym&Lrf3m&WOz*eL$HeW}t4|}M3<_rHl|Dy9^|&h|
zYQsg>dB@s|LanvI!PLkk%i|#`h7`uP#b-Tnqpvm0bEyU_W)4KCzOtv#&7%6qMS9HT
z=^dD}&6|)OX165&c7uC2|Mk1xm!8?zQu3%C01|EIIq^zqQvs_3n}ElJ;h}D_euG}B
zEB6FO`Log4YI{=*C;89`y45#atW^2TI1KbOW|c3r9wT3Hi=DsYR$QZ*zs(JQi_axh
zB%@5JD%n1Fpd-o!4OburwE6s9OS|YBx89LkUF;UkVGq*&tbWv-UX!d$vx+w}RX6b9
zO%yl+#c~Ku`L&r0y(kxafw?Z7Lp)am6{8$eOyD&_QB9&-E%@pP^0WH9o?NfHY_@Gp
zDxwAXaSErMK<7#S?FUcmKSCImODobt+w8;dyc}C5rt6A-Qt5bk-ZHRIRLp{1li{Gk
z#?g7tc{ONUF>;$F{Egd}u-L=Yn3-qfwH%$HX7Hzmy6NjKe6EB8@W{8!Q(fi-Y{Zo=
zk{gkVgDYdH%6w%N)%G_6-*!T6^}5&@waq!=|Kmq@e?8#A;!&)ldiib$KeyIXr2VM4
zhDILQ$0^S}tv2Ls3oN`o6|+=ZaRcG+%E}A~M9o}0VlHCL9e!%qrz909z4KWwdBMBS
z0n;L=&Y9wMOr}T%n6Zo4o3Hf)n1Yf{NEGRz6;ogQ(4Rc>=H+1Z9W4AOwR;-?^vnTf
zD4e;T#KxsVE%f;BjCRZOVPLU8^KMtZN<VKn9O~cyb7253#sJr^P38*NoSW=_kqF>n
zD+F{>c;UQ`OY)jFzdS2lzX<lm2X(&D<&$@D0I{EM{Ivh+gSk1wS1*kJNMOI5T*ahn
zE6E?nr>GM)4?u1@20Kpte05b70Tm;?!_a%8f0qhC9*2@^C4J{M1=YZKm5%G?^Xk@R
z=J8B+<Q<`dOXAr;AbsK$bi3Z}c%!`N#U2uBpdcugupPmvE9~}I=g0vezpdDB=kI!6
z{9V~~XD?#MZLiad1n>`4-r-7Vc3UQ0;YGu1(}mRO^9DvQQ!I-gdcvT$w<!J!W%6`I
zndKILlR<KzVE_bIaoYWW4u7C<0c(wqTtwtc461GN@FIs5*aYTS_jMD5PboeJuaarS
zieYf5{YPheF6O0!xHP%0-N({Tye7U3=tx;7A1+#dP|dDC7#F|&71|_nx~YF1cPh1-
zb`cSvUq9HHT*yMruDB#}(e=SjoK*L0&DUc5Tpk>+NIW<paL!92vdCMu2~Mwk^Mmbz
zRUW20mDa2AYsqa4vB$&p@xLPw@HyXk9ri}#s;s5eQZ@Ysxi$bxxYldh|C8arZZ&i=
zo|b<IQCp514kJCby6E`xblHbL-{5stP)rcjnR*Oi)|!!f${*|2B6M7h*SX=oJ{F(2
z^js{q52j(Ms^{~-4-h<UWy()V#@x&-k@QW1N{<W#oCC1EfB#3`Yi^E;vR$85-}32;
zSd<!8BT~ReuFI3zkBhGQnCe$HlN8G__o<s+^%s-_t@)I2JWmcN7;4#uD?|Don`sPE
zbZMXOkWX7ILgEjL%Lw`O58wfYDCG7+IX|wlCX^<k(oNSj)j6f9l<R+QoQ*)jz)gQV
zczq6ZCKu*k*UZnHi}<9%*oS_-v>_q2P$u_P{6Yf(7_8oa8(lC9mkJgHuMm$^DjYRl
zZtW;+L1Bh-;4{GyE-pj$B`B>OKYwmQHAi}mMaAWeyc<=z@Wdo(Z`1$nbviW)ELX^Q
zx@Ay!QZeA@JSim-#`jhIYZqi~3#uel+?cp_Nw(WD$!jjvPbhU&E|6K5pIz6J8EK>9
zEU!wacs-ZtWTbb$6!DX5&_z;pyYvU9JsIbQ_LotaQ(<~>yeB(|KA>XBtEvj?i`EoR
zRI9MbWJCvM){tPN1V#yDQ6F&*QzhQB6=wkwBAd2fdA+Eu5*bUl-`BIIzPHEtsGz1V
z%zTRz#X4KJl@YT|luXTDS!U&yWnoOs7{x*&M(6Ool4rhO-dg&&PEel;(Jmy1*8xlL
zCSOFxB&0|^Kb!-u&Poi=R*q7bPuUyMY;QPiy+Nk|Jj5p6siHFnE3(wMo}JM0nx3Qz
z^EOW$yYb_HXm~dx*pN*ijTl$wwWyn1m6S#Z3z=FYrVul7;VxCyRW`yiZ1}cr@$FE@
zk6!9ufRz<YqcfB7e`nn$b?r8OY@TaB-PG~9?%?}S;WzPT3FJ5R2UOV%VzsLs+ae;D
zHT0Cy?a~G%yd`Ljs4a0aLCs&#Ljr0Q#`8jizd=-4p}Dg%pWL*s8DjHkmQPRFGck}L
z+nVDcN1e9n;9jVdsn|R1Ofw}@ZqeIQxvj!bO<!c~TtyEc5P;pxj70^_{NbA)Ca7Jj
z`(c-Kx}>2v_cWW2nWd<^-O2PSZ<>~orL3fja3fiA*KDwnYaYyALt3x>oGa%&ByOra
zlC=($Ds7a7s}G05bYGGXsl{`uvZM8}MR-Uu&kmFvRj@JMN$Qv3Xq@hCcS`OL&~;pz
z3Mb>oo=D;LiqM#``2fhha2~WjCPEIOT}S%EbdKSbT|qI0=2j4)UDQk=FIk^-Q5v@w
z?@U2i0ETux_w0NuEolZ2Yfr>`XR2|zf}!7C$T{xHt)0h!)B|R>N)`8#e=yF@OGImv
zSNO8sj;ompP2ss;ONa|RVW)Qxp{G7m1occc;PK9`Xvn)gtaAM7&bf;Q0c}N>z81NO
zI6kRjXV1I1+HCnrN15Z1u?s~$xj*<F5^(sE_v?=La_A>{(nt}p*^)5%Q7E_G1CZsI
zMY8_wh*Ol%AXHiZU4VnK5UM`j?lOA1`flM9%or-mc%D<OpVx32TW&z*Lc4faBdL_|
zUD=-M514=U<fudlrD4lFY5t7!ZpbcFH%=Ec?Qj9_LnKG<NXKLU1lSnwZEyFZn5@~4
zTAZdF%)PXgs%ohDLIkkJ<v>-1Rg!eBv#fqm%j@TLJr%iL{5@mr&>Iyi+xft-RLMBr
z1Y5M4c$34qIKfa2#UCsre6s^%zCC0I%tCbm0}b(PJtgbU0v8(D#D#4IZRc)N%fHws
zgLuChNqT0#<GrL<*Bcs;Gs4>B>mPoug>m|%uNQMv@aL9!4Wy@}-fro6kVil++Y!%O
zbaUK$Z^>b={7Rr%Re#y@L&dxOGF(fk6Iau|vn0s0Q<ito7Q69~f>GADV2bOi{X*l&
zJy1A2=Hf+1Q$S0kU{g)L1Dd<g?Hj5e@XwDv6Ysz4dwrci(WrnSvR7rgYQ1^{yvU=9
z@w^SRd#+!#mu&E{6{-?w+plT(^15M@xsUYSjCK2qHpC$fonFWR2y=8=(#C=Uy2gc*
z4h+?hxb#WhFduW}V~pZ;zqV?d?&GW0+u7N%d0EPH3KZMpE7hEzhf7++z6SG(eN*q;
z_3TP8n^+Z8kyGPTw|Ozp{9$0`DEdk>w)$*8ol$bCWQ}GESTqf9?m9#N+WRdtYddEz
zQ*xleonIHy8)1hVCa+s~S}l!pk8Dt#%KY{sR<|1mw=c}ndwT|^4<>g;^ZE?*Z+tb1
zqUYxuJu31}MZ8%z#Emkpfaa_6_A8JRvJrJ3Q}NL7Q)chjbd&n12bd3tF=|n^p{7Xp
z#F@<O{^!2#==`#(Kyx3(k-;!CBgN!Uw}Tiq{2b5R{8o1_4;7hmn_7o~)1Rd~U&|a%
zdSp@lKjbHbR5NS-czVpT*zX!{_MQt{8EM1GK-}!12Ho8PI%h2I>jpE0HF4F2=8bJT
z*@kE3PwBogUhMrQ(2d@)g0S|=Da~on*$5mW+l8k?!C6@68L;Xb*-OGHHoa(7XK04S
zPIP8fTb%Q2V9+C!$EzoIo>Vi1+je`|fR1w@_KWE8k&rBm^k<Y@-+g_K*20auB45-d
zyaKfOO*C!c=*5$fB&tUv*};ZAofC7`2Z+@6<ni5EHr<~Gp{VlZ8l^DuJACplFJO5|
zm;tRpW-<y6a@5tDWTmwqDlcIfh_<b--!CmmK3_kk|Gh~r<y^UsavC{}hA+p(q0hMQ
zGUbmc#;@iMBI37)zLi}~1QeSeH_6==M`Z*{Tgo(PyK^wEe8$^C-(91Ksj?0J8~d-N
zxjFN_b-#Q(GvI@QcR)6%(9W3d)@Zj?jrrsch%{U8gglHeBcQ9ib!Wz1j@!H}s$?@U
zb|VS1tXz|l(<*>Np!~|RvL4ipp`5>CB~niPjt*9^$YgEX_|DZiGkh8fT!k$B)YoXk
zL9V({REwxAgD!C~H<^a!8CQlD^;YvemiaBhq`S*A+EXze2Jg%fF;u*_rY6(zA|o?W
zt`F%gXg6)M-PxHl##>)0{%Hnk0;v~5t*T$F567<Rp*J}S9Hx!8&8AT*%Z(aeASwpX
zPSAEGN0Rx^wM(H8h|VVue;%=O6dZ%hOTqCz3IQO$6R+6{D>QpM8yo9@7OLJPRV8-Y
zBg&(!Zj0-YE5nbj1{q&x*TX9Yhi#$Y$#aGUZoUTih1En-7*gFqY|ah(+=ah6OeddJ
z^?Wn)(sHvhe26T<XU^gku$LIq-Jq<bA0J99{+U1>FjVN8gKiqi-!Ig#6TWg<+Gv5?
zd_!n2SUuJLeyNxCgp95o?TQCD`(V{RrrP3*xnphS8*UCzF;IOmMPhHxFn^7*FFTBR
z&Z45M*`w+)&T_`G^OALUso}~yA}a_#IjhAhLK2bDB;5)9)Cvpw`VW7-`^R_NsdUXu
zZ|5Tt#L(xL5c*m*Aw}_UcTVF(t1v4(FOxopZdIypuyZTVV7jEw_;rmZK{1EpJH3;~
zScj|mDmrmPl*5I`Kc1WzuP(I5l0tDJzB7f^>S{Gm?@uLDn#uDe!+TTQ%0B8g@Jctq
z`Xmc|z*}xRQ(8G0dxVogt}}9Lq`T~1w}~&!FW*ZhnbC_{^MqGb&tV`2-4;24AwTt~
z*lYH-#jft7zJLd49N4-82v20y=yEm2R|L~~d-1b_GeYwLD|T&eA6}pYR9j8vp#vnO
zcNJNmoHvuXBe;CMZCj6E<}cBVw*81@yHEwHNd(1FH`GXZj`40CwegP7*(|t{IS-b|
zY}<ag+(vEqV_b({UtKffmIokGvKvhscuom<c|ckki3tZw1x2MhhmFizcC2;!F<BlF
zFE?A=yrxlbSr2ovm)5-^`h#3Plhd|jTeIK1g#+Z3wxMvIM*f7SWN(1$N!YjVOrv)D
zTui;lbXE-RC3;Q`@OQN+vCpIXFe=|9OLgg1HK`H5gV4~(D~1%<?%5>NKX=#P(K9x8
z4bWd74wuzUH!(8aqp095bCPQmdRLu51edYSmGC;Ut}kpu!<Tn+MmFT;CVe4Ijer{H
z#%IP<647-~tYogAn+j0#6d>wn#z^f~*s?;(!{3QWd2vMS6j}MGXnm|tr?V`BmaNF+
z9T?d*%+IW)k{usbSEx*@1KmBceG`FmD7uUQ8vMwSx#<`sJ02H3OZ7`9bm0-ix8v<O
zV1;Fl`=|MJdNGi*{%A77?lO&k^7*}hfSBighJRFQM+zVxb)ee786_dsLI=6}P4{AL
zJOhw9CH1WS!mG8G#U}36x$vD-%h<TQ>a}F;gB(7u5-+~8pWzLY3hom}g8ustrl#F<
zMfrQ2Y&UrvnerE%m*RP7gL%y_>B>U+nwonDfViFZ*o=_}8y@_Kf^S!pKqh4(PZnG%
z&<T^E;|w}7$wVh<Z)uI-!<~mq;^7FA-xh9!%76%P{?NtgZN37pRq(c|A0F{*Et!cY
zY(2T3ee=$HK;VP^wxQ6MPb;2Jn%F}0$~(V(VL&o@iQ^j#c9caa2Nmg2Zsb?iSPmJy
zb8oXnFD+5Zx3ZcMubCa3CroIV)FNyWOO~A$6&Qi}$VTs~4s{bl=B%gGN6i@4AyfIg
z2W(#@^?s$!%{{Svbt6y6Z@#`y)Zgjjfj6+eL%m!vIZ9xCD2GU3sXp^YgsbsBSJBdv
z|0ZO`6c8#Xy=?8Y-WJDwC0q{y014Ezcr@;>T8yF~O3w{MmGz@t^<%8p*N^TtIfoZa
zU|BZqd2gk_h!)mi+bk;u9zwmmL8d#yIl4x2XvLt~-7R?`ySh5<9Md>lke#gP_s81c
z6AN4TwA&Ij`T(M!0##Ta35@o?D(F2|_98w+#Gs1hHC_fw+T4ccf2dB?IngMcY!9?a
z>7!dIXg^u~n$#qf@VgLNopc=05It|Rq5CqEgv9=1OZ6Er(m<yT&tb3{(J?|vxvZr^
z4`eRf?19s?7L9PD4JdHr4!7HGSYmVBvj=`vWGCQH>sy2PwZOV?Cz@*$jt9iG+eBTg
zl#I|q`P9`07jZ40JPvtBpt+aNMfLu#S}xU@>KgeZNN!O`&UDFXZ)_rYo6YK4{!0Ts
z8)eZ}#jmp-d?z?r1j3#2%oFX!GQ}$sCaOBc9J=b9peu)iM0{Y8z-vJxx8|q@&lss4
zVV^GCWrIN(Uxs0|gK-)jGmP6!t4~s(hL*g?z%bG+VFvNdI7O@Kpn&frx6>t}rxSCk
zNSIrAUhpN(>5cq3T6y*FpVgadEd~jJ$@N^0iIu*;>PEU<gNJG(N$2L$O&{L}&NKyJ
zdDrBWuCE-F%WG<G=f+?(*N+H36Hf`nxOb+e#?iWIH|eHT7)eF6ymRKstyZhuVybS4
z|FZkq>`kZFGX_`h;`76npNwY939lXMfKHXeG!1O#BeCR0r@v_?G3TN!*;t+=ssB35
z=VI&Jj^`P7uQnh|7gxg*7yw(a&#?O%e^@*%aaVaba7<B+6Y@lsk^N9J=4Q}osHCDn
zrJ9I>k$-!`_TCX!Fo`5tN|PC<Ya-*Dot}^1+OQom1$Oioy$xXHjDzo76Ml(e^7KTc
zHVk#rGF>;Woez9^d=Zn%eX+GcwGvqezGL|QoL*06CLD=wdW_=LUSi;o9ybp^CWKZd
z9^>C#x*M|zzTT}OLT}1{*Enlkuo(y){<`V!p@EleB38(+EjH@j4O#;g;^xbvoR=Pw
z;ni$GEFklZRW>NhwysMi<H=eE`!}No>M>PSPHQ1o`V`I{?Y{|72bU;yR_hNLPi7ss
zDrankUyBNm*|y~jmhT))cQVcge(8#%3Z+S<dokAf%qeP8w2npax7=*LFRIK%bhL4&
z?$=c@*`clYI3;F<aNLd$ys53hhLBw!+V9UtQ4zDXrwi8ZTwfsh%8hdb;b?J%Ox2$_
zjdI`FmiRrNJ!;RiFy7~KhXCy?I?9a(d6&zCTmRmlpcJ>is7Sb;S7~Q;O~^a3GLev@
zYe<t2#*658P#s#K@i^d~J)iGxo4Z=R)i{iR1uK|B=G}O#N6w>KLwW^*(WSY}-hnMf
zCis_QV00LAh4mh+Lj_k~>PE*4KznLw!inYmeYV+C6v-2sbB%<wyYux^F6FVVox8$h
zWSq|RkqNxwxQ<#&yKUy|*{G<JwQ|~%6^_M4skU{N(a3z=>AFRmIe2|^%Ek%Z4!!%>
z9sQcU(jAq&D6b;UvmC@f8CzB}n_d*A=M8k=pDE$8lQs28C<V!C`LK_%!>611^=Fjs
zkJ8Pl$jXI-1wqOx-{ZUZ0j&e>FN5z{{>#-VJ2X;ZuddC9@5pT$fKTqf)W>GM;WU^7
z=9ZD7KlJhoySw{P((>GFm)DzZ9QstddD4|G(X2NP);_rhCVi{cQUUQ{XOY-gPmhm2
zUneyrN7^X#PHAc9fm1wJQg)=du59Y!fcwIgL3IQBG^=ztMenxBJ>P%HR5_|{&Wo8I
zj4d;zVh76Dvwq;8RuE$~SO^oCVK+N}aX0Z&l?IVnb+_%Yz`($}c)Id0(W}D@gZgl%
z%hZKE!lu$6$NVl|F^J!6Kjcq;x{Z7xPq?pG|FPl2d`NifoIbNMtclFc37Mecc^Qpn
zw^^`-lhgWguw8)TH$QI5JzU%n3^mYhti6>=X@z1uApYE3T2@8p{w@4dpqoJyLBg4W
z3I$1tZfw1PU9OmRn|^9tm7AptXuy>16)xHC8rg-?rjzr<<UBuH*HT$ywcY7yHqjP1
z<2~`;<W9=^_u>m;L>peu!A!|yW!A>l_8u*@6?IL0^K(r#=w^=QP{e&|1>n8G-A&gN
z@V|i6lYX>+Trc4NHKR9RCLJAh$1>@Oy3N&IEZ;%98<#D@uMf=ke|_)|!X|mQ@&NqU
z=5AL@+>Z?a?3&k*`1v*-ELZvZ`eN0&zt1}31=Y8>=-r-)!_HS9ic`J%+YfM7Jad<J
zI<|Kv>K$}!Exh5b2y;Y1@&EqwPt}@qP_BB67oKo6_FP8QcIeZ=+CFJSbVAg^YhM^U
z{SGbC9SXu8RjvWmqkI@fAq1p67Q_1nh-Z}J4Pg2&*m(Ej%%&HNi7|VZXQ>^UGK_t5
z9s<vNzDrlVOC#O*zVu8r9WfxMkh(|9lUl|VRMZ>(@xWG!|MItztzB{rofX#^XE?-5
zPvt_{GCFK-Il2Ftznwa#q;B4&c;3!rh`kUR8Y0BC%Y^7>Y>^w@X~W02v=`RXJ%?C@
z+(x7Z3L|fm7t-e+fc0e_?o&#J&^=zr^PEFRby4|BpsJLPz48{C1~|z6hFm!I|E3Ji
zOlFQo28c!E$ew>!E@3$=^OL@HQp+<dROIPwrM=W4ROEjgWM}5+Lg}-UDLb!{8l@qe
zgjMfF#{0qw8Yd3a_!4I8D63HQ>isB92J)SyhGa+Vn`CV*B%F>jczba{uB(m0S5@2M
zO2F`w_rBpNQRsmUJFCZ~j{4&9Y#}p34eMkKvdz*NXu@vO&$7GmYTIQ+VBr(Rs#sxD
z0SFiB1bx=bZ=Xq3bh6as^XT)vf{7E4G4s%<3Arc>qjj|fpUKM)9z`h|@fQXt(5tje
z(5kl+UP$w#cCNa~c$H;&c=aAgC94IXj^cHj(1apah8wLuX7D=Wc`4;bN2@Ef2ejv^
zGhC{rs7TTY3Pc6a(!l7x!9mkX;PE<Drpz-|g@O52KCTi#4JE|wV_x}Hif>644O^wA
zTUuqH0&dYeR(}b}-`b}+yn*&Tt}Aj)NwjhkKgO<N-#FPLU5PdZ_ioPebVOg2%K1OW
zsrESsLJ^Pt#WVka#zuX9@NV1%0K}*ItLwkZ#_X7tZS?jQV}UJ^n()!~Gs0YO*U?;D
z*8rx4fXz4<VXSWVy>5AQr_Wo|w!!bw&BtlSXxZY9Ai*%8tX!J*3o--Y;0Y%%_T^W3
z1}84oa0$t%%8lz{3JTBgsezD>slC5~?1r}lhv+!rnb-?Ko_Y_YP*rB<r}rVTW=tMl
z*A(_=dP!M2uUDl8W8orRKvNw(w*PSf80(mOn(2m6%GPz~<7xtMVvcnfRRHsG^2Bns
z?0n{;7(H{&pgBc`Ww1Kr%qfyydUey20+`pq$GY<Py0>zBMpM|5H#{r(qCP++I`6TD
z;&v_kP}Tuc9wxR+X9U}bZ@gX~axKDMt9R&1{kSew`=lqm*pfXhz%D4<wz6fJRbmeI
z^!zma;lEk{4h~svNk>ht6@#kYwOYK;vdZe7*3uF_K|b0U6Ld}Qxlb%7Zzzcr#`qkQ
z#I%#!m62>p=h;&Gf<#!YK|n$>iZ~Ka0<$#3$7>$pjzNMJugrZiaG08(GKcP<>8E6e
zBu^$z*vtkctsTAGbvb?MK0J1u|6?_x!Ohv>&6z;LmFp*iQP0NY-)h-WCE@>_YYszi
zwHyaqq~pgdPE@?}`MU@d^DK+j@<od#D|<fGUli6pNp}18wvHt%SvR%XplUckE&Vx}
z@Ta*?Iz?o93c$fNarVO1=(POIaz*lp#u+zPDQ%hkDIvCnwd4W-H^bQX9Pb?<b>mv@
zpi__FhtBC9ZSzF~{Ri<r?I*GNQ@V=u#S?Exv%={K8v6cM06`14tSf%-6oX`RBrY_7
zUM}}=eo*%r&kV<z<|~{Y_ovE^R&q3KSVYm`BW2&|#TlG*r+BwYSOP~U;t9KQg)_je
zCpry)GS*}$f3(9`Bs~{z98sit!F28Hk2lHkN9}P9K9zV-Qi+%yiF4_5C4J&jUt@ji
z5PBnOGO>P3D?47`12g=<5$i)EkV^@T^>-Gvk%7GI<4nP`)H{OwenSJAvs#>-`-&u>
zoY3N~Lct%*XDUod<>pu~sy5Zolg70bHTu@woLntzZRnVm!zRaNbaM;VoW-rc=M&>f
zLCoG8)x}p4$=c+)Dc{?EtX~rM)eHAAH!CW(?~h2}HN76_`fN$c<Q%z}!yFTqC`9C}
zm8^#|Jpf=(tYvz~y};nX#6Nx^R7NJR<m#ZTWX1U#aF;sl)K@qrR;d1TR_h4NkX>gc
zeWJ^~NA|z^lJAkJv*TU5^RYN*Rrun+)O1(B(e(&Q>aORV-(4HeRy9@v9~9=kU85~x
z;Tvhvd;cwFyu0>uUc3)k0Ant>UW&yF-mkoU1WB^*(at_otLRaaaTFB-wld4LjJme1
z4rF02dutQAbHoi?iK#79&!w}ZHe8>WPJX52&{_Gdq-ZuNN4(kJix5%S+r>N>|8b6e
z$Jop66YACHf*<Fho2wPRMlqnBp*Ur3>rur4)@g$7H=dKOHz(cFJ9>IA50%Ntz-%=J
zYX&n@Q(wZ=pONzXXcpd^Y@<TLQU6_IfLR(;0h;&bII{c4WKK<6kf`^@{)Y?9zJ%hd
zGuSOFbf8-S{MHfeZ#4bR%OLY1@VmW!h*d+E(}62|{IiGPu8hR+rsHhES9I)F0Oa%6
z(f~gZuEbdbrpXJ16CIs=o#8`64!!c@Hp1yl7;9>M$*3;YwyGXhob|PLE=FGsU)?~E
z{Iz%dO|j&}x833vtGVsF*t*}{Q14;LLd?>-2harzm`DEwr~E{vOy9!10!-$%DUtFl
z!+ux3mBV3jL8u9dt12sDVvKRdXpd?z-GbuO+@h?FTJ$4)t_Vmd1j6l`xUBK5j|&x(
z^TEg3YZ^2wd%lS%_n3jOh}nweoEx9*dk_2WttXp>fUDnaS%ZU-(^FI3M0}vRT8ojs
zhO;X;T>Z?2rGC&jQdnw|0XlKG2<8bDxm;ha5KSXZ&CovsFWZ-W-&&~xNi${0k3RLd
zs%oTQe;ZX$rJD8hcA<MR3{jVuaoWdG^-!d|I+m(lMoL+fYMmP%7qF?4uch(+MjTl&
z<PrLqhV8G{1@QAyG(i8;MMVWYvv0s5)Q36x-<)+(LHdZEk#Mcpdo%>2*H-rEdmq*>
zFmS8fDr9muWx|1kp3nuK)0oNIo1h#@9^YtOf8KSVIypO57P|=js`a%9<t4(t-a1ig
zqo#2HgiyITkWBuPPUf`{GYT`$j*RG57KTKCj@m5kW8QiST|KDuCQfMSh1HjrW{~6)
zY(f808UVm?Ov3^BADtRIpMwq}eo*7|Xlvkr{_o2}-&^=ab7{tMXZV)-t@+-GsfV#Y
zFOnz^rbBqj>(fG5&cRZA0H+_&o@`v#mClpC{5jrOCd@be<)$!ABY(C(dT05HOoXY%
z`~2+%txrZ^sfq(JQ7TNt*AW$FZYjnGA4yhE6Q%xZEx>U4t`tDT2NiY|CF6@y#k@5d
z%XJxgx-84CX6k6{X}LkS7q3pvUz0o;;T}A+71ZnXtXYUV%T3F7&2m-CmtQ|7cNR0=
z-}1>qww9d5bW))6UaxC<?B-*qf8*Dh&xQkp9GAWqZ7VdPDU9t=-4ZXath59Dyx>ZG
zLEsA;0pY_ch=BpH=S0WsIum9_V-GW<$d;B~aaJ|-fJrWM;`}BN=0R57e3|yd_d?C6
z@bZrlIHCsZEey3#?>AZI4i`rQinxT9r;#~D+bpj3Qt1D3JO0eO@T1*(!fBqHjHo4}
zYsiLg*PC<)cXtNp*~vv{78RAxL1E|$Kl}EV1YulDmzA`dt_b>^DubgV0a1~e1n}38
z!hw1ziP40rb)=KLd<zP++)GM!iEt@L;#-z)^ty^b#$IzMB1{R6jgyg+FuKU$|0^sG
zMr{f-8(hO6`ksyl17QADte|IR4P;zjet0k5#U1sBSx}pWp~BS{;B}RSXU+ukUmzi0
zQgpA*iNo{1UtKTD@g=(-JGaJ!Sg4t8!D4mFjQNTeZr1qOOXVOS!+0;W(jHMy+(TDS
zWWf3gxD4T>)p4M^;B<OrNOdAMfM7bvnjQ-P>I#_^?ganDz%|BT`D+kA5FAMG$M>cJ
zTBkJwho20K<H};`>FRND^Vi>WsyD6O6{^54*1*2i*GC6k((VhnF*QW_LbOmX#_j2_
zNq$qGYlOw&8Ki=5tXuG!-}|N*RU7-0qyn0wKQ^0a=nvS2HWe8`lZ30TSo``J419^N
z9@~*~v5El6%^R}dYgKXjLq7d!LC5AL;=EgN#a<=RQ_N)l)(T4fZnxfT2oiSkyQIDE
z!D;bDmM=8Id_tjLkm&IOu%+}a`G*_Sq@L1|u5@u*JV+ufeoMT(Meh9rF1{vyXkI+5
z1lnEms%^7}-O+3LrVo+S8;%dUs`^pNM6D$6A4HW9Nau`8(s}gt-*JqZnInEUOH})*
z2?Lrt{c=Ee);1e?BCya|Wp(QIm>EVd=}mriFzI{AVU2%QId9$;Ms-;TJ`XuMx3(vn
zv|ZgAR`6<6s0p;ODXmP6`DkJm^SNyO;qs^EfAajp(pzwh``d-CF!k-Hi%u$|>>A8~
zqaZK$9^mkA11n3*xcR1|^;kyL#;3DKAmOVh{o)10{N|dcpmW;4S<Y(R-5I{Mr{a2Z
z=*S%ou;Fqia-hR|H`I9&a{C5)vj6dBsm0)V?fTrpgIZqEcQF!lg*YLXa1v(bT$|uz
z79AHZ);rW<_r3RXN99y*fG4<SrDNAoF+v5&8qB`?YHb>wHrs-{14H~T99!Y*uGxVr
zu^M{oySRgO%;<6liH2@Wv|WzGP}Qae3bTfDO<m|%Koxg&WXJ4YvIK+-dh@h1NPzEq
zD!TP;%J!Fs<RPKfC%|J()8lX#uV<G=r*Bl+A@Hl5_-B#FA=}AY&-%|9+E+lxYBJf{
zD>BZeKk-!ABW!j@VfT8&XlmL-yZ$4NONx6IM|NhiM~Q|#tmE0z&-RLO+7vgTX-O<J
zK+=d_O_G+cvqXUgMN&Ic9gY^3(qUOqmESQ4&jAxyME3}@H!b>S3P8hap=0Ijw<&i;
zL_ue2Lqw5=hhp%XbDoa)0E`S^Sd++TXH1rpthR%VNVv&esiA+M<vzYaC`0#L-hS{@
zCiU8`gr-Y3LEewPmy3$781j?rV!*Ziz3HKc>9~bscV&+3H)_O-ZN>9M)W6JA`)->n
zt1F+6hE{qw-BtI%^SAp(Vb0X#Y55SR!&blR123flR@94BasnqKQ{BKmTRr|ek^R1I
zgD4(i57XpbFxDMe9tPi)UUohu)Y8MNmT;{5CU0>VwwNueA4dpY;JR=NF(V*hcGfIb
zVXqlJPnFWx+RSNJh~Ij{M+UW!0W+u*X~jhzw~wZtYM-RFMewB751*b@{r-L$5IVsl
zJH^XdgCe$PQk%<i@=~%}cQ$#T9xpI-2VUvR6K$g=mf;cv@K{10Bf|nC+{<q+pQ?FZ
z=_<f7E?C`+#TDZ8Pq4b%mGrOq{%n{C8TtuLhqQo|&+mY0F#WXbd3khQihb@1Xz&+&
zHm;>^lx%|Z1?aR^?@JLTHQ3q3^k`t#b!$eD=HAR_M0W(^Q~~pk<iPpOuyZS;$*5A5
z1YT>c_@Aas>S|8zjAhyiq&$!aEG3tW9`#A>_bR93nA-U983#HsWn6E?x5?$5Uk&Iz
zMKxGh(N^F&uY+;t7{*riNY6S}$S1Zw^c&$an<?#dD0#h3Wd#1rX0$dm-ZsN)45;Gr
ztzwE-_d!Z7@39PrPLx9snQl0jqGXS`p_m*rTSxtq@vM_hne}a7b7!SSD;es082AN4
zFq8<NAXj@MobV9+?y{OY(IgP8c~mDleqWETn5H&ibg|>@im>8QCXdU7p|s+D+MkbF
zhFb5i-IlUvl3@<w5(H(EbTjCzE?W!qf9jd;b>R2pE+$YJL$Ge8b^Q}Pn$hc<@^8yu
z(M(?30c!bUC&8xL$vQaNc+nVSi?S7LbKi&Ty%!_wro^`VN+JTm!)SUAHu#g5_1dOt
zKeD_WRgN=PwtL}~lAgwXtP7TrQ%U8eh~F=`;Jrpc>PFY`g{VNMxsJR$Z#%ngw7hgx
zaf_|I=X0*Xg9%Z^QNc=+xer3M32a!ZdE}AL=4M-7pAn|xbBgt(2K2wwh~$mouA{<D
zjc7Y)2^!e@Sw(;S{Wo|6_`Klq<NOIqGU#Z%9n4<PBe9y<Fy5MBUexcLK~&Xq983}k
z{OgN_QUlrm6VWxdLZM9|!XpE--?W=l-_W_xQ4lHM&k=^JIlbiNb^VD5vC8C9_ss&+
z;`L!#dy|J_nOb(e{V@tn5oFmLXQDBcoa2l<DYF?Z+I6>jsv$x*8_zIi@#0I$E^#f5
zye2&Mr$#D8+<3pI#2FtrS#a~W&GpzQ1av0X*K|cFD7c7I3`lnh@10+2$HlT&Sts3=
zp=><qVQ!vt{mR!m#}+jL_E8iL1x1obJSmIV9RGe-xb2<b5pFr4Yrj+Nm;IzZGiDKe
zWWm2BugLv<%)9URR($X7N#XYxhtg#$Pv=n)-X~n+yB`qvmltq-+H;*{x*(;EsET1<
zsvqA3`YGBYrp)*U{dubK;&L8DOPT@k`wE%Qsgo}iu{rp{WbybMCOc%^`i&BR>S_*>
z4pLPGL7dRJopCg{my$q4MOGO{E+=)z@sys3&w#S5>0}brWF7LVMsadan`clwg+C3<
zP!xPDh7bLCM7pfxU~hq*xGHNW!`e{%*#S94@f@h(vLo5F^Nj!Z%-~>2R+~e;wT6e;
zLaw~NO@K0&`+}c3LMu*$R}1?pCZJ^$!`XT(pTI8JAt`00qdcRPm6nsgHF)48&e}m<
z5~y%*TR;8Bf2jR~=FgGRXd1zw%ax`P6~|sqzX^m%=(eusM#)S$d$EyRY@ovtgQ8{F
zj81XcXVe=*JeElHz^adS<AwNO=0w-Zh)_EBKRrCNk6@Mz>Sls1H`}S@he+D0&6fwV
z4g)bIes7cFKT5>0Di{&P&2fDOo;|7)UV;Lqj}b+Vc9}M#)&&<<9uJbRVj`%gbuu+C
znL`DSFNMaK_^(k`ipLJ|onx4KONyeMvY46ls8K8vg1dyL4j!_KWbQ4=^yHmr!ropa
z8|r#7^|-!aYs3BP8vA5{<5L0=F;9MCt#HofdsBPb(ExDkK0Nm;etBnFAAgP0sYYoP
zKrV?CUzqA9TJenE+LTc_le@?Oc8AhY^;<=|r&BOah`Q-;Xl=0Kd|`Z-QTh*7-QyhI
zPM-AbfL0YdJY&ue2hiM{w}>5MFJTS3x=Obg_`pQC*HnIv=7md>d<SERyWJ!CFvTMa
zf01P;=7M1PWk$T`Y)T5QOINjwpOj+MKW!U|wMz<BTRC%T+V@)f_tJ_cds4qJBQpNL
zmY`Twm6R)adY*1KSkJKJ{fF7#dYa>puJozm3z3IMk^KXw(^+R%`ny=KA7FJfU{^Nn
z@N@)=TKR|eD6T1-%asS-Rq5!GbNjol_QVhLb;NlL1(d81{^-zgJZ0A)w#VYQJsC;O
zEu|7#WG%iDM7<@2+$#$3P5<#{@Z&%|*t~1#FQQ5~i3G-oefq4u=7uS6eQt;<g*O+^
z9D03LqT)%r`diCG*`<doLS29Qy{R}sr8hYgMG!{jvs5lb%=yO!DO7!MI>;lmB_=*u
z?1)(#PAV<Jk|b$eTF-xX)HT4{lsZhkSGcKywJy~73*%$xg<iemhM69!5j9M7#&i`@
zjOUA~8o?79xL7ODWW*FGfgm0-|DF0CCm!SKXpPqpL(Btq@Bkyh|Do<JquTnSw?SG;
zDNvx40>z8BxYMF7PO;)na1ZWIvEuITE$+cXad&rz;1V=ICT)NJcV^a_H6P~Fy!n`{
zdvotT=j?O#exCj8WyXWtrO6L_GLc_1N}E}ti7C3*rkTs~x1RwBO^!qZdBlRt4^Lmb
zFk{#;`Iz@f!y@pxG+z>dRK+P()iA%drfU}t6X~uAUx?|H#q5`tv`o0P)EGJtqkgLF
zCXdou*HJO<DsF^veDU_3kjVI5`~1PKdkbJNot`n-UAKt;NfCPG=j7%eg+DqCxppW;
zl?;PF@~eLpeL1`Ok-0O_yK8uOFi69myzgAUdhATY^BAjFEF-mydm*BD(L92hiL-=n
z7`HQHd-O@YRZ*>#C6Bp23$NHDuPr-FE3So?#W{~&dkF=ets}u)SUu1fDnl`j#@4me
zGHJkf7f?0Hd69KtOO1B68!*5c_JgS=0OPo;!$?NA<ZZZz2fCFW6NB;OUGXv_M4FmO
zNi}RV+oFGP>+5-4w{~EvYR>$#*^WRyL|)HdKqhS4L1`3NpJwb1a<6ko)&B-66{`Qt
zcp+}5gRJ_TZ_iX&A`Vc3Hto@vi9su52*8I|mJ65^I{#tARHB18@*U=oJOAJo9H(Vk
zKasUi?wo|6VE{o^=o5Re-G+%dr6>1`#DW+TO-81j%&^YZZBsIfVR^%TQJYBP^<Tn-
z)M^zN%xWZwLMq8so0$!Z!ca0CtB#MG7MZ`-6#3eom8HFwN;EWHF1i#a)oM^utygI^
zGk4`=!@~s;SX&>7vzzPV`T%^RVyuJ>U$=r560CMiYKe$n{|*#aa;(v{GgVj?eX1Lt
zdz*Nqz>DKghmD3D>*0cK&^Vp_bMWJ**VdA(6g^q?PO~J(r^1q!?O_{9HuV^_uHs}R
zF9o+*-nANZ$QkQo-^!|+YhK6yViJTIG-UC##?!+n8%iuHmzeb^9w0yrRxKLm^kT}h
z4o2-~2-CE?V<HNMT(;`Rpo^D=vk_@RkB%2R@{%3M<7;31pJNlUJN6-SW6zDfl(Cln
zzstpdgnqHeih|!>VF-JFLEP%k=h*FkClQ&qUypOieeSEOex31@g9&+|<;MissQ;j&
zd!xTfCsu)bJAuD0G91ZkcO*<>e;U=rc><ekE2J#~zG{B^ha}-8)gFdPQI#kmgd+m2
z1?kESc^G1B8hNP-&${14P*nx=7j6Z&RyNMU3?#G=NpilgG>h`OR-Sgj&>8D=RC7Cx
zVXh9r;>`G;E*jxjalm6ePn7h00acmx@=6jI?+@3v?x^i;SO^&FnYW+L=MIEwgAji`
zqtu<^-fYa+&v8D|Kc=s=aH0CK(&Th7$O7hfx`NK9rXI{zAkvI7r%)(~kp7U*eJ>(&
z@uFSe^VcAI&a$I*fNbPMx_XLpY{5W7XHyFvf##46X|x`FL#E6i#giw%TemX$M<ql6
zp#U?;z5bQ{Bbh^^cE>qi@{9u1`>q;2czMwaO+z5(121R99+Bfj0IITsLY6J@MCC$9
zs!o}Cs0{*GQ|T+8rgiw}VqCwqUoL~#dveivh?5(iF}IAM74(YykofHD>ZW1lvMzX`
z7n0h_#s9EhJ4b5{a7$q%!Z=C>YyWvSJ%KxJB%kG*O9+Rl8MJl5?Q#};R|kg@T3a7q
zUJ^uQeYDH1o^WnB$`8S%lS^LP-}s7jTw6O70k1O)d64w5r~65%s$!(fCzii8vb#d8
z>g$BY`q8oG+fO57nY!WxQAD0OG$(9lLb>UDT|6hyE&n<{*UZy)vUut6z4Zy6AQT1g
ztzaDF0())I*m#KVOV9O@Nu32bZG}rZp^m}d;nuM@bU+oN8lB*ISxZ)NjHo(P?_cKD
zBPO~ZRQnTEB7)-`=V5Y(uBp&Diz~wBv}_ZNriA3_g(*rQs^BW;E|n|Nv!cdVf6L+9
zEiUzu1U2m(ZFI@X&Jb0_N=mIo?|Z}74_e`D?$E=Ontf*NkGgIfJ_CXeup;=y1O|&-
znuY%5!4T{qZQ62|w=YRl#jPMvc1o)ZQTaAcy;ZhLx+RVN#u8ICjwc;YcZ;NGw)$4b
z5yZa4Fp?oekn~E(vS+A$_h~RDvA8$0it;nrZw%X{*4^l=vs^q{V$ykbvKEOC>br{;
zD#GZ4nvoW4ip*Bw#wtpkWZ>2v1PZm0cOcD}52$Csf2StSGikxyUt<f<zP53{|22_{
z2#4t=xz%=De|)OXOBR~6`)xH#L>V80Nn~2&liVlWR+_t5co4T_pSvJ6htnF1Q00)#
zOqJKPYLl)WBrCtJ#$BfZO0Rgoj%5^|T^NQkBZrNN)>D-`%E$-k#JsHHl?DG8dwVBl
zmbzzNKVc|cR~r23&%Ajl>Gjr^kFR24WAPxS1X0<j?;mCM`sy1!B<rLNc05Wv$;-#r
zpW#%vHWV=C#F#m;1S^`b>E2d|S)2z@nY4Tu?MX+&FnROv0Y0>(Myo#d7*J_UM-^xP
zCWRug6!T%HCxRFi+sm_Mze_rmfKE2qv03LhaGzPaQTsfcui$HJ#3NqwPQ7ya{=387
zVj7m3)H$a&7zJ`2xtf*qELX0|=fwg!Y;MdJ_Pt}&{Y8K~1BAxQI5l1DT!fp_UYLrx
zz>)Of)ge*FXUj%+@_7V)O-bx8!XW%w`_`{cbpMrg`3L6j10$(ivBWveavoTGcSaW#
zX{kRLS|QV-CrVq0T!!bjS(Wik;d!6Y@mJP7&LkAfvbBz$ZSH`u(38S)gxHFLm{rWI
zlaoyv5#JA}*xVmt1X887*F1{*ST=<SDsd5D<qVfDet<3N{w^j5`y~ZPgk^pPt>1Zw
zU9|`Z`}t!?=U_~=_SoxnlQr<}qT}v4o}T9HvV!T@K5EQ5xulJ{B{iKr48@MXFp-&x
z?*^1kx~{+{(`(+4<Ow?h&BHS|_CXSfkFzH_Z<zCE)#19_I=K3H-L;*O6ljP8h%Bzm
zc|%H-GLCiu=+ZT=Q=LyUeMmhaEj^dbLacLIy0N@t+I$OZ4<S#p%$ewz&XO3^_;uaE
zrjAy4db6!7`{&nT?v%L3$Ca{MH$@azRRk8M{FH#5L&#GT|4TuCm85iub%PBem`l_s
zk?I*ROX^Y<>;8mFPREQCg-8_4gV}GM4b~b6S$txiYyJtrnW%Vow3Yb2ljXGK@%?HQ
z#k?Tigs%~HTUf)?)W90nGTUEHLnXTxp|8y{B}j%~DKb9M)AQ#ITpZkAW@4^zT$?P0
zsOckQdx$cq<~q*O&c=M{k;x3-8gFDF2#|n0Em40`IPYw3@&X6BMygcfZni5L8d9y3
zJ~E%<`AJ8WX6H_`^C2pzf31@?F$!bG=R`8@EtB$2&GE3Txm&e-@wIBRj6&V3tXGsH
z?lcj&iL#W#!yYYP=X!p3hj7N~;?ftKzoC1hx9#vwtD5Cv5`bam>lw30-;T~jo`7ir
z!mmBQ;8+Y1h|r>ER}0<r)1psRR={!0K;V!J{@9aF`M^N3<#Cv{Vi5^}sq4--XY)7r
zJa@KtHa1*#Y<o`yxb;*maaYOHn%9^`StJMDEioQIf6|T!uLeX(e%U0}ppk8kX5IAz
z=YC^U5MFw!H(s5T#LIv89<;!Ov4~s!p67YPCpvciuh$A0@mAz1f~)Jo%P6XS1yW8M
z&)COr+qG;gcL%;RV@{x^XP}LzE@3>>TG-z)>@D#7@}Kun2{`*5>*Jf*`9UQ!9fZqN
zehfR;P%1N9L`W-LqIIBmaH=0)_D3WaQxY?17R5f4ZA|qtMF0)GXyZb)CtSaqH2&Ih
z{&{oOV_v;E<e-5!mMBllRd{5HBj5Git7^TiLwZu4n$pVTL!Q_)9`MN%EWBya0`?~M
zfIgV_q)VEH(Ej0j*=K4-g}>*zBVX11&YxfM)LD9_*7S0;2koG&>yE?W67ax0R<5Kx
zopQ?*H!bTCmazj|ujfim&|LXVT=Ta+Q@uj)WjppuLi^3$G-!7c`~=>b6^HlwUjGqC
z?|*UuK0T47CDRrlpVOpy4pZ6mccL;)BS3!qWQ<OBME&&uMa7F6#bK|+9izL%RsYT<
zCmS+X%ZDdo*;fxX_@y4DdLE0=hF49woebv7T}x=sv$zS$7Rxa;#n-%reQFs~pIO=~
z?;E+P)QBa2`I;`LLCrv6KP^|J_t5p;xVs+%`O0R<QuZuG^eX-1%0@Q+j;@7(?r=}r
z#4~9#;e&T)=D)QR=W8ddBslrQG|w3`nWg!yl3J7kWI{rDad6Xr%Xb;Cw>3Oey~ubk
zC*K`G!=20+dij80qF4o$y^odODKOJM&*Lao5ynvmH+;Q-qmgTPH53#igtaY6*aee{
zRC^?SPP^)PHtTGQD^Vh;6!^-Y=C52$X&g6ZPX}IHXnQqb#|@}T7Br4V_Q$V14?-9<
zQZ6!yj~M_zyTgT_k?Yb|z*iER54Tt0OhSO$uH;=4j2h76=?VEBubf;fVfghC9YSz`
zimKexqk9dvDg9va@P7P`zM@Xw3J0^tCM)A~N9$mw`d8X~ESi3bb|sKOGYQ&{H`(0q
zF8rAZX&G|A#KHWxb?)=tp;y6^pZNBnJ!my`Ca)R@B8d4$CVJn6a8QJug>-)+Vl<z(
zP3Papd}U8MyPE6-by{W+K<&#GTM$Nvd3X;9Yl>%5MpgnXs1ed>c9&8e&b{IVp-P|o
z5m~Ov4Pew>%-Gt1K%1m1(krF{+M_(e<Sn@>#2)<KI8Kc(M50^{Lx+$lzN@ha;vC&D
z<QuKwj2HUmirT1&9b;nuJ%P0Zj^fmk=ZMG*OX>;EFq7RzIW|HU#}FGu-L8er)au1`
z(qPyJg^8gFkI|^K*J9!21h5iS-S{2w%nXt@v-Ns({x0>Ob?(cx--%Ret2zds@w`g0
znAoDhAP_J!jBEBv6V6eucl<SlTUWTlaR*Qfq#1pJZ`$f^)D*Id-A~`nIiEOTHN-1c
z1Nk*m@L?rtfHwob@Mb3qD+*HY@WPXUW30;>+Wh$<N=dWWvw46adUZx`fFb-zn~PXr
zMZF%=S!3ONP)capbV#81<1gU|;8wc7{EPV^p&cHc?^;sYbh5f-ctITlRg6HMuo*e6
zj5o68Ik(JcS`9;oUBlDqiL*<Zo(=xn0y*E7rZ(2|_8*h^=0rl2FF<cA#5ru4c_8t|
zuz@I(PTx_7JPS8Nk!oCG!_CPz(0s>&<wUP(DE?>dG<qpd5}aiP$)15dFXq3}hE3D>
zsaLnohbBzakxNUOoPqXg;WWES#ralF*r4Vn$kSn_tvja+f%N$goc3{gXp^!v!DLlM
zJT#44z2go>9C~)a^u+r^LUeyscuFV#ivQdV0h}M}j)j4TX+EAeNmk5zn{<&;#IXFb
zBiqNxkrK7I)yGL6!ON+QBz%pf{NqpU?ouih7`2h}>?{m#YMAD`G=c6R3sZ0P%wIFc
zjgkZ%*VcoY8k_zx@_Zj>lH&Ams&5Jc2~Uiz2i#d4jr%Hm9u9sfIZmExH`>#fN=L@|
zZz4`T{lJvBv2ym5t8}z<rLW2CI1x4a9Fq-J9<&TCds$R%G`LW5jjo>8lcywjkke`u
zTtFQcNT6f7?jIC|;9`NExbBVRR0Orf))-$b5-Sq4-E7>zNk&<Oymp3yeHIV)_p2?o
z;Rt;FDie8VPd0End(EFo?b6FpL-USdgU%p@XUOkTJ@Tc?s{!yvki%@jFb)34Ryb~O
zyCeVEUlJtJn)eh)C)<t3dTFlpx^q8n8h&=ODX8QXNyg_~^_Xi>9Xb>2k>DM;ixf2;
zR-s5|YTZGP8ke>w)R?p=N}QkMcgZV#AV8w7{)iB`cy-?POLt~W0KpFZ<5he;x|UzG
zx7-EYwYqtL&CR`r`VsiMu08p-csu%k8mR388^<Vm`-l?qCTNtjb>33GMz(&t2-1Hy
z5M7OY!p-V>s^`LEMDgdI2wn&3|4yOw{|A9r5j0=C8?{}K&^;`;{6I(O0gC%~O87P#
zpRWDp?zAGi?-l{qKX5^8UbM5eFE`k2rukTqyPxKulHUg&ovw=nz5Hh@TM$A;=%SZc
zXr<-MaFYihboKLMEa!nx7{^!tT^<B<WPk7jAT$An5B;@l>C7vvDhh6HZeWrY$zeti
z76b$sVSE1eIlCt8A)$<E;;*>iXK)@kadF|XxZsF*!Us|8(td|{SZsltSO0!TjHq9Z
z2)XC!m%A`t2p!@P^>kqC!8syq8-J(V8kw+<82IXhTvF%@qSWNzE=mXcrI+vDCukS&
ze+>10a3_G!d9Cn45qw*<a_!q=*vX;zoB%?Z=GmI{Eu<)mb@wj;rd=TLF?1y=iuPy`
z$+PNl1C`H3_x1`Me$`*KiO-@5J!Qf1|8Fr_A9Nyl9xc=@0T=oC`7_-RnVr5E(~-;%
zH)cM+A0NPga{zP_!F2{ZTpzDvV`r^FZo7Q$QU6_yv?q-Smqur&9}v5r?l((seM6De
zJDJPI+evvhlv`<hCL;D^Cz+$WYwX>TEIwT~&)@eb;ET(H#_oD#o7RVZytCyW5Fc%V
zpI$y*HSR~+sMh_Ebf@8q75B_mbC}sf)>m11CT<fA%{kGljUkvq;E2unL0o;V(@ETz
zlOI;$wRSBtyb7e7qUXr}X$#Np<gc-iY*`R*bzfmq@rRy$4oSLBj+-pg0zF;>;Cu#M
zFYXj>O4fCBbegXY>FMdu&obGq<|;FZy^P#R2tGEp6z@99Z9Ul)DxVA-$KmL*We^du
zNjR+@*2ut*C$BrEs$WRCmoL|*@Ii-*+5oo)A-Z%_CA38)w@f$D_v*j3RvB3d68<yq
z%2e=^xtS}q3^l$w&9a&r4)B(z4ijieRkOFJN1RK_sj#rHwN*#63>BezBk$e~sgRyL
zajxc6Vu{!N;Kf%x)pcdqaswtMA^CwgbCnh^sw&TMKSV9<m<GhMmvCFQ(ng0E4PC{V
zzF5@J+9qVD=*o%s$me-l1nMK7mHi)WBk*1)692-o7h;w0T_1X1xqx9&<56lV2u6|6
zvETr3?^|oe!u<R={PENw^O+NESi$Nmf2;uk6<@bf;+mP?zb_JA)$c>nNu5?>?>QW%
zSJPYBX@6YCXRa08XR~INX*%^#{3u}^^`enI^H%;1=})9_{x=d0s8D^R!u~6ix}8lC
z@{^l2miyOg1W5#(EN@GluWE=Wd)5{?DHtc;-M<droozF=S83ZCG<4d;*ofBi_B~53
zNHNFVJEzvkHA%BI^xZATcvD}Tnm)2%&S(2?VIZ|X<k*n=LzCm;I`blD%XOOEE_N!c
zfTX0PJ`W{;GjfC%$lHpWSZHdhAO@2i3Ess3goNG8_8)%A@4t`=jg46H>hhrf#s3J5
zT8um+c38*Q6*8IVU?KM+Pa#W693cp&3(A-0kHaIY^AFc(3O}6l_FJW9zel#-DRY~|
zZXvxDl=4AA(fj+pzAy>$=WEq@64&H&CmhE6Z&)f2i^c|Qe~Zw3hQk$Cy=kD+z3C)i
z*l{!b7CO1!87zO9$vf#IUZF`w5srUlpc6A6ts~ZE#cU>w&tw2MZp~;7K+BSytaN%*
z?gigo;Xb^Ry|8^dyA}{)RY$tD?P!O;*Lbi(ZF97X`utDo8WA=<<WxMhHB_RK1zYL@
zL~5A9qEbI9MkmS1=~vEXNymL$H)p|*PW$j{Zb<8n&7*m()%T>%NW{Qik|{YB76b3T
zhvZ94D8+2eDXUKqbBoRVIm^Bx^j171IAV3tc|pwTxvhneIUAAvuQ1@cv<<x-H55JT
zDuuQH(9Z}@>6Is`C>Q+Hz1Un{ZVdy#+4b)OK8>RA-wy_RSjYE_)Nwj{+iwdyZ>QPV
zT_~8}%F~XddB5BJy!cE99SGaWQWIqJEX9%kRkA&h^6M>#)D<4SyM$(1LME-|Q*&IF
zPH(^d6wbJTW7re!+C@0}S1A+;seuKmg7nxs3-I{W5}t%eMT_Rx=3MF%`AS5Qk=`sh
zz%R__O#xFaIG4dVQQ>=yI^~tb*R*c%BPUV8{u*Q^c)7HueE!!`ku|Lpzn(OZSFPZp
z<Lq|*PQ64ro_Lu2$?S*@ap8Mjt?s%;Ih#0So9%y<jfg*fN$a)NeA0$EdE6x&RmgbX
z^;MAHn(`g=+_xiR^B-L}9>O2M2wFMw95@Ra-ZM)|ZCj4agaU@R1tof#ThQb;n(4TX
z5T?p)(x%I5`ec_iKQA8fg#8p&tI9Y<XSkg(q3T?H+(IXQPC_UL?-PF`{}Qbxo1E+K
zh$Af>+!a3M|M6gYy7q-uh*MqA==7Bk033ylw|Wnu^^zUp%eW}wz<q3pJZT+r3Z^x!
zMg%A8Nb9r?+&Y&9>sRsx)lxYLEJYZ8S2C(Ms08_e?%0aC1<ODC7z(qf|1p1&t_%KZ
zl|%goiU&e)X(xy(&Ln_vt7iAheY5NFiP#e`ylsE0fA#hj^AAb2ec}&=XkYG5M8xpH
zFjDRhc!0?F)2!CkL)FChO4!<0bXRr+?Omt*9%EQ;w^@8{4>?BvGpMiNWH4e>8&=KX
zxhZE?Nl!ijT41%-^N}but8J_v4oA<I+3gRVqAEAYh&(oiV_OPFnoN3I+{{)_Y_2sX
zBxc`>V8!^BHVMfe9IgEI#ijU9S$%05qCe3#)vjqQvnL9(^nWk-LeE{YUc=&{D+T-Q
z37^8KM!Ea6lw9EPmoHGM>BWx0+5XwZETK29^trTnBP2n^T+aLaGOrqilbYq`vt@Az
zhRvwzgt*K@3Y@?WLvyq2As0GKH+S%0>3C47gR4kVxa!Jsh4tsv^#T!sFRT$KKV<-K
zg84r<vbII@c2XsHbPtqmVau1Z@43lznj(P&S3jkw+G!{XKo<a+T*pUCB4V>2>qi#9
zUGHLUL_(WBulD@+Mz84GkqSS-1*2G6C-ODb((pb5B0`wU1fV-_FBbU)j+TXdsy_La
z3{UVf%?8h#l~&Yy#y@fTpIpHD>qe#pQVdSMS|Nvj`{oP=o}Mq?p?Rush&l;YAA6FJ
zQ=l=juuc--gUpArTA$5Df;Q@P@}c*x^S7oae=&r1bcE>8DMz^5z_4r1mA^~Dl;-`o
zLT6M)68>0h^)I1MHJGyrQBN{Kekv|3`E6H8))JRjl`enGfpmZ<F|s8_sIu1%@S3dD
zh@;FHRycS?A=}@qeVsk5U$wX4e{hGs<@T5nzo@FmzW!@OTd)X$nJ*c_fNqfCJq7o{
zApr+TS87C!-Snheno!=S+d<Gn)_u5^{gmqpV}J7A@P#`O$>II^!INJnkGmJvNrIHE
zt9*a{-!}nqn%)~fob?g1SY5ogobhw}0FM<YzRq)N+C_>B0$VZC%J*fyWDM_H=8^Bq
zf&!PbhL6Qz1o)P{_q*>eBsw(pm`J&Bd_9)_&-<}Ps8~v=>M#kBC)De|WGh|f_Vo7i
zyuE7fO$<$$Il6Xp0`pi&{3yjYy9pO?GM{>{QDJdQt<Jt6U8-vJD#2&x-`GCqf2M~t
zsa~ggJ>q6QbqEs4-$jx(v6&GFxgMjB5?QW$pS7Z4H1~n`opgofAdpfZM&0$kqTyin
z(!{kbqxJ7bpq}t|y&^$VX0B9u)LbUWiHHu!9ULkDygcHJbX!<g0A_z`@-HSqLMriP
z9{c+f5@>hsfQ)?DbQBdQvseG!=WAB1qev9uW%Mq(5Hq1<`0-D#a~uoABD)r1A+ITX
z2-_LWJ2%?gG{ZowPQ7DEqqrO*9&4NhZ|eRn;wo3bH8J9C{(O8FIgXY!&zpLQ6k+^?
zxH_7r)isQJWDlKjum%!_p<Q9SxcYE64$GCtDGY)iAD4eUQgKJbR)#kQ+wEK4q~Gt>
zm<T1vGfXaXvLzlJc>Dja2aYh&qj=AKFO~<*4xAJz;m=fl^vj}4_z3rQLK^O=3tk}+
zq1q-$L+%R%@pyC7r?!<FVwiJHdyXuD#ii2D#}3E7hMBb|g17fuF$Bl7Y#|eYAX5io
zqKEYvl8c=j-lpsH`2bI7)3K8K7NG5jrPOe}?U?U>5pAF6WK~X$rg$(Gv^-@jcm3j-
z{6g&sR$srzHN>!j<))o!{{kdYR_>5^M@+7WKf01m<%7TTJ~ghNoD;JtgO`O#a<yu$
z|Mmjw2-eCWo&T5x)<skek~bn;ld(=k1c?rn#|6La$;rN)1VX#J!)w{)e@aHIk%xl;
zLpO*K=vW+ux2*LWcrP(xG}RzKz1gl6O&8<m)+M^w4#b!+WGQMTzKmfHuqrneh&Jbw
zzReu10HmH|(F<T)jOLj|&m1=x8Gx;QvbnSj3iHl!;Slkr-}{|54i!%`i`-lv3#MV-
zCriVhoSQ3PFaJjp?%q@WA!iL^rcV8)Mqf}%a<G_Fz?&1y?L~$W4VW5kuH9tO?lmED
zvCLZSy(6pmL|?ale=az~G2i~4C(rW^%5PoACQm4)gOG|Xr>jYM92Kp=-~^g=9%P9f
z@6~J7+<GnhAiU<^$<u&qbRj(+eaj0=Q~g#Wc=1B3+sS*U`7=g<_lQ8mlS0hM5awyX
z5bewY+|&H%xiG-hvmB6Y%(Yn1BWo^{Om6K?Cl7wSZ$2T@y4zKt6*_VTT$BIL#LN<D
z-oz$miO@Wf5lnJt0T;p?7n<t;EhSnYp3(QIpd1AD(-6#5mI7!_)#?(k2{|tCwOqe;
zD+t(8#Jtv~yclK9#o?X2*G2Hpoi@44pSskr*k=j<3)hhvWHGb6H13_L(cWzdHKG@P
z^qEfPxl}cb5>2I(lPO5s{0jdfYITci(`K$5GOgRx<s@XHq)$q7v2B++%sy<gGEoh+
zD7<1I`JIZ9m$~auvhsG#+7VO%!~0KEul;D8TiYG65l&~_+N57MaY+BH{#=rVvf#Tu
z>2f>31l+|?)tL6Kgmcu#7s^t2a(glxtDQqRl?0+QGCb(}t6x223D=Tc(DIaUq&b%?
z0<B#D*VX@T{=+Ne;53~%O;Te&lpnDl?>~1~j&*uzqQ-sPe=mwHkp8JBN-)=WSEYOB
zD%a(nW92cnmFVAshZyeZ16t2zEv0>opFPvt(|XY^Byr#uz`q+XOH0Hk*!tm1iB$5z
zPp#-ni@N>R%8;$A<dqhnkFb3|-f@9_kdM}{Q%#eu@VTx=EZWFmpjNizi!|!h?nvGV
z%<YLqA@8vCl{X4U85AV1TPsguSdZ6a&G}vd*3!-PUFD3$tT-IV1_}r_cnTJieqAOE
zau}(JFBsyxshkiw`!GLOa|rOU>fraU(VtCEp8FG+fA%@(MG8l_8m~2O++TK;Ih1DM
zG5Tjx9678fQ0)(Ivx>`=iaYv%X+IT@=Wu*J>%V!SQF>mUt1)h=JGbN}z$5BlgOA4X
z)u6-g+Nq1n@A-0<qK<7v*pInF80)QyKChTkNUe2m3C`WDP9LZ+mzKbhAp|Y1gPjpk
zRHtIv7l7u5gG1YK`GfFGf2-99!nrqIJSVK9xx?H%-hW;X$*6|-pWL3B4KBR%uZUve
z=b%`b81p7@gl%4PfO1{l$BxRhl$HEB(OkcIrssRyFY>E8>cAWqFvvRewvfI(U<i{E
z4OJ7bT3fj&DXx2=l#uqIszC9bQM|Mv-cpzeQ%b{{v-d&8o6s!nz1J>`ES>f;2o;2`
z?$?E(VcCqKKTHulDxA~PPFJ*Xn~!sz%2@N2A9!o3&(+t)Ou7|djhYT+Y>B-*Xg`z-
zt;y@`>I!cZhM{Q&-sHIAHw87Ev}&kD3uWL{=)B7;jE?i51$Ssqa5p9%F05c_0Mnzk
zOMAaKeCx4vfzgIg;9lc2guV0rqXFX{PbUA`Qbi4h(uhrggq+-qBBpug5d|-3IchIN
z2FC4N0Wtgbu5EOx6S@~dR<HsSsQn%ky*;LPtZPzAGu@i1f!}-X38mR+*>d9tht$5t
zQhg1;HtjNXRoM?L52@(3*ra-$+WmFmSLxR4;DQqkZ?QmO?V!qAKjbo_Tw^@R)-(*x
z7Mj>aDxog|UlSS#oTC?ZncCDQ+_Nj?2)i=l*VYbg3z|~MGNCc`z<?TImo#6q#UW5<
z#v2_6iDkSir%Dmcrl~K^0RM-3sN=6ja-j_tUH!YsItb@@G++3`Ty(+7*{bBC-vc!L
zBxRuZ?cqtnXT%}sx&g-dOp^oQxg6wd7RC#upT>7C&E8N(mx|J26ewQGH)?Y~v@nlp
zYAbVUfVT&{c;h-=H+W9hgDZ!#xGc4`xoiyH5<upkfTT8Ejnf=RUCajqlvO~o>T71s
z&sfTqjazoxqn;FM@HB3PDi1S!tE8kJw!}hT@T_SF>|E+nf1O1#-oh!8C#(12CurQO
z>zU2jf=ue7p@JND?7WfTL;*Ligd2g`{LM;c^JkE1Mx$`KRahUTbbmdm)ACXLq8-`8
z*|+lwI(G&a<xJYR0Ixcg%$!v`EeGA`&JqpO7XMl`66GCaA((K8EjS1!Oed#ohS4bZ
zY-y3~WVx2qwPNZ^MOtT9<*Ygu!AJ~v{x<;g*Vj?7x}5VK`XiS6!GX&h{(F^;>tj}z
zO#d4jQ;DvUK<!}-7h=gh=Pz2YJ~v1g2VaAY(ky|<-8Gj%k0OMw-)y$_LAd*6aO?!{
z<3`$2F^qv~X=+VZCVgDBgPWk|1$Ah}EiO31=NvKfY-bTU+GM+?ChLIyja`Ure*u;>
z$Lo2UdPV@yzR=BAWyNUT5Ebw$zbZ5$Zb%ROFbNotji}*T5B0V&>i<D_2<~9HzCW2M
z!uU$^-Cg0!bmu?<H0e?em$r*8Ib~?Y@^@Eh>4PrXiSY}JAr~^|<fK>9j1VIRlQmI%
zId?*Ak`~(7tu98>Fb5QY;+Jj6^&yX2rNNblWho5?)}9rFz=W<ZQW&WNO;NQ~C&qnE
z<iRO2BYX?u;n6E{iXT8KS+ux~o!J29lvgbA_nnDq64VpqB?bCW<T%*2&r=96Pz{6b
zhA)0%mXWf0<y<2Teeq2dn!pN){<sdIk$YVeX#%vDFI?Is5LJ_IgbVfob6<O>^o>Q!
z;cA};YRi@o$04T+^`V+1LBQjCdLz8q`UlNra4Jxvh|X?xFkwQt!@8jlf8f!pN(Vsk
zxD?2-z_r*E&~y3H`ezHIj8V-cwbCXLm_}mf9(0o`bhda$hmA103nn6dbHf_xndUC<
z+*iy|;v81{GN5K|Kru~YB;HbKyJ0C^0w|-^cB_{oeAC0zVNBfGmZ_~UC|U)Ap|diK
zR$Gs1V@x~cm&+Bae2wGpr%&v1jM6UuA!~SVDI7dH8E{}}>4~O(RJ8_esSLS)uN~pa
z+EYWBGO^?t_?BmIT2doBMt<9v5Z??>1LrVac5AwM3|I$a9)rFrPDS(Z&T^TX7ziky
zX*?gGQwyGAcn9L*W06%p6JjFarqEb_tPd#-WrnTi&@v^TDOAsBIa>^ulF2M?G>g?R
zbh<P0(J{`7dron03}97V+`mYzlwBUk5fTd=d0wY6DTHzeO*~hd9=GiHp~&>`N!1bd
zi|Rq`-O%99nt*<QzERfOtIY3@&n6hmt8<T8S!7<!ErE&7=1c<4EUN<p7gTe9#_Le_
zHtIi`-oRLBT?9IO{8(f4!3c8~d1k_P`?E^#oj6(_#*c*D5VqcPK@`vK)S1g-u}x#3
zq3_}xy4X#cr&KN^Te%nGj3kC@9JM`Vq)Rhu;L*uOQwthSmgZnu-JGf#zF$*x|IX-_
zUS6u?KB@gXL1w-J)<0d;*JbUj_Cd86FbNnLZ~=0thlF49M$U=4XQ<uQn4o55KYXfr
z1tLnX9UmHfO|is|07?W^Y{jeI{cKboG*IslwF}^eBXcNl<ejz_*Sj?}6Js4-LM$|-
ztw=Scsj&*I9Bc0f##*HJ1r74XZm)sEKxlN0oUC@Xmc;r}B8kEWNBQWSYd*@?j453=
zq4h=WJ8OrZYZE=`$%n1)^9JG1?0F2-eOx=Up14Ih&QBAJWl611zX<%*zS3DfY~@t6
z)brOa4VH*w_t2V!T>{V{g2P`|(rhQ#*kapUBeAr}<21a{bW5H6c`_SOeX++-R15Dw
zY>>WEwOjqyTeP?r6cZT7Z-r_1fs`^+Q}p$>E$kaq^YMDaho|4S(p-a$ZO4;nFBom~
zzj5+VCjFoiHYbcu9%+x{6wioR^~%;CWv!J#4+F~eO~Ai5(3{y*w)Eikh{0uQbBRTx
zOyf=y$;AZ~7$>TUQK=i(rk0M6l|GIb(`Y+KeXj8Ns0K=B%PWfqj!0N)3U1rK6F7JV
zS!mTtA^D$Nz#W5BKbF6QDI1l^keOWM9CcKxc#&1V7bXUp*Ruxma+&+RuY1_LicAM0
zYzkLL=LL{(R&UA!wUXxf(FBuauvkvBA4)TK)pUkK+Gr|5w8FO;`N`XMl5+f{^w0SK
z(?u++;&b<izyQ)TIr%rw8SDkf`bBe>szeUQ7-TKC)&%^1h){a`o<OhE^@WI`%$+{r
z_KfB}R9LEqhmS3*HFDNhN8cP=^Oy+O*QgV$?l5v6*%IgEWE=_^*4A))QyQw`z1i_h
z1aYu2>ZV1%k8q!6QtL0Li(u2}Fq@myNRv!{wZ2d+2cQt5s;yVaY!vRQ8r_)NF*#%Z
zx}4x~>8Mej%Mdw^cTCjBvt>=vSJ=qzN4zOu(Dh@Y>sfAzP0d+5$Hsg<0PUm-hBcfv
zcfTdwk0nTYUK43-t3Mj{0+sPz^3|^*uPBEgyWrl!lUVQQ1`KZmFJlrWY#@Pl%qt)5
zGgmKEGQcPEk!vO*Yj4_h{(;J_oMlsfJNQ6A|C!Lc`55qmcJHCJ3(&cQZ;Kn=j|k!0
zbtVsxmKIjNwugRN&>BB+VtmhQ+DadBYZS*l&Pg@2-bFCqHD14j>>Us|uq~b7G%bu#
zn@Xpmnjp=zf4nGy(s1<o9xGS*xB>a%;02e__W4U|ZMNAb>h&&FiDE*rCWf)L7Yf^L
zI(IfvbJraKe9tCKFJ1>IBwIC9h(uEn_{yrb%!_f`8J!<UHBfDZ^<ca~o9I|%sO#Se
zOzg40z$K_+nf<NR=wD)W(8Mr`k@l)0j1v)w%^U@1DQMiaHO^OJB23B8Y3*!RaO(Lk
zH2{}t#CEq&Ew(XqZz(`@CaW=itiqgf9?*xXR~7z2ut7Sr31UoVHB~DnUscG!V1}Yn
z!QjV=;aDMquBA!%d$pG^M>%o~KBk}f6=os&Z2ahZ1`Dwq%g|HOovi2~I46C=fb|t6
z{O_g?#|acTS~yg788~`~L!5qnn@#?c6$)BmvqN+=c*x1AdSsKJvnOYR)lvvV32+-6
z+T-6lj=HnWOd5IzV#=2FxI~*^UouUVc!rV|HAiI7%K2%58;g`UF7wm*2D=!?o<0y&
zaB{sFPSMz!ex_fp=Y4#jq=7b!F%<qpRZ2lZH6kf9d3qSleluV*0|OV6><cw#T^=x<
z*iM^zDdAOSfEDy7#kS(icUF#+8)b@HIgeXM1B3(iZM*othDV5RkdWTZMm=$5{SSDn
ze2VbUe?R|!ZlB4jhe^hNgJ^;IU+$L>s^<8=u+RCIHMeIyQU6arJ!}wQBaqqu&|Qz7
z;WQzEo3P;ja8aB^iSh^ABLtK3ziXceJ>G2AS<ZR`VU`o}2;lXdgFCbeesp+`L-@B0
zI~zO>U39xFj_WkchrgsjLY^JV5g|P!)mmtCLo~1m#v(mONR9=)BozK@(lzTw1c(&H
zV<x-bgDrHQR=AoYa>o%siKrfvfcrJ_@7z_4*!bM62m9#2SF^l3e(L?X%(oeleg6-I
z_GgX~_<BeDlvO<tuqY@D|CiOSG<f@;APSOd4mLykbdj8Q<wZqeY2)E`0WO`)o?9!2
z#yYw7o;Mx>Rjk;no4Ojm6H17M*dYkI(PZNZHBx<Aqr_zks<q5g#PNiboL;<i)fViF
zI9iWrDQATtvVR{RX)SXCfjTY^A2n*!*j&~wyb~6WxMQm73aFInwAIR1C*~esy8Ex)
z#^E%bltPwdn1l>`v*|M`kpXCMf)g}m#dnf*7Ous&?l{u4<0d>)278Bqyy{g<h^qf$
z-AL_T+1SXH%P*RJ=bvniuroiE5VIx#3=Dt`)_It8$mBKlfN76k-)V8PQG4a;_k)JF
zm{&(BDr`}Vf}^vGFHsj}Mrdfi4*z>#Tlr>ey5B@K%7>w)2nmwq*jv1Yj*8AfNDA&q
z3wgqJLQh#cjVX<mS+zpbP9*Q+_F_yyM+Xkail=mykHj)aRQL0U5XY>v&1C6moUY=@
z9;^c~9T3Wg6oX0sFtL|N{%znZQV21E&(VP3Q-IXTcdes*mxwMG6-0tH@w=NzpIhb9
zGhBY3={9MNx@2hQe6EJ(m(t4Y$j#Pp{g)-}w?I9wzXX_G>nZF(z~z*>9ubLq+k<@N
zjz(4sZ(2MXOTri$9scjlYz{inPpdZZZei$*8W$)LJ+r&!203I5?N4)l4hBJ<TR;v@
zFNYIl18Llp*FQr;JC}}=3IfNwQ?7w<(^Q+Rvx`Aj8>Oz2rk6t#Cmv~g=X`12|2)7k
zDFS&flD)L^K4imSXy0-+t6O~?IId`IvcsUQDC-kQ{E}qk8t|yfgO><N1!_4gQjPRr
z#!BQ%<!fxwR%>M6&Z4HzmuhZ3p7DWAt?zI0;{9%+e82(aru2V<^70$v9}r99Pcw&p
zQWt#**C{NBPKM{}(*8p*mY<Dr^=-Pjdc@KrlNy_D2}U!biE#ClW0Y~(Rj7Yb$U9h>
z=W7VtVE(qYkCnHaxjpzSYaPBBLCkqwj;`DI$t7&o2v6tVdP90%4g<bsG~LAs7)l6&
zl-sC=wWe+(DpMp#2xZ;6c{xB;WaH;8?gjB_mtSws$uq*3-y?U*98UdwDs$8OZrm&b
zU;J2WbQtRf(dq#6<k79CW-_aJ^TO%h*e@C0u_C!>Lw=T**Kd7l*VWafA|w35xX$Xb
zoQAp*8p_Z55am$Ew?KQZFi^c@7$MV=C~%VG6w0kF*9j!T0BIY$x~IQMUQBfw6=hd>
zGUJrnhHdJX_-q8tbI$pOLmu{*0gWi2F2_c;^%Cjq4aU}}-pPyNRVVUA%kt~jvVoiP
zd3jO5^7?ylxek6nl7_Xp6yQ{DlGY5GpogbA65L{msvcrQ*jB|)8O;&sCslezzZb?|
zW<L^AsVMn#z3KdZD0ZWRW1Y5Yy(|H)xzP=%I-!SgIDM9p|L#Z0q)Cwam{r<0RD8Oz
z4G^XS>k8j8m)9o00qhT>`ZOy%`E2Kb=lMTPiuMKQx`XeN7n%P#qwDbB{~ReoSL%PW
z2F$E8EnIzGQ)btv_7k%Ml=G3|Vu=uz^3~$AjGbR3T)eqMLqVpSt(mEfA3Yc6nI}AS
z5L>ddPsgN-rjdea6oU(X+4*S{(=4FMZP6ibK1K*s*4X>JY2;Y5;4I_Ne0(6Ni?r$_
zx1`ZZWUm-_`Fxl>1ez+&A~u23Ix|`*SA@Z{HJkdebKuguZSp?xg!5zi)qUVnn>bVd
z$!+xyA!?8Vq6`-aX-q!owXa{ec*Y(Tei;NVr_loHmp6OvLHlcD$=RV^_bZ5PA<RR)
z7#_2C=w9O?Er4%Y3tG76saHE^;cH%~Q>(yL%zWKcIHr2D<T3v|0u_F4r8~Y|qQ;WM
z#d-L0f;v^G;fR3a-c0<^>LeazyZrq7>$_Q%va*S?lGfJcsYLGjt9tGLu``+&8t7-$
zn?<spnq{vR&24t!$4xRI(D-WC&krc(72~?JTlQb1F3z{nCy3E`T!e2f4obgzQ59{m
ze<D8CjfF7izERY0J*`gEK8A+&#RJteDob+KEkq)L-vSmoD;3=B>NE{Xd``064np_n
zAB|P^@6Ov@Je}y2(!eH`316txEE~5LwWFcp%eMZbOUQYho=1N<ic5xwZCh_MFOp`#
zrYPRRnWbJwXZd(xYlS&!n}B2r;8<5)`#BV(<44RH;J^(&rGKz=9ec{6DB`Y6c+z^9
z9kT6o^6b|NTWbh={o&>|cVJG~tz%jEGT!DF%S`X*`ppy)c>^&vx!GL6IM~Kj5)`^e
z?QiU-b->{z6=gP3uVQ)_0!*&T3DecKCQLf83~iviWffv^VIFi~YdPqfSzbcXthFk{
ztP*{w|8_hj9!cVsG7zPU>qy-xFEf9%jdE)uw{M{%)i#d#qJW)!=zAO@2tphQUOstS
z`u!rktIm%~)_Y1f{*B8w^x|Q@B$g42z5OkGk`QQyi8Mp!xQE=c)QDbgPU>kGle(Tr
zZ32plBcEvn%F4*`G1c;Sd`7*x-jSw`30_SRCl7bOBIP$wb`>({aD$__+dynzMxADN
zDit|PQQhdm8*ujFNX+H~E>F=&eEl!R_Zu5J**!|@8tUL&euJq{e^El0+USak`dy|o
zT@i*vU2n3js|;E6@b?9QTI}{CGXjTtchwavKIl6t-L6rgIJzh37lP8A^*;T=I>wLg
z;}$2BSHgsFbA@kia%dpv{xMCSvovsM{_)rK3{5TLYCm4<0k?%GXrXcd{7~Oc*sp!B
z^O@mdD<Xv<l$l(cJ8p}lKe^vn@1$#B|6@)<`OZC0qSenPW}zni0Wrvl=w6#{YR8{h
z@tMUg@L3LO7R3x58{oox96hkM@DvRYkUiMpPh^1Z)OwVPXr7{zEvRW$2-k7za=08P
zPrHvkw)9`@g?Q(~Foz!=dw3=9q#}|_Bh}TPLNE|*CGf0zVIxqU2ODtXC;z>ttdOSC
zl0{u`@w9G1ohFfK(<ld7s<LJp6UOe-O4Gg|mj<6v?_Y;-qNC=i+XCpxCrc1;3<j3G
zC@+w%9zB1ElBO(Tiqa)^y^_Q;-?<Z<rD4egY#w+w(r1wlZ94;{zB;1WVT7Yy)({M)
zjf4?+oHI@H?2(SlL*L8*Ty8dAaQQ5GLoSmh0!Iy6xth(2Nd-+kjDrB6>G5*P1y8i$
zX^)9p#h(T!n2R01F_t^J;p;?p7$4^5fi}B4Kny^i`8%&1XUoXO>IPkn$9>}?l?huT
zk+ph~wjojwU4l;R7F4WG+L=dN@a;w!=5ixb&txJTZ4c49VCYBq^0IBlOJedg!Hd*;
zguVai1=PG_tc!fV+BXp|PJ4`%rj)NulGMaI*11xh`iETTOEO$CNVE}YEdX;ItIvD>
ziCd##H|r+cgHj({+trLl80($7Va?lBPXDd9nWi9~g&?;uq{ZD<x%xQb__`^m#;66{
zxS7wDmh6e}+D+Ht(gYm&{@P;IvT)75X*$(D!JL?nQBVY8T!~JLYH`kcuoWol0d8Ov
z^H7=DKjIXQ03_n=I5o1n%Thoht<1{VD8exTwR3x9L>Pu@w@I89fMbi915=O29X-D{
zo3$z^w@{XX-u-Xjg>dS&7IVIdnJF?p3<u|$rlXs^Y2Bc#j0kLFNKzsr-YmxEa5@2b
zjXB|@&=>$Bc0%P0{Kn!W9YHbQWLLSNG6}9c{$eS7<VEn){Hf!G;+%`mV!L!rc59}t
zKx;?K8IyeZ^K!0)+Q5@xCa6vG99*$vL#1Rs(0nDMDq^tV@q=;y(#MsZqcDO~jl~rg
zpsK2=irfpBdj|4s?+2_PV+@@JiAa}{;ZR+w^bmV>WTr(xMZdRx)k6$$<x))J6GXyd
zuF{Hqf=7_SE6{Xz=Bc#`aTK1L%CXeG%Hn}@_p_r=iq7Shd(WiquHnOFGgHKHRq8H%
z<^Yu?p+io-46?-hP{<qo3V!n;kpNhMRto4e?W;Z=zfJAfre=pQ;wT>P2rqxE%N>_m
zvXQ-97jB$m@^oBN74#W6x6m-sdvFEuZ$NZ66U~(&1>FfvMnZ1fGwV$xcLhn)64sVi
zTv|ub#cg?5BWUSLYF)d|DWAC@EPs}q4AvB9ch9nAp@+&X@e*<1$xuq0aiIR0*s^sV
zajIph#jG52_&oR4?zH>Cwh{4+#6tboJ?^s1O>PG}<8LI8t39iu=7A0uC%&JJpM*-{
zJruG8S6R|zd+Qt)UmyF(Wo+Y=G?>Zgoa}tJWlLMsS=$k=pN6KV4jL8qf2g`-DV?CA
zoRV){C*^{HD;vkVt4X_4j^gqRE#(c{TzhnAa^m9pV!Ilq+t8~<EDUW%#ej?YON&=j
zG}`RWSQ=%jr)Vvf`L*TEATVtH-0U$Tcy@?&wV~QHc0U-i*<0r%5}CtutFL@eG^4@5
zwg0}7dOc6yx~+}M(uJ<ADvb>Ov@SNf3Cg4Hv1uB4!dR@IbZsG`62nd%hZrCvbzg>|
z3HxK3U(&3y#aY#;`uRUlkigKxyX+s;9ea1#n3-Al<AA9f)WCRPAL7tF&ZT;4xWVme
z57r)!ZuxFiw)?aOuv3INDu62qg~`?IvxW4PT#qUjMdmVGWF(4Raybb&DX5l80#=55
zOJVCozc3vAi@Z@9d=MQ6RNj_Dvwm@^Jz@UvtC=34sG-~iwkfwcKCj#Dxh5(-JgjS%
zzEe9CP_%LWnTvNUCM+Lyl|k%$Av^y1c!VUaZ2Pv}ZrkG~vj56k|Ccvej5ZP(`8n2b
z`f`;2_J+Yx&`oYh7o|2TfO5oXNdu3^r~3=VV<aFE*Fc$+HVGqcBkW~|({9Y1q;*M5
z*alUTg-5dO;PS)n)gu$y^+m#T-NWh!+{e|0rFP!1lcD#G#WeGTZ490SX&+b?E9Nw7
z^GnQ3(IETzrYx|ol+n%vw+=ijNlZnT<E5(+Ri5s?!GrEwkdqmWXJZj2utU7csE0YQ
zb>r~(_0eU}`FCqR>t?38%AtBCh{T_faPQc79}=cUCSwHtOq7f(FD!u~i%plte!I#c
z;Q)SLZ9&geQeAd|HG>yZji>F*WGH|p(8#Se#gO1s{TvyD@Q5;9g`ZI2jE{vH)Sm9P
zZ{Uw>p$e!WjL#VamWN2IPdzHe_$pxI9YJZ<9?aoZ%-SnpjkkYJ2nJu4_)H$lxNI;O
zr4sQ(7B6_va}uVgVFGo_K0wtwzT;Y5Gb$}NPxWHY&o&pTN=z<^)P;So4LxK(5ih63
ztK-idt!WX>JS4bhq}8e1sw^Xvg>-nYlF~T%MB0*A76IdTbscLaiQY+v$Cti~BQ+nS
zI~r>DTKE~vQ67Z$4f31<#;nJjG^&hDjlV@rTBIe@hY~xNc`UAoy*ai%{3NNy$Hy0D
z-_ZQBlb|A|2;j}kKsjX94OB^q%ak<S|9v$f%<Y!sTS5ccH9d@VZg>9(b2(;|zp8Yj
zQ;}U5RE)K!$FsaD%PCs$u5W2A84Lo79CFQz5#52Uh<ppkX2k;{XSm5$!je`wKpznS
z?pkIKeZk?$_B|&<50$xErRL|U199R+F|wh&>E*CXw#BDei#v~J=Xd<6p$D;<Sd<bN
z2SVH{lVW!W*>y`u5U%lA^D<HVzV7=6=3e*DbVN>?CJpW{0YLAOJ@YJs3iJ6NfYcJ=
zjg4ifCT=F0fr5OypdZpp)ts8bd&!U#jciNaZJSY(`~mVCcO7XfybL#nmf5MumokhY
zF+`<BXY5X<YI{}uL_G~Lof#?``V)QnS}tkTb2t8s79Su?4ZK84{IgwdrC1D&?yTHY
z(7Dvb^vrp~dsp@)RdX%1BI&N9BW-<`kK}ZXx^0JIHO_gg&1w$1ud}=*B1yb&*#!zy
zk0|sPJr-0RW@u8a)<=Aqm@-q{@tHAqJ-aIU4X6s1{bznkd0XgL<krugyEw}4Uygo^
z>C22_#M&!3#2YEab{q~0R9PB#?IsQf;(uM{MFap#E}BViGLK+(KbsHpYKVCxch^dl
zou_epqG~KNF=$E{I85r*@W@IhnpCDM&KxV2@!KdREICb)%ZN{2DiNeM`B2D^{$b(S
z23Ii;SKqP19z^dR#H&0bJihfy#mY}vO8W0!q1<kisx6u6Yv!`PpGb9Qq+u}G(;eIq
zNZ8y5Ek_T}QC>wF(HLKseYx#mQARMRmbe!D&nQrtG|sGaab)90Mn<fv*V^OxZM4#|
z%g+NDIp^OmS%s(@*B%uMC>FHJok!KO=o*YhkkE1m2B7F!Z`qn^<on>vI=P<R{TLzW
zP<O1!XyjIv!sz?2XUmSskER9B`eG#(eTYRG)Q4#$CuH!*fitA3Rz<7dm^bQd=g~Cx
z^va3WsXoU?x)xBP59hGIQuO#leA1x0LfBGLuILkO%QM=s-Q-H3T*cPzx25N2+*wvY
ziqe*shN7R$#FGhX4Ffa$X7+DQ`;MXqBo$I}fV$T`CKx(spp1)kOsR&OZj|q(ru=fs
zKhEf`(p71KtIevZOt2USfql%S(5j}bmhg?F2UI;KYeoj5vKr?G)3&yF;<JF*b!8>`
z1atGV#NB_C4fd3R{MQ_7<ohWL%0Z-Q;ID0N4#-}Ml2dGL)W*nm0Nr>g2a{KWDXE_r
z&IdRoy<?j->jOh37)p@BSR6a=pkrm#FOw3)#G|<~3uksHIWbnCP7m|EJfpGg3I<Wq
z%-+PaZ;#0khcB#73EsujV`mu*mn0_?QEVF)`z}FyDOpE)%+FVu(w<VVa#wuT3}k<^
z3`Kf!_h-*P?HXBHR@cumv(fL)*l4wclYeS{=Tt`LCZb)g-a`9-u=mzcZM{*uAXQpu
zOAE!Vlmf*m4nf*d+={yt*C4^QMq9j;;slCINN|D$DDECC1d4l7EWw%Z`+eUZGwaS;
z_s;#+y)$b~{ybUdoY&6#?)~h&pGUx2egs*3sBHUcBjEg3gJj3>+IE8^-&_8ro@_?f
zrwSvDB8s?;=^w1KwDk=sV6SOw1+UJEmM4MbkQz^qe!8U>EdwUbHrJ*)o%5-Sm{*bB
zy6Yi3kA5Uj_#qI_gM&XAczzbwHW07b?W=s<7!GYfsP8iXot`(zheYtd>#q8nZqs%&
zAWd#mXtf2q?aTX<=>U_D@N5)%6!Tl+nckRxZUuVC1Yg2pq8ZTj;eu>D|C^FQc<tA`
z&)ex~W0+N}{XBB+iN?VWX7yFNy#kK|-%4+v%LNa4Rez|up0fItf=S;7Jkvr?Pk+o&
zr!{o#gF-^U%BIxVWpkoz_SN~)qMazC)~(d^J^coJ0#f&*w9K?zs&fF0{D1^$Z^BnZ
z+B>=nDmP)*UGi~#+_8lq9aTmBr0uTN^`~r{xhBGy+|nYsuVf&J@4hrQ5LEoQp0n=B
zipt(LOf+$sMX$B<>~D^rk5Ok>x7)K!Q^ZRp^61!&d17E@_LI*x(5Kn2Cg!3OO{-a{
z8{?I9fGHSO`sU<2wpyNOWN~({hO8_K#uxHy`!}Wa1Fj|Oy6M|h#7nI_#rpePq(>6q
zAbYym_s*qjF%!|!v>K0So?R9SYwOKex8XvzV*9H&Esmld%IrwnotT*m9b2|}kCs*Y
zA9tOt8?*RGo*oY^V^!+Es^sLLe4T2$A*L4^Tw*LN%<sFtHnz#K)Ja`_8#wy4TLLEN
z{nUhw*2sh!B&qLfT>NgV+0K`zwz$L2a{)A88mZ<D7$J=tBpt=edj%dbjQ}oI-LM<V
zp8|{u9&e$gljNPHT&!%lXO8&(a<H+@WVg<&KjCxEg!Zs+pNJC=yucIz?Ub(4*<UhC
z*1A+3oMs7TgaUIUm$U=E^i-dZZq?0q3CgfP8shzycuwB`<^KF!C0FVe{m-Saj7i&L
z;tu7qfT>~^IdY@7s~UTe2X@Egnpv_>2zJzZ{p{Qvu>SgNh>=?bJO2AKGL!~7SHBe$
z)%lfIsQ-0DOUF|Dk~55Ig;6h)cUBLDY#CxTeY|S)=I02&Hz4K!CpuGL<ze*&8l5@Q
zR>QShw1TQ5?u!VDFTSw^P|eOXF$n=j#mc6;Hva}>|EvvL-Z8S%F&ZDv>-#u55~<@e
zaOXhuC^zf(w%1787XXT0R?e`QN`s=b0pK_hcoY}y7POk~X*>&4eK4@cdl$s9>Yafu
zlZt_KOP&U#G~$QN6PS{6qUoCo|G2DA(*cKoO%ZznMV0mYestd|*M<fjbv{N_I;K0<
z(Kc6^iCQ5VB={ZGp-^Euqb{^gE!&gRk7$GTI*Mc7yFU6MuY{D8B^)Pf8on+Ye4Uz^
zETNTm-fj!F-wa+8#SIREb2(T;F>j^_6JaT@CUx@-_FALq;Ik_NJR1Sa<g%iS_-Xgq
z9h;5{OeD_<ncUNgE&}Z9*8KcTqwCi8D)bd5D0D-M_%PO#79V3WN>9A;yK9BA-BrWj
zyDLE_=Y2!*72H$qpiXa+n&<VRpf27|oD8DPhpWtbQ4Fb3@JZ{Nvk;PL%Acq?A1$ya
zB{={z*VhI52d2$^uzx7Kj5Nxs)u@GjkqEp6yK~oU5jbZ4qc$SX;&mexaUE*X^Ifl9
zE&>s}6Sv&`ZJAYqTF7p5#!2?a&u;HtrY65*H6Z$=^=Ml#AQyaJvA6D}`0RxE2KnWI
zHM<=|wqZ`Q68bef-Q|4Lx5GCN#bI~T<60GB+Tjyy@T7SAa71Dys9-gY^atw!meI=`
zvwT}CDFK8E@DHp?DqSN!iov^MJz0qz|1e@iIXK6hCqb1q@dlIa{OV5nKlhzS8Tvv!
z31C@E;hKlNtG}%fbx=cUr0CwIjt@vEt_|fJJB%Hd6_Jyk{gTeR1hWg4fs^6986>Q>
zFl%}1PT1`V4$Jq12*AHsz-}nVP^RHWv`cw4T%MeehWkFF`$RUapu4f~bYOrVEKQtz
zN5ovBx&L)de^501LR)f!QdGHmTD^XUUp*0WeE*okn2*1A+_|QZIg=)w=-x16Sm-Fz
z<q-^*{r4^t+o(2+-i&ii2C@uTZ(EK9prY`ezW8*Bxq;xuudP20a@_ZI2S?s~zI_}p
zh5C;BA+j$`+Rjqj>o={d=}mvVz}Bn0tngqw@`v}a(X7;1MR=TR10BhpEl4Exo^GH|
z;A1oSENlIwbzVW*$KJCBHg3=Fc{8(N-|$LVC5al)ZozGmgfo1X)1zANFB;nWYO--=
zYaKcqgvP{7xNc(f(<;;XDaQ&oFj}6RKb?z$29_yr863xV&#WS(pTi=?UDr+(Dn;_B
zKJTKzJH}?x=o)F+e#@E4UGsdqIauF=7n2L=ncQh<d+(4!$_RS2v)2vEtAhY@>&h#x
zHE*};B-)R4+lh&eKKIiU(|!uei!vN6P@&Ii+)Oex(g+yfuX~#mw|y@6>G3U>d}}JY
zu#@6~fWhuh#QYY`#kM`b+<<6fEW^(%K#h-v#mK{a)jk}q^*~#ga;D+5v?ppy=8~MA
zKa^klX>5NaaxRxxG{am)n@hemuIW)^n7iW=xDhlkZA8Dh-a572zmidLQu(^l?$t!Z
z^<x)<HpGNW%-_FdoV^ZYQNv$g-{p1b=Z_d!yh%N0kVb6SBNTZlxH^@sp|;d=Dymih
z{ochxpX;3I4O5f(@-Hvrw)8cZsm7`CXYWcZDup&~Pv%W$4-R?ao?jBM(U(IC(LNj#
zo1+~U8^qG<r_S?_2sJ-f6+<(zmt`nt)xptUHe0J}J3u?C^^@L;+o{0E85c~r(Td`V
z6OC*dSsi#`B_f_#b!KZ0+WMl~L<rhc@wdV%Kk0R;w@23=dav(@4Gad?<kw52JrmCN
zB>^9<BpiBWK^qFvpbI@C5FL%u&(Ma_i^DCPXVv5cxi48@8s@=o2f6sQk?A?0b*b}}
zVp&C^pC74fAOEN6^W>A{ONA&6lB*fKEqRr=e9rhEQr|cKKU{g;nAkX#+^DZjpe7T~
zNxkaaJ#j*%wcfAhY3vn2Gi@kAo<tlUBxVvrI!7)tZ9|H5%=(v;*;f$J7yQD}rn*iu
zR3=s1(<wS}=GHSd2=6o-y3vXRAQF&Hkn2zr{`o!IQ6&;+?y&c`_&>yNegKLHG|^d8
zM{nCpe-Y>Nf0F^^U?WjZE=o1KLkix;E@Q8Ettuenxr5Pf<1#naz&V&Hf>ckgb-pXc
zTUo@{#U(a6b^CcF8KPsQgIAe@z&BPmyQ+x=OI*3~?*U{4xB7ED`!olyaQ=%|-7eZ^
ztOQOeTLOuBhOr55C3Bw!fccxTc^p*r>#oGyI{f13Pum`x{ZnGcL4~BNlPX`}tID@c
zs;^5c3%RWH<Q>#9R3q#{R4`|WjZsT7k4&eQaDsfv&ciQMKvuRhJxzVQ0o2iXV=f|f
z=&GWKscb=~#sF<Av3Yj1mWIj8_lh2KO;mbf76Hy7bPbAS5(FwSzmmi`huX@u=S)5!
zeI>|5;6~wuUrB#Yp+4<S-vRHZ&qr1ZdO^a<RXjK5k3m-vx^>cjg4oyAg`hi7APkcm
zI`YQ1_3J6GY01V2+o@R{k+op;CPjA4t6PT8f7d17?dMU-eA@ndq{sH1F8t9)?v@`!
zoWD2qhPJOq{ebe-Q+S-Kk=r`bj1>@ADUr1FAg4NXK*^{k&#XKthvVJ+()jQSCSQ^_
z2F|v5d!V!9WS(St@W%y-xr}(bzDX&6shq%mP+W}qWkD<JlV8x<S~<MgdMS_dPFWAB
zU%`;p*#=v_D*j;bn`W5b?}5b!qenFL{M%dCD|^o773WzAJ!%1eA`vj8)YBED{sc0)
zL7v@iF?RSm|J|+RQ}D%pRD#DD_B@NgGu>i1MbnUS6Li>l4ACp!btE}<JAS?J!fCWq
zxWb)fnuY-)sKdJq&?1gvJz3)Ah4A$@@O6ce$T!R#3a&urZ-ZN$!z2r)9*2(Hu^1a;
ztWU{p7bJ%i^=fR`#H+R@K39~XaqCYTRWCQDPEg+IwS={x(~Kdes&nD`uTvd%=MOS!
zAEwc>1gSu}4$Kt}WG*1SqtDz%lssb4?1l;SbC1E_S5q0~*YEz&tGiuyVq-kZsi$4z
zu9}A$Y?H+@Y-lOVB1*jY`Np@do0*LSTiozb$R(~%dsA;_@Xa8~98r6ZdOr^hIFi1K
z8qF#br~!WMQVw$N$qQ!=Z>K5=8srb;T#HozKTc$RUH385>}B_}6N7j|BAaP(k(8#l
zLqG24<~E;G14_sN8e>%Yd0_+|FCIQmHo<yiqOKy{+qzgsm6X>g3uU#(vU*z6rcY#f
zNL$pS86U_{t=|0fk&C;w$9(LGlc?vNtR&LQH(bV>3W>dG<n&bz!~FAPb&@%TzAEuZ
zx{I(S-2}5(9qtVdF}|?5FNwi{-H$0>(C+8b1wvmDd$-n?WRmk4_l0l9#KhDND+EZ*
z`a)IIE$6Mj7F~Bc4BuZ`-G%F>3-5PQVP)q8o72jCPuG-UdpVOsY!8$IL`o)0Ky_9x
zS3+n^l@%!vj(@rbyMd#x5jyU=iUZW<#raVK)AQr6b%Q-(2;)Q)e5F|{NTr(p=23Q}
zCz5vd*Kp4P9#{UGqqxTgW8kG&UD8;zx>?T^9iqeY;1S;$SS?5Xk4JUI!Y>|)5+@Zu
zAwm3}n{+3+XOsB5JmCm!>hcF;lkD}vX_khccCPW>!fNFnz;ZYt=c9qw=<nl{zywhz
zyV=L(90JtGx{o#^rp^*Gb=sY!&DDjP<*gGA*?(<T$2(TxGB!OMPd;n0#fPRLI$Zj;
zfl8_DsDkVsk907BuV}DPA2HQ#Yj<)uV#2ZeJL~vl-dfc<4ICMHG}wWJ<&3y&9It^{
z5t-y27#&>*`8egGSVw%*E8rdA<FuaX{-2g!w~7vUFQUrhmba(Owh08?-OKqAGv%pw
z_7PoaCij=h9c8hBS35@S7$K}m1c4P+gZ$&RZud1O`I>_p1uQQ+8%HA+8~3F}h57s_
zCFGZej~Re;P}6uVp|rkHj<IYra`gvyYlL%D;yue>vxzAqT?eXMgjsdrY6kD?GFs{}
z6~$rkdt*5Do%8+{tM5$!u;qp~3QL!;{l>U1xPeD4wdw^ycuOhZ1eB4|g85Q5#-XDh
zcdlNty+KZq{?b9u;^^tR$UAB$+bY=E-1zt_Q!n0H@i>K1#iLP#S<7q11f81RzpU@x
zh*?jQz2||0(jUj<))gq%XykV=`rPYLC?=GEygwzok^$!69vmUbU}b)vwr3?)8PZoj
z2+@#<SDHbF)de(nrG*%i)6+;PLnY;d$W8Zg`p!>3m-MaO|5OA7JfQb2vF*GSKbJM)
ztnWP&PBn1Wq)C_0-SWj*qWs#>Xvt*a(nsNiNC-Fh1ZO0UbTrlU-uNLQA?aalYh-hO
zj{lkaKAGC0>H%-`Gs^{=3VYef*0Z1A^AjZMi)FgxWbP$TsM|7Ei&lS^8T|oo7I`B6
zE0r<XB^^5GkCP6N0>E%sX|<0XKm|2dmw0|pFWbBG3Co>b<q!Jpx-=>ql%|uXu2ftx
zs#jbg8~3eBcwrd{4gwx=V~;7PRogt`-+dq6GU_FZ(v=_ZEfViYAZB$?GM{emBs-1j
zgBG&$MHeW&tmPw1PG3*fd#_x&K~3dd>yhTOBy|VxNGdIm#JOx=Zh24OtHShijC^E>
zPsKgv4I?s>9CxHv|LX1@4Im~|)y>>c>Y?#hWIsV+i8H^ImL50&)cd9*ma=KicX-!#
z^i5&-MZZnJR$B5K6&lGtVG*CHy40gNOp64G+yo>{$kWl$+tc$WbAs+Q^M3xZfwmG0
z=2cmjP4|OGt4!2#0B#G40!s|j*Aydg19#SZ9QG=m=GV}b20EM9HQUP7jDl;LvOh_b
z`9(e=s2WyPb~OW7o;^hd(S6M=&iHQ;EmxTL%2r-C1;;5o{d^Q>;9L-(<uldVuNN>z
zI`Y<FcH|Yg)g4~5-T(wn;4YQ5q=gtJvgcjAYV7@Rf$BJ6TVaGl;^6>nE(!az|BfDF
z&HbxR*{dG#VNA_fgR~a7)5k+b{L`{RVV!b!`wCimx0a1RK5rfv5LJ1%N6EsH!r~UT
zK$d)#XZSSlZh8BS2J1D4!lxixIGH32R>-(zy%@NR+e<C(Xj44;@JKGu`?jypH)bX`
z0cLvo^QK<4lj;M8j-tNMxf|tIsa`;8!Wy?}P4BPlq!QZ*eMzdrB%`(LBSF$U;QYg2
z>~jf8k~DK+7fZf0Ad~gyuV}k|L6>w*Mq$-l_pD%BcmCVco|={wm4Ghk8AX@G%!E{j
z_MVWsT9lJLTw*6zr7#qCannqx`nW(i9FY?q6uWlJAm66#zHWzR*Ut1AtKBT@u&HG3
zo4#dO+w?Vdt}8z0wMNOZX1w>cbqGkf#n@*+3BsP=`b=!PTBociuBBvdYyB_Ys({lZ
z7eMDzNktxj{WK@s<1<Z>nmJj#=Lk$7djxa@vV8$HE6Zk5Ww35RAAT?ESbNi-5&tG^
z?FJ!dtHtaq(Y+gqE@f8UI)!J{zILYWWXA>ucaWN_dj(jM+L0_D8O`{J97eR5irV0H
z-gb?JXaZ%K$JgH#Z(unkk5VPA_K)w)$^kgIjgMe6UKHm&pKTRl;gt)cA`QvE?IH@;
z8-n`qm}k<k8sgbs`eY{w@;#z9jDyFDYDQA~W%Bhq*U@7q`58IR)6~9eLt2yz@$C0e
ztD(imYf>W(EPFjLquAi-=IgQ4U#lN6`zW+B-p5gRtN2-Z>xyQ%c9t_6nBDMQ4m1@H
zZ!Zt!KY-o8nn;4QZE)xg;QFxr|2ajFUXAeQ)vtu;KZ-et3~$}E{O1yZi28qPo-bFZ
z2w|W77Yq2OLH|t&(Ep;=w!XbC@KQv0;$K3sT6}F?ef-6H!b;E&J<qu^j0n706#rRx
z{9f<>0fE&2*0KB_9KSE*|J*=C^Cu>e%fRf#sbfpLH<l~5smWKb{Fthne~t&-FrLB?
zeEzbHd5TnGhY*CGyAWex6`dULOPxo{tkuh&IbTHOljh^(Pl&Gzv=AW)y2XT;b-fwe
zl~``+uFnTej`$<ZNd4yrvd?2_suzDP%=Fg!!E@hCTiLoyclA+TY1BU;AKjlzgWo=0
z;k8UlmRS8q4VRXY70p#Xc(6-a@RpE&Q)?P>dzOXsaImkPmNTKZUh)$})P5_^OV*=c
z+i!N7P0+)!4pd6UjL24kyP5{cX<LDNKpa;c^c@)!vT0ta+D;Dr;UajiT(kMq3f(Zv
zy%T;MdT}U2r*q8UELb|~ZL{FhpQbs9l%RzzN!iY?V%Nl?(C~3(I5JcD@)flM&3b)m
z>@(gB3?c1rhL91sq9dd;M9$|x$o2!82py+5e5Bi9GM|g&l^nv5O!`T8Jm?JmSuk0g
z?b8R(djuR`|0Xy}FWhKWVjo&F$YT0>X&#tq4g9pqdh6ga$~&As3b&N@yXIV2Ls^c~
zRh`!NXA`e!(^G_b6De(~=<(t4d16PUfeR$3eDU&i+7_C+zep8FPua5rTW|qmlIsrD
znXQ$XOf)w(?Dm!_9;a#$qL%rto)*G*<o<_7zFpb{UQ~{oFq|~iF>L7>Xd<Xl!6)k|
zQgjY&NgS~v?-IN*6JfuM;j?oNNIeUW^`)5GEWJvRa)*y>!n8ThB~EZ*q0Q2AO}Pip
z7e+ZR6WLLV{8OaH!mAd~@q_att)*qf$*zFr19&O%aO&Sk?=;2XY`(}^VcuqQ4&kRR
zewM_?Y{%OcqwgG4Q9Yp-sR#7B@87-L;t8}Sh-UY-&D!y3YRAIeN;##JB$b<s=JP}N
z>Q+yb_`O}u)NVP#xFk{2@+TH4<|99R-8-Hec~q5hC6dTCuY@F>NoNMy$=BAK#}D~9
zGKkYsAdM64DDF>MQ_l29+Ge~8InYo{u{!RePTFTqE+nGR@qIZfm9T7SrY<dAyLxiF
zwaXYiN5)4VEa1MSU-41Dc<pE2=`M2PBvta$OLL1K7K(1yjvC^xU+oa?{0}7sK=-&>
z4tD(C@iv84c-%U2*f_fl%Qg{{pSX3h8@#XSfR7H|N5=zVE}SnLnt9M&K-`$OVeI-4
z)0#?`cP8SLpBMepxoJU25KE?!J5R7fh$f6^)W=E%PuxS28}7qxR{J}0=g0H;)M4e|
z_(SCrHItC=&?g(tClZNB<M;unQ$^*AdDc`cZ%$uNpMF_>CKLFX51FVk)m!gVbt{t|
z<4{b>Gd%Q=+2UZHZn-H6a@o0lXbLQJV-F!|x=7CgFd6G0u?r=d<=JH!TUGsV$Ib7C
zA0*QPe+xo;^u5aUU*Tb^8Wy!GwjiaESG!Y6Moi8v17^N2?e|HhUX7v{6sLfPLv)1k
z_=5>NLDy+k&hSh+O0=w~pUjVHub^CX|0auN&cWTjlriz5s6u}uoX9Oq7c8Rub(-Zp
z-g=Z*gd@y4E&y`VgB{z6qvx0G)DAi`1KvWbv663#*-R~AD1)=%Gv9wdyxP?LN|kVs
zQgL#K`d0A(*<@7c$1SQ;-M3b37EdOyC?0I!tiKP6OLijb<ZknDqp`p0LHzJWhABWu
zZh!N>uWn*|4%<afk<|&?2?`UDJcJ*^(a6ePC^eJ}I5L&&<En;(J|SH1AFkDF$7V96
zTDV~j2ujKI#2?D*`G$8*S%u?Bz!A2T#<E2gRWKo;NmgU{cYe-OXNMoAulPlxOT0wt
zV;;9savQqYz{WhkPnjV6QCu?7l}emGc1*lmNFG4OTFoQ6Pj!4<Um6JG+6$@R8+L&M
zONfF6nxp>Svh=9l3*tK)tLhISKO5hk+EYpOW**Sm!rUBZ<jMZJvC6)E?H`%oKN&5X
zaQ=xAS*(Upy&GmUPiV6iUVp8Alq5~@`wPCjGw0n{ph#=|%jTw7ZtAVlN{RQUXY0r3
z%hcOrqZUno%g?B@uehX|hoV{&21#=ar@|YGg+y&F9rvH#KiFFjf#OmHQSuEkJr#s=
zz=EbSSgW!0_y@ZgAQVZetOq0&W%zc`*ytSW6?33`UeiJP19h$wv%TvyPgi3z@IxHm
z`%Dv^Xqu`W;GaygbXL>EvO!E;2ghmzuySnI!Ju8*=aTz!)X&Bcc}!6>L%fr&<=)}!
z<>=711+%#%IMkRNAuzXNlg&{_>NJ>|YN*=mT)uG(j|$)c>CIAZ9Aesorz7qRbVN~x
zoiLVn6qgqAq`OVjo^hjC>3?nUZSn792KPvNj|*Y^%S}XXan~A^jF(tK4su^jjz`~+
zy>Ef$T~nZoEGLvvN8p8T#P3k&EF}<AkgB96@t3a2ko;V+2>6VmUglRd-<>^z(tRWm
zAT03%!1-N>8Xbk`4;!;YD9HA<#f(V#gZZ@j71=drJ+9{Or4P%FJAA<=K8*_Iq32n8
zr?qd?FI6`cppv0p8_hVx`S6za`P5|!A@%(^mHizs2<h<-rAkgu_ZbMy7p8WFJRQuU
z7jrNyiJ4=V6tMHYi&r+%_eB4d2Z%u&i#=nFnjO|i8+;Qv{EdZyiLR=4Hm>GE@p(%k
zC_z9M{|w?(DLe4gryl;jUsnW$O5LtLWO|f0OSLi`?%hU>?Vl(^$aC<|R9oU<6>l^t
zej}*OehuJmCUQ&qeb-MopQZchJ-gh=&fVj(3{7inD`N_gf|g)~xv2}%QfyNf=;Q9|
z)<|h4DoP<1pBUf=Esu@FeVf&cL+$vF>MIt)8)EHq-cuMnE4OS`=x+8W?)WsVqP>a4
z43IR7fYv2BQA*OM4lxRs4L%l4>;nGsTCZf%yrS80BK8|`f8~lCqb0)#gG@B5K09TG
zHgWt``r!^PGp7`b7Q5{5?RX7!5iTuzK!2m(T!I(9TyZH<;W+=;zG;AVe#qYBJhDH>
zc5c7ICjonLxqVI=q^p;K4doA%k{pxX3ow3Tqb)8Mk&@qnVetZa{QT^%T*mS$OeL_f
z%9`Boi648ohuWeVIVHu(yz<F6<&*A}xMwjrdvKjsY#$Q;?2Bd50(rCap0A1M3WgR5
z=Q>uA)tui8UX@)la^6whF-tNPxRWn~H89t%cAkfjZ#9HELlNFD6;^09c^XSrEM5_H
z`uTiPykP&*W*?R;+-^$U8khlbLxXsNaN8{f%}LE*IjCT6XUveXC1pY>*gg9A`K<5j
zZ<-dt?lX`Wkp?QTurg*K>wA>x$c8chR>}Q9-9Do_*(?et=Y3X_%GEnxmq|05_I}|L
z-k4NQOXzf|E-}fsGCb;)w*P2e{SMC?8bmo@A|&*gLk>SPP)H?5uT`iIU|kLot+Df#
z>?#rza~-z~yw2!ErsHgTkE!DNc51ru#5_;_ioKe%LEq*LrAS&URbm(W`x0YVl;zLV
zbJc$7BJ5vVTT*nH1i~XJ&Re?vPGgorW@5#?7r9=|#!|!RXV*`HiX-p>k%T#oD*9vH
zglF_Uu5LKuD)w}?8T)V}c<}`7Y_0?1J73k`y-2+%>KxYh=r%o{GM|sQ5y*V%vP<`F
z?wa8dQ;1>pM;}*XJk`b9`^3Ti+${&!I*&wz0{tVz^(_$g-#jw;w>eF#Fe{|f>iooW
zGPPYE^Na~1{DyMEsD;t^RHu7=HsbV5WftFG9DX@XBV!hKxO7Rz&W={Ao}~yrm93O`
z%&2!*@mr2#d*hwaXMHnGY4hspCUKMfUPi>iht*Fp14y24#!%ojrqDMl&lhBn<Wrb3
zx@up4M*UDTwpy0ZEPsxys3{bxcyP22?3*--cFqaO#w0!l7VQY1%tl0ws$@EGLK{r_
z7NH~&`u9Z<<?{~^<&5u_=6A)b?9ILy>FGzVU-z_`ZWsHxXR}I^`PtH~JN*wnFJE5l
zg&4Lo7slukUGHV-%GXfUZ_Jg`*jhlc=M=gaD@KTux`)%E1MnK)cL!*60HVnsiwMj-
zYU`Hbgv*?5FIu`UPza5`H*~gnaPfD1vFqdA$&{07TF);c%tK1!b-wfFNVNdSCQBop
z{}S0aKWZyS)G02yKeFbjBfDb?u)hel<pmJfOa1eJ1A8h4+Y*3ZV>8v0=79??is$U7
zVkr2_{7G16uXNVma03#q60UqPX(4&`DsO^(+h+|gJ=r-2Jd0Ub(8~Shkm~%JwUYjF
z>Oq`KF;)VL!34V6*`Bx3f0Q-egR<SKF5R9ULynl@T2c*`aY9Uum$%E|PU`0w6br+@
z6F;^Z$RZXl8t*L(yfuLs>EzVZ6y$G91Um0mo{OEGB&5~@LC$H;IdD6i(P02Z>`#}w
z5PDo~Lm9grSx&-V8HB#WxXmqbyFxBsfW7sW-7URpFmO;bakSD_41hJZ!M?Fk<J|9J
zYV9pTG)Y!V*xd%iD?W87WJ5&_gO4{c!_waRHP{l7#YT>5Q}br`9k|hp!NFc_58t}e
z{Lu*}Nem;>tl`yBKk7j|p>VDxVR4>mA5nAk^%5xMG0T1Q?Wo+^3qpBgHTb<A?Qyk8
zLvw0sHdCR*rT&@W(7v_DGtUOgNaKY{i})hcbN&LUAOnHqiZ<yX>PYrsnjx4vWae=2
zY-aDI2A7)c!vd@06M^<4nP!$k1;xtpt6g^IwpL4_#+WUq7x|idZiPDmwZ*|ZU`9@(
z!&p0SJ-Q-SyXhG9HD*3%v%pDi&d9!0m9fCyXlmF%;ntL=>+dDKz8lTd1kJu<=PfHb
z^FUAI`o>aS8J+p+V`U`hsGi=Ae@MSh1X>S~uHN45^fodXuSlVEmF?9DYfH)dz`M53
z<Ytz1sG?%$DCZxbSyWxkyff>yQ(qC$FcS@hLZW9<N9>W__Qu54LDu`b88}N9>WMem
zfsYD0OD2$=;vUSF&a%$lDPkNt9kV7(E(DL`Uo4<-bs}e&+TH<X`Bv9en;t$Bcv{S*
z4G~+{pH^UX5?c4sXLiPf7HHm@DOoj3G3%qEHT#Juj>dn9dR^LIPD{J7@HTjyB^g?s
zrZTo%L0W+CRIOn_*zf5Di~1zis1FT+=hm7SUl5=m>fiY72j_0RP(T#@BVN-+xz*9H
zZq;t8Rez@gKY3uas@y$>&uT<grhg5Y&IDM#UBJD=Kjk_&`B>iYs4>d7qjs}${#>6Z
zsXwLCUfYf76}M>=)LopXexiiJWXG<}j@i=snT>SEoevXWzqBu8ElxDW-;t4q^R{Ag
z35Ket>E~{?;eL?kG)6IpdanFCW|{LW28(2dMN@GptXk6<g<o4E4zBq`MdkH&tZEfL
zL1X6OLZBhf9I%h>gULW9FHK>tdZPrrU=ifg(JsTU_SPECMRsvp>*|b^8lh<*vVqs-
z&L%P51n1=ssXS3<o;=YN*_nITue-um=WZ0J^q9}OVM!cw-(0r~J`_##4;kmu><US`
z0iD9X)P2ux{R<pD;rtI)IAuaE>($*#B>&<_FSY-puJ6b7YyZ>$et-Ng6!JdzKTwqa
zjz`oQ6D>`}McXc%ZtAPWk?FevFhMJcdi+28qce66V)mjJwL~tv8Gxn;TX)BS+s)>G
z{&s#mhr9Bn*f;vHzs1dr*Jt}{sk)SiduOK0+J)wZ`|5A0o9q`l7NEF_HPA~_$RlST
zf-+?}1<ad2xL$NEKN$>PO%VqrihG=;2j1PP<-zqlzB_51TIaR#2ZLTqPtzx^I8Fb?
z?_)yfYzx~<B8Ac9I=eJVI@@71#&6~C2cdmT!tvI@MP{UbSotfScYg7l0cn)#n%Fz(
zP5UECT!@X*)%*GhJISd68US2ZbvffT4^3!!|AGPn?Fun)jUTduiaf=rU;HRqaT>_j
z8GL;H>h~t^gn7bay-?lV^yj)+28<<Lp_>~>$W!`}tg7`ef1jzutojW*MH0QS9G~sK
zAC`20(IB4v@c`X>bD>*wyY-CdbBR@!pP@E`4%^LADJZwOw}SlSGfOU{gkIDVW`+h{
z(rbe(&g6&IDSo3cF`#s*wm@{me6qjp`e|Rq#`~Zfhh7^DFEGIRz~repK%$M`3Cx)S
zz`DJ^I5@C(nnA}Y1mc7=2@vtsUrR3*<jPC9)!-IKIeDakl@-A@QR*)zviR>yz3c2#
z`rz9ep|~b;vA;pdrhgU#BkD@_od<u|$uKrkPUH^d8wuhnoue<J?E7naoXC2TDUe<J
zX|~M-pY}D#3gY3V&k5+=<<);fJ#j;*O4Ia8QTDxREK!t)svbKd)CWEgEsNT?@pVW&
z@dNH}r)!tqj&8f#y7My=g7oy4wzR0?5-t?17|gL%h-#l1;4dWB4E;#~R$`<ys1`MN
zB9?ZIc{*fsg4`%p`VgE4Z>&DOVeeqDFvfK~l2bxHBqf5I(KU95q--#AZywYD72qGc
zcs!(D&{oi4>Tg=0(IXWUPZQ3`?F28<qrE$eCI@)h;reJA^>515Plgt6jJwWD%u>0j
z<K%BHjT<>K5L$n<`0)LUIq;16#Pj@g@rw@uPj4){o|4vVb}7v38r4a2*wNijhHTk9
z1CZM@`mh{)a*ZJ`)XPAw%!8QkAUh4&Z4yG#-t?@JCuBu;c>rqbQ(vYHyeF797a#7`
zE70JAZ18Fm9$F$yH7IMyPYA^Y7iAr*vdK_MDhPERGJu=Yaibz$X3zg7RG^`mA=%;a
zw)koA+INvDR(ic1$^5geb;aP#oL6hy1q{)hdj4YdKT2vR6MwxDC$wGQ3t{ba>1yHA
zN#b?j289n`1$1J?J(A`TjP!W=1QZ}iLn==N>^)(%R^rpw+Uw`TqDuq)6{hB_qnTN*
zv(xxvU_a_wmC7p9oZ+wROtl1Dh_0wcbZ!Hv;j6=SXz_%-MrM<v%HpFeUCu+%YThNH
zA)a7@bmXtI9KHPq%x_t(d(3#t;md_YTQWT;vPgd&GKLIKh($8eOp*CdW}jn$EM4Qq
zYT;rTmosy$E3(9?6&Fv@;M-Rj5I+?H#3#aS#HoE^ZF9)VoJ}xDGCh;4y|DA~HJYV_
zlAoAn!X0A^&8bf{Xv=l-1X)VDD3a#5bgloGbSU6y)b7@o_1ZvGx_r3TbxNVIs?!_H
z(}w=N%}^zo^rvlQPW-`tYFy=8*HZ!BivH6vvg!DJg@mYq{6P=G6q)!NQx|d+hxElf
z2S$HdnPH=CEa)|c7#_YJ9B)~;p#|865k+#sgV*|TtOW%ZXZa}oZ#Ol-lD<K{@|K%l
zisEuYPICNxHD-5epIbJp=x@d8HCOZ96!$4F6xE&*846lFBy@!+iTvNbBz8Y3KFuj6
zfo2pMKbo&O4kHhQQHB^TF!-1a0?uoVUy-J)Kj=&M-~X_**zQ5;00o?=rE>}8(v}SD
z?L|;~rn542IbY}H9%WXG`t0QUSS<Br7YgFKdS}QkTi-du2{z$^MFb$PNsRE56hD|Z
z0<)5fS6m+S8&MD+(xNQyHBly?c<s0n_mYw6T=NO@H@ikPC?`bPybJVQHojupa_4;X
z{>6p7@5}10ry7Ke!Rebb-+pz1L)1pl0h*aItobxT>*b|3-=%HmUaafd#EIi?`Uu`A
z5J)AVF1dL5r2~*N^K?rIYsy|>z_p$cW25W*aH9ZUiau)%#(mRK6fG7AQo-MhVSvJV
zdv&z@ic2<Df4nX)@2MLq4hftI)^I7Ow9Fc+sk~lN&!Fh4`ph`C4h1t2zAEUq{z??J
zJGA{9@^MR%>sVce@5{CqUFqGbK|8CWEe%2)q|;AfH^FQy5IOG$3jgkJQsQx6lJL!d
ztcq!_Iomjz<;Ya*x=)=~Bp?nY;YoV4B}`j>rLV1PgY-Ux2uw;ZS0Gk1hlG6G^m4xY
zBcDI%`-HA}J&)LM6iJ@=dGqjZcn*vx^LRZf**9JW*8@*cePDJ?rXm<`18%bb@T>|x
zp&~T0lj&-r%`_gnQbM4EaQsf`R0wE<G+Rr|I)eru)AWK{`>qa8@JX0!fhdg25XwGa
zD%9bi&r4C1?zx7~Z#>i*v@?oLpf?LX0wC*!%7n2sDJIcr^K%u&?JngdiOAWk5yPFD
z>~04Wr`c845pM(9H!F)@HNgNeakm}c2lQfSbd6D|C(KwMn8(Aws4qKJQ?Cu1<r17s
zrk&z>lGYYL3vG8hf%s?l7LN7uFs^ygXjw?7R@Zdbtqqd=9Y-~>a<R&}qwSk+Vak6$
z)hIDPtPk)_Y%*s9`JL@tVXc`cz07kA{Ccg;V7hdCK&1iU8d1v%j`AOZikIa71t!P;
z>PNgJ^xz4tDerraVr<U$tNysJC?lr1`3T{YPH5ku>J{(gpWZhV4p;yEmsnN*tGjsB
zaODN3f98m04YzX$Jr-Yps5a9EO~A3`lM~w-jkkBdYHlO879N*l%f(JFG^E|>{B{RA
zWY2tAVDogQjl)v}fx18Q=XM>7I?SD@#9FC4EiGlO1ARg>`aam+{i*o+NJJg@X@kW0
zPfU8b?R56bK>*`%2Bvl6m~nS<6{0Ov=)LY=VXP@?_bqGPRl;89REIHY`a~&K0b`>s
z5a6V*CvS0hyKA{*_2NsEyDF~r{_m{GHHbU-DjUKyj*9PrLenHT#G~WU?$Y|hhAUTK
zXjAb9vHltUa`FMKPBa6(SZS|6!-7vI1?i{XoFn_Wv-Q?n_S`3SJAQsDHbs|we9VL?
zZ6IBcKD4d=FxR9R%HJ+BnYW6lE#MirlPS3*zq-wtnmA9(p@$pqsp1s1QFAVxg@XzU
zC(TMf+8$;<#rAaO$7iuSSIi{x+fBP$D48-0{Ya3Z)tAdEQ^LR5xg1vA%;`gU3u<EZ
zf{iPid7I(05fjJ$oiXwpHVED2DEaHhcWUks>?Q8k>6@6v$q*X<Y;HJAEwC4U8hrl8
zdg(({Er9AWO`;7mX&!2|V68e-tnHpj(!;f=U=Y0W@$#g7LV1z8`BCe=mK%XX5zS{p
z9@7Nl1qQ~31SyC7nVih!8-(l*Wq9GH1~oj)qqGC8FO{1kBJ)z@hLT4fI#JHeOozA`
z=Ig!?1lNsG*mkcky6Z}dJ{LN^ecqh{%h5&<0y%^o_laZ5{p9LGlCq$H+4Me#Oa_x{
zb8uhzOxXHuH*et&7yFFd5AJOzAGTL2n$P0XCNs}x<`|3hdDgUevqN{+>b)4wIx3rK
zzejE&@#n8+_kDHR{{b|7LhMu2nwu)%*S8ucH#t=krJnGqD2(+)JsOyNNH-EBIzOyu
z+rU}f-xI8d_1dQ3x{(HriPqi`aQ<dn^D9wu&v`ji?>e(58{@HgrG&5jg|Lu3SsaS6
zwB1*Xj<(H;Teilkr}K0&zh9yoCh>AeZo>p0Umnpl)OnNMQ8bjOVbZ~yYi<XSmjTnd
zG}{J1tZ^HN(#wXUw=k!dREY*^fgtSr;SUnE)_4O0DeixkOsTu&n0Z`9&7ev%HJrRb
zx(q@MEYv(-a{BB7Cl+-oJ1NpAzB@5H2~b-zmcNaC8&gT<o<9%IVz14D0ZO&jsV18e
zQm99+O&VxzpdSjPzFgBi(1Ulmz1ry^2)=KJo@ERX*7%X<@S(}t=da8f0-x@|i_-(0
zRn92SPsym8aglkGT@UQ@BHA`Hmr5gLAFE!PihMQq_|p{|d^n9LU=H!?ZHc^`xon>e
zTNHdsWPLVzS19m8ZP(v#&j;LJrJAqxvFmkQ&EQ7#IX1V0-l8|T+HS#14;T%ro*B!T
zwzi#4zu_!TQl=p1K&jH<z_69jkU=Fh%?Ml~TcPB<llFzVi<AhQF`xaPSOCGQNeFBy
zuC*&^c;#|ZZJiNIO`nGr-=~2VX<n{G1k22y4$>w95%}q!WBeCTzwPo;*mM>}^;zj1
z4HHn%d|UJMZd<7gRb$jn=B;Zqwa-~915mW<z-}5XT%@aYNj;TVXPO8DzZ<>!FFAFl
zN)Gq*@}$7_?ppx8$~Cr)B1Cq6z^7S6EvV-N<eNH^G9}E%S9492Fp5onTGbW}k#0Yq
z9%cr|B5JHV5JSdc#)@v{Ag0QG?tH1UrJ~YH=ux@WbA8&=N=m1q`EP-CypOvWw+^Kn
z{%^73XPpYZ3wuqTDfocv6*o8ck3aq%tjXw%Qk`U)LK30oMbUtP05-wviP<-bX`)M3
zgY(Q||0b)KoPNmw7$Uk&cnMAW%SIK{k8iSOaA=4u&E|qDh%$-~bHL^it0E$6qi#S-
zZ0Sa((>+(pul>ka!X_<VhA$tYDt)xd_&!Xtx@69Gw%QSGawON~KAhBJa8tm1px>OJ
z^@lXT(jL|hdGyegj4+AMni8s~ZH@;=U05WqqphlJN)oh0e`~(ed_F2+DAMwv+KyIJ
zSGuORAhL%;?wmvJlxv*%sSycAmR2W&@xoz`ny*)&h6W&6#UrShX1**gKwE~SGLyyX
zn!`|6yjp*<`;+U%{M_8J<Ftem<R@8;d8yl6Aa;)9LO@Wn7fL4EAWma?)P7IoNn$-{
z^lJf?Y@*-a)bY}R??NTVew`GRiw3^<9le2E_#8y^An9^*e+SLM$I3<UV(es2OfebQ
zY8V*gaMAmbSV#vZ9ayr1+$Y17yrAbLJJ{Z+x0Fi%o?31>b+|DCwGl6Q5V38C+!D!=
zfUwFo4>OBA*R|N+dk+`h4Up;t`%!H0>0YWIcG?*)#k99hyNW~37U`Y<Fp1-g&DUqC
zNh0ro(7IRY{GA1%f&Fkdcrg)#BPQ_H<pM<@_Wq2V<;FwE?Z}WLvHGZ>^9g%sK*a+j
zXMJAP5FXn~qjU1EvLB-VoV5FQM`x-wQxo@5nd#qZd&d2sa)M9x-$n{~Mww0ww`RPd
zopQ*$i8Ke1`e)o*Fv;^`z^<K0TDTaZTm&K{HqV`It>`^br6=rm|5kg)U3}R1gS?Ju
z#!6Hf$c4*ZO{4}mU*w>qRaqBVmu0>8zLMdt6alv*bmToh@q8uVpqUen5dglaa^HPm
zR26)re_Hc~G!r34gJ+T_wN;<;6aG)^Y<OV;@vZpI>A%p~{kx?n+rG_|Eo`9G?UeB}
z#G<M?8)9xRKAKix88ohO|77*0<Wn4_dLOlu(y|}?aYaX6^jojws_O;PX25Y~_mZ*o
zgRLg{`0|ltG-x}w+)=t)-%0mYt>^sUxba%@(1-~GiI@Vxl59yLpi)T_e*Z#Jowri|
zkuz-($ERX@=~@ov{;X`MD*gkDz4yR)-Wue-4}W!KfD-+8fL8wn<`n_=>RI>)-x{f>
z)XC0g2F^Z@P+8qDn&B$;$*i<UsrCWQZU8BgCS3jk^aK2?f9scThW)6U_{>Ug;0lo0
z9dtr$w9#{Gpx2TuFnTLPYju-<+-<Clj+&-|CmIgYpO*~Oabm_^EJ$veU`zu}poJg-
zkBu>>$i0U(fljPlfdugEKv80~D6)A*2QNOT`B~DNxm_bhrj0NLE%Hx^Sf>XX@T(OO
zExJNhDOnm{%g<x#q6B!_P`EU)ZsJWON_2~uvf$vJkLgcmKbAFi#enoWJJjlrBa{rq
z)X~1bDhGBhq}}cIYj7f3NDmsoz1Mzk)c)f5uT3bJ(Kjcfb73ws+yANOoe72!>O1+%
zE`BVE`O}m66O<cu`bW{zrXFG#_Rmw=WdV`ib8nV5c{yhHfhGtilm1uXwMLWwwsVbu
zZi-WxXnB26hO`96H!lO|@tKb#3Tm)a`%a5p-Anq}6s-Y&KkQmAj;>RtZu7W)TW;(9
zh?d*~&m0{r_&a43(UbO~@;6h~5?v}QRu($<V)N&`3}>ZQ#>am=?TUbYZ&XQ4J=6yR
z+>d6%(I<}EKG8q6F`N){fytm}!#;L%9TO3n*vn&eIP}};50ZW{F&Hqdc(jCDgBoGE
zgU}=LU3Dq|HLUc6XV6IeGq!85ui`GHHlSx#Y);pC)s3`%<Y?y^Hca!$5`2HHujXd)
zy47#H0?2>9-1*MKx}H-`uf-i_;(u;uwk&L-vh_r=ba_L^Rx^o|yOwE!ZOlX;@%E`G
z(}PRB9w<t$R)iZKaKo-g7am0Q6@D3H9$mf0CE6esbR?1x!U~X@%w*+D<Pw=*HJsHr
zgcu-XJQnLfn+tbOxjqH_0iH@D>ng;tcPK3htH4y{rsXpcR;NuDT26$M4uMq{G*b-E
z4j^hU{=3;xFhgm{{V@Y|ez2(|qNCWLLu|8xvqPYv1-6!6RX3Y#k*PYGZb7z$<b3Ev
zD|5F2vRMxjwZ>7C`r=4`5|$po`vg;@J}Zy=dqGhN<R+(HC_{P~0r6CfS(?m8O81!f
zAX8jT*6qgLiNH$Oox&T<lUhNdy^RVdym!=sjWNsb)=mma3VGw!YDV~nGAgB*8aSM?
zSuY7k2oW{GoA=mqcbU}j4K)TAnI{)`rhWsACTJmkO1PpT)_+5`)wi3G&tVxc(@i6f
zr!k@>cJq98XiuQ8ZCK&--`8gS*R5cwTh|`>n#3G3Oow84PhYb0@s=QttC95bv+we3
zNTj_9${0Ew9m)0?3=Pl<9+7z|w>?@9w`zytne}jVHejFB`^#Ylw%HW~HScKrasOmK
z?aW&;z7J%=y49lSq&j;Z&1j2TZ|eQ$gJUJKo=v6R2ynuuMQ<?EzhEnH-&jzZ8v8^U
z$iN~D#1mk`=y7XC^<PV_e-2{a*CP3EyP2PY+a?MP^y?!xDd<B@DkqF%XVrfp<03k5
z(jMg(=?w13vXN;9nLAx#ix9^x3$eNjz5|^fqra{xtZ3smL`r$OQ?SkuLj>ELz)W!&
z&sGZ#l+){4(YI6yyvmnsp?N|u^>pBLk}IWk`~3<F)anqiP6Y8#Tr|DBa?ki)1!FN1
zv(Q=GHeUn-4N_t4q>8UI_^-NL58fQFO9O&9c66-ff<Ya)$qrrGW5Q|rkd6KfJ}_H<
z`RyUGk7nIr7z;d)tL16AzdVvzuka1se#B-!kJt-0*pcbMdn6lod(n;6+p79I7Dzw8
zj0Zc#)wmiXc)t|>RXRyo*-U(cb6q{)AXqEVwi*;uOmqcxTk>3aD;w9ocYu+oi2TCq
z`N>@I$!btRXq|#fVwfUJPSQh=cj@>?P#pdK)R!yNWvy+|F6XU8X`xSsny-*sBuUQx
zxa;Q<jWV%g5PPY<_a77c>aZK9#7Xtpf7~hm_}O&xXi4}B*qumM>bq7dr07q3E?t<Y
zD!d@6A_QfSXilz9lkxXR!Nk%zY5#$mZcFR>BA<l;S9PvA$Vdi#nBH`TL4}bE&-2T5
zN2Fa~q|^dE!=d%L23Y88jp!RmrO>x!TEiq)nO2$f1i&Y8^M+JymEAt6maPd|*m#1{
z!0p9mbb*ZaU87F3hLi(vrBAb7_2$pO@jMppmI5*cs(JtMfI~0TmVF}CgZRl3su?zK
zE9;cnp>n&)KS+<d6QTz5a2<brW$)ssBs*7q+d$BlZUh);bl4g^LO%k|4wLzyD4H0C
zjZ8`@5bx>|rHV_~XV@KbUBv`F%fHZDUSa$|_PLmR>s;L1xIdENQ2nBQAfzij{L9Q0
zw8}U4e}QmJuYIY#|3l<@VgrxM@<Ixpk1@y<U&mq~?XiJ~mpuv4%JnFXik$e8{>k$0
zDexsBW$|svfN7<^OEhgQcR+?K90Q*yJtd;<9fd8$bS3#!Ew5)~sCVA2IwexXttILq
zbu7dbsX<62^hasN1%lJ<eECzBSpV}Y-KnG5J1w<Uu=IaIS5JC^<q6k_h`!(aACFZ1
z7aaQk|0DiqVuu8LDM}}pIqa$g={>jR=770}1mRl;n!zltB1A+6?El($ME^7K$p6<)
z5e+`TIVpF3*HQ}=-knP-EkB=%0gFmENTfRyQ4q2`Zew>2IodlU1G97L@+~_)ZqI0y
zEWP&CtDh5ddl!2(J_280R4qq7+0OR!EiW?_)gsgaV8#17$8No!DWdaY73~iB_<6gB
zE5TTYS*c%4_gsu*T>At}x`7Ww^11?9j#Rw2SdQJ+k)KwOq>BR{e^a6=q%q3WgJeO)
z%wCU&uwZxSsXVqm$%N^E06-BA;SYpEm@lYMk!|`o#c^?adY^(_y%zT-_`@S$M@!br
z29WuDfA+_FS&P`ESf8HI(mFod(a#HFFO>7gDcU;n{`@Bv@S)3uOrhER;>`PXxA3W>
z;y@~CQ=tfNH*_e)e_^|&<z@C^$ceKMiK1HVldBh-J|m!T@V^<jUuX6{6V*fL`d@7Z
zGv;1a15}g}r76ug#kxxG4~KXJG%t<p+<f-Wela19;`p}}WvC9wBB-tf(0@{@7iWBd
z8e??8s)<h){N_W@Yfx8gfl9hkh8SlBEG_~=G>veeX7lf&fI#$&S8U};V4+jS;PTb`
z`RE9{_Dr}zs`te}kDA0$?nC<<u?C0d#?5=Da=ZhT7XIbkD3c|F4TGa%bJ$R=K0`?_
zOtiwuV(T1U^8kL$0!aWinP@+A<mKijj}2xr9_hl|ldo66=*dhClVQf1zDOjl`_`vG
z-1&vh$e8y<>t|9-z}~I6rndt$7y!3a{6C+_2*IR~0vv5}*MIPcNTKDB{=3*$DaYbA
zgWb}XI@&Dfl?ZjjVGk+KmJ@=^b`A##v>so8wF{HYiLd-U+7>pCcMTYUb=W|YlkI|i
zNXUeltqg{MUX~XBR;3GA#NV$uWZ0geb}NLe*GxaMAG3XY6`~;GBe-2llVQ>Wr3&8J
zh$qgF$p<$x{11nXCJ%=DR&FgE^s{kSCJo^YTze0^a-j*dH3gpX8XxH}Vf*1Hm@je)
zd`-YsZz~!ClEgue{Irh_Q{4mDENhsd>Iz))kN2j*x2EL-L!q1fZr;melXUciceV^)
zg|}Nvg%$9r(wDudCR;my0tn0%$LH}l7f0!Xt@+Ry-@+X1aM&~%&k$}c@Qv@+4D0;M
zp6a_?E%ty6{|cdnBfZ{&(x9PJl}73yN_4|sx|~EN+Q@YFT~$8@^+N=)QvWlBbhRKI
zyCL<A!(6DrX^lJAg7EG?`-EX`tRD`19x%)Kf(6^NZNP+0ty;dAJ=?xldS}Ol2e7+E
zFPMo+=a1Rhc+@9^hBHdi&yIP^Tx<^E+5F!5nU|g_C{V-9-cEWSxnMH}V^$Lfo8~Vs
z#y(h^?R51UgoZBGoe@8<v*Xvy%oIg!g*Uyps^WMbN5J74>wQ+Yb<5%WPMiIsFxEPb
zdVq0852uXquP?>*??QkvLqZ_!nU5}AtxjqX(zWQO+Pk+aQ@{TZd_`tU$>!C6XO8p2
zo-0Yb3nE!%>$+85m@?%1_{_Hd@8G1V7+~pIsD?@{^gID$omnh3%N5#wHuDK}9`*hz
zV)4&c#*6Jg-oOvZo^C>5uia~HJF@9SR#JZ+bMH?;4+Br=xR^}Ke6&~Q!2UjROSclF
z`SXvGT;C!*_l?bsl2RR5CpEr3$mMuI$AYgvAZ9lFv6>2(YrpyD?sOg5IKwPx=Vq*1
z$jn*PEummiptx>w^YI(S$>}7M8kx83eCcG2TMo{58>Iv;mH!Xk-aD$vF6b8p8!9R)
zqI5(Alp+EG(qE|x(tAgG550$|NN)ntn}D=XBE1BN^bS%IYC^ApL`nz{AUF7a-}=_Q
z_pE!*IqO^J-w^iR&peYoGr#%G%->n)e=f{H&=8-a(v3MhI3SM`fc982cd+UHvfpBo
z;ppM;*&(ycQBzQhQ69D5g7d>Wix%GO%!919UFE$|{{eZe&pp?6e?Vbm;doOJS#A0n
zGP%ykh?ZN}MFc;Q6zrIC_!$s)D$26WM0=#232H2?nM4)cC{gCfbbi5Y^3^CuP>UoN
zvWDwd%%janPqy<iKxz*7vk1KkZW>dId3~Xh@X&szk;*25zzmD?Z1d?1YUY$exb#oJ
zkkI7mIUe?C@<`XkxA1j`Wf@wgIDc*T<OS0IL~Q;{e!%3+FCgbRdg8L08U7zsLUBxv
zBm;uz-|WqVpG1B-RJ}J})Yh`YpOxAbvVFpMk&0Qcxcf2Qn8TOji~k)QkgGyDD<{$D
z;JftBjO^`^mBGn~!}N8-fJcJ>d#z0o+^4l)q0_l*OP{xZI|cKOu;G-(r|iwPkQcP*
zsnh%|iZNr8;1LYZGv6-S!D+qb7d8hQ`><F#VaK4M#mhQ}OPrT*am3>F$qG@Ix1i=G
z3GpF}L!k3#sKCWhXdjZ(zO&Hm?oXO5EHvdF%bsgoA9dt32{`N=)?;8%6;x=~d{^zD
zCEKc0V?QfmotcAG%Wz!`JTe3nN&~+a6k+i>*Pxel-w0a=9VQ%$WZn)PE>ul_`7R}m
z?~CaR-|y}@bfAIk@p@6Q*_M)4HY*;F58r2-9W}u{FX+w0KaBmLv{m!OIypOIUiPdg
z!9YPr@L{R=bRcYfp;S^*+Hi6|9~~IQ;``^*cJwsr-K|R(L#T~;F1<|X9L#JwSzVMI
zNut3qqc?X18UCS^q(ubFC&iuErq{wLTPUDSGY(+2TXJjnz~<X#0s-F%NiPg8F~6Q@
zJywUF8LoM>sAcokjbU$Z*4{=(kJfNRs0Rc*c2Hciono`h0<M1YQ)8|&Yy9wG6%pE8
zv(GzVy7O)EwX?IbmOa43z-<ThX#vHX6i{D$)&SdS*?M&$QS*cAzurEXR6PO~w~W8d
z>@E-8(>r<Oi<E~ujz2tVPuj^z-#@DM(6zB0e8mk}EpX6YL&g4MG?I&v?Fr&tPdBS)
z4QPM5tAwr`oKvL>6|b|I1qRx_Naec}|Al)J{|liKpPR{f>>-#VF~QDubh%5dVn|qI
z$?2ISD=)}nB)CeyrNBmOL4CgHITcFn<l;tnG4}s-{9inhp$L#!58>qXD7+^=a)=Ri
z+ZlWXv29m(ju<&)7Q<%kWW96>Sf*Sbp$sT4ug?8*1!C*z{LO^hb!Yzyz~56iPEe4v
z^2d8@WXoesga7i(c+CFojsKMV{{%zrzriECAh{ur_t)!%MDWaLNw+7ym}QSkDPx^z
z&f&~W<&3O4E@@Evmm3%OV}pe;ZW<fJ{ZV;sa9XfLB%o_`UllLD3L@fRCveD>R(%na
zujLML7sS)A|MWsO+?Q3p^Jn7@4pzzy<xg68R_s$a%}hUDOb7Xubm4=cLFXgHV_(0t
zU)JmcSlICp;KDy}y-Eu1=Wf>2=ST+VE>tCWEgUk5|JNV3BoW-MR~KR~R-yT<@txlV
zcbEXJxZZpr`v#c{$NTo_UdkmsGSr2)XUuB%_b2ne$PT>Aj)&*xo+sW2ifzrb9nvEv
zXI2$SIc&~Iy4RUCXQK6!vK7_ljl}1=ho&b!Bb0tLwQz>{I&4SmjzjU~s3~MD$^|n3
zb7fJMaNzD3y1;${)9!x!^sF2|va6cma;nWD!Pj{lJo3K2aM16ke0Xz;PVeAue_D&E
zn0KpTDO<tmZomi&IH*Dy@?6AY?Fy?*k5X50$Vhh1OIZJ{irVUyrPGKCgq&asY7@Bj
zb#7FB_Mj#O#CveLWj*&-4LuGp$m*T-Rf}`bI02nqv0RT^*6R`Z(3U8B#h!GS1?5!-
z^2ajCrlk+xho=|IEF>NZriHD0hNzx!GJ($rC_*wpntC&5Z7HDKy+R*1KdVZKEKtZK
zU&jyrE_BL`X+vd|nX_^?5l-9EJ$fpe$r~EU>uEm{?5vAnnj5YG@1wJC?WhgM%_Ov_
zw#e?ewjaj!?Llt+ayL>QJa`e+okV%@M*mnVT%~o@T%E7`YJ&69{aBt3=DL)E3+=pO
zW|Lj9yOl~`ifKEhwgSIW?jdi~O!`_rQ*|p15$&Gk9U|&bCq7_xV7w$anLp56H`r3O
zm&t&CW@Tcy?vU2PJrs!CGfy`yLVc_*bUr&>4K9!W;rtCWbW(Rdihk$%gS7jv6w=hL
z@E)g=Qp+FvmAb@a7a~s)!|oWG*maipMPs41=_VjZ)MLYY;2v1ciKn4R$`>)%02Zpk
zNR$a4eqpfb4-*8WJ|51I{II=ndeyX%Lf(zAacA<17&+Th2L9PQi(Bp=&$O?)U&wnP
zlI&JzV)3Q2B$U0L;|NRH=<2xM$jz+#UdFd-hy4C%ky7a<@dDVpo>!-O(?Z{6H|bdi
zCKJ~pPY92~_t(3Ae3OVTy;);RVHnNyP3S}8W$K3#C+-#SW`l=L0W8fQt{8dZx4nEY
zLs@h#Unv5F#{=KVpQ-<vuDS3-j}o4cUEaNAKrVc(Z3`bzeyyVga+0T~ezMgT+@mUY
z?Hj^5GK+obD4)CjPNojr1U9Gp?7P^Ffdjuhbm#F6!ITM7E`B35|C-Txf7|~0NT|*#
zLh`z9Cdco>xd%F6?^jI-%4}(d=<T)}YL$LJ*PK3mH6Af~6+}W^ex)!6o0E@PeVU}N
zH=xpFzay1T0jlf!Rg#UsY~t0%WED1hmQHWbvDq34)=K%pP62+U$J#^NG4$-p;c1B+
z;rngWYl86R<1g#Y^WtqUn(C5K(_n8lkG4z1OQK$Jj=KoLdX2(Pb0eTTJLk5Xkm0ak
zPeJT^?ICaoQfY>kpp;a*`lbZR&7>0F)9UM=Hu_Xtfa4+}_`@!Dl{P#N3vxVv&HZaF
z#v9(C#dZ6zb?ct@)uTt?uDxm3Qd%aHI7w~+P_7YuSd-PDZoGbNSy1i!b+vr;IeJ~*
zvaVxU$gK?Np{*Jda_?GK-DUT_(^;czyXp6mhe>Ygy3*@!ug*d{-S$6R=zwzA&6jrz
z-qT2^xN-k-&jTl5Zm1c)G@F0*cEjk(CgBVbrBMtsE1cNpY+^P({a(400&*L(tCaX)
zW0UpM|CHX+B}*EDxitscBR2^3+RioF8BlH-E0lb;r1Nq0L4FguY-uZ~OV`s!yH2NP
zUcDEc^|W5>gUldPHfi^dd~BCqF1%_dkOg4tHS?ll{rD8?xpfEWj2ZFd2uUaGtshJ(
z)8h`#O?GWx_Qjk^t<NY|lIaILPb2}tHNv{wj@83Sp_iQ7A>djInOGD%0nuvl*^6>%
zpCT^H<Yj=2mE_t#h;DL&5NnS-`UA&^d(ACNogU*XubA;UuMX2beJ6Pbf2_UWwlG3D
z*^4wm+mRorZJLyhn#~kjXgIqplype47a}KQ7nkM#CRP${B=SD<*?*Y_l96#-8%+Bz
zV{j3V*_`y6=w0~_>u~V_bKt_K8<QrSt_FSe|FquwYwa#w7!p5;?4}vRPXk+uUbwxO
zzlMwEBZ-f<J<RS?=QQh&`9v~0|JDe2FUN@73|zdhangeS`rCS;rBVbW;Hqn1rf2{M
z&IZy@Hk>03D{pMX>tiFR+dNous2jd<m`b~?y*HcLuF*L@rsjD6?=Hb)(aLD0f5E`V
z|7pSQ|2Oj6|JS{TMes-v-iX{-$?PouZ#6bq!`y$2g#Vuawv2hnqI);%BEiV@JPuXk
zfBBf)^I|D>l_X~TWO?d+Y*GgUWnGYY`O|fdc=PPPT>AA)@4u<TUa>eQW3LNF>;4n9
zdZzk1N%TXv)8Jy0j7AQD{p*=1jaH<Vk-(%R?)~@eO=LuzABmF>I^b8_DKhn0`8J&C
zH4w4P(pm9*ar#2L6i9^yc3h)O*^g-CviQ|PnjX2!y+8k^JK<vVK|11*fmd|&jlODx
zOHgj7Xj_^|NP{(;a<p=M>emIuUM2GeDJPe~eMcl2<Oz{@nD#O!1AJ%ePj{pizE2&j
zSxjr#Y+};lkl~6=g}GGEo92~U5QZ3(mI@qdFXz3~XwFHn%+&PDHp?)qQgV90&hAle
zB2+E%cm9!OD1mG_0cwmVM@=2f;jtjsvD=BE85)zUAw0?1Y4m(xCQ`)#Q8!6`HJF#v
zm~ZpsN4OrH_wWOwJ25N?mi1^<=B+{ZdwQ&f)*APW47{!_qyib_uj;cK?PduUeaR$3
zl#G+~p@B?lD_@z&r<kxq$d?ryzI6;lA=}gj&&?HNk&6kNsYv2Wl9XO@6q6jWlZ7LS
zBsD!`qwl-Js%^)LMvmQR1tv|!+QkNN6<0G|T(q4-_|1B7_VXA0&3TX3<Pn9;#U&T{
z)D@vw;bM5{H*uZojVB~xzfLANB8MjC5T0L5=BVH<%-{>aA7Lp|AY8B4?Y>Gtto9|)
zzL&MAg%`b}`cOq3wuP@9nokbECN1R~AzCr31gzh;15zsGBflJ}n(>f@xXY3yjl_+F
z-8r4i41fu)i|d(qCDC4v7j8-)9AWqN^H|DKUOkBO{stH=57)^X{~%OnvP*Hbv|c~X
z>rYe(0xY&QvEdBkur<hM$v(IHQ<wo5BiFw+V1$Q|NU8`yxI-N&iHH<Tc|o)8JwW0A
zssGX$c5t>+JrnwY585>5d#(!y*RSwD93uGTd+1636u!s5k17a;r0vU@O16T{9aoMp
zWx|FZ2WWYy@^^5{ESZ9{h65%^J$agVa$>PR&xJC|UgWX}D~W2tL{Qy(LbW6nhzKb3
zFN{=vgKrkvJpU!iZ46PPYt8wo5$;`t7W_0$4e;LHT|5h}cDY9&@y_=<OSBRJ18zGX
zjh+2w$7{VZ&SE)!hbbD6BcQqBs|a~cwVu}U-$0+P#X2S}kGWuNgN$UVl$F<o1IlC!
zUHM+4f;of*UN#df%x|A^c5YT&5;yAn7fktBDNA-uDyO)jeD^8+Fc)g(Fe*T)Gj>ma
zjXV2fV{T=(@U^MrSr$R5(_=O+ykzlXLoK4^Cz5BHW4tVY*;c(CFI`Ak>26V4ZRnWZ
zFmb%?x{N?_c4F#7GvC>4a%fbwVKZ&QJ|G8;QnO+#N37;Xe~_%i$0$<v{0NVOfX+OG
zKb@P;k_LX*AO*CfMLo6-R!ZWvAJROx><LFu>(R)CS=mzCeW?E|<+=})x9B$}ev1T2
zwX}n_e(f5$)Lx5BE?8(h7pvuk6;Cw)_nHa1;foESV1bN(;$G@>({T?VbB=qv>)Ily
zvC+I+$)J@~TX>yd)s^y4Phn0v+1Nf{s>Kk@KZ?sSDx+MmBt0r;FGJR9=k<{D*Nb0>
z?q9k~>&e!=Tc49s-58#x(TdDQXsp#=RIKR4SQu%%LmKxu#dm2d8bmP%b2VYo%^z&A
z%~Gkg@bwtacAhDAE>c&!M@Fk;iZP`DwzS;>>l>VVjf<h!{=3lQs~%A_Hx#sE%Wp7{
z5`yR^w;`WPNdQqQgk)moIxfReIE9uWt13^p$PEX+1jkJ}OqI3&DG4zB9aE3TiYT^Z
z*B+?yyS@BgS0VHIKkk={uq)Z1eh%M46k9DEiU026j@m)oYLZzOF(@$BxvTFG7qs16
z5*OqJEvmDsfHI0@c2LCTh-=httqTBPkF97tGw82#71~$vZ|zYEQLNnA*2`Dx`Sx8$
z)<VyYrKR|CTp<@+XwTQ@3gfbj5y6(Fs?jo5qgMN|5A)Y8fRj|_Gv#>!uF`yQFQxa5
zMZ)X9w(3e!3Og<sYzZ_Zh*tOAVt#&_WFfRHqm>(5R+}*-2d1bMpvdZvfd2DZy-tP3
zJ&VbL&GL<!vA@~iecdqqA&<n=O+Cplwq<2KHH{mm`I$qt4#FN3#yiC^pZDvAhJmro
zHo~8nNkxg9A6y)r=FS@4b}f%18h&d)_`Co}jlGx;G$Wj-MjKGq7IJ-st|E(zk7c8p
zm8HzV>cIv1IXdk>EctUFF0Pg1<GpJ1I_cwIQ%^{@HQQf@rQv?y|8EM<xPA8V**fTa
zy-)qER4N7+w95U|nY0dxNACIV(jUH{-6$3W;;QuNAJ7?u$eweaLfkX6ISC|%*lL0M
z$wn6;6N!J=K|6nK6GX%kkz+GWyN#jHWWF2`A52e9pgUYg59!)*n?UpfDJt6b<;Sh9
zuiku0=MsGJuM0{qyJ;345qArAW{D$@j53JZYQ*hU3g*)|;!&LR`7-3Jjpej$fUjl6
ztZ@%ZJZEX$OM<LOor-i+*e(=cX(HEWSd{p)&n#7C9gL7W7`o(%Gv&_(Fz71KaV;mQ
ze4DQhLA|f7mWJy#=|KY?T_)C4>A$K4N_WjIjp3PrSjGB_OgP!EqnF9#uOHkzI|7}?
zr5G9k1%Z5L<I>1ie(sLS)nzy41LlF!XPZXcdKJDd%hjO7jFk9R*O?l7*$VrG9TB;$
z8bw>+_&qn+vDSW@NdI9C(2NM3jjj@aO5tsHa0-Sx_M#{;(4lWhgW|#bzFnl_-i}v~
z{B)V7Tk|<#=QgoMU_B>&=KN$QQ&GMnKw9Z9Z1d60lIOB3nj{BVDxg`R+3`{0{OKBm
zcmj#3gcJs}<eaWiADbh}45+03{33lzS`w!XSLZ%4klm@VFi1MnXxWu8y{dmpv2Y1X
zFSL|13?^X4u#o{<Q3Ut%f<x#$SjgrGv)_Xa@<52O=@C7XlOQR9)v7SCjZss?lM9PW
z7ENtQ_c4y~_}GI%gg!3n{16aBLBJC|Mp|=dXdcq5VT}_E&O1pxD$_rK0x?DN4N!f!
z6YRLxC7{ZH{9NH!4YViHBupSpak7QWKdh!MBk_2MiF;><co?A0FB|cg7(n<%#GN3a
zaRYgk$h#-D0EPbEO2Y0KUijwUSM!?RhTPZH^^aa~@OVqfa0Ir67}UlVCqbA8eM_(i
z9h4^SOJj-kAOfy24v^{#oWtE}KCs(?g#&2SJRR4+y}hb0<vWq>vBB|Mn)?i4D0rXr
zpy%r>@}Qg}M<GQJtTA#HJp+iF&(ennv7Ge%I}z7BleU^HaIrmvcmz7nDUKlEv1WA#
z(6p#WvsxEQczU6jFd{LCQ|^>(j)<z^%_x*~l$!vR2r@jSRJ=NsF6cF*p5+OEfUpe?
zZ+HiK0jT`$PEFhj=(w9G^yfF8Fi$<4{p&f^*~*bDf;xZkz$d3@^#Z~pix#we__0Ve
z%bx^wXWqgM9d(;cQDYm|F{Pb4!_%tg=spM#SIQj6IqL5Mfly0x2k1(ljuNn&^iHQY
z|6si4XLj^of^XDRS3n6F(k3TJ>|s(8Z+XD-&L`;r2oaOeFnw%mU7bxpWaH;854bP(
zqy=^JkePYGby`Vw{dA=k+^-a{bm7n_UR~IMv<O>vizqY<=OhK8anO0f=uVXtp<I08
z%Qu)kA!1jP7(l#Fm&;{JZ6_K$`nd^qU^Eish>!EM+{|gwt3QOs^<LE~!$HpMCxk)t
zC8Cs)>bjD(=70C4>UO_dM#OKOdJ%U3*j97}0Ejl~{x&)9yALx4;($aPj9x7u4tM^e
z+!>wB%VxZ|gTqFQ0fr2Vng~s$RhNNh^DVZ$R$@Cw^LM3d4b_RBn`I)}w5=`Y#|6^B
z9}v(#bJ<Ux4E^9el>Br72a_!i>vc}OQ&Tg8dJioZSYw$b9p3wGv{CFF5cYlMdAS3Y
z0K{3g`ZIXB#j92g-DJahPu*c@c^BY8b*SNPc`ksx%>S^Jh}y;Hm~pj2<)!QhL6JNU
zO3!~`B@a<!1_ja=j3Ba)RszYSA}VaqE9*TKH1jdQ2i5o#xY%A(Bf3P=*^Nq+PZM-L
zh(IJ9S;hge0itY1T14qJp7OItLi8TcvR<i!GnSI06JB@;9y$VuXGbcc^8&VJM9$9?
zrkT&?^n(KpE#@@dse;V-bcm?zlva^a?WrzPXvZIs{>TfInao_G>2LXUbZs?EjL=@^
zEIkV&&Yxq6Mp9Xaq()nR4rlesO|v!-inQ~sCyHi&&+Xc1l0fD}Smgux;oy4nzRNL}
z-bMc<g)At!+F$-7pNbm-L~!@*;^(Q40{;yNE3W7nlN=<HYew4Dm7R7#<07`cfN1Ys
zP<lxvFaLvzXv=2w^K@Y(w2Zwh=SxOP!0Nbt7gEE+>(T6fv2BQZ_UegWgSA2CG5l7D
zWGqcnP*p|;LaFePSH?aAb%>?N;B)tJe#dY;b@j+vlVMd+n)q^h6OVVw63fMv{*|ZV
z;Xesq-@S&72hOEQ5BYDDZlIE;b!MM`&Y}xJscW6QERFx<u^9T@|65Mhp{nBfu=@E+
z<=*g&c~-feret>UeF=Vu&8sgb3>JtS_}u*0c-Qf@3O&qh+9NTJqN6cQWVQbVqdy9z
zsekc=ebF~xc5|Cpo4DwCL2v4u3^_>BZHa)=tKptzs)dR@^0*o{Sg`?(wvH)HTY5;9
zX;ZNRyDD9(*F7Cw$01KJ;&(ijZnVPc)rRv`M~8sU^~FB4E4Fz8S(p&`(|`13t%Z(l
zEMru)=0&>YDJ3ay&wWwvk|cV$dwh^1iGe{-J8ENlEj!s-Y}H0&mQ|R_v_9)Uv4D<L
zR<n@zOnlZr9aX=gF;14!&eAn)xS?nztE`X&v%Jw#bm1CL?&UgDj)~F)JFrjhDG!_D
zqU$Ho3C(%dKppHxOO=mMp(jtYSatRr-R9N7a)S#{;;rzjPu&fxeFp^L2~SUNvBHoH
zG<<yPls^CLPcK&kzkj5s*2<|&{HiHTzI+b(Otht}f09#J$R<2~b8tk52rn<A##n#X
ztq*rW-&`M%-PEd_5t-%o^d0uXrZ{Zwzy&W5^T+QrNX<=F`v!NdYlRtVhrcrWaOI2H
z)qZ}lV`6tZ)|yIIXUa0#n5O<l4ZP;{T-E#9LS3)P!qDy@s7h@mYrdCfrrl28yyzIm
zc(?zd&XMQrTHf1SQGuGI$}pSE+jTyD9UFH%(|MbiaHiF<K!F;xMTZn=-<K{V$R)OK
z&|c5D<ybuC2Yu1C(xtq#L>*bXEQz7Qc2Z0OUah8oHxS;Lqu9Xr1F^}{M8DmK{v9xu
z#<1B}mL~aChjYb5+{<#!++0oH=i1?M%9QBjv+Iz-8qP1Wz`qi-Af-SZZEAJHExiWv
zFkC;1C`7E@M@6PQX)ZEhHwH8_H-Y=pbqs_~Y&sW{oe09pixnS{x_)*x*OF^DI?rMR
zPYs&X%b>4P6t<e19`iKkIi`6jb4r@l>^FpNez|Bv5G{C-WfeG^fzM1^Lsh-e3l2h`
z5bS0;YcUQLb6R@k$$kA1KGIKt19|WH#lR$P+wGFoZtr$pN6#MQLTFR`tvqX+h2fJg
zY{I3eu5Pw<DTaJm+troTq|%SZ)rAE{k3L$uq+a-QPj6q;>0$hnf~u?Yy2UYrO#TOJ
z2MS3sVU9Tx7NjDleR1u4YvjR9|B6%&;7GD^1Ii+LLN$x$7a%<Ksl8h6JPqH@{<!tD
zEKVjR+!{5k*Cth}4GBa1CN2I}f%F(g0!P*&Vd<xbSJcjj*PIN<U*HrTX$3?^KOAK`
zJ{gu3xIF7~U$g%DovxNj^#^QP-NH_~@-{6EUYw>v{)mb!CNS2;HfT|Po=$%r^A;KN
zu0ku$vq1dvB+mrh6sZG_!s=<S@9$~LB=kkp$H(dt{AHKBrSjeRWYSB)bk)fAO**Ev
zah`mGD$H~#Ag7e824x?iON)O9)%Dd4OfuRzoM^gMdcVOTnbE~Go0anCmZ==#7Ts;q
zKsY-1CrshNy)aG5ili0>fwLELcWZ=MC2r@QYwCP3)z6%Pq&xI%Tj_de`TOMZe<qcI
zTmSfQA=IS*o2yUyglxe*|KIi${~sMENbbuiCV6Q+&QLAZg)4Av=ncAWpFIOb6AX}8
zPG!x_A5nbBNbL@FM_bl6#o|KPyShiTm=3f1Eu*vkl9C!eM^8I{m3Tf0J05t$Z(9|3
ziixM{;(WsM#b1Dy`P4sB@%{N>;_am<pBf-`<yghSsrSIh<5ju)vPmMYS|t0pO>2n-
zVXGG8GZ3|u8(JuOq3&d^UG&vt5`He}Q|@*zjY4JV{A_tzm-WJ8BLO4#f))L{GC%i$
z<(l7>nc#QYL~{I12I&F=u$(f1XR-a9Ua8-xK}Ux@du`ElQt=jL>IEv2L#e#Y*1)6e
zB20E!5fu->P+XB0*JOJ(^MFncKGPXJ7lUryL6!Q%ojUAF#+q+UHDPnF5&3W&Wyo+R
zx9$#yGntesvy<QHPc8wXy3}Yl^_X^%YElyFW9Kf1{V(M&m@8xrOED%a3w`_R;p7H5
zn&7Zl)oc(xXO31P&rl+aqBFBG(ZnNYiW?#P%Gs$m>(u+7A%Uar<a$o&ABC@mXx><6
z=Vy49!!vh|W8bJnzV?^9Hq;iZD6M<XsMt=@50lvzJEXXN8f+-can@hUNdMkw0o728
z3+qzu8i~5p;}YICttLcg^gw)`cEbLcJ-)PPqnTHETEkKK-SG*eJvb3-8ql+#+!bOJ
z3Rt`_4`dC--L7}b`m+02`oWNR<*v+QDH^Rf=951PYT8$_Do<S`S7$wJi$PZA4}Fee
z1j>z-hy>Ex1y0+P<7V-5tk<q-hxnQQQ>;j}u8NU-U7Y8o6j>nwI}2`TiJ}nqj@*Xk
z3A;F(*i6#-SgXZuhgx{AI-mWqY<#W*ZM9sj?|OUZtOCctz@_E=Fu4pA?C>{~Fplqb
ze_)sP)EYk7Tfp@p5*4i25lrf7_)PYWvTiB`RZGCZ*HrQKSq}gs?N2aNEO1!*NwDLD
zxn7lS;PR=)!2na>a$44NwPJt3D$``oEcwWanrDQ#h516_+h)D1E1YAoE`EvE|8`!{
z`_A8TI{|!x2^@FwlJIL|bgPlo3l1y%TmatSQlz3&`L2_Ud6~EZg}}<$YBRBV0Pj;J
z$@lLx;7HN^oh?lLr0~k{QBo-%X7n)MLpPQqVAfu@zDn3%2!_O5hkKm*oPvb}-qzk4
z<hz5abaz^kyb$}seTM2cKVQ+QN;B8Em)!Z<^89(n3!(M+usby8KYbxDueAvjmJdj3
z8f)#<`AaM>a#WY^#gsEW7c&{?$IM;^<&A?qR=5;B)-SYmSTeEeS#Kb;y6{JXjxjbP
zm-|;D)_)}y=N~D`lU%l|8;M&py&)8h@K3@}lxsBnKtGb+ohYvR8#NvMM{c~E#p9!$
z%X?4xqb(Mo%EcLftqQANep&JKU*ulzGyl%NW9WY+k@A5TU-;i4o*KU+KiVi<kBj8X
z$<N5%qJ40&&`0inE7UEvZ@2EghpzW|&BvzmR4?)ARg7di4dK?bAOQ$SmL=>QlZ;yo
z$ZiTS*IHC&X-dhAhmIP~j;e$xu89muu4J#Dbg4;r;jQ>TGZETQYD+D9IB~9=X2+@k
zDhhD~#raB!;@WGyKWkdjfdtFRhpS>DQMCv}Ib8*8nREeB?n^KV#r5LVgB_hCR40!1
z;L<1Qf6q6t<KQNm`bJMu;vldu>J9h%AVPMHh?%rMe#T41V~Ot>wf)eqJ&vTb^{45!
zZxgXWRf{ejCZoGXY1NntHuOC0H-ZfXa;ZJ#Kv|I4MZg9@HNna_t$kES(+<*a)`KMz
z<Ra5QU~-FsHVrEWJL1BJ$UpJLW#?JvR+;!QFYnfTguz(ZFwu+2+lBx|t)|^FsH^|u
zbt}v6uHlEZ>ic__Dofbrsn2A5D(k(y>l*|7cLop<<>EW*4jz;uSMrnlhx@lSwrjGF
z!6*&K<kJ3~_sx{8{lHi_SSx<smS<xwi}j8orjNeTPcNJEklkb4U}&u|i5sHk;XGWK
zY#rr4Kn-|uXl}Bt(r`zvhQpuIVz_7yE)44RC(LC?>85W~f8g7ZlHPM3+Te{bnSCoo
zgA5rU^bav5qD%HM?_Uz{athk$>`GrgG=dE4e2#lN(POE<1uPo{B=LzWf3X2D_d!xy
zeo6q~-Gps_*)VZ{>^7`#{p2mx@dt)AynHIO9^ehk9I>*hU&iiVmr`|aJB^(hAqBy-
zY5bJGxYFrAjp}O7IY?)_jV!fIdTrt;LM~ISN5<jPBX&<j)m{yPfWWC#=RFhj<el1x
zb@?~rGoRLT{Kol8YnS%vXzxDXx8%%VJ!Mv0qERr6t-fQjR_h~|<iW((??kLSInk<;
z3haq#cY7e4{j5j9&96WtnWA~Xu*oN83Egt;!X?*pu<`XdY#L+#$UdX&I1*V+_q-h^
zB&lp&?W&jY2N09OI4f4&&+vrLb8^yGS$3FC(vRuPPvMAX$R1L!<*6l`A7rBFsO(*R
z(=z^tL(#pg%WNxJboBGPlP|dTwy+qD%HQ#~S3ad2zR(OSv3@_hF!MG3Hi=Yu7Mp)P
z>_iSMjoG~8bM>=9fo$MvN@>-63F{LdIsfI>$nB6Wq+9TpxlH}W>A@h`E7jRgfRB&I
z^QbkFxef7G#HvnJ{JU%pc!$y-Zn!A<K!oQW?G^ZSrEa{?&M6oU8FyTQRZwed*_+R}
zvq}fhk(`jwR3RR$AWNahVUAODbwY7m&-D_u0EhBuP=S3dx~Uz73R&xE9hZnvXo^ZP
zTwO1kKl&Ncu}7p|V<=Mv7|yr@TrwRWBN+I#Ej-U&Jj-r28EP3%uJ0T=)L7>_(fnqq
za7;<-5icV(6dUkvU}kR(yh^uwzAe`d^Sl2f<-VNfM+!2sh!_L1?94N5t-9l>USEvs
zvojpB=~E@o7esTpa;ps7+<Fmj((-lm^)YECZ|dpctXpe$vDMLpzmDYjr{18~>Y9v_
zaigIIw^ot7UF8*ZaOr1(;ttdvgLkE9AF{OS>+j|5>+F9LJv-^bmt|IW)n4=K^@)-N
z^wUXwi_?>;a%)9iIoaS-49asY=(XFp!wW$VD{C7Fbi8jo9xSF0N#9Pf9(2U>@wX<?
zYt%vP4D_a708D;t+dt42*#to2Q*&EiQL^E#23Oo-OWC7{HaB0fWjd8{&dSRlcPtpv
z05M>C@e1tlxAeO@hNMXM#m$xG@%Y7isK{S3OjL3QbmP<iOfskV3hd#ge=Zk;KcS}?
z7w5dB@HG_GOspb>6$}}ImfW9?`6(=(Rt!pd@BZ#;QLWA{snA_<(zN|4{yS|aF6C?x
zNiCIgy-)!wTbwtzn|4EFa-d#cO`RpUznrU`RCZ(g;IQ+-r(mHQY^6{HeIw!}5~w+G
z<6g)(TDG+ek=0Qv_ZHxE+t)E*&w_i_Wtf_wMQ`Z|t=<(0)YoTIi8G@_)tRc32@`&D
zxSs}FdXJ?@(C?yp{`tfi1|2Q<@f<p+$?FTw!4LTKTT3Ck$E!)$(q>7iDh^L2B-^}o
zaIL3kvdQVeI)3J)L4m@T6sk|L+g$>Bj_+F>FF{!DTkP*EBAM)j(#Sk0$`T-!RU|6v
z{k>B~VHEq)Aq>t9prH~ON@H7l?O4svn?`+fICHJE-uZO6UO`4z(o5_9150a(I?M7v
z2a)2s+c&Fk9K;_MDM@J;pc0m31#QB=rMA#v<Q8u(^v##F$ARB>gK8UH{k@%&1LvyB
zOr0b*Az9f>nr52iHj&~(fMu@!!eoCr$ZOsD?NqaCCTX&TDkFMkAJl|7jv|pJP}W+U
zRakuH6X)E3OT)q)12TJ2K;YYC%^|=RqJHu1r)Mz3bKCfOF)+`jIk4m5D6b$JyOd~)
z)X>Q}FSQez9}-QmT8S0_cXC=U9Ee>iItxL~E)r&Cc9#pkdo<}_?${)WC#1$FcD>D@
zW3Y%FmAG<j6S60N8d(ALYP!SQHldpZGSPcjMj?>uOmlT_tGhLE>jwkC+S{YLH|4oT
z;WzcfeI~DOA)S(m|A__cGKKi7wennAf7E!%$P5zR92e2|wXDA`_k8Rqq5}F_d?#zj
z9xdQr)B^x#AQ}C5AO_J3H8!tAE4E+X*~#PjC9{3wKxdPi=~!I+fU}N+_QB!Rl+oIf
zWI*yCtQMv3cpxzMXYbEP81!xW+c#GV3OsR9)VI3%B1(TS0TSD8%Ni5u@A;9-li-3o
zyn@5;W$SEpV|dDtCAzS#$kPyBDmsuR$xYda_97EjC^pR4>(*H83+k^fIPx2Psa?Y`
zcdXqP#WJwutbNt<&(JzWGGxR%F2nj3yO3q;(djiRrYs2}CiM>wb(P{Z!16ootFHx=
z5T~L`9f$;6m`(UX7^ZvBJ-gPwjmitXQM(kw8}_hFDA^tR%TDcqR8DJaYf+8?sHPsD
zQ9oCe+r%Lx<du4L>6>-lK%CgCe)F%n%UY<4EC&lM5A$?7p{!4D6sEuTj#1gB?DTIN
z3QI~CCypglIPEj|4W=xpD+9x>M`m~5q8XIgg9fV30iZowh=b#LOf)_nQsrg+9pQAz
zWCr@|F49SpD5!m9FSQ45V$6r1KR<WgLf@3nd0VQ)qvv>KnAH6vO;DLR%2^z|WR~{q
z@I{n^I=zblH7w0-PR7SJb7H+rvyf1YCS*Q;r<bke;jNG@JXw0F1?Ap?oE9jg`bjq&
z(_ZVJ4WXK}g`e)!mM3x=WB*apa4}nz3b?Jn;G`&S<d@ZjW)c`JK6p`O9m}<&)AbGj
z(KlF&u;0rXeLMnc5N*TVDZK*_DiOMD+e{CER0Uo!F@;n3dX@<NMx+_O7$<o8*;IkK
zPF7s>yG#|Kj!DucA;0am%6GR!xK*U_JO<AZo+10?Oc7vI>41LzhFB>|*8l}^zF~VS
zz-s5}xbPJwz4&dfnh9@1tV~|iRk2LYjm`?`#dx!kUJBFJ=aj3qea)?FyM@<0R<RsR
z!Q^DLpDJ(t0ta$MgG>C39;b13B`>wJMG$ILO<T|Vrc$oWPYJkACW7zqtd#|<q@Z)Q
zo_(b|Lb5%<M~I^WO`_W>TF(zx8gK7$_o)jua{W@w0d<R3TWUK5yytU#u+jTiUvZXV
ztwN$<b?B-G(g+q#9Wqk19l?o`1kcQ{NO*2wm00HQ*|FG=`xN!0-uzKf)l`*3!@1(~
zI~A1xmf?meF<4z~kaR}(eeE&b>1*Kit*(kI(A5bSHW*XF--3&4b8LmGFCLJ3`jLgi
zUTq1&yJKt;-C%w`4T3*za^7Y_C2y-gO;2Cu42g8~&#FGWVr7R_7ZufDS?GONvh$#A
zINH9a><it-z;m3Hl`c3a*Ux+HYeW+V?Ro|<&n72=>sMWL=0u=gzL^gj+*SFFmxFGd
z7&{j&Ndcv|bgf=-09o_rMT5pXAvmQ~NAAn;c3&)%Qs;vNA2{bwD!%3CYxrxiV;e80
zKO7GBW%QY0CxO*xd1|DgrG=qTbco)BSCj(bwzrwq24mHwGUcU;L~1WmSt|Xwr0<vI
z`rB==+D4xbKnG%<O(WR!OcYXAU7?Cxd!u)2{IXe)fBAT+ufSRR`JatH2AC-iKYw7g
z;#|j!U7YLKyfE<S$<MOR!<1`<s{#4lg_>81HiE4R{z)Wr<NfmyT;;72wU?DTKxtz9
z8VRaVuo%4b^OjfGny~h{JMf1CxW{`>a^h>ij|SJMmwCt@0P*{u4W_94fM&3-eVn7v
zRHYx5lVw&`woh}*<Z=eQchGUN&-ZxkrT9|obB#GsF$CIs!u#}9VfU+o*b*|uavN85
z#<{$@g4VoS&BqfDcf%#V^iCOG2AsN|vvJkqnNL?^mNwSX)uaw3UyV_RRN~Glu(NS$
zSAs1(^9Y4an_Di`@OA`0lG#G!DQuVI@V!cZSlqnD4_i3drjKP$P(?T2j;U&xD}?=y
zDh7;X#k&`)>8i*pjEe&Y1`(67wO1X%!3O2-9^?j(69Q6_sQrfWjdE`0w)%0>zkj{^
zxI^G;l<y!Vg@TyS>`*sT0vIZ_FtisjT_u(U2|K+}i#r~G^Q4L9nXA24V+nWhF^Pv)
zvYKMeN<Z%i8(-DO=-ONF<mI^tw)Yv&=;2gX?#lLP8Zn$YXOTn610}j=osEB9S9sJ-
zBlzC?5x&kvsnmq?aO1u|#uG5;#N?guj@D9pQA7u57aNf|Hi7a^QkKjs_4YQ<vYD(}
z!nogiP(4JCt2pRo_NR^=d3B#o#ryL42IW6l&Ndxi;$uV}DkB#6FC%XU9ltEf)i5=(
zkJ2M&PCgx)see~iDcGzS<SP(e${-LJ8Hp*5b7@a-AEbHc=oVL>7c}H5Z=O^N=Y+jC
zeV8VUY>HjrIvRl8f3nUr@>0*_c2k-{bN3$-P)n1Pdt0cDm5QV*okBL`Q`@HEJ+zB`
z$PVw=z;~+8QG^JdOz<=cxp$aLE{dez_j@VvdRovx;dhGEslJock(^cPvjHu(R;`L#
z-|f#kH}!PPD6qwW0;9lWRN(ne94SQ6{?S=ZM%6mHyV#R+sw7c)s{W3UOUDwq9jX}p
zrde~PlB76-0F?N;ULsKr5VY`nluCMza2VA}CwMLHTxsyRodCW22;GU?V!}}r>?n##
z>gbp6X%Xn8$U<A2v!fqaQdLz%kKZzXX#aK2gz;_Z9~=iQdvS*g(+u_VZ(DheU>7#t
z;5<F+i4FgBnwCMngEV_Y>U$0!7IR5kRE1Axl^3rvX(4UMuF9-SDmWpDYmQy2R}S7@
zhG?iZYT?ee_(>Bc)6#B+(tG6`-=fOxt1k;$jT{43qbIKe&I|j6B_FuHtzYvJw%U1t
zXo)36f)&-t5iw!1u`Bkq`mxUbTYa;J_kJ%+2V|tIN3DI`2fqoWXNMZ$o1*>Hc7}h&
zKZG3ytd~WlTc)NtCKkM9O@8IMQp(zpHTgh$iUFQF(&X&nlN&T=GM_R2I4aZ+Iw59#
zuV!F&0aM7WRz*)Crn(X}uJ7{}Jm6F5Gqd+rd_DFgdGA0XSGrFJ8$QBEt3@s>j)Kzf
zDAIN<MoS1Kr+cWyWW()gfN+68;f6~qUnd{UX$@{w8qOu^ZDmQdXa72>3OCMhK``Ge
z&TU+Io^Dg~v)92T(#Hp~c4S%I*wZE;P6eGg^<gQkoLxcBL;2~Y7|A~FVkn_hKbNmH
z3-FF)jh-ZUflO2o((}Nx-zEag1GG*k);?aFw_JoEnJT&MRB&}oxLV=7h}L<oeL3!A
z<=EpI$Xw5Yjo|93wMYfG8?Ctc^RAGQgvz0YQ>JB^I!jlyacw^oA^p7QR`{nS8Ox`<
zgk;r9;K$uAu7Ku)9^!IOk6PwYw@B-*oyM-+L!J7>J{Ok*-_DA}Gy%v9qv;mzafh#S
zT2D(|jpW}zD!h}SH?4;WwN11`Ox7|P2>Y7sr0J5k4T7!>1$JsSmaRQ(`-@fbbYT0{
zpF+abu!{W72a-R2R$pQidgd~Bo)`c4ktmaHoVuT?-1ZBrldilb7s$q2oJhesU3r^j
z)E6ZADA$Ola!bo>m8Qcyyw9Z<yq~Sk8zdf9LKYT#6^94G*^N4-c{Rqx4ol)oKXWOv
zM}Mw}&$&NGG3B-RYt&PsE#$J$W8E3u{Yn#gwam|7+!Uu<H|n4#!Sw@%w%Gn5Bl#>H
zVG&z(5pt<bh!^lWE>zC?`1&|xnfl3izJz6MSIgf0f9iU{hIB8X=h=)vpaGD_>+yqj
zden1O7IUP(8AQA=*lqA=@s7fXgV(1%;Dl_pDgG(kdDf+ghpMGHPl}Y#Uc!8I%jbyO
z-AsaQn*w__kD_|&7~grKu^VG<3bG!vp75`2j_1>j4Pw%yeCGQ7tLAh*VT=r(!%c;v
zZX8?kSVM^7C)J-zy)mD&@YIpwvOGP{ejf%kg}DhIvSKhXb|LQlO|Nz4MA3*Ivqe|V
zo0e9KJM{xB{0`l`&P`cEO1QV}3TJ|I#(e!g{$F%HYxe10i?fLT19kV$H%wywpo|=>
zZi{WpXo-iWgRy95?x7F%P_)-^so-zqSN<x#1=8GHnqcF;4^CXa;sw&hG(n&VGQ;fV
zy|VPVKtDOu+EM;L=)L^bM{X+&EnE#=*ThZmZ0=o+AGm&PRrHD;n)WT&B6FU9xNHI>
zqPEM*VsFz8$l=!;;6pEI7M|S@``lgl7_Zr#^f??g^Un<8TB+cn7>@PeItaU${72P8
z+d-UM*m+9}m{84Cdg1^M#$ftmZ$I$vn*AvmS%p&H2{jKJfw(Nr(*0R;u5d`n85`V4
zGFS)oKI}N`shSm?Zm!D<t_)HG+80>Vlm%$@ja2_cr7x;M_D^Jd+!VYVJYbHm_T=zu
zOrv*r$6?!up2;nL*Z4Bs8z+ogu~aB?Cp8lC`E}}%F8Q@qr?PC{%6b0|*8C^7$fteB
z={m%BQ_6@`MXyH({Y_ta0_BxN-0$fyQucn!8-on@t=-z&^#uG_b?{^{Umq5&6DQR?
z&;S$+$zw%tj5b#T^91!<ihm6ocKA>y1w1i!GvQsL9rm&FFI&@0O856H*|Ew-3LBXw
zOmT6y44fUN?|ie?F0y{0H~F~G%=1ydhW5u8f(&+c(~Z$9owjXv$DYdH1P^`34S3n(
zXIR)Xhk#hWO1f59GRw9aF*p<-U{Nmk;`_u#YyKYa`JO_{=$>p<g=W{x?N90x8&hjW
zPTJ}_v*L6m@NG-R%{{Oeg&5FA>+nOGL4~Y|!sc(dlOnaXSN_5nM?O2KIe?A8b-(O4
zmr`l<&S}!Sw^U0lV}VZEy_S1FnidVP2O4JF{0gZIq}J9A+B_+MmArqfeElqc_~(pp
zj>HMYlA3E=lq7~L0vopzN#n<F-!qYYRiAxutFi2kjKR>ZjR1lg@{p4{p01;eZ|RWt
z^Uffn9R}aCd3l?0aN0KRjM|7Ckri3~da+`hgO*=kMFf$bE+Q`e4V-v)y5hxLiSP4t
zcmrbZX+vnJI}a^`5Yo~ms(3LF`NZg3K!MpEChD!iDx3WI=C52}G;-X&-?HWnZ?-yI
zk0Wm4S+jVWkh50=D`-L_muWX7SY6rM1uDH2Dhsv;&ebY-1>!_qvRBfJ>gSqOYLZb6
zd{)uVonhttEP|46y()g9LV6WdSFBdo72?(kP!{mRfCA>PB|Tdc&JXQlv^c4HG8};}
z)>gxGi!Js6m%4{ahbZroYWwPM?klvdEmF;1nK=omB~1Gdjv@~r@87@nqzcN0gY^K2
zpk>a!=)y$gUcLJRI(=m8Kx>?j+)AA$!rqfnrpT|E--v`RRcvwJ%_tM+qLa;^g$Z>R
zrMUeh$@<g(AlpZXyuho;9^d%y=r5mT3cd56Sit|AoMC=_acvc4KOWUo-V-9J0jcN7
zcwwt99iQSKStkD?A0y+~vve-U65jZ>8R^Yvxl+{7+jwrx`$4Ek><_DOI+8KAKEG?X
zD1+M=wdAYOdNsoKTINbvk?&Jj$etz3x-5-LAM;+vb__urW#V-9;%OczBQ(ucj^N~C
z;xdYZ@=Rh+k~Aom=8Pw_0+!Sjn*vjjLJxh)gtxxk*-shYrSNW;$E4;nNKUrO=ScE*
z9$?ywRj6?5E^;8E<uC)OiNAX-*<INnA%h0iXI~&&S?aK!R84hW&XoZ1GQX+}S(Os^
z<bI&IAfAWsZb|nFrv0>an<w6A4mtmowVQ+}KI|2peqDvLsWtTI?=WB!CiPQIb$otU
z*Oexn-<%h;xR(qRFF(FTf;Tz$C-g?V@&ZXgys4V3r535DlW+!H1D#e6#!ZRyz>p8a
zN12_!3qou7s{|#z;3WlT%;bUOe@o`?17{{kc{GO$yK)dM11Nqj>3tq}RwR4&t`EO)
z^lje0h5lHFiMORI5A!7|3|~VDaA>R9e6ubyE<9!AB7FW{^bX=oQGxgZO2wLPTu1z|
zEQceZzDgNSs3ndI4954O@`$c!8Nwq!&Mz}Oh-!wfDRJi$@5Y3<Dg%oxsv7}|$up|=
zwxdtq)r+K${$@(ZHR;9kuc=j>_3*Y-60P!Io>w_<_15EcTB~vPs9s^kKol97*#oX$
z|1f4Z$DSu5b)?XKYNI5oKsl**VYiw`@+nx`1=Mrfr}hT%K2AjeIH_UwlU~eF{`_vr
zVHSJJfFZdnO{C5m6@rJ+nyI5e(2TdCn8U6@F=!t>s6!<H4$e1>pQ)Tv9gSxxdDAE1
zR3Uxt7gb`OfqRl4jXg0yxIaa8{tQo_Hjt^IBn&SlWxp|1r_Gz%cmXj8*m%LxIG|Di
z{7I!%-eVA~>DcRX-Z)1$sX?Xjg)t8$<lI}8`&L~v+E67^fm~zVqnJJ&_`pFj_H4rO
z875Y$!u8;j+5L{BcuR*OuB}v-nT=2?gA=N7w&#6UiVI)aMvcgt)^C-n93VENRaS2^
zogwBcfHYEB&@yT3{D!wFqgK4|boRlh;FA)9z?+7~RtWf22hK4suXWew@!_}&&qS4t
z>~9o*W6*s6`{nk0^gi`*hr1g{0_r$>X0$KS%_rjnR8i+J?Rm2qLvN%Ff~*jVec)63
zr*|yJ-C06szDNZ6O%MAiDEMBy1xBu4zg$;D8UsiD$L2ZM40Nq^%v5S!bvR{A$N~0Y
zio<oq3i=`6qC>x`H$JJ0Wrdkr7Yk+9+<eis7ZA9d`X~yAuT$;OQk+&yhMXOC$iX?G
z-331Spv?iKd4-}5Y<$^yoa@<*{Ne3-+bHdis|Rz##geuCQjw>h?Y>+I=xL%%!I!wJ
zn63P1>>uv<vx2>~indPX-QumM66Qn6-Sgi5DE7yix0?YBL%_!4bJwU=XyqjuZF%=7
zeM8G0>G1N|-LYNaJd$xtnbaP*1nqXo;jUGMhT9s;Zer^1Xk$8REFDzUP;21BXd&J-
z#JOj`4=Yi;Jwr!pRx>%?R#^M1t-Yh{+}VZ;da&O<Jgw|uU;o2Tl8eo!BZQE--DLTj
zxrfKvfR<XK0vn~5MxVsK*a%uwFg=~=s;t3b3XEs(Pe)R1)K=5}pbv>r2JqO(136A0
z;*y${a$d|$!^-#WPrVQ_%4u2~qqDs|?T=pkaI<STl<E+hFUE@crwHJkMoXF9tcgA7
zO}kf8a)|l@y=1X!qvm;U>_ls!xayin!?~2_Yog~7*G`ziIIZ9ISv*yOY2(=k;SBqY
z_L6fU4H!00RLnjsWVzGk2F}I12>$4mtvAnRzwW-Gs{P9TvYnv?W-y$1eS?X&LTz?p
zF<wt_)$G1Tjg7Yt4CZ3!2A&h~;KW4^Nk6Jf%q{$&%jiTRP-VbAnmD(W?WMwEI&wrv
z!&}11qJR9JoWvgpqT>z^gGh{RVeQEug@tz{K~H~_aQK}#0$(%s-)G7aYS~kcCJ<CM
z^woW#l#k#fpi0bmo(-r&(?Xd-X?snV_e|5o%wK?>zC0z`d$JvuHBu=!Jw#%%d%gm1
zhd(k=n7!hEy%lT&GHRK=(sZh?kikY%n!<e`P3lgv8G(4LWw*l6ASmtg$TmzViz0(5
zvf3B0)6~j%ys8rzuRT7r^>L0VF80GYkeO|l79PaT#y67c(Wg}TvsE0_fUOcJwE}!~
zjCQcfPFtq@VwIq4|E9o9@q5C0d83a%(4*x2WcH~_lC#(q{}{D+sW7^Nc&lQI5BAS6
z1_Jb;ZcI*me7}4fJwf@D_N(=~d3wLMm=W1fY3|9_IpC#~t){&MR0HJ6tVGymOu2z+
z)|PC@@m^D~%Qb8tcYS_q{63O9&f|l;r-HQ}I=G1bnx3<JPV_+)*q?Cn`Q5n#RT^L@
zlMyi9est9{aC>K7QO9ynrB*OoWT>cW_csH5LK(kd&)6ixgF}{jjNvi<M|-VTPtGNv
zNuR)Hj^FVe+pY&!_?6OigKdFXZ?mVepNx`vsT>R^*?ZWAhPOT`<Rd%2Jbo$YtVf-A
z`#p{?5d;9Po#q#u2h|a%g)?<;X9vIWDp$d{PG@_ytctHjlYGsp&>U=(v3u2_pbnF-
zs)LGG^8iaMH;~n@J9x)rQ37ZJ=6;+*!tg85QXN?rni9$J`|V9@HHk{Btu$e~dgKnX
z*nv+$9F;h%Y<{aSLcv2whmckGEMKp|NXjVrn{Mb9q2D_9d#*;kGrD5WV2Ej-o?v3u
zyCQ-$uaibiiraFdeNLUD2G_FojIy{?Ha11cq0wwGSrRO;k;cb*EW{@SN2goWt<LH#
z3VOeCC@Xt=c}<SjT#>ar&^D}IDu@!r_fLJ<B%QN>wLXmyrDb}TzrYy@osW_b%c_Xs
zIB?Et%^WP|>!K4i0C)ZnNvyBU<Ew8d)(z6${#l;zp~&G%spSX1Q^&hpdtGIs0wx&P
zl)6uZw0x68x%4R)r<FXBzSv`m?&TqCe(p3h_xn%%5O2a#c=SoP>Q*L8md63MY`I8u
zz`>I7n14K_LbKagP;*lJb4B9aJGdJVpQGseEt@`EKrYQ>_HZ}wyU)w_Q-j15Zd<G}
z6KpbIg<BSpBag&K-o`$AvHoFe-v8{;Le`KnBh7l9`A`3Ny>3G<a7>*bg5{s%|Esby
zjfe7!|GuJ9DUp3G5;4jW6GDX<WlLe~OSbImj3pBl*#~8mWeEMU4u-5_uZ+FK82c32
zX6y{cdSBf4qx=8p|LnT12j6pD=XGA^I_G=7@6RVQCWLwmE$#*L*Bg3%zu!_UwCRh@
zYuwU+>1oQ-zfZFyf_md$ovl9)jw*}+88cKLC<i(3KDfFsqoB~#vYM%^uD{tEx%;58
z(<I2Tj4-4fNrblfq`D8SpJv#8W_SYfB=GRf)*?atwJ0TCQp!nCWC+kyy6z@g$eB?X
zgkVzP)-RQvO(aJ?qA{l4ds4CWb;HEVo8x@3Vz?|e0_oz@`O_)ZWZeRN6H!UK?ew{e
z50xKG$N)9ncM705bwKcs?JH3`*`v(q_n<v9$!L2uW|N}L7v-0@nP;5;0piiIwh!`g
z<qnpmG{o&6ZYQ1_utu}_E_|$CvW?fR0NvKi2F;iXV8PH*yo^ob4JYJ8%mvAkK){(c
zpmK{V)5uHa%U6DU+cV-^pSz(8_yn37om~IKekyto;;C+;;4lsuNfn9{@&1eJ)tn}W
zPel%+J+7*2wL$gcP8k2;R9fcY^g~DaUk-qEboIKhtqH_fQ=^66=}m_a^!c^^JTse(
zyLs65TeVFqKm($CuCg#0CxV`Bhm0HJqry*FsMZ<RtDQVbAQqG~aen)nD|E`Nd~>Jg
zbn8{af^>IH536#N_Mtg1WQb|RGmxFP`3A7>s6-4B^;K=H?+9!L`b+J@3-Rs)r4CS>
zx}3gs!Bq9V0D`fb5%RK;`idhZgPAZ(;Gmy(uU73d+U~xr@vf;aXYVs`PQ=DL_1L;#
zAb!Qo-%8ndU-AW9+KS-28_Hwy<|H(i-^|y5=KK$>{8mK1?gThEM^W{A5F^8p-m&(%
z&{gix)s{2DJPC&z28aGkI{E+R*Xh2B9j&<_X#1g4J|s^?RM66m2;SD_e~>ghl;s>Q
zMqe!K#mgI3PuO~8xiay6<BaQ(4Bxqk;cK$Zg*Zfquyv!%^Gb9U{NO1%15Cj~YR#>y
z5e64Rl>N_BG+$lCE3Mu&M26|)BDy_`ZhUjDHZ4&(*LKUHHsMEKu-|PFo0>(giflEK
zK;h?p+c-gm9Gt7@d~0gzB3lJFuXILy0TM@&6DWXupp}<@KMiLWvBALQx)-}$J))Wz
zUGI8?+K<gQq8)=3GR35j$F-C{`$hYRJ;V{!b(||R<++&9U9Ok|g~!6?ZrhgQ5M`Aj
zc~ZL$mmtj%Q|A8B&vS#vYsspgy*Da2^sRu7Whq&$I&*I6QxcKC!Qk@673xlS5!k#&
zJ;SbV!kJaD_+|FZDoOrIi%N{y^o(=!d-9cA+PqDzyn5pJE;uNDl*#;Mvp_U*`}!}D
z>oQ${^>V}M0CiO2Fz>cQE@`AhDC|)}mavjio9Qq5l7ri3gYcAEGiO0<e?#4R#Y<<$
zIjaGeMunODUW(rwl}c4~n@8?EaL$_Wbj2#ClqcHX+x4utRSmT&?GrsL(!aS$>|i_o
zrAHr6)CnJY(^a<IY<5R7l>7=MB_lC50UtpMlq}v0g{xRU0dD*69P$Q~?E8MZ{%^pf
zk2u+_cq60kIp*&kKxzi3<tVhS;$zcp9jnW{DX=ty@o9XZ)YkeiBm>pXruWjNs;QLf
z6pyOvF?92pXqLw-aS)eo|JF7Co|>m1B?l^0cucuuWHYH_DIdL%05?&c2t>9KhhVM?
z`F1b~k*TFN1iJ|~O$**IyaxU~qV%9LR`C{UP6%zm&nFmbsxtMH-RywruQ6*VS}36I
z0OFZ&V#4f@o|frkCi)*CD8YaCl;3{uV6P(a=E&Z!!pZFFT3iP%>S1NT$`7}$Mf3OO
z^|yb%w@&G|{-Y*hhPjN@@F$vlVE<=viDy!Aq|3auaI{J7%a^%?U_ZpaYb>(A%f&<A
zH+f)$MlG!#Q5%Pt9WEw$2v>%jpGsgJe_HLGv?B)Jv+H;sV~LL*1&O8M{|g8}|D>mn
zg4U*YjJa8<2JdOS-iHxMQV+e$lGeFsv(Mt%yG&as_Ae{X?l$+s^U#2&oWPn@<;<K%
zY)1Z7%^gttP6Z!5G^on;X+sCR&yi^ssJ?5|24sRGBC5#;p^bI>Z*1zh0~f{DR?F5S
z!$aLNX_b0kE}~yHY+g{Ze3Qlp{+&q9cYx=pdD#5x@`OBfS#JHPQkj3f7(?%UQ8Z`x
z2`*Em(mwwPr4N#18#aWFSAPpkUiu)#o1;<8H~hQ`#sXyxOICV)M=2(bZ+w|_5tj0u
z92O6QCVOF-)_%z1Pi=A(q+eTSU|`{UsCnN=OCL{JeXcGv`J`25V5Jv1gD=3>I^FSH
zdNyIIlXZFgn#C3pep3#FR1nt>H6pf?k-YyY=<f+>@apvx5S3}X`zd~cO@cF@e(jJ5
z`PuWm-6$={qe@Q?3m45t7<q0b#<zWRzxD=q=Ecr+!nM)%1fOZ@v*6z&`~Rj(o5a07
z?Ck!Dw|o@ajaJ=g_;8!L^lT<7xK6J$B&1v=PgS({jK+0U1=Fy4BkoZh%P%zpNkZ{R
z`LekNH0h+WKY1i^xTIx{FnW0|s*auX)IZvDPjM_Lb_6_yfbN*a@d(iSv2Vqwa{>oB
zVM~3s0oP%Rny>Gt9_mc(o#LOVKMO2@T-+H~`et<$8>oS5L%0Kau10s`d;#jd?6umr
z+v@`3Mm5v<JgyeL&N1g{2^j}VT<bX6)R=+N><;+tFx#~cad!y;Pv|s>wQ+4|%N;Sy
zQma<Ov?11R`gM8LrG1R90yKI4$HhpGm$Z0Gu1lN78>!Wu{$n4ZXkKjU=-#HZhJ4yY
z0n4;FpQU796tr*G5^r~{BKognvuhY=_xy&oWV5I}`OfVsw2OcGKOMb682r7Jf{C|z
z0}}RIn_CS^TNBCu`$0MGK_W$Kc%ibed~Ha}uf2Y`&v!iZj;d3V9gFOq@kXFKMFwm5
z>2(rPh9DG+k#n7QG#<S4OwJjiwz9_l5FeTqM9vj~UFgBJuNZZ=&q>2sB*cE^U3_^q
zH_6pFNx4&|NOCqeo2)_)vKFs0SFl5euBjl^vgYFI>;fl!*4*WcM@XOf<l=HuQf&^c
zo@hiwPKL<D?UapWHl|{!r%A6+phIoG#v;W-%3JReDP{^QX<?@w+R99)XsfL4#tiH&
zHKp|0jH}LI8sZz`$0UY=8oFr&0#ev^%U$%2S1(e&yv}eJKK|C6$4a^|#1$W56-~N+
zE3Q!gOq*D``?_@Ea+LZd+IhL0qb1Nut7DO<wy2m-Ikw16huP%jth=;!f%O92Y^?Cb
z+8AC|Fcu@fp{yszAe>t2R3)V8q4Q(Jx%EJNnLT)CPn7y?>n^;yHmwDm>9TdVc4<^&
zkw}ZpDw`$D9+#4CKl#12GUgBxPmK$$z8a8q+m0;I4$djb{t#2Bm8X2hOhM(q5n;wy
zH>c*c_QJ1O{Wbov`D}}_(3IlU>8tpPEZ0fAF-J{PLL29-00fZM%Uqa?%2$?3;a5Ps
zxR-WohXtAy-d7)N7QbP2P+s9#iuv=@jvPhwv3I4aS&QPii>TI6S>YyaGHKh*FC>#D
zVb*I{8s~_;v2?RWbfoB`=iXp?N$9GM-^e;G%pmD!UPHBS?lj@tSX0={MP_Os4RtoR
zq)~_brgKlhAH!5@gd9PHjs{OH+jWn!(WlV>$yxkVT-}gh4~0%=zpNP3;AaV#$T>8D
zmOipV80NJf*v`pc&pAlpYiOK4d+WS3?1OpQ?<sOGY5VK8WYz3fGI%e@UIGLxN8{}n
zQs4s`>)=kK8&lJ)n=jedcSyi7>e@|MPBP~oo07P5)pCTv`u){Q>9q%_(8sagFElfP
zPpj|!>MYS<vV8%A?{Lb82%noOxNi`Lnyh(lGs3`fXM^KMiVq7U%lidL*ttP@*EhlY
zGIE_LJIO=U#@E9_fZQp>9Viem4nxleRG7L!dOj8|Jf;uoR+XR|=>x3OWAeU&^F}o%
zH{-@4HK{s?6R@5eRXk>}FJs(2EfT`6GACDFi_Q$jdnk2wxjL;r{w8|EHTL~9W9#zJ
z)&B=u#}PdeQKu&k?nuO(w|PQ@rOKZdy#doVI@~Tca#8m-4kJ$G!!I`C9Bq3ANy3~r
zBC7=U5ub%r=u6`KON!^3w!$5)75Mb2WmxJ@gqO9Ip9!b!i;ji7v~p4YL<3TK`nj$M
zwU-4ozdqhPP6ki)n4bEhl;EDsw$bCgX;o-M?M>yL9hX+;Y4=<?^xZd<Jxr=yG=P8p
zK7aNuy@bYkfkP-dEjU+PKYTxMnKgC`lG*vm`bw24+JP4hR@6ngkFYG_kney4av;U@
z#GW$@>(t@ZG%o4%Pc3O}hBcQ@8JZ@0#-@DozqL25)jd!WnJv`<@(VcDwA&YueV!aK
zTa2e_uRaw7s)89+1c5r}-;t6%d<N=4_%E8+@vTJj{Ye$iyOJj67cyCct{WUw6<-_e
zQts>{TaT`I95>4YYm;Q4I(2MTw1CO}M15j@*G!0s&rqXVAL0E6d{MEajxgpj2JR@q
zSuTTjY=5^f2G?_o@Bx3J^Up%TuQF9a*H}l%J=U}HLrQ_rmTIhrQX4hqv(NuEY7O&o
zDn41}gfbHg2^f?8ZrSD$xgle;SUxwhA-)(Pc56h`mRCB96ss2@w)x8hauXf>_39Qp
z^;JabEA<dunL}PNwQT_sxI(>=*|L(}cdI+-U$zDS&M5Qn_YL+gmf-N+yVsHcpJRZ$
z6yOC&fPus=gn@Z#I5}m0LyN#7?~9$IzR15%a+!Xx)8sd(&|`S&Z|l1Rc$P&j9hWBY
zY?-mx8a@9ta9LcEwWwZsd#3LMEv8sn{aLrX%*yIN`eeJlY~H<wrJ?8+n}bLD>kpS(
zTJR#o@%wK7X0;~)txZjDog?=^1|9=|ss)k41NA;d&RM7gaZEYYrdt?fsynZoSt^sR
zSj||Ws?3gw7UzS$v#Bztj7e2y$(3+(ch+R8KDOWBt@6VY;btbE=T9Fa0aG0x$ItL+
zhwuLX!UApXmp}?N1AzlyarckfWoX=cellJM*e)I2lrY%`^Ix;IJPW?{b58n#!hh*M
z@v#k+75IQ@F`+B<dC$#}BaN8V*~HjcMB9rNm<x#Av%?xl+`k3<^~i~`Yw<_OP#FOK
ziETMz86quGu$L_`El>2#INF2qMAhvE<9fUG<ru2z_BNE8mJ={FO(!nd=z!b&NA#;L
zAcXjC_uXk*sZs>D{?Fwo@SD<{7l4&;P!D40ocHb2YU<N~AD_vwAdVx^lZOe{f8Dza
zq{SOMvGe6MX}8ie_UDxmRlD}@T%n<vw6eVCX8F1biGZ*#*9xI0Yq)1ss@W$X8!vTb
zXU{H)4IQr<lshT`L}FkB{81+7N=jE#W`bI+8l>>X4i~D6hZ9F!X#-Y+?1)}a9>=C;
zX^T>N@xFd~NoSKFo$_i|yh+rw;<1|PlC_J0VS4pIdLV1$_))wt2`1YsCIRVeCZuRz
zbP!OVMIu9T>wsE|jDG81?mu*SJxNhLIKU|xgD8^tXfh@(><n<L1_&4(AUE63tmP?L
zI8<i(tD`9H0xRj%<b*tKICPQBd<@uMIfo4M=|H-iX*n0EDrAt;h_9O}dEQY%L$Jv1
zB!fCSKNp@snP?ar6PD|w7`=0I7kvZ%Zrnqq<q!xX$v1W=Tr&YXlHDirzvT`czb!MM
zm$kaVq1Od|>V@#jZ@S+`I^r0belEBcJ#f;QDXB-Tr7XD6SN*V*)pQb0O76Z%SUlV3
z#V9v51n3&rC<~x*ud#MrT5?%XH@m*R{`G>gWP)ezQP1iEJ%L)f=iL3LyTF?Mov*ah
zK0?=CyD&eeNcNctJ%3r}GbDpcuBEMDJa{eO?V2OVW+G?P6$CzlVveBMOOceyqJv6y
z7gt!i_9!Le8!|zJNH;NY{II*VsEfs93Kz~Tk>_=BgAK`CK}Fbyg8ib4g(_dRIws4i
zt-ai$n9?VPmIL86$3xQ_nEZWslZ-DIps!Yx@G%vA<Gi^W{6>Vhdbd7LRbn8pcV`%v
z*qw)h0qo%0G)t-K^m{6|!y!T3x!K3B)Eoh5@X4Jlj47sEgka=OTVQ<q_lN29e*Z;9
zd~KhsT8hx$VN{l?R=>miP@*x62;)-OLj$gyu*bZ9@BcEXfOFy%{S0h@ue)+C_Z~3b
z%TdSTlC~j#)tZ5)4F4O4>Hnd?b#MqoI6UN>62Ji$r;m0Cj0`n|SNBR795s)kKh)CK
KEO}u2`u_k*Ec-J6

literal 97214
zcmd43byQnzv_8n!meQ621&Rh~aV=H|6fIudU5XUf;!cYd3GNb#I}}N9XbS{)4-y=T
zYtX=iesk}dS$EBvHM8#Tx9<6ecjbh0_G|my`+1(7a1|vPoM+_EFfcH1KFCU{VPIf>
z$G~`e^yC5hlhKPB6%33Q7#}3xYj|evq5>2QX0tZ$vWHI7(|SqwaHYSd!r#7;0(|7N
zN7ibL7iYz{+0(B4^dJA(xi4MjPOIrr{#5Z3j4F1%67}r&voY`^acTEvI{0mn0}u7j
z(R8;L?g3hL`j1Fhmv?bvtE5wRiw*;WFL$2}bF>KV3=5oVFX+3KG1+-A)?ZzYFjZ2Y
zgRk?pzMPbv3vABH#85p&+lan6uD|}<IOKnT`?s~^^@!qc<LAi}{=bdDO?;<+zcfs{
z^lt+!^Yfp-EuomehkqNMRR3W8Z5#^yFMJS~=>8p_;T>UkcSy%OB=y}9HMOue-K$QX
zVWAWK_A`Csn-!At-C0_UwFt|LJ7@H_#c&fwVF=U$;%UR>0s>`7=JEtX;LB^4`&&ca
z7l*I^NIyQ_=+URcSbOx>^jDTB6ymN`OnRQ?l_e+EeYaw3Z#VC5vLBE+M+RoT|J(O9
zHjDW={Q4(7WY1Oq9gF{lK@l5Db6|Cw<YNaXS6nWucN<q;rO%$WU%=%#sHu%!qAgiO
zPE$i4J@~>STHktl!t+J!*w&^t8Sn0$pCDXm>Wz09na7WVlo`&B=qqc1p>3c}lc)+0
zs-o$gYhB&x)`*Q3RxF^|u~e^`mt9#h09rQnPnD+@#tf+9k2*&-Y4d^S-g1zShvTrr
zH)3?JV%7cq3sIrSCF$$5E1ls;SpTr_c~bk;XuV!1dO?lGILz>ga>vdvEVrZ9jl*}N
z`CbFA<@^ri;kE6zho><U(Z{l1sOc%i=G3w@m!#97ZO5(Ixb0W;M;WjA8)~?%eBP{v
zh}@n1`q;F$ejV17GLg40QLr%8|H;zP(2+gvbyxV)WnV6PLC0u5L=#n}gJ9GAYY)vT
z#Z0EG5u~0jGrpL^>m{-Mv4Dr)ifnwY6f)u*b_I|3lYUtQfPJ0KoV|-3jnJd!IWs)`
zsGO75NkX3B)KfyFJUjLPQh)O$j?DK@7kK#}e5<>-XRo5@ma9bVE~jEnwK{(W%3mWh
zX~IW?!Hz=bDMb&zY?>49mAbKxjtuR~q9U(K`nubZkIel2Z<l@rp%<TmmOf(_ftvM-
zHL8G!XK$niCyqk2xHV<iXyO(+IY!Vpo3WC6*1cbP{d!PQ?y;bB3~q(Z`)_+XVwJC#
zFx<_YZLYrD7PoDh)*1(-YU>!yIX7zkwLDU|TBntYwntLp#(;s?JL>y`P?CVFR%5>%
znNll>!e`<ZWQ1p;pe}EX-9uI`KWPRM#PuTXUbD6b-OX8;=;$_Z`|jfk3<TKQ`y7^i
z`%AfPlIq1aqO&Ablb-BB!Z5?l*3Qn{;^OW3-7O*|Dd`hLf=16t!>Q-cR3nvxdK+o1
zr~9-thi>p{N{?Hu%E;Azf;f{dLU@A2@3xJQP~P;n76whBenx^jr9H!**qhf&KQ|-K
z0N;0a2Y=n%svD|%Pzk;CK~mX?cvKfboo)xF$wfy9p8M3<@73K223VjTq_*-wH1#tM
zyb~+BMsF)m@=iQH&5bSkVJRE6dDj?-%o}A<?eB<+`fc7mT+RB(KQ^vbQlG#iT^_(O
z#W^<x^uDf~cR2V$yX>;5$666&KZuw8XL}kjTYE0{qoAlLuL<pmF@*4iO-EXo7#=XM
zN}Lv1g0HPxxy09t5QC+&#weDIib6)ahq|Y4C8f#4i4uL~>8TMu+A(bYBF?Kl=WXX@
z)Tpg01KI@1*L{{tLs^1|n+;$Lr67_q;F$3mxi@EG>*w^X%jj1Q79M@YwD##J!>?cZ
z{W9|M%1`!&)w&Op>8`d&e6(IupNCJFa2=oJN!&(zU+Yd7_l<Bb2|uE^$kY=KxH<H5
zVE~2U?fV{1v0mOCB}6ADqo@rU7>(1x=_J48_7*Og&5R0z81(@t{kwL&x+iP5o%)(5
zGI~Dme!u5cpf~Z_O3GXCpn@BDIo%DdggRxkNwo1CDXn&n*iswql|aMj2^}#B+K;H_
zTSpfzj#mnlhcHjn-~mjC*28VkpITs5{Z$uX_*qyk_V#-zCUV@FMIFFSl!8O445pi5
zt76xO>u>pkJnhSJR3>6|f*J00yy^+|>QEPO*|yv?9R`N%*@@^~92M8RiY8&TPC4UV
zAqVc=DV|>2S)OP%KTS=td)xCQb>G=kN7_$j!kr_qc3;-Rl<i*hA}3itq5hQlWwrKX
zYc!8lyHY_x!S}ow;kOC`B6nvK+{Y<d`Jcn;ZEez{raoOZxO&yoR-tYQ;<#C)DUI4P
zx!(NK0@BooZBA~&E67g0`sKdfT<_mlbKHM-Q6&9gxz%=>SjtPH!ykqE!)&IRcsXi&
zRh$?!2noq;GW*f{e3N>y*?GBhx#~7DWiE8H{xk(zq)Z7M3wx+|u#kuq8`f}Xq}~_>
ztjyvb1Nq6+N%R93g>xZp=RwdlW}zs1e=?scBhh(Ob=$J$YvOC8={bb<ozZ~%t^9(Y
z`rOLX9x*XY0yXUg?>bS709)y|(!7S6F8J5_wq~o?C5pX5G%wTfiB_g1jpUf#zTjYa
zfr0VL2YQU7`D)aGO(mDzJh#GZ#lU1;z6!VhQNBn<GDOi3N9VF91?)3aJsfv{IxT`T
zoDteU5*<;pJtS+o0#k|t+_BYz${Bu0Q2S*@`=7l%Vc(0xEJ2T&88<Kg-gQm;PlVQW
zx+om4GB1r=t}^<UP*K|jlE(&yMsLboFDvCU<TPA%%8|f4NJPYK>L-m@vnTwA0&Yv@
zGA<v$FTB=q1}%P9H@zl!8kX$wWUd?_qn9zs6nnGOsO->s4#N&7=nV5<T(tJRJX5{g
zG4ZjPDIVd!K(TJxoQ*{b1?)8@`~sDjtU89$#=YMgIR<U?d_XOoi;{l6sk!p*7C@ao
zvmKU-LX63)*8)yDI?kh{hbD<_HWBkzUy*$vTjd(uefU6Tv0&k(>`Nf87Tds#Y1B#~
zL!M{ujJ7#~nU7mrGbP>Z(Qj_-r_<kzQ&tKWt?JHGl`${^4OQ?vw4*65BfM|s%Q_zB
z8b<Q8y)3_rxF~DCafInH8D9o*>|~UE(#zhUsW83`I`BL2G5#PFu-}eqgbM8`--_YA
zYr9TCTumAK12;$$KIaL?Zr1{`kGDo?ugCqak*HB>)aY~@5>h9qkjZKGj7*;&yfyKJ
zs6Yaw#5`%aD%+q@g~RNe#U=5W!FyCXUXt51Du~aje+sE7f+D;8V$2a*{L15#ffPN*
zFom|-N{Y3|%H48GeO<DlN;}5B;&7#VV&tqft*TWe?|Bbv3CN&iZ$_tO3gNyH)U4ME
zL&Ye2DDu`R0NPdi$-jPZF=ZQC<XbGQRCsRvfx_3zOH-%%`pb4_Fu?0_V?$rRJv|$^
z!QXm>)RsrMQ<->aO0&(Pq9e}2V165iIQAH_vUbFisd)mvZC}qW(x2o<?dwEVkzDv{
z(W;J;o((F%y57)-w&X{Jaw##Cf|8t{f8)X$N%b+edW817xMW<uKqmjs5_c{eU7}Zu
z+735cFlCXOyaN%&yVKMQuht(N%cUIS?_Qgqey_njN;<$a-t#)sB=Vh^8+iK~rricq
zxntd#O)>K0y;u&mhvM;WTF0mYb01exkbOgqrrhZ{6x*|#rBIWZ=?y%Uf|#(u<z*g=
z%&lvp{l+*P&N2={T(=_Ro8#Km{HrES6cgffpp#sZQq-F9+y%vL-})+ux)D(MD}tJ{
z6bDVD;)F*7j?jl2;qu2_TU8|j{O+mK4-Z)$;J*6sL8AZHzQ_I+5h0GLTqHHJZAvd=
zbN)@$kCw*GJa{ONj4?{AU(CTE!@hT9-{EmA-AanG%#zN+#m@n~1UWoY9&93B6E4C9
z=PF3`m)=}hF_^#DllCP}&q7ya2|*-7YuC`1YDl09I4WdIfr%W)HV*bv2SnwZ%28@1
zji7a*#lZMDZQglUfR3&h!;28Y$9YIVz$K#X2Fn;9=+B$e_q^O!A{(foUpGk#Hyw&y
zwi}ma9=q7VgGdkNzF_15sIICQP1HM#N|*YcbF>#!o#q;8>CYCvU$8DnR({V(y1Tu7
zbsy>;{4o5mbEa?eL=G{lPkF+aoZ+aeE9Jx)XE9^>7^0Z7EGx9D?wYuz+%>B|HCNW(
zKlL8;ywk4JuAlD`tE~7{(F-Sx-e<NMcx`#o%8TIibOODFuEo$$n{&`fSx}NV9={~`
zFeN4YY0@_~!;D2M`)U&B;t`_&TX*MXNaqvIa$_+cR#y8jH)A)sno-sKwo1dQ`&Gv&
z08DBb|C|0uoS5vdFQ+x03NL>fEHBGpKBD~m%xq}Ls$s^nkVUMfGW|y(2d^!6IZ1Hw
zxBl^JM+1EBKCW_77}E56A<a9p-MA8b42;9Ia@UovnKBl`2K2H^y9|Y{g!cjc{WtVQ
zuUIuDj^?wm;E=`->q@<D6o0IOj5=M01<KglZnm9vHP3$XH<d1Pvhrx)cc&OlBAm)_
zM~f&?3dG@>JYHAIU?Jv*(RLmxWMTZ?TO&^|Jy!;E;0g~V2V6Va>au@PeJ#hOoSce<
zK<b3r%?G=ewSJj=06JqW89t&Ai}(#sCRuExO#pQ*o7f+ZpxD`^+p6EqPt`9t)j;9K
zxzf>gjtU-UX?YAW6Iv-6(6$jjy-zeAi(ak60Rjewsr9YZ{BXAl^B<GGJFql$^(33e
zpuMgfb=1`osaLSvY?IqFLQ6P#DVFU?J;`u()Aw#hA7fkG2szbu54)8wcKK!YbvFh<
z#^5gG)bZ|R<?MDpW%D-#C^%0#s!AJDX7y8qg`TP&q>aBp&NymhTi4UGwo&*km;tnj
zoipSKJCl2`T+IG_6syNdH=I0<hN@rP8tn@56G#tCifriX-mY>$d{_Iuw{wb~3X7r^
ztCW;)wma|wa$_hj`_6BBDw1gglKHupv_6}Nwg`!_C4XaWOY|IP?-_wl+q@Gwvxx?S
z!EE&k6Q)+R{^{Wo)+K&M&&kwX*{FFp`+6*1g!?T;*bSvy<lT;a{IET`p0l3N$34eg
zeN4ZxB&KwqFnms2dn$Z4<S_g@G?})@5%J<Yxeh^a4Iu9utcRvBHX+itlx9C6;?BJ%
zUL|itrW6{Ba5)=O-Tp57f*o##N37?#;KBBQwG$j<$>EVGIF~Rd<cP2^Mtux>ru$Vm
z=&V+c7N|t+e_OY=J(gJg^lRaNU;(N5>hlvi69U{c5#*40aZIYXI30EV@9ZG8QBtMy
zq0$Wk`vXW939^NzI@lH(*;v^%9TJz_X+az;3kGQ@I+3eX^iW7?xb@<!>hi{WmFS|A
zG!RGHB;ktG$ro0A`!GL*$=U9tHqUOV^@!Zc5;BaeeophcT?Cnqosh0t$NNblWttn9
zQPQ}y<aUPA4o7WOG{1YW#8saAprNPCUWtuUYYJ{!fESW9c*a37(>|?-@Eu-6VeJeX
zHJ$Z#>G_Gt`8%oTe_9W01VN=L5Z*h2GPwJ5wry@pA;3jcjElB@Lgd4p_Pa$}tTSTd
zuCUG>>L})M(B=MKWb3sC>#|(6{Fn6HkdRz*moJHh$fh$ZSv3jOU9OM;0zO9C*O6vV
zXS=^wjO9}H`mxVG<I1CEViC7qjmRRu&$17_P87ygq%r*c2ns^p<gtrV*RVfC-<X}9
znRzku!Nep7W64kBzrYpUba@#5LHyJD_s<BlQ~h=S7kxIxe2_-B0yDel@@7BAtG)uN
z{JpbQZVC31ensnmAItL>1PRPMQ@-sL#qas1|7h*`f1m_I2RG6Gq6BDXhrR@Chrz<G
zOFS3%FoRd*qrl9c==Y*whUn|=fSd02>*jW!i^FAfnsuiy=0A8H!qH<OQ3ybz7VY#H
zYtQ}@H~DV_6z<K!!1!-KCjK8Ev{?J#;$?Y7#a}?lN!`GJEwE@W?f-%>nSHxQ$k0>w
ze+P!1pg;1Y{NDi@{m+B3{;NekS{RMC_T?^Ob?1CUjP3Y4c!Lv?9sgV>)3zDSVSkR?
z`id;3d0COhl});4I|cpR?`)jX|2`i6K~tq@FWEPlc{Bd@B@e{~P@=GZS|hm0cQvke
zP+^YrocT=MB_7CRCSk#2Jv=emfE1$3WiE2`Lss7oU2yqC_HyL&rPT#p_iw*j0sW~W
zM9)ef>jPZhwoh9;wkVU=>X<v>qnL&~Mm*#y!b>5tR@`ou5WiOxZU@CS)uDwAC9S0{
zAIo9<KhdH1;p8`kqRcJV46LDfFCbp=`JFn{Em$DhCkL5U_SyQ~9^gY}O7?~WR<5F;
z{fa+5A6)9p21g*_d!pr3CE0<lokdPA1Di$ekbbU`vN`Ju+`-^0vwzG2X3bR<os+eR
za6)po5o^lmlLSNT-6M(~W(PxK8DwmUx?tY<iO0aRl_SOFajFt?F%69;ai^038gKR3
z&Bx8AX`<t}szt29EvWqUr@Sy)???F0K+|qg%@zb%$U03HrD}g7S;=*a<6r{o2&C5h
zG!YKT&L&)7L%xLw5VxrwI}z_5v#v?<ZI{lE0b6?5kZ#}gxX5CzbEeb+HZR`FD2N&@
zb~CKh#3$Q|`_g286gM>T6;;$_Wzc572B67!+u?k5g=J}!7Qz3n8)m`4NMi72P^*>3
zLtUGw#!!(@^e@gz@Pt2BJp#mW#4Fv+^GDF>(nfYiy{~OUfr;*px1EhdswR@zoJ1Yr
z<f3*^t`(fQXT2~Th;*GVl6qXq!7>*S>Su#J*;naPaNPOHL+>qb!OoQQL!?@8p}TRB
z7Wpd|Y~FN}?%USwAHeMl%;-rF-at98ZjRXZ-j+`y*}@PV0D#2J4b!Ehh~>aJ7lR(V
zGEH@$Y5cbWC4qGa+1wKp=M`7BdkVs%9Jnh2?i>J`BB}9CG;HlepLuhd+>A7auzzuK
z6!WY6^SM~8uD4CULG>|>E!?eaStcKFKVwLA|H`Idk5@EHefBdxL=n7@Hr72Dq>8kK
zJSlaoD8Pb~T<>gzM!#m60*62BDQbn~tb8sSw31a8k5E&hFNm?De2=OU5tAIoFh!~2
zM?4-I>R4tY;nbTfeZW1P)x*PfcsW3LPGmpSWB1x^$J2M5T=Mk+!a&ofnKYG9SsC8X
zomLXhd7y;M9QWftXy9GU>rc6OyY|ogundDBc5V+Tz4@)@)=@B*WY@)OwO^8h3PmWL
zsXy8`CJR@0)*H50gS+fQD$b^YeziDz#;{^^r!aJBmc$&!SOMl=xfpGJ^U_9tAt9bs
z#OYGs&|o@lTzdqKuBTajG<yb2cznr54oP`HN@-N<xDA(q$i13)OC-%JVQ2B4jZT^?
zU!mjG^#(2MFiP2kK`yPb+!n(8I|^tX<E!9XXqTsDfGv6I`ui+YZ`{uu9AqYhPG0~3
z^TgjX<Po5OwAIgQ7Anqd-~CxOD5%@i?Lpv}iopSU2M0aT_sl1SJ?`%YEm}C;*w7Xq
z0>T3y3iNEz_8FCnJf?Z!konXtdT+uulS`iYv<N-=m~L)TE-R^!)Uc`s{*j$j!1$G^
z$X;EpQuu?|;Lgf@b+c{kCc14*yQJ6AA_2)KpJ%KH!-8{Rsoy$(rtns?3gXa&ck>Ko
zrzdOH$14g;m_{eEq4V>Ip=yZON}fUFH90`amEjX+s${3;(OrqoMf-e_t#j)c6i#i4
zDKn6cl-l@|6DtrGW<LaHvxvb&+x#6JvPC-^FG?_A<%+)C9-a}dd@3_3L|QXGYfM=2
zfht!`UHv6lIB$rb+3Jql-o_0W*~^u{@OUuSINd)44^%-Q=^lI5rLXaLWlPeMx4+O#
zBf_jDVlg;^zFbEdkW+1)fy+Y>A)4h(P%2LEavE##P0kb-w>mGef9{KjeCRjE=mI<<
zxlYAn;+QIIRgFn1rTI<m!4HxKTE8`?KSr94(bI2-(UDKiRf95X7-9y6((hS=K*E2p
zK1UdNkCgp>UM6E*VVeW<2)+s#{h|>>3ESCLvltk;?uOTqE5UQKb7H61Cz~6mNKQT&
z&)NEo+qJoQOp(uQUi3_~8b)@1y8Vt5Z51V>Q6YC+tyU)SfR||0S+iKBJXsoF)38gc
zF+{;mvPUHA)0h{jcCx1CH~q5+H*WZg)L7**4V8tvAN>^Rf;g(PX>MMBW;U04z6vFz
zr6Ws^{!yiUd}UUW9o}Mrfa^IsS2ud~+1DVF6udMPZnsKmGe)(v<3xKD?<p;@se2DK
zP?>+E{Mk{xwY(}f_ZYX8R=7yhinJ{CiCL~97tfngctWTZX-@Y>rr%S7*8N;2bK~C5
zIDLL?24~Kx?O1k6621_Zy{YFBko1R|#4l7S&oDK$YgS26dO~K=jp6VZ+F^GSZnwRu
zBDpdXPCbWbR<=KSXyLd?sbP~^SZ31dG`29=jHpe=>>%1m<moRZ?neY|g^TI8DwaZS
zI&!||uWD2h)z)cN`84Aagt}$)z7#G7vP^_a(z1Yg9x$W3fidf~F`6gyphs0#gEBt~
zd(``)4gXTOSp-yks{t_k81;_RX9slj4RRA+OD`iE>;0%ZCw&FxarLLZ>`92EhNy<A
z&3NaFCvGA;?P=<~GYojne^xV2tRqg>SvD9+>lw;^NN=Qeh?GM?uCygtS)twyZ_QuU
z_hdLIom*eOAERp1;svI*Ja9f1dOh{U5cXs1**3h~-NqscM37=7W%*qFJ~*xUmt{i7
zs0Y~hgO7pnbM?Q54YW&tZ~ZR~@cw@id*|hUO;c|4Ip1%;_PBFEGbL!o&JojnH4;tI
zwO?u9m6nz5G;V?k#T@>fk^6rTTG<r6y97A4RJXRWA2#@3*9Tmq&Jk6WmBeDWXrcst
zEs=Q~ELK!i-Ceie`FvqK5o|vZ6uq7uZo66Mz<#CuFJp%>ytTj2u;9tEW{-w62*hwr
zaR2g~;G^ujlK^5*In(M?jL%R0jX#GkGTJWzUy6b=!YL$v{__gdHL5OA3#Sc`=<fY!
z()V~yA5a!~(hn%B9X~0%or+{+9S1_W{MruSHQpKv-j$8>_6d8JIXoSaSF0^cz2L{~
zGg-5hDN2ggF*d_~1SWm=j(5o=B=DgaIbht(j1Znzb9~tQy`T8Ruqrdv^SkJxagAq9
zjgY<BT>mr-mRu);vzZ=ZYv$-4vj7AqUMfcz&Mh{09Dx0|6-w{>;k$@VIT}seF3wgr
zQw$Nu*)3zWsEwR``nZsq+WN}+<a{5XDs9f3+@q)Gq0#NG?1<{KH``3m!nwtpCI6Mn
zF+BLtw2^3<K}Q@Di*xNeN0D^Vfb9uL-CRM%>-+V04@6wF=u^Hc^+4@#R6Kv&WjXlH
zcjM!0?C|3d^GoHb%-5**!JZdOi>+AE+BKDVGwC8OHY;r>kOFE7N7g$l&aEB=0x9~m
zg=S$scfq~pKQ^-H$6|PrqJ82#@_2V^Yh(*D+vS5tWmB~~+uWYt(o}F}?ouIY{89V(
z+4%vYN*E4T0lFTvp)S2(K6Co#`=TTJjycZ8*e7*f@9MZ?a9H<ZtL*HGp~u(|zxs{q
z=xokakl)#X`?t1n`1my;W3={S%VN`9$=~qGmkQtMl?R#|g0#+}oYhPMS>87I_>^BG
zp?A}&)kh`F&!rbxXXEiKhTG3>DfbG399ulpKredFNr<1V8ZOU>w;X1j>t*o-^?`UO
z3f>*}GRAeC$i&<&fr&}hHO~!z5o~<YF<457sr>`3-fW{re>K3Pns=^3UUmbZ`iH=Y
zcD>#K<Z*0Aq|1L`0hg;Fk^vm#WcH3V?gr7&5O~CLRcBko*Y$d1GQpo#>M3qz`SW*r
zb4FDDCl`Xu*)@|(&Dz7fDQkaot;T5dId0>1dbV0*zp&VPjl5<pLtX0k*Pit26}*q`
zJ<*=FDZurb4#qc5d}M1|@ub^RTQBo~+qhhGR&|Hqn3NSvS6HV*x%UpDGdn^)Z)BLH
zjNOmj74MFHpq%MhE7>o*5vG)3CXP(RlGiFKoJhVjzA>h0t(fJhYPtGlcw#*}%j&H|
zAmp*WyJA91qI>mgIfdBJECNm9wLy8P=O<ZRkd&9s{0Dm;r~j~>A?}Xc@8*E}h-`j8
ztI|7JTV)ykEyj)eMe&&oy(mVfT=i)d_(x9nKgvjW<y81Iw{i*k+UWU;4C3Nt)LKmd
zn^S(!X$f%&=`?Xc>-3D;W)`xzAHw#q9q9+%j}DO`^`MkKI9w7=C~$V%>BssNt{w14
z&XhBv{j9H`D+R=jn`0U=Yir4Y3)R}#*#rvDBPM|+k^pWsfr~8G6hW5FxkWwzlXb&|
z>TQ~~QqRTOaw~vDX};ly<sCLVV+T7<(yed&{qB2(g<ebNcFNh-JcX{Yh;8HcnON=(
znyMd7XP=Y%eb!R<N^<a`j+0ueAih@;uD5^g&gFIy4%pScw-;pxI}maie~O(FBayql
zvV*xo)`eQ(fQ>ErA;0?bo*$jQpYK*@lddNLd7H!M$_rkHoYj+URgCd?VK*O#W!kOw
zeNY!6f;J~%=ML?6LuCi;c@|FvMmRms3}VT2(8dKCi2wYOSvwP8A%5`tz-KR4z9|m0
zH#s|May^mnb58jjy!)+AOMkGy_?B)#aIS2;!w)5Wj>dR`Ae3?7<hr7I2tOR*=I?r2
z>Hc8*!lcn_ozT7SlbBP7XG2kqxvh<J9&~>F<%B`5K1?W=oHxzN#OMd()C>G(6D7JP
zZ+m3r9xwCfeaNV`=#S861#f=E=kMCBWgNAY?mxZO^64{*%zRGlFrf6ucABr{+$iXF
z2$^`Kw%+T4$QD7I{ZgYL^tyP}UX$sH7M7T=gYW|IOZaX-&!q2p-%g&}b8y5YQ;F=&
z+$?0U4*I)D?1lRQ{5bS^uH-}1dk6WW+qlyA?J;oC*&#35TT7e#{N>c3CKUZg-B_4w
z!}rfGlpx_kl~NSgZ(d3mTBxi``z8@hxGJ=a^9%Ywf7zRD&cB2mA*?e=z4toGgeUj?
zPX3++$B51WvXf2atR{xL3J2k7gUa?XL_qhupqPNesqV-Wt)Zl0To1+TVYf#WaR7Su
z6jAHA^PGy)U=f-EHebycn}Hzn4#bG_n3apOCllAor<IAFN$odKjWAjc-;tDa6nJ~N
z-v37;G^wU`RXDfZF)t57r(DOkn|1Ls*-6OYYALH;^o8zRt>rLU`_hHY4v9(f`3EDA
z!V-^1fg8lc?k74ZeY=sAWWjqqS8V0LcPE<|4m(@{R1StgC{M~dsN0U($eha^>@<N@
z^K5DC<xonWG?j-l!VhrK%k@$>uhwAdh3~x4E_C-<85ux{533*h1PUy?o>Ph`X)!6e
zo^a}zOg5}<e&;%`07Oz0A3Oo}3|+x?Rqn0{7Y>T-T7+B;l+ialD=ZJqe{ee5Iv4Lu
zgv1;~HdD8F6}mfcZt;b8!cJ#WUA{*7)OW)s3`pnDha7}m`dUO*&)&RkXT54cQ(bqr
zzbb2IRsc^<Sl0W~`f|b*Dd}7tbss7QA%Nxre5lV1Zlvtdv4p!sxtE|ls~%3zI_p(J
zUvl(SOG^R{popBuoaWD@(al{ptFgiSae^ayOOPD2U$yKx^0eNXZcm;k0Jp1n`&l$*
zRNH3UE?h4MEi9Shu7F@F#~%9)R_*jMS|GyDc<ur<9)=(}mYtmZZFG@CZ8TtUJxPG^
z{(f&&SKA03U(0u{_Bwi=C;N>?|K4!XK7oP*^l|nZc!Zl5#(p&GveXwfMG?J6P8wfX
zjbvWuK%oVnwzih@r8Iz{%73a7vsxXrB40ihd}GYvMSnO%dGs+i;4OijR}}8ml!o^7
z-h|8CRG7p3-O|9whfS4?C}c8ai5ulcHH6>Ite0!Xd<Q;)#hj<SAJeJ{@kL%uPWjsR
zM6_+5LTvM<3!xcR26j_MvqnY+>;v`2wqE@oCD)}kP7;saI}ju>iG$jhtLPTdLsK%}
z2P`MYiA;X4z#dvwW-IDzrrOgUcHD1^cu~eY_{U5$ikL++JdD`UDhE~^#eXx{e&KX<
zsU0FBUQnmeFDJP-m~;r+4aGR*f5IR5G6^!+%dxJll@bnM@zhy}ZFhDj$r>=?*=Xe-
zOL$vb(9V0TcUOkozuShG*uUsqoTeG7<_!52%Iz!z{*^WBHL8~3{gT%a=6~sEx)CMp
zb52s)QG#g>EovT8$XEKTIy<WFwGoVjsd-F8HX?C!hZI#wg=Ux2*~)PT1s_Ito%jI_
zGI}^v%aBSjN|B*jns&89^T=p-)?>^149Ih9=Pl1X-%rDf4}XFCNdN}8^}M3OybyIG
zuI76^n0sy?ur5}DRNb84Vnjvx83b6qmisPOSt;3=vazv+jl$$x-+Q^{0k3zV@*1@?
z%x_e$TjzMIVpQ-A^T~e_(k_V&!587lt^P-;(E8*}OUt674Q=hsP3?N<{zAZEgJOkE
z`(Zwb4XgT4k>q6Bj17PC<{2ZNh$rOj;2J@HS(yXAyxUrW@&w1MWUKhz5@XO6Y24l)
z^`i2pVtv~?U7f+s12-RK8tlZY$QqqD23#wyFH&B5aJ+r|#=Lp~W;Gq+GnBH8Xr;SS
zV#|KMS&s?U_HetCK4YX@&uwYa^Zi~E3mC7>eO+upm^STj)qw>Fq2Es%YYq2U>~rsV
zj!yBk%nyImm@1V!#Lz+O?u7jsH0Y_K*(BGg{Y|9EHe?AaUP(enxb^h((vhC<CrN#J
z4{(>l{oZ2;6m%Lp2sLq?rAiRjr-T_-U2UI)p(RRL*yw1t{$SDPtE+^b(c9m_zkgG9
zOY4~QjMsgN0U}$cRx^Dd`Mk$)Bh+$GI1egvr39`s)z65e7ErTj(;}s~*&@-_(<diC
zU0noFX;Eu}OXEiehDvK?6^dxSLSlf1=+OG-zV&#7T;BFU&HCtACm~3IPm9i;KQcL_
zy!>XRW8%Pc@#2RTN4Ft3i`}m6vJ$DY@#^y`@D%HcHb;t~Agt(7AfwdJF9zzALZ(9L
z{GwN+?=Pkx(2fJ&@|8e8j+P_Txkw9HBx)svm9>5-IlNm#rvc$v*SZR&r-wBpJ`5=J
z-)V$*DUkIYj~o#aYPF2IzKK_pR-@eKw-Rdc$hm_j_lVEV>hD{oxaQrg>n*wFubM+p
z>o>laB=6niBmFI@d^z9JA1HqKR1oJmz|p7d;NC|8S3^+D?^(|nmXe@XrY?^fw%@CW
z(xo3@tHppbuOv^`K?hyko|CG==x^*C0|@xoZKa;y*`?}e`8ru7K%b`lhe3;~TCt*G
zp`uhNJp&Me-=phG{rHtIT3Il?HVK_LXw4a9alSs?*<`H(pB`9b_Q588ELMnIpmwzF
zT)Z3{i{u%he3{{a6^CLeRSdsXI^Gr*SxVVMTsCK|H(~Vj*AUQw(x5}8@3TlhHe@R}
zwae8Q)hNr!;YLvYJGsXe1-g313T(RC0K`wL&l+WAlW$YQtwgNbY9{Xb<Ru({?mqoo
zH1t(1$ALQKIKY=fVC7k8OODAMrv0OS(CD8%xSnln-`*du<!mq?pWv7Z``E|(B<}F7
zK(eayz%P?LJf+cXhqF<({yakf%a0kIIuNZ<Cbi+qq&N%vueIYHwUD^&V?8eV_O2uC
zHvKop>xeJjZ8^CwE@g_N-pfJa-W-oEtL+^QKKNPr!s*rK8m5nTw1Sm9_!~Nh@wZ0q
zcKw=?>z+@W1JrgD6{1oE)vzBz>!TWSIT3CBD_e(#o1t(WQX<NE044Z9mhM5n#Ad?A
z1X~I2K8gIfMvnNj%8uLIe2)IO<&}uLgMkrX-sim{#H*;?w$$VYU%!Cp`0N{N%9|nA
zRZO>B?!~RAh1ONv^GCn2iXc*2=3=w~WMxf}lKC#@sCq>F-2_nQpD<6SJ0q=C_nX^e
zT1v+L^(v<nV86az{~N1+20)`Fd+^6eq4O$0Z-0MJ8@Sb-tjm@4`_v$GASEO<b(8aS
zNK->&zPdO$el9%=!E}CIZ_!-%jCODkA2NMh`kbx2WC<barw6rET0goiQ)g!#oMfl3
z)&Fg*Q+5j*=hMcjI4$#<QPR)Tn@G%KE_oKnh8{JnbztVT6EaC#bc81Sn%V;>f@t+X
zd^z6kix;Yf2njY9v-7A0^x7kYc%~biw>`CuVicsI8)4T&1{W9p$H~7!y}1hCO`nVM
z-yUnpH001Z`kd(noOi+&TUWlco)|BZ`!9b@rebrWu1xo)o!2vDnt=KddYqi^5k-@U
zuyo)H+cbzCX-%5?$uu-J)wG}^4=;Z&FMn585q{5tF8gnN$SK%V=)4uHY89t*uEx$y
zyAyKkyeJGx8}#ec`Gbi|w=Jp&ss!G#E*UVUuov|Azd|ldJj&yonaD4|DXTTBKT`ww
zVeJIn;_UpnB}p%pp8%2q{99cMxySO_lANe7)YRq-rYaaII;Q!^(}O4x=bPHv+E?|V
zG2||(7JWeU_60MT-KqrnV0HtjlWqTW<}v}#@%7&1TE3jEs~{hm<|C1A%ZU&*Cs)hj
zAWZPbkKQ5+n_otUzH!h*A~9}sh?ak|4c-CvBZO|F)8vI30?v`03v+@8x-(8SB?r*-
z_><+VbHr7lYM$p3$Rop2+1M$X;i-Ej?-aF{r$_F!eO@eDkLiPx=ZN}QZEbSWC11;t
zJ;HF+f(BPS8~}s+W$mujHC5GuUaNSUXP&Ud${e=Ass@m)<71_w#y0VQ9|gP%Y{bcZ
zU}X_*Du?0bLV(Z7NngfrmMyXVxIIS<8OOfkKG`l)wgb<@=)Q!_A<Qn=*3r*D&}r?C
zWheOx(GFGlQa~SW@+1A<6*%i5#~QZ!b)rOCGBTiym1M`nI)iZDU7?&0r7etX-_ZDj
zfC9iP{<!;V?bi;SyE9EQefz|4BadocL0@le#j;Ra&CHx(n5sWd?)LjrUR|32{5Kqz
zDi#2^Qop)}3&t!OFRtu6sW$-IqNSr$<ZXPPUfRq0Aon?#s~oKD?JL<m5FDQSc}IOb
zhJNZE6K~LIk=+(q)I`K`9&<)=ol#7ZE949`gqY+LJ`{Hen|JlGdi!boud;0tnY9g=
zOn7KN=Rygg2T1sp0JP72Pa~7>m8;Xl2juINKIePq+I(;8p>LaqIj=M<^I1yRNT_wJ
zd%-A<w{>8lS%bad;c=OBk86Y5|G)z3-1ITov6P`r3*D2KQfVygimt}CR*Hm9Y|&uy
zvCxXd>l2_w*wwCt4m4%3<O8xY8Z1zt$g=OaWyP)wHX5?QouFL14x04e7DuOmS!TDO
z1v}e-T{}8eNL<dJb5Q-F=-%R!z;a=<x{~&vpC`$~?Y<XSHY(9kPR~&5lSz{`cn2ID
z9L#J3%G-TaxRk=?8lVYdJu=slJ)K>jKN%#@zU_|X1e{;T;*h(k70Bqx<~3vTZW1M0
zslDwIp-`U$=9E)JwyGGjTQE8xrhyHg*skLFi=7qb-sr|D8oqR-`kdS>RM=^ap4}>D
zc6K69Z!ImYN3pEMOBkPn$f2WXYB1hHi1@CztbLcswJy;(UQ~2P7Kqz|TqbgXO&l*_
zn~GOmHU#+m?qf${m4&1AJ7^q?0UdSDzp4cl0cEB5l8^QLoeo!QYp+aeeEN+9JsOMn
zs#Q%~hG$2$n;hpJ#0p~>0b0gX!AR06-vZs^>yu+i33c^G&(Hp_qWi}QguQ0@xjBS9
zE*D6W`tZsA(&2O5IvS0?9Atlg9w=6^W;%dMQ<IP9-*SjSgD@XEUL+MozGms6|F>pB
zC@66C51J8rbNT;TRpALcKrJ3T6{4S4SR?(H`3K`adGrVzPh#w=iXjlJsc~<RC#=f<
ztjy7O6>xWmclYYh{4XGi7IV|n(?94T`d8_27_|xZ*+-+K0UK$SkHCQ~U$iR?UN4A6
z|DSj%{p952-5*g@kwh3SS4gK>EO2kf`0lEkI^gE!WElHZJ*VV7%YuFz7195;+K<DX
zmpgcF(G|i|e8=l`6m$JJ*Je=563||YlzTkV0I*Y6Z|gG)O}ic~x6cF=iT>#SqNbN@
z-<XLT3;4GT<Zy@ZNtlKBLo;5qFd3@-Nm+=y(Hi0KnjpOn{Bpvrckkh{)lZ0G<9XmJ
zY4<ja7F8|AU)}ipQ7+9(UZe2A@@YyJdwGjTM`lAV@*GpthBGgx!nHIsdWvYs<HN?l
zJKg#KKx&!I0q8u8273bx6S;D;PT}NXEQPOk%=DP6n$_{IKd6|?(<3_mc}z@(Rmxe#
zil)=z8fD&6yb#;}7n?s!Qycv)ejFKnA?`jBGrJNvB-=7NDx;kfG&`Z7Sh(N3s-rjZ
zO20x?*_?kxef>GhsSY6H2oe^VCD=pA!o)O_xGc`!>?+X(*l{z=xd;S*vtp!*aPJb7
z@ok+FNKc`id%H?j|6FPVAO&h=L8R)wz_$1t*C4vQXq8|mXRC|SCrn}v^OCUx(!EIT
zR+bbzx+pw+`U?1ONza9Xt{aJ7mQ=H?TPJ+xV&k`Yu0FLJ@-T!cRoAvJx16Q`CIPZh
zWl!^x`!%EY6G%|?lq6$R;;oG&?w;vKG1pIqH?LN4@FPlHY_#LV52`N=RExFuDXq?R
z@jKu%fpS3ey0Ns4J`hZrA*4#a8Lvk5n%4@b*v~X&v7*_XzUGXzBK6z7s!lvwl3CVS
z-BAZ48*5m|`}8kV{L^x%TuioI>T^hF|H*{ui>%oW4~JZ%inKoz_?kN|7QbU>a&s#k
z{Kf=0VT&5X(}W)u=1g%YMk{IPax04}p~oem!9t~u`NqMJtN~W#`G0omSj7$7oY|QP
z!sDa=IntY)|NaiJ^8=RC?PoX}-SAIK$g{s3K|9q^L!O+(>J!2#-|k#qS|~e3)>$0~
z{qQdnhj<~Lu=ko?TU~S}UTcL6XYfjkMNT5%nRLeP<`My7>$U9rg=(>cS}0wdL60Is
zBn!(FL>;?1v%IZQ0XX55kv0<L-6mi?mA_SA_PtUi3uH6tADf0*-3T^3!d?>i*N^zK
zPp#~HfZ&%3?z2Lv7+EL=zWpZsSY!4fB#PXdaG03jp~185x>-R#kg1>2OtdY4#ca}q
zH2jP0*OlLp^iDFw%L$apsDWm&gTs95yacuWahQ};j?<umX*#~9%W|!#HG$b`Zmu|g
z`o3K0l9OOpT1bS7Y*d2Nf36F+Zy*H+;*c?9ZC0&i@tIQ08DD`RUss6g`{ffNjfr9t
zW}e(054Lh~4AsefLKi4bHwhmwfkA**TiaPn%shU7KAuG&eGPkiX6SQF;wZ41>|}mw
zXX2)aYn5~(f~VDFv!p=FiC_6WJ-<krWARg2OIiNdjDHC(U!+E<ipuo*w?`Tu!iFtd
zvh)xiV_wxTm5&fV4?ipOlE~07S`u_uc<zcMd1`;ANedVW%hgepC~r5WI04D*x}<AO
z=qOr%f6;UVzxoY1H1B@OwKhAf>2?N3C`(d6S+mjz-3&(yS9t56MTb~1<vM7!h}Kmi
z4$U-Infs3)2n7DEY5QquH<&8PQxa*f-|<!z@x98PfMC_xcy!G`jcVzHC|^)ofkQjC
zJS8FnUZ!DY)Ae#ya%D$K<hti&+M{n5p6SnUiGFHO&XsIP4hs;NNMDs`3?|u(57ln#
zy)<njovy)7D}Gr%Y@G(e_JVm6<SX^*tai2FWqs|HjzjD0@7=L)p(!e^mxfjR$Fxn4
z#w!CmJ2Nebp6T4>6`i|=;-@mUuy+!#{md#5Mh5B-st-o*wRAw3c8VplK-goA_rczf
z8SOeUP5RfLSzQ)~E3Gsrec2td>pF~n;m1TizYJyO!m(m9ed($ZJZ8@plu2&3tk;+{
z_qlQk<?N;3jHMSCFUzuGmZjS07s7WTvo5Je$g=QcE)Tr;W|ZvD`6poOlO-HBLhO4>
z|7Ww5U?MRGeZUUIi#_x~F_dD4%1KMN;*Y(g-<w2hpt|>Ky6}yw`~)xM%s;E=YpYCu
z;$8Mn-JLmKn0#Lw=WTfGH0tKVx-lsG&Rwd9zo_%FS7x=Xazc^Prx;0Mx2doFR-kbS
zx@=}7aiwpc1)d?A>!MR)J7erTYbX)@Rss~dPEZi&G&8ynSYie5IdqCv>&ai|Agf{8
zoDVznt=ObbJh}uWP&C*3F6sH5?mx=krPv;wJ;>(hcpPmMuyKoWpp9D41pthTi;Gh!
z!g<p+U+`=3QvErXilGl7w+L&7!3ADKN8GAxrV9O9v{L`vkwv><R!g?GKNSp7q!xXk
zmyt#&azbZ{+7@{eEUt?3T5%vdNEIbwo?ju^$tw0YvbD7p-(6Ykmfk3Z`%K~v^>p(K
z*T-->l{*NTHeZur{?18@y|Sa?c!$m<F<Q_?p8^FsJBoAL&ma35j{X=eNouw5p;mJM
zY#&hQV+$!sa+<mNQ=-&To^(R0+62;|w(N7Zb>1j%*B?Q4culs|=w<CiB{J*3!axRO
zH~K{3-8rqFfXw_onx$;=+6McTUE0?;`Q6GuiFJVH-qGz)ni)4-jh#L>;;hM?XW<E`
zibNxLUXC%|hJ_nbwyUe_jSpiyHjmEeuvn;6Zgu@k1DEvLsu6cWW(l1`>}WbCP%W$&
zP2NvHW7^J&GJNkD&h|9)RQQ<k<f?{}SKszzGR@RkKGiE4pR&Xa_Tf1LSL~y8H#8IL
zE_C<aBAsm35E9pV2fI}%7EL6T%$4@!$HR{)GvqlHF+)WUegX{PQ*F~|U_mWNuogb#
zn%U3im>mrjKe7HtO5I1ZNR{k6qs(z(1!(Zoq{Hz=;zV?P-q()XuRYvL)ztPD4z<PA
zI-OF!`8-C1pwLfc+h5mAK&kRjf&Cqua~w&E#xJYElE_`r*W2)@H5#{@9@!SI^7wjm
z3BiaglQ}k5`S?gpWK>+Vv*-gB{u;c;5%12c9q7@$JiNSTg9tNpb$*Bk#*HZC?cV4j
zl5F#62OR2an_G#Em2G;rK9nl84sfr%xx)1}``pd@I>NWBx4DO7Mk34E-gUr0vybG@
zF;nlg`I<}Aq0_*xIMjQO{7Q|5B+oqEce$m&D3Mw%2>w{;$;3-3NO?z!-*|Y&F8s(H
z?ch1oca`iU{fmj<64}V`klYMCXpV@GaH`q|v8pR(*#z1dtl@7_1$-8^Q_8aH28*=%
z{HE08Ct*@oG5K)X7cc%XUeVGg5vqi-cP()2mT0V@yM*zV`IJ_q$Wd+^EjcG96t=P*
z2;_^UFKDKWaf}E_OMTMdMz{XPkfxafcGmEkK&^Fl;`@85PbS=oM}bM0bVH4~49)xY
z8$lKlNuu9q&X}e+d{&6Ckpx&?7CD~zqQsg!DbJ%SAdy8hu|nUvbX#j!kAsXkm^i_m
zGVic__eQO%jU>^B%i1V6_N<1}u1&toaTh-fmv^$yc83I3RP3J)dnefK3p)DJz?W{(
zS}C8D`qGkOGQsze<^rMPykgfqfg9U@?+Va@xV8EVOk_%3)piyU#eOqv8k>bh(pT|O
z&E8n4Y-dICYrZ_?IL>|UUox)@Nwn5UEv&=LaB=OCJ-0d^!@kjuzps4(NMkK!ie2#6
z#9A>D%E|UrcdTj}-Zp948Air36DnzFXpqJ{8=L0I$0yO;LrYsk3cEbYwbwD>_!@F?
zt~(mP*L@<&qOFpsFflPRGJ5;Fil4<k^J73ugpBr}rJYimv&GlNSnoE5B@5l0iFXs?
zo~7CK2-d%u=mGGW*?iVZU<$q8Q6i$~9?4HxY(#8t2mASd8(>W?_Jdtn+Wb}&&&aM}
z0I!!4!RYdca-8H`Y7+GFr{F3vG+8Umr#T)`{NRi4r8haH)iz2Ku9vV1!H-kX<+Cyx
zRvhjn8BMF+oPtKllT|=@%2QcJw;w8e6}-H&*ka}S1X_3!2^m9N%zw}<K9pyOMsfS&
zW1Kf;Sp=3Jjgo!&nQQUP-o+ZR8>+5zifnootW029MkPR|54ZM0S!j58VO$Bg!xZ;f
z&qd~a<`yR`$y=3A<kTZlYEO=7i`Ic*rKu}KsAwpbap_Kwvg4Mcm6Q3&Vx5{P)zy7S
zIYphS&#`{Px8x9;QckcG$pBT2NNHCDfZI=)W8!6D+SpgI&>ZYE+;n!$+mW>dvKTLH
z3BB*C>iAjVPmO(*CLkGv0YhvW6Ka|XzyAXZ2#$RC<p*D4mnB%AZNc?>v=>`E3-;;n
zbh8cV(mbk3c#?Hsgl>&)C_RpgaF&W}l9Oa!*LDIoG3Jy-%T~lx)K=skoe~2#^LBJv
zSX4JK(k9}pR;ek?A~;s3uDe0NTAFY+0bAGsUr#X<`IVQP**q(YygJ_hGPzK4FKk5Q
z#p>Ivd&MS3wji2DeP7yK-c)du)~M)`q*VW!B_jbYUR)~v9%<Kn8u-1M=`E*41!Gy;
zAB2Y4KNHhuC9GkoQqN0+0MjWP;S3d$06freIWI3!(Y5!Yowc3NQ70FcjI<!dgfBa^
z!}Gc3ZEPx}4y__q(g#3c+CQjb1_y|Ek;H-=I?X&gZf-PV0)>zazKx!@F(CslrXU>*
zeB4dvs=Ss(<m_g9<o({V;ca};Y1dZa;Z!bl*HfMFD5KdN_|y7sL5ZBfh^D5q5B86B
z?Z<FWJbAD&+ssV0Pt#NeDConvXc(PI{aWFQac`N+xt492G!h318q@l$1{CZ)Z1?UZ
zS4L=3fWq80MbklbG_}%_QE+<WltL>;dlVM5)t^g_I0axw!LROGVLxBG7^;DWd4D}I
z*A7{->J>ouaF$ZTZK^DK&vYb0_tD72oXC`b%H(1qzoP1-QMubxNQ)&}diRbeF|vV#
zkkrMa`0^ubgd|<fM-BJX<xuyINKKs)0jR}e>gLu*tc*_O1gujw@WB|p>>pCF4+(l9
z;Za?uT}~m+Ezck`KdxpLh}Ay;`$JZzGFFxCRzE$rNR!sN=2Cph<1X7lU`ngE9=GGO
z-7z*DOZI`s?G3tbvFhlpYFjP>*}e|3YgN?T<t(WHlnPJ!<d!C6+$c6yZ<k)th-`1U
z@)3u``!r$dEqCi_u|_bsaV5aYx7eThkj#3U&rNXc$RuNFB91MoaT}rvMx%2p6bVT*
zyH~vT^SU2hrKZNEDoaAhBp@gHE{+0RWyMfUwl~|+A)rygsSrBDc&^ty`)_^;X{f1&
zy0>-xrl5^Ku8a#S9>)$p>-?BhC!sOGTKa^(6~Kk}kzyiQd#ky4EWVSaWt7}&E%A4Z
zYj)F-_xlB|%kgFh94a|g19f^D7+cZ()b;rNXBLS@HD*cfCF5vVtowh=4_W+wlJeb`
zSoor=F>|pi4>W>vmjmJ7dHl=kOZbmqaGlLSE031^R{oV8O~Dy*VsAoZ)(Uc!Xu|E!
zU_KSy!|B4^B0sja9W(3t92(~)m@`d6#?<)Nh-cON<5l{tyxNmVM^TW4NVNm8YPZfb
z^6sO7lOOx(tB)pnFUv{RChH>qx&AX-IWoh$m^vnOKZuz!Kferf__WXD9zR2=zMAJJ
z+>R-k__>%J9n3I(Q1NbCRaLuQL<CAaf?#*pwx{0Nr6^<JP9S8r=KLB*e&iWX^K`Y&
z!-tJlb1T9l^hzrC*9y7{NPs=zg@t!*VY<CzRN3KoVC>8sJ59U?1G(aS8YE3XbrQ_?
zqPm^{r}rd|L|fZ((a7zpt&_-BJHho5t<1J3RiREARl1tH$FW|WqiKnv)ARHCy1JLd
z#1TcW(Uk<J-4PwFqYQgqpD|@}9p4B}NauWc_B{Q8Z7$E)0gvD$x5rizKp6%iChywU
zmBNWr5qb#<t&n??b2mN#SX`)%(u*o?N*8l17G3M%pU10E3&QlO@V<KSMCM^QPQ;k`
z6K=%J{QO(f*O0v7OaE7FCq%W6rA0T<IrnC!w{n3Lh=o;`@Q<T{?}ERS6cOfc%j>Aq
zej(|m`*U**T^X~M7!nd9OQ)u<e?92v?}9EQTKRza+hkS(cNR-Bm54%5Q|xUlDS=7!
zqKcn284qdPm(n{=atQ|W$kBAkpQeD#oCjZ3EL-Hu>U;KeHX0Ha#a6`g{<$m#k6Tqa
zC~a%&;j4u?d?t&`vziV4k%AV@O%qPCb0e6zar1dqcD=26QCVhfMu>0jS6$NJYCgU<
z;#16Twmy+zx<yC6fRjl>1WmP4ij~XNaq_}<iU{@w9Uh@e)G;uW(WH0frSaWPfML5o
z>R!7^eY;G3yAyz_%J$kIJK~SpuiZYd?G+yzAlw*vs+s*NBAAcgROw}ENuZhvNh$e3
zru6|1DA@cQ<=n?N7Ax#2yuc|h=iMy1`BO)+inwgoiOoePqKYS8C^qkVWtsf*U~!(D
zH`yZ6k~$CF$9M~*o}+)n<Z*E@;kmVWO)-pLPUwv<?=dxdIcNX>!QNX1#r3s&gZx7h
zl8^v_;1(cwfB?ZYxCD3Y1c#=PU_m<x?g4^ZaBaLBhY0S{G|<ox+}-`#<UQ}HQ#BV;
z-_+EcQ!~R26c^olt-aUU&-&RTOQ`cI=Ic2KCYhTp^#Ei%gANn|7e<?hgqab4eIXIq
zDFFK@_w3e)gq4X8yy{eLu3B$S!b!Pi>YNv5ucx3J2WRfHpEO2ZF&u_che;K0%+8V#
zE}&)7KUbK3dqu=m%%XmEq+U~7%bFL@1RI38HJe|}vwo#M8Tc4DVVqPm@{rw_43MQ`
zi_r8wzH?{!N9qeXct@SiPYnSSIb2CUB8Mqbqf$kj4TZ8Fb&QBCABW?TH=H(j`SRk*
z^0gcO(4Zsw=1iO`^IMTSa18xvx9Hc?v!{oh*>j8dPCtcugC0xRS(O%vvK`Wi>S|>T
zS<R>2E`U!|z?%zLqV<6$vR!A!PlmrzZ#nZ_zL=44@Mh-cSt%(pB<15dd8PEE)Kl0V
zoM5w{*e4h6(@xLn-e2fiaWZ0J+Ow>`mKe=lxTG(W{pEK-w7Q}xb;rB6LmKa*?i!?$
zKS(}s?m8_fHj#S*9`1-yx6yPk-vUR}X<%#FSy9E+Q3MOz1uQ1fZEcmgbZo?KZX3?N
zO%XIff*V5iIkpjde7AG{0Z<ly7?rrNzOnD5V-qROj{W#^70N~C8N&D8$|%0PvYRwh
z%kpV+@r-#c69wRp#^wd{nfYLhg)KN*Of`rIcr~78CXdS5iUxfWpY8m#Rny^{)o|pj
zK}<_#RGr^6ai))8`Qh8H3rqf%Xm(po$ntVOeULkyyjWqwTbyY9IuLIECL^U>GNdCn
z71keItnxhN^o6EFD}`hBn4@5DVVAM3gQTU>UQBnkobR2lxr-g93qRTZCI<oVu4I|#
z@uYQiiiI|%g;|NxD{EZ7L<a6jB`jk-+{!8}9sBRu_miC>`ua*q`Hl@o?Td5YEI*Q>
zfoRDfok+&Ah1KnuhKKY~qcJH3Ta<BgN-A}}`Mk(-HP@7-%7}%?iv};E@Wk9)F?4oG
zs#O0wG-rpbxnrDTX|)82!b?1J_9z8BWfTfkV<YXY+z4q@CYxtS&k9uGxO~u6(-9){
zvR!3MC!I~ZsDc6!o0_Yo_>%7yt9c%LE7!=)&dvtZ*YSF$lb#QW;Z`B*I8&$(Iz&PW
zSKL!pyjSNg@OngPF+yb}srOf2G5s5>yZf2uW@UvPo1o5x?Be{1$Bfw;d{+Sr1St1Z
zV!p{dN}i+&9J>7wxtvLwUVYcLh}Ra_z){0Z$E$*yoSY!i?H-S$4Jq~qb2mwHc0og=
zL-rLG`Wq>ly}jK^F=(obgjwe%OZl<x9`!~f+d7pwFK$t-+?cxpE^lRSV~#`gmQ$#k
z#oyhMhYdJ4{hD(kF-ndn8(xfrQ(!^jH6UX;lf0%Z#ScRZTYQQu>+4loo6*0-jema+
zQUKThc=!=L$QYloM)VCx3IToDB3^V{_(14>qJ`*+3f%2`cOHpUJ1;snW0D#SY;w!`
z6_N8_$H$3xA`UMWWf_%tQ60+`ZA1nFx~*_SZFYDY16s3s*qm)ted`&Lny4K;owxj@
z+Ah+V_|ewuTI(P>wos#-Xi1Gkf^nwBR|()@`uIYANRgj^_W4%j6aC@wnA?^5bt=R2
za5d(3H2_C-o}j;;A}p-`_MEN%t@7mmqCw#Q7$FAKIbC!B5_Ma_NxFxHhu{0k{{M;j
z@flF5jYp_Z;v28-*y;vH<@+w%ux>H!2aX&@;lc79McF?Hl*E)q-&+i@zV{Wp=on8#
zBz4QqJ{F$&dV_zheiF+f;=SPo4*h7T8w`^0^D}sG)6Je}lwnw1ZNinF5_^NnxOkz-
zar>0nKEf+|ko-0z-s-?n_AJpn^QPh4Mf2KO$nJ`<h&>)^-}8ivFWQ}pV{K4oKQq&=
zc6qT?K5!~w?d4#254vWD0(!7LVd~y_=fj=<kn$hyCv=_Qlw6VXSKoZ;`m%7+cHGhI
zeG<?$JKzA~C2&^g=8lkS?>N>Hlm;$fQ^tylt^cb*M^(IK*J}3l2;<gPEGp`JcqwWF
zu4TAOxA2t+<9l#q&1K^Fr1)?_#hLpG1j;!FeK_8kJT$QfHRiQcG&Lc83u~reZzeT^
zC)1QP<>GF%zg-m7f~!SIzET2bn+5*-#u=VseogGCEe>+u#g$Ozs>;&DV~(TN{SozL
z#39-5K2EAgi{vQalK$B8hVhnig<JyBO@>><RLeoSGvCMTk)T*dwOVTGeUCnm3lUwV
zQu^r7k%t_l$%5}mJWjb_r6GtM1XsP1VL6CO*wCwHvXoTl^=u`NjT%+LN+OT1b-W-)
zk*AZT(<^5oU9U=DTmLjI3A~vzfo!)H#97f~d*cc1izj-MpqncN=`8SWrKngsi29{o
zn_c6-u>d6KC2K8T?U5vO_s?}RPI9z;H219%lw*+eR+^%NrfX#pd`~QfE(C=i&)P@3
z1Oemel03fAv$M>2FPgq1Vkn$-W0JogdVcP8b@b;?52FUU))-M!lRN)p3%};iyH1<6
zht7&R&<Dg3s|;Gg36`iVc_u?mp2A|$1e2%@Jr}=_*GsjQ@ySYGi9Ev#9TPk|fm?OR
zM=nBx+jS2pn>YY_jFHh4>i3q^!V#?KTB|x-3+-6!O+?C>J1N%6qi@vgv%WMst~6lU
zI<j6%csE(1>FDPO67|>2P?u;+<+IQnC(@VjUX5BQg<+*8R!Zzo7b-4|4j78N?xZuO
zI7mHzib*b#4WImpv2lWD;Nu7R!9hWCjg4buBsystY+86mPR|blln?CI@o-ut7@-gN
z$HPM(*0L~MJs>_{7oH*@7PA!+u1T?-Py{T+LSH^%*IORH{XymTabfF6?*)DctZ}`&
zdCJ@zB?o9hN*!2?eQ$!4+uKm~H_4S3QqwztE8}crEaP2^52RtMPS?a4>h9$!!YV#7
zF)?&4raq-<baC4H@{xbci4ww|^usmmWaohxzbz*;n-@5I{wSMZk{D%bB(O4b{zc}Z
zX_vb5i!7L4VA>WBuRip^GCn1Of7X!v+5Vfgrs@i*G2@zi{=6rW&cvHG+Z(A4)UG$-
zuNNvmQ32{>WA~dGlY_Y#Y_7ZP?M-ZnEV!U%v>^{>nZjvNPrfXAh1#*H;>EU~)BMud
z4rqHq+|6vh#jAXCGyV-RvtZ#*`koGWi&pO$xoUn@UO^rYWdG|<dD%2YdcPyTRBRJi
z3Rh6+3mm?r=Kl9d>RDGenyqThk?AwaQMP|C<>X{(IfQ@-$;*>Ou<{@YtNPgu-(?50
z?6Zu+Nes(p33)sOi^nVkN$j1!KJ9Kll#huC5pG51fq1EuvFZbWdCzNLCMgjk`gjpU
zAn)f>?cM@)AAZ2c39^lMhV#)_7}0jkYcjL!vx}6?9=7^j9(JDWKraUbBv2sCt)BxN
z^e7TXS)e09=02bwH?&uaW5Xj|Dj(d=3%<zb@~v@^+52b>)byWRfi=j~F#GIi--vZ<
zht<VzsH!@up9<W{v`pYO0M0Vy67fbshC=y8W%}E>Ia0QqLp3TY8yeU~P!37f6^o9j
zn=ftv*!?CScwm-r?{qPGo&^SWOs9IDT`zaNt3!!#OiXm0-V9&$CrWsg`(++o{>aQ{
zkJLB8%w!JFh|%LNJ%PpVXI>CNtn(37lXMq<p9DPZ<L~!#-i9n2a)_z(f?1NosQMt!
z;vIlI7!D4xN}uBd1PEf8jEFBT8Op&Y&(@zUyXWr!r)6XmiPuh|3)Rf0wq4S^!n+XN
zuEZM5`huM)VH7^9HLhDw^NHcgg4n2f+-k>YaQiruq8L87W?K~HbEqg|@hZKEt$zE5
zM@M<rY+|)neJDX-zyD6uebrgNS9_>ErCL4+?ZsoDzN)}ZmNHH}Yg?TRw>v_{zJX{w
z0~ab><-M7zhzXU!$Q3P=i*oELyf&C>@=-8?x6u=Ye&-KpGrfp;=@v<}k{P$}%aQy5
zZ=FFEIYhqoX8zfdGvQqOcGSI(6#w9eL-%WeeYqv;iO!i9e8aAIs#m%*+I`lukcL*!
z>CZN%aegj+`**p01Zb_Wua-Y0-E<~vf_|2^hD29UiDv&1@q43nc*WWDB;ApbZBhA#
zq1y6y`jXp;l|0t&in)|BD^z&(yCSA$tA0Dy`ED5H$|7x}@Jw0szrH@W*dHDqt`)fS
zgxNa<S8E1ShjKrJ_znz+;f!gPGM21>gf6j@gSbp=d^{IM<W~-3o>PvRIJ$9JipLr@
z_J$1h_IPmiumGaXQE&l*{$HLU)kXuv?Gp!_B5C`6eoo_qUias81}9)<9?6NHEyk7f
zQ<^|ba>6O6j%yQwXJ1$O`vMV0-8y`W41>`9^Zx2{vYrd`f^(}#>RaPm?kly@vWAQ=
z6Ej2hLQ$NT%;lz-th?r<|M3-++5os=--nk@OOY``Gu!C9U}^wgfDkL%hf4V#cJA+A
zHcxq|(as*<BxWdqiJ-kp_@p3Dm&)UPOYfmSj?I2rRAR!$o@aJy@D`|I?~<CKyLjHx
z!M5#h3~uCS+<9&b=--7eSL9M0F-Uw-L-%PMa61*0nr=XEI<ObIGn#SOujKAj2#YjM
z6O@X1z;(SFDl0`X0<L;ur3kg(m4DT}o@OGB7lu>A;BJ`X5(JVid>-qyD&e{GA$+54
zlrmiF0Ck6BYCpj5JGI=YM@E4c*xAcnCt6xp-Wm=)S!UL85e>Y(tDmsbeVz;4;yK^6
z6T<OH@SBEwcs^8R8MBWirK8ysXhiFr&v&2HibcI1NB2_GOt+pqAN_|$bZB-!P2_=v
zH)7V(E~@#cUy(?=WKGCWnJUg~g#*9!2yyVT#J{`xyZ9OT-)a*N!2VTP?dwj%gD!o%
zEi|a>&$m%U*ON=$C+R<b08y01Y8fI0E0lph^Ybwg8@mN2QSjU<O-8n3?D%H)?GI{0
z(^;>`Jj*SV7cbyvDka`#l_7on+F5d@mTt*)F%RUAeXlT4=r#wnjoU>AILQ7b#QP)g
z`#6Db!^YI_z4+7H69JY5V9&q(4T!ON+itJzf5dU%Q-Ku(ICwJsy`IcwYZ@SQ7fX~R
z*+zy*fENO!G0=p2;DsE|<j=RMGPKM%Ns4YiT`6uLgsqufWvzbkQdifzrOCf~k)Zb$
zt$6t~rn0mK7!Qbvk$F^StW}v2KAUy6YqhQw+tNH2$(`pS3!TVnBuoN>dkfv}+Ij)`
zD4i%3fs11i#kC9ToVp?b^rB#?QLD(1>6p+fUGu}VajWHkaybhwIHfrGLlvfsB6eis
za!brmL^-RyMBX7JzZq@6qi^@<J(zFr;pR8;7qV<w>PRnp)BGuN4w)?@G{SjOUqp@c
zv(xK?K=F9oXNu!VS69Avgc4F}OMj9_3u+4foQ5i26(tnt@)A*;Jmm&%<R52XZH(Kb
zcW0|3R~tJzI#72qt)f}$mw&E%FblV|tMJT|krQpiEe9P3n62P_2;$JrHxr90*F$c$
zoCxQ5@NMBJuKnDuQl{L{vt-hMxE%cx@>qmPDtnV%u+97!Nt79XiItISXf8lnICV5k
z!z`;XuC7gXBUTz2*)H>Z_oMTSmSuplq8@q3HHF$Otq5fOe5N9z)L4_t-XO6-*JsQr
zZW+IR?!EW^OigRl{N&|mgi2-TU?1@qGQurrIw(o|Z@xuQb0xu}{s5_C!Uys9L$3$w
z7F?$+rPI&%kXZ|n!%ip@NOH|HZED_&QUfSfhYAnv2~%_WWqK<NAhG{>k?0PX*dugv
zRMhB%KK9{W9)$qd+H^@>==$xxxX20Mn+X$rQnD%&N7N<Iv{N3;xg1EvB&NX<G239h
zu0;u3Q)xdR^H}?g>Hq!o!AbF!#cY!tJ~g`i)0nh?)Ia8SqepcQjQp)MtG*dBm<o|3
z>cN8Vpgp@(0Bv_%RB;s+2&y1U*I1Uo0^me33awnd%{&7abApJC(1~#UwgKBwLt`eP
z4eYG?>_?RqUq4KgiXWJmeosZx%3nmMUxvVq2p_6YjK^I{7l|u@Fz1W8g&TGe@>X_I
z^u>^`AFe*9gxS=%^jW9+%Yc=bOcttODang-#%MJ~I~NqWHgb$yr2y|<b*8RkoYU0~
z`+~|a)MBgPyPA0pd|@B7U2fin4@`ug*6mJOSdQ{-L5}OJywu2_Ejm##ze4LLn2I@t
zgk)2^KdwZUk{Gs5qzE&_Mflq3gwu|0Fj$<^Um$hK%tX7ggY#9PCT`m`hh~ts&(1W}
zdJ3Kdgz^>PYK^O#rv>Z!zL)sa$0@Zp^mb&MQ>D0U@5^KB>1`W1U17q0Ca#M6MRk!8
z<WJS~>@DP;K}fo14nAHcX~diL3#Y&_Cf}=URnyEi-}T?nNxVGDI_v0IVy1$ptZxy9
zrq1n4v(j?*g#t37a5;+(ej-iEE{@K)PK$2ov&HB)T@T<$m-o1>n;x^%e0f5A1MQ*`
zTN3#)vTu7@LPsCvU7y7BEj&YJWPKJM%l0a~^4XAJMsp+I0L3`{t>%seI7hIyw`BK|
zCo{e{5**unmStM<wzZP}H4%~cRQNi)o7`7f{*7E<bET_4C6BJt#0w_)ThPxrugCC(
z6h5mLG_%jjV*J@&CK(X@Dl|*3G_il~i|^F&l3P*eDI_Db;+(?tK7Hd=hH<0*m_mV*
z43-*?RNIwYNrX)SBm&<YV&CCW$|O#3axcXTR>V?Ms}1tgBQnl!lstLJsriM#=t%mr
zqsrYyHHX(K8X;5odFKV(!|!AjX4Nb;IdA@1RSXcVRBu%f`U2UEK3m8bF&5=qM@Rnt
zo3mpvF)j$>tG#KdvQGPQ$z`aGTpd%|&vIYdm-y5l*!G$qy=A`m1ek<dN)CwF4D7q|
zRBlLncM_*&RqG_*qwu)8Go?P@cV#Nvujh-){YMLpdv%)+jdENg-m@Fh@{Lj#Jp`Nh
z9O-;iIZQf^ML}Rgtv-67J&%XU&aNGCJIX17-7SC!1vCAl4{fe`^}KN`^q#f5@qtX@
z-f#6S;_#;jOM6ER$Df=Fv};Yc2oyF?i%h<2=$l9Aj;N|OiW0x6BMHoHA|Yxd1@yMD
zqnu*n!%7C)ui~uKh%0k@njFzo+qUoC-KKmQ`@F%bm+{qUBG{rb;>{?JJnHSN%4s0j
zicaQ=<SH~EwH$=LpPo=}&fno`tchc&bd5Y|kfU9nI(oqwr&Q=TtYYGJuPWS1fkt9p
zG{{$gRhzD6yKIZm_on`zNdeRH;?TjDg5#PR<3dE$ncx+D(Itvae{Zww4o^e0P)$M9
zD|P2sPh3k{0Xr&#)-~a=e&We#8PX^R_~SdsPP<F<2$iAe)YCc-!isxO?Su`Do&;Ry
z@NV0$J9Dbb5{tOCEU9*2OjDDmTsP4=%*$43<8gbzALJ|j4wz>d3)IWW{Ns>V#je_r
zuWtAEJ0Mn-<r`3tTHwOp#EzFhVK)B4ib@?RFk6MIOSK)=JAPP<b7Uw<2C~_pBteep
ztS;>UkzNLV8fo=kq*Xu_6|7aM0}R+;geC;3z*4g&>ZIeX4cfDiEKwTb)ZUQ>OFt4x
z;I{cU7QhLjxmk?szhh1j2(J`^MbK3`g>HTz9ZTByQkUTUjI<!FSv)oP$`t1?5j=l>
zm@6gHi7|CIoA#eJnDv0zzbh*?@%>g+0@Hb`AJ6*PX(1v)urD=r=_6gTZt1w2P`Os4
zMwDGdfyZYQ6_pov5F6>RDNA7?%MjPlOC-0SMIe7n5qI~h`K3C#tY_SI+wN+$Bvk%L
zQI68m1wBPfOuR;^5zn@KyBiXh;+mgo1^JrXTzFAvN)V%N^&y}3`*P%??|$lxaX!O0
zd4r)P=?6|g`uVehF2Q`2A7#6IkMABeIK7RtrD2o)U1XheLgZ1GtL9-LdA=sJIr_=a
zh;g~0BLB5BC{UmXBV&#l<C(v$rFO;tGdZvCKZE`LvxxeCUBcXs!9R;YZYba1GExN4
zz5zaf|H^igOaFBaVEqqj+wk85C;y+|(wOz3Va+0lp$|HLN(mEHBYN1Q%;mcUvTz3c
zj9l>vez5htoE6gc0!MHIOi5&Jq#UjS$;0$*UE7vlg_k!UF0Tf4{W?a;F&Rz$t<y(5
zfg;rkv5}{xWdJeo-i}j%Z-`WZ{R+KVF@8shy7vz>qvj<%%iPzIXG<p35a&bWQ0cW3
z*n45dKbQw=&HDfeq@rG}qg?v0IpkOTJP*-gXM<Nypo&?WCyg}hT&+%EAnjvKjcMw@
zh(_2Cz;&)qe{RChVCZ*#?){-KunC$22qT7(923PeC$@5@xw>D+iT#`-THC27_*X}T
zzowZ#K>!RRzkK&(+Y-LiL4>@UOT!5D7FozLiAHdX@$=6CISC_?+$EW<7^gC?<2vxf
zzSI2Hj{qlThNP&?9qE(<01fWYxatCu?;E*P(mo39G)E7NS;aWptE3CLNJ|V-7T{wl
zTJvJV(2Lc*vm~B@7bjpw`o9@2>iEaoQ<<684jM_!z~aSvP7M@?rB_F@(XXF1w7{KV
z8|e>AJerG%iMmwbUOZ#RBg$v+74fw?La+iQbg>)n`a?w#t6J$m6ei(f3z}8b(6+;M
zDDavuzV``&q#UE~#nSe<TtLULKz+-d=jYFO5aO8Hk<zqDZ^Ze)s{};(dA}dm=mHOQ
zY%HqBeqw-8ArIPm(H~dIJ0P&uXFTBO?RJP{FE~O+`l=*~3+oBZ9`A>SUYvB!6dPU-
z#P?Fi>vm=7^-b(#>PGIN0(w|BpSCBMX2l9N`gCI09c{02Wxcf;vG*ex#4?TTpQCQa
z_%-tHf$38k4@TF^jD8{Hz6(|ug&m<Qc~o|5OSn1XRt5K^(w}q@&Mg~*o~D_>*=i4{
zn|$tjKRZ+y^)YoR{<%N|vtcdh!EGYZcXBcN2pasf77iMZx(*avAQNgtthMR8_4{T-
zE8V^NEDIsfD1rJFDTYI2+krwBCC*Zeg2Z>xf7%sb5?s#s)A3hp{Ts|z>%;p)!@toG
z)wITgZOBX2{_^6)+JcMOYe|Rtl?|xy#Jm7S&n>VYKz%!k5ddrw0=w00AhR#@fs_}W
zsp?<v7Mo)uCl4H3xp+fw6LYG(fI~|Wn4XA_PtLPJfHZiZH^CxoC^j~>@H097VK6@J
z^wfl@TZDQ&)Y@z_>TGdltCBm}@>_hc8b!Z-1j2R=;I#KiFVxb}OGOZs%(ao=FsjW5
zjRll{O}OX?dud^HT3gt3QaTSaWl^M$^${{~3cvj~kTT(R>JPZJhet;>JolSVC=mJQ
zs?it#1MP<MVu(&os0E*I&zJxqH91BLq~HQ{6i9uoqvc##Z{!7U_{ywT@6&Ihm!~+6
zzV_l8l_8nrfCT@Cwd4gMQ@?=edP(K*a&9^J^>U)%C`3L{#2zFobmAnG<l?eYd44%Q
z>bqmLm9#y@w9zOEdpZuQx-rDx1-i*BzU<T{NnSiF0bf;*dYP&dmcpK>g1k4<LnAKi
z1=7H(Co`M775s(_P)}FaO7v6y7f<?ZcE=HI6!i29lS`CKl)cjBlzTzMew)ikizeru
zBo0^T%=&!LgNBGCgJx8`f<SH~(N0tPoZNKlmEVnP?-2@Zc!OLuLMx-MN?@Gj8JzaE
z1k&YHTP@YDS$jkGw)%aKBobOpJd%ExJ5I)+KTPo(g=+~U(A+|%g8`540?7f*ZnoD$
z!&yd(LV*T{QvlCmRH(2}I!nV)7yJxp#FBaBaiUU7q47m|<W&}*wSsmd=Pfhjy2AR!
zpE@TGGP=L&&(7|TQfy)6%<tBWRsOUT8u92h5&XF|qsKRh=0#uic-h*ZUZP&De<1pj
zLXnbETF!MWFzPc05wj9=#4I`GZ(rI~mF{O|r#>@7hc<qTaqRtuY3gL6o}BtK`S+;e
znFrG!ThYvB2^7)1jBfFp7Bx)imi-&ul<xXul2kf|nZLPdtm*W8F6);^xv|4BGyg#?
zUIw+VW!?Vt5-O6nya43i4&DEd>$KWm2J0f`1BXnIi8;Py5EgmeWQ@_&q&XbKOOK7F
zMSD!8&<Kyhht(-dIk{N-)OcrdbA>*X!7Yr8gyf7IflQCc?b2946!3{T=j!uHYt07}
z*{AH;u$mgcUe99N>}NZ}hESiAtiBY1!Msh$SUcJ`LR;}I&9bhjYp1QAIi5}_^*6O8
z$QRN_DBTnm9u8jMXeqJkCMG6EurLOqyqtDXAEt)vUTyub+~DdT0f?OQywGnQ>!W^_
zI3EcC4lZFv!`&CmS2WnfjdlzmoL4=`Dt|&9YD^`{EVAwCiHNj(?#yZ9_#3taD=HH=
z>Z#zCfGtn0uBSMVJ+?}cr00vMw8AF#YH&uI>Q^csyS54T4<qyv7TJ{x@M%qGTFp|q
zk+WV`tu`@Xb@qLy$-0B`%L0!&lBkxhJ9ntA*F}!|0crXOz(Pp8_PLn(jpO0a#C22d
zedBSx07Oraqce8AiZuLQtW!R11@@8C!{h}`-BO8D3qoh`s*SB}rokBjRa2c$4Fu@>
zus__=W5jkZ8RfC1wHGv<eRQr=VlUrp`<VJ^qHYAx6o^*LRa>wVQP}DxGqw6*>zxaz
zXnI1(%)-;pwt(&hBg`L0KBH@(6wD`MS-<bh<c!?}unt0Cu%DM5TR$7yfzffn!Ikgv
z9u59Z=w&QycpSTc^knSB2l<|_&Ih*fc6Rr;TdfT7Y@OG`p4^fM-A8?P-L%GQT?3cy
z>FG(({-i$nlofgbqr_(#ILz#u&KZ1n-jw06stkYR>^PrZ%T$Fi0IeTI=_*vNywlo3
zO|+TN?Wf|DlN?j~UUc|Y0?RNShF^ZH&Ad<SYw(SF3}9xn^Y<qjP|%<CR9k@X>;24U
zQad9<Bg!vJ=lf-_n60JB;o+>|;YpE`k`j+PQX`|sN<j6ONzM@_=#8+?Hi}<jDw1HI
zc`4>qr}7wYeU@x3wa_jEApGDbt8F6zuY$gJG4DG{!upAN_tm6~{Erej`)Tbi6tCJc
zletvLc2vKiGnq9bt9oicM`UC49TjnX)o!`lDSlMAe{6x1xq-n7)<Mp=g?$C|<{HTJ
z3qAMfEIBx!Komrm^f8pTWpeRHZ0*;Q7C6j$v&a?j8yY@>CyU6;@MYb>gDi)_))0yC
z_s=g(Hy%3jwdDC>FOSO&Bw$ue8$7bWK%;_!`T3vgmzxPWzs$kEz4WO?={uIAFHgM=
zv?Wb6QYr<GQ}BOxz!5o)sSH{@0EuWQ;)_fgeO+ELH!trA;c8`^ZMpba!sU2*dM@iS
z9iH;=C}Uzcs3l_icoR;!pNmKHvdLwotO45Z2X!jB$>Y_kmNuy_a^v)jpKWz>2nNC&
z!o$(5dYUc3q>5t~kG#2>Do&KnWx_&J0<qn!BC5425h-qj^1+wmMv3y4>y=2@m|dx{
znpkWxKKbSL_l>@6MONAKr)-ABS$g4AD&(3?7Agd0W8ki7i?dCG)*QZtxdo1XoXdOw
zW!^?NIzm%CX%MyB7&Yw&-}Lmti+(xvUarx0IrzS}R93ftoT+ivaUB%&fzAr{gp%SI
zROhraaF*4c@a@B6a6-7R$_jn_FT?rV+`OEYo3=LpsiFmKL@ht!NHg~8r_)Fc1%jM!
zpUr57T4LNdSpt@*^X$Hwd)*~XiWra}Nwr{jOeN}V(w|T%44GwUb>Gc72}p3BZrwXp
zF1Ig)5HhbOxwZ|E=PjPG<A;nTIQ?FI==Lix{>@o>yK7Ly3#dqa^BP!s+zOY-!`0dK
zv`qN(cj4>e+hwit^|eO|q9gSzHy8dJ>T0JN5w?t1Y3y0#iA>YcPKB9UzDjxqs<S3N
zN+gU{)((iN3e0G+co+V%Pv}jJMyoWC1>jK#Ob{?h18e}Rnc;^Q)pj?lDtNnm#|Adz
zh4GqA(vlh!u&3VKPe4`SVw6vUf>%Vm*tR%&zGn}$f?i_c_T-}9a@)U=GOb`R<{xf8
ze0PlA)P0rI+6?p9WmffZlS=h6+SG<<651m`oqq`rGv>fRtC(PfyQ07MUPzx{+092F
z?J+hplZ(nzeI%FR;V2}ErG2N|k7HyV<eD5fB}BX40Wb4lil7!C2@W2JUY{HWvKLwy
zprm@bJF~5zjMHPJr!RSmH>s)P0ccB|eehdvjz!XM0LcEM$f$Oe(M4+?^TzB@;lp0r
zdX>*PwD%(e%lSF7#>#)6YaoYB-lj}~TUd-muJNj$J#@=NiCO!unYiGhcxP+sk?X&)
zfQIP}v-Qy0&?u!^7(ArS=C-2`NXV@QX|LBPx-Re)41h`12!R(Ts(T$lIUzrwRRy9@
zcJ8EK`YT6&x>1Wfk+DGu{+OL<PbbLX!t&Y8tERf<QjcNg881JnZ&z!<w7Mj^dIeO~
zxp^y{XP!To_b(^Q%A2pRu`hb)e`e@QTY%S*!ye*(EO;5so|P3`yT?zQ|A;K;86H@b
zbCkS(QUB&-<Qpu~`#9mi-=7qe>g&Sivt*{+VgDUiw(*hUjr$ByN80WTWTA`QZNHY%
zFMHlWAZE_+F~9fssY-tPk}}b};5$%Mwg8{^u`~CPgW9h`M}zb6nw<C6>(faR0kY&H
z&m<=z#SEz+XK^~58*fimUXmT9sna=ZJX<UJy1@tW`+7_x|54OyIAy~cf)P63%QYDR
z#Lm7w3XQP1*3_MRnXpxz(D1|w=o|&SBG?<Ha2UBj#~DPUQDqLH`&Zr$iM4kREE+1B
z1szM~SV|${rvvHjmywM(wtn_~<fRu^fU$lXr_g>V@edm-t0zlM^YJD$E9+=cF<H$1
zty^=^$P+qK8{1t{PP_Lqrdc(DV^_yh7_A-HV__0W4=$BS3g4@<QCbnx;?3k#qRHJ_
zppVu0`sJBcL0LVdMR><2BQcRv(qJ9Blt;JGzXg-Q1XGY6{)}wKF@1pIuX!z?ov;WS
zz|Zuo-of@goAEtL6kqSAg?LwAEL?cZO6*<2&ppaBz?@kj0Ht(ks4}tqm_wvwP<B?d
zjz@5{0p9nv=GFV%1{)Fdw8s2LYfE)eJdUDQE%7Nd>93f{G4IRQS{#Obdb#A7sj3T8
z694uncy6Ew8H`7F9RoY^N~_mzFE_^)U1{|RAk3)$?99{byf1TSu%r}7qXe@r-F!=Y
zw!AZa#kr@KFeVVJwhj)rf1B>L1U6Tes|PZXGTL6`D*MWV)@OA+B@Ha|@5uw5v(EEf
z9>x_2aIf6zF>2f6fL>-97av$We`ZW@agk8e+JlQ>>l`KD7k+>{iaBA45)biOJulOv
zcS<y)&f4)M!nEU@foiOP%hM;U0$<~4hdy46ZAi}mhic*d4K5QxW>t%f2NISLeQTqA
z2m{;joo{1wF4LjpCP~(&?#F4Z7s!Ci6Cj^-GTfihOhNtU=V>{>LYEi0uONWaxz~Z~
z!MmNFsHbn>DLMVBmJPRdU7GUX@VoR~?`83)jU=1(8K-VK`rcJp7H>J2!Kq9+RrP+e
zZEaUT%wSP=l&=bPe{vW@FWBFk%jats!7-J6k+0zbOLdyXYjYyol|KY$fe3>)`(TC`
zQYO_|l8Y8j=ov!Sa6x1L5=a#+(xvM(b5l#Y4M+45t|~5M;eNyuAy(76zRAVd8duhC
zLh5KC+8D85AOntT$!U?@IQoesy7!@rH=0I_P*QbLKTR`7Y5(fy`s+9~d#*uMF30X!
zoOt+B;J`Q)7X)Iz7U#COWUZAM<AryOn&ucZonk41x#P9G!cTM6U$9&$p*+w!ptO54
zwZH$XDScqHY4`C7Q+S+*@2uyIu>`hx+-sa!edA}>`%)*>Xf(QK(3;{F-^W_}PwU0M
z`aygegpZ79?s>wis^~u%zqxmtmkmI9O<aG8bS$iBhChG*^Z#_T@!+H9dhNILqgQH}
z$;<;;(vfZ5r(r?Z4j1K-Zh$+sVcM|oV;yrrlxThOq1hV~JzaS%J$58ty(t0}Mz%q<
zceJjT?mGR?@U?b%_tA?|ql}mhldkC~gmR40#<AK4tI0BvaY}{ixH~;L^m~=KwWlsG
zAK)%s2$mF0U~YX44EoRL$zP!KYYtWOkJnf2hhnlTcxZPW*|<H5YNJFUX2m#3eP{m#
zVi>u6@bFA(Err+gV_7~DM{OAR*7B6y-F@$3Z+b_n!?cEXM={N@$8u^X&a)5xI;O{=
zoK5<VMawK%bi{=wq6*WqILKYUaBX0c;#}*?P$Z%2Afe>-p>n~wbktdbYhykZf6vy}
z4!Ecv1-GD4_xe>b_2gq}v;}b%=j_L9UCE8J_6un*E+H#%1z}_BX}#CXKC;drK@%Kx
z5eHe>_Ad&D%9vD_`mjZ<0fgUgCKu`ulqaMXR5zuINRW{Y)ITxU(|Aep;O>ZN3~_v2
zTAR7<om@Ft`ZdEqXVic&UMKmpRfA|xywDe2e%}Y@M~tJ=sI0dxUBI&XsUr3k;E_7|
zaqz`6@moRppV8k0#EW&3bpqdoKLCx%;KGi_*It_OU)EQ`Z=1ix<s1|=jG&o5JLxs?
zj<7bAHV}+$Xg7-uOOTd79FGWC>?mt)l@z2HlEyuVhgaTGB2KzOfjNp}C&bZjT6fzR
zr_eFuRJzRM5GDJJvM<t&66cLfVt3T>?bxz;tA^*PRq35Wp6-z?G8ZeU-zjrUrd9kQ
zi~-#84+E``V03q?UjF@+06;eFBkyOwjX56tGXmH@wHxLrH#YlTZ@-W(wv^ESz^aZe
z4!<Q!bFLRi1$70)Usa>NVJc})v~G0);wnHr&exHKJ&<T2PUjLjP>1r=P7dD83aly5
zWnW)kycswQW*SReC?+j9I)D#k5{Ucm9DVuHUpRxU%O(ZbTW@}c1>W>tO8LHNDY=de
zARNpQfp$|zhqGnAmC=+h%x$hia<e7N+mV4TN;;O>?N#NZ;?5~M{J#j7<Y!4`7A`!r
zCe%n@PT7r06&tp}sdsVB`u_bL6M}@+L*~`_Qco>EsXc9yTuY(ps8kd@xxT+&#S<5a
zvpotW(T4Q@`t|nh-8-3QdA4h@q9-5C75rXhwNauv^Tg9CJc~I;t`DDGgrOF|^y+EC
z`Idmr|IYy<VyZ7~CWQGC35@@f+HF>F#Ab~SvI{Q>rj)HkY}SRB!SX1wE#+_~+0_4?
zI(|w@+E$yDMYP`XKgGHX=u|H%80ls4MJd^&JN8n&gKC+co9t5JDx1Y>^t}wPS&jI}
z7cGt+<$u%#ayllM2pkd>hbGM5*4u__ievDcN<oyqBb@hZ3{wH`H;V<0PI>HPWnj!l
z4cRwi+>lib7R@X>!O{*(&RCx(nb&!1<XV3dKo0Jt6$LDG^21~hIZFb|PqpC$!?#+7
z54Qo>%JzU)Mb3TO>|D#m3cKVHRK|Cu^|v8amC=MQAF~}rdjpp?pLGzul^!o^O9ip)
zgm!?8I~&E(i>$i*;&+la`M!x&8;9%D?1GwT@Fw87pMtc#x4>niOFGkz!-Cj{h1n8z
z>foqQ@nI~8Q8JVZ>%Xa^!6GFXs&*QlXA0tHYF8s>3@$oZ4fW0^p_(L%Yqk<`{^U@n
zqeC{D*|%?5vV#cDe9V|Q%RQ^Q_!Vw_16^-!DcYzvcbz9mb<G7zuL~bPMd4UQ9Wkl!
z&S^rPQWACEF|#l}P4W5-?&y19cmF<lTHor^ux?A!0DEf|mSf`3^!$;bmdNtL!Xe72
za?-Pm+_)4Vm0iSlKDIMQ_PztQSdCMjq)BKoYe;8cx!h)~xJt>?YjUryVWH(wiSP(o
zC1dS1+OqB$v;0XF@n+>wd6oW9WL=Nx&tZ!u^XBFK-y3A^*)bB9xWge+0gO=^tVJT?
z>B@gs4e#y6A3uGB8|PBw5_)WxqY~RXUkm+Qe&mjA*A}L6kNzSp^88OiO4#1%M4uOi
z+goi<kxdX;8oyu;{)d<^;%!)QS#F>bzoopGUFM|o2Nx}%lS4|>&&u!i`D2=xc6niG
z+|+d$jC(Z~O^Qx6N{OLZT&myL7CM-ASUt|KXeUEsoLK@Fu%G3*O5rJXm!7yE_oCOq
zH4Hs;J-5BdTUV2dy<Jgsq5ZtWwB^)FBeKPM`eWgp)UdA_fs14s@pCI&y~@>Uv-G!X
z0K^4Ai!|VlyWX_i8LOwPx~xDrUESoKvX=Mz<MiLn*{xbs?5e&i+-u+}n|~B#S?qR3
zn0(_LIlYUY^shb+?5H+nMD?+qn-5pe>=Yv6tcW#64Q;0G8t1cg2XTpWR^x1CHNgK_
zk(JY8su?P14w)<%914F>9F^C|=B7%o+^C#R5*t(~ID7S&vtN;a9oWC3>-*=;%06zK
zOY1GNqkiM_{)nptIv<#7&}FYzA2I4-+48ZLNkAt}QYfC1gdsXb<azq~Zz*FRIpCzC
zRpXGv<}JuSO76^=LkH@g#^%-4RNTH-pt}0q?E$+K-BY*pH9ETAW|avqv+o+sj-aI}
zqqD53l8y9Jli4+Ae}OAQz>?nw1<l+{M(szJ8uaaVI60*!%qYw)jm__C!<ZPqbFsx)
zKB(}=L{j#M$}EjL+wLdvEnCxRJzD6C$lPjsOMzY`+F;Of?&zxn`sv`wz`7LzO#QQb
zuT$4M1f##nN+qt10G=j!si$r@w@R(ujpM(sY2Z)bmLvkMn!i6Ess4Y)@qe^|<v$uz
zh~BGpNN7I0$@M*<y!o&eZ0X=wYT~z~yTb)n;q<!*4wgxQEVrp$_itQ4$}tyb?9gMi
zazjW@!7Q;v{rSA##@gH|SLBJ`4dv`9)bE(rIu3M%so}r>;U8dspK>)?3w@{owY7Z3
zLNg8!jnWup5qoX-W7H9faQte7#$@(~<=|r@l&U3K-lXgmUZNK|wE1u<HhHT?YdiZ|
zYTsZJX_x)a)^q^EJ0-maA<OS!3P#-|Wda1=4=uOVUB!oIpZ<*nXwIt<)+$KV1wC)Y
zcpgkCD|XA$rxJj+L|u>E5_2$(^&00r;q>WOT&5;odoxQnyVf|@k&jgzuJ%9=;xoFc
z4F#Q!cIh~t{PO`9xc11Iau0msnt__h{(kz}ij$Dh;1_G>M~v`(OU(X*-rf@WRaCiY
z#%$$*1CYSMujPJhw(-HJ$h}7y6Rgy@Wn^P5fXPqq4AtaV7%~!2o!X)zBLCv#X(0k%
z(}070U0$sP;?>st;FIlgD)+x73g{zI8|*MdL5EJA&$E(W4Y*}bEaO&z#U#o~PT!QQ
z&FFl}<wd0CcQZdSCp{VP+>rmhSR9?K!KB25Vch2s^wKuh^_+DxG>cX}@OiMTm4x@`
zg#NdyKt!|}mJrZ$Bh$sU1(24-aN$#n&5bCQx4L$FZO%lhsxrhj%(1?g-S1wjmo=z{
zuG`p6251;(1>&=@+c>aOL$-IzDd=Pj@<5^wr-=WyoL4O}H-#!fe=ddb04T5LTuviP
zu|D<sXw*sWIPh}cUE|KiQPKRErNrE3K6!KAYT$*jQ}O=((!^vBW2|ZZwuUFtjLwhI
zk6gm|xRy=M8N6~U=e@P18|+gq-DPE@2hgT1p2q=B92OIF)USGY0+K)^*F2RqNQ?kR
zm?gsSTa+h<>uLqXS2}rhk)en3F|rl)rf=UCvdETCsoQslP30_Vy;k*WDR-oIjw#an
zMpr)kt!qjjOzW&=xNeG$@d4HFkYvSXpkp6<^m3S01*-!SotYsmaVfwi$TBLI=<|D=
z_2y)`zsi*FxvY-<DkDjew6?tt4cg}0{5Peqv#oX7F|MWFi8t%k*}G~rogPrSjPYK9
zmi5LnqCHGi>uHwV3iQ%>5;~T07M|%lHg2GF59ikExr<bR$GbO11{X?rqpn@uJPkH&
zyj-(eTKvq+q_k1M@o6}8J1?{)D++G`0<}!mM|oX_7QSJ`hLH|N(WLB<)!@(~VxBWb
zSx*k$qdy3@)BrJEQrp({nT7PMBMZ;!UT{BX=k{X>G-!ztnpF__!^j!{@baffLHR_5
za%Ppxn0A7AV4TMz`2Cu=3-COk*)v9uFcpTmT-))>aa~vz+dIF8H)iivuq{@o{;BUR
zpFUr}p1q#aoXmW&{3k@~=VxO;Tsi%XOg!d%(^<%C%_^=K=+*jb-L&>RP($(Sw7DaM
zm|Sg4j{UtlG5IKj$S!;-OW;UI8UCIf&7@_hBYl!J;#m(fAkRuK=^;qaG#Ys2VXd?l
zh~~F^rC{LF`3|x)EDaeo^p!=8hD;>ok?nti_?i2uzsGb~9w9Ten=6Y!4J~@JuHXY3
zGaeo0M0)b^4dDKLTu<ZmZy3RSEu#y&S|^<?{&<DzuPV71L$jY;clPMDe*EF(aiu50
zfq@>ydzViedtd$drIuOll+V&$4!UyJ^yYc(9AOkA)TQ&!A_-7iq!4zteN!_hj?Yc#
zr(;WO3nd~#lM$2%|3Eb+1RD=GY-1ep#(HFad9gclGAe4>gymMN&YdL2^MSsldrvlw
zXV&7C)wp*htSpK1fGRUf*ybwk-Ro#z_B!(yt&rG?be^uV-C~r#Z@&1FIZ8Lh+=R-V
zB0D?Y>|1<%Hy7tX1~D@_Xn?ciq4ttzKQq6kEZZA)(iDeL2b0Ok>g(<8hn3SFhXD<7
z>$%hH;-z}YM$dpcA}H2QAQt5WH+|U{PxVERiJnis=yGzlWnY>&(DmABE`deF$wk_y
zr03<IQw;V^XSm)C{@I^Qzl~sAs4?61X|PBTQ)s*mv2RG2_*xOxhx@=@*r$q3J;GI4
zWprLcf|#R6bV*Sc)M!JwhZn{Rs`O3bDZ?-d5seS->x}*)iR&7;v8kT=P5>e6ihcTw
z3|mwaCDvV4(=Lt^oD#k`($v(g%+@emhT+~=QI*zKvUux)sP{Y!Xkv!@8xCc!P<DKz
zhJxjNPeMb7i^g>2<+2{>$)vh7q;i!N9$6rJl{;$aNrA%ShvOGU7c{O()28*!m{)cr
zfg;6^SS#XqZ;6|%3Fw&p7G-UMO!+BFMXddlw)Hgcm9kJ6{<oQRlfA3ZE*X{PJ)PP9
zl372DV7Bif?pNiO=U5h&o~t%R*(XTL*WZsC6XgmBd2PD}>b8e`I>SB`nR+*GZst{6
z+GQeaH8eHNriR*wvusxusn8t|Y4n^WHqUc)6>4fjz8*U5k%|-_1RJ>C4e|B~b~69{
zj}t5Oe1*bs79B#?gjC-syO-_S&36SnkcOW_5GZAUt6&q-JaHQXf+D}X56`{4CKNl=
zAZ4ja6~0BwtLbwB@*KG^hrUO^D_T*!?(_n9slA|`-n`t}oT~G1SxA()D7UmcF&#EM
zolL!P%d2J+x~rkl4l?##no@>d)&}=p|6cMwFN`B4GAgo*X%(ElXe6~{I3E9;CVLO(
zD<ibwDdQ+)`Rn5nq*U(<LZg?Foa5`3_{*9l<Cv9SNElvZn2bq4#y?%mUh5i!R84-0
z-=cI;#ctpg5zetpLGJev{@lljj)$S)`}H71#cSvJuZVY>li@`|Kg`usv$;@ac<(3U
z33Y<ZUI?P$dC2%xIQK#C`5hkeb;!t*{Yl#-AawtS^|~I^*j<^}Y$9Bh2wZe|-TrO!
zjS(rz=fj_H5U`%1`(DmwQPGZ<y|l&iQLSFr%eBzLW3i^1++R^VD?^En#+L{kjt@Kg
zP+)xcp(hb^Y>ml8cXzRXm7KkZ=Md!QgYunwS@o$c0w3sbo^GORNp=1#1^wr7^26z3
z(RK0fZHk%oTI|}d?k9fZ8$WL^gnuUC0t`ty2O&|W4cZcP3wTq>?jF7B@9JTPUn{pm
zQg(mooAR@=DoEhSyN{P~-Ob4?dapP41u{%@k-~%OO*Z@fShGZ!hT%5L`Qu|t38eM*
z^v(PjtsOodb&Hom$T;Zo{YX$0T$`uL3fpa9Z|^tb#U_oN?(jHo&3m=CpVDr#cj6q<
z)lJqZC~f5ga~+aezWz|UOVyb{LySQwvCHkroZHH3nFXFJpAXkmNJq}GJOv6AjG~6W
z=*7=>q59maZy}{H@{xjm>GdZ5>f+q%>B%Ln4tSm#1Sx`g#2qCh7`vl7(v|o!Ayfsr
zl|25bUv7j0fzcf&BmuTmETM(}+Qc^J%k41|E8|Nm3p<hN!Ir&z4;GE&zfnukgwVg<
zjsFI)vbGd}CFcQ!zNA>_kw*uR(@6}*m)3a7V=BN81RkEJ7O6={ulJEm&#)A3R1I`C
z#3Er^slZ*q`myp1*x^)w)K%>utgK|2q%59jz{c>J!pUJm{}}~Y$?&hw`mG6Jo8nAg
zgHwt$<VWzTidyS7y0U&{H0d*o{Xy71r+O07X^~#KMX(imX-$Wzzn!BWj<<0p*|`Lg
zmNY6TUh9W#QZHWHia!p_M*DYiguXh_GLUcGv2DK_x+s&eUZ4e|!_O)<s!2ug^OF$$
zL--dhrjfqA{lZ@uV&0LBJycV_6O%rlQvBufY03kObeWej{Z8#=-&MgX?Yx=WSScTU
zs<S)lSld+|d)yA}&n;5HO+JrHP8eZ>A1g(mL#)A@gY#goEti^e)Lk^HlwuO#0}Mqu
z+s-9z$_k}kzO-lBaX`6=Za>5UpuFJ$ZdxtR+o9~f1Uli0GZNn8^Dg+<V8#%aUA)0+
zb+0mpT%*Q7n}~2>&%EO;9k=(hgItT3i<BGMaL&FTf9Dp6GW`nPjPuPed_a!BX)XmA
z$vE9bk}O?D$nY4n?y!4y700}l)?Os;KaCn|!<lc9)N=fh#;WbDEKYO6Xtne)c39wC
zhSAOo<@cuJ?<cz4eqtJL7}`KuyG;xBhXv?%DjzL|ZPP)=<~&!zO2V+*d)xf-!&H(N
z2>=_?0R1p6$rVn0?rkKm+<zD#&6`DTMSlC3{t*HZ{8))$OCDlWQM4<F=WXLb00Dt4
z`<8vLEf~_x!SfIA+K>7HnZ4l@5IQAiE%WwYb(7bs%*LDS=rk&BexOxs(lZ^tbBaoo
zDUeesW0b`#=5{+@r=_=SNo+$%m_MHkWBnJvrc<jY*4vWwo9qz-Wsm;mb8P=F#pWXM
zZWdJ8u>>2@Wq|BBx*$yOz7?v<=;8&zc9@4;pSb~p?VV1a^kcpc*j`x*dPsqhWXS04
z=kJ1nZDBgrmgLa|0dZtZkaj>AM9afw(B0vsB})W(%!|;@_JOmGsFK17HHDU^RhdOw
zKMeYQ&WV3vUK*Rv@5okvkvoq!a;vq+GTr^Jr+03g{~#c4n^fO$0exqtblv}WUTf!k
z^|HzR^tlm>GK-+%;fr@d6Xg6IN^flVXzz27*`cIg4hSp0=P|xB@|LEK(cUiXe#08I
zKIM<JZht$n=goxQbtSa<XY!`;+le1rE`QdLUg#pL@X)Nv(Dxz0rYt1$FOs66di+NW
zx}E8A6Z5UK7@5~f`>Y4Kbmg*5t0da$J@9u;0Zl0X70mto=s&cylI#CLsC+{Hn<**!
zccOwOkk5HLM6BF@OJEg%Hcx;5^MB(9apArT`*&1xQeU2O;@wvqre4RJ$$!5HOM$nc
z@b6#$Z5Q~zHDx=Nx2p{6qv>y0`x$&8rurMARyJ?M8QPbqls)>8Bi3<qXE`PO>fC{E
z6qXEKD%NWY@_9O$Em3dOi|F;&<u222_Ufbjf%IIPthT<BM8Ax$Y&&&LO(URk^>Fv5
z?u9zk6iFMg`>1aa$ovjxKxStrKu9(jRU1k8R({PCS|Y_C7JM6St+>{V+iY~J>)VWZ
zIHwt51YSLT*!=OAlo!VAGV!i8yk2oRZBYTZy*~Hn_d_LV=I)bUOG!?f{~HTP{roA1
z_PWEOMQ?2^!3Cn>(emP)_an$hu7ER(t4p$H_zSky+wpWaHi9%%En9>2S)TZ`;V_gj
zYJ9mGJW!L{<HD2}$GaYwLhU@A40<*baWym1)2OwYKW*AlnRShjMQrZK)#l&q>Qo6Y
zyaIb1b8*V;^4@)V(8Fd}3nSr(56^mdR7V{pM!;}gL1KiReD$Jm8?P7@Jz(0FR-LsQ
zCAAsGqzK3uu*6CC!xgJDB}kU8FxgjpMdmHDvaQ2iJ26*sIW;I;_#oLfT-K9e99)|k
z4lbq+G0>jfFK(=b>!SB&2Y<ypdiCUi;O_jYc2$0qQO`ZUxT$`c>4&;nxUCMQy5CcY
z*Xw>J|FrE>H|>fD>lBIiEb#MfLR7)u-Ef2k5VtgqcD#W|fCjcW<Wf}xBiUU~zgK;!
zY9Ll0e3DK;59$hCd4CUkdAGZN+}kSFLsTuE&_G^s`{Tv4NH$lQ7a7pZ+X0BoIR<dg
z#w~jAW2!uUo)KC=o8!U-q`{kfdgn`#k@sRY`mL)`kB-DDg1mGJcMwQwhO;phzw-DE
z%DO$d>Ix0ggZPQ^)H68~tWf}`&}zR3pVw=-y8N-mMA#BH8^0qs88|wk)<3*w_JEn+
z>D;D}c=6!OydEt}w{d<T>|<kJXdu1yWRpH}m71H0+9}1ds}<rK(~Da_XH{!=EFJvB
z>%h(NUR90k+;+fhSGK<HmB?7ut1bR7@^Wp>k4T4w5Y1NAMB9z#gCg|h!#w*e91~&=
zRg(*$QQ_A_oB;!|GW)|};G!%|Rsi7~483XRVk+Bh6>~!-=4<A>&lh>ZHa!^z1MXgV
zti}`2(*9)1&}@IomCsDmD45eq2N$n?2|{iy2<k-E7MYBFXQ;dvjFtcRADsNKQn4Le
z$GXR@;XN}UWx?%cC4wxtLM5bO0V#@gDmaJJ`}pBb*RNsydTlO;##G15r#T}K52ZZK
zg3+gef$LvvJWx?0{jdhg+LcG1!{dB@H_>@)>TWs189QS}?z``g?snhxOYwP0kPJGM
zW##&C)F#Bdn$0r}ZY<~ZV_8gxP3U;9y!&75y>(PuahEnqm9|(Z?rka1V!>Tnv`CR+
z#T|+TcPmh!c!A<pplEOl7Sa}XcY?cn(BvL?=bby>x@*mS|Csq^UE!aEK+ZWofA+KY
zv$si8^u$7r_D#)ueT>!VC|MDQhLuwzQHEzt`1Cxu@pC658jVe_$GdG}GZKj@Ekn-D
zjP-pe$Z<K7%5j1${`hSG#bRGq7&WrYq@Z(l-qKA&qO>1>ll<Vkxx(%nEIU1I`80AV
z{c4y<pFK(+Vi!X&`Z8O4E1&<uY#mQmAn$Keo;G)fsHQN{fFKKPBL|K2xRB9yUx&Vk
z@E2FN60f>ht=G(b<Mje#Np7V0Vbg@-;IeqfHcX-j?=?JY{p&=mK&jn)29E+Ws1`Wb
zgGkd+>XgMr6ljjm+;T*bj=O5xQ%9N)5%QLLM3B)1_37l2wj>H{)zXb3&cp`JY*ac0
z<ra0~N8jgPNIq<n;<_+JC^T5XUu=!JBT%Kk9_yM?pPf>;6XA~33q&W>j0$anVn!GX
zrHIQ@>x>hLB$gfA>r6H4`jcPNCqQbBS0!bTRga52#T8t-=1YgTe3d9_x=Eq-=aFb$
zB{R0kq7;h6)EpJf8S*xwk5r+L8qR|R1}@xIDR7hvYzkh}&oE~XS82=^Z>+3b)qlRu
z-H`b8gh>C<-qkD0_c!zJJKFj4vC6E;;rt2-<8}w#3ZCU>oD*Hg<NAlWM|+_Yq}V(y
zp-Apdr-g{~$oPF5-1qEvaU1zmBPPi3xUS+=0^_Sah)DAJVftsA?5}eiG~ujJt>XIB
z7iXA8v*G;7BZ`uu(vrtOKC*jRD1*-0%um)kyXt|v6Irp3kKBHoyST$g8G~q;vQpA&
z-}w>DNu+ybiTi(_U}u((%=Yb2b9Dy)l#=7VBzzz4zYvvi=P}xDnZnsoh(s&E!ImY_
zcDc~G?sVx?Z(gy&qIS_bw{by|<U)SGoebE_qwhE2Mr?I4?+F#0Rv$KK<r(cJNXD}n
zw`&J!hm9d=&WXwkr)?6gjd{m^%qe=V-g#p-GHByH*Ir+l(<Bo(#e7f2@5{Ym8EL{y
z+=xEVNk{47?`COEy%X=*&Q8aboeMFy>rBz7v>Wu4^--bJy)xI_L+oDut;JwFJKWew
z+XA>&;d_qfPr>(|9BpfYEXwlL$#X4ainpBh%i3Q??6xgmW~0Kpl9o4#TgaBXP9A`s
z4*HggN5_&s9hKorRmpCmJM-N<LEunb<j=gC`&mZ^puxofKgk)_*k2FH8IzTOQhKfw
zqe|oO?%XWgG;J=d%UKdG#Af!KAa3agUYrt0dy&bsDM(}E6zj5Y%Sev*9?uA~IfVr7
znUOIzt~}%;EZIuXSoV{+W+6NIvi?)_o`Sw>Qkhj}Zidmccb{ACC&FgVaQ2<ZV&$n>
z(AxNzzz!IaxP?rMW>{?h>(rfJuTsDBQvRWm9p=xjj_-OzrDX$iT1Cg3(>by^1YXD1
z`Vr%>7ryE?(vfKlBLa#ZA)uv#q~PkWf^G6GB7mFt<&JC*t-go%5k?YzK&_ckhBhZk
zh80+B8F;>KZ0F9y@`twbe5IpQ3`eHYh(FP>mIxbV_6SR7<EO%@ULyOj;wq{u#z|+I
zbCRo2O`WGGf~_Lg56!sdFJ&-ufkM=|p%)0&MmT=6kKWg<Jxf*jH5rH$Ye~%Z*c?GC
z{k>UE*=tdizbxNm__{3R`#!q&=;L!b<aMrmSc~y;f59;IXR#BWU`aW6dg@X@yMzm|
zwz8_gxYlx+b>IEwQCNKBHaQT#g!<JgWWmjj$&Tm$c;+3STCIWbaf?rGIIp`ZHkVkH
zT05CPDX`Yoh#dvneAcz;J%+o_$;p$ceYK^li9<@9t{g%t?^ysWXu+aT%V>1Ln4DGI
z=Rj?#SxIQ0U<r=6SfR~_(|dj`qC|yrav<%&l+caW&ve3cr5LuAy!kl9p!XgVYv5f+
z<Aam4%*Oh$EjE=zKJ||a>y9M*j;zBgc{c0Vb_Ly$gY+J@#cQ$msnwoMWj>}RNNL>5
z&bT8OGN5k{6zt$Jya8)$-2V&Q)UpFU!}!h5wqrVMYQX#D;m1hge}ZN=`I`#d7#RN@
zIQU<InaB!^-0ti&3SPw$o07gl8r*T)R2?|XNd~SnOW57#WZs5snO^N(kJ`v`xtNWu
zb!EM5U^cJkbks%>aw1JHJ8mBS?Zs0&gDD-Ydf1!h@RfkKy{J`KSa(WF<sY(AT^%1=
za|Ltq;4J|n_a-Ofq41U`q^Sn)azIg~vxg)nf4_z3mXWx2j8eDs6ygrXoCy{9_nhO0
zI{&;f#)sZo3v6%h;>u@Fj=qh@FB*WbEp%LNtgjvlBUcU&bA1jp)vLt~yBGTUvNfxV
zu}E5kd2RT8Q6k;mS9hz&zSj)}FhO}f5Ky?kzW?~flKR5=a{l*^$898`83uef^!^*|
zYg_w~vb<MbhAy2ldg(fiHOxGFl&opoo^B5Pv&#J|{4lcW{!BAMeT*mtYW-RVL?>6H
z_$?+k2Xbb;;e6Sogb+CnQ+kv|Zrwwbs6fDg`bov!?DAE^Ji;V1E0*kJu_cLe8hd$v
ze*JK!@crwH6NsyA2~D3=O<v9Md{?46opD1xWf#}N0fM3%lLSOVMI{;UI^`^1#<I81
zpE5$FP@?NzmQ*_}!`iEh&ud%K&xX2f${G;<M-n^tK|Dg7vG4EJS(dicy4~CA>{=$U
z4Os6Z5WLJEWLeI}$!Qc}s}IAcuor?$3t}>m1SZzGoc#IIv$|TC<TB+aGBe0^e8@PV
zlxEpdi%`goT<EztJUpbQy`8siBKIj1c{=e3@fpYM^eAoW?}78BFdsWAjwG$vUGMf3
zPgl;?&yI~A%Q<SWHo6|Z?|D+nS0B;d%7DqCAXC(_^=%23CSB?Hr+@(ai9khIC|{!^
zhpYGMZd%f0PL8JQcg1V<`2tR3C>?F`@A3v_q#3;#R8g#0NNPY@Gj1{H`O?i4vopJW
z3T~%T-~tK6lzohQeU09iL%&+xxf~bP=aqW;A`|sRr%hKw`EsIlRjJc@dRRhY8~T<7
zk*s>tjlZ-~*Kzdpnzpc=J#uk`LzCY8!0GMLaVv6&itg+SK;lxfMBg@-FGcj}@38mP
zVr)E7&&)q6rs#?i($2!&9d=YBa8;A-s@#p+d+$^46zzRI@|zr82}ACRl;w7inws#_
zPwoyC!D||#O7)<N!IN7WtuVo0R1J7rNLFXCr<Gy0F>j&?Hj$kM=oFY76Z{)|9S&PS
ze+~~FciC=cCJ8PJADeC#p7P`U`uwljcEE!2*1mQMZKDj{vXtAcG(CBrL%_`4P|siK
z*u3*0D?W6U)}u-p(hyQ~sh>_Uu4(2(LKG!S;&g-)25w=mHw;ljX){!uDbU1)WbjdF
z_8foKOcspR3@T$tUh8S}c3A2&d2lNb-N`ZUPk%fgI3H24Ap#ne5qDxiP}CbQ3S6$4
z`Io;<d&j+4pMQoIR6Vw|`c}UsQ#g(DpjGfDaRf%wz`xu5><|AzRs2uwW&aY(@c)wo
z{|PzZhToxo-bWKVRC9@?_hGAB^hMv?6Hd9=47LNyG_{NA_p7C|S2(FAj;K^D&+K^R
zX_CHKN%Y?fxep%|(61jL2Q!|sw$@f(Fb$XzcpQ8UJg#p&13m7ubc_Wm6YqXC_$L=o
ze^Z>t4*c&t!GFRHjFAW#JQ?u6H@xBm|I=Ut<Qj+Z7A3>!TPykot{)$4Q6hs4hC~Vf
zK?d~Y&iLGt0UI%trM>3kFH^S1j%k`?)y*l*c4%WrM8%)7mlkCuHLEg`h!bquTfDOl
zWm~Kw)DCzj_kXehlym?0YydVi`Cn!ONCWN-)6qg&rhI5^b35jaO0LBm0ex976I#{j
zYafnDga{-_wk#Bn5_RPv+^02NUDVDzRA92B27xn8YH8f3zi+m$sg1=cmpJqCh8RdT
zBe>V?B157O48#L`7fq<ys>>u0TgKu)5E}70Yxo?xy!^WFK3!R!G4^Qrm~Y!?Bm-sa
zSGp9BhW-XcV992rWnRKK&OKwU`qcZW*1EA2Y7Km0M@`Ka9=&lc?#70hO)QLlM4O%l
zTAARcy9v{lvAutr2);U5_5KZ-QJ)$A07e;*-|#gZFkPBQ5JU)*HkMh|d8|?)<kSmx
zVW1T5)M6(AnO_<EIr^k%+~)Oy!Vf0(J8#>qg!5|<2Q@Yn!?Vp11QMkn2X}j~#<6X6
zZ800QU42*{XL3FC?m1@V>lvJj2xj?d!qMI4s%fPnv*-4ue<hv3pyOnEVvb;*DXt|x
z7aS3ycmLo8&T^@uS9$s}?9km`z6omC`xdF0Yus37GC#!~IFEDDI|bQITyf+$oCpi0
zg+6ub9pW9|xNys}!n;5I!3;FU1|27dX^#4fgWa`zG*U~AH>XEREC-?|{KYX;fCyui
zcDeh1op;_wOxiRlgHBV31}(-Va+dNaGRyg2J_~X`Bn&HF{K;%$svShxSJj~(Z|LhU
z%7}2uQ)P5EnS6pZ`e1Okh{`ot`=tKJrQ|z_x9$=W{i!f5AIvqyQDZUrCwP?L6~URs
zVfou-_MNbgddr(3jtT>krnTcP`sP;(uXPzJLqK1ry^NjyGjhP?Anres1B9Cmhr20S
zMop6w33EX~&GK#Nt{-;yWPJ#Te>-J{J;{wMTzaT|mSpBzsGKqPt3O;R(`Oo@<t*-W
z7sje8ku_U6MYst~g>&qzP8}RfbtUc+RXoqV7xHmRK^E^So%)5xk^^0Fh01a<5n{DP
zYdGC<)Zj@W>eGb{xpUCdN;3rAs~HD}S&DI50ozYaI<_`k7es3v@<QR?T5UpK@aB(Y
z$t~GJN`0`QE0oE)ymH(PgVb-wQp3tG0r%s+B(1H<ibHn&td?$Z03tTdsM?YR(nQsH
zX&c}Nel7^FSo1}*&&h}*Qi&eU|2}>(|9j-1u-2nPelNilI@hl)Zn{p|a{q3QNA;A0
zj}rXiWDe&XDS?`{Xp8)#3@&hQlcLmv+$$K49BGFgh)G?oJn2|DtnjM0%>n<4>8@L0
zJ%<_3INRoDUHB69GJZJ1tTr^?j@<bb(d~K#cXz2>T4qk`vIrt9PqEDpi0R)lMm&w1
ziVrpV+sje3#5zJ_4Qou*Cn=ueqVi!3SqMa83N5?^&Regbt5WgojKf^8NnNjv^F;Iy
z-gV_cDLjwdrs?E9xWMYfQ>NMRSHpq4tAgaNer(>4_}FZ&2IKwXc4QkGGlwu1xO>=o
z@5)a1(Zs(uzJKld^2G$}n3~T|ZGu<CEvnt7AAcH0@3Z~N``Mg`uq>aLLKHtiluI%Y
ztRB2R+Bx)rs9}q$OSs;%54g)<86t#yRdVuvo0M2RAW_FzW9^|&69MT7=j!fTgW96-
za0_zh;n${_+^>;i{^wF9S{e(=o}hh(NiH3Go@|9*1iI^-Jv8PwgZ1o8fNOWs<FGH*
zBPi{vWK8*k$x2i-UC+b;vAbyh1&S8_Ql0aHIK$#^v{jc$jyd)BtgPtJi7}*ik)ZZw
zimJn<(R0{MQ=Q0vX3#CpHIMt69+%o7Dl%0&aA10Pg^{J6vg`BD`T6lW^F7>}l>1td
z$=E^zTuYL7!8Jq0rUWct=YRmm#2z0xUis*-?k{g^ab7#w;ZMi3Y?Nm;`0+JZMoDhI
z2mg5?MPrQUD{p$<_gtd{<mUGc<w<1;&wME1{0w)Et?+0KT`<1ZVdcj;Iq>3Uzr>^Z
z)Z)!6bCFz-_1L-D(tz53k&Z-QbD&PLvTV=$-EgtUvUlD7l+*CMhazIeDgmaGGY#4n
zEDd8h`bPAjmxI;)&d|4aQtaL{=J6x`icgRaaS@~0N-m!5r?uILWH4B{hB`2-&0=#D
zv-oRz^r|~uMJTm5q_n|sg4=c!shkg|V=))nJ}YNK;6R-J7qXzZuxudVauQ;jz!=x3
zHGj_R&8-I|zpLiFDYUD)+DmK7ljUnw%&w%^KIv{By4GCJ(V8V6`xR~*?LxO24T3e1
zvAVRVm=(Q{z1Jq(2{_^Aj~1c`8R6u~GAJC%wd(pMlcw$b(r*qQiyK%NbCrvmKI8?*
z_G2~yX`uu3>0oOY58y_`Bwx`j0$aMnWz9+Nhy30Eg}vS^T@i(#N_Imly6&3vjyIZf
zJd6wV)YWR7WenP^9I|lLHgntf%KV$_>XFmX0E{n-$d;FYwBIS7y{_@7D&bH}p(+3p
zBPmMU9`|pwf$u?I@>Hu2i{PG+>#Gb=5f^F@1>?J!jH*P2V*1tR?7eylM693QMP192
z*&gPTe*XFy63Ka=9T>lUmQ|N<?`$Rl*v5*NDfWjbcyYE?n1qIaPaQk&^p|76AXFV(
z(o5VdJ~3fIJa`!!o!Mrfln~3LS-!KpC_qGFIhLw1&WrO%K248zV}RQ>?ZFunP76jR
z&!eR&N%?0?wT5B1f+M&l68!KQVy$XsA4noT*dfbI-Lup~PyO$S7h+hl_*^;yCD<1&
z!&=}W&8knreo5_RshPjleLpIMDCAP)f~+j|(KQhi*UFmU*3GZ7bPLLX=LZfluIzt!
z^i%H*>+$G54DiFqeZX>CiV@@O=0W18+yDA6bfNv1QU_;$mCaB8!5yrr0hGdO&D9&T
z-R{$k8*_op^k&JkvLI%E7`7e0`#I!!G~2q;+dDZQKF-PthjQj|Ml?I8g{HnhlrawF
z-la<U(eVtCR_C01CPBw3J$8{Xtm#jw`8A-<fQRr29;*(_*>klo32Fb)l5^n%^0&38
zuq1%aUJAt?HMeTsE!wzNxwF5KQiko<{p$1woMrZ?Sps;Bc_bjT9RBRW{oVBbR=vxL
z+PCbKZsbftcX!G~Ys+Ytl7mBS<<Vysi<oC0<iYQ%1qZQ2rzZIcD=W<lOVdHfFF~>n
zZQep4R7f1dVO{f2mD2e}g|MC}YMr`ji)5-!CRt|Pi@Q~<vV1F0-Wy-{z9f(``3*rh
zh*0#8on`TwI-Y1__7DzSR<Pk$;g_fuegS@W2lu|o-#IxXP3WFj&(q0copcrSIKwG2
z10|Fv%@76BsoPEc>?nD|MI_z_c)Ff%XJR=0KlQ(gJsmYL-u*p8D|&#r^Np;AcKw!n
zu)OkQPzdvZvVYUq8w16+=CXbnmVG|d-8z+42hcUVE@q7lNQKF$_=LS=qu}@v-pf*e
zc(AZVOs#ZllwJhWf+v|s_7H*}3Cw1YARU;8vix%wnw8{|jQdf6YUGgOaK^p>CgbG3
z@SQA&*GqowuC~lHI*ndVPK27X0`taDqRCLl-dfZBs0^L089#3=rxYyohiVzMt|Um*
z9)h6WTzZC|<DVqQeZfz{gYVMxG=9B0$h%UW*$C4g6I`iePw0HD*Zr*Fk%BGV<z144
zyc;TwPyarp8~Y@8DFwqK^GNY&Qqlx8eWu}t2idgTO>53k5_70}W7V7j@zB8?&0C2X
z50n}uI3e^kBb&(oWq6*hVsc(tM*gOSg>15ZbM5e~aO32sIEAh|j1a!v$*so2one{o
zFdcHQrIp{FyicT1GGVTP{B=a<yAhtA__e;$rpwQ3^AhT-<|Vq`c5KEx3sC|dveGFE
zQFME?p4`rr6s|K%*}YnMts|E!A}N#Oc;+XoQPk_hS+g|Gf%!)ql}*f0a0SNs5sRU-
za>x&fmej-MlN9?rkdNltk9K|fSckCZ35|7L{BC}}LAOob#|JpKSE5$p`CWxae<4jz
zoE7;EcL&onS$lQ79G+K3Cl*cxLTtClQyVFK7hti{MyDUkp5}@`w9NUK%BFtkL>3Lb
z!nd3samKe$cvfj*vc<sgH|Z6x$Mq%xDaGQcYx_2rHz6Ty>M|$CDq*iRVu|0sGU|{t
zq}wr<>u@DR({X;iK|B4k(f~lWv@E2>)@^aR?)CJrvbYDpHlcT;#*(bH7izf1oShA&
zs7I2Lu%!KJxSL{Q85E1kb&t0#BgU^ZrS)H|cByDLzR234`b!t0iI5-K2-6))b%=IK
zl5b=27h)wb>mgr}s~r5QauX+z3g}DZQ<l3R<C2o8a#*-(zJdY+%|0SDM_-AqA0>Qc
z@PAzi>Bj8N?EO&lt584P1yT{oYSv=DybU9ia#417;^2h7QrH!U-J5A}vpI?(dnT!N
zm^OBQkva8?$*@iOi_|T7R9WNID>I>?j$fQQ#tHGWO&9a90BJvaJ|o#@w5a0<JsuPX
zKZBDzu<U-X&EwtQfBBL3M?`OSOOjJ|NOKERtymM$;wnw#T~*oS7=$mS)_S-YPL{Gb
z|N7(oQjEbT>m78(4t=`#$Xz~2^a+ZAfLTz`^?bdgk~hj_m%j9BM75cul#4iyD4cI1
zwn(#jdVkCXSw7A2E(PW@D*DJ02wit9F)^5TlJ;=gpAUg`PN#GysP&ktbdDp^IB|Kb
z^d%Yd63bq_JIJ#=t|(9FtotUoB0#R?)5m$!h4*iaX}XK2aTujxvb7I_iwb7dMbmbr
z8bsd)W$k{{7r0hYb=tZ+`~`iu(!Ic<lTl|V3R92M#1pcVs-!G8F~G9bkINZ>)Onq3
z2DUHNFs44FHR}iVT@TIF^0=^X+DF9%P_D6%vJ8^g&j2CS5Aa>`03$WKpu$yqaH*RA
zQV;If*>dntF2DnsJ9`}1o$vvUg_e!o3s&eJ+F6M;y{zDqTndzvb7ZJk1<j~!NuK=9
zHv2yKS!S^%y=ii=yG@sVjn<<pkowQ^PAr9MU*=;V)E2{_@pyZZ^G@T_#szvryEmV+
zs&4z~Lx$SM)Yahd+_C${ejfeXj}&l4NXN9IDBcYSFJg6^Hy&63Jo9h<m-E0CfS-bP
z(tpzP|ITgwPsg<UD+ltw#DD#N;X-=EzX|_Yy@oAGE`jy2f!04J#_jliH*-?H<?k{6
zHwPyDkM+Gu!T6QA??r!;u9fI9gYeE6DzB)jmRnwH)9^@fl+t&~>viAeQZS7*LhF1i
zu64L*$pQ&Nt0u5$Z`~;2Fn*K$qx<B^l2or+_0d{hM{_i&qAM+fn6ob4gxQWym8-Kw
zzVQ6D^W}gz-zzxE>o3cX8q8v&p5v(Lx%6vZ_zzIi6#~5lN9{+{O76{F47;BC$EN!n
zZq0cW>U*C@H63m;{o!?-Lj!^Fae$Tx0KNFYIF69b?sdHu_j1g9E`mCX)zJ4mi3{!}
ziUYrgqgML*K*jDyrKLXlbVM0m`;iK~O~)&xji;Mu9~$XZz6I~N*6aq)oh`?LuwFEW
zDvH)tA0D3!B+urf@~<w2qkONo^cjkg!*jqd1HUvf{?SxYz|kPm3_C5qTFYoW@4DEw
zW<c*EMuX{R&xUx>CsBnD5N{VPY`4;Y2iR+&fu*bT@?L1qjUBYnph3Qum3wP#MQ9?T
zqz>N(L|U4{qD}@i+G~xEYiA=xl(C@{eI-h{Nlcxw4Xdn09Z&@RO_@Xcup2{XYtadn
z1kl$v6Y~oRAl1w5Yeqtynw0fAX3$Kd7Rzbyt99Osw7F{sE69E&T(|cG>@Al=@pA5L
zGAgvR<CUR(uL(ZQb+4-#+HB_GVZ=4UQtBa9srL$#zJ0Fu;X$cr924a*h6MDIROGr+
z^pf+uS+8<34ohU_vUN{{2!3|Xps4RnZjE=Snn)IW9VNMXo5&O6J>X=ra714toiV?M
z$3AX69h*ZH4eYHwQB0Y;=u<>5l$KsE!Ff1W(I<!uHD{{`oy_MxQ|N5b3!q%!613<W
z`^?2@H5}D(c@UA}i$?OMjU%*bva}qTt56~?*0}meRKM>*SmMS)6K7LYm}2X?^Nmm9
zHx>{pIJ~kkJEkZe@JZ-;c>_|4Jq?|OqwNhm(ATc&L9Ky-hbgvA%HXREtRy_t0X&9G
z5($Ez6o2I*RTPyW7c`#O+wz59ZB85rh8F+%nWN`5RD4}2D=o$7dsT{_L#z5C+%K2#
z)QQpK8EC0$g7c_`QG1x_&D_HPG#0sC``0J?`9v9waE{BpMuSB;U!6ku$<(YOYBd3V
zj>x0At~eS5Wf0GL9Q8VI)7I0h^Xq};u6)F>BBMlWPc+h64&KEn`g*Wj4%hO|fLX@s
zEvq9p_>Ttl(ULA(-TLm=5xg83PJ-|s1n^@;@&-{_#Lcb0bOOjOS!f4=7q#_9uXxt$
z=-TyEPumTm<z1ObaE&)M=YEzVdU1p<QznAJO57Y@oP8RLqS@W?eg?l#ym)LIp3wb(
z=J?_`j@Rcn16LII!~UN!^|kD|>)l~}baTHe>W@3p6>l890^I{Oo|_#+h`mU7EXsFl
zc0Ros?!&IFKv7~*^lPq@lM7!DCGUxAgRL>BCH$(I{K;`t(>eTyet#oMYaxQSIB+yE
zQ&E)N*zgrL@x`V_(_tYsBiFAv&Ocom@u;X2tW&q2NZ-R!)GCb_r|;pPF40IK>J>SC
z6hkYtYo(_Q;RC<K%P4GIvR(FFOhKde%}u39Zw#a_?0{jY=1>YhFrV{YTFO9i4SYAQ
zJt=m-PW%D#UP+M~-SdT~Zj=J80OTfCeuk{GwdY9Rl=HF0Dcd$-meV+mX20g<OX2Ii
zgfLrJwbG-WOTTaTDNCC)uXl?tJxd#tfdTkS(aNjmdmS;pJC0gWr1mL89`vJJmWu1$
zE@a@ycb<@IV8crJbz60q?G6Aw6L>d^<u9i*4cRzGBhb%x*N8()eTJqlWsbD1+AS%E
zK-ULiZI-_dWJ=FL@au8(Pja_#cP(o-p@=+0Mj|Hk8*gYSrn&b;r^<CH_t|>$sh~De
z(*BPS$x3W6Lil`+0nZbTI>}p%McTrKk5;|7q5Bu@+Ix*hQYX?Y<2N0HVF2WBluyvm
zi@^PK&{^gQZ$P5-dC<Li0!>P^5wlkdy}X>TRVca&cHv54+q4)+p?@)y;Dc<K3jwVp
z_?$J58nqQ|S)c>7_qcpZJfU9vXv8S*y(NodFl=}b4}5;;3duYWYH6pzJAo&qj^i#Z
z?e-~1w_F~dtqDfIlV};{^;Nx{D_@j>A-dM<ZJgRe9cC-GCZNw!RyH@aSN<{~$8Ej0
zLKT>ss+vYUmm-R5WO-3%4b#5JW-(t#O~q+gny;hHTKBoAeg`(vr-Z_5{nN6vs2AiZ
zY4Q@VB-MQ^se@wlBSgGcVxwrAW10?{o10T+7xAWhT~P>-4?*Hm6lxnmGd9QUChpzH
zaXMIe(=+>jY3F|vdKTAK9m}#JLtoF#Tt`8G1EH%OPt?u#S|6oo_DebL6&H_|THL29
zpHp9AQTJ>ex04NqW(^0d6;TTC^<wtiBo1TKVJ|PqtlQ2Kun{_z!Y-1*^oLbwR2LN8
zCBtyISK|bYi)s+H@EPFk7NT-V%j;U@(94d}(DUA@&ZB{_D?)2T?AnB`EBBh%uPoMR
z5889~%y!YoB=9p=^d<>fA(zP(b~2XIDz?i_optMiUHZ2ZHg;hwi~M6%mGEaGwT?1q
z6Y5>*_>T9olM=p1*&tNiwj^HPbxKNT2Zl}%wU~pW_s3B}V!UUcUSl`x34Y+S_C?X4
z;3+h|)7ZL&&q96Cm2j36WtoOO6DGmTx?<@}uPYR=UN#eE1r^#3L*7(UBbG*I#{{|a
z#KYgTyY8XJX@~)Z6OjFu3~)xT=((R*_~scudvNr6%(CuEign`kV%%SfQarTfnu>Y)
zVam#3O6z!9Jb^Q^fPQE9diUD*tT&Ib>}(;Ww29uQ261T~7l|$C!aIB1HsN+1VH-*%
z`se$Wr<HNDFJYI}%4P<76yytj8NUbLux{DyIJC^HKS0`gU+o8E%v{J^CeV0a#6f3Y
z{$pcg|NO_V;Hb(MK8=<zd4g3c7(wshiKp)l``+CsP*~dD4!g`)ep08=ev0XS(aG?a
zqU(4GwLhw}>g4_YF4LnQ=c798sj!wFz_);b@$LEi%?kkck(jq5fbo3g|BZ0p?Hvx3
zxU#zBwyp9HfUSd!NavN-40-*LY2nGoJSrK!`f6*P-4_gsF+quwf49C%KDquJNBe1B
ztC**7V9doRH{FN&=G%$nfb+c2q_82N5UB#KnJC>;=RBq4P)^hr<S7-LjC`82W20Q)
zbo_Pb)Ih0<xc?^lTv`6LMn^ZAL_5Gc&VsPlzZvFI(#Rx5{3*U5X*%x6)rzW|1-h>A
z9bF=k@TR6_dNQs!a6WxfaCLju%cb}7#oPoQ)lKmbj6`Yxmoaig+r>Q5Z!cU<u|!E_
z+brJCJPPno=2EM`$K?pp?o}w5eb$*3?f=6W>-(s3;5sr=(5g?O`s4w-R^DRCpQ{wx
zmOTx&rtd4ISgs(|I**gzxCQyrH<$lCa>D|@sd*SsF>0Ajfv&Gt{-iV0W%Dgg&l?(t
zUk+2O{}89^W)Wbqv#_r%e%~Lz^hFRX*#%xMs>HeFdLq_tbu>BaA~yW}qdXRFwLXhE
z7LyTe4P8)=ain0o&kLqWrB^W^YzWuF&E42?fQ>Uy)n^`Rv#)&<i`g*RdewLV55FUu
z6Eg}HYbW8j%y+ulH~QPen50uOM-yt)rv0}1F8)fr4|I+o@PXC6No$prSKd%(shU_@
zE{Ad!KI=LiulEa1eUC{_su0#UcX=L1YC@>;eiiecaf1nb%(js7`LQ0v`r(`%L+3zd
zUHo+VYohP=5>9MNWLC!%Cs|~^**~oI3S5J{mG$;39;=04J9z5hjIxt%^BxvrG>oRI
zJTv#d;4R}Hoy*~{Bpfm<5qS+Qc9r41xmn{=U~#_Ts(2v%`THO@XUFGn*i@mLhOb>1
zq7;6H1n<(lTzcp`f;AfVO5^EHQ#kLKNzZrtb`ln-0?iM-e{umN$e>Z3O5J>od)mq`
zq<ezID<_s>aWAh2K4ljA1x^2=W&0RBeI>CY75GBx1}Mu50@E2NEB6E+O&HfB#t$D;
z*`Xw!K5Rb(GeN5pLCaF53?+15Ln-{bO&#hKO!ZD|1}nSV#EM^NfO)L=m2D$%Nd2?p
z&0q`-wZf*!R_%2=J+C}Vklu2;o^~&9nk9b|dzO@Fo)eVLJ*01ufOHMZnkEjs0GHI&
z(us#UTw@ngT)>ue_zB!5$0_WS6>1kkLxsmKA}%`O3Nm?BIkAquPuDKUj=E7hM9y=G
z8i#oPlG}gGkz?Zlxw(F#Ixwv{`jk>4Yl$ga-{wUbS!Kg(KhE-rHw^-D<ty>iAc;2e
zO;fn)vp6l+fv%HF4?d-}=;C|I-DV`tqR~pF1hH}*`-ZNnXFtseBCeHq3CN1R`9IpJ
zn_RB>e2P_9?c&!21jz%kA`IY8^!5>?V#TDYv>}1QoGCr8oS=A|20<)r$$`*x1p{Hx
zt_?p4PRZd15-cy}WtHc&dd#9mbC+Ap41IrI=2krn$aHVc^~d3jeoQil_&GI}%)MD4
zoH6rl_^1_BN&cofZeuLjD3klsK2!$lhHJtY-ujPDj3xH+n-4MmgH{NL8OoLANg;aA
zLyCQS?#R=&&ENhLV4RZ>-M;(Z?AQ1&qfvm^%J1ugeGw_h^sn@KwH{liGw*sR{P^Qp
zTVam1O^xnc9>m=Je`Z!Ut?i~FVz*FtGc_Bl3yJibm?I;_BpVtjwdOuMK=*oPa6$N<
zY(nLNgq2KVTCDm_0He+|nS9eZ23$ZS`EOO-%Rg~SHd7^Skiyf|m~YEiLox2n-@;xk
z-n)~;WnD5wux<U4{~Mo>o7akmLz=IPv*Q?3_RO{?r)A#E<3cB+s@g18kZq{JpKb5R
z{<kyGSpr)IQ^JJQ>UE+b)-dPtdVwt(ec_~=<bD{x3t+b-n|#>G$q97UW2<^xkAgS5
zWH78dp>-*#wy-wg)BPh%Nhs(kEd^%_kJvZ7cUjXo;J#PXepl~4JfkIdf3?gQTQjfp
zIH30MOhO0W2+UnZFc@HX;5zw)PfRY+DAB)fh8>O6s?veE?U{fzXK?6bZd%KRuVrUY
zNJ&M7XmocpG+Y3o7C}wNIUu_J&r|s8g=c(zc5l`CvSVq5rDl>8x-CK%@|fy3TC)Q%
zNfLN%`voBB_+llf&yMG9GGh9;1U#u(4}iKc_<8sG(votv7<l6oGCpZWu%=bQUCrsY
zrJr@GQ>O_veXbrH*n?#C6@$}@=J;w)c{Uyb&+>)y`TXyya~kxL@AmF4Y7Kprfj$>S
zuc41KP{Rp&9x|x`N;E`CQAHlT1gcB-lK8i0CPr`=R3mhQ@dtAWrPZN$y5&(lS&Ltj
z_G|V!G~-X?cq#b?yZfn_K_JLUPc5Xb&TH>*6tdVUd@cr>zw&ff2sa{W)^<71Jvj=5
zR5RgexhO}?d^lr8A3>tfH0IQ3UC+Ex6l`ZVM8M27Dl(mK4^jcLEmU2ZpDK{Lt?q^a
zIGrp`ZYs!6PfVPh_xqwis8)DlQWAc~gVJ{azuI#@X+3H5wYcJ=GK)9xIQ+bJ@Sve3
z7&8i_PmCFC<f5LMs*|eygz#<2X<J|Mv;(&~NgQUL^`Fcze9^)nwHmrg-e5sNPPspA
z6l3yOr|jRTB9`o~I|qeh(<ytb!Qh8b<mc6$Ub(8<W6;j>KIQL?2+Huke69H;!I+Cv
zg%fr5%_esk7!+CibSq}Py;d%!7l9~Bqt)e-#0Dyz2?b5;B=s3;PPrks=h7*D(UK8Z
z8UbP8S;1$>-H6mq9G=BoU5Bu2%**$rOJBd<PFD-SoEEsw_C1bDuM7(<*#?%6Ci*Ek
z?@K~5iH!0r23An8`1foBpZVjD{E2l<jI6zS4Q@;GgF{1|e+F0hkwAtAGc&UUCtsj;
zP1{9U7!WcLVt+TuZ&=0T@5podxW|zU4z)hWgFq~e><Escq>)pa?wtbZEWX&D?<Ho*
zykP=Woa$5dN6X2a_c!`zZ>vgS<N<n7i=)GCkRn^hXAax^-VdcQEDQ+GLkZ^6uwFIJ
zMk%K+IGz$us2ILZe|S}u%-48iuzC?wS%ZZcya+s&75&^mvudrGS<9d>J8#8oX>hj^
zUKYZs#*KC%<kcV#Rogl-r3W5Zx6boO&*==um7eozeYJ3MJtt>++@!CPxu|(Vf~?-L
z_m3YzTfUz-t56f9rbLYR9}?6&fCMOTI6qwJ1OnWd`5c1A&kR)Xz~zlz<F;6aqQ|Om
ztDrKzQBGA{yvTG)gpSX1-m-#p;f8{{q3_S;TOLAjP43{1sMCIUud49$k*NZxYRRxL
zr<0}5Q_wZL_uZAQ%M-I!QAWEY9Gf<Gcf-|-LTt{F*|gMeVdG$Z!S9#nlh}zjnA~6r
z7`wuvl9F_@(+)eLcLKcoOzQ%7>>i$kE8b0ID7gRd*Z$T8Nr_$*GyZ!<GghFmktziq
z`kWcc%FjaW)Qq2pk*QA1Xt&?CiH&2qP+d*RPyhbd9b{-p0kO=Z(d^fJ+(<KXkzdw|
z0DNWL9OZRL3F4j8aPsfsR5<5G?rC|qN>RS*gmhs~dcaA{h{9*R-G~4I&&?~wcMsp^
zw{I{$Mt-@OZvV~N*8edI`TyE9`D`#tN-rxI=L8RsrWSqNl3H_Ed(3Ja|ERyzY+!hX
z=wTw=iEJue0K_%kAvf{7E$qjnp2k_PUEOibqWLYwV{rt?4-&DTF;cBL=fybduToq#
zV0rdN^6mDFI|QiP_gI?9vcX-7^wfy4E*nM>@6^H(6;pQRrdEc~<d8;fYn+G09T#%b
zgIQ-Or(t?K$mJhiFGy0k2{cMFZyxvy$sNFo{ov&I06y80j!R}@JwM4>uyKAUCe?mt
zvt1#lCWm<VUB|(c7f%Xzh(ET(alOg=#b0=`Iy(4y6GPJidR8L(OOMrh-Y(>Tr$Jl!
zHPnS^-{2q@xf^L7Mk3D*q)G~O&@+8vbF?HTw{o{Qt8g6zb~X(+yo(3=^*WiXkWpgb
z;9XNWhyg&+fA7;;DsaZ?M1(3T430O4@R@wcN*F9=m0;!NpoylVY6wKBR|3`O7%g>}
z2-O^f1Cpk(0EHQ_5H1EJAE-#uQCeB0DYPf^sQP_*Y8A&l3^%SICdCIrh_IClLO$AE
zvsND(<V737qW8ig%7qPd(qtvC^^yKE%%%+m(<W8OAT|EjQB9!et#RD@{^z$>z7gII
z16R(m$txDq$18i|_!ycX3*)7s#8pM^uz>(=LanYSAokky9(|TIY8lwjm^j-0^;y#9
zuEpKBp&GF53oJwKrTt)BZaSyMP~#*!zBDzbC<+KHXuNT$$MANY{K5tJ)bJicpjI2d
z>s4qX4<RG2ox}I{9P_TqgJA*zc0w73@X|3&)<`DUtXtkQa;9dQ_a?66;Z#}Aa0TZE
z<O6W6{3mavGV*|8T%IbgI`ApX?99GIk11kbDFrYq7ax%^O1|bM&)ZvlfwgGUZvFgl
zK9*FW4d1#A|08q4vCsMo$xR<Y9L|f+3fu0Azaqk~*v+0kz3GGZHz1$nvY-&a^*`Bz
zxW9kSKav^`x5A%m5)&PAewP~Q{zazmF-?#*lgB**5tY_XK7rmAhV=YF;U1=j9{Rc0
zagfn^+_&mA_4Rk!U)9|@5`IwtO%9b|l+7795}RR2dKFC;)FaY%LX-3<FQ(W@H9xDN
ztu{$cB!fo(S%Qy15mB>Szq@nWeRdWFiJzQdDYk@Z^wb=S`RmPwM#TSSEZm477%PlQ
zsgtx$={tVDl_Z%y(WzzsdO3hkMwLJC){JuYJ(Ykisr>$atfAPw$HJr*%C$KBkslz@
zx@tc{Xe0S9?8_`il<O3P^*U-c3bQzIV{Q4AznuuhId<FJbj3VYczcUcJ)t(sIT~y?
z^me4;2plnI(f?C=Ov&93Y#7~3Up&x5U?dvNJvXsWuC*TiNB6G<;37`0nV7OYUK^i6
zsM{|N{0Yy(*D27*m$zcehsYdN&%AZc2_dYgLNH#m_VRB2x-Hw2J0#biE_}O^Ffc5n
z{vVF^|3$Om_x<|nBGs*WQ9LMdamMjwn0B+wc&-^TUL8Wd!NqioEJ=v&V9v|*kx#Ao
zjWE`80&4SYz2gMtF$yCay6+N+@-2qJFK#L^Jf8$})23^C-OYA6!%EDUIPbUUKqP&(
zZTi`e<`PSd`X<v4y?CFt@fR4_-&jCt`F()AQOGZw>*&sqn+A6bFissgr&!h1hf@_{
z8~f~h0)pl-DRlX|Z4>AxT;zB5i%zZ#YB?;4EQ2!`M9T?YRHoSt$Iq1}w#ZT~uOW6E
z-}Jtz_@YvSm;5;}(<t?lK3(oP<uRz#i0Mk^#+b7PVPWuS))hKAr93Hp$ZVB+WR+EJ
z%h=jnYz8k^{z1SbMo%hv?b6UlQ^<j7b?(id(#72LPc8u3^OiZyTACX%q01)PCF`n-
z_&MuRXlHqH-G<tLIM!d$>9SR(PmPs*B3kR8-0_>-*^MuvArVCm7;wdz<m+lk?u^1Q
z;+DLO(a7&b_Y1HjYRB8{tRSGM*fXO+nV<nl8)6@{^bHqi@eT`DzBo$cV%>A@a+bI0
zAY#vJP4MvKRam~~c3h;_0&m+uFQ>`MM8nD+*Bt5YN!Mjzo6wAwX1C3jt8~?1zk7su
zDi2k?vvk=eJ;ZrBD{JqUs}*~6h{avDdT$A6t`R<jF{7ZSvHBQ6e;@n?c1pY&=(#jA
z_ZTwxZpP(k<$)`r)smYwL4!q8fXJ0-ur-#)1W}C_Ve<^U|8tt$dbA?ihPkltLgLDd
z9@UkK<7yQx=4N^(pUl^?ZD<hIM^^xPpQki<_d%r0;fvEBUArgI1?pjgA0)7Hpaaf$
z)y_^vc)mTR*>cr6dBHX8?g2EVNg>r7DlM5O0v{iGR0Dm`$OceS)wAA6#P#*{9O@K`
z+?zxH!SiA3d`Tu4G$1Ueidzo1#eo8>gcFXBWWEBU!n1|t$4Q$~bv6+#nX9o*CLEf<
z1abDuCXy<%Mxw*sR+<7#PLF^iG!&=O_|UZKby_Hyg~=R^f<zu)-=B3=vDSX(AFWf3
z!piY_Cp*gRJ@-Wp!rE;*EO4`bOs{^~K-kmoVg~W?>utrQxph$b3ik(nemLDB-=>+w
znk6_9s;>hvxLi5CGI3s6usfV(h!(EG3!D*mmg!<r=6%EAuI1%dWc<<yuRQNlyr=mZ
z^}>f&lrCEr2MT6a3ySsD0yZ#zb@mOfjG#&mwHEhti<w8n<BW;eIAnGJHkp3_SV{#a
z5dG^e&+Gk#=8yzO+v`ontipZMiw|g?GD~3)E#7c_mbT-bSA&i4SY*^SqoDzIq><cM
zRh!0lwJ$H7li8g)(%|7+=F#1B_i4}Df(ov?$V=9dv=ER@idy&lOW&ET6rB2A(Gd>&
zR^<;0&un8Dn5hv;(7IK;DMq{>f{x`YQqm6Uo{F1bbc$J?s%y=Qr5q`})Z_*ZHHph=
z5iyrPs$@pE+NrR(uYkxPF@Bxe%z;0;F{$P5%DsTuwp6){u1pi2m=D&m&wMAc#}$We
z+TG|L+lRE^V;YvM(%XXJ5X#5DaCihv0Jbzhr=qfDrGGgUOyl!e&lhNXnhCz}M9}n;
zx3dG#J!XvxZ_Y3N)XRV6RUS*pvA(i>zNdc49T!ri8iodFTZE3uP6hpVyz*NIiA>%M
zm1f#}jiazd=4QP7!nMS5Hiy9IcV7yPkg4NieW4%u1xm?S-Z}Gr3a8LBI$k^tT6844
z{JKoR&iT#j1%rqRW9+9RAI3oGqB11g^V4I=_W5tShUL|B`l{3Nq-DnPe*W9y){0{R
zvH3RUp3{R^4n2m@l8mp-qPrDj(amWIzuS5B&lYi>0+{^E(TyzlWVc}tb=EE_A|P;a
zF%EC4uNUZix%=}+WC?+0VuosQX*|V`>9qHwD&u1pC|MUtx9`g0ZFfR;Kr?^dovbbk
zoVJp2;JQQWhh`|$`^`T|akee}jAJjI4&m$)a5uJ>v_Z;;F{!h1Zl{QEVB-|xB`HKN
zuBROJ&7OL;XFc!JwD2^^CUX_)`2w~n*Uy-5q1(=+5$)JwsW@PNAn>3rZAY&LVM7$Q
zghd3}-B)y)HSR;!UA)9z1Hi<WehOVxw(8ZjwY{0TqlI9a-R<p;@mSVekNo>7yMo3P
zg_e0mnuX-W!{5b`JvZ4&_IYY_0yZk}Ndt_3HMyIG>N=`b_Yc{7+LAI)CHe`4I&;&%
zGbn1E(!_kOM5Kt6Y8ZBG8!JASjK*9z`w@mIt6LNFV58oczvD^e^xNm)>%Ye``vOP#
zK93huHx3vTgx{NL{9u6SM9nl$G%=bpeP^+I*OHcS5R70l++N6-Z*0%lJIW3Y)-;?4
zQX1U~8!`0v-OE_XEFPV7U?OwNEPVAH8e;O>)9zbVZYtE2JQqMtwb$se;c145bUCXA
zM7?4R>Kv`m13gsx3~}$=P_G{Rl-h4Ly7lo5hk{tS-gkGo*12$z&!Zl1v^!mn`)Nt=
zO60ij*smdGS)Hf;ZVVZ_ywYb}AvkquSnC^}057L3dQCn^snvX2p6E2Sy-T;b`E61h
z;`uFA-1bARdapZwN>h5@$LHF)TDzu*71-+YQ~EX<7hhfWU{TIL?oq;XYaOhKeEm`&
zV5yvmdEVyI`O?Yql|&}djKrn4g9|Z7Oq4e*`%^Kb;jUw|K&BW`QA17WLdfI%^gF<J
zet-IR(+yZ>zz6^P48<?6fPjm!w5y$kF{95e{OzypnP{qe!8Z0*q>0ZEzfw6IQZ#Le
z{+O<~G&9ktJ*qa3?Y)(DX5ih${r#->sSXF;BbZtd?*);q7L;d>bv$gLRd)JbyAN%K
z?RJAGPK{i7%HtBQcU8<ho=nOOqw-GC;Nl^Cz$22~Owy28{KuybcG!sD-co)GjKcw=
zZ~jdU&qdgzmiNFD38IRZdic`;>TT|bgSnW3-^rKtOR)GlDadPjLM`LZIZNuJF7feo
zK{R?Dk4z-3@BhWFi*uPQ>Y6jCp-r$_9upXIS*|#OIk4w`n)UI>N$EdTsLbns7iYOM
z(dgo$M#ARiR+M(t*!h7MYwXRV)O%Z>9`@aU&M!wml9c-ZBDyR*k{X22b%z!f)#1*_
zT9k8>R?+L}=EYQt-({-(9xXQMoAi_*|4GA9X~FYu>&z;c{y;Cwj2ibTCYEOf2h~iN
z2TMw^W~OA$+yqFgVczUcAvNpxcPldz=&9>U=<4*!wJtXx972h_yiWzrM>zGpgQ{;m
z(f#Vxq+j6dD;m<)lImtXpBhr!BqVx6d;E6K2BcYI(lp-3us!cRAdhpKYts?cxraYp
z>K*3Q@kmqFXtikn3k}rz@vL3FibPwT(l!4Km^O2lHg6{@=B?y22mEUPYcZAhjw0ET
z%Br0z%#Ia~1<4voIxDH3flSGth_}#UB-ma~)pb<R;nc%cgd&aol}1Nci!pDZvD|w8
zIcC9LQ}lqgX>D~y{B+Ib7@;;eD;i?UrP}hMFG^p*wYr}6!+4rkZbV!c_<n4GI()$5
z21<R`156aHy{5}u6bfbQdpUiH+(XY}iY6L_$UD2XtP{DsT392_lV?oNurwO#P~?Ji
z@i}m$6nxuJ`piCK85V;rZIWLO#LFg+_F^Ajf$2m9-fw1E`V8!4m`-4$=eua*ZLRqp
z+@cCjwWjdLctM^!#-cReG<POnMlP_qFvt^|guc1@qg3?KMFCcBq{-UyiT0*X&4B=a
zl`ReUMI7>Cp*eU_XoHwq>MtKrG}(2~bM`RJEi6))gFf7qQc$;gSP5eLuyDM&IL;+g
zM+p?hG71(){v^#$r>-yP@X0I?$GsN+xzh=*PVA;aUJSBqTp7ibyhLc_?6p$-jS?`y
zo|j<oDOr?wd@crVdD2g6zg;ZB8N8rgsZuCt8vEezlq>g#k6cvwWFT3Lvq*QW`OS3f
ze`aiFVClUBoWT3dc)eStJ|~b^W}_$*GTOO(!O|jj&KW}vqp`6)ZCcr&HXy-04;VWV
zKlPoI+;nkmT4zBy%?RXNa)Bsku6tCwu1V7oI4#%vF@v8d(;CtT64i<6jqZn;Q%H%m
zQE<qI?A%*&_IVuX@RHz88fW-KdMF?9+UO@r8Hx|@L$?DKpM)pJfI5UDKsmBbg+?FE
zz|Jp4poW^jPWFWa2QX~M8h|lgqCuanudi?Eqc1i$H(!N?7gf1fh3Rz%&QD~Hea?Kb
z;K#n0Px-1K#J^|@bL+1+QS8XhPMmgtx*Q2en+b1I&#;&wJYSFHZx>&vrC%ljoA%;S
zyhKu9#ivOM_0es1JS(!!7K%IwqI+lM*03Bg0=JY?U4pl3%Ql_HvL&P3J7nZN<48Hq
zA3bEhp0zJYeN5!&+K@m6<pg>Zqwgy#W1`m4(UI%!%sJ4ft}ZUiR`%)iWC6yt<HWR=
z>SvX4ByH07IVjiHGoQOa?3t>KV{VR1gwk8JV!8GmnB)43%xAdfRoH65{q8ubZ8*OR
zmLi6E^*U6y=*V7cZjC7_hxFtK6v|KKNSBEJ$leH=t&Xd7rd56yK1%dHjg`}>!w#}q
zI=I1kV-L+=0bGk6-KmM)xvpxKiGLXcby8R%P&+|Nq2rWdmDMN;=F#Lj$)AcRp#MZ+
z<E|~(H<~uOY($YIp%w6HJFk!NTx#gDQ0<#MWkp=;Umw_bCrJ#Rj2p?wpPgD3eJ8n)
z$0TaTp9qQ9DmB;4)q>V_7#BbHmxgo_8dE4I(i6{?zfQ~LmHDh$9U#dGo9TYorEmnC
z&p<xg{h><p{`+4J8bxpbF3$`MRdbTwW`mJ89tbwloXF2ED!4`l3cDua>5i%eSpQJe
zUy0~663cnNJXUsnH%KtKRuq{Q(Q-UxC(V>uf5Z69hXLj$@OpE~8Q&&W!1(V@w^!z5
z6{an|=Ug-PA=$pR`ZFwvZ|iHNB=MmfKC>>*zLbd+{|gFb$Y@bU>Vx{~?bn$*kh*M1
z@@m15%XynAZLUU*%xkjhknPWdlA|@!=_3X*F{gGWbusY@TAyPef16kX##Nn6WiUA_
z3eT*5YkRfOahMU{qYAW&Mu{1&zDbhc_6dO(*c04Lc%{-u4w!~p!{GGS)olsx{@pUR
zzA^eYK@^~xga;Uk<!ZLw9{ngVH|GII#jf(kqrpy>nK$P_mHrEQ+Jrof=l+#RbwFXS
zq0^sgs#tNnMm2MQGx#JPEd{NMhv03Kao%vDqY3H~uo-YDj=88-alDT{oM0j`>DO8;
zokapnM&#UB(t0l;<)}K<V>*Mq4Bf{%3P`I^J?7(gDUyMR4NjaQ80qQdON~h3nZx&#
z37eA99fAY9O*Y~D_N`++#`aBPCvr41sgCpFo}@#?8&m~n3^Rr<BPk!!OB}l2OnH?8
z=u2+W1*(Q!qQ2|f^qpYsZ(U335_JyNy6$4@n8843kzx5>W4Na_37?z0{QI;*9Tn;^
zkIcFX-X8aakV`){OwhjlzML>yyEWgBkgtyZqYEsA#FcTz`0$LEUMPjmoquuxVr|<&
zSNqoEF(Ox)0WZQPnOpi_i+=G~>76No+Qg+s)benS;<&4|*-Tyz)MEb0c<!HYlWdIe
zF7ETU>VB7Dy<qMFqh(d~Ex(Mb`l#dqR#2i=Z~;5gD$LVavrdJG7fw8GYrS3{qVM=I
z?q%h`!GZnHNX7(4=!e#RRZQpJ+_~Lv3Va~^*sU{eCtIuC%|jelR?QUKn{WWKXh$Z)
zmtHN$)awFsV!5A2McwTKDmDD}>Fk8WUr7CYm?z=*RjGBfgg`s^165QYY@o|%e1npo
zX>LC&<dLpWbbr{APA&FzP+BXHRN#=1Bu$ra)f6@uE~gPW{){$cUh~A2+evBU&i}#Q
zS4Fk;w_R4D6fai1g(5`@6xTw57I!GYU4sUfQrt@^ZpEG8!2+eYYXTH^2<{GZ_`max
ztTh+2X4ZTc-<qocAvx##?6Ljqjeq#$_$YU0Hc^&WX_4(7D}$fl=4?Hp63X>1m^*eW
zJPtmyYtVxC?BO+pLBA_0;wp&0snm*o0@GCa@_FA=-<iby*i6xDpjm&2oV;M8Lg*#8
z#7w3xrtijyo@7+8XMOrxbHM#bbbLY~7E%&g+*@k(1@Eq`VQ8AAXQF7gnS+tHD%=~&
z5mb_}El|U%?mC3v%3|;s=+OJ3aSg#dm8rv)_*z6>UtG>)K3l6_JmES8!M5{VQ1hPo
z8%2$)rl$KDk@#ZI2xRvJ#B#2l|2xvEW*uHqa*N2`;w%+H<5cR__WP!3*ynOslWb8F
zwX+F!iZh_aj`e@mGS!x-?dGQWsBxi;rA$(4gT7H<pR?Nj5Sy9*kSpT`yCQ3p%6oXA
zkj2(6JglThYOnx-)n#Q73-CZq$*?N@^ie!t=Saf(K-_V=YoHVjt>_ESDsNHNN{Yq|
z=;t`p?~}9o)|NaRuw25u1+OJ|sP5`|q76j#fxh;NL`>brOubiDembw`_i!agKy~wi
zJlNm*6<kbpUe4!8+H!$oyQ~QUM6+eh^~D4%!jml3wqAI*dUQC*vL_Ur4M6W(Q`!M&
z;`k+Cg?x{*sZTuM;+gw{f_q-e<nu49#QJR!GW}_XSw;MtsEV>ej7)HdptATc(#8^w
z@E<;33W__Q6mi3gFp6ECx~yZ%`W8>&cm3JyT0kIZ0L}&<ciLJXz%MGEdz%*yr0(Z&
zc&#VyB8ryGQg2Ym<jU(s<kK6tPn|^Ibgx7i@-xFXR=!k<Mc=FWEZZyflV&y(BSNcv
z(HZT~J+v1fqTTj!)Q$#PhhrgW!PBiLG@5fYwG(RCHmRDs?x9a;cXv1UW$fy*V5_xL
z7(bg0qvR#gl;_Cgs7Z@?zx9te*2i#b=uWY2&WSRE+GceWe{Lmx8VfM8)`UEkDd26~
zv6zu<<qvbf#yC9mim+%}R3hovR0(xyj4keSmZCGrmC9~$*)IK!BH^m!56?Pf&sWs=
zaF_ap5m?`bHC87&725L!iH;^e@p2TbMc9);ZA+8F*3fR<&@V9Whjf7-E|*CxOH4Mh
zmwbh8vRM>+o0{TNuiwY^QEIMa3Utf?E{vQgknb<`y|TO8@x5TblWg8_X}r5>xjSpQ
zYHT5|65Ef0<UIXQu+z9-9G+>?<_?`oP^ZhD(6J%mLGzE8FQlstmMk3a<0i|pWm=|{
zGXEa>xmdpsX@nj&T>r_w-k|DqGFhD=5x;;=yRp8sqnTQ`Ak4xW_7_@uvi${tZS9mG
zWQm2d^(*m<C-~d&Zr@)Ihs=>`=0dZd;gb!<UfvvqPlNNd2Gt*(t@@`uQ+pM|95?=2
zxwY#QY!f*mV#8E$7%Vz6z~AJ0yXOcxGa3=hBCA!CSkBoFmvj{(fK&=tPvxY)Dw6o#
z@Vqw*S~e6pQ$GE3!k~&-dkzD~Oe!sgmCrdgJ~2ispoKGy`y-iM1XY~Li`B@TIWI2W
zmo|OsC&!THHB(Xn^$HgcwYpz_eV*-Q6Up&8*D1kd*l_pWO7U^*gsS<LA4Kv+Ih}lf
zr^N*ezCR8Fe^Ym!AQ4TCdh3qp>r0h{5R`k2&K1YLxa4T22CzK8!^8h)AKY0A*S-*B
zZX<2Q2!8U)n$i19)yNJ5VVtx{>T|idM)a-2v0$?@1QQPIZ^IvY@fzA<RMD2d$L|OE
zt`Rl0%iM9;-2*kN*mGeet?@T!Gqt1&+`QmtPh#E+SByo0#yC&Ru7d5Q!@yN(%&V&-
zj4<W~d<p$^@<YnTA4SaDkt*h_wMA5d*KGjys#42ukzIU%$%LB^Hp>JPw1xVsP&hTn
zzap9*{9U-|Vh!Jk6nB!`-lTsQXT!reU8bojUy@h!=>zx9MiDW2y&j12Dq_-_7*!ew
z@6d*^MM<_|P|aY<#Jx-4yIp<bEP==RVjt4<P(_iuEU;$Rv5;mWv#iUpn69eIMF%sg
zVue8#LVU<c7H8j|A|?*3@}c7R$v1Cagx80gJ965SPlQOU(xX-os}8+pH$0-qxK&6_
z(n1oKnSDaypo|6y5n`9_rQE0&;B>tTxgX{KDUnB%Z-f%4d=amn#_pWkw)bwdv<5TM
zi#_wTZ<jTEzSNxnazmF7^1y;{-B=*nOSJ`wY6HbLcJ1u3aLhx!Gtnh=@Wfr6UuwJl
zRv(x`^-<Gqf?I@j{5ymnWcC(-W_OB{-CE+)&XAVaRKJ2XN<%K2i_X`J$Rlfgeg?(b
zX~7m7xpjs2CXn<Nt(j-_c669vE`JME+#`TT(_y9G?X`<!WkEXU7($xKQ2`#$>NECe
zOYVG!tZ78;<Zlq@FgP%tET#rg$wdn}R5<A;q~zz*RDn$~!-|-GsciLQRwP&lg0$ZV
zORrW#47n!dTt@7aMl8XIaP>^+N@ug1Pge{vg+dSy5a{P=sT(8EWQwGD-gcu}ut>i7
zPe=4ee^X6GQj=D7>bU%g;d9<bK&V=12pT)3WNqptMmBOdXbjIj+NUa;??;J+$Aj$#
znis@bdx1k8Ab|T{Bo;lACDpl=5%QcyuH~<+nZr3(wCn{V3Ygq<=frp2dF^k=XMHfE
z@b-3nYmGg4yA!zaOB``vR-TxpR-NM=>*`}?6=&UPJfuk0rG0Gc#;4L7Yo0b~6VL)s
za9iPVpD|6A<U2n(1!u?A_#?cy#FT4J(aCtww3SE4F4AgF)eaueW+^_b7^Z(6M9OJ5
za?)70_;DtWDbw<*f%$Vab|jq=t-?kkK4TK1hT-+gN^0V5*tgGRt0?Xr5}KRX<3QL}
zS(WD8B;Ei#^O=x|WS)e-BbPnCfbC;cERMut2ERMY3cfYc!^7=|O7@J)<?Bdl0&a2L
z_`#<uPccV0_^$CdMpaG6C-clq2#8*xoq4P*5@pWn9W=%VfUYA}_54YlPLhM(6M46G
zh16clSP^hV*qAq_K~w~8tb-5kft`=;YY}VQ4pwV18CNb<zBg}hRL@jkYg>(^i*w={
zc3lBP#HyyQ)D<+=L*V|381f=L^kny@k|Qnj*@vCG1n=TOQzVOm&FiDz+Mvg-19jA`
zA6sWWKv(3$6YBB{HW+hr{c-o?A#F`gGZ;cp1XZv^gk`H?B>iTTxZwcdgx{ZtZDl4%
z|Krbtw~WIatbF1x(2PQmj{dT?fk>ovEhagu>${&s5PY+b^{_hb8Av*639%0%_a<85
z(<S@X7N|vDu+w47_pY+E;f0{PyY5<YS}oXZS@g-&MA|RS2yP8C3+1D86L0!e{s9uy
zQuU1aS?|`Dx_qECQFBBKvD7*UvIkvjWw)kRie0wp9cvH|Oe?fvzZ}@lzPhP+3zScP
zV*+Psd7bd0@ougFHs4He_uoBt+h;$d3f~<SAgN;V+j}L)2X<;xYpt=zGR>4ed_qFk
zg1Z);5f6F_H$0X8btzzp8P)yaSs&417A<en5+b(?ckCBuk{CrcF~%E;?DOo;E+?gj
z9}ruDv_r!|W2jDY3Phn~N~)9;>*a8|`!j#l>V;=dH2-WvKFF2(dM>W}5u;emDdepq
zJ2c?70@5LY*mp^-%=E87V-tQt?7Ja(R6yUdO$8E1RJW7ABkyT|Yhkk5AJXNvW~RVU
zx?Td2#&LckN}|{#nU-0Dyq#lw($45qeBRrzGd~B_bfv|m&EN$-YOFmjYVA%T;*0Sw
ziTw8KoP0qFD<%q)r|29!UF;b{U1{pTzQnVCz?Q!mG<z$u9}=r9ELEaMk<<=b-p%bJ
zgQ}7q29eshE8aSD;(uv<+ZEA@?@=T@;z?xHntAp8JezWIhvh|jU1na&$z*r~dh2{y
z^TF;LEdMN@s9as<8lMo2bDC`00P1tg0~n)h97nLcYlFRjsoGVMa>Ty&BR-;ozY5uR
zQ65Z|D{pxRJJko3`B#?}I#ybh^yj)=gX|C3bIuJ(Kjx@Pig0S@?MvNOqn11hzUWSz
zC|Iv>k|!Gsu-5tZggO?gV4!252)FXyUd9eX(A6Cp8Hmy<bSsI@8scKQ+b^W1y?&>D
zeOotWJ8~vCDmN<Gar4^)ecby~#BKLS1?Bw*3AJgjZ6VW<=Q+QRNBHGC7muAWg6aIm
zsIP)N4bgd9<~RCMhrO3dFcg|(r*z;ETtIr(;9o59zz_m<WZ+ippC2CN{98Kk|1q`S
z*Y7}znkS_cGCQ%Re(pWsTMX)xGP|BB6pz5u6si9-V`5ERx@vuTNdgNZuo+8Yu0)(~
z4nBWu*PHcb2y5~M+j`xF5nIt@vCp<SqmORPiO8Ac_8!QMot8RgIAAh*I5CY<Q>Utq
zTXW-G#KnN+&9^iI*&)yEN2an3QcHQ#KFX1o5Z;kE5`Hj{!bpX)Jg_({UcdfZfd^FE
z4Zd@zYK#ZS)GiOI{-vsR^oXAYOg&KyS8QXA%zwpaGle<Px2VGUV#_p%$~Sfg!zL$7
z&8}<O`}IqBlaIndS94xcc@2UE$?D^MJ9)5ljp9|PP@TN5r=H(qC;0~04$#4Hh&g5p
z9LD|;4@A&WvAXgNf0slhI*=}cg8F@uqFIi&GF@M`#7Yq<zs{)<W1}F7gGMtTomD?0
z!{ccqpE^_)2(#I-*-wbLYsLOKxpo)tY=-3x=DM$x6bAY_@Ta&$<=j5?+$OPI84;}l
zl9Kb2_PzAJ8zIY4cg(ZX7C_oCAv5Cp(}?Td6Q6n_fE$nbuupwYsp|U?jQ_v^a4^;*
zi7CEHsH4!YBAc$9U_34H(^Pe}vWI<^vsZ(~O!%vT5%1<r5hNSP-P(ePI&Sm%mTUN2
zE9Oj~TGHUb-|M$~5@^m$gJG#B-FByQIjW_fi26a36trLL9DSpN!7<ZigEw=DS7YHI
z+$DOPHr^_jSY^q-a{)Ui?$}P-UycJt<Xx5~UN+s3zjftlNU<t{4_RTGi9V8zw)psN
z$p_-HVhhM&!H>Xl+3CY`(GBRkM6AwyCuCN$iAbRg3Bf{#0Wq41_@Z8Il0x_p-3?}Y
z5k?9I3f6P<z22lH$=T`{n&)9XafP7sE!^~|*&?hDD;mbVesNWdfrc+2Q9$xInBGmz
zD5@Zew~4!G9=b+iwejGpMQe$@z@cHl#XUQj!(4qWw+mTe&udj%;G^I3Vk;~8ho*qp
zn6Xc6;dqW3EV?_O3&_8viUJJ54lBHKVUtuprw?Vpg(Dl#($L?t9k+Udn)3r28q{-w
zhoDlWlg<tAPp-{=u5D^Q;UagPRF|Ih-pj)cw#-`^rgx@)W{vl#YNk^qLwb{|(%S_G
zk>vSx_%jvZYqJd}NJJ^?sXV+#&?4Uw&nWp<;>`vE{z843J}guH!AbgbR)>ubtRSzZ
z56s^Hs{E$@^URYx90=fyR08Q-B5!XC3+LqBVq>NR1u}LD`MD60Ql37h)~&3H(q+Fq
zBv)jn)--0PTo!O3Aq^FJU`hI7Ng2A4IdYAR#y_TMoGq{YecAOCAboaaOhjat3E@YU
zK(|jR`E4Z`lPHVhS#ac<R}}~{_|s~jN|^5`pWf?lpwsf~RdsK;ndSfz*Ega>mlcgY
zAz;UCq7X(?^RaBU2e6w$CPgPYNKsCjgd>^kqsU0PbFTGUrt+{draffvFc|sDoB(;-
zJ^z#`>45zW-0`kI#Z2RJ3<@<msSUYqe)+d0Lq<Gp0H~AbQet{uPL%q7Dpf%P$)?t-
zYr&8#Hru^f1AVxO1*L?i=&N~_w@ZX7(8&wPV#OKvT*cjDjP!M#TC`5Wax~B$dX5F~
zYN&2y11OTYv*xo%JFjKI`HLtoVHY27>nXUdg_U@l&WAbQt&$#UaoF4?+&Di{y3k}^
zzr^`4($P-D%g##@(O<$%2=bBsF-aaf=e@g-rfBCls@p&6^2c_1Y@TzFw-&*4e0O@X
z<YRavn9Mo;`MR=<DPm6KicU2UV@6ql5d^Kz+JlD;#ad|t;DX|WqU4<!)l)E=tYp4+
zED%B0teu}eL6YqhVy=3%>|q&ajbd-1zIWL+j&rzfsJ9#P7?;sFm9J8I*-baNkox|d
zA>WGGyrlAlm%PAn0Gnja=vL;(&%#|r(2%QHDm1R5YVC%nU#M}N<`5N5I3KqM1A;#m
zIE%}_Em8dbcXR*nlCSKEsO(`jWt{-}Vjk{VrNYa|58#33ZFsSdL`eav`bw(oyXI5x
zsCXSDy5b$@A<pM9JKF`D*-Lf2^Ma=-oLbbwVuC#DZB#;KoWx}3X^Z`#o3&{-TqM<@
zMdGD~D^jWQHQKDP3vts&U*f3K3kRveON8!?mVXTjn5_(<Z^zLk^&o+HRk#|Qpe+I0
z_}U+xQ~PHhDG!X#+OiL^*Y}@DUA}akxi1d^`D)dzS=ag5`T4sYJ73Sc+Z*cZ1$5)}
ziPA8LG~r2&e$8z6;LzE}a`Q0j4>kCE69Z??`3eg>($Ly(mLbipno)M|7SFy-CFmcg
z*$pck;g`;wg4?uXOOr$;4z0b|5-{Z)Q6Cks8Oths>b|+33g~1uH>OzM&UJ!!dariq
zk;BST$8I3f4pQW9F2k)03lp(DlM>U?hNe|b9*Nzv;<b#QhKxSEMU$Jc^zVlxVFDv0
zzS~`5lx+&rKR-xO)YlNzXM>wE85)!oY@(LWo`e+VPZxd^$H^JX|NQ|-^}2Y5d|Z^@
zivB3Fsg{Ui?=zrr=cYhOY!Z6()cXA|FA;&EH=cxjbModSt9D;+BA+&PgkS_to7VWQ
z!G1OxAEp*%hW4jA=C|1j$o19Qx<{>xhWmJ~y(<<{*Hbn-Lb=BOHIqOe+vPD`Sn>Ml
zRBzSy*YL{mFvY8fc5adlHUL>pl`W1Q_;`QhdGTyyefuBaHJ^zcq<*Cg)vi)P5S3cq
z5BCZ%z_Q>A?}=&-P1|;ovsw>pYmG)Q^a4_c?b!T1d|tc9+7T+fYV8W@$g=#kCx_&%
zg~0GVD~m{KS4j?y&bJN&bk$xYFQBgp=&9}$gGfh2%K9}Qg$qVr$oGNWBa-W9HFPj-
z?L745x|tG7SQ=>WSWl&opM`9PBN}dxO|X^I3G?OaL9A-(iKz`xa-o_eo!vTCS5~eI
zGWeg~lWmV+mb}Zi);e?6Tn5JTjr8w@g>0&jTW_LTli!OJ4{DquoZX2^H)R!4A0x!t
zN?a{Ye3VWEpl5RZU1C%cBLt@+g%n*()pHkS@_G`Hkq)clw6!61l$^6}OYswF#@DwZ
z+M`{x73MNVLywEYWoSvxbsc;ptcoZqx1AR@!h@)Y_^Kg`ci>TKX5&9>OnSIn*5|8m
zA_Tc4iT)WHIZkkr96eaa48E2uy0I@MJn7I?qI^PmB)}pWPJAwDM#4(43wl8(>MQPx
zC6|Ej%V6@tHu*szuJIS&pH6V&n5xV5r?{!E4afNG8e2#usM*UXCDDqQf6d)}bk=-Y
z1NA;%3|>0{N~#EqcqQ%@FA@E@$pP-wQsE2V+22MJcAX{Cy)dgS%+e1C&$3T8-1Ebc
z$HvX$XjWc>x*u!80?5l+p*Ok10w>-b0cBg63}O+K{t{aH8wmf$FR1=3eJa9>uZ>;D
zh-_8HC6bG7&Fp6CZ`K;8JXwyGwbvg!Tp>23{^ANjDKrlViDr_EcJ_X>KGrWL`>C71
zD_zA@j6{j#m=BQmiE~v1XQTztVYL`)M~u(v@eF0yKM6{*4_|N6;1;sZ2}z9ho4po0
zGkhB-kQr>3I4Oag>7sDrGU;_;H#7MeGqg0abrxl76gLI0d_nykzwQqrl(^MNl(6zS
zd=XcERK&VCOsT?o;P3VK!djCB3z5RZZ?n*?$<|Bt1@Dsar#!6-{C;rkTpa5`F%Fkk
z2B^cqzmB^u5Olno>$i6ciROiB-+BVMP6zm-TSvOpO~NuY3WrKi!lMq)7lnu<b%PHR
z>?Z18UI}#XZtbikTj?L;&IzPdsBxnHjNk|3oIQHD^5&n3A^vAm0XV0@!NJ=_>f6PP
z>z<7FWXpS~l+N3{B=L&e=E=XyD@pj9sn96}7<l#-|8SoUk~(XrWXJ6MwO<9Pb2Q#M
zapwF{YncUl%6ylXWO@!=gKjQXmGt;Cp@vr~xtKzRw4<!QQJpU|PkTBS_Mdbfp4*(S
zI-H5dh6_r0jE96um4%dztmBrvegs$cYQQmlZV;4XQBxv0^XI25P4ix?{b8ihw)5RM
zYF+Am2GshitC8_wjA*&kpDwWzJ9{>5^N5)Enh*)rB=%^_87K)<ldHp{9{$3IOitA%
zx<Co#!?XiW%c&rdlV*0!3AdmB8AECOEoI6+%&e0~*qUg<y*&ap5t?5<ojQ^I@Jox<
z3VSUo<n+CAD;yhlJDZw3x9gWZ&ez7%g@#yk6h;K;o5750Q`aUWGdi1Mm2BnqX*pRD
zw+3{Fx&XhV*;@T(r9^Ueh@MY-_(_-ieU<*vef9hL`Z`U}RpffVEiDbeWo%!2E6)`)
z==Z5NuGxCyj+QP?<34?-ud&K&h5)yf6%v9@=DbYCp9vd?cchnOWMx@<>7he>%O9yP
z0|nsQL_fz$QCBSP%0Exk<8%B-X%qmO1vD3D=AklWi5N6%UD_v|D%U!0*<UY%btl$l
zCTO#=I8yz%`}dQr5-~h=wAWkPE)zF!*dSv>zx7Q@+7~6|VFhA4*XKIHWY`>!t@)O7
zgGA5<CDi5oNxgA(5+=1xR0f^E$I1P5aV}3e1x_WZe;$rC5q@U#T6-ki_lbCpkK62A
z`Q)mV%62^2`nnL3(Y%d?Knee(H~d6}2$H~F{1RGEXu|5f1P>K@F~wRcVngcchHv+K
zXrsZ{fBxv*Ze3unnL?1>?>Bh2kjx<O9p_Hp^c&oqx#ozB=xEbs0^a_;#AW(>!wbm6
z*c0wBn4wv%G!#**N}`Z!o+rb+>h-_4OVYU^`bY(MZwqO(;z{#<p0;AS+Q5^Uo}J1B
z*2&mxe^-T<I+M|8q_)nOQO({}PCtk#Vh^%@Sg?P!&xjdHzB`XL(iMfYrqZ`y!V#AX
zSaJ~k3`up&Scu1-eet^iced@UU4NAb7S7I)Maj0u-hUmEy?Y1fDAF9Q=vy3^<4);H
zGT>W6HnjG*GukFX>XB;HRCoRbBAP`;8Cpx9(O+QO<jwLUt}kbLw%jFc>TCtnZfZw+
z){khsh-156<Jim(P^@x{dG1h&#(GP#V~sUSfE6<&uPolw?1h4B<0C~5)F};aV)msa
z<3$UEXG>2Zs;~t+*{kfv37*IJDWjJo1!=)(WrAm|8V*(R_A}d+Ni3b!v(NNLE)yK|
zYzu1{q$qIq9v5nsD7OA4jTNx}%J5I@%Jr{`{)6D@#l}5sT#|YOG1<(YEk7SUW3+U6
z6D+*^L`+Zco!jiX(By>A3hI%dWqk43&B)oxE;uC4z?)X1-$9x7;dnNBA6u$mxbVXK
zx_3Yu`r`Y&TRnM?__0CvXVRnUhGmr2IT%|;O!DuaiyJgWcCW5O*?eq~mcz`InhTL`
zn^=(!$pplrIfacl-nz)Xov@Zm1IyKM4?DW^ht9;rySFI1KuePBwJH*vYYhuxpq_E%
z%bVffy}6J3{cf7ZashX1`8_I@$jffVf&7BBCX9SW82?h&s_YRLOK?vn!H}3_uF_%1
z^$_5LOGG|;us;Q`I(&U%wh|Z6TYRP9Hr_M3=lP^{h;jazh|bbk+6ItZe1QKSi^Ky!
z@Xd?JrTcn0QCdc0jZIZ~3uxdC8;2v#g;_4anN+hOvGO!XkT^T8_U4g%x$=F^#qHt0
znrwf6cW(=uEcbsLCsy5;T^V3cZxs9CV<UxkF$lChA#FlqB<KT)wY@JeKF||;Lh*HI
zfL4mT31E<ph1I{D{zfZ@Mlvu1egoq(miPzM=Vl0W64_$|^!1%m%0U=K7#+V7$32W)
zl_2^a@*FRctwPQxKd=&m0(SL4$9)pYSf<oTs7;=KkbCT8XrxamX4kaK^ailbJXXDl
z$gp4<NXO~jPox0!!qbdD7l{pRO_vYCRmr6lh_m^a>(s=<eurIJ4YFQG)vvsWnq|Dd
z)24EOX(M}@$FM!Dpja*&q#DVaip0OilEareo^dv5;ggTV6964XL0Ua1ysSwwEVQdg
zujUHT;aXXYVfn>>=K_j2r1v2f<<TxvU-G@uu%$_3ZT>Y9S`n=ewSw9V>0<#NC<)xu
z*Gtkp<;X=`H36fI2&Ew+C@gf>x3c2Z<-mnZ7kQzvTNto-?h8~Q9DENF;;afziCB5x
zZwM~>U%CUmW(^>q6<*_qQ#fk3OtiI+ar+_HxV80bB7MSB*PC<kAeJPg!7CV7hVGbh
z_rJ%A0sv2DUKRvUgMak(P|qBQae+e&g08W+li$()Kq?9^<zHz{Cf1U82p-;au&Ngw
z&HOVoa^&})lNwOEYY3G9Ls_4bpHj3&(OB(=mv(F$x%=`?^lMy3-n5pbsnlVM1Ja1Q
zISR<Vv(cVjx|JUuppKZ1$~j8dzt+$PfVGf{;B&$5Tgfww3cvkd^Mb^u5(@W-xy<z7
zEI<~^^wt1g{3uq#VAWyB8M~b%_9gtke>4c=mD-!k^!>jv9KnK&QWZKyYI4)zqb_}9
zg%YB#>5NNXfgJP_d;oPM0!qDcaO+};L8Ze7hUtxsyjS<L{BFQ4?4Nb>;1gW*pGK<(
z58nQ7w#nRo{(s~N_}}DT#LEZu0Ue1?BY-@jOF*3j9Z9J0x5I9!1Sn$rWTN4poM8iE
za&r;ZP_r^t%#&LEWBkZP=we?gD#E)wE1%nu5kXoTodE{~xRZPTX%1Nr`}#Np=z2H=
zvRZuE>rfhoj>qdLHS!+bQ}n2vAB?t*qFATo7j+jvh7D{h;z1b3YDYBZ;Q}hvwO(Dc
z^*HL0zlar~1+auQ#v_F$45hcC>`CZeQ4TT{>U#sl-rZ_&2`Yi?Mg%^IPhNvEcqp31
z;U2lid(*aJ+aqE*yO!J?UPJUx+i+?IfF6?9I9oSGAjgu1$|TKxoNRr%8Pa>Vdowh*
z*Yae<k&kIA>gw>APEhY?@Ix0UTCh-!*nBaef<UOH$PLpooOvhb8vxR~@i@nZ3*c*s
zDQM%9uY0~QiYj5t4Vj7;hDNYzcPtczmF~FIPL&4bE6S`A@e}n1ASu|goYK`W96{m0
zc_JHM|J})~G-Rh0tjwy~hdro$zwcgs1x$HC7)TwiR8ywsU8$V_YN6y)?+44zO@mk4
z*BP3htm_+B|3T}(r3fgp2C*-zV(D(VK2I#&Fcl;+7Y^+SK9OSN{?2UKIM&APYe>SX
z)Ul^lS)?aiP}I>E!^JXzDBeR(Ps!-i=Ju&Zrxbx`SiJHoet0?rK?govp>s<#ZtG#s
zmX>BR2KA}iV0Y?L$Fy1He?WaN;(k&|11alYXE3u}ySr&t|1+C4RqBmU&%L|CTm^3Z
zo#a2h^9X>s-2<9{I)Nsjv^_8B=5#lH1VA<KYW+1E&3bs2)N$G+<<^K<$NID@)n1cu
zBi7(<0b8TI4uNZ9%Hc2>iceP_BvS7B+K^U{Bi7}tT31cV!6Sd;E~(=tTg_n%<I9D7
z*-5WJgX^!-ABBIkB#(OY1eV`>T3H9?358S^=`xW>)_I1^Wa$;c|9tpGE!}k3>B3f6
zCHd#e{wc4UOjml~XRWm2FvJ4BGm_eq4lO{S{E0&I7*<=-X9)QZGIA@~+uvk<>SvyR
zSYrE5tT|^bR!p?lzT<z^i`YEAKjP#9{?~a90yadc`ej}v&zwEf+lHx^7CAvYt)T1K
zAM$uMx%s5bCM3`GY9_gfl_@jK&Jkn9i0R^83L9*;_1zNhk~8VEfh$tf*_9sm)anxg
zg$O*Va5bcV^o_QI3PAh~2auUccnu1ALy$8M{*l^f6Z_$x-9h3bvT7AX)DG<#Pq*xG
zdu{D%)*XpCF-<Gt>q^KT(7pbCC`CyM*Ucvl%5R*|z!(bBDufJln5w+3&vl%}5M1Fz
zeeYGBEbJDZDb)b^tys8fqR~040v7(a(?9rW06@#UchVM&%b+dQNuK7Foqo`uY@v5_
zy%B;IW96Y$f#75}8Q_{%NVls)Z2v^D5|o$#HS1Fu6Gz~zt2Vvi<f?t*QDF<C70=UV
zH=Ul<;2>$ipEWaW*&wN+9)lVJad+m_Bf66{R7oKfc2a7$E7K9Br$ftKK*?j6ku)67
zZ{!`l)y6N7&A4P${#p6_ZrtjZLO`XUuc#L6(SnuQmi4?`Kd~wHhvxQ<3(vSR-6G4g
zE&JkC8A@+mIcMTdr=ad`Gh_6HPi8|DP1iNQztW)yQ!X04l?OLV!GtTyHY>=P5n*SQ
zI^FN}UEn^{bq$SUp05&o@034mkNqBUno4#bu1o;YI<DyTaMLYHvqiw?Ap~7lV{81z
z7Lq^xgy1v8rptkyg0H;<LH59TJoU5T=Pt4W)j`6dQ~J19<+T9nDdA*QXG!W?{l~XW
zy*_)BMGw%eb8a`tJgSVl7Vvybwbi}+!=u>};7J~bLYW+Va`Oa4youkcF(D8zsIdcF
znzjeKDxIA*P)0bZZ7(W!?WC?rQed9GI52;m&=)a3Jz6Kr98>S5PMg@lh0VXEf2+O1
zW$^9!iInR2mUtkzK{_UNw2udd>L_}rtX-kSDp34A=5w>!i!1}j25_++F|%izRn7eF
z&tBGh|4xXvp}@cjezn_JRaNDC9_)M0;CsjrDP_EUeTd@$zET5lNLSlwrv=0}gNff`
zBh@prp9jkk&Lp(rzy5|m09$w>uhAk=0P;s_+mG3(5i`QJ=*5iOM}v>pSFcNAUW-3&
z<88+c#;3qG{>H&4#M!hF2al1N&T3}fTA%%mbr}(eG_KVuiXMEP8pY&79TiaZ%Mr)b
zUn3*B!hBI}d|6x4lf5~z&%XF{M$v-u6myYwiQ*fpCj~iCb+?$DUgOEPbc1hHh$N}_
zvf@K*Z9CwR7K8wWJ*$DCq4|2J^)_75nW?E5XxE@!G>HE-VoOW|S*nbA%q8blDYHfY
z*s2bTOBuO0qa+Rqb<oJo3d>VnSMw%s>Y)wZ{lw^}2kJ;GYLqFEG5I64!V2+S<Ewm;
zOsErJmQqqC!0G=igc_#}CCcH*sA4y%q}e!Cd}Ul-+jj`5DC?r+7F6mhQhu|dR&P*W
z8oWF+>hHJl{PMg{Vq%XOY!Yivys{{wXWfu;j3!R%Nlb5~|MixRgeDs0)mU!7wjR&d
zqm`!}NrmtI3_1RZeC|_z>2Rh~7PdF)a;I4|iye5-eVvW0M?$#fztOmt{PG0!wH`}s
zfHCu?KQya3S{-`4LmPW2F8sMY;`gtj@o8b#xlR|_`3N~;hc>461Ti(&vp`-1h{=!^
zrPtCD_DMQo_hZ_#)J5_3Cjzaz)UD})5}pr6&lO%54F&LpS006sB8<gtQv6;Y@8eG;
zzpQqwzcg474%WzL?6MwoQeqAd3>EO);NWIb*yKDgZxxwA61`hvc~fy!(=9)~I@p~i
zs~7xyHgz*!PPHVHUuL@W+~*T2lQHtfyMhK2zg|n7Aih$&4CVa%$Anx<Q|n_RV0GGy
z{7V~hVK^J}=PK()0E5}e(EGd(4U$0y_MHoOU~f%o!irTKGJY3`9|zq4UPfbm-aMOx
zMnvC^GA=9rZA50BbXjTAbfm4-BAgC$7%QJ>x4OAeF-E<y=IU+zBco3IlYletW4`xm
zx=y#>WRv}P$y(bQSeYEiMG#*LfH4+h`ETSEfSU~b;lYFd7-9DR7I*ze@a)|yTMh!s
zmV2QvJ9gbey*K?%JH7q`o{Hb>bm}~0S?%u`m{t@To0?d7Zm8i&<J!CZGkR(2WB*8C
zD*i<d#9F7A)lS0F;-2uJ>}FU<ukwW3lDccC`U4Z9x5MBWq2u7>>_VKO8NVx4n*4><
zwq;ux=x$c>s=c>v2^tR-2-S^KKoh~Y>xZxvaZ#{zTRmt5uhsj!sESUIkAcS$)w?wn
zuUAXy3_9ed2x`p{(w0RoTs$v<EV0rJ3ausc=3?oYTE(Di4!T&}PtrYi&+*2BU)|wp
zF2-6CKJGV&psuD<fR%UEpVBiF)80y4xwPP3q1DP-WeHfS5Vb!#&BY7e1|BO}cQ&H%
zQ{&T+CemcXtjcq4#~Ra$GOIahg^{Kl6PJ^}t%sM3-Kau1ldpaW4cqLTj*Rwb5gv6}
zA2p9A`<IG8F(Mj==XPL}yBTzA`KZ=yXf6wcT4`Ds1<2Y@OubFm=?M9?_oW40sr9|5
z=OY0vNUHhc3H+(wpMS-dm0|nl7IUFgl8De<OKFNc;C!*NvVgkBJiiWE%4C1P4&LRr
zm}z~{RK!uVuzrj?m~H-OzLG}Rnpl`S@4+(kVk%J*5Yq5Cn0s@D4h%#)z|}X--{iE{
zLs0Buh8SxqDo^o?7($!zaIKpoPw$z@!X3vrSu@*hI(yap96bBGx%&7tj(pk5r3Z1u
z&rvAL1hJofQ{cPKW7_*Vb+(#Ew9#X$y_g)+!SV28|3}_yA$jS5sxOd*nKqX<Ft=H4
zC`bk3g~V+yB1r;t8QUqz_jD)<H9gYw)?V0D;xmq<d6GbF^`65L>eowl{viIwp|e)K
zO)8&(H+V@>QMenVId*SZnGI@B`7=)>wD+_EY94V8i$#2^4=X9B3jO%iDiVTtrw<$6
z1zY_%A`*?J?$vp|qT$%q*XPkTcMyYqV&dJ;&AwuEHq((Rnc7Lt<wA4MpOX3<Fz)?}
zmuoS)AEIn6?P?C5X$S{`uDqNNCw-;W-=<kj9?GlFHkE8eRo2o!{*mq3*N4(L*Adr`
zPJ%&0Q&KV`CsRgE;122$E^li;w{L3OZ|Dm0Dc9__ot!DKg?Vb&PE8NU62xyXF5<wm
zhCb9SQ5FgZgK{a#pwwC)!Xj`|>wp!2QYoO?Q$L2#CN5Nb-eohP@i&OYhA~Hgn_tJ<
z6+0FWQl?Z@P_o85ORXq~3e|f85}|sIm|m+5jR=DJN^97vB7@)G+qWS5h>am5ZW0Wt
zzX4Q|#zPY!?n@G+yzi<!0(x#51$UDt!g~lDTsyaL=y73lvS}r=P3(TMYyZv#yxu4T
z{M)Z%0L<Fi{mmNKb}*`ttdNK5Phok|W%j&6+h*2_40@f)t!2)~^?XjN72o>?ggk)#
zbg;_Lr52<POV@=9Gv~jV8zA;seyrLSQEv<-vv?ELlKC_igTrM#+JrIt@B5kL`m6LJ
zqvtK3yF8bc#oWE3Z>*X$D>1a6oUc|EFQ+R#F=`lKxr*EF>l>W)fm1a;mEx0sZi=ti
z)QqFiyK2j-6nQp=12LosT{RURpuj<RN(E$dl71J)S6mUmF>zmKn-g}c&Y9;I;%ner
zr_4^OXU5&72%B2BT%lqAMGCE#&{{fZdG9pBuj}_10tklEkYuIaH9RA6pW%k;Q+1#8
zZ&;=P$}nz5X)%3$eGI%^$KUVW{w$zoqfSLRGus3sZF)@E6jM@sQYoJ6`<<h6=XVn_
zpq=V9ICu6vyITp9O#)k5iD(_8-IQo@nxOkO>n;LDJMeMl<k=ng^n=0bF3TX0oxurZ
zC6rRd)=|rK-u-Pe%$`)JuUB`eT_EJ~_6w=^;bduN2A5qh!Kr$G(cugqKSml}OL5Q_
ze-@aI|1_mUv#(})RFYsGd)QkTC5V3jO^t7L=jY$*P|o9bnO4@Pp^fz-#$>iL?yuNF
z`X<I-W%IhsHLty)h|!Zvh%XBzFTz{u*H!zdf+Sv(=4mkgnZ#GAk4V~xC9rzs=(gV;
z2GPkb188CEyuJ)(|FyE2i<-h)yr<SsxNibnRp}SLwSQ?}=i~@jghnH|z%P?u{NXrf
zY}E~_Hx}!D9)(OlH0PRyoz^=CTRRwxq{=SKJoof9p9fA*-2J@%+dLa9?s53rn&;hG
zC=D^<@$#XmXV{cF0Mx`vvMZ4Gn~D6)w`BZF6?@QdB7lA9qA^>O^}5bnDt$W1zMMd)
ze$8T20}WuUf-`ECNHOVR$4^-XEYwW%)mM2PRZv%MXrX?LX?MMi;A-CPk0RYVE~|6d
zSz7Z;2&UAVX>zK2?`j~mS3UqlW=Z~qZP&nIEdNvuhwIB#0RG#QMKfE)YlhLLb+Bgo
z&Zp4MbSOqcL86Glt-FA`mm$57SYM*Go^FWKMEi1*DWco7N0<rBTy&tgeeVbu0bZs+
z2eKhzDwi%zw!hA>J3H;<jH;Vy4`B^UD4}9pOc}o28m4r+xekV@(>|QdSnzZ6dgpXi
z+d`i&<xN<hEvyWC0d)!(t2DY<s4PnF`vZq@x$dmwfq%U-v{i~M#<xkuw{69rJ&x$-
z9e<F6?ibKTO1=E1lH@ZvUPIewwYsO$$8VWx12|N#ZMPos#CJr-)+0dT$hDmc&<+l9
zYjTs$)?>us;=(5iN`BBp?x<#r=<hXKqVKx(BFwv5Z+~y24*fRiOft}G9-7w?*MLx#
zEPFdb$@qJli|-i(jXC^u<!(ehD)f`<-KyPHDKYGtF@`4UK1iuw5xHBe9!@~#)G6)F
z9u2WH@GXmwo3C&~gP3Bv_RB8u%6f$xGRyV>r6ly=Lxb5yzJ&KG&wxRDcYg~1xMGRG
z<7Ii)-*B5==d-gk;9sBQKYT<k1zWK14$GN97nh=Bm@uJp(}l>{Gw%$3j}PA3GD4IJ
zCg0*`I!mCj9xMko)JUnv5=k3L38$=fMp$Lq<GBszJ9+wyo)R!rS}{pH5#}?g1_WC&
z=GCkPzUcedSnW<gXX28=JP9AQ$-g0|UJB5*4@t}~cmo|0B?V)W+^8i=c)v0g`o$Tw
zO3pCI={Lu|h;KnH?6HDVnRP{yRzPdwa@el_F-}@fH29Qi!$;Inx}>Xc(sQxj%kglf
zXJp`P1;2$df`s03+NnSyuUoBZzdv+BdZpdnJqxoOh5MX~Yw?0i8V0Z1;r8bjB0Ou4
z1I=|J3djg_jyO$@qchKrr|bJ%6<u(s^x<G$Z4bwWQ!!x3++qM;H&h+>?72V;4kp!?
zDijq)@Rqo`@4QHTMH3iTjUQlSfnKhPV2U^Ez+K9{jHQKLR!us0XgC@LVBpBKdQ!Fw
zESUf@^5wY?zmm5_+{V>TXI9l_?ZFTy1>xMIvWZ7aQGadgahIiPe@+FKr0TiZ%zNNc
ziIe7R+*D@R8B&>9Q`x_E*`?BLt|c2A?AT5}${Fu|36KF+;ybYN3Eiry<@leF8?706
zVdAKcMO*GK)_Q)?J8Q6iatU{%)E+0ad#M75Dt0H(xRG`Uu}*j}_T3H5&3AUj&7Cct
z)ohwgM9Zj@KId2)H)If_<>;2O{Al-#`O&Tok$Q}ulnIky%B#w+QzrTaMt*!W3m}^h
zkcWk*m`sn7wN$&G<8^6>F+D8-nXV4#zGK?JMtnUGU1egIsp=U1rS#<!4MS87#_v1#
z<RmWKoH}dwQm#v{2Ouu<!6U4Mrsku@GUg;MNVB!|wH_QM*EA+mTCbqvHInL@+bAzO
zJd!5Y7VQC%A+&xIyMTieWF<6Y_m&FNHGEIg&4MJ(%?)wc^r6RLsUZ$2B8CaN>z_dQ
z=U4ENW1UP_tPTNvwK-2Hj(_G@P9SSC)t(QKGNY%I!v6NV)!05CuJvPT)TDM!TjR1e
z<VE)nVQ5TcQjZQQ81aNUY@@V{Pi83cB^<b5J|(SIAObFJ+VoXA0fe(sNUuu6dp-V?
zTrPo+O&QtfPz5#m!-+{<@8=WDxoe0HSK5o(CiX_$&us#vK~9XmzDqws3eTvUs;X4>
zOe@?If>YPdaYyJgZ%#W(k9N?bgEAMdDL)M{BvtcLgrc|AA!@#5D<_ZeNi`TUdDo=d
zsukC4&}*PPp|~leto-Mgg63n>6rwFPFb*&2qtvYPUneDd@6j(T0^TaGIKT0ot#{@1
z=?ZfC@Tsq<G7YsUyZbopSfpn*qayI4*kM3oUWq%SDoq~Bce`&Z>SlC{)R>0`J1bj~
z9#pISZH7B@{?*(qiw?{jjTbp$O_+2nUkN@b^#W)iUY(3zUV1!W{AQ+^>Cx!cH?|De
zYGH-n_h&KT+}V8s=j%6uf7)jQ85V%w9z0k4*PH48bk{NpJ-qjamE8Ub=zi`06JUug
zV%#eOe*N>G?1PHv8~pk=D9yW_mK#`jc)0HouP=ccI{Xa2cN3a%9@^8>Lw%V^eP40d
z`<0KJn0S2ro!$4M4`@>Fq84()J7;sBXq-El8uB>}B+<J+x%UVkq6@DA96u<45a90A
z?v7_)_hi?#<*Ma6;qLIB{0R7`CfbPB4~qOwYZ1=N4tQ|P*w|QLdKS`*uy8zj@6M_3
zX!qT;w6y;F_d)M2p^u}{_W%!lUtv`8-ckR*nkO67a>iY+rpVnvR7Zw~?P`spu(NWl
z|I8A$hK&BE%P&?yVY!cWr}SjJa-i1bUYH>|DgUt&NzFNf-ekOR{oUotQ87S~%b=k_
zj|vw#ojM<3&`Z6(*3{6$e9Z2%^tw@~TyO>+BYZJ#oxO_J%gmfTAdz#`r&mZ_(01s2
z^C`p4;Z-|FyPxwI<BylvV~;oW#J3!3%VD*BqDp#tdOnM}ih)BSE0w^NskoT<er;A!
zd-@m{7<lkMr$R$ZZ*f>)M&FgfeKFRj%(CyrCLMxI!$GIg*uh&Tx0{)~(bgf3>BLd4
z`@YK-#+!%Q?CkZUJR2kVE8m>ngtv<C0Fh*x8>l6rCyVaOp2GYr+=)CzcI4}MEbbnM
zv-|9xP@)q$0GF0Ly5CD*_3&#J+hAL&P&l!k*8zd0Lb>g9ZEXT?fzPLJfx_Xo&<?uS
zf?zC`-HYDzjj5$0b{`t%7nVry$7%1}J114ck}raX-)ZT|-&e+41REO`9XN-3hGUBM
zUYKTVDGt8pS8_qJ`%J4-D6hQ$E;@$~JTD^u^k-~X$YWQAj1~u8*1GQJ)IZQaUx^kb
zSWuQME#C+VoSmr9n$=y^uV-T!nwl;J?q9C_ULkK}KuMBhxN*oc@RZa)v+E!}I}Ifn
zW7xD}51OD~LPfHSd<s*Q;w57N&VdC76D*wW@Zii(==0|?zLl?V1V{0?Dt#03vrq5L
z$Nq#i%?j2A9;P!AoPPxC3+_%Vhf=b8n{Mxp|Nd=G{`AFT+ovxEXluTt<Jir%ot+*$
zZiEFk9%L)RdC1}uK(!&et;bQJeBK-{f%8P^*&`f_%k%ZFrCr(!$<NVIj6d8gPc8~d
zsYNFZ#%?Lk5)vftx+Dss$0`JyI3UJd?ddB$vqQpnMm+QuKYmrOqB&T+a1E;$yzts`
z%N$U>l4+j!Jbj*NoBd0~+3s~2+myHKh0jkbuUy~53%@dsPN@{&*c0+`R`v^urk?aZ
zJ3+F&KHF<P_--q5r#+)eM=E#h6#hEhFK3s4+WIrek91Z~V)W5P*)550JZ~hvBZF~l
zV@eXDe3KzupV2<-oWAEJ?8@_$Es~wnitt>JYp!T?7(DrGv#g5v0PIFaVAsF@`1(&c
zuj7#DTnp{MGkRd3462RtIIsInXwbW`_-t1>tai<kQ(tW}@TB;?31!ra$am8v#Z*-$
ztEkJ5p~+b#KDhvCOZC^?U9M~QF}v(dy0}8dmcm%KS<BciCdp62eP}V?i&WH6oK=R7
zC7)*BKj7RGieWY!?xnX<F4U9oQjS^+@b{4hTlOZrQ5+Uyb`!tf=AtgkyO_q5_|gK0
z=A1*;+J7o8RRkh7*XPdNRM<Gke!R61Jy=qE8D7jHk`ZB?yz<I6O-|(G??%+XpJ3MA
z(wc^qD(V!O*d*TFx%rX1!pDuv)d0rk0U^*4_%|1VJ2bx$eHhshnH2!67DVuR2*WGO
zc06EzU+!WO=w7+L;YyehF8^Uh{&^A)V^NAwD96}6&-iPAlF#c4bI?^(mVab?0xvFg
zZ8NNC$Y=Y)W<RRX-r$V97mxt>n#Ix0Sp6yQQ>Zs8ml4*D-8^-70WE2#{oX8+BosLs
z_TB86Yd*Sm9$BcqyRGSJ&2R%Bsor~RMeU<d#^q10lmhzlojW1<JfUqr_y4x<^3tR8
zKuaeN=R{)kXOJiKl-2LaD}XBFuV?An`ue!T%xGw6kD?>v;^Ke@+>aXWvyx)|cP`-n
z{LuAJKWsjOv+uj@1EK^E_TB&n!qmcoao_E{FypfD{z?k&R^HyiV$k#XyDQ(jaNh&=
z=95ypr_IH4CuOeQo3i?-y}f&+#ojX_z)!ljNSE8@qF3Xpicgz8v##y}*}XnA02ZVv
z7Vx8zN%Y(n0dsa&Yd0@qEY@_C<#{_MdNbyGEbV)IeKZ8@#;>m5*_eRu6I(1?0ABtR
zdH`-Jta6b<C8p66W}W%O4Nzh@VJXRtZ?3x2vU9GCX|}Mlpm@W?fWoHXdQ;C^b~$yP
zX+<!@NOFBzwTQLg6*d%Thg+!FcYeTA&Es^7oQpNTy8JVR>ZWHNn8RGut5GTBNdSxT
zxx3^*n|rTI)7ofz8kRL>%)4ZC&s2dL(Kt!7Jf<ol7cZWksY+K*PQhxs+v}%^T367Y
zVJ+^Dg;F6@(wm*v_Dw9)pXuggZOT<56=ClD%3>;*z<flL-meiWD^zZR-rox2t~_hW
zw{0IOJ_m&MminW+4i3`WUU&%M!#09Z#fT`iu1l&~D9G^Y)Sn^6L5c!5fR=V(hq$bN
zmm=y+4_BZ;Lu}mYEZz(x{v)sR^Qxj~bs0seQ#Fsz$>3>g?^I`R{ZT}0oXNqkmZ^`I
znQehHT_i_*<xTq?56(}a5ZJx*^YqoiuY49(R(Ux&3O@UVb)Vh!boaF+Y$S@DA4D07
zi62Fu+1~xB%ImdWa=a#s9NlK8k_hR>_cCV}#?5w)X4k{*Ppr>*cPUa!)|Mj6-?dc3
zo!`H?kYa1=4r4*Z{L$V~kVQzRoC{eA?y+`c_M1Q)eXhOurfMCld#__+Jpt#vvGa|8
zTxVNmMb$w^Q0-&z5A&H6TV#NZ=u6=KsJI^Ccnr+n-OTH^_}ujA-yX7G|6#vgQM_GI
zRTQo{XsAglyjZN*jR8g<!YKQWzRfMy1L_@E-6+j1FLEiRK-I*JZ~lPtb;sX+VA7Vx
z->|I|v^#uCedD}F@Y)6`k*k53t5T<$EF?&QTr&5JKCK}(Yi}LU@~ZQymp)<{-KN>`
zs{Hcf$CqA}A1uTp_lJdB69(Ugyzc>tufxGo2RpEhTdw<BbeJGG?)cGa4(u}+u?*{7
z%nl^6@Y$e_5M+asy<-8?u7LlMG`Kvh&c?Ww%IhPBSk2!A?CvCxTMkd7ll{Iz)9Q7a
zzjQE<&}yV-!J9UN_Q%dx!64<@;RzD6!QeDOC`&+vQe%P{gKAuHuE&##>d#N5Q>Wk4
zhI#2qfpafEK<;HKpG*91C1C7fWb${ll9v9lC?TsFhuV${j6qfgmmo8%4}5-<vDL4C
z;g{_DQ<Id`t7R#oKsf62nw+di)89GWrn`uXIIoO8{KsqIC}d~8+38%NzT$~Zc7!o!
zj(@O?OSRgI->FbaVL>7443Fx*GIyz;@EOoQeydyR{iulUKNc-_Ac=b;)BWe$cWfW!
zx4NYf6ZFyJ6JJv5$(Ul%q3QG2d;<?fw~{*uETK^`G0o-g=4}xkM(@t=NOdmn*denw
z2Dt(=%{GQbWK0gkoX##bhE`rzX~i|M^)X6Y!J8#Z8yod67}!Qo15q5G!$wzWKvL-c
znivY;7Pu8fZ;smllxK~-DbIEq1sN$RStw}l%&Mj)=?K`!V+Sl$l@7A_U3tqfwIzQ!
z(7L*K1jL-5Pdn+_><%cj6Qtz?hj1p3_Ebr)cWogUKG)$dy;hL$agH&`OMu7PGSt4~
zChCkrf&)kG`$pZi5h^}dQO9WB(?=74-S%PtZsD!JzdtCEo`=Ees;kZB{qt8cxjUO~
z>1~F6sIeX#?u@~?EuP`^Y31VCY5o~360$hLFBT3w=}*^8ESorqii~qF>~oR>scEGp
zj9I?BxqYu<eJCk(+G$`~IX)@9-c)mf86thwJ^Knc@4I5Z`loa9@YDv@RO(Uq$GvkB
zNuPMboAGIWe@>79VP9TlkU7<6Qm!KU$ynw`&*(+Y+-r}QmqAN1ksG-dt<z!r+E<kT
zL=aUgB_M3;F-mLBtQvQa)KisvA=UNs@>l+A(Ot_Q(E&MKJw5g!u;}K|!4eZ=Pp=(s
z<4BsAI#D@VmBRT44uI*|ulvW=0ekiV;ne?+M(_Eo7@P8eu(GD+o-)@)USD7TtKPvs
zG5q~|oVsej%YTNz+kdX=vR?nf-sbS+R8ucwW+9N+F7;|(^riyW_k3MHy{Uq%b}dqt
z`ep;FpA2fgd*ynqe=$SM+j7@IKz+L(eKY3ghnwMPTy>(sPDvJ$nrJP0dE6&@w+I*I
z**_$q1|piT48S_4I$qeFFmk1~xd^-#;LY>7vIaCm0p^Oa##P}PLs`AMnQ`j7gZ?Dr
zmfMaikg(ibt*~dU_YS#T(0)z*1dOb3B`yQo_p%1+OY61Sxpg0y_Z&NarGnkx{e~SY
z1Mc3u{B6C%QXBPL{C^?uJ)@djyR}hWE=5Jbj?}0ipfnK(9aNOA2(su9DbjllH7X(^
zO}cdHAWcdLp(<5637r6;1qeNX&_a^)#P{9j{MqA-{p~UK_`Wlaf8r0GJa_Ig?>Vn|
zU2`@;XNPEk^C8ERE}GAS?gj2r89bJQ0xRC=<D%32-q51<PEFC~^RQ&)hF^0PD9)^6
za*vA~|JDmgKp?TTIVguh+HGsu@Ca21urpqB;4JvswXyt*vWs=#+Y@&72TKp>H*L#`
zIEm5=ey#w`BK_3SD==4@Lsy(s=lD)Hi`nz@_lXYeBvz~{sOBHT60;)`wygXp5(A*o
z({*Ii`cAV6Y*4Rc(3;7Wuz=Y-{XIqYI_QsMV^APLaf-^<3_WBvn{F2JOzS^WpvRJF
z!G^YCNn8}e0n)RzsR7BR45!BDHb9}3*{(Z)4^aJq!Oh@O-YJSmp!poPoj;AF#Y9=-
zk2qLvMsC~dT_rd+nOKm}JvM07h2(wMYn7b@vQHcnkLh%Jh9-9mOhL4!9>Xd`8y!%=
zEAOrpH%m%O_yt;MQ4#=1#m3C{w&VIH3m>g{tZ5Y25_^e9{Q>%F0Idub^x9|B1Y1kU
z!(i#Ch}KQIgS0P@dDyG6+Vv>y*7_E+&z6f$-}WqZnvC)0nU+apCv<o;AA}f}gWrGR
zzj0U*O)=weJwDI?*{zY>XdR1-Aiikt#vk=n0SlY+$fW3F@0y{Q9@v8lKEw+e^%TRN
zPlk5ma@RXxA{a?;Ejy`U1H0G(VL>(Jngme5re<X-DohLHk}<lPrv#DlkOhV%XHLg4
zIqR7@#vAKo5_nFzy?@!{X<L}nNXvuC@8&I4nHIR1DK<H6wy6NaYd5L8y!k@wF1Mp6
ztHlC!icitkX~8}Wv#j8^*jG(l$UL53rp=D9pk=~Y%uEfwo^@*Heoiuqte36qj)OMZ
z^oVfqhpx9&T3Ky+0Ndkj1YqR%W*?6e-Z4*MJ<~Y{ly7(Rh(O4GM8`3_$l^kzNm$2t
z(dcb(HgsXEDiZu9pMBu?0KW#2GV8Ai3?$mfe7xzT4RYD-D5v$#D|2UkWZ2&dEfL23
znpWLu+nkX&0`gtkJXc%?UvW(ZE|A*W+r?3}-j1`Ab3FnyN;9H7p|3bL({9nH3`;p=
zp|wu8Cgt#FBj+jX+8<-$Z3AY<h?GZHdL)<X+S!@)AOn4*qp3M;L(m+zEYYU6>r#%d
z5O<bBEzE}$**-SJ7+x;G(G(yZNGNU&v|2#`w({rI7e60s`34e~qf8wP-7Sf&nU3XO
zp}={7L{|ovr;`tvX`@wky_YFF42(I<-ise^T<l3wI4ZVlAoTt&E|5{aG)-w?oZHva
zqA4Ht!U{n|>U`c+k<7y!!F?z#^abtLmbkj)L)pFPh+GXl2yK3vsIphBC0KuS)C=l7
z_nSdMocQEMQNxb~VB^D0S%5|N1rDW#!t(<H_J9U-^CL~|G$XXzpFS+Iw|p{U<Fo$T
zsZow10CKu8Ls**HouW|4#teN>@BMe!+JIT;fz`uN8-ui?Ls07B(D5e@3Io&dP-MMJ
zLr^nJ%NJ8+zQ0nSD9^U<B25qza|xns&Qrr-4^Wj0$g6fgE0%#?z;&W$@Wg4@m9jty
zm?@4r29x*oJ|K37Oc~@ACoye^{pJT2ZSgSUguE547;?CikXqn#SL?`UYZF_uoG@^_
z)U0@{)glHuf@6<0mw+DJkB*NRm}umct~Tl(+h<o8VQK($)CR)Id<&pVRz#Z_IUASC
z9jObajPIZY$XJjfbP2gUgKg>rjEtp-0*#xt+sO+l2hDY`6E?BOt2WW{G_mHO1?O=S
z+B-&|d-MQALqrf+W|NeJ{gl}NGj>?NqV<{mutkGHH@4>hJA;s`FLkOM<*eU#F%F;<
z&-E!%H?T%RAk}qj+=ss~d+X5|4TF=Ri@@SR4wJc?DFr0LV@Quqh%31_JhWfP`Jov;
z>Qs5q(L(b<aw=^A)PUv^E)nLN`<;qe6)SMW&{jdh$4hg|v3!v9!$l;rFZ4`cO+$Ud
z#>8=$0@PBpXl1;ypqaw7{>jlFOh4Ib?$^%%O(QRzP<#4V7dYh&Hv6z6#^%eR*AN4m
zL2gy&{^1e?+JX<P%j<xY7Lb|LVUnVhnJ|dff)fm@rC?O{sJ(nHCC=BB9c3R7R^L&T
zt6gc%6kDI9A#)XS57It{6NKExLdg4y6cecP;!ru5&vs&xho9LwKr|V@cgo*;i*EUD
z1_#gV%s%#4eHnyn!H?kO3trsKW8a5lI<V*7`3&w4B*tY@7L*I(ZGw)+fU5&P>4t0%
zQEWI~AK*wm^qVSJ+z;}??lLHN9*=|<Om-~Vu55{@n5&+Jq$>D0?`!yHGy+`&w(eSb
zG&GwyKj+R6YTlKFL1(GK_2q#5ot>agQ}&mE+XVd8*5+JCu;h)kWlF~|QXG5mTg986
zIRGXn@%U1zP|mCP=w`p!IDgnW&IS?Uc|HMZh@7dn^m6{5>|FhUJ=uw@ND0;VIqp^&
zDid%C+Mq@eYa$0M1{f8&$|!bcA+#JUu$zZXj;B<V_dUxRoH}b5%3+)OG*Xfg3vK6=
z$YO^4!F-P*+F)VAmV&pM9R|U0wSTHr<%ge_&ugBt-QHr8onhl!4>AXCGAi7!jxePK
zTh+BB#t;c20ZZHD9LI%B9!uNmJoX|d{}+^BrNspc!goVOU~>o7me5Toe%>a?O}|Gq
zXA4UT&qPvJGd9;0>z6}Jg&61KWVapnB{Ikd8VqJo60@Sm0dhIWZT>Fh6)+1|v`Wj%
z8CE!%H?fVhTdej~mT7(D9*=Sn#j}`h|87|sNK<ni2aX%lq9hO9o}HM2W~Op%3uSs`
zlQYl~#PaE8+UwMcr@(>G`FA45lODPKZ-i=QhEDp8PWB!=-B9&%ETn{l6m=iFRtA{c
zH+b)^t2%wxG5y{wW6%Yja3vpS#BPv@p$%}KhX^Z;6h2*S&!KCj2VW#EwZt_K2-OM?
z{V*Bz8_v)s4;v?j@mc7GJ{D=#^L`fyAA&6QX7+;P`trJ@eWuNW22vYX7!UVFB!F2;
zpP2B+$L-n@6jn84#I<ZSvboKK;Et$6u6({JQX$^PvFfV&=!(0ksn2j0a(T(?jijVF
zHntC2=J<G_&n~d3>kV$Jb31^1-O;s!eY|Dhbx*gDP5qoeI%sPNeu0TeSO`A7I~AHk
za_V=Ppq`stX`PZwDsyq6P#q6un&IqcPi#NE>^f*HlWIDmo;L}-f_R+07ck{&U@w??
zlbOM1H1(nzIj^aBhmc`Z<FY#0{RxbO@6Yy62rzPE^{(c+EdK8AK1`mg8AVMVm;Ttd
zs<xf$Uhn4~K_q7J%qzbt%=EPs;pW?qLU0Mmp!>OPB>mWkrR8DWj+n>ucMUDeJz5Xu
z`}I^>jCZ#8vr`&<S`%F1s1gp=t{2`7iN;=q6K#&wdLG4&eE`a&`Op0Y!yIsr>_;OJ
zF(VluV%!+R0L8KtRSx%D10%B*>)0f-{J)P#IDXnQ=Cn6mwpX3`3_mawLY`7tD~Nj|
z!Km-NA)nk}DpU&aMG9Q-zq`-}!!3j3gGw_UAw>tlH`0H-Bw-HJ#&-jwwE)<N<xX2>
z&0N`XH9;V3(TE88yl9hqSLni_{}l>iVf9z{jPc0iOz?#4&1TEIL?3JOAiHH($XL#^
zeb<0|Pw!mZ#>ENIRZwI<3q}vXWP<^3ri!3XuoD2=_vzYmUgxNS?|BViSDT8LSmqL{
zwOJ)r;;uWqG9)P5eUGh%%=rC<LYJ9zR|X#$ilg5b;;$tp8nFikC#V<ZWAyItFfe;#
zyaM`0bUbI=ie)w79dd>`mpOr*duKwMsKa({x(*?33=xw~&l1!guYS*MpD`Mh#%V{{
z3kdrDu>KlxY{VO18m2b+Iq<hXYHZ4{h%IGHb(#Igu%o~jNN@zRWnN75ZE@W3tlD>Y
zFecRx*Ooj`fEDEtGV1q!%>hFGErRjZ3o$O=@v$R^9e5)EyjVj6vhrfM%>(jlBtOfP
znOsaL$;i18YGOE}U22^)sdp6>Aq7@2u$kJa5!8I%`!P6fq%Y`8M^vwhqNAaln7_-t
zYMKELB2UjD=xv;q=eWs^X;+}s$CP_UCSTnpG?f*fp(y9<{B)%;hOt${F}*x|!z?PF
znKd3u3U09mj8B|8A%~=!YyL*5`nhl=%RaDv&be1E<6w-q_9+YVReStm%meL>60Jg)
z*nqWEGEufPQgzZo$ubU32qXM}D=?FI9fxnGfH)jozK%63yf`oX#O|SkCOkksv*Z;U
zThUUpXU6lC84SXOS=QJnjo`}{S&)}#e_%2}Y0>4@QDfqQm1Aw+)Fj9NU|zFQ-?!Iu
z>KnhuRjZ$E{B|uxp^G_-ls8(I+M`t<s-2MowTrK7jbSOa389TFVN&x*BU!&(?<R1=
z{^&^mKgJF!;LZN+m!<8D>^{Z#j2CUo6V<+_RZ38e`9XCgpJH6kao)x6#+8;A2F5;i
zX0Olp|H@HOy2g^Hc)>vo@#LPYwTYmpzl(Pb8|M!l8Ay>hW;7BMv1^jk0}78ao%lv;
zv%=dSiB)t(PJFID!_zHdw5k6a8-J-1RKqVQWmNB1AaOy>+0dw190I#%m{@WJ=I+3r
z_ar#|I>%vy`90(w|KRt#Y8E=RUJt2H#T8gnNf#LLpDoQjrZuc|frPxHGT_@zc*chq
z<d_ey#OSz`BRsX$vcFg>H9sp0110Hv(5Wo(vmx*KBbBX(BTAoZ3OQyW0*>2V{aXe(
zuvr=7Pb-xDN(8}YksqDMm;@$}olfiaChnOu1^Jn5oe9Izr5Dg5?H}6q6I#a?Vg4d<
zQ8~jB3ttzPc;4{hBRTEG`*tL)O1*7t?6%S`nJU{kIXO}LXI<;e%Iq52_wP_ss4sfL
z5Er5cDOD)a8darWqUTl+`{r=@E$6y1`I7hCd<gsH@YGCy&$ffcPh+c$VuVx~GsC(h
zS?d5F_GxkDk1fAn7I}S%5r5iqCDkwUo3m0(TT&p{P_h4Pxo6Mg8t=@wRF=SX_LEvU
zV1C*?Mni*3rshXVFCn7hI-!dyHZFC}r8m^^jp5$@57VN_DVj?ivtgN_sfp6}IsV=i
ziMp;Awx*?Hwie)nW}FH2n@62LP*r)B+h6CNcVJc9WP`$$IsjkpHa$w)bCH*%rZnZe
z&q?h+`tSv7Wv+06NqMae&Nd<(!mZ?z2j@s1)Gd`3Ueek8jbY9h_jmAKo_#&_7R2U2
zTSdUDf&$D-O?723aa}jG1ssFVM;&{)C_;&jcy)Bq-OMlI?60RgXH|`QN9?Z|?ULZ&
z)}_=`UibxV|D6{cI=iHieCLe_i!gZBoM4eH>uciet!E}@uIy{z8TB{&^lXN3LihCa
z+=oiP&zfTqh?N`ho}L`ilQr!l=wH8NIqSc}OyW#8BOE|r_AD^XIRwEQ)H-IJAM1IK
zD>%n<cijNe`Ki`0Df?0-F^nf$quU~z|JFIw$0tU2hiiWn`!Hp2tZ{UMg&B&<GwT`I
zFWg4|vk8{mbf$ur>u%?{*z2+A7EfzD>{J%gpQ>_jT`oO@$MEwOg*3L3+*D&RiX5EQ
z-*q`1^c0`fr*f`?&!}vs#ja<g#`4NttQ;Q>lhd9G{F5ZJ6M9sySAP7xIfRoFzNEB#
zz>c*Ry#PdUN<SYnPpWSPN1cyK6uuwk$<fs>Qpm1?WcwKXK{gM#C`i;@(#IL&724oY
zr1MQCq>zW@>(Tp`tveG)Ye;GmQ7g9M>MFLZv$GkFI=ROFVU+kT;IxVZOTxPHqF7W`
z8DthQ0Ihf+fjX4m-9uY>mG~-##s*!%Z!}a%GQH}sS@KbK8a9eQ{~?a_4~S^iwz@&9
zE={3*R>Vr!<$SYRJH=l8(bf=*%7`kFVARO2zl4o{;8oo7Ab+C1S$^%YsIJiSf9@wB
z_DKQz#Ju&Il0K7jDxF4r-C-(VyS?F0Dh;(siGpny&CzWCn}Ii%Isr|s+-na_bXG-o
zK%T+_6>qNKISl&jU#r15aV%vtv#evK2wydszM=iO<_25QbD%@8T%~KgYkb+%eNIli
zlqMzyGZZ3tUk%p8W@l~;DQ%i-^eGekkaejM<In7zxv_T-(_&NNyI#XQ+9;lN&P6ox
z)Cp+IS*aCyf)#h3vhf}4Cv1j*%D_Oj4*P{Zmtb~msdd;d9hFyiO(l;W9<02qb(e@&
z?vHxb7ehE$!_WO%J$^F$Gi6%Z<f1W}80mc6=QA#wY^p+}K+#{+y1_S=Ji-^s`;?A!
zhHEre7dnlaOt)Tww7i1swpFLlrA|_3RFWd&VwmP{I0nH`8?2fiIg4P@itaU65Ch9q
zMe1e3aQ*1v<&>4L$6}lvx195%(uLabz3GSO2@^rWm;F0I)x%)OizJ6F#_7&)ftXY5
zJPGFsXIa=I>I}<cZmzoP4{3aUVe>GpIX3kzH|LUsuydG;nR9SteW4Ynh`p)xeW#$Z
z#LYflrMI~w@@nf3k^A;nEOM{Q^mzw*PA1rMBv>J2$pxf7lhkC9c2MioiSjN})sK!v
z!@OL-US4)H(pL9q@H9!S9nB7$iCJ-t9K1umnNX%F^ue*+u{s<mL9Cx|KlgiF$s=bp
zjlUj8$m2V;`$8Q1VKmx6NBT<ibX@O{r$g)cC?O67A<r&q{R0Wbo1KZ;4_GK)Iu~di
z^69xig|BHK4IoXhI=_ErLE&82P!tnepdFUFqA?qnS8OL%-@_4YxF*lVWqCgWr`%a+
z?eXG67W4|*uSz0$T%v5@CRc+|YI3v3wyi@|(9mS?6f*DG&cxYhLXl6DOicCHo$%Dl
zDoMBRm(7GRuwGQN6s`Wi>!LmR(j*lbXR5995fWxRPfFuY4asxg)|0p>jaCmm9<El>
zKA~GWc2<1AqDbblBqnx9i>#J*@zsKugA#Y-Jq<~i$f{5A;f7Dsd+z$ZVWs<0t2hQ@
zR^B`QBJ;?Xp#_uv1aSy<Hqa%&u=znk&w>%ezUvuyJ-c%5L+-`H?{T$teCaZ8_<K#9
z<V|)~Q{xJUy@f-Bub)CiPoQ<!l65Q1Em_d}f}CP^<)-w4gePapj(MaADuQh}Co`Qc
z1ZvYJq*D4?C#O6hcFSnTT}xK*RTWjjR}OsRs?o=hy!YH|p4TZ-7cP=6=B2;gbjo_q
zy(u<K689dZ8DE1rCq22Bd=cU4y1d>N(6iFwf~z`zV%zGH>!9WQoWjt@eW+6o{#KQU
zTIf;B%e(ep`-eBHC68F_BcrY<S!yr934Ok6yLWvXCuIWv0}CMO%^OUCnN@bKW<A9!
zZOPZ+xEQow3EJOk$5vyDMvHIDFb|Q&eci4K2%kASp^ryN_R5Aj=zl*XsLIwC=AN>w
zj`)SD9J3M$M4r;CdU5V>?z-|vbcg5U35Thw4*dm^nRuj=dufNKaLSidT2)Q^ezwNx
z&h$y6o2w3KUVAOp*Ezbji$~%J4IHUVSvt(7tJu5(Q``F^i5=G7NvqeHfUK$cn%6n}
zr;9#&FPw?^-;J!CTY6JgQ37wyL`OIcmpNB|U+bHzeV?P?r5@Cu<;XE?50@^njb+JI
za?A~O+Z(~Q9;6p}?`=Re@=i0;kShu?s$#yMxQ6`;sw3vvT%bHM%SG$czt4Y+McB$2
z7I{_XS?g>MG8(Lw%--ZG_U`>uNy)m-p<T!_KbbjksC*+eO<gZ&^r))p3m0#fLOHnO
z`}8~jG5<k+3UXg*bik;5VsW~>^C3cUtZf_n_9itk>=^Tg8?bXz92YDFFC?@;Ewg(&
zB!|@m^1QlxJLYSC@m8LD9Oq^4W|P?TykC0byQ{b)n~HZs3^aCxr-;>#Q$8!^S_E7q
z(n#;N9ZIrk3sf?YaHUjUd>DOYl{&rEGCVRWDrF@6Kz8X&QX0lhwIidD34TFb`+2?i
za3|T;<u7H(iX`umqo=x5UC6#gZPoi6@dioFVJ-U~?&9_w`SQ$ldai9Tj{_!Dn9b5Z
zDS(67`;n7^{B{l_*4&8vd!48~mQ|aysjBtvwN^pLneQ{MkD{u(IHE<hi?+-cgzu{v
zX!qr_;vYVF>R}N-C^%S@;dC6|ruc&JDQ6<$SC{`dF0C#wmkpFqBYAvVk;PP`wjzgT
z|94%cRfU1WZ^`&w{vyqgm1T;({2dK{H(bHbzJBE8+-hbk9a_X)AMl5ZowMUFJwp33
zN2Mn1G?#Tty?b$2qYL7w>*5Lz?PS2Q{hn7%9|dqR(@Oq2A!ql85Ch;1C!X!e({YDy
zv;QX(LFpN^GI%m!XKryKrpd)49RMdr&{oSbsG6%)``~fgA3B`ubRt8;RlxU4;g2Z%
zC_K@ke7jwFvNb#p2(K5q_JT?B5};@7Cil|&qSzGytnWm_EBYU2Rjj_eX05xF^Cc%<
zsOL#^l~P}Uh7dchHQXB4en#S^S|1(tioSZ1p^=|SdLA}5nc?GKmmqvUwN^5fS>?%H
zb)AR7bVAWj*{44rM^D&$b?6EH<Kg=(e1jo1`VXpeuzA&W&?6;ADOJ#OCE}5h(iiIs
zl?hT-Hh8DRAmGXEv-G6-hSCQnu*#w>{#$Gwr|FXzqYX2Dujfin6pn0*i9iJw06VRJ
z^7HY4{l`n%>Y~^;AyR)AaVE<_mjk4(^y}wGEv`w7+WXWb&8y~$k!`&d!=8Lu(*F1R
z0Z^mL$X?(~sIi&GdAXKfU8@FIfC_O*o!h3EFf1^lY<Bq#i)<(eP3AfO_)I85A(#H6
zu|UgmKfTVgY!hks-OA%+wQIDU!bM`s1W56g&>%ZksGt!tFeUz|X@S!;`C?udeG+^!
z-v-YNOS*fP5OPItb?yagbD_p$Y#fUn-$sQL6*ENVJ2;I$dvm+{QB(w+#kZOZAjG`&
z>3FraMo-0^`1ZSr5BNB7E$#n*Y~}xyk?k+@XuvR)HM5YjDC(k9LwCzCbYlfL1joFH
zy%#mY(x4a0jPps>TW}{ugCbyt)xGWodefn_D6iNAurz%cxsv}yZH_H__f+YIO!XNK
zwXYRE%Z^U9cVld=IGo4^U%&S<^PN;V(sIxP*b6^pwN5k0Tbr)}5Ef<D3Sn^P+?|$Q
z=-oa=fb7)u8D3NZ%@O~HHS^wGW95mC1oT8j6<-cqpszaDqtii5zcr>RFume45vbV+
z5YYgXr}BXp+>@yKwNQEP*>W+4S(!E_>0TpK`QRU<k$UCl6>SOK?`rm<;$TB|0A)il
zB1==$o^ixfZ@5#tO932ZQeV?v4j9*otv_i&+x7LA@xqP<zqDae&DWmXGt_IW3M4n$
z-&L2^0ni{P3w!g*YWOK8=B);qX7EEfSkT@~<KWbDD?590)r-J{{FDXa6OlT}dbiUm
zpLQZ2NZl;GI%cms;9Vvu9=|KsC5W4kKH_p;<C^v-b+@<{HEO6&b>0Quzs&@kBma*b
z-?LDs^IoNyUI3l*QBP<@lnF-g6g>qyuDk^ADr-!)=L2;leeB^nl?!xMQZA+k>ID5G
z$>-#r{kAWdJA@GS(sj#~*S9y{LS?z)?D-?pIK!_*5}?`fe?0TEJ5{ow#V&I%HAcFh
zHehsWuSajXiEH+iTpTM)e32p4hy7#h==Lj-XX<8&Zm|;Mt5@cNk}Eb6y6DeQSuruT
zk86Ukzhlx9YNITn+xAY@Q~(a)%&~SHeU@i7T>-ut!u={Ck6%AIlFGu{;Sh}H2LZqE
zkNu1fF|w<aN%YiYWn<5<=eer3hzg9$s@P4as4};g<JedqMmsf)ZRGJc*shg5l+)v6
zj8qWrm<1k({^7kSwVF5RAd?irUPV^y&OPB?vkeod>=%?)LnPX!=S=K0#Z*~ld60go
zLsWjEUZ%2^_s@j;m(i6AGpv7Lb>M$*?~pTqj}tFl|I<_PU(qROF}%&#t_S+FV2_t1
zlai7ojj~LHo0sLc4)Y*Kc|W;v{V+uB4v^sc7nCmqBO_q-b#+JjFp@rO-v`D5?G4!4
z58B!f#O{;!_nXPnTTIa}hSA~P<e2CHtDTXigLV;RPy_-qlPW9vK)%l19Ci#Pp|b*Q
zoLwr3WkZtXpe-%1jJMOyKWzSrh=Pjelt%=&8(MD|o{!2@2i(Wp_uDWz^jpY_iYwjP
zlwFOPIXoW8lPP!W@o93x2w}hM@^mksi4t1Iew%69xlJo7hOKlT_BbBi0x1Og9cp&g
zyB-kL$?|G5rS8kbj$)C}aFTJtbnQVuq-SfbqJHPZPfLx{42`@;3OfU|<AFbQErNjx
zwPFKuSE0QPhfAs2e|eGjHb93lps*%mrfAjOCYQT4pNxW8M9iifBS)>LlrL62bx^1X
z+pG^ubvj%oi<Er0dMZ@-nQULC=J4+(1G9^Br4o}%FWU6ooUlKWw{N__Z$Pblnw~lI
zAf^+y0$wd&^!+XLX(lQarDh_teIr_TTvkysaASKVWYHXk<hZfGz@XgP^zJI2RYlSY
z_k{cJu$gb|Jrlv=Zl56Mr*{f4oo9>yQ6q0}dMZ~Vw9(DK$KSi1#=~&lWm?u}`Q+Qq
zM8Lvafv4qoF7O4-^ZgZFY;y(Wze_LQ0r0Q3{Ko2Aa(<{KP>s#1W{%X^9aGoPmj=ds
zbIag}t%vn5GVLAFs{gEBtabo$0_zx`{2Z^*scelQ(QdVVp)HvJB!*==HRu%8TdrHS
z`5k`U!q`2sZ!4gOGU0XPdDsh|lGnU{O?lr%$JC<~r9LD1W88hsf49HfOa>8fG*3MS
z7n{Rq1V+i$tU$h{x@V`5(O!GA+qT!DIGUT><)$s;JwKR8^flp8i6-`&ZAf|T29!6%
zIqjxY+{Ru7rT5f{XdyZk!pn;U)FcT#_3TpPt7sY-9)KUL7%k5!zk6{hb&NSzD`#n{
z=;|qw2r{ll*Te%gnK-F_x-%alg0K=o46Msub2ft*N{=*l-=5scNM+e?XmANOxGSRz
z1xkyRYu5nVs862Y1=jgEB&p9d^{EVOvm=YualT}88^zVV9DDTDRz>ZVtXY*q=_8vb
z33!w&C{@;H$@|b<L#TZosdQ?ra)4T)Wa<~hv1#-xW?iT;SQ~x0QRcy=EuN!fAS;MP
zU$picXlEqE;!*Orcke7GYEZ^i?pcl2`Jr2KC$?4TbUFI5BheK!FaO>O+OMY(MQ9J@
zX1Yn`Iah@&UBwfXo$x){8stGdbocF^OOa#+t%X#Jm;V8^e^cE=b|(F;J@mtHMU<1N
zbAScXRPEQ;a8p@}<TL!RjU1WibSb%Q1GO#HeJ2cB9U}E!%0sqvOcgVLf|qu1Tkj!U
zDksu2Q=4v-nX-RkK-UJzn|;|m$tJb)gGty>E36@-X-Dl)*<=<y+L#;Q`v!+8^ix&n
zcPp!i{m1pfg?JH&bA#VzFWkYVEWNASJqpwepvFH&5&50;U-#+HuLCTK%~WLer<tNo
z&uin>c*-0qvbldi!+4T>X8w$x|Bx?jWzLd4u$&|Izyh{{1tEBr^JP<K)Rcs0V8rx&
zVwrr7xpYuaMT3lwaC|Eg>6&E%L3%~BJA_cc^|S+0Y8KqglA9fSIHKX!da%7hLgAI%
zdZbv956w1+p4HT3YsK7}mv&?Lo*YA3#8OkD{~@qX0XuTIJ%>SV-o>9z!07d$qa99-
z#ikB7hN~|D++>2{;lnhjV3Z{(Ay&?Tgbrh8m<)QI@3Ez7(zWv;VCm#r6`&>V;P*Ed
zq9`ocXWaHh&l2bD-~EPrB)!;BoYA)VF(P`^I5jxgw4jQihkzKvwc~3oHDI-F&I3h^
z49*-fqCWShnEWewmi)X^++M+_UU{esip((KgnR0-hlMDG#^vD^cOp|p3YY4Y$PzAd
z7`j?P{J{gxMif4E2%OqEUva>@zZ^B)>Jvojm|y8*#CePnx%=by*XtU`-I>w5+>*an
zb~{XUiJ-&hAH&n@FTc3kvm-iGCVwb=--EAT{#T~&iCH1wMsZxtx~vk&+nZ3^+0|tA
z<Lw@>DgqlCf7kp67EtbBs#;|@-ss3v)S4+9Q|9LEw)<rF4Vkd!W*n%0R<fJL$TB{1
zIi7#Y@ybNfQK$%F`6;j-xOO5?Jsnrw-bicd8|v9;6<e1H^vJ2d1m85)kn%g~-v>pD
z*pxZVy+fG}mA(<&FgA7Zmqb6z8T8^xNc2ao_+Mjo@mSK7QBd(?Two4DD)8DplqJR;
zB{Q6u$=Et~!tuU+ozu9?=M*b7c3H#Qo5pT3X%jvxXnRV#?(l4Qu^3yn_c+{gV&SSA
z=3x>4%8|QA`tjqO^2#c)&&_X}p>6~7kt3s3pPPQ0Ap@lBWJjmv8U>Q;a0F+(5Jbjv
zMW?3(l*1A`6m8S}d-~J!tz#<V#+Jcy`uNM?I_9AXib>>vwS><gSJRF!1xMTvTdu61
z_P+Xry2BP&otimvgo!gf#<jXtelZIo-tt*q_?+elx87!XrZJYkJn!S}S1kndv)BYq
z$_CJcrMi34p|echvk&LF6cuoM8D1>{YD$-g-iO#$R~i|aMkYeg&I927(ioVu@2CY~
zYBwXCG;@v5EUM?2939<Z`G7ZkzGk_?RoYo%v)NU&fde5ca(4rj)Y=~4K&-e5I|+h+
zU(iW%PS=i&c~Hs1<-Oc2@759n-^}rbdN>YcH13$LD|-2j!9DN^@Tm`roeRJvE%w+p
zNYD6TSZ>B0Ls{XKPoPDQx&s^TCT_R0<EmQoEin$A^J()(gfCkEWaP>+p9o+F;_1@L
zJtP0J!Dn(^>NX4a?CaoyX|fetnuo&}Tgx|)I8c2}@tcND`2t~%axG1_vYB-ZY;M>>
zui15WUfpta7@&^a9^j!(DO8o0URxB64LpgRVT-JPVkHl9)|5=0Fs|S66}m3IVaji0
z7QLxWBfJVN=L~mVp7NwF?JuQcAJGWmZqGG6XYkKeyJKQ?i{!h;AIZ-+*q3*G+S=Q-
zJxVM9?FEM8T5sRuwDYacECI&d5C}MOevgqRLE;Wz<tr;P`Hy-YTrv&)+v#&XC28Tg
z(lBp;LBnPELb;Fe*VNpaf5580NED=4Gcv#y8|Lml{BH3Bdz|M|&1bfvIqfL5?ZVA~
zosQ1z4_R`9LH=>9HuHxT2-js<;j%X$Q#{>MmR1ruCGWE$76zLFJLeG%q{cO*Y;#sE
zueIAPu6mxPb7UpU#la|TFk5SCo6q4-WwOSWceOf<d!TL*f;HZWGQD}R>+ujmcDVvc
z_jlHcNF>sU#(BC%K#MZ0b^84L<t7NdNgo+-;{rj4zg57Hjc~~EJcKd=p`b-5I<uGE
zmYa>Id{4Xu1L5xHw>bt}8|3To{iee{7hw?*m+B|G@_YU>J6uAID*fp+XSd~(Cy4YE
zlaI`-ttNFM&}bm4>v6q^pZmF7z;RV+zm>CH)1EW&#!_Vy*hhy3od({;lKHJGC$#~7
z-A^ANvV8(hg9&H;wk}tdD7fz!)5e~(_KY20!dQB_a|$Vjs48O3_~~{`8-g8a`E1Sf
ziG*dC)p_0n+~EL*ug^mGOdr079q!^y$8H!WB6^X7cAIU02a$@LJFYThVKV*hQsaj=
zsck@iy_v0Gs&psyuWTO`5^WkwnbwB{N*vMXLJFD+Z3Xm9gSrI}`)I2WN-=E*Mjfcf
zQZ}Ol*DZlid^Ses*RMF?j4%(}6HMF3o^V7D?&45nZPS85?NkixX?>lvOrwa<p+RHC
z&BW+8&u*!mRCyRU*WEW%k7h_>4xJ%YDUz!w6pD7*<q$TXt9Eq+;Bwz?XMxb0en+RA
zXIj~utaz6@o1N2r2cP18;7TEZwV`fefOGO%baMTO@T%|fv*rBOt5%&+oXs?HGYu6T
zBz|5ZibMK}kfEt5rIU65Qen(VqKB+Gyt8kG_aFv_$V-Z!WPgbJr}NCmMz3TtvIz4~
zUJ&C7o@x!`32-n2MOB)b24K`3m1wTW?8p_nc;|pQMu=*CF)%1O_qxKL)<@A0InI2S
z5^tE7m#^<w2JuXJ`$GI?ar8sBeQh<6#0}2+8-CNw)LCXKFniSgbXhW)oa4#;nI5D5
z^!fPq6d2I}_0LJF>-!6HvyPh;lOsB-Y_dq;iTs7S6vC$6;fCwJj;C`iIq%NCec{2k
zI#gF?CgbCz@Bc{~hR2DO9(Jq}i5=uASeDaEG=;^_>wE$@PY2Hc+h(A%Bz<Dvo~lD8
z_Q7I%Ph;NHjC;CIjE3pzxoBcHCoSJ>K7CkD4-c`TXIMiF!0xvBq8+yShP4%yv7?aQ
zbX%qZw*z;Fo0Sbv@*X^JC`n(~QEFL`z9v8apfG;zNzKPNK)RNB{@RCq0G@&B{&%=Z
zgRh$Q{hRmuB(WE+J>GrsY)c<_1@s#I-~h9>MH@vlUFU!A610<wA_M&66I`bOM;CVr
zbnugQ1fdDM{2Qo61MD99PSl3}(a$j-E=e}~0`ZDF@;GC^VL90*<D8uJOu$axiu`AE
z<a9kC!v<nB`Y(A;=ZTlP1UdkYvk2Xj+}xrHZ+|_U*`mzQ-wynP0m|+_@4ftQLHwTx
z_J1P*>wj3Ezx~0e(bIPJHj}B56UKJ)Y4t(dRHAni${yuVD!W<f-XlZeL;aGJ-aRu`
z6%q%ajVq_M7@&7ZAbOzE{Ccx33-@X)df%n`al8me{S8GrG1$n108oQj_Ix&vhv(kW
zT|O+-=P*GeL!o+WFfX+)SS4JUc|%q^%BRuKQYOMI!pzVaBm7x>FCCdK4@6Mbe)0r#
z`zzCa0FM1uAP;Y9;`*j9C@j1=QDqY@fZ+LiW4`ShmlV&0vVUxhqiLDQlqZBl;jBen
zQ8VF6R~W76o15Z-FtL;;4ZK0B?~hc%Qy!~(mJI=YT7Yd6mh(P1!+r60483D3&gHnn
zWtT*9dP6aZh$){{wFv$q#3fY|aJ1AN;));4!ilS^q9ZN|nc%mY%DpG3vEO5?c`E$u
z>YP%g(hC)%^qRO_##QyWu9%A7*L+f|Cn7qr7!T|<zwo!gW;>aH`OHX9r@$d(xW1V$
z4%nL$0XU4!-o-RKg~ri<$~DiUEh?jc06u47OsieVm8Ts3hMm1Alyy$1NI$r(OZi%u
zV_@s(oj4P9;D`_ITzII?d<2{k2?+_(e7ML=t()bJL|ow=uS3_JF2KebjcJ5#YaSIn
z75T`2!;ZaCtPC+;tCzhn!p?UFSmGJz#)0P(aG~9Fg#%$5#2)?DNYck*VT?ZDg!2HZ
zTdGF}?!OV{z!fDLL6O=CJ7A{GDUF($Zl*|DaVl1(L?TN*a4&|kMUvk+KG0FlHsg*R
z*6&SM{VaAvtJDPB49raFdmb|f@qHd)5b}$_-*zBZVB~a`x>=3GSQ%``h1$o9S2q6n
zqdX^E{e~zHO8JJT_)bWzNZ0O4JM?jlQEJWYM{(NX&KYJw(rMj(vDJ|#DWG6(8()IA
zuQ(UkGMEBb)NkSE8}a0(Ei!ewnd~!GW=b9mRj5YEP;l;5(e&G9p30YQs*9evx4g%*
zCLtCAb&~_FkrEp$zcsF@hw}?{MaQ^V%B<gWseEEt-dV=U<z&dg$Avp`Tlm5&<1Ejb
zoZ2)RK;JKFS?__BWTyU7JitMyxHvwoAlg2Rrlc21{BX%fMmpedDZ|62yMS%Mmsjko
zIH-JB<y_zMGnhBuP*#1l!wXZ1ydp(oZ#)x7UyBCjVmF1<t(-v`#hOfzrZ4H5RfRmI
z;$ijOChTXsPUMaKVY>rxzScxDjD{a7=)n;aC2N1UOJCr?urPmfTW{m7`T-t_>{~W-
z>aVLrj%X|=YC)!&=VJ1ELR%}8dP?tgQxh{DkW;%f?y!pR^vT9r#9BIWzNWA6_#Z=_
zA%!%Gu)gpml7DhgCSavZXyi@xMxj@ZqpxQh3jYotIUm0=)t^w_Sq{&9i9y0QYUKw$
zmAet*BY?p{@BFE___pN_!TkT6dLeW?{4lloFcpWx`R{Kw0wC7AP(Z6{li|OK{MW@m
zPas?y`qy3d8>q@02?!ZL6x6@UG_O|;oZ(vf70jT`vugv}v!ShLQmTM@Ac4R|^X)DD
zb}G!G($OP8Qmx1dU0YgO+S{Bijsm8H|BfXfjYv#NqD!sCw`-mvgzMh@-;dD;1ANcL
z1|fPi=q4(u9DthN{`K%TzdR1O1jRQyFgK=US}TDqeLC+w@OA%-B|d(|Ic&B)>d(?h
zGRly=QQjet@iiQ5(CEn@l;WHsKk2x|UZ#VcOVoSuG}IYm)jGoEZ2`QaQS~SAAT1<e
z7&s{{bFVt1Z3aX@Orat+BBdsZGuVo`)jW@}mJKnok>!`Y#!MN`{xp9mZ%leOj+h*n
z%5#&_DUxBPFzWkN3iW#ez<k!iF8&6zFmL%<hfZdgXv_U@ky)=ZRe%HFr{x@xIESL7
zI_(mZiFp1-gI<^Gu@56G$0qd@z+a57wDYn&3Cwdq351G3m^$4txei-0fjdX<*hA-k
zWShpDrrAwki#$of_cSSgLFm`G)`^o0T9wp=F_(`@<Qr9T+(|F3kWZ7gXFHH$xE_Jd
z{ZRL*oIIyUsh06u>|x#toao9JM#2Jc8j)9>Fjg^7J*@>gQyGPwZ<?<+2Q?ybfR{YF
z6Y1?C4}7`Y$-g<|D&`;E5{Om3&o}S>Ik7rRn|dkaN>`<zuxfCq_;*#6f$`c8cP@gJ
zB_rgyoP7y3^@CRbfdzQ`R@3IjzSs*9R2}u^fL$;sK>t4Uov`Xh^A^xU+)Ji#ynqKE
zlTc<|kX*AnVw10kU$OQ}2Lp*Cw|-AQNrY3T2D<7F{WOBZxt8YTXxw46SPkLgyw{Cj
zr#qw9B7is{N7KTs%B#*xu`ALIrL7s`A%tDH`?O1W*He1R1UabalP%UX?j=(#?;`X|
zmC2~TT$DvwU%7zcOq7!!y|{|J=FgK^W@e(2>2hJ=yx@vo-){D4iy6U3b#mDu3JorP
z;+V(A0VuHG%4#GYgL_pP`WgN82OolL>9p{5bAVT0`o`b%&aqcp#VZDdg_rsFUG{(g
zU&Q6Xp?$ohql~D7T!e~n|5w0-dKZpfU+PasPCKb5Eh$GLonPe)og!FOxlP7?ai%XO
zP~2ef%dp$i%kA(>Wt@{9JATgRV>`~WdGJMr3>Em~!MP@W<N%VEbODG~<p(Jj)o#9S
z<9q1_re-tnf`+*sR7KeafSbTNmHRrUkJ?QfHi#BqfYt-EYTw?UN|`?jx14h~IdZjk
z!#>ivfcmm{L(M1dlvApZ$j1Q9n0PJ6JWq?wsbpeNWM$|Gv@ohQNwz8s*N%zQ&DAcd
zsB}McO?#83z%g*fL+XXZs)#DRJ_X;q^Gq2gq&Wd5$mT#sTg4*}_4tHW+PQ9bOqe=j
zM`C+#1rmPRjwfYCOZXMZKm9$T2MC(7EDy_u3iL!88|VmdWWN(OIpDHt&r5a`6Iu2K
zD9Sy#mb%z$5wMAqibPIBpJ@SJ=(n+dJ3q%`fcFcSB^Y?y8~F|>;qVxr4Oom5*ZynX
z;ovK}Zl8gf>+hMwmC<LC^lC)c=s7szl*a(24}1K4*6DDqnYzX)>rEF_{zVsi0Y{y7
zoJkYgt~s8_q!@ah0*uq6lm8k}=rIXGBhi~e9j`=FSI9u4LYvG$@b&{{F1b(6M%OM-
z=puZ;;LQMUdie+lpa&(J5BmV)Tn?kGxilSG&zjSR1iUZ42S<0%=?3%bzsUxy!T;-a
z5P1H-Ivc=Wo(SQarGNYn6~W428dMq`9R*hCheTjt;7Pys|0j|C-wB%NL;W8bG2qM-
zOZp-p_tH7p)iVS&|5*wxo`_pX_!p<*3#?RJOhMGY+zW(Zev!dh^gMDbs>7k&%aGeN
zPs9@@+We#tB!t0q7`>>$oI#x*$-4;d2bFC+splxDNcF5r^ry$OwU=GDd4QS`hHM}p
zJG?>8s^~J>vog2O_Rf{jbJ;EL>rLWa;H4Oy4Nj2KE95(`CU<GxDY{ob|3-F_GN5}f
ziqeMMl{O)VI|*1Z+WUAXf;A+wrvM?rgAafl!$e#=xsNNaVEh;%bRsPC!)W#032*Wr
z-N8|IM+Zrq2LnJ0vjkp1$g27LdE+ixL)Lp8I{sO^tpboCwYcK#8{rV<^NI5Zx15)f
ztjj*+SgIvzV_2UQk)u9#+~1*d;Fyc+SB&&3D6gr8rQR-fHFq0q)!jqk$pEKzsaUw?
zB@uO7!<cxT1E7>w`o#kh8N`)HBl&Ax{bj6Kz~agA(p`wWyu7fmuu}|7$5R88DInce
zHSt|r2_|@CQ)p(48a>VJCsXg~0#=vLuAz0gQoBFOva!jMe{@g>4d5OLd*`Fzlj$|W
z0!~1Yj~R@i-4@d;X6ux!Rvn4VSaAWlO1Zm;!>1Ht?6lTDNoNEAXnw126fqS9q?JC$
zuclkhv;T=}|6glnj8v%Wy^MMKS84lo<oS@=!P~5aJNTGbjf<7uu=pER7;s0SEy$Le
z=^B^=#tpFRB6z`TSyz^sQOS8)mCxC(a}dJ7qf-sx>Wv?`_l-P#Z$CHBrbLXPzvNYg
zckk)wwCez64GPo#kX8WRyUS5{^Feqxi%1Yq?dFK?UF#H;%5zEL*1XO}&VP=2ES_^(
zUn7pR8sTi|YDKmiHm}~D`fX+lf>|z9$VhHx#d>}%3JFdKMpWM9*3U&1&fe@FoiUpf
z5Bkj~gRco@$hnp8{idPPQ)EIePzdr1RTCb{0a%LJ`bR%cPPcPD+048ADE36dKiZXU
zHBH6*uWE<Z11rUwFMXW<kmJQ0S4J^-(kPV!kejWXmh@_t1;y}2zfhXIS2j#_D|LBU
zpL_9(%cR9eWpFy&1KAbNj<=jG1XdgS3@~^@%*Q{O9jBh<6$S1ND4RY7wrQWfWkb3-
z->OHQb#lwWaK9_xdc>MY{tb1)cD}4YSG*9r)&^U8hwC!h@4*$eETt-@yf?R^%S?4w
zReB<aFRR>|h`7&w@h_cXpt=O`8mI}7LHbkCBJm7s<TJNNImT*;CT`L%87`w=01Nt`
zwNa;>iR2u;dLNg2=f$H&vs*bDUdcmJO7yDu&4VW+cdyx$dGDUZvrGHCTLZay7KU4;
zBG07TW^z(ljGn3pNNA|ICrvA?;*WLTfcs2&^X-FuxN0E41+m3TPd~c4x;hNCbtHbj
znuUJ&NcqJ>DcftRx}BALre|3Drc%>uQ+li2n`&+V(v+Vq$LRh!zjqyg#!C&}VI=fH
zN9LYdUS$YgFXuJSgc>4T{^ses3Ecr6eA;Z4)jPk92X3=*XEEuaAFFg06QCR_=wdD5
zTe_88f=Azh-yVIJJ^)8Y$8d*H``e#6z!`DyK-a-h!ED3zOQ$bQXgK({KJ8gyaSM&k
z@+?I2V?J@|#$LK@#8&w|l3%(|SGF#s`bEQ)EgqPK-9KvbBCM=xKCvZGi>*@EZ7UTE
z^vcP&4wkGp0biV1FngZn3S5t@_><lP-ARBmG+X~KI2jnmODpVE;N!&ke^*-kuU*IV
zC;o@b`G1=h@xSfC{}0`j|LGk4VPZ9UuHak=M+E9ol?QH(We-vIW2<-LVvRz8Z(b8|
zDom-TV3mxArU<fr<%-mIk+y0ex4#k)3jO=U_%I-@Jah#rB|*rHjIR<7=T^sG2K5Q#
zRrQ_jTSn!CP53)unDtWF3&?C4<+@2=ljYmlrqxbUO{sfVofWY)(~gQ#$!1;+{EJ$-
zO)u&?=u9wMqD#%2Wi=NlGbp(O1WOi%+18ZJP{%AoM-@#ZrFEApvL&KSHMpL^nxkHf
zWm>tzhB_QFFdiN|SKpZdMW6OdX1+4vh&`uHA<tTVqhiUX1v#{uF<NQo<v#3nLYy->
zP1fyB#77+JRcZ4L0AD}Hcjm>11jf#CNQ39fU|#qb^VBDpTB*r4`P5rJLt`Z|`&cuf
z=cAd{10R<=`Rr9{&}Eypb1<8JqIMVGi9;|{EYMaQk0nOc&xAI`#N`o+Lb58d07lSA
zOrQ59hO?+Wr4a;7EVSc0Qef5lR48yO1BGbN6ETAqOzvw#FFTm|i`9J1{N6jdWdLuo
z@Lc;C=cTUS;ZVx(DM=ZWDKM7~<UXc|`0&(#(2)p^l(LIyUGhDhOvb}8p5l4132Rt0
znAYG#PW9e=8lW?_2TxO7I~wE$F6}fVfbF;)wuLa_cbu<tFi)#hb#Nc0dme1hJ@A_w
zCT3x5*qUz|xf2~Ck9qv%50{;eseirYLP<7Are#9d)r>0{cQoeAKCu;bRRP!c22eyQ
zq*j!xDV1KSOHPNvl*_LD>C2lF+JC)dEx#*t6jBss?9W$hSJcwmYxEmIWe3Q0eSE37
zTRV22V@uHyQZ3dtH<s0-rFbU|SH0i=5#<3gQx!~);Jj4MTF~To(Ro2Wn!Eg8$%Rug
zP*)p|!%2h(Gq!TKyq6kfKYIju?`H9%(*1Vxv!wG;&UtM@6Rp<2T0K*~$%&^Lm^E;A
zPu#n}!H5D?-Oh~RVboHST#*NEGtFxy5R8Q1clk#HL0jT5)+vP{Vz|{e<SGz=(f$Pn
zlhbt-SSU2=2>Vcuq<(fJdvoDZzU1L_rS`qEC*)X<)MdB&Y+{t-UFeG2K9LVuwJhy)
zH7rm!g85gXP%l;*x_eo2pC$i0;8Q*Mz~5Fhd|z7wRubPX6P6W|+j|G%90MQ5Odh&D
zimk>b-A_1Fzk7txp8X-FuKh$z_*0bljl91S%F<QN2+(yD7oRs~svIzd5AZQnx!a^o
z2K}I}%s8?=b5w+SmP~5@eMRLd;|@V)f{nXR_&&lO*($frrSK31NuDE;{00^i68d#!
z9pN>{*@nMjsQ9nc<cT_O%)SK*{mu%6Lf8UeMHE$Dk7fx6h#z;K!XonrR$(Y!ZHDz`
z;5vZN>jl7?YdGX(Myb2IdpxjTW}m2FuCGx{ucF32?a%v5`NhyVkbZdFiXy%q&1ZN#
zc+ePk4E~M*yeDB!B>2m*$2~!j&{G7qo(YloAG9Y&0%aaj(FZ=mgf$j`tBw5lk)hZw
zw?eO8Oe(-zN*7%KpKMHTb@Qk}HQ)Aiwc0ARpNa>1$Il!%2l-P4$a^vD?&&=4l-HH{
zu2oO7HBu$JCE4C7@xt!dVL$D@CY5^N{)*%*!$rG^XIfYRMX7x39Z-~Uc3$3m^=S;y
zoO;;-kQ_B%SKkrxx~WE%-$-_^zQM^a@BA?TSv7jHH+@Pz45H4cV&wn#2=+@=SC^Sk
zx}1BSF;gYn;G0JKQ~w}0;C5x4xX3YK)$H~Gbu%r;12JJeU0>+vYCpX-m-EnPvv<RR
zkYquC#4tEpoqKBWP4trT5z8B~vfuiyy%H8-A6K--+EGLG`K=lFs~%)P<`VlZSN_!t
zAr+WIzP~2b_Bl1*X}usXT-~x~>11}nSd~&ctYxNbnFn{GQ4Ii94b220O(qISR24-C
z-CHayHxzc!i$l<!7@3W)5O4BvA$+C{<bwiyMHf}(S7LvGno4ZWpJ=;C&b7@E2T4eW
zvTqzu9;0Ws4anX5*5x0&>?QgIc<22>vw(9uk)E(R;W*p-!$YdtoAxQG!|id74$pbP
znowCa#Mh9+JSio^uiv+_hX9JT?DVSYD&G}O`|K+cmBp57CJ(B>;^;9!mQQhCthAf3
zYO42{(A&HPW<3wDIhmw<f9m!~r98}51kUaD-c8^_^hJo8a`}oBy!xh9lat+)QZCo^
zMd6Lvu8JmM%fJk+qs0p$_Cd!32=NPQ8trY$Be%Hi;Lnb78{g-M?kan_$K@U1a+wG6
zEki#{CJ?%HINoaNS~D;(C>2>o3Qf1VXdExk6=@_TMuVbhgARR{XEKmi2|sqV-vc}<
zlbiBBD>_IGJJ(&r60ZFnz9!F<7V9MNGO8syd=7Uc>4vH*S>ci2{rR(EF-Boz_Xgmq
z-Q|K>0z|f5^U>3l{-;%{21QV#&+bB!E+?JgQUDN<-8r!#NxhzMPVPu+G^)s>SsF;x
zj7m26kPrFMXW?HWYGb0hML9MdMZCaT2#{Q|xXK!Pg1yff0Yh<=q`Q?X*m=AhcY{}B
zA>~U&i4IRMcETSx0#fQ{-MUoMBA#B>fctCsI8jFdb$z|~+cmx`I8ls-9Yf-Z`2ue0
zAS)OZGhe;*+rUGTbgjUtGg9D%j9DA17itS~mnie>8U?gngNHw2xY43g*+0GkWe@}q
zdl{O-Lab|5X1y=Bnl5uC3v&C7pZ&oZ>`<L(*(Q>-%IQXoos2w+L!+uJQ8D=~1`pLV
z{GWAV8bV#3QwCbax>Ow`_tP9i=AD#Jm%?n8>I>8C1^bpH!l+N4Hz(6MAG<%ZG?>}<
z#5jYw)dkQ6LZ-Uj=?bP9Om@FikA+N;%`likXjej<IQ8X6E`UO8Gg2&)$kLio>!Mbs
z>;hy<cJyB&gzpn-HPyPX?!@}#C&bj(&V=5Iz|QQ8<TdgZ$KCq7l1ZOVZ9moEj!d4^
zF&h4&`>=NaJAppI0T>fuEZQewFT_v)(0?km&aEb_%mF1Y-J~DsI9-ai&_<5UbT>V$
z_c#!Wc1;226k7(8L?0~7=@_F^4%h&Bk6vF*3dFv2b%kBpcUw>9FNZXlsYwhf*{Xys
z|9(Qzb8^Im=zluV9x3*v=&vH_z5Nd&EfQltaYxDX3c$k-w+n|uZB3!S{Y>vmP3qev
zhE(U@brADewRFwZ_x6O^2Q00`Bt|wz`X7u|ds6|#y9_7NxU}sMNt)jpjqMJ{bRFy?
zP1_B-c5VF=WBU6gT`h(bZ>flsw4K7Mz(O-_nzA}=WxKzwZrGZdA~52X97UX_i*{bs
z0aOaEUHOxKy1N<{o_?=i&yEvU-i^{c%Y{Y$ugS~ZHL28ie{-tJqrw)!|JA^?RC^Ae
zZeRQ+xpM2q|6&)rFTUSt1DwM5-?n3C{p+wOU%^Q#kIt=){=Un9_eHg+@|Um9M188r
zefBD-w%+^d$~BI%`o7;~-k1OLT5B?AO6Q%ORd%P$XZ7CN@iE5J%_6s|`f#^fp<C^_
z2^CQ@Cb(H_e!ls#&-vdk4jNb+UbTpjF<x>UxDzmIjl^;Dh4)q~$-PuIG_2OoJ9qq8
zw)^U-0c%alM3%EWHr|@|{EE;<mz9TucJ*thdxSdGD7PQm7Iju&?x%`>lgy%4N@>l#
z={UvAXRE4Qq5b?hUg^9iZ{3O#x}sBJ+5DDWeX?(sarmK&6ZgG{nyfVU*3=4zNiS|j
z?`ZFLvH6w$=1A|^YhBh2JUn}3^y2J8`4)>`w)dQDuYNiF@jT7zr=L%<<#qY!{3$$r
z&#6x<r=EUz<3Q)m9QW&eM{nzv&pY-BxPI~Jvl9ip7w50O_>DQRrpT~c@6jIB!p~pU
zEt!4F>+#EHw%Zm?2r0Pm_)*l}7v;bWaSP{Jm#e+mx$|Y%*B7?tZ!2W#-S_uwo3MtN
zVdah;i=_Il%sv=c{pH@J2NQKwxjnyk{Zf$z7Hqn)7QlT3C%BllnWt$>O5Kax8)Y@C
zw2*W2R-OA9-_$#$ZvOn$d+wp@cBPjhlcy;kIqa~c`%$6crcBStS`+sj^N?Ox_vDMt
zZ@0GWsTFclax!JiQ<9s~{%_%LpIDl{^31*N=${`SZJik%zUgq<;u%Ynw_R(0(PNz&
zvRbzMlkQob-Pcm*T-j#&Xz|-OaZ-V+k3L@Ok{vSrUF&D#!|BrLx2mi>GfMMc)?|J<
zQS;PGB4*cQzl7Zr)(M5j_ne<|WA?f2lfSU;+PcLgdgfiZyFaYAKhj#TIr991_WOt3
zRW<MB_M`~@O|4kA^>FbeUzN2VdiQ_!vTj)7>3T^~<)quCpFx*6eKy4@y<DPmHmD1D
zm}IwC&4$M(mu$J*{ZadGui=~N;`!6v5BC-aRtfE&XWgmuWrwXSzwGrB`eB=A2J4v!
z_dc`Pbio^PShDw{cdd&TUp^j{b|)+3`BCFs+1YZrt2K1u{oPiadv@j2vpCOr$Nd*K
z*#4{y`+s(Fs_fU;C(9oPJ!fa=-+AneZ2xTCp6@p;Z+g^Do0ziZ{2dO(wVULue)1{w
zmfmi&sXbw`>88c{wTrW!^h?QRRoLBioh}(3b$)s6ac|(r#Bw9~Lzgb?-Bx_(iOBs|
zGgjuu|NgRJ?&YIupEj?^*|U6F!{Xmsxy*G->KD5G_G=f+{d4fv3#HipWIx?^-pAi~
z@K3ls**@l_C$t*}xv>sDg5KP7DHwPV^r6Qosj0wS9RW4{x9`vF@7f>!QuWvaP>-F<
zUmP@mHt=^N{H_NMVg3JK$jQ|PbPpS-smaW+obf@_raRe>K`!-l^>bP0l+XkKa%EU&


From e7cd61d0e8f1884441a1845c5a72f429102ae300 Mon Sep 17 00:00:00 2001
From: qudadd <201747065+qudadd@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:01:49 +0800
Subject: [PATCH 10/10] fix: recover interrupted timezone upgrades and verify
 guard identity

---
 docs/ARCHITECTURE.md                   |  6 ++++
 docs/releases/0.25.0-alpha.1.md        |  1 +
 envscope/timezone_heartbeat.py         | 29 ++++++++++++++++
 envscope/timezone_service.py           |  7 ++--
 envscope/timezone_windows.py           | 48 ++++++++++++++++++--------
 envscope/watchdog.py                   |  9 ++---
 native/timezone_windows.c              | 28 ++++++++++++---
 scripts/windows_timezone_acceptance.py | 28 +++++++++++++--
 tests/test_watchdog.py                 | 27 +++++++++++++--
 tests/test_windows_timezone_service.py | 36 ++++++++++++++++++-
 tests/test_windows_timezone_worker.py  | 34 ++++++++++++++++++
 11 files changed, 220 insertions(+), 33 deletions(-)
 create mode 100644 envscope/timezone_heartbeat.py

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 0bb3a87..ccc20d1 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -109,3 +109,9 @@ STUN 验证消息类型、magic cookie、transaction ID、消息长度、属性
 `timezone_service.py` 均提供预览、确认、独立读回、恢复和撤销。前台授权与周期心跳分别
 记录，后台不会弹授权窗口。`guard_notifications.py` 对需要处理的状态去重，正常巡检和
 恢复只留日志。实施与验收范围见 [权限升级验收表](PERMISSION_ACCEPTANCE.md)。
+
+Windows 安装器与原生守护共用独占事务锁。安装器先写受保护的事务记录，
+完成后原子发布该记录的摘要；守护只接受相符的提交摘要。初次设置时区由获授权的
+前台事务写入并读回，周期任务没有绕过提交检查的入口。升级中断导致程序与基线
+暂时不匹配时，恢复入口仍读取受保护的记录和备份摘要，普通巡检继续拒绝该状态。
+两个平台的状态页与 Watchdog 共用心跳身份、策略、时效检查。
diff --git a/docs/releases/0.25.0-alpha.1.md b/docs/releases/0.25.0-alpha.1.md
index f63af7e..b71288a 100644
--- a/docs/releases/0.25.0-alpha.1.md
+++ b/docs/releases/0.25.0-alpha.1.md
@@ -5,6 +5,7 @@
 - 读取失败分别显示权限拒绝、组织策略、超时、工具缺失或本版未支持。根据当前失败项目提供授权入口，返回后复检原选择；取消与目标改变不会沿用旧证据。
 - Windows 增加受保护的系统时区守护，与 macOS 服务一样按批准基线运行、读回、限频、记录和恢复。后台权限不足不会声称已经保护，也不会反复弹出授权框。
 - 守护异常通知去重，重启应用后仍可查看待处理事项。
+- Windows 守护升级中断时保留恢复入口；未完成事务阻止后台写入，恢复后才重新巡检。心跳核对版本、策略和目标，避免旧状态误报正常。
 - 首页集中显示目标、检测、问题与修复方案。侧栏直接进入守护和账号，高级系统操作按需展开；保留选择检查、全选、备份、恢复和工具。
 - 更新应用、托盘和导航图标；保留页面滚动与展开说明，防止检测重复提交。设置刷新和保存、教学与 IP 读取之间的时序冲突已修正。
 - 安装包使用固定应用标识与版本资源；更新校验包身份、摘要和发布版本。
diff --git a/envscope/timezone_heartbeat.py b/envscope/timezone_heartbeat.py
new file mode 100644
index 0000000..60d22cf
--- /dev/null
+++ b/envscope/timezone_heartbeat.py
@@ -0,0 +1,29 @@
+"""One strict identity/freshness check for native service and watchdog views."""
+from . import __release__
+
+
+def normalize_heartbeat(value, system):
+    if system != 'Windows':
+        return value
+    result = dict(value)
+    for key in ('format', 'guard_policy'):
+        text = value.get(key)
+        result[key] = int(text) if isinstance(text, str) and text in ('1', '2') else None
+    for key in ('fixture', 'initial'):
+        result[key] = {'0': False, '1': True}.get(value.get(key))
+    try:
+        result['at_epoch'] = float(value.get('at_epoch', 0))
+    except (TypeError, ValueError):
+        result['at_epoch'] = 0
+    return result
+
+
+def heartbeat_current(baseline, heartbeat, now, *, fixture=False):
+    stamp = heartbeat.get('at_epoch')
+    return (type(heartbeat.get('format')) is int and heartbeat['format'] == 1
+            and type(heartbeat.get('guard_policy')) is int and heartbeat['guard_policy'] == 2
+            and baseline.get('release') == __release__
+            and heartbeat.get('release') == baseline.get('release')
+            and bool(baseline.get('target')) and heartbeat.get('target') == baseline['target']
+            and heartbeat.get('fixture') is fixture and heartbeat.get('initial') is False
+            and type(stamp) in (int, float) and 0 <= now - stamp < 180)
diff --git a/envscope/timezone_service.py b/envscope/timezone_service.py
index eed7a54..791ef56 100644
--- a/envscope/timezone_service.py
+++ b/envscope/timezone_service.py
@@ -28,6 +28,7 @@
 from .region_setup import current_region
 from .remedies import SolutionPlans
 from .target_environment import fingerprint
+from .timezone_heartbeat import heartbeat_current
 
 
 @dataclass(frozen=True)
@@ -479,11 +480,7 @@ def status(self):
                 state,reason='unregistered','服务文件存在，但系统未确认注册。可预览重新安装。'
             elif heartbeat and (type(heartbeat.get('guard_policy')) is not int or heartbeat.get('guard_policy')!=2):
                 state,reason='outdated','系统时区守护仍使用旧策略，不能确认已监测旧任务冲突；请预览更新并等待新心跳。'
-            elif (type(heartbeat.get('format')) is not int or heartbeat.get('format')!=1
-                  or heartbeat.get('release')!=base.get('release')
-                  or type(heartbeat.get('at_epoch')) not in (int,float) or not 0<=self.io.clock()-heartbeat['at_epoch']<180
-                  or heartbeat.get('target')!=base['target'] or heartbeat.get('fixture') is not self.io.fixture
-                  or heartbeat.get('initial') is not False):
+            elif not heartbeat_current(base,heartbeat,self.io.clock(),fixture=self.io.fixture):
                 state,reason='waiting','尚未收到当前基线的新心跳，请刷新；没有心跳不计为守护正常。'
             elif heartbeat.get('state')=='legacy_conflict':
                 state,reason='conflict','后台检测到旧时区任务重新出现或登记读取失败，已暂停写入。请处理旧任务并复检。'
diff --git a/envscope/timezone_windows.py b/envscope/timezone_windows.py
index 5829045..6cb99e2 100644
--- a/envscope/timezone_windows.py
+++ b/envscope/timezone_windows.py
@@ -14,6 +14,7 @@
 from .region_setup import current_region
 from .system_network_windows import COMMON, powershell, quote
 from .target_environment import fingerprint
+from .timezone_heartbeat import heartbeat_current, normalize_heartbeat
 
 # Reuse the existing reviewed ACL, reparse and atomic JSON-write primitives.
 PROTECTION = COMMON[COMMON.index('function Assert-Protected'):COMMON.index('$Root=@ROOT@')]
@@ -26,6 +27,7 @@
 $Root=@ROOT@;$TaskName=@TASK@;$Fixture=@FIXTURE@
 $Worker=Join-Path $Root 'timezone-helper.exe'
 $Baseline=Join-Path $Root 'baseline.ini';$ReceiptPath=Join-Path $Root 'transaction.json'
+$CommitPath=Join-Path $Root 'worker-commit.json'
 $WorkerArgs=@ARGS@
 if([IO.DriveInfo]::new([IO.Path]::GetPathRoot($Root)).DriveType -ne 'Fixed'){throw 'local fixed volume required'}
 function Hash($path) {if(-not(Test-Path -LiteralPath $path)){return ''};Assert-Protected $path;return (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash.ToLowerInvariant()}
@@ -44,11 +46,21 @@
 function Snapshot {
  No-Links $Root
  if(Test-Path -LiteralPath $Root){Assert-Protected ([IO.DirectoryInfo]::new($Root).Parent.FullName);Assert-Protected $Root}
- $task=Read-Task;$base=Ini $Baseline;$status=Ini (Join-Path $Root 'status.ini');$receipt=@{}
+ $task=Read-Task;$receipt=@{}
  if(Test-Path -LiteralPath $ReceiptPath){Assert-Protected $ReceiptPath;if((Get-Item -LiteralPath $ReceiptPath).Length -gt 65536){throw 'oversized receipt'};$receipt=Get-Content -LiteralPath $ReceiptPath -Raw | ConvertFrom-Json}
- if($base.Count -and ($base.format -cne '1' -or $base.worker_sha256 -cne (Hash $Worker) -or $base.owner -cnotmatch '^S-1-5(-[0-9]+)+$')){throw 'invalid baseline'}
- if($task -and -not $base.Count -and $receipt.state -notin @('pending','partial')){throw 'orphan task'}
- return @{baseline=$base;status=$status;transaction=$receipt;registered=($null -ne $task);enabled=($null -ne $task -and $task.Settings.Enabled);baseline_sha=(Hash $Baseline);worker_sha=(Hash $Worker);pending=($receipt.state -in @('pending','partial'))}
+ if($receipt.id -and ($receipt.format -ne 1 -or $receipt.id -cnotmatch '^[a-f0-9]{32}$' -or $receipt.owner -cnotmatch '^S-1-5(-[0-9]+)+$' -or $receipt.fixture -isnot [bool] -or $receipt.fixture -ne $Fixture -or $receipt.state -notin @('pending','partial','committed','restored'))){throw 'invalid receipt'}
+ if((Test-Path -LiteralPath $ReceiptPath) -and -not $receipt.id){throw 'invalid receipt'}
+ $committed=$false
+ if(Test-Path -LiteralPath $CommitPath){Assert-Protected $CommitPath;if((Get-Item -LiteralPath $CommitPath).Length -eq 66){$committed=([IO.File]::ReadAllText($CommitPath) -ceq ('"'+(Hash $ReceiptPath)+'"'))}}
+ $pending=($receipt.id -and ($receipt.state -in @('pending','partial') -or -not $committed))
+ # Recovery trusts the protected receipt and its backup hashes, never a torn
+ # live baseline/worker pair. Still validate ACLs even when parsing is deferred.
+ $baselineHash=Hash $Baseline;$workerHash=Hash $Worker;[void](Hash (Join-Path $Root 'status.ini'))
+ try{$base=Ini $Baseline}catch{if(-not $pending){throw};$base=@{}}
+ try{$status=Ini (Join-Path $Root 'status.ini')}catch{if(-not $pending){throw};$status=@{}}
+ if(-not $pending -and $base.Count -and ($base.format -cne '1' -or $base.worker_sha256 -cne $workerHash -or $base.owner -cnotmatch '^S-1-5(-[0-9]+)+$')){throw 'invalid baseline'}
+ if($task -and -not $base.Count -and -not $pending){throw 'orphan task'}
+ return @{baseline=$base;status=$status;transaction=$receipt;registered=($null -ne $task);enabled=($null -ne $task -and $task.Settings.Enabled);baseline_sha=$baselineHash;worker_sha=$workerHash;pending=[bool]$pending}
 }
 function New-Root($path) {
  No-Links $path;if(Test-Path -LiteralPath $path){Assert-Protected $path;return}
@@ -106,9 +118,9 @@
  if($p.nonce -cnotmatch '^[a-f0-9]{32}$' -or $p.owner -cnotmatch '^S-1-5(-[0-9]+)+$' -or $p.action -notin @('install','remove','restore')){throw 'invalid plan'}
  $now=Snapshot
  if($now.baseline_sha -cne $p.before.baseline_sha -or $now.worker_sha -cne $p.before.worker_sha -or $now.registered -ne $p.before.registered -or $now.enabled -ne $p.before.enabled -or $now.transaction.id -cne $p.before.transaction.id){throw 'state changed'}
- if($now.baseline.Count -and $now.baseline.owner -cne $p.owner){throw 'foreign owner'}
+ if($now.baseline.Count -and $now.baseline.owner -cne $p.owner -and -not ($now.pending -and $p.action -eq 'restore')){throw 'foreign owner'}
  if($p.action -eq 'restore') {
-  $r=$now.transaction;if($r.id -cne $p.restore_id -or $r.owner -cne $p.owner -or $r.state -notin @('committed','pending','partial')){throw 'foreign receipt'}
+  $r=$now.transaction;if($r.id -cne $p.restore_id -or $r.owner -cne $p.owner -or $r.state -notin @('committed','pending','partial','restored')){throw 'foreign receipt'}
   $backup=Join-Path $Root ('backup-'+$r.id);Assert-Protected $backup
   foreach($name in @('timezone-helper.exe','baseline.ini','state.ini','status.ini')){$old=Join-Path $backup $name;if($r.hashes.$name -and (Hash $old) -cne $r.hashes.$name){throw 'backup changed'}}
   Stop-Guard
@@ -119,7 +131,7 @@
   }
   Set-Zone $r.before_zone
   if($r.before_registered){Register-Guard ([bool]$r.before_enabled)}
-  $r.state='restored';Record $r
+  $r.state='restored';Record $r;Save $CommitPath (Hash $ReceiptPath) $true
  } else {
   if($now.pending){throw 'recovery required'}
   if((Zone) -cne $p.observed){throw 'zone changed'}
@@ -135,29 +147,34 @@
   }
   $r=@{format=1;id=$p.nonce;owner=$p.owner;state='pending';before_zone=$p.observed;before_registered=$now.registered;before_enabled=$now.enabled;hashes=$hashes;fixture=$Fixture;action=$p.action}
   Record $r
-  if($Fixture -and $p.fixture_interrupt){throw 'fixture interruption'}
+  if($Fixture -and (($p.fixture_interrupt -is [bool] -and $p.fixture_interrupt) -or $p.fixture_interrupt -ceq 'after_pending')){throw 'fixture interruption'}
   Stop-Guard
   if($p.action -eq 'install') {
    if($p.target -cnotmatch '^[A-Za-z0-9 +_-]{1,100}$' -or $p.release -cnotmatch '^v[0-9a-zA-Z.+-]+$'){throw 'invalid target'}
    Copy-Item -LiteralPath (Join-Path $stage 'worker.exe') -Destination $Worker -Force;Protect $Worker $false $true
+   if($Fixture -and $p.fixture_interrupt -eq 'after_worker'){throw 'fixture worker interruption'}
    $original=if($now.baseline.original){$now.baseline.original}else{$p.observed}
    $ini="[guard]`nformat=1`nowner=$($p.owner)`ntarget=$($p.target)`noriginal=$original`nrelease=$($p.release)`nworker_sha256=$($p.worker.sha256)`nnonce=$($p.nonce)`n"
+   if($Fixture -and $p.fixture_interrupt -eq 'baseline_partial'){[IO.File]::WriteAllText($Baseline,"[guard]`nformat=1`nbroken");Protect $Baseline $false $true;throw 'fixture baseline interruption'}
    [IO.File]::WriteAllText($Baseline,$ini,[Text.UTF8Encoding]::new($false));Protect $Baseline $false $true
    foreach($name in @('state.ini','status.ini')){$file=Join-Path $Root $name;if(Test-Path -LiteralPath $file){Assert-Protected $file;Remove-Item -LiteralPath $file -Force}}
-   if($Fixture){& $Worker --once $Root}else{& $Worker --once};if($LASTEXITCODE -ne 0 -or (Zone) -cne $p.target){throw 'worker failed'}
+   # Only this explicitly reviewed foreground transaction may initialize the
+   # timezone. Scheduled workers require the committed receipt and same lock.
+   Set-Zone $p.target
    Register-Guard $true
   } else {
    if($p.restore){Set-Zone $now.baseline.original}
    if(Test-Path -LiteralPath $Baseline){Assert-Protected $Baseline;Remove-Item -LiteralPath $Baseline -Force}
   }
   $r.after_baseline_sha=Hash $Baseline;$r.after_worker_sha=Hash $Worker
-  $r.state='committed';Record $r
+  $r.state='committed';Record $r;Save $CommitPath (Hash $ReceiptPath) $true
  }
 } catch {if($r -and $r.state -ne 'restored'){$r.state='partial';Record $r};throw}
 finally {
  # Keep stage and receipts for recovery; never recursively delete system paths.
  $transactionLock.Dispose()
 }
+if(Test-Path -LiteralPath $Baseline){if($Fixture){& $Worker --once $Root}else{& $Worker --once};if($LASTEXITCODE -ne 0){throw 'post-commit worker failed'}}
 '''
 
 
@@ -198,7 +215,7 @@ def owner(self):
     def authority(self):
         value=self.inspect();beat=value.get('status',{})
         return {**value,'registered':value['registered'] and value['enabled'],'foreign_owner':bool(value['baseline']) and value['baseline'].get('owner')!=self.owner(),
-                'status':{**beat,'at_epoch':float(beat.get('at_epoch',0)),'initial':beat.get('initial')!='0'}}
+                'fixture':self.fixture,'status':normalize_heartbeat(beat,'Windows')}
 
     def execute(self,payload):
         data=json.dumps(payload,sort_keys=True).encode()
@@ -250,8 +267,9 @@ def __init__(self,store,reader,*,io=None,**kwargs):
     def status(self):
         try:
             snapshot=self.io.inspect();base=snapshot['baseline'];beat=snapshot['status'];receipt=snapshot.get('transaction',{})
-            owner=base.get('owner')==self.io.owner() if base else receipt.get('owner')==self.io.owner()
-            stamp=float(beat.get('at_epoch',0));current=(beat.get('format')=='1' and beat.get('guard_policy')=='2' and beat.get('target')==base.get('target') and beat.get('release')==base.get('release') and beat.get('fixture')==str(int(self.io.fixture)) and beat.get('initial')=='0' and 0<=self.io.clock()-stamp<180)
+            owner=base.get('owner')==self.io.owner() if base and not snapshot['pending'] else receipt.get('owner')==self.io.owner()
+            normalized=normalize_heartbeat(beat,'Windows');stamp=normalized.get('at_epoch',0)
+            current=heartbeat_current(base,normalized,self.io.clock(),fixture=self.io.fixture)
             state=('recovery_required' if snapshot['pending'] else 'conflict' if base and not owner else 'not_installed' if not base else
                    'unregistered' if not snapshot['registered'] or not snapshot['enabled'] else 'waiting' if not current else
                    'active' if beat.get('state') in ('healthy','restored') and beat.get('observed')==base.get('target') else 'attention')
@@ -321,8 +339,8 @@ def _restore_plan(self,*,pending=False,nonce=None):
         snapshot=self.io.inspect();record=snapshot.get('transaction',{});owner=self.io.owner()
         if record.get('owner')!=owner:return {'state':'blocked','reason':'恢复记录不属于当前用户。'}
         if nonce and record.get('id')!=nonce:return {'state':'retest_required','reason':'已有后续时区操作，未覆盖。'}
-        if (pending and not snapshot['pending']) or record.get('state') not in ('committed','partial','pending'):return {'state':'guided','reason':'没有符合条件的恢复记录。'}
-        if record.get('state')=='committed' and (record.get('after_baseline_sha')!=snapshot['baseline_sha'] or record.get('after_worker_sha')!=snapshot['worker_sha']):
+        if (pending and not snapshot['pending']) or record.get('state') not in ('committed','partial','pending','restored') or record.get('state')=='restored' and not snapshot['pending']:return {'state':'guided','reason':'没有符合条件的恢复记录。'}
+        if record.get('state')=='committed' and not snapshot['pending'] and (record.get('after_baseline_sha')!=snapshot['baseline_sha'] or record.get('after_worker_sha')!=snapshot['worker_sha']):
             return {'state':'blocked','reason':'事务完成后的系统基线或程序又有变化，未覆盖后续修改。'}
         payload={'nonce':secrets.token_hex(16),'owner':owner,'action':'restore','before':stable(snapshot),'restore_id':record['id']}
         return self._plan(payload,['申请系统授权，停止当前时区任务，并恢复最新事务保存的时区、辅助程序与后台任务状态。','保留完整备份和日志；恢复后重新检测。'])
diff --git a/envscope/watchdog.py b/envscope/watchdog.py
index e696046..68af07a 100644
--- a/envscope/watchdog.py
+++ b/envscope/watchdog.py
@@ -16,6 +16,7 @@
 from .region_setup import current_region, discover_controller, set_system_value, _run
 from .accounts import _safe_chain
 from .transport import CurlTransport
+from .timezone_heartbeat import heartbeat_current
 
 
 def native_write(key, value, system=None, runner=_run):
@@ -100,7 +101,7 @@ def __init__(self,home=None,system=None,reader=None,writer=None,controller=None,
             native_io=NativeTimezoneIO()
             def native_authority():
                 value=native_io.inspect();base=value.get('baseline',{})
-                return {**value,'foreign_owner':bool(base) and base.get('owner_uid')!=os.getuid()}
+                return {**value,'fixture':native_io.fixture,'foreign_owner':bool(base) and base.get('owner_uid')!=os.getuid()}
             self.authority=native_authority
         if authority is None and self.system=='Windows' and platform.system()=='Windows' and reader is None and writer is None:
             from .timezone_windows import WindowsTimezoneIO
@@ -201,9 +202,9 @@ def mark(state,note):
                     if authority.get('baseline') and (not authority.get('registered') or authority['baseline'].get('target')!=target):
                         mark('attention','系统时区守护与用户任务的基线不一致或尚未注册；未覆盖，请重新批准本次维护方案。');continue
                     if authority.get('registered'):
-                        heartbeat=authority.get('status',{});stamp=heartbeat.get('at_epoch')
-                        healthy=(type(stamp) in (int,float) and 0<=now-stamp<180
-                                 and heartbeat.get('state') in ('healthy','restored','repairing','cooldown') and heartbeat.get('initial') is False)
+                        heartbeat=authority.get('status',{})
+                        healthy=(heartbeat_current(authority.get('baseline',{}),heartbeat,now,fixture=authority.get('fixture',False))
+                                 and heartbeat.get('state') in ('healthy','restored','repairing','cooldown'))
                         mark(('delegated' if drift else 'healthy') if healthy else 'attention',('时区漂移已交给获授权的系统守护，等待下次 60 秒检查并读回。' if drift else '批准的时区基线及系统守护心跳正常') if healthy else '已注册系统时区守护，但心跳过期或恢复已暂停；请在本页核对状态并重新批准。')
                         continue
                 if key=='timezone' and self.capability_reader().get('timezone',{}).get('state')!='available':
diff --git a/native/timezone_windows.c b/native/timezone_windows.c
index d277448..bb4b430 100644
--- a/native/timezone_windows.c
+++ b/native/timezone_windows.c
@@ -93,9 +93,9 @@ static int replace_text(const wchar_t *name,const char *data) {
 static int ascii(const wchar_t *in,char *out,int size) {
     return WideCharToMultiByte(CP_UTF8,0,in,-1,out,size,NULL,NULL)>0;
 }
-static int own_hash(wchar_t out[65]) {
-    wchar_t file[MAX_PATH];BYTE digest[32], buffer[16384];BCRYPT_ALG_HANDLE alg=NULL;BCRYPT_HASH_HANDLE hash=NULL;
-    if(!GetModuleFileNameW(NULL,file,MAX_PATH)||!safe_file(file,0))return 0;
+static int file_hash(const wchar_t *file,wchar_t out[65]) {
+    BYTE digest[32], buffer[16384];BCRYPT_ALG_HANDLE alg=NULL;BCRYPT_HASH_HANDLE hash=NULL;
+    if(!safe_file(file,0))return 0;
     HANDLE h=CreateFileW(file,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_FLAG_OPEN_REPARSE_POINT,NULL);
     if(h==INVALID_HANDLE_VALUE)return 0;
     int ok=BCryptOpenAlgorithmProvider(&alg,BCRYPT_SHA256_ALGORITHM,NULL,0)==0 && BCryptCreateHash(alg,&hash,NULL,0,NULL,0,0)==0;
@@ -104,6 +104,18 @@ static int own_hash(wchar_t out[65]) {
     if(hash)BCryptDestroyHash(hash);if(alg)BCryptCloseAlgorithmProvider(alg,0);CloseHandle(h);
     if(ok){for(int i=0;i<32;i++)swprintf(out+i*2,3,L"%02x",digest[i]);out[64]=0;}return ok;
 }
+static int own_hash(wchar_t out[65]) {
+    wchar_t file[MAX_PATH];return GetModuleFileNameW(NULL,file,MAX_PATH)&&file_hash(file,out);
+}
+static int committed_lifecycle(void) {
+    wchar_t file[MAX_PATH],hash[65];char receipt[67],expected[65];DWORD count=0;
+    if(!path_for(file,L"transaction.json")||!file_hash(file,hash)||!ascii(hash,expected,sizeof(expected)))return 0;
+    if(!path_for(file,L"worker-commit.json")||!safe_file(file,0))return 0;
+    HANDLE h=CreateFileW(file,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+    if(h==INVALID_HANDLE_VALUE)return 0;
+    int ok=ReadFile(h,receipt,sizeof(receipt),&count,NULL)&&count==66&&receipt[0]=='"'&&receipt[65]=='"'&&!memcmp(receipt+1,expected,64);
+    CloseHandle(h);return ok;
+}
 static int read_zone(void) {
 #if ENVSCOPE_FIXTURE
     return read_value(L"clock.ini",L"timezone",observed,128)&&text_safe(observed);
@@ -149,7 +161,7 @@ static int status(const char *state,const wchar_t *attempts,int pending) {
     }
     snprintf(data,sizeof(data),"[guard]\nstate=%s\nattempts=%s\npending=%d\n",state,tries,pending);return replace_text(L"state.ini",data);
 }
-static int once(void) {
+static int once_locked(void) {
     wchar_t file[MAX_PATH],value[512],hash[65];
     if(!safe_file(root,0)||!path_for(file,L"baseline.ini")||!safe_file(file,0))return 72;
     if(!read_value(L"baseline.ini",L"worker_sha256",value,512)||!own_hash(hash)||wcscmp(hash,value))return 73;
@@ -161,6 +173,7 @@ static int once(void) {
     path_for(state_path,L"state.ini");
     if(GetFileAttributesW(state_path)!=INVALID_FILE_ATTRIBUTES && (!read_value(L"state.ini",L"pending",pending,8)||!safe_file(state_path,0)||(wcscmp(pending,L"0")&&wcscmp(pending,L"1"))))goto done;
     read_value(L"state.ini",L"attempts",attempts,512);
+    if(!committed_lifecycle()){ok=status("lifecycle_pending",attempts,!wcscmp(pending,L"1"));goto done;}
     if(!wcscmp(pending,L"1")){ok=status("attention",attempts,1);goto done;}
     if(!wcscmp(observed,target)){ok=status("healthy",attempts,0);goto done;}
     long long last=0, values[3];int count=0;wchar_t *cursor=attempts;
@@ -176,6 +189,13 @@ static int once(void) {
     ok=status("restored",attempts,0);
 done:CloseHandle(lock);return ok?0:76;
 }
+static int once(void) {
+    wchar_t file[MAX_PATH];
+    if(!safe_file(root,0)||!path_for(file,L"transaction.lock")||!safe_file(file,1))return 72;
+    HANDLE lock=CreateFileW(file,GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_ALWAYS,FILE_FLAG_OPEN_REPARSE_POINT,NULL);
+    if(lock==INVALID_HANDLE_VALUE)return 75;
+    int result=once_locked();CloseHandle(lock);return result;
+}
 int wmain(int argc,wchar_t **argv) {
     if(argc==2&&!wcscmp(argv[1],L"--version")){printf("{\"format\":1,\"release\":\"%s\",\"fixture\":%s}\n",ENVSCOPE_RELEASE,fixture?"true":"false");return 0;}
     if(argc!=(fixture?3:2)||wcscmp(argv[1],L"--once"))return 64;
diff --git a/scripts/windows_timezone_acceptance.py b/scripts/windows_timezone_acceptance.py
index 1a68ff1..b985052 100644
--- a/scripts/windows_timezone_acceptance.py
+++ b/scripts/windows_timezone_acceptance.py
@@ -33,7 +33,7 @@ def main():
         worker=json.loads((build_root/'timezone-helper.json').read_text())|{'path':str(binary)}
         class FixtureIO(WindowsTimezoneIO):
             interrupt=False
-            def execute(self,payload):super().execute({**payload,**({'fixture_interrupt':True} if self.interrupt else {})})
+            def execute(self,payload):super().execute({**payload,**({'fixture_interrupt':self.interrupt} if self.interrupt else {})})
         io=FixtureIO(root=root,task=task,fixture=True,worker=lambda:worker)
         def powershell(source):
             value=subprocess.run([io.executable,'-NoProfile','-NonInteractive','-Command','[Console]::InputEncoding=[Text.UTF8Encoding]::new($false); & ([scriptblock]::Create([Console]::In.ReadToEnd()))'],input=source.encode(),capture_output=True,timeout=30)
@@ -67,9 +67,33 @@ def reader():
             plan=service.prepare_undo();assert service.undo(plan['plan_id'],True)['state']=='completed'
             assert reader()['network']['timezone_id']=='Eastern Standard Time'
             summary['remove_restore_undo']=True
-            r=report(Path(temporary),store.settings(),'Windows');plan=service.prepare(r);io.interrupt=True
+            r=report(Path(temporary),store.settings(),'Windows');plan=service.prepare(r);io.interrupt='after_pending'
             assert service.apply(plan['plan_id'],True)['state']=='partial';assert service.status()['state']=='recovery_required'
+            powershell(io.script("Set-Zone 'China Standard Time'"))
+            deadline=time.monotonic()+85
+            while time.monotonic()<deadline:
+                beat=io.inspect()['status']
+                if beat.get('state')=='lifecycle_pending' and beat.get('initial')=='0':break
+                time.sleep(2)
+            else:raise AssertionError('No scheduled cycle observed during incomplete lifecycle')
+            assert reader()['network']['timezone_id']=='China Standard Time'
+            summary['pending_lifecycle_blocks_scheduled_write']=True
             io.interrupt=False;plan=service.prepare_recovery();assert service.recover(plan['plan_id'],True)['state']=='completed'
+            # Distinct executable bytes reproduce a real upgrade's old-baseline /
+            # new-worker mismatch. A PE overlay leaves the fixture code unchanged.
+            upgraded=binary.with_name('timezone-upgrade-fixture.exe')
+            upgraded.write_bytes(binary.read_bytes()+b'ENVSCOPE_UPGRADE_FIXTURE')
+            worker=worker|{'path':str(upgraded),'sha256':hashlib.sha256(upgraded.read_bytes()).hexdigest()}
+            for stage in ('after_worker','baseline_partial'):
+                r=report(Path(temporary),store.settings(),'Windows');plan=service.prepare(r);io.interrupt=stage
+                assert service.apply(plan['plan_id'],True)['state']=='partial'
+                assert service.status()['state']=='recovery_required',service.status()
+                snapshot=io.inspect()
+                if stage=='after_worker':assert snapshot['baseline']['worker_sha256']!=snapshot['worker_sha']
+                else:assert not snapshot['baseline']
+                io.interrupt=False;plan=service.prepare_recovery();assert plan['state']=='planned',plan
+                result=service.recover(plan['plan_id'],True);assert result['state']=='completed',result
+                summary[stage+'_recovered']=True
             summary['interrupted_transaction_recovery']=True
             assert subprocess.check_output([tzutil,'/g'])==before_zone
             summary.update(real_timezone_unchanged=True,real_uac_consent=False,fixture_worker=True)
diff --git a/tests/test_watchdog.py b/tests/test_watchdog.py
index 427c7fc..617bfe0 100644
--- a/tests/test_watchdog.py
+++ b/tests/test_watchdog.py
@@ -11,6 +11,7 @@
 from envscope.accounts import AccountManager, AccountError
 from tests.test_maintenance import FakeScheduler
 from scripts.environment_fixtures import report, target
+from envscope import __release__
 
 
 class WatchdogTests(unittest.TestCase):
@@ -37,14 +38,36 @@ def test_authorized_mac_service_owns_timezone_repairs_without_duplicate_writes(s
         from datetime import datetime,timezone
         now=datetime.now(timezone.utc).timestamp()
         writer=Mock()
-        authority=lambda:{'registered':True,'pending':False,'baseline':{'target':'America/New_York'},
-                          'status':{'at_epoch':now,'state':'healthy','initial':False}}
+        authority=lambda:{'registered':True,'pending':False,'baseline':{'target':'America/New_York','release':__release__},
+                          'status':{'format':1,'guard_policy':2,'target':'America/New_York','release':__release__,
+                                    'fixture':False,'at_epoch':now,'state':'healthy','initial':False}}
         guard=Watchdog(system='Darwin',reader=lambda:{'timezone_iana':'Asia/Shanghai'},writer=writer,authority=authority)
         stats={};events=[]
         self.assertFalse(guard.run({'timezone':'America/New_York'},stats,lambda *a,**k:events.append(a),lambda:None))
         self.assertEqual(stats['watchdog']['timezone']['state'],'delegated')
         self.assertEqual(stats['watchdog']['timezone']['attempts'],[])
         writer.assert_not_called()
+    def test_mismatched_native_heartbeat_never_claims_healthy_or_delegated(self):
+        now=datetime.now(timezone.utc).timestamp()
+        valid={'format':1,'guard_policy':2,'target':'America/New_York','release':__release__,
+               'fixture':False,'at_epoch':now,'state':'healthy','initial':False}
+        for mismatch in ({'target':'UTC'},{'release':'v0.1.0'},{'guard_policy':1},{'format':True},{'fixture':True}):
+            for observed in ('America/New_York','Asia/Shanghai'):
+                with self.subTest(mismatch=mismatch,observed=observed):
+                    writer=Mock();value={'registered':True,'pending':False,'baseline':{'target':'America/New_York','release':__release__},'status':valid|mismatch}
+                    guard=Watchdog(system='Darwin',reader=lambda:{'timezone_iana':observed},writer=writer,authority=lambda:value)
+                    stats={};guard.run({'timezone':'America/New_York'},stats,lambda *a,**k:None,lambda:None)
+                    self.assertEqual(stats['watchdog']['timezone']['state'],'attention');writer.assert_not_called()
+
+    def test_valid_cooldown_remains_delegated_but_old_release_is_attention(self):
+        now=datetime.now(timezone.utc).timestamp()
+        for release,expected in ((__release__,'delegated'),('v0.1.0','attention')):
+            value={'registered':True,'pending':False,'baseline':{'target':'America/New_York','release':release},
+                   'status':{'format':1,'guard_policy':2,'target':'America/New_York','release':release,
+                             'fixture':False,'at_epoch':now,'state':'cooldown','initial':False}}
+            writer=Mock();guard=Watchdog(system='Darwin',reader=lambda:{'timezone_iana':'Asia/Shanghai'},writer=writer,authority=lambda:value)
+            stats={};guard.run({'timezone':'America/New_York'},stats,lambda *a,**k:None,lambda:None)
+            self.assertEqual(stats['watchdog']['timezone']['state'],expected);writer.assert_not_called()
     def test_mac_guard_never_competes_with_changed_pending_or_unknown_root_baseline(self):
         states=[{'registered':True,'baseline':{'target':'Europe/London'}},
                 {'registered':False,'pending':True},{'registered':False,'legacy_registered':True},ValueError('unreadable')]
diff --git a/tests/test_windows_timezone_service.py b/tests/test_windows_timezone_service.py
index 0afe050..f264350 100644
--- a/tests/test_windows_timezone_service.py
+++ b/tests/test_windows_timezone_service.py
@@ -91,13 +91,47 @@ class WindowsTimezoneTransportTests(unittest.TestCase):
     def test_snapshot_retains_transaction_receipt_in_powershell_case_insensitive_scope(self):
         import json
         with tempfile.TemporaryDirectory() as folder:
-            root=Path(folder);receipt={'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','state':'pending'}
+            root=Path(folder);receipt={'format':1,'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','fixture':True,'state':'pending'}
             (root/'transaction.json').write_text(json.dumps(receipt))
             io=WindowsTimezoneIO(root=root,task='EnvScope-TimezoneFixture-12345678',fixture=True)
             value=io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
             self.assertEqual(value['transaction'],receipt)
             self.assertTrue(value['pending'])
 
+    def test_pending_receipt_remains_recoverable_with_incomplete_live_pair(self):
+        import json
+        with tempfile.TemporaryDirectory() as folder:
+            root=Path(folder);receipt={'format':1,'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','fixture':True,'state':'partial'}
+            (root/'transaction.json').write_text(json.dumps(receipt))
+            (root/'timezone-helper.exe').write_bytes(b'new fixture worker')
+            io=WindowsTimezoneIO(root=root,task='EnvScope-TimezoneFixture-12345678',fixture=True)
+            for base in ('[guard]\nformat=1\nowner='+receipt['owner']+'\nworker_sha256='+'0'*64+'\n','[guard]\nformat=1\nbroken'):
+                with self.subTest(base=base):
+                    (root/'baseline.ini').write_text(base)
+                    value=io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
+                    self.assertTrue(value['pending']);self.assertEqual(value['transaction'],receipt)
+                    self.assertEqual(value['worker_sha'],hashlib.sha256(b'new fixture worker').hexdigest())
+            # An incomplete live pair is tolerated only for protected recovery.
+            raw=json.dumps(receipt|{'state':'committed'}).encode()
+            (root/'transaction.json').write_bytes(raw)
+            (root/'worker-commit.json').write_text(json.dumps(hashlib.sha256(raw).hexdigest()))
+            with self.assertRaises(ValueError):
+                io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
+
+    def test_commit_publication_interruption_retains_recovery(self):
+        import json
+        with tempfile.TemporaryDirectory() as folder:
+            root=Path(folder);io=WindowsTimezoneIO(root=root,task='EnvScope-TimezoneFixture-12345678',fixture=True)
+            for state in ('committed','restored'):
+                raw=json.dumps({'format':1,'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','fixture':True,'state':state}).encode()
+                (root/'transaction.json').write_bytes(raw)
+                (root/'worker-commit.json').write_text('"'+'0'*64+'"')
+                value=io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
+                self.assertTrue(value['pending'])
+                (root/'worker-commit.json').write_text(json.dumps(hashlib.sha256(raw).hexdigest()))
+                value=io._read('function Assert-Protected($path){};function Read-Task{return $null};Snapshot | ConvertTo-Json -Depth 12 -Compress')
+                self.assertFalse(value['pending'])
+
     def test_windows_powershell_ini_parser_preserves_values_and_rejects_duplicates(self):
         import re
         from envscope.timezone_windows import HEADER
diff --git a/tests/test_windows_timezone_worker.py b/tests/test_windows_timezone_worker.py
index 1ce328d..dcf1c4c 100644
--- a/tests/test_windows_timezone_worker.py
+++ b/tests/test_windows_timezone_worker.py
@@ -1,6 +1,7 @@
 """Compiled fixture has no OS clock-writing branch; only disposable files change."""
 import configparser
 import hashlib
+import json
 import os
 from pathlib import Path
 import platform
@@ -30,6 +31,10 @@ def setUp(self):
         self.root = Path(self.directory.name)
         self.write('baseline', target='Eastern Standard Time', worker_sha256=hashlib.sha256(self.exe.read_bytes()).hexdigest())
         self.write('clock', timezone='China Standard Time', at_epoch=1793400000)
+        self.receipt={'format':1,'id':'a'*32,'owner':'S-1-5-21-1-2-3-1001','fixture':True,'state':'committed'}
+        raw=json.dumps(self.receipt).encode()
+        (self.root/'transaction.json').write_bytes(raw)
+        (self.root/'worker-commit.json').write_text(json.dumps(hashlib.sha256(raw).hexdigest()),encoding='ascii')
 
     def write(self, name, **values):
         (self.root / (name + '.ini')).write_text('[guard]\n' + ''.join(str(k) + '=' + str(v) + '\n' for k, v in values.items()), encoding='ascii')
@@ -71,3 +76,32 @@ def test_malformed_pending_marker_never_allows_a_write(self):
         self.write('state',pending='unknown',state='repairing',attempts='')
         self.assertNotEqual(self.run_worker(),0)
         self.assertEqual(self.read('clock')['timezone'],'China Standard Time')
+
+    def test_incomplete_lifecycle_blocks_worker_until_receipt_is_committed(self):
+        for state in ('pending','partial'):
+            with self.subTest(state=state):
+                (self.root/'transaction.json').write_text(json.dumps(self.receipt|{'state':state}))
+                self.run_worker()
+                self.assertEqual(self.read('clock')['timezone'],'China Standard Time')
+        (self.root/'worker-commit.json').unlink()
+        (self.root/'transaction.json').write_text(json.dumps(self.receipt))
+        self.run_worker()
+        self.assertEqual(self.read('clock')['timezone'],'China Standard Time')
+        raw=(self.root/'transaction.json').read_bytes()
+        (self.root/'worker-commit.json').write_text(json.dumps(hashlib.sha256(raw).hexdigest()))
+        self.assertEqual(self.run_worker(),0)
+        self.assertEqual(self.read('clock')['timezone'],'Eastern Standard Time')
+
+    def test_live_lifecycle_lock_blocks_worker(self):
+        import ctypes
+        from ctypes import wintypes
+        create=ctypes.windll.kernel32.CreateFileW
+        create.argtypes=[wintypes.LPCWSTR,wintypes.DWORD,wintypes.DWORD,ctypes.c_void_p,wintypes.DWORD,wintypes.DWORD,wintypes.HANDLE]
+        create.restype=wintypes.HANDLE
+        close=ctypes.windll.kernel32.CloseHandle;close.argtypes=[wintypes.HANDLE]
+        handle=create(str(self.root/'transaction.lock'),0xC0000000,0,None,4,0x80,None)
+        self.assertNotEqual(handle,wintypes.HANDLE(-1).value)
+        try:
+            self.assertNotEqual(self.run_worker(),0)
+            self.assertEqual(self.read('clock')['timezone'],'China Standard Time')
+        finally:close(handle)