From e8be6674303fcf9e29f2a720d068601f340a955b Mon Sep 17 00:00:00 2001 From: Jacob Groundwater Date: Fri, 31 Jul 2026 00:00:12 -0700 Subject: [PATCH 01/18] Add host-backed container runtime foundations --- CONTAINER_RUNTIME_PROTOCOL.md | 149 ++++ Makefile | 189 +++- README.md | 6 +- RUNTIME_FOUNDATIONS.md | 93 ++ .../page.tsx | 2 +- .../app/docs/building-from-source/page.tsx | 6 +- Website/src/app/docs/getting-started/page.tsx | 2 +- Website/src/app/download/page.tsx | 4 +- .../page.tsx | 4 +- .../src/components/landing/DownloadCTA.tsx | 2 +- macOS/GhostTools/Package.swift | 11 +- macOS/GhostTools/README.txt | 35 + .../Sources/GhostTools/Server/Router.swift | 161 +++- .../Sources/ghost-container/Args.swift | 230 +++++ .../ghost-container/GhostContainerCLI.swift | 456 ++++++++++ .../Sources/ghost-container/LineReader.swift | 58 ++ .../Sources/ghost-container/Protocol.swift | 179 ++++ .../Sources/ghost-container/VsockDial.swift | 84 ++ .../Tests/GhostContainerTests/ArgsTests.swift | 271 ++++++ .../GhostContainerTests/LineReaderTests.swift | 135 +++ .../GhostContainerTests/ProtocolTests.swift | 328 +++++++ .../GhostContainerTests/VsockDialTests.swift | 101 +++ .../GuestFilesystemRouterTests.swift | 104 +++ .../Services/ContainerBridgeService.swift | 584 +++++++++++++ macOS/GhostVM/Services/ContainerRunner.swift | 406 +++++++++ .../Services/ContainerRuntimeXPCClient.swift | 201 +++++ macOS/GhostVM/Services/GhostClient.swift | 66 ++ .../GuestFileSystemBridgeService.swift | 276 ++++++ macOS/GhostVM/Services/GuestVolumeMount.swift | 111 +++ .../Services/NetworkSettingsView.swift | 68 ++ macOS/GhostVM/SwiftUIDemoApp.swift | 22 + macOS/GhostVM/VMApp-Info.template.plist | 2 +- macOS/GhostVMContainerRuntime/Info.plist | 27 + .../GhostVMContainerRuntime/RuntimeMain.swift | 811 ++++++++++++++++++ .../entitlements.plist | 10 + macOS/GhostVMFS/FileSystemExtension.swift | 9 + macOS/GhostVMFS/GhostVMFSClient.swift | 124 +++ macOS/GhostVMFS/GhostVMFileSystem.swift | 35 + macOS/GhostVMFS/GhostVMItem.swift | 13 + macOS/GhostVMFS/GhostVMVolume.swift | 248 ++++++ macOS/GhostVMFS/Info.template.plist | 51 ++ macOS/GhostVMFS/entitlements.plist | 12 + macOS/GhostVMHelper/main.swift | 89 +- macOS/GhostVMImageFetch/FetchMain.swift | 194 +++++ .../VMConfigurationBuilder.swift | 9 +- .../Containers/ContainerBridgeProtocol.swift | 207 +++++ .../Containers/ContainerRunPolicy.swift | 232 +++++ .../Containers/ContainerRuntimeProtocol.swift | 219 +++++ .../ContainerRuntimeXPCProtocol.swift | 37 + .../Content/ContentAddressedStore.swift | 164 ++++ .../GhostVMKit/Core/GhostClientProtocol.swift | 4 + macOS/GhostVMKit/Core/GhostClientTypes.swift | 57 ++ macOS/GhostVMKit/Core/NetworkConfig.swift | 8 +- macOS/GhostVMKit/Core/VMStoredConfig.swift | 6 + .../Networking/NetworkManager.swift | 140 +++ .../Networking/SharedVmnetIPv4Pool.swift | 41 + .../Networking/SharedVmnetNetwork.swift | 263 ++++++ macOS/GhostVMKit/Operations/InitOptions.swift | 5 +- .../GhostVMKit/Operations/VMController.swift | 4 +- .../ContainerBridgeProtocolTests.swift | 234 +++++ .../ContainerRunPolicyTests.swift | 229 +++++ .../ContentAddressedStoreTests.swift | 81 ++ .../GhostVMTests/GhostClientTypesTests.swift | 19 + macOS/GhostVMTests/InitOptionsTests.swift | 5 +- macOS/GhostVMTests/MockGhostClient.swift | 4 + macOS/GhostVMTests/NetworkManagerTests.swift | 68 ++ .../SharedVmnetIPv4PoolTests.swift | 41 + macOS/GhostVMTests/VMConfigStoreTests.swift | 1 + macOS/GhostVMTests/VMCtlTests.swift | 29 + macOS/GhostVMUITests/CreateVMUITests.swift | 2 + macOS/GhostVMUITests/EditVMUITests.swift | 2 + macOS/project.yml | 139 ++- 72 files changed, 8160 insertions(+), 59 deletions(-) create mode 100644 CONTAINER_RUNTIME_PROTOCOL.md create mode 100644 RUNTIME_FOUNDATIONS.md create mode 100644 macOS/GhostTools/Sources/ghost-container/Args.swift create mode 100644 macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift create mode 100644 macOS/GhostTools/Sources/ghost-container/LineReader.swift create mode 100644 macOS/GhostTools/Sources/ghost-container/Protocol.swift create mode 100644 macOS/GhostTools/Sources/ghost-container/VsockDial.swift create mode 100644 macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift create mode 100644 macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift create mode 100644 macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift create mode 100644 macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift create mode 100644 macOS/GhostTools/Tests/GhostToolsTests/GuestFilesystemRouterTests.swift create mode 100644 macOS/GhostVM/Services/ContainerBridgeService.swift create mode 100644 macOS/GhostVM/Services/ContainerRunner.swift create mode 100644 macOS/GhostVM/Services/ContainerRuntimeXPCClient.swift create mode 100644 macOS/GhostVM/Services/GuestFileSystemBridgeService.swift create mode 100644 macOS/GhostVM/Services/GuestVolumeMount.swift create mode 100644 macOS/GhostVMContainerRuntime/Info.plist create mode 100644 macOS/GhostVMContainerRuntime/RuntimeMain.swift create mode 100644 macOS/GhostVMContainerRuntime/entitlements.plist create mode 100644 macOS/GhostVMFS/FileSystemExtension.swift create mode 100644 macOS/GhostVMFS/GhostVMFSClient.swift create mode 100644 macOS/GhostVMFS/GhostVMFileSystem.swift create mode 100644 macOS/GhostVMFS/GhostVMItem.swift create mode 100644 macOS/GhostVMFS/GhostVMVolume.swift create mode 100644 macOS/GhostVMFS/Info.template.plist create mode 100644 macOS/GhostVMFS/entitlements.plist create mode 100644 macOS/GhostVMImageFetch/FetchMain.swift create mode 100644 macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift create mode 100644 macOS/GhostVMKit/Containers/ContainerRunPolicy.swift create mode 100644 macOS/GhostVMKit/Containers/ContainerRuntimeProtocol.swift create mode 100644 macOS/GhostVMKit/Containers/ContainerRuntimeXPCProtocol.swift create mode 100644 macOS/GhostVMKit/Content/ContentAddressedStore.swift create mode 100644 macOS/GhostVMKit/Networking/NetworkManager.swift create mode 100644 macOS/GhostVMKit/Networking/SharedVmnetIPv4Pool.swift create mode 100644 macOS/GhostVMKit/Networking/SharedVmnetNetwork.swift create mode 100644 macOS/GhostVMTests/ContainerBridgeProtocolTests.swift create mode 100644 macOS/GhostVMTests/ContainerRunPolicyTests.swift create mode 100644 macOS/GhostVMTests/ContentAddressedStoreTests.swift create mode 100644 macOS/GhostVMTests/NetworkManagerTests.swift create mode 100644 macOS/GhostVMTests/SharedVmnetIPv4PoolTests.swift diff --git a/CONTAINER_RUNTIME_PROTOCOL.md b/CONTAINER_RUNTIME_PROTOCOL.md new file mode 100644 index 0000000..a61a988 --- /dev/null +++ b/CONTAINER_RUNTIME_PROTOCOL.md @@ -0,0 +1,149 @@ +# GhostVM Container Runtime Protocol + +The GhostVM container boundary is a backend-neutral runtime API. Docker is a +frontend implemented inside GhostTools; it is not the protocol spoken to the +outer host. + +```text +docker CLI / compose / another client + | + v + guest frontend adapter + | + v + GhostVM runtime protocol over vsock + | + v + host runtime backend + | + v + Apple Containerization or another engine +``` + +## Design rules + +1. Methods model runtime resources and lifecycle operations, not Docker HTTP + routes or Swift implementation types. +2. The guest owns frontend compatibility. For example, the Docker adapter maps + Docker Engine API requests to one or more runtime methods. +3. The host owns container objects and their lifetimes. A frontend refers to + images, filesystems, containers, and processes by stable IDs. +4. Every request carries a protocol major/minor version and request ID. A major + mismatch is incompatible; minor versions are additive. +5. Frontends call `system.capabilities` and must not infer behavior from the + host implementation or operating-system version. +6. Errors use stable machine-readable codes. Backend error strings are only + diagnostics and never control frontend behavior. +7. Large and interactive data uses bounded binary stream frames associated + with a request. JSON metadata must never contain whole build contexts, + filesystem archives, or unbounded process output. + +## Runtime surface + +| Resource | Methods | +|---|---| +| System | `system.capabilities` | +| Image | `image.pull`, `image.list`, `image.inspect`, `image.delete`, `image.unpack` | +| Filesystem | `filesystem.create`, `filesystem.delete` | +| Container | `container.create`, `container.start`, `container.stop`, `container.kill`, `container.wait`, `container.resize`, `container.state`, `container.list`, `container.delete` | +| Container I/O | `container.copyIn`, `container.copyOut`, `container.dial` | +| Process | `process.create`, `process.start`, `process.kill`, `process.wait`, `process.resize`, `process.delete` | +| Network | `network.createInterface`, `network.releaseInterface` | +| Build extension | `build.create` | + +`build.create` is a product-level extension because Containerization does not +define Dockerfile semantics. Its input context and output are streams; the host +may implement it with BuildKit or another builder. + +## Framework mapping + +| Runtime method | Containerization operation | +|---|---| +| `container.create` | `LinuxContainer.create()` | +| `container.start` | `LinuxContainer.start()` | +| `container.stop` | `LinuxContainer.stop()` | +| `container.kill` | `LinuxContainer.kill(_:)` | +| `container.wait` | `LinuxContainer.wait(timeoutInSeconds:)` | +| `container.resize` | `LinuxContainer.resize(to:)` | +| `process.create` | `LinuxContainer.exec(_:configuration:)` | +| `process.start` | `LinuxProcess.start()` | +| `process.kill` | `LinuxProcess.kill(_:)` | +| `process.wait` | `LinuxProcess.wait(timeoutInSeconds:)` | +| `process.resize` | `LinuxProcess.resize(to:)` | +| `container.copyIn` | `LinuxContainer.copyIn(...)` | +| `container.copyOut` | `LinuxContainer.copyOut(...)` | +| `container.dial` | `LinuxContainer.dialVsock(port:)` | + +This mapping is semantic rather than source-compatible. Swift actors, closures, +file handles, and concrete framework types are not part of the wire contract. + +### Guest directory mounts + +Frontend adapters translate a guest bind-mount source into a host-owned +filesystem resource before creating the container: + +```text +Docker or container volume syntax + | + v + filesystem.create(guestPath) + | + v + filesystem ID + container.create mount + | + v + host FSKit mount + Containerization.Mount.share +``` + +The `source` of a runtime mount is the filesystem resource ID returned by the +host. It is never an outer-host path supplied by the guest. Runtime mount fields +otherwise follow Containerization's semantic model: `type`, `source`, +`destination`, `options`, and `runtimeOptions`. + +Filesystem I/O is not tunneled through container lifecycle requests. The host +FSKit extension uses a separate bounded filesystem transport to GhostTools for +lookup, attributes, directory enumeration, and range I/O. + +## Docker mapping + +Docker Compose is client-side and uses the ordinary Docker Engine API. A +GhostTools Docker endpoint can therefore translate its core calls as follows: + +| Docker operation | Runtime sequence | +|---|---| +| Pull image | `image.pull` | +| Bind guest directory | `filesystem.create`, then a `container.create` mount | +| Create container | `image.unpack`, `container.create` | +| Start container | `container.start` | +| Wait or inspect | `container.wait`, `container.state` | +| Exec | `process.create`, `process.start`, `process.wait`, `process.delete` | +| Stop or remove | `container.stop`, `container.delete` | +| Build Dockerfile | `build.create` with a streamed build context | + +Named volumes, Compose networks, port publication, and restart policies are +orchestration features. They belong in the host runtime service and are exposed +as additive capabilities rather than leaking Docker request structures into +the base container lifecycle API. + +## One-shot run compatibility + +The one-shot `run` request remains operational while the primitive handlers are +implemented. It is a temporary compatibility path and is not part of the stable +runtime surface above. Its optional `volumes` array contains +`{guestPath, destination, readOnly}` records. The host validates these, +registers capability-scoped FSKit exports, mounts them for the run lifetime, and +passes only the resulting host mount paths to the isolated runtime helper. + +Version 1 sends raw stdin bytes after the request newline and remains accepted +for existing GhostTools installations. Version 2 adds `tty`, `columns`, and +`rows` request fields. Guest-to-host traffic after a version 2 request is NDJSON: + +```json +{"version":2,"type":"stdin","data":"YmFzZTY0"} +{"version":2,"type":"resize","columns":120,"rows":40} +{"version":2,"type":"stdinClose"} +``` + +Host responses use the request's protocol version. In TTY mode, the container +process receives a native PTY, stderr is merged into stdout, `TERM` is set to +`xterm-256color`, and resize frames map to `LinuxContainer.resize(to:)`. diff --git a/Makefile b/Makefile index a6b5b8d..e9e17c3 100644 --- a/Makefile +++ b/Makefile @@ -10,9 +10,10 @@ GHOSTTOOLS_SIGN_ID ?= $(CODESIGN_ID) APP_PROVISIONING_PROFILE ?= .var/profiles/GhostVM_App_Distribution.provisionprofile HELPER_PROVISIONING_PROFILE ?= .var/profiles/GhostVM_Helper_Distribution.provisionprofile VMCTL_PROVISIONING_PROFILE ?= .var/profiles/vmctl_command_line.provisionprofile +FSKIT_PROVISIONING_PROFILE ?= .var/profiles/GhostVM_FS_Distribution.provisionprofile -# Inject build timestamp into patch version during development builds. -# Set to 0 for production releases (make dist does this automatically). +# Inject the build timestamp into the patch version. +# Set to 0 only when a canonical release version is explicitly required. INJECT_TIMESTAMP ?= 1 BUILD_TIMESTAMP := $(shell date +%Y%m%d%H%M%S) APP_SKIP_XCODE_SIGNING ?= 0 @@ -30,15 +31,18 @@ PLIST_GEN_DIR = build/generated-plists PLIST_GHOSTVM_TEMPLATE = macOS/GhostVM/VMApp-Info.template.plist PLIST_HELPER_TEMPLATE = macOS/GhostVMHelper/Info.template.plist PLIST_TOOLS_TEMPLATE = macOS/GhostTools/Sources/GhostTools/Resources/Info.template.plist +PLIST_FSKIT_TEMPLATE = macOS/GhostVMFS/Info.template.plist PLIST_GHOSTVM = $(PLIST_GEN_DIR)/GhostVM-Info.plist PLIST_HELPER = $(PLIST_GEN_DIR)/GhostVMHelper-Info.plist PLIST_TOOLS = $(PLIST_GEN_DIR)/GhostTools-Info.plist +PLIST_FSKIT = $(PLIST_GEN_DIR)/GhostVMFS-Info.plist BASE_VERSION := $(strip $(shell cat "$(VERSION_FILE)" 2>/dev/null)) ifeq ($(BASE_VERSION),) $(error Missing $(VERSION_FILE). Create it with a version like 1.85.0) endif +BASE_MAJOR_MINOR := $(word 1,$(subst ., ,$(BASE_VERSION))).$(word 2,$(subst ., ,$(BASE_VERSION))) .PHONY: all cli app clean help run launch generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist @@ -55,7 +59,8 @@ render-plists: @for ITEM in \ "$(PLIST_GHOSTVM_TEMPLATE):$(PLIST_GHOSTVM)" \ "$(PLIST_HELPER_TEMPLATE):$(PLIST_HELPER)" \ - "$(PLIST_TOOLS_TEMPLATE):$(PLIST_TOOLS)"; do \ + "$(PLIST_TOOLS_TEMPLATE):$(PLIST_TOOLS)" \ + "$(PLIST_FSKIT_TEMPLATE):$(PLIST_FSKIT)"; do \ TEMPLATE="$${ITEM%%:*}"; \ OUT="$${ITEM#*:}"; \ cp "$$TEMPLATE" "$$OUT"; \ @@ -66,7 +71,7 @@ render-plists: prepare-app-plists: render-plists ifeq ($(INJECT_TIMESTAMP),1) @echo "Injecting build timestamp $(BUILD_TIMESTAMP) into GhostVM and GhostVMHelper..." - @for PLIST in "$(PLIST_GHOSTVM)" "$(PLIST_HELPER)"; do \ + @for PLIST in "$(PLIST_GHOSTVM)" "$(PLIST_HELPER)" "$(PLIST_FSKIT)"; do \ MAJOR_MINOR=$$(plutil -extract CFBundleShortVersionString raw "$$PLIST" | sed 's/\.[^.]*$$//'); \ plutil -replace CFBundleShortVersionString -string "$$MAJOR_MINOR.$(BUILD_TIMESTAMP)" "$$PLIST"; \ plutil -replace CFBundleVersion -string "$$MAJOR_MINOR.$(BUILD_TIMESTAMP)" "$$PLIST"; \ @@ -92,12 +97,25 @@ framework: $(XCODE_PROJECT) # Build the vmctl CLI (depends on framework) cli: $(XCODE_PROJECT) +ifeq ($(APP_SKIP_XCODE_SIGNING),1) + xcodebuild -project $(XCODE_PROJECT) \ + -scheme vmctl \ + -configuration $(XCODE_CONFIG) \ + -derivedDataPath $(BUILD_DIR) \ + CODE_SIGN_STYLE=Manual \ + CODE_SIGN_IDENTITY=- \ + DEVELOPMENT_TEAM= \ + CODE_SIGNING_ALLOWED=NO \ + CODE_SIGNING_REQUIRED=NO \ + build +else xcodebuild -project $(XCODE_PROJECT) \ -scheme vmctl \ -configuration $(XCODE_CONFIG) \ -derivedDataPath $(BUILD_DIR) \ DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \ build +endif @echo "vmctl built at: $(BUILD_DIR)/Build/Products/$(XCODE_CONFIG)/vmctl.app/Contents/MacOS/vmctl" # Build the SwiftUI app via xcodebuild (includes GhostTools.dmg) @@ -247,7 +265,7 @@ launch: app # Run unit tests test: $(XCODE_PROJECT) xcodebuild test -project $(XCODE_PROJECT) -scheme GhostVMTests -destination 'platform=macOS' - swift test --package-path macOS/GhostTools --filter AsyncVSockIOTests + swift test --package-path macOS/GhostTools # Run UI tests (excludes screenshot-capture tests; use 'make capture' for those) uitest: $(XCODE_PROJECT) @@ -308,20 +326,24 @@ GHOSTTOOLS_DIR = macOS/GhostTools GHOSTTOOLS_BUILD_DIR = $(BUILD_DIR)/GhostTools GHOSTTOOLS_APP = $(GHOSTTOOLS_BUILD_DIR)/GhostTools.app GHOSTTOOLS_DMG = $(BUILD_DIR)/GhostTools.dmg +# Virtualization.framework rejects compressed UDIF images as storage attachments. +GHOSTTOOLS_DMG_FORMAT = UDRW # Build GhostTools guest agent (.app bundle, signed) tools: ghosttools-icon @echo "Building GhostTools..." @$(MAKE) --no-print-directory prepare-tools-plist INJECT_TIMESTAMP=$(INJECT_TIMESTAMP) @# Force relink so the embedded __TEXT/__info_plist picks up the new timestamp - @rm -f "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" + @rm -f "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/release/ghost-container" swift build --package-path $(GHOSTTOOLS_DIR) --scratch-path $(GHOSTTOOLS_BUILD_DIR) -c release @# Assemble .app bundle @rm -rf "$(GHOSTTOOLS_APP)" @mkdir -p "$(GHOSTTOOLS_APP)/Contents/MacOS" @mkdir -p "$(GHOSTTOOLS_APP)/Contents/Resources" @cp "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/" + @cp "$(GHOSTTOOLS_BUILD_DIR)/release/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/" vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" + vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" @cp "$(PLIST_TOOLS)" "$(GHOSTTOOLS_APP)/Contents/Info.plist" @# Generate release notes from git log since last tag @LAST_TAG=$$(git describe --tags --abbrev=0 2>/dev/null); \ @@ -342,8 +364,13 @@ debug-tools: vtool -set-build-version macos 26.0 26.0 -replace \ -output $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug \ $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools + vtool -set-build-version macos 26.0 26.0 -replace \ + -output $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug \ + $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container codesign --force -s "-" $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug + codesign --force -s "-" $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug @echo "Debug binary: $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug" + @echo "Debug binary: $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug" @echo "Copy to guest and use: lldb GhostTools-debug" # Generate GhostTools .icns from source PNG @@ -403,10 +430,14 @@ dmg: tools @mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" @cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" @cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" + @# Include ghost-container at DMG root level for direct testing from mounted volume + @cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" + codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/ghost-container" @rm -f "$(GHOSTTOOLS_DMG)" - hdiutil makehybrid -o "$(GHOSTTOOLS_DMG)" \ - -hfs -hfs-volume-name "GhostTools" \ - "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" + hdiutil create -volname "GhostTools" \ + -srcfolder "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" \ + -ov -format $(GHOSTTOOLS_DMG_FORMAT) "$(GHOSTTOOLS_DMG)" + @xattr -c "$(GHOSTTOOLS_DMG)" @echo "GhostTools.dmg created at: $(GHOSTTOOLS_DMG)" # Sparkle tools for signing updates @@ -427,7 +458,8 @@ sparkle-tools: $(SPARKLE_TOOLS_DIR)/bin/sign_update # Distribution settings DIST_DIR = build/dist DMG_NAME = GhostVM -VERSION ?= $(shell git describe --tags --always 2>/dev/null || echo "dev") +VERSION ?= $(BASE_MAJOR_MINOR).$(BUILD_TIMESTAMP) +NOTARY_KEYCHAIN_PROFILE ?= # Auto-detect Developer ID Application identity for distribution DIST_CODESIGN_ID := $(shell security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | sed 's/.*"\(.*\)".*/\1/') @@ -436,7 +468,7 @@ DIST_CODESIGN_ID := $(shell security find-identity -v -p codesigning | grep "Dev # Note: If you get "Operation not permitted", grant Terminal Full Disk Access in # System Preferences > Privacy & Security > Full Disk Access dist: - $(MAKE) app cli INJECT_TIMESTAMP=0 APP_SKIP_XCODE_SIGNING=1 + $(MAKE) app cli INJECT_TIMESTAMP=1 BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) APP_SKIP_XCODE_SIGNING=1 @# Verify we have a real signing identity for distribution @if [ -z "$(DIST_CODESIGN_ID)" ]; then \ echo "Error: No 'Developer ID Application' identity found in keychain."; \ @@ -445,14 +477,14 @@ dist: exit 1; \ fi @# Verify notarization credentials are set - @if [ -z "$(NOTARY_APPLE_ID)" ] || [ -z "$(NOTARY_TEAM_ID)" ] || [ -z "$(NOTARY_PASSWORD)" ]; then \ - echo "ERROR: Notarization requires NOTARY_APPLE_ID, NOTARY_TEAM_ID, and NOTARY_PASSWORD"; \ - echo "Set these in a .env file or as environment variables."; \ + @if [ -z "$(NOTARY_KEYCHAIN_PROFILE)" ] && { [ -z "$(NOTARY_APPLE_ID)" ] || [ -z "$(NOTARY_TEAM_ID)" ] || [ -z "$(NOTARY_PASSWORD)" ]; }; then \ + echo "ERROR: Notarization requires NOTARY_KEYCHAIN_PROFILE or Apple ID credentials."; \ + echo "Set a keychain profile, or NOTARY_APPLE_ID, NOTARY_TEAM_ID, and NOTARY_PASSWORD."; \ exit 1; \ fi @# Verify provisioning profile certificates match the signing identity (AMFI rejects @# apps where the profile cert doesn't match the signing cert, even if entitlements match) - @scripts/verify-profile-cert.sh "$(DIST_CODESIGN_ID)" $(APP_PROVISIONING_PROFILE) $(HELPER_PROVISIONING_PROFILE) $(VMCTL_PROVISIONING_PROFILE) + @scripts/verify-profile-cert.sh "$(DIST_CODESIGN_ID)" $(APP_PROVISIONING_PROFILE) $(HELPER_PROVISIONING_PROFILE) $(VMCTL_PROVISIONING_PROFILE) $(FSKIT_PROVISIONING_PROFILE) @echo "Creating distribution DMG (version $(VERSION))..." @echo "Signing with: $(DIST_CODESIGN_ID)" @rm -rf "$(DIST_DIR)" @@ -470,6 +502,9 @@ dist: test -f "$(HELPER_PROVISIONING_PROFILE)" || (echo "ERROR: HELPER_PROVISIONING_PROFILE not found: $(HELPER_PROVISIONING_PROFILE)" && exit 1); \ cp "$(HELPER_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/embedded.provisionprofile"; \ fi + @if [ -n "$(HELPER_PROVISIONING_PROFILE)" ]; then \ + cp "$(HELPER_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc/Contents/embedded.provisionprofile"; \ + fi @if /usr/libexec/PlistBuddy -c "Print :com.apple.vm.networking" macOS/GhostVM/entitlements.plist >/dev/null 2>&1 && [ -z "$(APP_PROVISIONING_PROFILE)" ]; then \ echo "ERROR: APP_PROVISIONING_PROFILE is required for macOS/GhostVM/entitlements.plist (com.apple.vm.networking present)"; \ exit 1; \ @@ -486,6 +521,12 @@ dist: test -f "$(VMCTL_PROVISIONING_PROFILE)" || (echo "ERROR: VMCTL_PROVISIONING_PROFILE not found: $(VMCTL_PROVISIONING_PROFILE)" && exit 1); \ cp "$(VMCTL_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/embedded.provisionprofile"; \ fi + @if [ -z "$(FSKIT_PROVISIONING_PROFILE)" ]; then \ + echo "ERROR: FSKIT_PROVISIONING_PROFILE is required for the GhostVMFS extension"; \ + exit 1; \ + fi + @test -f "$(FSKIT_PROVISIONING_PROFILE)" || (echo "ERROR: FSKIT_PROVISIONING_PROFILE not found: $(FSKIT_PROVISIONING_PROFILE)" && exit 1) + cp "$(FSKIT_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/embedded.provisionprofile" @# --- Inside-out code signing for notarization --- @echo "Signing nested components (inside-out)..." @# 1. Sign all embedded frameworks (GhostVMKit, NIO, etc.) in GhostVMHelper.app @@ -502,6 +543,34 @@ dist: codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ fi; \ done + @# 1c. Sign Debug dylibs and standalone container helpers + @for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/MacOS/"*.dylib; do \ + if [ -f "$$dylib" ]; then \ + echo " Signing $$(basename $$dylib) (in Helper)"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ + fi; \ + done + @if [ -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/Helpers/ghostvm-image-fetch" ]; then \ + echo " Signing ghostvm-image-fetch"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" \ + "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/Helpers/ghostvm-image-fetch"; \ + fi + @# Sign the runtime XPC service explicitly (entitlements + helper profile) BEFORE the + @# generic XPC loop so the later generic re-sign cannot strip its vmnet entitlements. + @if [ -d "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc" ]; then \ + echo " Signing ghostvm-container-runtime.xpc"; \ + codesign --force --options runtime --timestamp \ + --entitlements macOS/GhostVMContainerRuntime/entitlements.plist \ + -s "$(DIST_CODESIGN_ID)" \ + "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc"; \ + fi + @# Sign remaining (ordinary) XPC services generically, skipping the runtime XPC + @for xpc in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/"*.xpc; do \ + if [ -d "$$xpc" ] && [ "$$(basename "$$xpc")" != "ghostvm-container-runtime.xpc" ]; then \ + echo " Signing $$(basename $$xpc) (in Helper)"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$xpc"; \ + fi; \ + done @# 2. Sign GhostVMHelper.app (with its own entitlements) @echo " Signing GhostVMHelper.app" codesign --force --options runtime --timestamp \ @@ -539,6 +608,18 @@ dist: codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ fi; \ done + @# 4b. Sign the FSKit extension before signing its containing app. + @for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/MacOS/"*.dylib; do \ + if [ -f "$$dylib" ]; then \ + echo " Signing $$(basename $$dylib) (in GhostVMFS)"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ + fi; \ + done + @echo " Signing GhostVMFS.appex" + codesign --force --options runtime --timestamp \ + --entitlements macOS/GhostVMFS/entitlements.plist \ + -s "$(DIST_CODESIGN_ID)" \ + "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex" @# 5. Sign vmctl.app (frameworks, then the bundle itself with entitlements) @for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/Frameworks/"*.framework; do \ if [ -d "$$fw" ]; then \ @@ -552,6 +633,12 @@ dist: codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ fi; \ done + @for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/MacOS/"*.dylib; do \ + if [ -f "$$dylib" ]; then \ + echo " Signing $$(basename $$dylib) (in vmctl)"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ + fi; \ + done @echo " Signing vmctl.app" codesign --force --options runtime --timestamp \ --entitlements macOS/GhostVM/vmctl/entitlements.plist \ @@ -563,13 +650,22 @@ dist: @mkdir -p "$(DIST_DIR)/ghosttools-stage" @cp -R "$(GHOSTTOOLS_APP)" "$(DIST_DIR)/ghosttools-stage/" @cp "$(GHOSTTOOLS_DIR)/README.txt" "$(DIST_DIR)/ghosttools-stage/" + @cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(DIST_DIR)/ghosttools-stage/" codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app" + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/ghost-container" @rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" - hdiutil makehybrid -o "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" \ - -hfs -hfs-volume-name "GhostTools" \ - "$(DIST_DIR)/ghosttools-stage" + hdiutil create -volname "GhostTools" \ + -srcfolder "$(DIST_DIR)/ghosttools-stage" \ + -ov -format $(GHOSTTOOLS_DMG_FORMAT) "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" + @xattr -c "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" @rm -rf "$(DIST_DIR)/ghosttools-stage" @# 6. Sign the main app bundle (top-level, with entitlements) + @for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/MacOS/"*.dylib; do \ + if [ -f "$$dylib" ]; then \ + echo " Signing $$(basename $$dylib) (in $(APP_NAME))"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ + fi; \ + done @echo " Signing $(APP_NAME).app" codesign --force --options runtime --timestamp \ --entitlements macOS/GhostVM/entitlements.plist \ @@ -590,11 +686,15 @@ dist: codesign --force --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" @echo "DMG signed with: $(DIST_CODESIGN_ID)" @# --- Notarization --- - xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" \ - --apple-id "$(NOTARY_APPLE_ID)" \ - --team-id "$(NOTARY_TEAM_ID)" \ - --password "$(NOTARY_PASSWORD)" \ - --wait + @if [ -n "$(NOTARY_KEYCHAIN_PROFILE)" ]; then \ + xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" \ + --keychain-profile "$(NOTARY_KEYCHAIN_PROFILE)" --wait; \ + else \ + xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" \ + --apple-id "$(NOTARY_APPLE_ID)" \ + --team-id "$(NOTARY_TEAM_ID)" \ + --password "$(NOTARY_PASSWORD)" --wait; \ + fi xcrun stapler staple "$(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" @echo "Distribution created: $(DIST_DIR)/$(DMG_NAME)-$(VERSION).dmg" @echo "vmctl is at: $(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/MacOS/vmctl" @@ -605,12 +705,14 @@ dist: debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon @# Build GhostTools (debug) @$(MAKE) --no-print-directory prepare-tools-plist INJECT_TIMESTAMP=1 BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) - @rm -f "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" + @rm -f "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container" swift build --package-path $(GHOSTTOOLS_DIR) --scratch-path $(GHOSTTOOLS_BUILD_DIR) -c debug @rm -rf "$(GHOSTTOOLS_APP)" @mkdir -p "$(GHOSTTOOLS_APP)/Contents/MacOS" "$(GHOSTTOOLS_APP)/Contents/Resources" @cp "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/" + @cp "$(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/" vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" + vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" @cp "$(PLIST_TOOLS)" "$(GHOSTTOOLS_APP)/Contents/Info.plist" @cp "$(GHOSTTOOLS_ICON_ICNS)" "$(GHOSTTOOLS_APP)/Contents/Resources/" codesign --force --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_APP)" @@ -619,10 +721,12 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon @mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" @cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" @cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" + @cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/" + codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/ghost-container" @rm -f "$(GHOSTTOOLS_DMG)" - hdiutil makehybrid -o "$(GHOSTTOOLS_DMG)" \ - -hfs -hfs-volume-name "GhostTools" \ - "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" + hdiutil create -volname "GhostTools" \ + -srcfolder "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" \ + -ov -format $(GHOSTTOOLS_DMG_FORMAT) "$(GHOSTTOOLS_DMG)" @# Build app + cli (debug) @$(MAKE) --no-print-directory prepare-app-plists INJECT_TIMESTAMP=1 BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) xcodebuild -project $(XCODE_PROJECT) -scheme $(APP_NAME) -configuration Debug -derivedDataPath $(BUILD_DIR) \ @@ -666,6 +770,7 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon @if [ -n "$(HELPER_PROVISIONING_PROFILE)" ]; then \ test -f "$(HELPER_PROVISIONING_PROFILE)" || (echo "ERROR: HELPER_PROVISIONING_PROFILE not found: $(HELPER_PROVISIONING_PROFILE)" && exit 1); \ cp "$(HELPER_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/embedded.provisionprofile"; \ + cp "$(HELPER_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc/Contents/embedded.provisionprofile"; \ fi @if [ -n "$(APP_PROVISIONING_PROFILE)" ]; then \ test -f "$(APP_PROVISIONING_PROFILE)" || (echo "ERROR: APP_PROVISIONING_PROFILE not found: $(APP_PROVISIONING_PROFILE)" && exit 1); \ @@ -692,6 +797,22 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \ fi; \ done + @# Sign the runtime XPC service explicitly (entitlements + helper profile) BEFORE the + @# helper so its vmnet entitlements are not stripped by a later generic re-sign. + @if [ -d "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc" ]; then \ + echo " Signing ghostvm-container-runtime.xpc"; \ + codesign --force --options runtime --timestamp \ + --entitlements macOS/GhostVMContainerRuntime/entitlements.plist \ + -s "$(DIST_CODESIGN_ID)" \ + "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc"; \ + fi + @# Sign remaining (ordinary) XPC services in the helper generically + @for xpc in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/"*.xpc; do \ + if [ -e "$$xpc" ] && [ "$$(basename "$$xpc")" != "ghostvm-container-runtime.xpc" ]; then \ + echo " Signing $$(basename $$xpc) (in Helper)"; \ + codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$xpc"; \ + fi; \ + done codesign --force --options runtime --timestamp \ --entitlements macOS/GhostVMHelper/entitlements.plist \ -s "$(DIST_CODESIGN_ID)" \ @@ -747,9 +868,9 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon @xattr -cr "$(DIST_DIR)/ghosttools-stage/GhostTools.app" codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app" @rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" - hdiutil makehybrid -o "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" \ - -hfs -hfs-volume-name "GhostTools" \ - "$(DIST_DIR)/ghosttools-stage" + hdiutil create -volname "GhostTools" \ + -srcfolder "$(DIST_DIR)/ghosttools-stage" \ + -ov -format $(GHOSTTOOLS_DMG_FORMAT) "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" @rm -rf "$(DIST_DIR)/ghosttools-stage" @# Strip xattrs and sign main app MacOS dylibs then bundle @xattr -cr "$(DIST_DIR)/dmg-stage/$(APP_NAME).app" @@ -799,7 +920,7 @@ website-build: # Bump canonical app version used to render generated plists # Usage: make bump VERSION=1.2.0 bump: - @if [ -z "$(VERSION)" ] || [ "$(VERSION)" = "$$(git describe --tags --always 2>/dev/null || echo dev)" ]; then \ + @if [ -z "$(VERSION)" ] || [ "$(VERSION)" = "$(BASE_MAJOR_MINOR).$(BUILD_TIMESTAMP)" ]; then \ echo "Usage: make bump VERSION=x.y.z"; exit 1; \ fi @echo "Bumping canonical version to $(VERSION)..." @@ -812,7 +933,7 @@ bump: check-version: @BASE="$$(cat "$(VERSION_FILE)")"; \ echo "Canonical version: $$BASE"; \ - for PLIST in "$(PLIST_GHOSTVM)" "$(PLIST_HELPER)" "$(PLIST_TOOLS)"; do \ + for PLIST in "$(PLIST_GHOSTVM)" "$(PLIST_HELPER)" "$(PLIST_TOOLS)" "$(PLIST_FSKIT)"; do \ if [ -f "$$PLIST" ]; then \ CUR=$$(plutil -extract CFBundleShortVersionString raw "$$PLIST"); \ echo " $$(basename "$$PLIST"): $$CUR"; \ @@ -848,7 +969,7 @@ help: @echo " make sparkle-sign - Sign DMG for Sparkle auto-updates" @echo " make website - Run Next.js dev server (Website/)" @echo " make website-build - Build Next.js site for production" - @echo " make bump VERSION=x.y.z - Bump version in all 3 targets" + @echo " make bump VERSION=x.y.z - Bump version in all versioned targets" @echo " make check-version - Verify all targets have the same version" @echo " make clean - Remove build artifacts and generated project" @echo "" @@ -856,7 +977,7 @@ help: @echo " DEVELOPMENT_TEAM - Apple Developer team ID (via .env file, see .env.example)" @echo " CODESIGN_ID - Code signing identity (default: Apple Development)" @echo " XCODE_CONFIG - Xcode build configuration (default: Release)" - @echo " VERSION - Version for DMG (default: git describe)" + @echo " VERSION - Version for DMG (default: MAJOR.MINOR.YYYYMMDDHHMMSS)" @echo "" @echo "Notarization (via .env file or environment):" @echo " NOTARY_APPLE_ID - Apple ID for notarization" diff --git a/README.md b/README.md index f5deab5..ee04235 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@

Latest Release   - Platform + Platform   Architecture

@@ -52,7 +52,7 @@ GhostVM is a native macOS app for creating and managing macOS virtual machines o 2. Open the DMG and drag **GhostVM.app** to your Applications folder 3. Launch GhostVM and create your first workspace -**Requirements:** macOS 15+ (Sequoia) on Apple Silicon (M1 or later) +**Requirements:** macOS 26+ (Tahoe) on Apple Silicon (M1 or later) ## CLI Usage @@ -95,7 +95,7 @@ vmctl remote --name dev apps ## Building from Source -**Requirements:** Xcode 15+ and [XcodeGen](https://github.com/yonaskolb/XcodeGen) +**Requirements:** Xcode 26+ and [XcodeGen](https://github.com/yonaskolb/XcodeGen) ```bash brew install xcodegen diff --git a/RUNTIME_FOUNDATIONS.md b/RUNTIME_FOUNDATIONS.md new file mode 100644 index 0000000..82cf2f4 --- /dev/null +++ b/RUNTIME_FOUNDATIONS.md @@ -0,0 +1,93 @@ +# GhostVM Runtime Foundations + +GhostVM's VM and container features share control-plane concepts, but they do +not share packet processors or guest compatibility APIs. + +```text +Docker CLI / Compose + | + v +GhostTools frontend and internal CLI + | + v +container runtime protocol over vsock + | + v +GhostVMHelper + | + +-- ghostvm-image-fetch (short-lived) + | +-- kernel and ImageStore preparation + | + +-- GhostVMContainerRuntime.xpc (one per GhostVMHelper) + +-- all Containerization container VMs +``` + +GhostVM does not start `container-apiserver`, `container-core-images`, or a +global container daemon. A short-lived `ghostvm-image-fetch` subprocess prepares +the kernel, requested image, and vminit image in a per-VM application-support +root. After it exits, the helper's application-scoped +`GhostVMContainerRuntime.xpc` opens that store without pulling and calls +`ContainerManager` and `LinuxContainer` directly. One runtime process hosts all +container VMs for its containing helper. Lifecycle control uses raw XPC while +standard streams use file descriptors transferred in the XPC run request. + +## Network management + +`NetworkManager` owns backend-neutral network definitions and workload +endpoints. Both VM NICs and container interfaces attach through this control +plane. + +The initial backend drivers are deliberately distinct: + +- `virtualization-nat` uses `VZNATNetworkDeviceAttachment` when host containers + are disabled. +- `bridged` uses a selected host interface. +- `vmnet-shared` is active for container-enabled NAT VMs. `GhostVMHelper` + reserves one `VMNET_SHARED_MODE` network per macOS VM, reserves `.2` for the + VM through DHCP, and allocates `.3+` statically to that VM's containers. The + helper sends the opaque vmnet serialization and allocated interface settings + directly to its runtime XPC service with every run. The runtime reconstructs + the exact network before creating the container VM attachment. Reconstruction + failure fails the run; it never silently creates an unrelated NAT network. + +The multi-NIC configuration concepts from PR #144 can be adapted to these +types. Its custom ARP, DHCP, DNS, NAT, and TCP implementation is not part of the +runtime foundation. + +## Content store + +`ContentAddressedStore` owns immutable blobs under OCI-style digest paths: + +```text +content/ + blobs/ + sha256/ + ingest/ + refs/ + snapshots/ +``` + +Writers copy or download into `ingest`, verify the SHA-256 digest, and publish +with a same-volume rename. Existing blobs are reused. Blob deletion, reference +counting, and leases are intentionally deferred. + +## Runtime protocol + +The guest-to-host API uses stable resource methods such as `image.pull`, +`container.create`, and `process.start`. Docker's HTTP API remains a guest-side +frontend and is never forwarded directly to the host. + +Every request includes a major/minor version, request ID, method, and +method-specific parameters. Frontends query `system.capabilities` before using +optional methods. The current one-shot `run` request remains as the migration +path while primitive handlers are added. + +## GhostTools CLI + +`ghost-container` is the internal diagnostic frontend. It is already built as +a GhostTools package product, copied into `GhostTools.app/Contents/MacOS`, and +placed at the GhostTools DMG root for direct testing. + +The next guest layer is a Docker Engine API adapter that shares the same runtime +client and translates Docker operations into one or more runtime protocol +methods. diff --git a/Website/src/app/apple-silicon-mac-virtual-machines/page.tsx b/Website/src/app/apple-silicon-mac-virtual-machines/page.tsx index 883e8e0..5dbc289 100644 --- a/Website/src/app/apple-silicon-mac-virtual-machines/page.tsx +++ b/Website/src/app/apple-silicon-mac-virtual-machines/page.tsx @@ -353,7 +353,7 @@ export default function AppleSiliconMacVirtualMachines() {

Requirements

  • Mac with Apple Silicon (M1, M2, M3, M4, or later)
    • -
  • macOS 15 Sequoia or later
    • +
  • macOS 26 Tahoe or later
  • At least 8GB RAM (16GB+ recommended)
  • 20GB+ free disk space per VM
diff --git a/Website/src/app/docs/building-from-source/page.tsx b/Website/src/app/docs/building-from-source/page.tsx index cf10bfb..2631f38 100644 --- a/Website/src/app/docs/building-from-source/page.tsx +++ b/Website/src/app/docs/building-from-source/page.tsx @@ -7,7 +7,7 @@ import { siteConfig } from "@/config/site"; export const metadata: Metadata = { title: "Build GhostVM from Source - Xcode Setup Guide", description: - "Build GhostVM from source with Xcode 15+ and XcodeGen. Clone the repo, generate project, and compile the app. Contributor guide for Mac developers.", + "Build GhostVM from source with Xcode 26+ and XcodeGen. Clone the repo, generate project, and compile the app. Contributor guide for Mac developers.", }; export default function BuildingFromSource() { @@ -20,8 +20,8 @@ export default function BuildingFromSource() {

Prerequisites

    -
  • macOS 15+ (Sequoia) on Apple Silicon (M1 or later)
    • -
  • Xcode 15+
    • +
  • macOS 26+ (Tahoe) on Apple Silicon (M1 or later)
    • +
  • Xcode 26+
  • XcodeGen
    • diff --git a/Website/src/app/docs/getting-started/page.tsx b/Website/src/app/docs/getting-started/page.tsx index bd37484..bb13d26 100644 --- a/Website/src/app/docs/getting-started/page.tsx +++ b/Website/src/app/docs/getting-started/page.tsx @@ -23,7 +23,7 @@ export default function GettingStarted() {

    Requirements

      -
    • macOS 15+ (Sequoia) on Apple Silicon (M1 or later)
      • +
    • macOS 26+ (Tahoe) on Apple Silicon (M1 or later)

    Installation

    diff --git a/Website/src/app/download/page.tsx b/Website/src/app/download/page.tsx index de433f5..c8f0279 100644 --- a/Website/src/app/download/page.tsx +++ b/Website/src/app/download/page.tsx @@ -47,7 +47,7 @@ export default function DownloadPage() {
  • - macOS 15 Sequoia or later + macOS 26 Tahoe or later
@@ -57,7 +57,7 @@ export default function DownloadPage() { Build from Source
-

Requires Xcode 15+ and XcodeGen:

+

Requires Xcode 26+ and XcodeGen:

               
                 {`brew install xcodegen
diff --git a/Website/src/app/macos-virtual-machine-for-development/page.tsx b/Website/src/app/macos-virtual-machine-for-development/page.tsx
index 88c7f6d..17ee2c1 100644
--- a/Website/src/app/macos-virtual-machine-for-development/page.tsx
+++ b/Website/src/app/macos-virtual-machine-for-development/page.tsx
@@ -233,7 +233,7 @@ export default function MacOSVirtualMachineForDevelopment() {
             Mac with Apple Silicon (M1, M2, M3, M4, or later)
           
           
  • 
-            macOS 15 Sequoia or later
+            macOS 26 Tahoe or later
           
    • 
           
  • 
             8GB+ RAM recommended (16GB+ for comfortable
@@ -273,7 +273,7 @@ export default function MacOSVirtualMachineForDevelopment() {
         
    4. Testing macOS Versions
    
         
    
           Run different macOS versions side by side. Test your app on Sonoma
-          while your host runs Sequoia. No need for multiple physical machines.
+          while your host runs Tahoe. No need for multiple physical machines.
         
    
 
         
    5. AI Agent Workspaces
    
diff --git a/Website/src/components/landing/DownloadCTA.tsx b/Website/src/components/landing/DownloadCTA.tsx
index dd317ee..7e12745 100644
--- a/Website/src/components/landing/DownloadCTA.tsx
+++ b/Website/src/components/landing/DownloadCTA.tsx
@@ -22,7 +22,7 @@ export default function DownloadCTA() {
         
    
           
    
             
-            macOS 15+ (Sequoia)
+            macOS 26+ (Tahoe)
           
    
           
    
             
diff --git a/macOS/GhostTools/Package.swift b/macOS/GhostTools/Package.swift
index e563951..28f1c24 100644
--- a/macOS/GhostTools/Package.swift
+++ b/macOS/GhostTools/Package.swift
@@ -7,7 +7,8 @@ let package = Package(
         .macOS(.v15)
     ],
     products: [
-        .executable(name: "GhostTools", targets: ["GhostTools"])
+        .executable(name: "GhostTools", targets: ["GhostTools"]),
+        .executable(name: "ghost-container", targets: ["ghost-container"])
     ],
     dependencies: [
         .package(path: "../../Packages/GhostHTTP")
@@ -29,11 +30,19 @@ let package = Package(
                 .unsafeFlags(["-Xlinker", "-sectcreate", "-Xlinker", "__TEXT", "-Xlinker", "__info_plist", "-Xlinker", "../../build/generated-plists/GhostTools-Info.plist"], .when(configuration: .release))
             ]
         ),
+        .executableTarget(
+            name: "ghost-container",
+            dependencies: []
+        ),
         .testTarget(
             name: "GhostToolsTests",
             dependencies: [
                 "GhostTools",
             ]
+        ),
+        .testTarget(
+            name: "GhostContainerTests",
+            dependencies: ["ghost-container"]
         )
     ]
 )
diff --git a/macOS/GhostTools/README.txt b/macOS/GhostTools/README.txt
index 3064fc0..ca8b347 100644
--- a/macOS/GhostTools/README.txt
+++ b/macOS/GhostTools/README.txt
@@ -12,6 +12,7 @@ enabling enhanced host-guest integration:
 - Pointer and keyboard input injection
 - Screenshot capture with element overlays
 - Log streaming to host
+- Experimental host-backed Apple container execution
 
 Installation
 ------------
@@ -24,6 +25,40 @@ To install manually:
 
    sudo cp /Volumes/GhostTools/GhostTools.app /Applications/
 
+The experimental container CLI can be run directly from the mounted DMG:
+
+   /Volumes/GhostTools/ghost-container run registry-1.docker.io/library/alpine:latest echo hello
+
+Host-backed Containers
+----------------------
+
+This feature runs ephemeral Linux containers on the outer Mac through Apple's
+Containerization framework. It currently supports:
+
+   ghost-container run IMAGE [COMMAND...]
+   ghost-container run -it IMAGE [COMMAND...]
+   ghost-container run -v /guest/path:/container/path:ro IMAGE [COMMAND...]
+
+Use -i to attach stdin and -t to allocate a terminal. Combined -it sessions
+support terminal resize events and Ctrl-C through the container PTY. Alpine
+images provide /bin/sh by default:
+
+   ghost-container run -it registry-1.docker.io/library/alpine:latest /bin/sh
+
+The outer Mac must be Apple silicon. In GhostVM, open Edit Settings for this VM,
+select NAT (Shared), and enable Host-backed Containers before starting the VM.
+Guest directory mounts additionally require macOS 26 or later and the GhostVM
+file system extension enabled under System Settings > General > Login Items &
+Extensions > File System Extensions. Restart the VM after changing the setting.
+
+Enabling the bridge grants any process in the guest permission to request the
+limited host-side container run operation. Images are pulled using the host
+user's registry access and remain in the host image store after the ephemeral
+container exits, so private registry access and disk usage are part of this
+trust grant. A read-only volume exposes only the requested guest directory to
+the container. Outer-host paths, read-write mounts, builds, ports, and
+persistent containers are not supported.
+
 GhostTools requires Accessibility permission in the guest to enable
 pointer, keyboard, and UI automation features. Grant this in
 System Settings > Privacy & Security > Accessibility.
diff --git a/macOS/GhostTools/Sources/GhostTools/Server/Router.swift b/macOS/GhostTools/Sources/GhostTools/Server/Router.swift
index 78ebe15..77eb0c4 100644
--- a/macOS/GhostTools/Sources/GhostTools/Server/Router.swift
+++ b/macOS/GhostTools/Sources/GhostTools/Server/Router.swift
@@ -60,7 +60,7 @@ final class Router: @unchecked Sendable {
             return handleFrontmostApp(request)
         } else if path == "/api/v1/apps" || path.hasPrefix("/api/v1/apps/") {
             return handleApps(request: request, body: body)
-        } else if path == "/api/v1/fs" || path == "/api/v1/fs/mkdir" || path == "/api/v1/fs/delete" || path == "/api/v1/fs/move" {
+        } else if path == "/api/v1/fs" || path.hasPrefix("/api/v1/fs/") {
             return handleFS(request: request, body: body)
         } else if path == "/api/v1/exec" {
             return handleExec(request: request, body: body)
@@ -553,6 +553,43 @@ final class Router: @unchecked Sendable {
             let queryPath = parseQuery(request.path, key: "path") ?? NSHomeDirectory()
             return listDirectory(at: queryPath)
         }
+
+        if path == "/api/v1/fs/metadata" && request.method == .GET {
+            guard let queryPath = parseQuery(request.path, key: "path") else {
+                return HTTPResponse.error(.badRequest, message: "Path required")
+            }
+            return metadata(at: queryPath)
+        }
+
+        if path == "/api/v1/fs/list" && request.method == .GET {
+            guard let queryPath = parseQuery(request.path, key: "path") else {
+                return HTTPResponse.error(.badRequest, message: "Path required")
+            }
+            return listDirectoryMetadata(at: queryPath)
+        }
+
+        if path == "/api/v1/fs/read" && request.method == .GET {
+            guard
+                let queryPath = parseQuery(request.path, key: "path"),
+                let offsetValue = parseQuery(request.path, key: "offset"),
+                let offset = UInt64(offsetValue),
+                let lengthValue = parseQuery(request.path, key: "length"),
+                let length = Int(lengthValue),
+                length >= 0,
+                length <= 1024 * 1024
+            else {
+                return HTTPResponse.error(.badRequest, message: "Valid path, offset, and length are required")
+            }
+            return readFile(at: queryPath, offset: offset, length: length)
+        }
+
+        if path == "/api/v1/fs/readlink" && request.method == .GET {
+            guard let queryPath = parseQuery(request.path, key: "path") else {
+                return HTTPResponse.error(.badRequest, message: "Path required")
+            }
+            return readSymbolicLink(at: queryPath)
+        }
+
         guard request.method == .POST else {
             return HTTPResponse.error(.methodNotAllowed, message: "Method not allowed")
         }
@@ -625,6 +662,102 @@ final class Router: @unchecked Sendable {
         }
     }
 
+    private func metadata(at path: String) -> HTTPResponse {
+        do {
+            return HTTPResponse.json(try JSONEncoder().encode(try fileMetadata(at: path)))
+        } catch let error as POSIXError where error.code == .ENOENT {
+            return HTTPResponse.error(.notFound, message: "Path not found")
+        } catch let error as POSIXError where error.code == .EACCES {
+            return HTTPResponse.error(.forbidden, message: "Access denied")
+        } catch {
+            return HTTPResponse.error(.internalServerError, message: "Failed to read metadata: \(error.localizedDescription)")
+        }
+    }
+
+    private func listDirectoryMetadata(at path: String) -> HTTPResponse {
+        do {
+            let names = try FileManager.default.contentsOfDirectory(atPath: path)
+            let entries = try names.sorted().map { name in
+                try fileMetadata(at: (path as NSString).appendingPathComponent(name))
+            }
+            return HTTPResponse.json(try JSONEncoder().encode(GuestDirectoryMetadata(path: path, entries: entries)))
+        } catch let error as POSIXError where error.code == .ENOENT {
+            return HTTPResponse.error(.notFound, message: "Path not found")
+        } catch let error as POSIXError where error.code == .EACCES {
+            return HTTPResponse.error(.forbidden, message: "Access denied")
+        } catch {
+            return HTTPResponse.error(.internalServerError, message: "Failed to list directory: \(error.localizedDescription)")
+        }
+    }
+
+    private func readFile(at path: String, offset: UInt64, length: Int) -> HTTPResponse {
+        do {
+            let metadata = try fileMetadata(at: path)
+            guard metadata.type == .file else {
+                return HTTPResponse.error(.badRequest, message: "Path is not a regular file")
+            }
+            let handle = try FileHandle(forReadingFrom: URL(fileURLWithPath: path))
+            defer { try? handle.close() }
+            try handle.seek(toOffset: offset)
+            let data = try handle.read(upToCount: length) ?? Data()
+            return HTTPResponse(
+                status: .ok,
+                headers: ["Content-Type": "application/octet-stream"],
+                body: .bytes(data)
+            )
+        } catch let error as POSIXError where error.code == .ENOENT {
+            return HTTPResponse.error(.notFound, message: "Path not found")
+        } catch let error as POSIXError where error.code == .EACCES {
+            return HTTPResponse.error(.forbidden, message: "Access denied")
+        } catch {
+            return HTTPResponse.error(.internalServerError, message: "Failed to read file: \(error.localizedDescription)")
+        }
+    }
+
+    private func readSymbolicLink(at path: String) -> HTTPResponse {
+        do {
+            let target = try FileManager.default.destinationOfSymbolicLink(atPath: path)
+            return HTTPResponse(
+                status: .ok,
+                headers: ["Content-Type": "text/plain; charset=utf-8"],
+                body: .bytes(Data(target.utf8))
+            )
+        } catch let error as POSIXError where error.code == .ENOENT {
+            return HTTPResponse.error(.notFound, message: "Path not found")
+        } catch {
+            return HTTPResponse.error(.internalServerError, message: "Failed to read symbolic link: \(error.localizedDescription)")
+        }
+    }
+
+    private func fileMetadata(at path: String) throws -> GuestFileMetadata {
+        var info = stat()
+        guard Darwin.lstat(path, &info) == 0 else {
+            throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)
+        }
+
+        let type: GuestFileType
+        switch info.st_mode & S_IFMT {
+        case S_IFREG: type = .file
+        case S_IFDIR: type = .directory
+        case S_IFLNK: type = .symbolicLink
+        default: type = .other
+        }
+
+        return GuestFileMetadata(
+            name: URL(fileURLWithPath: path).lastPathComponent,
+            type: type,
+            size: UInt64(max(0, info.st_size)),
+            mode: UInt32(info.st_mode),
+            uid: info.st_uid,
+            gid: info.st_gid,
+            inode: info.st_ino,
+            device: UInt64(info.st_dev),
+            linkCount: UInt32(info.st_nlink),
+            modifiedSeconds: info.st_mtimespec.tv_sec,
+            modifiedNanoseconds: Int32(info.st_mtimespec.tv_nsec)
+        )
+    }
+
     // MARK: - Exec
 
     private struct ExecRequest: Codable {
@@ -825,3 +958,29 @@ final class RouterBatchTracker: @unchecked Sendable {
 final class LaunchResult: @unchecked Sendable {
     var success: Bool = false
 }
+
+enum GuestFileType: String, Codable {
+    case file
+    case directory
+    case symbolicLink
+    case other
+}
+
+struct GuestFileMetadata: Codable {
+    let name: String
+    let type: GuestFileType
+    let size: UInt64
+    let mode: UInt32
+    let uid: UInt32
+    let gid: UInt32
+    let inode: UInt64
+    let device: UInt64
+    let linkCount: UInt32
+    let modifiedSeconds: Int
+    let modifiedNanoseconds: Int32
+}
+
+struct GuestDirectoryMetadata: Codable {
+    let path: String
+    let entries: [GuestFileMetadata]
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/Args.swift b/macOS/GhostTools/Sources/ghost-container/Args.swift
new file mode 100644
index 0000000..68c47b6
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghost-container/Args.swift
@@ -0,0 +1,230 @@
+import Foundation
+
+/// Parse `ghost-container run [-i] [-t] [-v GUEST:CONTAINER:ro] IMAGE [COMMAND...]`.
+enum ParsedAction {
+    case run(image: String, command: [String], volumes: [HostContainerVolume], interactive: Bool, tty: Bool)
+    case help
+    case version
+}
+
+/// Errors produced during argument parsing.
+enum ParseError: LocalizedError {
+    case noArguments
+    case unknownSubcommand(String)
+    case missingImage
+    case invalidImage(String)
+    case tooManyCommands(max: Int)
+    case invalidCommand(index: Int, reason: String)
+    case missingVolume
+    case invalidVolume(String)
+    case tooManyVolumes(max: Int)
+    case duplicateVolumeDestination(String)
+
+    var errorDescription: String? {
+        switch self {
+        case .noArguments:
+            return "no arguments provided"
+        case .unknownSubcommand(let sub):
+            return "unknown subcommand '\(sub)'. Expected 'run'."
+        case .missingImage:
+            return "missing IMAGE argument. Usage: ghost-container run IMAGE [COMMAND...]"
+        case .invalidImage(let reason):
+            return "invalid IMAGE: \(reason)"
+        case .tooManyCommands(let max):
+            return "too many command arguments: maximum is \(max)"
+        case .invalidCommand(let index, let reason):
+            return "invalid command argument at index \(index): \(reason)"
+        case .missingVolume:
+            return "missing value for -v/--volume. Expected GUEST_PATH:CONTAINER_PATH:ro"
+        case .invalidVolume(let reason):
+            return "invalid volume: \(reason)"
+        case .tooManyVolumes(let max):
+            return "too many volumes: maximum is \(max)"
+        case .duplicateVolumeDestination(let path):
+            return "duplicate container volume destination '\(path)'"
+        }
+    }
+}
+
+struct CLIOptions {
+    let action: ParsedAction
+}
+
+/// Parse raw argv (excluding argv[0]).
+///
+/// Rules:
+/// - No arguments → help.
+/// - First token must be a subcommand (`run`, `--help`, `-h`, `help`, `--version`, `-v`).
+///   No flags/options before the subcommand are accepted.
+/// - `run [-i] [-t] [-v GUEST:CONTAINER:ro] IMAGE [COMMAND...]` — COMMAND args after IMAGE are opaque.
+func parseArguments(_ argv: [String]) -> Result {
+    if argv.isEmpty {
+        return .success(CLIOptions(action: .help))
+    }
+
+    let first = argv[0]
+
+    switch first {
+    case "--help", "-h", "help":
+        return .success(CLIOptions(action: .help))
+    case "--version", "-v":
+        return .success(CLIOptions(action: .version))
+    case "run":
+        break
+    default:
+        return .failure(.unknownSubcommand(first))
+    }
+
+    var index = 1
+    var volumes: [HostContainerVolume] = []
+    var interactive = false
+    var tty = false
+    optionLoop: while index < argv.count {
+        let token = argv[index]
+        switch token {
+        case "-i", "--interactive":
+            interactive = true
+            index += 1
+            continue
+        case "-t", "--tty":
+            tty = true
+            index += 1
+            continue
+        case "-it", "-ti":
+            interactive = true
+            tty = true
+            index += 1
+            continue
+        default:
+            break
+        }
+
+        let specification: String
+        if token == "-v" || token == "--volume" {
+            index += 1
+            guard index < argv.count else { return .failure(.missingVolume) }
+            specification = argv[index]
+        } else if token.hasPrefix("--volume=") {
+            specification = String(token.dropFirst("--volume=".count))
+        } else {
+            break optionLoop
+        }
+
+        guard volumes.count < kMaxVolumes else {
+            return .failure(.tooManyVolumes(max: kMaxVolumes))
+        }
+        switch parseVolume(specification) {
+        case .success(let volume):
+            guard !volumes.contains(where: { $0.destination == volume.destination }) else {
+                return .failure(.duplicateVolumeDestination(volume.destination))
+            }
+            volumes.append(volume)
+        case .failure(let error):
+            return .failure(error)
+        }
+        index += 1
+    }
+
+    guard index < argv.count else {
+        return .failure(.missingImage)
+    }
+
+    let image = argv[index]
+    if let err = validateImage(image) {
+        return .failure(err)
+    }
+
+    let command = Array(argv.dropFirst(index + 1))
+
+    if command.count > kMaxCommandArgs {
+        return .failure(.tooManyCommands(max: kMaxCommandArgs))
+    }
+    for (i, arg) in command.enumerated() {
+        if let err = validateCommandArg(arg) {
+            return .failure(.invalidCommand(index: i, reason: err))
+        }
+    }
+
+    return .success(CLIOptions(action: .run(
+        image: image,
+        command: command,
+        volumes: volumes,
+        interactive: interactive,
+        tty: tty
+    )))
+}
+
+/// Maximum number of command arguments accepted locally (matches host cap).
+let kMaxCommandArgs: Int = 64
+
+/// Maximum UTF-8 byte length of the image name (matches host cap).
+let kMaxImageBytes: Int = 256
+
+/// Maximum UTF-8 byte length of each command argument (matches host cap).
+let kMaxCommandArgBytes: Int = 4096
+
+/// Maximum number of guest directory mounts in one run request.
+let kMaxVolumes: Int = 32
+
+private func parseVolume(_ specification: String) -> Result {
+    let fields = specification.split(separator: ":", omittingEmptySubsequences: false).map(String.init)
+    guard fields.count == 2 || fields.count == 3 else {
+        return .failure(.invalidVolume("expected GUEST_PATH:CONTAINER_PATH[:ro]"))
+    }
+    let guestPath = fields[0]
+    let destination = fields[1]
+    guard guestPath.hasPrefix("/"), !guestPath.contains("\0") else {
+        return .failure(.invalidVolume("guest path must be absolute and contain no NUL bytes"))
+    }
+    let destinationParts = destination.split(separator: "/", omittingEmptySubsequences: true)
+    guard destination.hasPrefix("/"),
+          destination != "/",
+          !destination.contains("\0"),
+          !destinationParts.contains(where: { $0 == "." || $0 == ".." }) else {
+        return .failure(.invalidVolume("container path must be absolute, must not be '/', and must contain no dot components or NUL bytes"))
+    }
+    guard guestPath.utf8.count <= kMaxVolumePathBytes, destination.utf8.count <= kMaxVolumePathBytes else {
+        return .failure(.invalidVolume("paths must not exceed \(kMaxVolumePathBytes) bytes"))
+    }
+    let mode = fields.count == 3 ? fields[2] : "rw"
+    guard mode == "ro" else {
+        return .failure(.invalidVolume("guest directory mounts are currently read-only; append ':ro'"))
+    }
+    return .success(HostContainerVolume(guestPath: guestPath, destination: destination, readOnly: true))
+}
+
+let kMaxVolumePathBytes: Int = 4096
+
+/// Validate an image name: nonempty, no NUL, no leading dash, sensible UTF-8 byte
+/// length, no whitespace.
+func validateImage(_ image: String) -> ParseError? {
+    if image.isEmpty {
+        return .invalidImage("image name is empty")
+    }
+    if image.contains("\0") {
+        return .invalidImage("image name contains NUL byte")
+    }
+    if image.hasPrefix("-") {
+        return .invalidImage("image name must not start with '-'")
+    }
+    // Length is measured in UTF-8 bytes to match the host.
+    if image.utf8.count > kMaxImageBytes {
+        return .invalidImage("image name exceeds \(kMaxImageBytes) bytes")
+    }
+    if image.contains(" ") || image.contains("\t") || image.contains("\n") || image.contains("\r") {
+        return .invalidImage("image name must not contain whitespace")
+    }
+    return nil
+}
+
+/// Validate a single command argument: no NUL, bounded UTF-8 byte length.
+/// Args may begin with `-` (opaque), so only NUL and length are checked.
+func validateCommandArg(_ arg: String) -> String? {
+    if arg.contains("\0") {
+        return "contains NUL byte"
+    }
+    if arg.utf8.count > kMaxCommandArgBytes {
+        return "exceeds \(kMaxCommandArgBytes) bytes"
+    }
+    return nil
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift b/macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift
new file mode 100644
index 0000000..cb48233
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift
@@ -0,0 +1,456 @@
+import Foundation
+
+let gcVersion = "0.1.0"
+
+let gcHelp = """
+Usage: ghost-container run [-i] [-t] [-v GUEST_PATH:CONTAINER_PATH:ro] IMAGE [COMMAND...]
+
+Run a container image on the outer Mac through Apple container.
+
+Arguments:
+  IMAGE     Fully qualified OCI image reference
+  COMMAND   Optional command and args to run inside the container
+
+Examples:
+  ghost-container run registry-1.docker.io/library/alpine:latest echo hello
+  ghost-container run -it registry-1.docker.io/library/alpine:latest /bin/sh
+  ghost-container run -v /home/user/src:/src:ro registry-1.docker.io/library/alpine:latest ls /src
+  ghost-container run registry-1.docker.io/library/ubuntu:24.04
+
+Options:
+  -i, --interactive  Keep stdin attached
+  -t, --tty          Allocate a terminal (combine as -it)
+  -v, --volume SPEC  Mount a guest directory read-only (GUEST:CONTAINER:ro)
+  --help, -h     Show this help
+  --version, -v  Show version
+"""
+
+/// Entry point — parses argv, dispatches to run, exits with appropriate status.
+@main
+struct GhostContainerCLI {
+    static func main() {
+        signal(SIGPIPE, SIG_IGN)
+
+        let argv = Array(CommandLine.arguments.dropFirst())
+
+        let result = parseArguments(argv)
+
+        let exitCode: Int32
+        switch result {
+        case .success(let opts):
+            exitCode = run(opts)
+        case .failure(let err):
+            FileHandle.standardError.write(Data((err.errorDescription ?? "error").utf8))
+            FileHandle.standardError.write(Data("\n".utf8))
+            exitCode = 125
+        }
+
+        exit(exitCode)
+    }
+
+    /// Execute a parsed action. Returns a process exit status.
+    static func run(_ opts: CLIOptions) -> Int32 {
+        switch opts.action {
+        case .help:
+            FileHandle.standardOutput.write(Data(gcHelp.utf8))
+            return 0
+        case .version:
+            FileHandle.standardOutput.write(Data("\(gcVersion)\n".utf8))
+            return 0
+        case .run(let image, let command, let volumes, let interactive, let tty):
+            return runContainer(
+                image: image,
+                command: command,
+                volumes: volumes,
+                interactive: interactive,
+                tty: tty,
+                port: kDefaultVsockPort
+            )
+        }
+    }
+}
+
+/// Connect to the host via vsock, attach stdin, and stream responses.
+func runContainer(
+    image: String,
+    command: [String],
+    volumes: [HostContainerVolume] = [],
+    interactive: Bool = false,
+    tty: Bool = false,
+    port: UInt32
+) -> Int32 {
+    if tty && isatty(STDOUT_FILENO) == 0 {
+        writeStderr("ghost-container: -t requires stdout to be a terminal\n")
+        return 125
+    }
+    if tty && interactive && isatty(STDIN_FILENO) == 0 {
+        writeStderr("ghost-container: -it requires stdin to be a terminal\n")
+        return 125
+    }
+
+    let terminalSize = tty ? currentTerminalSize() : nil
+    var rawTerminal: RawTerminal?
+    if tty && interactive {
+        do {
+            rawTerminal = try RawTerminal(fd: STDIN_FILENO)
+        } catch {
+            writeStderr("ghost-container: failed to enter raw terminal mode: \(error)\n")
+            return 125
+        }
+    }
+    defer { rawTerminal?.restore() }
+    let terminationSources = rawTerminal.map(installTerminalSignalHandlers) ?? []
+    defer { terminationSources.forEach { $0.cancel() } }
+
+    var terminalStderrNormalizer = TerminalNewlineNormalizer()
+    @discardableResult
+    func writeRunStderr(_ data: Data) -> Bool {
+        let output = rawTerminal == nil ? data : terminalStderrNormalizer.normalize(data)
+        return writeStderr(output)
+    }
+    @discardableResult
+    func writeRunStderr(_ string: String) -> Bool {
+        writeRunStderr(Data(string.utf8))
+    }
+
+    let fd: Int32
+    do {
+        fd = try vsockDialHost(port: port)
+    } catch let err as VsockDialError {
+        writeRunStderr("ghost-container: cannot connect to host: \(err)\n")
+        return 125
+    } catch {
+        writeRunStderr("ghost-container: unexpected error: \(error)\n")
+        return 125
+    }
+
+    defer {
+        Darwin.close(fd)
+    }
+
+    let inputWriter: ContainerInputWriter?
+    if interactive || tty {
+        let inputSocket = Darwin.dup(fd)
+        guard inputSocket >= 0 else {
+            writeRunStderr("ghost-container: failed to duplicate input socket (errno \(errno))\n")
+            return 125
+        }
+        inputWriter = ContainerInputWriter(fd: inputSocket)
+    } else {
+        inputWriter = nil
+    }
+    defer { inputWriter?.close() }
+
+    let request = makeRunRequest(
+        image: image,
+        command: command,
+        volumes: volumes,
+        interactive: interactive,
+        tty: tty,
+        columns: terminalSize?.columns,
+        rows: terminalSize?.rows
+    )
+    let line: Data
+    do {
+        line = try encodeRequestLine(request)
+    } catch {
+        writeRunStderr("ghost-container: failed to encode request: \(error)\n")
+        return 125
+    }
+
+    guard writeAll(fd: fd, line) else {
+        writeRunStderr("ghost-container: failed to send request (EPIPE/errno \(errno))\n")
+        return 125
+    }
+
+    // Input and resize controls share one serialized framed writer.
+    var resizeSource: DispatchSourceSignal?
+    if tty, let inputWriter {
+        signal(SIGWINCH, SIG_IGN)
+        let source = DispatchSource.makeSignalSource(signal: SIGWINCH, queue: .global(qos: .userInitiated))
+        source.setEventHandler {
+            let size = currentTerminalSize()
+            _ = inputWriter.send(.resize(columns: size.columns, rows: size.rows))
+        }
+        source.resume()
+        resizeSource = source
+    }
+    defer {
+        resizeSource?.cancel()
+    }
+
+    if interactive, let inputWriter {
+        DispatchQueue.global(qos: .userInitiated).async {
+            forwardStdin(inputFD: STDIN_FILENO, writer: inputWriter, keepWriteSideOpen: tty)
+        }
+    } else if !tty {
+        _ = Darwin.shutdown(fd, SHUT_WR)
+    }
+
+    let reader = LineReader(fd: fd, maxLineBytes: 1_048_576)
+
+    while true {
+        let rawLine: Data?
+        do {
+            rawLine = try reader.readLine()
+        } catch LineReaderError.lineTooLong(let max) {
+            writeRunStderr("ghost-container: response line exceeded \(max) bytes\n")
+            return 125
+        } catch LineReaderError.ioError(let err, let op) {
+            writeRunStderr("ghost-container: \(op) error: errno \(err) (\(String(cString: strerror(err))))\n")
+            return 125
+        } catch {
+            writeRunStderr("ghost-container: unexpected read error: \(error)\n")
+            return 125
+        }
+
+        guard let json = rawLine, !json.isEmpty else {
+            writeRunStderr("ghost-container: connection closed before exit response\n")
+            return 125
+        }
+
+        switch decodeResponse(json) {
+        case .stdout(let data):
+            if !writeStdout(data) {
+                writeRunStderr("ghost-container: failed to write stdout to fd 1 (errno \(errno): \(String(cString: strerror(errno))))\n")
+                return 125
+            }
+        case .stderr(let data):
+            if !writeRunStderr(data) {
+                // Best-effort diagnostic: writing the diagnostic itself may also
+                // fail (e.g. fd 2 closed). If it does, we cannot report further;
+                // just surface the original failure via the exit status.
+                _ = writeRunStderr("ghost-container: failed to write stderr to fd 2 (errno \(errno): \(String(cString: strerror(errno))))\n")
+                return 125
+            }
+        case .exit(let code):
+            return code
+        case .error(let message):
+            writeRunStderr("ghost-container: host error: \(message)\n")
+            return 125
+        case .protocolError(let message):
+            writeRunStderr("ghost-container: protocol error: \(message)\n")
+            return 125
+        }
+    }
+}
+
+/// Encode a request as an NDJSON line with the exact key order:
+/// `{"version":1,"operation":"run","image":"...","command":[...]}\n`
+///
+/// `JSONEncoder` uses alphabetical key ordering which doesn't match the
+/// required wire format, so we build the JSON string manually with proper
+/// escaping.
+func encodeRequestLine(_ request: HostContainerRequest) throws -> Data {
+    var json = "{\"version\":\(request.version)"
+    json += ",\"operation\":\(jsonString(request.operation))"
+    json += ",\"image\":\(jsonString(request.image))"
+    json += ",\"command\":["
+    json += request.command.map { jsonString($0) }.joined(separator: ",")
+    json += request.stdin ? "],\"stdin\":true" : "],\"stdin\":false"
+    json += request.tty ? ",\"tty\":true" : ",\"tty\":false"
+    if let columns = request.columns, let rows = request.rows {
+        json += ",\"columns\":\(columns),\"rows\":\(rows)"
+    }
+    if !request.volumes.isEmpty {
+        json += ",\"volumes\":["
+        json += request.volumes.map { volume in
+            "{\"guestPath\":\(jsonString(volume.guestPath)),\"destination\":\(jsonString(volume.destination)),\"readOnly\":\(volume.readOnly ? "true" : "false")}"
+        }.joined(separator: ",")
+        json += "]"
+    }
+    json += "}"
+    json.append("\n")
+    return Data(json.utf8)
+}
+
+/// Relays fd 0 to the socket's write side and half-closes it at EOF, leaving
+/// the opposite direction open for stdout/stderr/exit frames.
+func forwardStdin(inputFD: Int32, writer: ContainerInputWriter, keepWriteSideOpen: Bool) {
+    var buffer = [UInt8](repeating: 0, count: 32 * 1024)
+    while true {
+        let count = Darwin.read(inputFD, &buffer, buffer.count)
+        if count > 0 {
+            if !writer.send(.stdin(Data(buffer[0.. Bool {
+        guard let line = try? encodeInputFrame(frame) else { return false }
+        lock.lock()
+        defer { lock.unlock() }
+        guard !closed else { return false }
+        return writeAll(fd: fd, line)
+    }
+
+    func shutdownWrite() {
+        lock.lock()
+        if !closed {
+            _ = Darwin.shutdown(fd, SHUT_WR)
+        }
+        lock.unlock()
+    }
+
+    func close() {
+        lock.lock()
+        guard !closed else {
+            lock.unlock()
+            return
+        }
+        closed = true
+        _ = Darwin.shutdown(fd, SHUT_WR)
+        Darwin.close(fd)
+        lock.unlock()
+    }
+}
+
+func currentTerminalSize() -> (columns: UInt16, rows: UInt16) {
+    var size = winsize()
+    let descriptor = isatty(STDOUT_FILENO) != 0 ? STDOUT_FILENO : STDIN_FILENO
+    guard ioctl(descriptor, TIOCGWINSZ, &size) == 0, size.ws_col > 0, size.ws_row > 0 else {
+        return (80, 24)
+    }
+    return (size.ws_col, size.ws_row)
+}
+
+final class RawTerminal: @unchecked Sendable {
+    private let fd: Int32
+    private let lock = NSLock()
+    private var original: termios?
+
+    init(fd: Int32) throws {
+        self.fd = fd
+        var original = termios()
+        guard tcgetattr(fd, &original) == 0 else {
+            throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)
+        }
+        var raw = original
+        cfmakeraw(&raw)
+        guard tcsetattr(fd, TCSAFLUSH, &raw) == 0 else {
+            throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)
+        }
+        self.original = original
+    }
+
+    func restore() {
+        lock.lock()
+        guard var original else {
+            lock.unlock()
+            return
+        }
+        self.original = nil
+        _ = tcsetattr(fd, TCSAFLUSH, &original)
+        lock.unlock()
+    }
+}
+
+struct TerminalNewlineNormalizer {
+    private var previousByteWasCarriageReturn = false
+
+    mutating func normalize(_ data: Data) -> Data {
+        var output = Data()
+        output.reserveCapacity(data.count)
+        for byte in data {
+            if byte == 0x0A, !previousByteWasCarriageReturn {
+                output.append(0x0D)
+            }
+            output.append(byte)
+            previousByteWasCarriageReturn = byte == 0x0D
+        }
+        return output
+    }
+}
+
+func installTerminalSignalHandlers(_ terminal: RawTerminal) -> [DispatchSourceSignal] {
+    [SIGINT, SIGTERM, SIGHUP, SIGQUIT].map { signalNumber in
+        signal(signalNumber, SIG_IGN)
+        let source = DispatchSource.makeSignalSource(signal: signalNumber, queue: .global(qos: .userInitiated))
+        source.setEventHandler {
+            terminal.restore()
+            signal(signalNumber, SIG_DFL)
+            raise(signalNumber)
+        }
+        source.resume()
+        return source
+    }
+}
+
+/// Escape a string for inclusion in a JSON string literal (including surrounding quotes).
+private func jsonString(_ s: String) -> String {
+    var result = "\""
+    for scalar in s.unicodeScalars {
+        switch scalar {
+        case "\"":
+            result += "\\\""
+        case "\\":
+            result += "\\\\"
+        case "\n":
+            result += "\\n"
+        case "\r":
+            result += "\\r"
+        case "\t":
+            result += "\\t"
+        case "\u{08}":
+            result += "\\b"
+        case "\u{0C}":
+            result += "\\f"
+        default:
+            if scalar.value < 0x20 {
+                result += String(format: "\\u%04x", scalar.value)
+            } else {
+                result += String(scalar)
+            }
+        }
+    }
+    result += "\""
+    return result
+}
+
+/// Write bytes to fd 1 (stdout). Returns false on write failure.
+@discardableResult
+func writeStdout(_ data: Data) -> Bool {
+    return writeAll(fd: 1, data)
+}
+
+/// Write bytes to fd 2 (stderr). Returns false on write failure.
+@discardableResult
+func writeStderr(_ data: Data) -> Bool {
+    return writeAll(fd: 2, data)
+}
+
+/// Write a UTF-8 string to stderr. Returns false on write failure.
+@discardableResult
+func writeStderr(_ s: String) -> Bool {
+    return writeStderr(Data(s.utf8))
+}
+
+/// Map a host-provided exit status into a valid process exit status.
+///
+/// Predictable mapping (no bit masking):
+/// - `0...255` is accepted unchanged.
+/// - Any malformed/out-of-range value (negative, ≥ 256) maps to `125` so the
+///   guest never silently returns a wrong code.
+func clampExitCode(_ code: Int32) -> Int32 {
+    if (0...255).contains(code) {
+        return code
+    }
+    return 125
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/LineReader.swift b/macOS/GhostTools/Sources/ghost-container/LineReader.swift
new file mode 100644
index 0000000..cc94587
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghost-container/LineReader.swift
@@ -0,0 +1,58 @@
+import Foundation
+
+/// Errors from the line-based NDJSON reader.
+enum LineReaderError: Error {
+    case lineTooLong(max: Int)
+    case ioError(errno: Int32, op: String)
+}
+
+/// Reads newline-delimited lines from a blocking file descriptor.
+/// Enforces a maximum line length to bound memory in a guest.
+final class LineReader {
+    private let fd: Int32
+    private let maxLineBytes: Int
+    private var buffer: [UInt8] = []
+
+    init(fd: Int32, maxLineBytes: Int = 1_048_576) {
+        self.fd = fd
+        self.maxLineBytes = maxLineBytes
+        self.buffer.reserveCapacity(4096)
+    }
+
+    /// Read the next complete line (without the trailing `\n`).
+    /// Returns `nil` on clean EOF before any data.
+    /// Throws on line-too-long or read errors.
+    func readLine() throws -> Data? {
+        while true {
+            if let nlIdx = buffer.firstIndex(of: 0x0A) {
+                let line = Data(buffer[0..= maxLineBytes {
+                throw LineReaderError.lineTooLong(max: maxLineBytes)
+            }
+
+            var chunk = [UInt8](repeating: 0, count: 4096)
+            let n = Darwin.read(fd, &chunk, chunk.count)
+
+            if n < 0 {
+                let err = errno
+                if err == EINTR { continue }
+                throw LineReaderError.ioError(errno: err, op: "read")
+            }
+
+            if n == 0 {
+                if buffer.isEmpty {
+                    return nil
+                }
+                let remaining = Data(buffer)
+                buffer.removeAll(keepingCapacity: true)
+                return remaining
+            }
+
+            buffer.append(contentsOf: chunk[0.. HostContainerRequest {
+    return HostContainerRequest(
+        version: kProtocolVersion,
+        operation: "run",
+        image: image,
+        command: command,
+        stdin: interactive,
+        tty: tty,
+        columns: columns,
+        rows: rows,
+        volumes: volumes
+    )
+}
+
+enum HostContainerInputType: String, Codable {
+    case stdin
+    case stdinClose
+    case resize
+}
+
+struct HostContainerInputFrame: Codable {
+    let version: Int
+    let type: HostContainerInputType
+    let data: String?
+    let columns: UInt16?
+    let rows: UInt16?
+
+    static func stdin(_ data: Data) -> HostContainerInputFrame {
+        HostContainerInputFrame(
+            version: kProtocolVersion,
+            type: .stdin,
+            data: data.base64EncodedString(),
+            columns: nil,
+            rows: nil
+        )
+    }
+
+    static var stdinClose: HostContainerInputFrame {
+        HostContainerInputFrame(version: kProtocolVersion, type: .stdinClose, data: nil, columns: nil, rows: nil)
+    }
+
+    static func resize(columns: UInt16, rows: UInt16) -> HostContainerInputFrame {
+        HostContainerInputFrame(version: kProtocolVersion, type: .resize, data: nil, columns: columns, rows: rows)
+    }
+}
+
+func encodeInputFrame(_ frame: HostContainerInputFrame) throws -> Data {
+    var data = try JSONEncoder().encode(frame)
+    data.append(0x0A)
+    return data
+}
+
+// MARK: - Response
+
+/// A single NDJSON response line from the host.
+struct HostContainerResponse: Codable {
+    let version: Int?
+    let type: String
+    let data: String?
+    let exitCode: Int32?
+    let message: String?
+}
+
+/// Discrete decoded response for internal handling.
+/// - `.protocolError`: distinct from `.error` (host-reported runtime error) — a
+///   protocol error means the wire response was malformed, had an unknown type,
+///   a wrong/missing version, or was missing a required field. It is never
+///   decoded as success or silent empty output.
+enum DecodedResponse {
+    case stdout(Data)
+    case stderr(Data)
+    case exit(Int32)
+    case error(String)
+    case protocolError(String)
+}
+
+/// Decode a raw JSON line into a `DecodedResponse`.
+///
+/// Strict rules:
+/// - `version` is **required** and must equal `kProtocolVersion`, otherwise `.protocolError`.
+/// - `type` must be one of `stdout`, `stderr`, `exit`, `error`.
+/// - `stdout`/`stderr` require `data` encoded as base64. An empty base64 string is
+///   valid empty output. Missing or invalid data produces `.protocolError`.
+/// - `exit` **requires** `exitCode`; missing/out-of-range → `.protocolError`.
+/// - `error` **requires** a nonempty `message`; missing/empty → `.protocolError`.
+/// - Malformed JSON, unknown type, or any other malformed field → `.protocolError`.
+/// - `.protocolError` is never decoded as success or silent empty output.
+func decodeResponse(_ json: Data) -> DecodedResponse {
+    guard let resp = try? JSONDecoder().decode(HostContainerResponse.self, from: json) else {
+        return .protocolError("malformed JSON response")
+    }
+
+    guard let v = resp.version, v == kProtocolVersion else {
+        return .protocolError("unsupported or missing response version")
+    }
+
+    switch resp.type {
+    case "stdout":
+        return decodeOutputStream(resp.data, kind: "stdout")
+    case "stderr":
+        return decodeOutputStream(resp.data, kind: "stderr")
+    case "exit":
+        guard let code = resp.exitCode else {
+            return .protocolError("exit response missing exitCode")
+        }
+        guard (0...255).contains(code) else {
+            return .protocolError("exit response has out-of-range exitCode")
+        }
+        return .exit(code)
+    case "error":
+        guard let msg = resp.message, !msg.isEmpty else {
+            return .protocolError("error response missing or empty message")
+        }
+        return .error(msg)
+    default:
+        return .protocolError("unknown response type '\(resp.type)'")
+    }
+}
+
+/// Decode base64 stream data for `stdout`/`stderr`.
+/// - Empty string → empty output (valid).
+/// - Invalid base64 → `.protocolError` (never silent empty output).
+private func decodeOutputStream(_ data: String?, kind: String) -> DecodedResponse {
+    guard let s = data else {
+        return .protocolError("\(kind) response missing data")
+    }
+    if s.isEmpty {
+        return kind == "stdout" ? .stdout(Data()) : .stderr(Data())
+    }
+    guard let decoded = Data(base64Encoded: s) else {
+        return .protocolError("\(kind) response has invalid base64 data")
+    }
+    return kind == "stdout" ? .stdout(decoded) : .stderr(decoded)
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/VsockDial.swift b/macOS/GhostTools/Sources/ghost-container/VsockDial.swift
new file mode 100644
index 0000000..26acf58
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghost-container/VsockDial.swift
@@ -0,0 +1,84 @@
+import Foundation
+
+/// sockaddr_vm structure for AF_VSOCK addressing.
+/// Must match the kernel's sockaddr_vm layout exactly (12 bytes on Darwin).
+struct sockaddr_vm {
+    var svm_len: UInt8
+    var svm_family: UInt8
+    var svm_reserved1: UInt16
+    var svm_port: UInt32
+    var svm_cid: UInt32
+
+    init(port: UInt32, cid: UInt32) {
+        self.svm_len = UInt8(MemoryLayout.size)
+        self.svm_family = UInt8(AF_VSOCK)
+        self.svm_reserved1 = 0
+        self.svm_port = port
+        self.svm_cid = cid
+    }
+}
+
+enum VsockDialError: Error, CustomStringConvertible {
+    case socketCreationFailed(errno: Int32)
+    case connectFailed(errno: Int32)
+
+    var description: String {
+        switch self {
+        case .socketCreationFailed(let err):
+            return "socket(AF_VSOCK) failed: errno \(err) (\(String(cString: strerror(err))))"
+        case .connectFailed(let err):
+            return "connect() failed: errno \(err) (\(String(cString: strerror(err))))"
+        }
+    }
+}
+
+/// Dial the host via AF_VSOCK, returning a blocking file descriptor.
+/// Uses `VMADDR_CID_HOST` (2) to reach the VM host.
+func vsockDialHost(port: UInt32) throws -> Int32 {
+    let fd = socket(AF_VSOCK, SOCK_STREAM, 0)
+    guard fd >= 0 else {
+        throw VsockDialError.socketCreationFailed(errno: errno)
+    }
+
+    var addr = sockaddr_vm(port: port, cid: VMADDR_CID_HOST)
+
+    let rc = withUnsafePointer(to: &addr) { addrPtr in
+        addrPtr.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockaddrPtr in
+            Darwin.connect(fd, sockaddrPtr, socklen_t(MemoryLayout.size))
+        }
+    }
+
+    guard rc == 0 else {
+        let err = errno
+        Darwin.close(fd)
+        throw VsockDialError.connectFailed(errno: err)
+    }
+
+    return fd
+}
+
+/// Write all bytes to a blocking fd, retrying on EINTR.
+@discardableResult
+func writeAll(fd: Int32, _ data: Data) -> Bool {
+    if data.isEmpty { return true }
+    return data.withUnsafeBytes { rawBuffer -> Bool in
+        guard let base = rawBuffer.baseAddress else { return false }
+        var offset = 0
+        while offset < data.count {
+            let written = Darwin.write(fd, base.advanced(by: offset), data.count - offset)
+            if written < 0 {
+                if errno == EINTR { continue }
+                return false
+            }
+            if written == 0 { return false }
+            offset += written
+        }
+        return true
+    }
+}
+
+/// Write a byte sequence to a fd, retrying on EINTR.
+@discardableResult
+func writeBytes(fd: Int32, _ bytes: [UInt8]) -> Bool {
+    return writeAll(fd: fd, Data(bytes))
+}
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift b/macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift
new file mode 100644
index 0000000..2dce25e
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift
@@ -0,0 +1,271 @@
+@testable import ghost_container
+import XCTest
+
+final class ArgsTests: XCTestCase {
+
+    func testNoArgumentsReturnsHelp() {
+        let result = parseArguments([])
+        guard case .success(let opts) = result, case .help = opts.action else {
+            return XCTFail("Expected .help, got \(result)")
+        }
+    }
+
+    func testHelpFlag() {
+        for flag in ["--help", "-h", "help"] {
+            let result = parseArguments([flag])
+            guard case .success(let opts) = result, case .help = opts.action else {
+                return XCTFail("Expected .help for '\(flag)', got \(result)")
+            }
+        }
+    }
+
+    func testVersionFlag() {
+        for flag in ["--version", "-v"] {
+            let result = parseArguments([flag])
+            guard case .success(let opts) = result, case .version = opts.action else {
+                return XCTFail("Expected .version for '\(flag)', got \(result)")
+            }
+        }
+    }
+
+    func testRunWithImageOnly() {
+        let result = parseArguments(["run", "alpine"])
+        guard case .success(let opts) = result,
+              case .run(let image, let command, let volumes, let interactive, let tty) = opts.action else {
+            return XCTFail("Expected .run, got \(result)")
+        }
+        XCTAssertEqual(image, "alpine")
+        XCTAssertEqual(command, [])
+        XCTAssertEqual(volumes, [])
+        XCTAssertFalse(interactive)
+        XCTAssertFalse(tty)
+    }
+
+    func testRunWithCommand() {
+        let result = parseArguments(["run", "alpine", "echo", "hello"])
+        guard case .success(let opts) = result,
+              case .run(let image, let command, _, _, _) = opts.action else {
+            return XCTFail("Expected .run, got \(result)")
+        }
+        XCTAssertEqual(image, "alpine")
+        XCTAssertEqual(command, ["echo", "hello"])
+    }
+
+    func testCommandMayBeginWithDash() {
+        let result = parseArguments(["run", "alpine", "-c", "--flag", "-n"])
+        guard case .success(let opts) = result,
+              case .run(let image, let command, _, _, _) = opts.action else {
+            return XCTFail("Expected .run, got \(result)")
+        }
+        XCTAssertEqual(image, "alpine")
+        XCTAssertEqual(command, ["-c", "--flag", "-n"])
+    }
+
+    func testRejectsFlagBeforeImage() {
+        let result = parseArguments(["run", "--some-flag", "alpine"])
+        guard case .failure(let err) = result else {
+            return XCTFail("Expected failure for flag-before-image, got \(result)")
+        }
+        XCTAssertEqual(err.errorDescription, "invalid IMAGE: image name must not start with '-'")
+    }
+
+    func testRejectsUnknownSubcommand() {
+        let result = parseArguments(["bogus"])
+        guard case .failure(let err) = result else {
+            return XCTFail("Expected failure, got \(result)")
+        }
+        if case .unknownSubcommand(let sub) = err {
+            XCTAssertEqual(sub, "bogus")
+        } else {
+            XCTFail("Expected .unknownSubcommand, got \(err)")
+        }
+    }
+
+    func testRejectsMissingImage() {
+        let result = parseArguments(["run"])
+        guard case .failure(let err) = result else {
+            return XCTFail("Expected failure, got \(result)")
+        }
+        if case .missingImage = err {} else {
+            XCTFail("Expected .missingImage, got \(err)")
+        }
+    }
+
+    func testRejectsEmptyImage() {
+        XCTAssertNotNil(validateImage(""))
+    }
+
+    func testRejectsNullInImage() {
+        XCTAssertNotNil(validateImage("alpine\0evil"))
+    }
+
+    func testRejectsLeadingDashInImage() {
+        XCTAssertNotNil(validateImage("-evil"))
+    }
+
+    func testRejectsTooLongImage() {
+        // Length is measured in UTF-8 bytes.
+        XCTAssertNotNil(validateImage(String(repeating: "a", count: 257)))
+    }
+
+    func testRejectsTooLongImageByUtf8Bytes() {
+        // 256 'a' is exactly at the limit → accepted.
+        XCTAssertNil(validateImage(String(repeating: "a", count: 256)))
+        // A single 2-byte UTF-8 char pushes past 256 bytes even though char count
+        // is 1 + a few ascii — verify byte-based measurement.
+        // 255 'a' (255 bytes) + one 2-byte char (é) = 257 bytes → rejected.
+        let s = String(repeating: "a", count: 255) + "é"
+        XCTAssertGreaterThan(s.utf8.count, 256)
+        XCTAssertNotNil(validateImage(s))
+    }
+
+    func testRejectsWhitespaceInImage() {
+        XCTAssertNotNil(validateImage("alpine latest"))
+        XCTAssertNotNil(validateImage("alpine\tlatest"))
+        XCTAssertNotNil(validateImage("alpine\nlatest"))
+    }
+
+    func testValidImageAccepted() {
+        XCTAssertNil(validateImage("alpine"))
+        XCTAssertNil(validateImage("ubuntu:24.04"))
+        XCTAssertNil(validateImage("registry.example.com/my/img:v1"))
+    }
+
+    // MARK: - Command argument validation
+
+    func testRejectsTooManyCommandArgs() {
+        var argv = ["run", "alpine"]
+        argv.append(contentsOf: (0..<65).map { "c\($0)" })
+        let result = parseArguments(argv)
+        guard case .failure(let err) = result else {
+            return XCTFail("Expected failure for too many command args, got \(result)")
+        }
+        if case .tooManyCommands(let max) = err {
+            XCTAssertEqual(max, 64)
+        } else {
+            XCTFail("Expected .tooManyCommands, got \(err)")
+        }
+    }
+
+    func testAcceptsMaxCommandArgs() {
+        var argv = ["run", "alpine"]
+        argv.append(contentsOf: (0..<64).map { "c\($0)" })
+        let result = parseArguments(argv)
+        guard case .success(let opts) = result,
+              case .run(_, let command, _, _, _) = opts.action else {
+            return XCTFail("Expected .run with 64 command args, got \(result)")
+        }
+        XCTAssertEqual(command.count, 64)
+    }
+
+    func testRejectsNullInCommandArg() {
+        let result = parseArguments(["run", "alpine", "echo\0evil"])
+        guard case .failure(let err) = result else {
+            return XCTFail("Expected failure for NUL in command arg, got \(result)")
+        }
+        if case .invalidCommand(let index, _) = err {
+            XCTAssertEqual(index, 0)
+        } else {
+            XCTFail("Expected .invalidCommand, got \(err)")
+        }
+    }
+
+    func testRejectsTooLongCommandArgByUtf8Bytes() {
+        // 4096 bytes accepted, 4097 rejected.
+        let ok = String(repeating: "a", count: 4096)
+        let result = parseArguments(["run", "alpine", ok])
+        guard case .success = result else {
+            return XCTFail("Expected success for 4096-byte arg, got \(result)")
+        }
+
+        let tooLong = String(repeating: "a", count: 4097)
+        let result2 = parseArguments(["run", "alpine", tooLong])
+        guard case .failure(let err) = result2 else {
+            return XCTFail("Expected failure for 4097-byte arg, got \(result2)")
+        }
+        if case .invalidCommand(let index, _) = err {
+            XCTAssertEqual(index, 0)
+        } else {
+            XCTFail("Expected .invalidCommand, got \(err)")
+        }
+    }
+
+    func testCommandArgUtf8ByteLengthNotCharCount() {
+        // 'é' is 1 char but 2 UTF-8 bytes. 4095 'é' = 8190 bytes → rejected.
+        let arg = String(repeating: "é", count: 4095)
+        XCTAssertGreaterThan(arg.utf8.count, 4096)
+        let result = parseArguments(["run", "alpine", arg])
+        guard case .failure = result else {
+            return XCTFail("Expected failure for oversized-by-utf8 arg, got \(result)")
+        }
+    }
+
+    // MARK: - Volumes
+
+    func testParsesReadOnlyVolumeBeforeImage() {
+        let result = parseArguments(["run", "-v", "/home/user/src:/src:ro", "alpine", "ls", "/src"])
+        guard case .success(let options) = result,
+              case .run(let image, let command, let volumes, _, _) = options.action else {
+            return XCTFail("Expected volume run, got \(result)")
+        }
+        XCTAssertEqual(image, "alpine")
+        XCTAssertEqual(command, ["ls", "/src"])
+        XCTAssertEqual(volumes, [HostContainerVolume(guestPath: "/home/user/src", destination: "/src", readOnly: true)])
+    }
+
+    func testParsesLongVolumeFlag() {
+        let result = parseArguments(["run", "--volume=/data:/mnt/data:ro", "alpine"])
+        guard case .success(let options) = result,
+              case .run(_, _, let volumes, _, _) = options.action else {
+            return XCTFail("Expected volume run, got \(result)")
+        }
+        XCTAssertEqual(volumes.first?.destination, "/mnt/data")
+    }
+
+    func testRejectsImplicitReadWriteVolume() {
+        let result = parseArguments(["run", "-v", "/data:/data", "alpine"])
+        guard case .failure(let error) = result else {
+            return XCTFail("Expected read-write volume rejection")
+        }
+        XCTAssertEqual(error.errorDescription, "invalid volume: guest directory mounts are currently read-only; append ':ro'")
+    }
+
+    func testRejectsDuplicateVolumeDestination() {
+        let result = parseArguments(["run", "-v", "/one:/data:ro", "-v", "/two:/data:ro", "alpine"])
+        guard case .failure(let error) = result else {
+            return XCTFail("Expected duplicate destination rejection")
+        }
+        XCTAssertEqual(error.errorDescription, "duplicate container volume destination '/data'")
+    }
+
+    func testRejectsVolumeDestinationTraversal() {
+        let result = parseArguments(["run", "-v", "/data:/mnt/../:ro", "alpine"])
+        guard case .failure = result else {
+            return XCTFail("Expected traversal destination rejection")
+        }
+    }
+
+    func testParsesInteractiveTTYFlags() {
+        for flag in ["-it", "-ti"] {
+            let result = parseArguments(["run", flag, "alpine", "/bin/sh"])
+            guard case .success(let options) = result,
+                  case .run(_, let command, _, let interactive, let tty) = options.action else {
+                return XCTFail("Expected interactive TTY run for \(flag), got \(result)")
+            }
+            XCTAssertEqual(command, ["/bin/sh"])
+            XCTAssertTrue(interactive)
+            XCTAssertTrue(tty)
+        }
+    }
+
+    func testParsesSeparateInteractiveTTYFlagsMixedWithVolume() {
+        let result = parseArguments(["run", "-i", "-v", "/data:/data:ro", "-t", "alpine"])
+        guard case .success(let options) = result,
+              case .run(_, _, let volumes, let interactive, let tty) = options.action else {
+            return XCTFail("Expected interactive TTY volume run, got \(result)")
+        }
+        XCTAssertEqual(volumes.count, 1)
+        XCTAssertTrue(interactive)
+        XCTAssertTrue(tty)
+    }
+}
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift b/macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift
new file mode 100644
index 0000000..0bdebad
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift
@@ -0,0 +1,135 @@
+@testable import ghost_container
+import XCTest
+
+final class LineReaderTests: XCTestCase {
+
+    private func makeSocketPair() throws -> (Int32, Int32) {
+        var fds = [Int32](repeating: -1, count: 2)
+        let rc = socketpair(AF_UNIX, SOCK_STREAM, 0, &fds)
+        XCTAssertEqual(rc, 0, "socketpair failed: errno=\(errno)")
+        guard rc == 0 else {
+            throw LineReaderError.ioError(errno: errno, op: "socketpair")
+        }
+        return (fds[0], fds[1])
+    }
+
+    func testReadSingleLine() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        _ = writeAll(fd: fdA, Data("hello\n".utf8))
+        let reader = LineReader(fd: fdB)
+        let line = try reader.readLine()
+        XCTAssertEqual(line, Data("hello".utf8))
+    }
+
+    func testReadMultipleLines() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        _ = writeAll(fd: fdA, Data("line1\nline2\nline3\n".utf8))
+        let reader = LineReader(fd: fdB)
+
+        XCTAssertEqual(try reader.readLine(), Data("line1".utf8))
+        XCTAssertEqual(try reader.readLine(), Data("line2".utf8))
+        XCTAssertEqual(try reader.readLine(), Data("line3".utf8))
+    }
+
+    func testReadLineAcrossMultipleReads() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        let reader = LineReader(fd: fdB)
+
+        _ = writeAll(fd: fdA, Data("partial".utf8))
+        // Give the kernel time to deliver
+        usleep(10_000)
+
+        // Write the rest with newline
+        _ = writeAll(fd: fdA, Data("-line\n".utf8))
+
+        let line = try reader.readLine()
+        XCTAssertEqual(line, Data("partial-line".utf8))
+    }
+
+    func testReadLineTrailingDataWithoutNewline() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        _ = writeAll(fd: fdA, Data("first\ntrailing".utf8))
+        let reader = LineReader(fd: fdB)
+
+        XCTAssertEqual(try reader.readLine(), Data("first".utf8))
+
+        // Close write end → EOF on read end
+        Darwin.close(fdA)
+
+        let line = try reader.readLine()
+        XCTAssertEqual(line, Data("trailing".utf8))
+
+        // Should now get nil
+        let next = try reader.readLine()
+        XCTAssertNil(next)
+    }
+
+    func testReturnsNilOnCleanEOF() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        Darwin.close(fdA)
+
+        let reader = LineReader(fd: fdB)
+        let line = try reader.readLine()
+        XCTAssertNil(line)
+
+        Darwin.close(fdB)
+    }
+
+    func testThrowsOnLineTooLong() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        // Write a long line without newline
+        let big = Data((0..<100).map { _ in UInt8(0x61) }) // 100 'a's
+        _ = writeAll(fd: fdA, big)
+
+        let reader = LineReader(fd: fdB, maxLineBytes: 10)
+
+        do {
+            _ = try reader.readLine()
+            XCTFail("Expected lineTooLong error")
+        } catch LineReaderError.lineTooLong(let max) {
+            XCTAssertEqual(max, 10)
+        } catch {
+            XCTFail("Expected lineTooLong, got \(error)")
+        }
+    }
+
+    func testEmptyLine() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+
+        _ = writeAll(fd: fdA, Data("\n\n\n".utf8))
+        let reader = LineReader(fd: fdB)
+
+        XCTAssertEqual(try reader.readLine(), Data())
+        XCTAssertEqual(try reader.readLine(), Data())
+        XCTAssertEqual(try reader.readLine(), Data())
+    }
+}
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift b/macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift
new file mode 100644
index 0000000..76a86dd
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift
@@ -0,0 +1,328 @@
+@testable import ghost_container
+import XCTest
+
+final class ProtocolTests: XCTestCase {
+
+    // MARK: - Request encoding
+
+    func testRequestWireFormatMatchesExactly() throws {
+        let req = makeRunRequest(image: "alpine", command: ["echo", "hello"])
+        let line = try encodeRequestLine(req)
+        let s = String(data: line, encoding: .utf8)!
+
+        XCTAssertEqual(s, #"{"version":2,"operation":"run","image":"alpine","command":["echo","hello"],"stdin":false,"tty":false}"# + "\n")
+    }
+
+    func testRequestWithEmptyCommand() throws {
+        let req = makeRunRequest(image: "ubuntu:24.04", command: [])
+        let line = try encodeRequestLine(req)
+        let s = String(data: line, encoding: .utf8)!
+
+        XCTAssertEqual(s, #"{"version":2,"operation":"run","image":"ubuntu:24.04","command":[],"stdin":false,"tty":false}"# + "\n")
+    }
+
+    func testRequestWithVolume() throws {
+        let volume = HostContainerVolume(guestPath: "/home/user/src", destination: "/src", readOnly: true)
+        let request = makeRunRequest(image: "alpine", command: [], volumes: [volume])
+        let line = try encodeRequestLine(request)
+        XCTAssertEqual(
+            String(data: line, encoding: .utf8),
+            #"{"version":2,"operation":"run","image":"alpine","command":[],"stdin":false,"tty":false,"volumes":[{"guestPath":"/home/user/src","destination":"/src","readOnly":true}]}"# + "\n"
+        )
+    }
+
+    func testInteractiveTTYRequestIncludesTerminalSize() throws {
+        let request = makeRunRequest(
+            image: "alpine",
+            command: ["/bin/sh"],
+            interactive: true,
+            tty: true,
+            columns: 120,
+            rows: 40
+        )
+        XCTAssertEqual(
+            String(data: try encodeRequestLine(request), encoding: .utf8),
+            #"{"version":2,"operation":"run","image":"alpine","command":["/bin/sh"],"stdin":true,"tty":true,"columns":120,"rows":40}"# + "\n"
+        )
+    }
+
+    func testInputFramesAreNDJSON() throws {
+        let input = try encodeInputFrame(.stdin(Data([0x00, 0xFF])))
+        let resize = try encodeInputFrame(.resize(columns: 132, rows: 43))
+        XCTAssertEqual(input.last, 0x0A)
+        XCTAssertEqual(resize.last, 0x0A)
+        let inputObject = try JSONSerialization.jsonObject(with: Data(input.dropLast())) as? [String: Any]
+        let resizeObject = try JSONSerialization.jsonObject(with: Data(resize.dropLast())) as? [String: Any]
+        XCTAssertEqual(inputObject?["type"] as? String, "stdin")
+        XCTAssertEqual(inputObject?["data"] as? String, Data([0x00, 0xFF]).base64EncodedString())
+        XCTAssertEqual(resizeObject?["columns"] as? Int, 132)
+        XCTAssertEqual(resizeObject?["rows"] as? Int, 43)
+    }
+
+    // MARK: - Response decoding: success cases
+
+    func testDecodeStdout() throws {
+        let payload = "hello world".data(using: .utf8)!
+        let b64 = payload.base64EncodedString()
+        let json = #"{"version":2,"type":"stdout","data":"\#(b64)"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .stdout(let data):
+            XCTAssertEqual(data, payload)
+        default:
+            XCTFail("Expected .stdout")
+        }
+    }
+
+    func testDecodeStderr() throws {
+        let payload = "error line".data(using: .utf8)!
+        let b64 = payload.base64EncodedString()
+        let json = #"{"version":2,"type":"stderr","data":"\#(b64)"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .stderr(let data):
+            XCTAssertEqual(data, payload)
+        default:
+            XCTFail("Expected .stderr")
+        }
+    }
+
+    func testDecodeExit() throws {
+        let json = #"{"version":2,"type":"exit","exitCode":42}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .exit(let code):
+            XCTAssertEqual(code, 42)
+        default:
+            XCTFail("Expected .exit")
+        }
+    }
+
+    func testDecodeExitZero() throws {
+        let json = #"{"version":2,"type":"exit","exitCode":0}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .exit(let code):
+            XCTAssertEqual(code, 0)
+        default:
+            XCTFail("Expected .exit")
+        }
+    }
+
+    func testDecodeExit255() throws {
+        let json = #"{"version":2,"type":"exit","exitCode":255}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .exit(let code):
+            XCTAssertEqual(code, 255)
+        default:
+            XCTFail("Expected .exit")
+        }
+    }
+
+    func testDecodeError() throws {
+        let json = #"{"version":2,"type":"error","message":"image not found"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .error(let message):
+            XCTAssertEqual(message, "image not found")
+        default:
+            XCTFail("Expected .error")
+        }
+    }
+
+    // MARK: - Response decoding: empty base64 is valid empty output
+
+    func testDecodeStdoutEmptyBase64StringYieldsEmpty() throws {
+        let json = #"{"version":2,"type":"stdout","data":""}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .stdout(let data):
+            XCTAssertTrue(data.isEmpty)
+        default:
+            XCTFail("Expected .stdout with empty data")
+        }
+    }
+
+    func testDecodeStderrEmptyBase64StringYieldsEmpty() throws {
+        let json = #"{"version":2,"type":"stderr","data":""}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .stderr(let data):
+            XCTAssertTrue(data.isEmpty)
+        default:
+            XCTFail("Expected .stderr with empty data")
+        }
+    }
+
+    func testDecodeStdoutMissingDataIsProtocolError() throws {
+        let json = #"{"version":2,"type":"stdout"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for missing data")
+        }
+    }
+
+    // MARK: - Response decoding: strict protocol errors (never success)
+
+    func testDecodeStdoutInvalidBase64IsProtocolError() throws {
+        let json = #"{"version":2,"type":"stdout","data":"!!! not base64"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for invalid base64, not silent empty output")
+        }
+    }
+
+    func testDecodeExitMissingCodeIsProtocolError() throws {
+        let json = #"{"version":2,"type":"exit"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for missing exitCode")
+        }
+    }
+
+    func testDecodeExitOutOfRangeHighIsProtocolError() throws {
+        let json = #"{"version":2,"type":"exit","exitCode":256}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for out-of-range exitCode")
+        }
+    }
+
+    func testDecodeExitNegativeIsProtocolError() throws {
+        let json = #"{"version":2,"type":"exit","exitCode":-1}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for negative exitCode")
+        }
+    }
+
+    func testDecodeErrorMissingMessageIsProtocolError() throws {
+        let json = #"{"version":2,"type":"error"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for missing error message")
+        }
+    }
+
+    func testDecodeErrorEmptyMessageIsProtocolError() throws {
+        let json = #"{"version":2,"type":"error","message":""}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for empty error message")
+        }
+    }
+
+    func testDecodeUnsupportedVersionIsProtocolError() throws {
+        let json = #"{"version":99,"type":"exit","exitCode":0}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for wrong version")
+        }
+    }
+
+    func testDecodeMissingVersionIsProtocolError() throws {
+        // version is now required.
+        let json = #"{"type":"exit","exitCode":7}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for missing version")
+        }
+    }
+
+    func testDecodeUnknownTypeIsProtocolError() throws {
+        let json = #"{"version":2,"type":"bogus"}"#.data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for unknown type")
+        }
+    }
+
+    func testDecodeMalformedJSONIsProtocolError() throws {
+        let json = "not json".data(using: .utf8)!
+
+        switch decodeResponse(json) {
+        case .protocolError:
+            break
+        default:
+            XCTFail("Expected .protocolError for malformed JSON")
+        }
+    }
+
+    // MARK: - Exit code clamping (predictable, no bit masking)
+
+    func testClampExitCodeZero() {
+        XCTAssertEqual(clampExitCode(0), 0)
+    }
+
+    func testClampExitCodeNormal() {
+        XCTAssertEqual(clampExitCode(42), 42)
+    }
+
+    func testClampExitCodeNormalUnchangedInRange() {
+        for c in Int32(0)...Int32(255) {
+            XCTAssertEqual(clampExitCode(c), c, "exit \(c) should map to itself")
+        }
+    }
+
+    func testClampExitCode256MapsTo125() {
+        // Out-of-range host status maps to 125, not bit masking.
+        XCTAssertEqual(clampExitCode(256), 125)
+    }
+
+    func testClampExitCodeNegativeMapsTo125() {
+        XCTAssertEqual(clampExitCode(-1), 125)
+        XCTAssertEqual(clampExitCode(-2), 125)
+    }
+
+    func testClampExitCode255() {
+        XCTAssertEqual(clampExitCode(255), 255)
+    }
+
+    func testClampExitCodeLargeMapsTo125() {
+        XCTAssertEqual(clampExitCode(1000), 125)
+    }
+
+    func testTerminalNewlineNormalizerConvertsBareLineFeeds() {
+        var normalizer = TerminalNewlineNormalizer()
+        let output = normalizer.normalize(Data("one\ntwo\n".utf8))
+        XCTAssertEqual(output, Data("one\r\ntwo\r\n".utf8))
+    }
+
+    func testTerminalNewlineNormalizerPreservesCarriageReturnsAcrossChunks() {
+        var normalizer = TerminalNewlineNormalizer()
+        let first = normalizer.normalize(Data("one\r".utf8))
+        let second = normalizer.normalize(Data("\ntwo\r\n".utf8))
+        XCTAssertEqual(first + second, Data("one\r\ntwo\r\n".utf8))
+    }
+}
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift b/macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift
new file mode 100644
index 0000000..d264e80
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift
@@ -0,0 +1,101 @@
+@testable import ghost_container
+import XCTest
+
+final class VsockDialTests: XCTestCase {
+
+    /// The Darwin sockaddr_vm layout must be exactly 12 bytes (no padding/zero
+    /// field): svm_len(1) + svm_family(1) + svm_reserved1(2) + svm_port(4) + svm_cid(4).
+    func testSockaddrVmSizeIs12Bytes() {
+        XCTAssertEqual(MemoryLayout.size, 12)
+        XCTAssertEqual(MemoryLayout.stride, 12)
+    }
+
+    func testSockaddrVmFieldsInitialized() {
+        let addr = ghost_container.sockaddr_vm(port: 5004, cid: 2)
+        XCTAssertEqual(addr.svm_len, 12)
+        XCTAssertEqual(addr.svm_family, UInt8(ghost_container.AF_VSOCK))
+        XCTAssertEqual(addr.svm_reserved1, 0)
+        XCTAssertEqual(addr.svm_port, 5004)
+        XCTAssertEqual(addr.svm_cid, 2)
+    }
+
+    // MARK: - writeAll / writeBytes / write helpers return Bool
+
+    private func makeSocketPair() throws -> (Int32, Int32) {
+        var fds = [Int32](repeating: -1, count: 2)
+        let rc = socketpair(AF_UNIX, SOCK_STREAM, 0, &fds)
+        XCTAssertEqual(rc, 0, "socketpair failed: errno=\(errno)")
+        guard rc == 0 else {
+            throw LineReaderError.ioError(errno: errno, op: "socketpair")
+        }
+        return (fds[0], fds[1])
+    }
+
+    func testWriteAllReturnsTrueOnSuccess() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+        XCTAssertTrue(writeAll(fd: fdA, Data("hello".utf8)))
+    }
+
+    func testWriteAllReturnsTrueForEmptyData() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+        XCTAssertTrue(writeAll(fd: fdA, Data()))
+    }
+
+    func testWriteAllReturnsFalseOnClosedFd() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        Darwin.close(fdA)
+        Darwin.close(fdB)
+        // Writing to a closed fd fails.
+        XCTAssertFalse(writeAll(fd: fdA, Data("nope".utf8)))
+    }
+
+    func testWriteBytesReturnsBool() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+        XCTAssertTrue(writeBytes(fd: fdA, [0x68, 0x69]))
+    }
+
+    func testForwardStdinHalfClosesOnlyWriteSide() throws {
+        let (fdA, fdB) = try makeSocketPair()
+        defer {
+            Darwin.close(fdA)
+            Darwin.close(fdB)
+        }
+        let input = Pipe()
+        try input.fileHandleForWriting.write(contentsOf: Data("hello".utf8))
+        try input.fileHandleForWriting.close()
+
+        let writer = ContainerInputWriter(fd: fdA)
+        forwardStdin(
+            inputFD: input.fileHandleForReading.fileDescriptor,
+            writer: writer,
+            keepWriteSideOpen: false
+        )
+
+        let reader = LineReader(fd: fdB, maxLineBytes: 64 * 1024)
+        let stdinLine = try XCTUnwrap(reader.readLine())
+        let closeLine = try XCTUnwrap(reader.readLine())
+        let stdinFrame = try JSONDecoder().decode(HostContainerInputFrame.self, from: stdinLine)
+        let closeFrame = try JSONDecoder().decode(HostContainerInputFrame.self, from: closeLine)
+        XCTAssertEqual(stdinFrame.type, .stdin)
+        XCTAssertEqual(Data(base64Encoded: try XCTUnwrap(stdinFrame.data)), Data("hello".utf8))
+        XCTAssertEqual(closeFrame.type, .stdinClose)
+        XCTAssertNil(try reader.readLine())
+
+        XCTAssertTrue(writeAll(fd: fdB, Data("response".utf8)))
+        var responseBuffer = [UInt8](repeating: 0, count: 8)
+        XCTAssertEqual(Darwin.read(fdA, &responseBuffer, responseBuffer.count), 8)
+        XCTAssertEqual(Data(responseBuffer), Data("response".utf8))
+    }
+}
diff --git a/macOS/GhostTools/Tests/GhostToolsTests/GuestFilesystemRouterTests.swift b/macOS/GhostTools/Tests/GhostToolsTests/GuestFilesystemRouterTests.swift
new file mode 100644
index 0000000..67d29a9
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostToolsTests/GuestFilesystemRouterTests.swift
@@ -0,0 +1,104 @@
+import Foundation
+import XCTest
+@testable import GhostTools
+
+final class GuestFilesystemRouterTests: XCTestCase {
+    private var directory: URL!
+
+    override func setUpWithError() throws {
+        directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghosttools-fs-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+        try Data("abcdef".utf8).write(to: directory.appendingPathComponent("sample.txt"))
+        try FileManager.default.createDirectory(
+            at: directory.appendingPathComponent("folder", isDirectory: true),
+            withIntermediateDirectories: true
+        )
+        try FileManager.default.createSymbolicLink(
+            atPath: directory.appendingPathComponent("sample-link").path,
+            withDestinationPath: "sample.txt"
+        )
+    }
+
+    override func tearDownWithError() throws {
+        try? FileManager.default.removeItem(at: directory)
+    }
+
+    func testMetadataReturnsRegularFileAttributes() throws {
+        let response = try route(
+            path: "/api/v1/fs/metadata", query: [
+                URLQueryItem(name: "path", value: directory.appendingPathComponent("sample.txt").path),
+            ]
+        )
+
+        XCTAssertEqual(response.status, .ok)
+        let metadata = try JSONDecoder().decode(GuestFileMetadata.self, from: responseData(response))
+        XCTAssertEqual(metadata.name, "sample.txt")
+        XCTAssertEqual(metadata.type, .file)
+        XCTAssertEqual(metadata.size, 6)
+        XCTAssertNotEqual(metadata.inode, 0)
+    }
+
+    func testListReturnsTypedEntries() throws {
+        let response = try route(
+            path: "/api/v1/fs/list", query: [URLQueryItem(name: "path", value: directory.path)]
+        )
+
+        XCTAssertEqual(response.status, .ok)
+        let listing = try JSONDecoder().decode(GuestDirectoryMetadata.self, from: responseData(response))
+        XCTAssertEqual(listing.entries.map(\.name), ["folder", "sample-link", "sample.txt"])
+        XCTAssertEqual(listing.entries.map(\.type), [.directory, .symbolicLink, .file])
+    }
+
+    func testRangeReadReturnsRequestedBytes() throws {
+        let response = try route(
+            path: "/api/v1/fs/read", query: [
+                URLQueryItem(name: "path", value: directory.appendingPathComponent("sample.txt").path),
+                URLQueryItem(name: "offset", value: "2"),
+                URLQueryItem(name: "length", value: "3"),
+            ]
+        )
+
+        XCTAssertEqual(response.status, .ok)
+        XCTAssertEqual(String(data: try responseData(response), encoding: .utf8), "cde")
+    }
+
+    func testRangeReadRejectsMoreThanOneMiB() throws {
+        let response = try route(
+            path: "/api/v1/fs/read", query: [
+                URLQueryItem(name: "path", value: directory.appendingPathComponent("sample.txt").path),
+                URLQueryItem(name: "offset", value: "0"),
+                URLQueryItem(name: "length", value: String(1024 * 1024 + 1)),
+            ]
+        )
+
+        XCTAssertEqual(response.status, .badRequest)
+    }
+
+    func testReadSymbolicLinkReturnsTarget() throws {
+        let response = try route(
+            path: "/api/v1/fs/readlink", query: [
+                URLQueryItem(name: "path", value: directory.appendingPathComponent("sample-link").path),
+            ]
+        )
+
+        XCTAssertEqual(response.status, .ok)
+        XCTAssertEqual(String(data: try responseData(response), encoding: .utf8), "sample.txt")
+    }
+
+    private func route(path: String, query: [URLQueryItem]) throws -> HTTPResponse {
+        var components = URLComponents()
+        components.path = path
+        components.queryItems = query
+        let request = HTTPRequest(method: .GET, path: components.string!, headers: [:])
+        let body = BodyReader(fd: -1, framing: .knownLength(0), prelude: Data())
+        return try Router().route(request: request, body: body)
+    }
+
+    private func responseData(_ response: HTTPResponse) throws -> Data {
+        guard case .bytes(let data) = response.body else {
+            throw XCTSkip("Expected an in-memory response body")
+        }
+        return data
+    }
+}
diff --git a/macOS/GhostVM/Services/ContainerBridgeService.swift b/macOS/GhostVM/Services/ContainerBridgeService.swift
new file mode 100644
index 0000000..deae0fa
--- /dev/null
+++ b/macOS/GhostVM/Services/ContainerBridgeService.swift
@@ -0,0 +1,584 @@
+import Foundation
+import Virtualization
+import GhostVMKit
+
+/// Host-side listener for guest-initiated container control connections.
+///
+/// Registered on the VM's VZVirtioSocketDevice. When a guest process connects to
+/// ContainerBridgeConstants.port, the service accepts the connection, reads one
+/// versioned NDJSON request, submits it to the runtime XPC service via
+/// ContainerRunner, and streams NDJSON response frames back. One request per
+/// connection; at most `maxConcurrentConnections` simultaneous connections.
+final class ContainerBridgeService: @unchecked Sendable {
+    /// MVP invariant: one fetch/run chain per VM keeps Containerization's
+    /// process-local image-store locking from becoming a cross-process race.
+    static let maxConcurrentConnections = 1
+
+    /// SO_RCVTIMEO/SO_SNDTIMEO applied to accepted sockets: bounds slowloris
+    /// request reads and frame writes blocked on a stalled guest. This is not
+    /// a cap on total container runtime.
+    private static let socketIOTimeoutSeconds = 15
+
+    private let vm: VZVirtualMachine
+    private let vmQueue: DispatchQueue
+    private let vmHash: String
+    private let port: UInt32
+    private let fileSystemBridge: GuestFileSystemBridgeService?
+    private let sharedNetwork: SharedVmnetNetwork
+    private let runtimeClient: ContainerRuntimeXPCClient
+
+    private let stateLock = NSLock()
+    private var listener: VZVirtioSocketListener?
+    private var listenerDelegate: BridgeListenerDelegate?
+    private var isRunning = false
+    private var activeCount = 0
+    private var connections: [UUID: VZVirtioSocketConnection] = [:]
+    private var writers: [UUID: VSockFrameWriter] = [:]
+    private var runners: [UUID: ContainerRunner] = [:]
+    private var tasks: [UUID: Task] = [:]
+
+    /// - Parameters:
+    ///   - vm: The running virtual machine (accessed only on `vmQueue`).
+    ///   - vmQueue: The serial queue the VZVirtualMachine was created with.
+    ///   - vmHash: Stable per-VM identifier used in generated container names.
+    ///   - port: Vsock port to listen on.
+    init(
+        vm: VZVirtualMachine,
+        vmQueue: DispatchQueue,
+        vmHash: String,
+        sharedNetwork: SharedVmnetNetwork,
+        fileSystemBridge: GuestFileSystemBridgeService? = nil,
+        port: UInt32 = ContainerBridgeConstants.port
+    ) {
+        self.vm = vm
+        self.vmQueue = vmQueue
+        self.vmHash = vmHash
+        self.port = port
+        self.fileSystemBridge = fileSystemBridge
+        self.sharedNetwork = sharedNetwork
+        self.runtimeClient = ContainerRuntimeXPCClient()
+    }
+
+    /// Registers the vsock listener on vmQueue. Safe to call once per VM run.
+    public func start() {
+        stateLock.lock()
+        guard !isRunning else {
+            stateLock.unlock()
+            return
+        }
+        isRunning = true
+        let delegate = BridgeListenerDelegate { [weak self] connection in
+            self?.accept(connection) ?? false
+        }
+        let listener = VZVirtioSocketListener()
+        listener.delegate = delegate
+        // VZ does not retain the listener and its delegate property is weak,
+        // so the service must retain both for the listener to keep firing.
+        self.listener = listener
+        self.listenerDelegate = delegate
+        stateLock.unlock()
+
+        // Listen even without the CLI so guests get a structured error frame
+        // (executableNotFound) instead of a dead port.
+        if !ContainerRunner.isExecutableAvailable {
+            NSLog("ContainerBridge: %@ is unavailable on this host; bridge will still listen and return structured errors to guest requests", ContainerRunner.executablePath)
+        }
+
+        vmQueue.async {
+            guard let socketDevice = self.vm.socketDevices.first as? VZVirtioSocketDevice else {
+                NSLog("ContainerBridge: no VZVirtioSocketDevice on this VM; listener not registered")
+                return
+            }
+            socketDevice.setSocketListener(listener, forPort: self.port)
+            NSLog("ContainerBridge: listening for guest container requests on vsock port %u (vm=%@)", self.port, self.vmHash)
+        }
+    }
+
+    /// Idempotent: atomically flips to not-running and snapshots all
+    /// per-connection state under one lock, then unwinds in order — cancel
+    /// tasks, shut down frame writers (wakes blocked reads/writes), request
+    /// runner termination. Each connection task closes its VZ connection only
+    /// after its blocking input relay has observed shutdown and returned.
+    public func stop() {
+        stateLock.lock()
+        guard isRunning else {
+            stateLock.unlock()
+            return
+        }
+        isRunning = false
+        let registeredListener = self.listener
+        let registeredDelegate = self.listenerDelegate
+        self.listener = nil
+        self.listenerDelegate = nil
+        let openTasks = Array(tasks.values)
+        let openWriters = Array(writers.values)
+        let activeRunners = Array(runners.values)
+        let openConnections = connections
+        stateLock.unlock()
+
+        vmQueue.async {
+            if let socketDevice = self.vm.socketDevices.first as? VZVirtioSocketDevice {
+                socketDevice.removeSocketListener(forPort: self.port)
+            }
+            // VZ does not retain the listener and its delegate is weak. Keep both
+            // alive until deregistration has completed on the VM queue.
+            withExtendedLifetime((registeredListener, registeredDelegate)) {}
+        }
+        for task in openTasks {
+            task.cancel()
+        }
+        for writer in openWriters {
+            writer.shutdown()
+        }
+        for runner in activeRunners {
+            runner.terminate()
+        }
+        runtimeClient.invalidate()
+        NSLog("ContainerBridge: stopped (cancelled %d task(s), terminated %d run(s), signalled %d connection(s))", openTasks.count, activeRunners.count, openConnections.count)
+    }
+
+    /// Closes the connection exactly once: the `connections` dictionary entry
+    /// is the ownership token — whichever path (stop or per-connection
+    /// cleanup) removes it under the lock performs the close.
+    private func closeConnectionOnce(id: UUID, connection: VZVirtioSocketConnection) {
+        stateLock.lock()
+        let owned = connections.removeValue(forKey: id) != nil
+        stateLock.unlock()
+        if owned {
+            connection.close()
+        }
+    }
+
+    // MARK: - Accept (called on vmQueue by VZ; must never block)
+
+    private func accept(_ connection: VZVirtioSocketConnection) -> Bool {
+        Self.applySocketTimeouts(fd: connection.fileDescriptor)
+        let writer = VSockFrameWriter(fd: connection.fileDescriptor)
+
+        stateLock.lock()
+        guard isRunning, activeCount < Self.maxConcurrentConnections else {
+            let running = isRunning
+            let count = activeCount
+            stateLock.unlock()
+            NSLog("ContainerBridge: rejecting connection (isRunning=%d, active=%d/%d)", running ? 1 : 0, count, Self.maxConcurrentConnections)
+            return false
+        }
+        activeCount += 1
+        let id = UUID()
+        connections[id] = connection
+        writers[id] = writer
+        // The task handle is registered before the lock is released and
+        // per-connection cleanup also takes stateLock, so an early-finishing
+        // task can never leave a stale entry behind.
+        let task = Task.detached { [self] in
+            await handleConnection(id: id, connection: connection, writer: writer)
+        }
+        tasks[id] = task
+        stateLock.unlock()
+
+        // The task retains `connection` for its whole IO lifetime; dropping it
+        // would close the fd (VZ owns the descriptor).
+        return true
+    }
+
+    /// Bounds request reads and blocked frame writes without capping total
+    /// container runtime. Failure to set an option is logged, never fatal.
+    private static func applySocketTimeouts(fd: Int32) {
+        var timeout = timeval(tv_sec: socketIOTimeoutSeconds, tv_usec: 0)
+        let length = socklen_t(MemoryLayout.size)
+        if setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, length) != 0 {
+            NSLog("ContainerBridge: setsockopt(SO_RCVTIMEO) failed (errno=%d); continuing without a receive timeout", errno)
+        }
+        if setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &timeout, length) != 0 {
+            NSLog("ContainerBridge: setsockopt(SO_SNDTIMEO) failed (errno=%d); continuing without a send timeout", errno)
+        }
+    }
+
+    // MARK: - Connection handling
+
+    private func handleConnection(id: UUID, connection: VZVirtioSocketConnection, writer: VSockFrameWriter) async {
+        // ownsFD: false — the VZ connection is the sole fd owner, so the
+        // channel is never closed (that would double-close the descriptor).
+        let channel = BlockingVSockChannel(fd: connection.fileDescriptor, ownsFD: false)
+        defer {
+            // Shut down raw writers BEFORE VZ closes the fd, so a stale write
+            // can never land on a reused descriptor.
+            writer.shutdown()
+            closeConnectionOnce(id: id, connection: connection)
+            stateLock.lock()
+            writers[id] = nil
+            runners[id] = nil
+            tasks[id] = nil
+            activeCount -= 1
+            stateLock.unlock()
+        }
+
+        var mountedVolumes: [GuestVolumeMount] = []
+        var responseVersion = ContainerBridgeConstants.protocolVersion
+        let inputRelay = InputRelayTracker()
+        do {
+            let (line, initialInput) = try await readRequestLine(channel: channel)
+            let request = try ContainerRunRequest.decode(line: line)
+            if (ContainerBridgeConstants.minimumProtocolVersion...ContainerBridgeConstants.protocolVersion).contains(request.version) {
+                responseVersion = request.version
+            }
+            let run = try ContainerRunPolicy.validate(request)
+
+            mountedVolumes = try await prepareVolumes(run.volumes)
+            var arguments = run.containerArguments(vmHash: vmHash, uniqueSuffix: Self.makeNameSuffix())
+            if let separator = arguments.firstIndex(of: "--") {
+                for mount in mountedVolumes {
+                    arguments.insert(
+                        contentsOf: ["--mount", mount.mountPoint.path, mount.destination, mount.readOnly ? "ro" : "rw"],
+                        at: separator
+                    )
+                }
+            }
+            let runner = ContainerRunner(
+                runtimeIdentifier: vmHash,
+                image: run.image,
+                arguments: arguments,
+                runtimeClient: runtimeClient,
+                sharedNetwork: sharedNetwork
+            )
+
+            // Re-check isRunning atomically with registration: stop()
+            // snapshots runners, so a runner registered after stop() began
+            // would never be terminated by it.
+            stateLock.lock()
+            let stillRunning = isRunning
+            if stillRunning {
+                runners[id] = runner
+            }
+            stateLock.unlock()
+            guard stillRunning else {
+                runner.terminate()
+                throw ContainerProtocolError.connectionClosed
+            }
+
+            NSLog("ContainerBridge: starting XPC runtime run (image=%@, %d command arg(s)) for connection %@", run.image, run.command.count, id.uuidString)
+
+            let exitCode: Int32 = try await withCheckedThrowingContinuation { continuation in
+                do {
+                    try runner.start(
+                        onReady: {
+                            Self.clearSocketReceiveTimeout(fd: connection.fileDescriptor)
+                            let task = Task.detached {
+                                if run.protocolVersion >= 2 {
+                                    await Self.relayFramedInput(
+                                        channel: channel,
+                                        initialInput: initialInput,
+                                        run: run,
+                                        runner: runner,
+                                        writer: writer
+                                    )
+                                } else if run.attachStdin {
+                                    if !initialInput.isEmpty, !runner.writeStdin(initialInput) {
+                                        runner.closeStdin()
+                                        return
+                                    }
+                                    do {
+                                        while let chunk = try await channel.read(maxBytes: 32 * 1024) {
+                                            guard runner.writeStdin(chunk) else { break }
+                                        }
+                                    } catch {
+                                        // Closing the connection during normal teardown wakes this read.
+                                    }
+                                    runner.closeStdin()
+                                } else {
+                                    runner.closeStdin()
+                                }
+                            }
+                            inputRelay.set(task)
+                        },
+                        onOutput: { stream, data in
+                            let response = (stream == .stdout)
+                                ? ContainerResponse.stdout(data, version: run.protocolVersion)
+                                : ContainerResponse.stderr(data, version: run.protocolVersion)
+                            guard let frame = try? response.encodeLine() else { return }
+                            if !writer.writeFrame(frame) {
+                                // Guest went away; don't leave a container running.
+                                runner.terminate()
+                            }
+                        },
+                        onExit: { code in
+                            continuation.resume(returning: code)
+                        }
+                    )
+                } catch {
+                    continuation.resume(throwing: error)
+                }
+            }
+
+            // Emitted only after both pipes drained (see ContainerRunner), so
+            // the exit frame is always the last frame on the connection.
+            try writer.writeFrameOrThrow(ContainerResponse.exit(exitCode, version: run.protocolVersion).encodeLine())
+            NSLog("ContainerBridge: run finished (exit=%d) for connection %@", exitCode, id.uuidString)
+            await releaseVolumes(&mountedVolumes)
+        } catch {
+            await releaseVolumes(&mountedVolumes)
+            let message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+            if let frame = try? ContainerResponse.error(message, version: responseVersion).encodeLine() {
+                writer.writeFrame(frame)
+            }
+            NSLog("ContainerBridge: request failed: %@", message)
+        }
+        writer.shutdown()
+        if let task = inputRelay.take() {
+            await task.value
+        }
+    }
+
+    private static func relayFramedInput(
+        channel: BlockingVSockChannel,
+        initialInput: Data,
+        run: ValidatedContainerRun,
+        runner: ContainerRunner,
+        writer: VSockFrameWriter
+    ) async {
+        var buffer = initialInput
+        var stdinClosed = !run.attachStdin
+        if stdinClosed {
+            runner.closeStdin()
+        }
+
+        do {
+            while true {
+                while let newline = buffer.firstIndex(of: 0x0A) {
+                    guard newline - buffer.startIndex <= ContainerBridgeConstants.maxRequestLineBytes else {
+                        throw ContainerProtocolError.requestTooLarge(limit: ContainerBridgeConstants.maxRequestLineBytes)
+                    }
+                    let line = Data(buffer[buffer.startIndex.. 0,
+                              let rows = frame.rows, rows > 0 else {
+                            throw ContainerProtocolError.malformedInputFrame("invalid resize frame")
+                        }
+                        runner.resize(columns: columns, rows: rows)
+                    }
+                }
+                guard buffer.count <= ContainerBridgeConstants.maxRequestLineBytes else {
+                    throw ContainerProtocolError.requestTooLarge(limit: ContainerBridgeConstants.maxRequestLineBytes)
+                }
+                guard let chunk = try await channel.read(maxBytes: 32 * 1024) else {
+                    guard buffer.isEmpty else {
+                        throw ContainerProtocolError.malformedInputFrame("connection closed during input frame")
+                    }
+                    break
+                }
+                buffer.append(chunk)
+            }
+        } catch {
+            let message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+            if let frame = try? ContainerResponse.error(message, version: run.protocolVersion).encodeLine() {
+                writer.writeFrame(frame)
+            }
+            runner.terminate()
+        }
+        runner.closeStdin()
+    }
+
+    private func prepareVolumes(_ volumes: [ContainerRunVolume]) async throws -> [GuestVolumeMount] {
+        guard !volumes.isEmpty else { return [] }
+        guard let fileSystemBridge else { throw GuestVolumeMount.MountError.bridgeUnavailable }
+
+        var mounted: [GuestVolumeMount] = []
+        do {
+            for volume in volumes {
+                let registered = try await MainActor.run {
+                    try fileSystemBridge.registerExport(guestPath: volume.guestPath, readOnly: volume.readOnly)
+                }
+                do {
+                    mounted.append(try GuestVolumeMount.mount(
+                        registeredExport: registered,
+                        destination: volume.destination,
+                        readOnly: volume.readOnly,
+                        rootURL: ContainerRunner.runtimeRootURL
+                            .appendingPathComponent(vmHash, isDirectory: true)
+                            .appendingPathComponent("mounts", isDirectory: true)
+                    ))
+                } catch {
+                    await MainActor.run { fileSystemBridge.unregisterExport(id: registered.id) }
+                    throw error
+                }
+            }
+            return mounted
+        } catch {
+            await releaseVolumes(&mounted)
+            throw error
+        }
+    }
+
+    private func releaseVolumes(_ volumes: inout [GuestVolumeMount]) async {
+        guard !volumes.isEmpty else { return }
+        let mounted = volumes
+        volumes.removeAll()
+        for mount in mounted.reversed() {
+            mount.unmount()
+        }
+        if let fileSystemBridge {
+            await MainActor.run {
+                for mount in mounted {
+                    fileSystemBridge.unregisterExport(id: mount.exportID)
+                }
+            }
+        }
+    }
+
+    /// Reads a single NDJSON request line, enforcing the size cap.
+    private func readRequestLine(channel: BlockingVSockChannel) async throws -> (line: Data, initialInput: Data) {
+        var buffer = Data()
+        while true {
+            guard let chunk = try await channel.read(maxBytes: 4096) else {
+                throw ContainerProtocolError.emptyRequest
+            }
+            buffer.append(chunk)
+            if let newline = buffer.firstIndex(of: 0x0A) {
+                // The cap applies even when the newline arrives beyond the limit.
+                guard newline - buffer.startIndex <= ContainerBridgeConstants.maxRequestLineBytes else {
+                    throw ContainerProtocolError.requestTooLarge(limit: ContainerBridgeConstants.maxRequestLineBytes)
+                }
+                let inputStart = buffer.index(after: newline)
+                return (
+                    Data(buffer[buffer.startIndex.. ContainerBridgeConstants.maxRequestLineBytes {
+                throw ContainerProtocolError.requestTooLarge(limit: ContainerBridgeConstants.maxRequestLineBytes)
+            }
+        }
+    }
+
+    /// The request header has a short timeout; attached stdin may remain idle
+    /// for the full lifetime of an interactive process.
+    private static func clearSocketReceiveTimeout(fd: Int32) {
+        var timeout = timeval(tv_sec: 0, tv_usec: 0)
+        let length = socklen_t(MemoryLayout.size)
+        if setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, length) != 0 {
+            NSLog("ContainerBridge: failed to clear stdin receive timeout (errno=%d)", errno)
+        }
+    }
+
+    private static func makeNameSuffix() -> String {
+        String(UUID().uuidString.prefix(8)).lowercased()
+    }
+}
+
+private final class InputRelayTracker: @unchecked Sendable {
+    private let lock = NSLock()
+    private var task: Task?
+
+    func set(_ task: Task) {
+        lock.withLock { self.task = task }
+    }
+
+    func take() -> Task? {
+        lock.withLock {
+            let task = self.task
+            self.task = nil
+            return task
+        }
+    }
+}
+
+// MARK: - VZ listener delegate adapter
+
+/// VZVirtioSocketListener.delegate is weak and its callback arrives on the VM's
+/// serial queue, so this adapter stays a small non-isolated forwarder.
+private final class BridgeListenerDelegate: NSObject, VZVirtioSocketListenerDelegate {
+    private let onConnection: (VZVirtioSocketConnection) -> Bool
+
+    init(onConnection: @escaping (VZVirtioSocketConnection) -> Bool) {
+        self.onConnection = onConnection
+    }
+
+    func listener(_ listener: VZVirtioSocketListener, shouldAcceptNewConnection connection: VZVirtioSocketConnection, from socketDevice: VZVirtioSocketDevice) -> Bool {
+        onConnection(connection)
+    }
+}
+
+// MARK: - Frame writer
+
+/// Serializes NDJSON frame writes from concurrent stdout/stderr/exit producers
+/// onto one dedicated queue using a blocking Darwin write loop, so frames can
+/// never interleave. Callers are private runner/connection threads — never
+/// vmQueue or the main thread.
+private final class VSockFrameWriter: @unchecked Sendable {
+    private let fd: Int32
+    private let queue = DispatchQueue(label: "org.ghostvm.containerbridge.writer")
+    private let closedLock = NSLock()
+    private var isClosed = false // closedLock-confined
+
+    init(fd: Int32) {
+        self.fd = fd
+    }
+
+    /// Writes one complete frame atomically. Returns false if the fd is dead
+    /// (EPIPE/EBADF etc. — SIGPIPE is ignored by the host apps).
+    @discardableResult
+    func writeFrame(_ data: Data) -> Bool {
+        queue.sync {
+            closedLock.lock()
+            let closed = isClosed
+            closedLock.unlock()
+            if closed { return false }
+
+            var offset = 0
+            while offset < data.count {
+                let written = data.withUnsafeBytes { ptr in
+                    Darwin.write(fd, ptr.baseAddress! + offset, data.count - offset)
+                }
+                if written > 0 {
+                    offset += written
+                    continue
+                }
+                if written < 0, errno == EINTR { continue }
+                closedLock.lock()
+                isClosed = true
+                closedLock.unlock()
+                return false
+            }
+            return true
+        }
+    }
+
+    func writeFrameOrThrow(_ data: Data) throws {
+        guard writeFrame(data) else {
+            throw ContainerProtocolError.connectionClosed
+        }
+    }
+
+    /// Marks the writer closed and shuts the socket down both ways, waking any
+    /// thread blocked in read/write so cleanup can proceed. Never closes the
+    /// fd (VZ owns it) and never touches `queue`, so it cannot deadlock behind
+    /// a blocked write. Safe to call multiple times.
+    func shutdown() {
+        closedLock.lock()
+        isClosed = true
+        closedLock.unlock()
+        // shutdown(2) is idempotent enough for cleanup and must run even if a
+        // prior write marked the writer closed, because the read side may still
+        // be blocked on the same socket.
+        Darwin.shutdown(fd, SHUT_RDWR)
+    }
+}
diff --git a/macOS/GhostVM/Services/ContainerRunner.swift b/macOS/GhostVM/Services/ContainerRunner.swift
new file mode 100644
index 0000000..640d44b
--- /dev/null
+++ b/macOS/GhostVM/Services/ContainerRunner.swift
@@ -0,0 +1,406 @@
+import Foundation
+import GhostVMKit
+
+/// Serializes a short-lived image fetch helper, then submits one run to the
+/// helper-scoped container runtime XPC service and bridges its standard streams.
+///
+/// Reader/waiter threads use blocking Darwin IO on pipe fds (kqueue-safe regular
+/// pipes); callbacks therefore arrive on private threads, never on vmQueue or main.
+public final class ContainerRunner: @unchecked Sendable {
+    public enum Stream: String, Sendable {
+        case stdout
+        case stderr
+    }
+
+    public enum RunnerError: Error, LocalizedError, Equatable {
+        case executableNotFound(String)
+        case launchFailed(String)
+        case terminatedBeforeStart
+
+        public var errorDescription: String? {
+            switch self {
+            case .executableNotFound(let path):
+                return "Bundled container helper not found at \(path)."
+            case .launchFailed(let detail):
+                return "Failed to launch container helper: \(detail)"
+            case .terminatedBeforeStart:
+                return "Container run was terminated before the process started."
+            }
+        }
+    }
+
+    private static let fetchQueue = DispatchQueue(label: "org.ghostvm.container.image-fetch", qos: .userInitiated)
+
+    /// Bundled helpers. Fixed by policy; never taken from a guest request.
+    public static var runtimeExecutablePath: String {
+        Bundle.main.bundleURL
+            .appendingPathComponent("Contents/XPCServices/ghostvm-container-runtime.xpc/Contents/MacOS/ghostvm-container-runtime")
+            .path
+    }
+
+    public static var imageFetchExecutablePath: String {
+        Bundle.main.bundleURL
+            .appendingPathComponent("Contents/Helpers/ghostvm-image-fetch")
+            .path
+    }
+
+    public static var executablePath: String { runtimeExecutablePath }
+
+    public static var runtimeRootURL: URL {
+        FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0]
+            .appendingPathComponent("GhostVM/container-runtime", isDirectory: true)
+    }
+
+    public static var kernelURL: URL {
+        runtimeRootURL.appendingPathComponent("kernel/vmlinux")
+    }
+
+    private let image: String
+    private let arguments: [String]
+    private let rootURL: URL
+    private let runtimeKernelURL: URL
+    private let runtimeClient: ContainerRuntimeXPCClient
+    private let sharedNetwork: SharedVmnetNetwork
+    private let lock = NSLock()
+    private let stdinQueue = DispatchQueue(label: "org.ghostvm.container.stdin", qos: .userInitiated)
+    private var process: Process?
+    private var runtimeRunIdentifier: String?
+    private var networkLease: SharedVmnetEndpointLease?
+    private var stdinWriteHandle: FileHandle?
+    private var terminateRequested = false
+
+    init(
+        runtimeIdentifier: String,
+        image: String,
+        arguments: [String],
+        runtimeClient: ContainerRuntimeXPCClient,
+        sharedNetwork: SharedVmnetNetwork
+    ) {
+        self.image = image
+        self.arguments = arguments
+        self.rootURL = Self.runtimeRootURL.appendingPathComponent(runtimeIdentifier, isDirectory: true)
+        self.runtimeKernelURL = rootURL.appendingPathComponent("kernel/vmlinux")
+        self.runtimeClient = runtimeClient
+        self.sharedNetwork = sharedNetwork
+    }
+
+    /// Whether both bundled container helpers are present and executable.
+    public static var isExecutableAvailable: Bool {
+        FileManager.default.isExecutableFile(atPath: runtimeExecutablePath)
+            && FileManager.default.isExecutableFile(atPath: imageFetchExecutablePath)
+    }
+
+    /// Launches the process and returns immediately.
+    ///
+    /// - Parameters:
+    ///   - onOutput: Called from private reader threads, in pipe order, once per
+    ///     read chunk until the pipe reaches EOF.
+    ///   - onExit: Called exactly once, only after the process exited AND both
+    ///     pipes were drained to EOF, so no output is lost to a termination race.
+    ///     Exit codes of signal-killed processes are reported as 128+signal.
+    public func start(
+        onReady: @escaping () -> Void,
+        onOutput: @escaping (Stream, Data) -> Void,
+        onExit: @escaping (Int32) -> Void
+    ) throws {
+        guard FileManager.default.isExecutableFile(atPath: Self.imageFetchExecutablePath) else {
+            throw RunnerError.executableNotFound(Self.imageFetchExecutablePath)
+        }
+        guard FileManager.default.isExecutableFile(atPath: Self.runtimeExecutablePath) else {
+            throw RunnerError.executableNotFound(Self.runtimeExecutablePath)
+        }
+
+        // terminate() before start() is remembered: do not launch at all.
+        lock.lock()
+        let cancelledBeforeLaunch = terminateRequested
+        lock.unlock()
+        guard !cancelledBeforeLaunch else {
+            throw RunnerError.terminatedBeforeStart
+        }
+
+        Self.fetchQueue.async { [self] in
+            fetchThenRun(onReady: onReady, onOutput: onOutput, onExit: onExit)
+        }
+    }
+
+    /// Writes one raw stdin chunk to the running container worker.
+    @discardableResult
+    public func writeStdin(_ data: Data) -> Bool {
+        if data.isEmpty { return true }
+        return stdinQueue.sync {
+            lock.lock()
+            let handle = stdinWriteHandle
+            lock.unlock()
+            guard let handle else { return false }
+            let fd = handle.fileDescriptor
+            return data.withUnsafeBytes { bytes in
+                guard let base = bytes.baseAddress else { return true }
+                var offset = 0
+                while offset < data.count {
+                    let written = Darwin.write(fd, base.advanced(by: offset), data.count - offset)
+                    if written > 0 {
+                        offset += written
+                        continue
+                    }
+                    if written < 0, errno == EINTR { continue }
+                    return false
+                }
+                return true
+            }
+        }
+    }
+
+    /// Half-closes the worker's stdin socket, which Containerization forwards as EOF.
+    public func closeStdin() {
+        lock.lock()
+        let handle = stdinWriteHandle
+        stdinWriteHandle = nil
+        lock.unlock()
+        guard let handle else { return }
+        // A socket half-close wakes a blocked writer without closing/reusing its
+        // fd. The serialized close runs after that writer has returned.
+        _ = Darwin.shutdown(handle.fileDescriptor, SHUT_WR)
+        stdinQueue.async {
+            try? handle.close()
+        }
+    }
+
+    public func resize(columns: UInt16, rows: UInt16) {
+        lock.lock()
+        let runIdentifier = runtimeRunIdentifier
+        lock.unlock()
+        if let runIdentifier {
+            runtimeClient.resize(runIdentifier: runIdentifier, columns: columns, rows: rows)
+        }
+    }
+
+    private func fetchThenRun(
+        onReady: @escaping () -> Void,
+        onOutput: @escaping (Stream, Data) -> Void,
+        onExit: @escaping (Int32) -> Void
+    ) {
+        lock.lock()
+        let cancelled = terminateRequested
+        lock.unlock()
+        guard !cancelled else {
+            onExit(143)
+            return
+        }
+
+        let fetch = Process()
+        fetch.executableURL = URL(fileURLWithPath: Self.imageFetchExecutablePath)
+        fetch.arguments = [
+            "fetch",
+            "--root", rootURL.path,
+            "--kernel", runtimeKernelURL.path,
+            "--image", image,
+        ]
+        fetch.standardInput = FileHandle.nullDevice
+        fetch.standardOutput = FileHandle.nullDevice
+        let stderrPipe = Pipe()
+        fetch.standardError = stderrPipe
+
+        do {
+            try fetch.run()
+        } catch {
+            onOutput(.stderr, Data("ghostvm-image-fetch: \(error.localizedDescription)\n".utf8))
+            onExit(125)
+            return
+        }
+        register(fetch)
+
+        let drainGroup = DispatchGroup()
+        drainGroup.enter()
+        DispatchQueue.global(qos: .userInitiated).async {
+            Self.readLoop(fd: stderrPipe.fileHandleForReading.fileDescriptor, stream: .stderr, keepingAlive: stderrPipe, onOutput: onOutput)
+            drainGroup.leave()
+        }
+        fetch.waitUntilExit()
+        drainGroup.wait()
+        clearProcess(fetch)
+
+        let fetchStatus = Self.exitStatus(fetch)
+        guard fetchStatus == 0 else {
+            onExit(fetchStatus)
+            return
+        }
+
+        lock.lock()
+        let shouldRun = !terminateRequested
+        lock.unlock()
+        guard shouldRun else {
+            onExit(143)
+            return
+        }
+
+        launchRuntime(onReady: onReady, onOutput: onOutput, onExit: onExit)
+    }
+
+    private func launchRuntime(
+        onReady: @escaping () -> Void,
+        onOutput: @escaping (Stream, Data) -> Void,
+        onExit: @escaping (Int32) -> Void
+    ) {
+        var workerArguments = arguments
+        workerArguments.insert(contentsOf: ["--root", rootURL.path, "--kernel", runtimeKernelURL.path], at: 1)
+        let runIdentifier = UUID().uuidString
+        let lease: SharedVmnetEndpointLease
+        do {
+            lease = try sharedNetwork.acquireEndpoint(identifier: runIdentifier)
+        } catch {
+            onOutput(.stderr, Data("ghostvm-container-runtime: \(error.localizedDescription)\n".utf8))
+            onExit(125)
+            return
+        }
+        var stdinSockets = [Int32](repeating: -1, count: 2)
+        guard socketpair(AF_UNIX, SOCK_STREAM, 0, &stdinSockets) == 0 else {
+            lease.close()
+            onOutput(.stderr, Data("ghostvm-container-runtime: failed to create stdin socket (errno \(errno))\n".utf8))
+            onExit(125)
+            return
+        }
+        let parentStdin = FileHandle(fileDescriptor: stdinSockets[0], closeOnDealloc: true)
+        let childStdin = FileHandle(fileDescriptor: stdinSockets[1], closeOnDealloc: true)
+        let stdoutPipe = Pipe()
+        let stderrPipe = Pipe()
+
+        lock.lock()
+        self.runtimeRunIdentifier = runIdentifier
+        self.networkLease = lease
+        self.stdinWriteHandle = parentStdin
+        let terminateImmediately = terminateRequested
+        lock.unlock()
+
+        let drainGroup = DispatchGroup()
+        drainGroup.enter()
+        DispatchQueue.global(qos: .userInitiated).async {
+            Self.readLoop(fd: stdoutPipe.fileHandleForReading.fileDescriptor, stream: .stdout, keepingAlive: stdoutPipe, onOutput: onOutput)
+            drainGroup.leave()
+        }
+        drainGroup.enter()
+        DispatchQueue.global(qos: .userInitiated).async {
+            Self.readLoop(fd: stderrPipe.fileHandleForReading.fileDescriptor, stream: .stderr, keepingAlive: stderrPipe, onOutput: onOutput)
+            drainGroup.leave()
+        }
+
+        do {
+            try runtimeClient.startRun(
+                runIdentifier: runIdentifier,
+                arguments: workerArguments,
+                network: lease,
+                stdinFD: childStdin.fileDescriptor,
+                stdoutFD: stdoutPipe.fileHandleForWriting.fileDescriptor,
+                stderrFD: stderrPipe.fileHandleForWriting.fileDescriptor,
+                onReady: {
+                    onReady()
+                },
+                onExit: { status in
+                    DispatchQueue.global(qos: .userInitiated).async {
+                        // The service closes its output descriptors before the
+                        // exit event; drain all buffered bytes before reporting.
+                        drainGroup.wait()
+                        self.closeStdin()
+                        self.clearRuntime(runIdentifier: runIdentifier)
+                        onExit(status)
+                    }
+                }
+            )
+            // XPC duplicates descriptors when they are inserted into the request.
+            try? childStdin.close()
+            try? stdoutPipe.fileHandleForWriting.close()
+            try? stderrPipe.fileHandleForWriting.close()
+            if terminateImmediately {
+                runtimeClient.cancel(runIdentifier: runIdentifier)
+            }
+        } catch {
+            try? childStdin.close()
+            try? stdoutPipe.fileHandleForWriting.close()
+            try? stderrPipe.fileHandleForWriting.close()
+            onOutput(.stderr, Data("ghostvm-container-runtime: \(error.localizedDescription)\n".utf8))
+            DispatchQueue.global(qos: .userInitiated).async {
+                drainGroup.wait()
+                self.closeStdin()
+                self.clearRuntime(runIdentifier: runIdentifier)
+                onExit(125)
+            }
+        }
+    }
+
+    /// Cancels image preparation or the active runtime-service run. Safe to call
+    /// multiple times and remembered before start so a late run cannot survive.
+    public func terminate() {
+        lock.lock()
+        terminateRequested = true
+        let process = self.process
+        let runtimeRunIdentifier = self.runtimeRunIdentifier
+        lock.unlock()
+        closeStdin()
+        if let process, process.isRunning {
+            Self.terminateWithEscalation(process)
+        }
+        if let runtimeRunIdentifier {
+            runtimeClient.cancel(runIdentifier: runtimeRunIdentifier)
+        }
+    }
+
+    private func register(_ process: Process) {
+        lock.lock()
+        self.process = process
+        let terminateImmediately = terminateRequested
+        lock.unlock()
+        if terminateImmediately {
+            Self.terminateWithEscalation(process)
+        }
+    }
+
+    private func clearProcess(_ process: Process) {
+        lock.lock()
+        if self.process === process {
+            self.process = nil
+        }
+        lock.unlock()
+    }
+
+    private func clearRuntime(runIdentifier: String) {
+        lock.lock()
+        guard runtimeRunIdentifier == runIdentifier else {
+            lock.unlock()
+            return
+        }
+        runtimeRunIdentifier = nil
+        let lease = networkLease
+        networkLease = nil
+        lock.unlock()
+        lease?.close()
+    }
+
+    private static func exitStatus(_ process: Process) -> Int32 {
+        process.terminationReason == .uncaughtSignal
+            ? 128 + process.terminationStatus
+            : process.terminationStatus
+    }
+
+    private static func terminateWithEscalation(_ process: Process) {
+        guard process.isRunning else { return }
+        process.terminate()
+        DispatchQueue.global(qos: .userInitiated).asyncAfter(deadline: .now() + 2) {
+            if process.isRunning {
+                kill(process.processIdentifier, SIGKILL)
+            }
+        }
+    }
+
+    private static func readLoop(fd: Int32, stream: Stream, keepingAlive: Pipe, onOutput: (Stream, Data) -> Void) {
+        var buffer = [UInt8](repeating: 0, count: 32 * 1024)
+        while true {
+            let n = Darwin.read(fd, &buffer, buffer.count)
+            if n > 0 {
+                onOutput(stream, Data(buffer[0.. Void
+        let onExit: (Int32) -> Void
+    }
+
+    private let connection: xpc_connection_t
+    private let lock = NSLock()
+    private var pendingRuns: [String: PendingRun] = [:]
+    private var invalidated = false
+
+    static func ping() throws {
+        let connection = xpc_connection_create(ContainerRuntimeXPCProtocol.serviceName, nil)
+        xpc_connection_set_event_handler(connection) { _ in }
+        xpc_connection_activate(connection)
+        defer { xpc_connection_cancel(connection) }
+
+        let request = xpc_dictionary_create_empty()
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.version, ContainerRuntimeXPCProtocol.version)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.operation, ContainerRuntimeXPCProtocol.Operation.ping)
+        let reply = xpc_connection_send_message_with_reply_sync(connection, request)
+        if xpc_get_type(reply) == XPC_TYPE_ERROR {
+            let detail = xpc_dictionary_get_string(reply, XPC_ERROR_KEY_DESCRIPTION)
+                .map { String(cString: $0) } ?? "unknown XPC error"
+            throw ClientError.unavailable(detail)
+        }
+        guard xpc_get_type(reply) == XPC_TYPE_DICTIONARY,
+              xpc_dictionary_get_bool(reply, ContainerRuntimeXPCProtocol.Key.ok) else {
+            throw ClientError.unavailable("invalid ping response")
+        }
+    }
+
+    init() {
+        connection = xpc_connection_create(ContainerRuntimeXPCProtocol.serviceName, nil)
+        xpc_connection_set_event_handler(connection) { [weak self] event in
+            self?.handle(event)
+        }
+        xpc_connection_activate(connection)
+    }
+
+    deinit {
+        invalidate()
+    }
+
+    func startRun(
+        runIdentifier: String,
+        arguments: [String],
+        network: SharedVmnetEndpointLease,
+        stdinFD: Int32,
+        stdoutFD: Int32,
+        stderrFD: Int32,
+        onReady: @escaping () -> Void,
+        onExit: @escaping (Int32) -> Void
+    ) throws {
+        let encodedArguments: Data
+        do {
+            encodedArguments = try JSONEncoder().encode(arguments)
+        } catch {
+            throw ClientError.encodingFailed(error.localizedDescription)
+        }
+
+        lock.lock()
+        guard !invalidated else {
+            lock.unlock()
+            throw ClientError.unavailable("connection is invalidated")
+        }
+        pendingRuns[runIdentifier] = PendingRun(onReady: onReady, onExit: onExit)
+        lock.unlock()
+
+        let request = xpc_dictionary_create_empty()
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.version, ContainerRuntimeXPCProtocol.version)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.operation, ContainerRuntimeXPCProtocol.Operation.run)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.runIdentifier, runIdentifier)
+        encodedArguments.withUnsafeBytes { bytes in
+            xpc_dictionary_set_data(
+                request,
+                ContainerRuntimeXPCProtocol.Key.arguments,
+                bytes.baseAddress,
+                bytes.count
+            )
+        }
+        xpc_dictionary_set_value(request, ContainerRuntimeXPCProtocol.Key.networkSerialization, network.serialization)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.ipv4Address, network.ipv4Address)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.ipv4Gateway, network.ipv4Gateway)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.macAddress, network.macAddress)
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.mtu, UInt64(network.mtu))
+        xpc_dictionary_set_fd(request, ContainerRuntimeXPCProtocol.Key.stdin, stdinFD)
+        xpc_dictionary_set_fd(request, ContainerRuntimeXPCProtocol.Key.stdout, stdoutFD)
+        xpc_dictionary_set_fd(request, ContainerRuntimeXPCProtocol.Key.stderr, stderrFD)
+        xpc_connection_send_message(connection, request)
+    }
+
+    func cancel(runIdentifier: String) {
+        let request = request(operation: ContainerRuntimeXPCProtocol.Operation.cancel)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.runIdentifier, runIdentifier)
+        xpc_connection_send_message(connection, request)
+    }
+
+    func resize(runIdentifier: String, columns: UInt16, rows: UInt16) {
+        let request = request(operation: ContainerRuntimeXPCProtocol.Operation.resize)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.runIdentifier, runIdentifier)
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.columns, UInt64(columns))
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.rows, UInt64(rows))
+        xpc_connection_send_message(connection, request)
+    }
+
+    func invalidate() {
+        lock.lock()
+        guard !invalidated else {
+            lock.unlock()
+            return
+        }
+        invalidated = true
+        let runs = Array(pendingRuns.values)
+        pendingRuns.removeAll()
+        lock.unlock()
+
+        let request = request(operation: ContainerRuntimeXPCProtocol.Operation.shutdown)
+        xpc_connection_send_message(connection, request)
+        xpc_connection_cancel(connection)
+        for run in runs {
+            run.onExit(143)
+        }
+    }
+
+    private func handle(_ event: xpc_object_t) {
+        if xpc_get_type(event) == XPC_TYPE_ERROR {
+            let detail = xpc_dictionary_get_string(event, XPC_ERROR_KEY_DESCRIPTION)
+                .map { String(cString: $0) } ?? "unknown XPC error"
+            NSLog("ContainerRuntimeXPC: connection event: %@", detail)
+            failPendingRuns(
+                status: 125,
+                invalidating: xpc_equal(event, XPC_ERROR_CONNECTION_INVALID)
+            )
+            return
+        }
+        guard xpc_get_type(event) == XPC_TYPE_DICTIONARY,
+              let operationValue = xpc_dictionary_get_string(event, ContainerRuntimeXPCProtocol.Key.operation),
+              let runValue = xpc_dictionary_get_string(event, ContainerRuntimeXPCProtocol.Key.runIdentifier)
+        else {
+            return
+        }
+
+        let operation = String(cString: operationValue)
+        let runIdentifier = String(cString: runValue)
+        switch operation {
+        case ContainerRuntimeXPCProtocol.Operation.ready:
+            lock.lock()
+            let callback = pendingRuns[runIdentifier]?.onReady
+            lock.unlock()
+            callback?()
+        case ContainerRuntimeXPCProtocol.Operation.exit:
+            lock.lock()
+            let pending = pendingRuns.removeValue(forKey: runIdentifier)
+            lock.unlock()
+            pending?.onExit(Int32(xpc_dictionary_get_int64(event, ContainerRuntimeXPCProtocol.Key.exitCode)))
+        default:
+            break
+        }
+    }
+
+    private func failPendingRuns(status: Int32, invalidating: Bool = false) {
+        lock.lock()
+        if invalidating {
+            invalidated = true
+        }
+        let runs = Array(pendingRuns.values)
+        pendingRuns.removeAll()
+        lock.unlock()
+        for run in runs {
+            run.onExit(status)
+        }
+    }
+
+    private func request(operation: String) -> xpc_object_t {
+        let request = xpc_dictionary_create_empty()
+        xpc_dictionary_set_uint64(request, ContainerRuntimeXPCProtocol.Key.version, ContainerRuntimeXPCProtocol.version)
+        xpc_dictionary_set_string(request, ContainerRuntimeXPCProtocol.Key.operation, operation)
+        return request
+    }
+}
diff --git a/macOS/GhostVM/Services/GhostClient.swift b/macOS/GhostVM/Services/GhostClient.swift
index e79c94a..84249d1 100644
--- a/macOS/GhostVM/Services/GhostClient.swift
+++ b/macOS/GhostVM/Services/GhostClient.swift
@@ -262,6 +262,72 @@ public final class GhostClient: GhostClientProtocol {
         throw GhostClientError.notConnected
     }
 
+    public func fileMetadata(path: String) async throws -> GuestFileMetadata {
+        let response = try await sendGuestFilesystemRequest(path: "/api/v1/fs/metadata", guestPath: path)
+        let statusCode = response.head.status.rawValue
+        guard statusCode == 200 else {
+            throw GhostClientError.invalidResponse(statusCode)
+        }
+        return try JSONDecoder().decode(GuestFileMetadata.self, from: response.body)
+    }
+
+    public func listDirectoryMetadata(path: String) async throws -> GuestDirectoryMetadata {
+        let response = try await sendGuestFilesystemRequest(path: "/api/v1/fs/list", guestPath: path)
+        let statusCode = response.head.status.rawValue
+        guard statusCode == 200 else {
+            throw GhostClientError.invalidResponse(statusCode)
+        }
+        return try JSONDecoder().decode(GuestDirectoryMetadata.self, from: response.body)
+    }
+
+    public func readFile(path: String, offset: UInt64, length: Int) async throws -> Data {
+        guard length >= 0, length <= 1024 * 1024 else {
+            throw GhostClientError.connectionFailed("Filesystem read length exceeds 1 MiB")
+        }
+        let encodedPath = Self.encodeQueryValue(path)
+        guard let vm = virtualMachine else {
+            throw GhostClientError.notConnected
+        }
+        let response = try await sendHTTPRequest(
+            vm: vm,
+            method: "GET",
+            path: "/api/v1/fs/read?path=\(encodedPath)&offset=\(offset)&length=\(length)",
+            body: nil
+        )
+        let statusCode = response.head.status.rawValue
+        guard statusCode == 200 else {
+            throw GhostClientError.invalidResponse(statusCode)
+        }
+        return response.body
+    }
+
+    public func readSymbolicLink(path: String) async throws -> String {
+        let response = try await sendGuestFilesystemRequest(path: "/api/v1/fs/readlink", guestPath: path)
+        let statusCode = response.head.status.rawValue
+        guard statusCode == 200, let target = String(data: response.body, encoding: .utf8) else {
+            throw GhostClientError.invalidResponse(statusCode)
+        }
+        return target
+    }
+
+    private func sendGuestFilesystemRequest(path endpoint: String, guestPath: String) async throws -> HTTPBufferedResponse {
+        guard let vm = virtualMachine else {
+            throw GhostClientError.notConnected
+        }
+        return try await sendHTTPRequest(
+            vm: vm,
+            method: "GET",
+            path: "\(endpoint)?path=\(Self.encodeQueryValue(guestPath))",
+            body: nil
+        )
+    }
+
+    private static func encodeQueryValue(_ value: String) -> String {
+        var allowed = CharacterSet.alphanumerics
+        allowed.insert(charactersIn: "-._~")
+        return value.addingPercentEncoding(withAllowedCharacters: allowed) ?? value
+    }
+
     /// Create a directory in the guest
     public func mkdir(path: String) async throws {
         let body = try JSONEncoder().encode(["path": path])
diff --git a/macOS/GhostVM/Services/GuestFileSystemBridgeService.swift b/macOS/GhostVM/Services/GuestFileSystemBridgeService.swift
new file mode 100644
index 0000000..7e30161
--- /dev/null
+++ b/macOS/GhostVM/Services/GuestFileSystemBridgeService.swift
@@ -0,0 +1,276 @@
+import Foundation
+import GhostVMKit
+
+/// Loopback bridge used by the sandboxed FSKit extension. A random export ID is
+/// the capability for one guest directory; callers never provide guest roots.
+@MainActor
+final class GuestFileSystemBridgeService {
+    struct RegisteredExport: Sendable {
+        let id: String
+        let resourceURL: URL
+    }
+
+    private struct Export {
+        let root: String
+        let readOnly: Bool
+    }
+
+    private weak var client: GhostClient?
+    private var exports: [String: Export] = [:]
+    private var serverFD: Int32 = -1
+    private var acceptSource: DispatchSourceRead?
+    private(set) var port: UInt16 = 0
+
+    func start(client: GhostClient) throws {
+        guard serverFD < 0 else { return }
+        self.client = client
+
+        let fd = Darwin.socket(AF_INET, SOCK_STREAM, 0)
+        guard fd >= 0 else { throw BridgeError.socket(errno) }
+
+        var reuse: Int32 = 1
+        _ = Darwin.setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &reuse, socklen_t(MemoryLayout.size))
+
+        var address = sockaddr_in()
+        address.sin_len = UInt8(MemoryLayout.size)
+        address.sin_family = sa_family_t(AF_INET)
+        address.sin_port = 0
+        address.sin_addr.s_addr = inet_addr("127.0.0.1")
+
+        let bindResult = withUnsafePointer(to: &address) { pointer in
+            pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                Darwin.bind(fd, $0, socklen_t(MemoryLayout.size))
+            }
+        }
+        guard bindResult == 0 else {
+            Darwin.close(fd)
+            throw BridgeError.bind(errno)
+        }
+        guard Darwin.listen(fd, 32) == 0 else {
+            Darwin.close(fd)
+            throw BridgeError.listen(errno)
+        }
+
+        var boundAddress = sockaddr_in()
+        var boundLength = socklen_t(MemoryLayout.size)
+        let nameResult = withUnsafeMutablePointer(to: &boundAddress) { pointer in
+            pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                Darwin.getsockname(fd, $0, &boundLength)
+            }
+        }
+        guard nameResult == 0 else {
+            Darwin.close(fd)
+            throw BridgeError.socketName(errno)
+        }
+
+        serverFD = fd
+        port = UInt16(bigEndian: boundAddress.sin_port)
+        let source = DispatchSource.makeReadSource(fileDescriptor: fd, queue: .global(qos: .userInitiated))
+        source.setEventHandler { [weak self] in
+            guard let self else { return }
+            while true {
+                let connection = Darwin.accept(fd, nil, nil)
+                guard connection >= 0 else {
+                    if errno == EINTR { continue }
+                    return
+                }
+                Task { @MainActor [weak self] in
+                    await self?.handle(connection)
+                }
+            }
+        }
+        source.resume()
+        acceptSource = source
+        NSLog("GuestFileSystemBridgeService: Listening on 127.0.0.1:\(port)")
+    }
+
+    func stop() {
+        acceptSource?.cancel()
+        acceptSource = nil
+        if serverFD >= 0 {
+            Darwin.close(serverFD)
+            serverFD = -1
+        }
+        port = 0
+        exports.removeAll()
+        client = nil
+    }
+
+    func registerExport(guestPath: String, readOnly: Bool = true) throws -> RegisteredExport {
+        guard port != 0 else { throw BridgeError.notRunning }
+        guard guestPath.hasPrefix("/"), !guestPath.contains("\0") else {
+            throw BridgeError.invalidGuestPath
+        }
+        guard exports.count < 32 else { throw BridgeError.tooManyExports }
+
+        let id = UUID().uuidString.lowercased()
+        exports[id] = Export(root: guestPath, readOnly: readOnly)
+        var components = URLComponents()
+        components.scheme = "ghostvm"
+        components.host = "127.0.0.1"
+        components.port = Int(port)
+        components.path = "/\(id)"
+        components.queryItems = [URLQueryItem(name: "mode", value: readOnly ? "ro" : "rw")]
+        guard let url = components.url else { throw BridgeError.invalidResourceURL }
+        return RegisteredExport(id: id, resourceURL: url)
+    }
+
+    func unregisterExport(id: String) {
+        exports.removeValue(forKey: id)
+    }
+
+    private func handle(_ fd: Int32) async {
+        defer { Darwin.close(fd) }
+        let request = await Task.detached(priority: .userInitiated) {
+            Self.readRequest(fd)
+        }.value
+        guard let request else {
+            Self.writeResponse(fd, status: 400, contentType: "application/json", body: Self.errorBody("Malformed request"))
+            return
+        }
+
+        let response = await route(request)
+        await Task.detached(priority: .userInitiated) {
+            Self.writeResponse(fd, status: response.status, contentType: response.contentType, body: response.body)
+        }.value
+    }
+
+    private func route(_ request: Request) async -> Response {
+        guard request.method == "GET" else { return .error(405, "Method not allowed") }
+        guard let components = URLComponents(string: "http://localhost\(request.target)") else {
+            return .error(400, "Malformed target")
+        }
+
+        let parts = components.path.split(separator: "/", omittingEmptySubsequences: true).map(String.init)
+        guard parts.count == 3, parts[0] == "v1", let export = exports[parts[1]] else {
+            return .error(404, "Export not found")
+        }
+        let relativePath = components.queryItems?.first(where: { $0.name == "path" })?.value ?? ""
+        guard let guestPath = resolve(relativePath: relativePath, within: export.root) else {
+            return .error(400, "Invalid relative path")
+        }
+        guard let client else { return .error(503, "Guest is unavailable") }
+
+        do {
+            switch parts[2] {
+            case "metadata":
+                let metadata = try await client.fileMetadata(path: guestPath)
+                return .json(try JSONEncoder().encode(metadata))
+            case "list":
+                let listing = try await client.listDirectoryMetadata(path: guestPath)
+                return .json(try JSONEncoder().encode(listing))
+            case "read":
+                let offset = UInt64(components.queryItems?.first(where: { $0.name == "offset" })?.value ?? "")
+                let length = Int(components.queryItems?.first(where: { $0.name == "length" })?.value ?? "")
+                guard let offset, let length, length >= 0, length <= 1024 * 1024 else {
+                    return .error(400, "Invalid read range")
+                }
+                return .binary(try await client.readFile(path: guestPath, offset: offset, length: length))
+            case "readlink":
+                return .text(try await client.readSymbolicLink(path: guestPath))
+            default:
+                return .error(404, "Operation not found")
+            }
+        } catch {
+            return .error(502, error.localizedDescription)
+        }
+    }
+
+    private func resolve(relativePath: String, within root: String) -> String? {
+        guard !relativePath.contains("\0"), !relativePath.hasPrefix("/") else { return nil }
+        let components = relativePath.split(separator: "/", omittingEmptySubsequences: true)
+        guard !components.contains(where: { $0 == "." || $0 == ".." }) else { return nil }
+        return components.reduce(root) { ($0 as NSString).appendingPathComponent(String($1)) }
+    }
+
+    private struct Request {
+        let method: String
+        let target: String
+    }
+
+    private struct Response {
+        let status: Int
+        let contentType: String
+        let body: Data
+
+        static func json(_ data: Data) -> Self { .init(status: 200, contentType: "application/json", body: data) }
+        static func binary(_ data: Data) -> Self { .init(status: 200, contentType: "application/octet-stream", body: data) }
+        static func text(_ value: String) -> Self { .init(status: 200, contentType: "text/plain; charset=utf-8", body: Data(value.utf8)) }
+        static func error(_ status: Int, _ message: String) -> Self {
+            .init(status: status, contentType: "application/json", body: GuestFileSystemBridgeService.errorBody(message))
+        }
+    }
+
+    nonisolated private static func readRequest(_ fd: Int32) -> Request? {
+        var data = Data()
+        var buffer = [UInt8](repeating: 0, count: 4096)
+        let terminator = Data("\r\n\r\n".utf8)
+        while data.count <= 16 * 1024 {
+            let count = Darwin.read(fd, &buffer, buffer.count)
+            guard count > 0 else { return nil }
+            data.append(contentsOf: buffer[.. 0 {
+                let written = Darwin.write(fd, pointer, remaining)
+                guard written > 0 else { return }
+                pointer = pointer.advanced(by: written)
+                remaining -= written
+            }
+        }
+    }
+
+    nonisolated private static func errorBody(_ message: String) -> Data {
+        (try? JSONSerialization.data(withJSONObject: ["error": message])) ?? Data()
+    }
+
+    enum BridgeError: Error, LocalizedError {
+        case socket(Int32)
+        case bind(Int32)
+        case listen(Int32)
+        case socketName(Int32)
+        case notRunning
+        case invalidGuestPath
+        case tooManyExports
+        case invalidResourceURL
+
+        var errorDescription: String? {
+            switch self {
+            case .socket(let code): return "filesystem bridge socket failed: errno \(code)"
+            case .bind(let code): return "filesystem bridge bind failed: errno \(code)"
+            case .listen(let code): return "filesystem bridge listen failed: errno \(code)"
+            case .socketName(let code): return "filesystem bridge getsockname failed: errno \(code)"
+            case .notRunning: return "filesystem bridge is not running"
+            case .invalidGuestPath: return "guest export path must be absolute"
+            case .tooManyExports: return "filesystem export limit reached"
+            case .invalidResourceURL: return "failed to create FSKit resource URL"
+            }
+        }
+    }
+}
diff --git a/macOS/GhostVM/Services/GuestVolumeMount.swift b/macOS/GhostVM/Services/GuestVolumeMount.swift
new file mode 100644
index 0000000..1e8099f
--- /dev/null
+++ b/macOS/GhostVM/Services/GuestVolumeMount.swift
@@ -0,0 +1,111 @@
+import Foundation
+
+/// Owns one FSKit mount for the lifetime of a container run.
+struct GuestVolumeMount: Sendable {
+    let exportID: String
+    let mountPoint: URL
+    let destination: String
+    let readOnly: Bool
+
+    enum MountError: Error, LocalizedError {
+        case bridgeUnavailable
+        case extensionUnavailable
+        case mountFailed(String)
+
+        var errorDescription: String? {
+            switch self {
+            case .bridgeUnavailable:
+                return "Guest filesystem bridge is unavailable."
+            case .extensionUnavailable:
+                return "GhostVM's file system extension is not enabled. Enable it in System Settings > General > Login Items & Extensions > File System Extensions."
+            case .mountFailed(let detail):
+                return "Failed to mount guest directory through FSKit: \(detail)"
+            }
+        }
+    }
+
+    static func mount(
+        registeredExport: GuestFileSystemBridgeService.RegisteredExport,
+        destination: String,
+        readOnly: Bool,
+        rootURL: URL
+    ) throws -> Self {
+        guard extensionIsEnabled() else { throw MountError.extensionUnavailable }
+
+        let mountPoint = rootURL.appendingPathComponent(UUID().uuidString.lowercased(), isDirectory: true)
+        try FileManager.default.createDirectory(at: mountPoint, withIntermediateDirectories: true)
+
+        do {
+            try run(
+                executable: "/sbin/mount",
+                arguments: [
+                    "-F", "-t", "ghostvm",
+                    "-o", "rdonly,nobrowse,nodev,nosuid",
+                    registeredExport.resourceURL.absoluteString,
+                    mountPoint.path,
+                ]
+            )
+        } catch {
+            try? FileManager.default.removeItem(at: mountPoint)
+            throw error
+        }
+
+        return Self(
+            exportID: registeredExport.id,
+            mountPoint: mountPoint,
+            destination: destination,
+            readOnly: readOnly
+        )
+    }
+
+    func unmount() {
+        do {
+            try Self.run(executable: "/sbin/umount", arguments: [mountPoint.path])
+            try? FileManager.default.removeItem(at: mountPoint)
+        } catch {
+            NSLog("GuestVolumeMount: failed to unmount %@: %@", mountPoint.path, error.localizedDescription)
+        }
+    }
+
+    static func extensionIsEnabled() -> Bool {
+        let process = Process()
+        let output = Pipe()
+        process.executableURL = URL(fileURLWithPath: "/usr/bin/pluginkit")
+        process.arguments = ["-m", "-p", "com.apple.fskit.fsmodule"]
+        process.standardOutput = output
+        process.standardError = output
+        do {
+            try process.run()
+            let data = output.fileHandleForReading.readDataToEndOfFile()
+            process.waitUntilExit()
+            guard process.terminationStatus == 0,
+                  let text = String(data: data, encoding: .utf8) else { return false }
+            return text.contains("org.ghostvm.ghostvm.fs")
+        } catch {
+            return false
+        }
+    }
+
+    private static func run(executable: String, arguments: [String]) throws {
+        let process = Process()
+        let output = Pipe()
+        process.executableURL = URL(fileURLWithPath: executable)
+        process.arguments = arguments
+        process.standardOutput = output
+        process.standardError = output
+        do {
+            try process.run()
+        } catch {
+            throw MountError.mountFailed(error.localizedDescription)
+        }
+        let data = output.fileHandleForReading.readDataToEndOfFile()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let detail = String(data: data, encoding: .utf8)?
+                .trimmingCharacters(in: .whitespacesAndNewlines)
+            let message = detail.flatMap { $0.isEmpty ? nil : $0 }
+                ?? "mount exited with status \(process.terminationStatus)"
+            throw MountError.mountFailed(message)
+        }
+    }
+}
diff --git a/macOS/GhostVM/Services/NetworkSettingsView.swift b/macOS/GhostVM/Services/NetworkSettingsView.swift
index a9af8e7..e680357 100644
--- a/macOS/GhostVM/Services/NetworkSettingsView.swift
+++ b/macOS/GhostVM/Services/NetworkSettingsView.swift
@@ -1,4 +1,5 @@
 import SwiftUI
+import AppKit
 import GhostVMKit
 import Virtualization
 
@@ -61,3 +62,70 @@ struct NetworkSettingsView: View {
         .sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
     }
 }
+
+@available(macOS 13.0, *)
+struct HostContainerSettingsView: View {
+    @Binding var isEnabled: Bool
+    let networkMode: NetworkMode
+    let accessibilityIdentifier: String
+
+    @State private var fileSystemExtensionEnabled: Bool?
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 4) {
+            Toggle("Enable host-backed containers", isOn: Binding(
+                get: { networkMode == .nat && isEnabled },
+                set: { isEnabled = networkMode == .nat && $0 }
+            ))
+            .toggleStyle(.checkbox)
+            .disabled(networkMode != .nat)
+            .accessibilityIdentifier(accessibilityIdentifier)
+
+            if networkMode != .nat {
+                Text("Host-backed containers currently require NAT (Shared) networking.")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+            } else if isEnabled {
+                Text("Uses an isolated network shared by this VM and its containers.")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+
+                Text(fileSystemExtensionStatus)
+                    .font(.caption)
+                    .foregroundStyle(fileSystemExtensionEnabled == false ? Color.orange : Color.secondary)
+
+                if fileSystemExtensionEnabled == false {
+                    Button("Open System Settings…") {
+                        guard let url = URL(string: "x-apple.systempreferences:com.apple.LoginItems-Settings.extension") else {
+                            return
+                        }
+                        NSWorkspace.shared.open(url)
+                    }
+                    .font(.caption)
+                }
+            }
+        }
+        .task(id: isEnabled) {
+            guard isEnabled else { return }
+            fileSystemExtensionEnabled = await Task.detached(priority: .utility) {
+                GuestVolumeMount.extensionIsEnabled()
+            }.value
+        }
+        .onChange(of: networkMode) { _, newMode in
+            if newMode != .nat {
+                isEnabled = false
+            }
+        }
+    }
+
+    private var fileSystemExtensionStatus: String {
+        switch fileSystemExtensionEnabled {
+        case true:
+            return "File System Extension: Enabled"
+        case false:
+            return "File System Extension: Not Enabled"
+        case nil:
+            return "File System Extension: Checking…"
+        }
+    }
+}
diff --git a/macOS/GhostVM/SwiftUIDemoApp.swift b/macOS/GhostVM/SwiftUIDemoApp.swift
index 5e70068..9401aae 100644
--- a/macOS/GhostVM/SwiftUIDemoApp.swift
+++ b/macOS/GhostVM/SwiftUIDemoApp.swift
@@ -739,6 +739,7 @@ struct CreateVMDemoView: View {
     @State private var diskImageFormat: DiskImageFormat = .defaultForCurrentHost
     @State private var sharedFolders: [SharedFolderConfig] = []
     @State private var networkConfig: NetworkConfig = NetworkConfig.defaultConfig
+    @State private var hostContainersEnabled = false
     @State private var restoreItems: [RestoreItem] = []
     @State private var selectedRestorePath: String?
     @State private var isCreating: Bool = false
@@ -836,6 +837,14 @@ struct CreateVMDemoView: View {
                 NetworkSettingsView(networkConfig: $networkConfig)
             }
 
+            labeledRow("Containers") {
+                HostContainerSettingsView(
+                    isEnabled: $hostContainersEnabled,
+                    networkMode: networkConfig.mode,
+                    accessibilityIdentifier: "createVM.hostContainersToggle"
+                )
+            }
+
             Spacer(minLength: 8)
 
             HStack {
@@ -1009,6 +1018,7 @@ struct CreateVMDemoView: View {
         opts.restoreImagePath = restorePath
         opts.sharedFolders = validFolders
         opts.networkConfig = networkConfig
+        opts.hostContainersEnabled = hostContainersEnabled && networkConfig.mode == .nat
 
         isCreating = true
 
@@ -1411,6 +1421,7 @@ struct EditVMView: View {
     @State private var sharedFolders: [SharedFolderConfig] = []
     @State private var portForwards: [PortForwardConfig] = []
     @State private var networkConfig: NetworkConfig = NetworkConfig.defaultConfig
+    @State private var hostContainersEnabled = false
     @State private var diskGiB: String = ""
     @State private var customIcon: NSImage?
     @State private var customIconChanged: Bool = false
@@ -1510,6 +1521,14 @@ struct EditVMView: View {
                             NetworkSettingsView(networkConfig: $networkConfig)
                         }
 
+                        labeledRow("Containers") {
+                            HostContainerSettingsView(
+                                isEnabled: $hostContainersEnabled,
+                                networkMode: networkConfig.mode,
+                                accessibilityIdentifier: "editVM.hostContainersToggle"
+                            )
+                        }
+
                         if networkConfig.mode == .nat {
                             labeledRow("Port Forwards") {
                                 PortForwardListView(forwards: $portForwards)
@@ -1804,6 +1823,8 @@ struct EditVMView: View {
 
                     // Load network config
                     self.networkConfig = config.networkConfig ?? NetworkConfig.defaultConfig
+                    self.hostContainersEnabled = config.hostContainersEnabled
+                        && self.networkConfig.mode == .nat
 
                     // Load icon mode
                     self.isDynamicIconMode = config.iconMode == "stack"
@@ -1865,6 +1886,7 @@ struct EditVMView: View {
                     storedConfig.iconMode = nil
                 }
                 storedConfig.networkConfig = networkConfig
+                storedConfig.hostContainersEnabled = hostContainersEnabled && networkConfig.mode == .nat
                 try store.save(storedConfig)
 
                 // Save or remove custom icon
diff --git a/macOS/GhostVM/VMApp-Info.template.plist b/macOS/GhostVM/VMApp-Info.template.plist
index c3bd3be..1b9f39c 100644
--- a/macOS/GhostVM/VMApp-Info.template.plist
+++ b/macOS/GhostVM/VMApp-Info.template.plist
@@ -34,7 +34,7 @@
 	CFBundlePackageType
 	APPL
 	LSMinimumSystemVersion
-	15.0
+	$(MACOSX_DEPLOYMENT_TARGET)
 	LSMultipleInstancesProhibited
 	
 	NSPrincipalClass
diff --git a/macOS/GhostVMContainerRuntime/Info.plist b/macOS/GhostVMContainerRuntime/Info.plist
new file mode 100644
index 0000000..db9ed08
--- /dev/null
+++ b/macOS/GhostVMContainerRuntime/Info.plist
@@ -0,0 +1,27 @@
+
+
+
+
+	CFBundleDevelopmentRegion
+	en
+	CFBundleExecutable
+	$(EXECUTABLE_NAME)
+	CFBundleIdentifier
+	$(PRODUCT_BUNDLE_IDENTIFIER)
+	CFBundleInfoDictionaryVersion
+	6.0
+	CFBundleName
+	$(PRODUCT_NAME)
+	CFBundlePackageType
+	XPC!
+	LSMinimumSystemVersion
+	$(MACOSX_DEPLOYMENT_TARGET)
+	XPCService
+	
+		RunLoopType
+		dispatch_main
+		ServiceType
+		Application
+	
+
+
diff --git a/macOS/GhostVMContainerRuntime/RuntimeMain.swift b/macOS/GhostVMContainerRuntime/RuntimeMain.swift
new file mode 100644
index 0000000..6041098
--- /dev/null
+++ b/macOS/GhostVMContainerRuntime/RuntimeMain.swift
@@ -0,0 +1,811 @@
+import Containerization
+import ContainerizationExtras
+import ContainerizationOCI
+import ContainerizationOS
+import Foundation
+import GhostVMKit
+import XPC
+import vmnet
+
+// The shared protocol constants live as nested types on ContainerRuntimeXPCProtocol;
+// pull them into file-local aliases (shadowing Foundation.Operation) for readability.
+private typealias Key = ContainerRuntimeXPCProtocol.Key
+private typealias Operation = ContainerRuntimeXPCProtocol.Operation
+
+private struct RuntimeOptions {
+    struct Mount {
+        let source: String
+        let destination: String
+        let readOnly: Bool
+    }
+
+    let root: URL
+    let kernel: URL
+    let id: String
+    let image: String
+    let networkIdentifier: String?
+    let interactive: Bool
+    let tty: Bool
+    let terminalColumns: UInt16
+    let terminalRows: UInt16
+    let mounts: [Mount]
+    let command: [String]
+
+    static func parse(_ arguments: [String]) throws -> RuntimeOptions {
+        guard arguments.first == "run" else {
+            throw RuntimeError.usage
+        }
+
+        var root: String?
+        var kernel: String?
+        var id: String?
+        var image: String?
+        var networkIdentifier: String?
+        var interactive = false
+        var tty = false
+        var terminalColumns: UInt16 = 80
+        var terminalRows: UInt16 = 24
+        var mounts: [Mount] = []
+        var command: [String] = []
+        var index = 1
+        while index < arguments.count {
+            let argument = arguments[index]
+            if argument == "--" {
+                command = Array(arguments.dropFirst(index + 1))
+                break
+            }
+            switch argument {
+            case "-i", "--interactive":
+                interactive = true
+                index += 1
+                continue
+            case "-t", "--tty":
+                tty = true
+                index += 1
+                continue
+            case "-it", "-ti":
+                interactive = true
+                tty = true
+                index += 1
+                continue
+            case "--tty-size":
+                guard index + 2 < arguments.count,
+                      let columns = UInt16(arguments[index + 1]), columns > 0,
+                      let rows = UInt16(arguments[index + 2]), rows > 0 else {
+                    throw RuntimeError.usage
+                }
+                terminalColumns = columns
+                terminalRows = rows
+                index += 3
+                continue
+            case "--mount":
+                guard index + 3 < arguments.count else {
+                    throw RuntimeError.usage
+                }
+                let source = arguments[index + 1]
+                let destination = arguments[index + 2]
+                let mode = arguments[index + 3]
+                let destinationParts = destination.split(separator: "/", omittingEmptySubsequences: true)
+                guard
+                    source.hasPrefix("/"),
+                    destination.hasPrefix("/"),
+                    destination != "/",
+                    !source.contains("\0"),
+                    !destination.contains("\0"),
+                    !destinationParts.contains(where: { $0 == "." || $0 == ".." }),
+                    mode == "ro" || mode == "rw",
+                    mounts.count < 32,
+                    !mounts.contains(where: { $0.destination == destination })
+                else {
+                    throw RuntimeError.invalidMount(source: source, destination: destination, mode: mode)
+                }
+                mounts.append(Mount(source: source, destination: destination, readOnly: mode == "ro"))
+                index += 4
+                continue
+            default:
+                break
+            }
+            guard index + 1 < arguments.count else {
+                throw RuntimeError.usage
+            }
+            let value = arguments[index + 1]
+            switch argument {
+            case "--root": root = value
+            case "--kernel": kernel = value
+            case "--id": id = value
+            case "--image": image = value
+            case "--network-id": networkIdentifier = value
+            default: throw RuntimeError.usage
+            }
+            index += 2
+        }
+
+        guard let root, let kernel, let id, let image else {
+            throw RuntimeError.usage
+        }
+        return RuntimeOptions(
+            root: URL(fileURLWithPath: root, isDirectory: true),
+            kernel: URL(fileURLWithPath: kernel),
+            id: id,
+            image: image,
+            networkIdentifier: networkIdentifier,
+            interactive: interactive,
+            tty: tty,
+            terminalColumns: terminalColumns,
+            terminalRows: terminalRows,
+            mounts: mounts,
+            command: command
+        )
+    }
+}
+
+private enum RuntimeError: Error, LocalizedError {
+    case usage
+    case kernelNotFound(String)
+    case invalidMount(source: String, destination: String, mode: String)
+
+    var errorDescription: String? {
+        switch self {
+        case .usage:
+            return "usage: ghostvm-container-runtime run [-i|--interactive] [-t|--tty] [--tty-size COLUMNS ROWS] --root PATH --kernel PATH --id ID --image IMAGE [--network-id ID] [--mount HOST_PATH CONTAINER_PATH ro|rw] [-- COMMAND...]"
+        case .kernelNotFound(let path):
+            return "container kernel not found at \(path); the image fetch helper must prepare runtime assets first"
+        case .invalidMount(let source, let destination, let mode):
+            return "invalid mount: source='\(source)' destination='\(destination)' mode='\(mode)'"
+        }
+    }
+}
+
+private final class FileWriter: Writer, @unchecked Sendable {
+    private let handle: FileHandle
+
+    init(_ handle: FileHandle) {
+        self.handle = handle
+    }
+
+    func write(_ data: Data) throws {
+        try handle.write(contentsOf: data)
+    }
+
+    func close() throws {}
+}
+
+private final class FileHandleReaderStream: ReaderStream, @unchecked Sendable {
+    private let handle: FileHandle
+
+    init(_ handle: FileHandle) {
+        self.handle = handle
+    }
+
+    func stream() -> AsyncStream {
+        AsyncStream { continuation in
+            handle.readabilityHandler = { readable in
+                let data = readable.availableData
+                if data.isEmpty {
+                    readable.readabilityHandler = nil
+                    continuation.finish()
+                } else {
+                    continuation.yield(data)
+                }
+            }
+            continuation.onTermination = { [handle] _ in
+                handle.readabilityHandler = nil
+            }
+        }
+    }
+}
+
+/// A single registered container run. Owns the reconstructed vmnet reference and
+/// the duplicated stdio file descriptors for its lifetime, guarantees exactly-once
+/// completion, and balances the XPC transaction that keeps the service alive.
+private final class RunContext: @unchecked Sendable {
+    private weak var broker: RuntimeBroker?
+    let connection: xpc_connection_t
+    let runIdentifier: String
+    private let options: RuntimeOptions
+    private let networkReference: vmnet_network_ref
+    private let ipv4Address: String
+    private let ipv4Gateway: String
+    private let macAddress: String
+    private let mtu: UInt32
+    private let stdinHandle: FileHandle
+    private let stdoutHandle: FileHandle
+    private let stderrHandle: FileHandle
+
+    private let stateLock = NSLock()
+    private var registered = false
+    private var cancelled = false
+    private var completed = false
+    private var networkReleased = false
+    private var task: Task?
+    private var resizeTask: Task?
+    private var activeContainer: LinuxContainer?
+    private var pendingTerminalSize: (columns: UInt16, rows: UInt16)?
+
+    init(
+        broker: RuntimeBroker,
+        connection: xpc_connection_t,
+        runIdentifier: String,
+        options: RuntimeOptions,
+        networkReference: vmnet_network_ref,
+        ipv4Address: String,
+        ipv4Gateway: String,
+        macAddress: String,
+        mtu: UInt32,
+        stdinHandle: FileHandle,
+        stdoutHandle: FileHandle,
+        stderrHandle: FileHandle
+    ) {
+        self.broker = broker
+        self.connection = connection
+        self.runIdentifier = runIdentifier
+        self.options = options
+        self.networkReference = networkReference
+        self.ipv4Address = ipv4Address
+        self.ipv4Gateway = ipv4Gateway
+        self.macAddress = macAddress
+        self.mtu = mtu
+        self.stdinHandle = stdinHandle
+        self.stdoutHandle = stdoutHandle
+        self.stderrHandle = stderrHandle
+    }
+
+    func markRegistered() {
+        stateLock.lock()
+        registered = true
+        stateLock.unlock()
+    }
+
+    func sendReady() {
+        let event = xpc_dictionary_create_empty()
+        xpc_dictionary_set_string(event, Key.operation, Operation.ready)
+        xpc_dictionary_set_string(event, Key.runIdentifier, runIdentifier)
+        xpc_connection_send_message(connection, event)
+        log("runtime[\(getpid())]: run '\(runIdentifier)' ready (container '\(options.id)')")
+    }
+
+    func setTask(_ task: Task) {
+        stateLock.lock()
+        let alreadyCompleted = completed
+        if !alreadyCompleted {
+            self.task = task
+        }
+        let shouldCancel = cancelled || alreadyCompleted
+        stateLock.unlock()
+        if shouldCancel {
+            task.cancel()
+        }
+    }
+
+    func cancelTask() {
+        stateLock.lock()
+        cancelled = true
+        let current = task
+        stateLock.unlock()
+        current?.cancel()
+        log("runtime[\(getpid())]: run '\(runIdentifier)' cancel requested")
+    }
+
+    func resize(columns: UInt16, rows: UInt16) {
+        stateLock.lock()
+        pendingTerminalSize = (columns, rows)
+        let container = activeContainer
+        let shouldResize = options.tty && !completed
+        let previousResize = resizeTask
+        let nextResize: Task?
+        if shouldResize, let container {
+            nextResize = Task {
+                await previousResize?.value
+                try? await container.resize(to: Terminal.Size(width: columns, height: rows))
+            }
+            resizeTask = nextResize
+        } else {
+            nextResize = nil
+        }
+        stateLock.unlock()
+        _ = nextResize
+    }
+
+    /// Runs the create/start/wait/stop/delete flow and returns the exit code plus an
+    /// optional localized failure message to emit on the supplied stderr. Cancellation
+    /// is reported as 143 with no message; other failures as 125 with the message.
+    func runContainer() async -> (exitCode: Int32, message: String?) {
+        do {
+            guard FileManager.default.isReadableFile(atPath: options.kernel.path) else {
+                throw RuntimeError.kernelNotFound(options.kernel.path)
+            }
+
+            let reference = try Reference.parse(options.image)
+            reference.normalize()
+            let normalizedImage = reference.description
+            let imageStore = try ImageStore(path: options.root)
+
+            // The short-lived fetch helper is the only image-store writer.
+            let image = try await imageStore.get(reference: normalizedImage, pull: false)
+            let kernel = Kernel(path: options.kernel, platform: .linuxArm)
+            var manager = try await ContainerManager(
+                kernel: kernel,
+                initfsReference: "ghcr.io/apple/containerization/vminit:0.40.1",
+                imageStore: imageStore,
+                network: nil
+            )
+
+            var container: LinuxContainer?
+            do {
+                let created = try await manager.create(
+                    options.id,
+                    image: image,
+                    rootfsSizeInBytes: 2 * 1024 * 1024 * 1024,
+                    networking: false
+                ) { configuration in
+                    try self.configureContainer(&configuration)
+                }
+                container = created
+                try await created.create()
+                try await created.start()
+                let terminalSize = stateLock.withLock {
+                    activeContainer = created
+                    return pendingTerminalSize ?? (options.terminalColumns, options.terminalRows)
+                }
+                if options.tty {
+                    try await created.resize(to: Terminal.Size(width: terminalSize.0, height: terminalSize.1))
+                }
+                sendReady()
+                let status = try await withTaskCancellationHandler {
+                    try await created.wait()
+                } onCancel: {
+                    Task { try? await created.stop() }
+                }
+                if Task.isCancelled {
+                    try? await created.stop()
+                    try? manager.delete(options.id)
+                    return (143, nil)
+                }
+                try await created.stop()
+                try manager.delete(options.id)
+                return (status.exitCode, nil)
+            } catch {
+                if let container { try? await container.stop() }
+                try? manager.delete(options.id)
+                throw error
+            }
+        } catch {
+            if Task.isCancelled || error is CancellationError {
+                return (143, nil)
+            }
+            let message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+            return (125, message)
+        }
+    }
+
+    private func configureContainer(_ configuration: inout LinuxContainer.Configuration) throws {
+        configuration.cpus = 2
+        configuration.memoryInBytes = 1024 * 1024 * 1024
+        configuration.interfaces = [
+            VmnetNetwork.Interface(
+                reference: networkReference,
+                ipv4Address: try CIDRv4(ipv4Address),
+                ipv4Gateway: try IPv4Address(ipv4Gateway),
+                macAddress: try MACAddress(macAddress),
+                mtu: mtu
+            )
+        ]
+        configuration.dns = DNS(nameservers: [ipv4Gateway])
+        if !options.command.isEmpty {
+            configuration.process.arguments = options.command
+        }
+        for mount in options.mounts {
+            configuration.mounts.append(
+                Containerization.Mount.share(
+                    source: mount.source,
+                    destination: mount.destination,
+                    options: mount.readOnly ? ["ro"] : []
+                )
+            )
+        }
+        if options.interactive {
+            configuration.process.stdin = FileHandleReaderStream(stdinHandle)
+        }
+        configuration.process.terminal = options.tty
+        if options.tty {
+            configuration.process.environmentVariables.removeAll { $0.hasPrefix("TERM=") }
+            configuration.process.environmentVariables.append("TERM=xterm-256color")
+        }
+        configuration.process.stdout = FileWriter(stdoutHandle)
+        configuration.process.stderr = options.tty ? nil : FileWriter(stderrHandle)
+    }
+
+    /// Exactly-once completion: writes any failure message to the supplied stderr,
+    /// releases the vmnet reference, closes the owned stdio handles, then sends the
+    /// asynchronous exit event. Transaction/broker cleanup runs only for runs that
+    /// were actually registered with a balanced `xpc_transaction_begin`.
+    func complete(exitCode: Int32, message: String?) {
+        stateLock.lock()
+        guard !completed else {
+            stateLock.unlock()
+            return
+        }
+        completed = true
+        task = nil
+        let resizeTask = self.resizeTask
+        self.resizeTask = nil
+        activeContainer = nil
+        let wasRegistered = registered
+        stateLock.unlock()
+        resizeTask?.cancel()
+
+        if let message {
+            let line = "ghostvm-container-runtime: \(message)\n"
+            try? stderrHandle.write(contentsOf: Data(line.utf8))
+        }
+        releaseNetworkReference()
+        try? stdoutHandle.close()
+        try? stderrHandle.close()
+        try? stdinHandle.close()
+
+        let event = xpc_dictionary_create_empty()
+        xpc_dictionary_set_string(event, Key.operation, Operation.exit)
+        xpc_dictionary_set_string(event, Key.runIdentifier, runIdentifier)
+        xpc_dictionary_set_int64(event, Key.exitCode, Int64(exitCode))
+        if let message {
+            xpc_dictionary_set_string(event, Key.error, message)
+        }
+        xpc_connection_send_message(connection, event)
+
+        if wasRegistered {
+            broker?.remove(self)
+            xpc_transaction_end()
+        }
+        log("runtime[\(getpid())]: run '\(runIdentifier)' completed with exit code \(exitCode)")
+    }
+
+    private func releaseNetworkReference() {
+        stateLock.lock()
+        guard !networkReleased else {
+            stateLock.unlock()
+            return
+        }
+        networkReleased = true
+        stateLock.unlock()
+        SharedVmnetNetwork.releaseVmnetReference(networkReference)
+    }
+
+    deinit {
+        releaseNetworkReference()
+        try? stdinHandle.close()
+        try? stdoutHandle.close()
+        try? stderrHandle.close()
+    }
+}
+
+/// Hosts all container VMs for the containing GhostVMHelper as an application-scoped
+/// XPC service. Tracks runs by identifier and per-connection so that `cancel`,
+/// `shutdown`, and connection invalidation can cancel the right tasks.
+private final class RuntimeBroker: @unchecked Sendable {
+    private let lock = NSLock()
+    private var runs: [String: RunContext] = [:]
+    private var connectionRuns: [ObjectIdentifier: Set] = [:]
+
+    func handle(connection: xpc_connection_t, request: xpc_object_t) {
+        let version = xpc_dictionary_get_uint64(request, Key.version)
+        guard let operation = Self.string(request, Key.operation) else {
+            sendReply(connection: connection, request: request, error: "missing operation")
+            return
+        }
+        guard version == ContainerRuntimeXPCProtocol.version else {
+            sendReply(connection: connection, request: request, error: "unsupported protocol version \(version)")
+            return
+        }
+
+        switch operation {
+        case Operation.ping:
+            sendReply(connection: connection, request: request, ok: true)
+        case Operation.run:
+            handleRun(connection: connection, request: request)
+        case Operation.cancel:
+            handleCancel(connection: connection, request: request)
+        case Operation.resize:
+            handleResize(connection: connection, request: request)
+        case Operation.shutdown:
+            handleShutdown(connection: connection, request: request)
+        default:
+            sendReply(connection: connection, request: request, error: "unsupported operation '\(operation)'")
+        }
+    }
+
+    /// Connection invalidated (client gone). Cancel every run owned by it.
+    func disconnect(connection: xpc_connection_t) {
+        let contexts = cancelAll(for: connection)
+        if !contexts.isEmpty {
+            log("runtime[\(getpid())]: connection invalidated, cancelling \(contexts.count) run(s)")
+        }
+    }
+
+    func register(_ context: RunContext, connection: xpc_connection_t) -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        guard runs[context.runIdentifier] == nil else { return false }
+        runs[context.runIdentifier] = context
+        connectionRuns[ObjectIdentifier(connection), default: []].insert(context.runIdentifier)
+        return true
+    }
+
+    func remove(_ context: RunContext) {
+        let runIdentifier = context.runIdentifier
+        let connectionID = ObjectIdentifier(context.connection)
+        lock.lock()
+        if runs[runIdentifier] === context {
+            runs.removeValue(forKey: runIdentifier)
+        }
+        if var set = connectionRuns[connectionID] {
+            set.remove(runIdentifier)
+            connectionRuns[connectionID] = set.isEmpty ? nil : set
+        }
+        lock.unlock()
+    }
+
+    private func handleRun(connection: xpc_connection_t, request: xpc_object_t) {
+        guard let runIdentifier = Self.string(request, Key.runIdentifier), !runIdentifier.isEmpty else {
+            sendReply(connection: connection, request: request, error: "missing run identifier")
+            return
+        }
+
+        let stdinFD = xpc_dictionary_dup_fd(request, Key.stdin)
+        let stdoutFD = xpc_dictionary_dup_fd(request, Key.stdout)
+        let stderrFD = xpc_dictionary_dup_fd(request, Key.stderr)
+        guard stdinFD >= 0, stdoutFD >= 0, stderrFD >= 0 else {
+            if stdinFD >= 0 { close(stdinFD) }
+            if stdoutFD >= 0 { close(stdoutFD) }
+            if stderrFD >= 0 { close(stderrFD) }
+            sendExit(connection: connection, runIdentifier: runIdentifier, exitCode: 125, message: "missing stdio file descriptors")
+            return
+        }
+        let stdinHandle = FileHandle(fileDescriptor: stdinFD, closeOnDealloc: false)
+        let stdoutHandle = FileHandle(fileDescriptor: stdoutFD, closeOnDealloc: false)
+        let stderrHandle = FileHandle(fileDescriptor: stderrFD, closeOnDealloc: false)
+
+        let arguments: [String]
+        do {
+            arguments = try Self.decodeArguments(request)
+        } catch {
+            failRun(
+                connection: connection, runIdentifier: runIdentifier,
+                stdinHandle: stdinHandle, stdoutHandle: stdoutHandle, stderrHandle: stderrHandle,
+                message: "invalid arguments payload: \(error)"
+            )
+            return
+        }
+
+        let options: RuntimeOptions
+        do {
+            options = try RuntimeOptions.parse(arguments)
+        } catch {
+            let message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+            failRun(
+                connection: connection, runIdentifier: runIdentifier,
+                stdinHandle: stdinHandle, stdoutHandle: stdoutHandle, stderrHandle: stderrHandle,
+                message: message
+            )
+            return
+        }
+
+        guard let serialization = xpc_dictionary_get_value(request, Key.networkSerialization) else {
+            failRun(
+                connection: connection, runIdentifier: runIdentifier,
+                stdinHandle: stdinHandle, stdoutHandle: stdoutHandle, stderrHandle: stderrHandle,
+                message: "missing network serialization"
+            )
+            return
+        }
+
+        // Reconstruct the vmnet reference directly from the helper-provided
+        // serialization. Fail closed: never fall back to an isolated NAT network.
+        var vmnetStatus: vmnet_return_t = .VMNET_FAILURE
+        guard let networkReference = vmnet_network_create_with_serialization(serialization, &vmnetStatus),
+              vmnetStatus == .VMNET_SUCCESS
+        else {
+            failRun(
+                connection: connection, runIdentifier: runIdentifier,
+                stdinHandle: stdinHandle, stdoutHandle: stdoutHandle, stderrHandle: stderrHandle,
+                message: "failed to reconstruct vmnet network (status \(vmnetStatus.rawValue))"
+            )
+            return
+        }
+
+        guard let ipv4Address = Self.string(request, Key.ipv4Address),
+              let ipv4Gateway = Self.string(request, Key.ipv4Gateway),
+              let macAddress = Self.string(request, Key.macAddress)
+        else {
+            SharedVmnetNetwork.releaseVmnetReference(networkReference)
+            failRun(
+                connection: connection, runIdentifier: runIdentifier,
+                stdinHandle: stdinHandle, stdoutHandle: stdoutHandle, stderrHandle: stderrHandle,
+                message: "missing network endpoint fields"
+            )
+            return
+        }
+        let mtu = UInt32(xpc_dictionary_get_uint64(request, Key.mtu))
+
+        let context = RunContext(
+            broker: self,
+            connection: connection,
+            runIdentifier: runIdentifier,
+            options: options,
+            networkReference: networkReference,
+            ipv4Address: ipv4Address,
+            ipv4Gateway: ipv4Gateway,
+            macAddress: macAddress,
+            mtu: mtu,
+            stdinHandle: stdinHandle,
+            stdoutHandle: stdoutHandle,
+            stderrHandle: stderrHandle
+        )
+
+        guard register(context, connection: connection) else {
+            // A run with this identifier is already active; fail the duplicate immediately.
+            context.complete(exitCode: 125, message: "duplicate run identifier '\(runIdentifier)'")
+            return
+        }
+        xpc_transaction_begin()
+        context.markRegistered()
+
+        let task = Task { [context] in
+            let (exitCode, message) = await context.runContainer()
+            context.complete(exitCode: exitCode, message: message)
+        }
+        context.setTask(task)
+    }
+
+    private func handleCancel(connection: xpc_connection_t, request: xpc_object_t) {
+        let connectionID = ObjectIdentifier(connection)
+        let runIdentifier = Self.string(request, Key.runIdentifier) ?? ""
+        lock.lock()
+        let belongs = connectionRuns[connectionID]?.contains(runIdentifier) ?? false
+        let context = belongs ? runs[runIdentifier] : nil
+        lock.unlock()
+        context?.cancelTask()
+        sendReply(connection: connection, request: request, ok: true, runIdentifier: runIdentifier)
+    }
+
+    private func handleResize(connection: xpc_connection_t, request: xpc_object_t) {
+        let connectionID = ObjectIdentifier(connection)
+        let runIdentifier = Self.string(request, Key.runIdentifier) ?? ""
+        let rawColumns = xpc_dictionary_get_uint64(request, Key.columns)
+        let rawRows = xpc_dictionary_get_uint64(request, Key.rows)
+        guard rawColumns > 0, rawColumns <= UInt16.max,
+              rawRows > 0, rawRows <= UInt16.max else {
+            sendReply(connection: connection, request: request, error: "invalid terminal size", runIdentifier: runIdentifier)
+            return
+        }
+        lock.lock()
+        let belongs = connectionRuns[connectionID]?.contains(runIdentifier) ?? false
+        let context = belongs ? runs[runIdentifier] : nil
+        lock.unlock()
+        context?.resize(columns: UInt16(rawColumns), rows: UInt16(rawRows))
+        sendReply(connection: connection, request: request, ok: context != nil, runIdentifier: runIdentifier)
+    }
+
+    private func handleShutdown(connection: xpc_connection_t, request: xpc_object_t) {
+        sendReply(connection: connection, request: request, ok: true)
+        let contexts = cancelAll(for: connection)
+        log("runtime[\(getpid())]: shutdown requested, cancelling \(contexts.count) run(s) for this connection")
+    }
+
+    private func cancelAll(for connection: xpc_connection_t) -> [RunContext] {
+        let connectionID = ObjectIdentifier(connection)
+        lock.lock()
+        let runIdentifiers = connectionRuns[connectionID] ?? []
+        let contexts = runIdentifiers.compactMap { runs[$0] }
+        lock.unlock()
+        for context in contexts {
+            context.cancelTask()
+        }
+        return contexts
+    }
+
+    /// Closes the duplicated stdio handles, writes the failure to the supplied stderr,
+    /// and sends an exit event. Used for setup failures that occur before a run is
+    /// registered (no transaction to balance).
+    private func failRun(
+        connection: xpc_connection_t,
+        runIdentifier: String,
+        stdinHandle: FileHandle,
+        stdoutHandle: FileHandle,
+        stderrHandle: FileHandle,
+        message: String
+    ) {
+        let line = "ghostvm-container-runtime: \(message)\n"
+        try? stderrHandle.write(contentsOf: Data(line.utf8))
+        try? stdoutHandle.close()
+        try? stderrHandle.close()
+        try? stdinHandle.close()
+        sendExit(connection: connection, runIdentifier: runIdentifier, exitCode: 125, message: message)
+        log("runtime[\(getpid())]: run '\(runIdentifier)' rejected during setup: \(message)")
+    }
+
+    private func sendReply(
+        connection: xpc_connection_t,
+        request: xpc_object_t,
+        ok: Bool = false,
+        error: String? = nil,
+        runIdentifier: String? = nil
+    ) {
+        let reply = xpc_dictionary_create_reply(request) ?? xpc_dictionary_create_empty()
+        if ok {
+            xpc_dictionary_set_bool(reply, Key.ok, true)
+        }
+        if let error {
+            xpc_dictionary_set_string(reply, Key.error, error)
+        }
+        if let runIdentifier {
+            xpc_dictionary_set_string(reply, Key.runIdentifier, runIdentifier)
+        }
+        xpc_connection_send_message(connection, reply)
+    }
+
+    private func sendExit(
+        connection: xpc_connection_t,
+        runIdentifier: String,
+        exitCode: Int32,
+        message: String?
+    ) {
+        let event = xpc_dictionary_create_empty()
+        xpc_dictionary_set_string(event, Key.operation, Operation.exit)
+        xpc_dictionary_set_string(event, Key.runIdentifier, runIdentifier)
+        xpc_dictionary_set_int64(event, Key.exitCode, Int64(exitCode))
+        if let message {
+            xpc_dictionary_set_string(event, Key.error, message)
+        }
+        xpc_connection_send_message(connection, event)
+    }
+
+    private static func string(_ dictionary: xpc_object_t, _ key: String) -> String? {
+        guard let value = xpc_dictionary_get_string(dictionary, key) else { return nil }
+        return String(cString: value)
+    }
+
+    private static func decodeArguments(_ request: xpc_object_t) throws -> [String] {
+        guard let value = xpc_dictionary_get_value(request, Key.arguments) else {
+            return []
+        }
+        let length = xpc_data_get_length(value)
+        guard length > 0, let bytes = xpc_data_get_bytes_ptr(value) else {
+            return []
+        }
+        let data = Data(bytes: bytes, count: length)
+        return try JSONDecoder().decode([String].self, from: data)
+    }
+}
+
+nonisolated(unsafe) private let broker = RuntimeBroker()
+
+nonisolated private func log(_ message: String) {
+    NSLog("%@", message)
+}
+
+/// `xpc_connection_t` is not Sendable in the XPC overlay, but each connection is
+/// retained by the runtime for the lifetime of its event handler and serviced
+/// serially on its target queue. This box lets the handler capture one safely.
+private struct ConnectionBox: @unchecked Sendable {
+    let value: xpc_connection_t
+}
+
+nonisolated private func acceptConnection(_ connection: xpc_connection_t) {
+    let connectionBox = ConnectionBox(value: connection)
+    xpc_connection_set_event_handler(connection) { event in
+        if xpc_get_type(event) == XPC_TYPE_DICTIONARY {
+            broker.handle(connection: connectionBox.value, request: event)
+        } else {
+            broker.disconnect(connection: connectionBox.value)
+        }
+    }
+    xpc_connection_activate(connection)
+}
+
+@main
+private struct GhostVMContainerRuntime {
+    nonisolated static func main() {
+        log("runtime[\(getpid())]: container runtime service starting")
+        xpc_main(acceptConnection)
+    }
+}
diff --git a/macOS/GhostVMContainerRuntime/entitlements.plist b/macOS/GhostVMContainerRuntime/entitlements.plist
new file mode 100644
index 0000000..dccbe21
--- /dev/null
+++ b/macOS/GhostVMContainerRuntime/entitlements.plist
@@ -0,0 +1,10 @@
+
+
+
+
+	com.apple.security.virtualization
+	
+	com.apple.vm.networking
+	
+
+
diff --git a/macOS/GhostVMFS/FileSystemExtension.swift b/macOS/GhostVMFS/FileSystemExtension.swift
new file mode 100644
index 0000000..8d5e064
--- /dev/null
+++ b/macOS/GhostVMFS/FileSystemExtension.swift
@@ -0,0 +1,9 @@
+import ExtensionFoundation
+import FSKit
+
+@main
+struct GhostVMFileSystemExtension: UnaryFileSystemExtension {
+    var fileSystem: GhostVMFileSystem {
+        GhostVMFileSystem()
+    }
+}
diff --git a/macOS/GhostVMFS/GhostVMFSClient.swift b/macOS/GhostVMFS/GhostVMFSClient.swift
new file mode 100644
index 0000000..f814ad1
--- /dev/null
+++ b/macOS/GhostVMFS/GhostVMFSClient.swift
@@ -0,0 +1,124 @@
+import Foundation
+import FSKit
+
+enum GhostVMFileType: String, Codable {
+    case file
+    case directory
+    case symbolicLink
+    case other
+}
+
+struct GhostVMFileMetadata: Codable {
+    let name: String
+    let type: GhostVMFileType
+    let size: UInt64
+    let mode: UInt32
+    let uid: UInt32
+    let gid: UInt32
+    let inode: UInt64
+    let device: UInt64
+    let linkCount: UInt32
+    let modifiedSeconds: Int
+    let modifiedNanoseconds: Int32
+}
+
+struct GhostVMDirectoryMetadata: Codable {
+    let path: String
+    let entries: [GhostVMFileMetadata]
+}
+
+struct GhostVMFSClient: Sendable {
+    private let baseURL: URL
+    private let session: URLSession
+
+    init(resourceURL: URL) throws {
+        guard
+            resourceURL.scheme == "ghostvm",
+            resourceURL.host == "127.0.0.1",
+            let port = resourceURL.port,
+            resourceURL.pathComponents.count == 2,
+            let exportID = resourceURL.pathComponents.last,
+            !exportID.isEmpty
+        else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+
+        var components = URLComponents()
+        components.scheme = "http"
+        components.host = "127.0.0.1"
+        components.port = port
+        components.path = "/v1/\(exportID)"
+        guard let baseURL = components.url else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+        self.baseURL = baseURL
+
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.timeoutIntervalForRequest = 10
+        configuration.timeoutIntervalForResource = 30
+        self.session = URLSession(configuration: configuration)
+    }
+
+    func metadata(path: String) async throws -> GhostVMFileMetadata {
+        try await JSONDecoder().decode(GhostVMFileMetadata.self, from: request(operation: "metadata", path: path))
+    }
+
+    func list(path: String) async throws -> GhostVMDirectoryMetadata {
+        try await JSONDecoder().decode(GhostVMDirectoryMetadata.self, from: request(operation: "list", path: path))
+    }
+
+    func read(path: String, offset: UInt64, length: Int) async throws -> Data {
+        try await request(
+            operation: "read",
+            path: path,
+            extraQuery: [
+                URLQueryItem(name: "offset", value: String(offset)),
+                URLQueryItem(name: "length", value: String(length)),
+            ]
+        )
+    }
+
+    func readSymbolicLink(path: String) async throws -> String {
+        let data = try await request(operation: "readlink", path: path)
+        guard let target = String(data: data, encoding: .utf8), !target.contains("\0") else {
+            throw fs_errorForPOSIXError(EIO)
+        }
+        return target
+    }
+
+    private func request(
+        operation: String,
+        path: String,
+        extraQuery: [URLQueryItem] = []
+    ) async throws -> Data {
+        let operationURL = baseURL.appendingPathComponent(operation)
+        guard var components = URLComponents(url: operationURL, resolvingAgainstBaseURL: false) else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+        components.queryItems = [URLQueryItem(name: "path", value: path)] + extraQuery
+        guard let url = components.url else { throw fs_errorForPOSIXError(EINVAL) }
+
+        do {
+            let (data, response) = try await session.data(from: url)
+            guard let response = response as? HTTPURLResponse else {
+                throw fs_errorForPOSIXError(EIO)
+            }
+            switch response.statusCode {
+            case 200:
+                return data
+            case 400:
+                throw fs_errorForPOSIXError(EINVAL)
+            case 404:
+                throw fs_errorForPOSIXError(ENOENT)
+            case 503:
+                throw fs_errorForPOSIXError(ENOTCONN)
+            default:
+                throw fs_errorForPOSIXError(EIO)
+            }
+        } catch let error as POSIXError {
+            throw error
+        } catch {
+            throw fs_errorForPOSIXError(ENOTCONN)
+        }
+    }
+}
diff --git a/macOS/GhostVMFS/GhostVMFileSystem.swift b/macOS/GhostVMFS/GhostVMFileSystem.swift
new file mode 100644
index 0000000..3a9f409
--- /dev/null
+++ b/macOS/GhostVMFS/GhostVMFileSystem.swift
@@ -0,0 +1,35 @@
+import Foundation
+import FSKit
+
+final class GhostVMFileSystem: FSUnaryFileSystem, FSUnaryFileSystemOperations {
+    func probeResource(resource: FSResource) async throws -> FSProbeResult {
+        guard let resource = resource as? FSGenericURLResource,
+              resource.url.scheme == "ghostvm",
+              resource.url.host == "127.0.0.1",
+              resource.url.port != nil,
+              resource.url.pathComponents.count == 2,
+              let resourceID = UUID(uuidString: resource.url.lastPathComponent) else {
+            return .notRecognized
+        }
+        return .usable(
+            name: "GhostVM",
+            containerID: FSContainerIdentifier(uuid: resourceID)
+        )
+    }
+
+    func loadResource(resource: FSResource, options: FSTaskOptions) async throws -> FSVolume {
+        guard let resource = resource as? FSGenericURLResource,
+              let resourceID = UUID(uuidString: resource.url.lastPathComponent) else {
+            throw fs_errorForPOSIXError(ENOTSUP)
+        }
+        let client = try GhostVMFSClient(resourceURL: resource.url)
+        containerStatus = .ready
+        return GhostVMVolume(
+            volumeID: FSVolume.Identifier(uuid: resourceID),
+            volumeName: FSFileName(string: "GhostVM"),
+            client: client
+        )
+    }
+
+    func unloadResource(resource: FSResource, options: FSTaskOptions) async throws {}
+}
diff --git a/macOS/GhostVMFS/GhostVMItem.swift b/macOS/GhostVMFS/GhostVMItem.swift
new file mode 100644
index 0000000..3071ee5
--- /dev/null
+++ b/macOS/GhostVMFS/GhostVMItem.swift
@@ -0,0 +1,13 @@
+import FSKit
+
+final class GhostVMItem: FSItem {
+    let relativePath: String
+    let parentID: FSItem.Identifier
+    var metadata: GhostVMFileMetadata
+
+    init(relativePath: String, parentID: FSItem.Identifier, metadata: GhostVMFileMetadata) {
+        self.relativePath = relativePath
+        self.parentID = parentID
+        self.metadata = metadata
+    }
+}
diff --git a/macOS/GhostVMFS/GhostVMVolume.swift b/macOS/GhostVMFS/GhostVMVolume.swift
new file mode 100644
index 0000000..c1fe1bd
--- /dev/null
+++ b/macOS/GhostVMFS/GhostVMVolume.swift
@@ -0,0 +1,248 @@
+import Foundation
+import FSKit
+
+final class GhostVMVolume: FSVolume, FSVolume.Operations, FSVolume.ReadWriteOperations {
+    private let client: GhostVMFSClient
+    private var items: [UInt64: GhostVMItem] = [:]
+    private var root: GhostVMItem?
+
+    init(volumeID: FSVolume.Identifier, volumeName: FSFileName, client: GhostVMFSClient) {
+        self.client = client
+        super.init(volumeID: volumeID, volumeName: volumeName)
+    }
+
+    var supportedVolumeCapabilities: FSVolume.SupportedCapabilities {
+        let capabilities = FSVolume.SupportedCapabilities()
+        capabilities.supportsPersistentObjectIDs = true
+        capabilities.supports64BitObjectIDs = true
+        capabilities.supports2TBFiles = true
+        capabilities.supportsSymbolicLinks = true
+        capabilities.supportsHardLinks = false
+        capabilities.supportsFastStatFS = true
+        capabilities.doesNotSupportVolumeSizes = true
+        capabilities.caseFormat = .sensitive
+        return capabilities
+    }
+
+    var volumeStatistics: FSStatFSResult {
+        let result = FSStatFSResult(fileSystemTypeName: "ghostvm")
+        result.blockSize = 4096
+        result.ioSize = 1024 * 1024
+        return result
+    }
+
+    var requestedMountOptions: FSVolume.MountOptions = .readOnly
+    var maximumLinkCount: Int { 1 }
+    var maximumNameLength: Int { 255 }
+    var restrictsOwnershipChanges: Bool { true }
+    var truncatesLongNames: Bool { false }
+    var maximumFileSize: UInt64 { UInt64.max }
+
+    func mount(options: FSTaskOptions) async throws {}
+
+    func unmount() async {
+        items.removeAll()
+        root = nil
+    }
+
+    func synchronize(flags: FSSyncFlags) async throws {}
+
+    func activate(options: FSTaskOptions) async throws -> FSItem {
+        if let root { return root }
+        let metadata = try await client.metadata(path: "")
+        let item = GhostVMItem(relativePath: "", parentID: .parentOfRoot, metadata: metadata)
+        root = item
+        items[FSItem.Identifier.rootDirectory.rawValue] = item
+        return item
+    }
+
+    func deactivate(options: FSDeactivateOptions = []) async throws {}
+
+    func attributes(_ request: FSItem.GetAttributesRequest, of item: FSItem) async throws -> FSItem.Attributes {
+        let item = try ghostItem(item)
+        item.metadata = try await client.metadata(path: item.relativePath)
+        return attributes(for: item)
+    }
+
+    func setAttributes(_ newAttributes: FSItem.SetAttributesRequest, on item: FSItem) async throws -> FSItem.Attributes {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func lookupItem(named name: FSFileName, inDirectory directory: FSItem) async throws -> (FSItem, FSFileName) {
+        let directory = try ghostItem(directory)
+        guard directory.metadata.type == .directory, let nameString = name.string, isValidName(nameString) else {
+            throw fs_errorForPOSIXError(ENOENT)
+        }
+        let path = childPath(nameString, parent: directory.relativePath)
+        let metadata = try await client.metadata(path: path)
+        return (item(path: path, parent: identifier(for: directory), metadata: metadata), name)
+    }
+
+    func reclaimItem(_ item: FSItem) async throws {}
+
+    func readSymbolicLink(_ item: FSItem) async throws -> FSFileName {
+        let item = try ghostItem(item)
+        guard item.metadata.type == .symbolicLink else { throw fs_errorForPOSIXError(EINVAL) }
+        return FSFileName(string: try await client.readSymbolicLink(path: item.relativePath))
+    }
+
+    func createItem(
+        named name: FSFileName,
+        type: FSItem.ItemType,
+        inDirectory directory: FSItem,
+        attributes: FSItem.SetAttributesRequest
+    ) async throws -> (FSItem, FSFileName) {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func createSymbolicLink(
+        named name: FSFileName,
+        inDirectory directory: FSItem,
+        attributes: FSItem.SetAttributesRequest,
+        linkContents contents: FSFileName
+    ) async throws -> (FSItem, FSFileName) {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func createLink(to item: FSItem, named name: FSFileName, inDirectory directory: FSItem) async throws -> FSFileName {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func removeItem(_ item: FSItem, named name: FSFileName, fromDirectory directory: FSItem) async throws {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func renameItem(
+        _ item: FSItem,
+        inDirectory sourceDirectory: FSItem,
+        named sourceName: FSFileName,
+        to destinationName: FSFileName,
+        inDirectory destinationDirectory: FSItem,
+        overItem: FSItem?
+    ) async throws -> FSFileName {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func enumerateDirectory(
+        _ directory: FSItem,
+        startingAt cookie: FSDirectoryCookie,
+        verifier: FSDirectoryVerifier,
+        attributes requestedAttributes: FSItem.GetAttributesRequest?,
+        packer: FSDirectoryEntryPacker
+    ) async throws -> FSDirectoryVerifier {
+        let directory = try ghostItem(directory)
+        let listing = try await client.list(path: directory.relativePath)
+        let start = Int(cookie.rawValue)
+        guard start <= listing.entries.count else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+
+        for index in start.. Int {
+        let item = try ghostItem(item)
+        guard offset >= 0, length >= 0 else { throw fs_errorForPOSIXError(EINVAL) }
+        guard item.metadata.type == .file else {
+            throw fs_errorForPOSIXError(item.metadata.type == .directory ? EISDIR : EINVAL)
+        }
+        // The guest and loopback bridges cap each range read at 1 MiB.
+        // Returning a partial read is valid and lets FSKit request the remainder.
+        let requestLength = min(length, 1024 * 1024)
+        let data = try await client.read(path: item.relativePath, offset: UInt64(offset), length: requestLength)
+        return buffer.withUnsafeMutableBytes { destination in
+            let count = min(destination.count, data.count)
+            data.copyBytes(to: destination.bindMemory(to: UInt8.self), count: count)
+            return count
+        }
+    }
+
+    func write(contents: Data, to item: FSItem, at offset: off_t) async throws -> Int {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    private func ghostItem(_ item: FSItem) throws -> GhostVMItem {
+        guard let item = item as? GhostVMItem else { throw fs_errorForPOSIXError(ESTALE) }
+        return item
+    }
+
+    private func item(path: String, parent: FSItem.Identifier, metadata: GhostVMFileMetadata) -> GhostVMItem {
+        let id = identifier(device: metadata.device, inode: metadata.inode, path: path)
+        if let existing = items[id.rawValue] {
+            existing.metadata = metadata
+            return existing
+        }
+        let item = GhostVMItem(relativePath: path, parentID: parent, metadata: metadata)
+        items[id.rawValue] = item
+        return item
+    }
+
+    private func attributes(for item: GhostVMItem) -> FSItem.Attributes {
+        let result = FSItem.Attributes()
+        result.type = itemType(item.metadata.type)
+        result.mode = item.metadata.mode
+        result.uid = item.metadata.uid
+        result.gid = item.metadata.gid
+        result.linkCount = item.metadata.linkCount
+        result.size = item.metadata.size
+        result.allocSize = item.metadata.size
+        result.fileID = identifier(for: item)
+        result.parentID = item.parentID
+        result.modifyTime = timespec(
+            tv_sec: item.metadata.modifiedSeconds,
+            tv_nsec: Int(item.metadata.modifiedNanoseconds)
+        )
+        return result
+    }
+
+    private func identifier(for item: GhostVMItem) -> FSItem.Identifier {
+        if item.relativePath.isEmpty { return .rootDirectory }
+        return identifier(device: item.metadata.device, inode: item.metadata.inode, path: item.relativePath)
+    }
+
+    private func identifier(device: UInt64, inode: UInt64, path: String) -> FSItem.Identifier {
+        var value = device ^ (inode &* 0x9E37_79B9_7F4A_7C15)
+        for byte in path.utf8 {
+            value = (value ^ UInt64(byte)) &* 0x100_0000_01B3
+        }
+        value = max(value, FSItem.Identifier.rootDirectory.rawValue + 1)
+        return FSItem.Identifier(rawValue: value) ?? .invalid
+    }
+
+    private func itemType(_ type: GhostVMFileType) -> FSItem.ItemType {
+        switch type {
+        case .file: return .file
+        case .directory: return .directory
+        case .symbolicLink: return .symlink
+        case .other: return .unknown
+        }
+    }
+
+    private func childPath(_ child: String, parent: String) -> String {
+        parent.isEmpty ? child : "\(parent)/\(child)"
+    }
+
+    private func isValidName(_ name: String) -> Bool {
+        !name.isEmpty && name != "." && name != ".." && !name.contains("/") && !name.contains("\0")
+    }
+}
diff --git a/macOS/GhostVMFS/Info.template.plist b/macOS/GhostVMFS/Info.template.plist
new file mode 100644
index 0000000..81c73b9
--- /dev/null
+++ b/macOS/GhostVMFS/Info.template.plist
@@ -0,0 +1,51 @@
+
+
+
+
+	CFBundleDevelopmentRegion
+	$(DEVELOPMENT_LANGUAGE)
+	CFBundleExecutable
+	$(EXECUTABLE_NAME)
+	CFBundleIdentifier
+	$(PRODUCT_BUNDLE_IDENTIFIER)
+	CFBundleInfoDictionaryVersion
+	6.0
+	CFBundleName
+	$(PRODUCT_NAME)
+	CFBundlePackageType
+	XPC!
+	EXAppExtensionAttributes
+	
+		EXExtensionPointIdentifier
+		com.apple.fskit.fsmodule
+		FSMediaTypes
+		
+		FSPersonalities
+		
+			GhostVM
+			
+				FSName
+				ghostvm
+				FSfileObjectsAreCaseSensitive
+				
+			
+		
+		FSRequiresSecurityScopedPathURLResources
+		
+		FSShortName
+		ghostvm
+		FSSupportedSchemes
+		
+			ghostvm
+		
+		FSSupportsBlockResources
+		
+		FSSupportsGenericURLResources
+		
+		FSSupportsPathURLs
+		
+		FSSupportsServerURLs
+		
+	
+
+
diff --git a/macOS/GhostVMFS/entitlements.plist b/macOS/GhostVMFS/entitlements.plist
new file mode 100644
index 0000000..93e61a7
--- /dev/null
+++ b/macOS/GhostVMFS/entitlements.plist
@@ -0,0 +1,12 @@
+
+
+
+
+	com.apple.developer.fskit.fsmodule
+	
+	com.apple.security.app-sandbox
+	
+	com.apple.security.network.client
+	
+
+
diff --git a/macOS/GhostVMHelper/main.swift b/macOS/GhostVMHelper/main.swift
index a60fbb4..593dc06 100644
--- a/macOS/GhostVMHelper/main.swift
+++ b/macOS/GhostVMHelper/main.swift
@@ -39,6 +39,8 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
     private var virtualMachine: VZVirtualMachine?
     private var vmQueue: DispatchQueue?
     private var layout: VMFileLayout?
+    private var sharedVmnetNetwork: SharedVmnetNetwork?
+    private var hostContainersEnabled = false
     private var pendingWindowStateSaveWorkItem: DispatchWorkItem?
     private var shouldEnterFullScreenOnShow = false
     private let windowConfigQueue = DispatchQueue(label: "org.ghostvm.helper.windowConfig", qos: .utility)
@@ -61,6 +63,8 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
     private var healthCheckService: HealthCheckService?
     private var autoPortMapService: AutoPortMapService?
     private var hostAPIService: HostAPIService?
+    private var guestFileSystemBridgeService: GuestFileSystemBridgeService?
+    private var containerBridgeService: ContainerBridgeService?
     private var bridgeMonitorService: BridgeMonitorService?
     private var autoPortMapCancellable: AnyCancellable?
     private var fileTransferCancellable: AnyCancellable?
@@ -1333,9 +1337,44 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
                 try store.save(config)
             }
 
+            // Container-enabled NAT VMs own one vmnet network shared by the
+            // macOS guest and every container launched for this VM.
+            let networkConfig = config.networkConfig ?? NetworkConfig.defaultConfig
+            hostContainersEnabled = config.hostContainersEnabled && networkConfig.mode == .nat
+            if hostContainersEnabled {
+                guard let vmMACAddress = config.macAddress else {
+                    throw VMError.message("NAT networking requires a persistent VM MAC address.")
+                }
+                let networkIdentifier = String(vmBundleURL.path.stableHash)
+                let sharedNetwork = try SharedVmnetNetwork(
+                    networkIdentifier: networkIdentifier,
+                    vmMACAddress: vmMACAddress,
+                    preferredIPv4Subnet: networkConfig.vmnetIPv4Subnet
+                )
+                sharedVmnetNetwork = sharedNetwork
+                if networkConfig.vmnetIPv4Subnet != sharedNetwork.ipv4Subnet {
+                    var updatedNetworkConfig = networkConfig
+                    updatedNetworkConfig.vmnetIPv4Subnet = sharedNetwork.ipv4Subnet
+                    config.networkConfig = updatedNetworkConfig
+                    config.modifiedAt = Date()
+                    try store.save(config)
+                }
+                NSLog(
+                    "GhostVMHelper: Created shared vmnet network %@ (%@, gateway %@)",
+                    networkIdentifier,
+                    sharedNetwork.ipv4Subnet,
+                    sharedNetwork.ipv4Gateway
+                )
+            }
+
             // Build VM configuration
             let builder = VMConfigurationBuilder(layout: layout!, storedConfig: config)
-            let vmConfiguration = try builder.makeConfiguration(headless: false, connectSerialToStandardIO: false, runtimeSharedFolder: nil)
+            let vmConfiguration = try builder.makeConfiguration(
+                headless: false,
+                connectSerialToStandardIO: false,
+                runtimeSharedFolder: nil,
+                natNetworkAttachment: sharedVmnetNetwork?.attachment
+            )
 
             // Create VM
             vmQueue = DispatchQueue(label: "ghostvm.helper.\(vmName)")
@@ -1617,6 +1656,8 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
             ownsLock = false
         }
         vmView?.virtualMachine = nil
+        sharedVmnetNetwork?.close()
+        sharedVmnetNetwork = nil
     }
 
     // MARK: - Services
@@ -1633,6 +1674,35 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
         apiService.start(client: client, vmWindow: self.window)
         self.hostAPIService = apiService
 
+        // 1c. Container bridge: guest-initiated vsock control listener (port 5004).
+        if hostContainersEnabled {
+            NSLog("GhostVMHelper: host containers enabled — starting container bridge listener on vsock port \(ContainerBridgeConstants.port)")
+            let fileSystemBridge = GuestFileSystemBridgeService()
+            do {
+                try fileSystemBridge.start(client: client)
+                self.guestFileSystemBridgeService = fileSystemBridge
+                if let debugPath = UserDefaults.standard.string(forKey: "GuestFilesystemExportPath") {
+                    let resource = try fileSystemBridge.registerExport(guestPath: debugPath)
+                    NSLog("GhostVMHelper: Debug guest filesystem resource: \(resource.resourceURL.absoluteString)")
+                }
+            } catch {
+                NSLog("GhostVMHelper: Failed to start guest filesystem bridge: \(error.localizedDescription)")
+            }
+            if let sharedNetwork = sharedVmnetNetwork {
+                let bridge = ContainerBridgeService(
+                    vm: vm,
+                    vmQueue: queue,
+                    vmHash: String(vmBundleURL.path.stableHash),
+                    sharedNetwork: sharedNetwork,
+                    fileSystemBridge: fileSystemBridge
+                )
+                bridge.start()
+                self.containerBridgeService = bridge
+            } else {
+                NSLog("GhostVMHelper: Container bridge requires a shared vmnet network")
+            }
+        }
+
         // 2. Guest health polling via the unified HTTP server on vsock port 5000
         let hcService = HealthCheckService()
         hcService.start(client: client)
@@ -1839,6 +1909,12 @@ final class HelperAppDelegate: NSObject, NSApplicationDelegate, NSWindowDelegate
         eventStreamService?.stop()
         eventStreamService = nil
 
+        containerBridgeService?.stop()
+        containerBridgeService = nil
+
+        guestFileSystemBridgeService?.stop()
+        guestFileSystemBridgeService = nil
+
         hostAPIService?.stop()
         hostAPIService = nil
 
@@ -2325,6 +2401,17 @@ private func formattedBuildDate(from version: String) -> String? {
 // which PortForwardListener handles gracefully.
 signal(SIGPIPE, SIG_IGN)
 
+if CommandLine.arguments.contains("--container-runtime-xpc-self-test") {
+    do {
+        try ContainerRuntimeXPCClient.ping()
+        print("GhostVMContainerRuntime XPC: ready")
+        exit(0)
+    } catch {
+        FileHandle.standardError.write(Data("GhostVMContainerRuntime XPC: \(error.localizedDescription)\n".utf8))
+        exit(1)
+    }
+}
+
 MainActor.assumeIsolated {
     let app = HelperApplication.shared
     let delegate = HelperAppDelegate()
diff --git a/macOS/GhostVMImageFetch/FetchMain.swift b/macOS/GhostVMImageFetch/FetchMain.swift
new file mode 100644
index 0000000..c4ff1bb
--- /dev/null
+++ b/macOS/GhostVMImageFetch/FetchMain.swift
@@ -0,0 +1,194 @@
+import Containerization
+import ContainerizationArchive
+import ContainerizationError
+import ContainerizationExtras
+import ContainerizationOCI
+import CryptoKit
+import Foundation
+
+private let initfsReference = "ghcr.io/apple/containerization/vminit:0.40.1"
+
+private func writeStatus(_ message: String) {
+    try? FileHandle.standardError.write(contentsOf: Data("ghostvm-image-fetch: \(message)\n".utf8))
+}
+
+private actor ImagePullProgress {
+    private static let reportInterval: Int64 = 4 * 1024 * 1024
+
+    private let reference: String
+    private var completedBytes: Int64 = 0
+    private var totalBytes: Int64 = 0
+    private var lastReportedBytes: Int64 = 0
+
+    init(reference: String) {
+        self.reference = reference
+    }
+
+    func update(_ events: [ProgressEvent]) {
+        for event in events {
+            switch event {
+            case .addSize(let value): completedBytes += value
+            case .addTotalSize(let value): totalBytes += value
+            case .addItems, .addTotalItems: break
+            }
+        }
+
+        if completedBytes - lastReportedBytes >= Self.reportInterval {
+            report()
+        }
+    }
+
+    func finish() {
+        report(force: true)
+    }
+
+    private func report(force: Bool = false) {
+        guard force || completedBytes != lastReportedBytes else { return }
+        lastReportedBytes = completedBytes
+        let completed = ByteCountFormatter.string(fromByteCount: completedBytes, countStyle: .file)
+        if totalBytes > 0 {
+            let total = ByteCountFormatter.string(fromByteCount: totalBytes, countStyle: .file)
+            let percent = min(100, Int((Double(completedBytes) / Double(totalBytes)) * 100))
+            writeStatus("Pulling \(reference): \(completed) / \(total) (\(percent)%)")
+        } else {
+            writeStatus("Pulling \(reference): \(completed)")
+        }
+    }
+}
+
+private struct FetchOptions {
+    let root: URL
+    let kernel: URL
+    let image: String
+
+    static func parse(_ arguments: [String]) throws -> FetchOptions {
+        guard arguments.first == "fetch" else { throw FetchError.usage }
+        var root: String?
+        var kernel: String?
+        var image: String?
+        var index = 1
+        while index < arguments.count {
+            guard index + 1 < arguments.count else { throw FetchError.usage }
+            switch arguments[index] {
+            case "--root": root = arguments[index + 1]
+            case "--kernel": kernel = arguments[index + 1]
+            case "--image": image = arguments[index + 1]
+            default: throw FetchError.usage
+            }
+            index += 2
+        }
+        guard let root, let kernel, let image else { throw FetchError.usage }
+        return FetchOptions(
+            root: URL(fileURLWithPath: root, isDirectory: true),
+            kernel: URL(fileURLWithPath: kernel),
+            image: image
+        )
+    }
+}
+
+private enum FetchError: Error, LocalizedError {
+    case usage
+    case unqualifiedImageReference(String)
+    case kernelDownloadFailed
+    case kernelDigestMismatch
+
+    var errorDescription: String? {
+        switch self {
+        case .usage:
+            return "usage: ghostvm-image-fetch fetch --root PATH --kernel PATH --image IMAGE"
+        case .unqualifiedImageReference(let reference):
+            return "image reference must include an explicit registry domain: \(reference)"
+        case .kernelDownloadFailed:
+            return "failed to download the container kernel"
+        case .kernelDigestMismatch:
+            return "downloaded container kernel archive failed SHA-256 verification"
+        }
+    }
+}
+
+@main
+private struct GhostVMImageFetch {
+    static func main() async {
+        do {
+            let options = try FetchOptions.parse(Array(CommandLine.arguments.dropFirst()))
+            let references = try [options.image, initfsReference].map(normalizeReference)
+            try await prepareKernel(at: options.kernel)
+            let store = try ImageStore(path: options.root)
+            for reference in references {
+                writeStatus("Resolving image \(reference)...")
+                do {
+                    _ = try await store.get(reference: reference)
+                    writeStatus("Image cached: \(reference)")
+                    continue
+                } catch let error as ContainerizationError where error.code == .notFound {
+                    let progress = ImagePullProgress(reference: reference)
+                    _ = try await store.pull(reference: reference, progress: { events in
+                        await progress.update(events)
+                    })
+                    await progress.finish()
+                }
+                writeStatus("Image ready: \(reference)")
+            }
+            writeStatus("Fetch complete.")
+        } catch {
+            let message = (error as? LocalizedError)?.errorDescription ?? String(describing: error)
+            try? FileHandle.standardError.write(contentsOf: Data("ghostvm-image-fetch: \(message)\n".utf8))
+            exit(125)
+        }
+    }
+
+    private static func prepareKernel(at destination: URL) async throws {
+        if FileManager.default.isReadableFile(atPath: destination.path) {
+            writeStatus("Kernel ready (cached): \(destination.path)")
+            return
+        }
+
+        let archiveURL = URL(string: "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst")!
+        let expectedDigest = "f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
+        let kernelPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
+        writeStatus("Downloading container kernel...")
+        let (downloadURL, response) = try await URLSession.shared.download(from: archiveURL)
+        guard let response = response as? HTTPURLResponse, response.statusCode == 200 else {
+            throw FetchError.kernelDownloadFailed
+        }
+        writeStatus("Verifying container kernel...")
+        guard try sha256(of: downloadURL) == expectedDigest else {
+            throw FetchError.kernelDigestMismatch
+        }
+
+        var reader = try ArchiveReader(file: downloadURL)
+        var (entry, kernelData) = try reader.extractFile(path: kernelPath)
+        if entry.fileType == .symbolicLink, let link = entry.symlinkTarget {
+            let target = URL(filePath: kernelPath)
+                .deletingLastPathComponent()
+                .appending(path: link)
+                .standardized
+                .relativePath
+            reader = try ArchiveReader(file: downloadURL)
+            (entry, kernelData) = try reader.extractFile(path: target)
+        }
+        _ = entry
+        try FileManager.default.createDirectory(at: destination.deletingLastPathComponent(), withIntermediateDirectories: true)
+        try kernelData.write(to: destination, options: .atomic)
+        writeStatus("Kernel ready: \(destination.path)")
+    }
+
+    private static func normalizeReference(_ value: String) throws -> String {
+        let reference = try Reference.parse(value)
+        guard reference.domain != nil else {
+            throw FetchError.unqualifiedImageReference(value)
+        }
+        reference.normalize()
+        return reference.description
+    }
+
+    private static func sha256(of url: URL) throws -> String {
+        let handle = try FileHandle(forReadingFrom: url)
+        defer { try? handle.close() }
+        var hasher = SHA256()
+        while let data = try handle.read(upToCount: 1024 * 1024), !data.isEmpty {
+            hasher.update(data: data)
+        }
+        return hasher.finalize().map { String(format: "%02x", $0) }.joined()
+    }
+}
diff --git a/macOS/GhostVMKit/Configuration/VMConfigurationBuilder.swift b/macOS/GhostVMKit/Configuration/VMConfigurationBuilder.swift
index a4fae99..b9db5d5 100644
--- a/macOS/GhostVMKit/Configuration/VMConfigurationBuilder.swift
+++ b/macOS/GhostVMKit/Configuration/VMConfigurationBuilder.swift
@@ -13,7 +13,12 @@ public final class VMConfigurationBuilder {
         self.storedConfig = storedConfig
     }
 
-    public func makeConfiguration(headless: Bool, connectSerialToStandardIO: Bool, runtimeSharedFolder: RuntimeSharedFolderOverride?) throws -> VZVirtualMachineConfiguration {
+    public func makeConfiguration(
+        headless: Bool,
+        connectSerialToStandardIO: Bool,
+        runtimeSharedFolder: RuntimeSharedFolderOverride?,
+        natNetworkAttachment: VZNetworkDeviceAttachment? = nil
+    ) throws -> VZVirtualMachineConfiguration {
         let config = VZVirtualMachineConfiguration()
 
         config.bootLoader = VZMacOSBootLoader()
@@ -63,7 +68,7 @@ public final class VMConfigurationBuilder {
         switch networkConfig.mode {
         case .nat:
             print("[VMConfigurationBuilder] Using NAT networking")
-            networkDevice.attachment = VZNATNetworkDeviceAttachment()
+            networkDevice.attachment = natNetworkAttachment ?? VZNATNetworkDeviceAttachment()
 
         case .bridged:
             print("[VMConfigurationBuilder] Attempting bridged networking with interface: \(networkConfig.bridgeInterfaceIdentifier ?? "nil")")
diff --git a/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift b/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift
new file mode 100644
index 0000000..986152c
--- /dev/null
+++ b/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift
@@ -0,0 +1,207 @@
+import Foundation
+
+/// Constants for the guest-initiated container control channel.
+///
+/// The host (GhostVMHelper) listens on this vsock port via VZVirtioSocketListener.
+/// A guest CLI connects to VMADDR_CID_HOST on this port, sends one NDJSON request,
+/// and receives one NDJSON response object per line.
+public enum ContainerBridgeConstants {
+    /// Vsock port the host listens on for guest-initiated container requests.
+    /// Ports 5000-5003 are used by guest-side GhostTools listeners.
+    public static let port: UInt32 = 5004
+
+    /// Wire protocol version. Version 2 adds framed stdin and TTY resize events.
+    public static let protocolVersion = 2
+    public static let minimumProtocolVersion = 1
+
+    /// Maximum accepted size of a single request line in bytes (before the newline).
+    public static let maxRequestLineBytes = 64 * 1024
+}
+
+/// A single guest request: run an image with a command.
+///
+/// Wire format (one JSON object on one line):
+/// {"version":2,"operation":"run","image":"alpine","command":["sh"],"stdin":true,"tty":true,"columns":120,"rows":40}
+/// Version 1 carries raw stdin after the request line. Version 2 carries NDJSON
+/// input frames so terminal resize events can share the same connection safely.
+public struct ContainerRunRequest: Codable, Equatable, Sendable {
+    public var version: Int
+    public var operation: String
+    public var image: String
+    public var command: [String]
+    public var stdin: Bool?
+    public var tty: Bool?
+    public var columns: UInt16?
+    public var rows: UInt16?
+    public var volumes: [ContainerRunVolume]?
+
+    public init(
+        version: Int,
+        operation: String,
+        image: String,
+        command: [String],
+        stdin: Bool? = nil,
+        tty: Bool? = nil,
+        columns: UInt16? = nil,
+        rows: UInt16? = nil,
+        volumes: [ContainerRunVolume]? = nil
+    ) {
+        self.version = version
+        self.operation = operation
+        self.image = image
+        self.command = command
+        self.stdin = stdin
+        self.tty = tty
+        self.columns = columns
+        self.rows = rows
+        self.volumes = volumes
+    }
+
+    /// Decodes one request line (without the trailing newline).
+    public static func decode(line: Data) throws -> ContainerRunRequest {
+        guard !line.isEmpty else { throw ContainerProtocolError.emptyRequest }
+        do {
+            return try JSONDecoder().decode(ContainerRunRequest.self, from: line)
+        } catch {
+            throw ContainerProtocolError.malformedRequest(String(describing: error))
+        }
+    }
+
+    /// Encodes as one NDJSON line (JSON object + '\n').
+    public func encodeLine() throws -> Data {
+        var data = try JSONEncoder().encode(self)
+        data.append(0x0A)
+        return data
+    }
+}
+
+public enum ContainerInputType: String, Codable, Sendable {
+    case stdin
+    case stdinClose
+    case resize
+}
+
+/// A version 2 guest-to-host input frame.
+public struct ContainerInputFrame: Codable, Equatable, Sendable {
+    public var version: Int
+    public var type: ContainerInputType
+    public var data: String?
+    public var columns: UInt16?
+    public var rows: UInt16?
+
+    public init(type: ContainerInputType, data: String? = nil, columns: UInt16? = nil, rows: UInt16? = nil) {
+        self.version = ContainerBridgeConstants.protocolVersion
+        self.type = type
+        self.data = data
+        self.columns = columns
+        self.rows = rows
+    }
+
+    public static func stdin(_ chunk: Data) -> ContainerInputFrame {
+        ContainerInputFrame(type: .stdin, data: chunk.base64EncodedString())
+    }
+
+    public static func resize(columns: UInt16, rows: UInt16) -> ContainerInputFrame {
+        ContainerInputFrame(type: .resize, columns: columns, rows: rows)
+    }
+
+    public func encodeLine() throws -> Data {
+        var data = try JSONEncoder().encode(self)
+        data.append(0x0A)
+        return data
+    }
+
+    public static func decode(line: Data) throws -> ContainerInputFrame {
+        do {
+            return try JSONDecoder().decode(ContainerInputFrame.self, from: line)
+        } catch {
+            throw ContainerProtocolError.malformedInputFrame(String(describing: error))
+        }
+    }
+}
+
+public struct ContainerRunVolume: Codable, Equatable, Sendable {
+    public var guestPath: String
+    public var destination: String
+    public var readOnly: Bool
+
+    public init(guestPath: String, destination: String, readOnly: Bool) {
+        self.guestPath = guestPath
+        self.destination = destination
+        self.readOnly = readOnly
+    }
+}
+
+public enum ContainerResponseType: String, Codable, Sendable {
+    case stdout
+    case stderr
+    case exit
+    case error
+}
+
+/// A single host response frame (one JSON object per line).
+///
+/// - stdout/stderr: "data" holds base64-encoded output bytes.
+/// - exit: "exitCode" holds the exit status (128+signal when killed by a signal).
+/// - error: "message" describes what failed (protocol, validation, or launch).
+public struct ContainerResponse: Codable, Equatable, Sendable {
+    public var version: Int
+    public var type: ContainerResponseType
+    public var data: String?
+    public var exitCode: Int32?
+    public var message: String?
+
+    public init(version: Int = ContainerBridgeConstants.protocolVersion, type: ContainerResponseType, data: String? = nil, exitCode: Int32? = nil, message: String? = nil) {
+        self.version = version
+        self.type = type
+        self.data = data
+        self.exitCode = exitCode
+        self.message = message
+    }
+
+    public static func stdout(_ chunk: Data, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
+        ContainerResponse(version: version, type: .stdout, data: chunk.base64EncodedString())
+    }
+
+    public static func stderr(_ chunk: Data, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
+        ContainerResponse(version: version, type: .stderr, data: chunk.base64EncodedString())
+    }
+
+    public static func exit(_ code: Int32, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
+        ContainerResponse(version: version, type: .exit, exitCode: code)
+    }
+
+    public static func error(_ message: String, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
+        ContainerResponse(version: version, type: .error, message: message)
+    }
+
+    /// Encodes as one NDJSON line (JSON object + '\n').
+    public func encodeLine() throws -> Data {
+        var data = try JSONEncoder().encode(self)
+        data.append(0x0A)
+        return data
+    }
+}
+
+public enum ContainerProtocolError: Error, LocalizedError, Equatable {
+    case emptyRequest
+    case requestTooLarge(limit: Int)
+    case malformedRequest(String)
+    case malformedInputFrame(String)
+    case connectionClosed
+
+    public var errorDescription: String? {
+        switch self {
+        case .emptyRequest:
+            return "Empty request: send one JSON line such as {\"version\":1,\"operation\":\"run\",\"image\":\"alpine\",\"command\":[\"echo\",\"hello\"]}."
+        case .requestTooLarge(let limit):
+            return "Request line exceeds the \(limit)-byte limit."
+        case .malformedRequest(let detail):
+            return "Malformed request JSON: \(detail)"
+        case .malformedInputFrame(let detail):
+            return "Malformed input frame JSON: \(detail)"
+        case .connectionClosed:
+            return "Connection closed by peer."
+        }
+    }
+}
diff --git a/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift b/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
new file mode 100644
index 0000000..48eacd9
--- /dev/null
+++ b/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
@@ -0,0 +1,232 @@
+import Foundation
+
+/// A container run request that passed validation.
+public struct ValidatedContainerRun: Equatable, Sendable {
+    public let image: String
+    public let command: [String]
+    public let attachStdin: Bool
+    public let allocateTTY: Bool
+    public let terminalColumns: UInt16
+    public let terminalRows: UInt16
+    public let protocolVersion: Int
+    public let volumes: [ContainerRunVolume]
+
+    public init(
+        image: String,
+        command: [String],
+        attachStdin: Bool = false,
+        allocateTTY: Bool = false,
+        terminalColumns: UInt16 = 80,
+        terminalRows: UInt16 = 24,
+        protocolVersion: Int = ContainerBridgeConstants.protocolVersion,
+        volumes: [ContainerRunVolume] = []
+    ) {
+        self.image = image
+        self.command = command
+        self.attachStdin = attachStdin
+        self.allocateTTY = allocateTTY
+        self.terminalColumns = terminalColumns
+        self.terminalRows = terminalRows
+        self.protocolVersion = protocolVersion
+        self.volumes = volumes
+    }
+
+    /// Arguments for the helper-scoped Containerization runtime service.
+    public func containerArguments(vmHash: String, uniqueSuffix: String) -> [String] {
+        let name = ContainerRunPolicy.containerName(vmHash: vmHash, uniqueSuffix: uniqueSuffix)
+        var terminalArguments: [String] = []
+        if attachStdin { terminalArguments.append("-i") }
+        if allocateTTY {
+            terminalArguments += ["-t", "--tty-size", String(terminalColumns), String(terminalRows)]
+        }
+        return ["run"] + terminalArguments + ["--id", name, "--image", image, "--"] + command
+    }
+}
+
+public enum ContainerPolicyError: Error, LocalizedError, Equatable {
+    case unsupportedVersion(found: Int)
+    case unsupportedOperation(found: String)
+    case emptyImage
+    case imageTooLong(max: Int)
+    case imageStartsWithDash
+    case imageContainsNUL
+    case imageContainsWhitespaceOrControl
+    case tooManyCommandArguments(max: Int)
+    case commandArgumentTooLong(max: Int)
+    case commandArgumentContainsNUL
+    case tooManyVolumes(max: Int)
+    case invalidVolumeGuestPath
+    case invalidVolumeDestination
+    case volumePathTooLong(max: Int)
+    case duplicateVolumeDestination(String)
+    case readWriteGuestVolumesUnsupported
+    case ttyRequiresProtocolVersion2
+    case invalidTerminalSize
+
+    public var errorDescription: String? {
+        switch self {
+        case .unsupportedVersion(let found):
+            return "Unsupported protocol version \(found); this host supports version \(ContainerBridgeConstants.protocolVersion)."
+        case .unsupportedOperation(let found):
+            return "Unsupported operation '\(found)'; the only supported operation is 'run'."
+        case .emptyImage:
+            return "Image must not be empty."
+        case .imageTooLong(let max):
+            return "Image exceeds the \(max)-byte limit."
+        case .imageStartsWithDash:
+            return "Image must not start with '-' (flags are not accepted)."
+        case .imageContainsNUL:
+            return "Image must not contain NUL bytes."
+        case .imageContainsWhitespaceOrControl:
+            return "Image must not contain whitespace or control characters."
+        case .tooManyCommandArguments(let max):
+            return "Command has too many arguments (max \(max))."
+        case .commandArgumentTooLong(let max):
+            return "Command argument exceeds the \(max)-byte limit."
+        case .commandArgumentContainsNUL:
+            return "Command arguments must not contain NUL bytes."
+        case .tooManyVolumes(let max):
+            return "Request has too many volumes (max \(max))."
+        case .invalidVolumeGuestPath:
+            return "Volume guest paths must be absolute and contain no NUL bytes."
+        case .invalidVolumeDestination:
+            return "Volume destinations must be absolute, must not be '/', and must contain no dot components or NUL bytes."
+        case .volumePathTooLong(let max):
+            return "Volume paths must not exceed \(max) bytes."
+        case .duplicateVolumeDestination(let path):
+            return "Duplicate volume destination '\(path)'."
+        case .readWriteGuestVolumesUnsupported:
+            return "Guest directory mounts are currently read-only."
+        case .ttyRequiresProtocolVersion2:
+            return "TTY mode requires container bridge protocol version 2."
+        case .invalidTerminalSize:
+            return "Terminal columns and rows must both be greater than zero."
+        }
+    }
+}
+
+/// Pure validation for guest container run requests.
+public enum ContainerRunPolicy {
+    /// Maximum image reference length in UTF-8 bytes.
+    public static let maxImageLength = 256
+    /// Maximum number of command arguments.
+    public static let maxCommandCount = 64
+    /// Maximum length of one command argument in UTF-8 bytes.
+    public static let maxCommandArgumentLength = 4096
+    /// Apple's container CLI rejects names longer than 63 characters.
+    public static let maxContainerNameLength = 63
+    public static let maxVolumeCount = 32
+    public static let maxVolumePathLength = 4096
+
+    public static func validate(_ request: ContainerRunRequest) throws -> ValidatedContainerRun {
+        guard (ContainerBridgeConstants.minimumProtocolVersion...ContainerBridgeConstants.protocolVersion).contains(request.version) else {
+            throw ContainerPolicyError.unsupportedVersion(found: request.version)
+        }
+        guard request.operation == "run" else {
+            throw ContainerPolicyError.unsupportedOperation(found: request.operation)
+        }
+
+        let image = request.image
+        guard !image.isEmpty else { throw ContainerPolicyError.emptyImage }
+        guard image.utf8.count <= maxImageLength else { throw ContainerPolicyError.imageTooLong(max: maxImageLength) }
+        guard !image.hasPrefix("-") else { throw ContainerPolicyError.imageStartsWithDash }
+        guard !image.contains("\0") else { throw ContainerPolicyError.imageContainsNUL }
+        // No legitimate image reference contains whitespace or control
+        // characters; rejecting them also keeps log-injection out of NSLog.
+        guard !image.unicodeScalars.contains(where: isWhitespaceOrControl) else {
+            throw ContainerPolicyError.imageContainsWhitespaceOrControl
+        }
+
+        guard request.command.count <= maxCommandCount else {
+            throw ContainerPolicyError.tooManyCommandArguments(max: maxCommandCount)
+        }
+        for argument in request.command {
+            guard argument.utf8.count <= maxCommandArgumentLength else {
+                throw ContainerPolicyError.commandArgumentTooLong(max: maxCommandArgumentLength)
+            }
+            guard !argument.contains("\0") else { throw ContainerPolicyError.commandArgumentContainsNUL }
+        }
+
+        let volumes = request.volumes ?? []
+        guard volumes.count <= maxVolumeCount else {
+            throw ContainerPolicyError.tooManyVolumes(max: maxVolumeCount)
+        }
+        var destinations = Set()
+        for volume in volumes {
+            guard volume.guestPath.hasPrefix("/"), !volume.guestPath.contains("\0") else {
+                throw ContainerPolicyError.invalidVolumeGuestPath
+            }
+            let destinationParts = volume.destination.split(separator: "/", omittingEmptySubsequences: true)
+            guard volume.destination.hasPrefix("/"),
+                  volume.destination != "/",
+                  !volume.destination.contains("\0"),
+                  !destinationParts.contains(where: { $0 == "." || $0 == ".." }) else {
+                throw ContainerPolicyError.invalidVolumeDestination
+            }
+            guard volume.guestPath.utf8.count <= maxVolumePathLength,
+                  volume.destination.utf8.count <= maxVolumePathLength else {
+                throw ContainerPolicyError.volumePathTooLong(max: maxVolumePathLength)
+            }
+            guard destinations.insert(volume.destination).inserted else {
+                throw ContainerPolicyError.duplicateVolumeDestination(volume.destination)
+            }
+            guard volume.readOnly else {
+                throw ContainerPolicyError.readWriteGuestVolumesUnsupported
+            }
+        }
+
+        let allocateTTY = request.tty == true
+        guard !allocateTTY || request.version >= 2 else {
+            throw ContainerPolicyError.ttyRequiresProtocolVersion2
+        }
+        let columns = request.columns ?? 80
+        let rows = request.rows ?? 24
+        guard !allocateTTY || (columns > 0 && rows > 0) else {
+            throw ContainerPolicyError.invalidTerminalSize
+        }
+
+        return ValidatedContainerRun(
+            image: image,
+            command: request.command,
+            attachStdin: request.stdin == true,
+            allocateTTY: allocateTTY,
+            terminalColumns: columns,
+            terminalRows: rows,
+            protocolVersion: request.version,
+            volumes: volumes
+        )
+    }
+
+    /// Maps a string to a container-name-safe component ([a-z0-9_.-], never empty,
+    /// starts with an alphanumeric, max 32 chars).
+    public static func sanitizedNameComponent(_ raw: String) -> String {
+        var mapped = String()
+        mapped.reserveCapacity(raw.count)
+        for scalar in raw.lowercased().unicodeScalars {
+            switch scalar {
+            case "a"..."z", "0"..."9", ".", "_", "-":
+                mapped.append(Character(scalar))
+            default:
+                mapped.append("-")
+            }
+        }
+        let trimmed = mapped.drop(while: { !$0.isLetter && !$0.isNumber })
+        let result = trimmed.isEmpty ? "x" : String(trimmed)
+        return String(result.prefix(32))
+    }
+
+    /// Generated container name, hard-capped at Apple's 63-character limit.
+    static func containerName(vmHash: String, uniqueSuffix: String) -> String {
+        let raw = "gv-\(sanitizedNameComponent(vmHash))-\(sanitizedNameComponent(uniqueSuffix))"
+        var name = String(raw.prefix(maxContainerNameLength))
+        // Truncation may leave a trailing separator, which name validators reject.
+        while let last = name.last, !last.isLetter, !last.isNumber {
+            name.removeLast()
+        }
+        return name
+    }
+
+    private static func isWhitespaceOrControl(_ scalar: Unicode.Scalar) -> Bool {
+        CharacterSet.whitespacesAndNewlines.contains(scalar) || CharacterSet.controlCharacters.contains(scalar)
+    }
+}
diff --git a/macOS/GhostVMKit/Containers/ContainerRuntimeProtocol.swift b/macOS/GhostVMKit/Containers/ContainerRuntimeProtocol.swift
new file mode 100644
index 0000000..fcea63a
--- /dev/null
+++ b/macOS/GhostVMKit/Containers/ContainerRuntimeProtocol.swift
@@ -0,0 +1,219 @@
+import Foundation
+
+/// Version of the backend-neutral container runtime API.
+public struct ContainerRuntimeVersion: Codable, Equatable, Sendable {
+    public static let current = ContainerRuntimeVersion(major: 1, minor: 0)
+
+    public var major: Int
+    public var minor: Int
+
+    public init(major: Int, minor: Int) {
+        self.major = major
+        self.minor = minor
+    }
+
+    public func isCompatible(with other: ContainerRuntimeVersion) -> Bool {
+        major == other.major
+    }
+}
+
+/// Extensible method name used by frontends and runtime backends.
+public struct ContainerRuntimeMethod: RawRepresentable, Codable, Hashable, Sendable {
+    public let rawValue: String
+
+    public init(rawValue: String) {
+        self.rawValue = rawValue
+    }
+
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        self.rawValue = try container.decode(String.self)
+    }
+
+    public func encode(to encoder: Encoder) throws {
+        var container = encoder.singleValueContainer()
+        try container.encode(rawValue)
+    }
+
+    public static let systemCapabilities = Self(rawValue: "system.capabilities")
+
+    public static let imagePull = Self(rawValue: "image.pull")
+    public static let imageList = Self(rawValue: "image.list")
+    public static let imageInspect = Self(rawValue: "image.inspect")
+    public static let imageDelete = Self(rawValue: "image.delete")
+    public static let imageUnpack = Self(rawValue: "image.unpack")
+
+    public static let filesystemCreate = Self(rawValue: "filesystem.create")
+    public static let filesystemDelete = Self(rawValue: "filesystem.delete")
+
+    public static let containerCreate = Self(rawValue: "container.create")
+    public static let containerStart = Self(rawValue: "container.start")
+    public static let containerStop = Self(rawValue: "container.stop")
+    public static let containerKill = Self(rawValue: "container.kill")
+    public static let containerWait = Self(rawValue: "container.wait")
+    public static let containerResize = Self(rawValue: "container.resize")
+    public static let containerState = Self(rawValue: "container.state")
+    public static let containerList = Self(rawValue: "container.list")
+    public static let containerDelete = Self(rawValue: "container.delete")
+    public static let containerCopyIn = Self(rawValue: "container.copyIn")
+    public static let containerCopyOut = Self(rawValue: "container.copyOut")
+    public static let containerDial = Self(rawValue: "container.dial")
+
+    public static let processCreate = Self(rawValue: "process.create")
+    public static let processStart = Self(rawValue: "process.start")
+    public static let processKill = Self(rawValue: "process.kill")
+    public static let processWait = Self(rawValue: "process.wait")
+    public static let processResize = Self(rawValue: "process.resize")
+    public static let processDelete = Self(rawValue: "process.delete")
+
+    public static let networkCreateInterface = Self(rawValue: "network.createInterface")
+    public static let networkReleaseInterface = Self(rawValue: "network.releaseInterface")
+
+    public static let buildCreate = Self(rawValue: "build.create")
+}
+
+/// Metadata decoded before selecting a method-specific parameter type.
+public struct ContainerRuntimeRequestEnvelope: Codable, Equatable, Sendable {
+    public var version: ContainerRuntimeVersion
+    public var id: String
+    public var method: ContainerRuntimeMethod
+
+    public init(
+        version: ContainerRuntimeVersion = .current,
+        id: String = UUID().uuidString.lowercased(),
+        method: ContainerRuntimeMethod
+    ) {
+        self.version = version
+        self.id = id
+        self.method = method
+    }
+}
+
+public struct ContainerRuntimeRequest: Codable, Equatable, Sendable {
+    public var version: ContainerRuntimeVersion
+    public var id: String
+    public var method: ContainerRuntimeMethod
+    public var parameters: Parameters
+
+    public init(
+        version: ContainerRuntimeVersion = .current,
+        id: String = UUID().uuidString.lowercased(),
+        method: ContainerRuntimeMethod,
+        parameters: Parameters
+    ) {
+        self.version = version
+        self.id = id
+        self.method = method
+        self.parameters = parameters
+    }
+}
+
+public struct ContainerRuntimeEmpty: Codable, Equatable, Sendable {
+    public init() {}
+}
+
+/// A directory exported by GhostTools and materialized as a host filesystem.
+public struct ContainerRuntimeFilesystemCreateParameters: Codable, Equatable, Sendable {
+    public var guestPath: String
+    public var readOnly: Bool
+
+    public init(guestPath: String, readOnly: Bool = true) {
+        self.guestPath = guestPath
+        self.readOnly = readOnly
+    }
+}
+
+public struct ContainerRuntimeFilesystem: Codable, Equatable, Sendable {
+    public var id: String
+
+    public init(id: String) {
+        self.id = id
+    }
+}
+
+public struct ContainerRuntimeFilesystemDeleteParameters: Codable, Equatable, Sendable {
+    public var id: String
+
+    public init(id: String) {
+        self.id = id
+    }
+}
+
+/// Framework-shaped mount metadata. `source` is a host-owned filesystem ID,
+/// never an outer-host path supplied by the guest.
+public struct ContainerRuntimeMount: Codable, Equatable, Sendable {
+    public var type: String
+    public var source: String
+    public var destination: String
+    public var options: [String]
+    public var runtimeOptions: [String]
+
+    public init(
+        type: String,
+        source: String,
+        destination: String,
+        options: [String] = [],
+        runtimeOptions: [String] = []
+    ) {
+        self.type = type
+        self.source = source
+        self.destination = destination
+        self.options = options
+        self.runtimeOptions = runtimeOptions
+    }
+}
+
+public struct ContainerRuntimeErrorCode: RawRepresentable, Codable, Hashable, Sendable {
+    public let rawValue: String
+
+    public init(rawValue: String) {
+        self.rawValue = rawValue
+    }
+
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        self.rawValue = try container.decode(String.self)
+    }
+
+    public func encode(to encoder: Encoder) throws {
+        var container = encoder.singleValueContainer()
+        try container.encode(rawValue)
+    }
+
+    public static let invalidArgument = Self(rawValue: "invalid_argument")
+    public static let notFound = Self(rawValue: "not_found")
+    public static let alreadyExists = Self(rawValue: "already_exists")
+    public static let failedPrecondition = Self(rawValue: "failed_precondition")
+    public static let unavailable = Self(rawValue: "unavailable")
+    public static let unsupported = Self(rawValue: "unsupported")
+    public static let permissionDenied = Self(rawValue: "permission_denied")
+    public static let timeout = Self(rawValue: "timeout")
+    public static let cancelled = Self(rawValue: "cancelled")
+    public static let internalError = Self(rawValue: "internal")
+}
+
+public struct ContainerRuntimeFailure: Codable, Equatable, Sendable {
+    public var code: ContainerRuntimeErrorCode
+    public var message: String
+
+    public init(code: ContainerRuntimeErrorCode, message: String) {
+        self.code = code
+        self.message = message
+    }
+}
+
+public struct ContainerRuntimeCapabilities: Codable, Equatable, Sendable {
+    public var version: ContainerRuntimeVersion
+    public var methods: [ContainerRuntimeMethod]
+    public var features: [String]
+
+    public init(
+        version: ContainerRuntimeVersion = .current,
+        methods: [ContainerRuntimeMethod],
+        features: [String] = []
+    ) {
+        self.version = version
+        self.methods = methods
+        self.features = features
+    }
+}
diff --git a/macOS/GhostVMKit/Containers/ContainerRuntimeXPCProtocol.swift b/macOS/GhostVMKit/Containers/ContainerRuntimeXPCProtocol.swift
new file mode 100644
index 0000000..bc6ed98
--- /dev/null
+++ b/macOS/GhostVMKit/Containers/ContainerRuntimeXPCProtocol.swift
@@ -0,0 +1,37 @@
+import Foundation
+
+/// Raw XPC protocol shared by GhostVMHelper and its embedded container runtime.
+public enum ContainerRuntimeXPCProtocol {
+    public static let serviceName = "org.ghostvm.ghostvm.helper"
+    public static let version: UInt64 = 1
+
+    public enum Operation {
+        public static let ping = "ping"
+        public static let run = "run"
+        public static let cancel = "cancel"
+        public static let resize = "resize"
+        public static let shutdown = "shutdown"
+        public static let ready = "ready"
+        public static let exit = "exit"
+    }
+
+    public enum Key {
+        public static let operation = "operation"
+        public static let version = "version"
+        public static let runIdentifier = "runIdentifier"
+        public static let arguments = "arguments"
+        public static let networkSerialization = "networkSerialization"
+        public static let ipv4Address = "ipv4Address"
+        public static let ipv4Gateway = "ipv4Gateway"
+        public static let macAddress = "macAddress"
+        public static let mtu = "mtu"
+        public static let columns = "columns"
+        public static let rows = "rows"
+        public static let stdin = "stdin"
+        public static let stdout = "stdout"
+        public static let stderr = "stderr"
+        public static let exitCode = "exitCode"
+        public static let error = "error"
+        public static let ok = "ok"
+    }
+}
diff --git a/macOS/GhostVMKit/Content/ContentAddressedStore.swift b/macOS/GhostVMKit/Content/ContentAddressedStore.swift
new file mode 100644
index 0000000..6b20874
--- /dev/null
+++ b/macOS/GhostVMKit/Content/ContentAddressedStore.swift
@@ -0,0 +1,164 @@
+import CryptoKit
+import Foundation
+
+public enum ContentStoreError: Error, Equatable {
+    case unsupportedDigestAlgorithm(String)
+    case invalidDigest(String)
+    case digestMismatch(expected: ContentDigest, actual: ContentDigest)
+    case blobNotFound(ContentDigest)
+}
+
+/// OCI-style content digest, currently restricted to SHA-256.
+public struct ContentDigest: Codable, Hashable, Sendable, CustomStringConvertible {
+    public let algorithm: String
+    public let encoded: String
+
+    public init(algorithm: String, encoded: String) throws {
+        guard algorithm == "sha256" else {
+            throw ContentStoreError.unsupportedDigestAlgorithm(algorithm)
+        }
+        let lowercaseHex = CharacterSet(charactersIn: "0123456789abcdef")
+        guard encoded.count == 64, encoded.unicodeScalars.allSatisfy(lowercaseHex.contains) else {
+            throw ContentStoreError.invalidDigest("\(algorithm):\(encoded)")
+        }
+        self.algorithm = algorithm
+        self.encoded = encoded
+    }
+
+    public init(_ value: String) throws {
+        let parts = value.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false)
+        guard parts.count == 2 else {
+            throw ContentStoreError.invalidDigest(value)
+        }
+        try self.init(algorithm: String(parts[0]), encoded: String(parts[1]))
+    }
+
+    public var description: String {
+        "\(algorithm):\(encoded)"
+    }
+
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.singleValueContainer()
+        try self.init(container.decode(String.self))
+    }
+
+    public func encode(to encoder: Encoder) throws {
+        var container = encoder.singleValueContainer()
+        try container.encode(description)
+    }
+
+    public static func sha256(_ data: Data) -> ContentDigest {
+        let encoded = SHA256.hash(data: data).map { String(format: "%02x", $0) }.joined()
+        return try! ContentDigest(algorithm: "sha256", encoded: encoded)
+    }
+}
+
+/// On-disk locations for immutable blobs and mutable image metadata.
+public struct ContentStoreLayout: Sendable {
+    public let rootURL: URL
+
+    public init(rootURL: URL) {
+        self.rootURL = rootURL
+    }
+
+    public var blobsURL: URL { rootURL.appendingPathComponent("blobs", isDirectory: true) }
+    public var ingestURL: URL { rootURL.appendingPathComponent("ingest", isDirectory: true) }
+    public var referencesURL: URL { rootURL.appendingPathComponent("refs", isDirectory: true) }
+    public var snapshotsURL: URL { rootURL.appendingPathComponent("snapshots", isDirectory: true) }
+
+    public func blobURL(for digest: ContentDigest) -> URL {
+        blobsURL
+            .appendingPathComponent(digest.algorithm, isDirectory: true)
+            .appendingPathComponent(digest.encoded, isDirectory: false)
+    }
+}
+
+/// Append-only content store. Publication is a same-volume rename from ingest
+/// into the digest path, so readers never observe a partial blob.
+public actor ContentAddressedStore {
+    public let layout: ContentStoreLayout
+
+    private let fileManager: FileManager
+
+    public init(rootURL: URL, fileManager: FileManager = .default) {
+        self.layout = ContentStoreLayout(rootURL: rootURL)
+        self.fileManager = fileManager
+    }
+
+    public func prepare() throws {
+        try fileManager.createDirectory(at: layout.blobsURL, withIntermediateDirectories: true)
+        try fileManager.createDirectory(at: layout.ingestURL, withIntermediateDirectories: true)
+        try fileManager.createDirectory(at: layout.referencesURL, withIntermediateDirectories: true)
+        try fileManager.createDirectory(at: layout.snapshotsURL, withIntermediateDirectories: true)
+    }
+
+    @discardableResult
+    public func put(_ data: Data) throws -> ContentDigest {
+        try prepare()
+        let digest = ContentDigest.sha256(data)
+        let temporaryURL = layout.ingestURL.appendingPathComponent(UUID().uuidString.lowercased())
+        try data.write(to: temporaryURL)
+        _ = try publish(temporaryURL: temporaryURL, expectedDigest: digest)
+        return digest
+    }
+
+    /// Copies an external download into ingest, verifies it, then publishes it.
+    @discardableResult
+    public func importBlob(at sourceURL: URL, expectedDigest: ContentDigest) throws -> URL {
+        try prepare()
+        let temporaryURL = layout.ingestURL.appendingPathComponent(UUID().uuidString.lowercased())
+        try fileManager.copyItem(at: sourceURL, to: temporaryURL)
+        return try publish(temporaryURL: temporaryURL, expectedDigest: expectedDigest)
+    }
+
+    public func contains(_ digest: ContentDigest) -> Bool {
+        fileManager.fileExists(atPath: layout.blobURL(for: digest).path)
+    }
+
+    public func blobURL(for digest: ContentDigest) throws -> URL {
+        let url = layout.blobURL(for: digest)
+        guard fileManager.fileExists(atPath: url.path) else {
+            throw ContentStoreError.blobNotFound(digest)
+        }
+        return url
+    }
+
+    private func publish(temporaryURL: URL, expectedDigest: ContentDigest) throws -> URL {
+        var shouldRemoveTemporary = true
+        defer {
+            if shouldRemoveTemporary {
+                try? fileManager.removeItem(at: temporaryURL)
+            }
+        }
+
+        let actualDigest = try Self.sha256(of: temporaryURL)
+        guard actualDigest == expectedDigest else {
+            throw ContentStoreError.digestMismatch(expected: expectedDigest, actual: actualDigest)
+        }
+
+        let destinationURL = layout.blobURL(for: actualDigest)
+        if fileManager.fileExists(atPath: destinationURL.path) {
+            return destinationURL
+        }
+
+        try fileManager.createDirectory(
+            at: destinationURL.deletingLastPathComponent(),
+            withIntermediateDirectories: true
+        )
+        try fileManager.moveItem(at: temporaryURL, to: destinationURL)
+        shouldRemoveTemporary = false
+        return destinationURL
+    }
+
+    private static func sha256(of url: URL) throws -> ContentDigest {
+        let handle = try FileHandle(forReadingFrom: url)
+        defer { try? handle.close() }
+
+        var hasher = SHA256()
+        while let chunk = try handle.read(upToCount: 1024 * 1024), !chunk.isEmpty {
+            hasher.update(data: chunk)
+        }
+        let encoded = hasher.finalize().map { String(format: "%02x", $0) }.joined()
+        return try ContentDigest(algorithm: "sha256", encoded: encoded)
+    }
+}
diff --git a/macOS/GhostVMKit/Core/GhostClientProtocol.swift b/macOS/GhostVMKit/Core/GhostClientProtocol.swift
index 56f0f62..0100454 100644
--- a/macOS/GhostVMKit/Core/GhostClientProtocol.swift
+++ b/macOS/GhostVMKit/Core/GhostClientProtocol.swift
@@ -19,6 +19,10 @@ public protocol GhostClientProtocol {
 
     // File system
     func listDirectory(path: String) async throws -> FSListResponse
+    func fileMetadata(path: String) async throws -> GuestFileMetadata
+    func listDirectoryMetadata(path: String) async throws -> GuestDirectoryMetadata
+    func readFile(path: String, offset: UInt64, length: Int) async throws -> Data
+    func readSymbolicLink(path: String) async throws -> String
     func mkdir(path: String) async throws
     func deleteFile(path: String) async throws
     func moveFile(from: String, to: String) async throws
diff --git a/macOS/GhostVMKit/Core/GhostClientTypes.swift b/macOS/GhostVMKit/Core/GhostClientTypes.swift
index df9e5c9..3d37a49 100644
--- a/macOS/GhostVMKit/Core/GhostClientTypes.swift
+++ b/macOS/GhostVMKit/Core/GhostClientTypes.swift
@@ -141,6 +141,63 @@ public struct FSListResponse: Codable {
     }
 }
 
+public enum GuestFileType: String, Codable, Equatable, Sendable {
+    case file
+    case directory
+    case symbolicLink
+    case other
+}
+
+public struct GuestFileMetadata: Codable, Equatable, Sendable {
+    public let name: String
+    public let type: GuestFileType
+    public let size: UInt64
+    public let mode: UInt32
+    public let uid: UInt32
+    public let gid: UInt32
+    public let inode: UInt64
+    public let device: UInt64
+    public let linkCount: UInt32
+    public let modifiedSeconds: Int
+    public let modifiedNanoseconds: Int32
+
+    public init(
+        name: String,
+        type: GuestFileType,
+        size: UInt64,
+        mode: UInt32,
+        uid: UInt32,
+        gid: UInt32,
+        inode: UInt64,
+        device: UInt64,
+        linkCount: UInt32,
+        modifiedSeconds: Int,
+        modifiedNanoseconds: Int32
+    ) {
+        self.name = name
+        self.type = type
+        self.size = size
+        self.mode = mode
+        self.uid = uid
+        self.gid = gid
+        self.inode = inode
+        self.device = device
+        self.linkCount = linkCount
+        self.modifiedSeconds = modifiedSeconds
+        self.modifiedNanoseconds = modifiedNanoseconds
+    }
+}
+
+public struct GuestDirectoryMetadata: Codable, Equatable, Sendable {
+    public let path: String
+    public let entries: [GuestFileMetadata]
+
+    public init(path: String, entries: [GuestFileMetadata]) {
+        self.path = path
+        self.entries = entries
+    }
+}
+
 // MARK: - Accessibility Types
 
 /// Frame rectangle for accessibility elements
diff --git a/macOS/GhostVMKit/Core/NetworkConfig.swift b/macOS/GhostVMKit/Core/NetworkConfig.swift
index f63e9e6..46d6b25 100644
--- a/macOS/GhostVMKit/Core/NetworkConfig.swift
+++ b/macOS/GhostVMKit/Core/NetworkConfig.swift
@@ -8,10 +8,16 @@ public enum NetworkMode: String, Codable {
 public struct NetworkConfig: Codable, Equatable {
     public var mode: NetworkMode
     public var bridgeInterfaceIdentifier: String?
+    public var vmnetIPv4Subnet: String?
 
-    public init(mode: NetworkMode = .nat, bridgeInterfaceIdentifier: String? = nil) {
+    public init(
+        mode: NetworkMode = .nat,
+        bridgeInterfaceIdentifier: String? = nil,
+        vmnetIPv4Subnet: String? = nil
+    ) {
         self.mode = mode
         self.bridgeInterfaceIdentifier = bridgeInterfaceIdentifier
+        self.vmnetIPv4Subnet = vmnetIPv4Subnet
     }
 
     public static var defaultConfig: NetworkConfig {
diff --git a/macOS/GhostVMKit/Core/VMStoredConfig.swift b/macOS/GhostVMKit/Core/VMStoredConfig.swift
index 31637c7..1366144 100644
--- a/macOS/GhostVMKit/Core/VMStoredConfig.swift
+++ b/macOS/GhostVMKit/Core/VMStoredConfig.swift
@@ -42,6 +42,8 @@ public struct VMStoredConfig: Codable {
     public var portForwards: [PortForwardConfig]
     // Network configuration (NAT vs bridged)
     public var networkConfig: NetworkConfig?
+    // Allows this VM to request host-backed containers.
+    public var hostContainersEnabled: Bool
     // Icon mode: nil = static (icon.png), "dynamic" = mirror guest foreground app
     public var iconMode: String?
     // Persisted VM window state
@@ -76,6 +78,7 @@ public struct VMStoredConfig: Codable {
         case macAddress
         case portForwards
         case networkConfig
+        case hostContainersEnabled
         case iconMode
         case windowWidth
         case windowHeight
@@ -109,6 +112,7 @@ public struct VMStoredConfig: Codable {
         macAddress: String? = nil,
         portForwards: [PortForwardConfig] = [],
         networkConfig: NetworkConfig? = nil,
+        hostContainersEnabled: Bool = false,
         iconMode: String? = nil,
         windowWidth: Double? = nil,
         windowHeight: Double? = nil,
@@ -140,6 +144,7 @@ public struct VMStoredConfig: Codable {
         self.macAddress = macAddress
         self.portForwards = portForwards
         self.networkConfig = networkConfig
+        self.hostContainersEnabled = hostContainersEnabled
         self.iconMode = iconMode
         self.windowWidth = windowWidth
         self.windowHeight = windowHeight
@@ -175,6 +180,7 @@ public struct VMStoredConfig: Codable {
         // Port forwards - defaults to empty for backwards compatibility
         portForwards = try container.decodeIfPresent([PortForwardConfig].self, forKey: .portForwards) ?? []
         networkConfig = try container.decodeIfPresent(NetworkConfig.self, forKey: .networkConfig)
+        hostContainersEnabled = try container.decodeIfPresent(Bool.self, forKey: .hostContainersEnabled) ?? false
         iconMode = try container.decodeIfPresent(String.self, forKey: .iconMode)
         windowWidth = try container.decodeIfPresent(Double.self, forKey: .windowWidth)
         windowHeight = try container.decodeIfPresent(Double.self, forKey: .windowHeight)
diff --git a/macOS/GhostVMKit/Networking/NetworkManager.swift b/macOS/GhostVMKit/Networking/NetworkManager.swift
new file mode 100644
index 0000000..a9e7162
--- /dev/null
+++ b/macOS/GhostVMKit/Networking/NetworkManager.swift
@@ -0,0 +1,140 @@
+import Foundation
+
+/// Identifies a network independently of the backend that implements it.
+public struct ManagedNetworkID: RawRepresentable, Codable, Hashable, Sendable {
+    public let rawValue: String
+
+    public init(rawValue: String) {
+        self.rawValue = rawValue
+    }
+}
+
+/// Host networking implementations available to VM and container workloads.
+public enum ManagedNetworkDriver: String, Codable, Sendable {
+    /// Virtualization.framework's per-VM NAT attachment.
+    case virtualizationNAT = "virtualization-nat"
+    /// A direct attachment to a host interface.
+    case bridged
+    /// A shared vmnet network with centrally managed addresses.
+    case vmnetShared = "vmnet-shared"
+}
+
+/// Backend-neutral network configuration owned by the runtime helper.
+public struct ManagedNetwork: Codable, Equatable, Sendable {
+    public var id: ManagedNetworkID
+    public var name: String
+    public var driver: ManagedNetworkDriver
+    public var ipv4Subnet: String?
+    public var gateway: String?
+    public var bridgeInterfaceIdentifier: String?
+
+    public init(
+        id: ManagedNetworkID,
+        name: String,
+        driver: ManagedNetworkDriver,
+        ipv4Subnet: String? = nil,
+        gateway: String? = nil,
+        bridgeInterfaceIdentifier: String? = nil
+    ) {
+        self.id = id
+        self.name = name
+        self.driver = driver
+        self.ipv4Subnet = ipv4Subnet
+        self.gateway = gateway
+        self.bridgeInterfaceIdentifier = bridgeInterfaceIdentifier
+    }
+}
+
+public enum NetworkWorkloadKind: String, Codable, Hashable, Sendable {
+    case virtualMachine = "virtual-machine"
+    case container
+}
+
+/// A VM NIC or container interface attached to a managed network.
+public struct ManagedNetworkEndpoint: Codable, Equatable, Sendable, Identifiable {
+    public var id: UUID
+    public var networkID: ManagedNetworkID
+    public var workloadKind: NetworkWorkloadKind
+    public var workloadID: String
+    public var interfaceName: String?
+    public var macAddress: String?
+    public var ipv4Address: String?
+
+    public init(
+        id: UUID = UUID(),
+        networkID: ManagedNetworkID,
+        workloadKind: NetworkWorkloadKind,
+        workloadID: String,
+        interfaceName: String? = nil,
+        macAddress: String? = nil,
+        ipv4Address: String? = nil
+    ) {
+        self.id = id
+        self.networkID = networkID
+        self.workloadKind = workloadKind
+        self.workloadID = workloadID
+        self.interfaceName = interfaceName
+        self.macAddress = macAddress
+        self.ipv4Address = ipv4Address
+    }
+}
+
+public enum NetworkManagerError: Error, Equatable {
+    case networkAlreadyExists(ManagedNetworkID)
+    case networkNotFound(ManagedNetworkID)
+    case endpointAlreadyExists(UUID)
+}
+
+/// Single-owner control plane for VM and container network definitions.
+/// Concrete backends translate endpoints into VZ or Containerization interfaces.
+public actor NetworkManager {
+    private var networksByID: [ManagedNetworkID: ManagedNetwork]
+    private var endpointsByID: [UUID: ManagedNetworkEndpoint]
+
+    public init(networks: [ManagedNetwork] = []) {
+        self.networksByID = Dictionary(uniqueKeysWithValues: networks.map { ($0.id, $0) })
+        self.endpointsByID = [:]
+    }
+
+    public func networks() -> [ManagedNetwork] {
+        networksByID.values.sorted { $0.name.localizedStandardCompare($1.name) == .orderedAscending }
+    }
+
+    public func network(id: ManagedNetworkID) -> ManagedNetwork? {
+        networksByID[id]
+    }
+
+    public func create(_ network: ManagedNetwork) throws {
+        guard networksByID[network.id] == nil else {
+            throw NetworkManagerError.networkAlreadyExists(network.id)
+        }
+        networksByID[network.id] = network
+    }
+
+    public func remove(id: ManagedNetworkID) throws {
+        guard networksByID.removeValue(forKey: id) != nil else {
+            throw NetworkManagerError.networkNotFound(id)
+        }
+        endpointsByID = endpointsByID.filter { $0.value.networkID != id }
+    }
+
+    public func attach(_ endpoint: ManagedNetworkEndpoint) throws {
+        guard networksByID[endpoint.networkID] != nil else {
+            throw NetworkManagerError.networkNotFound(endpoint.networkID)
+        }
+        guard endpointsByID[endpoint.id] == nil else {
+            throw NetworkManagerError.endpointAlreadyExists(endpoint.id)
+        }
+        endpointsByID[endpoint.id] = endpoint
+    }
+
+    public func detach(endpointID: UUID) {
+        endpointsByID.removeValue(forKey: endpointID)
+    }
+
+    public func endpoints(networkID: ManagedNetworkID? = nil) -> [ManagedNetworkEndpoint] {
+        endpointsByID.values
+            .filter { networkID == nil || $0.networkID == networkID }
+            .sorted { $0.id.uuidString < $1.id.uuidString }
+    }
+}
diff --git a/macOS/GhostVMKit/Networking/SharedVmnetIPv4Pool.swift b/macOS/GhostVMKit/Networking/SharedVmnetIPv4Pool.swift
new file mode 100644
index 0000000..492b43d
--- /dev/null
+++ b/macOS/GhostVMKit/Networking/SharedVmnetIPv4Pool.swift
@@ -0,0 +1,41 @@
+import Foundation
+
+public enum SharedVmnetIPv4PoolError: Error, Equatable {
+    case exhausted
+}
+
+/// Deterministic first-fit allocator for the static container range of a
+/// shared vmnet subnet. The gateway (.1) and macOS DHCP lease (.2) are skipped.
+public struct SharedVmnetIPv4Pool {
+    public let subnet: UInt32
+    public let mask: UInt32
+    public let prefixLength: UInt64
+    private var allocations: [String: UInt32] = [:]
+
+    public init(subnet: UInt32, mask: UInt32, prefixLength: UInt64) {
+        self.subnet = subnet & mask
+        self.mask = mask
+        self.prefixLength = prefixLength
+    }
+
+    public mutating func allocate(endpointIdentifier: String) throws -> UInt32 {
+        if let existing = allocations[endpointIdentifier] { return existing }
+        let broadcast = subnet | ~mask
+        guard broadcast > subnet + 3 else { throw SharedVmnetIPv4PoolError.exhausted }
+
+        let used = Set(allocations.values)
+        for address in (subnet + 3).. String {
+        "\((address >> 24) & 0xff).\((address >> 16) & 0xff).\((address >> 8) & 0xff).\(address & 0xff)"
+    }
+}
diff --git a/macOS/GhostVMKit/Networking/SharedVmnetNetwork.swift b/macOS/GhostVMKit/Networking/SharedVmnetNetwork.swift
new file mode 100644
index 0000000..d6eb53f
--- /dev/null
+++ b/macOS/GhostVMKit/Networking/SharedVmnetNetwork.swift
@@ -0,0 +1,263 @@
+import Foundation
+import Virtualization
+import XPC
+import vmnet
+
+public enum SharedVmnetError: Error, LocalizedError {
+    case invalidMACAddress(String)
+    case networkCreationFailed(vmnet_return_t)
+    case serializationFailed(vmnet_return_t)
+    case networkClosed
+
+    public var errorDescription: String? {
+        switch self {
+        case .invalidMACAddress(let address):
+            return "Invalid MAC address for shared vmnet network: \(address)"
+        case .networkCreationFailed(let status):
+            return "Failed to create shared vmnet network (status \(status.rawValue))."
+        case .serializationFailed(let status):
+            return "Failed to serialize shared vmnet network (status \(status.rawValue))."
+        case .networkClosed:
+            return "The shared vmnet network is closed."
+        }
+    }
+}
+
+/// Owns the shared-mode vmnet network used by one NAT macOS VM and allocates
+/// endpoint settings for container VMs hosted by the runtime XPC service.
+public final class SharedVmnetNetwork: @unchecked Sendable {
+    public let networkIdentifier: String
+    public let networkReference: vmnet_network_ref
+    public let serialization: xpc_object_t
+    public let ipv4Subnet: String
+    public let ipv4Gateway: String
+
+    private let lock = NSLock()
+    private var pool: SharedVmnetIPv4Pool
+    private var closed = false
+
+    public init(networkIdentifier: String, vmMACAddress: String, preferredIPv4Subnet: String? = nil) throws {
+        let macBytes = try Self.parseMACAddress(vmMACAddress)
+        let created = try Self.createNetwork(
+            vmMACAddress: macBytes,
+            preferredSubnetOctet: Self.subnetOctet(from: preferredIPv4Subnet)
+        )
+
+        var status: vmnet_return_t = .VMNET_FAILURE
+        guard let serialization = vmnet_network_copy_serialization(created.reference, &status), status == .VMNET_SUCCESS else {
+            Self.releaseVmnetReference(created.reference)
+            throw SharedVmnetError.serializationFailed(status)
+        }
+
+        self.networkIdentifier = networkIdentifier
+        self.networkReference = created.reference
+        self.serialization = serialization
+        self.ipv4Subnet = "\(created.subnetString)/\(created.prefixLength)"
+        self.ipv4Gateway = created.gateway
+        self.pool = SharedVmnetIPv4Pool(
+            subnet: created.subnet,
+            mask: created.mask,
+            prefixLength: created.prefixLength
+        )
+    }
+
+    public var attachment: VZVmnetNetworkDeviceAttachment {
+        VZVmnetNetworkDeviceAttachment(network: networkReference)
+    }
+
+    public func acquireEndpoint(identifier: String) throws -> SharedVmnetEndpointLease {
+        lock.lock()
+        defer { lock.unlock() }
+        guard !closed else { throw SharedVmnetError.networkClosed }
+        let address = try pool.allocate(endpointIdentifier: identifier)
+        return SharedVmnetEndpointLease(
+            owner: self,
+            endpointIdentifier: identifier,
+            serialization: serialization,
+            ipv4Address: "\(SharedVmnetIPv4Pool.string(for: address))/\(pool.prefixLength)",
+            ipv4Gateway: ipv4Gateway,
+            macAddress: Self.macAddress(networkIdentifier: networkIdentifier, endpointIdentifier: identifier),
+            mtu: 1500
+        )
+    }
+
+    public func close() {
+        lock.lock()
+        guard !closed else {
+            lock.unlock()
+            return
+        }
+        closed = true
+        lock.unlock()
+        Self.releaseVmnetReference(networkReference)
+    }
+
+    deinit {
+        close()
+    }
+
+    private struct CreatedNetwork {
+        let reference: vmnet_network_ref
+        let subnet: UInt32
+        let mask: UInt32
+        let prefixLength: UInt64
+        let subnetString: String
+        let gateway: String
+    }
+
+    private static func createNetwork(vmMACAddress: [UInt8], preferredSubnetOctet: UInt8?) throws -> CreatedNetwork {
+        var lastStatus: vmnet_return_t = .VMNET_FAILURE
+        var candidates: [UInt8] = preferredSubnetOctet.map { [$0] } ?? []
+        while candidates.count < 64 {
+            let candidate = UInt8.random(in: 1...254)
+            if !candidates.contains(candidate) { candidates.append(candidate) }
+        }
+
+        // vmnet reserves the configured subnet atomically. Retry random /24s
+        // so concurrently running GhostVM instances cannot collide.
+        for octet in candidates {
+            var status: vmnet_return_t = .VMNET_FAILURE
+            guard let configuration = vmnet_network_configuration_create(.VMNET_SHARED_MODE, &status) else {
+                throw SharedVmnetError.networkCreationFailed(status)
+            }
+
+            let subnetString = "192.168.\(octet).0"
+            let gatewayString = "192.168.\(octet).1"
+            let vmAddressString = "192.168.\(octet).2"
+            var subnetAddress = in_addr()
+            var mask = in_addr()
+            var vmAddress = in_addr()
+            _ = subnetString.withCString { inet_pton(AF_INET, $0, &subnetAddress) }
+            _ = "255.255.255.0".withCString { inet_pton(AF_INET, $0, &mask) }
+            _ = vmAddressString.withCString { inet_pton(AF_INET, $0, &vmAddress) }
+
+            let subnetStatus = vmnet_network_configuration_set_ipv4_subnet(configuration, &subnetAddress, &mask)
+            var mac = ether_addr(octet: (
+                vmMACAddress[0], vmMACAddress[1], vmMACAddress[2],
+                vmMACAddress[3], vmMACAddress[4], vmMACAddress[5]
+            ))
+            let reservationStatus = vmnet_network_configuration_add_dhcp_reservation(configuration, &mac, &vmAddress)
+
+            if subnetStatus == .VMNET_SUCCESS, reservationStatus == .VMNET_SUCCESS,
+               let reference = vmnet_network_create(configuration, &status), status == .VMNET_SUCCESS {
+                releaseVmnetReference(configuration)
+                var actualSubnet = in_addr()
+                var actualMask = in_addr()
+                vmnet_network_get_ipv4_subnet(reference, &actualSubnet, &actualMask)
+                let subnet = UInt32(bigEndian: actualSubnet.s_addr) & UInt32(bigEndian: actualMask.s_addr)
+                let maskValue = UInt32(bigEndian: actualMask.s_addr)
+                return CreatedNetwork(
+                    reference: reference,
+                    subnet: subnet,
+                    mask: maskValue,
+                    prefixLength: UInt64(maskValue.nonzeroBitCount),
+                    subnetString: subnetString,
+                    gateway: gatewayString
+                )
+            }
+
+            lastStatus = status
+            releaseVmnetReference(configuration)
+        }
+
+        throw SharedVmnetError.networkCreationFailed(lastStatus)
+    }
+
+    private static func parseMACAddress(_ address: String) throws -> [UInt8] {
+        let parts = address.split(separator: ":", omittingEmptySubsequences: false)
+        guard parts.count == 6 else { throw SharedVmnetError.invalidMACAddress(address) }
+        let bytes = parts.compactMap { UInt8($0, radix: 16) }
+        guard bytes.count == 6 else { throw SharedVmnetError.invalidMACAddress(address) }
+        return bytes
+    }
+
+    private static func subnetOctet(from subnet: String?) -> UInt8? {
+        guard let subnet else { return nil }
+        let components = subnet.split(separator: ".", omittingEmptySubsequences: false)
+        guard components.count == 4,
+              components[0] == "192",
+              components[1] == "168",
+              components[3] == "0/24",
+              let octet = UInt8(components[2]),
+              octet > 0,
+              octet < 255 else {
+            return nil
+        }
+        return octet
+    }
+
+    fileprivate func releaseEndpoint(identifier: String) {
+        lock.lock()
+        pool.release(endpointIdentifier: identifier)
+        lock.unlock()
+    }
+
+    private static func macAddress(networkIdentifier: String, endpointIdentifier: String) -> String {
+        var hash: UInt64 = 0xcbf29ce484222325
+        for byte in "\(networkIdentifier):\(endpointIdentifier)".utf8 {
+            hash ^= UInt64(byte)
+            hash &*= 0x100000001b3
+        }
+        let bytes: [UInt8] = [
+            0x02,
+            UInt8((hash >> 32) & 0xff),
+            UInt8((hash >> 24) & 0xff),
+            UInt8((hash >> 16) & 0xff),
+            UInt8((hash >> 8) & 0xff),
+            UInt8(hash & 0xff),
+        ]
+        return bytes.map { String(format: "%02x", $0) }.joined(separator: ":")
+    }
+
+    public static func releaseVmnetReference(_ reference: OpaquePointer) {
+        Unmanaged.fromOpaque(UnsafeRawPointer(reference)).release()
+    }
+}
+
+/// Helper-owned endpoint allocation. Its opaque network serialization is sent
+/// directly to the runtime service and the address is returned to IPAM on close.
+public final class SharedVmnetEndpointLease: @unchecked Sendable {
+    public let serialization: xpc_object_t
+    public let ipv4Address: String
+    public let ipv4Gateway: String
+    public let macAddress: String
+    public let mtu: UInt32
+
+    private let owner: SharedVmnetNetwork
+    private let endpointIdentifier: String
+    private let lock = NSLock()
+    private var closed = false
+
+    fileprivate init(
+        owner: SharedVmnetNetwork,
+        endpointIdentifier: String,
+        serialization: xpc_object_t,
+        ipv4Address: String,
+        ipv4Gateway: String,
+        macAddress: String,
+        mtu: UInt32
+    ) {
+        self.owner = owner
+        self.endpointIdentifier = endpointIdentifier
+        self.serialization = serialization
+        self.ipv4Address = ipv4Address
+        self.ipv4Gateway = ipv4Gateway
+        self.macAddress = macAddress
+        self.mtu = mtu
+    }
+
+    public func close() {
+        lock.lock()
+        guard !closed else {
+            lock.unlock()
+            return
+        }
+        closed = true
+        lock.unlock()
+        owner.releaseEndpoint(identifier: endpointIdentifier)
+    }
+
+    deinit {
+        close()
+    }
+}
diff --git a/macOS/GhostVMKit/Operations/InitOptions.swift b/macOS/GhostVMKit/Operations/InitOptions.swift
index 4701b4f..f1d5894 100644
--- a/macOS/GhostVMKit/Operations/InitOptions.swift
+++ b/macOS/GhostVMKit/Operations/InitOptions.swift
@@ -11,6 +11,7 @@ public struct InitOptions {
     public var sharedFolderWritable: Bool
     public var sharedFolders: [SharedFolderConfig]
     public var networkConfig: NetworkConfig?
+    public var hostContainersEnabled: Bool
 
     public init(
         cpus: Int = 4,
@@ -21,7 +22,8 @@ public struct InitOptions {
         sharedFolderPath: String? = nil,
         sharedFolderWritable: Bool = false,
         sharedFolders: [SharedFolderConfig] = [],
-        networkConfig: NetworkConfig? = nil
+        networkConfig: NetworkConfig? = nil,
+        hostContainersEnabled: Bool = false
     ) {
         self.cpus = cpus
         self.memoryGiB = memoryGiB
@@ -32,5 +34,6 @@ public struct InitOptions {
         self.sharedFolderWritable = sharedFolderWritable
         self.sharedFolders = sharedFolders
         self.networkConfig = networkConfig
+        self.hostContainersEnabled = hostContainersEnabled
     }
 }
diff --git a/macOS/GhostVMKit/Operations/VMController.swift b/macOS/GhostVMKit/Operations/VMController.swift
index c493e60..8e2b649 100644
--- a/macOS/GhostVMKit/Operations/VMController.swift
+++ b/macOS/GhostVMKit/Operations/VMController.swift
@@ -448,7 +448,8 @@ public final class VMController {
             lastInstallDate: nil,
             legacyName: nil,
             macAddress: macAddress.string,
-            networkConfig: options.networkConfig
+            networkConfig: options.networkConfig,
+            hostContainersEnabled: options.hostContainersEnabled
         )
 
         let store = VMConfigStore(layout: layout)
@@ -665,6 +666,7 @@ public final class VMController {
                 macAddress: macAddress.string,
                 portForwards: [],
                 networkConfig: sourceConfig.networkConfig,
+                hostContainersEnabled: false,
                 iconMode: nil
             )
 
diff --git a/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift b/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift
new file mode 100644
index 0000000..1e052ae
--- /dev/null
+++ b/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift
@@ -0,0 +1,234 @@
+import XCTest
+@testable import GhostVMKit
+
+final class ContainerBridgeProtocolTests: XCTestCase {
+
+    // MARK: - Runtime API
+
+    func testRuntimeVersionsUseMajorCompatibility() {
+        XCTAssertTrue(ContainerRuntimeVersion.current.isCompatible(with: .init(major: 1, minor: 9)))
+        XCTAssertFalse(ContainerRuntimeVersion.current.isCompatible(with: .init(major: 2, minor: 0)))
+    }
+
+    func testRuntimeRequestEnvelopeRoundTrip() throws {
+        let request = ContainerRuntimeRequest(
+            id: "request-1",
+            method: .containerCreate,
+            parameters: ContainerRuntimeEmpty()
+        )
+        let encoded = try JSONEncoder().encode(request)
+        let envelope = try JSONDecoder().decode(ContainerRuntimeRequestEnvelope.self, from: encoded)
+        let decoded = try JSONDecoder().decode(ContainerRuntimeRequest.self, from: encoded)
+
+        XCTAssertEqual(decoded, request)
+        XCTAssertEqual(envelope.version, .current)
+        XCTAssertEqual(envelope.id, "request-1")
+        XCTAssertEqual(envelope.method.rawValue, "container.create")
+    }
+
+    func testRuntimeMethodsAllowForwardCompatibleValues() throws {
+        let method = ContainerRuntimeMethod(rawValue: "snapshot.prepare")
+        let encoded = try JSONEncoder().encode(method)
+        let decoded = try JSONDecoder().decode(ContainerRuntimeMethod.self, from: encoded)
+
+        XCTAssertEqual(decoded, method)
+        XCTAssertEqual(String(data: encoded, encoding: .utf8), #""snapshot.prepare""#)
+    }
+
+    func testRuntimeCapabilitiesRoundTrip() throws {
+        let capabilities = ContainerRuntimeCapabilities(
+            methods: [.imagePull, .containerCreate, .containerStart],
+            features: ["build.stream.v1"]
+        )
+        let encoded = try JSONEncoder().encode(capabilities)
+        let decoded = try JSONDecoder().decode(ContainerRuntimeCapabilities.self, from: encoded)
+
+        XCTAssertEqual(decoded, capabilities)
+    }
+
+    func testRuntimeFailureUsesStableCode() throws {
+        let failure = ContainerRuntimeFailure(code: .notFound, message: "container missing")
+        let encoded = try JSONEncoder().encode(failure)
+        let decoded = try JSONDecoder().decode(ContainerRuntimeFailure.self, from: encoded)
+
+        XCTAssertEqual(decoded, failure)
+        XCTAssertEqual(decoded.code.rawValue, "not_found")
+    }
+
+    func testRuntimeFilesystemRequestAndMountRoundTrip() throws {
+        let request = ContainerRuntimeRequest(
+            id: "request-fs",
+            method: .filesystemCreate,
+            parameters: ContainerRuntimeFilesystemCreateParameters(
+                guestPath: "/Users/guest/project",
+                readOnly: true
+            )
+        )
+        let mount = ContainerRuntimeMount(
+            type: "virtiofs",
+            source: "filesystem-1",
+            destination: "/workspace",
+            options: ["ro"]
+        )
+
+        let requestData = try JSONEncoder().encode(request)
+        let mountData = try JSONEncoder().encode(mount)
+
+        XCTAssertEqual(
+            try JSONDecoder().decode(
+                ContainerRuntimeRequest.self,
+                from: requestData
+            ),
+            request
+        )
+        XCTAssertEqual(try JSONDecoder().decode(ContainerRuntimeMount.self, from: mountData), mount)
+        XCTAssertEqual(request.method, .filesystemCreate)
+        XCTAssertEqual(mount.source, "filesystem-1")
+    }
+
+    // MARK: - Request decoding
+
+    func testDecodeValidRequest() throws {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine","command":["echo","hello"]}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(request.version, 1)
+        XCTAssertEqual(request.operation, "run")
+        XCTAssertEqual(request.image, "alpine")
+        XCTAssertEqual(request.command, ["echo", "hello"])
+        XCTAssertNil(request.stdin)
+    }
+
+    func testDecodeAttachedStdinRequest() throws {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine","command":["cat"],"stdin":true}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(request.stdin, true)
+    }
+
+    func testDecodeVolumeRequest() throws {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine","command":[],"volumes":[{"guestPath":"/data","destination":"/mnt/data","readOnly":true}]}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(
+            request.volumes,
+            [ContainerRunVolume(guestPath: "/data", destination: "/mnt/data", readOnly: true)]
+        )
+    }
+
+    func testDecodeTTYRequest() throws {
+        let line = Data(#"{"version":2,"operation":"run","image":"alpine","command":["/bin/sh"],"stdin":true,"tty":true,"columns":120,"rows":40}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(request.tty, true)
+        XCTAssertEqual(request.columns, 120)
+        XCTAssertEqual(request.rows, 40)
+    }
+
+    func testInputFrameRoundTrip() throws {
+        let frame = ContainerInputFrame.resize(columns: 132, rows: 43)
+        let line = try frame.encodeLine()
+        XCTAssertEqual(line.last, 0x0A)
+        XCTAssertEqual(try ContainerInputFrame.decode(line: Data(line.dropLast())), frame)
+    }
+
+    func testDecodeToleratesUnknownKeys() throws {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine","command":[],"future":"field"}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(request.image, "alpine")
+        XCTAssertEqual(request.command, [])
+    }
+
+    func testDecodeEmptyLineThrowsEmptyRequest() {
+        XCTAssertThrowsError(try ContainerRunRequest.decode(line: Data())) { error in
+            XCTAssertEqual(error as? ContainerProtocolError, .emptyRequest)
+        }
+    }
+
+    func testDecodeInvalidJSONThrows() {
+        let line = Data("not json".utf8)
+        XCTAssertThrowsError(try ContainerRunRequest.decode(line: line)) { error in
+            guard case .malformedRequest = (error as? ContainerProtocolError) else {
+                return XCTFail("Expected malformedRequest, got \(error)")
+            }
+        }
+    }
+
+    func testDecodeMissingCommandThrows() {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine"}"#.utf8)
+        XCTAssertThrowsError(try ContainerRunRequest.decode(line: line)) { error in
+            guard case .malformedRequest = (error as? ContainerProtocolError) else {
+                return XCTFail("Expected malformedRequest, got \(error)")
+            }
+        }
+    }
+
+    func testDecodeWrongCommandTypeThrows() {
+        let line = Data(#"{"version":1,"operation":"run","image":"alpine","command":"echo hi"}"#.utf8)
+        XCTAssertThrowsError(try ContainerRunRequest.decode(line: line))
+    }
+
+    func testRequestEncodeRoundTrip() throws {
+        let request = ContainerRunRequest(version: 1, operation: "run", image: "alpine", command: ["echo", "hello"], stdin: true)
+        let line = try request.encodeLine()
+        XCTAssertEqual(line.last, 0x0A)
+        let decoded = try ContainerRunRequest.decode(line: Data(line.dropLast()))
+        XCTAssertEqual(decoded, request)
+    }
+
+    // MARK: - Response encoding
+
+    private func jsonObject(for response: ContainerResponse) throws -> [String: Any] {
+        let line = try response.encodeLine()
+        XCTAssertEqual(line.last, 0x0A, "Response line must end with a newline")
+        let object = try JSONSerialization.jsonObject(with: Data(line.dropLast()))
+        return try XCTUnwrap(object as? [String: Any])
+    }
+
+    func testStdoutResponseShape() throws {
+        let payload = Data([0x00, 0xFF, 0x61]) // binary-safe via base64
+        let json = try jsonObject(for: .stdout(payload))
+        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["type"] as? String, "stdout")
+        XCTAssertEqual(json["data"] as? String, payload.base64EncodedString())
+        XCTAssertNil(json["exitCode"])
+        XCTAssertNil(json["message"])
+    }
+
+    func testStderrResponseShape() throws {
+        let payload = Data("boom".utf8)
+        let json = try jsonObject(for: .stderr(payload))
+        XCTAssertEqual(json["type"] as? String, "stderr")
+        XCTAssertEqual(json["data"] as? String, payload.base64EncodedString())
+    }
+
+    func testExitResponseShape() throws {
+        let json = try jsonObject(for: .exit(137))
+        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["type"] as? String, "exit")
+        XCTAssertEqual(json["exitCode"] as? Int32, 137)
+        XCTAssertNil(json["data"])
+        XCTAssertNil(json["message"])
+    }
+
+    func testErrorResponseShape() throws {
+        let json = try jsonObject(for: .error("something failed"))
+        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["type"] as? String, "error")
+        XCTAssertEqual(json["message"] as? String, "something failed")
+        XCTAssertNil(json["data"])
+        XCTAssertNil(json["exitCode"])
+    }
+
+    func testResponseRoundTrip() throws {
+        let response = ContainerResponse.exit(0)
+        let line = try response.encodeLine()
+        let decoded = try JSONDecoder().decode(ContainerResponse.self, from: Data(line.dropLast()))
+        XCTAssertEqual(decoded, response)
+    }
+
+    // MARK: - Constants
+
+    func testConstants() {
+        XCTAssertEqual(ContainerBridgeConstants.port, 5004)
+        XCTAssertEqual(ContainerBridgeConstants.protocolVersion, 2)
+        XCTAssertEqual(ContainerBridgeConstants.minimumProtocolVersion, 1)
+        XCTAssertEqual(ContainerBridgeConstants.maxRequestLineBytes, 64 * 1024)
+    }
+}
diff --git a/macOS/GhostVMTests/ContainerRunPolicyTests.swift b/macOS/GhostVMTests/ContainerRunPolicyTests.swift
new file mode 100644
index 0000000..ec00389
--- /dev/null
+++ b/macOS/GhostVMTests/ContainerRunPolicyTests.swift
@@ -0,0 +1,229 @@
+import XCTest
+@testable import GhostVMKit
+
+final class ContainerRunPolicyTests: XCTestCase {
+
+    private func request(
+        version: Int = 1,
+        operation: String = "run",
+        image: String = "alpine",
+        command: [String] = ["echo", "hello"],
+        stdin: Bool? = nil,
+        tty: Bool? = nil,
+        columns: UInt16? = nil,
+        rows: UInt16? = nil,
+        volumes: [ContainerRunVolume]? = nil
+    ) -> ContainerRunRequest {
+        ContainerRunRequest(
+            version: version,
+            operation: operation,
+            image: image,
+            command: command,
+            stdin: stdin,
+            tty: tty,
+            columns: columns,
+            rows: rows,
+            volumes: volumes
+        )
+    }
+
+    private func assertRejected(
+        _ request: ContainerRunRequest,
+        expected: ContainerPolicyError,
+        file: StaticString = #filePath,
+        line: UInt = #line
+    ) {
+        do {
+            _ = try ContainerRunPolicy.validate(request)
+            XCTFail("Expected \(expected) to be thrown", file: file, line: line)
+        } catch let error as ContainerPolicyError {
+            XCTAssertEqual(error, expected, file: file, line: line)
+        } catch {
+            XCTFail("Expected ContainerPolicyError, got \(error)", file: file, line: line)
+        }
+    }
+
+    // MARK: - Valid requests
+
+    func testValidRequestPasses() throws {
+        let run = try ContainerRunPolicy.validate(request())
+        XCTAssertEqual(run.image, "alpine")
+        XCTAssertEqual(run.command, ["echo", "hello"])
+        XCTAssertFalse(run.attachStdin)
+    }
+
+    func testAttachedStdinPasses() throws {
+        let run = try ContainerRunPolicy.validate(request(command: ["cat"], stdin: true))
+        XCTAssertTrue(run.attachStdin)
+        XCTAssertEqual(
+            run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234"),
+            ["run", "-i", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "cat"]
+        )
+    }
+
+    func testInteractiveTTYPasses() throws {
+        let run = try ContainerRunPolicy.validate(request(
+            version: 2,
+            command: ["/bin/sh"],
+            stdin: true,
+            tty: true,
+            columns: 120,
+            rows: 40
+        ))
+        XCTAssertTrue(run.attachStdin)
+        XCTAssertTrue(run.allocateTTY)
+        XCTAssertEqual(run.terminalColumns, 120)
+        XCTAssertEqual(run.terminalRows, 40)
+        XCTAssertEqual(
+            run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234"),
+            ["run", "-i", "-t", "--tty-size", "120", "40", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "/bin/sh"]
+        )
+    }
+
+    func testEmptyCommandIsAllowed() throws {
+        let run = try ContainerRunPolicy.validate(request(command: []))
+        XCTAssertEqual(run.command, [])
+    }
+
+    func testReadOnlyVolumePasses() throws {
+        let volume = ContainerRunVolume(guestPath: "/home/user/src", destination: "/src", readOnly: true)
+        let run = try ContainerRunPolicy.validate(request(volumes: [volume]))
+        XCTAssertEqual(run.volumes, [volume])
+    }
+
+    /// `container run` parses post-image arguments with captureForPassthrough,
+    /// so command elements starting with '-' reach the container verbatim.
+    func testCommandArgumentsStartingWithDashAreAllowed() throws {
+        let run = try ContainerRunPolicy.validate(request(command: ["echo", "-n", "hi"]))
+        XCTAssertEqual(run.command, ["echo", "-n", "hi"])
+    }
+
+    func testLimitsAreAcceptedAtBoundaries() throws {
+        let image = String(repeating: "a", count: ContainerRunPolicy.maxImageLength)
+        let command = [String](repeating: String(repeating: "b", count: ContainerRunPolicy.maxCommandArgumentLength), count: ContainerRunPolicy.maxCommandCount)
+        XCTAssertNoThrow(try ContainerRunPolicy.validate(request(image: image, command: command)))
+    }
+
+    // MARK: - Rejected requests
+
+    func testRejectsUnsupportedVersion() {
+        assertRejected(request(version: 3), expected: .unsupportedVersion(found: 3))
+    }
+
+    func testRejectsTTYOnVersion1() {
+        assertRejected(request(version: 1, tty: true), expected: .ttyRequiresProtocolVersion2)
+    }
+
+    func testRejectsZeroTerminalSize() {
+        assertRejected(
+            request(version: 2, tty: true, columns: 0, rows: 24),
+            expected: .invalidTerminalSize
+        )
+    }
+
+    func testRejectsUnsupportedOperation() {
+        assertRejected(request(operation: "exec"), expected: .unsupportedOperation(found: "exec"))
+    }
+
+    func testRejectsEmptyImage() {
+        assertRejected(request(image: ""), expected: .emptyImage)
+    }
+
+    func testRejectsImageStartingWithDash() {
+        assertRejected(request(image: "-alpine"), expected: .imageStartsWithDash)
+    }
+
+    func testRejectsImageContainingNUL() {
+        assertRejected(request(image: "alp\0ine"), expected: .imageContainsNUL)
+    }
+
+    func testRejectsImageContainingWhitespace() {
+        assertRejected(request(image: "alp ine"), expected: .imageContainsWhitespaceOrControl)
+        assertRejected(request(image: "alp\tine"), expected: .imageContainsWhitespaceOrControl)
+        assertRejected(request(image: "alp\nine"), expected: .imageContainsWhitespaceOrControl)
+        assertRejected(request(image: "alp\r\nine"), expected: .imageContainsWhitespaceOrControl)
+    }
+
+    func testRejectsImageContainingControlCharacters() {
+        assertRejected(request(image: "alp\u{1B}ine"), expected: .imageContainsWhitespaceOrControl)
+        assertRejected(request(image: "alp\u{7F}ine"), expected: .imageContainsWhitespaceOrControl)
+    }
+
+    func testRejectsImageTooLong() {
+        let image = String(repeating: "a", count: ContainerRunPolicy.maxImageLength + 1)
+        assertRejected(request(image: image), expected: .imageTooLong(max: ContainerRunPolicy.maxImageLength))
+    }
+
+    func testRejectsTooManyCommandArguments() {
+        let command = [String](repeating: "x", count: ContainerRunPolicy.maxCommandCount + 1)
+        assertRejected(request(command: command), expected: .tooManyCommandArguments(max: ContainerRunPolicy.maxCommandCount))
+    }
+
+    func testRejectsCommandArgumentTooLong() {
+        let command = [String(repeating: "b", count: ContainerRunPolicy.maxCommandArgumentLength + 1)]
+        assertRejected(request(command: command), expected: .commandArgumentTooLong(max: ContainerRunPolicy.maxCommandArgumentLength))
+    }
+
+    func testRejectsCommandArgumentContainingNUL() {
+        assertRejected(request(command: ["echo", "a\0b"]), expected: .commandArgumentContainsNUL)
+    }
+
+    func testRejectsReadWriteVolume() {
+        let volume = ContainerRunVolume(guestPath: "/data", destination: "/data", readOnly: false)
+        assertRejected(request(volumes: [volume]), expected: .readWriteGuestVolumesUnsupported)
+    }
+
+    func testRejectsDuplicateVolumeDestination() {
+        let volumes = [
+            ContainerRunVolume(guestPath: "/one", destination: "/data", readOnly: true),
+            ContainerRunVolume(guestPath: "/two", destination: "/data", readOnly: true),
+        ]
+        assertRejected(request(volumes: volumes), expected: .duplicateVolumeDestination("/data"))
+    }
+
+    func testRejectsVolumeDestinationTraversal() {
+        let volume = ContainerRunVolume(guestPath: "/data", destination: "/mnt/../", readOnly: true)
+        assertRejected(request(volumes: [volume]), expected: .invalidVolumeDestination)
+    }
+
+    // MARK: - argv construction
+
+    func testContainerArguments() throws {
+        let run = try ContainerRunPolicy.validate(request(image: "alpine", command: ["echo", "hello"]))
+        let argv = run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234")
+        XCTAssertEqual(argv, ["run", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "echo", "hello"])
+    }
+
+    func testContainerArgumentsSanitizesNameComponents() throws {
+        let run = try ContainerRunPolicy.validate(request(image: "alpine", command: []))
+        let argv = run.containerArguments(vmHash: "Weird Hash!", uniqueSuffix: "ABCD1234")
+        XCTAssertEqual(argv[2], "gv-weird-hash--abcd1234")
+        // Executable path is never part of argv; the runner supplies it.
+        XCTAssertFalse(argv.contains("ghostvm-container-runtime"))
+    }
+
+    func testContainerArgumentsCapsNameAtAppleLimit() throws {
+        let run = try ContainerRunPolicy.validate(request(image: "alpine", command: []))
+        let argv = run.containerArguments(
+            vmHash: String(repeating: "h", count: 64),
+            uniqueSuffix: String(repeating: "s", count: 32)
+        )
+        let name = argv[2]
+        XCTAssertLessThanOrEqual(name.count, ContainerRunPolicy.maxContainerNameLength)
+        XCTAssertEqual(ContainerRunPolicy.maxContainerNameLength, 63)
+        XCTAssertTrue(name.hasPrefix("gv-"))
+        // Truncation must not leave a trailing separator.
+        XCTAssertTrue(name.last?.isLetter == true || name.last?.isNumber == true)
+    }
+
+    // MARK: - Name component sanitization
+
+    func testSanitizedNameComponent() {
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent("12345"), "12345")
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent("My VM.Hash_1"), "my-vm.hash_1")
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent("--bad"), "bad")
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent(""), "x")
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent("!!!"), "x")
+        XCTAssertEqual(ContainerRunPolicy.sanitizedNameComponent(String(repeating: "a", count: 100)).count, 32)
+    }
+}
diff --git a/macOS/GhostVMTests/ContentAddressedStoreTests.swift b/macOS/GhostVMTests/ContentAddressedStoreTests.swift
new file mode 100644
index 0000000..9fdcf2c
--- /dev/null
+++ b/macOS/GhostVMTests/ContentAddressedStoreTests.swift
@@ -0,0 +1,81 @@
+import Foundation
+import XCTest
+@testable import GhostVMKit
+
+final class ContentAddressedStoreTests: XCTestCase {
+    private var temporaryDirectory: URL!
+
+    override func setUpWithError() throws {
+        temporaryDirectory = FileManager.default.temporaryDirectory
+            .appendingPathComponent("GhostVM-ContentStoreTests-\(UUID().uuidString)", isDirectory: true)
+    }
+
+    override func tearDownWithError() throws {
+        try? FileManager.default.removeItem(at: temporaryDirectory)
+    }
+
+    func testPutPublishesAtDigestPath() async throws {
+        let store = ContentAddressedStore(rootURL: temporaryDirectory)
+        let data = Data("hello".utf8)
+
+        let digest = try await store.put(data)
+        let url = try await store.blobURL(for: digest)
+        let containsBlob = await store.contains(digest)
+
+        XCTAssertEqual(digest.description, "sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824")
+        XCTAssertEqual(try Data(contentsOf: url), data)
+        XCTAssertTrue(containsBlob)
+    }
+
+    func testDuplicatePutReusesBlob() async throws {
+        let store = ContentAddressedStore(rootURL: temporaryDirectory)
+        let data = Data("same blob".utf8)
+
+        let first = try await store.put(data)
+        let second = try await store.put(data)
+
+        XCTAssertEqual(first, second)
+        let files = try FileManager.default.contentsOfDirectory(
+            at: temporaryDirectory.appendingPathComponent("blobs/sha256"),
+            includingPropertiesForKeys: nil
+        )
+        XCTAssertEqual(files.count, 1)
+    }
+
+    func testImportRejectsDigestMismatchAndCleansIngest() async throws {
+        let store = ContentAddressedStore(rootURL: temporaryDirectory)
+        let sourceURL = FileManager.default.temporaryDirectory
+            .appendingPathComponent("GhostVM-ContentSource-\(UUID().uuidString)")
+        try Data("actual".utf8).write(to: sourceURL)
+        defer { try? FileManager.default.removeItem(at: sourceURL) }
+
+        let expected = ContentDigest.sha256(Data("expected".utf8))
+        do {
+            try await store.importBlob(at: sourceURL, expectedDigest: expected)
+            XCTFail("Expected digest mismatch")
+        } catch let error as ContentStoreError {
+            guard case .digestMismatch(let reportedExpected, _) = error else {
+                return XCTFail("Unexpected error: \(error)")
+            }
+            XCTAssertEqual(reportedExpected, expected)
+        }
+
+        let ingest = temporaryDirectory.appendingPathComponent("ingest")
+        XCTAssertEqual(try FileManager.default.contentsOfDirectory(atPath: ingest.path), [])
+    }
+
+    func testDigestValidation() throws {
+        XCTAssertThrowsError(try ContentDigest("sha512:abcd"))
+        XCTAssertThrowsError(try ContentDigest("sha256:abcd"))
+        XCTAssertNoThrow(try ContentDigest("sha256:" + String(repeating: "a", count: 64)))
+    }
+
+    func testDigestCodableUsesOCIString() throws {
+        let digest = ContentDigest.sha256(Data("hello".utf8))
+        let encoded = try JSONEncoder().encode(digest)
+        let decoded = try JSONDecoder().decode(ContentDigest.self, from: encoded)
+
+        XCTAssertEqual(String(data: encoded, encoding: .utf8), #""sha256:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824""#)
+        XCTAssertEqual(decoded, digest)
+    }
+}
diff --git a/macOS/GhostVMTests/GhostClientTypesTests.swift b/macOS/GhostVMTests/GhostClientTypesTests.swift
index 4cb01c1..f9a1497 100644
--- a/macOS/GhostVMTests/GhostClientTypesTests.swift
+++ b/macOS/GhostVMTests/GhostClientTypesTests.swift
@@ -48,6 +48,25 @@ final class GhostClientTypesTests: XCTestCase {
         XCTAssertTrue(response.files.isEmpty)
     }
 
+    func testGuestFileMetadataRoundTrip() throws {
+        let metadata = GuestFileMetadata(
+            name: "sample.txt",
+            type: .file,
+            size: 42,
+            mode: 0o100644,
+            uid: 501,
+            gid: 20,
+            inode: 123,
+            device: 4,
+            linkCount: 1,
+            modifiedSeconds: 1000,
+            modifiedNanoseconds: 500
+        )
+
+        let encoded = try JSONEncoder().encode(metadata)
+        XCTAssertEqual(try JSONDecoder().decode(GuestFileMetadata.self, from: encoded), metadata)
+    }
+
     func testClipboardGetResponseConvenienceContent() throws {
         // UTF-8 text data should produce non-nil content
         let response = ClipboardGetResponse(data: Data("test content".utf8), type: "public.utf8-plain-text")
diff --git a/macOS/GhostVMTests/InitOptionsTests.swift b/macOS/GhostVMTests/InitOptionsTests.swift
index 9a48886..a61bbb3 100644
--- a/macOS/GhostVMTests/InitOptionsTests.swift
+++ b/macOS/GhostVMTests/InitOptionsTests.swift
@@ -12,6 +12,7 @@ final class InitOptionsTests: XCTestCase {
         XCTAssertNil(options.sharedFolderPath)
         XCTAssertFalse(options.sharedFolderWritable)
         XCTAssertTrue(options.sharedFolders.isEmpty)
+        XCTAssertFalse(options.hostContainersEnabled)
     }
 
     func testCustomValues() {
@@ -22,7 +23,8 @@ final class InitOptionsTests: XCTestCase {
             restoreImagePath: "/path/to/restore.ipsw",
             diskImageFormat: .sparseFile,
             sharedFolderPath: "/Users/test/shared",
-            sharedFolderWritable: true
+            sharedFolderWritable: true,
+            hostContainersEnabled: true
         )
         XCTAssertEqual(options.cpus, 8)
         XCTAssertEqual(options.memoryGiB, 16)
@@ -31,5 +33,6 @@ final class InitOptionsTests: XCTestCase {
         XCTAssertEqual(options.restoreImagePath, "/path/to/restore.ipsw")
         XCTAssertEqual(options.sharedFolderPath, "/Users/test/shared")
         XCTAssertTrue(options.sharedFolderWritable)
+        XCTAssertTrue(options.hostContainersEnabled)
     }
 }
diff --git a/macOS/GhostVMTests/MockGhostClient.swift b/macOS/GhostVMTests/MockGhostClient.swift
index 2d62b73..5432830 100644
--- a/macOS/GhostVMTests/MockGhostClient.swift
+++ b/macOS/GhostVMTests/MockGhostClient.swift
@@ -65,6 +65,10 @@ final class MockGhostClient: GhostClientProtocol {
 
     // MARK: - File system stubs
     func listDirectory(path: String) async throws -> FSListResponse { throw MockError.notImplemented }
+    func fileMetadata(path: String) async throws -> GuestFileMetadata { throw MockError.notImplemented }
+    func listDirectoryMetadata(path: String) async throws -> GuestDirectoryMetadata { throw MockError.notImplemented }
+    func readFile(path: String, offset: UInt64, length: Int) async throws -> Data { throw MockError.notImplemented }
+    func readSymbolicLink(path: String) async throws -> String { throw MockError.notImplemented }
     func mkdir(path: String) async throws {}
     func deleteFile(path: String) async throws {}
     func moveFile(from: String, to: String) async throws {}
diff --git a/macOS/GhostVMTests/NetworkManagerTests.swift b/macOS/GhostVMTests/NetworkManagerTests.swift
new file mode 100644
index 0000000..f9d27b6
--- /dev/null
+++ b/macOS/GhostVMTests/NetworkManagerTests.swift
@@ -0,0 +1,68 @@
+import XCTest
+@testable import GhostVMKit
+
+final class NetworkManagerTests: XCTestCase {
+    func testVMAndContainerEndpointsShareNetworkControlPlane() async throws {
+        let networkID = ManagedNetworkID(rawValue: "development")
+        let network = ManagedNetwork(
+            id: networkID,
+            name: "Development",
+            driver: .vmnetShared,
+            ipv4Subnet: "192.168.127.0/24",
+            gateway: "192.168.127.1"
+        )
+        let manager = NetworkManager(networks: [network])
+
+        try await manager.attach(ManagedNetworkEndpoint(
+            networkID: networkID,
+            workloadKind: .virtualMachine,
+            workloadID: "macos-dev"
+        ))
+        try await manager.attach(ManagedNetworkEndpoint(
+            networkID: networkID,
+            workloadKind: .container,
+            workloadID: "web"
+        ))
+
+        let endpoints = await manager.endpoints(networkID: networkID)
+        XCTAssertEqual(Set(endpoints.map(\.workloadKind)), [.virtualMachine, .container])
+    }
+
+    func testAttachRequiresKnownNetwork() async {
+        let manager = NetworkManager()
+        let networkID = ManagedNetworkID(rawValue: "missing")
+        let endpoint = ManagedNetworkEndpoint(
+            networkID: networkID,
+            workloadKind: .container,
+            workloadID: "web"
+        )
+
+        do {
+            try await manager.attach(endpoint)
+            XCTFail("Expected missing network error")
+        } catch let error as NetworkManagerError {
+            XCTAssertEqual(error, .networkNotFound(networkID))
+        } catch {
+            XCTFail("Unexpected error: \(error)")
+        }
+    }
+
+    func testRemovingNetworkRemovesItsEndpoints() async throws {
+        let networkID = ManagedNetworkID(rawValue: "temporary")
+        let manager = NetworkManager(networks: [
+            ManagedNetwork(id: networkID, name: "Temporary", driver: .virtualizationNAT)
+        ])
+        try await manager.attach(ManagedNetworkEndpoint(
+            networkID: networkID,
+            workloadKind: .virtualMachine,
+            workloadID: "test-vm"
+        ))
+
+        try await manager.remove(id: networkID)
+
+        let endpoints = await manager.endpoints()
+        let network = await manager.network(id: networkID)
+        XCTAssertTrue(endpoints.isEmpty)
+        XCTAssertNil(network)
+    }
+}
diff --git a/macOS/GhostVMTests/SharedVmnetIPv4PoolTests.swift b/macOS/GhostVMTests/SharedVmnetIPv4PoolTests.swift
new file mode 100644
index 0000000..6d0c6e7
--- /dev/null
+++ b/macOS/GhostVMTests/SharedVmnetIPv4PoolTests.swift
@@ -0,0 +1,41 @@
+import XCTest
+@testable import GhostVMKit
+
+final class SharedVmnetIPv4PoolTests: XCTestCase {
+    func testAllocatesContainersAfterGatewayAndVMLease() throws {
+        var pool = SharedVmnetIPv4Pool(
+            subnet: 0xc0a85000,
+            mask: 0xffffff00,
+            prefixLength: 24
+        )
+
+        XCTAssertEqual(try pool.allocate(endpointIdentifier: "one"), 0xc0a85003)
+        XCTAssertEqual(try pool.allocate(endpointIdentifier: "two"), 0xc0a85004)
+        XCTAssertEqual(SharedVmnetIPv4Pool.string(for: 0xc0a85003), "192.168.80.3")
+    }
+
+    func testAllocationIsIdempotentAndReleasedAddressIsReused() throws {
+        var pool = SharedVmnetIPv4Pool(
+            subnet: 0xc0a85000,
+            mask: 0xfffffff8,
+            prefixLength: 29
+        )
+
+        XCTAssertEqual(try pool.allocate(endpointIdentifier: "one"), 0xc0a85003)
+        XCTAssertEqual(try pool.allocate(endpointIdentifier: "one"), 0xc0a85003)
+        pool.release(endpointIdentifier: "one")
+        XCTAssertEqual(try pool.allocate(endpointIdentifier: "two"), 0xc0a85003)
+    }
+
+    func testRejectsSubnetWithoutContainerAddresses() {
+        var pool = SharedVmnetIPv4Pool(
+            subnet: 0xc0a85000,
+            mask: 0xfffffffc,
+            prefixLength: 30
+        )
+
+        XCTAssertThrowsError(try pool.allocate(endpointIdentifier: "one")) { error in
+            XCTAssertEqual(error as? SharedVmnetIPv4PoolError, .exhausted)
+        }
+    }
+}
diff --git a/macOS/GhostVMTests/VMConfigStoreTests.swift b/macOS/GhostVMTests/VMConfigStoreTests.swift
index e10c39e..c52e771 100644
--- a/macOS/GhostVMTests/VMConfigStoreTests.swift
+++ b/macOS/GhostVMTests/VMConfigStoreTests.swift
@@ -54,6 +54,7 @@ final class VMConfigStoreTests: XCTestCase {
         XCTAssertEqual(loaded.diskBytes, config.diskBytes)
         XCTAssertEqual(loaded.installed, config.installed)
         XCTAssertEqual(loaded.lastInstallBuild, config.lastInstallBuild)
+        XCTAssertFalse(loaded.hostContainersEnabled)
         XCTAssertNil(loaded.windowWidth)
         XCTAssertNil(loaded.windowHeight)
     }
diff --git a/macOS/GhostVMTests/VMCtlTests.swift b/macOS/GhostVMTests/VMCtlTests.swift
index f880b97..5f3bac7 100644
--- a/macOS/GhostVMTests/VMCtlTests.swift
+++ b/macOS/GhostVMTests/VMCtlTests.swift
@@ -130,6 +130,7 @@ final class VMStoredConfigTests: XCTestCase {
         XCTAssertEqual(decoded.restoreImagePath, config.restoreImagePath)
         XCTAssertEqual(decoded.installed, config.installed)
         XCTAssertEqual(decoded.lastInstallBuild, config.lastInstallBuild)
+        XCTAssertFalse(decoded.hostContainersEnabled)
         XCTAssertNil(decoded.windowWidth)
         XCTAssertNil(decoded.windowHeight)
     }
@@ -185,6 +186,34 @@ final class VMStoredConfigTests: XCTestCase {
         XCTAssertFalse(config.isSuspended)
     }
 
+    func testHostContainersDefaultsToFalseAndRoundTrips() throws {
+        let json = """
+        {
+            "version": 1,
+            "createdAt": 0,
+            "modifiedAt": 0,
+            "cpus": 2,
+            "memoryBytes": 4294967296,
+            "diskBytes": 34359738368,
+            "restoreImagePath": "/restore.ipsw",
+            "hardwareModelPath": "HardwareModel.bin",
+            "machineIdentifierPath": "MachineIdentifier.bin",
+            "auxiliaryStoragePath": "AuxiliaryStorage.bin",
+            "diskPath": "disk.img",
+            "sharedFolderReadOnly": true,
+            "installed": false
+        }
+        """
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .secondsSince1970
+        var config = try decoder.decode(VMStoredConfig.self, from: json.data(using: .utf8)!)
+        XCTAssertFalse(config.hostContainersEnabled)
+
+        config.hostContainersEnabled = true
+        let data = try JSONEncoder().encode(config)
+        XCTAssertTrue(try decoder.decode(VMStoredConfig.self, from: data).hostContainersEnabled)
+    }
+
     func testIsSuspendedEncodeDecode() throws {
         // JSON with isSuspended = true should decode correctly
         let json = """
diff --git a/macOS/GhostVMUITests/CreateVMUITests.swift b/macOS/GhostVMUITests/CreateVMUITests.swift
index 079ebe6..e1712de 100644
--- a/macOS/GhostVMUITests/CreateVMUITests.swift
+++ b/macOS/GhostVMUITests/CreateVMUITests.swift
@@ -26,6 +26,8 @@ final class CreateVMUITests: XCTestCase {
         XCTAssertTrue(cpuField.waitForExistence(timeout: 3), "CPU field should exist")
         XCTAssertTrue(memoryField.exists, "Memory field should exist")
         XCTAssertTrue(diskField.exists, "Disk field should exist")
+        XCTAssertTrue(app.checkBoxes["createVM.hostContainersToggle"].exists,
+                      "Host containers setting should exist")
     }
 
     func testCancelDismissesSheet() {
diff --git a/macOS/GhostVMUITests/EditVMUITests.swift b/macOS/GhostVMUITests/EditVMUITests.swift
index 1f7c76a..0e5f27b 100644
--- a/macOS/GhostVMUITests/EditVMUITests.swift
+++ b/macOS/GhostVMUITests/EditVMUITests.swift
@@ -71,6 +71,8 @@ final class EditVMUITests: XCTestCase {
             XCTAssertEqual(memoryField.value as? String, "16", "Memory field should have mock value of 16")
             XCTAssertEqual(diskField.value as? String, "128", "Disk field should have mock value of 128")
             XCTAssertFalse(diskField.isEnabled, "Disk field should be read-only after VM creation")
+            XCTAssertTrue(app.checkBoxes["editVM.hostContainersToggle"].exists,
+                          "Host containers setting should exist")
         }
 
         XCTContext.runActivity(named: "Units and info banner") { _ in
diff --git a/macOS/project.yml b/macOS/project.yml
index d402b51..10cbcf1 100644
--- a/macOS/project.yml
+++ b/macOS/project.yml
@@ -2,8 +2,8 @@ name: GhostVM
 options:
   bundleIdPrefix: org.ghostvm
   deploymentTarget:
-    macOS: "15.0"
-  xcodeVersion: "15.4"
+    macOS: "26.0"
+  xcodeVersion: "26.0"
 
 packages:
   Sparkle:
@@ -11,6 +11,9 @@ packages:
     from: "2.6.0"
   GhostHTTP:
     path: ../Packages/GhostHTTP
+  Containerization:
+    url: https://github.com/apple/containerization.git
+    exactVersion: "0.40.1"
 
 settings:
   base:
@@ -45,6 +48,7 @@ targets:
       base:
         PRODUCT_NAME: GhostVMKit
         PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostvmkit
+        SKIP_INSTALL: YES
         GENERATE_INFOPLIST_FILE: YES
         DEFINES_MODULE: YES
         SWIFT_VERSION: "5.0"
@@ -74,6 +78,7 @@ targets:
       base:
         PRODUCT_NAME: vmctl
         PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.vmctl
+        SKIP_INSTALL: YES
         GENERATE_INFOPLIST_FILE: YES
         INFOPLIST_KEY_LSBackgroundOnly: YES
         SWIFT_VERSION: "5.0"
@@ -107,10 +112,19 @@ targets:
       - target: GhostVMKit
         embed: true
       - package: GhostHTTP
+      - target: GhostVMContainerRuntime
+        embed: true
+        codeSign: true
+      - target: GhostVMImageFetch
+        codeSign: true
+        copy:
+          destination: wrapper
+          subpath: Contents/Helpers
     settings:
       base:
         PRODUCT_NAME: GhostVMHelper
         PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostvm.helper
+        SKIP_INSTALL: YES
         INFOPLIST_FILE: ../build/generated-plists/GhostVMHelper-Info.plist
         GENERATE_INFOPLIST_FILE: NO
         SWIFT_VERSION: "5.0"
@@ -119,8 +133,125 @@ targets:
         CODE_SIGN_IDENTITY: "Apple Development"
         DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
         ENABLE_HARDENED_RUNTIME: YES
+        EMBEDDED_CONTENT_CONTAINS_SWIFT: YES
         LD_RUNPATH_SEARCH_PATHS:
           - "@executable_path/../Frameworks"
+    postBuildScripts:
+      - name: Embed Container Helper Swift Libraries
+        basedOnDependencyAnalysis: false
+        script: |
+          SWIFT_STDLIB_TOOL="${TOOLCHAIN_DIR}/usr/bin/swift-stdlib-tool"
+          RUNTIME="${TARGET_BUILD_DIR}/${CONTENTS_FOLDER_PATH}/XPCServices/ghostvm-container-runtime.xpc/Contents/MacOS/ghostvm-container-runtime"
+          FETCHER="${TARGET_BUILD_DIR}/${CONTENTS_FOLDER_PATH}/Helpers/ghostvm-image-fetch"
+          FRAMEWORKS="${TARGET_BUILD_DIR}/${CONTENTS_FOLDER_PATH}/Frameworks"
+          mkdir -p "${FRAMEWORKS}"
+          for CANDIDATE in "${TOOLCHAIN_DIR}"/usr/lib/swift-*/macosx; do
+            if [ -f "${CANDIDATE}/libswiftCompatibilitySpan.dylib" ]; then
+              SWIFT_LIBS="${CANDIDATE}"
+            fi
+          done
+          test -n "${SWIFT_LIBS:-}"
+          if [ -n "${EXPANDED_CODE_SIGN_IDENTITY:-}" ]; then
+            "${SWIFT_STDLIB_TOOL}" --copy --scan-executable "${RUNTIME}" --scan-executable "${FETCHER}" --platform "${PLATFORM_NAME}" --source-libraries "${SWIFT_LIBS}" --destination "${FRAMEWORKS}" --sign "${EXPANDED_CODE_SIGN_IDENTITY}"
+          else
+            "${SWIFT_STDLIB_TOOL}" --copy --scan-executable "${RUNTIME}" --scan-executable "${FETCHER}" --platform "${PLATFORM_NAME}" --source-libraries "${SWIFT_LIBS}" --destination "${FRAMEWORKS}"
+          fi
+          rm -f "${FRAMEWORKS}/libswiftCompatibilitySpan.dylib.original"
+
+  GhostVMContainerRuntime:
+    type: xpc-service
+    platform: macOS
+    sources:
+      - path: GhostVMContainerRuntime
+        excludes:
+          - "Info.plist"
+          - "entitlements.plist"
+    dependencies:
+      - target: GhostVMKit
+        link: true
+        embed: false
+      - package: Containerization
+        product: Containerization
+      - package: Containerization
+        product: ContainerizationOCI
+      - package: Containerization
+        product: ContainerizationOS
+      - package: Containerization
+        product: ContainerizationExtras
+    settings:
+      base:
+        PRODUCT_NAME: ghostvm-container-runtime
+        # Provisioning constraint: the runtime reuses the helper's
+        # org.ghostvm.ghostvm.helper application identifier / vmnet Developer ID
+        # provisioning profile (already authorized) as a deliberate duplicate
+        # identity for this testable DMG. Do not change without a new profile.
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostvm.helper
+        SKIP_INSTALL: YES
+        INFOPLIST_FILE: GhostVMContainerRuntime/Info.plist
+        GENERATE_INFOPLIST_FILE: NO
+        SWIFT_VERSION: "6.0"
+        CODE_SIGN_ENTITLEMENTS: GhostVMContainerRuntime/entitlements.plist
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: "Apple Development"
+        DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
+        ENABLE_HARDENED_RUNTIME: YES
+        LD_RUNPATH_SEARCH_PATHS:
+          - "@executable_path/../Frameworks"
+          - "@executable_path/../../../../Frameworks"
+
+  GhostVMImageFetch:
+    type: tool
+    platform: macOS
+    sources:
+      - path: GhostVMImageFetch
+    dependencies:
+      - package: Containerization
+        product: Containerization
+      - package: Containerization
+        product: ContainerizationArchive
+      - package: Containerization
+        product: ContainerizationExtras
+      - package: Containerization
+        product: ContainerizationOCI
+    settings:
+      base:
+        PRODUCT_NAME: ghostvm-image-fetch
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.image-fetch
+        SKIP_INSTALL: YES
+        SWIFT_VERSION: "6.0"
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: "Apple Development"
+        DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
+        ENABLE_HARDENED_RUNTIME: YES
+        LD_RUNPATH_SEARCH_PATHS:
+          - "@executable_path/Frameworks"
+          - "@executable_path/../Frameworks"
+
+  GhostVMFS:
+    type: extensionkit-extension
+    platform: macOS
+    deploymentTarget: "26.0"
+    sources:
+      - path: GhostVMFS
+        excludes:
+          - "*.plist"
+    dependencies:
+      - sdk: FSKit.framework
+      - sdk: ExtensionFoundation.framework
+    settings:
+      base:
+        PRODUCT_NAME: GhostVMFS
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostvm.fs
+        SKIP_INSTALL: YES
+        INFOPLIST_FILE: ../build/generated-plists/GhostVMFS-Info.plist
+        GENERATE_INFOPLIST_FILE: NO
+        CODE_SIGN_ENTITLEMENTS: GhostVMFS/entitlements.plist
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: "Apple Development"
+        DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
+        ENABLE_APP_SANDBOX: YES
+        ENABLE_HARDENED_RUNTIME: YES
+        SWIFT_VERSION: "5.0"
 
   GhostVM:
     type: application
@@ -150,11 +281,15 @@ targets:
         copy:
           destination: plugins
           subpath: Helpers
+      - target: GhostVMFS
+        embed: true
+        codeSign: true
       - package: Sparkle
     settings:
       base:
         PRODUCT_NAME: GhostVM
         PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostvm
+        SKIP_INSTALL: NO
         INFOPLIST_FILE: ../build/generated-plists/GhostVM-Info.plist
         CODE_SIGN_ENTITLEMENTS: GhostVM/entitlements.plist
         CODE_SIGN_STYLE: Automatic

From 815d1b77d45758d1cdd00b0625bbc84a2c8bf83d Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 15:18:22 -0700
Subject: [PATCH 02/18] Add arm64 GhostHTTP3 dynamic framework

---
 macOS/GhostHTTP3/README.md                    |  196 +
 macOS/GhostHTTP3/RESEARCH.md                  |   54 +
 macOS/GhostHTTP3/Sources/GhostHTTP3.c         |   36 +
 macOS/GhostHTTP3/THIRD_PARTY_NOTICES.md       |   26 +
 macOS/GhostHTTP3/Tests/smoke.c                |   28 +
 macOS/GhostHTTP3/Tests/smoke.swift            |    8 +
 macOS/GhostHTTP3/Tests/stress.c               | 1125 +++++
 macOS/GhostHTTP3/Tests/udp-chaos-proxy.c      |  767 +++
 macOS/GhostHTTP3/Tests/udp-datagram.c         |   87 +
 .../include/GhostHTTP3/GhostHTTP3.h           |   35 +
 macOS/GhostHTTP3/include/module.modulemap     |    5 +
 macOS/GhostHTTP3/quiche-0.29.3.Cargo.lock     | 4497 +++++++++++++++++
 macOS/GhostHTTP3/scripts/build-framework.sh   |  136 +
 .../GhostHTTP3/scripts/build-with-rust-dmg.sh |   29 +
 .../scripts/create-rust-toolchain-dmg.sh      |   59 +
 macOS/GhostHTTP3/scripts/soak-chaos.sh        |  119 +
 macOS/GhostHTTP3/scripts/test-chaos.sh        |  489 ++
 macOS/GhostHTTP3/scripts/test-framework.sh    |   43 +
 macOS/GhostHTTP3/scripts/test-http3.sh        |   75 +
 macOS/GhostHTTP3/scripts/test-stress.sh       |   48 +
 20 files changed, 7862 insertions(+)
 create mode 100644 macOS/GhostHTTP3/README.md
 create mode 100644 macOS/GhostHTTP3/RESEARCH.md
 create mode 100644 macOS/GhostHTTP3/Sources/GhostHTTP3.c
 create mode 100644 macOS/GhostHTTP3/THIRD_PARTY_NOTICES.md
 create mode 100644 macOS/GhostHTTP3/Tests/smoke.c
 create mode 100644 macOS/GhostHTTP3/Tests/smoke.swift
 create mode 100644 macOS/GhostHTTP3/Tests/stress.c
 create mode 100644 macOS/GhostHTTP3/Tests/udp-chaos-proxy.c
 create mode 100644 macOS/GhostHTTP3/Tests/udp-datagram.c
 create mode 100644 macOS/GhostHTTP3/include/GhostHTTP3/GhostHTTP3.h
 create mode 100644 macOS/GhostHTTP3/include/module.modulemap
 create mode 100644 macOS/GhostHTTP3/quiche-0.29.3.Cargo.lock
 create mode 100755 macOS/GhostHTTP3/scripts/build-framework.sh
 create mode 100755 macOS/GhostHTTP3/scripts/build-with-rust-dmg.sh
 create mode 100755 macOS/GhostHTTP3/scripts/create-rust-toolchain-dmg.sh
 create mode 100755 macOS/GhostHTTP3/scripts/soak-chaos.sh
 create mode 100755 macOS/GhostHTTP3/scripts/test-chaos.sh
 create mode 100755 macOS/GhostHTTP3/scripts/test-framework.sh
 create mode 100755 macOS/GhostHTTP3/scripts/test-http3.sh
 create mode 100755 macOS/GhostHTTP3/scripts/test-stress.sh

diff --git a/macOS/GhostHTTP3/README.md b/macOS/GhostHTTP3/README.md
new file mode 100644
index 0000000..8ba6974
--- /dev/null
+++ b/macOS/GhostHTTP3/README.md
@@ -0,0 +1,196 @@
+# GhostHTTP3
+
+GhostHTTP3 packages Cloudflare's production QUIC and RFC 9114 HTTP/3 stack as a
+single arm64 dynamic macOS framework. The framework executable is a Mach-O
+dylib that exposes quiche's complete C API (QUIC, HTTP/3, and QPACK) plus a
+tiny, versioned GhostHTTP3 wrapper API.
+
+This is a transport library, not the GhostFile protocol. GhostFile will use
+ordinary HTTP request semantics (`GET`, `HEAD`, status codes, headers, and body
+data) over the `h3` ALPN. There is no GhostFile-specific wire framing here.
+
+## Build
+
+Requirements:
+
+- Xcode command-line tools
+- Rust 1.88 or newer via `rustup`
+- CMake and Ninja (used while building quiche's BoringSSL dependency)
+- `libev` and `uthash` for the upstream C interoperability test
+
+The native build/test dependencies can be installed with:
+
+```sh
+brew install cmake ninja libev uthash
+```
+
+Run:
+
+```sh
+macOS/GhostHTTP3/scripts/build-with-rust-dmg.sh
+```
+
+That command creates a reusable sparse read/write macOS disk image at
+`macOS/GhostHTTP3/.build/toolchains/Rust-1.88.0-macOS-arm64.sparseimage`, mounts it at
+`macOS/GhostHTTP3/.build/mount/GhostHTTP3Rust188`, installs the toolchain and the arm64 macOS Rust target
+inside the image, then builds and tests the framework. Its logical capacity is
+4 GB, but it consumes only the space actually written. It can be detached with:
+
+```sh
+hdiutil detach macOS/GhostHTTP3/.build/mount/GhostHTTP3Rust188
+```
+
+If an appropriate `rustup` toolchain is already on `PATH`, the lower-level
+`build-framework.sh`, `test-framework.sh`, `test-stress.sh`, `test-http3.sh`,
+and `test-chaos.sh` scripts can be run directly. The disk-image build command
+runs them automatically after building the framework.
+
+`test-http3.sh` compiles Cloudflare's C client and server against the generated
+framework, exchanges `GET /` and an HTTP `200` response over loopback UDP, and
+asserts that ALPN negotiated `h3`. This exercises HTTP/3 HEADERS, SETTINGS,
+QPACK, DATA, and QUIC stream handling through the packaged library.
+
+`test-stress.sh` links a deterministic two-endpoint harness against the same
+framework. It establishes TLS over QUIC and exercises a 12 KiB QPACK header
+block, an empty response, 96 multiplexed requests while an earlier request is
+paused, 16 parallel 512 KiB response bodies with byte-for-byte validation,
+single-stream cancellation, server-initiated stream reset, GOAWAY rejection,
+bidi stream limit enforcement, application-level CONNECTION_CLOSE with peer-error
+inspection, and an oversized-header rejection path that asserts the peer receives
+`HTTP_EXCESSIVE_LOAD` (0x107). Application traffic is delivered in reversed
+datagram batches to exercise QUIC packet reordering throughout those scenarios.
+Set `GHOST_HTTP3_TEST_SANITIZERS=1` to compile the C harness with AddressSanitizer
+and UndefinedBehaviorSanitizer.
+
+`test-framework.sh` links and runs C and Swift consumers against the dynamic
+framework, verifies its arm64-only architecture and `@rpath` install name, and
+checks its ad-hoc build signature. A shipping app should embed the framework in
+`Contents/Frameworks` and sign it with the app during the normal code-signing
+phase.
+
+`test-chaos.sh` builds a user-space UDP impairment proxy
+(`Tests/udp-chaos-proxy.c`) and replays conservative, deterministic, seeded
+impairments through the upstream C quiche examples over loopback. The five
+gated impairment scenarios are: a transparency baseline, two-sided datagram
+loss (4% c2s / 5% s2c), 10% duplication, delay+jitter+reorder, and a
+deterministic 1350-byte MTU filter check. Each scenario asserts BOTH ends: the `http3-client` log proves
+HTTP/3 success over QUIC (`200 "byez"`) AND the proxy's machine-parseable
+`stats` lines prove each impairment actually fired (loss, dup, delayed,
+reordered, drop_mtu). The MTU check completes real HTTP/3 exchanges and then
+injects a harmless 1400-byte UDP sentinel to prove over-limit packets are
+dropped without claiming flaky live-traffic black-hole recovery. The proxy's per-direction delayed-packet queues are
+hard-bounded (`--queue`, default 256) with counted overflow drops, and every
+test process terminates within `GHOST_HTTP3_CHAOS_PROXY_MAX_DURATION` (300s
+default) plus a per-client watchdog. The gate also rejects forwarding errors
+and any delayed datagrams still queued at shutdown.
+
+`soak-chaos.sh` is an opt-in seed-progression soak that re-runs the chaos
+scenarios across an advancing seed range with a wall-clock budget checked
+between seeds. It is
+explicitly off the gated path (enable with `GHOST_HTTP3_SOAK=1`).
+
+## Environment variables
+
+`GHOST_HTTP3_TEST_SANITIZERS=1` builds the C harness and the proxy with
+AddressSanitizer and UndefinedBehaviorSanitizer.
+
+`GHOST_HTTP3_BUILD_DIR` (all scripts) overrides the default
+`.build` directory under the project root.
+
+`GHOST_HTTP3_BUILD_DIR`, `MACOSX_DEPLOYMENT_TARGET`, and the rust toolchain
+mount path (`GHOST_HTTP3_RUST_MOUNT`) affect `build-framework.sh` only.
+
+`test-chaos.sh` knobs (read alongside the script for the full list):
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `GHOST_HTTP3_CHAOS_SEED` | `7` | impairment PRNG seed; seed 7 is validated as stable |
+| `GHOST_HTTP3_CHAOS_ITERATIONS` | `3` | client exchanges per scenario |
+| `GHOST_HTTP3_CHAOS_PORT_BASE` | PID-derived | first candidate UDP port pair |
+| `GHOST_HTTP3_CHAOS_SERVER_PORT` / `GHOST_HTTP3_CHAOS_PROXY_PORT` | unset | pin both ports (skip the scan) |
+| `GHOST_HTTP3_CHAOS_CLIENT_TIMEOUT` | `25` | per-client watchdog (must exceed quiche's 5s idle timeout) |
+| `GHOST_HTTP3_CHAOS_PROXY_MAX_DURATION` | `300` | proxy self-termination bound |
+| `GHOST_HTTP3_CHAOS_HARSH` | `0` | opt-in harsh-loss reproducer documenting the example's idle-timeout limit |
+| `GHOST_HTTP3_CHAOS_TOLERATE_STALL` | `0` | diagnostic escape hatch; when 1, stalls are counted and the run is explicitly not reported as a recovery gate |
+| `GHOST_HTTP3_TEST_SANITIZERS` | `0` | build the proxy with ASan/UBSan |
+
+`soak-chaos.sh` knobs:
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `GHOST_HTTP3_SOAK_SEED_START` | `7` | first seed in the advancing range |
+| `GHOST_HTTP3_SOAK_SEED_COUNT` | `5` | how many successive seeds to run |
+| `GHOST_HTTP3_SOAK_MAX_SECONDS` | `240` | wall-clock budget checked between seeds (one in-flight seed can overshoot) |
+| `GHOST_HTTP3_SOAK_MAX_ITERATIONS` | `0` | hard seed-count cap (0 = no cap) |
+| `GHOST_HTTP3_SOAK_ITERATIONS` | `3` | per-seed chaos iterations |
+| `GHOST_HTTP3_SOAK_SANITIZERS` | `0` | build the proxy with ASan/UBSan |
+| `GHOST_HTTP3_SOAK_HARSH` | `0` | also run the harsh reproducer per seed |
+| `GHOST_HTTP3_SOAK_QUIET` | `0` | suppress per-seed chaos output |
+
+## Limitations (read before extending)
+
+- The included driver is IPv4 / loopback only; both endpoints are on
+  `127.0.0.1`. There is no second host involved and no need for elevated
+  privileges. The proxy accepts remote listen/target addresses, but tracks one
+  active client address at a time.
+- The stock quiche `http3-server.c` / `http3-client.c` examples hard-code
+  `max_idle_timeout = 5000ms`. When two-sided loss or an aggressive MTU
+  black hole hits a
+  handshake-critical flight, the example can stall until that timeout fires;
+  `test-chaos.sh` uses a validated conservative profile, and `GHOST_HTTP3_CHAOS_HARSH=1`
+  documents the failing edge as a reproducer rather than a regression. The
+  soak classifies the same stall mode as STALLED (informational), not as a
+  failure, so seed progression can advance across seeds that exercise the
+  quiche example's hard limit without false-positive soak alarms.
+- quiche's own `lost=` counter is `0` for the very short recovered flows used
+  here; it is printed for information but not asserted. The proxy's own
+  `drop_loss` counter is the source of truth.
+- The combined multi-impairment scenario was pulled from the gated set on
+  purpose: as soon as loss, dup, jitter, and MTU drop happen together, any of
+  them can land on the 1-RTT flight inside the 5s idle window and stall the
+  handshake non-deterministically across OS scheduling jitter. The five
+  individual scenarios each prove one impairment class cleanly.
+- The soak does not exercise the harsh-loss reproducer unless
+  `GHOST_HTTP3_SOAK_HARSH=1` is set; enabling it widens the per-seed timeout.
+
+## What remains for multi-host / GitHub Actions
+
+- Cross-host UDP impairment via the real network (not loopback) would catch
+  reception-path behaviors the loopback simulator cannot (OS receive-buffer
+  pressure, ICMP source quench, etc.). The proxy already supports
+  `--listen-host` / `--target-host`; what is missing is the test driver that
+  runs the client on one host and the server on another.
+- A "multi-impairment at once" deterministic profile that survives without a
+  handshake stall likely needs a request-padding profile or a patched
+  example with a longer idle timeout; the harsh reproducer above is the
+  placeholder until then.
+- For GitHub Actions: gate `test-chaos.sh` (it is already wired into
+  `build-with-rust-dmg.sh`); make `GHOST_HTTP3_SOAK=1` opt-in per matrix
+  because the seed-progression adds non-trivial wall-clock.
+- A long-horizon multi-hour soak run from CI on a quiet dedicated runner
+  would further tighten the leak-detection evidence on the proxy.
+
+Artifacts are written to `macOS/GhostHTTP3/.build/artifacts/`:
+
+- `GhostHTTP3.framework`: arm64 dynamic framework. Its executable has install
+  name `@rpath/GhostHTTP3.framework/Versions/A/GhostHTTP3`.
+
+There is no x86 slice, static release library, or XCFramework. The build asks
+Cargo for a `cdylib` only and links the GhostHTTP3 wrapper into that same dylib.
+System dependencies such as libc++ and libiconv are recorded by the dylib and
+do not require separate bundled copies.
+
+## Upstream
+
+The build pins quiche 0.29.3 to commit
+`55886df3be579579207104c8e645825b6347a209`. The upstream header is copied into
+the generated framework so C, Objective-C, C++, and Swift targets can use the
+full HTTP/3 API.
+
+quiche intentionally excludes `Cargo.lock` from its repository. This wrapper
+checks in the resolved `quiche-0.29.3.Cargo.lock` used by the build and passes
+Cargo's `--locked` flag, so transitive Rust dependencies cannot drift.
+
+See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) for licensing.
+See [RESEARCH.md](RESEARCH.md) for the Google QUICHE, Mozilla Neqo, and
+Cloudflare quiche selection rationale.
diff --git a/macOS/GhostHTTP3/RESEARCH.md b/macOS/GhostHTTP3/RESEARCH.md
new file mode 100644
index 0000000..897cd1f
--- /dev/null
+++ b/macOS/GhostHTTP3/RESEARCH.md
@@ -0,0 +1,54 @@
+# HTTP/3 implementation selection
+
+Decision recorded 2026-07-31: package Cloudflare quiche behind the standalone
+GhostHTTP3 framework boundary.
+
+## Candidates
+
+### Google QUICHE
+
+[Google QUICHE](https://quiche.googlesource.com/quiche/) is Google's
+production-ready QUIC and HTTP/3 implementation and powers Google servers,
+Chromium, and Envoy. It is reputable, but its upstream embedding instructions
+say that embedders currently need to implement platform APIs and create build
+files. Its documented standalone binaries target Linux. That makes it a poor
+first fit for a small, signed macOS app framework despite the strength of the
+implementation.
+
+### Mozilla Neqo
+
+[Mozilla Neqo](https://github.com/mozilla/neqo) is Firefox's Rust QUIC, HTTP/3,
+and QPACK implementation. Mozilla states that its server functionality is
+experimental, not used in production by Mozilla, not optimized for performance
+or resource use, and should not be used in production. GhostFile needs a server
+as a primary role, so Neqo was not selected.
+
+### Cloudflare quiche
+
+[Cloudflare quiche](https://github.com/cloudflare/quiche) implements IETF QUIC
+and HTTP/3, powers Cloudflare's production edge, is used by Android's DNS
+resolver, and can be integrated into curl. Its supported build emits native
+library targets, including a `cdylib`, with a thin C FFI. The FFI includes the complete
+HTTP/3 surface needed here: ALPN `h3`, SETTINGS, QPACK, request/response HEADERS,
+DATA bodies, GOAWAY, stream events, and transport statistics.
+
+This combination gives GhostFile a production-proven implementation with a
+small and testable macOS integration surface. GhostHTTP3 builds quiche's
+supported `cdylib` output for arm64 and packages that one dylib as a dynamic
+framework; the backend can be upgraded or replaced without changing
+GhostFile's HTTP resource model.
+
+## GhostFile integration boundary
+
+GhostFile will use regular RFC 9114 semantics over UDP/QUIC:
+
+- standard HTTP methods and pseudoheaders;
+- HTTP status codes and response headers;
+- request and response bodies in HTTP/3 DATA frames;
+- one HTTP request stream per independent filesystem operation;
+- no GhostFile transport framing inside QUIC streams.
+
+The existing mDNS discovery remains appropriate for the LAN. Its service
+metadata should advertise `alpn=h3` and `transport=http3`; the discovered
+endpoint feeds either this framework's client API or Apple's HTTP/3-capable
+`URLSession` client.
diff --git a/macOS/GhostHTTP3/Sources/GhostHTTP3.c b/macOS/GhostHTTP3/Sources/GhostHTTP3.c
new file mode 100644
index 0000000..e338444
--- /dev/null
+++ b/macOS/GhostHTTP3/Sources/GhostHTTP3.c
@@ -0,0 +1,36 @@
+#include 
+
+uint32_t ghost_http3_api_version(void) {
+    return GHOST_HTTP3_API_VERSION;
+}
+
+const char *ghost_http3_backend_version(void) {
+    return quiche_version();
+}
+
+const uint8_t *ghost_http3_application_protocol(size_t *length) {
+    static const uint8_t protocol[] = QUICHE_H3_APPLICATION_PROTOCOL;
+
+    if (length != NULL) {
+        *length = sizeof(protocol) - 1;
+    }
+
+    return protocol;
+}
+
+bool ghost_http3_backend_is_ready(void) {
+    quiche_config *quic = quiche_config_new(QUICHE_PROTOCOL_VERSION);
+    if (quic == NULL) {
+        return false;
+    }
+
+    quiche_h3_config *http3 = quiche_h3_config_new();
+    if (http3 == NULL) {
+        quiche_config_free(quic);
+        return false;
+    }
+
+    quiche_h3_config_free(http3);
+    quiche_config_free(quic);
+    return true;
+}
diff --git a/macOS/GhostHTTP3/THIRD_PARTY_NOTICES.md b/macOS/GhostHTTP3/THIRD_PARTY_NOTICES.md
new file mode 100644
index 0000000..0eab9a8
--- /dev/null
+++ b/macOS/GhostHTTP3/THIRD_PARTY_NOTICES.md
@@ -0,0 +1,26 @@
+# Third-party notices
+
+GhostHTTP3 incorporates [Cloudflare quiche](https://github.com/cloudflare/quiche),
+which is distributed under the BSD 2-Clause License:
+
+Copyright (C) 2018-2019, Cloudflare, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/macOS/GhostHTTP3/Tests/smoke.c b/macOS/GhostHTTP3/Tests/smoke.c
new file mode 100644
index 0000000..9536864
--- /dev/null
+++ b/macOS/GhostHTTP3/Tests/smoke.c
@@ -0,0 +1,28 @@
+#include 
+
+#include 
+#include 
+
+int main(void) {
+    size_t alpn_length = 0;
+    const uint8_t *alpn = ghost_http3_application_protocol(&alpn_length);
+
+    if (ghost_http3_api_version() != GHOST_HTTP3_API_VERSION) {
+        fprintf(stderr, "GhostHTTP3 API version mismatch\n");
+        return 1;
+    }
+
+    if (!ghost_http3_backend_is_ready()) {
+        fprintf(stderr, "quiche QUIC/HTTP3 backend failed its runtime check\n");
+        return 2;
+    }
+
+    if (alpn_length != 3 || alpn[0] != 2 || memcmp(alpn + 1, "h3", 2) != 0) {
+        fprintf(stderr, "unexpected HTTP/3 ALPN bytes\n");
+        return 3;
+    }
+
+    printf("GhostHTTP3 API %u, quiche %s, ALPN h3\n",
+           ghost_http3_api_version(), ghost_http3_backend_version());
+    return 0;
+}
diff --git a/macOS/GhostHTTP3/Tests/smoke.swift b/macOS/GhostHTTP3/Tests/smoke.swift
new file mode 100644
index 0000000..01dc115
--- /dev/null
+++ b/macOS/GhostHTTP3/Tests/smoke.swift
@@ -0,0 +1,8 @@
+import GhostHTTP3
+
+guard ghost_http3_backend_is_ready() else {
+    fatalError("GhostHTTP3 backend is not ready")
+}
+
+let backend = String(cString: ghost_http3_backend_version())
+print("Swift linked GhostHTTP3 API \(ghost_http3_api_version()), quiche \(backend)")
diff --git a/macOS/GhostHTTP3/Tests/stress.c b/macOS/GhostHTTP3/Tests/stress.c
new file mode 100644
index 0000000..b377342
--- /dev/null
+++ b/macOS/GhostHTTP3/Tests/stress.c
@@ -0,0 +1,1125 @@
+// Exercises the packaged GhostHTTP3/quiche library without a TCP or HTTP/1.x
+// fallback. Two HTTP/3 endpoints exchange QUIC datagrams in memory so the
+// test is deterministic while still traversing TLS, QUIC, QPACK, and RFC 9114.
+
+#include 
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#define CID_LEN 16
+#define DATAGRAM_CAPACITY 65535
+#define WIRE_DATAGRAM_CAPACITY 2048
+#define REORDER_BATCH_SIZE 4
+#define MAX_REQUESTS 256
+#define BODY_CHUNK 16384
+#define FAST_REQUEST_COUNT 96
+#define LARGE_REQUEST_COUNT 16
+#define LARGE_BODY_LENGTH (512 * 1024)
+#define CANCEL_BODY_LENGTH (32 * 1024 * 1024)
+// RFC 9114 §4.2 error codes for the wire-level application close that quiche
+// raises when a peer exceeds SETTINGS_MAX_FIELD_SECTION_SIZE: the QPACK
+// decoder reports HeaderListTooLarge and the h3 layer converts that to
+// Error::ExcessiveLoad, surfaced as a CONNECTION_CLOSE error code on the
+// wire. Used to verify rejection rather than "no crash" only.
+#define H3_EXCESSIVE_LOAD_ERROR 0x107
+#define H3_REQUEST_CANCELLED_ERROR 0x10c
+#define SERVER_RESET_ERROR 0x201
+#define CONNECTION_CLOSE_ERROR 0x102
+#define STREAM_LIMIT_TEST_COUNT 4
+#define MAX_FIELD_SECTION_SIZE_LIMIT 128
+
+#define CHECK(condition, ...) do { \
+    if (!(condition)) { \
+        fprintf(stderr, "FAIL: "); \
+        fprintf(stderr, __VA_ARGS__); \
+        fprintf(stderr, "\n"); \
+        exit(1); \
+    } \
+} while (0)
+
+typedef struct {
+    quiche_conn *quic;
+    quiche_h3_conn *h3;
+    struct sockaddr_storage local;
+    socklen_t local_len;
+    struct sockaddr_storage peer;
+    socklen_t peer_len;
+} endpoint;
+
+typedef struct {
+    endpoint client;
+    endpoint server;
+    quiche_config *client_config;
+    quiche_config *server_config;
+    quiche_h3_config *client_h3_config;
+    quiche_h3_config *server_h3_config;
+    size_t datagrams;
+    bool reorder_datagrams;
+    size_t reordered_batches;
+} test_pair;
+
+typedef struct {
+    uint8_t bytes[WIRE_DATAGRAM_CAPACITY];
+    size_t length;
+    quiche_send_info send_info;
+} queued_packet;
+
+typedef struct {
+    uint64_t stream_id;
+    char path[16384];
+    bool headers_sent;
+    bool finished;
+    bool abandoned;
+    bool server_reset_after_partial;
+    bool server_reset_sent;
+    size_t body_length;
+    size_t body_sent;
+    uint8_t seed;
+} server_response;
+
+typedef struct {
+    server_response responses[MAX_REQUESTS];
+    size_t response_count;
+    int64_t paused_stream;
+    bool paused_released;
+    bool goaway_sent;
+    size_t reset_count;
+} server_state;
+
+typedef struct {
+    uint64_t stream_id;
+    char path[128];
+    size_t expected_length;
+    size_t body_received;
+    uint8_t seed;
+    int status;
+    bool saw_headers;
+    bool finished;
+    bool cancel_on_headers;
+    bool cancellation_sent;
+    bool expect_server_reset;
+    bool saw_reset;
+} client_request;
+
+typedef struct {
+    client_request requests[MAX_REQUESTS];
+    size_t request_count;
+    bool saw_goaway;
+} client_state;
+
+typedef struct {
+    char path[16384];
+    int status;
+    size_t content_length;
+    bool saw_path;
+    bool saw_status;
+    bool saw_content_length;
+} parsed_headers;
+
+static void make_address(struct sockaddr_storage *storage, socklen_t *length,
+                         uint16_t port) {
+    struct sockaddr_in *address = (struct sockaddr_in *) storage;
+    memset(storage, 0, sizeof(*storage));
+    address->sin_family = AF_INET;
+    address->sin_port = htons(port);
+    address->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    *length = sizeof(*address);
+}
+
+static quiche_config *make_config_with_stream_limit(bool server,
+                                                     const char *cert_path,
+                                                     const char *key_path,
+                                                     uint64_t max_streams_bidi) {
+    quiche_config *config = quiche_config_new(QUICHE_PROTOCOL_VERSION);
+    CHECK(config != NULL, "could not create QUIC config");
+    CHECK(quiche_config_set_application_protos(
+              config, (const uint8_t *) QUICHE_H3_APPLICATION_PROTOCOL,
+              sizeof(QUICHE_H3_APPLICATION_PROTOCOL) - 1) == 0,
+          "could not configure h3 ALPN");
+
+    if (server) {
+        CHECK(quiche_config_load_cert_chain_from_pem_file(config, cert_path) == 0,
+              "could not load test certificate at %s", cert_path);
+        CHECK(quiche_config_load_priv_key_from_pem_file(config, key_path) == 0,
+              "could not load test private key at %s", key_path);
+    } else {
+        quiche_config_verify_peer(config, false);
+    }
+
+    quiche_config_set_max_idle_timeout(config, 30000);
+    quiche_config_set_max_recv_udp_payload_size(config, 1350);
+    quiche_config_set_max_send_udp_payload_size(config, 1350);
+    quiche_config_set_initial_max_data(config, 64 * 1024 * 1024);
+    quiche_config_set_initial_max_stream_data_bidi_local(config, 2 * 1024 * 1024);
+    quiche_config_set_initial_max_stream_data_bidi_remote(config, 2 * 1024 * 1024);
+    quiche_config_set_initial_max_stream_data_uni(config, 2 * 1024 * 1024);
+    quiche_config_set_initial_max_streams_bidi(config, max_streams_bidi);
+    quiche_config_set_initial_max_streams_uni(config, 16);
+    quiche_config_set_disable_active_migration(config, true);
+    return config;
+}
+
+static quiche_config *make_config(bool server, const char *cert_path,
+                                  const char *key_path) {
+    return make_config_with_stream_limit(server, cert_path, key_path, MAX_REQUESTS);
+}
+
+static ssize_t deliver_first_client_packet(test_pair *pair, uint8_t *packet,
+                                           quiche_send_info *send_info) {
+    ssize_t length = quiche_conn_send(pair->client.quic, packet,
+                                      DATAGRAM_CAPACITY, send_info);
+    CHECK(length > 0, "client did not produce an Initial packet: %zd", length);
+
+    uint32_t version = 0;
+    uint8_t type = 0;
+    uint8_t scid[QUICHE_MAX_CONN_ID_LEN];
+    uint8_t dcid[QUICHE_MAX_CONN_ID_LEN];
+    uint8_t token[256];
+    size_t scid_len = sizeof(scid);
+    size_t dcid_len = sizeof(dcid);
+    size_t token_len = sizeof(token);
+    CHECK(quiche_header_info(packet, (size_t) length, CID_LEN, &version, &type,
+                             scid, &scid_len, dcid, &dcid_len,
+                             token, &token_len) == 0,
+          "could not parse client Initial packet");
+
+    uint8_t server_scid[CID_LEN];
+    for (size_t i = 0; i < sizeof(server_scid); i++) {
+        server_scid[i] = (uint8_t) (0xa0 + i);
+    }
+    pair->server.quic = quiche_accept(
+        server_scid, sizeof(server_scid), dcid, dcid_len,
+        (const struct sockaddr *) &pair->server.local, pair->server.local_len,
+        (const struct sockaddr *) &pair->server.peer, pair->server.peer_len,
+        pair->server_config);
+    CHECK(pair->server.quic != NULL, "could not create server QUIC connection");
+
+    quiche_recv_info receive_info = {
+        .from = (struct sockaddr *) &send_info->from,
+        .from_len = send_info->from_len,
+        .to = (struct sockaddr *) &send_info->to,
+        .to_len = send_info->to_len,
+    };
+    CHECK(quiche_conn_recv(pair->server.quic, packet, (size_t) length,
+                           &receive_info) == length,
+          "server rejected client Initial packet");
+    pair->datagrams++;
+    return length;
+}
+
+static void deliver_packet(endpoint *to, queued_packet *packet) {
+    quiche_recv_info receive_info = {
+        .from = (struct sockaddr *) &packet->send_info.from,
+        .from_len = packet->send_info.from_len,
+        .to = (struct sockaddr *) &packet->send_info.to,
+        .to_len = packet->send_info.to_len,
+    };
+    ssize_t accepted = quiche_conn_recv(to->quic, packet->bytes,
+                                        packet->length, &receive_info);
+    CHECK(accepted == (ssize_t) packet->length,
+          "peer rejected QUIC packet: %zd", accepted);
+}
+
+static size_t transfer(endpoint *from, endpoint *to, bool reorder,
+                       size_t *reordered_batches) {
+    size_t transferred = 0;
+    for (;;) {
+        queued_packet batch[REORDER_BATCH_SIZE];
+        size_t batch_count = 0;
+        while (batch_count < REORDER_BATCH_SIZE) {
+            queued_packet *packet = &batch[batch_count];
+            ssize_t length = quiche_conn_send(
+                from->quic, packet->bytes, sizeof(packet->bytes),
+                &packet->send_info);
+            if (length == QUICHE_ERR_DONE) {
+                break;
+            }
+            CHECK(length > 0, "QUIC packet generation failed: %zd", length);
+            packet->length = (size_t) length;
+            batch_count++;
+        }
+        if (batch_count == 0) {
+            break;
+        }
+        if (reorder && batch_count > 1) {
+            for (size_t i = batch_count; i > 0; i--) {
+                deliver_packet(to, &batch[i - 1]);
+            }
+            (*reordered_batches)++;
+        } else {
+            for (size_t i = 0; i < batch_count; i++) {
+                deliver_packet(to, &batch[i]);
+            }
+        }
+        transferred += batch_count;
+        CHECK(transferred < 100000, "QUIC transfer loop did not quiesce");
+    }
+    return transferred;
+}
+
+static size_t pump_transport(test_pair *pair) {
+    size_t total = 0;
+    for (size_t round = 0; round < 10000; round++) {
+        size_t moved = transfer(&pair->client, &pair->server,
+                                pair->reorder_datagrams,
+                                &pair->reordered_batches);
+        moved += transfer(&pair->server, &pair->client,
+                          pair->reorder_datagrams,
+                          &pair->reordered_batches);
+        total += moved;
+        if (moved == 0) {
+            pair->datagrams += total;
+            return total;
+        }
+    }
+    CHECK(false, "QUIC transport did not quiesce");
+    return 0;
+}
+
+static void assert_h3_alpn(endpoint *value, const char *side) {
+    const uint8_t *protocol = NULL;
+    size_t protocol_length = 0;
+    quiche_conn_application_proto(value->quic, &protocol, &protocol_length);
+    CHECK(protocol_length == 2 && memcmp(protocol, "h3", 2) == 0,
+          "%s negotiated unexpected ALPN", side);
+}
+
+static void pair_create_internal(test_pair *pair, const char *cert_path,
+                                  const char *key_path,
+                                  uint64_t server_max_streams_bidi,
+                                  uint64_t max_field_section_size,
+                                  uint16_t client_port) {
+    memset(pair, 0, sizeof(*pair));
+    make_address(&pair->client.local, &pair->client.local_len, client_port);
+    make_address(&pair->client.peer, &pair->client.peer_len, client_port + 1);
+    pair->server.local = pair->client.peer;
+    pair->server.local_len = pair->client.peer_len;
+    pair->server.peer = pair->client.local;
+    pair->server.peer_len = pair->client.local_len;
+
+    pair->client_config = make_config(false, cert_path, key_path);
+    pair->server_config = make_config_with_stream_limit(
+        true, cert_path, key_path, server_max_streams_bidi);
+
+    uint8_t client_scid[CID_LEN];
+    for (size_t i = 0; i < sizeof(client_scid); i++) {
+        client_scid[i] = (uint8_t) (0x10 + i);
+    }
+    pair->client.quic = quiche_connect(
+        "localhost", client_scid, sizeof(client_scid),
+        (const struct sockaddr *) &pair->client.local, pair->client.local_len,
+        (const struct sockaddr *) &pair->client.peer, pair->client.peer_len,
+        pair->client_config);
+    CHECK(pair->client.quic != NULL, "could not create client QUIC connection");
+
+    uint8_t first_packet[DATAGRAM_CAPACITY];
+    quiche_send_info first_send_info;
+    deliver_first_client_packet(pair, first_packet, &first_send_info);
+
+    for (size_t round = 0; round < 1000; round++) {
+        pump_transport(pair);
+        if (quiche_conn_is_established(pair->client.quic) &&
+            quiche_conn_is_established(pair->server.quic)) {
+            break;
+        }
+    }
+    CHECK(quiche_conn_is_established(pair->client.quic),
+          "client QUIC handshake did not complete");
+    CHECK(quiche_conn_is_established(pair->server.quic),
+          "server QUIC handshake did not complete");
+    assert_h3_alpn(&pair->client, "client");
+    assert_h3_alpn(&pair->server, "server");
+
+    pair->client_h3_config = quiche_h3_config_new();
+    pair->server_h3_config = quiche_h3_config_new();
+    CHECK(pair->client_h3_config != NULL && pair->server_h3_config != NULL,
+          "could not create HTTP/3 configs");
+    quiche_h3_config_set_qpack_max_table_capacity(pair->client_h3_config, 4096);
+    quiche_h3_config_set_qpack_blocked_streams(pair->client_h3_config, 100);
+    quiche_h3_config_set_qpack_max_table_capacity(pair->server_h3_config, 4096);
+    quiche_h3_config_set_qpack_blocked_streams(pair->server_h3_config, 100);
+    if (max_field_section_size > 0) {
+        quiche_h3_config_set_max_field_section_size(
+            pair->server_h3_config, max_field_section_size);
+    }
+
+    pair->client.h3 = quiche_h3_conn_new_with_transport(
+        pair->client.quic, pair->client_h3_config);
+    pair->server.h3 = quiche_h3_conn_new_with_transport(
+        pair->server.quic, pair->server_h3_config);
+    CHECK(pair->client.h3 != NULL && pair->server.h3 != NULL,
+          "could not create HTTP/3 connections");
+    pump_transport(pair);
+}
+
+static void pair_create(test_pair *pair, const char *cert_path,
+                        const char *key_path) {
+    pair_create_internal(pair, cert_path, key_path, MAX_REQUESTS, 0, 41000);
+}
+
+static void pair_free(test_pair *pair) {
+    quiche_h3_conn_free(pair->client.h3);
+    quiche_h3_conn_free(pair->server.h3);
+    quiche_conn_free(pair->client.quic);
+    quiche_conn_free(pair->server.quic);
+    quiche_h3_config_free(pair->client_h3_config);
+    quiche_h3_config_free(pair->server_h3_config);
+    quiche_config_free(pair->client_config);
+    quiche_config_free(pair->server_config);
+}
+
+static int parse_header(uint8_t *name, size_t name_length, uint8_t *value,
+                        size_t value_length, void *context) {
+    parsed_headers *headers = context;
+    if (name_length == 5 && memcmp(name, ":path", 5) == 0) {
+        CHECK(value_length < sizeof(headers->path), "request path is too large");
+        memcpy(headers->path, value, value_length);
+        headers->path[value_length] = '\0';
+        headers->saw_path = true;
+    } else if (name_length == 7 && memcmp(name, ":status", 7) == 0) {
+        char status[4] = {0};
+        CHECK(value_length == 3, "malformed :status value");
+        memcpy(status, value, value_length);
+        headers->status = atoi(status);
+        headers->saw_status = true;
+    } else if (name_length == 14 &&
+               memcmp(name, "content-length", 14) == 0) {
+        char length[32] = {0};
+        CHECK(value_length < sizeof(length), "content-length is too large");
+        memcpy(length, value, value_length);
+        headers->content_length = (size_t) strtoull(length, NULL, 10);
+        headers->saw_content_length = true;
+    }
+    return 0;
+}
+
+static uint8_t body_byte(uint8_t seed, size_t offset) {
+    return (uint8_t) (seed + (offset * 31u) + (offset >> 8));
+}
+
+static server_response *server_find(server_state *state, uint64_t stream_id) {
+    for (size_t i = 0; i < state->response_count; i++) {
+        if (state->responses[i].stream_id == stream_id) {
+            return &state->responses[i];
+        }
+    }
+    return NULL;
+}
+
+static server_response *server_add(server_state *state, uint64_t stream_id,
+                                   const char *path) {
+    CHECK(state->response_count < MAX_REQUESTS, "too many server requests");
+    server_response *response = &state->responses[state->response_count++];
+    memset(response, 0, sizeof(*response));
+    response->stream_id = stream_id;
+    CHECK(strlen(path) < sizeof(response->path), "server path overflow");
+    strcpy(response->path, path);
+    return response;
+}
+
+static void configure_server_response(server_state *state,
+                                      server_response *response) {
+    unsigned index = 0;
+    if (strcmp(response->path, "/paused") == 0) {
+        state->paused_stream = (int64_t) response->stream_id;
+        response->body_length = 11;
+        response->seed = 0x71;
+        return;
+    }
+    if (strcmp(response->path, "/empty") == 0) {
+        response->body_length = 0;
+        response->seed = 0;
+        return;
+    }
+    if (strcmp(response->path, "/cancel") == 0) {
+        response->body_length = CANCEL_BODY_LENGTH;
+        response->seed = 0xc1;
+        return;
+    }
+    if (strcmp(response->path, "/server-reset") == 0) {
+        response->body_length = LARGE_BODY_LENGTH;
+        response->seed = 0xd1;
+        response->server_reset_after_partial = true;
+        return;
+    }
+    if (sscanf(response->path, "/fast/%u", &index) == 1) {
+        response->body_length = 257 + (index % 127);
+        response->seed = (uint8_t) index;
+        return;
+    }
+    if (sscanf(response->path, "/large/%u", &index) == 1) {
+        response->body_length = LARGE_BODY_LENGTH;
+        response->seed = (uint8_t) (0x40 + index);
+        return;
+    }
+    CHECK(false, "server received unknown path: %s", response->path);
+}
+
+static bool send_response_headers(test_pair *pair, server_response *response) {
+    char length[32];
+    snprintf(length, sizeof(length), "%zu", response->body_length);
+    const char *status = response->body_length == 0 ? "204" : "200";
+    quiche_h3_header headers[] = {
+        {(const uint8_t *) ":status", 7,
+         (const uint8_t *) status, strlen(status)},
+        {(const uint8_t *) "content-length", 14,
+         (const uint8_t *) length, strlen(length)},
+        {(const uint8_t *) "server", 6,
+         (const uint8_t *) "ghost-http3-stress", 18},
+    };
+    int result = quiche_h3_send_response(
+        pair->server.h3, pair->server.quic, response->stream_id,
+        headers, sizeof(headers) / sizeof(headers[0]),
+        response->body_length == 0);
+    if (result == QUICHE_H3_ERR_DONE ||
+        result == QUICHE_H3_ERR_STREAM_BLOCKED) {
+        return false;
+    }
+    CHECK(result == 0, "could not send response headers on stream %" PRIu64
+          ": %d", response->stream_id, result);
+    response->headers_sent = true;
+    response->finished = response->body_length == 0;
+    return true;
+}
+
+static void server_poll(test_pair *pair, server_state *state) {
+    for (size_t count = 0; count < 10000; count++) {
+        quiche_h3_event *event = NULL;
+        int64_t stream_id = quiche_h3_conn_poll(
+            pair->server.h3, pair->server.quic, &event);
+        if (stream_id < 0) {
+            return;
+        }
+
+        switch (quiche_h3_event_type(event)) {
+        case QUICHE_H3_EVENT_HEADERS: {
+            parsed_headers headers = {0};
+            CHECK(quiche_h3_event_for_each_header(event, parse_header,
+                                                   &headers) == 0,
+                  "could not parse request headers");
+            CHECK(headers.saw_path, "request omitted :path");
+            if (server_find(state, (uint64_t) stream_id) == NULL) {
+                server_response *response = server_add(
+                    state, (uint64_t) stream_id, headers.path);
+                configure_server_response(state, response);
+            }
+            break;
+        }
+        case QUICHE_H3_EVENT_DATA: {
+            uint8_t discard[4096];
+            while (quiche_h3_recv_body(pair->server.h3, pair->server.quic,
+                                       (uint64_t) stream_id, discard,
+                                       sizeof(discard)) > 0) {}
+            break;
+        }
+        case QUICHE_H3_EVENT_RESET:
+            state->reset_count++;
+            break;
+        case QUICHE_H3_EVENT_FINISHED:
+        case QUICHE_H3_EVENT_GOAWAY:
+        case QUICHE_H3_EVENT_PRIORITY_UPDATE:
+            break;
+        }
+        quiche_h3_event_free(event);
+    }
+    CHECK(false, "server HTTP/3 event loop did not quiesce");
+}
+
+static void server_flush(test_pair *pair, server_state *state) {
+    uint8_t body[BODY_CHUNK];
+    for (size_t i = 0; i < state->response_count; i++) {
+        server_response *response = &state->responses[i];
+        if (response->finished || response->abandoned) {
+            continue;
+        }
+        if (!response->headers_sent) {
+            if ((int64_t) response->stream_id == state->paused_stream &&
+                !state->paused_released) {
+                continue;
+            }
+            if (!send_response_headers(pair, response)) {
+                continue;
+            }
+            if (response->finished) {
+                continue;
+            }
+        }
+
+        if (response->server_reset_after_partial && !response->server_reset_sent) {
+            if (response->body_sent >= BODY_CHUNK) {
+                int result = quiche_conn_stream_shutdown(
+                    pair->server.quic, response->stream_id,
+                    QUICHE_SHUTDOWN_WRITE, SERVER_RESET_ERROR);
+                CHECK(result == 0, "server stream reset failed on %" PRIu64
+                      ": %d", response->stream_id, result);
+                response->server_reset_sent = true;
+                response->abandoned = true;
+                state->reset_count++;
+                continue;
+            }
+        }
+
+        size_t remaining = response->body_length - response->body_sent;
+        size_t length = remaining < sizeof(body) ? remaining : sizeof(body);
+        for (size_t j = 0; j < length; j++) {
+            body[j] = body_byte(response->seed, response->body_sent + j);
+        }
+        bool final = length == remaining;
+        ssize_t sent = quiche_h3_send_body(
+            pair->server.h3, pair->server.quic, response->stream_id,
+            body, length, final);
+        if (sent == QUICHE_H3_ERR_DONE || sent == QUICHE_H3_ERR_STREAM_BLOCKED) {
+            continue;
+        }
+        if (sent == QUICHE_H3_TRANSPORT_ERR_STREAM_STOPPED ||
+            sent == QUICHE_H3_TRANSPORT_ERR_STREAM_RESET) {
+            response->abandoned = true;
+            state->reset_count++;
+            continue;
+        }
+        CHECK(sent > 0, "body send failed on stream %" PRIu64 ": %zd",
+              response->stream_id, sent);
+        response->body_sent += (size_t) sent;
+        if (response->body_sent == response->body_length) {
+            response->finished = true;
+        }
+    }
+}
+
+static client_request *client_find(client_state *state, uint64_t stream_id) {
+    for (size_t i = 0; i < state->request_count; i++) {
+        if (state->requests[i].stream_id == stream_id) {
+            return &state->requests[i];
+        }
+    }
+    return NULL;
+}
+
+static size_t client_send(test_pair *pair, client_state *state,
+                          const char *path, size_t expected_length,
+                          uint8_t seed, bool cancel_on_headers,
+                          bool padded_headers, bool expect_server_reset) {
+    CHECK(state->request_count < MAX_REQUESTS, "too many client requests");
+    static uint8_t padding[12 * 1024];
+    static bool padding_ready = false;
+    if (!padding_ready) {
+        memset(padding, 'p', sizeof(padding));
+        padding_ready = true;
+    }
+    quiche_h3_header headers[] = {
+        {(const uint8_t *) ":method", 7, (const uint8_t *) "GET", 3},
+        {(const uint8_t *) ":scheme", 7, (const uint8_t *) "https", 5},
+        {(const uint8_t *) ":authority", 10,
+         (const uint8_t *) "ghostfile.test", 14},
+        {(const uint8_t *) ":path", 5,
+         (const uint8_t *) path, strlen(path)},
+        {(const uint8_t *) "user-agent", 10,
+         (const uint8_t *) "ghost-http3-stress", 18},
+        {(const uint8_t *) "x-ghost-padding", 15,
+         padding, padded_headers ? sizeof(padding) : 0},
+    };
+    size_t header_count = padded_headers ? 6 : 5;
+    int64_t stream_id = quiche_h3_send_request(
+        pair->client.h3, pair->client.quic, headers, header_count, true);
+    CHECK(stream_id >= 0, "could not send %s: %" PRId64, path, stream_id);
+
+    size_t index = state->request_count++;
+    client_request *request = &state->requests[index];
+    memset(request, 0, sizeof(*request));
+    request->stream_id = (uint64_t) stream_id;
+    snprintf(request->path, sizeof(request->path), "%s", path);
+    request->expected_length = expected_length;
+    request->seed = seed;
+    request->cancel_on_headers = cancel_on_headers;
+    request->expect_server_reset = expect_server_reset;
+    return index;
+}
+
+static void client_poll(test_pair *pair, client_state *state) {
+    for (size_t count = 0; count < 10000; count++) {
+        quiche_h3_event *event = NULL;
+        int64_t stream_id = quiche_h3_conn_poll(
+            pair->client.h3, pair->client.quic, &event);
+        if (stream_id < 0) {
+            return;
+        }
+
+        if (quiche_h3_event_type(event) == QUICHE_H3_EVENT_GOAWAY) {
+            state->saw_goaway = true;
+            quiche_h3_event_free(event);
+            continue;
+        }
+
+        client_request *request = client_find(state, (uint64_t) stream_id);
+        CHECK(request != NULL, "event for unknown client stream %" PRId64,
+              stream_id);
+
+        switch (quiche_h3_event_type(event)) {
+        case QUICHE_H3_EVENT_HEADERS: {
+            parsed_headers headers = {0};
+            CHECK(quiche_h3_event_for_each_header(event, parse_header,
+                                                   &headers) == 0,
+                  "could not parse response headers");
+            CHECK(headers.saw_status && headers.saw_content_length,
+                  "response omitted required headers on %s", request->path);
+            if (!request->expect_server_reset) {
+                CHECK(headers.content_length == request->expected_length,
+                      "content-length mismatch on %s: %zu != %zu",
+                      request->path, headers.content_length,
+                      request->expected_length);
+            }
+            request->status = headers.status;
+            request->saw_headers = true;
+            if (request->cancel_on_headers && !request->cancellation_sent) {
+                int result = quiche_conn_stream_shutdown(
+                    pair->client.quic, request->stream_id,
+                    QUICHE_SHUTDOWN_READ, H3_REQUEST_CANCELLED_ERROR);
+                CHECK(result == 0, "could not cancel stream %" PRIu64 ": %d",
+                      request->stream_id, result);
+                request->cancellation_sent = true;
+            }
+            break;
+        }
+        case QUICHE_H3_EVENT_DATA: {
+            if (request->cancellation_sent) {
+                break;
+            }
+            uint8_t body[32768];
+            for (;;) {
+                ssize_t received = quiche_h3_recv_body(
+                    pair->client.h3, pair->client.quic, request->stream_id,
+                    body, sizeof(body));
+                if (received <= 0) {
+                    break;
+                }
+                if (!request->expect_server_reset) {
+                    for (ssize_t i = 0; i < received; i++) {
+                        uint8_t expected = body_byte(
+                            request->seed, request->body_received + (size_t) i);
+                        CHECK(body[i] == expected,
+                              "body corruption on %s at offset %zu",
+                              request->path,
+                              request->body_received + (size_t) i);
+                    }
+                }
+                request->body_received += (size_t) received;
+                CHECK(request->body_received <= request->expected_length,
+                      "body overflow on %s", request->path);
+            }
+            break;
+        }
+        case QUICHE_H3_EVENT_FINISHED:
+            CHECK(request->saw_headers, "stream finished before headers: %s",
+                  request->path);
+            CHECK(request->body_received == request->expected_length,
+                  "short body on %s: %zu != %zu", request->path,
+                  request->body_received, request->expected_length);
+            request->finished = true;
+            break;
+        case QUICHE_H3_EVENT_RESET:
+            CHECK(request->cancellation_sent || request->expect_server_reset,
+                  "unexpected reset on %s", request->path);
+            request->saw_reset = true;
+            break;
+        case QUICHE_H3_EVENT_GOAWAY:
+        case QUICHE_H3_EVENT_PRIORITY_UPDATE:
+            break;
+        }
+        quiche_h3_event_free(event);
+    }
+    CHECK(false, "client HTTP/3 event loop did not quiesce");
+}
+
+static void drive_round(test_pair *pair, server_state *server,
+                        client_state *client) {
+    pump_transport(pair);
+    server_poll(pair, server);
+    server_flush(pair, server);
+    pump_transport(pair);
+    client_poll(pair, client);
+}
+
+static bool requests_finished(client_state *state, size_t first, size_t count) {
+    for (size_t i = first; i < first + count; i++) {
+        if (!state->requests[i].finished) {
+            return false;
+        }
+    }
+    return true;
+}
+
+static void drive_until_finished(test_pair *pair, server_state *server,
+                                 client_state *client, size_t first,
+                                 size_t count, const char *label) {
+    for (size_t round = 0; round < 200000; round++) {
+        drive_round(pair, server, client);
+        if (requests_finished(client, first, count)) {
+            return;
+        }
+        CHECK(!quiche_conn_is_closed(pair->client.quic) &&
+              !quiche_conn_is_closed(pair->server.quic),
+              "connection closed during %s", label);
+    }
+    CHECK(false, "%s timed out", label);
+}
+
+int main(int argc, char **argv) {
+    CHECK(argc == 3, "usage: %s cert.crt cert.key", argv[0]);
+    CHECK(ghost_http3_backend_is_ready(), "GhostHTTP3 backend is not ready");
+
+    test_pair pair;
+    server_state server = {.paused_stream = -1};
+    client_state client = {0};
+    pair_create(&pair, argv[1], argv[2]);
+    printf("PASS handshake: TLS over QUIC negotiated ALPN h3\n");
+    pair.reorder_datagrams = true;
+
+    size_t empty = client_send(&pair, &client, "/empty", 0, 0,
+                               false, true, false);
+    drive_until_finished(&pair, &server, &client, empty, 1,
+                         "empty response and oversized request headers");
+    CHECK(client.requests[empty].status == 204,
+          "empty response had status %d", client.requests[empty].status);
+    printf("PASS edge headers: 12 KiB header block and zero-byte 204 response\n");
+
+    size_t paused = client_send(&pair, &client, "/paused", 11, 0x71,
+                                false, false, false);
+    size_t fast_first = client.request_count;
+    for (unsigned i = 0; i < FAST_REQUEST_COUNT; i++) {
+        char path[64];
+        snprintf(path, sizeof(path), "/fast/%u", i);
+        client_send(&pair, &client, path, 257 + (i % 127), (uint8_t) i,
+                    false, (i % 19) == 0, false);
+        if ((i % 8) == 7) {
+            drive_round(&pair, &server, &client);
+        }
+    }
+    drive_until_finished(&pair, &server, &client, fast_first,
+                         FAST_REQUEST_COUNT, "multiplexed fast requests");
+    CHECK(server.paused_stream == (int64_t) client.requests[paused].stream_id,
+          "server did not observe the paused stream");
+    CHECK(!client.requests[paused].saw_headers &&
+          !client.requests[paused].finished,
+          "paused request unexpectedly completed before fast requests");
+    printf("PASS multiplexing: %d requests completed while an earlier stream was paused\n",
+           FAST_REQUEST_COUNT);
+
+    server.paused_released = true;
+    drive_until_finished(&pair, &server, &client, paused, 1,
+                         "released paused request");
+    printf("PASS stream resumption: paused request completed after release\n");
+
+    size_t large_first = client.request_count;
+    for (unsigned i = 0; i < LARGE_REQUEST_COUNT; i++) {
+        char path[64];
+        snprintf(path, sizeof(path), "/large/%u", i);
+        client_send(&pair, &client, path, LARGE_BODY_LENGTH,
+                    (uint8_t) (0x40 + i), false, false, false);
+        if ((i % 8) == 7) {
+            drive_round(&pair, &server, &client);
+        }
+    }
+    drive_until_finished(&pair, &server, &client, large_first,
+                         LARGE_REQUEST_COUNT, "parallel large bodies");
+    printf("PASS parallel bodies: %d x %d KiB verified byte-for-byte\n",
+           LARGE_REQUEST_COUNT, LARGE_BODY_LENGTH / 1024);
+
+    size_t cancelled = client_send(&pair, &client, "/cancel",
+                                    CANCEL_BODY_LENGTH, 0xc1, true, false,
+                                    false);
+    size_t post_cancel_first = client.request_count;
+    for (unsigned i = 1000; i < 1016; i++) {
+        char path[64];
+        snprintf(path, sizeof(path), "/fast/%u", i);
+        client_send(&pair, &client, path, 257 + (i % 127), (uint8_t) i,
+                    false, false, false);
+        if ((i % 8) == 7) {
+            drive_round(&pair, &server, &client);
+        }
+    }
+    drive_until_finished(&pair, &server, &client, post_cancel_first, 16,
+                         "requests after cancellation");
+    CHECK(client.requests[cancelled].cancellation_sent,
+          "large response was not cancelled");
+    CHECK(!quiche_conn_is_closed(pair.client.quic),
+          "cancelling one stream closed the connection");
+    printf("PASS cancellation: reset a 32 MiB stream; 16 sibling requests survived\n");
+
+    size_t reuse = client_send(&pair, &client, "/fast/4242",
+                               257 + (4242 % 127), (uint8_t) 4242,
+                               false, true, false);
+    drive_until_finished(&pair, &server, &client, reuse, 1,
+                         "connection reuse");
+    CHECK(pair.reordered_batches > 0,
+          "test traffic never produced a reorderable packet batch");
+
+    quiche_stats stats;
+    quiche_conn_stats(pair.client.quic, &stats);
+    printf("PASS connection reuse: %zu request streams on one h3 connection\n",
+           client.request_count);
+    printf("PASS packet reordering: %zu datagram batches delivered in reverse order\n",
+           pair.reordered_batches);
+    printf("PASS GhostHTTP3 stress: datagrams=%zu sent=%zu recv=%zu lost=%zu\n",
+           pair.datagrams, stats.sent, stats.recv, stats.lost);
+
+    size_t reset_idx = client_send(&pair, &client, "/server-reset",
+                                    LARGE_BODY_LENGTH, 0xd1, false, false,
+                                    true);
+    for (size_t round = 0; round < 200000; round++) {
+        drive_round(&pair, &server, &client);
+        if (client.requests[reset_idx].saw_reset) {
+            break;
+        }
+        CHECK(!quiche_conn_is_closed(pair.client.quic) &&
+              !quiche_conn_is_closed(pair.server.quic),
+              "connection closed during server-initiated reset");
+    }
+    CHECK(client.requests[reset_idx].saw_reset,
+          "client did not observe server reset");
+    CHECK(client.requests[reset_idx].saw_headers,
+          "client did not see headers before server reset");
+    CHECK(client.requests[reset_idx].body_received > 0,
+          "client received no body before server reset");
+    CHECK(client.requests[reset_idx].body_received < LARGE_BODY_LENGTH,
+          "client received full body despite expecting server reset");
+    printf("PASS server reset: stream reset mid-response after %" PRId64 " bytes\n",
+           (int64_t) client.requests[reset_idx].body_received);
+
+    size_t normal_after_reset = client_send(&pair, &client, "/fast/9999",
+                                             257 + (9999 % 127),
+                                             (uint8_t) 9999, false, false,
+                                             false);
+    drive_until_finished(&pair, &server, &client, normal_after_reset, 1,
+                         "request after server-initiated reset");
+    printf("PASS post-reset recovery: new request completed on same connection\n");
+
+    size_t pre_goaway = client_send(&pair, &client, "/fast/7777",
+                                     257 + (7777 % 127),
+                                     (uint8_t) 7777, false, false, false);
+    int goaway_result = quiche_h3_send_goaway(pair.server.h3, pair.server.quic,
+                                               0);
+    CHECK(goaway_result == 0, "could not send GOAWAY: %d", goaway_result);
+    server.goaway_sent = true;
+    drive_until_finished(&pair, &server, &client, pre_goaway, 1,
+                         "in-flight request after GOAWAY");
+    CHECK(client.requests[pre_goaway].finished,
+          "in-flight request did not complete after GOAWAY");
+    for (size_t round = 0; round < 1000; round++) {
+        drive_round(&pair, &server, &client);
+        if (client.saw_goaway) {
+            break;
+        }
+    }
+    CHECK(client.saw_goaway, "client did not receive GOAWAY event");
+    printf("PASS GOAWAY: in-flight request completed; client received GOAWAY\n");
+
+    quiche_h3_header goaway_reject_headers[] = {
+        {(const uint8_t *) ":method", 7, (const uint8_t *) "GET", 3},
+        {(const uint8_t *) ":scheme", 7, (const uint8_t *) "https", 5},
+        {(const uint8_t *) ":authority", 10,
+         (const uint8_t *) "ghostfile.test", 14},
+        {(const uint8_t *) ":path", 5,
+         (const uint8_t *) "/fast/8888", 10},
+    };
+    int64_t post_goaway_stream = quiche_h3_send_request(
+        pair.client.h3, pair.client.quic, goaway_reject_headers, 4, true);
+    CHECK(post_goaway_stream == QUICHE_H3_ERR_FRAME_UNEXPECTED,
+          "post-GOAWAY request should be rejected with FRAME_UNEXPECTED, got %"
+          PRId64, post_goaway_stream);
+    printf("PASS GOAWAY rejection: new request rejected after GOAWAY (err=%"
+           PRId64 ")\n", post_goaway_stream);
+
+    pair_free(&pair);
+
+    /* ---- Stream limit / backpressure ---- */
+    static test_pair limit_pair;
+    static server_state limit_server;
+    static client_state limit_client;
+    memset(&limit_pair, 0, sizeof(limit_pair));
+    memset(&limit_server, 0, sizeof(limit_server));
+    memset(&limit_client, 0, sizeof(limit_client));
+    limit_server.paused_stream = -1;
+    pair_create_internal(&limit_pair, argv[1], argv[2],
+                          STREAM_LIMIT_TEST_COUNT, 0, 41200);
+    CHECK(quiche_conn_peer_streams_left_bidi(limit_pair.client.quic)
+            == STREAM_LIMIT_TEST_COUNT,
+          "client should see %u peer bidi streams, got %" PRIu64,
+          STREAM_LIMIT_TEST_COUNT,
+          quiche_conn_peer_streams_left_bidi(limit_pair.client.quic));
+
+    for (unsigned i = 0; i < STREAM_LIMIT_TEST_COUNT; i++) {
+        char path[64];
+        snprintf(path, sizeof(path), "/fast/%u", 10000 + i);
+        client_send(&limit_pair, &limit_client, path,
+                    257 + ((10000 + i) % 127),
+                    (uint8_t) (10000 + i), false, false, false);
+        CHECK(quiche_conn_peer_streams_left_bidi(limit_pair.client.quic)
+                == STREAM_LIMIT_TEST_COUNT - (uint64_t)(i + 1),
+              "stream budget mismatch after %u opens: got %" PRIu64,
+              i + 1,
+              quiche_conn_peer_streams_left_bidi(limit_pair.client.quic));
+    }
+
+    quiche_h3_header over_limit_headers[] = {
+        {(const uint8_t *) ":method", 7, (const uint8_t *) "GET", 3},
+        {(const uint8_t *) ":scheme", 7, (const uint8_t *) "https", 5},
+        {(const uint8_t *) ":authority", 10,
+         (const uint8_t *) "ghostfile.test", 14},
+        {(const uint8_t *) ":path", 5, (const uint8_t *) "/fast/99999", 11},
+    };
+    int64_t over_limit_stream = quiche_h3_send_request(
+        limit_pair.client.h3, limit_pair.client.quic, over_limit_headers, 4,
+        true);
+    CHECK(over_limit_stream == QUICHE_H3_TRANSPORT_ERR_STREAM_LIMIT,
+          "over-limit request should return STREAM_LIMIT, got %" PRId64,
+          over_limit_stream);
+
+    drive_until_finished(&limit_pair, &limit_server, &limit_client, 0,
+                          STREAM_LIMIT_TEST_COUNT, "stream-limit requests");
+    printf("PASS stream limit: %d streams allowed, over-limit rejected (err=%"
+           PRId64 ")\n", STREAM_LIMIT_TEST_COUNT, over_limit_stream);
+    pair_free(&limit_pair);
+
+    /* ---- Connection close with peer error ---- */
+    static test_pair close_pair;
+    pair_create(&close_pair, argv[1], argv[2]);
+    const char *close_reason = "ga-shutdown";
+    int close_result = quiche_conn_close(
+        close_pair.server.quic, true, (uint64_t) CONNECTION_CLOSE_ERROR,
+        (const uint8_t *) close_reason, strlen(close_reason));
+    CHECK(close_result == 0, "quiche_conn_close failed: %d", close_result);
+    bool client_saw_close = false;
+    for (size_t round = 0; round < 5000; round++) {
+        pump_transport(&close_pair);
+        if (quiche_conn_is_closed(close_pair.client.quic) ||
+            quiche_conn_is_draining(close_pair.client.quic)) {
+            client_saw_close = true;
+            break;
+        }
+    }
+    CHECK(client_saw_close, "client did not detect connection close");
+    CHECK(quiche_conn_is_closed(close_pair.server.quic) ||
+          quiche_conn_is_draining(close_pair.server.quic),
+          "server should be closed or draining after close");
+
+    bool peer_is_app = false;
+    uint64_t peer_error_code = 0;
+    const uint8_t *peer_reason = NULL;
+    size_t peer_reason_len = 0;
+    CHECK(quiche_conn_peer_error(close_pair.client.quic, &peer_is_app,
+                                  &peer_error_code, &peer_reason,
+                                  &peer_reason_len),
+          "client should have peer error after close");
+    CHECK(peer_is_app, "peer error should be app-level");
+    CHECK(peer_error_code == CONNECTION_CLOSE_ERROR,
+          "peer error code mismatch: %" PRIu64, peer_error_code);
+    CHECK(peer_reason_len == strlen(close_reason),
+          "peer reason length mismatch: %zu", peer_reason_len);
+    CHECK(memcmp(peer_reason, close_reason, peer_reason_len) == 0,
+          "peer reason text mismatch");
+
+    bool local_is_app = false;
+    uint64_t local_error_code = 0;
+    const uint8_t *local_reason = NULL;
+    size_t local_reason_len = 0;
+    CHECK(quiche_conn_local_error(close_pair.server.quic, &local_is_app,
+                                   &local_error_code, &local_reason,
+                                   &local_reason_len),
+          "server should have local error after initiating close");
+    CHECK(local_is_app, "local error should be app-level");
+    CHECK(local_error_code == CONNECTION_CLOSE_ERROR,
+          "local error code mismatch: %" PRIu64, local_error_code);
+    CHECK(local_reason_len == strlen(close_reason),
+          "local reason length mismatch: %zu", local_reason_len);
+    CHECK(memcmp(local_reason, close_reason, local_reason_len) == 0,
+          "local reason text mismatch");
+    printf("PASS connection close: app=%d code=%" PRIu64 " reason=%.*s "
+           "(client draining=%d server draining=%d)\n",
+           peer_is_app, peer_error_code, (int) peer_reason_len,
+           (const char *) peer_reason,
+           quiche_conn_is_draining(close_pair.client.quic),
+           quiche_conn_is_draining(close_pair.server.quic));
+    pair_free(&close_pair);
+
+    /* ---- Oversized headers / max_field_section_size ---- */
+    static test_pair field_pair;
+    static server_state field_server;
+    static client_state field_client;
+    memset(&field_pair, 0, sizeof(field_pair));
+    memset(&field_server, 0, sizeof(field_server));
+    memset(&field_client, 0, sizeof(field_client));
+    field_server.paused_stream = -1;
+    pair_create_internal(&field_pair, argv[1], argv[2], MAX_REQUESTS,
+                          MAX_FIELD_SECTION_SIZE_LIMIT, 41300);
+    static uint8_t oversized_value[4 * 1024];
+    memset(oversized_value, 'x', sizeof(oversized_value));
+    quiche_h3_header oversized_headers[] = {
+        {(const uint8_t *) ":method", 7, (const uint8_t *) "GET", 3},
+        {(const uint8_t *) ":scheme", 7, (const uint8_t *) "https", 5},
+        {(const uint8_t *) ":authority", 10,
+         (const uint8_t *) "ghostfile.test", 14},
+        {(const uint8_t *) ":path", 5, (const uint8_t *) "/oversized", 10},
+        {(const uint8_t *) "x-oversized", 11,
+         oversized_value, sizeof(oversized_value)},
+    };
+    int64_t oversized_stream = quiche_h3_send_request(
+        field_pair.client.h3, field_pair.client.quic, oversized_headers, 5,
+        true);
+    CHECK(oversized_stream >= 0,
+          "oversized header request should be accepted for sending: %" PRId64,
+          oversized_stream);
+    // RFC 9114 §4.2.2: client-side header enforcement is not done at encode
+    // time, so quiche accepts the 4 KiB request. The receiver (server) is
+    // the one bound by SETTINGS_MAX_FIELD_SECTION_SIZE; on decode quiche
+    // raises HeaderListTooLarge → Error::ExcessiveLoad and tears down the
+    // h3 connection with code 0x107. The loop drives until both endpoints
+    // reach a terminal transport state (closed or draining).
+    bool client_terminal = false;
+    bool server_terminal = false;
+    for (size_t round = 0; round < 5000; round++) {
+        drive_round(&field_pair, &field_server, &field_client);
+        if (quiche_conn_is_closed(field_pair.client.quic) ||
+            quiche_conn_is_draining(field_pair.client.quic)) {
+            client_terminal = true;
+        }
+        if (quiche_conn_is_closed(field_pair.server.quic) ||
+            quiche_conn_is_draining(field_pair.server.quic)) {
+            server_terminal = true;
+        }
+        if (client_terminal && server_terminal) {
+            break;
+        }
+    }
+    CHECK(client_terminal,
+          "client should reach terminal state after the server rejected the "
+          "oversized header");
+    CHECK(server_terminal,
+          "server should reach terminal state after rejecting the oversized "
+          "header");
+    bool oversize_peer_is_app = false;
+    uint64_t peer_code = 0;
+    const uint8_t *peer_close_reason = NULL;
+    size_t peer_close_reason_len = 0;
+    CHECK(quiche_conn_peer_error(field_pair.client.quic, &oversize_peer_is_app,
+                                  &peer_code, &peer_close_reason,
+                                  &peer_close_reason_len),
+          "client should observe the server's CONNECTION_CLOSE error");
+    CHECK(oversize_peer_is_app,
+          "rejection close should be application-level (HTTP/3)");
+    CHECK(peer_code == H3_EXCESSIVE_LOAD_ERROR,
+          "peer error code should be HTTP_EXCESSIVE_LOAD (0x107), got 0x%"
+          PRIx64, peer_code);
+    printf("PASS oversized headers: 4 KiB field rejected by "
+           "max_field_section_size=%d via HTTP_EXCESSIVE_LOAD=0x%" PRIx64
+           " (app=%d); transport drained cleanly without framework crash\n",
+           MAX_FIELD_SECTION_SIZE_LIMIT, peer_code, oversize_peer_is_app);
+    pair_free(&field_pair);
+
+    return 0;
+}
diff --git a/macOS/GhostHTTP3/Tests/udp-chaos-proxy.c b/macOS/GhostHTTP3/Tests/udp-chaos-proxy.c
new file mode 100644
index 0000000..31ed48c
--- /dev/null
+++ b/macOS/GhostHTTP3/Tests/udp-chaos-proxy.c
@@ -0,0 +1,767 @@
+// Deterministic user-space UDP impairment proxy ("chaos proxy") for the
+// GhostHTTP3 HTTP/3 test phases. Requires no root privileges: it relays
+// loopback UDP datagrams between one client and one server through two
+// sockets and applies configurable impairments in each direction.
+//
+// Impairments per direction (client->server "c2s" and server->client "s2c"):
+//   - random loss            (--c2s-loss / --s2c-loss, percent)
+//   - random duplication     (--c2s-dup / --s2c-dup, percent)
+//   - fixed delay + uniform jitter (--c2s-delay / --c2s-jitter, milliseconds)
+//   - reordering             (--c2s-reorder percent, --c2s-reorder-ms range)
+//   - drop above MTU         (--mtu bytes, applies to both directions)
+//
+// All impairment decisions are drawn from a SplitMix64 PRNG seeded with
+// --seed; each direction consumes an independent stream keyed only by that
+// direction's packet sequence, so a fixed seed replays the same decision
+// pattern for the same offered traffic. Delayed packets sit in a bounded
+// per-direction queue (--queue); overflow drops are counted, never silent.
+//
+// The proxy prints one machine-parseable stats line per direction on exit
+// (SIGINT/SIGTERM or --max-duration) and optionally every --stats-interval
+// seconds. --probe-port provides a bind probe the driver uses for
+// collision-resistant port selection and server-readiness detection.
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#define MAX_DATAGRAM 65536
+#define MAX_QUEUE_CAPACITY 4096
+#define DEFAULT_QUEUE_CAPACITY 256
+#define DEFAULT_MAX_DURATION_SEC 300
+
+#define CHECK(condition, ...) do { \
+    if (!(condition)) { \
+        fprintf(stderr, "FAIL: "); \
+        fprintf(stderr, __VA_ARGS__); \
+        fprintf(stderr, "\n"); \
+        exit(1); \
+    } \
+} while (0)
+
+typedef enum {
+    DIR_C2S = 0,
+    DIR_S2C = 1,
+} direction;
+
+typedef struct {
+    double loss_pct;
+    double dup_pct;
+    double reorder_pct;
+    uint32_t delay_ms;
+    uint32_t jitter_ms;
+    uint32_t reorder_ms;
+} impairment_config;
+
+typedef struct {
+    uint64_t rx;
+    uint64_t tx;
+    uint64_t drop_loss;
+    uint64_t drop_mtu;
+    uint64_t drop_full;
+    uint64_t drop_nopeer;
+    uint64_t send_error;
+    uint64_t duplicated;
+    uint64_t delayed;
+    uint64_t reordered;
+    uint64_t max_queue;
+} direction_stats;
+
+typedef struct {
+    uint64_t sequence;
+    uint64_t release_at_ms;
+    size_t length;
+    uint8_t *data;
+    bool duplicate;
+} queued_packet;
+
+typedef struct {
+    impairment_config config;
+    direction_stats stats;
+    uint64_t prng_state;
+    uint64_t next_sequence;
+    uint64_t max_released_sequence;
+    queued_packet *queue;
+    size_t queue_length;
+    size_t queue_capacity;
+} direction_state;
+
+typedef struct {
+    const char *listen_host;
+    uint16_t listen_port;
+    const char *target_host;
+    uint16_t target_port;
+    uint64_t seed;
+    size_t queue_capacity;
+    uint16_t mtu;
+    uint32_t max_duration_sec;
+    uint32_t stats_interval_sec;
+    bool verbose;
+    direction_state directions[2];
+} proxy;
+
+static volatile sig_atomic_t stop_requested = 0;
+
+static void handle_signal(int signal_number) {
+    (void) signal_number;
+    stop_requested = 1;
+}
+
+static uint64_t monotonic_ms(void) {
+    struct timespec now;
+    CHECK(clock_gettime(CLOCK_MONOTONIC, &now) == 0,
+          "clock_gettime failed: %s", strerror(errno));
+    return (uint64_t) now.tv_sec * 1000 + (uint64_t) now.tv_nsec / 1000000;
+}
+
+// SplitMix64: small, deterministic, and independent of libc rand().
+static uint64_t prng_next(direction_state *state) {
+    state->prng_state += 0x9e3779b97f4a7c15ULL;
+    uint64_t value = state->prng_state;
+    value = (value ^ (value >> 30)) * 0xbf58476d1ce4e5b9ULL;
+    value = (value ^ (value >> 27)) * 0x94d049bb133111ebULL;
+    return value ^ (value >> 31);
+}
+
+static double prng_double(direction_state *state) {
+    return (double) (prng_next(state) >> 11) * (1.0 / 9007199254740992.0);
+}
+
+static uint32_t prng_range(direction_state *state, uint32_t inclusive_max) {
+    return (uint32_t) (prng_double(state) * (double) (inclusive_max + 1));
+}
+
+static bool prng_roll(direction_state *state, double pct) {
+    return pct > 0.0 && prng_double(state) < pct / 100.0;
+}
+
+static const char *direction_name(direction dir) {
+    return dir == DIR_C2S ? "c2s" : "s2c";
+}
+
+static void print_stats_line(const proxy *config, direction dir) {
+    const direction_state *state = &config->directions[dir];
+    const direction_stats *stats = &state->stats;
+    printf("stats dir=%s rx=%" PRIu64 " tx=%" PRIu64
+           " drop_loss=%" PRIu64 " drop_mtu=%" PRIu64
+           " drop_full=%" PRIu64 " drop_nopeer=%" PRIu64
+           " send_error=%" PRIu64
+           " dup=%" PRIu64 " delayed=%" PRIu64
+           " reordered=%" PRIu64 " queued=%zu max_queue=%" PRIu64 "\n",
+           direction_name(dir), stats->rx, stats->tx,
+           stats->drop_loss, stats->drop_mtu,
+           stats->drop_full, stats->drop_nopeer,
+           stats->send_error,
+           stats->duplicated, stats->delayed,
+           stats->reordered, state->queue_length, stats->max_queue);
+    fflush(stdout);
+}
+
+static void print_stats(const proxy *config) {
+    print_stats_line(config, DIR_C2S);
+    print_stats_line(config, DIR_S2C);
+}
+
+static bool queue_enqueue(proxy *config, direction dir, uint64_t release_at_ms,
+                          const uint8_t *data, size_t length,
+                          bool duplicate) {
+    direction_state *state = &config->directions[dir];
+    if (state->queue_length == state->queue_capacity) {
+        state->stats.drop_full++;
+        if (config->verbose) {
+            fprintf(stderr, "%s #%" PRIu64 " %zuB drop(queue full)\n",
+                    direction_name(dir), state->next_sequence, length);
+        }
+        return false;
+    }
+
+    queued_packet *entry = &state->queue[state->queue_length++];
+    entry->sequence = state->next_sequence;
+    entry->release_at_ms = release_at_ms;
+    entry->length = length;
+    entry->duplicate = duplicate;
+    entry->data = malloc(length == 0 ? 1 : length);
+    CHECK(entry->data != NULL, "out of memory queueing %zu bytes", length);
+    memcpy(entry->data, data, length);
+
+    if (state->queue_length > state->stats.max_queue) {
+        state->stats.max_queue = state->queue_length;
+    }
+    return true;
+}
+
+// Releases every due packet in (release time, arrival sequence) order.
+static void queue_release_due(proxy *config, direction dir, int send_socket,
+                              const struct sockaddr_storage *destination,
+                              socklen_t destination_length) {
+    direction_state *state = &config->directions[dir];
+    uint64_t now = monotonic_ms();
+
+    while (state->queue_length > 0) {
+        size_t earliest = 0;
+        for (size_t index = 1; index < state->queue_length; index++) {
+            queued_packet *candidate = &state->queue[index];
+            queued_packet *current = &state->queue[earliest];
+            if (candidate->release_at_ms < current->release_at_ms ||
+                (candidate->release_at_ms == current->release_at_ms &&
+                 candidate->sequence < current->sequence)) {
+                earliest = index;
+            }
+        }
+
+        queued_packet *entry = &state->queue[earliest];
+        if (entry->release_at_ms > now) {
+            return;
+        }
+
+        if (destination == NULL) {
+            state->stats.drop_nopeer++;
+        } else {
+            ssize_t sent = sendto(send_socket, entry->data, entry->length, 0,
+                                  (const struct sockaddr *) destination,
+                                  destination_length);
+            if (sent < 0 || (size_t) sent != entry->length) {
+                state->stats.send_error++;
+                fprintf(stderr, "%s sendto failed: %s\n",
+                        direction_name(dir),
+                        sent < 0 ? strerror(errno) : "short datagram send");
+            } else {
+                state->stats.tx++;
+                // Duplicates ride the original's sequence number and are
+                // excluded from reorder accounting: a late copy is an
+                // artifact of duplication, not of packet reordering.
+                if (!entry->duplicate) {
+                    if (entry->sequence < state->max_released_sequence) {
+                        state->stats.reordered++;
+                        if (config->verbose) {
+                            fprintf(stderr, "%s #%" PRIu64
+                                    " released out of order\n",
+                                    direction_name(dir), entry->sequence);
+                        }
+                    } else {
+                        state->max_released_sequence = entry->sequence;
+                    }
+                }
+            }
+        }
+
+        free(entry->data);
+        if (earliest + 1 < state->queue_length) {
+            memmove(entry, entry + 1,
+                    (state->queue_length - earliest - 1) *
+                    sizeof(queued_packet));
+        }
+        state->queue_length--;
+        now = monotonic_ms();
+    }
+}
+
+static uint64_t queue_next_release_ms(const direction_state *state) {
+    if (state->queue_length == 0) {
+        return UINT64_MAX;
+    }
+    uint64_t earliest = UINT64_MAX;
+    for (size_t index = 0; index < state->queue_length; index++) {
+        if (state->queue[index].release_at_ms < earliest) {
+            earliest = state->queue[index].release_at_ms;
+        }
+    }
+    return earliest;
+}
+
+// Applies the configured impairment pipeline to one received datagram.
+static void impair_and_queue(proxy *config, direction dir,
+                             const uint8_t *data, size_t length) {
+    direction_state *state = &config->directions[dir];
+    const impairment_config *impairment = &state->config;
+    uint64_t sequence = state->next_sequence;
+    uint64_t now = monotonic_ms();
+
+    state->stats.rx++;
+
+    if (config->mtu > 0 && length > config->mtu) {
+        state->stats.drop_mtu++;
+        if (config->verbose) {
+            fprintf(stderr, "%s #%" PRIu64 " %zuB drop(mtu %u)\n",
+                    direction_name(dir), sequence, length,
+                    (unsigned) config->mtu);
+        }
+        state->next_sequence++;
+        return;
+    }
+
+    if (prng_roll(state, impairment->loss_pct)) {
+        state->stats.drop_loss++;
+        if (config->verbose) {
+            fprintf(stderr, "%s #%" PRIu64 " %zuB drop(loss)\n",
+                    direction_name(dir), sequence, length);
+        }
+        state->next_sequence++;
+        return;
+    }
+
+    uint64_t hold_ms = impairment->delay_ms;
+    if (impairment->jitter_ms > 0) {
+        hold_ms += prng_range(state, impairment->jitter_ms);
+    }
+    if (prng_roll(state, impairment->reorder_pct)) {
+        hold_ms += 1 + prng_range(state, impairment->reorder_ms);
+    }
+
+    uint64_t release_at_ms = now + hold_ms;
+    if (hold_ms > 0) {
+        state->stats.delayed++;
+    }
+    if (config->verbose) {
+        fprintf(stderr, "%s #%" PRIu64 " %zuB fwd hold=%" PRIu64 "ms\n",
+                direction_name(dir), sequence, length, hold_ms);
+    }
+    queue_enqueue(config, dir, release_at_ms, data, length, false);
+
+    if (prng_roll(state, impairment->dup_pct)) {
+        // The duplicate rides the same impairment decision 1 ms behind the
+        // original so arrival order between the two is deterministic. Count
+        // only successfully-queued dups; if the queue is full queue_enqueue
+        // has already accounted it as drop_full, so do not double-count.
+        if (queue_enqueue(config, dir, release_at_ms + 1, data, length, true)) {
+            state->stats.duplicated++;
+            if (config->verbose) {
+                fprintf(stderr, "%s #%" PRIu64 " %zuB dup\n",
+                        direction_name(dir), sequence, length);
+            }
+        } else if (config->verbose) {
+            fprintf(stderr, "%s #%" PRIu64 " %zuB dup dropped (queue full)\n",
+                    direction_name(dir), sequence, length);
+        }
+    }
+
+    state->next_sequence++;
+}
+
+static int make_udp_socket(void) {
+    int fd = socket(AF_INET, SOCK_DGRAM, 0);
+    CHECK(fd >= 0, "socket failed: %s", strerror(errno));
+
+    int flags = fcntl(fd, F_GETFL, 0);
+    CHECK(flags >= 0 && fcntl(fd, F_SETFL, flags | O_NONBLOCK) == 0,
+          "failed to make socket non-blocking: %s", strerror(errno));
+    return fd;
+}
+
+static void resolve_ipv4(const char *host, uint16_t port,
+                         struct sockaddr_storage *address,
+                         socklen_t *address_length) {
+    char service[8];
+    snprintf(service, sizeof(service), "%u", (unsigned) port);
+
+    const struct addrinfo hints = {
+        .ai_family = AF_INET,
+        .ai_socktype = SOCK_DGRAM,
+        .ai_protocol = IPPROTO_UDP,
+    };
+
+    struct addrinfo *result = NULL;
+    int rc = getaddrinfo(host, service, &hints, &result);
+    CHECK(rc == 0, "failed to resolve %s:%s: %s", host, service,
+          gai_strerror(rc));
+    CHECK(result->ai_addrlen <= sizeof(*address),
+          "resolved address too large");
+    memcpy(address, result->ai_addr, result->ai_addrlen);
+    *address_length = result->ai_addrlen;
+    freeaddrinfo(result);
+}
+
+static uint16_t bound_port(int socket_fd) {
+    struct sockaddr_storage address;
+    socklen_t address_length = sizeof(address);
+    CHECK(getsockname(socket_fd, (struct sockaddr *) &address,
+                      &address_length) == 0,
+          "getsockname failed: %s", strerror(errno));
+    return ntohs(((struct sockaddr_in *) &address)->sin_port);
+}
+
+static void drain_socket(proxy *config, direction dir, int socket_fd) {
+    uint8_t buffer[MAX_DATAGRAM];
+    for (;;) {
+        ssize_t length = recvfrom(socket_fd, buffer, sizeof(buffer), 0,
+                                  NULL, NULL);
+        if (length < 0) {
+            if (errno == EWOULDBLOCK || errno == EAGAIN) {
+                return;
+            }
+            if (errno == EINTR) {
+                return;
+            }
+            fprintf(stderr, "%s recvfrom failed: %s\n",
+                    direction_name(dir), strerror(errno));
+            return;
+        }
+        impair_and_queue(config, dir, buffer, (size_t) length);
+    }
+}
+
+static void run_proxy(proxy *config) {
+    struct sockaddr_storage listen_address;
+    socklen_t listen_address_length;
+    resolve_ipv4(config->listen_host, config->listen_port,
+                 &listen_address, &listen_address_length);
+
+    struct sockaddr_storage target_address;
+    socklen_t target_address_length;
+    resolve_ipv4(config->target_host, config->target_port,
+                 &target_address, &target_address_length);
+
+    // client_sock faces the HTTP/3 client; server_sock faces the quiche
+    // server. Replies are sent from client_sock so the client sees a
+    // consistent peer address (the proxy), hiding the real server.
+    int client_sock = make_udp_socket();
+    CHECK(bind(client_sock, (struct sockaddr *) &listen_address,
+               listen_address_length) == 0,
+          "failed to bind %s:%u: %s", config->listen_host,
+          (unsigned) config->listen_port, strerror(errno));
+
+    int server_sock = make_udp_socket();
+
+    struct sockaddr_storage client_address;
+    socklen_t client_address_length = sizeof(client_address);
+    bool client_known = false;
+
+    printf("config listen=%s:%u target=%s:%u seed=%" PRIu64
+           " queue=%zu mtu=%u"
+           " c2s(loss=%.2f%% dup=%.2f%% delay=%ums jitter=%ums"
+           " reorder=%.2f%% reorder_ms=%ums)"
+           " s2c(loss=%.2f%% dup=%.2f%% delay=%ums jitter=%ums"
+           " reorder=%.2f%% reorder_ms=%ums)\n",
+           config->listen_host, (unsigned) config->listen_port,
+           config->target_host, (unsigned) config->target_port, config->seed,
+           config->queue_capacity, (unsigned) config->mtu,
+           config->directions[DIR_C2S].config.loss_pct,
+           config->directions[DIR_C2S].config.dup_pct,
+           config->directions[DIR_C2S].config.delay_ms,
+           config->directions[DIR_C2S].config.jitter_ms,
+           config->directions[DIR_C2S].config.reorder_pct,
+           config->directions[DIR_C2S].config.reorder_ms,
+           config->directions[DIR_S2C].config.loss_pct,
+           config->directions[DIR_S2C].config.dup_pct,
+           config->directions[DIR_S2C].config.delay_ms,
+           config->directions[DIR_S2C].config.jitter_ms,
+           config->directions[DIR_S2C].config.reorder_pct,
+           config->directions[DIR_S2C].config.reorder_ms);
+    printf("listening on %s:%u\n", config->listen_host,
+           (unsigned) bound_port(client_sock));
+    fflush(stdout);
+
+    uint64_t start_ms = monotonic_ms();
+    uint64_t deadline_ms = config->max_duration_sec > 0
+        ? start_ms + (uint64_t) config->max_duration_sec * 1000
+        : UINT64_MAX;
+    uint64_t next_stats_ms = config->stats_interval_sec > 0
+        ? start_ms + (uint64_t) config->stats_interval_sec * 1000
+        : UINT64_MAX;
+
+    while (!stop_requested) {
+        uint64_t now = monotonic_ms();
+        if (now >= deadline_ms) {
+            break;
+        }
+
+        queue_release_due(config, DIR_C2S, server_sock,
+                          &target_address, target_address_length);
+        queue_release_due(config, DIR_S2C, client_sock,
+                          client_known ? &client_address : NULL,
+                          client_address_length);
+
+        if (now >= next_stats_ms) {
+            print_stats(config);
+            next_stats_ms = now + (uint64_t) config->stats_interval_sec * 1000;
+        }
+
+        uint64_t wake_ms = deadline_ms;
+        uint64_t release_ms;
+        release_ms = queue_next_release_ms(&config->directions[DIR_C2S]);
+        if (release_ms < wake_ms) {
+            wake_ms = release_ms;
+        }
+        release_ms = queue_next_release_ms(&config->directions[DIR_S2C]);
+        if (release_ms < wake_ms) {
+            wake_ms = release_ms;
+        }
+        if (next_stats_ms < wake_ms) {
+            wake_ms = next_stats_ms;
+        }
+
+        int timeout_ms = -1;
+        if (wake_ms != UINT64_MAX) {
+            now = monotonic_ms();
+            timeout_ms = wake_ms <= now ? 0
+                : (wake_ms - now > INT32_MAX ? INT32_MAX
+                                             : (int) (wake_ms - now));
+        }
+
+        struct pollfd fds[2] = {
+            { .fd = client_sock, .events = POLLIN },
+            { .fd = server_sock, .events = POLLIN },
+        };
+
+        int ready = poll(fds, 2, timeout_ms);
+        if (ready < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            fprintf(stderr, "poll failed: %s\n", strerror(errno));
+            break;
+        }
+        if (ready == 0) {
+            continue;
+        }
+
+        if (fds[0].revents & POLLIN) {
+            // Track the most recent client address so replies find the
+            // current client even across successive client processes.
+            uint8_t peek[MAX_DATAGRAM];
+            struct sockaddr_storage source;
+            socklen_t source_length = sizeof(source);
+            ssize_t length = recvfrom(client_sock, peek, sizeof(peek),
+                                      MSG_PEEK,
+                                      (struct sockaddr *) &source,
+                                      &source_length);
+            if (length >= 0) {
+                memcpy(&client_address, &source, source_length);
+                client_address_length = source_length;
+                client_known = true;
+            }
+            drain_socket(config, DIR_C2S, client_sock);
+        }
+        if (fds[1].revents & POLLIN) {
+            drain_socket(config, DIR_S2C, server_sock);
+        }
+    }
+
+    close(client_sock);
+    close(server_sock);
+
+    // Print before freeing so `queued` truthfully reports any datagrams that
+    // were still pending when the proxy stopped. The driver asserts zero for
+    // gated scenarios instead of mistaking cleanup for successful delivery.
+    print_stats(config);
+
+    for (direction dir = DIR_C2S; dir <= DIR_S2C; dir++) {
+        direction_state *state = &config->directions[dir];
+        for (size_t index = 0; index < state->queue_length; index++) {
+            free(state->queue[index].data);
+        }
+        state->queue_length = 0;
+    }
+
+}
+
+static double parse_percent(const char *option, const char *value) {
+    char *end = NULL;
+    double parsed = strtod(value, &end);
+    CHECK(end != value && *end == '\0' && parsed >= 0.0 && parsed <= 100.0,
+          "%s expects a percentage in [0, 100], got '%s'", option, value);
+    return parsed;
+}
+
+static uint64_t parse_u64(const char *option, const char *value,
+                          uint64_t maximum) {
+    char *end = NULL;
+    errno = 0;
+    uint64_t parsed = strtoull(value, &end, 10);
+    CHECK(errno == 0 && end != value && *end == '\0' && parsed <= maximum,
+          "%s expects an integer in [0, %" PRIu64 "], got '%s'",
+          option, maximum, value);
+    return parsed;
+}
+
+static void usage(const char *program) {
+    fprintf(stderr,
+        "usage: %s --listen-port PORT --target-port PORT [options]\n"
+        "       %s --probe-port PORT\n"
+        "\n"
+        "Relays UDP between a client and a target server, applying\n"
+        "deterministic seeded impairments in both directions.\n"
+        "\n"
+        "required:\n"
+        "  --listen-port PORT    UDP port the client connects to\n"
+        "  --target-port PORT    UDP port of the real server\n"
+        "\n"
+        "addressing:\n"
+        "  --listen-host ADDR    listen address (default 127.0.0.1)\n"
+        "  --target-host ADDR    server address (default 127.0.0.1)\n"
+        "\n"
+        "determinism and bounds:\n"
+        "  --seed N              impairment PRNG seed (default 1)\n"
+        "  --queue N             per-direction delayed-packet queue capacity\n"
+        "                        (default %d, max %d; overflow drops counted)\n"
+        "  --max-duration SEC    graceful self-termination deadline\n"
+        "                        (default %d, 0 disables)\n"
+        "\n"
+        "impairments (DIR is c2s or s2c):\n"
+        "  --DIR-loss PCT        random packet loss, 0-100\n"
+        "  --DIR-dup PCT         random duplication, 0-100\n"
+        "  --DIR-delay MS        fixed delay added to every packet\n"
+        "  --DIR-jitter MS       uniform extra delay in [0, MS]\n"
+        "  --DIR-reorder PCT     probability of holding a packet back\n"
+        "  --DIR-reorder-ms MS   reorder hold range in [1, MS] (default 30)\n"
+        "  --mtu BYTES           drop datagrams larger than this (0 disables)\n"
+        "\n"
+        "diagnostics:\n"
+        "  --stats-interval SEC  also print stats periodically (default off)\n"
+        "  -v, --verbose         log every packet decision to stderr\n"
+        "  --probe-port PORT     exit 0 if ADDR:PORT is bindable, 1 if busy\n"
+        "  --probe-host ADDR     probe address (default 127.0.0.1)\n",
+        program, program, DEFAULT_QUEUE_CAPACITY, MAX_QUEUE_CAPACITY,
+        DEFAULT_MAX_DURATION_SEC);
+}
+
+int main(int argc, char *argv[]) {
+    static const struct option options[] = {
+        { "listen-host",     required_argument, NULL, 'H' },
+        { "listen-port",     required_argument, NULL, 'p' },
+        { "target-host",     required_argument, NULL, 'T' },
+        { "target-port",     required_argument, NULL, 't' },
+        { "seed",            required_argument, NULL, 's' },
+        { "queue",           required_argument, NULL, 'q' },
+        { "mtu",             required_argument, NULL, 'm' },
+        { "max-duration",    required_argument, NULL, 'd' },
+        { "stats-interval",  required_argument, NULL, 'i' },
+        { "verbose",         no_argument,       NULL, 'v' },
+        { "probe-port",      required_argument, NULL, 'P' },
+        { "probe-host",      required_argument, NULL, 'B' },
+        { "help",            no_argument,       NULL, 'h' },
+        { "c2s-loss",        required_argument, NULL, 1000 },
+        { "c2s-dup",         required_argument, NULL, 1001 },
+        { "c2s-delay",       required_argument, NULL, 1002 },
+        { "c2s-jitter",      required_argument, NULL, 1003 },
+        { "c2s-reorder",     required_argument, NULL, 1004 },
+        { "c2s-reorder-ms",  required_argument, NULL, 1005 },
+        { "s2c-loss",        required_argument, NULL, 1006 },
+        { "s2c-dup",         required_argument, NULL, 1007 },
+        { "s2c-delay",       required_argument, NULL, 1008 },
+        { "s2c-jitter",      required_argument, NULL, 1009 },
+        { "s2c-reorder",     required_argument, NULL, 1010 },
+        { "s2c-reorder-ms",  required_argument, NULL, 1011 },
+        { NULL, 0, NULL, 0 },
+    };
+
+    proxy config = {
+        .listen_host = "127.0.0.1",
+        .listen_port = 0,
+        .target_host = "127.0.0.1",
+        .target_port = 0,
+        .seed = 1,
+        .queue_capacity = DEFAULT_QUEUE_CAPACITY,
+        .mtu = 0,
+        .max_duration_sec = DEFAULT_MAX_DURATION_SEC,
+        .stats_interval_sec = 0,
+        .verbose = false,
+    };
+
+    const char *probe_host = "127.0.0.1";
+    uint64_t probe_port = 0;
+
+    int option;
+    while ((option = getopt_long(argc, argv, "hvp:H:t:T:s:q:m:d:i:P:B:",
+                                 options, NULL)) != -1) {
+        impairment_config *c2s = &config.directions[DIR_C2S].config;
+        impairment_config *s2c = &config.directions[DIR_S2C].config;
+        switch (option) {
+            case 'H': config.listen_host = optarg; break;
+            case 'p': config.listen_port = (uint16_t) parse_u64("--listen-port", optarg, 65535); break;
+            case 'T': config.target_host = optarg; break;
+            case 't': config.target_port = (uint16_t) parse_u64("--target-port", optarg, 65535); break;
+            case 's': config.seed = parse_u64("--seed", optarg, UINT64_MAX); break;
+            case 'q': config.queue_capacity = (size_t) parse_u64("--queue", optarg, MAX_QUEUE_CAPACITY); break;
+            case 'm': config.mtu = (uint16_t) parse_u64("--mtu", optarg, 65535); break;
+            case 'd': config.max_duration_sec = (uint32_t) parse_u64("--max-duration", optarg, 86400); break;
+            case 'i': config.stats_interval_sec = (uint32_t) parse_u64("--stats-interval", optarg, 86400); break;
+            case 'v': config.verbose = true; break;
+            case 'P': probe_port = parse_u64("--probe-port", optarg, 65535); break;
+            case 'B': probe_host = optarg; break;
+            case 'h': usage(argv[0]); return 0;
+            case 1000: c2s->loss_pct = parse_percent("--c2s-loss", optarg); break;
+            case 1001: c2s->dup_pct = parse_percent("--c2s-dup", optarg); break;
+            case 1002: c2s->delay_ms = (uint32_t) parse_u64("--c2s-delay", optarg, 60000); break;
+            case 1003: c2s->jitter_ms = (uint32_t) parse_u64("--c2s-jitter", optarg, 60000); break;
+            case 1004: c2s->reorder_pct = parse_percent("--c2s-reorder", optarg); break;
+            case 1005: c2s->reorder_ms = (uint32_t) parse_u64("--c2s-reorder-ms", optarg, 60000); break;
+            case 1006: s2c->loss_pct = parse_percent("--s2c-loss", optarg); break;
+            case 1007: s2c->dup_pct = parse_percent("--s2c-dup", optarg); break;
+            case 1008: s2c->delay_ms = (uint32_t) parse_u64("--s2c-delay", optarg, 60000); break;
+            case 1009: s2c->jitter_ms = (uint32_t) parse_u64("--s2c-jitter", optarg, 60000); break;
+            case 1010: s2c->reorder_pct = parse_percent("--s2c-reorder", optarg); break;
+            case 1011: s2c->reorder_ms = (uint32_t) parse_u64("--s2c-reorder-ms", optarg, 60000); break;
+            default: usage(argv[0]); return 2;
+        }
+    }
+
+    if (probe_port > 0) {
+        struct sockaddr_storage address;
+        socklen_t address_length;
+        resolve_ipv4(probe_host, (uint16_t) probe_port, &address,
+                     &address_length);
+        int fd = socket(AF_INET, SOCK_DGRAM, 0);
+        CHECK(fd >= 0, "socket failed: %s", strerror(errno));
+        if (bind(fd, (struct sockaddr *) &address, address_length) == 0) {
+            close(fd);
+            printf("%s:%" PRIu64 " free\n", probe_host, probe_port);
+            return 0;
+        }
+        int bind_errno = errno;
+        close(fd);
+        if (bind_errno == EADDRINUSE) {
+            printf("%s:%" PRIu64 " busy\n", probe_host, probe_port);
+            return 1;
+        }
+        fprintf(stderr, "probe bind failed: %s\n", strerror(bind_errno));
+        return 2;
+    }
+
+    if (config.listen_port == 0 || config.target_port == 0) {
+        usage(argv[0]);
+        return 2;
+    }
+    CHECK(config.queue_capacity >= 1, "--queue must be at least 1");
+
+    // Distinct PRNG streams per direction so impairment decisions depend
+    // only on the seed and that direction's packet sequence, not on how
+    // the two directions happen to interleave in real time.
+    config.directions[DIR_C2S].prng_state = config.seed;
+    config.directions[DIR_S2C].prng_state =
+        config.seed ^ 0x9e3779b97f4a7c15ULL;
+
+    for (direction dir = DIR_C2S; dir <= DIR_S2C; dir++) {
+        config.directions[dir].queue_capacity = config.queue_capacity;
+        config.directions[dir].queue =
+            calloc(config.queue_capacity, sizeof(queued_packet));
+        CHECK(config.directions[dir].queue != NULL,
+              "out of memory allocating packet queue");
+    }
+
+    struct sigaction action = { .sa_handler = handle_signal };
+    sigemptyset(&action.sa_mask);
+    sigaction(SIGINT, &action, NULL);
+    sigaction(SIGTERM, &action, NULL);
+    sigaction(SIGHUP, &action, NULL);
+    signal(SIGPIPE, SIG_IGN);
+
+    run_proxy(&config);
+
+    free(config.directions[DIR_C2S].queue);
+    free(config.directions[DIR_S2C].queue);
+    return 0;
+}
diff --git a/macOS/GhostHTTP3/Tests/udp-datagram.c b/macOS/GhostHTTP3/Tests/udp-datagram.c
new file mode 100644
index 0000000..7911b96
--- /dev/null
+++ b/macOS/GhostHTTP3/Tests/udp-datagram.c
@@ -0,0 +1,87 @@
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+static int parse_u16(const char *text, uint16_t *value) {
+    char *end = NULL;
+    errno = 0;
+    unsigned long parsed = strtoul(text, &end, 10);
+    if (errno != 0 || end == text || *end != '\0' || parsed > UINT16_MAX) {
+        return -1;
+    }
+    *value = (uint16_t) parsed;
+    return 0;
+}
+
+static int parse_size(const char *text, size_t *value) {
+    char *end = NULL;
+    errno = 0;
+    unsigned long parsed = strtoul(text, &end, 10);
+    if (errno != 0 || end == text || *end != '\0' || parsed == 0 ||
+        parsed > 65507UL) {
+        return -1;
+    }
+    *value = (size_t) parsed;
+    return 0;
+}
+
+int main(int argc, char **argv) {
+    if (argc != 4) {
+        fprintf(stderr, "usage: %s IPV4 PORT BYTES\n", argv[0]);
+        return 2;
+    }
+
+    uint16_t port = 0;
+    size_t payload_size = 0;
+    if (parse_u16(argv[2], &port) != 0 || port == 0 ||
+        parse_size(argv[3], &payload_size) != 0) {
+        fprintf(stderr, "invalid port or datagram size\n");
+        return 2;
+    }
+
+    struct sockaddr_in destination = {
+        .sin_family = AF_INET,
+        .sin_port = htons(port),
+    };
+    if (inet_pton(AF_INET, argv[1], &destination.sin_addr) != 1) {
+        fprintf(stderr, "invalid IPv4 address: %s\n", argv[1]);
+        return 2;
+    }
+
+    int fd = socket(AF_INET, SOCK_DGRAM, 0);
+    if (fd < 0) {
+        perror("socket");
+        return 1;
+    }
+
+    uint8_t *payload = calloc(payload_size, 1);
+    if (payload == NULL) {
+        perror("calloc");
+        close(fd);
+        return 1;
+    }
+
+    ssize_t sent = sendto(fd, payload, payload_size, 0,
+        (const struct sockaddr *) &destination, sizeof(destination));
+    if (sent < 0 || (size_t) sent != payload_size) {
+        if (sent < 0) {
+            perror("sendto");
+        } else {
+            fprintf(stderr, "short UDP send: %zd of %zu bytes\n", sent,
+                payload_size);
+        }
+        free(payload);
+        close(fd);
+        return 1;
+    }
+
+    free(payload);
+    close(fd);
+    return 0;
+}
diff --git a/macOS/GhostHTTP3/include/GhostHTTP3/GhostHTTP3.h b/macOS/GhostHTTP3/include/GhostHTTP3/GhostHTTP3.h
new file mode 100644
index 0000000..c168f06
--- /dev/null
+++ b/macOS/GhostHTTP3/include/GhostHTTP3/GhostHTTP3.h
@@ -0,0 +1,35 @@
+#ifndef GHOST_HTTP3_H
+#define GHOST_HTTP3_H
+
+#include 
+#include 
+#include 
+
+#include "quiche.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/// The stable GhostHTTP3 wrapper API version.
+#define GHOST_HTTP3_API_VERSION 1
+
+/// Returns the GhostHTTP3 wrapper API version.
+uint32_t ghost_http3_api_version(void);
+
+/// Returns the version string reported by the linked quiche backend.
+const char *ghost_http3_backend_version(void);
+
+/// Returns quiche's length-prefixed HTTP/3 ALPN list (currently `h3`).
+/// The returned bytes have static storage duration.
+const uint8_t *ghost_http3_application_protocol(size_t *length);
+
+/// Performs a lightweight runtime check that both QUIC and HTTP/3
+/// configuration objects can be created by the linked backend.
+bool ghost_http3_backend_is_ready(void);
+
+#ifdef __cplusplus
+} // extern "C"
+#endif
+
+#endif // GHOST_HTTP3_H
diff --git a/macOS/GhostHTTP3/include/module.modulemap b/macOS/GhostHTTP3/include/module.modulemap
new file mode 100644
index 0000000..3352c12
--- /dev/null
+++ b/macOS/GhostHTTP3/include/module.modulemap
@@ -0,0 +1,5 @@
+framework module GhostHTTP3 {
+    umbrella header "GhostHTTP3.h"
+    export *
+    module * { export * }
+}
diff --git a/macOS/GhostHTTP3/quiche-0.29.3.Cargo.lock b/macOS/GhostHTTP3/quiche-0.29.3.Cargo.lock
new file mode 100644
index 0000000..f28721a
--- /dev/null
+++ b/macOS/GhostHTTP3/quiche-0.29.3.Cargo.lock
@@ -0,0 +1,4497 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "addr2line"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "assert_matches"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
+
+[[package]]
+name = "async-trait"
+version = "0.1.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "backtrace"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-link",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bindgen"
+version = "0.72.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+dependencies = [
+ "bitflags 2.13.1",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.13.0",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "boring"
+version = "4.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0e3bc837369e9e662d3845c374ac3771b054d4bc2dee5457591198d16d684c"
+dependencies = [
+ "bitflags 2.13.1",
+ "boring-sys",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+]
+
+[[package]]
+name = "boring-sys"
+version = "4.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15aad385759d3da2737772aefb391332227bef7cb71fb85c106cadd9d1e63a98"
+dependencies = [
+ "bindgen",
+ "cmake",
+ "fs_extra",
+ "fslock",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "buffer-pool"
+version = "0.2.1"
+dependencies = [
+ "crossbeam",
+ "foundations",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytecount"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex 2.0.1",
+]
+
+[[package]]
+name = "cdylib-link-lines"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98eabef08bbdf5afd0b9c0cabb1ac335f7c70447ef095eed85dffd9628b20bc"
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cf-rustracing"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e708e4e7bd0aa8f03edc6befeb0b40587c202c503f00a7cc20e612d14af55d3"
+dependencies = [
+ "backtrace",
+ "rand 0.10.2",
+ "tokio",
+ "trackable",
+]
+
+[[package]]
+name = "cf-rustracing-jaeger"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16c0e4d8cce27f6a6eaff58d2b66f063a18b8ed0d6ef0947ae7a263afa3b7c08"
+dependencies = [
+ "cf-rustracing",
+ "hostname",
+ "local-ip-address",
+ "percent-encoding",
+ "rand 0.10.2",
+ "thrift_codec",
+ "tokio",
+ "trackable",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cidr"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdf600c45bd958cf2945c445264471cca8b6c8e67bc87b71affd6d7e5682621"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_lex 0.2.4",
+ "indexmap 1.9.3",
+ "strsim 0.10.0",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "301b56658598e48f3648647ac6fc887be7e7108eddfa4e9b63fcf3ec58c0cadf"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94a65403d1a1bd28f7dc68eb8506e8874808ee5eecb59298de588e2e1407a078"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex 1.1.0",
+ "strsim 0.11.1",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "color_quant"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "const-hex"
+version = "1.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33e2a781ebdf4467d1428dc4593067825fb646f6871475098d8577421af73558"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "proptest",
+ "serde_core",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core-graphics"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c07782be35f9e1140080c6b96f0d44b739e2278479f64e02fdab4e32dfd8b081"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "core-graphics-types",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "libc",
+]
+
+[[package]]
+name = "core-text"
+version = "20.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9d2790b5c08465d49f8dc05c8bcae9fea467855947db39b0f8145c091aaced5"
+dependencies = [
+ "core-foundation",
+ "core-graphics",
+ "foreign-types",
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-queue",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crossterm"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
+dependencies = [
+ "bitflags 2.13.1",
+ "crossterm_winapi",
+ "derive_more",
+ "document-features",
+ "mio",
+ "parking_lot",
+ "rustix 1.1.4",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
+[[package]]
+name = "datagram-socket"
+version = "0.8.0"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "libc",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "debug_panic"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9377eb110cece2e9431deb8d7d2ec8c116510b896741f9f2bf02b352147aa2a6"
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "dlib"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "docopt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f3f119846c823f9eafcf953a8f6ffb6ed69bf6240883261a7f13b634579a51f"
+dependencies = [
+ "lazy_static",
+ "regex",
+ "serde",
+ "strsim 0.10.0",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dwrote"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b35532432acc8b19ceed096e35dfa088d3ea037fe4f3c085f1f97f33b4d02"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "winapi",
+ "wio",
+]
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "either"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+
+[[package]]
+name = "enum_dispatch"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
+dependencies = [
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "env_filter"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "jiff",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "erased-serde"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c138974f9d5e7fe373eb04df7cae98833802ae4b11c24ac7039a21d5af4b26c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "erased-serde"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
+dependencies = [
+ "serde",
+ "serde_core",
+ "typeid",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "float-ord"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce81f49ae8a0482e4c55ea62ebbd7e5a686af544c00b9d090bba3ff9be97b3d"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "font-kit"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c7e611d49285d4c4b2e1727b72cf05353558885cc5252f93707b845dfcaf3d3"
+dependencies = [
+ "bitflags 2.13.1",
+ "byteorder",
+ "core-foundation",
+ "core-graphics",
+ "core-text",
+ "dirs",
+ "dwrote",
+ "float-ord",
+ "freetype-sys",
+ "lazy_static",
+ "libc",
+ "log",
+ "pathfinder_geometry",
+ "pathfinder_simd",
+ "walkdir",
+ "winapi",
+ "yeslogic-fontconfig-sys",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "foundations"
+version = "5.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490e0a8bc50e56156b4a73c6f634c8ff6d0e5b9caf35711d41e59272d636e018"
+dependencies = [
+ "anyhow",
+ "cf-rustracing",
+ "cf-rustracing-jaeger",
+ "crossbeam-utils",
+ "erased-serde 0.4.10",
+ "foundations-macros",
+ "futures-util",
+ "governor",
+ "http",
+ "indexmap 2.14.0",
+ "libc",
+ "opentelemetry-proto",
+ "parking_lot",
+ "pin-project-lite",
+ "prometheus",
+ "prometheus-client",
+ "prometools",
+ "rand 0.10.2",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_with",
+ "serde_yaml",
+ "slab",
+ "slog",
+ "slog-async",
+ "slog-json",
+ "slog-term",
+ "thread_local",
+ "tokio",
+ "yaml-merge-keys",
+ "zeroize",
+]
+
+[[package]]
+name = "foundations-macros"
+version = "5.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36818af4b1a941c0f83adbf04b33e075a12ebac872fdda62f809ab74a9e7b189"
+dependencies = [
+ "darling 0.23.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "freetype-sys"
+version = "0.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7edc5b9669349acfda99533e9e0bcf26a51862ab43b08ee7745c55d28eb134"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "fslock"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04412b8935272e3a9bae6f48c7bfff74c2911f60525404edfdd28e49884c3bfb"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+
+[[package]]
+name = "futures-task"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
+
+[[package]]
+name = "futures-util"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "fuzzy-matcher"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54614a3312934d066701a80f20f15fa3b56d67ac7722b39eea5b4c9dd1d66c94"
+dependencies = [
+ "thread_local",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "getset"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cf442baaabe4213ce7d1239afc26c039180b6456da2cededa316ae2c8a77a77"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "gif"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80792593675e051cf94a4b111980da2ba60d4a83e43e0048c5693baab3977045"
+dependencies = [
+ "color_quant",
+ "weezl",
+]
+
+[[package]]
+name = "gimli"
+version = "0.32.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "governor"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9efcab3c1958580ff1f25a2a41be1668f7603d849bb63af523b208a3cc1223b8"
+dependencies = [
+ "cfg-if",
+ "dashmap",
+ "futures-sink",
+ "futures-timer",
+ "futures-util",
+ "getrandom 0.3.4",
+ "hashbrown 0.16.1",
+ "nonzero_ext",
+ "parking_lot",
+ "portable-atomic",
+ "quanta",
+ "rand 0.9.5",
+ "smallvec",
+ "spinning_top",
+ "web-time",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "h3i"
+version = "0.6.0"
+dependencies = [
+ "clap 3.2.25",
+ "env_logger",
+ "inquire",
+ "log",
+ "mio",
+ "multimap",
+ "octets",
+ "qlog",
+ "quiche",
+ "ring",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "tokio",
+ "tokio-quiche",
+ "url",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hostname"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-link",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "libc",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "image"
+version = "0.24.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "color_quant",
+ "jpeg-decoder",
+ "num-traits",
+ "png",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "inquire"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6654738b8024300cf062d04a1c13c10c8e2cea598ec1c47dc9b6641159429756"
+dependencies = [
+ "bitflags 2.13.1",
+ "crossterm",
+ "dyn-clone",
+ "fuzzy-matcher",
+ "unicode-segmentation",
+ "unicode-width 0.2.2",
+]
+
+[[package]]
+name = "intrusive-collections"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "189d0897e4cbe8c75efedf3502c18c887b05046e59d28404d4d8e46cbc4d1e86"
+dependencies = [
+ "memoffset",
+]
+
+[[package]]
+name = "ipnetwork"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
+dependencies = [
+ "hermit-abi 0.5.2",
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "jpeg-decoder"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00810f1d8b74be64b13dbf3db89ac67740615d6c891f0e7b6179326533011a07"
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "local-ip-address"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa08fb2b1ec3ea84575e94b489d06d4ce0cbf052d12acd515838f50e3c3d63e3"
+dependencies = [
+ "libc",
+ "neli",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memmem"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "multimap"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "neli"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9786d56d972959e1408b6a93be6af13b9c1392036c5c1fafa08a1b0c6ee87"
+dependencies = [
+ "bitflags 2.13.1",
+ "byteorder",
+ "derive_builder",
+ "getset",
+ "libc",
+ "log",
+ "neli-proc-macros",
+ "parking_lot",
+]
+
+[[package]]
+name = "neli-proc-macros"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05d8d08c6e98f20a62417478ebf7be8e1425ec9acecc6f63e22da633f6b71609"
+dependencies = [
+ "either",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "netlog"
+version = "0.1.0"
+dependencies = [
+ "log",
+ "regex",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nonzero_ext"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bf9645c8b145698bb0b18a4637dcacbc421ea49bef2317e4fd8065a387cf21"
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "object"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "octets"
+version = "0.3.6"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "opentelemetry"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b84bcd6ae87133e903af7ef497404dda70c60d0ea14895fc8a5e6722754fc2a0"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.19",
+ "tracing",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7175df06de5eaee9909d4805a3d07e28bb752c34cab57fa9cff549da596b30f"
+dependencies = [
+ "base64",
+ "const-hex",
+ "opentelemetry",
+ "opentelemetry_sdk",
+ "prost",
+ "serde",
+ "serde_json",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ae4f5991976fd48df6d843de219ca6d31b01daaab2dad5af2badeded372bd"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry",
+ "percent-encoding",
+ "rand 0.9.5",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+
+[[package]]
+name = "papergrid"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ad43c07024ef767f9160710b3a6773976194758c7919b17e63b863db0bdf7fb"
+dependencies = [
+ "bytecount",
+ "fnv",
+ "unicode-width 0.1.14",
+]
+
+[[package]]
+name = "papergrid"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6978128c8b51d8f4080631ceb2302ab51e32cc6e8615f735ee2f83fd269ae3f1"
+dependencies = [
+ "bytecount",
+ "fnv",
+ "unicode-width 0.2.2",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pathfinder_geometry"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b7e7b4ea703700ce73ebf128e1450eb69c3a8329199ffbfb9b2a0418e5ad3"
+dependencies = [
+ "log",
+ "pathfinder_simd",
+]
+
+[[package]]
+name = "pathfinder_simd"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4500030c302e4af1d423f36f3b958d1aecb6c04184356ed5a833bf6b60435777"
+dependencies = [
+ "rustc_version",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "plotters"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
+dependencies = [
+ "chrono",
+ "font-kit",
+ "image",
+ "lazy_static",
+ "num-traits",
+ "pathfinder_geometry",
+ "plotters-backend",
+ "plotters-bitmap",
+ "plotters-svg",
+ "ttf-parser",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
+
+[[package]]
+name = "plotters-bitmap"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72ce181e3f6bf82d6c1dc569103ca7b1bd964c60ba03d7e6cdfbb3e3eb7f7405"
+dependencies = [
+ "gif",
+ "image",
+ "plotters-backend",
+]
+
+[[package]]
+name = "plotters-canvas"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9126f053e70c9a2f2dd6998912a3536071e909fd37bde74b671402bfa441fc00"
+dependencies = [
+ "js-sys",
+ "plotters-backend",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
+name = "png"
+version = "0.17.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "pretty_assertions"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ae130e2f271fbc2ac3a40fb1d07180839cdbbe443c7a27e1e3c13c5cac0116d"
+dependencies = [
+ "diff",
+ "yansi",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "procfs"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
+dependencies = [
+ "bitflags 2.13.1",
+ "hex",
+ "procfs-core",
+ "rustix 0.38.44",
+]
+
+[[package]]
+name = "procfs-core"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
+dependencies = [
+ "bitflags 2.13.1",
+ "hex",
+]
+
+[[package]]
+name = "prometheus"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
+dependencies = [
+ "cfg-if",
+ "fnv",
+ "lazy_static",
+ "libc",
+ "memchr",
+ "parking_lot",
+ "procfs",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "prometheus-client"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83cd1b99916654a69008fd66b4f9397fbe08e6e51dfe23d4417acf5d3b8cb87c"
+dependencies = [
+ "dtoa",
+ "itoa",
+ "parking_lot",
+ "prometheus-client-derive-text-encode",
+]
+
+[[package]]
+name = "prometheus-client-derive-text-encode"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66a455fbcb954c1a7decf3c586e860fd7889cddf4b8e164be736dbac95a953cd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "prometools"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06c0f1b9189e7361a3e32ded803ab2ecb9a829d86cc32ce3fba8cff1b0cd4b69"
+dependencies = [
+ "itoa",
+ "parking_lot",
+ "prometheus-client",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "proptest"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
+dependencies = [
+ "bitflags 2.13.1",
+ "num-traits",
+ "rand 0.9.5",
+ "rand_chacha",
+ "rand_xorshift",
+ "regex-syntax",
+ "unarray",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "qlog"
+version = "0.18.0"
+dependencies = [
+ "flate2",
+ "foundations",
+ "humantime",
+ "pretty_assertions",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "tempfile",
+ "zstd",
+]
+
+[[package]]
+name = "qlog-dancer"
+version = "0.1.0"
+dependencies = [
+ "clap 4.6.5",
+ "env_logger",
+ "futures-util",
+ "getrandom 0.3.4",
+ "js-sys",
+ "log",
+ "netlog",
+ "plotters",
+ "plotters-canvas",
+ "qlog",
+ "regex",
+ "serde",
+ "serde-wasm-bindgen",
+ "serde_json",
+ "smallvec",
+ "table_to_html",
+ "tabled 0.15.0",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "wirefilter-engine",
+]
+
+[[package]]
+name = "quanta"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3ab5a9d756f0d97bdc89019bd2e4ea098cf9cde50ee7564dde6b81ccc8f06c7"
+dependencies = [
+ "crossbeam-utils",
+ "libc",
+ "once_cell",
+ "raw-cpuid",
+ "wasi",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "quiche"
+version = "0.29.3"
+dependencies = [
+ "boring",
+ "bytes",
+ "cdylib-link-lines",
+ "debug_panic",
+ "either",
+ "enum_dispatch",
+ "foreign-types-shared",
+ "intrusive-collections",
+ "libc",
+ "libm",
+ "log",
+ "mio",
+ "octets",
+ "qlog",
+ "ring",
+ "rstest",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "sfv",
+ "slab",
+ "smallvec",
+ "url",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "quiche_apps"
+version = "0.1.0"
+dependencies = [
+ "docopt",
+ "env_logger",
+ "libc",
+ "log",
+ "mio",
+ "nix",
+ "octets",
+ "quiche",
+ "ring",
+ "url",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "raw-cpuid"
+version = "11.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "relative-path"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rstest"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5a3193c063baaa2a95a33f03035c8a72b83d97a54916055ba22d35ed3839d49"
+dependencies = [
+ "futures-timer",
+ "futures-util",
+ "rstest_macros",
+]
+
+[[package]]
+name = "rstest_macros"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c845311f0ff7951c5506121a9ad75aec44d083c31583b2ea5a30bcb0b0abba0"
+dependencies = [
+ "cfg-if",
+ "glob",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "relative-path",
+ "rustc_version",
+ "syn 2.0.119",
+ "unicode-ident",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be2a24f50780bc85f09cc6ac299bdf1424302742d77221106859c9d8b102126a"
+dependencies = [
+ "arrayvec",
+ "num-traits",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-wasm-bindgen"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8302e169f0eddcc139c70f139d19d6467353af16f9fce27e8c30158036a1e16b"
+dependencies = [
+ "js-sys",
+ "serde",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "indexmap 2.14.0",
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
+dependencies = [
+ "base64",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
+dependencies = [
+ "darling 0.23.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.8.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578a7433b776b56a35785ed5ce9a7e777ac0598aac5a6dd1b4b18a307c7fc71b"
+dependencies = [
+ "indexmap 1.9.3",
+ "ryu",
+ "serde",
+ "yaml-rust",
+]
+
+[[package]]
+name = "sfv"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27daf6ed3fc7ffd5ea3ce9f684fe351c47e50f2fdbb6236e2bad0b440dbe408"
+dependencies = [
+ "data-encoding",
+ "indexmap 2.14.0",
+ "rust_decimal",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "sliceslice"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "361b80c452f3f8cc2426bf996059740b4c78ef5a5aeb1c1852d8ac4f561b8b4c"
+dependencies = [
+ "cfg-if",
+ "memchr",
+ "paste",
+ "seq-macro",
+]
+
+[[package]]
+name = "slog"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b3b8565691b22d2bdfc066426ed48f837fc0c5f2c8cad8d9718f7f99d6995c1"
+dependencies = [
+ "anyhow",
+ "erased-serde 0.3.31",
+ "rustversion",
+ "serde_core",
+]
+
+[[package]]
+name = "slog-async"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72c8038f898a2c79507940990f05386455b3a317d8f18d4caea7cbc3d5096b84"
+dependencies = [
+ "crossbeam-channel",
+ "slog",
+ "take_mut",
+ "thread_local",
+]
+
+[[package]]
+name = "slog-json"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e1e53f61af1e3c8b852eef0a9dee29008f55d6dd63794f3f12cef786cf0f219"
+dependencies = [
+ "serde",
+ "serde_json",
+ "slog",
+ "time",
+]
+
+[[package]]
+name = "slog-scope"
+version = "4.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42b76cf645c92e7850d5a1c9205ebf2864bd32c0ab3e978e6daad51fedf7ef54"
+dependencies = [
+ "arc-swap",
+ "lazy_static",
+ "slog",
+]
+
+[[package]]
+name = "slog-stdlog"
+version = "4.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6706b2ace5bbae7291d3f8d2473e2bfab073ccd7d03670946197aec98471fa3e"
+dependencies = [
+ "log",
+ "slog",
+ "slog-scope",
+]
+
+[[package]]
+name = "slog-term"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cb1fc680b38eed6fad4c02b3871c09d2c81db8c96aa4e9c0a34904c830f09b5"
+dependencies = [
+ "chrono",
+ "is-terminal",
+ "slog",
+ "term",
+ "thread_local",
+ "time",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spinning_top"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d96d2d1d716fb500937168cc09353ffdc7a012be8475ac7308e1bdf0e3923300"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "table_to_html"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3b254ecd96aa3863439e99bf7a1ab9226a74ebbeab5c45da3a025153b79c1d"
+dependencies = [
+ "tabled 0.20.0",
+]
+
+[[package]]
+name = "tabled"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c998b0c8b921495196a48aabaf1901ff28be0760136e31604f7967b0792050e"
+dependencies = [
+ "papergrid 0.11.0",
+ "tabled_derive",
+ "unicode-width 0.1.14",
+]
+
+[[package]]
+name = "tabled"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e39a2ee1fbcd360805a771e1b300f78cc88fec7b8d3e2f71cd37bbf23e725c7d"
+dependencies = [
+ "papergrid 0.17.0",
+ "testing_table",
+]
+
+[[package]]
+name = "tabled_derive"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c138f99377e5d653a371cdad263615634cfc8467685dfe8e73e2b8e98f44b17"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "take_mut"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f764005d11ee5f36500a149ace24e00e3da98b0158b3e2d53a7495660d3f4d60"
+
+[[package]]
+name = "task-killswitch"
+version = "0.2.1"
+dependencies = [
+ "dashmap",
+ "futures-util",
+ "parking_lot",
+ "tokio",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix 1.1.4",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "term"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "testing_table"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f8daae29995a24f65619e19d8d31dea5b389f3d853d8bf297bbf607cd0014cc"
+dependencies = [
+ "unicode-width 0.2.2",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+dependencies = [
+ "thiserror-impl 2.0.19",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "thrift_codec"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d957f535b242b91aa9f47bde08080f9a6fef276477e55b0079979d002759d5"
+dependencies = [
+ "byteorder",
+ "trackable",
+]
+
+[[package]]
+name = "time"
+version = "0.3.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "tokio-quiche"
+version = "0.19.0"
+dependencies = [
+ "anyhow",
+ "assert_matches",
+ "boring",
+ "bytes",
+ "clap 4.6.5",
+ "crossbeam",
+ "datagram-socket",
+ "env_logger",
+ "foundations",
+ "futures",
+ "futures-util",
+ "h3i",
+ "http",
+ "http-body",
+ "http-body-util",
+ "ipnetwork",
+ "libc",
+ "log",
+ "nix",
+ "octets",
+ "pin-project",
+ "qlog",
+ "quiche",
+ "regex",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "slog-scope",
+ "slog-stdlog",
+ "smallvec",
+ "task-killswitch",
+ "tempfile",
+ "thiserror 2.0.19",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "url",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-util",
+ "libc",
+ "pin-project-lite",
+ "slab",
+ "tokio",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.13+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+dependencies = [
+ "indexmap 2.14.0",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "base64",
+ "bytes",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "sync_wrapper",
+ "tokio",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.14.0",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "trackable"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15bd114abb99ef8cee977e517c8f37aee63f184f2d08e3e6ceca092373369ae"
+dependencies = [
+ "trackable_derive",
+]
+
+[[package]]
+name = "trackable_derive"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebeb235c5847e2f82cfe0f07eb971d1e5f6804b18dac2ae16349cc604380f82f"
+dependencies = [
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "ttf-parser"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17f77d76d837a7830fe1d4f12b7b4ba4192c1888001c7164257e4bc6d21d96b4"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "weezl"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
+
+[[package]]
+name = "wildcard"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36241ad0795516b55e3b60e55c7f979d4f324e4aaea4c70d56b548b9164ee4d2"
+dependencies = [
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wio"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d129932f4644ac2396cb456385cbf9e63b5b30c6e8dc4820bdca4eb082037a5"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "wirefilter-engine"
+version = "0.7.0"
+source = "git+https://github.com/cloudflare/wirefilter.git?rev=f3116d9f244d10a2d9a37d036cfa7129c5e50d3b#f3116d9f244d10a2d9a37d036cfa7129c5e50d3b"
+dependencies = [
+ "backtrace",
+ "cfg-if",
+ "cidr",
+ "fnv",
+ "getrandom 0.3.4",
+ "memmem",
+ "rand 0.9.5",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sliceslice",
+ "thiserror 1.0.69",
+ "wildcard",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yaml-merge-keys"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af47d205071caaef70ebce5e04e1d88eba944833f8a6626dacdda700f86c285a"
+dependencies = [
+ "lazy_static",
+ "serde_yaml",
+ "thiserror 1.0.69",
+ "yaml-rust",
+]
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
+
+[[package]]
+name = "yansi"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
+
+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
+dependencies = [
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/macOS/GhostHTTP3/scripts/build-framework.sh b/macOS/GhostHTTP3/scripts/build-framework.sh
new file mode 100755
index 0000000..59d96f8
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/build-framework.sh
@@ -0,0 +1,136 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+source_dir=${build_dir}/upstream/quiche
+output_dir=${build_dir}/artifacts
+deployment_target=${MACOSX_DEPLOYMENT_TARGET:-15.0}
+lock_file=${project_dir}/quiche-0.29.3.Cargo.lock
+
+# quiche 0.29.3. Keep this immutable so the framework is reproducible.
+quiche_revision=55886df3be579579207104c8e645825b6347a209
+quiche_repository=https://github.com/cloudflare/quiche.git
+
+if ! command -v cargo >/dev/null 2>&1 || ! command -v rustup >/dev/null 2>&1; then
+    print -u2 "error: Rust 1.88 or newer installed with rustup is required"
+    exit 1
+fi
+
+rust_version=$(rustc --version | awk '{ print $2 }')
+version_parts=(${(s:.:)rust_version})
+if (( ${#version_parts} < 2 )) || \
+   (( version_parts[1] < 1 )) || \
+   (( version_parts[1] == 1 && version_parts[2] < 88 )); then
+    print -u2 "error: could not determine the Rust compiler version"
+    exit 1
+fi
+
+mkdir -p "${build_dir}/upstream" "${build_dir}/dylib" "${output_dir}"
+
+if [[ ! -d ${source_dir}/.git ]]; then
+    git clone --filter=blob:none --no-checkout "${quiche_repository}" "${source_dir}"
+fi
+
+git -C "${source_dir}" fetch --depth 1 origin "${quiche_revision}"
+git -C "${source_dir}" checkout --detach --force "${quiche_revision}"
+cp "${lock_file}" "${source_dir}/Cargo.lock"
+
+actual_revision=$(git -C "${source_dir}" rev-parse HEAD)
+if [[ ${actual_revision} != ${quiche_revision} ]]; then
+    print -u2 "error: expected quiche ${quiche_revision}, got ${actual_revision}"
+    exit 1
+fi
+
+target=aarch64-apple-darwin
+cargo_target_dir=${build_dir}/cargo-dylib
+wrapper_object=${build_dir}/dylib/GhostHTTP3.o
+
+rustup target add "${target}" >/dev/null
+
+xcrun clang \
+    -arch arm64 \
+    -fPIC \
+    -mmacosx-version-min="${deployment_target}" \
+    -I"${project_dir}/include" \
+    -I"${source_dir}/quiche/include" \
+    -c "${project_dir}/Sources/GhostHTTP3.c" \
+    -o "${wrapper_object}"
+
+# Ask Cargo for only a cdylib. The wrapper object is linked into that same
+# image, producing one dynamic library that exports both the complete quiche C
+# API and the small versioned GhostHTTP3 API. The explicit export roots keep
+# the C wrapper visible through rustc's cdylib export list.
+(
+    cd "${source_dir}"
+    MACOSX_DEPLOYMENT_TARGET="${deployment_target}" \
+        cargo rustc \
+            --locked \
+            --release \
+            --package quiche \
+            --features ffi \
+            --target "${target}" \
+            --target-dir "${cargo_target_dir}" \
+            --crate-type cdylib \
+            -- \
+            -C "link-arg=${wrapper_object}" \
+            -C 'link-arg=-Wl,-u,_ghost_http3_api_version' \
+            -C 'link-arg=-Wl,-u,_ghost_http3_backend_version' \
+            -C 'link-arg=-Wl,-u,_ghost_http3_application_protocol' \
+            -C 'link-arg=-Wl,-u,_ghost_http3_backend_is_ready' \
+            -C 'link-arg=-Wl,-exported_symbol,_ghost_http3_api_version' \
+            -C 'link-arg=-Wl,-exported_symbol,_ghost_http3_backend_version' \
+            -C 'link-arg=-Wl,-exported_symbol,_ghost_http3_application_protocol' \
+            -C 'link-arg=-Wl,-exported_symbol,_ghost_http3_backend_is_ready'
+)
+
+dylib_path=${cargo_target_dir}/${target}/release/libquiche.dylib
+if [[ ! -f ${dylib_path} ]]; then
+    print -u2 "error: Cargo did not produce the arm64 quiche dylib"
+    exit 1
+fi
+
+framework_dir=${output_dir}/GhostHTTP3.framework
+rm -rf "${framework_dir}" "${output_dir}/GhostHTTP3.xcframework"
+mkdir -p \
+    "${framework_dir}/Versions/A/Headers" \
+    "${framework_dir}/Versions/A/Modules" \
+    "${framework_dir}/Versions/A/Resources"
+
+cp "${dylib_path}" "${framework_dir}/Versions/A/GhostHTTP3"
+
+cp "${project_dir}/include/GhostHTTP3/GhostHTTP3.h" "${framework_dir}/Versions/A/Headers/GhostHTTP3.h"
+cp "${source_dir}/quiche/include/quiche.h" "${framework_dir}/Versions/A/Headers/quiche.h"
+cp "${project_dir}/include/module.modulemap" "${framework_dir}/Versions/A/Modules/module.modulemap"
+
+info_plist=${framework_dir}/Versions/A/Resources/Info.plist
+plutil -create xml1 "${info_plist}"
+plutil -insert CFBundleDevelopmentRegion -string en "${info_plist}"
+plutil -insert CFBundleExecutable -string GhostHTTP3 "${info_plist}"
+plutil -insert CFBundleIdentifier -string com.ghostvm.GhostHTTP3 "${info_plist}"
+plutil -insert CFBundleInfoDictionaryVersion -string 6.0 "${info_plist}"
+plutil -insert CFBundleName -string GhostHTTP3 "${info_plist}"
+plutil -insert CFBundlePackageType -string FMWK "${info_plist}"
+plutil -insert CFBundleShortVersionString -string 0.1.0 "${info_plist}"
+plutil -insert CFBundleVersion -string 1 "${info_plist}"
+plutil -insert MinimumOSVersion -string "${deployment_target}" "${info_plist}"
+
+ln -s A "${framework_dir}/Versions/Current"
+ln -s Versions/Current/GhostHTTP3 "${framework_dir}/GhostHTTP3"
+ln -s Versions/Current/Headers "${framework_dir}/Headers"
+ln -s Versions/Current/Modules "${framework_dir}/Modules"
+ln -s Versions/Current/Resources "${framework_dir}/Resources"
+
+xcrun install_name_tool \
+    -id '@rpath/GhostHTTP3.framework/Versions/A/GhostHTTP3' \
+    "${framework_dir}/Versions/A/GhostHTTP3"
+codesign --force --sign - --timestamp=none "${framework_dir}"
+
+file "${framework_dir}/GhostHTTP3" | rg -q 'Mach-O 64-bit dynamically linked shared library arm64'
+[[ $(lipo -archs "${framework_dir}/GhostHTTP3") == arm64 ]]
+otool -D "${framework_dir}/GhostHTTP3" | \
+    rg -q '^@rpath/GhostHTTP3\.framework/Versions/A/GhostHTTP3$'
+
+print "Built arm64 dynamic framework ${output_dir}/GhostHTTP3.framework"
diff --git a/macOS/GhostHTTP3/scripts/build-with-rust-dmg.sh b/macOS/GhostHTTP3/scripts/build-with-rust-dmg.sh
new file mode 100755
index 0000000..a7dd983
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/build-with-rust-dmg.sh
@@ -0,0 +1,29 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+mount_point=${GHOST_HTTP3_RUST_MOUNT:-${build_dir}/mount/GhostHTTP3Rust188}
+
+"${script_dir}/create-rust-toolchain-dmg.sh"
+
+export CARGO_HOME=${mount_point}/cargo
+export RUSTUP_HOME=${mount_point}/rustup
+export PATH=${CARGO_HOME}/bin:${PATH}
+
+"${script_dir}/build-framework.sh"
+"${script_dir}/test-framework.sh"
+"${script_dir}/test-stress.sh"
+"${script_dir}/test-http3.sh"
+"${script_dir}/test-chaos.sh"
+
+# Optional, bounded seed-progression soak. Off by default to keep CI builds
+# under the framework build budget; enable with GHOST_HTTP3_SOAK=1 (and see
+# the soak-chaos.sh env knobs for further tuning).
+if [[ ${GHOST_HTTP3_SOAK:-0} == 1 ]]; then
+    "${script_dir}/soak-chaos.sh"
+fi
+
+print "To detach the reusable toolchain: hdiutil detach ${mount_point}"
diff --git a/macOS/GhostHTTP3/scripts/create-rust-toolchain-dmg.sh b/macOS/GhostHTTP3/scripts/create-rust-toolchain-dmg.sh
new file mode 100755
index 0000000..d3c54ad
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/create-rust-toolchain-dmg.sh
@@ -0,0 +1,59 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+image_dir=${build_dir}/toolchains
+image_path=${GHOST_HTTP3_RUST_IMAGE:-${image_dir}/Rust-1.88.0-macOS-arm64.sparseimage}
+mount_point=${GHOST_HTTP3_RUST_MOUNT:-${build_dir}/mount/GhostHTTP3Rust188}
+volume_name=GhostHTTP3Rust188
+rust_version=1.88.0
+
+mkdir -p "${image_dir}"
+
+if [[ ! -f ${image_path} ]]; then
+    hdiutil create \
+        -size 4g \
+        -fs APFS \
+        -volname "${volume_name}" \
+        -type SPARSE \
+        "${image_path}"
+fi
+
+if ! mount | grep -Fq " on ${mount_point} ("; then
+    mkdir -p "${mount_point}"
+    hdiutil attach -nobrowse -mountpoint "${mount_point}" "${image_path}"
+fi
+
+mkdir -p "${mount_point}/cargo" "${mount_point}/rustup" "${mount_point}/bootstrap"
+
+rustup_init=${mount_point}/bootstrap/rustup-init
+if [[ ! -x ${rustup_init} ]]; then
+    curl --fail --location --show-error \
+        https://static.rust-lang.org/rustup/dist/aarch64-apple-darwin/rustup-init \
+        -o "${rustup_init}"
+    chmod 755 "${rustup_init}"
+fi
+
+if [[ ! -x ${mount_point}/cargo/bin/rustc ]]; then
+    CARGO_HOME="${mount_point}/cargo" \
+    RUSTUP_HOME="${mount_point}/rustup" \
+        "${rustup_init}" \
+            -y \
+            --no-modify-path \
+            --profile minimal \
+            --default-toolchain "${rust_version}"
+fi
+
+CARGO_HOME="${mount_point}/cargo" \
+RUSTUP_HOME="${mount_point}/rustup" \
+    "${mount_point}/cargo/bin/rustup" target add \
+        aarch64-apple-darwin
+
+print "Rust toolchain image: ${image_path}"
+print "Mounted at: ${mount_point}"
+CARGO_HOME="${mount_point}/cargo" \
+RUSTUP_HOME="${mount_point}/rustup" \
+    "${mount_point}/cargo/bin/rustc" --version
diff --git a/macOS/GhostHTTP3/scripts/soak-chaos.sh b/macOS/GhostHTTP3/scripts/soak-chaos.sh
new file mode 100755
index 0000000..e5cfaf5
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/soak-chaos.sh
@@ -0,0 +1,119 @@
+#!/bin/zsh
+
+# Deterministic seed-progression soak for the GhostHTTP3 chaos phase.
+#
+# Re-runs the conservative chaos scenarios across an advancing seed range
+# with a wall-clock budget, no root, and no second host. Because losing
+# a handshake-critical datagram inside quiche's 5s idle timeout causes some
+# seeds to stall the stock http3 example independent of framework health,
+# the soak treats those stalls as documented findings (it logs them but does
+# NOT factor them into the pass/fail verdict). Real failures are: process
+# leaks, proxy-queue overflows, lost-client-address, server-failed-h3, or a
+# non-loss scenario that could not complete.
+#
+# Tunables (environment):
+#   GHOST_HTTP3_SOAK_SEED_START       first seed (default 7)
+#   GHOST_HTTP3_SOAK_SEED_COUNT       how many successive seeds (default 5)
+#   GHOST_HTTP3_SOAK_MAX_SECONDS      wall-clock budget (default 240s; checked
+#                                     between seeds)
+#   GHOST_HTTP3_SOAK_MAX_ITERATIONS   hard cap on seeds run (default: off/0)
+#   GHOST_HTTP3_SOAK_ITERATIONS       per-seed chaos iterations (default 2)
+#   GHOST_HTTP3_SOAK_SANITIZERS=1    build the proxy with ASan/UBSan
+#   GHOST_HTTP3_SOAK_HARSH=1         also run the harsh-loss reproducer/seed
+#   GHOST_HTTP3_SOAK_QUIET=1         suppress per-seed chaos output
+#
+# Tip: combine with GHOST_HTTP3_SOAK_MAX_ITERATIONS=20 to bound the maximum
+# CPU/IO commitment while still exercising budgeted seeds.
+
+set -uo pipefail
+
+script_dir=${0:A:h}
+
+soak_seed_start=${GHOST_HTTP3_SOAK_SEED_START:-7}
+soak_seed_count=${GHOST_HTTP3_SOAK_SEED_COUNT:-5}
+soak_max_seconds=${GHOST_HTTP3_SOAK_MAX_SECONDS:-240}
+soak_max_iterations=${GHOST_HTTP3_SOAK_MAX_ITERATIONS:-0}
+soak_iterations=${GHOST_HTTP3_SOAK_ITERATIONS:-3}
+soak_sanitizers=${GHOST_HTTP3_SOAK_SANITIZERS:-0}
+soak_harsh=${GHOST_HTTP3_SOAK_HARSH:-0}
+soak_quiet=${GHOST_HTTP3_SOAK_QUIET:-0}
+
+starts_at=$(date +%s)
+deadline=$((starts_at + soak_max_seconds))
+
+passes=0
+stalls=0
+low_drop=0
+fails=0
+completed=0
+
+last_seed=$((soak_seed_start + soak_seed_count - 1))
+for ((seed = soak_seed_start; seed <= last_seed; seed++)); do
+    if (( $(date +%s) >= deadline )); then
+        print -r -u2 -- "soak: wall-clock cap ${soak_max_seconds}s reached, stopping at seed ${seed}"
+        break
+    fi
+    if (( soak_max_iterations > 0 && completed >= soak_max_iterations )); then
+        print -r -u2 -- "soak: iteration cap ${soak_max_iterations} reached, stopping at seed ${seed}"
+        break
+    fi
+
+    out_file=$(mktemp -t ghost_http3_soak.XXXXXX)
+    env_vars=(
+        GHOST_HTTP3_CHAOS_SEED=${seed}
+        GHOST_HTTP3_CHAOS_ITERATIONS=${soak_iterations}
+        GHOST_HTTP3_CHAOS_CLIENT_TIMEOUT=25
+        GHOST_HTTP3_CHAOS_PROXY_MAX_DURATION=180
+        # Forces strict chaos mode so the soak classifier can distinguish
+        # STALL / LOW-DROP / FAIL outcomes; the chaos test's tolerant
+        # default would mask all but structural failures.
+        GHOST_HTTP3_CHAOS_TOLERATE_STALL=0
+    )
+    if (( soak_sanitizers )); then
+        env_vars+=(GHOST_HTTP3_TEST_SANITIZERS=1)
+    fi
+    if [[ ${soak_harsh} == 1 ]]; then
+        env_vars+=(GHOST_HTTP3_CHAOS_HARSH=1)
+    fi
+
+    if env "${env_vars[@]}" "${script_dir}/test-chaos.sh" >"${out_file}" 2>&1; then
+        passes=$((passes + 1))
+        [[ ${soak_quiet} == 0 ]] && print -r -- "soak seed=${seed}: PASS"
+    else
+        # The chaos script exits non-zero for three classes of run. We
+        # classify each so the soak only fails on framework regressions:
+        #   * STALLED: a quiche example idle-timeout fire (5s) on the loss
+        #     scenario when this seed happened to drop a handshake-critical
+        #     flight. Documented; not a framework bug.
+        #   * LOW_DROP: a non-loss assertion threshold (dup, reorder, mtu)
+        #     wasn't met for this low-packet seed. The impairment was
+        #     configured but fired too rarely to elicit the threshold on a
+        #     short loopback flow. Informational; not a framework bug.
+        #   * FAIL: structural — proxy queue overflow, drop_nopeer,
+        #     server-failed-h3, ASan error, or unclassified chaos failure.
+        if rg -q 'idle timeout fired|stalled handshake|client watchdog timed out|ALPN h3 not negotiated|ALPN h3 or HTTP/3 success markers missing' "${out_file}"; then
+            stalls=$((stalls + 1))
+            [[ ${soak_quiet} == 0 ]] && print -r -- "soak seed=${seed}: STALLED (documented quiche example idle-timeout limit)"
+        elif rg -q "dropped no datagrams at all|fired no dups at all|did not reorder any packets|delayed nothing|dropped no oversized datagram|did not actually drop" "${out_file}"; then
+            low_drop=$((low_drop + 1))
+            [[ ${soak_quiet} == 0 ]] && print -r -- "soak seed=${seed}: LOW-DROP (impairment configured but fired below threshold on this short flow)"
+        else
+            fails=$((fails + 1))
+            print -r -u2 -- "soak seed=${seed}: FAIL"
+            tail -12 "${out_file}" >&2
+        fi
+    fi
+    rm -f "${out_file}" 2>/dev/null || true
+    completed=$((completed + 1))
+done
+
+elapsed=$(( $(date +%s) - starts_at ))
+print -r -- "soak summary: seeds_tried=${completed} passes=${passes} stalls=${stalls} low_drop=${low_drop} fails=${fails} elapsed=${elapsed}s"
+print -r -- "soak budget: seed_start=${soak_seed_start} seed_count=${soak_seed_count} max_seconds=${soak_max_seconds} max_iterations=${soak_max_iterations} iterations=${soak_iterations} (time checked between seeds)"
+
+# Stalls and low-drop counts are documented/informational and do not gate the
+# exit code. Only structural failures do.
+if (( fails > 0 )); then
+    exit 1
+fi
+exit 0
diff --git a/macOS/GhostHTTP3/scripts/test-chaos.sh b/macOS/GhostHTTP3/scripts/test-chaos.sh
new file mode 100755
index 0000000..1f1e21e
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/test-chaos.sh
@@ -0,0 +1,489 @@
+#!/bin/zsh
+
+# Drives the deterministic UDP chaos proxy phase: compiles the proxy and the
+# upstream quiche C HTTP/3 client/server against the packaged
+# GhostHTTP3.framework, then replays conservative impairment scenarios that
+# must all end in a successful RFC 9114 exchange (GET / -> 200 "byez").
+#
+# Every scenario asserts both ends: the client/server logs prove HTTP/3
+# success over QUIC, and the proxy's own counters prove the impairments
+# actually fired (loss, duplication, delay/jitter, reordering, MTU drops).
+#
+# Conservatism invariants (read before changing any rate/seed):
+#   * The stock quiche example sets max_idle_timeout=5000ms. Any loss that
+#     drops a handshake-critical datagram can stall the client until that
+#     idle timeout, so per-direction loss rates are deliberately small and
+#     the seed is fixed. The harsh-loss reproducer below documents the
+#     failure mode that motivated this conservatism (opt-in).
+#   * Proxy stats (drop_loss, dup, delayed, reordered, drop_mtu) are the
+#     source of truth for "impairment fired". quiche's own `lost=` counter
+#     is NOT asserted because it does not increment on small flows whose
+#     retransmissions complete before QUIC declares a packet lost.
+#
+# Tunables (environment):
+#   GHOST_HTTP3_CHAOS_SEED          impairment PRNG seed (default 7)
+#   GHOST_HTTP3_CHAOS_ITERATIONS    client runs per scenario (default 3)
+#   GHOST_HTTP3_CHAOS_PORT_BASE     first candidate UDP port (default derived
+#                                   from this script's PID)
+#   GHOST_HTTP3_CHAOS_SERVER_PORT / GHOST_HTTP3_CHAOS_PROXY_PORT
+#                                   pin both ports explicitly (skips the scan)
+#   GHOST_HTTP3_CHAOS_CLIENT_TIMEOUT  per-client watchdog (default 25s; must
+#                                     exceed quiche's 5s idle timeout with
+#                                     margin for retransmission drains)
+#   GHOST_HTTP3_CHAOS_PROXY_MAX_DURATION  proxy self-termination bound (300s)
+#   GHOST_HTTP3_CHAOS_HARSH=1       also run the harsh-loss reproducer
+#                                  (expected to stall; documents the limit)
+#   GHOST_HTTP3_CHAOS_TOLERATE_STALL=1
+#                                   diagnostic mode only: count client stalls
+#                                   rather than failing the conservative phase
+#   GHOST_HTTP3_TEST_SANITIZERS=1   build the proxy with ASan/UBSan
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+framework_dir=${build_dir}/artifacts/GhostHTTP3.framework
+examples_dir=${build_dir}/upstream/quiche/quiche/examples
+test_dir=${build_dir}/tests
+proxy_binary=${test_dir}/udp-chaos-proxy
+datagram_binary=${test_dir}/udp-datagram
+
+seed=${GHOST_HTTP3_CHAOS_SEED:-7}
+iterations=${GHOST_HTTP3_CHAOS_ITERATIONS:-3}
+port_base=${GHOST_HTTP3_CHAOS_PORT_BASE:-$((20000 + ($$ % 30000)))}
+client_timeout=${GHOST_HTTP3_CHAOS_CLIENT_TIMEOUT:-25}
+proxy_max_duration=${GHOST_HTTP3_CHAOS_PROXY_MAX_DURATION:-300}
+harsh=${GHOST_HTTP3_CHAOS_HARSH:-0}
+# Diagnostic escape hatch only. The default gate is strict: every conservative
+# exchange must complete successfully. Tolerant mode is useful for exploring
+# seeds around the stock examples' hard-coded 5s idle-timeout boundary, but a
+# tolerant run is never reported as a passing recovery gate.
+tolerate_stalls=${GHOST_HTTP3_CHAOS_TOLERATE_STALL:-0}
+
+if [[ ! -d ${framework_dir} ]]; then
+    print -u2 "error: GhostHTTP3.framework is missing; run build-framework.sh first"
+    exit 1
+fi
+
+if [[ ! -f /opt/homebrew/include/ev.h || ! -f /opt/homebrew/include/uthash.h ]]; then
+    print -u2 "error: chaos test requires: brew install libev uthash"
+    exit 1
+fi
+
+if [[ ! -f ${examples_dir}/cert.crt || ! -f ${examples_dir}/cert.key ]]; then
+    print -u2 "error: quiche example TLS identity is missing; run build-framework.sh first"
+    exit 1
+fi
+
+mkdir -p "${test_dir}"
+
+sanitize_flags=()
+if [[ ${GHOST_HTTP3_TEST_SANITIZERS:-0} == 1 ]]; then
+    sanitize_flags=(
+        -O1
+        -fno-omit-frame-pointer
+        -fsanitize=address,undefined
+    )
+fi
+
+xcrun clang \
+    -std=c17 \
+    -O2 \
+    -Wall \
+    -Wextra \
+    -Werror \
+    -Wno-unused-parameter \
+    "${sanitize_flags[@]}" \
+    "${project_dir}/Tests/udp-chaos-proxy.c" \
+    -o "${proxy_binary}"
+
+xcrun clang \
+    -std=c17 \
+    -O2 \
+    -Wall \
+    -Wextra \
+    -Werror \
+    "${project_dir}/Tests/udp-datagram.c" \
+    -o "${datagram_binary}"
+
+common_flags=(
+    -O2
+    -I"${framework_dir}/Headers"
+    -I/opt/homebrew/include
+    -L/opt/homebrew/lib
+    -F"${build_dir}/artifacts"
+    -framework GhostHTTP3
+    -Wl,-rpath,@executable_path/../artifacts
+    -lev
+)
+
+xcrun clang "${common_flags[@]}" \
+    "${examples_dir}/http3-server.c" \
+    -o "${test_dir}/http3-server"
+
+xcrun clang "${common_flags[@]}" \
+    "${examples_dir}/http3-client.c" \
+    -o "${test_dir}/http3-client"
+
+# --- collision-resistant port selection -------------------------------------
+# The proxy's probe mode binds a candidate UDP port: exit 0 means free.
+port_free() {
+    "${proxy_binary}" --probe-port "$1" >/dev/null 2>&1
+}
+
+server_port=${GHOST_HTTP3_CHAOS_SERVER_PORT:-}
+proxy_port=${GHOST_HTTP3_CHAOS_PROXY_PORT:-}
+
+if [[ -z ${server_port} && -z ${proxy_port} ]]; then
+    candidate=${port_base}
+    for (( attempt = 0; attempt < 200; attempt++ )); do
+        if (( candidate + 1 > 65535 )); then
+            break
+        fi
+        if port_free ${candidate} && port_free $(( candidate + 1 )); then
+            server_port=${candidate}
+            proxy_port=$(( candidate + 1 ))
+            break
+        fi
+        (( candidate += 2 ))
+    done
+fi
+
+if [[ -z ${server_port} || -z ${proxy_port} ]]; then
+    print -u2 "error: could not find a free UDP port pair (set GHOST_HTTP3_CHAOS_SERVER_PORT and GHOST_HTTP3_CHAOS_PROXY_PORT)"
+    exit 1
+fi
+
+print "chaos phase: seed=${seed} iterations=${iterations} server_port=${server_port} proxy_port=${proxy_port}"
+
+# --- process lifecycle -------------------------------------------------------
+server_pid=""
+proxy_pid=""
+server_log=""
+proxy_log=""
+client_log=""
+
+cleanup() {
+    [[ -n ${proxy_pid} ]] && kill ${proxy_pid} >/dev/null 2>&1 || true
+    [[ -n ${server_pid} ]] && kill ${server_pid} >/dev/null 2>&1 || true
+    wait >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+trap 'cleanup; exit 130' INT
+trap 'cleanup; exit 143' TERM HUP
+
+fail() {
+    # Use `print -r -- ` so leading dashes in the message (e.g. "--- tail")
+    # are not parsed as options. zsh otherwise aborts the function before
+    # the diagnostic tail is emitted, turning real failures into the
+    # misleading "print: bad option: -" line.
+    print -r -u2 -- "error: $1"
+    for log in "${client_log}" "${server_log}" "${proxy_log}"; do
+        if [[ -n ${log} && -f ${log} ]]; then
+            print -r -u2 -- "=== tail ${log} ==="
+            tail -30 "${log}" >&2
+        fi
+    done
+    exit 1
+}
+
+wait_server_ready() {
+    for (( i = 0; i < 100; i++ )); do
+        kill -0 ${server_pid} 2>/dev/null || return 1
+        port_free ${server_port} || return 0
+        sleep 0.05
+    done
+    return 1
+}
+
+wait_proxy_ready() {
+    for (( i = 0; i < 100; i++ )); do
+        kill -0 ${proxy_pid} 2>/dev/null || return 1
+        rg -q '^listening on ' "${proxy_log}" 2>/dev/null && return 0
+        sleep 0.05
+    done
+    return 1
+}
+
+run_client() {
+    local log=$1
+    (
+        cd "${examples_dir}"
+        exec "${test_dir}/http3-client" 127.0.0.1 ${proxy_port}
+    ) >"${log}" 2>&1 &
+    local client_pid=$!
+    local waited=0
+    while kill -0 ${client_pid} 2>/dev/null; do
+        if (( waited >= client_timeout * 10 )); then
+            kill -9 ${client_pid} >/dev/null 2>&1 || true
+            wait ${client_pid} >/dev/null 2>&1 || true
+            print -r -u2 -- "client watchdog killed PID ${client_pid} after ${client_timeout}s"
+            return 124
+        fi
+        sleep 0.1
+        (( waited += 1 ))
+    done
+    local rc=0
+    wait ${client_pid} >/dev/null 2>&1 || rc=$?
+    if (( rc != 0 )); then
+        # The stock quiche example returns non-zero when the 5s idle
+        # timeout fires (handshake stall). Surface that explicitly so the
+        # caller can fail with the right message instead of letting the
+        # rg assertions later guess what happened.
+        print -r -u2 -- "http3-client exited with status ${rc}"
+    fi
+    return ${rc}
+}
+
+# Extracts FIELD from the last "stats dir=DIR ..." line of a proxy log.
+stat_value() {
+    local log=$1 dir=$2 field=$3
+    rg "^stats dir=${dir} " "${log}" | tail -1 | sed -E "s/.* ${field}=([0-9]+).*/\1/"
+}
+
+# Runs one scenario: fresh server + proxy, ${iterations} client exchanges,
+# then a graceful proxy shutdown so its cumulative stats land in the log.
+# After it returns, callers assert on ${proxy_log}/${server_log}/${client_log}.
+#
+# When scenario_tolerate_stall=1 (set by the harsh-loss reproducer), a
+# per-iteration client stall — non-zero exit, idle-timeout fire, or missing
+# HTTP/3 success marker — is recorded into ${stalled} and ${completed} globals
+# rather than aborting the script. The mandatory invariants (bounded queue,
+# known peer, clean process teardown) are still asserted below.
+scenario_tolerate_stall=${tolerate_stalls}
+stalled=0
+completed=0
+# Cumulative counters across scenarios; printed in the final summary.
+total_stalls=0
+total_completed=0
+total_iterations=0
+# A scenario may inject one harmless oversized UDP datagram after all HTTP/3
+# clients have completed. This proves the proxy's MTU filter/counter without
+# turning the stock quiche example's 5s idle timeout into a flaky black-hole
+# recovery assertion.
+mtu_probe_bytes=0
+
+run_scenario() {
+    local name=$1; shift
+
+    server_log=${test_dir}/chaos-${name}-server.log
+    proxy_log=${test_dir}/chaos-${name}-proxy.log
+    client_log=${test_dir}/chaos-${name}-client.log
+    : > "${client_log}"
+
+    # Start each scenario with fresh counters so toleration accounting is
+    # visible to the caller before we re-enter the next scenario.
+    stalled=0
+    completed=0
+    total_iterations=$((total_iterations + iterations))
+
+    print "== scenario ${name}: $*"
+
+    (
+        cd "${examples_dir}"
+        exec "${test_dir}/http3-server" 127.0.0.1 ${server_port}
+    ) >"${server_log}" 2>&1 &
+    server_pid=$!
+    wait_server_ready || fail "http3-server did not start on 127.0.0.1:${server_port}"
+
+    "${proxy_binary}" \
+        --listen-port ${proxy_port} \
+        --target-port ${server_port} \
+        --seed ${seed} \
+        --max-duration ${proxy_max_duration} \
+        "$@" >"${proxy_log}" 2>&1 &
+    proxy_pid=$!
+    wait_proxy_ready || fail "udp-chaos-proxy did not start on 127.0.0.1:${proxy_port}"
+
+    for (( iteration = 1; iteration <= iterations; iteration++ )); do
+        local iteration_log=${client_log}.${iteration}
+        local rc=0
+        run_client "${iteration_log}" || rc=$?
+        local marker_ok=0
+        if rg -q "connection established: h3" "${iteration_log}" && \
+           rg -q "got HTTP header: :status=200" "${iteration_log}" && \
+           rg -q "got HTTP header: content-length=5" "${iteration_log}" && \
+           rg -q "^byez" "${iteration_log}"; then
+            marker_ok=1
+        fi
+
+        if (( marker_ok )); then
+            completed=$((completed + 1))
+        elif (( scenario_tolerate_stall == 1 )); then
+            stalled=$((stalled + 1))
+        elif (( rc == 124 )); then
+            fail "client watchdog timed out after ${client_timeout}s (scenario ${name}, iteration ${iteration})"
+        elif (( rc != 0 )); then
+            fail "http3-client exited ${rc}, likely the 5s idle timeout fired on a stalled handshake (scenario ${name}, iteration ${iteration})"
+        else
+            fail "ALPN h3 or HTTP/3 success markers missing (scenario ${name}, iteration ${iteration})"
+        fi
+
+        cat "${iteration_log}" >> "${client_log}"
+    done
+
+    if (( mtu_probe_bytes > 0 )); then
+        "${datagram_binary}" 127.0.0.1 ${proxy_port} ${mtu_probe_bytes} || \
+            fail "could not inject ${mtu_probe_bytes}-byte MTU probe (scenario ${name})"
+        # Give the loopback relay a bounded moment to account for the packet
+        # before asking it to print its final counters and terminate.
+        sleep 0.2
+    fi
+
+    kill -TERM ${proxy_pid} >/dev/null 2>&1 || true
+    wait ${proxy_pid} >/dev/null 2>&1 || true
+    proxy_pid=""
+
+    kill ${server_pid} >/dev/null 2>&1 || true
+    wait ${server_pid} >/dev/null 2>&1 || true
+    server_pid=""
+
+    # The mandatory invariants hold even when stalls are tolerated.
+    local dir
+    for dir in c2s s2c; do
+        [[ $(stat_value "${proxy_log}" ${dir} drop_full) == 0 ]] || \
+            fail "proxy queue overflowed (scenario ${name}, ${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} drop_nopeer) == 0 ]] || \
+            fail "proxy lost track of the client address (scenario ${name}, ${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} send_error) == 0 ]] || \
+            fail "proxy failed to forward a datagram (scenario ${name}, ${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} queued) == 0 ]] || \
+            fail "proxy stopped with queued datagrams (scenario ${name}, ${dir})"
+    done
+
+    # Any completed client proves the server should have negotiated h3. Strict
+    # mode necessarily has completions; an all-stalled diagnostic run does not.
+    if (( completed > 0 || scenario_tolerate_stall == 0 )); then
+        rg -q 'proto=Ok\("h3"\)' "${server_log}" || \
+            fail "server did not negotiate h3 (scenario ${name})"
+    fi
+
+    if (( scenario_tolerate_stall == 1 )); then
+        print "   tolerated: ${stalled}/${iterations} iterations stalled, ${completed}/${iterations} completed"
+    fi
+
+    total_stalls=$((total_stalls + stalled))
+    total_completed=$((total_completed + completed))
+
+    rg '^stats' "${proxy_log}" | sed 's/^/   /'
+}
+
+total() {
+    local field=$1
+    echo $(( $(stat_value "${proxy_log}" c2s ${field}) + \
+             $(stat_value "${proxy_log}" s2c ${field}) ))
+}
+
+# --- scenarios ---------------------------------------------------------------
+
+# Transparency baseline: the unimpaired proxy must be invisible.
+run_scenario baseline
+[[ $(total tx) == $(total rx) ]] || fail "baseline proxy dropped or invented datagrams"
+[[ $(stat_value "${proxy_log}" c2s reordered) == 0 && \
+   $(stat_value "${proxy_log}" s2c reordered) == 0 ]] || fail "baseline reordered packets"
+
+# Loss: QUIC retransmission must recover from both-direction datagram loss.
+# The rate is deliberately small (4% c2s / 5% s2c): above the quiche example's
+# 5s idle-timeout handshake stall threshold lies the harsh-loss repro below.
+# We assert proxy drop counters, not quiche's `lost=` counter, because the
+# lost counter does not increment for short flows whose retransmissions
+# deliver before loss detection declares a packet lost. We require >= 1 drop
+# so the assertion is robust to low-packet-count seeds across the soak while
+# still proving impairment fired.
+run_scenario loss --c2s-loss 4 --s2c-loss 5
+(( $(total drop_loss) >= 1 )) || fail "loss scenario dropped no datagrams at all (proxy stats show impairment did not fire)"
+# Informational only: print quiche's own lost counters without asserting them,
+# because they are 0 for short recovered flows per the comment above.
+client_lost=$(rg -o 'lost=[0-9]+' "${client_log}" -N | tail -1 2>/dev/null | sed -E 's/lost=//')
+server_lost=$(rg -o 'lost=[0-9]+' "${server_log}" -N | tail -1 2>/dev/null | sed -E 's/lost=//')
+print "   quiche lost: client=${client_lost:-missing} server=${server_lost:-missing}"
+
+# Duplication: QUIC tolerates duplicate datagrams by design. >= 1 fire across
+# both directions is enough to prove the impairment fired; seed/iteration pairs
+# with very low UDP-packet counts will sometimes suppress the dup decision.
+run_scenario duplication --c2s-dup 10 --s2c-dup 10
+(( $(total dup) >= 1 )) || fail "duplication scenario fired no dups at all (proxy stats show impairment did not fire)"
+
+# Delay, jitter, and reordering: every datagram is held. >= 1 reorder event
+# across either direction proves the reorder impairment fired; both-directions
+# is demonstrable at the stable seed/iteration profile but is not robust to
+# the short flow of a low-traffic seed.
+run_scenario reorder \
+    --c2s-delay 15 --c2s-jitter 25 --c2s-reorder 20 --c2s-reorder-ms 40 \
+    --s2c-delay 15 --s2c-jitter 25 --s2c-reorder 20 --s2c-reorder-ms 40
+(( $(total delayed) > 0 )) || fail "reorder scenario delayed nothing"
+(( $(total reordered) >= 1 )) || \
+    fail "reorder scenario did not reorder any packets in either direction"
+
+# MTU filter: normal quiche datagrams fit the configured 1350-byte ceiling, so
+# the real HTTP/3 exchanges must pass. Afterward, a 1400-byte UDP sentinel is
+# injected and must be rejected. This deterministically verifies MTU policy
+# and accounting; a 1200-byte live-traffic black hole is kept out of the gate
+# because the stock example's fixed 5s idle timeout makes recovery flaky.
+mtu_probe_bytes=1400
+run_scenario mtu-filter --mtu 1350
+mtu_probe_bytes=0
+(( $(total drop_mtu) >= 1 )) || fail "mtu scenario dropped no oversized datagram"
+
+# Combined compound impairments were removed from the gated set because any
+# impairment that drops or delays the 1-RTT flight inside the quiche example's
+# 5s idle window can stall the handshake non-deterministically across OS
+# scheduling jitter; the individual scenarios above already prove each
+# impairment class in isolation. A combined "harsh-loss" reproducer below
+# documents the boundary failure mode (opt-in).
+
+if (( tolerate_stalls == 0 )); then
+    print "HTTP/3 chaos phase passed: all conservative scenarios recovered over QUIC (seed=${seed}, iterations=${iterations})"
+else
+    print "HTTP/3 chaos diagnostic completed (not a recovery gate): iterations=${total_iterations} completed=${total_completed} stalled=${total_stalls}; structural proxy invariants remained gated"
+fi
+
+# --- opt-in harsh-loss reproducer --------------------------------------------
+# Emergency-brake profile that motivated the conservative loss rates above.
+# The stock quiche http3 examples hard-code max_idle_timeout=5000ms; with
+# c2s=8% / s2c=10% two-sided loss on a ~10-datagram loopback handshake,
+# seed=7 reliably stalls an iteration when the proxy drops a handshake-
+# critical flight that the QUIC loss-detection timer cannot recover inside
+# the 5s idle window. This is a quiche-example limitation, NOT a GhostHTTP3
+# framework regression: the proxy is correct (drops are counted, queues are
+# bounded, no peer loss, no leak), and the framework survives.
+#
+# Because the stalling iteration is timing-sensitive (OS scheduling jitter
+# affects when the lossy flight arrives), this reproducer does NOT assert a
+# hard pass/fail. It documents the failure mode and asks only for these
+# invariant policies to hold:
+#   * no proxy queue overflow (drop_full == 0)
+#   * no client address loss (drop_nopeer == 0)
+#   * the proxy and server processes terminate within their max-duration /
+#     client_timeout bounds (no zombie, no leak)
+#   * at least one iteration reaches the 5s idle timeout path (i.e. the
+#     impairment fired at loss rates near the stall threshold)
+if [[ ${harsh} == 1 ]]; then
+    print "== scenario harsh-loss (opt-in reproducer; expected to stall >= 1 iteration)"
+    saved_iterations=${iterations}
+    saved_tolerate=${scenario_tolerate_stall}
+    iterations=3
+    scenario_tolerate_stall=1
+    run_scenario harsh-loss --c2s-loss 8 --s2c-loss 10
+    scenario_tolerate_stall=${saved_tolerate}
+    iterations=${saved_iterations}
+
+    # The mandatory invariants hold even when iterations stall.
+    local dir
+    for dir in c2s s2c; do
+        [[ $(stat_value "${proxy_log}" ${dir} drop_full) == 0 ]] || \
+            fail "harsh-loss proxy queue overflowed (${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} drop_nopeer) == 0 ]] || \
+            fail "harsh-loss proxy lost client address (${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} send_error) == 0 ]] || \
+            fail "harsh-loss proxy failed to forward a datagram (${dir})"
+        [[ $(stat_value "${proxy_log}" ${dir} queued) == 0 ]] || \
+            fail "harsh-loss proxy stopped with queued datagrams (${dir})"
+    done
+    (( $(total drop_loss) >= 1 )) || \
+        fail "harsh-loss reproducer did not actually drop any datagram (impairment did not fire)"
+
+    print "harsh-loss reproducer: ${completed}/3 iterations recovered, ${stalled}/3 stalled"
+    print "harsh-loss reproducer: documented expected behavior (see comment above)"
+fi
diff --git a/macOS/GhostHTTP3/scripts/test-framework.sh b/macOS/GhostHTTP3/scripts/test-framework.sh
new file mode 100755
index 0000000..1e0e285
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/test-framework.sh
@@ -0,0 +1,43 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+framework_dir=${build_dir}/artifacts/GhostHTTP3.framework
+test_binary=${build_dir}/tests/ghost-http3-smoke
+swift_test_binary=${build_dir}/tests/ghost-http3-swift-smoke
+
+if [[ ! -d ${framework_dir} ]]; then
+    print -u2 "error: GhostHTTP3.framework is missing; run build-framework.sh first"
+    exit 1
+fi
+
+mkdir -p "${test_binary:h}"
+
+xcrun clang \
+    -F"${build_dir}/artifacts" \
+    -framework GhostHTTP3 \
+    -Wl,-rpath,@executable_path/../artifacts \
+    "${project_dir}/Tests/smoke.c" \
+    -o "${test_binary}"
+
+"${test_binary}"
+
+xcrun swiftc \
+    -F"${build_dir}/artifacts" \
+    -framework GhostHTTP3 \
+    -Xlinker -rpath \
+    -Xlinker @executable_path/../artifacts \
+    "${project_dir}/Tests/smoke.swift" \
+    -o "${swift_test_binary}"
+
+"${swift_test_binary}"
+
+file "${framework_dir}/GhostHTTP3"
+[[ $(lipo -archs "${framework_dir}/GhostHTTP3") == arm64 ]]
+otool -D "${framework_dir}/GhostHTTP3"
+otool -L "${test_binary}" | \
+    rg -q '@rpath/GhostHTTP3\.framework/Versions/A/GhostHTTP3'
+codesign --verify --strict "${framework_dir}"
diff --git a/macOS/GhostHTTP3/scripts/test-http3.sh b/macOS/GhostHTTP3/scripts/test-http3.sh
new file mode 100755
index 0000000..a57922e
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/test-http3.sh
@@ -0,0 +1,75 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+framework_dir=${build_dir}/artifacts/GhostHTTP3.framework
+examples_dir=${build_dir}/upstream/quiche/quiche/examples
+test_dir=${build_dir}/tests
+port=${GHOST_HTTP3_TEST_PORT:-$((30000 + ($$ % 20000)))}
+
+if [[ ! -f /opt/homebrew/include/ev.h || ! -f /opt/homebrew/include/uthash.h ]]; then
+    print -u2 "error: HTTP/3 integration test requires: brew install libev uthash"
+    exit 1
+fi
+
+mkdir -p "${test_dir}"
+
+common_flags=(
+    -O2
+    -I"${framework_dir}/Headers"
+    -I/opt/homebrew/include
+    -L/opt/homebrew/lib
+    -F"${build_dir}/artifacts"
+    -framework GhostHTTP3
+    -Wl,-rpath,@executable_path/../artifacts
+    -lev
+)
+
+xcrun clang "${common_flags[@]}" \
+    "${examples_dir}/http3-server.c" \
+    -o "${test_dir}/http3-server"
+
+xcrun clang "${common_flags[@]}" \
+    "${examples_dir}/http3-client.c" \
+    -o "${test_dir}/http3-client"
+
+server_log=${test_dir}/http3-server.log
+client_log=${test_dir}/http3-client.log
+
+(
+    cd "${examples_dir}"
+    exec "${test_dir}/http3-server" 127.0.0.1 "${port}"
+) >"${server_log}" 2>&1 &
+server_pid=$!
+
+cleanup() {
+    kill "${server_pid}" >/dev/null 2>&1 || true
+    wait "${server_pid}" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+trap 'cleanup; exit 130' INT
+trap 'cleanup; exit 143' TERM HUP
+
+sleep 0.2
+kill -0 "${server_pid}" 2>/dev/null || {
+    print -u2 "error: HTTP/3 server failed to start on 127.0.0.1:${port}"
+    tail -30 "${server_log}" >&2
+    exit 1
+}
+
+(
+    cd "${examples_dir}"
+    exec "${test_dir}/http3-client" 127.0.0.1 "${port}"
+) >"${client_log}" 2>&1
+
+rg -q "connection established: h3" "${client_log}"
+rg -q "got HTTP header: :status=200" "${client_log}"
+rg -q "got HTTP header: content-length=5" "${client_log}"
+rg -q "^byez" "${client_log}"
+rg -q 'proto=Ok\("h3"\)' "${server_log}"
+
+print "HTTP/3 interoperability passed: GET / -> 200, 5-byte body, ALPN h3"
+rg "connection established: h3|got HTTP header: :status|got HTTP header: content-length|^byez" "${client_log}"
diff --git a/macOS/GhostHTTP3/scripts/test-stress.sh b/macOS/GhostHTTP3/scripts/test-stress.sh
new file mode 100755
index 0000000..dd72514
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/test-stress.sh
@@ -0,0 +1,48 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+framework_dir=${build_dir}/artifacts/GhostHTTP3.framework
+examples_dir=${build_dir}/upstream/quiche/quiche/examples
+test_dir=${build_dir}/tests
+test_binary=${test_dir}/ghost-http3-stress
+
+if [[ ! -d ${framework_dir} ]]; then
+    print -u2 "error: GhostHTTP3.framework is missing; run build-framework.sh first"
+    exit 1
+fi
+
+if [[ ! -f ${examples_dir}/cert.crt || ! -f ${examples_dir}/cert.key ]]; then
+    print -u2 "error: quiche example TLS identity is missing; run build-framework.sh first"
+    exit 1
+fi
+
+mkdir -p "${test_dir}"
+
+sanitize_flags=()
+if [[ ${GHOST_HTTP3_TEST_SANITIZERS:-0} == 1 ]]; then
+    sanitize_flags=(
+        -O1
+        -fno-omit-frame-pointer
+        -fsanitize=address,undefined
+    )
+fi
+
+xcrun clang \
+    -std=c17 \
+    -O2 \
+    -Wall \
+    -Wextra \
+    -Werror \
+    -Wno-unused-parameter \
+    "${sanitize_flags[@]}" \
+    -F"${build_dir}/artifacts" \
+    -framework GhostHTTP3 \
+    -Wl,-rpath,@executable_path/../artifacts \
+    "${project_dir}/Tests/stress.c" \
+    -o "${test_binary}"
+
+"${test_binary}" "${examples_dir}/cert.crt" "${examples_dir}/cert.key"

From f7a94c4acf956e872d9af7f3bc0da87ce9cc63aa Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 16:48:17 -0700
Subject: [PATCH 03/18] Integrate GhostFile with HTTP/3 transport

---
 GHOSTFILE.md                                  |  92 ++++
 Makefile                                      |  45 +-
 .../GhostFile/DeveloperIDExportOptions.plist  |  16 +
 .../GhostFile/DeveloperIDUploadOptions.plist  |  16 +
 macOS/GhostFile/GhostFileApp.swift            |  12 +
 macOS/GhostFile/GhostFileContentView.swift    | 288 ++++++++++
 macOS/GhostFile/GhostFileDiscovery.swift      | 133 +++++
 .../GhostFile/GhostFileHTTP3ShareServer.swift | 505 +++++++++++++++++
 macOS/GhostFile/GhostFileMountManager.swift   | 155 ++++++
 .../GhostFile/GhostFileShareController.swift  |  84 +++
 macOS/GhostFile/GhostFileShareRouter.swift    | 244 +++++++++
 macOS/GhostFile/GhostFileTLSIdentity.swift    |  80 +++
 macOS/GhostFile/Info.plist                    |  32 ++
 macOS/GhostFile/entitlements.plist            |   5 +
 macOS/GhostFileFS/FileSystemExtension.swift   |   9 +
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 383 +++++++++++++
 macOS/GhostFileFS/GhostFileItem.swift         |  27 +
 macOS/GhostFileFS/GhostFileSystem.swift       |  57 ++
 macOS/GhostFileFS/GhostFileVolume.swift       | 295 ++++++++++
 macOS/GhostFileFS/Info.plist                  |  70 +++
 macOS/GhostFileFS/entitlements.plist          |  12 +
 macOS/GhostFileShared/GhostFileHTTP3.swift    | 517 ++++++++++++++++++
 macOS/GhostFileShared/GhostFileProtocol.swift |  96 ++++
 .../GhostFileProtocolTests.swift              | 157 ++++++
 .../GhostFileQUICIntegrationTests.swift       | 136 +++++
 macOS/GhostHTTP3/scripts/ensure-framework.sh  |  27 +
 macOS/project.yml                             | 140 +++++
 scripts/benchmark-ghostfile.py                | 168 ++++++
 scripts/stress-ghostfile.sh                   | 127 +++++
 29 files changed, 3927 insertions(+), 1 deletion(-)
 create mode 100644 GHOSTFILE.md
 create mode 100644 macOS/GhostFile/DeveloperIDExportOptions.plist
 create mode 100644 macOS/GhostFile/DeveloperIDUploadOptions.plist
 create mode 100644 macOS/GhostFile/GhostFileApp.swift
 create mode 100644 macOS/GhostFile/GhostFileContentView.swift
 create mode 100644 macOS/GhostFile/GhostFileDiscovery.swift
 create mode 100644 macOS/GhostFile/GhostFileHTTP3ShareServer.swift
 create mode 100644 macOS/GhostFile/GhostFileMountManager.swift
 create mode 100644 macOS/GhostFile/GhostFileShareController.swift
 create mode 100644 macOS/GhostFile/GhostFileShareRouter.swift
 create mode 100644 macOS/GhostFile/GhostFileTLSIdentity.swift
 create mode 100644 macOS/GhostFile/Info.plist
 create mode 100644 macOS/GhostFile/entitlements.plist
 create mode 100644 macOS/GhostFileFS/FileSystemExtension.swift
 create mode 100644 macOS/GhostFileFS/GhostFileHTTPClient.swift
 create mode 100644 macOS/GhostFileFS/GhostFileItem.swift
 create mode 100644 macOS/GhostFileFS/GhostFileSystem.swift
 create mode 100644 macOS/GhostFileFS/GhostFileVolume.swift
 create mode 100644 macOS/GhostFileFS/Info.plist
 create mode 100644 macOS/GhostFileFS/entitlements.plist
 create mode 100644 macOS/GhostFileShared/GhostFileHTTP3.swift
 create mode 100644 macOS/GhostFileShared/GhostFileProtocol.swift
 create mode 100644 macOS/GhostFileTests/GhostFileProtocolTests.swift
 create mode 100644 macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
 create mode 100755 macOS/GhostHTTP3/scripts/ensure-framework.sh
 create mode 100755 scripts/benchmark-ghostfile.py
 create mode 100755 scripts/stress-ghostfile.sh

diff --git a/GHOSTFILE.md b/GHOSTFILE.md
new file mode 100644
index 0000000..3f21efd
--- /dev/null
+++ b/GHOSTFILE.md
@@ -0,0 +1,92 @@
+# GhostFile
+
+GhostFile is a standalone macOS demo for sharing and mounting folders over a
+local network with FSKit.
+
+One `GhostFile.app` instance shares a selected folder through a versioned,
+read-only HTTP/3 filesystem API and advertises it with Bonjour. Another instance
+discovers that share (or accepts its URL manually) and mounts it through the
+embedded `GhostFileFS.appex` extension.
+
+```text
+GhostFile.app (Share)                 GhostFile.app (Mount)
+        |                                      |
+        +-- _ghostfile._udp via mDNS ----------+
+        |                                      |
+        +-- GhostFile v1 over HTTP/3 ---------->+-- GhostFileFS.appex
+                                                        |
+                                                        +-- native mount
+```
+
+## Build and run
+
+The extension uses the restricted `com.apple.developer.fskit.fsmodule`
+entitlement. Select an Apple Developer team that has this capability before
+running the signed app.
+
+```bash
+make ghostfile DEVELOPMENT_TEAM=YOUR_TEAM_ID
+make run-ghostfile DEVELOPMENT_TEAM=YOUR_TEAM_ID
+```
+
+Use `open -n build/xcode/Build/Products/Debug/GhostFile.app` to launch a second
+instance. Enable **GhostFileFS** under **System Settings > General > Login Items
+& Extensions > File System Extensions** before mounting.
+
+The mounted volume appears under `~/GhostFile Mounts` and can be revealed in
+Finder from the app.
+
+## Protocol
+
+Version 1 exposes bounded, WebDAV-like operations for each share:
+
+- `capabilities`
+- `metadata(path)`
+- `directory(path)`
+- `content(path, offset, length)`
+- `readlink(path)`
+
+The wire protocol uses normal HTTP semantics: `GET` requests, HTTPS pseudo
+headers, bearer authorization, status codes, content lengths, and byte ranges.
+Each request uses an independent bidirectional HTTP/3 stream on one persistent
+QUIC connection. Directory responses contain a stable verifier for FSKit
+pagination, and file reads are limited to 1 MiB per request. Paths are relative
+to the selected share and both lexical traversal and symlink escapes are
+rejected.
+
+GhostHTTP3 embeds Cloudflare's quiche library in a dynamically linked arm64
+framework. Network.framework carries its UDP datagrams, while quiche implements
+the QUIC transport, TLS 1.3 handshake, QPACK, HTTP/3 request/response framing,
+flow control, and multiplexing. Integration tests cover 32 concurrent 64 KiB
+range reads and verify that a two-second paused request doesn't delay an
+independent request on the same connection.
+
+The service is advertised as `_ghostfile._udp` with `transport=http3` and
+`alpn=h3` TXT values. Peers negotiate the standard `h3` ALPN over TLS 1.3 and
+QUIC. The server uses an ephemeral certificate whose DER SHA-256 pin is carried
+in the share URL, so the self-signed local connection is still authenticated.
+
+## Current scope
+
+- Read-only shares and mounts.
+- Local-network discovery with Bonjour/mDNS.
+- Manual URL mounting for environments where multicast discovery is
+  unavailable, including VM-to-host networking.
+- Access keys and the server public-key pin are passed to the extension in the
+  FSKit resource URL for this demo. A production version should move credentials
+  into a shared Keychain access group and persist/pair TLS identities.
+- New directory entries and metadata are fetched from the server. macOS may
+  retain already-read file pages in its unified buffer cache; remount a share to
+  guarantee a fresh snapshot after an existing source file is overwritten.
+
+## Verification
+
+```bash
+make test-ghostfile DEVELOPMENT_TEAM=YOUR_TEAM_ID
+scripts/stress-ghostfile.sh /path/to/mount /path/to/shared/folder
+python3 scripts/benchmark-ghostfile.py \
+  /path/to/shared/folder/large-file /path/to/mount/large-file
+```
+
+The stress script checks parallel reads, checksums, directory enumeration,
+spaces and UTF-8 names, symlinks, and enforcement of the read-only mount.
diff --git a/Makefile b/Makefile
index e9e17c3..a71b4e9 100644
--- a/Makefile
+++ b/Makefile
@@ -38,13 +38,17 @@ PLIST_HELPER  = $(PLIST_GEN_DIR)/GhostVMHelper-Info.plist
 PLIST_TOOLS   = $(PLIST_GEN_DIR)/GhostTools-Info.plist
 PLIST_FSKIT   = $(PLIST_GEN_DIR)/GhostVMFS-Info.plist
 
+# GhostHTTP3 arm64 dynamic framework (built via Rust/quiche)
+GHOSTHTTP3_DIR = macOS/GhostHTTP3
+GHOSTHTTP3_FRAMEWORK = $(GHOSTHTTP3_DIR)/.build/artifacts/GhostHTTP3.framework
+
 BASE_VERSION := $(strip $(shell cat "$(VERSION_FILE)" 2>/dev/null))
 ifeq ($(BASE_VERSION),)
 $(error Missing $(VERSION_FILE). Create it with a version like 1.85.0)
 endif
 BASE_MAJOR_MINOR := $(word 1,$(subst ., ,$(BASE_VERSION))).$(word 2,$(subst ., ,$(BASE_VERSION)))
 
-.PHONY: all cli app clean help run launch generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist
+.PHONY: all cli app clean help run launch ghostfile run-ghostfile test-ghostfile generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist ghosthttp3-framework
 
 all: help
 
@@ -262,6 +266,41 @@ run: debug
 launch: app
 	open "$(BUILD_DIR)/Build/Products/$(XCODE_CONFIG)/$(APP_NAME).app"
 
+# Build the GhostHTTP3 arm64 dynamic framework if not already built.
+ghosthttp3-framework:
+	@"$(GHOSTHTTP3_DIR)/scripts/ensure-framework.sh"
+
+# Build the standalone GhostFile network filesystem demo and its FSKit extension.
+ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
+	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
+		echo "ERROR: DEVELOPMENT_TEAM is required to sign GhostFileFS.appex"; \
+		echo "Set it in .env or run: make ghostfile DEVELOPMENT_TEAM=YOUR_TEAM_ID"; \
+		exit 1; \
+	fi
+	xcodebuild -project $(XCODE_PROJECT) \
+		-scheme GhostFile \
+		-configuration Debug \
+		-derivedDataPath $(BUILD_DIR) \
+		-allowProvisioningUpdates \
+		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \
+		build
+
+run-ghostfile: ghostfile
+	open -n "$(BUILD_DIR)/Build/Products/Debug/GhostFile.app"
+
+test-ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
+	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
+		echo "ERROR: DEVELOPMENT_TEAM is required to sign the GhostFile test host and FSKit extension"; \
+		echo "Set it in .env or run: make test-ghostfile DEVELOPMENT_TEAM=YOUR_TEAM_ID"; \
+		exit 1; \
+	fi
+	xcodebuild test -project $(XCODE_PROJECT) \
+		-scheme GhostFileTests \
+		-destination 'platform=macOS' \
+		-derivedDataPath $(BUILD_DIR) \
+		-allowProvisioningUpdates \
+		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)"
+
 # Run unit tests
 test: $(XCODE_PROJECT)
 	xcodebuild test -project $(XCODE_PROJECT) -scheme GhostVMTests -destination 'platform=macOS'
@@ -955,6 +994,10 @@ help:
 	@echo "  make debug-export - Debug build ad-hoc signed (no Xcode needed on target)"
 	@echo "  make run      - Build and run attached to terminal"
 	@echo "  make launch   - Build and launch detached"
+	@echo "  make ghostfile - Build GhostFile.app and its FSKit extension"
+	@echo "  make ghosthttp3-framework - Build the GhostHTTP3 arm64 dynamic framework"
+	@echo "  make run-ghostfile - Build and launch another GhostFile instance"
+	@echo "  make test-ghostfile - Run GhostFile protocol and server tests"
 	@echo "  make test     - Run unit tests"
 	@echo "  make uitest   - Run UI tests"
 	@echo "  make capture     - Capture raw screenshots from UI tests → build/screenshots/"
diff --git a/macOS/GhostFile/DeveloperIDExportOptions.plist b/macOS/GhostFile/DeveloperIDExportOptions.plist
new file mode 100644
index 0000000..07f49e3
--- /dev/null
+++ b/macOS/GhostFile/DeveloperIDExportOptions.plist
@@ -0,0 +1,16 @@
+
+
+
+
+    destination
+    export
+    method
+    developer-id
+    signingStyle
+    automatic
+    stripSwiftSymbols
+    
+    teamID
+    3FGZQE8AW3
+
+
diff --git a/macOS/GhostFile/DeveloperIDUploadOptions.plist b/macOS/GhostFile/DeveloperIDUploadOptions.plist
new file mode 100644
index 0000000..a9ffa25
--- /dev/null
+++ b/macOS/GhostFile/DeveloperIDUploadOptions.plist
@@ -0,0 +1,16 @@
+
+
+
+
+	destination
+	upload
+	method
+	developer-id
+	signingStyle
+	automatic
+	stripSwiftSymbols
+	
+	teamID
+	3FGZQE8AW3
+
+
diff --git a/macOS/GhostFile/GhostFileApp.swift b/macOS/GhostFile/GhostFileApp.swift
new file mode 100644
index 0000000..303a3e9
--- /dev/null
+++ b/macOS/GhostFile/GhostFileApp.swift
@@ -0,0 +1,12 @@
+import SwiftUI
+
+@main
+struct GhostFileApp: App {
+    var body: some Scene {
+        WindowGroup("GhostFile") {
+            GhostFileContentView()
+                .frame(minWidth: 720, minHeight: 560)
+        }
+        .defaultSize(width: 820, height: 650)
+    }
+}
diff --git a/macOS/GhostFile/GhostFileContentView.swift b/macOS/GhostFile/GhostFileContentView.swift
new file mode 100644
index 0000000..8ddfd61
--- /dev/null
+++ b/macOS/GhostFile/GhostFileContentView.swift
@@ -0,0 +1,288 @@
+import SwiftUI
+
+private enum GhostFileMode: String, CaseIterable, Identifiable {
+    case share = "Share"
+    case mount = "Mount"
+    var id: Self { self }
+}
+
+struct GhostFileContentView: View {
+    @State private var mode: GhostFileMode = .share
+
+    var body: some View {
+        VStack(spacing: 0) {
+            HStack {
+                VStack(alignment: .leading, spacing: 2) {
+                    Text("GhostFile")
+                        .font(.title2.weight(.semibold))
+                    Text("Share and mount folders over your local network")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                Spacer()
+                Picker("Mode", selection: $mode) {
+                    ForEach(GhostFileMode.allCases) { mode in
+                        Text(mode.rawValue).tag(mode)
+                    }
+                }
+                .pickerStyle(.segmented)
+                .frame(width: 230)
+            }
+            .padding()
+
+            Divider()
+
+            switch mode {
+            case .share:
+                GhostFileShareView()
+            case .mount:
+                GhostFileMountView()
+            }
+        }
+    }
+}
+
+private struct GhostFileShareView: View {
+    @StateObject private var controller = GhostFileShareController()
+
+    var body: some View {
+        Group {
+            if let server = controller.server {
+                activeShare(server)
+            } else {
+                shareSetup
+            }
+        }
+        .padding(24)
+    }
+
+    private var shareSetup: some View {
+        Form {
+            Section("Folder") {
+                HStack {
+                    Text(controller.selectedFolder?.path ?? "No folder selected")
+                        .foregroundStyle(controller.selectedFolder == nil ? .secondary : .primary)
+                        .lineLimit(1)
+                        .truncationMode(.middle)
+                    Spacer()
+                    Button("Choose…") { controller.chooseFolder() }
+                }
+            }
+
+            Section("Network Share") {
+                TextField("Share name", text: $controller.shareName)
+                HStack {
+                    TextField("Port", text: $controller.portText)
+                        .frame(width: 100)
+                    Text("Use 0 to select an available port automatically.")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+                HStack {
+                    SecureField("Access key", text: $controller.accessKey)
+                    Button("Regenerate") { controller.regenerateAccessKey() }
+                }
+            }
+
+            Section("Protocol") {
+                LabeledContent("Discovery", value: "Bonjour / mDNS")
+                LabeledContent("Filesystem API", value: "GhostFile v1")
+                LabeledContent("Transport", value: "HTTP/3 · QUIC / UDP · multiplexed")
+                LabeledContent("Access", value: "Read only")
+            }
+
+            if let message = controller.errorMessage {
+                Text(message).foregroundStyle(.red)
+            }
+
+            HStack {
+                Spacer()
+                Button("Start Sharing") { controller.start() }
+                    .buttonStyle(.borderedProminent)
+                    .controlSize(.large)
+            }
+        }
+        .formStyle(.grouped)
+    }
+
+    private func activeShare(_ server: GhostFileShareServer) -> some View {
+        GhostFileActiveShareView(server: server, controller: controller)
+    }
+}
+
+private struct GhostFileActiveShareView: View {
+    @ObservedObject var server: GhostFileShareServer
+    @ObservedObject var controller: GhostFileShareController
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 20) {
+            HStack {
+                VStack(alignment: .leading, spacing: 4) {
+                    Label("Sharing “\(server.shareName)”", systemImage: "network")
+                        .font(.title2.weight(.semibold))
+                    Text(server.rootURL.path)
+                        .foregroundStyle(.secondary)
+                        .lineLimit(1)
+                        .truncationMode(.middle)
+                }
+                Spacer()
+                Label("Online", systemImage: "circle.fill")
+                    .foregroundStyle(.green)
+            }
+
+            GroupBox("Share URL") {
+                HStack {
+                    Text(server.shareURL?.absoluteString ?? "Starting…")
+                        .textSelection(.enabled)
+                    Spacer()
+                    Button("Copy") {
+                        if let value = server.shareURL?.absoluteString { controller.copy(value) }
+                    }
+                }
+                .padding(.vertical, 4)
+            }
+
+            GroupBox("Access Key") {
+                HStack {
+                    Text(controller.accessKey)
+                        .font(.system(.body, design: .monospaced))
+                        .textSelection(.enabled)
+                    Spacer()
+                    Button("Copy") { controller.copy(controller.accessKey) }
+                }
+                .padding(.vertical, 4)
+            }
+
+            Grid(alignment: .leading, horizontalSpacing: 24, verticalSpacing: 10) {
+                GridRow { Text("Bonjour").foregroundStyle(.secondary); Text("\(server.shareName) · _ghostfile._udp") }
+                GridRow { Text("Transport").foregroundStyle(.secondary); Text("HTTP/3 · QUIC / UDP") }
+                GridRow { Text("Access").foregroundStyle(.secondary); Text("Read only") }
+                GridRow { Text("Requests").foregroundStyle(.secondary); Text("\(server.requestCount)") }
+            }
+
+            Spacer()
+            HStack {
+                Spacer()
+                Button("Stop Sharing", role: .destructive) { controller.stop() }
+                    .controlSize(.large)
+            }
+        }
+    }
+}
+
+private struct GhostFileMountView: View {
+    @StateObject private var discovery = GhostFileDiscovery()
+    @StateObject private var mountManager = GhostFileMountManager()
+    @State private var selectedShareID: UUID?
+    @State private var urlText = ""
+    @State private var accessKey = ""
+    @State private var volumeName = "GhostFile Share"
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 18) {
+            HStack {
+                Text("Nearby Shares").font(.headline)
+                Spacer()
+                if discovery.isSearching {
+                    ProgressView().controlSize(.small)
+                    Text("Searching…").font(.caption).foregroundStyle(.secondary)
+                }
+            }
+
+            List(discovery.shares, selection: $selectedShareID) { share in
+                Button {
+                    select(share)
+                } label: {
+                    HStack(spacing: 12) {
+                        Image(systemName: "externaldrive.connected.to.line.below")
+                            .font(.title2)
+                        VStack(alignment: .leading, spacing: 2) {
+                            Text(share.name).fontWeight(.medium)
+                            Text("\(share.host) · \(share.transport) · \(share.readOnly ? "Read only" : "Read & write")")
+                                .font(.caption)
+                                .foregroundStyle(.secondary)
+                        }
+                        Spacer()
+                    }
+                    .contentShape(Rectangle())
+                }
+                .buttonStyle(.plain)
+                .tag(share.id)
+            }
+            .frame(minHeight: 130, maxHeight: 200)
+            .overlay {
+                if discovery.shares.isEmpty {
+                    ContentUnavailableView(
+                        "No Nearby Shares",
+                        systemImage: "network.slash",
+                        description: Text("Start sharing in another GhostFile window, or enter a URL below.")
+                    )
+                }
+            }
+
+            GroupBox("Mount from URL") {
+                Form {
+                    TextField("Share URL", text: $urlText, prompt: Text("ghostfile://mac.local:8049/v1/shares/…"))
+                    SecureField("Access key", text: $accessKey)
+                    TextField("Volume name", text: $volumeName)
+                }
+                .formStyle(.columns)
+                .padding(.vertical, 8)
+            }
+
+            HStack {
+                switch mountManager.extensionEnabled {
+                case true:
+                    Label("FSKit extension enabled", systemImage: "checkmark.circle.fill").foregroundStyle(.green)
+                case false:
+                    Label("FSKit extension not enabled", systemImage: "exclamationmark.triangle.fill").foregroundStyle(.orange)
+                    Button("Open Settings…") { mountManager.openExtensionSettings() }
+                case nil:
+                    ProgressView().controlSize(.small)
+                    Text("Checking FSKit extension…").foregroundStyle(.secondary)
+                }
+                Spacer()
+                Button("Mount") {
+                    guard let url = URL(string: urlText) else {
+                        mountManager.errorMessage = "Enter a valid share URL."
+                        return
+                    }
+                    Task { await mountManager.mount(url: url, accessKey: accessKey, volumeName: volumeName) }
+                }
+                .buttonStyle(.borderedProminent)
+                .disabled(mountManager.isWorking || mountManager.extensionEnabled != true)
+            }
+
+            if !mountManager.mountedShares.isEmpty {
+                Divider()
+                Text("Mounted").font(.headline)
+                ForEach(mountManager.mountedShares) { mountedShare in
+                    HStack {
+                        VStack(alignment: .leading) {
+                            Text(mountedShare.name).fontWeight(.medium)
+                            Text(mountedShare.mountPoint.path).font(.caption).foregroundStyle(.secondary)
+                        }
+                        Spacer()
+                        Button("Reveal") { mountManager.reveal(mountedShare) }
+                        Button("Unmount") { Task { await mountManager.unmount(mountedShare) } }
+                    }
+                }
+            }
+
+            if let message = mountManager.errorMessage {
+                Text(message).foregroundStyle(.red).font(.callout)
+            }
+        }
+        .padding(24)
+        .task {
+            discovery.start()
+            await mountManager.refreshExtensionStatus()
+        }
+    }
+
+    private func select(_ share: DiscoveredGhostFileShare) {
+        selectedShareID = share.id
+        urlText = share.url?.absoluteString ?? ""
+        volumeName = share.name
+    }
+}
diff --git a/macOS/GhostFile/GhostFileDiscovery.swift b/macOS/GhostFile/GhostFileDiscovery.swift
new file mode 100644
index 0000000..028b41b
--- /dev/null
+++ b/macOS/GhostFile/GhostFileDiscovery.swift
@@ -0,0 +1,133 @@
+import Foundation
+
+struct DiscoveredGhostFileShare: Identifiable, Equatable {
+    let id: UUID
+    let name: String
+    let host: String
+    let port: Int
+    let readOnly: Bool
+    let transport: String
+    let publicKeyPin: String
+
+    var url: URL? {
+        var components = URLComponents()
+        components.scheme = GhostFileProtocol.urlScheme
+        components.host = host
+        components.port = port
+        components.path = GhostFileProtocol.shareBasePath(id: id)
+        components.queryItems = [URLQueryItem(name: "tls_pin", value: publicKeyPin)]
+        return components.url
+    }
+}
+
+@MainActor
+final class GhostFileDiscovery: NSObject, ObservableObject {
+    @Published private(set) var shares: [DiscoveredGhostFileShare] = []
+    @Published private(set) var isSearching = false
+
+    private let browser = NetServiceBrowser()
+    private var services: [ObjectIdentifier: NetService] = [:]
+    private var shareIDsByService: [ObjectIdentifier: UUID] = [:]
+
+    override init() {
+        super.init()
+        browser.delegate = self
+        browser.includesPeerToPeer = true
+    }
+
+    func start() {
+        guard !isSearching else { return }
+        isSearching = true
+        browser.searchForServices(
+            ofType: GhostFileProtocol.bonjourType,
+            inDomain: GhostFileProtocol.bonjourDomain
+        )
+    }
+
+    func stop() {
+        browser.stop()
+        for service in services.values {
+            service.stop()
+        }
+        services.removeAll()
+        shareIDsByService.removeAll()
+        shares.removeAll()
+        isSearching = false
+    }
+
+    private func resolved(_ service: NetService) {
+        guard let hostName = service.hostName,
+              let txtData = service.txtRecordData() else { return }
+        let txt = NetService.dictionary(fromTXTRecord: txtData)
+        guard let idData = txt["id"],
+              let idString = String(data: idData, encoding: .utf8),
+              let id = UUID(uuidString: idString) else { return }
+
+        let mode = txt["mode"].flatMap { String(data: $0, encoding: .utf8) } ?? "ro"
+        let transport = txt["transport"].flatMap { String(data: $0, encoding: .utf8) } ?? GhostFileProtocol.transport
+        let alpn = txt["alpn"].flatMap { String(data: $0, encoding: .utf8) } ?? GhostFileProtocol.alpn
+        guard transport == GhostFileProtocol.transport, alpn == GhostFileProtocol.alpn else { return }
+        guard let pinData = txt["tls-pin"],
+              let publicKeyPin = String(data: pinData, encoding: .utf8),
+              !publicKeyPin.isEmpty else { return }
+        let host = hostName.hasSuffix(".") ? String(hostName.dropLast()) : hostName
+        let discovered = DiscoveredGhostFileShare(
+            id: id,
+            name: service.name,
+            host: host,
+            port: service.port,
+            readOnly: mode == "ro",
+            transport: transport,
+            publicKeyPin: publicKeyPin
+        )
+        shareIDsByService[ObjectIdentifier(service)] = id
+        shares.removeAll { $0.id == id }
+        shares.append(discovered)
+        shares.sort { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
+    }
+}
+
+extension GhostFileDiscovery: NetServiceBrowserDelegate, NetServiceDelegate {
+    nonisolated func netServiceBrowser(
+        _ browser: NetServiceBrowser,
+        didFind service: NetService,
+        moreComing: Bool
+    ) {
+        Task { @MainActor in
+            let key = ObjectIdentifier(service)
+            services[key] = service
+            service.delegate = self
+            service.includesPeerToPeer = true
+            service.resolve(withTimeout: 5)
+        }
+    }
+
+    nonisolated func netServiceBrowser(
+        _ browser: NetServiceBrowser,
+        didRemove service: NetService,
+        moreComing: Bool
+    ) {
+        Task { @MainActor in
+            let key = ObjectIdentifier(service)
+            services.removeValue(forKey: key)
+            if let shareID = shareIDsByService.removeValue(forKey: key) {
+                shares.removeAll { $0.id == shareID }
+            }
+        }
+    }
+
+    nonisolated func netServiceDidResolveAddress(_ sender: NetService) {
+        Task { @MainActor in resolved(sender) }
+    }
+
+    nonisolated func netServiceBrowserDidStopSearch(_ browser: NetServiceBrowser) {
+        Task { @MainActor in isSearching = false }
+    }
+
+    nonisolated func netServiceBrowser(
+        _ browser: NetServiceBrowser,
+        didNotSearch errorDict: [String: NSNumber]
+    ) {
+        Task { @MainActor in isSearching = false }
+    }
+}
diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
new file mode 100644
index 0000000..e74b59d
--- /dev/null
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -0,0 +1,505 @@
+import Foundation
+import GhostHTTP
+import Network
+
+@MainActor
+final class GhostFileShareServer: ObservableObject {
+    typealias RequestDelay = @Sendable (GhostFileHTTPRequest) async -> Void
+
+    @Published private(set) var isRunning = false
+    @Published private(set) var port: UInt16 = 0
+    @Published private(set) var requestCount = 0
+
+    let shareID: UUID
+    let shareName: String
+    let accessKey: String
+    let rootURL: URL
+
+    private let requestDelay: RequestDelay
+    private var publicKeyPin = ""
+    private var listener: NWListener?
+    private var portTask: Task?
+    private var netService: NetService?
+    private var identityDirectory: URL?
+    private var sessions: [UUID: GhostFileHTTP3ServerSession] = [:]
+
+    init(
+        rootURL: URL,
+        shareName: String,
+        accessKey: String,
+        shareID: UUID = UUID(),
+        requestDelay: @escaping RequestDelay = { _ in }
+    ) {
+        self.rootURL = rootURL
+        self.shareName = shareName
+        self.accessKey = accessKey
+        self.shareID = shareID
+        self.requestDelay = requestDelay
+    }
+
+    var shareURL: URL? {
+        guard port != 0 else { return nil }
+        var host = ProcessInfo.processInfo.hostName
+        if !host.hasSuffix(".local") { host += ".local" }
+        var components = URLComponents()
+        components.scheme = GhostFileProtocol.urlScheme
+        components.host = host
+        components.port = Int(port)
+        components.path = GhostFileProtocol.shareBasePath(id: shareID)
+        components.queryItems = [URLQueryItem(name: "tls_pin", value: publicKeyPin)]
+        return components.url
+    }
+
+    func start(preferredPort: UInt16 = 0) throws {
+        guard listener == nil else { return }
+        let router = GhostFileShareRouter(
+            rootURL: rootURL,
+            shareID: shareID,
+            shareName: shareName,
+            accessKey: accessKey
+        )
+        let identity = try GhostFileTLSIdentity.make()
+        publicKeyPin = identity.publicKeyPin
+        let identityFiles = try Self.writeIdentityFiles(identity)
+
+        let txt: [String: String] = [
+            "version": String(GhostFileProtocol.version),
+            "id": shareID.uuidString.lowercased(),
+            "mode": "ro",
+            "transport": GhostFileProtocol.transport,
+            "alpn": GhostFileProtocol.alpn,
+            "auth": "access-key",
+            "tls-pin": publicKeyPin,
+        ]
+        let parameters = NWParameters.udp
+        parameters.allowLocalEndpointReuse = true
+        parameters.includePeerToPeer = true
+        let requestedPort = NWEndpoint.Port(rawValue: preferredPort) ?? .any
+
+        do {
+            let listener = try NWListener(using: parameters, on: requestedPort)
+            listener.stateUpdateHandler = { [weak self] state in
+                Task { @MainActor in self?.listenerStateChanged(state) }
+            }
+            listener.newConnectionHandler = { [weak self] connection in
+                Task { @MainActor in
+                    self?.accept(
+                        connection,
+                        router: router,
+                        certificatePath: identityFiles.certificate.path,
+                        privateKeyPath: identityFiles.privateKey.path
+                    )
+                }
+            }
+            self.identityDirectory = identityFiles.directory
+            self.listener = listener
+            listener.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.listener"))
+            port = listener.port?.rawValue ?? 0
+            isRunning = port != 0
+            portTask = Task { [weak self, weak listener] in
+                for _ in 0..<500 {
+                    guard let self, let listener else { return }
+                    if let boundPort = listener.port?.rawValue {
+                        self.port = boundPort
+                        self.isRunning = true
+                        self.publishBonjour(port: boundPort, values: txt)
+                        return
+                    }
+                    try? await Task.sleep(for: .milliseconds(10))
+                }
+            }
+        } catch {
+            try? FileManager.default.removeItem(at: identityFiles.directory)
+            throw error
+        }
+    }
+
+    func stop() {
+        listener?.cancel()
+        listener = nil
+        netService?.stop()
+        netService = nil
+        portTask?.cancel()
+        portTask = nil
+        for session in sessions.values { session.stop() }
+        sessions.removeAll()
+        if let identityDirectory { try? FileManager.default.removeItem(at: identityDirectory) }
+        identityDirectory = nil
+        port = 0
+        isRunning = false
+    }
+
+    private func accept(
+        _ connection: NWConnection,
+        router: GhostFileShareRouter,
+        certificatePath: String,
+        privateKeyPath: String
+    ) {
+        let id = UUID()
+        do {
+            let session = try GhostFileHTTP3ServerSession(
+                connection: connection,
+                certificatePath: certificatePath,
+                privateKeyPath: privateKeyPath,
+                router: router,
+                requestDelay: requestDelay,
+                requestCompleted: { [weak self] in
+                    Task { @MainActor in self?.requestCount += 1 }
+                },
+                stopped: { [weak self] in
+                    Task { @MainActor in self?.sessions.removeValue(forKey: id) }
+                }
+            )
+            sessions[id] = session
+            session.start()
+        } catch {
+            NSLog("GhostFile HTTP/3 session setup failed: %@", String(describing: error))
+            connection.cancel()
+        }
+    }
+
+    private func listenerStateChanged(_ state: NWListener.State) {
+        switch state {
+        case .ready:
+            port = listener?.port?.rawValue ?? 0
+            isRunning = port != 0
+            if port != 0 {
+                publishBonjour(port: port, values: [
+                    "version": String(GhostFileProtocol.version),
+                    "id": shareID.uuidString.lowercased(),
+                    "mode": "ro",
+                    "transport": GhostFileProtocol.transport,
+                    "alpn": GhostFileProtocol.alpn,
+                    "auth": "access-key",
+                    "tls-pin": publicKeyPin,
+                ])
+            }
+        case .failed(let error):
+#if DEBUG
+            print("GhostFile HTTP/3 listener failed: \(error)")
+#endif
+            stop()
+        case .cancelled:
+            port = 0
+            isRunning = false
+        case .waiting(let error):
+#if DEBUG
+            print("GhostFile HTTP/3 listener waiting: \(error)")
+#endif
+        case .setup:
+            break
+        @unknown default:
+            break
+        }
+    }
+
+    private func publishBonjour(port: UInt16, values: [String: String]) {
+        guard netService == nil else { return }
+        let service = NetService(
+            domain: GhostFileProtocol.bonjourDomain,
+            type: GhostFileProtocol.bonjourType,
+            name: shareName,
+            port: Int32(port)
+        )
+        service.includesPeerToPeer = true
+        let dataValues = values.mapValues { Data($0.utf8) }
+        service.setTXTRecord(NetService.data(fromTXTRecord: dataValues))
+        netService = service
+        service.publish()
+    }
+
+    private static func writeIdentityFiles(
+        _ identity: GhostFileTLSIdentity
+    ) throws -> (directory: URL, certificate: URL, privateKey: URL) {
+        let directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent("GhostFileHTTP3-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(
+            at: directory,
+            withIntermediateDirectories: false,
+            attributes: [.posixPermissions: 0o700]
+        )
+        do {
+            let certificate = directory.appendingPathComponent("certificate.pem")
+            let privateKey = directory.appendingPathComponent("private-key.pem")
+            try Data(identity.certificatePEM.utf8).write(to: certificate, options: .atomic)
+            try Data(identity.privateKeyPEM.utf8).write(to: privateKey, options: .atomic)
+            try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: certificate.path)
+            try FileManager.default.setAttributes([.posixPermissions: 0o600], ofItemAtPath: privateKey.path)
+            return (directory, certificate, privateKey)
+        } catch {
+            try? FileManager.default.removeItem(at: directory)
+            throw error
+        }
+    }
+}
+
+private actor GhostFileHTTP3ServerSession {
+    typealias RequestDelay = GhostFileShareServer.RequestDelay
+
+    private let connection: NWConnection
+    private let http3: GhostFileHTTP3Connection
+    private let router: GhostFileShareRouter
+    private let requestDelay: RequestDelay
+    private let requestCompleted: @Sendable () -> Void
+    private let stopped: @Sendable () -> Void
+    private var receiveTask: Task?
+    private var timeoutTask: Task?
+    private var isFlushing = false
+    private var flushAgain = false
+    private var hasStopped = false
+
+    init(
+        connection: NWConnection,
+        certificatePath: String,
+        privateKeyPath: String,
+        router: GhostFileShareRouter,
+        requestDelay: @escaping RequestDelay,
+        requestCompleted: @escaping @Sendable () -> Void,
+        stopped: @escaping @Sendable () -> Void
+    ) throws {
+        self.connection = connection
+        self.http3 = try GhostFileHTTP3Connection(
+            role: .server(certificatePath: certificatePath, privateKeyPath: privateKeyPath)
+        )
+        self.router = router
+        self.requestDelay = requestDelay
+        self.requestCompleted = requestCompleted
+        self.stopped = stopped
+    }
+
+    nonisolated func start() {
+        Task { await startIsolated() }
+    }
+
+    nonisolated func stop() {
+        Task { await stopIsolated() }
+    }
+
+    private func startIsolated() {
+        connection.stateUpdateHandler = { [weak self] state in
+            if case .failed(let error) = state {
+#if DEBUG
+                print("GhostFile HTTP/3 UDP connection failed: \(error)")
+#endif
+                Task { await self?.stopIsolated() }
+            } else if case .cancelled = state {
+                Task { await self?.stopIsolated() }
+            }
+        }
+        connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.session"))
+        receiveTask = Task { [weak self, connection] in
+            do {
+                while !Task.isCancelled {
+                    let datagram = try await connection.receiveHTTP3Datagram()
+                    await self?.received(datagram)
+                }
+            } catch {
+                await self?.stopIsolated()
+            }
+        }
+    }
+
+    private func received(_ datagram: Data) async {
+        guard !hasStopped else { return }
+        do {
+            try http3.receive(datagram)
+            try processEvents()
+            await flushOutgoing()
+            resetTimeout()
+        } catch {
+            NSLog("GhostFile HTTP/3 datagram failed: %@", String(describing: error))
+            stopIsolated()
+        }
+    }
+
+    private func processEvents() throws {
+        while let event = try http3.pollEvent() {
+            switch event {
+            case .headers(let streamID, let fields, _):
+                guard let request = Self.httpRequest(fields: fields),
+                      let context = Self.requestContext(request) else {
+                    Task { await self.sendBadRequest(streamID: streamID) }
+                    continue
+                }
+                let router = self.router
+                let delay = self.requestDelay
+                Task.detached(priority: .userInitiated) { [weak self] in
+                    await delay(context)
+                    let response = router.route(request)
+                    await self?.send(response, streamID: streamID)
+                }
+            case .data(let streamID):
+                _ = try http3.receiveBody(streamID: streamID)
+            case .finished, .reset:
+                break
+            }
+        }
+    }
+
+    private func sendBadRequest(streamID: UInt64) async {
+        let body = Data("Malformed HTTP/3 request".utf8)
+        do {
+            try http3.sendResponse(
+                streamID: streamID,
+                headers: [(":status", "400"), ("content-length", String(body.count))],
+                body: body
+            )
+            await flushOutgoing()
+        } catch { stopIsolated() }
+    }
+
+    private func send(_ response: HTTPResponse, streamID: UInt64) async {
+        guard !hasStopped else { return }
+        do {
+            let body = try Self.responseBodyData(response.body)
+            var headers: [(String, String)] = [
+                (":status", String(response.status.rawValue)),
+                ("content-length", String(body.count)),
+            ]
+            headers.append(contentsOf: response.headers.all.compactMap { entry in
+                let name = entry.name.lowercased()
+                guard name != "content-length", !name.hasPrefix(":") else { return nil }
+                return (name, entry.value)
+            })
+            try http3.sendResponse(streamID: streamID, headers: headers, body: body)
+            requestCompleted()
+            await flushOutgoing()
+        } catch {
+            NSLog("GhostFile HTTP/3 response failed: %@", String(describing: error))
+            stopIsolated()
+        }
+    }
+
+    private func flushOutgoing() async {
+        if isFlushing {
+            flushAgain = true
+            return
+        }
+        guard !hasStopped else { return }
+        isFlushing = true
+        defer { isFlushing = false }
+        do {
+            repeat {
+                flushAgain = false
+                while let datagram = try http3.nextDatagram() {
+                    try await connection.sendHTTP3Datagram(datagram)
+                }
+            } while flushAgain
+            resetTimeout()
+        } catch {
+            NSLog("GhostFile HTTP/3 UDP send failed: %@", String(describing: error))
+            stopIsolated()
+        }
+    }
+
+    private func resetTimeout() {
+        timeoutTask?.cancel()
+        guard let nanoseconds = http3.timeoutNanoseconds else { return }
+        timeoutTask = Task { [weak self] in
+            do {
+                try await Task.sleep(nanoseconds: max(1_000_000, nanoseconds))
+                guard !Task.isCancelled else { return }
+                await self?.timeoutFired()
+            } catch {}
+        }
+    }
+
+    private func timeoutFired() async {
+        http3.handleTimeout()
+        await flushOutgoing()
+        if http3.isClosed { stopIsolated() }
+    }
+
+    private func stopIsolated() {
+        guard !hasStopped else { return }
+        hasStopped = true
+        receiveTask?.cancel()
+        timeoutTask?.cancel()
+        connection.cancel()
+        stopped()
+    }
+
+    private nonisolated static func httpRequest(fields: [(String, String)]) -> HTTPRequestHead? {
+        guard let methodValue = fields.first(where: { $0.0 == ":method" })?.1,
+              let method = HTTPMethod(rawValue: methodValue),
+              let path = fields.first(where: { $0.0 == ":path" })?.1,
+              fields.first(where: { $0.0 == ":scheme" })?.1 == "https" else {
+            return nil
+        }
+        let headers = HTTPHeaders(fields.compactMap { name, value in
+            guard !name.hasPrefix(":") else { return nil }
+            return HTTPHeaders.Entry(name: name, value: value)
+        })
+        return HTTPRequestHead(method: method, path: path, headers: headers)
+    }
+
+    private nonisolated static func requestContext(_ request: HTTPRequestHead) -> GhostFileHTTPRequest? {
+        guard let components = URLComponents(string: "https://ghostfile.local\(request.path)") else { return nil }
+        let operation = components.path.split(separator: "/").last.map(String.init) ?? ""
+        let path = components.queryItems?.first(where: { $0.name == "path" })?.value
+        var offset: UInt64?
+        var length: Int?
+        if let range = request.header("range"), range.hasPrefix("bytes=") {
+            let pieces = range.dropFirst(6).split(separator: "-", maxSplits: 1)
+            if pieces.count == 2, let start = UInt64(pieces[0]), let end = UInt64(pieces[1]), end >= start {
+                offset = start
+                length = Int(end - start + 1)
+            }
+        }
+        return GhostFileHTTPRequest(operation: operation, path: path, offset: offset, length: length)
+    }
+
+    private nonisolated static func responseBodyData(_ body: HTTPResponseBody) throws -> Data {
+        switch body {
+        case .empty:
+            return Data()
+        case .bytes(let data):
+            return data
+        case .stream(let expectedLength, let producer):
+            let writer = GhostFileHTTP3BufferedWriter(capacity: expectedLength)
+            try producer(writer)
+            guard writer.data.count == expectedLength else { throw GhostFileHTTP3ServerError.incompleteBody }
+            return writer.data
+        }
+    }
+}
+
+private final class GhostFileHTTP3BufferedWriter: HTTPBodyWriter {
+    private(set) var data: Data
+
+    init(capacity: Int) {
+        data = Data()
+        data.reserveCapacity(capacity)
+    }
+
+    func write(_ data: Data) throws { self.data.append(data) }
+    func write(_ buffer: UnsafeRawBufferPointer) throws {
+        data.append(buffer.bindMemory(to: UInt8.self))
+    }
+}
+
+private enum GhostFileHTTP3ServerError: Error {
+    case incompleteBody
+    case closed
+}
+
+private extension NWConnection {
+    func sendHTTP3Datagram(_ data: Data) async throws {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation) in
+            send(content: data, completion: .contentProcessed { error in
+                if let error { continuation.resume(throwing: error) }
+                else { continuation.resume() }
+            })
+        }
+    }
+
+    func receiveHTTP3Datagram() async throws -> Data {
+        try await withCheckedThrowingContinuation { continuation in
+            receiveMessage { content, _, _, error in
+                if let error { continuation.resume(throwing: error) }
+                else if let content { continuation.resume(returning: content) }
+                else { continuation.resume(throwing: GhostFileHTTP3ServerError.closed) }
+            }
+        }
+    }
+}
diff --git a/macOS/GhostFile/GhostFileMountManager.swift b/macOS/GhostFile/GhostFileMountManager.swift
new file mode 100644
index 0000000..9d06937
--- /dev/null
+++ b/macOS/GhostFile/GhostFileMountManager.swift
@@ -0,0 +1,155 @@
+import AppKit
+import Foundation
+import FSKit
+
+struct MountedGhostFileShare: Identifiable, Equatable {
+    let id: UUID
+    let name: String
+    let sourceURL: URL
+    let mountPoint: URL
+}
+
+@MainActor
+final class GhostFileMountManager: ObservableObject {
+    @Published private(set) var mountedShares: [MountedGhostFileShare] = []
+    @Published private(set) var extensionEnabled: Bool?
+    @Published var errorMessage: String?
+    @Published private(set) var isWorking = false
+
+    func refreshExtensionStatus() async {
+        do {
+            let modules = try await FSClient.shared.installedExtensions
+            extensionEnabled = modules.contains {
+                $0.bundleIdentifier == "org.ghostvm.ghostfile.fs" && $0.isEnabled
+            }
+        } catch {
+            extensionEnabled = false
+            errorMessage = "Unable to inspect FSKit extensions: \(error.localizedDescription)"
+        }
+    }
+
+    func mount(url: URL, accessKey: String, volumeName: String) async {
+        guard !accessKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            errorMessage = "Enter the share's access key."
+            return
+        }
+        guard url.scheme == GhostFileProtocol.urlScheme else {
+            errorMessage = "GhostFile share URLs must use ghostfile://."
+            return
+        }
+        guard extensionEnabled == true else {
+            errorMessage = "Enable the GhostFile file system extension in System Settings first."
+            return
+        }
+
+        isWorking = true
+        defer { isWorking = false }
+        do {
+            var resourceComponents = URLComponents(url: url, resolvingAgainstBaseURL: false)
+            var queryItems = resourceComponents?.queryItems ?? []
+            queryItems.removeAll { $0.name == "access_key" }
+            queryItems.append(URLQueryItem(name: "access_key", value: accessKey))
+            resourceComponents?.queryItems = queryItems
+            guard let resourceURL = resourceComponents?.url else {
+                throw MountFailure("Invalid share URL")
+            }
+
+            let mountRoot = FileManager.default.homeDirectoryForCurrentUser
+                .appendingPathComponent("GhostFile Mounts", isDirectory: true)
+            try FileManager.default.createDirectory(at: mountRoot, withIntermediateDirectories: true)
+            let safeName = sanitizedVolumeName(volumeName)
+            let mountPoint = uniqueMountPoint(root: mountRoot, name: safeName)
+            try FileManager.default.createDirectory(at: mountPoint, withIntermediateDirectories: false)
+
+            do {
+                try await Task.detached(priority: .userInitiated) {
+                    try Self.run(
+                        executable: "/sbin/mount",
+                        arguments: [
+                            "-F", "-t", "ghostfile",
+                            "-o", "rdonly,nobrowse,nodev,nosuid",
+                            resourceURL.absoluteString,
+                            mountPoint.path,
+                        ]
+                    )
+                }.value
+            } catch {
+                try? FileManager.default.removeItem(at: mountPoint)
+                throw error
+            }
+
+            mountedShares.append(.init(
+                id: UUID(),
+                name: volumeName,
+                sourceURL: url,
+                mountPoint: mountPoint
+            ))
+            errorMessage = nil
+        } catch {
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func unmount(_ mountedShare: MountedGhostFileShare) async {
+        isWorking = true
+        defer { isWorking = false }
+        do {
+            try await Task.detached(priority: .userInitiated) {
+                try Self.run(executable: "/sbin/umount", arguments: [mountedShare.mountPoint.path])
+            }.value
+            try? FileManager.default.removeItem(at: mountedShare.mountPoint)
+            mountedShares.removeAll { $0.id == mountedShare.id }
+            errorMessage = nil
+        } catch {
+            errorMessage = error.localizedDescription
+        }
+    }
+
+    func reveal(_ mountedShare: MountedGhostFileShare) {
+        NSWorkspace.shared.activateFileViewerSelecting([mountedShare.mountPoint])
+    }
+
+    func openExtensionSettings() {
+        guard let url = URL(string: "x-apple.systempreferences:com.apple.LoginItems-Settings.extension") else { return }
+        NSWorkspace.shared.open(url)
+    }
+
+    private func sanitizedVolumeName(_ name: String) -> String {
+        let trimmed = name.trimmingCharacters(in: .whitespacesAndNewlines)
+        let source = trimmed.isEmpty ? "GhostFile Share" : trimmed
+        let sanitized = source.replacingOccurrences(of: "/", with: "-").replacingOccurrences(of: "\0", with: "")
+        return String(sanitized.prefix(80))
+    }
+
+    private func uniqueMountPoint(root: URL, name: String) -> URL {
+        var candidate = root.appendingPathComponent(name, isDirectory: true)
+        var suffix = 2
+        while FileManager.default.fileExists(atPath: candidate.path) {
+            candidate = root.appendingPathComponent("\(name) \(suffix)", isDirectory: true)
+            suffix += 1
+        }
+        return candidate
+    }
+
+    nonisolated private static func run(executable: String, arguments: [String]) throws {
+        let process = Process()
+        let output = Pipe()
+        process.executableURL = URL(fileURLWithPath: executable)
+        process.arguments = arguments
+        process.standardOutput = output
+        process.standardError = output
+        try process.run()
+        let data = output.fileHandleForReading.readDataToEndOfFile()
+        process.waitUntilExit()
+        guard process.terminationStatus == 0 else {
+            let detail = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
+            throw MountFailure(detail?.isEmpty == false ? detail! : "mount exited with status \(process.terminationStatus)")
+        }
+    }
+
+    private struct MountFailure: LocalizedError {
+        let detail: String
+        init(_ detail: String) { self.detail = detail }
+        var errorDescription: String? { detail }
+    }
+}
diff --git a/macOS/GhostFile/GhostFileShareController.swift b/macOS/GhostFile/GhostFileShareController.swift
new file mode 100644
index 0000000..81502ee
--- /dev/null
+++ b/macOS/GhostFile/GhostFileShareController.swift
@@ -0,0 +1,84 @@
+import AppKit
+import Foundation
+
+@MainActor
+final class GhostFileShareController: ObservableObject {
+    @Published var selectedFolder: URL?
+    @Published var shareName = "DemoShare"
+    @Published var portText = "0"
+    @Published var accessKey = UUID().uuidString.lowercased()
+    @Published private(set) var server: GhostFileShareServer?
+    @Published var errorMessage: String?
+
+    private var isAccessingSecurityScopedFolder = false
+
+    func chooseFolder() {
+        let panel = NSOpenPanel()
+        panel.title = "Choose a folder to share"
+        panel.prompt = "Share Folder"
+        panel.canChooseDirectories = true
+        panel.canChooseFiles = false
+        panel.allowsMultipleSelection = false
+        guard panel.runModal() == .OK, let url = panel.url else { return }
+        selectedFolder = url
+        if shareName == "DemoShare" || shareName.isEmpty {
+            shareName = url.lastPathComponent
+        }
+    }
+
+    func start() {
+        guard let selectedFolder else {
+            errorMessage = "Choose a folder to share."
+            return
+        }
+        let trimmedName = shareName.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmedName.isEmpty else {
+            errorMessage = "Enter a share name."
+            return
+        }
+        guard !accessKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            errorMessage = "Enter an access key."
+            return
+        }
+        guard let preferredPort = UInt16(portText) else {
+            errorMessage = "The port must be between 0 and 65535. Use 0 to choose automatically."
+            return
+        }
+
+        isAccessingSecurityScopedFolder = selectedFolder.startAccessingSecurityScopedResource()
+        let newServer = GhostFileShareServer(
+            rootURL: selectedFolder,
+            shareName: trimmedName,
+            accessKey: accessKey
+        )
+        do {
+            try newServer.start(preferredPort: preferredPort)
+            server = newServer
+            errorMessage = nil
+        } catch {
+            if isAccessingSecurityScopedFolder {
+                selectedFolder.stopAccessingSecurityScopedResource()
+                isAccessingSecurityScopedFolder = false
+            }
+            errorMessage = "Unable to start sharing: \(error.localizedDescription)"
+        }
+    }
+
+    func stop() {
+        server?.stop()
+        server = nil
+        if isAccessingSecurityScopedFolder {
+            selectedFolder?.stopAccessingSecurityScopedResource()
+            isAccessingSecurityScopedFolder = false
+        }
+    }
+
+    func regenerateAccessKey() {
+        accessKey = UUID().uuidString.lowercased()
+    }
+
+    func copy(_ value: String) {
+        NSPasteboard.general.clearContents()
+        NSPasteboard.general.setString(value, forType: .string)
+    }
+}
diff --git a/macOS/GhostFile/GhostFileShareRouter.swift b/macOS/GhostFile/GhostFileShareRouter.swift
new file mode 100644
index 0000000..62427d7
--- /dev/null
+++ b/macOS/GhostFile/GhostFileShareRouter.swift
@@ -0,0 +1,244 @@
+import Foundation
+import Darwin
+import GhostHTTP
+
+final class GhostFileShareRouter: @unchecked Sendable {
+    let rootURL: URL
+    let shareID: UUID
+    let shareName: String
+    let accessKey: String
+    private let resolvedRootURL: URL
+
+    init(rootURL: URL, shareID: UUID, shareName: String, accessKey: String) {
+        self.rootURL = rootURL.standardizedFileURL
+        self.shareID = shareID
+        self.shareName = shareName
+        self.accessKey = accessKey
+        self.resolvedRootURL = rootURL.resolvingSymlinksInPath().standardizedFileURL
+    }
+
+    func route(_ request: HTTPRequestHead) -> HTTPResponse {
+        guard request.header("authorization") == "Bearer \(accessKey)" else {
+            return responseError(.unauthorized, "A valid GhostFile access key is required")
+        }
+        guard let components = URLComponents(string: "http://ghostfile.local\(request.path)") else {
+            return responseError(.badRequest, "Malformed request URL")
+        }
+        let basePath = GhostFileProtocol.shareBasePath(id: shareID)
+        guard components.path.hasPrefix(basePath + "/") || components.path == basePath else {
+            return responseError(.notFound, "Share not found")
+        }
+
+        let operation = String(components.path.dropFirst(basePath.count))
+            .trimmingCharacters(in: CharacterSet(charactersIn: "/"))
+        if operation == "capabilities", request.method == .GET || request.method == .OPTIONS {
+            let capabilities = GhostFileCapabilities(
+                protocolVersion: GhostFileProtocol.version,
+                shareID: shareID,
+                name: shareName,
+                readOnly: true,
+                transports: [GhostFileProtocol.transport],
+                maximumReadLength: GhostFileProtocol.maximumReadLength
+            )
+            return json(capabilities, headers: ["Allow": "OPTIONS, GET, HEAD"])
+        }
+
+        let relativePath = components.queryItems?.first(where: { $0.name == "path" })?.value ?? ""
+        guard let url = resolvedURL(
+            relativePath: relativePath,
+            followFinalSymbolicLink: operation != "readlink" && operation != "metadata"
+        ) else {
+            return responseError(.badRequest, "Invalid or escaping relative path")
+        }
+
+        do {
+            switch (request.method, operation) {
+            case (.GET, "metadata"), (.HEAD, "metadata"):
+                let metadata = try fileMetadata(at: url, displayName: relativePath.isEmpty ? shareName : nil)
+                if request.method == .HEAD {
+                    return HTTPResponse(status: .ok, headers: ["ETag": metadata.etag])
+                }
+                return json(metadata, headers: ["ETag": metadata.etag])
+
+            case (.GET, "directory"):
+                let names = try FileManager.default.contentsOfDirectory(atPath: url.path).sorted()
+                let entries = try names.map { name in
+                    try fileMetadata(at: url.appendingPathComponent(name, isDirectory: false))
+                }
+                let listing = GhostFileDirectoryListing(
+                    path: relativePath,
+                    verifier: directoryVerifier(entries),
+                    entries: entries
+                )
+                return json(listing, headers: ["ETag": "\"dir-\(String(listing.verifier, radix: 16))\""])
+
+            case (.GET, "content"):
+                let metadata = try fileMetadata(at: url)
+                guard metadata.type == .file else {
+                    return responseError(.badRequest, "Path is not a regular file")
+                }
+                guard metadata.size > 0 else {
+                    return HTTPResponse(
+                        status: .ok,
+                        headers: ["Accept-Ranges": "bytes", "ETag": metadata.etag],
+                        body: .bytes(Data())
+                    )
+                }
+                guard let byteRange = GhostFileByteRange.parse(
+                    request.header("range"),
+                    fileSize: metadata.size,
+                    maximumLength: GhostFileProtocol.maximumReadLength
+                ) else {
+                    return HTTPResponse(
+                        status: .rangeNotSatisfiable,
+                        headers: ["Content-Range": "bytes */\(metadata.size)"]
+                    )
+                }
+                return fileResponse(url: url, metadata: metadata, byteRange: byteRange)
+
+            case (.GET, "readlink"):
+                var info = stat()
+                guard Darwin.lstat(url.path, &info) == 0 else { throw POSIXError.current() }
+                guard info.st_mode & S_IFMT == S_IFLNK else { throw POSIXError(.EINVAL) }
+                return .text(try FileManager.default.destinationOfSymbolicLink(atPath: url.path))
+
+            default:
+                return responseError(.methodNotAllowed, "Operation not supported")
+            }
+        } catch let error as POSIXError {
+            switch error.code {
+            case .ENOENT: return responseError(.notFound, "Path not found")
+            case .EACCES, .EPERM: return responseError(.forbidden, "Access denied")
+            default: return responseError(.internalServerError, error.localizedDescription)
+            }
+        } catch {
+            return responseError(.internalServerError, error.localizedDescription)
+        }
+    }
+
+    private func resolvedURL(relativePath: String, followFinalSymbolicLink: Bool) -> URL? {
+        guard let pathComponents = GhostFilePath.validatedComponents(relativePath) else { return nil }
+        if pathComponents.isEmpty { return rootURL }
+        let candidate = pathComponents.reduce(rootURL) { url, component in
+            url.appendingPathComponent(component, isDirectory: false)
+        }.standardizedFileURL
+
+        let containmentCandidate = followFinalSymbolicLink
+            ? candidate.resolvingSymlinksInPath().standardizedFileURL
+            : candidate.deletingLastPathComponent().resolvingSymlinksInPath().standardizedFileURL
+        let rootPath = resolvedRootURL.path
+        guard containmentCandidate.path == rootPath || containmentCandidate.path.hasPrefix(rootPath + "/") else {
+            return nil
+        }
+        return candidate
+    }
+
+    private func fileMetadata(at url: URL, displayName: String? = nil) throws -> GhostFileMetadata {
+        var info = stat()
+        guard Darwin.lstat(url.path, &info) == 0 else { throw POSIXError.current() }
+
+        let type: GhostFileNodeType
+        switch info.st_mode & S_IFMT {
+        case S_IFREG: type = .file
+        case S_IFDIR: type = .directory
+        case S_IFLNK: type = .symbolicLink
+        default: type = .other
+        }
+
+        var objectID = UInt64(info.st_ino) ^ (UInt64(info.st_dev) &* 0x9E37_79B9_7F4A_7C15)
+        let relativeIdentity = url.path.hasPrefix(rootURL.path)
+            ? String(url.path.dropFirst(rootURL.path.count))
+            : url.path
+        for byte in relativeIdentity.utf8 {
+            objectID = (objectID ^ UInt64(byte)) &* 0x100_0000_01b3
+        }
+        objectID = max(objectID, 3)
+        let modifiedSeconds = Int64(info.st_mtimespec.tv_sec)
+        let modifiedNanoseconds = Int32(info.st_mtimespec.tv_nsec)
+        let etagValue = objectID
+            ^ UInt64(max(0, info.st_size))
+            ^ UInt64(bitPattern: modifiedSeconds)
+            ^ UInt64(bitPattern: Int64(modifiedNanoseconds))
+
+        return GhostFileMetadata(
+            name: displayName ?? url.lastPathComponent,
+            type: type,
+            size: UInt64(max(0, info.st_size)),
+            mode: UInt32(info.st_mode),
+            uid: info.st_uid,
+            gid: info.st_gid,
+            objectID: objectID,
+            modifiedSeconds: modifiedSeconds,
+            modifiedNanoseconds: modifiedNanoseconds,
+            etag: "\"node-\(String(etagValue, radix: 16))\""
+        )
+    }
+
+    private func directoryVerifier(_ entries: [GhostFileMetadata]) -> UInt64 {
+        var value: UInt64 = 0xcbf2_9ce4_8422_2325
+        for entry in entries {
+            for byte in (entry.name + "\0" + entry.etag).utf8 {
+                value = (value ^ UInt64(byte)) &* 0x100_0000_01b3
+            }
+        }
+        return max(value, 1)
+    }
+
+    private func fileResponse(
+        url: URL,
+        metadata: GhostFileMetadata,
+        byteRange: GhostFileByteRange
+    ) -> HTTPResponse {
+        let end = byteRange.offset + UInt64(byteRange.length) - 1
+        return HTTPResponse(
+            status: .partialContent,
+            headers: [
+                "Content-Type": "application/octet-stream",
+                "Accept-Ranges": "bytes",
+                "Content-Range": "bytes \(byteRange.offset)-\(end)/\(metadata.size)",
+                "ETag": metadata.etag,
+            ],
+            body: .stream(contentLength: byteRange.length) { writer in
+                let handle = try FileHandle(forReadingFrom: url)
+                defer { try? handle.close() }
+                try handle.seek(toOffset: byteRange.offset)
+                var remaining = byteRange.length
+                while remaining > 0 {
+                    let data = try handle.read(upToCount: min(remaining, 64 * 1024)) ?? Data()
+                    guard !data.isEmpty else { throw POSIXError(.EIO) }
+                    try writer.write(data)
+                    remaining -= data.count
+                }
+            }
+        )
+    }
+
+    private func json(_ value: T, headers: [String: String] = [:]) -> HTTPResponse {
+        do {
+            var responseHeaders = headers
+            responseHeaders["Content-Type"] = "application/json"
+            return HTTPResponse(
+                status: .ok,
+                headers: responseHeaders,
+                body: .bytes(try JSONEncoder().encode(value))
+            )
+        } catch {
+            return responseError(.internalServerError, "Failed to encode response")
+        }
+    }
+
+    private func responseError(_ status: HTTPStatus, _ message: String) -> HTTPResponse {
+        let payload = (try? JSONEncoder().encode(GhostFileErrorPayload(error: message))) ?? Data()
+        return HTTPResponse(
+            status: status,
+            headers: ["Content-Type": "application/json"],
+            body: .bytes(payload)
+        )
+    }
+}
+
+private extension POSIXError {
+    static func current() -> POSIXError {
+        POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)
+    }
+}
diff --git a/macOS/GhostFile/GhostFileTLSIdentity.swift b/macOS/GhostFile/GhostFileTLSIdentity.swift
new file mode 100644
index 0000000..cb682d0
--- /dev/null
+++ b/macOS/GhostFile/GhostFileTLSIdentity.swift
@@ -0,0 +1,80 @@
+import Crypto
+import Foundation
+import Security
+import X509
+
+struct GhostFileTLSIdentity {
+    let networkIdentity: sec_identity_t
+    let publicKeyPin: String
+    let certificatePEM: String
+    let privateKeyPEM: String
+
+    static func make() throws -> Self {
+        var keyError: Unmanaged?
+        let keyAttributes: [CFString: Any] = [
+            kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeySizeInBits: 256,
+        ]
+        guard let secKey = SecKeyCreateRandomKey(keyAttributes as CFDictionary, &keyError) else {
+            throw IdentityError.security(keyError?.takeRetainedValue())
+        }
+
+        var exportError: Unmanaged?
+        guard let externalKey = SecKeyCopyExternalRepresentation(secKey, &exportError) as Data? else {
+            throw IdentityError.security(exportError?.takeRetainedValue())
+        }
+        let signingKey = try P256.Signing.PrivateKey(x963Representation: externalKey)
+        let name = try DistinguishedName {
+            OrganizationName("GhostVM")
+            CommonName("GhostFile Local Share")
+        }
+        let certificate = try Certificate(
+            version: .v3,
+            serialNumber: .init(),
+            publicKey: .init(signingKey.publicKey),
+            notValidBefore: Date().addingTimeInterval(-300),
+            notValidAfter: Date().addingTimeInterval(365 * 24 * 60 * 60),
+            issuer: name,
+            subject: name,
+            signatureAlgorithm: .ecdsaWithSHA256,
+            extensions: try Certificate.Extensions {
+                Critical(BasicConstraints.notCertificateAuthority)
+            },
+            issuerPrivateKey: Certificate.PrivateKey(signingKey)
+        )
+        let secCertificate = try SecCertificate.makeWithCertificate(certificate)
+        guard let secIdentity = SecIdentityCreate(nil, secCertificate, secKey),
+              let networkIdentity = sec_identity_create(secIdentity) else {
+            throw IdentityError.couldNotCreateIdentity
+        }
+
+        // GhostHTTP3 exposes quiche's DER leaf certificate directly. Pin that
+        // exact certificate for the lifetime of this ephemeral share.
+        let certificateDER = try certificate.serializeAsPEM().derBytes
+        let digest = SHA256.hash(data: certificateDER)
+        let pin = Data(digest).base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+        return Self(
+            networkIdentity: networkIdentity,
+            publicKeyPin: pin,
+            certificatePEM: try certificate.serializeAsPEM().pemString,
+            privateKeyPEM: try Certificate.PrivateKey(signingKey).serializeAsPEM().pemString
+        )
+    }
+
+    private enum IdentityError: LocalizedError {
+        case security(CFError?)
+        case couldNotCreateIdentity
+
+        var errorDescription: String? {
+            switch self {
+            case .security(let error):
+                return error.map { CFErrorCopyDescription($0) as String } ?? "Unable to create the GhostFile TLS key"
+            case .couldNotCreateIdentity:
+                return "Unable to create the GhostFile TLS identity"
+            }
+        }
+    }
+}
diff --git a/macOS/GhostFile/Info.plist b/macOS/GhostFile/Info.plist
new file mode 100644
index 0000000..b162c1c
--- /dev/null
+++ b/macOS/GhostFile/Info.plist
@@ -0,0 +1,32 @@
+
+
+
+
+	CFBundleDevelopmentRegion
+	$(DEVELOPMENT_LANGUAGE)
+	CFBundleExecutable
+	$(EXECUTABLE_NAME)
+	CFBundleIdentifier
+	$(PRODUCT_BUNDLE_IDENTIFIER)
+	CFBundleInfoDictionaryVersion
+	6.0
+	CFBundleName
+	GhostFile
+	CFBundlePackageType
+	APPL
+	CFBundleShortVersionString
+	1.0
+	CFBundleVersion
+	1
+	LSApplicationCategoryType
+	public.app-category.utilities
+	NSBonjourServices
+	
+		_ghostfile._udp
+	
+	NSLocalNetworkUsageDescription
+	GhostFile discovers, shares, and mounts folders on your local network.
+	NSPrincipalClass
+	NSApplication
+
+
diff --git a/macOS/GhostFile/entitlements.plist b/macOS/GhostFile/entitlements.plist
new file mode 100644
index 0000000..0c67376
--- /dev/null
+++ b/macOS/GhostFile/entitlements.plist
@@ -0,0 +1,5 @@
+
+
+
+
+
diff --git a/macOS/GhostFileFS/FileSystemExtension.swift b/macOS/GhostFileFS/FileSystemExtension.swift
new file mode 100644
index 0000000..cba9ddd
--- /dev/null
+++ b/macOS/GhostFileFS/FileSystemExtension.swift
@@ -0,0 +1,9 @@
+import ExtensionFoundation
+import FSKit
+
+@main
+struct GhostFileSystemExtension: UnaryFileSystemExtension {
+    var fileSystem: GhostFileSystem {
+        GhostFileSystem()
+    }
+}
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
new file mode 100644
index 0000000..ed40e20
--- /dev/null
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -0,0 +1,383 @@
+import CryptoKit
+import Dispatch
+import Foundation
+import FSKit
+import GhostHTTP3
+import Network
+
+struct GhostFileHTTP3Client: Sendable {
+    private let transport: GhostFileHTTP3Transport
+
+    init(resourceURL: URL) throws {
+        guard resourceURL.scheme == GhostFileProtocol.urlScheme,
+              let host = resourceURL.host,
+              let portNumber = resourceURL.port,
+              let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+              let components = URLComponents(url: resourceURL, resolvingAgainstBaseURL: false),
+              let accessKey = components.queryItems?.first(where: { $0.name == "access_key" })?.value,
+              !accessKey.isEmpty,
+              let publicKeyPin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value,
+              !publicKeyPin.isEmpty else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+        transport = try GhostFileHTTP3Transport(
+            host: host,
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: publicKeyPin,
+            resourceBasePath: resourceURL.path
+        )
+    }
+
+    func capabilities() async throws -> GhostFileCapabilities {
+        try await decode(GhostFileCapabilities.self, operation: "capabilities", relativePath: nil)
+    }
+
+    func metadata(path: String) async throws -> GhostFileMetadata {
+        try await decode(GhostFileMetadata.self, operation: "metadata", relativePath: path)
+    }
+
+    func directory(path: String) async throws -> GhostFileDirectoryListing {
+        try await decode(GhostFileDirectoryListing.self, operation: "directory", relativePath: path)
+    }
+
+    func read(path: String, offset: UInt64, length: Int) async throws -> Data {
+        guard length >= 0, length <= GhostFileProtocol.maximumReadLength else {
+            throw fs_errorForPOSIXError(EINVAL)
+        }
+        return try await request(operation: "content", relativePath: path, offset: offset, length: length)
+    }
+
+    func readSymbolicLink(path: String) async throws -> String {
+        let data = try await request(operation: "readlink", relativePath: path)
+        guard let value = String(data: data, encoding: .utf8), !value.contains("\0") else {
+            throw fs_errorForPOSIXError(EIO)
+        }
+        return value
+    }
+
+    private func decode(
+        _ type: T.Type,
+        operation: String,
+        relativePath: String?
+    ) async throws -> T {
+        let data = try await request(operation: operation, relativePath: relativePath)
+        do {
+            return try JSONDecoder().decode(type, from: data)
+        } catch {
+            throw fs_errorForPOSIXError(EIO)
+        }
+    }
+
+    private func request(
+        operation: String,
+        relativePath: String?,
+        offset: UInt64? = nil,
+        length: Int? = nil
+    ) async throws -> Data {
+        let response: GhostFileHTTP3Transport.Response
+        do {
+            response = try await transport.request(
+                operation: operation,
+                relativePath: relativePath,
+                offset: offset,
+                length: length
+            )
+        } catch {
+            NSLog("GhostFile HTTP/3 request failed: %@", String(describing: error))
+            throw fs_errorForPOSIXError(ENOTCONN)
+        }
+        switch response.status {
+        case 200, 206:
+            return response.body
+        case 400, 416:
+            throw fs_errorForPOSIXError(EINVAL)
+        case 401, 403:
+            throw fs_errorForPOSIXError(EACCES)
+        case 404:
+            throw fs_errorForPOSIXError(ENOENT)
+        case 502, 503, 504:
+            throw fs_errorForPOSIXError(ENOTCONN)
+        default:
+            throw fs_errorForPOSIXError(EIO)
+        }
+    }
+}
+
+actor GhostFileHTTP3Transport {
+    struct Response: Sendable {
+        let status: Int
+        let body: Data
+    }
+
+    private let accessKey: String
+    private let host: String
+    private let resourceBasePath: String
+    private let expectedCertificatePin: String
+    private let connection: NWConnection
+    private let http3: GhostFileHTTP3Connection
+    private var receiveTask: Task?
+    private var timeoutTask: Task?
+    private var hasStarted = false
+    private var isNetworkReady = false
+    private var hasValidatedPeer = false
+    private var terminalError: Error?
+    private var readyWaiters: [CheckedContinuation] = []
+    private var handshakeWaiters: [CheckedContinuation] = []
+    private var pending: [UInt64: PendingResponse] = [:]
+    private var isFlushing = false
+    private var flushAgain = false
+
+    init(
+        host: String,
+        port: NWEndpoint.Port,
+        accessKey: String,
+        publicKeyPin: String,
+        resourceBasePath: String = "/"
+    ) throws {
+        self.accessKey = accessKey
+        self.host = host
+        self.resourceBasePath = resourceBasePath
+        self.expectedCertificatePin = publicKeyPin
+        let parameters = NWParameters.udp
+        parameters.includePeerToPeer = true
+        connection = NWConnection(host: NWEndpoint.Host(host), port: port, using: parameters)
+        http3 = try GhostFileHTTP3Connection(role: .client(serverName: host))
+    }
+
+    func request(
+        operation: String,
+        relativePath: String?,
+        offset: UInt64?,
+        length: Int?
+    ) async throws -> Response {
+        try await ensureHTTP3Ready()
+        var components = URLComponents()
+        components.path = operationPath(operation)
+        if let relativePath {
+            components.queryItems = [URLQueryItem(name: "path", value: relativePath)]
+        }
+        let path = components.string ?? components.path
+        var headers: [(String, String)] = [
+            (":method", "GET"),
+            (":scheme", "https"),
+            (":authority", host),
+            (":path", path),
+            ("authorization", "Bearer \(accessKey)"),
+            ("accept", "application/json, application/octet-stream"),
+        ]
+        if let offset, let length, length > 0 {
+            headers.append(("range", "bytes=\(offset)-\(offset + UInt64(length) - 1)"))
+        }
+        let streamID = try http3.sendRequest(headers: headers)
+        return try await withCheckedThrowingContinuation { continuation in
+            pending[streamID] = PendingResponse(continuation: continuation)
+            Task { await self.flushOutgoing() }
+        }
+    }
+
+    private func operationPath(_ operation: String) -> String {
+        // The share UUID is already part of the mount URL path. The server
+        // validates it, so retain it when translating an FSKit operation.
+        // `host` is intentionally not involved in HTTP routing.
+        return resourceBasePath + "/" + operation
+    }
+
+    private func ensureHTTP3Ready() async throws {
+        if let terminalError { throw terminalError }
+        if !hasStarted { start() }
+        if !isNetworkReady {
+            try await withCheckedThrowingContinuation { readyWaiters.append($0) }
+        }
+        if !hasValidatedPeer {
+            try await withCheckedThrowingContinuation { handshakeWaiters.append($0) }
+        }
+    }
+
+    private func start() {
+        guard !hasStarted else { return }
+        hasStarted = true
+        connection.stateUpdateHandler = { [weak self] state in
+            guard let self else { return }
+            Task { await self.connectionStateChanged(state) }
+        }
+        connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.client"))
+        receiveTask = Task { [weak self, connection] in
+            do {
+                while !Task.isCancelled {
+                    let datagram = try await connection.receiveDatagram()
+                    await self?.received(datagram)
+                }
+            } catch {
+                await self?.fail(error)
+            }
+        }
+    }
+
+    private func connectionStateChanged(_ state: NWConnection.State) async {
+        switch state {
+        case .ready:
+            isNetworkReady = true
+            let waiters = readyWaiters
+            readyWaiters.removeAll()
+            waiters.forEach { $0.resume() }
+            await flushOutgoing()
+        case .failed(let error):
+            fail(error)
+        case .cancelled:
+            fail(TransportError.closed)
+        default:
+            break
+        }
+    }
+
+    private func received(_ datagram: Data) async {
+        do {
+            try http3.receive(datagram)
+            if http3.isEstablished && !hasValidatedPeer {
+                guard let certificate = http3.peerCertificateDER(),
+                      Self.pin(for: certificate) == expectedCertificatePin else {
+                    throw TransportError.certificatePinMismatch
+                }
+                hasValidatedPeer = true
+                let waiters = handshakeWaiters
+                handshakeWaiters.removeAll()
+                waiters.forEach { $0.resume() }
+            }
+            try processEvents()
+            await flushOutgoing()
+            resetTimeout()
+        } catch {
+            fail(error)
+        }
+    }
+
+    private func processEvents() throws {
+        while let event = try http3.pollEvent() {
+            switch event {
+            case .headers(let streamID, let fields, _):
+                guard var response = pending[streamID],
+                      let statusValue = fields.first(where: { $0.0 == ":status" })?.1,
+                      let status = Int(statusValue) else {
+                    throw TransportError.invalidResponse
+                }
+                response.status = status
+                pending[streamID] = response
+            case .data(let streamID):
+                guard var response = pending[streamID] else { continue }
+                response.body.append(try http3.receiveBody(streamID: streamID))
+                guard response.body.count <= GhostFileProtocol.maximumReadLength + 1024 * 1024 else {
+                    throw TransportError.invalidResponse
+                }
+                pending[streamID] = response
+            case .finished(let streamID):
+                guard let response = pending.removeValue(forKey: streamID),
+                      let status = response.status else {
+                    throw TransportError.invalidResponse
+                }
+                response.continuation.resume(returning: Response(status: status, body: response.body))
+            case .reset(let streamID):
+                pending.removeValue(forKey: streamID)?.continuation.resume(throwing: TransportError.streamReset)
+            }
+        }
+    }
+
+    private func flushOutgoing() async {
+        if isFlushing {
+            flushAgain = true
+            return
+        }
+        guard isNetworkReady, terminalError == nil else { return }
+        isFlushing = true
+        defer { isFlushing = false }
+        do {
+            repeat {
+                flushAgain = false
+                while let datagram = try http3.nextDatagram() {
+                    try await connection.sendDatagram(datagram)
+                }
+            } while flushAgain
+            resetTimeout()
+        } catch {
+            fail(error)
+        }
+    }
+
+    private func resetTimeout() {
+        timeoutTask?.cancel()
+        guard let nanoseconds = http3.timeoutNanoseconds else { return }
+        timeoutTask = Task { [weak self] in
+            do {
+                try await Task.sleep(nanoseconds: max(1_000_000, nanoseconds))
+                guard !Task.isCancelled else { return }
+                await self?.timeoutFired()
+            } catch {}
+        }
+    }
+
+    private func timeoutFired() async {
+        http3.handleTimeout()
+        await flushOutgoing()
+        if http3.isClosed { fail(TransportError.closed) }
+    }
+
+    private func fail(_ error: Error) {
+        guard terminalError == nil else { return }
+        NSLog("GhostFile HTTP/3 transport failed: %@", String(describing: error))
+        terminalError = error
+        readyWaiters.forEach { $0.resume(throwing: error) }
+        handshakeWaiters.forEach { $0.resume(throwing: error) }
+        readyWaiters.removeAll()
+        handshakeWaiters.removeAll()
+        for response in pending.values { response.continuation.resume(throwing: error) }
+        pending.removeAll()
+        timeoutTask?.cancel()
+        connection.cancel()
+    }
+
+    private nonisolated static func pin(for bytes: Data) -> String {
+        let digest = SHA256.hash(data: bytes)
+        return Data(digest).base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    private struct PendingResponse {
+        let continuation: CheckedContinuation
+        var status: Int?
+        var body = Data()
+    }
+
+    private enum TransportError: Error {
+        case invalidResponse
+        case certificatePinMismatch
+        case streamReset
+        case closed
+    }
+}
+
+private extension NWConnection {
+    func sendDatagram(_ data: Data) async throws {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation) in
+            send(content: data, completion: .contentProcessed { error in
+                if let error { continuation.resume(throwing: error) }
+                else { continuation.resume() }
+            })
+        }
+    }
+
+    func receiveDatagram() async throws -> Data {
+        try await withCheckedThrowingContinuation { continuation in
+            receiveMessage { content, _, _, error in
+                if let error { continuation.resume(throwing: error) }
+                else if let content { continuation.resume(returning: content) }
+                else { continuation.resume(throwing: GhostFileDatagramError.closed) }
+            }
+        }
+    }
+}
+
+private enum GhostFileDatagramError: Error {
+    case closed
+}
diff --git a/macOS/GhostFileFS/GhostFileItem.swift b/macOS/GhostFileFS/GhostFileItem.swift
new file mode 100644
index 0000000..58d75d0
--- /dev/null
+++ b/macOS/GhostFileFS/GhostFileItem.swift
@@ -0,0 +1,27 @@
+import FSKit
+import Foundation
+
+final class GhostFileItem: FSItem {
+    let relativePath: String
+    let parentID: FSItem.Identifier
+    private let lock = NSLock()
+    private var storedMetadata: GhostFileMetadata
+
+    init(relativePath: String, parentID: FSItem.Identifier, metadata: GhostFileMetadata) {
+        self.relativePath = relativePath
+        self.parentID = parentID
+        self.storedMetadata = metadata
+    }
+
+    var metadata: GhostFileMetadata {
+        lock.lock()
+        defer { lock.unlock() }
+        return storedMetadata
+    }
+
+    func update(metadata: GhostFileMetadata) {
+        lock.lock()
+        storedMetadata = metadata
+        lock.unlock()
+    }
+}
diff --git a/macOS/GhostFileFS/GhostFileSystem.swift b/macOS/GhostFileFS/GhostFileSystem.swift
new file mode 100644
index 0000000..282a9de
--- /dev/null
+++ b/macOS/GhostFileFS/GhostFileSystem.swift
@@ -0,0 +1,57 @@
+import Foundation
+import FSKit
+
+final class GhostFileSystem: FSUnaryFileSystem, FSUnaryFileSystemOperations {
+    func probeResource(resource: FSResource) async throws -> FSProbeResult {
+        guard let resource = resource as? FSGenericURLResource,
+              Self.validResourceURL(resource.url),
+              let shareID = Self.shareID(from: resource.url) else {
+            return .notRecognized
+        }
+        return .usable(
+            name: "GhostFile",
+            containerID: FSContainerIdentifier(uuid: shareID)
+        )
+    }
+
+    func loadResource(resource: FSResource, options: FSTaskOptions) async throws -> FSVolume {
+        guard let resource = resource as? FSGenericURLResource,
+              Self.validResourceURL(resource.url),
+              let shareID = Self.shareID(from: resource.url) else {
+            throw fs_errorForPOSIXError(ENOTSUP)
+        }
+        let client = try GhostFileHTTP3Client(resourceURL: resource.url)
+        let capabilities = try await client.capabilities()
+        guard capabilities.protocolVersion == GhostFileProtocol.version,
+              capabilities.shareID == shareID,
+              capabilities.readOnly else {
+            throw fs_errorForPOSIXError(ENOTSUP)
+        }
+        containerStatus = .ready
+        return GhostFileVolume(
+            volumeID: FSVolume.Identifier(uuid: shareID),
+            volumeName: FSFileName(string: capabilities.name),
+            client: client
+        )
+    }
+
+    func unloadResource(resource: FSResource, options: FSTaskOptions) async throws {}
+
+    private static func validResourceURL(_ url: URL) -> Bool {
+        guard url.scheme == GhostFileProtocol.urlScheme,
+              url.host != nil,
+              url.port != nil,
+              let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
+              components.queryItems?.contains(where: { $0.name == "access_key" && !($0.value ?? "").isEmpty }) == true,
+              components.queryItems?.contains(where: { $0.name == "tls_pin" && !($0.value ?? "").isEmpty }) == true else {
+            return false
+        }
+        return shareID(from: url) != nil
+    }
+
+    private static func shareID(from url: URL) -> UUID? {
+        let parts = url.path.split(separator: "/", omittingEmptySubsequences: true)
+        guard parts.count == 3, parts[0] == "v1", parts[1] == "shares" else { return nil }
+        return UUID(uuidString: String(parts[2]))
+    }
+}
diff --git a/macOS/GhostFileFS/GhostFileVolume.swift b/macOS/GhostFileFS/GhostFileVolume.swift
new file mode 100644
index 0000000..27df665
--- /dev/null
+++ b/macOS/GhostFileFS/GhostFileVolume.swift
@@ -0,0 +1,295 @@
+import Foundation
+import FSKit
+
+final class GhostFileVolume: FSVolume, FSVolume.Operations, FSVolume.ReadWriteOperations {
+    private let client: GhostFileHTTP3Client
+    private let itemLock = NSLock()
+    private var items: [UInt64: GhostFileItem] = [:]
+    private var rootItem: GhostFileItem?
+
+    init(volumeID: FSVolume.Identifier, volumeName: FSFileName, client: GhostFileHTTP3Client) {
+        self.client = client
+        super.init(volumeID: volumeID, volumeName: volumeName)
+    }
+
+    var supportedVolumeCapabilities: FSVolume.SupportedCapabilities {
+        let capabilities = FSVolume.SupportedCapabilities()
+        capabilities.supportsPersistentObjectIDs = false
+        capabilities.supports64BitObjectIDs = true
+        capabilities.supports2TBFiles = true
+        capabilities.supportsSymbolicLinks = true
+        capabilities.supportsHardLinks = false
+        capabilities.supportsFastStatFS = true
+        capabilities.doesNotSupportVolumeSizes = true
+        capabilities.caseFormat = .sensitive
+        return capabilities
+    }
+
+    var volumeStatistics: FSStatFSResult {
+        let result = FSStatFSResult(fileSystemTypeName: "ghostfile")
+        result.blockSize = 4096
+        result.ioSize = GhostFileProtocol.maximumReadLength
+        return result
+    }
+
+    var requestedMountOptions: FSVolume.MountOptions = .readOnly
+    var maximumLinkCount: Int { 1 }
+    var maximumNameLength: Int { 255 }
+    var restrictsOwnershipChanges: Bool { true }
+    var truncatesLongNames: Bool { false }
+    var maximumFileSize: UInt64 { UInt64.max }
+
+    func mount(options: FSTaskOptions) async throws {}
+
+    func unmount() async {
+        clearItems()
+    }
+
+    func synchronize(flags: FSSyncFlags) async throws {}
+
+    func activate(options: FSTaskOptions) async throws -> FSItem {
+        let existingRoot = itemLock.withLock { rootItem }
+        if let existingRoot { return existingRoot }
+
+        let metadata = try await client.metadata(path: "")
+        let candidate = GhostFileItem(relativePath: "", parentID: .parentOfRoot, metadata: metadata)
+        return itemLock.withLock {
+            if let rootItem { return rootItem }
+            rootItem = candidate
+            items[FSItem.Identifier.rootDirectory.rawValue] = candidate
+            return candidate
+        }
+    }
+
+    func deactivate(options: FSDeactivateOptions = []) async throws {
+        clearItems()
+    }
+
+    func attributes(_ request: FSItem.GetAttributesRequest, of item: FSItem) async throws -> FSItem.Attributes {
+        let item = try ghostItem(item)
+        let metadata = try await client.metadata(path: item.relativePath)
+        item.update(metadata: metadata)
+        return attributes(for: item)
+    }
+
+    func setAttributes(_ newAttributes: FSItem.SetAttributesRequest, on item: FSItem) async throws -> FSItem.Attributes {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func lookupItem(named name: FSFileName, inDirectory directory: FSItem) async throws -> (FSItem, FSFileName) {
+        let directory = try ghostItem(directory)
+        guard directory.metadata.type == .directory,
+              let nameString = name.string,
+              isValidName(nameString) else {
+            throw fs_errorForPOSIXError(ENOENT)
+        }
+        let path = childPath(nameString, parent: directory.relativePath)
+        let metadata = try await client.metadata(path: path)
+        return (cachedItem(path: path, parent: identifier(for: directory), metadata: metadata), name)
+    }
+
+    func reclaimItem(_ item: FSItem) async throws {
+        guard let item = item as? GhostFileItem, !item.relativePath.isEmpty else { return }
+        let id = identifier(for: item).rawValue
+        itemLock.withLock {
+            if items[id] === item { items.removeValue(forKey: id) }
+        }
+    }
+
+    func readSymbolicLink(_ item: FSItem) async throws -> FSFileName {
+        let item = try ghostItem(item)
+        guard item.metadata.type == .symbolicLink else { throw fs_errorForPOSIXError(EINVAL) }
+        return FSFileName(string: try await client.readSymbolicLink(path: item.relativePath))
+    }
+
+    func createItem(
+        named name: FSFileName,
+        type: FSItem.ItemType,
+        inDirectory directory: FSItem,
+        attributes: FSItem.SetAttributesRequest
+    ) async throws -> (FSItem, FSFileName) {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func createSymbolicLink(
+        named name: FSFileName,
+        inDirectory directory: FSItem,
+        attributes: FSItem.SetAttributesRequest,
+        linkContents contents: FSFileName
+    ) async throws -> (FSItem, FSFileName) {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func createLink(to item: FSItem, named name: FSFileName, inDirectory directory: FSItem) async throws -> FSFileName {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func removeItem(_ item: FSItem, named name: FSFileName, fromDirectory directory: FSItem) async throws {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func renameItem(
+        _ item: FSItem,
+        inDirectory sourceDirectory: FSItem,
+        named sourceName: FSFileName,
+        to destinationName: FSFileName,
+        inDirectory destinationDirectory: FSItem,
+        overItem: FSItem?
+    ) async throws -> FSFileName {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    func enumerateDirectory(
+        _ directory: FSItem,
+        startingAt cookie: FSDirectoryCookie,
+        verifier suppliedVerifier: FSDirectoryVerifier,
+        attributes requestedAttributes: FSItem.GetAttributesRequest?,
+        packer: FSDirectoryEntryPacker
+    ) async throws -> FSDirectoryVerifier {
+        let directory = try ghostItem(directory)
+        let listing = try await client.directory(path: directory.relativePath)
+        let currentVerifier = FSDirectoryVerifier(max(listing.verifier, 1))
+        if suppliedVerifier != .initial && suppliedVerifier != currentVerifier {
+            throw invalidDirectoryCookieError()
+        }
+
+        let entries = listing.entries.filter { isValidName($0.name) }
+        let syntheticEntryCount = requestedAttributes == nil ? 2 : 0
+        let totalEntryCount = syntheticEntryCount + entries.count
+        let start = Int(cookie.rawValue)
+        guard start <= totalEntryCount else { throw invalidDirectoryCookieError() }
+
+        var cursor = start
+        while cursor < totalEntryCount {
+            let packed: Bool
+            if requestedAttributes == nil, cursor < 2 {
+                let isDot = cursor == 0
+                let itemID: FSItem.Identifier
+                if isDot || directory.relativePath.isEmpty {
+                    itemID = identifier(for: directory)
+                } else {
+                    itemID = directory.parentID
+                }
+                packed = packer.packEntry(
+                    name: FSFileName(string: isDot ? "." : ".."),
+                    itemType: .directory,
+                    itemID: itemID,
+                    nextCookie: FSDirectoryCookie(UInt64(cursor + 1)),
+                    attributes: nil
+                )
+            } else {
+                let metadata = entries[cursor - syntheticEntryCount]
+                let path = childPath(metadata.name, parent: directory.relativePath)
+                let child = cachedItem(path: path, parent: identifier(for: directory), metadata: metadata)
+                packed = packer.packEntry(
+                    name: FSFileName(string: metadata.name),
+                    itemType: itemType(metadata.type),
+                    itemID: identifier(for: child),
+                    nextCookie: FSDirectoryCookie(UInt64(cursor + 1)),
+                    attributes: requestedAttributes == nil ? nil : attributes(for: child)
+                )
+            }
+            guard packed else { break }
+            cursor += 1
+        }
+        return currentVerifier
+    }
+
+    func read(
+        from item: FSItem,
+        at offset: off_t,
+        length: Int,
+        into buffer: FSMutableFileDataBuffer
+    ) async throws -> Int {
+        let item = try ghostItem(item)
+        guard offset >= 0, length >= 0 else { throw fs_errorForPOSIXError(EINVAL) }
+        guard item.metadata.type == .file else {
+            throw fs_errorForPOSIXError(item.metadata.type == .directory ? EISDIR : EINVAL)
+        }
+        let requestLength = min(length, GhostFileProtocol.maximumReadLength)
+        if requestLength == 0 { return 0 }
+        let data = try await client.read(path: item.relativePath, offset: UInt64(offset), length: requestLength)
+        return buffer.withUnsafeMutableBytes { destination in
+            let count = min(destination.count, data.count)
+            data.copyBytes(to: destination.bindMemory(to: UInt8.self), count: count)
+            return count
+        }
+    }
+
+    func write(contents: Data, to item: FSItem, at offset: off_t) async throws -> Int {
+        throw fs_errorForPOSIXError(EROFS)
+    }
+
+    private func ghostItem(_ item: FSItem) throws -> GhostFileItem {
+        guard let item = item as? GhostFileItem else { throw fs_errorForPOSIXError(ESTALE) }
+        return item
+    }
+
+    private func cachedItem(path: String, parent: FSItem.Identifier, metadata: GhostFileMetadata) -> GhostFileItem {
+        let id = identifier(for: metadata).rawValue
+        itemLock.lock()
+        defer { itemLock.unlock() }
+        if let existing = items[id] {
+            existing.update(metadata: metadata)
+            return existing
+        }
+        let item = GhostFileItem(relativePath: path, parentID: parent, metadata: metadata)
+        items[id] = item
+        return item
+    }
+
+    private func clearItems() {
+        itemLock.lock()
+        items.removeAll()
+        rootItem = nil
+        itemLock.unlock()
+    }
+
+    private func attributes(for item: GhostFileItem) -> FSItem.Attributes {
+        let metadata = item.metadata
+        let result = FSItem.Attributes()
+        result.type = itemType(metadata.type)
+        result.mode = metadata.mode
+        result.uid = metadata.uid
+        result.gid = metadata.gid
+        result.linkCount = 1
+        result.size = metadata.size
+        result.allocSize = metadata.size
+        result.fileID = identifier(for: item)
+        result.parentID = item.parentID
+        result.modifyTime = timespec(
+            tv_sec: Int(metadata.modifiedSeconds),
+            tv_nsec: Int(metadata.modifiedNanoseconds)
+        )
+        return result
+    }
+
+    private func identifier(for item: GhostFileItem) -> FSItem.Identifier {
+        item.relativePath.isEmpty ? .rootDirectory : identifier(for: item.metadata)
+    }
+
+    private func identifier(for metadata: GhostFileMetadata) -> FSItem.Identifier {
+        FSItem.Identifier(rawValue: max(metadata.objectID, 3)) ?? .invalid
+    }
+
+    private func itemType(_ type: GhostFileNodeType) -> FSItem.ItemType {
+        switch type {
+        case .file: return .file
+        case .directory: return .directory
+        case .symbolicLink: return .symlink
+        case .other: return .unknown
+        }
+    }
+
+    private func childPath(_ child: String, parent: String) -> String {
+        parent.isEmpty ? child : "\(parent)/\(child)"
+    }
+
+    private func isValidName(_ name: String) -> Bool {
+        !name.isEmpty && name != "." && name != ".." && !name.contains("/") && !name.contains("\0")
+    }
+
+    private func invalidDirectoryCookieError() -> Error {
+        NSError(domain: FSKitErrorDomain, code: FSError.Code.invalidDirectoryCookie.rawValue)
+    }
+}
diff --git a/macOS/GhostFileFS/Info.plist b/macOS/GhostFileFS/Info.plist
new file mode 100644
index 0000000..3e06c03
--- /dev/null
+++ b/macOS/GhostFileFS/Info.plist
@@ -0,0 +1,70 @@
+
+
+
+
+	CFBundleDevelopmentRegion
+	$(DEVELOPMENT_LANGUAGE)
+	CFBundleExecutable
+	$(EXECUTABLE_NAME)
+	CFBundleIdentifier
+	$(PRODUCT_BUNDLE_IDENTIFIER)
+	CFBundleInfoDictionaryVersion
+	6.0
+	CFBundleName
+	$(PRODUCT_NAME)
+	CFBundlePackageType
+	XPC!
+	CFBundleShortVersionString
+	1.0
+	CFBundleVersion
+	1
+	EXAppExtensionAttributes
+	
+		EXExtensionPointIdentifier
+		com.apple.fskit.fsmodule
+		FSActivateOptionSyntax
+		
+			shortOptions
+			g:m:o:u:
+		
+		FSCheckOptionSyntax
+		
+			shortOptions
+			nqy
+		
+		FSFormatOptionSyntax
+		
+			shortOptions
+			v
+		
+		FSMediaTypes
+		
+		FSPersonalities
+		
+			GhostFile
+			
+				FSName
+				ghostfile
+				FSfileObjectsAreCaseSensitive
+				
+			
+		
+		FSRequiresSecurityScopedPathURLResources
+		
+		FSShortName
+		ghostfile
+		FSSupportedSchemes
+		
+			ghostfile
+		
+		FSSupportsBlockResources
+		
+		FSSupportsGenericURLResources
+		
+		FSSupportsPathURLs
+		
+		FSSupportsServerURLs
+		
+	
+
+
diff --git a/macOS/GhostFileFS/entitlements.plist b/macOS/GhostFileFS/entitlements.plist
new file mode 100644
index 0000000..93e61a7
--- /dev/null
+++ b/macOS/GhostFileFS/entitlements.plist
@@ -0,0 +1,12 @@
+
+
+
+
+	com.apple.developer.fskit.fsmodule
+	
+	com.apple.security.app-sandbox
+	
+	com.apple.security.network.client
+	
+
+
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
new file mode 100644
index 0000000..b240322
--- /dev/null
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -0,0 +1,517 @@
+import Darwin
+import Foundation
+import GhostHTTP3
+
+final class GhostFileHTTP3Connection: @unchecked Sendable {
+    enum Role {
+        case client(serverName: String)
+        case server(certificatePath: String, privateKeyPath: String)
+    }
+
+    enum Event {
+        case headers(streamID: UInt64, fields: [(String, String)], hasBody: Bool)
+        case data(streamID: UInt64)
+        case finished(streamID: UInt64)
+        case reset(streamID: UInt64)
+    }
+
+    enum ConnectionError: LocalizedError {
+        case configuration(String)
+        case connection(String)
+        case http3(String)
+
+        var errorDescription: String? {
+            switch self {
+            case .configuration(let message), .connection(let message), .http3(let message):
+                return message
+            }
+        }
+    }
+
+    private let role: Role
+    private let quicConfiguration: OpaquePointer
+    private let http3Configuration: OpaquePointer
+    private var quicConnection: OpaquePointer?
+    private var http3Connection: OpaquePointer?
+    private var currentEvent: OpaquePointer?
+    private var pendingResponses: [UInt64: PendingHTTP3Response] = [:]
+    private var localAddress = sockaddr_in()
+    private var peerAddress = sockaddr_in()
+
+    init(role: Role) throws {
+        self.role = role
+        guard let quicConfiguration = quiche_config_new(UInt32(QUICHE_PROTOCOL_VERSION)) else {
+            throw ConnectionError.configuration("Unable to create the QUIC configuration")
+        }
+        self.quicConfiguration = quicConfiguration
+        guard let http3Configuration = quiche_h3_config_new() else {
+            quiche_config_free(quicConfiguration)
+            throw ConnectionError.configuration("Unable to create the HTTP/3 configuration")
+        }
+        self.http3Configuration = http3Configuration
+
+        let alpn = [UInt8](QUICHE_H3_APPLICATION_PROTOCOL.utf8)
+        guard quiche_config_set_application_protos(quicConfiguration, alpn, alpn.count) == 0 else {
+            throw ConnectionError.configuration("Unable to configure the HTTP/3 ALPN")
+        }
+        quiche_config_set_max_idle_timeout(quicConfiguration, 60_000)
+        quiche_config_set_max_recv_udp_payload_size(quicConfiguration, 1_350)
+        quiche_config_set_max_send_udp_payload_size(quicConfiguration, 1_350)
+        quiche_config_set_initial_max_data(quicConfiguration, 64 * 1024 * 1024)
+        quiche_config_set_initial_max_stream_data_bidi_local(quicConfiguration, 2 * 1024 * 1024)
+        quiche_config_set_initial_max_stream_data_bidi_remote(quicConfiguration, 2 * 1024 * 1024)
+        quiche_config_set_initial_max_stream_data_uni(quicConfiguration, 2 * 1024 * 1024)
+        quiche_config_set_initial_max_streams_bidi(quicConfiguration, 256)
+        quiche_config_set_initial_max_streams_uni(quicConfiguration, 16)
+        quiche_config_set_disable_active_migration(quicConfiguration, true)
+        quiche_h3_config_set_qpack_max_table_capacity(http3Configuration, 4_096)
+        quiche_h3_config_set_qpack_blocked_streams(http3Configuration, 100)
+
+        Self.fillAddress(&localAddress, port: 41_000)
+        Self.fillAddress(&peerAddress, port: 41_001)
+
+        switch role {
+        case .client(let serverName):
+            quiche_config_verify_peer(quicConfiguration, false)
+            var sourceID = [UInt8](repeating: 0, count: 16)
+            arc4random_buf(&sourceID, sourceID.count)
+            quicConnection = withAddresses { local, localLength, peer, peerLength in
+                sourceID.withUnsafeBufferPointer { sourceID in
+                    serverName.withCString { serverName in
+                        quiche_connect(
+                            serverName,
+                            sourceID.baseAddress,
+                            sourceID.count,
+                            local,
+                            localLength,
+                            peer,
+                            peerLength,
+                            quicConfiguration
+                        )
+                    }
+                }
+            }
+            guard quicConnection != nil else {
+                throw ConnectionError.connection("Unable to create the client QUIC connection")
+            }
+
+        case .server(let certificatePath, let privateKeyPath):
+            guard quiche_config_load_cert_chain_from_pem_file(quicConfiguration, certificatePath) == 0 else {
+                throw ConnectionError.configuration("Unable to load the GhostFile TLS certificate")
+            }
+            guard quiche_config_load_priv_key_from_pem_file(quicConfiguration, privateKeyPath) == 0 else {
+                throw ConnectionError.configuration("Unable to load the GhostFile TLS private key")
+            }
+            swap(&localAddress, &peerAddress)
+        }
+    }
+
+    deinit {
+        if let currentEvent { quiche_h3_event_free(currentEvent) }
+        if let http3Connection { quiche_h3_conn_free(http3Connection) }
+        if let quicConnection { quiche_conn_free(quicConnection) }
+        quiche_h3_config_free(http3Configuration)
+        quiche_config_free(quicConfiguration)
+    }
+
+    var isEstablished: Bool {
+        guard let quicConnection else { return false }
+        return quiche_conn_is_established(quicConnection)
+    }
+
+    var isClosed: Bool {
+        guard let quicConnection else { return false }
+        return quiche_conn_is_closed(quicConnection)
+    }
+
+    var timeoutNanoseconds: UInt64? {
+        guard let quicConnection else { return nil }
+        let value = quiche_conn_timeout_as_nanos(quicConnection)
+        return value == UInt64.max ? nil : value
+    }
+
+    func handleTimeout() {
+        guard let quicConnection else { return }
+        quiche_conn_on_timeout(quicConnection)
+    }
+
+    func receive(_ datagram: Data) throws {
+        if quicConnection == nil {
+            try acceptInitial(datagram)
+        }
+        guard let quicConnection else {
+            throw ConnectionError.connection("The server did not accept the QUIC connection")
+        }
+        var mutableDatagram = datagram
+        let result = withAddresses { local, localLength, peer, peerLength -> Int in
+            var receiveInfo = quiche_recv_info(
+                from: UnsafeMutablePointer(mutating: peer),
+                from_len: peerLength,
+                to: UnsafeMutablePointer(mutating: local),
+                to_len: localLength
+            )
+            return mutableDatagram.withUnsafeMutableBytes { bytes in
+                Int(quiche_conn_recv(
+                    quicConnection,
+                    bytes.bindMemory(to: UInt8.self).baseAddress,
+                    bytes.count,
+                    &receiveInfo
+                ))
+            }
+        }
+        guard result >= 0 else {
+            throw ConnectionError.connection("QUIC rejected a UDP datagram (\(result))")
+        }
+        try createHTTP3ConnectionIfReady()
+        try pumpResponseBodies()
+    }
+
+    func nextDatagram() throws -> Data? {
+        guard let quicConnection else { return nil }
+        try pumpResponseBodies()
+        var output = Data(count: 65_535)
+        var sendInfo = quiche_send_info()
+        let length = output.withUnsafeMutableBytes { bytes in
+            Int(quiche_conn_send(
+                quicConnection,
+                bytes.bindMemory(to: UInt8.self).baseAddress,
+                bytes.count,
+                &sendInfo
+            ))
+        }
+        if length == Int(QUICHE_ERR_DONE.rawValue) { return nil }
+        guard length > 0 else {
+            throw ConnectionError.connection("QUIC could not produce a UDP datagram (\(length))")
+        }
+        output.count = length
+        return output
+    }
+
+    func peerCertificateDER() -> Data? {
+        guard let quicConnection else { return nil }
+        var pointer: UnsafePointer?
+        var length = 0
+        quiche_conn_peer_cert(quicConnection, &pointer, &length)
+        guard let pointer, length > 0 else { return nil }
+        return Data(bytes: pointer, count: length)
+    }
+
+    func sendRequest(headers: [(String, String)], body: Data = Data()) throws -> UInt64 {
+        try createHTTP3ConnectionIfReady()
+        guard let quicConnection, let http3Connection else {
+            throw ConnectionError.http3("The HTTP/3 handshake is not complete")
+        }
+        let managedHeaders = ManagedHTTP3Headers(headers)
+        let streamID = managedHeaders.withUnsafeHeaders { headers, count in
+            quiche_h3_send_request(http3Connection, quicConnection, headers, count, body.isEmpty)
+        }
+        guard streamID >= 0 else {
+            throw ConnectionError.http3("Unable to open an HTTP/3 request stream (\(streamID))")
+        }
+        if !body.isEmpty {
+            let sent = body.withUnsafeBytes { bytes in
+                quiche_h3_send_body(
+                    http3Connection,
+                    quicConnection,
+                    UInt64(streamID),
+                    bytes.bindMemory(to: UInt8.self).baseAddress,
+                    bytes.count,
+                    true
+                )
+            }
+            guard sent == body.count else {
+                throw ConnectionError.http3("Unable to send the complete HTTP/3 request body")
+            }
+        }
+        return UInt64(streamID)
+    }
+
+    func sendResponse(streamID: UInt64, headers: [(String, String)], body: Data) throws {
+        guard quicConnection != nil, http3Connection != nil else {
+            throw ConnectionError.http3("The HTTP/3 connection is not ready")
+        }
+        pendingResponses[streamID] = PendingHTTP3Response(headers: headers, body: body)
+        try pumpResponses()
+    }
+
+    func pollEvent() throws -> Event? {
+        if let currentEvent {
+            quiche_h3_event_free(currentEvent)
+            self.currentEvent = nil
+        }
+        guard let quicConnection, let http3Connection else { return nil }
+        var event: OpaquePointer?
+        let streamID = quiche_h3_conn_poll(http3Connection, quicConnection, &event)
+        if streamID == Int64(QUICHE_H3_ERR_DONE.rawValue) { return nil }
+        guard streamID >= 0, let event else {
+            throw ConnectionError.http3("Unable to poll HTTP/3 events (\(streamID))")
+        }
+        currentEvent = event
+        switch quiche_h3_event_type(event) {
+        case QUICHE_H3_EVENT_HEADERS:
+            let box = HeaderCollectionBox()
+            let context = Unmanaged.passUnretained(box).toOpaque()
+            guard quiche_h3_event_for_each_header(event, ghostFileHTTP3CollectHeader, context) == 0 else {
+                throw ConnectionError.http3("Received malformed HTTP/3 headers")
+            }
+            return .headers(
+                streamID: UInt64(streamID),
+                fields: box.fields,
+                hasBody: quiche_h3_event_headers_has_more_frames(event)
+            )
+        case QUICHE_H3_EVENT_DATA:
+            return .data(streamID: UInt64(streamID))
+        case QUICHE_H3_EVENT_FINISHED:
+            return .finished(streamID: UInt64(streamID))
+        case QUICHE_H3_EVENT_RESET:
+            return .reset(streamID: UInt64(streamID))
+        default:
+            return nil
+        }
+    }
+
+    func receiveBody(streamID: UInt64) throws -> Data {
+        guard let quicConnection, let http3Connection else { return Data() }
+        var result = Data()
+        var buffer = Data(count: 64 * 1024)
+        while true {
+            let count = buffer.withUnsafeMutableBytes { bytes in
+                Int(quiche_h3_recv_body(
+                    http3Connection,
+                    quicConnection,
+                    streamID,
+                    bytes.bindMemory(to: UInt8.self).baseAddress,
+                    bytes.count
+                ))
+            }
+            if count == Int(QUICHE_H3_ERR_DONE.rawValue) { break }
+            guard count >= 0 else {
+                throw ConnectionError.http3("Unable to receive an HTTP/3 body (\(count))")
+            }
+            result.append(buffer.prefix(count))
+        }
+        return result
+    }
+
+    private func acceptInitial(_ datagram: Data) throws {
+        guard case .server = role else { return }
+        var version: UInt32 = 0
+        var packetType: UInt8 = 0
+        var sourceID = [UInt8](repeating: 0, count: Int(QUICHE_MAX_CONN_ID_LEN))
+        var destinationID = [UInt8](repeating: 0, count: Int(QUICHE_MAX_CONN_ID_LEN))
+        var token = [UInt8](repeating: 0, count: 256)
+        var sourceIDLength = sourceID.count
+        var destinationIDLength = destinationID.count
+        var tokenLength = token.count
+        let parsed = datagram.withUnsafeBytes { datagramBytes in
+            sourceID.withUnsafeMutableBufferPointer { sourceID in
+                destinationID.withUnsafeMutableBufferPointer { destinationID in
+                    token.withUnsafeMutableBufferPointer { token in
+                        quiche_header_info(
+                            datagramBytes.bindMemory(to: UInt8.self).baseAddress,
+                            datagramBytes.count,
+                            16,
+                            &version,
+                            &packetType,
+                            sourceID.baseAddress,
+                            &sourceIDLength,
+                            destinationID.baseAddress,
+                            &destinationIDLength,
+                            token.baseAddress,
+                            &tokenLength
+                        )
+                    }
+                }
+            }
+        }
+        guard parsed == 0, quiche_version_is_supported(version) else {
+            throw ConnectionError.connection("Received an unsupported QUIC Initial packet")
+        }
+        var serverID = [UInt8](repeating: 0, count: 16)
+        arc4random_buf(&serverID, serverID.count)
+        quicConnection = withAddresses { local, localLength, peer, peerLength in
+            serverID.withUnsafeBufferPointer { serverID in
+                destinationID.withUnsafeBufferPointer { destinationID in
+                    quiche_accept(
+                        serverID.baseAddress,
+                        serverID.count,
+                        destinationID.baseAddress,
+                        destinationIDLength,
+                        local,
+                        localLength,
+                        peer,
+                        peerLength,
+                        quicConfiguration
+                    )
+                }
+            }
+        }
+    }
+
+    private func createHTTP3ConnectionIfReady() throws {
+        guard http3Connection == nil,
+              let quicConnection,
+              quiche_conn_is_established(quicConnection) else { return }
+        guard let connection = quiche_h3_conn_new_with_transport(quicConnection, http3Configuration) else {
+            throw ConnectionError.http3("Unable to create the HTTP/3 connection")
+        }
+        http3Connection = connection
+    }
+
+    private func pumpResponseBodies() throws {
+        try pumpResponses()
+    }
+
+    private func pumpResponses() throws {
+        guard let quicConnection, let http3Connection, !pendingResponses.isEmpty else { return }
+        for streamID in Array(pendingResponses.keys) {
+            guard var pending = pendingResponses[streamID] else { continue }
+            if !pending.headersSent {
+                let managedHeaders = ManagedHTTP3Headers(pending.headers)
+                let result = managedHeaders.withUnsafeHeaders { headers, count in
+                    quiche_h3_send_response(
+                        http3Connection,
+                        quicConnection,
+                        streamID,
+                        headers,
+                        count,
+                        pending.body.isEmpty
+                    )
+                }
+                if result == Int32(QUICHE_H3_ERR_STREAM_BLOCKED.rawValue) ||
+                    result == Int32(QUICHE_H3_ERR_DONE.rawValue) {
+                    pendingResponses[streamID] = pending
+                    continue
+                }
+                guard result == 0 else {
+                    throw ConnectionError.http3("Unable to send HTTP/3 response headers (\(result))")
+                }
+                pending.headersSent = true
+                if pending.body.isEmpty {
+                    pendingResponses.removeValue(forKey: streamID)
+                    continue
+                }
+            }
+            while pending.offset < pending.data.count {
+                let offeredLength = min(16 * 1024, pending.data.count - pending.offset)
+                let isFinal = pending.offset + offeredLength == pending.data.count
+                let sent = pending.data.withUnsafeBytes { bytes -> Int in
+                    let base = bytes.bindMemory(to: UInt8.self).baseAddress?.advanced(by: pending.offset)
+                    return Int(quiche_h3_send_body(
+                        http3Connection,
+                        quicConnection,
+                        streamID,
+                        base,
+                        offeredLength,
+                        isFinal
+                    ))
+                }
+                if sent == Int(QUICHE_H3_ERR_DONE.rawValue) ||
+                    sent == Int(QUICHE_H3_ERR_STREAM_BLOCKED.rawValue) { break }
+                guard sent > 0 else {
+                    throw ConnectionError.http3("Unable to send the HTTP/3 response body (\(sent))")
+                }
+                pending.offset += sent
+            }
+            if pending.offset == pending.data.count {
+                pendingResponses.removeValue(forKey: streamID)
+            } else {
+                pendingResponses[streamID] = pending
+            }
+        }
+    }
+
+    private func withAddresses(
+        _ body: (UnsafePointer, socklen_t, UnsafePointer, socklen_t) throws -> T
+    ) rethrows -> T {
+        try withUnsafePointer(to: &localAddress) { local in
+            try withUnsafePointer(to: &peerAddress) { peer in
+                try local.withMemoryRebound(to: sockaddr.self, capacity: 1) { local in
+                    try peer.withMemoryRebound(to: sockaddr.self, capacity: 1) { peer in
+                        try body(local, socklen_t(MemoryLayout.size), peer, socklen_t(MemoryLayout.size))
+                    }
+                }
+            }
+        }
+    }
+
+    private static func fillAddress(_ address: inout sockaddr_in, port: UInt16) {
+        address = sockaddr_in()
+        address.sin_len = UInt8(MemoryLayout.size)
+        address.sin_family = sa_family_t(AF_INET)
+        address.sin_port = port.bigEndian
+        address.sin_addr = in_addr(s_addr: INADDR_LOOPBACK.bigEndian)
+    }
+}
+
+private struct PendingHTTP3Response {
+    let headers: [(String, String)]
+    let body: Data
+    var headersSent = false
+    var offset: Int
+
+    init(headers: [(String, String)], body: Data) {
+        self.headers = headers
+        self.body = body
+        self.offset = 0
+    }
+
+    var data: Data { body }
+}
+
+private final class HeaderCollectionBox {
+    var fields: [(String, String)] = []
+}
+
+private func ghostFileHTTP3CollectHeader(
+    _ name: UnsafeMutablePointer?,
+    _ nameLength: Int,
+    _ value: UnsafeMutablePointer?,
+    _ valueLength: Int,
+    _ context: UnsafeMutableRawPointer?
+) -> Int32 {
+    guard let name, let value, let context,
+          let headerName = String(bytes: UnsafeBufferPointer(start: name, count: nameLength), encoding: .utf8),
+          let headerValue = String(bytes: UnsafeBufferPointer(start: value, count: valueLength), encoding: .utf8) else {
+        return -1
+    }
+    Unmanaged.fromOpaque(context).takeUnretainedValue().fields.append((headerName, headerValue))
+    return 0
+}
+
+private final class ManagedHTTP3Headers {
+    private var names: [UnsafeMutablePointer] = []
+    private var values: [UnsafeMutablePointer] = []
+    private var headers: [quiche_h3_header] = []
+
+    init(_ fields: [(String, String)]) {
+        names.reserveCapacity(fields.count)
+        values.reserveCapacity(fields.count)
+        headers.reserveCapacity(fields.count)
+        for (name, value) in fields {
+            let nameBytes = Array(name.utf8)
+            let valueBytes = Array(value.utf8)
+            let namePointer = UnsafeMutablePointer.allocate(capacity: max(1, nameBytes.count))
+            let valuePointer = UnsafeMutablePointer.allocate(capacity: max(1, valueBytes.count))
+            if !nameBytes.isEmpty { namePointer.initialize(from: nameBytes, count: nameBytes.count) }
+            if !valueBytes.isEmpty { valuePointer.initialize(from: valueBytes, count: valueBytes.count) }
+            names.append(namePointer)
+            values.append(valuePointer)
+            headers.append(quiche_h3_header(
+                name: UnsafePointer(namePointer),
+                name_len: nameBytes.count,
+                value: UnsafePointer(valuePointer),
+                value_len: valueBytes.count
+            ))
+        }
+    }
+
+    deinit {
+        for pointer in names { pointer.deallocate() }
+        for pointer in values { pointer.deallocate() }
+    }
+
+    func withUnsafeHeaders(_ body: (UnsafePointer?, Int) -> T) -> T {
+        headers.withUnsafeBufferPointer { body($0.baseAddress, $0.count) }
+    }
+}
diff --git a/macOS/GhostFileShared/GhostFileProtocol.swift b/macOS/GhostFileShared/GhostFileProtocol.swift
new file mode 100644
index 0000000..e87200f
--- /dev/null
+++ b/macOS/GhostFileShared/GhostFileProtocol.swift
@@ -0,0 +1,96 @@
+import Foundation
+
+enum GhostFileProtocol {
+    static let version = 1
+    static let urlScheme = "ghostfile"
+    static let bonjourType = "_ghostfile._udp."
+    static let bonjourDomain = "local."
+    static let alpn = "h3"
+    static let transport = "http3"
+    static let maximumReadLength = 1024 * 1024
+
+    static func shareBasePath(id: UUID) -> String {
+        "/v1/shares/\(id.uuidString.lowercased())"
+    }
+}
+
+struct GhostFileHTTPRequest: Sendable {
+    let operation: String
+    let path: String?
+    let offset: UInt64?
+    let length: Int?
+}
+
+enum GhostFileNodeType: String, Codable, Sendable {
+    case file
+    case directory
+    case symbolicLink
+    case other
+}
+
+struct GhostFileCapabilities: Codable, Equatable, Sendable {
+    let protocolVersion: Int
+    let shareID: UUID
+    let name: String
+    let readOnly: Bool
+    let transports: [String]
+    let maximumReadLength: Int
+}
+
+struct GhostFileMetadata: Codable, Equatable, Sendable {
+    let name: String
+    let type: GhostFileNodeType
+    let size: UInt64
+    let mode: UInt32
+    let uid: UInt32
+    let gid: UInt32
+    let objectID: UInt64
+    let modifiedSeconds: Int64
+    let modifiedNanoseconds: Int32
+    let etag: String
+}
+
+struct GhostFileDirectoryListing: Codable, Equatable, Sendable {
+    let path: String
+    let verifier: UInt64
+    let entries: [GhostFileMetadata]
+}
+
+struct GhostFileErrorPayload: Codable, Equatable, Sendable {
+    let error: String
+}
+
+enum GhostFilePath {
+    static func validatedComponents(_ relativePath: String) -> [String]? {
+        guard !relativePath.contains("\0"), !relativePath.hasPrefix("/") else { return nil }
+        let components = relativePath.split(separator: "/", omittingEmptySubsequences: true).map(String.init)
+        guard !components.contains(where: { $0 == "." || $0 == ".." }) else { return nil }
+        return components
+    }
+
+    static func percentEncodedQuery(_ value: String) -> String {
+        var components = URLComponents()
+        components.queryItems = [URLQueryItem(name: "path", value: value)]
+        return components.percentEncodedQuery ?? "path="
+    }
+}
+
+struct GhostFileByteRange: Equatable, Sendable {
+    let offset: UInt64
+    let length: Int
+
+    static func parse(_ value: String?, fileSize: UInt64, maximumLength: Int) -> Self? {
+        guard let value, value.lowercased().hasPrefix("bytes=") else { return nil }
+        let raw = value.dropFirst("bytes=".count)
+        let pieces = raw.split(separator: "-", maxSplits: 1, omittingEmptySubsequences: false)
+        guard pieces.count == 2,
+              let start = UInt64(pieces[0]),
+              start < fileSize else { return nil }
+
+        let requestedEnd = pieces[1].isEmpty ? nil : UInt64(pieces[1])
+        guard requestedEnd == nil || requestedEnd! >= start else { return nil }
+        let boundedEnd = min(requestedEnd ?? (start + UInt64(maximumLength) - 1), fileSize - 1)
+        let length = Int(min(UInt64(maximumLength), boundedEnd - start + 1))
+        return Self(offset: start, length: length)
+    }
+}
diff --git a/macOS/GhostFileTests/GhostFileProtocolTests.swift b/macOS/GhostFileTests/GhostFileProtocolTests.swift
new file mode 100644
index 0000000..1819183
--- /dev/null
+++ b/macOS/GhostFileTests/GhostFileProtocolTests.swift
@@ -0,0 +1,157 @@
+import Foundation
+import GhostHTTP
+import XCTest
+@testable import GhostFile
+
+final class GhostFileProtocolTests: XCTestCase {
+    func testRelativePathValidationRejectsEscapes() {
+        XCTAssertEqual(GhostFilePath.validatedComponents("folder/file.txt"), ["folder", "file.txt"])
+        XCTAssertEqual(GhostFilePath.validatedComponents(""), [])
+        XCTAssertNil(GhostFilePath.validatedComponents("../secret"))
+        XCTAssertNil(GhostFilePath.validatedComponents("folder/../secret"))
+        XCTAssertNil(GhostFilePath.validatedComponents("/absolute"))
+        XCTAssertNil(GhostFilePath.validatedComponents("bad\0name"))
+    }
+
+    func testByteRangeIsBoundedToProtocolMaximum() {
+        XCTAssertEqual(
+            GhostFileByteRange.parse("bytes=4-9", fileSize: 20, maximumLength: 1024),
+            .init(offset: 4, length: 6)
+        )
+        XCTAssertEqual(
+            GhostFileByteRange.parse("bytes=10-", fileSize: 100, maximumLength: 8),
+            .init(offset: 10, length: 8)
+        )
+        XCTAssertNil(GhostFileByteRange.parse("bytes=20-30", fileSize: 20, maximumLength: 8))
+        XCTAssertNil(GhostFileByteRange.parse("items=0-1", fileSize: 20, maximumLength: 8))
+    }
+}
+
+final class GhostFileShareRouterTests: XCTestCase {
+    private var directory: URL!
+    private var router: GhostFileShareRouter!
+    private let shareID = UUID(uuidString: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee")!
+    private let accessKey = "demo-access-key"
+
+    override func setUpWithError() throws {
+        directory = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+        try Data("abcdefghij".utf8).write(to: directory.appendingPathComponent("sample.txt"))
+        try FileManager.default.createDirectory(
+            at: directory.appendingPathComponent("folder", isDirectory: true),
+            withIntermediateDirectories: true
+        )
+        router = GhostFileShareRouter(
+            rootURL: directory,
+            shareID: shareID,
+            shareName: "DemoShare",
+            accessKey: accessKey
+        )
+    }
+
+    override func tearDownWithError() throws {
+        try? FileManager.default.removeItem(at: directory)
+    }
+
+    func testCapabilitiesRequireAccessKey() throws {
+        let path = "\(GhostFileProtocol.shareBasePath(id: shareID))/capabilities"
+        let unauthorized = router.route(.init(method: .GET, path: path))
+        XCTAssertEqual(unauthorized.status, .unauthorized)
+
+        let authorized = router.route(request(method: .GET, path: path))
+        XCTAssertEqual(authorized.status, .ok)
+        let capabilities = try JSONDecoder().decode(GhostFileCapabilities.self, from: bodyData(authorized))
+        XCTAssertEqual(capabilities.shareID, shareID)
+        XCTAssertTrue(capabilities.readOnly)
+        XCTAssertEqual(capabilities.transports, [GhostFileProtocol.transport])
+    }
+
+    func testMetadataAndDirectoryListing() throws {
+        let metadataResponse = router.route(request(
+            method: .GET,
+            path: operationPath("metadata", relativePath: "sample.txt")
+        ))
+        XCTAssertEqual(metadataResponse.status, .ok)
+        let metadata = try JSONDecoder().decode(GhostFileMetadata.self, from: bodyData(metadataResponse))
+        XCTAssertEqual(metadata.name, "sample.txt")
+        XCTAssertEqual(metadata.type, .file)
+        XCTAssertEqual(metadata.size, 10)
+
+        let listingResponse = router.route(request(
+            method: .GET,
+            path: operationPath("directory", relativePath: "")
+        ))
+        XCTAssertEqual(listingResponse.status, .ok)
+        let listing = try JSONDecoder().decode(GhostFileDirectoryListing.self, from: bodyData(listingResponse))
+        XCTAssertEqual(listing.entries.map(\.name), ["folder", "sample.txt"])
+        XCTAssertNotEqual(listing.verifier, 0)
+    }
+
+    func testRangeReadStreamsOnlyRequestedBytes() throws {
+        let response = router.route(request(
+            method: .GET,
+            path: operationPath("content", relativePath: "sample.txt"),
+            extraHeaders: ["Range": "bytes=2-5"]
+        ))
+        XCTAssertEqual(response.status, .partialContent)
+        XCTAssertEqual(response.headers["Content-Range"], "bytes 2-5/10")
+        XCTAssertEqual(String(data: try bodyData(response), encoding: .utf8), "cdef")
+    }
+
+    func testTraversalIsRejected() {
+        let response = router.route(request(
+            method: .GET,
+            path: operationPath("metadata", relativePath: "../secret")
+        ))
+        XCTAssertEqual(response.status, .badRequest)
+    }
+
+    private func request(
+        method: HTTPMethod,
+        path: String,
+        extraHeaders: [String: String] = [:]
+    ) -> HTTPRequestHead {
+        var headers = extraHeaders
+        headers["Authorization"] = "Bearer \(accessKey)"
+        return HTTPRequestHead(method: method, path: path, headers: HTTPHeaders(headers))
+    }
+
+    private func operationPath(_ operation: String, relativePath: String) -> String {
+        "\(GhostFileProtocol.shareBasePath(id: shareID))/\(operation)?\(GhostFilePath.percentEncodedQuery(relativePath))"
+    }
+
+    private func bodyData(_ response: HTTPResponse) throws -> Data {
+        switch response.body {
+        case .empty:
+            return Data()
+        case .bytes(let data):
+            return data
+        case .stream(let expectedLength, let producer):
+            let writer = CollectingWriter()
+            try producer(writer)
+            XCTAssertEqual(writer.data.count, expectedLength)
+            return writer.data
+        }
+    }
+}
+
+final class GhostFileTLSIdentityTests: XCTestCase {
+    func testCreatesPinnedEphemeralIdentity() throws {
+        let identity = try GhostFileTLSIdentity.make()
+        XCTAssertFalse(identity.publicKeyPin.isEmpty)
+        XCTAssertFalse(identity.publicKeyPin.contains("="))
+    }
+}
+
+private final class CollectingWriter: HTTPBodyWriter, @unchecked Sendable {
+    private(set) var data = Data()
+
+    func write(_ data: Data) throws {
+        self.data.append(data)
+    }
+
+    func write(_ buffer: UnsafeRawBufferPointer) throws {
+        data.append(buffer.bindMemory(to: UInt8.self))
+    }
+}
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
new file mode 100644
index 0000000..c21bdb6
--- /dev/null
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -0,0 +1,136 @@
+import Foundation
+import Network
+import XCTest
+@testable import GhostFile
+
+final class GhostFileHTTP3IntegrationTests: XCTestCase {
+    func testPausedRequestDoesNotBlockAnotherRequestOnSameHTTP3Connection() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("hello over HTTP/3".utf8).write(to: fixture.appendingPathComponent("hello.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "quic-integration-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3Integration",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    if request.path == "slow.txt" {
+                        try? await Task.sleep(for: .seconds(2))
+                    }
+                }
+            )
+            try server.start()
+            return server
+        }
+
+        let shareURL = try await waitForShareURL(server)
+        let connectionDetails = try { () -> (NWEndpoint.Port, String) in
+            guard let portNumber = shareURL.port,
+                  let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+                  let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
+                  let pin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value else {
+                throw TestError.missingShareURL
+            }
+            return (port, pin)
+        }()
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: connectionDetails.0,
+            accessKey: accessKey,
+            publicKeyPin: connectionDetails.1,
+            resourceBasePath: shareURL.path
+        )
+
+        async let pausedResponse = transport.request(
+            operation: "metadata",
+            relativePath: "slow.txt",
+            offset: nil,
+            length: nil
+        )
+        try await Task.sleep(for: .milliseconds(100))
+
+        let clock = ContinuousClock()
+        let started = clock.now
+        let fastResponse = try await transport.request(
+            operation: "metadata",
+            relativePath: "hello.txt",
+            offset: nil,
+            length: nil
+        )
+        let elapsed = started.duration(to: clock.now)
+
+        XCTAssertEqual(fastResponse.status, 200)
+        XCTAssertLessThan(elapsed, .seconds(1), "A paused HTTP/3 request blocked an independent stream")
+        _ = try await pausedResponse
+        await MainActor.run { server.stop() }
+    }
+
+    func testConcurrentRangeReadsUseOneHTTP3Connection() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-load-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        let payload = Data((0..<(2 * 1024 * 1024)).map { UInt8(truncatingIfNeeded: $0) })
+        try payload.write(to: fixture.appendingPathComponent("payload.bin"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "quic-load-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3Load",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+
+        let shareURL = try await waitForShareURL(server)
+        let resourceURL = try { () -> URL in
+            guard var components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false) else {
+                throw TestError.missingShareURL
+            }
+            components.host = "127.0.0.1"
+            components.queryItems = (components.queryItems ?? []) + [
+                URLQueryItem(name: "access_key", value: accessKey)
+            ]
+            guard let url = components.url else { throw TestError.missingShareURL }
+            return url
+        }()
+        let client = try GhostFileHTTP3Client(resourceURL: resourceURL)
+
+        let chunkSize = 64 * 1024
+        try await withThrowingTaskGroup(of: Void.self) { group in
+            for chunkIndex in 0..<32 {
+                group.addTask {
+                    let offset = chunkIndex * chunkSize
+                    let data = try await client.read(
+                        path: "payload.bin",
+                        offset: UInt64(offset),
+                        length: chunkSize
+                    )
+                    XCTAssertEqual(data, payload.subdata(in: offset..<(offset + chunkSize)))
+                }
+            }
+            try await group.waitForAll()
+        }
+        await MainActor.run { server.stop() }
+    }
+
+    private enum TestError: Error {
+        case missingShareURL
+    }
+
+    private func waitForShareURL(_ server: GhostFileShareServer) async throws -> URL {
+        for _ in 0..<200 {
+            if let url = await MainActor.run(body: { server.shareURL }) {
+                return url
+            }
+            try await Task.sleep(for: .milliseconds(10))
+        }
+        throw TestError.missingShareURL
+    }
+}
diff --git a/macOS/GhostHTTP3/scripts/ensure-framework.sh b/macOS/GhostHTTP3/scripts/ensure-framework.sh
new file mode 100755
index 0000000..2d25df3
--- /dev/null
+++ b/macOS/GhostHTTP3/scripts/ensure-framework.sh
@@ -0,0 +1,27 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+script_dir=${0:A:h}
+project_dir=${script_dir:h}
+framework=${project_dir}/.build/artifacts/GhostHTTP3.framework
+binary=${framework}/Versions/A/GhostHTTP3
+
+if [[ -f ${binary} ]] && [[ $(lipo -archs "${binary}" 2>/dev/null) == arm64 ]]; then
+    print "GhostHTTP3 framework already built; skipping."
+    exit 0
+fi
+
+if command -v cargo >/dev/null 2>&1 && command -v rustup >/dev/null 2>&1; then
+    exec "${script_dir}/build-framework.sh"
+fi
+
+# Keep the Rust installation out of the host environment. The mounted image
+# is reusable by later Xcode and Make builds.
+build_dir=${GHOST_HTTP3_BUILD_DIR:-${project_dir}/.build}
+mount_point=${GHOST_HTTP3_RUST_MOUNT:-${build_dir}/mount/GhostHTTP3Rust188}
+"${script_dir}/create-rust-toolchain-dmg.sh"
+export CARGO_HOME=${mount_point}/cargo
+export RUSTUP_HOME=${mount_point}/rustup
+export PATH=${CARGO_HOME}/bin:${PATH}
+exec "${script_dir}/build-framework.sh"
diff --git a/macOS/project.yml b/macOS/project.yml
index 10cbcf1..809bc0d 100644
--- a/macOS/project.yml
+++ b/macOS/project.yml
@@ -11,6 +11,12 @@ packages:
     from: "2.6.0"
   GhostHTTP:
     path: ../Packages/GhostHTTP
+  SwiftCertificates:
+    url: https://github.com/apple/swift-certificates.git
+    from: "1.19.4"
+  SwiftCrypto:
+    url: https://github.com/apple/swift-crypto.git
+    from: "3.15.1"
   Containerization:
     url: https://github.com/apple/containerization.git
     exactVersion: "0.40.1"
@@ -35,8 +41,142 @@ schemes:
     test:
       targets:
         - GhostVMTests
+  GhostFile:
+    build:
+      targets:
+        GhostFile: all
+    run:
+      config: Debug
+  GhostFileTests:
+    build:
+      targets:
+        GhostFileTests: test
+    test:
+      targets:
+        - GhostFileTests
+
+aggregateTargets:
+  GhostHTTP3Framework:
+    settings:
+      base:
+        PRODUCT_NAME: GhostHTTP3Framework
+    buildScripts:
+      - name: Build GhostHTTP3 arm64 framework
+        runOnlyWhenInstalling: false
+        showEnvVars: false
+        outputFiles:
+          - $(SRCROOT)/GhostHTTP3/.build/artifacts/GhostHTTP3.framework/Versions/A/GhostHTTP3
+        script: |
+          set -euo pipefail
+          "${SRCROOT}/GhostHTTP3/scripts/ensure-framework.sh"
 
 targets:
+  GhostFileFS:
+    type: extensionkit-extension
+    platform: macOS
+    deploymentTarget: "26.0"
+    sources:
+      - path: GhostFileFS
+        excludes:
+          - "*.plist"
+      - path: GhostFileShared
+    dependencies:
+      - sdk: FSKit.framework
+      - sdk: ExtensionFoundation.framework
+      - sdk: Network.framework
+      - sdk: Security.framework
+      - target: GhostHTTP3Framework
+      - framework: GhostHTTP3/.build/artifacts/GhostHTTP3.framework
+        embed: true
+        codeSign: true
+    settings:
+      base:
+        PRODUCT_NAME: GhostFileFS
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostfile.fs
+        SKIP_INSTALL: YES
+        INFOPLIST_FILE: GhostFileFS/Info.plist
+        GENERATE_INFOPLIST_FILE: NO
+        CODE_SIGN_ENTITLEMENTS: GhostFileFS/entitlements.plist
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: "Apple Development"
+        DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
+        ENABLE_APP_SANDBOX: YES
+        ENABLE_HARDENED_RUNTIME: YES
+        SWIFT_VERSION: "5.0"
+        LD_RUNPATH_SEARCH_PATHS:
+          - "$(inherited)"
+          - "@executable_path/../Frameworks"
+
+  GhostFile:
+    type: application
+    platform: macOS
+    deploymentTarget: "26.0"
+    sources:
+      - path: GhostFile
+        excludes:
+          - "*.plist"
+      - path: GhostFileShared
+      - path: GhostFileFS/GhostFileHTTPClient.swift
+    dependencies:
+      - package: GhostHTTP
+      - package: SwiftCertificates
+        product: X509
+      - package: SwiftCrypto
+        product: Crypto
+      - sdk: FSKit.framework
+      - sdk: Network.framework
+      - sdk: Security.framework
+      - target: GhostHTTP3Framework
+      - framework: GhostHTTP3/.build/artifacts/GhostHTTP3.framework
+        embed: true
+        codeSign: true
+      - target: GhostFileFS
+        embed: true
+        codeSign: true
+    settings:
+      base:
+        PRODUCT_NAME: GhostFile
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostfile
+        SKIP_INSTALL: NO
+        INFOPLIST_FILE: GhostFile/Info.plist
+        GENERATE_INFOPLIST_FILE: NO
+        CODE_SIGN_ENTITLEMENTS: GhostFile/entitlements.plist
+        CODE_SIGN_STYLE: Automatic
+        CODE_SIGN_IDENTITY: "Apple Development"
+        DEVELOPMENT_TEAM: ${DEVELOPMENT_TEAM}
+        ENABLE_APP_SANDBOX: NO
+        ENABLE_HARDENED_RUNTIME: YES
+        SWIFT_VERSION: "5.0"
+        SWIFT_EMIT_LOC_STRINGS: NO
+        LD_RUNPATH_SEARCH_PATHS:
+          - "$(inherited)"
+          - "@executable_path/../Frameworks"
+      configs:
+        Debug:
+          ONLY_ACTIVE_ARCH: YES
+
+  GhostFileTests:
+    type: bundle.unit-test
+    platform: macOS
+    sources:
+      - path: GhostFileTests
+    dependencies:
+      - target: GhostFile
+      - package: GhostHTTP
+      - target: GhostHTTP3Framework
+      - framework: GhostHTTP3/.build/artifacts/GhostHTTP3.framework
+        link: true
+        embed: false
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: org.ghostvm.ghostfile.tests
+        GENERATE_INFOPLIST_FILE: YES
+        SWIFT_VERSION: "5.0"
+        LD_RUNPATH_SEARCH_PATHS:
+          - "$(inherited)"
+          - "@loader_path/../../../../../Frameworks"
+          - "@loader_path/Frameworks"
+
   GhostVMKit:
     type: framework
     platform: macOS
diff --git a/scripts/benchmark-ghostfile.py b/scripts/benchmark-ghostfile.py
new file mode 100755
index 0000000..7ec272c
--- /dev/null
+++ b/scripts/benchmark-ghostfile.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+
+import argparse
+import fcntl
+import hashlib
+import os
+import random
+import statistics
+import time
+
+
+F_NOCACHE = getattr(fcntl, "F_NOCACHE", 48)
+CHUNK_SIZE = 1024 * 1024
+
+
+def timed(operation):
+    started = time.perf_counter()
+    result = operation()
+    return time.perf_counter() - started, result
+
+
+def read_sequential(path, uncached):
+    total = 0
+    descriptor = os.open(path, os.O_RDONLY)
+    try:
+        if uncached:
+            fcntl.fcntl(descriptor, F_NOCACHE, 1)
+        while True:
+            chunk = os.read(descriptor, CHUNK_SIZE)
+            if not chunk:
+                break
+            total += len(chunk)
+    finally:
+        os.close(descriptor)
+    return total
+
+
+def read_random(path, offsets, uncached):
+    digest = hashlib.sha256()
+    descriptor = os.open(path, os.O_RDONLY)
+    try:
+        if uncached:
+            fcntl.fcntl(descriptor, F_NOCACHE, 1)
+        for offset in offsets:
+            digest.update(os.pread(descriptor, 4096, offset))
+    finally:
+        os.close(descriptor)
+    return digest.digest()
+
+
+def benchmark_pair(source_path, mount_path, samples, operation):
+    durations = {"regular": [], "fskit": []}
+    results = {"regular": [], "fskit": []}
+    paths = {"regular": source_path, "fskit": mount_path}
+    for sample in range(samples):
+        order = ("regular", "fskit") if sample % 2 == 0 else ("fskit", "regular")
+        for label in order:
+            duration, result = timed(lambda label=label: operation(paths[label]))
+            durations[label].append(duration)
+            results[label].append(result)
+    return durations, results
+
+
+def print_throughput(label, durations, byte_count):
+    source_seconds = statistics.median(durations["regular"])
+    mount_seconds = statistics.median(durations["fskit"])
+    mib = byte_count / (1024 * 1024)
+    source_rate = mib / source_seconds
+    mount_rate = mib / mount_seconds
+    print(
+        f"{label}: regular={source_rate:.1f} MiB/s "
+        f"fskit={mount_rate:.1f} MiB/s ratio={mount_rate / source_rate:.3f}x"
+    )
+
+
+def print_latency(label, durations, operations_per_sample):
+    source_us = statistics.median(durations["regular"]) * 1_000_000 / operations_per_sample
+    mount_us = statistics.median(durations["fskit"]) * 1_000_000 / operations_per_sample
+    print(
+        f"{label}: regular={source_us:.1f} us/op "
+        f"fskit={mount_us:.1f} us/op ratio={mount_us / source_us:.2f}x"
+    )
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Compare regular file I/O with a GhostFile FSKit mount")
+    parser.add_argument("source_file")
+    parser.add_argument("mounted_file")
+    parser.add_argument("--samples", type=int, default=5)
+    parser.add_argument("--random-reads", type=int, default=1000)
+    parser.add_argument("--metadata-ops", type=int, default=5000)
+    parser.add_argument("--directory-ops", type=int, default=2000)
+    parser.add_argument(
+        "--sequential-only",
+        action="store_true",
+        help="time only the first F_NOCACHE sequential read (useful with a fresh file identity)",
+    )
+    args = parser.parse_args()
+
+    source_size = os.path.getsize(args.source_file)
+    mount_size = os.path.getsize(args.mounted_file)
+    if source_size != mount_size:
+        raise SystemExit(f"size mismatch: regular={source_size} fskit={mount_size}")
+
+    print(f"file_size={source_size / (1024 * 1024):.1f} MiB samples={args.samples}")
+
+    if not args.sequential_only:
+        randomizer = random.Random(0x47484F535446494C)
+        max_offset = max(0, source_size - 4096)
+        offsets = [randomizer.randrange(0, max_offset + 1) for _ in range(args.random_reads)]
+        random_durations, random_results = benchmark_pair(
+            args.source_file,
+            args.mounted_file,
+            args.samples,
+            lambda path: read_random(path, offsets, True),
+        )
+        if len(set(random_results["regular"] + random_results["fskit"])) != 1:
+            raise SystemExit("random-read digest mismatch")
+        print_latency("random 4 KiB reads (F_NOCACHE)", random_durations, args.random_reads)
+
+    sequential_durations, sequential_results = benchmark_pair(
+        args.source_file,
+        args.mounted_file,
+        args.samples,
+        lambda path: read_sequential(path, True),
+    )
+    sequential_totals = sequential_results["regular"] + sequential_results["fskit"]
+    if set(sequential_totals) != {source_size}:
+        raise SystemExit("sequential-read length mismatch")
+    print_throughput("sequential reads (F_NOCACHE)", sequential_durations, source_size)
+
+    if args.sequential_only:
+        return
+
+    cached_durations, cached_results = benchmark_pair(
+        args.source_file,
+        args.mounted_file,
+        args.samples,
+        lambda path: read_sequential(path, False),
+    )
+    cached_totals = cached_results["regular"] + cached_results["fskit"]
+    if set(cached_totals) != {source_size}:
+        raise SystemExit("cached sequential-read length mismatch")
+    print_throughput("sequential reads (warm cache)", cached_durations, source_size)
+
+    source_directory = os.path.dirname(args.source_file)
+    mount_directory = os.path.dirname(args.mounted_file)
+    metadata_durations, _ = benchmark_pair(
+        args.source_file,
+        args.mounted_file,
+        args.samples,
+        lambda path: [os.stat(path) for _ in range(args.metadata_ops)],
+    )
+    print_latency("stat", metadata_durations, args.metadata_ops)
+
+    directory_durations, directory_results = benchmark_pair(
+        source_directory,
+        mount_directory,
+        args.samples,
+        lambda path: [tuple(sorted(entry.name for entry in os.scandir(path))) for _ in range(args.directory_ops)],
+    )
+    if directory_results["regular"][-1][-1] != directory_results["fskit"][-1][-1]:
+        raise SystemExit("directory listing mismatch")
+    print_latency("readdir", directory_durations, args.directory_ops)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/stress-ghostfile.sh b/scripts/stress-ghostfile.sh
new file mode 100755
index 0000000..5085e5a
--- /dev/null
+++ b/scripts/stress-ghostfile.sh
@@ -0,0 +1,127 @@
+#!/bin/zsh
+
+set -u
+set -o pipefail
+
+mount_point=${1:-}
+source_root=${2:-}
+workers=${GHOSTFILE_STRESS_WORKERS:-8}
+iterations=${GHOSTFILE_STRESS_ITERATIONS:-25}
+
+if [[ -z "$mount_point" || -z "$source_root" ]]; then
+    print -u2 "usage: $0 MOUNT_POINT SOURCE_ROOT"
+    exit 64
+fi
+
+large_file="$mount_point/stress/alpha/large-image.png"
+source_large="$source_root/stress/alpha/large-image.png"
+small_file="$mount_point/probe.txt"
+source_small="$source_root/probe.txt"
+space_file="$mount_point/stress/beta/space name.txt"
+unicode_file="$mount_point/stress/beta/unicode-π-世界.txt"
+symlink_file="$mount_point/stress/beta/link-to-large"
+broken_symlink="$mount_point/stress/beta/broken-link"
+write_probe="$mount_point/__ghostfile_write_probe__"
+directory_probe="$mount_point/__ghostfile_directory_probe__"
+
+failures=0
+checks=0
+
+check() {
+    local label=$1
+    shift
+    checks=$((checks + 1))
+    if "$@"; then
+        print "PASS $label"
+    else
+        print -u2 "FAIL $label"
+        failures=$((failures + 1))
+    fi
+}
+
+expect_failure() {
+    local label=$1
+    shift
+    checks=$((checks + 1))
+    if "$@" >/dev/null 2>&1; then
+        print -u2 "FAIL $label unexpectedly succeeded"
+        failures=$((failures + 1))
+    else
+        print "PASS $label rejected"
+    fi
+}
+
+worker() {
+    local worker_number=$1
+    local loop_number
+    local skip_blocks
+    for ((loop_number = 0; loop_number < iterations; loop_number++)); do
+        /usr/bin/stat -f '%z:%m:%i' "$large_file" >/dev/null || return 1
+        /usr/bin/shasum -a 256 "$large_file" >/dev/null || return 1
+        /bin/ls -la "$mount_point/stress/alpha" "$mount_point/stress/beta" >/dev/null || return 1
+        /usr/bin/readlink "$symlink_file" >/dev/null || return 1
+        /bin/cat "$small_file" "$space_file" "$unicode_file" >/dev/null || return 1
+        skip_blocks=$(((worker_number * 97 + loop_number * 31) % 400))
+        /bin/dd if="$large_file" of=/dev/null bs=4096 skip=$skip_blocks count=16 2>/dev/null || return 1
+    done
+}
+
+mount_is_fskit() {
+    local resolved_mount_point
+    resolved_mount_point=$(cd "$mount_point" && /bin/pwd -P) || return 1
+    /sbin/mount | /usr/bin/grep -F " on $resolved_mount_point " | /usr/bin/grep -F "fskit" >/dev/null
+}
+
+print "GhostFile stress target: $mount_point"
+print "workers=$workers iterations=$iterations"
+
+check "mount is FSKit" mount_is_fskit
+check "source and mounted large file match" /usr/bin/cmp -s "$source_large" "$large_file"
+check "source and mounted small file match" /usr/bin/cmp -s "$source_small" "$small_file"
+check "space-containing filename" /usr/bin/cmp -s "$source_small" "$space_file"
+check "UTF-8 filename" /usr/bin/cmp -s "$source_small" "$unicode_file"
+check "symlink target" test "$(/usr/bin/readlink "$symlink_file")" = "../../alpha/large-image.png"
+check "broken symlink remains a symlink" test -L "$broken_symlink"
+expect_failure "broken symlink content read" /bin/cat "$broken_symlink"
+
+for ((enumeration = 0; enumeration < 100; enumeration++)); do
+    /usr/bin/find "$mount_point" -maxdepth 5 -print >/dev/null || {
+        print -u2 "FAIL recursive enumeration at iteration $enumeration"
+        failures=$((failures + 1))
+        break
+    }
+done
+checks=$((checks + 1))
+if ((failures == 0)); then
+    print "PASS 100 recursive enumerations"
+fi
+
+typeset -a worker_pids
+for ((worker_number = 0; worker_number < workers; worker_number++)); do
+    worker "$worker_number" &
+    worker_pids+=("$!")
+done
+
+parallel_failure=0
+for worker_pid in $worker_pids; do
+    if ! wait "$worker_pid"; then
+        parallel_failure=1
+    fi
+done
+checks=$((checks + 1))
+if ((parallel_failure == 0)); then
+    print "PASS $((workers * iterations)) parallel operation batches"
+else
+    print -u2 "FAIL parallel operation batches"
+    failures=$((failures + 1))
+fi
+
+expect_failure "file creation on read-only mount" /usr/bin/touch "$write_probe"
+expect_failure "directory creation on read-only mount" /bin/mkdir "$directory_probe"
+expect_failure "hard-link creation on read-only mount" /bin/ln "$small_file" "$write_probe"
+expect_failure "metadata mutation on read-only mount" /bin/chmod u+x "$small_file"
+check "failed mutations left no file" test ! -e "$write_probe"
+check "failed mutations left no directory" test ! -e "$directory_probe"
+
+print "checks=$checks failures=$failures"
+exit "$failures"

From 59b9d599153f979bbdb8daddb9660b79d2b923e2 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 17:12:01 -0700
Subject: [PATCH 04/18] Add GhostFile tree IOPS benchmark

---
 scripts/benchmark-ghostfile-tree.py | 145 ++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100755 scripts/benchmark-ghostfile-tree.py

diff --git a/scripts/benchmark-ghostfile-tree.py b/scripts/benchmark-ghostfile-tree.py
new file mode 100755
index 0000000..2b0f6d6
--- /dev/null
+++ b/scripts/benchmark-ghostfile-tree.py
@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+
+import argparse
+import os
+import statistics
+import time
+
+
+def inventory(root):
+    files = []
+    directories = []
+    for current, directory_names, file_names in os.walk(root):
+        relative_directory = os.path.relpath(current, root)
+        directories.append(relative_directory)
+        files.extend(
+            os.path.join(relative_directory, name) if relative_directory != "." else name
+            for name in file_names
+        )
+        directory_names.sort()
+        file_names.sort()
+    return sorted(files), sorted(directories)
+
+
+def timed(operation):
+    started = time.perf_counter()
+    result = operation()
+    return time.perf_counter() - started, result
+
+
+def benchmark_pair(native_operation, mounted_operation, samples):
+    durations = {"native": [], "fskit": []}
+    results = {"native": [], "fskit": []}
+    operations = {"native": native_operation, "fskit": mounted_operation}
+    for sample in range(samples):
+        order = ("native", "fskit") if sample % 2 == 0 else ("fskit", "native")
+        for label in order:
+            duration, result = timed(operations[label])
+            durations[label].append(duration)
+            results[label].append(result)
+    return durations, results
+
+
+def print_rate(label, durations, operation_count, unit="ops/s"):
+    native_rate = operation_count / statistics.median(durations["native"])
+    fskit_rate = operation_count / statistics.median(durations["fskit"])
+    print(
+        f"{label}: native={native_rate:.1f} {unit} "
+        f"fskit={fskit_rate:.1f} {unit} ratio={fskit_rate / native_rate:.3f}x"
+    )
+
+
+def read_files(root, relative_paths):
+    byte_count = 0
+    checksum = 0
+    for relative_path in relative_paths:
+        with open(os.path.join(root, relative_path), "rb", buffering=0) as stream:
+            contents = stream.read()
+        byte_count += len(contents)
+        checksum = (checksum + sum(contents)) & 0xFFFFFFFF
+    return byte_count, checksum
+
+
+def stat_files(root, relative_paths):
+    return sum(os.stat(os.path.join(root, path)).st_size for path in relative_paths)
+
+
+def list_directories(root, relative_paths):
+    entry_count = 0
+    for relative_path in relative_paths:
+        path = root if relative_path == "." else os.path.join(root, relative_path)
+        with os.scandir(path) as entries:
+            entry_count += sum(1 for _ in entries)
+    return entry_count
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Compare native and GhostFile FSKit file-tree operation rates"
+    )
+    parser.add_argument("native_root")
+    parser.add_argument("mounted_root")
+    parser.add_argument("--samples", type=int, default=3)
+    parser.add_argument("--small-file-ops", type=int, default=2048)
+    parser.add_argument("--stat-ops", type=int, default=8192)
+    parser.add_argument("--directory-ops", type=int, default=2048)
+    args = parser.parse_args()
+
+    native_files, native_directories = inventory(args.native_root)
+    mounted_files, mounted_directories = inventory(args.mounted_root)
+    if native_files != mounted_files or native_directories != mounted_directories:
+        raise SystemExit("native and mounted tree inventories differ")
+
+    print(f"tree_files={len(native_files)} tree_directories={len(native_directories)}")
+    entry_count = len(native_files) + len(native_directories)
+    walk_durations, walk_results = benchmark_pair(
+        lambda: inventory(args.native_root),
+        lambda: inventory(args.mounted_root),
+        args.samples,
+    )
+    if any(result != walk_results["native"][0] for values in walk_results.values() for result in values):
+        raise SystemExit("tree inventory changed during benchmark")
+    print_rate("recursive tree enumeration", walk_durations, entry_count, "entries/s")
+
+    stat_paths = [native_files[index % len(native_files)] for index in range(args.stat_ops)]
+    stat_durations, stat_results = benchmark_pair(
+        lambda: stat_files(args.native_root, stat_paths),
+        lambda: stat_files(args.mounted_root, stat_paths),
+        args.samples,
+    )
+    if len(set(stat_results["native"] + stat_results["fskit"])) != 1:
+        raise SystemExit("stat size totals differ")
+    print_rate("small-file stat", stat_durations, len(stat_paths), "IOPS")
+
+    read_paths = native_files[: min(args.small_file_ops, len(native_files))]
+    read_durations, read_results = benchmark_pair(
+        lambda: read_files(args.native_root, read_paths),
+        lambda: read_files(args.mounted_root, read_paths),
+        args.samples,
+    )
+    if len(set(read_results["native"] + read_results["fskit"])) != 1:
+        raise SystemExit("small-file contents differ")
+    print_rate("open + read small files", read_durations, len(read_paths), "IOPS")
+    byte_count = read_results["native"][0][0]
+    native_mib = byte_count / statistics.median(read_durations["native"]) / (1024 * 1024)
+    fskit_mib = byte_count / statistics.median(read_durations["fskit"]) / (1024 * 1024)
+    print(
+        f"small-file payload throughput: native={native_mib:.2f} MiB/s "
+        f"fskit={fskit_mib:.2f} MiB/s ratio={fskit_mib / native_mib:.3f}x"
+    )
+
+    directory_paths = [
+        native_directories[index % len(native_directories)] for index in range(args.directory_ops)
+    ]
+    directory_durations, directory_results = benchmark_pair(
+        lambda: list_directories(args.native_root, directory_paths),
+        lambda: list_directories(args.mounted_root, directory_paths),
+        args.samples,
+    )
+    if len(set(directory_results["native"] + directory_results["fskit"])) != 1:
+        raise SystemExit("directory entry totals differ")
+    print_rate("directory listing", directory_durations, len(directory_paths), "IOPS")
+
+
+if __name__ == "__main__":
+    main()

From 6bd0db6f50ed2d78e5af68746b36856f96270f56 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 17:49:16 -0700
Subject: [PATCH 05/18] Pipeline GhostFile Network.framework datagrams

---
 .../GhostFile/GhostFileHTTP3ShareServer.swift | 64 ++++++++---------
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 70 +++++++++----------
 macOS/GhostFileShared/GhostFileHTTP3.swift    | 62 ++++++++++++++++
 3 files changed, 126 insertions(+), 70 deletions(-)

diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
index e74b59d..98c284e 100644
--- a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -242,7 +242,6 @@ private actor GhostFileHTTP3ServerSession {
     private let requestDelay: RequestDelay
     private let requestCompleted: @Sendable () -> Void
     private let stopped: @Sendable () -> Void
-    private var receiveTask: Task?
     private var timeoutTask: Task?
     private var isFlushing = false
     private var flushAgain = false
@@ -287,18 +286,31 @@ private actor GhostFileHTTP3ServerSession {
             }
         }
         connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.session"))
-        receiveTask = Task { [weak self, connection] in
-            do {
-                while !Task.isCancelled {
-                    let datagram = try await connection.receiveHTTP3Datagram()
-                    await self?.received(datagram)
-                }
-            } catch {
-                await self?.stopIsolated()
+        connection.batch {
+            for _ in 0..) in
-            send(content: data, completion: .contentProcessed { error in
-                if let error { continuation.resume(throwing: error) }
-                else { continuation.resume() }
-            })
-        }
-    }
-
-    func receiveHTTP3Datagram() async throws -> Data {
-        try await withCheckedThrowingContinuation { continuation in
-            receiveMessage { content, _, _, error in
-                if let error { continuation.resume(throwing: error) }
-                else if let content { continuation.resume(returning: content) }
-                else { continuation.resume(throwing: GhostFileHTTP3ServerError.closed) }
-            }
-        }
-    }
 }
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index ed40e20..cb797ba 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -116,7 +116,6 @@ actor GhostFileHTTP3Transport {
     private let expectedCertificatePin: String
     private let connection: NWConnection
     private let http3: GhostFileHTTP3Connection
-    private var receiveTask: Task?
     private var timeoutTask: Task?
     private var hasStarted = false
     private var isNetworkReady = false
@@ -202,18 +201,35 @@ actor GhostFileHTTP3Transport {
             Task { await self.connectionStateChanged(state) }
         }
         connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.client"))
-        receiveTask = Task { [weak self, connection] in
-            do {
-                while !Task.isCancelled {
-                    let datagram = try await connection.receiveDatagram()
-                    await self?.received(datagram)
-                }
-            } catch {
-                await self?.fail(error)
+        connection.batch {
+            for _ in 0..) in
-            send(content: data, completion: .contentProcessed { error in
-                if let error { continuation.resume(throwing: error) }
-                else { continuation.resume() }
-            })
-        }
-    }
-
-    func receiveDatagram() async throws -> Data {
-        try await withCheckedThrowingContinuation { continuation in
-            receiveMessage { content, _, _, error in
-                if let error { continuation.resume(throwing: error) }
-                else if let content { continuation.resume(returning: content) }
-                else { continuation.resume(throwing: GhostFileDatagramError.closed) }
-            }
-        }
-    }
-}
-
-private enum GhostFileDatagramError: Error {
-    case closed
-}
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index b240322..8b04c6e 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -1,6 +1,7 @@
 import Darwin
 import Foundation
 import GhostHTTP3
+import Network
 
 final class GhostFileHTTP3Connection: @unchecked Sendable {
     enum Role {
@@ -515,3 +516,64 @@ private final class ManagedHTTP3Headers {
         headers.withUnsafeBufferPointer { body($0.baseAddress, $0.count) }
     }
 }
+
+enum GhostFileNetworkDatagram {
+    // Amortize Network.framework callback and actor-hop overhead while keeping
+    // both the send queue and the receive window explicitly bounded.
+    static let maximumSendBatchCount = 64
+    static let maximumReceiveCount = 64
+}
+
+extension NWConnection {
+    func sendGhostFileDatagrams(_ datagrams: [Data]) async throws {
+        guard !datagrams.isEmpty else { return }
+
+        try await withCheckedThrowingContinuation { continuation in
+            let completion = GhostFileDatagramBatchCompletion(
+                count: datagrams.count,
+                continuation: continuation
+            )
+            batch {
+                for datagram in datagrams {
+                    send(content: datagram, completion: .contentProcessed { error in
+                        completion.completed(error: error)
+                    })
+                }
+            }
+        }
+    }
+}
+
+private final class GhostFileDatagramBatchCompletion: @unchecked Sendable {
+    private let lock = NSLock()
+    private var remaining: Int
+    private var continuation: CheckedContinuation?
+
+    init(count: Int, continuation: CheckedContinuation) {
+        remaining = count
+        self.continuation = continuation
+    }
+
+    func completed(error: NWError?) {
+        var continuationToResume: CheckedContinuation?
+        var completionError: Error?
+        lock.lock()
+        remaining -= 1
+        if let error, continuation != nil {
+            continuationToResume = continuation
+            continuation = nil
+            completionError = error
+        } else if remaining == 0, continuation != nil {
+            continuationToResume = continuation
+            continuation = nil
+        }
+        lock.unlock()
+
+        guard let continuationToResume else { return }
+        if let completionError {
+            continuationToResume.resume(throwing: completionError)
+        } else {
+            continuationToResume.resume()
+        }
+    }
+}

From cbd64e9d7c725cb789226b9cd9f251753f95d575 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 17:56:17 -0700
Subject: [PATCH 06/18] Add opt-in GhostFile HTTP3 bulk benchmark

---
 .../GhostFileQUICIntegrationTests.swift       | 141 ++++++++++++++++--
 1 file changed, 130 insertions(+), 11 deletions(-)

diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index c21bdb6..e471c81 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -4,6 +4,88 @@ import XCTest
 @testable import GhostFile
 
 final class GhostFileHTTP3IntegrationTests: XCTestCase {
+    func testBulkTransferBenchmarkWhenRequested() async throws {
+        let environment = ProcessInfo.processInfo.environment
+        guard environment["GHOSTFILE_RUN_BULK_BENCHMARK"] == "1" else {
+            throw XCTSkip("Set GHOSTFILE_RUN_BULK_BENCHMARK=1 to run the HTTP/3 bulk benchmark")
+        }
+        guard let fixturePath = environment["GHOSTFILE_BENCHMARK_FILE"] else {
+            throw XCTSkip("Set GHOSTFILE_BENCHMARK_FILE to the source fixture path")
+        }
+
+        let fixtureURL = URL(fileURLWithPath: fixturePath).standardizedFileURL
+        let payload = try Data(contentsOf: fixtureURL, options: .mappedIfSafe)
+        let accessKey = "quic-bulk-benchmark-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixtureURL.deletingLastPathComponent(),
+                shareName: "GhostFileHTTP3BulkBenchmark",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        let resourceURL = try loopbackResourceURL(
+            shareURL: shareURL,
+            accessKey: accessKey
+        )
+        let client = try GhostFileHTTP3Client(resourceURL: resourceURL)
+        let relativePath = fixtureURL.lastPathComponent
+        let chunkSize = GhostFileProtocol.maximumReadLength
+        let chunks = stride(from: 0, to: payload.count, by: chunkSize).map { offset in
+            (offset: offset, length: min(chunkSize, payload.count - offset))
+        }
+
+        // Establish the connection before either timed transfer.
+        _ = try await client.read(path: relativePath, offset: 0, length: 1)
+
+        let sequential = try await timedTransfer {
+            var responses: [(Int, Data)] = []
+            responses.reserveCapacity(chunks.count)
+            for chunk in chunks {
+                let data = try await client.read(
+                    path: relativePath,
+                    offset: UInt64(chunk.offset),
+                    length: chunk.length
+                )
+                responses.append((chunk.offset, data))
+            }
+            return responses
+        }
+        try verify(sequential.result, against: payload)
+
+        let parallel = try await timedTransfer {
+            var responses: [(Int, Data)] = []
+            responses.reserveCapacity(chunks.count)
+            for batchStart in stride(from: 0, to: chunks.count, by: 16) {
+                let batchEnd = min(batchStart + 16, chunks.count)
+                try await withThrowingTaskGroup(of: (Int, Data).self) { group in
+                    for chunk in chunks[batchStart.. URL in
-            guard var components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false) else {
-                throw TestError.missingShareURL
-            }
-            components.host = "127.0.0.1"
-            components.queryItems = (components.queryItems ?? []) + [
-                URLQueryItem(name: "access_key", value: accessKey)
-            ]
-            guard let url = components.url else { throw TestError.missingShareURL }
-            return url
-        }()
+        let resourceURL = try loopbackResourceURL(shareURL: shareURL, accessKey: accessKey)
         let client = try GhostFileHTTP3Client(resourceURL: resourceURL)
 
         let chunkSize = 64 * 1024
@@ -122,6 +194,53 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
 
     private enum TestError: Error {
         case missingShareURL
+        case responseMismatch
+    }
+
+    private func loopbackResourceURL(shareURL: URL, accessKey: String) throws -> URL {
+        guard var components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false) else {
+            throw TestError.missingShareURL
+        }
+        components.host = "127.0.0.1"
+        components.queryItems = (components.queryItems ?? []) + [
+            URLQueryItem(name: "access_key", value: accessKey)
+        ]
+        guard let url = components.url else { throw TestError.missingShareURL }
+        return url
+    }
+
+    private func timedTransfer(
+        _ operation: () async throws -> Result
+    ) async rethrows -> (seconds: Double, result: Result) {
+        let clock = ContinuousClock()
+        let started = clock.now
+        let result = try await operation()
+        let elapsed = started.duration(to: clock.now)
+        let components = elapsed.components
+        let seconds = Double(components.seconds) + Double(components.attoseconds) / 1e18
+        return (seconds, result)
+    }
+
+    private func verify(_ responses: [(Int, Data)], against payload: Data) throws {
+        var expectedOffset = 0
+        for (offset, data) in responses.sorted(by: { $0.0 < $1.0 }) {
+            guard offset == expectedOffset, offset + data.count <= payload.count else {
+                throw TestError.responseMismatch
+            }
+            guard payload[offset..<(offset + data.count)].elementsEqual(data) else {
+                throw TestError.responseMismatch
+            }
+            expectedOffset += data.count
+        }
+        guard expectedOffset == payload.count else {
+            throw TestError.responseMismatch
+        }
+    }
+
+    private func printBenchmark(_ label: String, bytes: Int, seconds: Double) {
+        let throughput = Double(bytes) / seconds / (1024 * 1024)
+        print("GHOSTFILE_BENCHMARK \(label): \(String(format: "%.1f", throughput)) MiB/s " +
+              "(\(String(format: "%.3f", seconds)) s)")
     }
 
     private func waitForShareURL(_ server: GhostFileShareServer) async throws -> URL {

From e7a806fe5d29b8007e54eb85ae1bb014999cab45 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 19:42:49 -0700
Subject: [PATCH 07/18] Batch GhostFile HTTP3 I/O pipeline

---
 GHOSTFILE.md                                  |   8 +
 GHOSTFILE_BENCHMARKS.md                       | 101 +++++
 .../GhostFile/GhostFileHTTP3ShareServer.swift | 347 +++++++++++++++---
 macOS/GhostFile/GhostFileShareRouter.swift    |  90 +++--
 macOS/GhostFileFS/GhostFileHTTPClient.swift   |  60 ++-
 macOS/GhostFileShared/GhostFileHTTP3.swift    | 297 +++++++++++++--
 .../GhostFileProtocolTests.swift              |  24 +-
 7 files changed, 800 insertions(+), 127 deletions(-)
 create mode 100644 GHOSTFILE_BENCHMARKS.md

diff --git a/GHOSTFILE.md b/GHOSTFILE.md
index 3f21efd..aee3244 100644
--- a/GHOSTFILE.md
+++ b/GHOSTFILE.md
@@ -61,6 +61,12 @@ flow control, and multiplexing. Integration tests cover 32 concurrent 64 KiB
 range reads and verify that a two-second paused request doesn't delay an
 independent request on the same connection.
 
+The server represents file bodies as immutable path/offset/length descriptors.
+Random-access `DispatchIO` channels perform the actual range reads and deliver
+their data outside the serialized HTTP/3 connection actor. Metadata and
+directory routing use a separate concurrent Dispatch queue, so blocking file
+system calls do not occupy the connection actor or Swift's cooperative executor.
+
 The service is advertised as `_ghostfile._udp` with `transport=http3` and
 `alpn=h3` TXT values. Peers negotiate the standard `h3` ALPN over TLS 1.3 and
 QUIC. The server uses an ephemeral certificate whose DER SHA-256 pin is carried
@@ -90,3 +96,5 @@ python3 scripts/benchmark-ghostfile.py \
 
 The stress script checks parallel reads, checksums, directory enumeration,
 spaces and UTF-8 names, symlinks, and enforcement of the read-only mount.
+Recorded before/after performance results are in
+[`GHOSTFILE_BENCHMARKS.md`](GHOSTFILE_BENCHMARKS.md).
diff --git a/GHOSTFILE_BENCHMARKS.md b/GHOSTFILE_BENCHMARKS.md
new file mode 100644
index 0000000..4d52482
--- /dev/null
+++ b/GHOSTFILE_BENCHMARKS.md
@@ -0,0 +1,101 @@
+# GhostFile benchmarks
+
+## 2026-07-31: receive-side QUIC datagram batching
+
+The remaining throughput ceiling was a serialized per-datagram feedback loop,
+not file I/O or HTTP/3 stream head-of-line blocking. Although each
+`NWConnection` registered 64 concurrent `receiveMessage` calls, every callback
+created an actor task that independently performed QUIC receive, HTTP/3 event
+polling, and an awaited outgoing flush. That made ACK/control processing and
+response progress pay the Swift task, actor, quiche, and Network.framework
+costs once per UDP packet.
+
+The client and server now re-arm the receive immediately, queue completed UDP
+datagrams on their connection actor, and drain up to 64 datagrams before one
+HTTP/3 event poll and outgoing flush.
+
+### Direct HTTP/3 result
+
+The same 75.5 MiB fixture and 1,350-byte QUIC payload were used before and
+after. The after values are medians of three runs without diagnostic logging.
+
+| Test | Before batching | After batching | Improvement |
+| --- | ---: | ---: | ---: |
+| Sequential 1 MiB ranges | 16.8 MiB/s | 167.7 MiB/s | 10.0x |
+| 16 concurrent streams | 27.4 MiB/s | 192.8 MiB/s | 7.0x |
+
+After samples:
+
+- Sequential: 148.6, 168.4, 167.7 MiB/s
+- 16-stream: 192.8, 189.5, 193.8 MiB/s
+
+### Diagnostic evidence
+
+Opt-in `GHOSTFILE_HTTP3_DIAGNOSTICS=1` sampling showed the pre-fix client
+spending about 490 ms of each 500 ms interval waiting on single-packet UDP
+sends, while the server's loopback QUIC RTT inflated to roughly 28 ms. The
+server emitted only about 7,250 packets per half-second. After receive-side
+batching, RTT fell to roughly 1.2 ms and the server emitted about 57,000 packets
+in a half-second with only five packets reported lost across the transfer.
+
+As a separate isolation test, increasing only the loopback QUIC payload from
+1,350 to 8,000 bytes raised the pre-fix result to 83.3 MiB/s sequential and
+93.1 MiB/s with 16 streams. That confirmed the ceiling scaled with UDP packet
+count. Jumbo payloads are not the production fix because real network paths
+must retain a conservative MTU; receive-side batching removes the per-packet
+serialization while keeping the 1,350-byte payload.
+
+## 2026-07-31: synchronous body producer to DispatchIO
+
+These measurements use the same 75.5 MiB fixture on one Apple Silicon Mac.
+Direct HTTP/3 runs use one persistent loopback QUIC connection. Mounted runs
+compare the source file with the FSKit mount and use `F_NOCACHE` where noted.
+Values are medians; the raw direct HTTP/3 samples are included because the
+16-stream result has occasional low outliers.
+
+### Direct HTTP/3
+
+| Test | Before | After |
+| --- | ---: | ---: |
+| Sequential 1 MiB ranges | 16.8 MiB/s | 16.8 MiB/s |
+| 16 concurrent streams | 27.8 MiB/s | 27.4 MiB/s |
+
+Before samples:
+
+- Sequential: 16.7, 16.8, 16.9 MiB/s
+- 16-stream: 28.1, 19.6, 27.8 MiB/s
+
+After samples:
+
+- Sequential: 16.5, 16.5, 17.1, 16.8, 17.0 MiB/s
+- 16-stream: 29.0, 27.2, 29.2, 27.4, 16.8 MiB/s
+
+### FSKit mount versus native I/O
+
+| Test | Before | After |
+| --- | ---: | ---: |
+| Random 4 KiB read | 1,250.1 us/op | 1,302.8 us/op |
+| Sequential `F_NOCACHE` | 13.2 MiB/s | 12.7 MiB/s |
+| Warm sequential | 17,944.1 MiB/s | 17,215.5 MiB/s |
+| `stat` | 0.8 us/op | 0.8 us/op |
+| `readdir` | 515.2 us/op | 524.4 us/op |
+| Recursive enumeration | 27,105 entries/s | 26,284 entries/s |
+| Small-file open + read | 2,437.7 IOPS | 2,318.8 IOPS |
+| Directory listing | 536.2 IOPS | 513.3 IOPS |
+
+A fresh-mount random-read scaling check after the change measured 768 IOPS
+with one worker and 1,869 IOPS with 16 workers, a 2.43x throughput increase.
+
+### Interpretation
+
+DispatchIO removes regular-file reads and byte copying from the serialized
+HTTP/3 connection actor. Routing operations such as `lstat` and directory
+enumeration run on a separate Dispatch queue. This prevents file I/O from
+stalling QUIC packet, ACK, and timeout processing, but it does not materially
+raise throughput: the before/after differences above are within run-to-run
+variance. The remaining performance ceiling is in the shared HTTP/3 packet
+pump rather than synchronous file reads.
+
+The after measurements also include reducing the per-datagram output buffer
+from 65,535 bytes to the configured 1,350-byte QUIC payload size. Without that
+change, 16-stream runs frequently collapsed to approximately 16--18 MiB/s.
diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
index 98c284e..3bc212d 100644
--- a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -1,3 +1,5 @@
+import Darwin
+import Dispatch
 import Foundation
 import GhostHTTP
 import Network
@@ -246,6 +248,20 @@ private actor GhostFileHTTP3ServerSession {
     private var isFlushing = false
     private var flushAgain = false
     private var hasStopped = false
+    private var responseTasks: [UInt64: Task] = [:]
+    private var terminatedRequestStreams: Set = []
+    private var pendingReceivedDatagrams: [Data] = []
+    private var isReceiveDrainScheduled = false
+
+    // GhostFile range requests are capped at 1 MiB. One DispatchIO operation per
+    // bounded range avoids re-entering the connection actor for artificial file
+    // chunks while independent HTTP/3 streams still read concurrently.
+    private static let fileReadChunkSize = GhostFileProtocol.maximumReadLength
+    private static let routingQueue = DispatchQueue(
+        label: "org.ghostvm.ghostfile.http3.routing",
+        qos: .userInitiated,
+        attributes: .concurrent
+    )
 
     init(
         connection: NWConnection,
@@ -305,23 +321,36 @@ private actor GhostFileHTTP3ServerSession {
             stopIsolated()
             return
         }
-        await received(content)
-        if !hasStopped {
-            receiveNextDatagram()
+        receiveNextDatagram()
+        pendingReceivedDatagrams.append(content)
+        guard !isReceiveDrainScheduled else { return }
+        isReceiveDrainScheduled = true
+        Task { [weak self] in
+            await Task.yield()
+            await self?.drainReceivedDatagrams()
         }
     }
 
-    private func received(_ datagram: Data) async {
-        guard !hasStopped else { return }
-        do {
-            try http3.receive(datagram)
-            try processEvents()
-            await flushOutgoing()
-            resetTimeout()
-        } catch {
-            NSLog("GhostFile HTTP/3 datagram failed: %@", String(describing: error))
-            stopIsolated()
+    private func drainReceivedDatagrams() async {
+        while !pendingReceivedDatagrams.isEmpty, !hasStopped {
+            let count = min(GhostFileNetworkDatagram.maximumReceiveCount, pendingReceivedDatagrams.count)
+            let datagrams = Array(pendingReceivedDatagrams.prefix(count))
+            pendingReceivedDatagrams.removeFirst(count)
+            do {
+                for datagram in datagrams {
+                    try http3.receive(datagram)
+                }
+                drainPeerTerminatedResponses()
+                try processEvents()
+                drainPeerTerminatedResponses()
+                await flushOutgoing()
+                resetTimeout()
+            } catch {
+                NSLog("GhostFile HTTP/3 datagram batch failed: %@", String(describing: error))
+                stopIsolated()
+            }
         }
+        isReceiveDrainScheduled = false
     }
 
     private func processEvents() throws {
@@ -335,14 +364,17 @@ private actor GhostFileHTTP3ServerSession {
                 }
                 let router = self.router
                 let delay = self.requestDelay
-                Task.detached(priority: .userInitiated) { [weak self] in
+                Task { [weak self] in
                     await delay(context)
-                    let response = router.route(request)
+                    let response = await Self.route(request, using: router)
                     await self?.send(response, streamID: streamID)
                 }
             case .data(let streamID):
                 _ = try http3.receiveBody(streamID: streamID)
-            case .finished, .reset:
+            case .reset(let streamID):
+                terminatedRequestStreams.insert(streamID)
+                cancelResponse(streamID: streamID)
+            case .finished:
                 break
             }
         }
@@ -360,20 +392,39 @@ private actor GhostFileHTTP3ServerSession {
         } catch { stopIsolated() }
     }
 
-    private func send(_ response: HTTPResponse, streamID: UInt64) async {
+    private func send(_ response: GhostFileHTTPResponse, streamID: UInt64) async {
         guard !hasStopped else { return }
+        guard terminatedRequestStreams.remove(streamID) == nil else { return }
         do {
-            let body = try Self.responseBodyData(response.body)
             var headers: [(String, String)] = [
                 (":status", String(response.status.rawValue)),
-                ("content-length", String(body.count)),
+                ("content-length", String(response.body.contentLength)),
             ]
             headers.append(contentsOf: response.headers.all.compactMap { entry in
                 let name = entry.name.lowercased()
                 guard name != "content-length", !name.hasPrefix(":") else { return nil }
                 return (name, entry.value)
             })
-            try http3.sendResponse(streamID: streamID, headers: headers, body: body)
+
+            switch response.body {
+            case .empty:
+                try http3.sendResponse(streamID: streamID, headers: headers, body: Data())
+            case .bytes(let body):
+                try http3.sendResponse(streamID: streamID, headers: headers, body: body)
+            case .fileRegion(let path, let identity, let offset, let length):
+                try http3.beginResponse(
+                    streamID: streamID,
+                    headers: headers,
+                    contentLength: length
+                )
+                startFileResponse(
+                    path: path,
+                    identity: identity,
+                    offset: offset,
+                    length: length,
+                    streamID: streamID
+                )
+            }
             requestCompleted()
             await flushOutgoing()
         } catch {
@@ -394,14 +445,24 @@ private actor GhostFileHTTP3ServerSession {
             repeat {
                 flushAgain = false
                 while true {
+                    let produceStartedAt = DispatchTime.now().uptimeNanoseconds
                     var datagrams: [Data] = []
                     datagrams.reserveCapacity(GhostFileNetworkDatagram.maximumSendBatchCount)
-                    while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount,
-                          let datagram = try http3.nextDatagram() {
+                    while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount {
+                        guard let datagram = try http3.nextDatagram() else { break }
                         datagrams.append(datagram)
+                        drainPeerTerminatedResponses()
                     }
+                    drainPeerTerminatedResponses()
                     guard !datagrams.isEmpty else { break }
+                    let produceFinishedAt = DispatchTime.now().uptimeNanoseconds
                     try await connection.sendGhostFileDatagrams(datagrams)
+                    let sendFinishedAt = DispatchTime.now().uptimeNanoseconds
+                    http3.recordSendBatch(
+                        packetCount: datagrams.count,
+                        produceNanoseconds: produceFinishedAt - produceStartedAt,
+                        networkNanoseconds: sendFinishedAt - produceFinishedAt
+                    )
                 }
             } while flushAgain
             resetTimeout()
@@ -433,6 +494,8 @@ private actor GhostFileHTTP3ServerSession {
         guard !hasStopped else { return }
         hasStopped = true
         timeoutTask?.cancel()
+        for task in responseTasks.values { task.cancel() }
+        responseTasks.removeAll()
         connection.cancel()
         stopped()
     }
@@ -467,35 +530,233 @@ private actor GhostFileHTTP3ServerSession {
         return GhostFileHTTPRequest(operation: operation, path: path, offset: offset, length: length)
     }
 
-    private nonisolated static func responseBodyData(_ body: HTTPResponseBody) throws -> Data {
-        switch body {
-        case .empty:
-            return Data()
-        case .bytes(let data):
-            return data
-        case .stream(let expectedLength, let producer):
-            let writer = GhostFileHTTP3BufferedWriter(capacity: expectedLength)
-            try producer(writer)
-            guard writer.data.count == expectedLength else { throw GhostFileHTTP3ServerError.incompleteBody }
-            return writer.data
+    private nonisolated static func route(
+        _ request: HTTPRequestHead,
+        using router: GhostFileShareRouter
+    ) async -> GhostFileHTTPResponse {
+        await withCheckedContinuation { continuation in
+            routingQueue.async {
+                continuation.resume(returning: router.route(request))
+            }
+        }
+    }
+
+    private func startFileResponse(
+        path: String,
+        identity: String,
+        offset: UInt64,
+        length: Int,
+        streamID: UInt64
+    ) {
+        let task = Task { [weak self] in
+            guard let self else { return }
+            do {
+                try await Self.produceFileResponse(
+                    path: path,
+                    identity: identity,
+                    offset: offset,
+                    length: length,
+                    sendChunk: { [weak self] data, isFinal in
+                        guard let self else { throw CancellationError() }
+                        try await self.sendFileChunk(data, isFinal: isFinal, streamID: streamID)
+                    }
+                )
+                await self.fileResponseFinished(streamID: streamID)
+            } catch is CancellationError {
+                await self.cancelResponse(streamID: streamID)
+            } catch {
+                await self.fileResponseFailed(error, streamID: streamID)
+            }
+        }
+        responseTasks[streamID] = task
+    }
+
+    private nonisolated static func produceFileResponse(
+        path: String,
+        identity: String,
+        offset: UInt64,
+        length: Int,
+        sendChunk: @escaping @Sendable (Data, Bool) async throws -> Void
+    ) async throws {
+        guard offset <= UInt64(Int64.max) else { throw POSIXError(.EOVERFLOW) }
+        let file = try await GhostFileDispatchIOFile.cached(path: path, identity: identity)
+
+        var currentOffset = offset
+        var remaining = length
+        while remaining > 0 {
+            try Task.checkCancellation()
+            let requestedLength = min(remaining, fileReadChunkSize)
+            let data = try await file.read(offset: currentOffset, length: requestedLength)
+            try Task.checkCancellation()
+            guard data.count == requestedLength else { throw POSIXError(.EIO) }
+            currentOffset += UInt64(data.count)
+            remaining -= data.count
+            try await sendChunk(data, remaining == 0)
+        }
+    }
+
+    private func sendFileChunk(_ data: Data, isFinal: Bool, streamID: UInt64) async throws {
+        guard !hasStopped, responseTasks[streamID] != nil else { throw CancellationError() }
+        try http3.appendResponseBody(streamID: streamID, data: data, isFinal: isFinal)
+        await flushOutgoing()
+        guard !hasStopped, responseTasks[streamID] != nil else { throw CancellationError() }
+    }
+
+    private func fileResponseFinished(streamID: UInt64) {
+        responseTasks.removeValue(forKey: streamID)
+    }
+
+    private func fileResponseFailed(_ error: Error, streamID: UInt64) async {
+        NSLog("GhostFile DispatchIO response failed on stream %llu: %@", streamID, String(describing: error))
+        cancelResponse(streamID: streamID, resetTransport: true)
+        await flushOutgoing()
+    }
+
+    private func cancelResponse(streamID: UInt64, resetTransport: Bool = false) {
+        responseTasks.removeValue(forKey: streamID)?.cancel()
+        if resetTransport {
+            http3.resetResponse(streamID: streamID)
+        } else {
+            http3.abandonResponse(streamID: streamID)
+        }
+    }
+
+    private func drainPeerTerminatedResponses() {
+        for streamID in http3.takePeerTerminatedResponseStreamIDs() {
+            terminatedRequestStreams.insert(streamID)
+            cancelResponse(streamID: streamID)
+        }
+        for streamID in http3.takeFailedResponseStreamIDs() {
+            terminatedRequestStreams.insert(streamID)
+            cancelResponse(streamID: streamID, resetTransport: true)
         }
     }
+
 }
 
-private final class GhostFileHTTP3BufferedWriter: HTTPBodyWriter {
-    private(set) var data: Data
+private final class GhostFileDispatchIOFile: @unchecked Sendable {
+    private static let callbackQueue = DispatchQueue(
+        label: "org.ghostvm.ghostfile.dispatch-io",
+        qos: .userInitiated,
+        attributes: .concurrent
+    )
+    private static let cacheMissQueue = DispatchQueue(
+        label: "org.ghostvm.ghostfile.dispatch-io.cache",
+        qos: .userInitiated
+    )
+    private static let cache: NSCache = {
+        let cache = NSCache()
+        cache.countLimit = 128
+        return cache
+    }()
+
+    private let channel: DispatchIO
+    private let cacheKey: NSString
+
+    static func cached(path: String, identity: String) async throws -> GhostFileDispatchIOFile {
+        let cacheKey = path + "\0" + identity
+        if let cached = cache.object(forKey: cacheKey as NSString) { return cached }
+        return try await withCheckedThrowingContinuation { continuation in
+            cacheMissQueue.async {
+                let key = cacheKey as NSString
+                if let cached = cache.object(forKey: key) {
+                    continuation.resume(returning: cached)
+                    return
+                }
+                do {
+                    let file = try GhostFileDispatchIOFile(path: path, cacheKey: key)
+                    cache.setObject(file, forKey: key)
+                    continuation.resume(returning: file)
+                } catch {
+                    continuation.resume(throwing: error)
+                }
+            }
+        }
+    }
 
-    init(capacity: Int) {
-        data = Data()
-        data.reserveCapacity(capacity)
+    init(path: String, cacheKey: NSString) throws {
+        guard let channel = path.withCString({ pathPointer in
+            DispatchIO(
+                type: .random,
+                path: pathPointer,
+                oflag: O_RDONLY,
+                mode: 0,
+                queue: Self.callbackQueue,
+                cleanupHandler: { _ in }
+            )
+        }) else {
+            throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO)
+        }
+        self.channel = channel
+        self.cacheKey = cacheKey
     }
 
-    func write(_ data: Data) throws { self.data.append(data) }
-    func write(_ buffer: UnsafeRawBufferPointer) throws {
-        data.append(buffer.bindMemory(to: UInt8.self))
+    func read(offset: UInt64, length: Int) async throws -> Data {
+        guard offset <= UInt64(Int64.max), length >= 0 else { throw POSIXError(.EOVERFLOW) }
+        do {
+            return try await withCheckedThrowingContinuation { continuation in
+                let operation = GhostFileDispatchIOReadOperation(
+                    expectedLength: length,
+                    continuation: continuation
+                )
+                channel.read(
+                    offset: off_t(offset),
+                    length: length,
+                    queue: Self.callbackQueue,
+                    ioHandler: operation.receive(done:data:error:)
+                )
+            }
+        } catch {
+            if Self.cache.object(forKey: cacheKey) === self {
+                Self.cache.removeObject(forKey: cacheKey)
+            }
+            throw error
+        }
     }
+
+    deinit { channel.close(flags: .stop) }
 }
 
-private enum GhostFileHTTP3ServerError: Error {
-    case incompleteBody
+private final class GhostFileDispatchIOReadOperation: @unchecked Sendable {
+    private let lock = NSLock()
+    private let expectedLength: Int
+    private var data = Data()
+    private var continuation: CheckedContinuation?
+
+    init(expectedLength: Int, continuation: CheckedContinuation) {
+        self.expectedLength = expectedLength
+        self.continuation = continuation
+        data.reserveCapacity(expectedLength)
+    }
+
+    func receive(done: Bool, data dispatchData: DispatchData?, error: Int32) {
+        let chunk = dispatchData.map { Data($0) } ?? Data()
+        var completion: CheckedContinuation?
+        var result: Result?
+
+        lock.lock()
+        if continuation != nil {
+            if error != 0 {
+                completion = continuation
+                continuation = nil
+                result = .failure(POSIXError(POSIXErrorCode(rawValue: error) ?? .EIO))
+            } else {
+                if done {
+                    completion = continuation
+                    continuation = nil
+                    if data.isEmpty, chunk.count == expectedLength {
+                        result = .success(chunk)
+                    } else {
+                        data.append(chunk)
+                        result = data.count == expectedLength ? .success(data) : .failure(POSIXError(.EIO))
+                    }
+                } else {
+                    data.append(chunk)
+                }
+            }
+        }
+        lock.unlock()
+
+        if let completion, let result { completion.resume(with: result) }
+    }
 }
diff --git a/macOS/GhostFile/GhostFileShareRouter.swift b/macOS/GhostFile/GhostFileShareRouter.swift
index 62427d7..92c89b1 100644
--- a/macOS/GhostFile/GhostFileShareRouter.swift
+++ b/macOS/GhostFile/GhostFileShareRouter.swift
@@ -2,6 +2,55 @@ import Foundation
 import Darwin
 import GhostHTTP
 
+struct GhostFileHTTPResponse: Sendable {
+    var status: HTTPStatus
+    var headers: HTTPHeaders
+    var body: GhostFileHTTPResponseBody
+
+    init(
+        status: HTTPStatus,
+        headers: HTTPHeaders = HTTPHeaders(),
+        body: GhostFileHTTPResponseBody = .empty
+    ) {
+        self.status = status
+        self.headers = headers
+        self.body = body
+    }
+
+    init(
+        status: HTTPStatus,
+        headers: [String: String],
+        body: GhostFileHTTPResponseBody = .empty
+    ) {
+        self.init(status: status, headers: HTTPHeaders(headers), body: body)
+    }
+
+    static func text(_ string: String, status: HTTPStatus = .ok) -> GhostFileHTTPResponse {
+        GhostFileHTTPResponse(
+            status: status,
+            headers: ["Content-Type": "text/plain; charset=utf-8"],
+            body: .bytes(Data(string.utf8))
+        )
+    }
+}
+
+enum GhostFileHTTPResponseBody: Sendable {
+    case empty
+    case bytes(Data)
+    case fileRegion(path: String, identity: String, offset: UInt64, length: Int)
+
+    var contentLength: Int {
+        switch self {
+        case .empty:
+            return 0
+        case .bytes(let data):
+            return data.count
+        case .fileRegion(_, _, _, let length):
+            return length
+        }
+    }
+}
+
 final class GhostFileShareRouter: @unchecked Sendable {
     let rootURL: URL
     let shareID: UUID
@@ -17,7 +66,7 @@ final class GhostFileShareRouter: @unchecked Sendable {
         self.resolvedRootURL = rootURL.resolvingSymlinksInPath().standardizedFileURL
     }
 
-    func route(_ request: HTTPRequestHead) -> HTTPResponse {
+    func route(_ request: HTTPRequestHead) -> GhostFileHTTPResponse {
         guard request.header("authorization") == "Bearer \(accessKey)" else {
             return responseError(.unauthorized, "A valid GhostFile access key is required")
         }
@@ -56,7 +105,7 @@ final class GhostFileShareRouter: @unchecked Sendable {
             case (.GET, "metadata"), (.HEAD, "metadata"):
                 let metadata = try fileMetadata(at: url, displayName: relativePath.isEmpty ? shareName : nil)
                 if request.method == .HEAD {
-                    return HTTPResponse(status: .ok, headers: ["ETag": metadata.etag])
+                    return GhostFileHTTPResponse(status: .ok, headers: ["ETag": metadata.etag])
                 }
                 return json(metadata, headers: ["ETag": metadata.etag])
 
@@ -78,7 +127,7 @@ final class GhostFileShareRouter: @unchecked Sendable {
                     return responseError(.badRequest, "Path is not a regular file")
                 }
                 guard metadata.size > 0 else {
-                    return HTTPResponse(
+                    return GhostFileHTTPResponse(
                         status: .ok,
                         headers: ["Accept-Ranges": "bytes", "ETag": metadata.etag],
                         body: .bytes(Data())
@@ -89,7 +138,7 @@ final class GhostFileShareRouter: @unchecked Sendable {
                     fileSize: metadata.size,
                     maximumLength: GhostFileProtocol.maximumReadLength
                 ) else {
-                    return HTTPResponse(
+                    return GhostFileHTTPResponse(
                         status: .rangeNotSatisfiable,
                         headers: ["Content-Range": "bytes */\(metadata.size)"]
                     )
@@ -188,9 +237,9 @@ final class GhostFileShareRouter: @unchecked Sendable {
         url: URL,
         metadata: GhostFileMetadata,
         byteRange: GhostFileByteRange
-    ) -> HTTPResponse {
+    ) -> GhostFileHTTPResponse {
         let end = byteRange.offset + UInt64(byteRange.length) - 1
-        return HTTPResponse(
+        return GhostFileHTTPResponse(
             status: .partialContent,
             headers: [
                 "Content-Type": "application/octet-stream",
@@ -198,26 +247,23 @@ final class GhostFileShareRouter: @unchecked Sendable {
                 "Content-Range": "bytes \(byteRange.offset)-\(end)/\(metadata.size)",
                 "ETag": metadata.etag,
             ],
-            body: .stream(contentLength: byteRange.length) { writer in
-                let handle = try FileHandle(forReadingFrom: url)
-                defer { try? handle.close() }
-                try handle.seek(toOffset: byteRange.offset)
-                var remaining = byteRange.length
-                while remaining > 0 {
-                    let data = try handle.read(upToCount: min(remaining, 64 * 1024)) ?? Data()
-                    guard !data.isEmpty else { throw POSIXError(.EIO) }
-                    try writer.write(data)
-                    remaining -= data.count
-                }
-            }
+            body: .fileRegion(
+                path: url.path,
+                identity: metadata.etag,
+                offset: byteRange.offset,
+                length: byteRange.length
+            )
         )
     }
 
-    private func json(_ value: T, headers: [String: String] = [:]) -> HTTPResponse {
+    private func json(
+        _ value: T,
+        headers: [String: String] = [:]
+    ) -> GhostFileHTTPResponse {
         do {
             var responseHeaders = headers
             responseHeaders["Content-Type"] = "application/json"
-            return HTTPResponse(
+            return GhostFileHTTPResponse(
                 status: .ok,
                 headers: responseHeaders,
                 body: .bytes(try JSONEncoder().encode(value))
@@ -227,9 +273,9 @@ final class GhostFileShareRouter: @unchecked Sendable {
         }
     }
 
-    private func responseError(_ status: HTTPStatus, _ message: String) -> HTTPResponse {
+    private func responseError(_ status: HTTPStatus, _ message: String) -> GhostFileHTTPResponse {
         let payload = (try? JSONEncoder().encode(GhostFileErrorPayload(error: message))) ?? Data()
-        return HTTPResponse(
+        return GhostFileHTTPResponse(
             status: status,
             headers: ["Content-Type": "application/json"],
             body: .bytes(payload)
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index cb797ba..d708927 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -126,6 +126,8 @@ actor GhostFileHTTP3Transport {
     private var pending: [UInt64: PendingResponse] = [:]
     private var isFlushing = false
     private var flushAgain = false
+    private var pendingReceivedDatagrams: [Data] = []
+    private var isReceiveDrainScheduled = false
 
     init(
         host: String,
@@ -224,9 +226,13 @@ actor GhostFileHTTP3Transport {
             fail(TransportError.closed)
             return
         }
-        await received(content)
-        if terminalError == nil {
-            receiveNextDatagram()
+        receiveNextDatagram()
+        pendingReceivedDatagrams.append(content)
+        guard !isReceiveDrainScheduled else { return }
+        isReceiveDrainScheduled = true
+        Task { [weak self] in
+            await Task.yield()
+            await self?.drainReceivedDatagrams()
         }
     }
 
@@ -247,25 +253,33 @@ actor GhostFileHTTP3Transport {
         }
     }
 
-    private func received(_ datagram: Data) async {
-        do {
-            try http3.receive(datagram)
-            if http3.isEstablished && !hasValidatedPeer {
-                guard let certificate = http3.peerCertificateDER(),
-                      Self.pin(for: certificate) == expectedCertificatePin else {
-                    throw TransportError.certificatePinMismatch
+    private func drainReceivedDatagrams() async {
+        while !pendingReceivedDatagrams.isEmpty, terminalError == nil {
+            let count = min(GhostFileNetworkDatagram.maximumReceiveCount, pendingReceivedDatagrams.count)
+            let datagrams = Array(pendingReceivedDatagrams.prefix(count))
+            pendingReceivedDatagrams.removeFirst(count)
+            do {
+                for datagram in datagrams {
+                    try http3.receive(datagram)
+                }
+                if http3.isEstablished && !hasValidatedPeer {
+                    guard let certificate = http3.peerCertificateDER(),
+                          Self.pin(for: certificate) == expectedCertificatePin else {
+                        throw TransportError.certificatePinMismatch
+                    }
+                    hasValidatedPeer = true
+                    let waiters = handshakeWaiters
+                    handshakeWaiters.removeAll()
+                    waiters.forEach { $0.resume() }
                 }
-                hasValidatedPeer = true
-                let waiters = handshakeWaiters
-                handshakeWaiters.removeAll()
-                waiters.forEach { $0.resume() }
+                try processEvents()
+                await flushOutgoing()
+                resetTimeout()
+            } catch {
+                fail(error)
             }
-            try processEvents()
-            await flushOutgoing()
-            resetTimeout()
-        } catch {
-            fail(error)
         }
+        isReceiveDrainScheduled = false
     }
 
     private func processEvents() throws {
@@ -310,6 +324,7 @@ actor GhostFileHTTP3Transport {
             repeat {
                 flushAgain = false
                 while true {
+                    let produceStartedAt = DispatchTime.now().uptimeNanoseconds
                     var datagrams: [Data] = []
                     datagrams.reserveCapacity(GhostFileNetworkDatagram.maximumSendBatchCount)
                     while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount,
@@ -317,7 +332,14 @@ actor GhostFileHTTP3Transport {
                         datagrams.append(datagram)
                     }
                     guard !datagrams.isEmpty else { break }
+                    let produceFinishedAt = DispatchTime.now().uptimeNanoseconds
                     try await connection.sendGhostFileDatagrams(datagrams)
+                    let sendFinishedAt = DispatchTime.now().uptimeNanoseconds
+                    http3.recordSendBatch(
+                        packetCount: datagrams.count,
+                        produceNanoseconds: produceFinishedAt - produceStartedAt,
+                        networkNanoseconds: sendFinishedAt - produceFinishedAt
+                    )
                 }
             } while flushAgain
             resetTimeout()
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index 8b04c6e..a8adad1 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -4,6 +4,16 @@ import GhostHTTP3
 import Network
 
 final class GhostFileHTTP3Connection: @unchecked Sendable {
+    private static let maximumUDPPayloadSize: Int = {
+        guard let rawValue = ProcessInfo.processInfo.environment["GHOSTFILE_HTTP3_UDP_PAYLOAD_SIZE"],
+              let value = Int(rawValue), (1_200...65_527).contains(value) else {
+            return 1_350
+        }
+        return value
+    }()
+    private static let diagnosticsEnabled =
+        ProcessInfo.processInfo.environment["GHOSTFILE_HTTP3_DIAGNOSTICS"] == "1"
+
     enum Role {
         case client(serverName: String)
         case server(certificatePath: String, privateKeyPath: String)
@@ -36,11 +46,35 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
     private var http3Connection: OpaquePointer?
     private var currentEvent: OpaquePointer?
     private var pendingResponses: [UInt64: PendingHTTP3Response] = [:]
+    private var peerTerminatedResponseStreamIDs: [UInt64] = []
+    private var failedResponseStreamIDs: [UInt64] = []
     private var localAddress = sockaddr_in()
     private var peerAddress = sockaddr_in()
+    private let diagnosticRole: String
+    private var diagnosticStartedAt = DispatchTime.now().uptimeNanoseconds
+    private var diagnosticPumpCalls = 0
+    private var diagnosticStreamVisits = 0
+    private var diagnosticBodyAttempts = 0
+    private var diagnosticBodyBlocked = 0
+    private var diagnosticBodyAcceptedBytes = 0
+    private var diagnosticNextDatagramCalls = 0
+    private var diagnosticDatagrams = 0
+    private var diagnosticDatagramBytes = 0
+    private var diagnosticSendDone = 0
+    private var diagnosticFuturePacingPackets = 0
+    private var diagnosticFuturePacingNanoseconds: UInt64 = 0
+    private var diagnosticMaximumPacingNanoseconds: UInt64 = 0
+    private var diagnosticBatches = 0
+    private var diagnosticBatchPackets = 0
+    private var diagnosticProduceNanoseconds: UInt64 = 0
+    private var diagnosticNetworkNanoseconds: UInt64 = 0
 
     init(role: Role) throws {
         self.role = role
+        switch role {
+        case .client: diagnosticRole = "client"
+        case .server: diagnosticRole = "server"
+        }
         guard let quicConfiguration = quiche_config_new(UInt32(QUICHE_PROTOCOL_VERSION)) else {
             throw ConnectionError.configuration("Unable to create the QUIC configuration")
         }
@@ -56,13 +90,16 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
             throw ConnectionError.configuration("Unable to configure the HTTP/3 ALPN")
         }
         quiche_config_set_max_idle_timeout(quicConfiguration, 60_000)
-        quiche_config_set_max_recv_udp_payload_size(quicConfiguration, 1_350)
-        quiche_config_set_max_send_udp_payload_size(quicConfiguration, 1_350)
+        quiche_config_set_max_recv_udp_payload_size(quicConfiguration, Self.maximumUDPPayloadSize)
+        quiche_config_set_max_send_udp_payload_size(quicConfiguration, Self.maximumUDPPayloadSize)
         quiche_config_set_initial_max_data(quicConfiguration, 64 * 1024 * 1024)
         quiche_config_set_initial_max_stream_data_bidi_local(quicConfiguration, 2 * 1024 * 1024)
         quiche_config_set_initial_max_stream_data_bidi_remote(quicConfiguration, 2 * 1024 * 1024)
         quiche_config_set_initial_max_stream_data_uni(quicConfiguration, 2 * 1024 * 1024)
-        quiche_config_set_initial_max_streams_bidi(quicConfiguration, 256)
+        // Each GhostFile content response is capped at 1 MiB. Keep the maximum
+        // number of concurrent request streams aligned with the 64 MiB
+        // connection window so application-side response buffering is bounded.
+        quiche_config_set_initial_max_streams_bidi(quicConfiguration, 64)
         quiche_config_set_initial_max_streams_uni(quicConfiguration, 16)
         quiche_config_set_disable_active_migration(quicConfiguration, true)
         quiche_h3_config_set_qpack_max_table_capacity(http3Configuration, 4_096)
@@ -169,8 +206,9 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
 
     func nextDatagram() throws -> Data? {
         guard let quicConnection else { return nil }
+        if Self.diagnosticsEnabled { diagnosticNextDatagramCalls += 1 }
         try pumpResponseBodies()
-        var output = Data(count: 65_535)
+        var output = Data(count: Self.maximumUDPPayloadSize)
         var sendInfo = quiche_send_info()
         let length = output.withUnsafeMutableBytes { bytes in
             Int(quiche_conn_send(
@@ -180,14 +218,100 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
                 &sendInfo
             ))
         }
-        if length == Int(QUICHE_ERR_DONE.rawValue) { return nil }
+        if length == Int(QUICHE_ERR_DONE.rawValue) {
+            if Self.diagnosticsEnabled { diagnosticSendDone += 1 }
+            return nil
+        }
         guard length > 0 else {
             throw ConnectionError.connection("QUIC could not produce a UDP datagram (\(length))")
         }
         output.count = length
+        if Self.diagnosticsEnabled {
+            diagnosticDatagrams += 1
+            diagnosticDatagramBytes += length
+            var now = timespec()
+            clock_gettime(CLOCK_MONOTONIC, &now)
+            let nowNanoseconds = Int64(now.tv_sec) * 1_000_000_000 + Int64(now.tv_nsec)
+            let sendNanoseconds = Int64(sendInfo.at.tv_sec) * 1_000_000_000 + Int64(sendInfo.at.tv_nsec)
+            if sendNanoseconds > nowNanoseconds {
+                let delay = UInt64(sendNanoseconds - nowNanoseconds)
+                diagnosticFuturePacingPackets += 1
+                diagnosticFuturePacingNanoseconds += delay
+                diagnosticMaximumPacingNanoseconds = max(diagnosticMaximumPacingNanoseconds, delay)
+            }
+        }
         return output
     }
 
+    func recordSendBatch(packetCount: Int, produceNanoseconds: UInt64, networkNanoseconds: UInt64) {
+        guard Self.diagnosticsEnabled else { return }
+        diagnosticBatches += 1
+        diagnosticBatchPackets += packetCount
+        diagnosticProduceNanoseconds += produceNanoseconds
+        diagnosticNetworkNanoseconds += networkNanoseconds
+
+        let now = DispatchTime.now().uptimeNanoseconds
+        guard now - diagnosticStartedAt >= 500_000_000, let quicConnection else { return }
+        var stats = quiche_stats()
+        quiche_conn_stats(quicConnection, &stats)
+        var path = quiche_path_stats()
+        let pathResult = quiche_conn_path_stats(quicConnection, 0, &path)
+        let elapsedMilliseconds = Double(now - diagnosticStartedAt) / 1_000_000
+        let averagePacingMicroseconds = diagnosticFuturePacingPackets == 0 ? 0 :
+            Double(diagnosticFuturePacingNanoseconds) / Double(diagnosticFuturePacingPackets) / 1_000
+        let message = String(format:
+            "GHOSTFILE_H3_DIAG role=%@ interval_ms=%.1f payload=%d batches=%d batch_packets=%d produce_ms=%.3f nw_wait_ms=%.3f datagrams=%d datagram_bytes=%d next_calls=%d send_done=%d pump_calls=%d stream_visits=%d body_attempts=%d body_blocked=%d body_accepted=%d pacing_future=%d pacing_avg_us=%.1f pacing_max_us=%.1f quic_sent=%zu quic_lost=%zu quic_retrans=%zu quic_lost_bytes=%llu flow_blocked=%llu stream_blocked=%llu path_ok=%d rtt_us=%.1f cwnd=%zu delivery_Bps=%llu pmtu=%zu",
+            diagnosticRole,
+            elapsedMilliseconds,
+            Self.maximumUDPPayloadSize,
+            diagnosticBatches,
+            diagnosticBatchPackets,
+            Double(diagnosticProduceNanoseconds) / 1_000_000,
+            Double(diagnosticNetworkNanoseconds) / 1_000_000,
+            diagnosticDatagrams,
+            diagnosticDatagramBytes,
+            diagnosticNextDatagramCalls,
+            diagnosticSendDone,
+            diagnosticPumpCalls,
+            diagnosticStreamVisits,
+            diagnosticBodyAttempts,
+            diagnosticBodyBlocked,
+            diagnosticBodyAcceptedBytes,
+            diagnosticFuturePacingPackets,
+            averagePacingMicroseconds,
+            Double(diagnosticMaximumPacingNanoseconds) / 1_000,
+            stats.sent,
+            stats.lost,
+            stats.retrans,
+            stats.lost_bytes,
+            stats.data_blocked_sent_count,
+            stats.stream_data_blocked_sent_count,
+            pathResult,
+            Double(path.rtt) / 1_000,
+            path.cwnd,
+            path.delivery_rate,
+            path.pmtu
+        )
+        NSLog("%@", message)
+        diagnosticStartedAt = now
+        diagnosticPumpCalls = 0
+        diagnosticStreamVisits = 0
+        diagnosticBodyAttempts = 0
+        diagnosticBodyBlocked = 0
+        diagnosticBodyAcceptedBytes = 0
+        diagnosticNextDatagramCalls = 0
+        diagnosticDatagrams = 0
+        diagnosticDatagramBytes = 0
+        diagnosticSendDone = 0
+        diagnosticFuturePacingPackets = 0
+        diagnosticFuturePacingNanoseconds = 0
+        diagnosticMaximumPacingNanoseconds = 0
+        diagnosticBatches = 0
+        diagnosticBatchPackets = 0
+        diagnosticProduceNanoseconds = 0
+        diagnosticNetworkNanoseconds = 0
+    }
+
     func peerCertificateDER() -> Data? {
         guard let quicConnection else { return nil }
         var pointer: UnsafePointer?
@@ -228,13 +352,69 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
     }
 
     func sendResponse(streamID: UInt64, headers: [(String, String)], body: Data) throws {
+        try beginResponse(streamID: streamID, headers: headers, contentLength: body.count)
+        guard !body.isEmpty else { return }
+        try appendResponseBody(streamID: streamID, data: body, isFinal: true)
+    }
+
+    func beginResponse(streamID: UInt64, headers: [(String, String)], contentLength: Int) throws {
         guard quicConnection != nil, http3Connection != nil else {
             throw ConnectionError.http3("The HTTP/3 connection is not ready")
         }
-        pendingResponses[streamID] = PendingHTTP3Response(headers: headers, body: body)
+        guard contentLength >= 0, pendingResponses[streamID] == nil else {
+            throw ConnectionError.http3("Invalid or duplicate HTTP/3 response")
+        }
+        pendingResponses[streamID] = PendingHTTP3Response(
+            headers: headers,
+            expectedBodyLength: contentLength
+        )
         try pumpResponses()
     }
 
+    func appendResponseBody(streamID: UInt64, data: Data, isFinal: Bool) throws {
+        guard var pending = pendingResponses[streamID] else {
+            throw ConnectionError.http3("No pending HTTP/3 response for stream \(streamID)")
+        }
+        guard !pending.inputFinished,
+              pending.receivedBodyLength <= pending.expectedBodyLength - data.count else {
+            throw ConnectionError.http3("HTTP/3 response body exceeded its declared length")
+        }
+        pending.append(data)
+        if isFinal {
+            guard pending.receivedBodyLength == pending.expectedBodyLength else {
+                throw ConnectionError.http3("Incomplete HTTP/3 response body")
+            }
+            pending.inputFinished = true
+        }
+        pendingResponses[streamID] = pending
+        try pumpResponses()
+    }
+
+    func abandonResponse(streamID: UInt64) {
+        pendingResponses.removeValue(forKey: streamID)
+    }
+
+    func resetResponse(streamID: UInt64, errorCode: UInt64 = 0x010c) {
+        pendingResponses.removeValue(forKey: streamID)
+        guard let quicConnection else { return }
+        _ = quiche_conn_stream_shutdown(
+            quicConnection,
+            streamID,
+            QUICHE_SHUTDOWN_WRITE,
+            errorCode
+        )
+    }
+
+    func takePeerTerminatedResponseStreamIDs() -> [UInt64] {
+        defer { peerTerminatedResponseStreamIDs.removeAll(keepingCapacity: true) }
+        return peerTerminatedResponseStreamIDs
+    }
+
+    func takeFailedResponseStreamIDs() -> [UInt64] {
+        defer { failedResponseStreamIDs.removeAll(keepingCapacity: true) }
+        return failedResponseStreamIDs
+    }
+
     func pollEvent() throws -> Event? {
         if let currentEvent {
             quiche_h3_event_free(currentEvent)
@@ -365,7 +545,9 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
 
     private func pumpResponses() throws {
         guard let quicConnection, let http3Connection, !pendingResponses.isEmpty else { return }
+        if Self.diagnosticsEnabled { diagnosticPumpCalls += 1 }
         for streamID in Array(pendingResponses.keys) {
+            if Self.diagnosticsEnabled { diagnosticStreamVisits += 1 }
             guard var pending = pendingResponses[streamID] else { continue }
             if !pending.headersSent {
                 let managedHeaders = ManagedHTTP3Headers(pending.headers)
@@ -376,7 +558,7 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
                         streamID,
                         headers,
                         count,
-                        pending.body.isEmpty
+                        pending.expectedBodyLength == 0
                     )
                 }
                 if result == Int32(QUICHE_H3_ERR_STREAM_BLOCKED.rawValue) ||
@@ -384,20 +566,28 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
                     pendingResponses[streamID] = pending
                     continue
                 }
+                if Self.isPeerTerminatedStreamError(Int(result)) {
+                    pendingResponses.removeValue(forKey: streamID)
+                    peerTerminatedResponseStreamIDs.append(streamID)
+                    continue
+                }
                 guard result == 0 else {
-                    throw ConnectionError.http3("Unable to send HTTP/3 response headers (\(result))")
+                    pendingResponses.removeValue(forKey: streamID)
+                    failedResponseStreamIDs.append(streamID)
+                    continue
                 }
                 pending.headersSent = true
-                if pending.body.isEmpty {
+                if pending.expectedBodyLength == 0 {
                     pendingResponses.removeValue(forKey: streamID)
                     continue
                 }
             }
-            while pending.offset < pending.data.count {
-                let offeredLength = min(16 * 1024, pending.data.count - pending.offset)
-                let isFinal = pending.offset + offeredLength == pending.data.count
-                let sent = pending.data.withUnsafeBytes { bytes -> Int in
-                    let base = bytes.bindMemory(to: UInt8.self).baseAddress?.advanced(by: pending.offset)
+            while let chunk = pending.currentChunk {
+                let offeredLength = min(16 * 1024, chunk.count - pending.chunkOffset)
+                let isFinal = pending.inputFinished &&
+                    pending.sentBodyLength + offeredLength == pending.expectedBodyLength
+                let sent = chunk.withUnsafeBytes { bytes -> Int in
+                    let base = bytes.bindMemory(to: UInt8.self).baseAddress?.advanced(by: pending.chunkOffset)
                     return Int(quiche_h3_send_body(
                         http3Connection,
                         quicConnection,
@@ -407,14 +597,32 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
                         isFinal
                     ))
                 }
+                if Self.diagnosticsEnabled {
+                    diagnosticBodyAttempts += 1
+                    if sent == Int(QUICHE_H3_ERR_DONE.rawValue) ||
+                        sent == Int(QUICHE_H3_ERR_STREAM_BLOCKED.rawValue) {
+                        diagnosticBodyBlocked += 1
+                    } else if sent > 0 {
+                        diagnosticBodyAcceptedBytes += sent
+                    }
+                }
                 if sent == Int(QUICHE_H3_ERR_DONE.rawValue) ||
                     sent == Int(QUICHE_H3_ERR_STREAM_BLOCKED.rawValue) { break }
+                if Self.isPeerTerminatedStreamError(sent) {
+                    pendingResponses.removeValue(forKey: streamID)
+                    peerTerminatedResponseStreamIDs.append(streamID)
+                    break
+                }
                 guard sent > 0 else {
-                    throw ConnectionError.http3("Unable to send the HTTP/3 response body (\(sent))")
+                    pendingResponses.removeValue(forKey: streamID)
+                    failedResponseStreamIDs.append(streamID)
+                    break
                 }
-                pending.offset += sent
+                pending.consume(sent)
             }
-            if pending.offset == pending.data.count {
+            if pendingResponses[streamID] == nil {
+                continue
+            } else if pending.inputFinished && pending.sentBodyLength == pending.expectedBodyLength {
                 pendingResponses.removeValue(forKey: streamID)
             } else {
                 pendingResponses[streamID] = pending
@@ -422,6 +630,14 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         }
     }
 
+    private static func isPeerTerminatedStreamError(_ value: Int) -> Bool {
+        value == Int(QUICHE_H3_ERR_REQUEST_CANCELLED.rawValue) ||
+            value == Int(QUICHE_H3_TRANSPORT_ERR_STREAM_STOPPED.rawValue) ||
+            value == Int(QUICHE_H3_TRANSPORT_ERR_STREAM_RESET.rawValue) ||
+            value == Int(QUICHE_H3_TRANSPORT_ERR_INVALID_STREAM_STATE.rawValue) ||
+            value == Int(QUICHE_H3_TRANSPORT_ERR_FINAL_SIZE.rawValue)
+    }
+
     private func withAddresses(
         _ body: (UnsafePointer, socklen_t, UnsafePointer, socklen_t) throws -> T
     ) rethrows -> T {
@@ -447,17 +663,42 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
 
 private struct PendingHTTP3Response {
     let headers: [(String, String)]
-    let body: Data
+    let expectedBodyLength: Int
     var headersSent = false
-    var offset: Int
-
-    init(headers: [(String, String)], body: Data) {
+    var chunks: [Data] = []
+    var chunkIndex = 0
+    var chunkOffset = 0
+    var receivedBodyLength = 0
+    var sentBodyLength = 0
+    var inputFinished: Bool
+
+    init(headers: [(String, String)], expectedBodyLength: Int) {
         self.headers = headers
-        self.body = body
-        self.offset = 0
+        self.expectedBodyLength = expectedBodyLength
+        self.inputFinished = expectedBodyLength == 0
+    }
+
+    var currentChunk: Data? {
+        chunkIndex < chunks.count ? chunks[chunkIndex] : nil
+    }
+
+    mutating func append(_ data: Data) {
+        guard !data.isEmpty else { return }
+        chunks.append(data)
+        receivedBodyLength += data.count
     }
 
-    var data: Data { body }
+    mutating func consume(_ count: Int) {
+        chunkOffset += count
+        sentBodyLength += count
+        guard let chunk = currentChunk, chunkOffset == chunk.count else { return }
+        chunkIndex += 1
+        chunkOffset = 0
+        if chunkIndex >= 8, chunkIndex * 2 >= chunks.count {
+            chunks.removeFirst(chunkIndex)
+            chunkIndex = 0
+        }
+    }
 }
 
 private final class HeaderCollectionBox {
@@ -520,7 +761,13 @@ private final class ManagedHTTP3Headers {
 enum GhostFileNetworkDatagram {
     // Amortize Network.framework callback and actor-hop overhead while keeping
     // both the send queue and the receive window explicitly bounded.
-    static let maximumSendBatchCount = 64
+    static let maximumSendBatchCount: Int = {
+        guard let rawValue = ProcessInfo.processInfo.environment["GHOSTFILE_HTTP3_SEND_BATCH_COUNT"],
+              let value = Int(rawValue), (1...1_024).contains(value) else {
+            return 64
+        }
+        return value
+    }()
     static let maximumReceiveCount = 64
 }
 
diff --git a/macOS/GhostFileTests/GhostFileProtocolTests.swift b/macOS/GhostFileTests/GhostFileProtocolTests.swift
index 1819183..34e15c4 100644
--- a/macOS/GhostFileTests/GhostFileProtocolTests.swift
+++ b/macOS/GhostFileTests/GhostFileProtocolTests.swift
@@ -121,17 +121,17 @@ final class GhostFileShareRouterTests: XCTestCase {
         "\(GhostFileProtocol.shareBasePath(id: shareID))/\(operation)?\(GhostFilePath.percentEncodedQuery(relativePath))"
     }
 
-    private func bodyData(_ response: HTTPResponse) throws -> Data {
+    private func bodyData(_ response: GhostFileHTTPResponse) throws -> Data {
         switch response.body {
         case .empty:
             return Data()
         case .bytes(let data):
             return data
-        case .stream(let expectedLength, let producer):
-            let writer = CollectingWriter()
-            try producer(writer)
-            XCTAssertEqual(writer.data.count, expectedLength)
-            return writer.data
+        case .fileRegion(let path, _, let offset, let length):
+            let handle = try FileHandle(forReadingFrom: URL(fileURLWithPath: path))
+            defer { try? handle.close() }
+            try handle.seek(toOffset: offset)
+            return try XCTUnwrap(handle.read(upToCount: length))
         }
     }
 }
@@ -143,15 +143,3 @@ final class GhostFileTLSIdentityTests: XCTestCase {
         XCTAssertFalse(identity.publicKeyPin.contains("="))
     }
 }
-
-private final class CollectingWriter: HTTPBodyWriter, @unchecked Sendable {
-    private(set) var data = Data()
-
-    func write(_ data: Data) throws {
-        self.data.append(data)
-    }
-
-    func write(_ buffer: UnsafeRawBufferPointer) throws {
-        data.append(buffer.bindMemory(to: UInt8.self))
-    }
-}

From 278049219229dc3724bc29eeace2567369112c21 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 31 Jul 2026 22:03:08 -0700
Subject: [PATCH 08/18] Optimize GhostFile small-file operations

---
 macOS/GhostFile/GhostFileShareRouter.swift    |  36 ++++-
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 146 +++++++++++++++++-
 macOS/GhostFileFS/GhostFileVolume.swift       |  62 ++++++--
 macOS/GhostFileShared/GhostFileProtocol.swift |  64 ++++++++
 .../GhostFileProtocolTests.swift              |  17 ++
 .../GhostFileQUICIntegrationTests.swift       |  38 +++++
 6 files changed, 343 insertions(+), 20 deletions(-)

diff --git a/macOS/GhostFile/GhostFileShareRouter.swift b/macOS/GhostFile/GhostFileShareRouter.swift
index 92c89b1..149c08b 100644
--- a/macOS/GhostFile/GhostFileShareRouter.swift
+++ b/macOS/GhostFile/GhostFileShareRouter.swift
@@ -114,12 +114,38 @@ final class GhostFileShareRouter: @unchecked Sendable {
                 let entries = try names.map { name in
                     try fileMetadata(at: url.appendingPathComponent(name, isDirectory: false))
                 }
+                var inlineContents: [GhostFileInlineContent] = []
+                var inlineByteCount = 0
+                for entry in entries where entry.type == .file
+                    && entry.size <= UInt64(GhostFileProtocol.maximumInlineFileLength) {
+                    guard inlineContents.count < GhostFileProtocol.maximumInlineDirectoryFileCount else {
+                        break
+                    }
+                    let length = Int(entry.size)
+                    guard inlineByteCount + length <= GhostFileProtocol.maximumInlineDirectoryLength else {
+                        continue
+                    }
+                    let childURL = url.appendingPathComponent(entry.name, isDirectory: false)
+                    let data = try Data(contentsOf: childURL, options: .mappedIfSafe)
+                    let currentMetadata = try fileMetadata(at: childURL)
+                    guard data.count == length, currentMetadata.etag == entry.etag else { continue }
+                    inlineContents.append(GhostFileInlineContent(
+                        name: entry.name,
+                        etag: entry.etag,
+                        data: data
+                    ))
+                    inlineByteCount += data.count
+                }
                 let listing = GhostFileDirectoryListing(
                     path: relativePath,
                     verifier: directoryVerifier(entries),
-                    entries: entries
+                    entries: entries,
+                    inlineContents: inlineContents.isEmpty ? nil : inlineContents
                 )
-                return json(listing, headers: ["ETag": "\"dir-\(String(listing.verifier, radix: 16))\""])
+                return json(listing, headers: [
+                    "Cache-Control": "private, max-age=5",
+                    "ETag": "\"dir-\(String(listing.verifier, radix: 16))\"",
+                ])
 
             case (.GET, "content"):
                 let metadata = try fileMetadata(at: url)
@@ -219,6 +245,12 @@ final class GhostFileShareRouter: @unchecked Sendable {
             objectID: objectID,
             modifiedSeconds: modifiedSeconds,
             modifiedNanoseconds: modifiedNanoseconds,
+            accessedSeconds: Int64(info.st_atimespec.tv_sec),
+            accessedNanoseconds: Int32(info.st_atimespec.tv_nsec),
+            changedSeconds: Int64(info.st_ctimespec.tv_sec),
+            changedNanoseconds: Int32(info.st_ctimespec.tv_nsec),
+            birthSeconds: Int64(info.st_birthtimespec.tv_sec),
+            birthNanoseconds: Int32(info.st_birthtimespec.tv_nsec),
             etag: "\"node-\(String(etagValue, radix: 16))\""
         )
     }
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index d708927..f370679 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -7,6 +7,7 @@ import Network
 
 struct GhostFileHTTP3Client: Sendable {
     private let transport: GhostFileHTTP3Transport
+    private let cache = GhostFileResponseCache()
 
     init(resourceURL: URL) throws {
         guard resourceURL.scheme == GhostFileProtocol.urlScheme,
@@ -34,18 +35,33 @@ struct GhostFileHTTP3Client: Sendable {
     }
 
     func metadata(path: String) async throws -> GhostFileMetadata {
-        try await decode(GhostFileMetadata.self, operation: "metadata", relativePath: path)
+        if let cached = await cache.metadata(path: path) { return cached }
+        let metadata = try await decode(GhostFileMetadata.self, operation: "metadata", relativePath: path)
+        await cache.store(metadata: metadata, path: path)
+        return metadata
     }
 
     func directory(path: String) async throws -> GhostFileDirectoryListing {
-        try await decode(GhostFileDirectoryListing.self, operation: "directory", relativePath: path)
+        if let cached = await cache.directory(path: path) { return cached }
+        let listing = try await decode(
+            GhostFileDirectoryListing.self,
+            operation: "directory",
+            relativePath: path
+        )
+        await cache.store(listing: listing, path: path)
+        return listing
     }
 
     func read(path: String, offset: UInt64, length: Int) async throws -> Data {
         guard length >= 0, length <= GhostFileProtocol.maximumReadLength else {
             throw fs_errorForPOSIXError(EINVAL)
         }
-        return try await request(operation: "content", relativePath: path, offset: offset, length: length)
+        if let cached = await cache.content(path: path, offset: offset, length: length) {
+            return cached
+        }
+        let data = try await request(operation: "content", relativePath: path, offset: offset, length: length)
+        await cache.storeRead(data: data, path: path, offset: offset)
+        return data
     }
 
     func readSymbolicLink(path: String) async throws -> String {
@@ -104,6 +120,130 @@ struct GhostFileHTTP3Client: Sendable {
     }
 }
 
+private actor GhostFileResponseCache {
+    private struct Entry: Sendable {
+        let value: Value
+        let storedAt: UInt64
+    }
+
+    private struct CachedContent: Sendable {
+        let data: Data
+        let etag: String
+    }
+
+    private static let metadataLifetime: UInt64 = 5_000_000_000
+    private static let directoryLifetime: UInt64 = 5_000_000_000
+    private static let contentLifetime: UInt64 = 5_000_000_000
+    private static let maximumMetadataCount = 32_768
+    private static let maximumDirectoryCount = 2_048
+    private static let maximumContentBytes = 64 * 1024 * 1024
+
+    private var metadataEntries: [String: Entry] = [:]
+    private var directoryEntries: [String: Entry] = [:]
+    private var contentEntries: [String: Entry] = [:]
+    private var contentBytes = 0
+
+    func metadata(path: String) -> GhostFileMetadata? {
+        fresh(metadataEntries[path], lifetime: Self.metadataLifetime)?.value
+    }
+
+    func directory(path: String) -> GhostFileDirectoryListing? {
+        fresh(directoryEntries[path], lifetime: Self.directoryLifetime)?.value
+    }
+
+    func content(path: String, offset: UInt64, length: Int) -> Data? {
+        guard let entry = fresh(contentEntries[path], lifetime: Self.contentLifetime) else {
+            removeContent(path: path)
+            return nil
+        }
+        if let metadata = fresh(metadataEntries[path], lifetime: Self.metadataLifetime)?.value,
+           metadata.etag != entry.value.etag {
+            removeContent(path: path)
+            return nil
+        }
+        guard offset <= UInt64(entry.value.data.count) else { return nil }
+        let start = Int(offset)
+        let end = min(entry.value.data.count, start + length)
+        return entry.value.data.subdata(in: start..(_ entry: Entry?, lifetime: UInt64) -> Entry? {
+        guard let entry, Self.now &- entry.storedAt <= lifetime else { return nil }
+        return entry
+    }
+
+    private func storeContent(_ data: Data, etag: String, path: String, storedAt: UInt64) {
+        if let previous = contentEntries[path] { contentBytes -= previous.value.data.count }
+        contentEntries[path] = Entry(value: CachedContent(data: data, etag: etag), storedAt: storedAt)
+        contentBytes += data.count
+    }
+
+    private func removeContent(path: String) {
+        if let removed = contentEntries.removeValue(forKey: path) {
+            contentBytes -= removed.value.data.count
+        }
+    }
+
+    private func trimMetadataIfNeeded() {
+        guard metadataEntries.count > Self.maximumMetadataCount else { return }
+        removeOldest(from: &metadataEntries, count: metadataEntries.count - Self.maximumMetadataCount)
+    }
+
+    private func trimDirectoriesIfNeeded() {
+        guard directoryEntries.count > Self.maximumDirectoryCount else { return }
+        removeOldest(from: &directoryEntries, count: directoryEntries.count - Self.maximumDirectoryCount)
+    }
+
+    private func trimContentIfNeeded() {
+        guard contentBytes > Self.maximumContentBytes else { return }
+        for (path, _) in contentEntries.sorted(by: { $0.value.storedAt < $1.value.storedAt }) {
+            removeContent(path: path)
+            if contentBytes <= Self.maximumContentBytes { break }
+        }
+    }
+
+    private func removeOldest(from entries: inout [String: Entry], count: Int) {
+        for key in entries.sorted(by: { $0.value.storedAt < $1.value.storedAt }).prefix(count).map(\.key) {
+            entries.removeValue(forKey: key)
+        }
+    }
+
+    private static var now: UInt64 { DispatchTime.now().uptimeNanoseconds }
+}
+
 actor GhostFileHTTP3Transport {
     struct Response: Sendable {
         let status: Int
diff --git a/macOS/GhostFileFS/GhostFileVolume.swift b/macOS/GhostFileFS/GhostFileVolume.swift
index 27df665..54cb8dc 100644
--- a/macOS/GhostFileFS/GhostFileVolume.swift
+++ b/macOS/GhostFileFS/GhostFileVolume.swift
@@ -69,7 +69,7 @@ final class GhostFileVolume: FSVolume, FSVolume.Operations, FSVolume.ReadWriteOp
         let item = try ghostItem(item)
         let metadata = try await client.metadata(path: item.relativePath)
         item.update(metadata: metadata)
-        return attributes(for: item)
+        return attributes(for: item, request: request)
     }
 
     func setAttributes(_ newAttributes: FSItem.SetAttributesRequest, on item: FSItem) async throws -> FSItem.Attributes {
@@ -186,7 +186,7 @@ final class GhostFileVolume: FSVolume, FSVolume.Operations, FSVolume.ReadWriteOp
                     itemType: itemType(metadata.type),
                     itemID: identifier(for: child),
                     nextCookie: FSDirectoryCookie(UInt64(cursor + 1)),
-                    attributes: requestedAttributes == nil ? nil : attributes(for: child)
+                    attributes: requestedAttributes.map { attributes(for: child, request: $0) }
                 )
             }
             guard packed else { break }
@@ -245,25 +245,57 @@ final class GhostFileVolume: FSVolume, FSVolume.Operations, FSVolume.ReadWriteOp
         itemLock.unlock()
     }
 
-    private func attributes(for item: GhostFileItem) -> FSItem.Attributes {
+    private func attributes(
+        for item: GhostFileItem,
+        request: FSItem.GetAttributesRequest? = nil
+    ) -> FSItem.Attributes {
         let metadata = item.metadata
         let result = FSItem.Attributes()
-        result.type = itemType(metadata.type)
-        result.mode = metadata.mode
-        result.uid = metadata.uid
-        result.gid = metadata.gid
-        result.linkCount = 1
-        result.size = metadata.size
-        result.allocSize = metadata.size
-        result.fileID = identifier(for: item)
-        result.parentID = item.parentID
-        result.modifyTime = timespec(
-            tv_sec: Int(metadata.modifiedSeconds),
-            tv_nsec: Int(metadata.modifiedNanoseconds)
+        func wanted(_ attribute: FSItem.Attribute) -> Bool {
+            request?.isAttributeWanted(attribute) ?? true
+        }
+        if wanted(.type) { result.type = itemType(metadata.type) }
+        if wanted(.mode) { result.mode = metadata.mode }
+        if wanted(.uid) { result.uid = metadata.uid }
+        if wanted(.gid) { result.gid = metadata.gid }
+        if wanted(.linkCount) { result.linkCount = 1 }
+        if wanted(.flags) { result.flags = 0 }
+        if wanted(.size) { result.size = metadata.size }
+        if wanted(.allocSize) { result.allocSize = metadata.size }
+        if wanted(.fileID) { result.fileID = identifier(for: item) }
+        if wanted(.parentID) { result.parentID = item.parentID }
+
+        let modifyTime = timestamp(
+            seconds: metadata.modifiedSeconds,
+            nanoseconds: metadata.modifiedNanoseconds
+        )
+        let accessTime = timestamp(
+            seconds: metadata.accessedSeconds ?? metadata.modifiedSeconds,
+            nanoseconds: metadata.accessedNanoseconds ?? metadata.modifiedNanoseconds
+        )
+        let changeTime = timestamp(
+            seconds: metadata.changedSeconds ?? metadata.modifiedSeconds,
+            nanoseconds: metadata.changedNanoseconds ?? metadata.modifiedNanoseconds
         )
+        let birthTime = timestamp(
+            seconds: metadata.birthSeconds ?? metadata.modifiedSeconds,
+            nanoseconds: metadata.birthNanoseconds ?? metadata.modifiedNanoseconds
+        )
+        if wanted(.modifyTime) { result.modifyTime = modifyTime }
+        if wanted(.accessTime) { result.accessTime = accessTime }
+        if wanted(.changeTime) { result.changeTime = changeTime }
+        if wanted(.birthTime) { result.birthTime = birthTime }
+        if wanted(.addedTime) { result.addedTime = birthTime }
+        if wanted(.backupTime) { result.backupTime = timespec() }
+        if wanted(.supportsLimitedXAttrs) { result.supportsLimitedXAttrs = false }
+        if wanted(.inhibitKernelOffloadedIO) { result.inhibitKernelOffloadedIO = false }
         return result
     }
 
+    private func timestamp(seconds: Int64, nanoseconds: Int32) -> timespec {
+        timespec(tv_sec: Int(seconds), tv_nsec: Int(nanoseconds))
+    }
+
     private func identifier(for item: GhostFileItem) -> FSItem.Identifier {
         item.relativePath.isEmpty ? .rootDirectory : identifier(for: item.metadata)
     }
diff --git a/macOS/GhostFileShared/GhostFileProtocol.swift b/macOS/GhostFileShared/GhostFileProtocol.swift
index e87200f..74018a9 100644
--- a/macOS/GhostFileShared/GhostFileProtocol.swift
+++ b/macOS/GhostFileShared/GhostFileProtocol.swift
@@ -8,6 +8,9 @@ enum GhostFileProtocol {
     static let alpn = "h3"
     static let transport = "http3"
     static let maximumReadLength = 1024 * 1024
+    static let maximumInlineFileLength = 64 * 1024
+    static let maximumInlineDirectoryLength = 512 * 1024
+    static let maximumInlineDirectoryFileCount = 256
 
     static func shareBasePath(id: UUID) -> String {
         "/v1/shares/\(id.uuidString.lowercased())"
@@ -47,13 +50,74 @@ struct GhostFileMetadata: Codable, Equatable, Sendable {
     let objectID: UInt64
     let modifiedSeconds: Int64
     let modifiedNanoseconds: Int32
+    let accessedSeconds: Int64?
+    let accessedNanoseconds: Int32?
+    let changedSeconds: Int64?
+    let changedNanoseconds: Int32?
+    let birthSeconds: Int64?
+    let birthNanoseconds: Int32?
     let etag: String
+
+    init(
+        name: String,
+        type: GhostFileNodeType,
+        size: UInt64,
+        mode: UInt32,
+        uid: UInt32,
+        gid: UInt32,
+        objectID: UInt64,
+        modifiedSeconds: Int64,
+        modifiedNanoseconds: Int32,
+        accessedSeconds: Int64? = nil,
+        accessedNanoseconds: Int32? = nil,
+        changedSeconds: Int64? = nil,
+        changedNanoseconds: Int32? = nil,
+        birthSeconds: Int64? = nil,
+        birthNanoseconds: Int32? = nil,
+        etag: String
+    ) {
+        self.name = name
+        self.type = type
+        self.size = size
+        self.mode = mode
+        self.uid = uid
+        self.gid = gid
+        self.objectID = objectID
+        self.modifiedSeconds = modifiedSeconds
+        self.modifiedNanoseconds = modifiedNanoseconds
+        self.accessedSeconds = accessedSeconds
+        self.accessedNanoseconds = accessedNanoseconds
+        self.changedSeconds = changedSeconds
+        self.changedNanoseconds = changedNanoseconds
+        self.birthSeconds = birthSeconds
+        self.birthNanoseconds = birthNanoseconds
+        self.etag = etag
+    }
 }
 
 struct GhostFileDirectoryListing: Codable, Equatable, Sendable {
     let path: String
     let verifier: UInt64
     let entries: [GhostFileMetadata]
+    let inlineContents: [GhostFileInlineContent]?
+
+    init(
+        path: String,
+        verifier: UInt64,
+        entries: [GhostFileMetadata],
+        inlineContents: [GhostFileInlineContent]? = nil
+    ) {
+        self.path = path
+        self.verifier = verifier
+        self.entries = entries
+        self.inlineContents = inlineContents
+    }
+}
+
+struct GhostFileInlineContent: Codable, Equatable, Sendable {
+    let name: String
+    let etag: String
+    let data: Data
 }
 
 struct GhostFileErrorPayload: Codable, Equatable, Sendable {
diff --git a/macOS/GhostFileTests/GhostFileProtocolTests.swift b/macOS/GhostFileTests/GhostFileProtocolTests.swift
index 34e15c4..588e79f 100644
--- a/macOS/GhostFileTests/GhostFileProtocolTests.swift
+++ b/macOS/GhostFileTests/GhostFileProtocolTests.swift
@@ -86,6 +86,23 @@ final class GhostFileShareRouterTests: XCTestCase {
         let listing = try JSONDecoder().decode(GhostFileDirectoryListing.self, from: bodyData(listingResponse))
         XCTAssertEqual(listing.entries.map(\.name), ["folder", "sample.txt"])
         XCTAssertNotEqual(listing.verifier, 0)
+        XCTAssertEqual(listing.inlineContents?.map(\.name), ["sample.txt"])
+        XCTAssertEqual(listing.inlineContents?.first?.data, Data("abcdefghij".utf8))
+        XCTAssertEqual(listing.inlineContents?.first?.etag, listing.entries.last?.etag)
+    }
+
+    func testDirectoryListingBoundsInlineContent() throws {
+        let oversized = Data(repeating: 0x41, count: GhostFileProtocol.maximumInlineFileLength + 1)
+        try oversized.write(to: directory.appendingPathComponent("oversized.bin"))
+
+        let listingResponse = router.route(request(
+            method: .GET,
+            path: operationPath("directory", relativePath: "")
+        ))
+        XCTAssertEqual(listingResponse.status, .ok)
+        let listing = try JSONDecoder().decode(GhostFileDirectoryListing.self, from: bodyData(listingResponse))
+        XCTAssertTrue(listing.entries.contains(where: { $0.name == "oversized.bin" }))
+        XCTAssertFalse(listing.inlineContents?.contains(where: { $0.name == "oversized.bin" }) ?? false)
     }
 
     func testRangeReadStreamsOnlyRequestedBytes() throws {
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index e471c81..2b67619 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -4,6 +4,44 @@ import XCTest
 @testable import GhostFile
 
 final class GhostFileHTTP3IntegrationTests: XCTestCase {
+    func testSmallFileInlineCacheExpiresAndRefreshes() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-cache-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        let fileURL = fixture.appendingPathComponent("tiny.txt")
+        try Data("before".utf8).write(to: fileURL)
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "quic-cache-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileCacheIntegration",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: loopbackResourceURL(shareURL: shareURL, accessKey: accessKey)
+        )
+        let listing = try await client.directory(path: "")
+        XCTAssertEqual(listing.inlineContents?.first(where: { $0.name == "tiny.txt" })?.data, Data("before".utf8))
+
+        try Data("after!".utf8).write(to: fileURL, options: .atomic)
+        let cachedContents = try await client.read(path: "tiny.txt", offset: 0, length: 64)
+        XCTAssertEqual(cachedContents, Data("before".utf8))
+
+        try await Task.sleep(for: .milliseconds(5_100))
+        let refreshed = try await client.metadata(path: "tiny.txt")
+        XCTAssertEqual(refreshed.size, 6)
+        let refreshedContents = try await client.read(path: "tiny.txt", offset: 0, length: 64)
+        XCTAssertEqual(refreshedContents, Data("after!".utf8))
+    }
+
     func testBulkTransferBenchmarkWhenRequested() async throws {
         let environment = ProcessInfo.processInfo.environment
         guard environment["GHOSTFILE_RUN_BULK_BENCHMARK"] == "1" else {

From a1ab9fd14f27775995f7deca7cb6c061843a08c5 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 16:15:10 -0700
Subject: [PATCH 09/18] Test HTTP/3 progress past a stalled stream

---
 macOS/GhostHTTP3/Tests/stress.c | 42 ++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/macOS/GhostHTTP3/Tests/stress.c b/macOS/GhostHTTP3/Tests/stress.c
index b377342..1244997 100644
--- a/macOS/GhostHTTP3/Tests/stress.c
+++ b/macOS/GhostHTTP3/Tests/stress.c
@@ -87,6 +87,7 @@ typedef struct {
     server_response responses[MAX_REQUESTS];
     size_t response_count;
     int64_t paused_stream;
+    int64_t blackholed_stream;
     bool paused_released;
     bool goaway_sent;
     size_t reset_count;
@@ -432,6 +433,13 @@ static void configure_server_response(server_state *state,
         response->seed = 0x71;
         return;
     }
+    if (strcmp(response->path, "/blackhole") == 0) {
+        state->blackholed_stream = (int64_t) response->stream_id;
+        // Model an application that accepted a request but never generated
+        // headers or a body. Other HTTP/3 streams must remain independent.
+        response->abandoned = true;
+        return;
+    }
     if (strcmp(response->path, "/empty") == 0) {
         response->body_length = 0;
         response->seed = 0;
@@ -774,7 +782,7 @@ int main(int argc, char **argv) {
     CHECK(ghost_http3_backend_is_ready(), "GhostHTTP3 backend is not ready");
 
     test_pair pair;
-    server_state server = {.paused_stream = -1};
+    server_state server = {.paused_stream = -1, .blackholed_stream = -1};
     client_state client = {0};
     pair_create(&pair, argv[1], argv[2]);
     printf("PASS handshake: TLS over QUIC negotiated ALPN h3\n");
@@ -815,6 +823,38 @@ int main(int argc, char **argv) {
                          "released paused request");
     printf("PASS stream resumption: paused request completed after release\n");
 
+    size_t blackholed = client_send(&pair, &client, "/blackhole", 0, 0,
+                                    false, false, false);
+    size_t after_blackhole_first = client.request_count;
+    for (unsigned i = 2000; i < 2016; i++) {
+        char path[64];
+        snprintf(path, sizeof(path), "/fast/%u", i);
+        client_send(&pair, &client, path, 257 + (i % 127), (uint8_t) i,
+                    false, false, false);
+    }
+    drive_until_finished(&pair, &server, &client, after_blackhole_first, 16,
+                         "requests after a black-holed stream");
+    CHECK(server.blackholed_stream ==
+              (int64_t) client.requests[blackholed].stream_id,
+          "server did not observe the black-holed stream");
+    CHECK(!client.requests[blackholed].saw_headers &&
+              !client.requests[blackholed].finished,
+          "black-holed request unexpectedly produced a response");
+    int cancel_blackhole = quiche_conn_stream_shutdown(
+        pair.client.quic, client.requests[blackholed].stream_id,
+        QUICHE_SHUTDOWN_READ, H3_REQUEST_CANCELLED_ERROR);
+    CHECK(cancel_blackhole == 0,
+          "could not cancel black-holed stream %" PRIu64 ": %d",
+          client.requests[blackholed].stream_id, cancel_blackhole);
+    client.requests[blackholed].cancellation_sent = true;
+    for (size_t round = 0; round < 32; round++) {
+        drive_round(&pair, &server, &client);
+    }
+    CHECK(!quiche_conn_is_closed(pair.client.quic) &&
+              !quiche_conn_is_closed(pair.server.quic),
+          "black-holed stream cancellation closed the connection");
+    printf("PASS black-holed stream: 16 later requests completed and the stalled stream was cancelled independently\n");
+
     size_t large_first = client.request_count;
     for (unsigned i = 0; i < LARGE_REQUEST_COUNT; i++) {
         char path[64];

From c8e254a7040f718c8e3adbed8e39ea41a548ceb1 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 16:44:32 -0700
Subject: [PATCH 10/18] Queue HTTP/3 requests until stream credit returns

---
 .../GhostFile/GhostFileHTTP3ShareServer.swift |  15 ++-
 macOS/GhostFileFS/GhostFileHTTPClient.swift   |  93 ++++++++++++++-
 macOS/GhostFileShared/GhostFileHTTP3.swift    |   5 +
 .../GhostFileQUICIntegrationTests.swift       | 107 ++++++++++++++++++
 4 files changed, 218 insertions(+), 2 deletions(-)

diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
index 3bc212d..15f80ba 100644
--- a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -52,6 +52,19 @@ final class GhostFileShareServer: ObservableObject {
         return components.url
     }
 
+#if DEBUG
+    var loopbackShareURLForTesting: URL? {
+        guard port != 0 else { return nil }
+        var components = URLComponents()
+        components.scheme = GhostFileProtocol.urlScheme
+        components.host = "127.0.0.1"
+        components.port = Int(port)
+        components.path = GhostFileProtocol.shareBasePath(id: shareID)
+        components.queryItems = [URLQueryItem(name: "tls_pin", value: publicKeyPin)]
+        return components.url
+    }
+#endif
+
     func start(preferredPort: UInt16 = 0) throws {
         guard listener == nil else { return }
         let router = GhostFileShareRouter(
@@ -101,7 +114,7 @@ final class GhostFileShareServer: ObservableObject {
             portTask = Task { [weak self, weak listener] in
                 for _ in 0..<500 {
                     guard let self, let listener else { return }
-                    if let boundPort = listener.port?.rawValue {
+                    if let boundPort = listener.port?.rawValue, boundPort != 0 {
                         self.port = boundPort
                         self.isRunning = true
                         self.publishBonjour(port: boundPort, values: txt)
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index f370679..d49ca2a 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -264,6 +264,8 @@ actor GhostFileHTTP3Transport {
     private var readyWaiters: [CheckedContinuation] = []
     private var handshakeWaiters: [CheckedContinuation] = []
     private var pending: [UInt64: PendingResponse] = [:]
+    private var streamCreditWaiters: [PendingStreamCredit] = []
+    private var reservedStreamCredits: UInt64 = 0
     private var isFlushing = false
     private var flushAgain = false
     private var pendingReceivedDatagrams: [Data] = []
@@ -293,6 +295,14 @@ actor GhostFileHTTP3Transport {
         length: Int?
     ) async throws -> Response {
         try await ensureHTTP3Ready()
+        try await acquireRequestStreamCredit()
+        do {
+            try Task.checkCancellation()
+            if let terminalError { throw terminalError }
+        } catch {
+            releaseReservedStreamCredit()
+            throw error
+        }
         var components = URLComponents()
         components.path = operationPath(operation)
         if let relativePath {
@@ -310,7 +320,15 @@ actor GhostFileHTTP3Transport {
         if let offset, let length, length > 0 {
             headers.append(("range", "bytes=\(offset)-\(offset + UInt64(length) - 1)"))
         }
-        let streamID = try http3.sendRequest(headers: headers)
+        let streamID: UInt64
+        do {
+            streamID = try http3.sendRequest(headers: headers)
+            releaseReservedStreamCredit()
+        } catch {
+            releaseReservedStreamCredit()
+            grantAvailableStreamCredits()
+            throw error
+        }
         return try await withCheckedThrowingContinuation { continuation in
             pending[streamID] = PendingResponse(continuation: continuation)
             Task { await self.flushOutgoing() }
@@ -413,6 +431,7 @@ actor GhostFileHTTP3Transport {
                     waiters.forEach { $0.resume() }
                 }
                 try processEvents()
+                grantAvailableStreamCredits()
                 await flushOutgoing()
                 resetTimeout()
             } catch {
@@ -452,6 +471,66 @@ actor GhostFileHTTP3Transport {
         }
     }
 
+    private func acquireRequestStreamCredit() async throws {
+        if unreservedStreamCreditCount > 0 {
+            reservedStreamCredits += 1
+            return
+        }
+
+        let waiterID = UUID()
+        try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { continuation in
+                let deadlineTask = Task { [weak self] in
+                    do {
+                        try await Task.sleep(for: .seconds(15))
+                        guard !Task.isCancelled else { return }
+                        await self?.streamCreditWaiterExpired(id: waiterID)
+                    } catch {}
+                }
+                streamCreditWaiters.append(PendingStreamCredit(
+                    id: waiterID,
+                    continuation: continuation,
+                    deadlineTask: deadlineTask
+                ))
+                grantAvailableStreamCredits()
+            }
+        } onCancel: {
+            Task { await self.cancelStreamCreditWaiter(id: waiterID) }
+        }
+    }
+
+    private var unreservedStreamCreditCount: UInt64 {
+        let available = http3.availableRequestStreamCount
+        return available > reservedStreamCredits ? available - reservedStreamCredits : 0
+    }
+
+    private func grantAvailableStreamCredits() {
+        while !streamCreditWaiters.isEmpty, unreservedStreamCreditCount > 0 {
+            let waiter = streamCreditWaiters.removeFirst()
+            reservedStreamCredits += 1
+            waiter.deadlineTask.cancel()
+            waiter.continuation.resume()
+        }
+    }
+
+    private func releaseReservedStreamCredit() {
+        precondition(reservedStreamCredits > 0, "Released HTTP/3 stream credit without a reservation")
+        reservedStreamCredits -= 1
+    }
+
+    private func cancelStreamCreditWaiter(id: UUID) {
+        guard let index = streamCreditWaiters.firstIndex(where: { $0.id == id }) else { return }
+        let waiter = streamCreditWaiters.remove(at: index)
+        waiter.deadlineTask.cancel()
+        waiter.continuation.resume(throwing: CancellationError())
+    }
+
+    private func streamCreditWaiterExpired(id: UUID) {
+        guard let index = streamCreditWaiters.firstIndex(where: { $0.id == id }) else { return }
+        let waiter = streamCreditWaiters.remove(at: index)
+        waiter.continuation.resume(throwing: TransportError.streamCreditTimedOut)
+    }
+
     private func flushOutgoing() async {
         if isFlushing {
             flushAgain = true
@@ -516,6 +595,11 @@ actor GhostFileHTTP3Transport {
         handshakeWaiters.removeAll()
         for response in pending.values { response.continuation.resume(throwing: error) }
         pending.removeAll()
+        for waiter in streamCreditWaiters {
+            waiter.deadlineTask.cancel()
+            waiter.continuation.resume(throwing: error)
+        }
+        streamCreditWaiters.removeAll()
         timeoutTask?.cancel()
         connection.cancel()
     }
@@ -534,10 +618,17 @@ actor GhostFileHTTP3Transport {
         var body = Data()
     }
 
+    private struct PendingStreamCredit {
+        let id: UUID
+        let continuation: CheckedContinuation
+        let deadlineTask: Task
+    }
+
     private enum TransportError: Error {
         case invalidResponse
         case certificatePinMismatch
         case streamReset
+        case streamCreditTimedOut
         case closed
     }
 }
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index a8adad1..f14ecb1 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -168,6 +168,11 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         return value == UInt64.max ? nil : value
     }
 
+    var availableRequestStreamCount: UInt64 {
+        guard let quicConnection else { return 0 }
+        return quiche_conn_peer_streams_left_bidi(quicConnection)
+    }
+
     func handleTimeout() {
         guard let quicConnection else { return }
         quiche_conn_on_timeout(quicConnection)
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index 2b67619..0a9c7b3 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -230,6 +230,86 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         await MainActor.run { server.stop() }
     }
 
+    func testRequestsWaitForHTTP3StreamCreditInsteadOfFailing() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-stream-credit-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("stream credit".utf8).write(to: fixture.appendingPathComponent("hello.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let gate = GhostFileRequestGate()
+        let accessKey = "quic-stream-credit-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3StreamCredit-\(UUID().uuidString)",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    guard request.operation == "metadata" else { return }
+                    await gate.wait()
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForLoopbackShareURL(server)
+        guard let portNumber = shareURL.port,
+              let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+              let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
+              let pin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value else {
+            throw TestError.missingShareURL
+        }
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: pin,
+            resourceBasePath: shareURL.path
+        )
+
+        _ = try await transport.request(
+            operation: "capabilities",
+            relativePath: nil,
+            offset: nil,
+            length: nil
+        )
+
+        let release = Task {
+            try await Task.sleep(for: .milliseconds(250))
+            await gate.open()
+        }
+        defer { release.cancel() }
+
+        let results = await withTaskGroup(of: Result.self) { group in
+            for _ in 0..<80 {
+                group.addTask {
+                    do {
+                        return .success(try await transport.request(
+                            operation: "metadata",
+                            relativePath: "hello.txt",
+                            offset: nil,
+                            length: nil
+                        ).status)
+                    } catch {
+                        return .failure(error)
+                    }
+                }
+            }
+            return await group.reduce(into: []) { $0.append($1) }
+        }
+
+        let statuses = results.compactMap { try? $0.get() }
+        let failures = results.compactMap { result -> String? in
+            guard case .failure(let error) = result else { return nil }
+            return String(describing: error)
+        }
+        XCTAssertEqual(failures, [], "Requests failed instead of waiting for HTTP/3 stream credit")
+        XCTAssertEqual(statuses.count, 80)
+        XCTAssertTrue(statuses.allSatisfy { $0 == 200 })
+    }
+
     private enum TestError: Error {
         case missingShareURL
         case responseMismatch
@@ -290,4 +370,31 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         }
         throw TestError.missingShareURL
     }
+
+    private func waitForLoopbackShareURL(_ server: GhostFileShareServer) async throws -> URL {
+        for _ in 0..<200 {
+            if let url = await MainActor.run(body: { server.loopbackShareURLForTesting }) {
+                return url
+            }
+            try await Task.sleep(for: .milliseconds(10))
+        }
+        throw TestError.missingShareURL
+    }
+}
+
+private actor GhostFileRequestGate {
+    private var isOpen = false
+    private var waiters: [CheckedContinuation] = []
+
+    func wait() async {
+        guard !isOpen else { return }
+        await withCheckedContinuation { waiters.append($0) }
+    }
+
+    func open() {
+        isOpen = true
+        let currentWaiters = waiters
+        waiters.removeAll()
+        currentWaiters.forEach { $0.resume() }
+    }
 }

From a8b2f1d61022ca5c4a2e0d859ab1f8fd931681ce Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 17:05:19 -0700
Subject: [PATCH 11/18] Cancel opened HTTP/3 requests with their callers

---
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 17 +++-
 macOS/GhostFileShared/GhostFileHTTP3.swift    | 16 ++++
 .../GhostFileQUICIntegrationTests.swift       | 94 +++++++++++++++++++
 3 files changed, 124 insertions(+), 3 deletions(-)

diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index d49ca2a..cbadadd 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -329,9 +329,13 @@ actor GhostFileHTTP3Transport {
             grantAvailableStreamCredits()
             throw error
         }
-        return try await withCheckedThrowingContinuation { continuation in
-            pending[streamID] = PendingResponse(continuation: continuation)
-            Task { await self.flushOutgoing() }
+        return try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { continuation in
+                pending[streamID] = PendingResponse(continuation: continuation)
+                Task { await self.flushOutgoing() }
+            }
+        } onCancel: {
+            Task { await self.cancelPendingRequest(streamID: streamID) }
         }
     }
 
@@ -585,6 +589,13 @@ actor GhostFileHTTP3Transport {
         if http3.isClosed { fail(TransportError.closed) }
     }
 
+    private func cancelPendingRequest(streamID: UInt64) async {
+        guard let response = pending.removeValue(forKey: streamID) else { return }
+        http3.cancelRequest(streamID: streamID)
+        response.continuation.resume(throwing: CancellationError())
+        await flushOutgoing()
+    }
+
     private func fail(_ error: Error) {
         guard terminalError == nil else { return }
         NSLog("GhostFile HTTP/3 transport failed: %@", String(describing: error))
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index f14ecb1..0c9dd97 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -356,6 +356,22 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         return UInt64(streamID)
     }
 
+    func cancelRequest(streamID: UInt64, errorCode: UInt64 = 0x010c) {
+        guard let quicConnection else { return }
+        _ = quiche_conn_stream_shutdown(
+            quicConnection,
+            streamID,
+            QUICHE_SHUTDOWN_READ,
+            errorCode
+        )
+        _ = quiche_conn_stream_shutdown(
+            quicConnection,
+            streamID,
+            QUICHE_SHUTDOWN_WRITE,
+            errorCode
+        )
+    }
+
     func sendResponse(streamID: UInt64, headers: [(String, String)], body: Data) throws {
         try beginResponse(streamID: streamID, headers: headers, contentLength: body.count)
         guard !body.isEmpty else { return }
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index 0a9c7b3..0044f4d 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -310,6 +310,81 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         XCTAssertTrue(statuses.allSatisfy { $0 == 200 })
     }
 
+    func testCancellingOpenedRequestFinishesPromptly() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-cancellation-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("cancel me".utf8).write(to: fixture.appendingPathComponent("cancel.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let gate = GhostFileRequestGate()
+        let accessKey = "quic-cancellation-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3Cancellation-\(UUID().uuidString)",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    guard request.operation == "metadata", request.path == "cancel.txt" else { return }
+                    await gate.wait()
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer {
+            Task {
+                await gate.open()
+                await MainActor.run { server.stop() }
+            }
+        }
+
+        let shareURL = try await waitForShareURL(server)
+        guard let portNumber = shareURL.port,
+              let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+              let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
+              let pin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value else {
+            throw TestError.missingShareURL
+        }
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: pin,
+            resourceBasePath: shareURL.path
+        )
+
+        let completed = expectation(description: "cancelled HTTP/3 request completed")
+        let requestTask = Task { () -> GhostFileCancellationOutcome in
+            defer { completed.fulfill() }
+            do {
+                _ = try await transport.request(
+                    operation: "metadata",
+                    relativePath: "cancel.txt",
+                    offset: nil,
+                    length: nil
+                )
+                return .succeeded
+            } catch is CancellationError {
+                return .cancelled
+            } catch {
+                return .failed(String(describing: error))
+            }
+        }
+
+        await gate.waitForArrival()
+        let clock = ContinuousClock()
+        let cancelledAt = clock.now
+        requestTask.cancel()
+        await fulfillment(of: [completed], timeout: 0.5)
+        let cancellationLatency = cancelledAt.duration(to: clock.now)
+
+        await gate.open()
+        let outcome = await requestTask.value
+        XCTAssertEqual(outcome, .cancelled)
+        XCTAssertLessThan(cancellationLatency, .milliseconds(500))
+    }
+
     private enum TestError: Error {
         case missingShareURL
         case responseMismatch
@@ -384,13 +459,26 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
 
 private actor GhostFileRequestGate {
     private var isOpen = false
+    private var hasArrival = false
     private var waiters: [CheckedContinuation] = []
+    private var arrivalWaiters: [CheckedContinuation] = []
 
     func wait() async {
+        if !hasArrival {
+            hasArrival = true
+            let currentArrivalWaiters = arrivalWaiters
+            arrivalWaiters.removeAll()
+            currentArrivalWaiters.forEach { $0.resume() }
+        }
         guard !isOpen else { return }
         await withCheckedContinuation { waiters.append($0) }
     }
 
+    func waitForArrival() async {
+        guard !hasArrival else { return }
+        await withCheckedContinuation { arrivalWaiters.append($0) }
+    }
+
     func open() {
         isOpen = true
         let currentWaiters = waiters
@@ -398,3 +486,9 @@ private actor GhostFileRequestGate {
         currentWaiters.forEach { $0.resume() }
     }
 }
+
+private enum GhostFileCancellationOutcome: Equatable {
+    case succeeded
+    case cancelled
+    case failed(String)
+}

From ce2efcacea797eed19eccd24dafee1e4f43d0133 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 17:21:09 -0700
Subject: [PATCH 12/18] Cancel HTTP/3 readiness waits with their callers

---
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 54 ++++++++++++---
 .../GhostFileQUICIntegrationTests.swift       | 65 +++++++++++++++++++
 2 files changed, 109 insertions(+), 10 deletions(-)

diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index cbadadd..002436d 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -261,8 +261,8 @@ actor GhostFileHTTP3Transport {
     private var isNetworkReady = false
     private var hasValidatedPeer = false
     private var terminalError: Error?
-    private var readyWaiters: [CheckedContinuation] = []
-    private var handshakeWaiters: [CheckedContinuation] = []
+    private var readyWaiters: [UUID: CheckedContinuation] = [:]
+    private var handshakeWaiters: [UUID: CheckedContinuation] = [:]
     private var pending: [UInt64: PendingResponse] = [:]
     private var streamCreditWaiters: [PendingStreamCredit] = []
     private var reservedStreamCredits: UInt64 = 0
@@ -347,16 +347,46 @@ actor GhostFileHTTP3Transport {
     }
 
     private func ensureHTTP3Ready() async throws {
+        try Task.checkCancellation()
         if let terminalError { throw terminalError }
         if !hasStarted { start() }
-        if !isNetworkReady {
-            try await withCheckedThrowingContinuation { readyWaiters.append($0) }
+        try await waitForNetworkReady()
+        try Task.checkCancellation()
+        try await waitForValidatedPeer()
+    }
+
+    private func waitForNetworkReady() async throws {
+        guard !isNetworkReady else { return }
+        let waiterID = UUID()
+        try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { continuation in
+                readyWaiters[waiterID] = continuation
+            }
+        } onCancel: {
+            Task { await self.cancelNetworkReadyWaiter(id: waiterID) }
         }
-        if !hasValidatedPeer {
-            try await withCheckedThrowingContinuation { handshakeWaiters.append($0) }
+    }
+
+    private func waitForValidatedPeer() async throws {
+        guard !hasValidatedPeer else { return }
+        let waiterID = UUID()
+        try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { continuation in
+                handshakeWaiters[waiterID] = continuation
+            }
+        } onCancel: {
+            Task { await self.cancelHandshakeWaiter(id: waiterID) }
         }
     }
 
+    private func cancelNetworkReadyWaiter(id: UUID) {
+        readyWaiters.removeValue(forKey: id)?.resume(throwing: CancellationError())
+    }
+
+    private func cancelHandshakeWaiter(id: UUID) {
+        handshakeWaiters.removeValue(forKey: id)?.resume(throwing: CancellationError())
+    }
+
     private func start() {
         guard !hasStarted else { return }
         hasStarted = true
@@ -404,7 +434,7 @@ actor GhostFileHTTP3Transport {
             isNetworkReady = true
             let waiters = readyWaiters
             readyWaiters.removeAll()
-            waiters.forEach { $0.resume() }
+            waiters.values.forEach { $0.resume() }
             await flushOutgoing()
         case .failed(let error):
             fail(error)
@@ -432,7 +462,7 @@ actor GhostFileHTTP3Transport {
                     hasValidatedPeer = true
                     let waiters = handshakeWaiters
                     handshakeWaiters.removeAll()
-                    waiters.forEach { $0.resume() }
+                    waiters.values.forEach { $0.resume() }
                 }
                 try processEvents()
                 grantAvailableStreamCredits()
@@ -600,8 +630,8 @@ actor GhostFileHTTP3Transport {
         guard terminalError == nil else { return }
         NSLog("GhostFile HTTP/3 transport failed: %@", String(describing: error))
         terminalError = error
-        readyWaiters.forEach { $0.resume(throwing: error) }
-        handshakeWaiters.forEach { $0.resume(throwing: error) }
+        readyWaiters.values.forEach { $0.resume(throwing: error) }
+        handshakeWaiters.values.forEach { $0.resume(throwing: error) }
         readyWaiters.removeAll()
         handshakeWaiters.removeAll()
         for response in pending.values { response.continuation.resume(throwing: error) }
@@ -615,6 +645,10 @@ actor GhostFileHTTP3Transport {
         connection.cancel()
     }
 
+    func invalidateForTesting() {
+        fail(TransportError.closed)
+    }
+
     private nonisolated static func pin(for bytes: Data) -> String {
         let digest = SHA256.hash(data: bytes)
         return Data(digest).base64EncodedString()
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index 0044f4d..5639338 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -4,6 +4,71 @@ import XCTest
 @testable import GhostFile
 
 final class GhostFileHTTP3IntegrationTests: XCTestCase {
+    func testCancellingRequestDuringQUICHandshakeFinishesPromptly() async throws {
+        let queue = DispatchQueue(label: "org.ghostvm.ghostfile.tests.cancel-handshake-udp")
+        let listener = try NWListener(using: .udp, on: .any)
+        let ready = expectation(description: "silent UDP listener ready")
+        let receivedInitialDatagram = expectation(description: "silent peer received initial QUIC datagram")
+        listener.stateUpdateHandler = { state in
+            if case .ready = state { ready.fulfill() }
+        }
+        listener.newConnectionHandler = { connection in
+            // A UDP listener creates this flow only after the client's first
+            // datagram arrives. Keep the peer silent so the QUIC handshake
+            // remains pending at a deterministic cancellation point.
+            receivedInitialDatagram.fulfill()
+            connection.start(queue: queue)
+        }
+        listener.start(queue: queue)
+        defer { listener.cancel() }
+        await fulfillment(of: [ready], timeout: 2)
+        guard let port = listener.port else { throw TestError.missingShareURL }
+
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: "cancel-handshake-test",
+            publicKeyPin: "not-a-real-pin",
+            resourceBasePath: "/v1/shares/00000000-0000-0000-0000-000000000001"
+        )
+
+        let completed = expectation(description: "handshake-waiting request completed after cancellation")
+        let requestTask = Task { () -> GhostFileCancellationOutcome in
+            defer { completed.fulfill() }
+            do {
+                _ = try await transport.request(
+                    operation: "capabilities",
+                    relativePath: nil,
+                    offset: nil,
+                    length: nil
+                )
+                return .succeeded
+            } catch is CancellationError {
+                return .cancelled
+            } catch {
+                return .failed(String(describing: error))
+            }
+        }
+
+        await fulfillment(of: [receivedInitialDatagram], timeout: 2)
+        let clock = ContinuousClock()
+        let cancelledAt = clock.now
+        requestTask.cancel()
+        await fulfillment(of: [completed], timeout: 0.5)
+        let cancellationLatency = cancelledAt.duration(to: clock.now)
+
+        // Unblock the deliberately broken implementation after the timeout
+        // assertion instead of waiting for the QUIC idle timeout.
+        await transport.invalidateForTesting()
+        let outcome = await requestTask.value
+        XCTAssertEqual(outcome, .cancelled)
+        XCTAssertLessThan(
+            cancellationLatency,
+            .milliseconds(500),
+            "Caller cancellation remained stuck in QUIC handshake readiness"
+        )
+    }
+
     func testSmallFileInlineCacheExpiresAndRefreshes() async throws {
         let fixture = FileManager.default.temporaryDirectory
             .appendingPathComponent("ghostfile-cache-tests-\(UUID().uuidString)", isDirectory: true)

From 7ce9b3b034e756c30c7d59fc17754a67222137fa Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 18:28:38 -0700
Subject: [PATCH 13/18] Cancel server routing for abandoned HTTP/3 streams

---
 .../GhostFile/GhostFileHTTP3ShareServer.swift | 34 +++++++-
 macOS/GhostFileShared/GhostFileHTTP3.swift    |  6 ++
 .../GhostFileQUICIntegrationTests.swift       | 83 +++++++++++++++++++
 macOS/GhostHTTP3/Tests/stress.c               |  6 ++
 4 files changed, 127 insertions(+), 2 deletions(-)

diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
index 15f80ba..cbdd53f 100644
--- a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -261,6 +261,7 @@ private actor GhostFileHTTP3ServerSession {
     private var isFlushing = false
     private var flushAgain = false
     private var hasStopped = false
+    private var routingTasks: [UInt64: Task] = [:]
     private var responseTasks: [UInt64: Task] = [:]
     private var terminatedRequestStreams: Set = []
     private var pendingReceivedDatagrams: [Data] = []
@@ -377,11 +378,20 @@ private actor GhostFileHTTP3ServerSession {
                 }
                 let router = self.router
                 let delay = self.requestDelay
-                Task { [weak self] in
+                let task = Task { [weak self] in
                     await delay(context)
+                    guard !Task.isCancelled else {
+                        await self?.routingCancelled(streamID: streamID)
+                        return
+                    }
                     let response = await Self.route(request, using: router)
-                    await self?.send(response, streamID: streamID)
+                    guard !Task.isCancelled else {
+                        await self?.routingCancelled(streamID: streamID)
+                        return
+                    }
+                    await self?.routingFinished(response, streamID: streamID)
                 }
+                routingTasks[streamID] = task
             case .data(let streamID):
                 _ = try http3.receiveBody(streamID: streamID)
             case .reset(let streamID):
@@ -507,6 +517,8 @@ private actor GhostFileHTTP3ServerSession {
         guard !hasStopped else { return }
         hasStopped = true
         timeoutTask?.cancel()
+        for task in routingTasks.values { task.cancel() }
+        routingTasks.removeAll()
         for task in responseTasks.values { task.cancel() }
         responseTasks.removeAll()
         connection.cancel()
@@ -584,6 +596,18 @@ private actor GhostFileHTTP3ServerSession {
         responseTasks[streamID] = task
     }
 
+    private func routingCancelled(streamID: UInt64) {
+        routingTasks.removeValue(forKey: streamID)
+        terminatedRequestStreams.remove(streamID)
+    }
+
+    private func routingFinished(_ response: GhostFileHTTPResponse, streamID: UInt64) async {
+        guard routingTasks.removeValue(forKey: streamID) != nil,
+              !hasStopped,
+              !terminatedRequestStreams.contains(streamID) else { return }
+        await send(response, streamID: streamID)
+    }
+
     private nonisolated static func produceFileResponse(
         path: String,
         identity: String,
@@ -626,6 +650,7 @@ private actor GhostFileHTTP3ServerSession {
     }
 
     private func cancelResponse(streamID: UInt64, resetTransport: Bool = false) {
+        routingTasks.removeValue(forKey: streamID)?.cancel()
         responseTasks.removeValue(forKey: streamID)?.cancel()
         if resetTransport {
             http3.resetResponse(streamID: streamID)
@@ -635,6 +660,11 @@ private actor GhostFileHTTP3ServerSession {
     }
 
     private func drainPeerTerminatedResponses() {
+        for streamID in Array(routingTasks.keys)
+            where http3.peerStoppedReceivingResponse(streamID: streamID) {
+            terminatedRequestStreams.insert(streamID)
+            cancelResponse(streamID: streamID)
+        }
         for streamID in http3.takePeerTerminatedResponseStreamIDs() {
             terminatedRequestStreams.insert(streamID)
             cancelResponse(streamID: streamID)
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index 0c9dd97..24676cd 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -436,6 +436,12 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         return failedResponseStreamIDs
     }
 
+    func peerStoppedReceivingResponse(streamID: UInt64) -> Bool {
+        guard let quicConnection else { return false }
+        return quiche_conn_stream_capacity(quicConnection, streamID) ==
+            Int(QUICHE_ERR_STREAM_STOPPED.rawValue)
+    }
+
     func pollEvent() throws -> Event? {
         if let currentEvent {
             quiche_h3_event_free(currentEvent)
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index 5639338..36294e6 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -450,6 +450,89 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         XCTAssertLessThan(cancellationLatency, .milliseconds(500))
     }
 
+    func testCancellingOpenedRequestCancelsServerRoutingWithoutBlockingSibling() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-server-cancellation-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("cancel me".utf8).write(to: fixture.appendingPathComponent("cancel.txt"))
+        try Data("still responsive".utf8).write(to: fixture.appendingPathComponent("sibling.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let gate = GhostFileRequestGate()
+        let serverRoutingCancelled = expectation(description: "server routing task cancelled after peer reset")
+        let accessKey = "quic-server-cancellation-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3ServerCancellation-\(UUID().uuidString)",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    guard request.operation == "metadata", request.path == "cancel.txt" else { return }
+                    await withTaskCancellationHandler {
+                        await gate.wait()
+                    } onCancel: {
+                        serverRoutingCancelled.fulfill()
+                    }
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer {
+            Task {
+                await gate.open()
+                await MainActor.run { server.stop() }
+            }
+        }
+
+        let shareURL = try await waitForLoopbackShareURL(server)
+        guard let portNumber = shareURL.port,
+              let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+              let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
+              let pin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value else {
+            throw TestError.missingShareURL
+        }
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: pin,
+            resourceBasePath: shareURL.path
+        )
+
+        let slowRequest = Task { () -> GhostFileCancellationOutcome in
+            do {
+                _ = try await transport.request(
+                    operation: "metadata",
+                    relativePath: "cancel.txt",
+                    offset: nil,
+                    length: nil
+                )
+                return .succeeded
+            } catch is CancellationError {
+                return .cancelled
+            } catch {
+                return .failed(String(describing: error))
+            }
+        }
+
+        await gate.waitForArrival()
+        slowRequest.cancel()
+        let slowOutcome = await slowRequest.value
+        XCTAssertEqual(slowOutcome, .cancelled)
+
+        let sibling = try await transport.request(
+            operation: "metadata",
+            relativePath: "sibling.txt",
+            offset: nil,
+            length: nil
+        )
+        XCTAssertEqual(sibling.status, 200)
+
+        await fulfillment(of: [serverRoutingCancelled], timeout: 0.5)
+        await gate.open()
+    }
+
     private enum TestError: Error {
         case missingShareURL
         case responseMismatch
diff --git a/macOS/GhostHTTP3/Tests/stress.c b/macOS/GhostHTTP3/Tests/stress.c
index 1244997..bc1803d 100644
--- a/macOS/GhostHTTP3/Tests/stress.c
+++ b/macOS/GhostHTTP3/Tests/stress.c
@@ -850,6 +850,12 @@ int main(int argc, char **argv) {
     for (size_t round = 0; round < 32; round++) {
         drive_round(&pair, &server, &client);
     }
+    ssize_t stopped_capacity = quiche_conn_stream_capacity(
+        pair.server.quic, client.requests[blackholed].stream_id);
+    CHECK(stopped_capacity == QUICHE_ERR_STREAM_STOPPED,
+          "server did not observe STOP_SENDING for cancelled stream %" PRIu64
+          ": %zd",
+          client.requests[blackholed].stream_id, stopped_capacity);
     CHECK(!quiche_conn_is_closed(pair.client.quic) &&
               !quiche_conn_is_closed(pair.server.quic),
           "black-holed stream cancellation closed the connection");

From f12621b6c67d7ea5690a0963ceafcdc964498a22 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 21:31:16 -0700
Subject: [PATCH 14/18] Harden GhostFile mounts over QUIC

---
 Makefile                                      |  95 ++-
 .../Sources/GhostHTTP/GhostHTTP.swift         |   8 +-
 .../Tests/GhostHTTPTests/GhostHTTPTests.swift |  26 +
 macOS/GhostFile/GhostFileContentView.swift    |  61 +-
 macOS/GhostFile/GhostFileDiscovery.swift      | 103 +++-
 .../GhostFile/GhostFileHTTP3ShareServer.swift | 533 +++++++++++++++--
 macOS/GhostFile/GhostFileMountManager.swift   | 358 +++++++++++-
 .../GhostFile/GhostFileShareController.swift  |  42 ++
 macOS/GhostFile/Info.plist                    |   4 +-
 macOS/GhostFile/NotarizeOptions.plist         |  12 +
 macOS/GhostFileFS/GhostFileHTTPClient.swift   | 475 +++++++++++++--
 macOS/GhostFileFS/GhostFileSystem.swift       |   8 +-
 macOS/GhostFileFS/Info.plist                  |   4 +-
 macOS/GhostFileShared/GhostFileHTTP3.swift    | 125 +++-
 macOS/GhostFileShared/GhostFileProtocol.swift |  16 +
 .../GhostFileProtocolTests.swift              |  48 ++
 .../GhostFileQUICIntegrationTests.swift       | 539 +++++++++++++++++-
 .../Patches/quiche-darwin-send-time.patch     |  41 ++
 macOS/GhostHTTP3/Tests/stress.c               |  26 +
 macOS/GhostHTTP3/scripts/build-framework.sh   |  16 +
 macOS/GhostHTTP3/scripts/ensure-framework.sh  |  17 +-
 scripts/enable-ghostfile-fskit.sh             |  50 ++
 22 files changed, 2447 insertions(+), 160 deletions(-)
 create mode 100644 macOS/GhostFile/NotarizeOptions.plist
 create mode 100644 macOS/GhostHTTP3/Patches/quiche-darwin-send-time.patch
 create mode 100755 scripts/enable-ghostfile-fskit.sh

diff --git a/Makefile b/Makefile
index a71b4e9..2d5c5c5 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,17 @@ FSKIT_PROVISIONING_PROFILE ?= .var/profiles/GhostVM_FS_Distribution.provisionpro
 # Set to 0 only when a canonical release version is explicitly required.
 INJECT_TIMESTAMP ?= 1
 BUILD_TIMESTAMP := $(shell date +%Y%m%d%H%M%S)
+GHOSTFILE_MAJOR_MINOR ?= 1.0
+GHOSTFILE_VERSION ?= $(GHOSTFILE_MAJOR_MINOR).$(BUILD_TIMESTAMP)
+GHOSTFILE_BUILD_NUMBER ?= 3
+GHOSTFILE_KEEP_INTERMEDIATES ?= 0
+GHOSTFILE_ARCHIVE = build/GhostFile-$(GHOSTFILE_VERSION).xcarchive
+GHOSTFILE_EXPORT_DIR = build/GhostFile-$(GHOSTFILE_VERSION)-export
+GHOSTFILE_UPLOAD_DIR = build/GhostFile-$(GHOSTFILE_VERSION)-upload
+GHOSTFILE_DERIVED_DATA = build/.GhostFile-$(GHOSTFILE_VERSION)-DerivedData
+GHOSTFILE_ARTIFACT = build/GhostFile-$(GHOSTFILE_VERSION)-notarized-arm64.zip
+GHOSTFILE_SHARED_DOWNLOADS ?= /Volumes/My Shared Files/Downloads
+GHOSTFILE_LSREGISTER = /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
 APP_SKIP_XCODE_SIGNING ?= 0
 XCODE_ALLOW_PROVISIONING_UPDATES ?= 1
 
@@ -48,7 +59,7 @@ $(error Missing $(VERSION_FILE). Create it with a version like 1.85.0)
 endif
 BASE_MAJOR_MINOR := $(word 1,$(subst ., ,$(BASE_VERSION))).$(word 2,$(subst ., ,$(BASE_VERSION)))
 
-.PHONY: all cli app clean help run launch ghostfile run-ghostfile test-ghostfile generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist ghosthttp3-framework
+.PHONY: all cli app clean help run launch ghostfile ghostfile-release ghostfile-notarized run-ghostfile run-ghostfile-release test-ghostfile generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist ghosthttp3-framework
 
 all: help
 
@@ -285,9 +296,86 @@ ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
 		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \
 		build
 
+# Build the optimized arm64 GhostFile app used for performance and distribution testing.
+ghostfile-release: $(XCODE_PROJECT) ghosthttp3-framework
+	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
+		echo "ERROR: DEVELOPMENT_TEAM is required to sign GhostFileFS.appex"; \
+		echo "Set it in .env or run: make ghostfile-release DEVELOPMENT_TEAM=YOUR_TEAM_ID"; \
+		exit 1; \
+	fi
+	xcodebuild -project $(XCODE_PROJECT) \
+		-scheme GhostFile \
+		-configuration Release \
+		-derivedDataPath $(BUILD_DIR) \
+		-allowProvisioningUpdates \
+		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \
+		ARCHS=arm64 \
+		ONLY_ACTIVE_ARCH=YES \
+		build
+
+# Create a timestamp-versioned, Developer ID signed, notarized arm64 GhostFile archive.
+# Every distributed filename includes the full major.minor.YYYYMMDDHHMMSS version.
+ghostfile-notarized: $(XCODE_PROJECT) ghosthttp3-framework
+	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
+		echo "ERROR: DEVELOPMENT_TEAM is required"; \
+		exit 1; \
+	fi
+	@for PLIST in macOS/GhostFile/Info.plist macOS/GhostFileFS/Info.plist; do \
+		plutil -replace CFBundleShortVersionString -string "$(GHOSTFILE_VERSION)" "$$PLIST"; \
+		plutil -replace CFBundleVersion -string "$(GHOSTFILE_BUILD_NUMBER)" "$$PLIST"; \
+	done
+	@echo "Building GhostFile $(GHOSTFILE_VERSION)..."
+	rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_UPLOAD_DIR)" "$(GHOSTFILE_DERIVED_DATA)"
+	xcodebuild archive -project $(XCODE_PROJECT) \
+		-scheme GhostFile \
+		-configuration Release \
+		-archivePath "$(GHOSTFILE_ARCHIVE)" \
+		-derivedDataPath "$(GHOSTFILE_DERIVED_DATA)" \
+		-allowProvisioningUpdates \
+		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \
+		ARCHS=arm64 \
+		ONLY_ACTIVE_ARCH=YES
+	xcodebuild -exportArchive \
+		-archivePath "$(GHOSTFILE_ARCHIVE)" \
+		-exportPath "$(GHOSTFILE_UPLOAD_DIR)" \
+		-exportOptionsPlist macOS/GhostFile/NotarizeOptions.plist \
+		-allowProvisioningUpdates
+	@ATTEMPT=1; \
+	while ! xcodebuild -exportNotarizedApp -archivePath "$(GHOSTFILE_ARCHIVE)" -exportPath "$(GHOSTFILE_EXPORT_DIR)"; do \
+		if [ "$$ATTEMPT" -ge 60 ]; then echo "ERROR: notarization did not complete"; exit 1; fi; \
+		echo "Waiting for notarization (attempt $$ATTEMPT/60)..."; \
+		ATTEMPT=$$((ATTEMPT + 1)); \
+		sleep 30; \
+	done
+	xcrun stapler validate "$(GHOSTFILE_EXPORT_DIR)/GhostFile.app"
+	rm -f "$(GHOSTFILE_ARTIFACT)"
+	ditto -c -k --keepParent "$(GHOSTFILE_EXPORT_DIR)/GhostFile.app" "$(GHOSTFILE_ARTIFACT)"
+	@if [ -d "$(GHOSTFILE_SHARED_DOWNLOADS)" ]; then \
+		cp "$(GHOSTFILE_ARTIFACT)" "$(GHOSTFILE_SHARED_DOWNLOADS)/GhostFile-$(GHOSTFILE_VERSION)-notarized-arm64.zip"; \
+	fi
+	@# Xcode/LaunchServices eagerly discovers FSKit extensions inside archives and
+	@# DerivedData. Unregister every non-installed build product even when the
+	@# intermediates are retained for release inspection.
+	@for APP in \
+		"$(GHOSTFILE_ARCHIVE)/Products/Applications/GhostFile.app" \
+		"$(GHOSTFILE_EXPORT_DIR)/GhostFile.app" \
+		"$(GHOSTFILE_DERIVED_DATA)/Build/Products/Release/GhostFile.app"; do \
+		if [ -d "$$APP" ]; then \
+			/usr/bin/pluginkit -r "$$APP/Contents/Extensions/GhostFileFS.appex" >/dev/null 2>&1 || true; \
+			$(GHOSTFILE_LSREGISTER) -u "$$APP" >/dev/null 2>&1 || true; \
+		fi; \
+	done
+	@if [ "$(GHOSTFILE_KEEP_INTERMEDIATES)" != "1" ]; then \
+		rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_UPLOAD_DIR)" "$(GHOSTFILE_DERIVED_DATA)"; \
+	fi
+	@echo "GhostFile artifact: $(GHOSTFILE_ARTIFACT)"
+
 run-ghostfile: ghostfile
 	open -n "$(BUILD_DIR)/Build/Products/Debug/GhostFile.app"
 
+run-ghostfile-release: ghostfile-release
+	open -n "$(BUILD_DIR)/Build/Products/Release/GhostFile.app"
+
 test-ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
 	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
 		echo "ERROR: DEVELOPMENT_TEAM is required to sign the GhostFile test host and FSKit extension"; \
@@ -300,6 +388,11 @@ test-ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
 		-derivedDataPath $(BUILD_DIR) \
 		-allowProvisioningUpdates \
 		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)"
+	@TEST_APP="$(BUILD_DIR)/Build/Products/Debug/GhostFile.app"; \
+	if [ -d "$$TEST_APP" ]; then \
+		/usr/bin/pluginkit -r "$$TEST_APP/Contents/Extensions/GhostFileFS.appex" >/dev/null 2>&1 || true; \
+		$(GHOSTFILE_LSREGISTER) -u "$$TEST_APP" >/dev/null 2>&1 || true; \
+	fi
 
 # Run unit tests
 test: $(XCODE_PROJECT)
diff --git a/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift b/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
index 19b8581..65e1c23 100644
--- a/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
+++ b/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
@@ -22,6 +22,7 @@ public enum HTTPQueryParser {
 public enum HTTPStatus: Int, Sendable {
     case switchingProtocols = 101
     case ok = 200
+    case partialContent = 206
     case created = 201
     case noContent = 204
     case badRequest = 400
@@ -31,6 +32,7 @@ public enum HTTPStatus: Int, Sendable {
     case methodNotAllowed = 405
     case requestTimeout = 408
     case payloadTooLarge = 413
+    case rangeNotSatisfiable = 416
     case headerTooLarge = 431
     case badGateway = 502
     case serviceUnavailable = 503
@@ -41,6 +43,7 @@ public enum HTTPStatus: Int, Sendable {
         switch self {
         case .switchingProtocols: return "Switching Protocols"
         case .ok: return "OK"
+        case .partialContent: return "Partial Content"
         case .created: return "Created"
         case .noContent: return "No Content"
         case .badRequest: return "Bad Request"
@@ -50,6 +53,7 @@ public enum HTTPStatus: Int, Sendable {
         case .methodNotAllowed: return "Method Not Allowed"
         case .requestTimeout: return "Request Timeout"
         case .payloadTooLarge: return "Payload Too Large"
+        case .rangeNotSatisfiable: return "Range Not Satisfiable"
         case .headerTooLarge: return "Request Header Fields Too Large"
         case .badGateway: return "Bad Gateway"
         case .serviceUnavailable: return "Service Unavailable"
@@ -682,7 +686,9 @@ public enum HTTPCodec {
                 throw HTTPError.headerTooLarge(maxBytes: maxHeaderBytes)
             }
 
-            let count = Darwin.read(fd, &chunk, chunk.count)
+            let count = chunk.withUnsafeMutableBytes { buffer in
+                Darwin.read(fd, buffer.baseAddress, buffer.count)
+            }
             if count > 0 {
                 buffer.append(contentsOf: chunk[0.. TimeInterval {
+        guard let data = txt["ttl"],
+              let string = String(data: data, encoding: .utf8),
+              let seconds = TimeInterval(string),
+              seconds.isFinite else {
+            return legacyTTL
+        }
+        return min(max(seconds, 4), 60)
+    }
+
+    static func isExpired(lastSeen: Date, ttl: TimeInterval, now: Date = Date()) -> Bool {
+        now.timeIntervalSince(lastSeen) >= ttl
+    }
+}
+
 @MainActor
 final class GhostFileDiscovery: NSObject, ObservableObject {
     @Published private(set) var shares: [DiscoveredGhostFileShare] = []
     @Published private(set) var isSearching = false
+    @Published private(set) var removalEvent: GhostFileShareRemoval?
 
     private let browser = NetServiceBrowser()
     private var services: [ObjectIdentifier: NetService] = [:]
     private var shareIDsByService: [ObjectIdentifier: UUID] = [:]
+    private var stoppingServices: Set = []
+    private var lastSeenByService: [ObjectIdentifier: Date] = [:]
+    private var ttlByService: [ObjectIdentifier: TimeInterval] = [:]
+    private var expiryTask: Task?
 
     override init() {
         super.init()
@@ -42,27 +76,53 @@ final class GhostFileDiscovery: NSObject, ObservableObject {
             ofType: GhostFileProtocol.bonjourType,
             inDomain: GhostFileProtocol.bonjourDomain
         )
+        expiryTask = Task { [weak self] in
+            while !Task.isCancelled {
+                try? await Task.sleep(for: GhostFileBonjourLease.sweepInterval)
+                guard !Task.isCancelled else { return }
+                guard let self else { return }
+                self.expireStaleServices()
+            }
+        }
     }
 
     func stop() {
+        expiryTask?.cancel()
+        expiryTask = nil
         browser.stop()
         for service in services.values {
+            service.stopMonitoring()
             service.stop()
         }
         services.removeAll()
         shareIDsByService.removeAll()
+        stoppingServices.removeAll()
+        lastSeenByService.removeAll()
+        ttlByService.removeAll()
         shares.removeAll()
         isSearching = false
     }
 
-    private func resolved(_ service: NetService) {
+    private func resolved(_ service: NetService, txtData suppliedTXTData: Data? = nil) {
         guard let hostName = service.hostName,
-              let txtData = service.txtRecordData() else { return }
+              let txtData = suppliedTXTData ?? service.txtRecordData() else { return }
         let txt = NetService.dictionary(fromTXTRecord: txtData)
         guard let idData = txt["id"],
               let idString = String(data: idData, encoding: .utf8),
               let id = UUID(uuidString: idString) else { return }
 
+        let key = ObjectIdentifier(service)
+        let state = txt["state"].flatMap { String(data: $0, encoding: .utf8) } ?? "ready"
+        if state == "stopping" {
+            if stoppingServices.insert(key).inserted {
+                shareIDsByService[key] = id
+                removeShare(forService: key)
+            }
+            return
+        }
+        stoppingServices.remove(key)
+        shareIDsByService[key] = id
+
         let mode = txt["mode"].flatMap { String(data: $0, encoding: .utf8) } ?? "ro"
         let transport = txt["transport"].flatMap { String(data: $0, encoding: .utf8) } ?? GhostFileProtocol.transport
         let alpn = txt["alpn"].flatMap { String(data: $0, encoding: .utf8) } ?? GhostFileProtocol.alpn
@@ -70,6 +130,8 @@ final class GhostFileDiscovery: NSObject, ObservableObject {
         guard let pinData = txt["tls-pin"],
               let publicKeyPin = String(data: pinData, encoding: .utf8),
               !publicKeyPin.isEmpty else { return }
+        lastSeenByService[key] = Date()
+        ttlByService[key] = GhostFileBonjourLease.ttl(from: txt)
         let host = hostName.hasSuffix(".") ? String(hostName.dropLast()) : hostName
         let discovered = DiscoveredGhostFileShare(
             id: id,
@@ -80,11 +142,29 @@ final class GhostFileDiscovery: NSObject, ObservableObject {
             transport: transport,
             publicKeyPin: publicKeyPin
         )
-        shareIDsByService[ObjectIdentifier(service)] = id
         shares.removeAll { $0.id == id }
         shares.append(discovered)
         shares.sort { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
     }
+
+    private func removeShare(forService key: ObjectIdentifier) {
+        guard let shareID = shareIDsByService.removeValue(forKey: key) else { return }
+        lastSeenByService.removeValue(forKey: key)
+        ttlByService.removeValue(forKey: key)
+        guard !shareIDsByService.values.contains(shareID) else { return }
+        shares.removeAll { $0.id == shareID }
+        removalEvent = GhostFileShareRemoval(shareID: shareID)
+    }
+
+    private func expireStaleServices(now: Date = Date()) {
+        let expired = lastSeenByService.compactMap { key, lastSeen -> ObjectIdentifier? in
+            let ttl = ttlByService[key] ?? GhostFileBonjourLease.legacyTTL
+            return GhostFileBonjourLease.isExpired(lastSeen: lastSeen, ttl: ttl, now: now) ? key : nil
+        }
+        for key in expired {
+            removeShare(forService: key)
+        }
+    }
 }
 
 extension GhostFileDiscovery: NetServiceBrowserDelegate, NetServiceDelegate {
@@ -109,15 +189,24 @@ extension GhostFileDiscovery: NetServiceBrowserDelegate, NetServiceDelegate {
     ) {
         Task { @MainActor in
             let key = ObjectIdentifier(service)
+            service.stopMonitoring()
             services.removeValue(forKey: key)
-            if let shareID = shareIDsByService.removeValue(forKey: key) {
-                shares.removeAll { $0.id == shareID }
-            }
+            stoppingServices.remove(key)
+            lastSeenByService.removeValue(forKey: key)
+            ttlByService.removeValue(forKey: key)
+            removeShare(forService: key)
         }
     }
 
     nonisolated func netServiceDidResolveAddress(_ sender: NetService) {
-        Task { @MainActor in resolved(sender) }
+        Task { @MainActor in
+            resolved(sender)
+            sender.startMonitoring()
+        }
+    }
+
+    nonisolated func netService(_ sender: NetService, didUpdateTXTRecord data: Data) {
+        Task { @MainActor in resolved(sender, txtData: data) }
     }
 
     nonisolated func netServiceBrowserDidStopSearch(_ browser: NetServiceBrowser) {
diff --git a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
index cbdd53f..5a5308d 100644
--- a/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
+++ b/macOS/GhostFile/GhostFileHTTP3ShareServer.swift
@@ -3,6 +3,23 @@ import Dispatch
 import Foundation
 import GhostHTTP
 import Network
+import OSLog
+
+private let ghostFileHTTP3ServerLogger = Logger(
+    subsystem: "org.ghostvm.ghostfile",
+    category: "HTTP3Server"
+)
+
+private let ghostFileServerProcessLogIdentity: String = {
+    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
+    let build = Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "unknown"
+    return "version=\(version) build=\(build) pid=\(ProcessInfo.processInfo.processIdentifier)"
+}()
+
+private func ghostFileServerElapsedMilliseconds(since startedAt: UInt64) -> UInt64 {
+    let now = DispatchTime.now().uptimeNanoseconds
+    return now >= startedAt ? (now - startedAt) / 1_000_000 : 0
+}
 
 @MainActor
 final class GhostFileShareServer: ObservableObject {
@@ -21,9 +38,16 @@ final class GhostFileShareServer: ObservableObject {
     private var publicKeyPin = ""
     private var listener: NWListener?
     private var portTask: Task?
+    private var heartbeatTask: Task?
+    private var stopTask: Task?
     private var netService: NetService?
+    private var bonjourResolver: GhostFileBonjourSelfResolver?
+    @Published private var resolvedShareHost: String?
     private var identityDirectory: URL?
     private var sessions: [UUID: GhostFileHTTP3ServerSession] = [:]
+    private var bonjourValues: [String: String] = [:]
+    private var bonjourHeartbeat: UInt64 = 0
+    private var isStopping = false
 
     init(
         rootURL: URL,
@@ -40,33 +64,32 @@ final class GhostFileShareServer: ObservableObject {
     }
 
     var shareURL: URL? {
-        guard port != 0 else { return nil }
-        var host = ProcessInfo.processInfo.hostName
-        if !host.hasSuffix(".local") { host += ".local" }
-        var components = URLComponents()
-        components.scheme = GhostFileProtocol.urlScheme
-        components.host = host
-        components.port = Int(port)
-        components.path = GhostFileProtocol.shareBasePath(id: shareID)
-        components.queryItems = [URLQueryItem(name: "tls_pin", value: publicKeyPin)]
-        return components.url
+        guard port != 0, let host = resolvedShareHost else { return nil }
+        return resourceURL(host: host)
     }
 
 #if DEBUG
     var loopbackShareURLForTesting: URL? {
         guard port != 0 else { return nil }
+        return resourceURL(host: "127.0.0.1")
+    }
+#endif
+
+    private func resourceURL(host: String) -> URL? {
         var components = URLComponents()
         components.scheme = GhostFileProtocol.urlScheme
-        components.host = "127.0.0.1"
+        components.host = host
         components.port = Int(port)
         components.path = GhostFileProtocol.shareBasePath(id: shareID)
         components.queryItems = [URLQueryItem(name: "tls_pin", value: publicKeyPin)]
         return components.url
     }
-#endif
 
     func start(preferredPort: UInt16 = 0) throws {
         guard listener == nil else { return }
+        ghostFileHTTP3ServerLogger.notice(
+            "Share listener starting share=\(self.shareID.uuidString.lowercased(), privacy: .public) \(ghostFileServerProcessLogIdentity, privacy: .public) preferredPort=\(preferredPort, privacy: .public) name=\(self.shareName, privacy: .private(mask: .hash)) root=\(self.rootURL.path, privacy: .private(mask: .hash))"
+        )
         let router = GhostFileShareRouter(
             rootURL: rootURL,
             shareID: shareID,
@@ -85,7 +108,10 @@ final class GhostFileShareServer: ObservableObject {
             "alpn": GhostFileProtocol.alpn,
             "auth": "access-key",
             "tls-pin": publicKeyPin,
+            "state": "ready",
+            "ttl": String(Int(GhostFileBonjourLease.advertisedTTL)),
         ]
+        bonjourValues = txt
         let parameters = NWParameters.udp
         parameters.allowLocalEndpointReuse = true
         parameters.includePeerToPeer = true
@@ -114,6 +140,11 @@ final class GhostFileShareServer: ObservableObject {
             portTask = Task { [weak self, weak listener] in
                 for _ in 0..<500 {
                     guard let self, let listener else { return }
+                    // NWListener can transiently report `.any` (raw value 0)
+                    // before the kernel assigns its real ephemeral port. Never
+                    // publish that placeholder: `publishBonjour` is one-shot,
+                    // so doing so would permanently advertise an unusable SRV
+                    // endpoint for this share instance.
                     if let boundPort = listener.port?.rawValue, boundPort != 0 {
                         self.port = boundPort
                         self.isRunning = true
@@ -130,18 +161,62 @@ final class GhostFileShareServer: ObservableObject {
     }
 
     func stop() {
+        guard listener != nil else {
+            finishStop()
+            return
+        }
+        guard !isStopping else { return }
+        isStopping = true
+        ghostFileHTTP3ServerLogger.notice(
+            "Share stop requested share=\(self.shareID.uuidString.lowercased(), privacy: .public) port=\(self.port, privacy: .public) sessions=\(self.sessions.count, privacy: .public) requests=\(self.requestCount, privacy: .public)"
+        )
+        isRunning = false
+        heartbeatTask?.cancel()
+        heartbeatTask = nil
+
+        // Tell mount clients to detach before closing their backing transport.
+        // This prevents a forced unmount from waiting on an already-dead share.
+        if let netService {
+            var stoppingValues = bonjourValues
+            stoppingValues["state"] = "stopping"
+            let dataValues = stoppingValues.mapValues { Data($0.utf8) }
+            netService.setTXTRecord(NetService.data(fromTXTRecord: dataValues))
+            stopTask = Task { [self] in
+                try? await Task.sleep(for: .seconds(2))
+                guard !Task.isCancelled else { return }
+                finishStop()
+            }
+        } else {
+            finishStop()
+        }
+    }
+
+    private func finishStop() {
+        ghostFileHTTP3ServerLogger.notice(
+            "Share stopping share=\(self.shareID.uuidString.lowercased(), privacy: .public) port=\(self.port, privacy: .public) sessions=\(self.sessions.count, privacy: .public) requests=\(self.requestCount, privacy: .public)"
+        )
+        stopTask?.cancel()
+        stopTask = nil
         listener?.cancel()
         listener = nil
         netService?.stop()
         netService = nil
+        bonjourResolver?.stop()
+        bonjourResolver = nil
+        resolvedShareHost = nil
         portTask?.cancel()
         portTask = nil
+        heartbeatTask?.cancel()
+        heartbeatTask = nil
         for session in sessions.values { session.stop() }
         sessions.removeAll()
         if let identityDirectory { try? FileManager.default.removeItem(at: identityDirectory) }
         identityDirectory = nil
+        bonjourValues = [:]
+        bonjourHeartbeat = 0
         port = 0
         isRunning = false
+        isStopping = false
     }
 
     private func accept(
@@ -151,8 +226,10 @@ final class GhostFileShareServer: ObservableObject {
         privateKeyPath: String
     ) {
         let id = UUID()
+        let sessionID = String(id.uuidString.prefix(12)).lowercased()
         do {
             let session = try GhostFileHTTP3ServerSession(
+                sessionID: sessionID,
                 connection: connection,
                 certificatePath: certificatePath,
                 privateKeyPath: privateKeyPath,
@@ -166,9 +243,14 @@ final class GhostFileShareServer: ObservableObject {
                 }
             )
             sessions[id] = session
+            ghostFileHTTP3ServerLogger.notice(
+                "Session accepted share=\(self.shareID.uuidString.lowercased(), privacy: .public) session=\(sessionID, privacy: .public) endpoint=\(String(describing: connection.endpoint), privacy: .public) activeSessions=\(self.sessions.count, privacy: .public)"
+            )
             session.start()
         } catch {
-            NSLog("GhostFile HTTP/3 session setup failed: %@", String(describing: error))
+            ghostFileHTTP3ServerLogger.error(
+                "Session setup failed share=\(self.shareID.uuidString.lowercased(), privacy: .public) session=\(sessionID, privacy: .public) error=\(String(describing: error), privacy: .public)"
+            )
             connection.cancel()
         }
     }
@@ -179,6 +261,9 @@ final class GhostFileShareServer: ObservableObject {
             port = listener?.port?.rawValue ?? 0
             isRunning = port != 0
             if port != 0 {
+                ghostFileHTTP3ServerLogger.notice(
+                    "Share listener ready share=\(self.shareID.uuidString.lowercased(), privacy: .public) port=\(self.port, privacy: .public)"
+                )
                 publishBonjour(port: port, values: [
                     "version": String(GhostFileProtocol.version),
                     "id": shareID.uuidString.lowercased(),
@@ -187,20 +272,25 @@ final class GhostFileShareServer: ObservableObject {
                     "alpn": GhostFileProtocol.alpn,
                     "auth": "access-key",
                     "tls-pin": publicKeyPin,
+                    "state": "ready",
+                    "ttl": String(Int(GhostFileBonjourLease.advertisedTTL)),
                 ])
             }
         case .failed(let error):
-#if DEBUG
-            print("GhostFile HTTP/3 listener failed: \(error)")
-#endif
-            stop()
+            ghostFileHTTP3ServerLogger.error(
+                "Share listener failed share=\(self.shareID.uuidString.lowercased(), privacy: .public) error=\(String(describing: error), privacy: .public)"
+            )
+            finishStop()
         case .cancelled:
+            ghostFileHTTP3ServerLogger.notice(
+                "Share listener cancelled share=\(self.shareID.uuidString.lowercased(), privacy: .public)"
+            )
             port = 0
             isRunning = false
         case .waiting(let error):
-#if DEBUG
-            print("GhostFile HTTP/3 listener waiting: \(error)")
-#endif
+            ghostFileHTTP3ServerLogger.notice(
+                "Share listener waiting share=\(self.shareID.uuidString.lowercased(), privacy: .public) error=\(String(describing: error), privacy: .public)"
+            )
         case .setup:
             break
         @unknown default:
@@ -210,6 +300,17 @@ final class GhostFileShareServer: ObservableObject {
 
     private func publishBonjour(port: UInt16, values: [String: String]) {
         guard netService == nil else { return }
+        guard port != 0 else {
+            ghostFileHTTP3ServerLogger.error(
+                "Refusing Bonjour publication with zero port share=\(self.shareID.uuidString.lowercased(), privacy: .public)"
+            )
+            return
+        }
+        ghostFileHTTP3ServerLogger.notice(
+            "Bonjour publish starting share=\(self.shareID.uuidString.lowercased(), privacy: .public) port=\(port, privacy: .public) ttl=\(values["ttl"] ?? "unknown", privacy: .public)"
+        )
+        bonjourValues = values
+        bonjourHeartbeat = 0
         let service = NetService(
             domain: GhostFileProtocol.bonjourDomain,
             type: GhostFileProtocol.bonjourType,
@@ -217,10 +318,34 @@ final class GhostFileShareServer: ObservableObject {
             port: Int32(port)
         )
         service.includesPeerToPeer = true
-        let dataValues = values.mapValues { Data($0.utf8) }
+        var initialValues = values
+        initialValues["heartbeat"] = String(bonjourHeartbeat)
+        let dataValues = initialValues.mapValues { Data($0.utf8) }
         service.setTXTRecord(NetService.data(fromTXTRecord: dataValues))
         netService = service
-        service.publish()
+        let resolver = GhostFileBonjourSelfResolver { [weak self, weak service] host in
+            Task { @MainActor in
+                guard let self, let service, self.netService === service else { return }
+                self.resolvedShareHost = host
+                ghostFileHTTP3ServerLogger.notice(
+                    "Bonjour self-resolution ready share=\(self.shareID.uuidString.lowercased(), privacy: .public) host=\(host, privacy: .public) port=\(self.port, privacy: .public)"
+                )
+            }
+        }
+        bonjourResolver = resolver
+        resolver.publish(service)
+        heartbeatTask = Task { [weak self, weak service] in
+            while !Task.isCancelled {
+                try? await Task.sleep(for: GhostFileBonjourLease.heartbeatInterval)
+                guard !Task.isCancelled, let self, let service else { return }
+                guard self.netService === service, self.isRunning, !self.isStopping else { return }
+                self.bonjourHeartbeat &+= 1
+                var heartbeatValues = self.bonjourValues
+                heartbeatValues["heartbeat"] = String(self.bonjourHeartbeat)
+                let dataValues = heartbeatValues.mapValues { Data($0.utf8) }
+                service.setTXTRecord(NetService.data(fromTXTRecord: dataValues))
+            }
+        }
     }
 
     private static func writeIdentityFiles(
@@ -246,11 +371,19 @@ final class GhostFileShareServer: ObservableObject {
             throw error
         }
     }
+
 }
 
 private actor GhostFileHTTP3ServerSession {
     typealias RequestDelay = GhostFileShareServer.RequestDelay
 
+    private struct RequestLogContext {
+        let requestID: String
+        let operation: String
+        let startedAt: UInt64
+    }
+
+    private let sessionID: String
     private let connection: NWConnection
     private let http3: GhostFileHTTP3Connection
     private let router: GhostFileShareRouter
@@ -260,12 +393,21 @@ private actor GhostFileHTTP3ServerSession {
     private var timeoutTask: Task?
     private var isFlushing = false
     private var flushAgain = false
+    private var isStopping = false
     private var hasStopped = false
     private var routingTasks: [UInt64: Task] = [:]
     private var responseTasks: [UInt64: Task] = [:]
+    private var requestLogs: [UInt64: RequestLogContext] = [:]
     private var terminatedRequestStreams: Set = []
     private var pendingReceivedDatagrams: [Data] = []
+    private var pendingScheduledDatagram: GhostFileScheduledDatagram?
     private var isReceiveDrainScheduled = false
+    private let createdAt = DispatchTime.now().uptimeNanoseconds
+    private var didLogHandshake = false
+    private var receivedDatagramCount = 0
+    private var receivedByteCount = 0
+    private var sentDatagramCount = 0
+    private var sentByteCount = 0
 
     // GhostFile range requests are capped at 1 MiB. One DispatchIO operation per
     // bounded range avoids re-entering the connection actor for artificial file
@@ -278,6 +420,7 @@ private actor GhostFileHTTP3ServerSession {
     )
 
     init(
+        sessionID: String,
         connection: NWConnection,
         certificatePath: String,
         privateKeyPath: String,
@@ -286,6 +429,7 @@ private actor GhostFileHTTP3ServerSession {
         requestCompleted: @escaping @Sendable () -> Void,
         stopped: @escaping @Sendable () -> Void
     ) throws {
+        self.sessionID = sessionID
         self.connection = connection
         self.http3 = try GhostFileHTTP3Connection(
             role: .server(certificatePath: certificatePath, privateKeyPath: privateKeyPath)
@@ -305,15 +449,11 @@ private actor GhostFileHTTP3ServerSession {
     }
 
     private func startIsolated() {
+        ghostFileHTTP3ServerLogger.notice(
+            "Session starting session=\(self.sessionID, privacy: .public) endpoint=\(String(describing: self.connection.endpoint), privacy: .public)"
+        )
         connection.stateUpdateHandler = { [weak self] state in
-            if case .failed(let error) = state {
-#if DEBUG
-                print("GhostFile HTTP/3 UDP connection failed: \(error)")
-#endif
-                Task { await self?.stopIsolated() }
-            } else if case .cancelled = state {
-                Task { await self?.stopIsolated() }
-            }
+            Task { await self?.connectionStateChanged(state) }
         }
         connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.session"))
         connection.batch {
@@ -330,11 +470,21 @@ private actor GhostFileHTTP3ServerSession {
     }
 
     private func receiveCompleted(_ content: Data?, error: NWError?) async {
-        guard !hasStopped else { return }
+        guard !hasStopped, !isStopping else { return }
         guard error == nil, let content else {
-            stopIsolated()
+            ghostFileHTTP3ServerLogger.error(
+                "Session receive failed session=\(self.sessionID, privacy: .public) error=\(String(describing: error), privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+            await stopIsolated(reason: "receiveFailed")
             return
         }
+        receivedDatagramCount += 1
+        receivedByteCount += content.count
+        if receivedDatagramCount == 1 {
+            ghostFileHTTP3ServerLogger.notice(
+                "Session first UDP datagram session=\(self.sessionID, privacy: .public) bytes=\(content.count, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+        }
         receiveNextDatagram()
         pendingReceivedDatagrams.append(content)
         guard !isReceiveDrainScheduled else { return }
@@ -346,7 +496,7 @@ private actor GhostFileHTTP3ServerSession {
     }
 
     private func drainReceivedDatagrams() async {
-        while !pendingReceivedDatagrams.isEmpty, !hasStopped {
+        while !pendingReceivedDatagrams.isEmpty, !hasStopped, !isStopping {
             let count = min(GhostFileNetworkDatagram.maximumReceiveCount, pendingReceivedDatagrams.count)
             let datagrams = Array(pendingReceivedDatagrams.prefix(count))
             pendingReceivedDatagrams.removeFirst(count)
@@ -354,14 +504,22 @@ private actor GhostFileHTTP3ServerSession {
                 for datagram in datagrams {
                     try http3.receive(datagram)
                 }
+                if http3.isEstablished && !didLogHandshake {
+                    didLogHandshake = true
+                    ghostFileHTTP3ServerLogger.notice(
+                        "Session QUIC handshake established session=\(self.sessionID, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+                    )
+                }
                 drainPeerTerminatedResponses()
                 try processEvents()
                 drainPeerTerminatedResponses()
                 await flushOutgoing()
                 resetTimeout()
             } catch {
-                NSLog("GhostFile HTTP/3 datagram batch failed: %@", String(describing: error))
-                stopIsolated()
+                ghostFileHTTP3ServerLogger.error(
+                    "Session datagram processing failed session=\(self.sessionID, privacy: .public) error=\(String(describing: error), privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+                )
+                await stopIsolated(reason: "datagramProcessingFailed")
             }
         }
         isReceiveDrainScheduled = false
@@ -376,9 +534,21 @@ private actor GhostFileHTTP3ServerSession {
                     Task { await self.sendBadRequest(streamID: streamID) }
                     continue
                 }
+                let requestID = request.header("x-ghostfile-request-id")
+                    ?? "peer-\(self.sessionID)-\(streamID)"
+                let logContext = RequestLogContext(
+                    requestID: requestID,
+                    operation: context.operation,
+                    startedAt: DispatchTime.now().uptimeNanoseconds
+                )
+                requestLogs[streamID] = logContext
+                ghostFileHTTP3ServerLogger.info(
+                    "Request received request=\(requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) offset=\(String(describing: context.offset), privacy: .public) length=\(String(describing: context.length), privacy: .public) path=\(String(describing: context.path), privacy: .private(mask: .hash))"
+                )
                 let router = self.router
                 let delay = self.requestDelay
                 let task = Task { [weak self] in
+                    let started = ContinuousClock.now
                     await delay(context)
                     guard !Task.isCancelled else {
                         await self?.routingCancelled(streamID: streamID)
@@ -389,13 +559,26 @@ private actor GhostFileHTTP3ServerSession {
                         await self?.routingCancelled(streamID: streamID)
                         return
                     }
-                    await self?.routingFinished(response, streamID: streamID)
+                    let elapsed = started.duration(to: .now)
+                    ghostFileHTTP3ServerLogger.info(
+                        "Request routed request=\(requestID, privacy: .public) session=\(self?.sessionID ?? "gone", privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) status=\(response.status.rawValue, privacy: .public) bytes=\(response.body.contentLength, privacy: .public) elapsed=\(String(describing: elapsed), privacy: .public)"
+                    )
+                    await self?.routingFinished(
+                        response,
+                        streamID: streamID,
+                        context: logContext
+                    )
                 }
                 routingTasks[streamID] = task
             case .data(let streamID):
-                _ = try http3.receiveBody(streamID: streamID)
+                try http3.discardReceivedBody(streamID: streamID)
             case .reset(let streamID):
                 terminatedRequestStreams.insert(streamID)
+                if let context = requestLogs.removeValue(forKey: streamID) {
+                    ghostFileHTTP3ServerLogger.error(
+                        "Request reset by client request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+                    )
+                }
                 cancelResponse(streamID: streamID)
             case .finished:
                 break
@@ -412,12 +595,19 @@ private actor GhostFileHTTP3ServerSession {
                 body: body
             )
             await flushOutgoing()
-        } catch { stopIsolated() }
+        } catch { await stopIsolated(reason: "badRequestSendFailed") }
     }
 
-    private func send(_ response: GhostFileHTTPResponse, streamID: UInt64) async {
+    private func send(
+        _ response: GhostFileHTTPResponse,
+        streamID: UInt64,
+        context: RequestLogContext
+    ) async {
         guard !hasStopped else { return }
-        guard terminatedRequestStreams.remove(streamID) == nil else { return }
+        guard terminatedRequestStreams.remove(streamID) == nil else {
+            requestLogs.removeValue(forKey: streamID)
+            return
+        }
         do {
             var headers: [(String, String)] = [
                 (":status", String(response.status.rawValue)),
@@ -429,11 +619,14 @@ private actor GhostFileHTTP3ServerSession {
                 return (name, entry.value)
             })
 
+            let completesImmediately: Bool
             switch response.body {
             case .empty:
                 try http3.sendResponse(streamID: streamID, headers: headers, body: Data())
+                completesImmediately = true
             case .bytes(let body):
                 try http3.sendResponse(streamID: streamID, headers: headers, body: body)
+                completesImmediately = true
             case .fileRegion(let path, let identity, let offset, let length):
                 try http3.beginResponse(
                     streamID: streamID,
@@ -447,40 +640,76 @@ private actor GhostFileHTTP3ServerSession {
                     length: length,
                     streamID: streamID
                 )
+                completesImmediately = false
+            }
+            ghostFileHTTP3ServerLogger.info(
+                "Response queued request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) status=\(response.status.rawValue, privacy: .public) bytes=\(response.body.contentLength, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+            )
+            if completesImmediately {
+                requestLogs.removeValue(forKey: streamID)
+                requestCompleted()
             }
-            requestCompleted()
             await flushOutgoing()
         } catch {
-            NSLog("GhostFile HTTP/3 response failed: %@", String(describing: error))
-            stopIsolated()
+            ghostFileHTTP3ServerLogger.error(
+                "Response failed request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) error=\(String(describing: error), privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+            )
+            await stopIsolated(reason: "responseFailed")
         }
     }
 
     private func flushOutgoing() async {
+        guard !hasStopped, !isStopping else { return }
         if isFlushing {
             flushAgain = true
             return
         }
-        guard !hasStopped else { return }
         isFlushing = true
         defer { isFlushing = false }
         do {
             repeat {
                 flushAgain = false
-                while true {
+                while !isStopping {
                     let produceStartedAt = DispatchTime.now().uptimeNanoseconds
                     var datagrams: [Data] = []
                     datagrams.reserveCapacity(GhostFileNetworkDatagram.maximumSendBatchCount)
+                    var transportDrained = false
                     while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount {
-                        guard let datagram = try http3.nextDatagram() else { break }
-                        datagrams.append(datagram)
+                        let scheduled: GhostFileScheduledDatagram
+                        if let pendingScheduledDatagram {
+                            scheduled = pendingScheduledDatagram
+                        } else if let next = try http3.nextScheduledDatagram() {
+                            scheduled = next
+                        } else {
+                            transportDrained = true
+                            break
+                        }
+                        let now = ghostFileMonotonicNanoseconds()
+                        guard scheduled.sendAtNanoseconds <= now else {
+                            pendingScheduledDatagram = scheduled
+                            break
+                        }
+                        pendingScheduledDatagram = nil
+                        datagrams.append(scheduled.data)
                         drainPeerTerminatedResponses()
                     }
                     drainPeerTerminatedResponses()
-                    guard !datagrams.isEmpty else { break }
+                    if datagrams.isEmpty {
+                        if transportDrained { break }
+                        guard let pendingScheduledDatagram else { break }
+                        let now = ghostFileMonotonicNanoseconds()
+                        if pendingScheduledDatagram.sendAtNanoseconds > now {
+                            try await Task.sleep(
+                                nanoseconds: pendingScheduledDatagram.sendAtNanoseconds - now
+                            )
+                        }
+                        continue
+                    }
                     let produceFinishedAt = DispatchTime.now().uptimeNanoseconds
                     try await connection.sendGhostFileDatagrams(datagrams)
                     let sendFinishedAt = DispatchTime.now().uptimeNanoseconds
+                    sentDatagramCount += datagrams.count
+                    sentByteCount += datagrams.reduce(into: 0) { $0 += $1.count }
                     http3.recordSendBatch(
                         packetCount: datagrams.count,
                         produceNanoseconds: produceFinishedAt - produceStartedAt,
@@ -490,8 +719,10 @@ private actor GhostFileHTTP3ServerSession {
             } while flushAgain
             resetTimeout()
         } catch {
-            NSLog("GhostFile HTTP/3 UDP send failed: %@", String(describing: error))
-            stopIsolated()
+            ghostFileHTTP3ServerLogger.error(
+                "Session UDP send failed session=\(self.sessionID, privacy: .public) error=\(String(describing: error), privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+            await stopIsolated(reason: "sendFailed")
         }
     }
 
@@ -510,21 +741,80 @@ private actor GhostFileHTTP3ServerSession {
     private func timeoutFired() async {
         http3.handleTimeout()
         await flushOutgoing()
-        if http3.isClosed { stopIsolated() }
+        if http3.isClosed {
+            ghostFileHTTP3ServerLogger.error(
+                "Session QUIC timeout closed connection session=\(self.sessionID, privacy: .public) activeRequests=\(self.requestLogs.count, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+            await stopIsolated(reason: "quicTimeoutClosed")
+        }
     }
 
-    private func stopIsolated() {
-        guard !hasStopped else { return }
-        hasStopped = true
+    private func connectionStateChanged(_ state: NWConnection.State) async {
+        switch state {
+        case .ready:
+            ghostFileHTTP3ServerLogger.notice(
+                "Session UDP ready session=\(self.sessionID, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+        case .waiting(let error):
+            ghostFileHTTP3ServerLogger.notice(
+                "Session UDP waiting session=\(self.sessionID, privacy: .public) error=\(String(describing: error), privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+        case .failed(let error):
+            ghostFileHTTP3ServerLogger.error(
+                "Session UDP failed session=\(self.sessionID, privacy: .public) error=\(String(describing: error), privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+            await stopIsolated(reason: "networkFailed")
+        case .cancelled:
+            await stopIsolated(reason: "networkCancelled")
+        default:
+            break
+        }
+    }
+
+    private func stopIsolated(reason: String = "requested") async {
+        guard !hasStopped, !isStopping else { return }
+        isStopping = true
+        ghostFileHTTP3ServerLogger.notice(
+            "Session stopping session=\(self.sessionID, privacy: .public) reason=\(reason, privacy: .public) activeRequests=\(self.requestLogs.count, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) receivedBytes=\(self.receivedByteCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) sentBytes=\(self.sentByteCount, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+        )
         timeoutTask?.cancel()
         for task in routingTasks.values { task.cancel() }
         routingTasks.removeAll()
         for task in responseTasks.values { task.cancel() }
         responseTasks.removeAll()
+        requestLogs.removeAll()
+        pendingScheduledDatagram = nil
+        while isFlushing {
+            await Task.yield()
+        }
+        let applicationErrorCode = reason == "requested"
+            ? GhostFileHTTP3Connection.h3NoError
+            : GhostFileHTTP3Connection.h3InternalError
+        await sendConnectionClose(reason: reason, applicationErrorCode: applicationErrorCode)
+        hasStopped = true
         connection.cancel()
         stopped()
     }
 
+    private func sendConnectionClose(reason: String, applicationErrorCode: UInt64) async {
+        do {
+            try http3.close(applicationErrorCode: applicationErrorCode, reason: reason)
+            while let datagram = try http3.nextScheduledDatagram() {
+                let now = ghostFileMonotonicNanoseconds()
+                if datagram.sendAtNanoseconds > now {
+                    try await Task.sleep(nanoseconds: datagram.sendAtNanoseconds - now)
+                }
+                try await connection.sendGhostFileDatagrams([datagram.data])
+                sentDatagramCount += 1
+                sentByteCount += datagram.data.count
+            }
+        } catch {
+            ghostFileHTTP3ServerLogger.error(
+                "Session close notification failed session=\(self.sessionID, privacy: .public) reason=\(reason, privacy: .public) error=\(String(describing: error), privacy: .public)"
+            )
+        }
+    }
+
     private nonisolated static func httpRequest(fields: [(String, String)]) -> HTTPRequestHead? {
         guard let methodValue = fields.first(where: { $0.0 == ":method" })?.1,
               let method = HTTPMethod(rawValue: methodValue),
@@ -573,6 +863,11 @@ private actor GhostFileHTTP3ServerSession {
         length: Int,
         streamID: UInt64
     ) {
+        if let context = requestLogs[streamID] {
+            ghostFileHTTP3ServerLogger.info(
+                "File response started request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) offset=\(offset, privacy: .public) bytes=\(length, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+            )
+        }
         let task = Task { [weak self] in
             guard let self else { return }
             do {
@@ -601,11 +896,15 @@ private actor GhostFileHTTP3ServerSession {
         terminatedRequestStreams.remove(streamID)
     }
 
-    private func routingFinished(_ response: GhostFileHTTPResponse, streamID: UInt64) async {
+    private func routingFinished(
+        _ response: GhostFileHTTPResponse,
+        streamID: UInt64,
+        context: RequestLogContext
+    ) async {
         guard routingTasks.removeValue(forKey: streamID) != nil,
               !hasStopped,
               !terminatedRequestStreams.contains(streamID) else { return }
-        await send(response, streamID: streamID)
+        await send(response, streamID: streamID, context: context)
     }
 
     private nonisolated static func produceFileResponse(
@@ -641,10 +940,20 @@ private actor GhostFileHTTP3ServerSession {
 
     private func fileResponseFinished(streamID: UInt64) {
         responseTasks.removeValue(forKey: streamID)
+        requestCompleted()
+        if let context = requestLogs.removeValue(forKey: streamID) {
+            ghostFileHTTP3ServerLogger.info(
+                "File response completed request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+            )
+        }
     }
 
     private func fileResponseFailed(_ error: Error, streamID: UInt64) async {
-        NSLog("GhostFile DispatchIO response failed on stream %llu: %@", streamID, String(describing: error))
+        if let context = requestLogs.removeValue(forKey: streamID) {
+            ghostFileHTTP3ServerLogger.error(
+                "File response failed request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) error=\(String(describing: error), privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+            )
+        }
         cancelResponse(streamID: streamID, resetTransport: true)
         await flushOutgoing()
     }
@@ -663,20 +972,130 @@ private actor GhostFileHTTP3ServerSession {
         for streamID in Array(routingTasks.keys)
             where http3.peerStoppedReceivingResponse(streamID: streamID) {
             terminatedRequestStreams.insert(streamID)
+            if let context = requestLogs.removeValue(forKey: streamID) {
+                ghostFileHTTP3ServerLogger.notice(
+                    "Response stopped by peer during routing request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+                )
+            }
             cancelResponse(streamID: streamID)
         }
         for streamID in http3.takePeerTerminatedResponseStreamIDs() {
             terminatedRequestStreams.insert(streamID)
+            if let context = requestLogs.removeValue(forKey: streamID) {
+                ghostFileHTTP3ServerLogger.notice(
+                    "Response abandoned by peer request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+                )
+            }
             cancelResponse(streamID: streamID)
         }
         for streamID in http3.takeFailedResponseStreamIDs() {
             terminatedRequestStreams.insert(streamID)
+            if let context = requestLogs.removeValue(forKey: streamID) {
+                ghostFileHTTP3ServerLogger.error(
+                    "Response stream failed request=\(context.requestID, privacy: .public) session=\(self.sessionID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(context.operation, privacy: .public) elapsedMs=\(ghostFileServerElapsedMilliseconds(since: context.startedAt), privacy: .public)"
+                )
+            }
             cancelResponse(streamID: streamID, resetTransport: true)
         }
     }
 
 }
 
+/// Resolves the service GhostFile just published and returns the actual mDNS
+/// SRV target. `ProcessInfo.hostName` is not suitable here: VPN and DNS clients
+/// can replace it with a connectivity-check hostname that is not the machine's
+/// Bonjour endpoint.
+private final class GhostFileBonjourSelfResolver: NSObject, NetServiceBrowserDelegate, NetServiceDelegate {
+    private let completion: (String) -> Void
+    private let browser = NetServiceBrowser()
+    private weak var publishedService: NetService?
+    private var expectedName = ""
+    private var candidates: [ObjectIdentifier: NetService] = [:]
+    private var didResolve = false
+
+    init(completion: @escaping (String) -> Void) {
+        self.completion = completion
+        super.init()
+        browser.delegate = self
+        browser.includesPeerToPeer = true
+    }
+
+    func publish(_ service: NetService) {
+        publishedService = service
+        service.delegate = self
+        service.publish()
+    }
+
+    func stop() {
+        browser.stop()
+        for service in candidates.values {
+            service.stop()
+        }
+        candidates.removeAll()
+        publishedService?.delegate = nil
+        publishedService = nil
+    }
+
+    func netServiceDidPublish(_ sender: NetService) {
+        guard sender === publishedService else { return }
+        expectedName = sender.name
+        // Resolve the final registered name directly. Browsing for our own
+        // service can miss or be delayed when instances with the same display
+        // name overlap during their short shutdown grace period.
+        resolve(domain: sender.domain, type: sender.type, name: sender.name)
+        browser.searchForServices(ofType: sender.type, inDomain: sender.domain)
+    }
+
+    func netService(_ sender: NetService, didNotPublish errorDict: [String: NSNumber]) {
+        guard sender === publishedService else { return }
+        ghostFileHTTP3ServerLogger.error(
+            "Bonjour publication failed name=\(sender.name, privacy: .private(mask: .hash)) error=\(String(describing: errorDict), privacy: .public)"
+        )
+    }
+
+    func netServiceBrowser(
+        _ browser: NetServiceBrowser,
+        didFind service: NetService,
+        moreComing: Bool
+    ) {
+        guard !didResolve, service.name == expectedName else { return }
+        beginResolution(service)
+    }
+
+    func netService(_ sender: NetService, didNotResolve errorDict: [String: NSNumber]) {
+        guard candidates.removeValue(forKey: ObjectIdentifier(sender)) != nil else { return }
+        ghostFileHTTP3ServerLogger.notice(
+            "Bonjour self-resolution attempt failed name=\(sender.name, privacy: .private(mask: .hash)) error=\(String(describing: errorDict), privacy: .public)"
+        )
+    }
+
+    func netServiceDidResolveAddress(_ sender: NetService) {
+        guard !didResolve, candidates[ObjectIdentifier(sender)] != nil,
+              let hostName = sender.hostName else { return }
+        didResolve = true
+        let host = hostName.hasSuffix(".") ? String(hostName.dropLast()) : hostName
+        completion(host)
+        browser.stop()
+        for service in candidates.values where service !== sender {
+            service.stop()
+        }
+        candidates.removeAll()
+    }
+
+    private func resolve(domain: String, type: String, name: String) {
+        beginResolution(NetService(domain: domain, type: type, name: name))
+    }
+
+    private func beginResolution(_ service: NetService) {
+        let key = ObjectIdentifier(service)
+        guard candidates[key] == nil else { return }
+        candidates[key] = service
+        service.delegate = self
+        service.includesPeerToPeer = true
+        service.resolve(withTimeout: 5)
+    }
+}
+
 private final class GhostFileDispatchIOFile: @unchecked Sendable {
     private static let callbackQueue = DispatchQueue(
         label: "org.ghostvm.ghostfile.dispatch-io",
diff --git a/macOS/GhostFile/GhostFileMountManager.swift b/macOS/GhostFile/GhostFileMountManager.swift
index 9d06937..8966c91 100644
--- a/macOS/GhostFile/GhostFileMountManager.swift
+++ b/macOS/GhostFile/GhostFileMountManager.swift
@@ -1,34 +1,146 @@
 import AppKit
 import Foundation
 import FSKit
+import OSLog
+
+private let ghostFileMountLogger = Logger(
+    subsystem: "org.ghostvm.ghostfile",
+    category: "Mount"
+)
 
 struct MountedGhostFileShare: Identifiable, Equatable {
     let id: UUID
+    let shareID: UUID
     let name: String
     let sourceURL: URL
     let mountPoint: URL
+    let removesMountPointOnUnmount: Bool
 }
 
 @MainActor
 final class GhostFileMountManager: ObservableObject {
+    nonisolated private static let extensionBundleIdentifier = "org.ghostvm.ghostfile.fs"
+
     @Published private(set) var mountedShares: [MountedGhostFileShare] = []
     @Published private(set) var extensionEnabled: Bool?
+    @Published private(set) var extensionRepairAvailable = false
+    @Published private(set) var extensionStatusDetail: String?
     @Published var errorMessage: String?
     @Published private(set) var isWorking = false
+    private var disconnectedShareIDs: Set = []
 
     func refreshExtensionStatus() async {
         do {
             let modules = try await FSClient.shared.installedExtensions
-            extensionEnabled = modules.contains {
-                $0.bundleIdentifier == "org.ghostvm.ghostfile.fs" && $0.isEnabled
+            let identities = modules.filter {
+                $0.bundleIdentifier == Self.extensionBundleIdentifier
+            }
+            let expectedURL = expectedExtensionURL.resolvingSymlinksInPath().standardizedFileURL
+            let snapshot = await Task.detached(priority: .utility) {
+                Self.registrationSnapshot()
+            }.value
+            let identity = identities.first {
+                $0.url.resolvingSymlinksInPath().standardizedFileURL == expectedURL
+            } ?? identities.first
+            let hasStaleIdentity = identities.contains {
+                $0.url.resolvingSymlinksInPath().standardizedFileURL != expectedURL
+            } || snapshot.urls.contains {
+                $0.resolvingSymlinksInPath().standardizedFileURL != expectedURL
+            }
+
+            guard let identity else {
+                extensionEnabled = false
+                extensionRepairAvailable = Bundle.main.bundleURL.path.hasPrefix("/Applications/")
+                extensionStatusDetail = "macOS has not registered the embedded GhostFileFS module."
+                return
+            }
+
+            let selectedCanonicalIdentity = identity.url.resolvingSymlinksInPath().standardizedFileURL == expectedURL
+            // FSClient can temporarily report a cached enabled value after the
+            // FSKit preference has been disabled, so require the on-disk FSKit
+            // state too. The Settings pane doesn't necessarily set PlugInKit's
+            // optional "+" election, so that marker is diagnostic only.
+            extensionEnabled = identity.isEnabled
+                && snapshot.enabledByFSKit
+                && selectedCanonicalIdentity
+                && !hasStaleIdentity
+            extensionRepairAvailable = hasStaleIdentity
+                || !snapshot.enabledByFSKit
+                || (snapshot.enabledByFSKit && !identity.isEnabled)
+
+            if hasStaleIdentity {
+                let staleCount = Set(
+                    (identities.map(\.url) + snapshot.urls)
+                        .map { $0.resolvingSymlinksInPath().standardizedFileURL }
+                        .filter { $0 != expectedURL }
+                ).count
+                extensionStatusDetail = "Found \(staleCount) stray GhostFileFS registration\(staleCount == 1 ? "" : "s"). macOS may launch the wrong extension; repair registration before mounting."
+            } else if !snapshot.enabledByFSKit {
+                extensionStatusDetail = "The Extensions toggle and FSKit's enabled-module list are out of sync."
+            } else if snapshot.enabledByFSKit && !identity.isEnabled {
+                extensionStatusDetail = "FSKit cached a stale disabled state for GhostFileFS."
+            } else {
+                extensionStatusDetail = nil
             }
         } catch {
             extensionEnabled = false
+            extensionRepairAvailable = false
+            extensionStatusDetail = nil
             errorMessage = "Unable to inspect FSKit extensions: \(error.localizedDescription)"
         }
     }
 
-    func mount(url: URL, accessKey: String, volumeName: String) async {
+    func repairExtensionRegistration() async {
+        let appURL = Bundle.main.bundleURL.resolvingSymlinksInPath().standardizedFileURL
+        guard appURL.path.hasPrefix("/Applications/") else {
+            errorMessage = "Move GhostFile to /Applications before repairing its FSKit registration."
+            return
+        }
+
+        isWorking = true
+        extensionEnabled = nil
+        defer { isWorking = false }
+
+        do {
+            let extensionURL = expectedExtensionURL.resolvingSymlinksInPath().standardizedFileURL
+            try await Task.detached(priority: .userInitiated) {
+                try Self.run(executable: "/usr/bin/codesign", arguments: ["--verify", "--deep", "--strict", appURL.path])
+
+                let snapshot = Self.registrationSnapshot()
+                for staleURL in snapshot.urls where staleURL.resolvingSymlinksInPath().standardizedFileURL != extensionURL {
+                    try? Self.run(executable: "/usr/bin/pluginkit", arguments: ["-r", staleURL.path])
+                    if let staleApp = Self.containingApp(for: staleURL), staleApp != appURL {
+                        try? Self.run(executable: Self.launchServicesRegisterPath, arguments: ["-u", staleApp.path])
+                    }
+                }
+
+                // Recreate the canonical identity too. A stuck Settings switch
+                // can be attached to a stale UUID even when its URL is correct.
+                try? Self.run(executable: "/usr/bin/pluginkit", arguments: ["-r", extensionURL.path])
+                try? Self.run(executable: Self.launchServicesRegisterPath, arguments: ["-u", appURL.path])
+                try Self.run(executable: Self.launchServicesRegisterPath, arguments: ["-f", "-R", "-trusted", appURL.path])
+
+                // FSKit caches module identities in a per-user agent. Restart it
+                // only after LaunchServices has created the replacement UUID.
+                try? Self.run(executable: "/usr/bin/killall", arguments: ["fskit_agent"])
+            }.value
+
+            try? await Task.sleep(for: .seconds(1))
+            await refreshExtensionStatus()
+            if extensionEnabled == true {
+                errorMessage = nil
+            } else {
+                errorMessage = nil
+                extensionStatusDetail = "Registration repaired. Turn on GhostFileFS in System Settings."
+                openExtensionSettings()
+            }
+        } catch {
+            extensionEnabled = false
+            errorMessage = "Unable to repair FSKit registration: \(error.localizedDescription)"
+        }
+    }
+
+    func mount(url: URL, accessKey: String, volumeName: String, requestedMountPoint: URL?) async {
         guard !accessKey.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
             errorMessage = "Enter the share's access key."
             return
@@ -37,8 +149,13 @@ final class GhostFileMountManager: ObservableObject {
             errorMessage = "GhostFile share URLs must use ghostfile://."
             return
         }
+        // Do not trust the status captured when the Mount view first appeared.
+        // LaunchServices can discover an Xcode/Downloads copy while the app is
+        // already open, and FSKit may otherwise launch that stale registration.
+        await refreshExtensionStatus()
         guard extensionEnabled == true else {
-            errorMessage = "Enable the GhostFile file system extension in System Settings first."
+            errorMessage = extensionStatusDetail
+                ?? "Enable the GhostFile file system extension in System Settings first."
             return
         }
 
@@ -47,21 +164,53 @@ final class GhostFileMountManager: ObservableObject {
         do {
             var resourceComponents = URLComponents(url: url, resolvingAgainstBaseURL: false)
             var queryItems = resourceComponents?.queryItems ?? []
-            queryItems.removeAll { $0.name == "access_key" }
+            queryItems.removeAll {
+                $0.name == "access_key" || $0.name == GhostFileProtocol.mountInstanceQueryName
+            }
+            let mountInstance = UUID()
             queryItems.append(URLQueryItem(name: "access_key", value: accessKey))
+            queryItems.append(URLQueryItem(
+                name: GhostFileProtocol.mountInstanceQueryName,
+                value: mountInstance.uuidString.lowercased()
+            ))
             resourceComponents?.queryItems = queryItems
             guard let resourceURL = resourceComponents?.url else {
                 throw MountFailure("Invalid share URL")
             }
+            guard let shareID = shareID(from: resourceURL) else {
+                throw MountFailure("Invalid GhostFile share URL")
+            }
 
-            let mountRoot = FileManager.default.homeDirectoryForCurrentUser
-                .appendingPathComponent("GhostFile Mounts", isDirectory: true)
-            try FileManager.default.createDirectory(at: mountRoot, withIntermediateDirectories: true)
-            let safeName = sanitizedVolumeName(volumeName)
-            let mountPoint = uniqueMountPoint(root: mountRoot, name: safeName)
-            try FileManager.default.createDirectory(at: mountPoint, withIntermediateDirectories: false)
+            let mountPoint: URL
+            let removesMountPointOnUnmount: Bool
+            let isAccessingMountPoint = requestedMountPoint?.startAccessingSecurityScopedResource() ?? false
+            defer {
+                if isAccessingMountPoint {
+                    requestedMountPoint?.stopAccessingSecurityScopedResource()
+                }
+            }
+            if let requestedMountPoint {
+                mountPoint = requestedMountPoint.standardizedFileURL
+                try validateUserSelectedMountPoint(mountPoint)
+                removesMountPointOnUnmount = false
+            } else {
+                let mountRoot = FileManager.default.homeDirectoryForCurrentUser
+                    .appendingPathComponent("GhostFile Mounts", isDirectory: true)
+                try FileManager.default.createDirectory(at: mountRoot, withIntermediateDirectories: true)
+                let safeName = sanitizedVolumeName(volumeName)
+                mountPoint = uniqueMountPoint(root: mountRoot, name: safeName)
+                try FileManager.default.createDirectory(at: mountPoint, withIntermediateDirectories: false)
+                removesMountPointOnUnmount = true
+            }
+
+            // Ignore an earlier disappearance of this share, but retain any
+            // removal notification that arrives while the mount is in flight.
+            disconnectedShareIDs.remove(shareID)
 
             do {
+                ghostFileMountLogger.info(
+                    "Mount invocation starting share=\(shareID.uuidString.lowercased(), privacy: .public) instance=\(mountInstance.uuidString.lowercased(), privacy: .public) target=\(mountPoint.path, privacy: .private(mask: .hash))"
+                )
                 try await Task.detached(priority: .userInitiated) {
                     try Self.run(
                         executable: "/sbin/mount",
@@ -70,34 +219,56 @@ final class GhostFileMountManager: ObservableObject {
                             "-o", "rdonly,nobrowse,nodev,nosuid",
                             resourceURL.absoluteString,
                             mountPoint.path,
-                        ]
+                        ],
+                        timeout: 25
                     )
                 }.value
+                ghostFileMountLogger.info(
+                    "Mount invocation completed share=\(shareID.uuidString.lowercased(), privacy: .public) instance=\(mountInstance.uuidString.lowercased(), privacy: .public)"
+                )
             } catch {
-                try? FileManager.default.removeItem(at: mountPoint)
+                ghostFileMountLogger.error(
+                    "Mount invocation failed share=\(shareID.uuidString.lowercased(), privacy: .public) instance=\(mountInstance.uuidString.lowercased(), privacy: .public) error=\(String(describing: error), privacy: .public)"
+                )
+                if removesMountPointOnUnmount {
+                    try? FileManager.default.removeItem(at: mountPoint)
+                }
                 throw error
             }
 
             mountedShares.append(.init(
                 id: UUID(),
+                shareID: shareID,
                 name: volumeName,
                 sourceURL: url,
-                mountPoint: mountPoint
+                mountPoint: mountPoint,
+                removesMountPointOnUnmount: removesMountPointOnUnmount
             ))
             errorMessage = nil
+            if disconnectedShareIDs.contains(shareID),
+               let mountedShare = mountedShares.last {
+                await unmount(mountedShare, force: true)
+            }
         } catch {
             errorMessage = error.localizedDescription
         }
     }
 
-    func unmount(_ mountedShare: MountedGhostFileShare) async {
+    func unmount(_ mountedShare: MountedGhostFileShare, force: Bool = false) async {
         isWorking = true
         defer { isWorking = false }
         do {
-            try await Task.detached(priority: .userInitiated) {
-                try Self.run(executable: "/sbin/umount", arguments: [mountedShare.mountPoint.path])
-            }.value
-            try? FileManager.default.removeItem(at: mountedShare.mountPoint)
+            do {
+                try await Self.runUnmount(mountedShare.mountPoint, force: force)
+            } catch where !force && Self.isDeviceBusy(error) {
+                // The user explicitly requested an unmount and GhostFile
+                // volumes are read-only network mounts. A forced retry is the
+                // appropriate recovery for a wedged FSKit vnode reference.
+                try await Self.runUnmount(mountedShare.mountPoint, force: true)
+            }
+            if mountedShare.removesMountPointOnUnmount {
+                try? FileManager.default.removeItem(at: mountedShare.mountPoint)
+            }
             mountedShares.removeAll { $0.id == mountedShare.id }
             errorMessage = nil
         } catch {
@@ -105,15 +276,103 @@ final class GhostFileMountManager: ObservableObject {
         }
     }
 
+    func unmountDisconnectedShare(withID shareID: UUID) async {
+        disconnectedShareIDs.insert(shareID)
+        let disconnectedMounts = mountedShares.filter { $0.shareID == shareID }
+        for mountedShare in disconnectedMounts {
+            await unmount(mountedShare, force: true)
+        }
+    }
+
     func reveal(_ mountedShare: MountedGhostFileShare) {
         NSWorkspace.shared.activateFileViewerSelecting([mountedShare.mountPoint])
     }
 
+    private static func runUnmount(_ mountPoint: URL, force: Bool) async throws {
+        try await Task.detached(priority: .userInitiated) {
+            let arguments = force ? ["-f", mountPoint.path] : [mountPoint.path]
+            try Self.run(executable: "/sbin/umount", arguments: arguments, timeout: 10)
+        }.value
+    }
+
+    private nonisolated static func isDeviceBusy(_ error: Error) -> Bool {
+        let detail = error.localizedDescription.lowercased()
+        return detail.contains("device busy") || detail.contains("resource busy")
+    }
+
     func openExtensionSettings() {
-        guard let url = URL(string: "x-apple.systempreferences:com.apple.LoginItems-Settings.extension") else { return }
+        extensionEnabled = nil
+
+        // Newer FSKit runtimes provide this official API. Keep the runtime
+        // check so builds made with the 26.4 SDK use it as soon as it exists.
+        let client = FSClient.shared as NSObject
+        let selector = NSSelectorFromString("openFileSystemExtensionsSettings")
+        if client.responds(to: selector) {
+            typealias OpenSettings = @convention(c) (AnyObject, Selector) -> Bool
+            let implementation = client.method(for: selector)
+            if unsafeBitCast(implementation, to: OpenSettings.self)(client, selector) {
+                return
+            }
+        }
+
+        // Older macOS 26 releases support the Extensions preferences route
+        // with an extension-point filter, which avoids the generic settings
+        // page and opens the FSKit Modules category directly.
+        guard let url = URL(string: "x-apple.systempreferences:com.apple.ExtensionsPreferences?extensionPointIdentifier=com.apple.fskit.fsmodule") else {
+            return
+        }
         NSWorkspace.shared.open(url)
     }
 
+    private var expectedExtensionURL: URL {
+        Bundle.main.bundleURL
+            .appendingPathComponent("Contents/Extensions/GhostFileFS.appex", isDirectory: true)
+    }
+
+    private struct RegistrationSnapshot: Sendable {
+        let urls: [URL]
+        let enabledByFSKit: Bool
+    }
+
+    private nonisolated static let launchServicesRegisterPath =
+        "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
+
+    private nonisolated static var enabledModulesURL: URL {
+        FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent("Library/Group Containers/group.com.apple.fskit.settings/enabledModules.plist")
+    }
+
+    private nonisolated static func registrationSnapshot() -> RegistrationSnapshot {
+        let output = (try? runAndCapture(
+            executable: "/usr/bin/pluginkit",
+            arguments: ["-v", "-m", "-A", "-D", "-p", "com.apple.fskit.fsmodule", "-i", extensionBundleIdentifier]
+        )) ?? ""
+        let matchingLines = output.split(separator: "\n").map(String.init).filter {
+            $0.contains(extensionBundleIdentifier)
+        }
+        let urls = matchingLines.compactMap { line -> URL? in
+            guard let path = line.split(separator: "\t", omittingEmptySubsequences: true).last,
+                  path.hasPrefix("/") else { return nil }
+            return URL(fileURLWithPath: String(path), isDirectory: true)
+        }
+        let enabledModules = (try? Data(contentsOf: enabledModulesURL)).flatMap {
+            try? PropertyListSerialization.propertyList(from: $0, format: nil) as? [String]
+        } ?? []
+        return RegistrationSnapshot(
+            urls: urls,
+            enabledByFSKit: enabledModules.contains(extensionBundleIdentifier)
+        )
+    }
+
+    private nonisolated static func containingApp(for url: URL) -> URL? {
+        var candidate = url
+        while candidate.path != "/" {
+            if candidate.pathExtension == "app" { return candidate }
+            candidate.deleteLastPathComponent()
+        }
+        return nil
+    }
+
     private func sanitizedVolumeName(_ name: String) -> String {
         let trimmed = name.trimmingCharacters(in: .whitespacesAndNewlines)
         let source = trimmed.isEmpty ? "GhostFile Share" : trimmed
@@ -131,20 +390,71 @@ final class GhostFileMountManager: ObservableObject {
         return candidate
     }
 
-    nonisolated private static func run(executable: String, arguments: [String]) throws {
+    private func validateUserSelectedMountPoint(_ mountPoint: URL) throws {
+        guard mountPoint.isFileURL else {
+            throw MountFailure("The mount point must be a local folder.")
+        }
+
+        var isDirectory: ObjCBool = false
+        guard FileManager.default.fileExists(atPath: mountPoint.path, isDirectory: &isDirectory),
+              isDirectory.boolValue else {
+            throw MountFailure("The selected mount point is not a folder.")
+        }
+
+        let contents = try FileManager.default.contentsOfDirectory(
+            at: mountPoint,
+            includingPropertiesForKeys: nil,
+            options: []
+        )
+        guard contents.isEmpty else {
+            throw MountFailure("The selected mount point must be empty.")
+        }
+    }
+
+    private func shareID(from url: URL) -> UUID? {
+        let parts = url.path.split(separator: "/", omittingEmptySubsequences: true)
+        guard parts.count == 3, parts[0] == "v1", parts[1] == "shares" else { return nil }
+        return UUID(uuidString: String(parts[2]))
+    }
+
+    nonisolated private static func run(
+        executable: String,
+        arguments: [String],
+        timeout: TimeInterval? = nil
+    ) throws {
+        _ = try runAndCapture(executable: executable, arguments: arguments, timeout: timeout)
+    }
+
+    nonisolated private static func runAndCapture(
+        executable: String,
+        arguments: [String],
+        timeout: TimeInterval? = nil
+    ) throws -> String {
         let process = Process()
         let output = Pipe()
         process.executableURL = URL(fileURLWithPath: executable)
         process.arguments = arguments
         process.standardOutput = output
         process.standardError = output
+        let finished = DispatchSemaphore(value: 0)
+        process.terminationHandler = { _ in finished.signal() }
         try process.run()
+        if let timeout,
+           finished.wait(timeout: .now() + timeout) == .timedOut {
+            process.terminate()
+            if finished.wait(timeout: .now() + 2) == .timedOut {
+                kill(process.processIdentifier, SIGKILL)
+                _ = finished.wait(timeout: .now() + 2)
+            }
+            throw MountFailure("Mount timed out after \(Int(timeout)) seconds. Verify the share is still online and reachable over UDP.")
+        }
         let data = output.fileHandleForReading.readDataToEndOfFile()
-        process.waitUntilExit()
+        if timeout == nil { process.waitUntilExit() }
+        let detail = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
         guard process.terminationStatus == 0 else {
-            let detail = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
-            throw MountFailure(detail?.isEmpty == false ? detail! : "mount exited with status \(process.terminationStatus)")
+            throw MountFailure(detail.isEmpty ? "Command exited with status \(process.terminationStatus)" : detail)
         }
+        return detail
     }
 
     private struct MountFailure: LocalizedError {
diff --git a/macOS/GhostFile/GhostFileShareController.swift b/macOS/GhostFile/GhostFileShareController.swift
index 81502ee..bdad46d 100644
--- a/macOS/GhostFile/GhostFileShareController.swift
+++ b/macOS/GhostFile/GhostFileShareController.swift
@@ -11,6 +11,11 @@ final class GhostFileShareController: ObservableObject {
     @Published var errorMessage: String?
 
     private var isAccessingSecurityScopedFolder = false
+    private static let selectedFolderBookmarkKey = "GhostFile.selectedFolderBookmark"
+
+    init() {
+        restoreSelectedFolder()
+    }
 
     func chooseFolder() {
         let panel = NSOpenPanel()
@@ -21,6 +26,7 @@ final class GhostFileShareController: ObservableObject {
         panel.allowsMultipleSelection = false
         guard panel.runModal() == .OK, let url = panel.url else { return }
         selectedFolder = url
+        persistSelectedFolder(url)
         if shareName == "DemoShare" || shareName.isEmpty {
             shareName = url.lastPathComponent
         }
@@ -81,4 +87,40 @@ final class GhostFileShareController: ObservableObject {
         NSPasteboard.general.clearContents()
         NSPasteboard.general.setString(value, forType: .string)
     }
+
+    private func persistSelectedFolder(_ url: URL) {
+        do {
+            let bookmark = try url.bookmarkData(
+                options: [],
+                includingResourceValuesForKeys: nil,
+                relativeTo: nil
+            )
+            UserDefaults.standard.set(bookmark, forKey: Self.selectedFolderBookmarkKey)
+        } catch {
+            errorMessage = "Unable to remember the shared folder: \(error.localizedDescription)"
+        }
+    }
+
+    private func restoreSelectedFolder() {
+        guard let bookmark = UserDefaults.standard.data(forKey: Self.selectedFolderBookmarkKey) else {
+            return
+        }
+        do {
+            var stale = false
+            let url = try URL(
+                resolvingBookmarkData: bookmark,
+                options: [],
+                relativeTo: nil,
+                bookmarkDataIsStale: &stale
+            )
+            selectedFolder = url
+            shareName = url.lastPathComponent
+            if stale {
+                persistSelectedFolder(url)
+            }
+        } catch {
+            UserDefaults.standard.removeObject(forKey: Self.selectedFolderBookmarkKey)
+            errorMessage = "Choose the shared folder again; its saved permission is no longer valid."
+        }
+    }
 }
diff --git a/macOS/GhostFile/Info.plist b/macOS/GhostFile/Info.plist
index b162c1c..0a6cbf7 100644
--- a/macOS/GhostFile/Info.plist
+++ b/macOS/GhostFile/Info.plist
@@ -15,9 +15,9 @@
 	CFBundlePackageType
 	APPL
 	CFBundleShortVersionString
-	1.0
+	1.0.20260801211105
 	CFBundleVersion
-	1
+	18
 	LSApplicationCategoryType
 	public.app-category.utilities
 	NSBonjourServices
diff --git a/macOS/GhostFile/NotarizeOptions.plist b/macOS/GhostFile/NotarizeOptions.plist
new file mode 100644
index 0000000..46c5662
--- /dev/null
+++ b/macOS/GhostFile/NotarizeOptions.plist
@@ -0,0 +1,12 @@
+
+
+
+
+	destination
+	upload
+	method
+	developer-id
+	signingStyle
+	automatic
+
+
diff --git a/macOS/GhostFileFS/GhostFileHTTPClient.swift b/macOS/GhostFileFS/GhostFileHTTPClient.swift
index 002436d..1966473 100644
--- a/macOS/GhostFileFS/GhostFileHTTPClient.swift
+++ b/macOS/GhostFileFS/GhostFileHTTPClient.swift
@@ -4,12 +4,33 @@ import Foundation
 import FSKit
 import GhostHTTP3
 import Network
+import OSLog
+
+private let ghostFileHTTP3Logger = Logger(
+    subsystem: "org.ghostvm.ghostfile.fs",
+    category: "HTTP3"
+)
+
+private let ghostFileProcessLogIdentity: String = {
+    let version = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
+    let build = Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "unknown"
+    return "version=\(version) build=\(build) pid=\(ProcessInfo.processInfo.processIdentifier)"
+}()
+
+private func ghostFileElapsedMilliseconds(since startedAt: UInt64) -> UInt64 {
+    let now = DispatchTime.now().uptimeNanoseconds
+    return now >= startedAt ? (now - startedAt) / 1_000_000 : 0
+}
 
 struct GhostFileHTTP3Client: Sendable {
-    private let transport: GhostFileHTTP3Transport
+    private let transport: GhostFileHTTP3TransportPool
     private let cache = GhostFileResponseCache()
 
-    init(resourceURL: URL) throws {
+    init(
+        resourceURL: URL,
+        connectionTimeout: Duration = .seconds(8),
+        requestTimeout: Duration = .seconds(5)
+    ) throws {
         guard resourceURL.scheme == GhostFileProtocol.urlScheme,
               let host = resourceURL.host,
               let portNumber = resourceURL.port,
@@ -21,12 +42,14 @@ struct GhostFileHTTP3Client: Sendable {
               !publicKeyPin.isEmpty else {
             throw fs_errorForPOSIXError(EINVAL)
         }
-        transport = try GhostFileHTTP3Transport(
+        transport = try GhostFileHTTP3TransportPool(
             host: host,
             port: port,
             accessKey: accessKey,
             publicKeyPin: publicKeyPin,
-            resourceBasePath: resourceURL.path
+            resourceBasePath: resourceURL.path,
+            connectionTimeout: connectionTimeout,
+            requestTimeout: requestTimeout
         )
     }
 
@@ -72,6 +95,14 @@ struct GhostFileHTTP3Client: Sendable {
         return value
     }
 
+    func invalidateTransportForTesting() async {
+        await transport.invalidateCurrentTransportForTesting()
+    }
+
+    func transportLogIDForTesting() async -> String? {
+        await transport.currentTransportLogIDForTesting()
+    }
+
     private func decode(
         _ type: T.Type,
         operation: String,
@@ -100,7 +131,9 @@ struct GhostFileHTTP3Client: Sendable {
                 length: length
             )
         } catch {
-            NSLog("GhostFile HTTP/3 request failed: %@", String(describing: error))
+            ghostFileHTTP3Logger.error(
+                "Request failed operation=\(operation, privacy: .public) error=\(String(describing: error), privacy: .public)"
+            )
             throw fs_errorForPOSIXError(ENOTCONN)
         }
         switch response.status {
@@ -120,6 +153,174 @@ struct GhostFileHTTP3Client: Sendable {
     }
 }
 
+private actor GhostFileHTTP3TransportPool {
+    private let host: String
+    private let port: NWEndpoint.Port
+    private let accessKey: String
+    private let publicKeyPin: String
+    private let resourceBasePath: String
+    private let connectionTimeout: Duration
+    private let requestTimeout: Duration
+    private var current: GhostFileHTTP3Transport?
+
+    init(
+        host: String,
+        port: NWEndpoint.Port,
+        accessKey: String,
+        publicKeyPin: String,
+        resourceBasePath: String,
+        connectionTimeout: Duration,
+        requestTimeout: Duration
+    ) throws {
+        self.host = host
+        self.port = port
+        self.accessKey = accessKey
+        self.publicKeyPin = publicKeyPin
+        self.resourceBasePath = resourceBasePath
+        self.connectionTimeout = connectionTimeout
+        self.requestTimeout = requestTimeout
+        current = try Self.makeTransport(
+            host: host,
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: publicKeyPin,
+            resourceBasePath: resourceBasePath,
+            connectionTimeout: connectionTimeout,
+            requestTimeout: requestTimeout
+        )
+    }
+
+    func request(
+        operation: String,
+        relativePath: String?,
+        offset: UInt64?,
+        length: Int?
+    ) async throws -> GhostFileHTTP3Transport.Response {
+        let requestID = Self.makeLogID()
+        let pathTag = Self.pathTag(relativePath)
+        let startedAt = DispatchTime.now().uptimeNanoseconds
+        var lastError: Error?
+        for attempt in 0...1 {
+            let candidate = try transport()
+            ghostFileHTTP3Logger.info(
+                "Request attempt request=\(requestID, privacy: .public) transport=\(candidate.logID, privacy: .public) attempt=\(attempt + 1, privacy: .public) operation=\(operation, privacy: .public) pathTag=\(pathTag, privacy: .public) offset=\(String(describing: offset), privacy: .public) length=\(String(describing: length), privacy: .public)"
+            )
+            do {
+                let response = try await candidate.request(
+                    requestID: requestID,
+                    operation: operation,
+                    relativePath: relativePath,
+                    offset: offset,
+                    length: length
+                )
+                ghostFileHTTP3Logger.info(
+                    "Request succeeded request=\(requestID, privacy: .public) transport=\(candidate.logID, privacy: .public) attempt=\(attempt + 1, privacy: .public) operation=\(operation, privacy: .public) status=\(response.status, privacy: .public) bytes=\(response.body.count, privacy: .public) totalMs=\(ghostFileElapsedMilliseconds(since: startedAt), privacy: .public)"
+                )
+                return response
+            } catch {
+                lastError = error
+                let terminal = await candidate.isTerminal
+                let requestTimedOut = Self.isRequestTimeout(error)
+                let peerClosed = Self.isCleanPeerClose(error)
+                ghostFileHTTP3Logger.error(
+                    "Request attempt failed request=\(requestID, privacy: .public) transport=\(candidate.logID, privacy: .public) attempt=\(attempt + 1, privacy: .public) operation=\(operation, privacy: .public) error=\(String(describing: error), privacy: .public) terminal=\(terminal, privacy: .public) totalMs=\(ghostFileElapsedMilliseconds(since: startedAt), privacy: .public)"
+                )
+                if requestTimedOut, !terminal {
+                    // A request deadline belongs to one HTTP/3 stream, not to
+                    // the QUIC connection. requestDeadlineExpired has already
+                    // reset that stream; keep the established transport for
+                    // sibling and subsequent requests.
+                    ghostFileHTTP3Logger.notice(
+                        "Request stream failed; transport retained request=\(requestID, privacy: .public) transport=\(candidate.logID, privacy: .public) operation=\(operation, privacy: .public) reason=requestTimedOut"
+                    )
+                    throw error
+                }
+                guard terminal else { throw error }
+                if current === candidate { current = nil }
+                guard !peerClosed else { throw error }
+                guard attempt == 0 else { throw error }
+                ghostFileHTTP3Logger.notice(
+                    "Request retry scheduled request=\(requestID, privacy: .public) retiredTransport=\(candidate.logID, privacy: .public) operation=\(operation, privacy: .public) reason=\(String(describing: error), privacy: .public) delayMs=100"
+                )
+                try? await Task.sleep(for: .milliseconds(100))
+            }
+        }
+        throw lastError ?? GhostFileHTTP3Transport.TransportError.closed
+    }
+
+    func invalidateCurrentTransportForTesting() async {
+        await current?.invalidateForTesting()
+    }
+
+    func currentTransportLogIDForTesting() -> String? {
+        current?.logID
+    }
+
+    private func transport() throws -> GhostFileHTTP3Transport {
+        if let current { return current }
+        let replacement = try Self.makeTransport(
+            host: host,
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: publicKeyPin,
+            resourceBasePath: resourceBasePath,
+            connectionTimeout: connectionTimeout,
+            requestTimeout: requestTimeout
+        )
+        current = replacement
+        ghostFileHTTP3Logger.notice(
+            "Transport pool installed transport=\(replacement.logID, privacy: .public) host=\(self.host, privacy: .public) port=\(self.port.rawValue, privacy: .public)"
+        )
+        return replacement
+    }
+
+    private nonisolated static func makeLogID() -> String {
+        String(UUID().uuidString.prefix(12)).lowercased()
+    }
+
+    private nonisolated static func pathTag(_ path: String?) -> String {
+        guard let path else { return "none" }
+        let digest = SHA256.hash(data: Data(path.utf8))
+        return digest.prefix(6).map { String(format: "%02x", $0) }.joined()
+    }
+
+    private nonisolated static func makeTransport(
+        host: String,
+        port: NWEndpoint.Port,
+        accessKey: String,
+        publicKeyPin: String,
+        resourceBasePath: String,
+        connectionTimeout: Duration,
+        requestTimeout: Duration
+    ) throws -> GhostFileHTTP3Transport {
+        try GhostFileHTTP3Transport(
+            host: host,
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: publicKeyPin,
+            resourceBasePath: resourceBasePath,
+            connectionTimeout: connectionTimeout,
+            requestTimeout: requestTimeout
+        )
+    }
+
+    private nonisolated static func isRequestTimeout(_ error: Error) -> Bool {
+        guard let transportError = error as? GhostFileHTTP3Transport.TransportError else {
+            return false
+        }
+        if case .requestTimedOut = transportError { return true }
+        return false
+    }
+
+    private nonisolated static func isCleanPeerClose(_ error: Error) -> Bool {
+        guard let transportError = error as? GhostFileHTTP3Transport.TransportError else {
+            return false
+        }
+        if case .peerClosed = transportError { return true }
+        return false
+    }
+}
+
 private actor GhostFileResponseCache {
     private struct Entry: Sendable {
         let value: Value
@@ -254,9 +455,14 @@ actor GhostFileHTTP3Transport {
     private let host: String
     private let resourceBasePath: String
     private let expectedCertificatePin: String
+    private let connectionTimeout: Duration
+    private let requestTimeout: Duration
     private let connection: NWConnection
     private let http3: GhostFileHTTP3Connection
+    nonisolated let logID = String(UUID().uuidString.prefix(12)).lowercased()
+    private let createdAt = DispatchTime.now().uptimeNanoseconds
     private var timeoutTask: Task?
+    private var connectionDeadlineTask: Task?
     private var hasStarted = false
     private var isNetworkReady = false
     private var hasValidatedPeer = false
@@ -269,33 +475,52 @@ actor GhostFileHTTP3Transport {
     private var isFlushing = false
     private var flushAgain = false
     private var pendingReceivedDatagrams: [Data] = []
+    private var pendingScheduledDatagram: GhostFileScheduledDatagram?
     private var isReceiveDrainScheduled = false
+    private var receivedDatagramCount = 0
+    private var receivedByteCount = 0
+    private var sentDatagramCount = 0
+    private var sentByteCount = 0
+
+    var isTerminal: Bool { terminalError != nil }
 
     init(
         host: String,
         port: NWEndpoint.Port,
         accessKey: String,
         publicKeyPin: String,
-        resourceBasePath: String = "/"
+        resourceBasePath: String = "/",
+        connectionTimeout: Duration = .seconds(8),
+        requestTimeout: Duration = .seconds(15)
     ) throws {
         self.accessKey = accessKey
         self.host = host
         self.resourceBasePath = resourceBasePath
         self.expectedCertificatePin = publicKeyPin
+        self.connectionTimeout = connectionTimeout
+        self.requestTimeout = requestTimeout
         let parameters = NWParameters.udp
         parameters.includePeerToPeer = true
         connection = NWConnection(host: NWEndpoint.Host(host), port: port, using: parameters)
         http3 = try GhostFileHTTP3Connection(role: .client(serverName: host))
+        ghostFileHTTP3Logger.notice(
+            "Transport created transport=\(self.logID, privacy: .public) \(ghostFileProcessLogIdentity, privacy: .public) host=\(host, privacy: .public) port=\(port.rawValue, privacy: .public) connectionTimeout=\(String(describing: connectionTimeout), privacy: .public) requestTimeout=\(String(describing: requestTimeout), privacy: .public)"
+        )
     }
 
     func request(
+        requestID: String = String(UUID().uuidString.prefix(12)).lowercased(),
         operation: String,
         relativePath: String?,
         offset: UInt64?,
         length: Int?
     ) async throws -> Response {
+        let requestStartedAt = DispatchTime.now().uptimeNanoseconds
+        ghostFileHTTP3Logger.info(
+            "Transport request begin request=\(requestID, privacy: .public) transport=\(self.logID, privacy: .public) operation=\(operation, privacy: .public) started=\(self.hasStarted, privacy: .public) networkReady=\(self.isNetworkReady, privacy: .public) peerValidated=\(self.hasValidatedPeer, privacy: .public) pending=\(self.pending.count, privacy: .public)"
+        )
         try await ensureHTTP3Ready()
-        try await acquireRequestStreamCredit()
+        try await acquireRequestStreamCredit(requestID: requestID, operation: operation)
         do {
             try Task.checkCancellation()
             if let terminalError { throw terminalError }
@@ -303,6 +528,9 @@ actor GhostFileHTTP3Transport {
             releaseReservedStreamCredit()
             throw error
         }
+        ghostFileHTTP3Logger.info(
+            "Transport request ready request=\(requestID, privacy: .public) transport=\(self.logID, privacy: .public) operation=\(operation, privacy: .public) readyMs=\(ghostFileElapsedMilliseconds(since: requestStartedAt), privacy: .public)"
+        )
         var components = URLComponents()
         components.path = operationPath(operation)
         if let relativePath {
@@ -316,6 +544,7 @@ actor GhostFileHTTP3Transport {
             (":path", path),
             ("authorization", "Bearer \(accessKey)"),
             ("accept", "application/json, application/octet-stream"),
+            ("x-ghostfile-request-id", requestID),
         ]
         if let offset, let length, length > 0 {
             headers.append(("range", "bytes=\(offset)-\(offset + UInt64(length) - 1)"))
@@ -329,9 +558,25 @@ actor GhostFileHTTP3Transport {
             grantAvailableStreamCredits()
             throw error
         }
+        ghostFileHTTP3Logger.info(
+            "HTTP/3 stream opened request=\(requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(operation, privacy: .public) openMs=\(ghostFileElapsedMilliseconds(since: requestStartedAt), privacy: .public)"
+        )
         return try await withTaskCancellationHandler {
             try await withCheckedThrowingContinuation { continuation in
-                pending[streamID] = PendingResponse(continuation: continuation)
+                let deadlineTask = Task { [weak self, requestTimeout] in
+                    do {
+                        try await Task.sleep(for: requestTimeout)
+                        guard !Task.isCancelled else { return }
+                        await self?.requestDeadlineExpired(streamID: streamID)
+                    } catch {}
+                }
+                pending[streamID] = PendingResponse(
+                    requestID: requestID,
+                    operation: operation,
+                    startedAt: requestStartedAt,
+                    continuation: continuation,
+                    deadlineTask: deadlineTask
+                )
                 Task { await self.flushOutgoing() }
             }
         } onCancel: {
@@ -390,11 +635,21 @@ actor GhostFileHTTP3Transport {
     private func start() {
         guard !hasStarted else { return }
         hasStarted = true
+        ghostFileHTTP3Logger.notice(
+            "UDP connection starting transport=\(self.logID, privacy: .public) host=\(self.host, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+        )
         connection.stateUpdateHandler = { [weak self] state in
             guard let self else { return }
             Task { await self.connectionStateChanged(state) }
         }
         connection.start(queue: DispatchQueue(label: "org.ghostvm.ghostfile.http3.client"))
+        connectionDeadlineTask = Task { [weak self, connectionTimeout] in
+            do {
+                try await Task.sleep(for: connectionTimeout)
+                guard !Task.isCancelled else { return }
+                await self?.connectionDeadlineExpired()
+            } catch {}
+        }
         connection.batch {
             for _ in 0.. previousCount {
+                    response.firstDataAt = DispatchTime.now().uptimeNanoseconds
+                    ghostFileHTTP3Logger.info(
+                        "Response first data request=\(response.requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(response.operation, privacy: .public) bytes=\(response.body.count - previousCount, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: response.startedAt), privacy: .public)"
+                    )
+                }
                 guard response.body.count <= GhostFileProtocol.maximumReadLength + 1024 * 1024 else {
                     throw TransportError.invalidResponse
                 }
-                pending[streamID] = response
             case .finished(let streamID):
-                guard let response = pending.removeValue(forKey: streamID),
-                      let status = response.status else {
+                guard let response = pending.removeValue(forKey: streamID) else { continue }
+                guard let status = response.status else {
                     throw TransportError.invalidResponse
                 }
+                response.deadlineTask.cancel()
+                ghostFileHTTP3Logger.info(
+                    "Response finished request=\(response.requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(response.operation, privacy: .public) status=\(status, privacy: .public) bytes=\(response.body.count, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: response.startedAt), privacy: .public)"
+                )
                 response.continuation.resume(returning: Response(status: status, body: response.body))
             case .reset(let streamID):
-                pending.removeValue(forKey: streamID)?.continuation.resume(throwing: TransportError.streamReset)
+                if let response = pending.removeValue(forKey: streamID) {
+                    response.deadlineTask.cancel()
+                    ghostFileHTTP3Logger.error(
+                        "Response reset request=\(response.requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(response.operation, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: response.startedAt), privacy: .public)"
+                    )
+                    response.continuation.resume(throwing: TransportError.streamReset)
+                }
             }
         }
     }
 
-    private func acquireRequestStreamCredit() async throws {
+    private func acquireRequestStreamCredit(requestID: String, operation: String) async throws {
         if unreservedStreamCreditCount > 0 {
             reservedStreamCredits += 1
             return
         }
 
         let waiterID = UUID()
+        ghostFileHTTP3Logger.notice(
+            "HTTP/3 stream credit wait request=\(requestID, privacy: .public) transport=\(self.logID, privacy: .public) operation=\(operation, privacy: .public) waiters=\(self.streamCreditWaiters.count + 1, privacy: .public)"
+        )
         try await withTaskCancellationHandler {
             try await withCheckedThrowingContinuation { continuation in
-                let deadlineTask = Task { [weak self] in
+                let deadlineTask = Task { [weak self, requestTimeout] in
                     do {
-                        try await Task.sleep(for: .seconds(15))
+                        try await Task.sleep(for: requestTimeout)
                         guard !Task.isCancelled else { return }
                         await self?.streamCreditWaiterExpired(id: waiterID)
                     } catch {}
                 }
                 streamCreditWaiters.append(PendingStreamCredit(
                     id: waiterID,
+                    requestID: requestID,
+                    operation: operation,
                     continuation: continuation,
                     deadlineTask: deadlineTask
                 ))
@@ -543,6 +856,9 @@ actor GhostFileHTTP3Transport {
             let waiter = streamCreditWaiters.removeFirst()
             reservedStreamCredits += 1
             waiter.deadlineTask.cancel()
+            ghostFileHTTP3Logger.notice(
+                "HTTP/3 stream credit granted request=\(waiter.requestID, privacy: .public) transport=\(self.logID, privacy: .public) operation=\(waiter.operation, privacy: .public) remainingWaiters=\(self.streamCreditWaiters.count, privacy: .public)"
+            )
             waiter.continuation.resume()
         }
     }
@@ -562,7 +878,39 @@ actor GhostFileHTTP3Transport {
     private func streamCreditWaiterExpired(id: UUID) {
         guard let index = streamCreditWaiters.firstIndex(where: { $0.id == id }) else { return }
         let waiter = streamCreditWaiters.remove(at: index)
-        waiter.continuation.resume(throwing: TransportError.streamCreditTimedOut)
+        ghostFileHTTP3Logger.error(
+            "HTTP/3 stream credit deadline expired request=\(waiter.requestID, privacy: .public) transport=\(self.logID, privacy: .public) operation=\(waiter.operation, privacy: .public) waiters=\(self.streamCreditWaiters.count + 1, privacy: .public)"
+        )
+        waiter.continuation.resume(throwing: TransportError.requestTimedOut)
+    }
+
+    private func connectionDeadlineExpired() {
+        guard !hasValidatedPeer, terminalError == nil else { return }
+        ghostFileHTTP3Logger.error(
+            "QUIC handshake deadline expired transport=\(self.logID, privacy: .public) networkReady=\(self.isNetworkReady, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) receivedBytes=\(self.receivedByteCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) sentBytes=\(self.sentByteCount, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+        )
+        fail(TransportError.connectionTimedOut)
+    }
+
+    private func requestDeadlineExpired(streamID: UInt64) async {
+        guard let response = pending.removeValue(forKey: streamID), terminalError == nil else { return }
+        ghostFileHTTP3Logger.error(
+            "Request deadline expired request=\(response.requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(response.operation, privacy: .public) status=\(String(describing: response.status), privacy: .public) bodyBytes=\(response.body.count, privacy: .public) networkReady=\(self.isNetworkReady, privacy: .public) peerValidated=\(self.hasValidatedPeer, privacy: .public) pending=\(self.pending.count + 1, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: response.startedAt), privacy: .public)"
+        )
+        http3.cancelRequest(streamID: streamID)
+        response.continuation.resume(throwing: TransportError.requestTimedOut)
+        await flushOutgoing()
+    }
+
+    private func cancelPendingRequest(streamID: UInt64) async {
+        guard let response = pending.removeValue(forKey: streamID) else { return }
+        response.deadlineTask.cancel()
+        ghostFileHTTP3Logger.notice(
+            "Request cancelled request=\(response.requestID, privacy: .public) transport=\(self.logID, privacy: .public) stream=\(streamID, privacy: .public) operation=\(response.operation, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: response.startedAt), privacy: .public)"
+        )
+        http3.cancelRequest(streamID: streamID)
+        response.continuation.resume(throwing: CancellationError())
+        await flushOutgoing()
     }
 
     private func flushOutgoing() async {
@@ -580,14 +928,41 @@ actor GhostFileHTTP3Transport {
                     let produceStartedAt = DispatchTime.now().uptimeNanoseconds
                     var datagrams: [Data] = []
                     datagrams.reserveCapacity(GhostFileNetworkDatagram.maximumSendBatchCount)
-                    while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount,
-                          let datagram = try http3.nextDatagram() {
-                        datagrams.append(datagram)
+                    var transportDrained = false
+                    while datagrams.count < GhostFileNetworkDatagram.maximumSendBatchCount {
+                        let scheduled: GhostFileScheduledDatagram
+                        if let pendingScheduledDatagram {
+                            scheduled = pendingScheduledDatagram
+                        } else if let next = try http3.nextScheduledDatagram() {
+                            scheduled = next
+                        } else {
+                            transportDrained = true
+                            break
+                        }
+                        let now = ghostFileMonotonicNanoseconds()
+                        guard scheduled.sendAtNanoseconds <= now else {
+                            pendingScheduledDatagram = scheduled
+                            break
+                        }
+                        pendingScheduledDatagram = nil
+                        datagrams.append(scheduled.data)
+                    }
+                    if datagrams.isEmpty {
+                        if transportDrained { break }
+                        guard let pendingScheduledDatagram else { break }
+                        let now = ghostFileMonotonicNanoseconds()
+                        if pendingScheduledDatagram.sendAtNanoseconds > now {
+                            try await Task.sleep(
+                                nanoseconds: pendingScheduledDatagram.sendAtNanoseconds - now
+                            )
+                        }
+                        continue
                     }
-                    guard !datagrams.isEmpty else { break }
                     let produceFinishedAt = DispatchTime.now().uptimeNanoseconds
                     try await connection.sendGhostFileDatagrams(datagrams)
                     let sendFinishedAt = DispatchTime.now().uptimeNanoseconds
+                    sentDatagramCount += datagrams.count
+                    sentByteCount += datagrams.reduce(into: 0) { $0 += $1.count }
                     http3.recordSendBatch(
                         packetCount: datagrams.count,
                         produceNanoseconds: produceFinishedAt - produceStartedAt,
@@ -616,19 +991,19 @@ actor GhostFileHTTP3Transport {
     private func timeoutFired() async {
         http3.handleTimeout()
         await flushOutgoing()
-        if http3.isClosed { fail(TransportError.closed) }
-    }
-
-    private func cancelPendingRequest(streamID: UInt64) async {
-        guard let response = pending.removeValue(forKey: streamID) else { return }
-        http3.cancelRequest(streamID: streamID)
-        response.continuation.resume(throwing: CancellationError())
-        await flushOutgoing()
+        if http3.isClosed {
+            ghostFileHTTP3Logger.error(
+                "QUIC timeout closed transport transport=\(self.logID, privacy: .public) pending=\(self.pending.count, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+            )
+            fail(TransportError.closed)
+        }
     }
 
     private func fail(_ error: Error) {
         guard terminalError == nil else { return }
-        NSLog("GhostFile HTTP/3 transport failed: %@", String(describing: error))
+        ghostFileHTTP3Logger.error(
+            "Transport failed transport=\(self.logID, privacy: .public) error=\(String(describing: error), privacy: .public) networkReady=\(self.isNetworkReady, privacy: .public) peerValidated=\(self.hasValidatedPeer, privacy: .public) pending=\(self.pending.count, privacy: .public) receivedDatagrams=\(self.receivedDatagramCount, privacy: .public) receivedBytes=\(self.receivedByteCount, privacy: .public) sentDatagrams=\(self.sentDatagramCount, privacy: .public) sentBytes=\(self.sentByteCount, privacy: .public) elapsedMs=\(ghostFileElapsedMilliseconds(since: self.createdAt), privacy: .public)"
+        )
         terminalError = error
         readyWaiters.values.forEach { $0.resume(throwing: error) }
         handshakeWaiters.values.forEach { $0.resume(throwing: error) }
@@ -642,6 +1017,8 @@ actor GhostFileHTTP3Transport {
         }
         streamCreditWaiters.removeAll()
         timeoutTask?.cancel()
+        connectionDeadlineTask?.cancel()
+        pendingScheduledDatagram = nil
         connection.cancel()
     }
 
@@ -657,23 +1034,47 @@ actor GhostFileHTTP3Transport {
             .replacingOccurrences(of: "=", with: "")
     }
 
-    private struct PendingResponse {
+    private final class PendingResponse {
+        let requestID: String
+        let operation: String
+        let startedAt: UInt64
         let continuation: CheckedContinuation
+        let deadlineTask: Task
         var status: Int?
         var body = Data()
+        var headersAt: UInt64?
+        var firstDataAt: UInt64?
+
+        init(
+            requestID: String,
+            operation: String,
+            startedAt: UInt64,
+            continuation: CheckedContinuation,
+            deadlineTask: Task
+        ) {
+            self.requestID = requestID
+            self.operation = operation
+            self.startedAt = startedAt
+            self.continuation = continuation
+            self.deadlineTask = deadlineTask
+        }
     }
 
     private struct PendingStreamCredit {
         let id: UUID
+        let requestID: String
+        let operation: String
         let continuation: CheckedContinuation
         let deadlineTask: Task
     }
 
-    private enum TransportError: Error {
+    enum TransportError: Error {
         case invalidResponse
         case certificatePinMismatch
         case streamReset
-        case streamCreditTimedOut
+        case connectionTimedOut
+        case requestTimedOut
+        case peerClosed
         case closed
     }
 }
diff --git a/macOS/GhostFileFS/GhostFileSystem.swift b/macOS/GhostFileFS/GhostFileSystem.swift
index 282a9de..c28dd64 100644
--- a/macOS/GhostFileFS/GhostFileSystem.swift
+++ b/macOS/GhostFileFS/GhostFileSystem.swift
@@ -8,9 +8,10 @@ final class GhostFileSystem: FSUnaryFileSystem, FSUnaryFileSystemOperations {
               let shareID = Self.shareID(from: resource.url) else {
             return .notRecognized
         }
+        let mountID = GhostFileProtocol.mountInstanceID(from: resource.url) ?? shareID
         return .usable(
             name: "GhostFile",
-            containerID: FSContainerIdentifier(uuid: shareID)
+            containerID: FSContainerIdentifier(uuid: mountID)
         )
     }
 
@@ -20,6 +21,7 @@ final class GhostFileSystem: FSUnaryFileSystem, FSUnaryFileSystemOperations {
               let shareID = Self.shareID(from: resource.url) else {
             throw fs_errorForPOSIXError(ENOTSUP)
         }
+        let mountID = GhostFileProtocol.mountInstanceID(from: resource.url) ?? shareID
         let client = try GhostFileHTTP3Client(resourceURL: resource.url)
         let capabilities = try await client.capabilities()
         guard capabilities.protocolVersion == GhostFileProtocol.version,
@@ -29,7 +31,9 @@ final class GhostFileSystem: FSUnaryFileSystem, FSUnaryFileSystemOperations {
         }
         containerStatus = .ready
         return GhostFileVolume(
-            volumeID: FSVolume.Identifier(uuid: shareID),
+            // LiveFS performs its final connector lookup using this identity.
+            // Use the same unqualified per-mount UUID returned by probeResource.
+            volumeID: FSVolume.Identifier(uuid: mountID),
             volumeName: FSFileName(string: capabilities.name),
             client: client
         )
diff --git a/macOS/GhostFileFS/Info.plist b/macOS/GhostFileFS/Info.plist
index 3e06c03..d33a6da 100644
--- a/macOS/GhostFileFS/Info.plist
+++ b/macOS/GhostFileFS/Info.plist
@@ -15,9 +15,9 @@
 	CFBundlePackageType
 	XPC!
 	CFBundleShortVersionString
-	1.0
+	1.0.20260801211105
 	CFBundleVersion
-	1
+	18
 	EXAppExtensionAttributes
 	
 		EXExtensionPointIdentifier
diff --git a/macOS/GhostFileShared/GhostFileHTTP3.swift b/macOS/GhostFileShared/GhostFileHTTP3.swift
index 24676cd..583d403 100644
--- a/macOS/GhostFileShared/GhostFileHTTP3.swift
+++ b/macOS/GhostFileShared/GhostFileHTTP3.swift
@@ -4,6 +4,9 @@ import GhostHTTP3
 import Network
 
 final class GhostFileHTTP3Connection: @unchecked Sendable {
+    static let h3NoError: UInt64 = 0x0100
+    static let h3InternalError: UInt64 = 0x0102
+
     private static let maximumUDPPayloadSize: Int = {
         guard let rawValue = ProcessInfo.processInfo.environment["GHOSTFILE_HTTP3_UDP_PAYLOAD_SIZE"],
               let value = Int(rawValue), (1_200...65_527).contains(value) else {
@@ -45,6 +48,10 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
     private var quicConnection: OpaquePointer?
     private var http3Connection: OpaquePointer?
     private var currentEvent: OpaquePointer?
+    // Reuse one receive buffer per QUIC connection. Every caller confines a
+    // GhostFileHTTP3Connection to its connection actor, so this storage is
+    // never accessed concurrently.
+    private var receiveScratchBuffer = Data(count: 64 * 1024)
     private var pendingResponses: [UInt64: PendingHTTP3Response] = [:]
     private var peerTerminatedResponseStreamIDs: [UInt64] = []
     private var failedResponseStreamIDs: [UInt64] = []
@@ -92,6 +99,12 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         quiche_config_set_max_idle_timeout(quicConfiguration, 60_000)
         quiche_config_set_max_recv_udp_payload_size(quicConfiguration, Self.maximumUDPPayloadSize)
         quiche_config_set_max_send_udp_payload_size(quicConfiguration, Self.maximumUDPPayloadSize)
+        // Start application traffic at QUIC's guaranteed 1200-byte datagram
+        // size and probe upward before using the configured maximum. Without
+        // DPLPMTUD, a path that carries the 1200-byte handshake but drops our
+        // former 1350-byte data packets becomes a permanent MTU black hole.
+        // This is common across VM bridges, VPNs, and IPv6 paths.
+        quiche_config_discover_pmtu(quicConfiguration, true)
         quiche_config_set_initial_max_data(quicConfiguration, 64 * 1024 * 1024)
         quiche_config_set_initial_max_stream_data_bidi_local(quicConfiguration, 2 * 1024 * 1024)
         quiche_config_set_initial_max_stream_data_bidi_remote(quicConfiguration, 2 * 1024 * 1024)
@@ -162,6 +175,32 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         return quiche_conn_is_closed(quicConnection)
     }
 
+    var isClosedOrDraining: Bool {
+        guard let quicConnection else { return false }
+        return quiche_conn_is_closed(quicConnection) || quiche_conn_is_draining(quicConnection)
+    }
+
+    var peerConnectionError: (isApplication: Bool, code: UInt64, reason: String)? {
+        guard let quicConnection else { return nil }
+        var isApplication = false
+        var code: UInt64 = 0
+        var reasonPointer: UnsafePointer?
+        var reasonLength = 0
+        guard quiche_conn_peer_error(
+            quicConnection,
+            &isApplication,
+            &code,
+            &reasonPointer,
+            &reasonLength
+        ) else {
+            return nil
+        }
+        let reason = reasonPointer.map {
+            String(decoding: UnsafeBufferPointer(start: $0, count: reasonLength), as: UTF8.self)
+        } ?? ""
+        return (isApplication, code, reason)
+    }
+
     var timeoutNanoseconds: UInt64? {
         guard let quicConnection else { return nil }
         let value = quiche_conn_timeout_as_nanos(quicConnection)
@@ -178,6 +217,26 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         quiche_conn_on_timeout(quicConnection)
     }
 
+    func close(
+        applicationErrorCode: UInt64 = GhostFileHTTP3Connection.h3NoError,
+        reason: String = "share-stopped"
+    ) throws {
+        guard let quicConnection, !isClosedOrDraining else { return }
+        let reasonBytes = Array(reason.utf8)
+        let result = reasonBytes.withUnsafeBufferPointer { bytes in
+            quiche_conn_close(
+                quicConnection,
+                true,
+                applicationErrorCode,
+                bytes.baseAddress,
+                bytes.count
+            )
+        }
+        guard result == 0 else {
+            throw ConnectionError.connection("Unable to close the QUIC connection (\(result))")
+        }
+    }
+
     func receive(_ datagram: Data) throws {
         if quicConnection == nil {
             try acceptInitial(datagram)
@@ -209,7 +268,7 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         try pumpResponseBodies()
     }
 
-    func nextDatagram() throws -> Data? {
+    func nextScheduledDatagram() throws -> GhostFileScheduledDatagram? {
         guard let quicConnection else { return nil }
         if Self.diagnosticsEnabled { diagnosticNextDatagramCalls += 1 }
         try pumpResponseBodies()
@@ -231,21 +290,27 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
             throw ConnectionError.connection("QUIC could not produce a UDP datagram (\(length))")
         }
         output.count = length
+        let nowNanoseconds = ghostFileMonotonicNanoseconds()
+        let rawSendNanoseconds = Int64(sendInfo.at.tv_sec) * 1_000_000_000
+            + Int64(sendInfo.at.tv_nsec)
+        let sendNanoseconds = rawSendNanoseconds > 0 ? UInt64(rawSendNanoseconds) : nowNanoseconds
         if Self.diagnosticsEnabled {
             diagnosticDatagrams += 1
             diagnosticDatagramBytes += length
-            var now = timespec()
-            clock_gettime(CLOCK_MONOTONIC, &now)
-            let nowNanoseconds = Int64(now.tv_sec) * 1_000_000_000 + Int64(now.tv_nsec)
-            let sendNanoseconds = Int64(sendInfo.at.tv_sec) * 1_000_000_000 + Int64(sendInfo.at.tv_nsec)
             if sendNanoseconds > nowNanoseconds {
-                let delay = UInt64(sendNanoseconds - nowNanoseconds)
+                let delay = sendNanoseconds - nowNanoseconds
                 diagnosticFuturePacingPackets += 1
                 diagnosticFuturePacingNanoseconds += delay
                 diagnosticMaximumPacingNanoseconds = max(diagnosticMaximumPacingNanoseconds, delay)
             }
         }
-        return output
+        return GhostFileScheduledDatagram(data: output, sendAtNanoseconds: sendNanoseconds)
+    }
+
+    // The in-memory protocol tests intentionally deliver datagrams without a
+    // wall clock. Production Network.framework callers use the scheduled API.
+    func nextDatagram() throws -> Data? {
+        try nextScheduledDatagram()?.data
     }
 
     func recordSendBatch(packetCount: Int, produceNanoseconds: UInt64, networkNanoseconds: UInt64) {
@@ -478,27 +543,41 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
         }
     }
 
-    func receiveBody(streamID: UInt64) throws -> Data {
-        guard let quicConnection, let http3Connection else { return Data() }
-        var result = Data()
-        var buffer = Data(count: 64 * 1024)
+    func receiveBody(streamID: UInt64, into destination: inout Data) throws {
+        try drainReceivedBody(streamID: streamID) { bytes in
+            guard let baseAddress = bytes.baseAddress, !bytes.isEmpty else { return }
+            destination.append(baseAddress.assumingMemoryBound(to: UInt8.self), count: bytes.count)
+        }
+    }
+
+    func discardReceivedBody(streamID: UInt64) throws {
+        try drainReceivedBody(streamID: streamID) { _ in }
+    }
+
+    private func drainReceivedBody(
+        streamID: UInt64,
+        consume: (UnsafeRawBufferPointer) -> Void
+    ) throws {
+        guard let quicConnection, let http3Connection else { return }
         while true {
-            let count = buffer.withUnsafeMutableBytes { bytes in
-                Int(quiche_h3_recv_body(
+            let count = receiveScratchBuffer.withUnsafeMutableBytes { bytes -> Int in
+                let count = Int(quiche_h3_recv_body(
                     http3Connection,
                     quicConnection,
                     streamID,
                     bytes.bindMemory(to: UInt8.self).baseAddress,
                     bytes.count
                 ))
+                if count > 0 {
+                    consume(UnsafeRawBufferPointer(start: bytes.baseAddress, count: count))
+                }
+                return count
             }
             if count == Int(QUICHE_H3_ERR_DONE.rawValue) { break }
             guard count >= 0 else {
                 throw ConnectionError.http3("Unable to receive an HTTP/3 body (\(count))")
             }
-            result.append(buffer.prefix(count))
         }
-        return result
     }
 
     private func acceptInitial(_ datagram: Data) throws {
@@ -688,6 +767,17 @@ final class GhostFileHTTP3Connection: @unchecked Sendable {
     }
 }
 
+struct GhostFileScheduledDatagram: Sendable {
+    let data: Data
+    let sendAtNanoseconds: UInt64
+}
+
+func ghostFileMonotonicNanoseconds() -> UInt64 {
+    var now = timespec()
+    clock_gettime(CLOCK_MONOTONIC, &now)
+    return UInt64(now.tv_sec) * 1_000_000_000 + UInt64(now.tv_nsec)
+}
+
 private struct PendingHTTP3Response {
     let headers: [(String, String)]
     let expectedBodyLength: Int
@@ -791,7 +881,10 @@ enum GhostFileNetworkDatagram {
     static let maximumSendBatchCount: Int = {
         guard let rawValue = ProcessInfo.processInfo.environment["GHOSTFILE_HTTP3_SEND_BATCH_COUNT"],
               let value = Int(rawValue), (1...1_024).contains(value) else {
-            return 64
+            // Sixteen packets keeps Network.framework submissions bounded
+            // without sacrificing loopback throughput. The former 64-packet
+            // default produced avoidable ~86 KiB UDP bursts on real links.
+            return 16
         }
         return value
     }()
diff --git a/macOS/GhostFileShared/GhostFileProtocol.swift b/macOS/GhostFileShared/GhostFileProtocol.swift
index 74018a9..99c28ba 100644
--- a/macOS/GhostFileShared/GhostFileProtocol.swift
+++ b/macOS/GhostFileShared/GhostFileProtocol.swift
@@ -11,10 +11,26 @@ enum GhostFileProtocol {
     static let maximumInlineFileLength = 64 * 1024
     static let maximumInlineDirectoryLength = 512 * 1024
     static let maximumInlineDirectoryFileCount = 256
+    static let mountInstanceQueryName = "mount_instance"
 
     static func shareBasePath(id: UUID) -> String {
         "/v1/shares/\(id.uuidString.lowercased())"
     }
+
+    /// FSKit uses the resource and volume identifiers to serialize work. Give
+    /// every network mount a connection-specific UUID so a dead mount cannot
+    /// leave a later connection to the same share permanently EBUSY.
+    ///
+    /// Although FSKit also exposes an eight-byte identifier qualifier for this
+    /// purpose, macOS 26.4 drops it during the final LiveFS connector lookup.
+    /// A plain UUID survives that handoff intact.
+    static func mountInstanceID(from url: URL) -> UUID? {
+        guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
+              let value = components.queryItems?.first(where: {
+                  $0.name == mountInstanceQueryName
+              })?.value else { return nil }
+        return UUID(uuidString: value)
+    }
 }
 
 struct GhostFileHTTPRequest: Sendable {
diff --git a/macOS/GhostFileTests/GhostFileProtocolTests.swift b/macOS/GhostFileTests/GhostFileProtocolTests.swift
index 588e79f..2bc9915 100644
--- a/macOS/GhostFileTests/GhostFileProtocolTests.swift
+++ b/macOS/GhostFileTests/GhostFileProtocolTests.swift
@@ -4,6 +4,22 @@ import XCTest
 @testable import GhostFile
 
 final class GhostFileProtocolTests: XCTestCase {
+    func testMountInstancesIdentifyOtherwiseIdenticalNetworkVolumes() throws {
+        let first = UUID(uuidString: "11111111-2222-3333-4444-555555555555")!
+        let second = UUID(uuidString: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee")!
+        let base = "ghostfile://example.local:443/v1/shares/99999999-8888-7777-6666-555555555555"
+        let firstURL = try XCTUnwrap(URL(string: "\(base)?mount_instance=\(first.uuidString)"))
+        let secondURL = try XCTUnwrap(URL(string: "\(base)?mount_instance=\(second.uuidString)"))
+
+        XCTAssertEqual(GhostFileProtocol.mountInstanceID(from: firstURL), first)
+        XCTAssertEqual(GhostFileProtocol.mountInstanceID(from: secondURL), second)
+        XCTAssertNotEqual(
+            GhostFileProtocol.mountInstanceID(from: firstURL),
+            GhostFileProtocol.mountInstanceID(from: secondURL)
+        )
+        XCTAssertNil(GhostFileProtocol.mountInstanceID(from: try XCTUnwrap(URL(string: base))))
+    }
+
     func testRelativePathValidationRejectsEscapes() {
         XCTAssertEqual(GhostFilePath.validatedComponents("folder/file.txt"), ["folder", "file.txt"])
         XCTAssertEqual(GhostFilePath.validatedComponents(""), [])
@@ -27,6 +43,38 @@ final class GhostFileProtocolTests: XCTestCase {
     }
 }
 
+final class GhostFileBonjourLeaseTests: XCTestCase {
+    func testAdvertisedTTLIsShortAndHeartbeatRefreshesBeforeExpiry() {
+        XCTAssertEqual(GhostFileBonjourLease.advertisedTTL, 6)
+        XCTAssertLessThan(
+            GhostFileBonjourLease.heartbeatInterval,
+            .seconds(GhostFileBonjourLease.advertisedTTL)
+        )
+    }
+
+    func testTTLParsingBoundsUntrustedAdvertisements() {
+        XCTAssertEqual(GhostFileBonjourLease.ttl(from: [:]), 15)
+        XCTAssertEqual(GhostFileBonjourLease.ttl(from: ["ttl": Data("1".utf8)]), 4)
+        XCTAssertEqual(GhostFileBonjourLease.ttl(from: ["ttl": Data("6".utf8)]), 6)
+        XCTAssertEqual(GhostFileBonjourLease.ttl(from: ["ttl": Data("600".utf8)]), 60)
+        XCTAssertEqual(GhostFileBonjourLease.ttl(from: ["ttl": Data("invalid".utf8)]), 15)
+    }
+
+    func testLeaseExpiresAtAdvertisedTTL() {
+        let lastSeen = Date(timeIntervalSince1970: 1_000)
+        XCTAssertFalse(GhostFileBonjourLease.isExpired(
+            lastSeen: lastSeen,
+            ttl: 6,
+            now: Date(timeIntervalSince1970: 1_005.999)
+        ))
+        XCTAssertTrue(GhostFileBonjourLease.isExpired(
+            lastSeen: lastSeen,
+            ttl: 6,
+            now: Date(timeIntervalSince1970: 1_006)
+        ))
+    }
+}
+
 final class GhostFileShareRouterTests: XCTestCase {
     private var directory: URL!
     private var router: GhostFileShareRouter!
diff --git a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
index 36294e6..2349b4c 100644
--- a/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
+++ b/macOS/GhostFileTests/GhostFileQUICIntegrationTests.swift
@@ -4,6 +4,170 @@ import XCTest
 @testable import GhostFile
 
 final class GhostFileHTTP3IntegrationTests: XCTestCase {
+    func testPublishedShareURLConnectsThroughResolvedBonjourHost() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-share-url-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "bonjour-share-url-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "URLTest-\(UUID().uuidString)",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        guard var components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false) else {
+            throw TestError.missingShareURL
+        }
+        components.queryItems = (components.queryItems ?? []) + [
+            URLQueryItem(name: "access_key", value: accessKey)
+        ]
+        let resourceURL = try XCTUnwrap(components.url)
+        let client = try GhostFileHTTP3Client(resourceURL: resourceURL)
+        let capabilities = try await client.capabilities()
+        let expectedShareID = await MainActor.run { server.shareID }
+
+        XCTAssertEqual(capabilities.shareID, expectedShareID)
+        XCTAssertEqual(shareURL.host?.hasSuffix(".local"), true)
+        XCTAssertNotEqual(shareURL.host, "connectivity-check.warp-svc.local")
+    }
+
+    func testClientReconnectsAfterHTTP3ConnectionLoss() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-reconnect-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("reconnected".utf8).write(to: fixture.appendingPathComponent("hello.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "reconnect-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "ReconnectTest",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: loopbackResourceURL(shareURL: shareURL, accessKey: accessKey)
+        )
+        _ = try await client.capabilities()
+
+        await client.invalidateTransportForTesting()
+
+        let metadata = try await client.metadata(path: "hello.txt")
+        let contents = try await client.read(path: "hello.txt", offset: 0, length: 64)
+        XCTAssertEqual(metadata.size, UInt64(contents.count))
+        XCTAssertEqual(contents, Data("reconnected".utf8))
+    }
+
+    func testTimedOutStreamDoesNotReplaceHTTP3Connection() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-timeout-retry-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("fresh connection".utf8).write(to: fixture.appendingPathComponent("hello.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let delay = GhostFileOneShotRequestDelay()
+        let accessKey = "timeout-retry-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "TimeoutRetryTest",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    guard request.operation == "metadata", request.path == "hello.txt",
+                          await delay.consume() else { return }
+                    try? await Task.sleep(for: .milliseconds(500))
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: loopbackResourceURL(shareURL: shareURL, accessKey: accessKey),
+            connectionTimeout: .seconds(2),
+            requestTimeout: .milliseconds(150)
+        )
+
+        let initialTransport = await client.transportLogIDForTesting()
+        let originalTransport = try XCTUnwrap(initialTransport)
+        do {
+            _ = try await client.metadata(path: "hello.txt")
+            XCTFail("The delayed request unexpectedly completed before its deadline")
+        } catch {}
+        let firstInvocationCount = await delay.invocationCount
+        let transportAfterTimeout = await client.transportLogIDForTesting()
+        XCTAssertEqual(firstInvocationCount, 1, "A stream timeout retried the request automatically")
+        XCTAssertEqual(
+            transportAfterTimeout,
+            originalTransport,
+            "A stream timeout replaced the entire QUIC connection"
+        )
+
+        let metadata = try await client.metadata(path: "hello.txt")
+        XCTAssertEqual(metadata.size, UInt64(Data("fresh connection".utf8).count))
+        let invocationCount = await delay.invocationCount
+        let finalTransport = await client.transportLogIDForTesting()
+        XCTAssertEqual(invocationCount, 2)
+        XCTAssertEqual(finalTransport, originalTransport)
+    }
+
+    func testUnresponsiveQUICPeerFailsWithinConnectionDeadline() async throws {
+        let queue = DispatchQueue(label: "org.ghostvm.ghostfile.tests.silent-udp")
+        let listener = try NWListener(using: .udp, on: .any)
+        let ready = expectation(description: "silent UDP listener ready")
+        listener.stateUpdateHandler = { state in
+            if case .ready = state { ready.fulfill() }
+        }
+        listener.newConnectionHandler = { connection in
+            // Accept UDP datagrams but intentionally never answer the QUIC handshake.
+            connection.start(queue: queue)
+        }
+        listener.start(queue: queue)
+        defer { listener.cancel() }
+        await fulfillment(of: [ready], timeout: 2)
+        guard let port = listener.port else { throw TestError.missingShareURL }
+
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: "deadline-test",
+            publicKeyPin: "not-a-real-pin",
+            resourceBasePath: "/v1/shares/00000000-0000-0000-0000-000000000001",
+            connectionTimeout: .milliseconds(250),
+            requestTimeout: .seconds(1)
+        )
+
+        let clock = ContinuousClock()
+        let started = clock.now
+        do {
+            _ = try await transport.request(
+                operation: "capabilities",
+                relativePath: nil,
+                offset: nil,
+                length: nil
+            )
+            XCTFail("An unresponsive QUIC peer unexpectedly completed a request")
+        } catch {
+            XCTAssertLessThan(started.duration(to: clock.now), .seconds(2))
+        }
+    }
+
     func testCancellingRequestDuringQUICHandshakeFinishesPromptly() async throws {
         let queue = DispatchQueue(label: "org.ghostvm.ghostfile.tests.cancel-handshake-udp")
         let listener = try NWListener(using: .udp, on: .any)
@@ -29,7 +193,9 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
             port: port,
             accessKey: "cancel-handshake-test",
             publicKeyPin: "not-a-real-pin",
-            resourceBasePath: "/v1/shares/00000000-0000-0000-0000-000000000001"
+            resourceBasePath: "/v1/shares/00000000-0000-0000-0000-000000000001",
+            connectionTimeout: .seconds(10),
+            requestTimeout: .seconds(10)
         )
 
         let completed = expectation(description: "handshake-waiting request completed after cancellation")
@@ -58,7 +224,7 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         let cancellationLatency = cancelledAt.duration(to: clock.now)
 
         // Unblock the deliberately broken implementation after the timeout
-        // assertion instead of waiting for the QUIC idle timeout.
+        // assertion so the test never waits for the ten-second deadline.
         await transport.invalidateForTesting()
         let outcome = await requestTask.value
         XCTAssertEqual(outcome, .cancelled)
@@ -107,6 +273,106 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         XCTAssertEqual(refreshedContents, Data("after!".utf8))
     }
 
+    func testDesktopSizedDirectoryListingCompletesOnOneHTTP3Connection() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-large-directory-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        // The real Desktop failure returned roughly 22 KiB. Use enough long
+        // directory names to force the response across multiple UDP send
+        // batches without introducing file-content I/O into this test.
+        for index in 0..<128 {
+            let name = String(format: "%03d-%@", index, String(repeating: "directory-entry-", count: 5))
+            try FileManager.default.createDirectory(
+                at: fixture.appendingPathComponent(name, isDirectory: true),
+                withIntermediateDirectories: false
+            )
+        }
+
+        let accessKey = "large-directory-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "LargeDirectoryTest",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: loopbackResourceURL(shareURL: shareURL, accessKey: accessKey),
+            connectionTimeout: .seconds(2),
+            requestTimeout: .seconds(2)
+        )
+        let initialTransport = await client.transportLogIDForTesting()
+        let originalTransport = try XCTUnwrap(initialTransport)
+        let started = ContinuousClock.now
+        let listing = try await client.directory(path: "")
+        let elapsed = started.duration(to: .now)
+        let finalTransport = await client.transportLogIDForTesting()
+
+        XCTAssertEqual(listing.entries.count, 128)
+        XCTAssertEqual(finalTransport, originalTransport)
+        XCTAssertLessThan(elapsed, .seconds(1))
+    }
+
+    func testDesktopSizedDirectoryListingSurvivesMinimumQUICPathMTU() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-minimum-pmtu-tests-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        for index in 0..<128 {
+            let name = String(format: "%03d-%@", index, String(repeating: "directory-entry-", count: 5))
+            try FileManager.default.createDirectory(
+                at: fixture.appendingPathComponent(name, isDirectory: true),
+                withIntermediateDirectories: false
+            )
+        }
+
+        let accessKey = "minimum-pmtu-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "MinimumPMTUTest",
+                accessKey: accessKey
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForLoopbackShareURL(server)
+        guard let serverPortValue = shareURL.port,
+              let serverPort = NWEndpoint.Port(rawValue: UInt16(serverPortValue)),
+              var components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false) else {
+            throw TestError.missingShareURL
+        }
+        let proxy = try GhostFilePathMTUProxy(upstreamPort: serverPort, maximumDatagramSize: 1_200)
+        let proxyPort = try await proxy.start()
+        defer { proxy.stop() }
+
+        components.host = "127.0.0.1"
+        components.port = Int(proxyPort.rawValue)
+        components.queryItems = (components.queryItems ?? []) + [
+            URLQueryItem(name: "access_key", value: accessKey)
+        ]
+        let resourceURL = try XCTUnwrap(components.url)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: resourceURL,
+            connectionTimeout: .seconds(2),
+            requestTimeout: .seconds(2)
+        )
+
+        let listing = try await client.directory(path: "")
+        XCTAssertEqual(listing.entries.count, 128)
+        XCTAssertGreaterThan(proxy.droppedDatagramCount, 0, "The PMTU proxy did not reject a probe")
+    }
+
     func testBulkTransferBenchmarkWhenRequested() async throws {
         let environment = ProcessInfo.processInfo.environment
         guard environment["GHOSTFILE_RUN_BULK_BENCHMARK"] == "1" else {
@@ -254,6 +520,66 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         await MainActor.run { server.stop() }
     }
 
+    func testTimedOutRequestDoesNotPoisonSiblingHTTP3Streams() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-timeout-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("still responsive".utf8).write(to: fixture.appendingPathComponent("hello.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let accessKey = "quic-timeout-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3Timeout",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    if request.path == "slow.txt" {
+                        try? await Task.sleep(for: .seconds(2))
+                    }
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer { Task { @MainActor in server.stop() } }
+
+        let shareURL = try await waitForShareURL(server)
+        guard let portNumber = shareURL.port,
+              let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
+              let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
+              let pin = components.queryItems?.first(where: { $0.name == "tls_pin" })?.value else {
+            throw TestError.missingShareURL
+        }
+        let transport = try GhostFileHTTP3Transport(
+            host: "127.0.0.1",
+            port: port,
+            accessKey: accessKey,
+            publicKeyPin: pin,
+            resourceBasePath: shareURL.path,
+            connectionTimeout: .seconds(2),
+            requestTimeout: .milliseconds(250)
+        )
+
+        do {
+            _ = try await transport.request(
+                operation: "metadata",
+                relativePath: "slow.txt",
+                offset: nil,
+                length: nil
+            )
+            XCTFail("The deliberately stalled request unexpectedly completed")
+        } catch {}
+
+        let response = try await transport.request(
+            operation: "metadata",
+            relativePath: "hello.txt",
+            offset: nil,
+            length: nil
+        )
+        XCTAssertEqual(response.status, 200)
+    }
+
     func testConcurrentRangeReadsUseOneHTTP3Connection() async throws {
         let fixture = FileManager.default.temporaryDirectory
             .appendingPathComponent("ghostfile-quic-load-\(UUID().uuidString)", isDirectory: true)
@@ -331,7 +657,8 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
             port: port,
             accessKey: accessKey,
             publicKeyPin: pin,
-            resourceBasePath: shareURL.path
+            resourceBasePath: shareURL.path,
+            requestTimeout: .seconds(5)
         )
 
         _ = try await transport.request(
@@ -404,7 +731,7 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
             }
         }
 
-        let shareURL = try await waitForShareURL(server)
+        let shareURL = try await waitForLoopbackShareURL(server)
         guard let portNumber = shareURL.port,
               let port = NWEndpoint.Port(rawValue: UInt16(portNumber)),
               let components = URLComponents(url: shareURL, resolvingAgainstBaseURL: false),
@@ -416,7 +743,8 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
             port: port,
             accessKey: accessKey,
             publicKeyPin: pin,
-            resourceBasePath: shareURL.path
+            resourceBasePath: shareURL.path,
+            requestTimeout: .seconds(10)
         )
 
         let completed = expectation(description: "cancelled HTTP/3 request completed")
@@ -444,10 +772,16 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         await fulfillment(of: [completed], timeout: 0.5)
         let cancellationLatency = cancelledAt.duration(to: clock.now)
 
+        // Always release the server barrier so a broken implementation can
+        // drain cleanly after the timeout assertion instead of leaking a task.
         await gate.open()
         let outcome = await requestTask.value
         XCTAssertEqual(outcome, .cancelled)
-        XCTAssertLessThan(cancellationLatency, .milliseconds(500))
+        XCTAssertLessThan(
+            cancellationLatency,
+            .milliseconds(500),
+            "Caller cancellation waited for the HTTP/3 response or request deadline"
+        )
     }
 
     func testCancellingOpenedRequestCancelsServerRoutingWithoutBlockingSibling() async throws {
@@ -533,6 +867,71 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
         await gate.open()
     }
 
+    func testStoppingShareNotifiesInFlightHTTP3RequestBeforeItsDeadline() async throws {
+        let fixture = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ghostfile-quic-share-stop-\(UUID().uuidString)", isDirectory: true)
+        try FileManager.default.createDirectory(at: fixture, withIntermediateDirectories: true)
+        try Data("stop me".utf8).write(to: fixture.appendingPathComponent("stop.txt"))
+        defer { try? FileManager.default.removeItem(at: fixture) }
+
+        let gate = GhostFileRequestGate()
+        let accessKey = "quic-share-stop-key"
+        let server = try await MainActor.run {
+            let server = GhostFileShareServer(
+                rootURL: fixture,
+                shareName: "GhostFileHTTP3ShareStop-\(UUID().uuidString)",
+                accessKey: accessKey,
+                requestDelay: { request in
+                    guard request.operation == "metadata", request.path == "stop.txt" else { return }
+                    await gate.wait()
+                }
+            )
+            try server.start()
+            return server
+        }
+        defer {
+            Task {
+                await gate.open()
+                await MainActor.run { server.stop() }
+            }
+        }
+
+        let shareURL = try await waitForLoopbackShareURL(server)
+        let client = try GhostFileHTTP3Client(
+            resourceURL: loopbackResourceURL(shareURL: shareURL, accessKey: accessKey),
+            connectionTimeout: .seconds(2),
+            requestTimeout: .seconds(4)
+        )
+
+        let request = Task { () -> GhostFileCancellationOutcome in
+            do {
+                _ = try await client.metadata(path: "stop.txt")
+                return .succeeded
+            } catch is CancellationError {
+                return .cancelled
+            } catch {
+                return .failed(String(describing: error))
+            }
+        }
+
+        await gate.waitForArrival()
+        let clock = ContinuousClock()
+        let stoppedAt = clock.now
+        await MainActor.run { server.stop() }
+        let outcome = await request.value
+        let elapsed = stoppedAt.duration(to: clock.now)
+
+        await gate.open()
+        guard case .failed = outcome else {
+            return XCTFail("An in-flight request unexpectedly survived share shutdown: \(outcome)")
+        }
+        XCTAssertLessThan(
+            elapsed,
+            .seconds(3),
+            "The client learned about share shutdown only from its request deadline"
+        )
+    }
+
     private enum TestError: Error {
         case missingShareURL
         case responseMismatch
@@ -605,6 +1004,17 @@ final class GhostFileHTTP3IntegrationTests: XCTestCase {
     }
 }
 
+private actor GhostFileOneShotRequestDelay {
+    private(set) var invocationCount = 0
+    private var shouldDelay = true
+
+    func consume() -> Bool {
+        invocationCount += 1
+        defer { shouldDelay = false }
+        return shouldDelay
+    }
+}
+
 private actor GhostFileRequestGate {
     private var isOpen = false
     private var hasArrival = false
@@ -640,3 +1050,120 @@ private enum GhostFileCancellationOutcome: Equatable {
     case cancelled
     case failed(String)
 }
+
+private final class GhostFilePathMTUProxy: @unchecked Sendable {
+    private let upstreamPort: NWEndpoint.Port
+    private let maximumDatagramSize: Int
+    private let listener: NWListener
+    private let queue = DispatchQueue(label: "org.ghostvm.ghostfile.tests.pmtu-proxy")
+    private let lock = NSLock()
+    private var downstream: NWConnection?
+    private var upstream: NWConnection?
+    private var dropped = 0
+
+    init(upstreamPort: NWEndpoint.Port, maximumDatagramSize: Int) throws {
+        self.upstreamPort = upstreamPort
+        self.maximumDatagramSize = maximumDatagramSize
+        listener = try NWListener(using: .udp, on: .any)
+    }
+
+    var droppedDatagramCount: Int {
+        lock.lock()
+        defer { lock.unlock() }
+        return dropped
+    }
+
+    func start() async throws -> NWEndpoint.Port {
+        try await withCheckedThrowingContinuation { continuation in
+            let completion = GhostFileProxyStartCompletion(continuation: continuation)
+            listener.stateUpdateHandler = { [weak self] state in
+                guard let self else { return }
+                switch state {
+                case .ready:
+                    if let port = self.listener.port {
+                        completion.succeed(port)
+                    }
+                case .failed(let error):
+                    completion.fail(error)
+                case .cancelled:
+                    completion.fail(CancellationError())
+                default:
+                    break
+                }
+            }
+            listener.newConnectionHandler = { [weak self] connection in
+                self?.accept(connection)
+            }
+            listener.start(queue: queue)
+        }
+    }
+
+    func stop() {
+        listener.cancel()
+        lock.lock()
+        let downstream = self.downstream
+        let upstream = self.upstream
+        self.downstream = nil
+        self.upstream = nil
+        lock.unlock()
+        downstream?.cancel()
+        upstream?.cancel()
+    }
+
+    private func accept(_ downstream: NWConnection) {
+        let upstream = NWConnection(host: "127.0.0.1", port: upstreamPort, using: .udp)
+        lock.lock()
+        guard self.downstream == nil else {
+            lock.unlock()
+            downstream.cancel()
+            return
+        }
+        self.downstream = downstream
+        self.upstream = upstream
+        lock.unlock()
+
+        downstream.start(queue: queue)
+        upstream.start(queue: queue)
+        forward(from: downstream, to: upstream)
+        forward(from: upstream, to: downstream)
+    }
+
+    private func forward(from source: NWConnection, to destination: NWConnection) {
+        source.receiveMessage { [weak self, weak source, weak destination] content, _, _, error in
+            guard let self, let source, let destination, error == nil, let content else { return }
+            if content.count <= self.maximumDatagramSize {
+                destination.send(content: content, completion: .contentProcessed { _ in })
+            } else {
+                self.lock.lock()
+                self.dropped += 1
+                self.lock.unlock()
+            }
+            self.forward(from: source, to: destination)
+        }
+    }
+}
+
+private final class GhostFileProxyStartCompletion: @unchecked Sendable {
+    private let lock = NSLock()
+    private var continuation: CheckedContinuation?
+
+    init(continuation: CheckedContinuation) {
+        self.continuation = continuation
+    }
+
+    func succeed(_ port: NWEndpoint.Port) {
+        complete(.success(port))
+    }
+
+    func fail(_ error: Error) {
+        complete(.failure(error))
+    }
+
+    private func complete(_ result: Result) {
+        lock.lock()
+        let continuation = self.continuation
+        self.continuation = nil
+        lock.unlock()
+        continuation?.resume(with: result)
+    }
+}
diff --git a/macOS/GhostHTTP3/Patches/quiche-darwin-send-time.patch b/macOS/GhostHTTP3/Patches/quiche-darwin-send-time.patch
new file mode 100644
index 0000000..05a2539
--- /dev/null
+++ b/macOS/GhostHTTP3/Patches/quiche-darwin-send-time.patch
@@ -0,0 +1,41 @@
+diff --git a/quiche/src/ffi.rs b/quiche/src/ffi.rs
+--- a/quiche/src/ffi.rs
++++ b/quiche/src/ffi.rs
+@@ -2161,11 +2161,30 @@ fn std_time_to_c(time: &Instant, out: &mut timespec) {
+     out.tv_nsec = raw_time.subsec_nanos() as libc::c_long;
+ }
+-
++
+-#[cfg(any(target_os = "macos", target_os = "ios", target_os = "windows"))]
+-fn std_time_to_c(_time: &Instant, out: &mut timespec) {
+-    // TODO: implement Instant conversion for systems that don't use timespec.
+-    out.tv_sec = 0;
+-    out.tv_nsec = 0;
++#[cfg(any(target_os = "macos", target_os = "ios"))]
++fn std_time_to_c(time: &Instant, out: &mut timespec) {
++    // Rust's Instant has no stable absolute representation on Darwin. Preserve
++    // the pacing delay in Instant's clock domain, then project that relative
++    // delay onto CLOCK_MONOTONIC, which is also used by GhostFile's sender.
++    let delay = time.saturating_duration_since(Instant::now());
++    let mut now = std::mem::MaybeUninit::::uninit();
++    if unsafe { libc::clock_gettime(libc::CLOCK_MONOTONIC, now.as_mut_ptr()) } != 0 {
++        out.tv_sec = 0;
++        out.tv_nsec = 0;
++        return;
++    }
++    let now = unsafe { now.assume_init() };
++    let nanoseconds = now.tv_nsec as u64 + delay.subsec_nanos() as u64;
++    out.tv_sec = now.tv_sec
++        + delay.as_secs() as libc::time_t
++        + (nanoseconds / 1_000_000_000) as libc::time_t;
++    out.tv_nsec = (nanoseconds % 1_000_000_000) as libc::c_long;
++}
++
++#[cfg(target_os = "windows")]
++fn std_time_to_c(_time: &Instant, out: &mut timespec) {
++    out.tv_sec = 0;
++    out.tv_nsec = 0;
+ }
+-
++
+ #[cfg(test)]
diff --git a/macOS/GhostHTTP3/Tests/stress.c b/macOS/GhostHTTP3/Tests/stress.c
index bc1803d..d7c952e 100644
--- a/macOS/GhostHTTP3/Tests/stress.c
+++ b/macOS/GhostHTTP3/Tests/stress.c
@@ -11,6 +11,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #define CID_LEN 16
 #define DATAGRAM_CAPACITY 65535
@@ -123,6 +124,16 @@ typedef struct {
     bool saw_content_length;
 } parsed_headers;
 
+static size_t future_pacing_packets = 0;
+
+static bool send_time_is_future(const struct timespec *send_time) {
+    struct timespec now;
+    CHECK(clock_gettime(CLOCK_MONOTONIC, &now) == 0,
+          "could not read Darwin monotonic clock");
+    return send_time->tv_sec > now.tv_sec ||
+        (send_time->tv_sec == now.tv_sec && send_time->tv_nsec > now.tv_nsec);
+}
+
 static void make_address(struct sockaddr_storage *storage, socklen_t *length,
                          uint16_t port) {
     struct sockaddr_in *address = (struct sockaddr_in *) storage;
@@ -156,6 +167,12 @@ static quiche_config *make_config_with_stream_limit(bool server,
     quiche_config_set_max_idle_timeout(config, 30000);
     quiche_config_set_max_recv_udp_payload_size(config, 1350);
     quiche_config_set_max_send_udp_payload_size(config, 1350);
+    // BBR2 is enabled only in this in-memory framework test to force observable
+    // future deadlines and verify the packaged Darwin send-time conversion.
+    // GhostFile production traffic retains quiche's default CUBIC controller.
+    quiche_config_set_cc_algorithm(config, QUICHE_CC_BBR2_GCONGESTION);
+    quiche_config_enable_pacing(config, true);
+    quiche_config_set_max_pacing_rate(config, 64 * 1024);
     quiche_config_set_initial_max_data(config, 64 * 1024 * 1024);
     quiche_config_set_initial_max_stream_data_bidi_local(config, 2 * 1024 * 1024);
     quiche_config_set_initial_max_stream_data_bidi_remote(config, 2 * 1024 * 1024);
@@ -176,6 +193,8 @@ static ssize_t deliver_first_client_packet(test_pair *pair, uint8_t *packet,
     ssize_t length = quiche_conn_send(pair->client.quic, packet,
                                       DATAGRAM_CAPACITY, send_info);
     CHECK(length > 0, "client did not produce an Initial packet: %zd", length);
+    CHECK(send_info->at.tv_sec > 0 || send_info->at.tv_nsec > 0,
+          "quiche returned no usable send timestamp on Darwin");
 
     uint32_t version = 0;
     uint8_t type = 0;
@@ -243,6 +262,9 @@ static size_t transfer(endpoint *from, endpoint *to, bool reorder,
             }
             CHECK(length > 0, "QUIC packet generation failed: %zd", length);
             packet->length = (size_t) length;
+            if (send_time_is_future(&packet->send_info.at)) {
+                future_pacing_packets++;
+            }
             batch_count++;
         }
         if (batch_count == 0) {
@@ -873,8 +895,12 @@ int main(int argc, char **argv) {
     }
     drive_until_finished(&pair, &server, &client, large_first,
                          LARGE_REQUEST_COUNT, "parallel large bodies");
+    CHECK(future_pacing_packets > 0,
+          "quiche produced no future pacing deadlines during large responses");
     printf("PASS parallel bodies: %d x %d KiB verified byte-for-byte\n",
            LARGE_REQUEST_COUNT, LARGE_BODY_LENGTH / 1024);
+    printf("PASS Darwin pacing timestamps: %zu future packet deadlines observed\n",
+           future_pacing_packets);
 
     size_t cancelled = client_send(&pair, &client, "/cancel",
                                     CANCEL_BODY_LENGTH, 0xc1, true, false,
diff --git a/macOS/GhostHTTP3/scripts/build-framework.sh b/macOS/GhostHTTP3/scripts/build-framework.sh
index 59d96f8..e15627a 100755
--- a/macOS/GhostHTTP3/scripts/build-framework.sh
+++ b/macOS/GhostHTTP3/scripts/build-framework.sh
@@ -9,6 +9,7 @@ source_dir=${build_dir}/upstream/quiche
 output_dir=${build_dir}/artifacts
 deployment_target=${MACOSX_DEPLOYMENT_TARGET:-15.0}
 lock_file=${project_dir}/quiche-0.29.3.Cargo.lock
+pacing_patch=${project_dir}/Patches/quiche-darwin-send-time.patch
 
 # quiche 0.29.3. Keep this immutable so the framework is reproducible.
 quiche_revision=55886df3be579579207104c8e645825b6347a209
@@ -36,6 +37,8 @@ fi
 
 git -C "${source_dir}" fetch --depth 1 origin "${quiche_revision}"
 git -C "${source_dir}" checkout --detach --force "${quiche_revision}"
+git -C "${source_dir}" apply --check "${pacing_patch}"
+git -C "${source_dir}" apply "${pacing_patch}"
 cp "${lock_file}" "${source_dir}/Cargo.lock"
 
 actual_revision=$(git -C "${source_dir}" rev-parse HEAD)
@@ -128,6 +131,19 @@ xcrun install_name_tool \
     "${framework_dir}/Versions/A/GhostHTTP3"
 codesign --force --sign - --timestamp=none "${framework_dir}"
 
+source_fingerprint=$(
+    shasum -a 256 \
+        "${project_dir}/Sources/GhostHTTP3.c" \
+        "${project_dir}/include/GhostHTTP3/GhostHTTP3.h" \
+        "${project_dir}/include/module.modulemap" \
+        "${project_dir}/quiche-0.29.3.Cargo.lock" \
+        "${pacing_patch}" \
+        "${project_dir}/scripts/build-framework.sh" \
+        "${project_dir}/scripts/ensure-framework.sh" | \
+        shasum -a 256 | awk '{ print $1 }'
+)
+print -r -- "${source_fingerprint}" > "${output_dir}/.source-fingerprint"
+
 file "${framework_dir}/GhostHTTP3" | rg -q 'Mach-O 64-bit dynamically linked shared library arm64'
 [[ $(lipo -archs "${framework_dir}/GhostHTTP3") == arm64 ]]
 otool -D "${framework_dir}/GhostHTTP3" | \
diff --git a/macOS/GhostHTTP3/scripts/ensure-framework.sh b/macOS/GhostHTTP3/scripts/ensure-framework.sh
index 2d25df3..1d52c5f 100755
--- a/macOS/GhostHTTP3/scripts/ensure-framework.sh
+++ b/macOS/GhostHTTP3/scripts/ensure-framework.sh
@@ -6,8 +6,23 @@ script_dir=${0:A:h}
 project_dir=${script_dir:h}
 framework=${project_dir}/.build/artifacts/GhostHTTP3.framework
 binary=${framework}/Versions/A/GhostHTTP3
+fingerprint_file=${project_dir}/.build/artifacts/.source-fingerprint
+source_fingerprint=$(
+    shasum -a 256 \
+        "${project_dir}/Sources/GhostHTTP3.c" \
+        "${project_dir}/include/GhostHTTP3/GhostHTTP3.h" \
+        "${project_dir}/include/module.modulemap" \
+        "${project_dir}/quiche-0.29.3.Cargo.lock" \
+        "${project_dir}/Patches/quiche-darwin-send-time.patch" \
+        "${project_dir}/scripts/build-framework.sh" \
+        "${project_dir}/scripts/ensure-framework.sh" | \
+        shasum -a 256 | awk '{ print $1 }'
+)
 
-if [[ -f ${binary} ]] && [[ $(lipo -archs "${binary}" 2>/dev/null) == arm64 ]]; then
+if [[ -f ${binary} ]] && \
+   [[ $(lipo -archs "${binary}" 2>/dev/null) == arm64 ]] && \
+   [[ -f ${fingerprint_file} ]] && \
+   [[ $(<"${fingerprint_file}") == ${source_fingerprint} ]]; then
     print "GhostHTTP3 framework already built; skipping."
     exit 0
 fi
diff --git a/scripts/enable-ghostfile-fskit.sh b/scripts/enable-ghostfile-fskit.sh
new file mode 100755
index 0000000..acffcbd
--- /dev/null
+++ b/scripts/enable-ghostfile-fskit.sh
@@ -0,0 +1,50 @@
+#!/bin/zsh
+
+set -euo pipefail
+
+readonly app_path="${1:-/Applications/GhostFile.app}"
+readonly extension_path="$app_path/Contents/Extensions/GhostFileFS.appex"
+readonly settings_path="$HOME/Library/Group Containers/group.com.apple.fskit.settings/enabledModules.plist"
+readonly lsregister_path="/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
+
+if [[ ! -d "$extension_path" ]]; then
+    print -u2 "GhostFile FSKit extension not found at: $extension_path"
+    exit 66
+fi
+
+readonly bundle_id="$(/usr/bin/plutil -extract CFBundleIdentifier raw "$extension_path/Contents/Info.plist")"
+if [[ "$bundle_id" != "org.ghostvm.ghostfile.fs" ]]; then
+    print -u2 "Unexpected FSKit bundle identifier: $bundle_id"
+    exit 65
+fi
+
+echo "Verifying GhostFile signature…"
+/usr/bin/codesign --verify --deep --strict "$app_path"
+
+echo "Registering and selecting $bundle_id…"
+"$lsregister_path" -f "$app_path"
+/usr/bin/pluginkit -e use -i "$bundle_id"
+
+if [[ ! -f "$settings_path" ]]; then
+    /bin/mkdir -p "${settings_path:h}"
+    /usr/libexec/PlistBuddy -c "Add : array" "$settings_path"
+fi
+
+if ! /usr/bin/plutil -p "$settings_path" | /usr/bin/grep -Fq "\"$bundle_id\""; then
+    readonly module_count="$(/usr/bin/plutil -p "$settings_path" | /usr/bin/awk '/^[[:space:]]+[0-9]+ => / { count++ } END { print count + 0 }')"
+    /usr/bin/plutil -insert "$module_count" -string "$bundle_id" "$settings_path"
+fi
+
+echo "Restarting the stale FSKit daemon (administrator password required)…"
+/usr/bin/sudo /usr/bin/killall fskitd 2>/dev/null || true
+/usr/bin/killall fskit_agent 2>/dev/null || true
+/bin/sleep 2
+
+echo
+echo "FSKit registration:"
+/usr/bin/pluginkit -v -m -A -D -p com.apple.fskit.fsmodule | /usr/bin/grep -F "$bundle_id" || true
+echo
+echo "Enabled module list:"
+/usr/bin/plutil -p "$settings_path"
+echo
+echo "GhostFile FSKit recovery complete. Reopen GhostFile and switch to Mount."

From 5228f6a808418b1f897e402c367d6625ca53b3e5 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Sat, 1 Aug 2026 21:38:37 -0700
Subject: [PATCH 15/18] Use GhostFiles as default mount directory

---
 macOS/GhostFile/GhostFileContentView.swift  | 2 +-
 macOS/GhostFile/GhostFileMountManager.swift | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/macOS/GhostFile/GhostFileContentView.swift b/macOS/GhostFile/GhostFileContentView.swift
index 311c821..0ddbfb4 100644
--- a/macOS/GhostFile/GhostFileContentView.swift
+++ b/macOS/GhostFile/GhostFileContentView.swift
@@ -230,7 +230,7 @@ private struct GhostFileMountView: View {
                     TextField("Volume name", text: $volumeName)
                     LabeledContent("Mount point") {
                         HStack {
-                            Text(mountPoint?.path ?? "Automatic — ~/GhostFile Mounts")
+                            Text(mountPoint?.path ?? "Automatic — ~/GhostFiles")
                                 .foregroundStyle(mountPoint == nil ? .secondary : .primary)
                                 .lineLimit(1)
                                 .truncationMode(.middle)
diff --git a/macOS/GhostFile/GhostFileMountManager.swift b/macOS/GhostFile/GhostFileMountManager.swift
index 8966c91..653416f 100644
--- a/macOS/GhostFile/GhostFileMountManager.swift
+++ b/macOS/GhostFile/GhostFileMountManager.swift
@@ -195,7 +195,7 @@ final class GhostFileMountManager: ObservableObject {
                 removesMountPointOnUnmount = false
             } else {
                 let mountRoot = FileManager.default.homeDirectoryForCurrentUser
-                    .appendingPathComponent("GhostFile Mounts", isDirectory: true)
+                    .appendingPathComponent("GhostFiles", isDirectory: true)
                 try FileManager.default.createDirectory(at: mountRoot, withIntermediateDirectories: true)
                 let safeName = sanitizedVolumeName(volumeName)
                 mountPoint = uniqueMountPoint(root: mountRoot, name: safeName)

From 4f94a77b2a05b81e610aa456b1fe43c037127280 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Wed, 5 Aug 2026 13:45:50 -0700
Subject: [PATCH 16/18] Fix GhostVMFS packaging and activation

---
 Makefile                                      |  97 +++--
 .../GhostVMFSExtensionAssistantView.swift     | 163 +++++++++
 .../Services/GhostVMFSExtensionManager.swift  | 339 ++++++++++++++++++
 .../Services/NetworkSettingsView.swift        |  31 +-
 macOS/GhostVM/SwiftUIDemoApp.swift            |  62 ++++
 macOS/GhostVMFS/Info.template.plist           |  17 +-
 macOS/GhostVMFS/entitlements.plist            |   4 +
 .../GhostVMFSExtensionManagerTests.swift      |  82 +++++
 macOS/project.yml                             |   3 +
 9 files changed, 759 insertions(+), 39 deletions(-)
 create mode 100644 macOS/GhostVM/Services/GhostVMFSExtensionAssistantView.swift
 create mode 100644 macOS/GhostVM/Services/GhostVMFSExtensionManager.swift
 create mode 100644 macOS/GhostVMTests/GhostVMFSExtensionManagerTests.swift

diff --git a/Makefile b/Makefile
index 2d5c5c5..886f459 100644
--- a/Makefile
+++ b/Makefile
@@ -33,6 +33,7 @@ XCODE_ALLOW_PROVISIONING_UPDATES ?= 1
 # Xcode project settings (generated via xcodegen)
 XCODE_PROJECT = macOS/GhostVM.xcodeproj
 XCODE_CONFIG ?= Release
+DEBUG_DMG_CONFIGURATION ?= Release
 BUILD_DIR ?= build/xcode
 APP_NAME = GhostVM
 VERSION_FILE = .version
@@ -741,6 +742,20 @@ dist:
 		fi; \
 	done
 	@# 4b. Sign the FSKit extension before signing its containing app.
+	@FOUND_GHOST_HTTP=0; for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/Frameworks/"GhostHTTP_*.framework; do \
+		if [ -d "$$fw" ]; then FOUND_GHOST_HTTP=1; fi; \
+	done; \
+	if [ "$$FOUND_GHOST_HTTP" != "1" ]; then \
+		echo "ERROR: GhostVMFS is missing its GhostHTTP package framework"; exit 1; \
+	fi
+	@test ! -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/MacOS/GhostVMFS.debug.dylib" || \
+		(echo "ERROR: GhostVMFS was packaged from a Debug build"; exit 1)
+	@for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/Frameworks/"*.framework; do \
+		if [ -d "$$fw" ]; then \
+			echo "  Signing $$(basename $$fw) (in GhostVMFS)"; \
+			codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$fw"; \
+		fi; \
+	done
 	@for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/MacOS/"*.dylib; do \
 		if [ -f "$$dylib" ]; then \
 			echo "  Signing $$(basename $$dylib) (in GhostVMFS)"; \
@@ -859,46 +874,50 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 	hdiutil create -volname "GhostTools" \
 		-srcfolder "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" \
 		-ov -format $(GHOSTTOOLS_DMG_FORMAT) "$(GHOSTTOOLS_DMG)"
-	@# Build app + cli (debug)
+	@# Use Release products even for the timestamped debug DMG. A Debug FSKit
+	@# extension contains Xcode trampoline dylibs and is not a distributable module.
 	@$(MAKE) --no-print-directory prepare-app-plists INJECT_TIMESTAMP=1 BUILD_TIMESTAMP=$(BUILD_TIMESTAMP)
-	xcodebuild -project $(XCODE_PROJECT) -scheme $(APP_NAME) -configuration Debug -derivedDataPath $(BUILD_DIR) \
+	xcodebuild -project $(XCODE_PROJECT) -scheme $(APP_NAME) -configuration $(DEBUG_DMG_CONFIGURATION) -derivedDataPath $(BUILD_DIR) \
 		CODE_SIGN_STYLE=Manual \
 		CODE_SIGN_IDENTITY=- \
 		DEVELOPMENT_TEAM= \
 		CODE_SIGNING_ALLOWED=NO \
 		CODE_SIGNING_REQUIRED=NO \
 		build
-	xcodebuild -project $(XCODE_PROJECT) -scheme vmctl -configuration Debug -derivedDataPath $(BUILD_DIR) \
+	xcodebuild -project $(XCODE_PROJECT) -scheme vmctl -configuration $(DEBUG_DMG_CONFIGURATION) -derivedDataPath $(BUILD_DIR) \
 		CODE_SIGN_STYLE=Manual \
 		CODE_SIGN_IDENTITY=- \
 		DEVELOPMENT_TEAM= \
 		CODE_SIGNING_ALLOWED=NO \
 		CODE_SIGNING_REQUIRED=NO \
 		build
-	@# Copy resources into debug app
-	@mkdir -p "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app/Contents/Resources"
-	@cp macOS/GhostVM/Resources/ghostvm.png "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app/Contents/Resources/"
-	@cp macOS/GhostVM/Resources/ghostvm-dark.png "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app/Contents/Resources/"
-	@cp build/GhostVMIcon.icns "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app/Contents/Resources/GhostVMIcon.icns"
-	@cp "$(GHOSTTOOLS_DMG)" "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app/Contents/Resources/"
+	@# Copy resources into the timestamped app.
+	@mkdir -p "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Resources"
+	@cp macOS/GhostVM/Resources/ghostvm.png "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Resources/"
+	@cp macOS/GhostVM/Resources/ghostvm-dark.png "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Resources/"
+	@cp build/GhostVMIcon.icns "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Resources/GhostVMIcon.icns"
+	@cp "$(GHOSTTOOLS_DMG)" "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Resources/"
 	@# Verify we have a real signing identity for distribution
 	@if [ -z "$(DIST_CODESIGN_ID)" ]; then \
 		echo "Error: No 'Developer ID Application' identity found in keychain."; \
 		exit 1; \
 	fi
-	@# Verify notarization credentials are set
-	@if [ -z "$(NOTARY_APPLE_ID)" ] || [ -z "$(NOTARY_TEAM_ID)" ] || [ -z "$(NOTARY_PASSWORD)" ]; then \
-		echo "ERROR: Notarization requires NOTARY_APPLE_ID, NOTARY_TEAM_ID, and NOTARY_PASSWORD"; \
+	@# Verify notarization credentials are set unless a local-only artifact was requested.
+	@if [ "$(SKIP_NOTARIZATION)" != "1" ] && [ -z "$(NOTARY_KEYCHAIN_PROFILE)" ] && { [ -z "$(NOTARY_APPLE_ID)" ] || [ -z "$(NOTARY_TEAM_ID)" ] || [ -z "$(NOTARY_PASSWORD)" ]; }; then \
+		echo "ERROR: Notarization requires NOTARY_KEYCHAIN_PROFILE or Apple ID credentials."; \
+		echo "Set SKIP_NOTARIZATION=1 to create a signed local-testing DMG."; \
 		exit 1; \
 	fi
-	@scripts/verify-profile-cert.sh "$(DIST_CODESIGN_ID)" $(APP_PROVISIONING_PROFILE) $(HELPER_PROVISIONING_PROFILE) $(VMCTL_PROVISIONING_PROFILE)
+	@scripts/verify-profile-cert.sh "$(DIST_CODESIGN_ID)" $(APP_PROVISIONING_PROFILE) $(HELPER_PROVISIONING_PROFILE) $(VMCTL_PROVISIONING_PROFILE) $(FSKIT_PROVISIONING_PROFILE)
 	$(eval DEBUG_VERSION := $(strip $(shell echo $(BASE_VERSION) | sed 's/\.[^.]*$$//')).$(BUILD_TIMESTAMP))
 	@echo "Creating debug DMG (version $(DEBUG_VERSION))..."
 	@echo "Signing with: $(DIST_CODESIGN_ID)"
 	@rm -rf "$(DIST_DIR)"
 	@mkdir -p "$(DIST_DIR)/dmg-stage"
-	cp -R "$(BUILD_DIR)/Build/Products/Debug/$(APP_NAME).app" "$(DIST_DIR)/dmg-stage/"
-	cp -R "$(BUILD_DIR)/Build/Products/Debug/vmctl.app" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/"
+	cp -R "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app" "$(DIST_DIR)/dmg-stage/"
+	cp -R "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/vmctl.app" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/"
+	@pluginkit -r "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex" >/dev/null 2>&1 || true
+	@"$(GHOSTFILE_LSREGISTER)" -u "$(BUILD_DIR)/Build/Products/$(DEBUG_DMG_CONFIGURATION)/$(APP_NAME).app" >/dev/null 2>&1 || true
 	@if [ -n "$(HELPER_PROVISIONING_PROFILE)" ]; then \
 		test -f "$(HELPER_PROVISIONING_PROFILE)" || (echo "ERROR: HELPER_PROVISIONING_PROFILE not found: $(HELPER_PROVISIONING_PROFILE)" && exit 1); \
 		cp "$(HELPER_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/embedded.provisionprofile"; \
@@ -912,6 +931,10 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 		test -f "$(VMCTL_PROVISIONING_PROFILE)" || (echo "ERROR: VMCTL_PROVISIONING_PROFILE not found: $(VMCTL_PROVISIONING_PROFILE)" && exit 1); \
 		cp "$(VMCTL_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/embedded.provisionprofile"; \
 	fi
+	@if [ -n "$(FSKIT_PROVISIONING_PROFILE)" ]; then \
+		test -f "$(FSKIT_PROVISIONING_PROFILE)" || (echo "ERROR: FSKIT_PROVISIONING_PROFILE not found: $(FSKIT_PROVISIONING_PROFILE)" && exit 1); \
+		cp "$(FSKIT_PROVISIONING_PROFILE)" "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/embedded.provisionprofile"; \
+	fi
 	@# Sign GhostVMHelper (frameworks, MacOS dylibs, then bundle)
 	@for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/Frameworks/"*.framework; do \
 		if [ -e "$$fw" ]; then \
@@ -992,6 +1015,29 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 			codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \
 		fi; \
 	done
+	@# Sign the FSKit extension before its containing app.
+	@FOUND_GHOST_HTTP=0; for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/Frameworks/"GhostHTTP_*.framework; do \
+		if [ -d "$$fw" ]; then FOUND_GHOST_HTTP=1; fi; \
+	done; \
+	if [ "$$FOUND_GHOST_HTTP" != "1" ]; then \
+		echo "ERROR: GhostVMFS is missing its GhostHTTP package framework"; exit 1; \
+	fi
+	@test ! -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/MacOS/GhostVMFS.debug.dylib" || \
+		(echo "ERROR: GhostVMFS was packaged from a Debug build"; exit 1)
+	@for fw in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/Frameworks/"*.framework; do \
+		if [ -e "$$fw" ]; then \
+			codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$fw"; \
+		fi; \
+	done
+	@for dylib in "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex/Contents/MacOS/"*.dylib; do \
+		if [ -e "$$dylib" ]; then \
+			codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \
+		fi; \
+	done
+	codesign --force --options runtime --timestamp \
+		--entitlements macOS/GhostVMFS/entitlements.plist \
+		-s "$(DIST_CODESIGN_ID)" \
+		"$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex"
 	@# Re-sign GhostTools.dmg inside the app bundle
 	@mkdir -p "$(DIST_DIR)/ghosttools-stage"
 	@hdiutil attach "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" -mountpoint "$(DIST_DIR)/ghosttools-mount" -nobrowse
@@ -1024,13 +1070,20 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 		-ov -format UDZO "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"
 	@rm -rf "$(DIST_DIR)/dmg-stage"
 	codesign --force --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"
-	@# Notarize
-	xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg" \
-		--apple-id "$(NOTARY_APPLE_ID)" \
-		--team-id "$(NOTARY_TEAM_ID)" \
-		--password "$(NOTARY_PASSWORD)" \
-		--wait
-	xcrun stapler staple "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"
+	@# Notarize unless this is an explicitly local-only build.
+	@if [ "$(SKIP_NOTARIZATION)" = "1" ]; then \
+		echo "Skipping notarization (local-testing DMG)."; \
+	elif [ -n "$(NOTARY_KEYCHAIN_PROFILE)" ]; then \
+		xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg" \
+			--keychain-profile "$(NOTARY_KEYCHAIN_PROFILE)" --wait && \
+		xcrun stapler staple "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"; \
+	else \
+		xcrun notarytool submit "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg" \
+			--apple-id "$(NOTARY_APPLE_ID)" \
+			--team-id "$(NOTARY_TEAM_ID)" \
+			--password "$(NOTARY_PASSWORD)" --wait && \
+		xcrun stapler staple "$(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"; \
+	fi
 	@echo "Debug distribution created: $(DIST_DIR)/$(DMG_NAME)-$(DEBUG_VERSION).dmg"
 	@echo "vmctl is at: $(APP_NAME).app/Contents/PlugIns/Helpers/vmctl.app/Contents/MacOS/vmctl"
 
diff --git a/macOS/GhostVM/Services/GhostVMFSExtensionAssistantView.swift b/macOS/GhostVM/Services/GhostVMFSExtensionAssistantView.swift
new file mode 100644
index 0000000..1e4e662
--- /dev/null
+++ b/macOS/GhostVM/Services/GhostVMFSExtensionAssistantView.swift
@@ -0,0 +1,163 @@
+import AppKit
+import SwiftUI
+
+struct GhostVMFSExtensionAssistantView: View {
+    @Environment(\.dismiss) private var dismiss
+    @ObservedObject var manager: GhostVMFSExtensionManager
+
+    var body: some View {
+        VStack(spacing: 0) {
+            VStack(spacing: 14) {
+                statusSymbol
+                Text(title)
+                    .font(.title2.weight(.semibold))
+                Text(detail)
+                    .foregroundStyle(.secondary)
+                    .multilineTextAlignment(.center)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .frame(maxWidth: 440)
+            }
+            .padding(.horizontal, 32)
+            .padding(.top, 30)
+            .padding(.bottom, 24)
+
+            Divider()
+
+            VStack(alignment: .leading, spacing: 12) {
+                helperRow(
+                    symbol: "shippingbox.fill",
+                    title: "Embedded with GhostVM",
+                    detail: "GhostVMFS is installed and repaired as part of the GhostVM app."
+                )
+                helperRow(
+                    symbol: "checkmark.shield.fill",
+                    title: "Your approval",
+                    detail: "Install / Repair registers GhostVMFS, then opens the File System Extensions switch."
+                )
+            }
+            .padding(24)
+
+            Divider()
+
+            HStack {
+                if manager.health.requiresAttention {
+                    Button("Later") { dismiss() }
+                }
+                Spacer()
+                Button("Scan Again") {
+                    Task { await manager.refresh() }
+                }
+                .disabled(manager.isWorking || manager.health == .checking)
+
+                primaryAction
+            }
+            .padding(18)
+        }
+        .frame(width: 540)
+        .interactiveDismissDisabled(manager.isWorking)
+    }
+
+    @ViewBuilder
+    private var statusSymbol: some View {
+        if manager.isWorking || manager.health == .checking {
+            ProgressView()
+                .controlSize(.large)
+                .frame(width: 52, height: 52)
+        } else {
+            Image(systemName: symbolName)
+                .font(.system(size: 38, weight: .semibold))
+                .foregroundStyle(manager.health == .ready ? Color.green : Color.orange)
+                .frame(width: 52, height: 52)
+        }
+    }
+
+    @ViewBuilder
+    private var primaryAction: some View {
+        switch manager.health {
+        case .ready:
+            Button("Done") { dismiss() }
+                .buttonStyle(.borderedProminent)
+        case .needsApplicationInstall, .missingEmbeddedExtension:
+            Button("Open Applications") {
+                NSWorkspace.shared.open(URL(fileURLWithPath: "/Applications", isDirectory: true))
+            }
+            .buttonStyle(.borderedProminent)
+        case .notRegistered, .duplicateRegistrations, .disabled:
+            if manager.repairAvailable {
+                Button(manager.isWorking ? "Repairing..." : "Install / Repair Extension") {
+                    Task { await manager.repairRegistration() }
+                }
+                .buttonStyle(.borderedProminent)
+                .disabled(manager.isWorking)
+            } else {
+                Button("Open File System Settings") { manager.openSettings() }
+                    .buttonStyle(.borderedProminent)
+            }
+        case .scanFailed:
+            Button("Open File System Settings") { manager.openSettings() }
+                .buttonStyle(.borderedProminent)
+        case .checking:
+            EmptyView()
+        }
+    }
+
+    private var title: String {
+        if manager.isWorking { return "Repairing GhostVMFS..." }
+        switch manager.health {
+        case .checking: return "Checking GhostVMFS..."
+        case .ready: return "GhostVMFS Is Ready"
+        case .needsApplicationInstall: return "Move GhostVM to Applications"
+        case .missingEmbeddedExtension: return "GhostVMFS Is Missing"
+        case .notRegistered: return "Install GhostVMFS"
+        case .duplicateRegistrations: return "Repair GhostVMFS"
+        case .disabled: return "Enable GhostVMFS"
+        case .scanFailed: return "Unable to Check GhostVMFS"
+        }
+    }
+
+    private var detail: String {
+        if manager.isWorking {
+            return "GhostVM is rebuilding the extension registration used by System Settings."
+        }
+        if let statusDetail = manager.statusDetail { return statusDetail }
+        if let errorMessage = manager.errorMessage { return errorMessage }
+        switch manager.health {
+        case .checking: return "Scanning macOS file system extension registration."
+        case .ready: return "The embedded extension is registered, enabled, and ready for guest directory mounts."
+        case .needsApplicationInstall: return "Drag GhostVM into Applications, then open that installed copy."
+        case .missingEmbeddedExtension: return "Reinstall GhostVM from the disk image to restore its embedded extension."
+        case .notRegistered: return "macOS has not registered the extension bundled with this app."
+        case .duplicateRegistrations: return "More than one copy is registered, so macOS may launch the wrong one."
+        case .disabled: return "Install / Repair refreshes GhostVMFS so you can enable it in System Settings."
+        case .scanFailed(let message): return message
+        }
+    }
+
+    private var symbolName: String {
+        switch manager.health {
+        case .ready: return "checkmark.circle.fill"
+        case .needsApplicationInstall: return "arrow.down.app.fill"
+        case .missingEmbeddedExtension: return "xmark.app.fill"
+        case .notRegistered: return "externaldrive.badge.plus"
+        case .duplicateRegistrations: return "wrench.and.screwdriver.fill"
+        case .disabled: return "externaldrive.fill.badge.exclamationmark"
+        case .scanFailed: return "exclamationmark.triangle.fill"
+        case .checking: return "externaldrive.fill"
+        }
+    }
+
+    private func helperRow(symbol: String, title: String, detail: String) -> some View {
+        HStack(alignment: .top, spacing: 12) {
+            Image(systemName: symbol)
+                .foregroundStyle(.secondary)
+                .frame(width: 22)
+            VStack(alignment: .leading, spacing: 2) {
+                Text(title).fontWeight(.medium)
+                Text(detail)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+    }
+}
diff --git a/macOS/GhostVM/Services/GhostVMFSExtensionManager.swift b/macOS/GhostVM/Services/GhostVMFSExtensionManager.swift
new file mode 100644
index 0000000..2c848a2
--- /dev/null
+++ b/macOS/GhostVM/Services/GhostVMFSExtensionManager.swift
@@ -0,0 +1,339 @@
+import AppKit
+import Combine
+import Darwin
+import Foundation
+import FSKit
+
+enum GhostVMFSExtensionHealth: Equatable {
+    case checking
+    case ready
+    case needsApplicationInstall
+    case missingEmbeddedExtension
+    case notRegistered
+    case duplicateRegistrations(Int)
+    case disabled
+    case scanFailed(String)
+
+    var requiresAttention: Bool {
+        switch self {
+        case .checking, .ready:
+            return false
+        case .needsApplicationInstall, .missingEmbeddedExtension, .notRegistered,
+             .duplicateRegistrations, .disabled, .scanFailed:
+            return true
+        }
+    }
+}
+
+extension Notification.Name {
+    static let ghostVMFSExtensionNeedsAttention = Notification.Name(
+        "org.ghostvm.ghostvm.fs-needs-attention"
+    )
+}
+
+@MainActor
+final class GhostVMFSExtensionManager: ObservableObject {
+    nonisolated static let extensionBundleIdentifier = "org.ghostvm.ghostvm.fs"
+    nonisolated static let extensionRelativePath = "Contents/Extensions/GhostVMFS.appex"
+
+    @Published private(set) var extensionEnabled: Bool?
+    @Published private(set) var health: GhostVMFSExtensionHealth = .checking
+    @Published private(set) var repairAvailable = false
+    @Published private(set) var statusDetail: String?
+    @Published private(set) var isWorking = false
+    @Published var errorMessage: String?
+
+    func refresh() async {
+        extensionEnabled = nil
+        health = .checking
+
+        let appURL = Self.appURL
+        let extensionURL = Self.expectedExtensionURL
+        guard FileManager.default.fileExists(atPath: extensionURL.path) else {
+            extensionEnabled = false
+            repairAvailable = false
+            health = .missingEmbeddedExtension
+            statusDetail = "This copy of GhostVM does not contain the GhostVMFS module. Reinstall GhostVM from the disk image."
+            return
+        }
+
+        do {
+            let modules = try await FSClient.shared.installedExtensions
+            let identities = modules.filter {
+                $0.bundleIdentifier == Self.extensionBundleIdentifier
+            }
+            let snapshot = await Task.detached(priority: .utility) {
+                Self.registrationSnapshot()
+            }.value
+            let expectedURL = extensionURL.resolvingSymlinksInPath().standardizedFileURL
+            let identity = identities.first {
+                $0.url.resolvingSymlinksInPath().standardizedFileURL == expectedURL
+            } ?? identities.first
+            let hasStaleIdentity = identities.contains {
+                $0.url.resolvingSymlinksInPath().standardizedFileURL != expectedURL
+            } || snapshot.urls.contains {
+                $0.resolvingSymlinksInPath().standardizedFileURL != expectedURL
+            }
+
+            guard let identity else {
+                extensionEnabled = false
+                if Self.isInstalledApplication(appURL) {
+                    health = .notRegistered
+                    repairAvailable = true
+                    statusDetail = "macOS has not registered GhostVMFS as an FSKit module."
+                } else {
+                    health = .needsApplicationInstall
+                    repairAvailable = false
+                    statusDetail = "Move GhostVM to Applications before installing its file system extension."
+                }
+                return
+            }
+
+            let selectedCanonicalIdentity = identity.url
+                .resolvingSymlinksInPath().standardizedFileURL == expectedURL
+            extensionEnabled = identity.isEnabled
+                && snapshot.enabledByFSKit
+                && selectedCanonicalIdentity
+                && !hasStaleIdentity
+            repairAvailable = hasStaleIdentity
+                || !snapshot.enabledByFSKit
+                || (snapshot.enabledByFSKit && !identity.isEnabled)
+
+            if !Self.isInstalledApplication(appURL) {
+                health = .needsApplicationInstall
+                repairAvailable = false
+                statusDetail = "Move GhostVM to Applications before installing its file system extension."
+            } else if hasStaleIdentity {
+                let staleCount = Set(
+                    (identities.map(\.url) + snapshot.urls)
+                        .map { $0.resolvingSymlinksInPath().standardizedFileURL }
+                        .filter { $0 != expectedURL }
+                ).count
+                health = .duplicateRegistrations(staleCount)
+                statusDetail = "Found \(staleCount) stray GhostVMFS registration\(staleCount == 1 ? "" : "s"). macOS may launch the wrong extension."
+            } else if !snapshot.enabledByFSKit {
+                health = .disabled
+                statusDetail = "Turn on GhostVMFS in System Settings under File System Extensions."
+            } else if !identity.isEnabled {
+                health = .disabled
+                statusDetail = "FSKit cached a stale disabled state for GhostVMFS."
+            } else {
+                health = .ready
+                statusDetail = nil
+                errorMessage = nil
+            }
+        } catch {
+            extensionEnabled = false
+            repairAvailable = false
+            health = .scanFailed(error.localizedDescription)
+            statusDetail = "GhostVM could not inspect FSKit extensions."
+            errorMessage = "Unable to inspect FSKit extensions: \(error.localizedDescription)"
+        }
+    }
+
+    func repairRegistration() async {
+        let appURL = Self.appURL
+        guard Self.isInstalledApplication(appURL) else {
+            health = .needsApplicationInstall
+            errorMessage = "Move GhostVM to /Applications before repairing its FSKit registration."
+            return
+        }
+        guard !Self.hasMountedGhostVMVolumes() else {
+            statusDetail = "Stop all containers using guest directory mounts before repairing GhostVMFS."
+            return
+        }
+
+        isWorking = true
+        extensionEnabled = nil
+        defer { isWorking = false }
+
+        do {
+            let extensionURL = Self.expectedExtensionURL
+            try await Task.detached(priority: .userInitiated) {
+                try Self.run(
+                    executable: "/usr/bin/codesign",
+                    arguments: ["--verify", "--deep", "--strict", appURL.path]
+                )
+
+                let snapshot = Self.registrationSnapshot()
+                for staleURL in snapshot.urls where
+                    staleURL.resolvingSymlinksInPath().standardizedFileURL
+                        != extensionURL.resolvingSymlinksInPath().standardizedFileURL {
+                    try? Self.run(executable: "/usr/bin/pluginkit", arguments: ["-r", staleURL.path])
+                    if let staleApp = Self.containingApp(for: staleURL), staleApp != appURL {
+                        try? Self.run(
+                            executable: Self.launchServicesRegisterPath,
+                            arguments: ["-u", staleApp.path]
+                        )
+                    }
+                }
+
+                // Recreate the canonical identity too. System Settings can keep
+                // its switch attached to an obsolete PlugInKit UUID.
+                try? Self.run(executable: "/usr/bin/pluginkit", arguments: ["-r", extensionURL.path])
+                try? Self.run(
+                    executable: Self.launchServicesRegisterPath,
+                    arguments: ["-u", appURL.path]
+                )
+                try Self.run(
+                    executable: Self.launchServicesRegisterPath,
+                    arguments: ["-f", "-R", "-trusted", appURL.path]
+                )
+                try? Self.run(executable: "/usr/bin/killall", arguments: ["fskit_agent"])
+            }.value
+
+            try? await Task.sleep(for: .seconds(1))
+            await refresh()
+            errorMessage = nil
+            if extensionEnabled != true {
+                statusDetail = "Registration repaired. Turn on GhostVMFS in System Settings."
+                openSettings()
+            }
+        } catch {
+            extensionEnabled = false
+            errorMessage = "Unable to repair FSKit registration: \(error.localizedDescription)"
+        }
+    }
+
+    func openSettings() {
+        extensionEnabled = nil
+
+        let client = FSClient.shared as NSObject
+        let selector = NSSelectorFromString("openFileSystemExtensionsSettings")
+        if client.responds(to: selector) {
+            typealias OpenSettings = @convention(c) (AnyObject, Selector) -> Bool
+            let implementation = client.method(for: selector)
+            if unsafeBitCast(implementation, to: OpenSettings.self)(client, selector) {
+                return
+            }
+        }
+
+        guard let url = URL(
+            string: "x-apple.systempreferences:com.apple.ExtensionsPreferences?extensionPointIdentifier=com.apple.fskit.fsmodule"
+        ) else { return }
+        NSWorkspace.shared.open(url)
+    }
+
+    nonisolated static func reportNeedsAttention() {
+        NotificationCenter.default.post(name: .ghostVMFSExtensionNeedsAttention, object: nil)
+    }
+
+    struct RegistrationSnapshot: Sendable {
+        let urls: [URL]
+        let enabledByFSKit: Bool
+    }
+
+    nonisolated static let launchServicesRegisterPath =
+        "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
+
+    nonisolated static var appURL: URL {
+        Bundle.main.bundleURL.resolvingSymlinksInPath().standardizedFileURL
+    }
+
+    nonisolated static var expectedExtensionURL: URL {
+        appURL.appendingPathComponent(extensionRelativePath, isDirectory: true)
+    }
+
+    nonisolated static var enabledModulesURL: URL {
+        FileManager.default.homeDirectoryForCurrentUser
+            .appendingPathComponent("Library/Group Containers/group.com.apple.fskit.settings/enabledModules.plist")
+    }
+
+    nonisolated static func registrationSnapshot() -> RegistrationSnapshot {
+        let output = (try? runAndCapture(
+            executable: "/usr/bin/pluginkit",
+            arguments: [
+                "-v", "-m", "-A", "-D",
+                "-p", "com.apple.fskit.fsmodule",
+                "-i", extensionBundleIdentifier,
+            ]
+        )) ?? ""
+        let enabledModules = (try? Data(contentsOf: enabledModulesURL)).map {
+            enabledModuleIdentifiers(from: $0)
+        } ?? []
+        return RegistrationSnapshot(
+            urls: registrationURLs(from: output),
+            enabledByFSKit: enabledModules.contains(extensionBundleIdentifier)
+        )
+    }
+
+    nonisolated static func registrationURLs(from output: String) -> [URL] {
+        output.split(separator: "\n").compactMap { line -> URL? in
+            guard line.contains(extensionBundleIdentifier),
+                  let path = line.split(separator: "\t", omittingEmptySubsequences: true).last,
+                  path.hasPrefix("/") else { return nil }
+            return URL(fileURLWithPath: String(path), isDirectory: true)
+        }
+    }
+
+    nonisolated static func enabledModuleIdentifiers(from data: Data) -> Set {
+        let modules = (try? PropertyListSerialization.propertyList(
+            from: data,
+            format: nil
+        )) as? [String]
+        return Set(modules ?? [])
+    }
+
+    nonisolated static func isInstalledApplication(_ url: URL) -> Bool {
+        url.path.hasPrefix("/Applications/")
+    }
+
+    nonisolated private static func containingApp(for url: URL) -> URL? {
+        var candidate = url
+        while candidate.path != "/" {
+            if candidate.pathExtension == "app" { return candidate }
+            candidate.deleteLastPathComponent()
+        }
+        return nil
+    }
+
+    nonisolated private static func hasMountedGhostVMVolumes() -> Bool {
+        var fileSystems: UnsafeMutablePointer?
+        let count = getmntinfo(&fileSystems, MNT_NOWAIT)
+        guard count > 0, let fileSystems else { return false }
+        for index in 0.. String in
+                guard let address = bytes.baseAddress else { return "" }
+                return String(cString: address.assumingMemoryBound(to: CChar.self))
+            }
+            if type == "ghostvm" { return true }
+        }
+        return false
+    }
+
+    nonisolated private static func run(executable: String, arguments: [String]) throws {
+        _ = try runAndCapture(executable: executable, arguments: arguments)
+    }
+
+    nonisolated private static func runAndCapture(
+        executable: String,
+        arguments: [String]
+    ) throws -> String {
+        let process = Process()
+        let output = Pipe()
+        process.executableURL = URL(fileURLWithPath: executable)
+        process.arguments = arguments
+        process.standardOutput = output
+        process.standardError = output
+        try process.run()
+        let data = output.fileHandleForReading.readDataToEndOfFile()
+        process.waitUntilExit()
+        let detail = String(data: data, encoding: .utf8)?
+            .trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
+        guard process.terminationStatus == 0 else {
+            throw ExtensionCommandFailure(
+                detail.isEmpty
+                    ? "Command exited with status \(process.terminationStatus)"
+                    : detail
+            )
+        }
+        return detail
+    }
+
+    private struct ExtensionCommandFailure: LocalizedError {
+        let detail: String
+        init(_ detail: String) { self.detail = detail }
+        var errorDescription: String? { detail }
+    }
+}
diff --git a/macOS/GhostVM/Services/NetworkSettingsView.swift b/macOS/GhostVM/Services/NetworkSettingsView.swift
index e680357..2a67c04 100644
--- a/macOS/GhostVM/Services/NetworkSettingsView.swift
+++ b/macOS/GhostVM/Services/NetworkSettingsView.swift
@@ -65,11 +65,12 @@ struct NetworkSettingsView: View {
 
 @available(macOS 13.0, *)
 struct HostContainerSettingsView: View {
+    @EnvironmentObject private var fileSystemExtensionManager: GhostVMFSExtensionManager
     @Binding var isEnabled: Bool
     let networkMode: NetworkMode
     let accessibilityIdentifier: String
 
-    @State private var fileSystemExtensionEnabled: Bool?
+    @State private var showingFileSystemExtensionAssistant = false
 
     var body: some View {
         VStack(alignment: .leading, spacing: 4) {
@@ -92,14 +93,11 @@ struct HostContainerSettingsView: View {
 
                 Text(fileSystemExtensionStatus)
                     .font(.caption)
-                    .foregroundStyle(fileSystemExtensionEnabled == false ? Color.orange : Color.secondary)
+                    .foregroundStyle(fileSystemExtensionManager.health.requiresAttention ? Color.orange : Color.secondary)
 
-                if fileSystemExtensionEnabled == false {
-                    Button("Open System Settings…") {
-                        guard let url = URL(string: "x-apple.systempreferences:com.apple.LoginItems-Settings.extension") else {
-                            return
-                        }
-                        NSWorkspace.shared.open(url)
+                if fileSystemExtensionManager.health.requiresAttention {
+                    Button("Set Up / Repair File System Extension...") {
+                        showingFileSystemExtensionAssistant = true
                     }
                     .font(.caption)
                 }
@@ -107,9 +105,10 @@ struct HostContainerSettingsView: View {
         }
         .task(id: isEnabled) {
             guard isEnabled else { return }
-            fileSystemExtensionEnabled = await Task.detached(priority: .utility) {
-                GuestVolumeMount.extensionIsEnabled()
-            }.value
+            await fileSystemExtensionManager.refresh()
+        }
+        .sheet(isPresented: $showingFileSystemExtensionAssistant) {
+            GhostVMFSExtensionAssistantView(manager: fileSystemExtensionManager)
         }
         .onChange(of: networkMode) { _, newMode in
             if newMode != .nat {
@@ -119,13 +118,13 @@ struct HostContainerSettingsView: View {
     }
 
     private var fileSystemExtensionStatus: String {
-        switch fileSystemExtensionEnabled {
-        case true:
+        switch fileSystemExtensionManager.health {
+        case .ready:
             return "File System Extension: Enabled"
-        case false:
+        case .checking:
+            return "File System Extension: Checking..."
+        default:
             return "File System Extension: Not Enabled"
-        case nil:
-            return "File System Extension: Checking…"
         }
     }
 }
diff --git a/macOS/GhostVM/SwiftUIDemoApp.swift b/macOS/GhostVM/SwiftUIDemoApp.swift
index 9401aae..5e23404 100644
--- a/macOS/GhostVM/SwiftUIDemoApp.swift
+++ b/macOS/GhostVM/SwiftUIDemoApp.swift
@@ -25,8 +25,11 @@ private func formattedBuildDate(from version: String) -> String? {
 @available(macOS 13.0, *)
 struct GhostVMSwiftUIApp: App {
     @NSApplicationDelegateAdaptor(App2AppDelegate.self) private var appDelegate
+    @Environment(\.scenePhase) private var scenePhase
     @StateObject private var store = App2VMStore()
     @StateObject private var restoreStore = App2RestoreImageStore()
+    @StateObject private var fileSystemExtensionManager = GhostVMFSExtensionManager()
+    @State private var showingFileSystemExtensionAssistant = false
 
     init() {
         // IMPORTANT: Ignore SIGPIPE signal
@@ -51,11 +54,36 @@ struct GhostVMSwiftUIApp: App {
             VMListDemoView()
                 .environmentObject(store)
                 .environmentObject(restoreStore)
+                .environmentObject(fileSystemExtensionManager)
                 .onOpenURL { url in
                     NSLog("[GhostVM] onOpenURL: \(url.path)")
                     store.addBundles(from: [url])
                     App2AppDelegate.handleOpenURLs([url], store: store)
                 }
+                .sheet(isPresented: $showingFileSystemExtensionAssistant) {
+                    GhostVMFSExtensionAssistantView(manager: fileSystemExtensionManager)
+                }
+                .task {
+                    guard !ProcessInfo.processInfo.arguments.contains("--ui-testing") else { return }
+                    await fileSystemExtensionManager.refresh()
+                    showingFileSystemExtensionAssistant =
+                        fileSystemExtensionManager.health.requiresAttention
+                }
+                .onChange(of: scenePhase) { _, phase in
+                    guard phase == .active else { return }
+                    Task { await fileSystemExtensionManager.refresh() }
+                }
+                .onReceive(
+                    NotificationCenter.default.publisher(for: .ghostVMFSExtensionNeedsAttention)
+                        .receive(on: RunLoop.main)
+                ) { _ in
+                    Task {
+                        await fileSystemExtensionManager.refresh()
+                        if fileSystemExtensionManager.health.requiresAttention {
+                            showingFileSystemExtensionAssistant = true
+                        }
+                    }
+                }
         }
         .commands {
             DemoAppCommands(
@@ -69,6 +97,7 @@ struct GhostVMSwiftUIApp: App {
         WindowGroup("Settings", id: "settings") {
             SettingsDemoView()
                 .environment(\.sparkleUpdater, appDelegate.updaterController.updater)
+                .environmentObject(fileSystemExtensionManager)
         }
 
         WindowGroup("Restore Images", id: "restoreImages") {
@@ -2600,12 +2629,14 @@ struct VMWindowView: View {
 @available(macOS 13.0, *)
 struct SettingsDemoView: View {
     @Environment(\.sparkleUpdater) private var updater
+    @EnvironmentObject private var fileSystemExtensionManager: GhostVMFSExtensionManager
     @State private var ipswPath: String
     @State private var feedURLString: String
     @State private var verificationMessage: String? = nil
     @State private var verificationWasSuccessful: Bool? = nil
     @State private var isVerifying: Bool = false
     @State private var autoCheckForUpdates: Bool = true
+    @State private var showingFileSystemExtensionAssistant = false
 
     private let labelWidth: CGFloat = 130
 
@@ -2620,6 +2651,23 @@ struct SettingsDemoView: View {
             Text("Choose where GhostVM stores IPSW downloads and configure the IPSW feed.")
                 .fixedSize(horizontal: false, vertical: true)
 
+            labeledRow("File System") {
+                HStack(spacing: 8) {
+                    Image(systemName: fileSystemExtensionManager.health == .ready
+                        ? "checkmark.circle.fill"
+                        : "exclamationmark.triangle.fill")
+                        .foregroundStyle(fileSystemExtensionManager.health == .ready
+                            ? Color.green
+                            : Color.orange)
+                    Text(fileSystemExtensionStatus)
+                        .foregroundStyle(.secondary)
+                    Button(fileSystemExtensionManager.health == .ready ? "Details..." : "Set Up / Repair...") {
+                        showingFileSystemExtensionAssistant = true
+                    }
+                    .accessibilityIdentifier("settings.fileSystemExtensionButton")
+                }
+            }
+
             labeledRow("IPSW Cache") {
                 HStack(spacing: 8) {
                     TextField("Path to IPSW cache", text: $ipswPath)
@@ -2699,6 +2747,20 @@ struct SettingsDemoView: View {
                 autoCheckForUpdates = updater.automaticallyChecksForUpdates
             }
         }
+        .task {
+            await fileSystemExtensionManager.refresh()
+        }
+        .sheet(isPresented: $showingFileSystemExtensionAssistant) {
+            GhostVMFSExtensionAssistantView(manager: fileSystemExtensionManager)
+        }
+    }
+
+    private var fileSystemExtensionStatus: String {
+        switch fileSystemExtensionManager.health {
+        case .checking: return "Checking GhostVMFS..."
+        case .ready: return "GhostVMFS is ready"
+        default: return "GhostVMFS needs attention"
+        }
     }
 
     @ViewBuilder
diff --git a/macOS/GhostVMFS/Info.template.plist b/macOS/GhostVMFS/Info.template.plist
index 81c73b9..18e1ad4 100644
--- a/macOS/GhostVMFS/Info.template.plist
+++ b/macOS/GhostVMFS/Info.template.plist
@@ -18,6 +18,21 @@
 	
 		EXExtensionPointIdentifier
 		com.apple.fskit.fsmodule
+		FSActivateOptionSyntax
+		
+			shortOptions
+			g:m:o:u:
+		
+		FSCheckOptionSyntax
+		
+			shortOptions
+			nqy
+		
+		FSFormatOptionSyntax
+		
+			shortOptions
+			v
+		
 		FSMediaTypes
 		
 		FSPersonalities
@@ -36,7 +51,7 @@
 		ghostvm
 		FSSupportedSchemes
 		
-			ghostvm
+			ghostfile
 		
 		FSSupportsBlockResources
 		
diff --git a/macOS/GhostVMFS/entitlements.plist b/macOS/GhostVMFS/entitlements.plist
index 93e61a7..cbaa286 100644
--- a/macOS/GhostVMFS/entitlements.plist
+++ b/macOS/GhostVMFS/entitlements.plist
@@ -2,8 +2,12 @@
 
 
 
+	com.apple.application-identifier
+	3FGZQE8AW3.org.ghostvm.ghostvm.fs
 	com.apple.developer.fskit.fsmodule
 	
+	com.apple.developer.team-identifier
+	3FGZQE8AW3
 	com.apple.security.app-sandbox
 	
 	com.apple.security.network.client
diff --git a/macOS/GhostVMTests/GhostVMFSExtensionManagerTests.swift b/macOS/GhostVMTests/GhostVMFSExtensionManagerTests.swift
new file mode 100644
index 0000000..3057cda
--- /dev/null
+++ b/macOS/GhostVMTests/GhostVMFSExtensionManagerTests.swift
@@ -0,0 +1,82 @@
+import Foundation
+import XCTest
+
+final class GhostVMFSExtensionManagerTests: XCTestCase {
+    func testRegistrationURLsOnlyReturnsMatchingAbsolutePaths() {
+        let output = """
+        +    org.ghostvm.ghostvm.fs(1.0)\tUUID-1\t2026-08-05 00:00:00 +0000\t/Applications/GhostVM.app/Contents/Extensions/GhostVMFS.appex
+        +    org.example.other.fs(1.0)\tUUID-2\t2026-08-05 00:00:00 +0000\t/Applications/Other.app/Contents/Extensions/Other.appex
+        org.ghostvm.ghostvm.fs malformed relative/path
+        """
+
+        XCTAssertEqual(
+            GhostVMFSExtensionManager.registrationURLs(from: output).map(\.path),
+            ["/Applications/GhostVM.app/Contents/Extensions/GhostVMFS.appex"]
+        )
+    }
+
+    func testEnabledModuleIdentifiersReadsFSKitPreferenceArray() throws {
+        let data = try PropertyListSerialization.data(
+            fromPropertyList: ["com.apple.fskit.apfs", "org.ghostvm.ghostvm.fs"],
+            format: .binary,
+            options: 0
+        )
+
+        XCTAssertEqual(
+            GhostVMFSExtensionManager.enabledModuleIdentifiers(from: data),
+            ["com.apple.fskit.apfs", "org.ghostvm.ghostvm.fs"]
+        )
+    }
+
+    func testInvalidEnabledModulesPreferenceIsEmpty() {
+        XCTAssertTrue(
+            GhostVMFSExtensionManager.enabledModuleIdentifiers(from: Data("invalid".utf8)).isEmpty
+        )
+    }
+
+    func testGhostVMFSAdvertisesMountOperation() throws {
+        let macOSDirectory = URL(fileURLWithPath: #filePath)
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+        let plistURL = macOSDirectory.appendingPathComponent("GhostVMFS/Info.template.plist")
+        let plist = try XCTUnwrap(
+            PropertyListSerialization.propertyList(from: Data(contentsOf: plistURL), format: nil)
+                as? [String: Any]
+        )
+        let attributes = try XCTUnwrap(plist["EXAppExtensionAttributes"] as? [String: Any])
+        let activateSyntax = try XCTUnwrap(attributes["FSActivateOptionSyntax"] as? [String: Any])
+
+        XCTAssertEqual(activateSyntax["shortOptions"] as? String, "g:m:o:u:")
+        XCTAssertEqual(
+            (attributes["FSCheckOptionSyntax"] as? [String: Any])?["shortOptions"] as? String,
+            "nqy"
+        )
+        XCTAssertEqual(
+            (attributes["FSFormatOptionSyntax"] as? [String: Any])?["shortOptions"] as? String,
+            "v"
+        )
+    }
+
+    func testGhostVMFSSigningIdentityMatchesBundleIdentifier() throws {
+        let macOSDirectory = URL(fileURLWithPath: #filePath)
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+        let entitlementsURL = macOSDirectory.appendingPathComponent("GhostVMFS/entitlements.plist")
+        let entitlements = try XCTUnwrap(
+            PropertyListSerialization.propertyList(
+                from: Data(contentsOf: entitlementsURL),
+                format: nil
+            ) as? [String: Any]
+        )
+
+        XCTAssertEqual(
+            entitlements["com.apple.application-identifier"] as? String,
+            "3FGZQE8AW3.org.ghostvm.ghostvm.fs"
+        )
+        XCTAssertEqual(
+            entitlements["com.apple.developer.team-identifier"] as? String,
+            "3FGZQE8AW3"
+        )
+    }
+
+}
diff --git a/macOS/project.yml b/macOS/project.yml
index 809bc0d..3c31383 100644
--- a/macOS/project.yml
+++ b/macOS/project.yml
@@ -376,6 +376,8 @@ targets:
         excludes:
           - "*.plist"
     dependencies:
+      - package: GhostHTTP
+        embed: true
       - sdk: FSKit.framework
       - sdk: ExtensionFoundation.framework
     settings:
@@ -449,6 +451,7 @@ targets:
     platform: macOS
     sources:
       - path: GhostVMTests
+      - path: GhostVM/Services/GhostVMFSExtensionManager.swift
     dependencies:
       - target: GhostVMKit
     settings:

From bed15e81a68a148923821ecbd917fb105c0b09c6 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Wed, 5 Aug 2026 14:48:05 -0700
Subject: [PATCH 17/18] Add ghostbox run configuration and port forwarding

---
 CONTAINER_RUNTIME_PROTOCOL.md                 |  11 +
 Makefile                                      |  45 +-
 RUNTIME_FOUNDATIONS.md                        |   4 +-
 macOS/GhostTools/Package.swift                |  10 +-
 macOS/GhostTools/README.txt                   |  28 +-
 .../Sources/ghost-container/Args.swift        | 230 ----------
 macOS/GhostTools/Sources/ghostbox/Args.swift  | 423 ++++++++++++++++++
 .../GhostboxCLI.swift}                        | 128 ++++--
 .../LineReader.swift                          |   0
 .../Sources/ghostbox/PortForwarder.swift      | 232 ++++++++++
 .../Protocol.swift                            |  28 +-
 .../VsockDial.swift                           |   0
 .../ArgsTests.swift                           | 112 +++--
 .../LineReaderTests.swift                     |   2 +-
 .../GhostboxTests/PortForwarderTests.swift    | 100 +++++
 .../ProtocolTests.swift                       |  66 ++-
 .../VsockDialTests.swift                      |  10 +-
 .../Services/ContainerBridgeService.swift     |   9 +-
 macOS/GhostVM/Services/ContainerRunner.swift  |   9 +-
 .../GhostVMContainerRuntime/RuntimeMain.swift |  42 +-
 .../Containers/ContainerBridgeProtocol.swift  |  29 +-
 .../Containers/ContainerRunPolicy.swift       | 141 +++++-
 .../ContainerBridgeProtocolTests.swift        |  25 +-
 .../ContainerRunPolicyTests.swift             |  71 ++-
 24 files changed, 1339 insertions(+), 416 deletions(-)
 delete mode 100644 macOS/GhostTools/Sources/ghost-container/Args.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Args.swift
 rename macOS/GhostTools/Sources/{ghost-container/GhostContainerCLI.swift => ghostbox/GhostboxCLI.swift} (73%)
 rename macOS/GhostTools/Sources/{ghost-container => ghostbox}/LineReader.swift (100%)
 create mode 100644 macOS/GhostTools/Sources/ghostbox/PortForwarder.swift
 rename macOS/GhostTools/Sources/{ghost-container => ghostbox}/Protocol.swift (86%)
 rename macOS/GhostTools/Sources/{ghost-container => ghostbox}/VsockDial.swift (100%)
 rename macOS/GhostTools/Tests/{GhostContainerTests => GhostboxTests}/ArgsTests.swift (69%)
 rename macOS/GhostTools/Tests/{GhostContainerTests => GhostboxTests}/LineReaderTests.swift (99%)
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/PortForwarderTests.swift
 rename macOS/GhostTools/Tests/{GhostContainerTests => GhostboxTests}/ProtocolTests.swift (80%)
 rename macOS/GhostTools/Tests/{GhostContainerTests => GhostboxTests}/VsockDialTests.swift (91%)

diff --git a/CONTAINER_RUNTIME_PROTOCOL.md b/CONTAINER_RUNTIME_PROTOCOL.md
index a61a988..4421e1e 100644
--- a/CONTAINER_RUNTIME_PROTOCOL.md
+++ b/CONTAINER_RUNTIME_PROTOCOL.md
@@ -147,3 +147,14 @@ for existing GhostTools installations. Version 2 adds `tty`, `columns`, and
 Host responses use the request's protocol version. In TTY mode, the container
 process receives a native PTY, stderr is merged into stdout, `TERM` is set to
 `xterm-256color`, and resize frames map to `LinuxContainer.resize(to:)`.
+
+Version 4 adds optional `environment`, `workingDirectory`, `user`, `cpus`, and
+`memoryBytes` run fields. Once the container starts, the host returns its
+private address before relaying output:
+
+```json
+{"version":4,"type":"ready","ipv4Address":"192.168.64.3"}
+```
+
+`ghostbox` binds requested TCP ports in the macOS guest and forwards them to
+that address. The host never binds an outer-Mac port on behalf of a guest run.
diff --git a/Makefile b/Makefile
index 886f459..2b9ed72 100644
--- a/Makefile
+++ b/Makefile
@@ -467,16 +467,16 @@ tools: ghosttools-icon
 	@echo "Building GhostTools..."
 	@$(MAKE) --no-print-directory prepare-tools-plist INJECT_TIMESTAMP=$(INJECT_TIMESTAMP)
 	@# Force relink so the embedded __TEXT/__info_plist picks up the new timestamp
-	@rm -f "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/release/ghost-container"
+	@rm -f "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/release/ghostbox"
 	swift build --package-path $(GHOSTTOOLS_DIR) --scratch-path $(GHOSTTOOLS_BUILD_DIR) -c release
 	@# Assemble .app bundle
 	@rm -rf "$(GHOSTTOOLS_APP)"
 	@mkdir -p "$(GHOSTTOOLS_APP)/Contents/MacOS"
 	@mkdir -p "$(GHOSTTOOLS_APP)/Contents/Resources"
 	@cp "$(GHOSTTOOLS_BUILD_DIR)/release/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
-	@cp "$(GHOSTTOOLS_BUILD_DIR)/release/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
+	@cp "$(GHOSTTOOLS_BUILD_DIR)/release/ghostbox" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
 	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools"
-	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container"
+	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox"
 	@cp "$(PLIST_TOOLS)" "$(GHOSTTOOLS_APP)/Contents/Info.plist"
 	@# Generate release notes from git log since last tag
 	@LAST_TAG=$$(git describe --tags --abbrev=0 2>/dev/null); \
@@ -498,12 +498,12 @@ debug-tools:
 		-output $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug \
 		$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools
 	vtool -set-build-version macos 26.0 26.0 -replace \
-		-output $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug \
-		$(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container
+		-output $(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox-debug \
+		$(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox
 	codesign --force -s "-" $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug
-	codesign --force -s "-" $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug
+	codesign --force -s "-" $(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox-debug
 	@echo "Debug binary: $(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools-debug"
-	@echo "Debug binary: $(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container-debug"
+	@echo "Debug binary: $(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox-debug"
 	@echo "Copy to guest and use: lldb GhostTools-debug"
 
 # Generate GhostTools .icns from source PNG
@@ -560,12 +560,12 @@ $(GHOSTVM_ICON_ICNS): $(GHOSTVM_ICON_SRC)
 dmg: tools
 	@echo "Creating GhostTools.dmg..."
 	@rm -rf "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage"
-	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage"
+	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
-	@# Include ghost-container at DMG root level for direct testing from mounted volume
-	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
-	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/ghost-container"
+	@# Keep guest-facing command-line tools under one conventional directory.
+	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
+	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
 	@rm -f "$(GHOSTTOOLS_DMG)"
 	hdiutil create -volname "GhostTools" \
 		-srcfolder "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" \
@@ -794,12 +794,12 @@ dist:
 	@# 5b. Re-create GhostTools.dmg with Developer ID signing for notarization
 	@echo "  Re-signing GhostTools for distribution..."
 	@rm -rf "$(DIST_DIR)/ghosttools-stage"
-	@mkdir -p "$(DIST_DIR)/ghosttools-stage"
+	@mkdir -p "$(DIST_DIR)/ghosttools-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(DIST_DIR)/ghosttools-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(DIST_DIR)/ghosttools-stage/"
-	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(DIST_DIR)/ghosttools-stage/"
+	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
 	codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
-	codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/ghost-container"
+	codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
 	@rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg"
 	hdiutil create -volname "GhostTools" \
 		-srcfolder "$(DIST_DIR)/ghosttools-stage" \
@@ -852,24 +852,24 @@ dist:
 debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 	@# Build GhostTools (debug)
 	@$(MAKE) --no-print-directory prepare-tools-plist INJECT_TIMESTAMP=1 BUILD_TIMESTAMP=$(BUILD_TIMESTAMP)
-	@rm -f "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container"
+	@rm -f "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" "$(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox"
 	swift build --package-path $(GHOSTTOOLS_DIR) --scratch-path $(GHOSTTOOLS_BUILD_DIR) -c debug
 	@rm -rf "$(GHOSTTOOLS_APP)"
 	@mkdir -p "$(GHOSTTOOLS_APP)/Contents/MacOS" "$(GHOSTTOOLS_APP)/Contents/Resources"
 	@cp "$(GHOSTTOOLS_BUILD_DIR)/debug/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
-	@cp "$(GHOSTTOOLS_BUILD_DIR)/debug/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
+	@cp "$(GHOSTTOOLS_BUILD_DIR)/debug/ghostbox" "$(GHOSTTOOLS_APP)/Contents/MacOS/"
 	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools" "$(GHOSTTOOLS_APP)/Contents/MacOS/GhostTools"
-	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container"
+	vtool -set-build-version macos 26.0 26.0 -replace -output "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox"
 	@cp "$(PLIST_TOOLS)" "$(GHOSTTOOLS_APP)/Contents/Info.plist"
 	@cp "$(GHOSTTOOLS_ICON_ICNS)" "$(GHOSTTOOLS_APP)/Contents/Resources/"
 	codesign --force --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_APP)"
 	@# Package GhostTools.dmg
 	@rm -rf "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage"
-	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage"
+	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
-	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghost-container" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
-	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/ghost-container"
+	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
+	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
 	@rm -f "$(GHOSTTOOLS_DMG)"
 	hdiutil create -volname "GhostTools" \
 		-srcfolder "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage" \
@@ -1039,12 +1039,15 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 		-s "$(DIST_CODESIGN_ID)" \
 		"$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Extensions/GhostVMFS.appex"
 	@# Re-sign GhostTools.dmg inside the app bundle
-	@mkdir -p "$(DIST_DIR)/ghosttools-stage"
+	@mkdir -p "$(DIST_DIR)/ghosttools-stage/bin"
 	@hdiutil attach "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg" -mountpoint "$(DIST_DIR)/ghosttools-mount" -nobrowse
 	@ditto "$(DIST_DIR)/ghosttools-mount/GhostTools.app" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
 	@hdiutil detach "$(DIST_DIR)/ghosttools-mount"
+	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(DIST_DIR)/ghosttools-stage/README.txt"
 	@xattr -cr "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
 	codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
+	@cp "$(DIST_DIR)/ghosttools-stage/GhostTools.app/Contents/MacOS/ghostbox" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
+	codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
 	@rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg"
 	hdiutil create -volname "GhostTools" \
 		-srcfolder "$(DIST_DIR)/ghosttools-stage" \
diff --git a/RUNTIME_FOUNDATIONS.md b/RUNTIME_FOUNDATIONS.md
index 82cf2f4..9875dec 100644
--- a/RUNTIME_FOUNDATIONS.md
+++ b/RUNTIME_FOUNDATIONS.md
@@ -84,9 +84,9 @@ path while primitive handlers are added.
 
 ## GhostTools CLI
 
-`ghost-container` is the internal diagnostic frontend. It is already built as
+`ghostbox` is the native diagnostic frontend. It is built as
 a GhostTools package product, copied into `GhostTools.app/Contents/MacOS`, and
-placed at the GhostTools DMG root for direct testing.
+placed at `GhostTools/bin/ghostbox` for direct testing.
 
 The next guest layer is a Docker Engine API adapter that shares the same runtime
 client and translates Docker operations into one or more runtime protocol
diff --git a/macOS/GhostTools/Package.swift b/macOS/GhostTools/Package.swift
index 28f1c24..ea66b2f 100644
--- a/macOS/GhostTools/Package.swift
+++ b/macOS/GhostTools/Package.swift
@@ -8,7 +8,7 @@ let package = Package(
     ],
     products: [
         .executable(name: "GhostTools", targets: ["GhostTools"]),
-        .executable(name: "ghost-container", targets: ["ghost-container"])
+        .executable(name: "ghostbox", targets: ["ghostbox"])
     ],
     dependencies: [
         .package(path: "../../Packages/GhostHTTP")
@@ -25,13 +25,13 @@ let package = Package(
                 "CPty",
                 .product(name: "GhostHTTP", package: "GhostHTTP"),
             ],
-            exclude: ["Resources/Info.plist", "Resources/Info.template.plist", "Resources/entitlements.plist"],
+            exclude: ["Resources/Info.template.plist", "Resources/entitlements.plist"],
             linkerSettings: [
                 .unsafeFlags(["-Xlinker", "-sectcreate", "-Xlinker", "__TEXT", "-Xlinker", "__info_plist", "-Xlinker", "../../build/generated-plists/GhostTools-Info.plist"], .when(configuration: .release))
             ]
         ),
         .executableTarget(
-            name: "ghost-container",
+            name: "ghostbox",
             dependencies: []
         ),
         .testTarget(
@@ -41,8 +41,8 @@ let package = Package(
             ]
         ),
         .testTarget(
-            name: "GhostContainerTests",
-            dependencies: ["ghost-container"]
+            name: "GhostboxTests",
+            dependencies: ["ghostbox"]
         )
     ]
 )
diff --git a/macOS/GhostTools/README.txt b/macOS/GhostTools/README.txt
index ca8b347..2e1d9f9 100644
--- a/macOS/GhostTools/README.txt
+++ b/macOS/GhostTools/README.txt
@@ -25,25 +25,31 @@ To install manually:
 
    sudo cp /Volumes/GhostTools/GhostTools.app /Applications/
 
-The experimental container CLI can be run directly from the mounted DMG:
+The native container CLI can be run directly from the mounted DMG:
 
-   /Volumes/GhostTools/ghost-container run registry-1.docker.io/library/alpine:latest echo hello
+   /Volumes/GhostTools/bin/ghostbox run registry-1.docker.io/library/alpine:latest echo hello
 
 Host-backed Containers
 ----------------------
 
-This feature runs ephemeral Linux containers on the outer Mac through Apple's
-Containerization framework. It currently supports:
+Ghostbox runs ephemeral Linux containers on the outer Mac through Apple's
+Containerization framework. It supports:
 
-   ghost-container run IMAGE [COMMAND...]
-   ghost-container run -it IMAGE [COMMAND...]
-   ghost-container run -v /guest/path:/container/path:ro IMAGE [COMMAND...]
+   ghostbox run IMAGE [COMMAND...]
+   ghostbox run -it IMAGE [COMMAND...]
+   ghostbox run -v /guest/path:/container/path[:ro|rw] IMAGE [COMMAND...]
+   ghostbox run -p 8080:80 -e MODE=production -w /app IMAGE
+   ghostbox run -u 1000:1000 --cpus 2 --memory 1g IMAGE
 
 Use -i to attach stdin and -t to allocate a terminal. Combined -it sessions
 support terminal resize events and Ctrl-C through the container PTY. Alpine
 images provide /bin/sh by default:
 
-   ghost-container run -it registry-1.docker.io/library/alpine:latest /bin/sh
+   ghostbox run -it registry-1.docker.io/library/alpine:latest /bin/sh
+
+Published ports currently support TCP and bind to the guest's 127.0.0.1 by
+default. Provide an explicit guest IPv4 address before the host port to change
+the bind address.
 
 The outer Mac must be Apple silicon. In GhostVM, open Edit Settings for this VM,
 select NAT (Shared), and enable Host-backed Containers before starting the VM.
@@ -55,9 +61,9 @@ Enabling the bridge grants any process in the guest permission to request the
 limited host-side container run operation. Images are pulled using the host
 user's registry access and remain in the host image store after the ephemeral
 container exits, so private registry access and disk usage are part of this
-trust grant. A read-only volume exposes only the requested guest directory to
-the container. Outer-host paths, read-write mounts, builds, ports, and
-persistent containers are not supported.
+trust grant. Volumes expose the requested guest directory to the container and
+default to read-write; append `:ro` for a read-only mount. Outer-host paths,
+builds, and persistent containers are not supported.
 
 GhostTools requires Accessibility permission in the guest to enable
 pointer, keyboard, and UI automation features. Grant this in
diff --git a/macOS/GhostTools/Sources/ghost-container/Args.swift b/macOS/GhostTools/Sources/ghost-container/Args.swift
deleted file mode 100644
index 68c47b6..0000000
--- a/macOS/GhostTools/Sources/ghost-container/Args.swift
+++ /dev/null
@@ -1,230 +0,0 @@
-import Foundation
-
-/// Parse `ghost-container run [-i] [-t] [-v GUEST:CONTAINER:ro] IMAGE [COMMAND...]`.
-enum ParsedAction {
-    case run(image: String, command: [String], volumes: [HostContainerVolume], interactive: Bool, tty: Bool)
-    case help
-    case version
-}
-
-/// Errors produced during argument parsing.
-enum ParseError: LocalizedError {
-    case noArguments
-    case unknownSubcommand(String)
-    case missingImage
-    case invalidImage(String)
-    case tooManyCommands(max: Int)
-    case invalidCommand(index: Int, reason: String)
-    case missingVolume
-    case invalidVolume(String)
-    case tooManyVolumes(max: Int)
-    case duplicateVolumeDestination(String)
-
-    var errorDescription: String? {
-        switch self {
-        case .noArguments:
-            return "no arguments provided"
-        case .unknownSubcommand(let sub):
-            return "unknown subcommand '\(sub)'. Expected 'run'."
-        case .missingImage:
-            return "missing IMAGE argument. Usage: ghost-container run IMAGE [COMMAND...]"
-        case .invalidImage(let reason):
-            return "invalid IMAGE: \(reason)"
-        case .tooManyCommands(let max):
-            return "too many command arguments: maximum is \(max)"
-        case .invalidCommand(let index, let reason):
-            return "invalid command argument at index \(index): \(reason)"
-        case .missingVolume:
-            return "missing value for -v/--volume. Expected GUEST_PATH:CONTAINER_PATH:ro"
-        case .invalidVolume(let reason):
-            return "invalid volume: \(reason)"
-        case .tooManyVolumes(let max):
-            return "too many volumes: maximum is \(max)"
-        case .duplicateVolumeDestination(let path):
-            return "duplicate container volume destination '\(path)'"
-        }
-    }
-}
-
-struct CLIOptions {
-    let action: ParsedAction
-}
-
-/// Parse raw argv (excluding argv[0]).
-///
-/// Rules:
-/// - No arguments → help.
-/// - First token must be a subcommand (`run`, `--help`, `-h`, `help`, `--version`, `-v`).
-///   No flags/options before the subcommand are accepted.
-/// - `run [-i] [-t] [-v GUEST:CONTAINER:ro] IMAGE [COMMAND...]` — COMMAND args after IMAGE are opaque.
-func parseArguments(_ argv: [String]) -> Result {
-    if argv.isEmpty {
-        return .success(CLIOptions(action: .help))
-    }
-
-    let first = argv[0]
-
-    switch first {
-    case "--help", "-h", "help":
-        return .success(CLIOptions(action: .help))
-    case "--version", "-v":
-        return .success(CLIOptions(action: .version))
-    case "run":
-        break
-    default:
-        return .failure(.unknownSubcommand(first))
-    }
-
-    var index = 1
-    var volumes: [HostContainerVolume] = []
-    var interactive = false
-    var tty = false
-    optionLoop: while index < argv.count {
-        let token = argv[index]
-        switch token {
-        case "-i", "--interactive":
-            interactive = true
-            index += 1
-            continue
-        case "-t", "--tty":
-            tty = true
-            index += 1
-            continue
-        case "-it", "-ti":
-            interactive = true
-            tty = true
-            index += 1
-            continue
-        default:
-            break
-        }
-
-        let specification: String
-        if token == "-v" || token == "--volume" {
-            index += 1
-            guard index < argv.count else { return .failure(.missingVolume) }
-            specification = argv[index]
-        } else if token.hasPrefix("--volume=") {
-            specification = String(token.dropFirst("--volume=".count))
-        } else {
-            break optionLoop
-        }
-
-        guard volumes.count < kMaxVolumes else {
-            return .failure(.tooManyVolumes(max: kMaxVolumes))
-        }
-        switch parseVolume(specification) {
-        case .success(let volume):
-            guard !volumes.contains(where: { $0.destination == volume.destination }) else {
-                return .failure(.duplicateVolumeDestination(volume.destination))
-            }
-            volumes.append(volume)
-        case .failure(let error):
-            return .failure(error)
-        }
-        index += 1
-    }
-
-    guard index < argv.count else {
-        return .failure(.missingImage)
-    }
-
-    let image = argv[index]
-    if let err = validateImage(image) {
-        return .failure(err)
-    }
-
-    let command = Array(argv.dropFirst(index + 1))
-
-    if command.count > kMaxCommandArgs {
-        return .failure(.tooManyCommands(max: kMaxCommandArgs))
-    }
-    for (i, arg) in command.enumerated() {
-        if let err = validateCommandArg(arg) {
-            return .failure(.invalidCommand(index: i, reason: err))
-        }
-    }
-
-    return .success(CLIOptions(action: .run(
-        image: image,
-        command: command,
-        volumes: volumes,
-        interactive: interactive,
-        tty: tty
-    )))
-}
-
-/// Maximum number of command arguments accepted locally (matches host cap).
-let kMaxCommandArgs: Int = 64
-
-/// Maximum UTF-8 byte length of the image name (matches host cap).
-let kMaxImageBytes: Int = 256
-
-/// Maximum UTF-8 byte length of each command argument (matches host cap).
-let kMaxCommandArgBytes: Int = 4096
-
-/// Maximum number of guest directory mounts in one run request.
-let kMaxVolumes: Int = 32
-
-private func parseVolume(_ specification: String) -> Result {
-    let fields = specification.split(separator: ":", omittingEmptySubsequences: false).map(String.init)
-    guard fields.count == 2 || fields.count == 3 else {
-        return .failure(.invalidVolume("expected GUEST_PATH:CONTAINER_PATH[:ro]"))
-    }
-    let guestPath = fields[0]
-    let destination = fields[1]
-    guard guestPath.hasPrefix("/"), !guestPath.contains("\0") else {
-        return .failure(.invalidVolume("guest path must be absolute and contain no NUL bytes"))
-    }
-    let destinationParts = destination.split(separator: "/", omittingEmptySubsequences: true)
-    guard destination.hasPrefix("/"),
-          destination != "/",
-          !destination.contains("\0"),
-          !destinationParts.contains(where: { $0 == "." || $0 == ".." }) else {
-        return .failure(.invalidVolume("container path must be absolute, must not be '/', and must contain no dot components or NUL bytes"))
-    }
-    guard guestPath.utf8.count <= kMaxVolumePathBytes, destination.utf8.count <= kMaxVolumePathBytes else {
-        return .failure(.invalidVolume("paths must not exceed \(kMaxVolumePathBytes) bytes"))
-    }
-    let mode = fields.count == 3 ? fields[2] : "rw"
-    guard mode == "ro" else {
-        return .failure(.invalidVolume("guest directory mounts are currently read-only; append ':ro'"))
-    }
-    return .success(HostContainerVolume(guestPath: guestPath, destination: destination, readOnly: true))
-}
-
-let kMaxVolumePathBytes: Int = 4096
-
-/// Validate an image name: nonempty, no NUL, no leading dash, sensible UTF-8 byte
-/// length, no whitespace.
-func validateImage(_ image: String) -> ParseError? {
-    if image.isEmpty {
-        return .invalidImage("image name is empty")
-    }
-    if image.contains("\0") {
-        return .invalidImage("image name contains NUL byte")
-    }
-    if image.hasPrefix("-") {
-        return .invalidImage("image name must not start with '-'")
-    }
-    // Length is measured in UTF-8 bytes to match the host.
-    if image.utf8.count > kMaxImageBytes {
-        return .invalidImage("image name exceeds \(kMaxImageBytes) bytes")
-    }
-    if image.contains(" ") || image.contains("\t") || image.contains("\n") || image.contains("\r") {
-        return .invalidImage("image name must not contain whitespace")
-    }
-    return nil
-}
-
-/// Validate a single command argument: no NUL, bounded UTF-8 byte length.
-/// Args may begin with `-` (opaque), so only NUL and length are checked.
-func validateCommandArg(_ arg: String) -> String? {
-    if arg.contains("\0") {
-        return "contains NUL byte"
-    }
-    if arg.utf8.count > kMaxCommandArgBytes {
-        return "exceeds \(kMaxCommandArgBytes) bytes"
-    }
-    return nil
-}
diff --git a/macOS/GhostTools/Sources/ghostbox/Args.swift b/macOS/GhostTools/Sources/ghostbox/Args.swift
new file mode 100644
index 0000000..c46d4c7
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghostbox/Args.swift
@@ -0,0 +1,423 @@
+import Foundation
+
+enum ParsedAction {
+    case run(GhostboxRunOptions)
+    case help
+    case version
+}
+
+struct GhostboxRunOptions: Equatable {
+    let image: String
+    let command: [String]
+    let volumes: [HostContainerVolume]
+    let publishedPorts: [PublishedPort]
+    let environment: [String]
+    let workingDirectory: String?
+    let user: String?
+    let cpus: Int?
+    let memoryBytes: UInt64?
+    let interactive: Bool
+    let tty: Bool
+}
+
+struct PublishedPort: Equatable {
+    let hostAddress: String
+    let hostPort: UInt16
+    let containerPort: UInt16
+}
+
+enum ParseError: LocalizedError, Equatable {
+    case unknownSubcommand(String)
+    case unknownOption(String)
+    case missingOptionValue(String)
+    case missingImage
+    case invalidImage(String)
+    case tooManyCommands(max: Int)
+    case invalidCommand(index: Int, reason: String)
+    case invalidVolume(String)
+    case tooManyVolumes(max: Int)
+    case duplicateVolumeDestination(String)
+    case invalidPublish(String)
+    case duplicatePublishedPort(address: String, port: UInt16)
+    case invalidEnvironment(String)
+    case environmentNotSet(String)
+    case tooManyEnvironmentVariables(max: Int)
+    case invalidWorkingDirectory(String)
+    case invalidUser(String)
+    case invalidCPUs(String)
+    case invalidMemory(String)
+
+    var errorDescription: String? {
+        switch self {
+        case .unknownSubcommand(let sub):
+            return "unknown subcommand '\(sub)'. Expected 'run'."
+        case .unknownOption(let option):
+            return "unknown run option '\(option)'"
+        case .missingOptionValue(let option):
+            return "option \(option) requires a value"
+        case .missingImage:
+            return "missing IMAGE argument. Usage: ghostbox run [OPTIONS] IMAGE [COMMAND...]"
+        case .invalidImage(let reason):
+            return "invalid IMAGE: \(reason)"
+        case .tooManyCommands(let max):
+            return "too many command arguments: maximum is \(max)"
+        case .invalidCommand(let index, let reason):
+            return "invalid command argument at index \(index): \(reason)"
+        case .invalidVolume(let reason):
+            return "invalid volume: \(reason)"
+        case .tooManyVolumes(let max):
+            return "too many volumes: maximum is \(max)"
+        case .duplicateVolumeDestination(let path):
+            return "duplicate container volume destination '\(path)'"
+        case .invalidPublish(let reason):
+            return "invalid published port: \(reason)"
+        case .duplicatePublishedPort(let address, let port):
+            return "duplicate published port \(address):\(port)"
+        case .invalidEnvironment(let reason):
+            return "invalid environment variable: \(reason)"
+        case .environmentNotSet(let name):
+            return "environment variable '\(name)' is not set in the guest"
+        case .tooManyEnvironmentVariables(let max):
+            return "too many environment variables: maximum is \(max)"
+        case .invalidWorkingDirectory(let reason):
+            return "invalid working directory: \(reason)"
+        case .invalidUser(let reason):
+            return "invalid user: \(reason)"
+        case .invalidCPUs(let reason):
+            return "invalid CPU limit: \(reason)"
+        case .invalidMemory(let reason):
+            return "invalid memory limit: \(reason)"
+        }
+    }
+}
+
+struct CLIOptions {
+    let action: ParsedAction
+}
+
+func parseArguments(_ argv: [String]) -> Result {
+    guard let first = argv.first else {
+        return .success(CLIOptions(action: .help))
+    }
+    switch first {
+    case "--help", "-h", "help":
+        return .success(CLIOptions(action: .help))
+    case "--version", "-v":
+        return .success(CLIOptions(action: .version))
+    case "run":
+        break
+    default:
+        return .failure(.unknownSubcommand(first))
+    }
+
+    var index = 1
+    var volumes: [HostContainerVolume] = []
+    var publishedPorts: [PublishedPort] = []
+    var environment: [String] = []
+    var workingDirectory: String?
+    var user: String?
+    var cpus: Int?
+    var memoryBytes: UInt64?
+    var interactive = false
+    var tty = false
+
+    optionLoop: while index < argv.count {
+        let token = argv[index]
+        switch token {
+        case "-i", "--interactive":
+            interactive = true
+            index += 1
+        case "-t", "--tty":
+            tty = true
+            index += 1
+        case "-it", "-ti":
+            interactive = true
+            tty = true
+            index += 1
+        case "-v", "--volume":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            if let error = appendVolume(argv[index + 1], to: &volumes) { return .failure(error) }
+            index += 2
+        case "-p", "--publish":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            if let error = appendPublishedPort(argv[index + 1], to: &publishedPorts) { return .failure(error) }
+            index += 2
+        case "-e", "--env":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            if let error = appendEnvironment(argv[index + 1], to: &environment) { return .failure(error) }
+            index += 2
+        case "-w", "--workdir":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            let value = argv[index + 1]
+            if let error = validateWorkingDirectory(value) { return .failure(error) }
+            workingDirectory = value
+            index += 2
+        case "-u", "--user":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            let value = argv[index + 1]
+            if let error = validateUser(value) { return .failure(error) }
+            user = value
+            index += 2
+        case "-c", "--cpus":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            guard let value = Int(argv[index + 1]), value > 0 else {
+                return .failure(.invalidCPUs("expected a positive integer"))
+            }
+            cpus = value
+            index += 2
+        case "-m", "--memory":
+            guard index + 1 < argv.count else { return .failure(.missingOptionValue(token)) }
+            switch parseMemory(argv[index + 1]) {
+            case .success(let value): memoryBytes = value
+            case .failure(let error): return .failure(error)
+            }
+            index += 2
+        default:
+            if token.hasPrefix("--volume=") {
+                if let error = appendVolume(String(token.dropFirst("--volume=".count)), to: &volumes) { return .failure(error) }
+                index += 1
+            } else if token.hasPrefix("--publish=") {
+                if let error = appendPublishedPort(String(token.dropFirst("--publish=".count)), to: &publishedPorts) { return .failure(error) }
+                index += 1
+            } else if token.hasPrefix("--env=") {
+                if let error = appendEnvironment(String(token.dropFirst("--env=".count)), to: &environment) { return .failure(error) }
+                index += 1
+            } else if token.hasPrefix("--workdir=") {
+                let value = String(token.dropFirst("--workdir=".count))
+                if let error = validateWorkingDirectory(value) { return .failure(error) }
+                workingDirectory = value
+                index += 1
+            } else if token.hasPrefix("--user=") {
+                let value = String(token.dropFirst("--user=".count))
+                if let error = validateUser(value) { return .failure(error) }
+                user = value
+                index += 1
+            } else if token.hasPrefix("--cpus=") {
+                guard let value = Int(token.dropFirst("--cpus=".count)), value > 0 else {
+                    return .failure(.invalidCPUs("expected a positive integer"))
+                }
+                cpus = value
+                index += 1
+            } else if token.hasPrefix("--memory=") {
+                switch parseMemory(String(token.dropFirst("--memory=".count))) {
+                case .success(let value): memoryBytes = value
+                case .failure(let error): return .failure(error)
+                }
+                index += 1
+            } else if token.hasPrefix("-") {
+                return .failure(.unknownOption(token))
+            } else {
+                break optionLoop
+            }
+        }
+    }
+
+    guard index < argv.count else { return .failure(.missingImage) }
+    let image = argv[index]
+    if let error = validateImage(image) { return .failure(error) }
+
+    let command = Array(argv.dropFirst(index + 1))
+    guard command.count <= kMaxCommandArgs else {
+        return .failure(.tooManyCommands(max: kMaxCommandArgs))
+    }
+    for (commandIndex, argument) in command.enumerated() {
+        if let reason = validateCommandArg(argument) {
+            return .failure(.invalidCommand(index: commandIndex, reason: reason))
+        }
+    }
+
+    return .success(CLIOptions(action: .run(GhostboxRunOptions(
+        image: image,
+        command: command,
+        volumes: volumes,
+        publishedPorts: publishedPorts,
+        environment: environment,
+        workingDirectory: workingDirectory,
+        user: user,
+        cpus: cpus,
+        memoryBytes: memoryBytes,
+        interactive: interactive,
+        tty: tty
+    ))))
+}
+
+let kMaxCommandArgs = 64
+let kMaxImageBytes = 256
+let kMaxCommandArgBytes = 4096
+let kMaxVolumes = 32
+let kMaxVolumePathBytes = 4096
+let kMaxEnvironmentVariables = 256
+
+private func appendVolume(_ specification: String, to volumes: inout [HostContainerVolume]) -> ParseError? {
+    guard volumes.count < kMaxVolumes else { return .tooManyVolumes(max: kMaxVolumes) }
+    switch parseVolume(specification) {
+    case .failure(let error):
+        return error
+    case .success(let volume):
+        guard !volumes.contains(where: { $0.destination == volume.destination }) else {
+            return .duplicateVolumeDestination(volume.destination)
+        }
+        volumes.append(volume)
+        return nil
+    }
+}
+
+private func parseVolume(_ specification: String) -> Result {
+    let fields = specification.split(separator: ":", omittingEmptySubsequences: false).map(String.init)
+    guard fields.count == 2 || fields.count == 3 else {
+        return .failure(.invalidVolume("expected GUEST_PATH:CONTAINER_PATH[:ro|rw]"))
+    }
+    let guestPath = fields[0]
+    let destination = fields[1]
+    guard guestPath.hasPrefix("/"), !guestPath.contains("\0") else {
+        return .failure(.invalidVolume("guest path must be absolute and contain no NUL bytes"))
+    }
+    let destinationParts = destination.split(separator: "/", omittingEmptySubsequences: true)
+    guard destination.hasPrefix("/"), destination != "/", !destination.contains("\0"),
+          !destinationParts.contains(where: { $0 == "." || $0 == ".." }) else {
+        return .failure(.invalidVolume("container path must be absolute, must not be '/', and must contain no dot components or NUL bytes"))
+    }
+    guard guestPath.utf8.count <= kMaxVolumePathBytes, destination.utf8.count <= kMaxVolumePathBytes else {
+        return .failure(.invalidVolume("paths must not exceed \(kMaxVolumePathBytes) bytes"))
+    }
+    let mode = fields.count == 3 ? fields[2] : "rw"
+    guard mode == "ro" || mode == "rw" else {
+        return .failure(.invalidVolume("volume mode must be 'ro' or 'rw'"))
+    }
+    return .success(HostContainerVolume(guestPath: guestPath, destination: destination, readOnly: mode == "ro"))
+}
+
+private func appendPublishedPort(_ specification: String, to ports: inout [PublishedPort]) -> ParseError? {
+    switch parsePublishedPort(specification) {
+    case .failure(let error):
+        return error
+    case .success(let port):
+        guard !ports.contains(where: { $0.hostAddress == port.hostAddress && $0.hostPort == port.hostPort }) else {
+            return .duplicatePublishedPort(address: port.hostAddress, port: port.hostPort)
+        }
+        ports.append(port)
+        return nil
+    }
+}
+
+func parsePublishedPort(_ specification: String) -> Result {
+    let protocolParts = specification.split(separator: "/", omittingEmptySubsequences: false)
+    guard protocolParts.count <= 2 else { return .failure(.invalidPublish("invalid protocol suffix")) }
+    if protocolParts.count == 2, protocolParts[1].lowercased() != "tcp" {
+        return .failure(.invalidPublish("only TCP is supported"))
+    }
+    let fields = protocolParts[0].split(separator: ":", omittingEmptySubsequences: false).map(String.init)
+    guard fields.count == 2 || fields.count == 3 else {
+        return .failure(.invalidPublish("expected [HOST_IP:]HOST_PORT:CONTAINER_PORT[/tcp]"))
+    }
+    let hostAddress = fields.count == 3 ? fields[0] : "127.0.0.1"
+    let hostPortText = fields.count == 3 ? fields[1] : fields[0]
+    let containerPortText = fields.count == 3 ? fields[2] : fields[1]
+    guard isIPv4Address(hostAddress) else { return .failure(.invalidPublish("host address must be an IPv4 address")) }
+    guard let hostPort = UInt16(hostPortText), hostPort > 0 else {
+        return .failure(.invalidPublish("host port must be between 1 and 65535"))
+    }
+    guard let containerPort = UInt16(containerPortText), containerPort > 0 else {
+        return .failure(.invalidPublish("container port must be between 1 and 65535"))
+    }
+    return .success(PublishedPort(hostAddress: hostAddress, hostPort: hostPort, containerPort: containerPort))
+}
+
+private func appendEnvironment(_ specification: String, to environment: inout [String]) -> ParseError? {
+    guard environment.count < kMaxEnvironmentVariables else {
+        return .tooManyEnvironmentVariables(max: kMaxEnvironmentVariables)
+    }
+    let name: String
+    let value: String
+    if let separator = specification.firstIndex(of: "=") {
+        name = String(specification[.. ParseError? {
+    guard path.hasPrefix("/") else { return .invalidWorkingDirectory("path must be absolute") }
+    guard !path.contains("\0") else { return .invalidWorkingDirectory("path contains a NUL byte") }
+    guard path.utf8.count <= 4096 else { return .invalidWorkingDirectory("path exceeds 4096 bytes") }
+    return nil
+}
+
+private func validateUser(_ user: String) -> ParseError? {
+    guard !user.isEmpty else { return .invalidUser("value must not be empty") }
+    guard !user.contains("\0"), user.utf8.count <= 256 else {
+        return .invalidUser("value must contain no NUL bytes and be at most 256 bytes")
+    }
+    guard !user.unicodeScalars.contains(where: { CharacterSet.whitespacesAndNewlines.contains($0) || CharacterSet.controlCharacters.contains($0) }) else {
+        return .invalidUser("value must not contain whitespace or control characters")
+    }
+    let fields = user.split(separator: ":", omittingEmptySubsequences: false)
+    guard fields.count <= 2, fields.allSatisfy({ !$0.isEmpty }) else {
+        return .invalidUser("expected NAME, UID, NAME:GID, or UID:GID")
+    }
+    return nil
+}
+
+func parseMemory(_ text: String) -> Result {
+    let lower = text.lowercased()
+    let digits = lower.prefix(while: { $0.isNumber })
+    guard !digits.isEmpty, let value = UInt64(digits), value > 0 else {
+        return .failure(.invalidMemory("expected a positive size such as 512m or 2g"))
+    }
+    let suffix = lower.dropFirst(digits.count)
+    let multiplier: UInt64
+    switch suffix {
+    case "", "b": multiplier = 1
+    case "k", "kb", "kib": multiplier = 1024
+    case "m", "mb", "mib": multiplier = 1024 * 1024
+    case "g", "gb", "gib": multiplier = 1024 * 1024 * 1024
+    case "t", "tb", "tib": multiplier = 1024 * 1024 * 1024 * 1024
+    default: return .failure(.invalidMemory("unsupported size suffix"))
+    }
+    let result = value.multipliedReportingOverflow(by: multiplier)
+    guard !result.overflow else { return .failure(.invalidMemory("size is too large")) }
+    return .success(result.partialValue)
+}
+
+func validateImage(_ image: String) -> ParseError? {
+    if image.isEmpty { return .invalidImage("image name is empty") }
+    if image.contains("\0") { return .invalidImage("image name contains NUL byte") }
+    if image.hasPrefix("-") { return .invalidImage("image name must not start with '-'") }
+    if image.utf8.count > kMaxImageBytes { return .invalidImage("image name exceeds \(kMaxImageBytes) bytes") }
+    if image.unicodeScalars.contains(where: { CharacterSet.whitespacesAndNewlines.contains($0) || CharacterSet.controlCharacters.contains($0) }) {
+        return .invalidImage("image name must not contain whitespace or control characters")
+    }
+    return nil
+}
+
+func validateCommandArg(_ argument: String) -> String? {
+    if argument.contains("\0") { return "contains NUL byte" }
+    if argument.utf8.count > kMaxCommandArgBytes { return "exceeds \(kMaxCommandArgBytes) bytes" }
+    return nil
+}
+
+private func isEnvironmentName(_ name: String) -> Bool {
+    guard let first = name.utf8.first, first == 95 || (65...90).contains(first) || (97...122).contains(first) else { return false }
+    return name.utf8.dropFirst().allSatisfy { $0 == 95 || (48...57).contains($0) || (65...90).contains($0) || (97...122).contains($0) }
+}
+
+private func isIPv4Address(_ address: String) -> Bool {
+    let octets = address.split(separator: ".", omittingEmptySubsequences: false)
+    return octets.count == 4 && octets.allSatisfy { octet in
+        !octet.isEmpty && octet.allSatisfy(\.isNumber) && UInt8(octet) != nil
+    }
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift b/macOS/GhostTools/Sources/ghostbox/GhostboxCLI.swift
similarity index 73%
rename from macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift
rename to macOS/GhostTools/Sources/ghostbox/GhostboxCLI.swift
index cb48233..cc6e4bd 100644
--- a/macOS/GhostTools/Sources/ghost-container/GhostContainerCLI.swift
+++ b/macOS/GhostTools/Sources/ghostbox/GhostboxCLI.swift
@@ -1,33 +1,39 @@
 import Foundation
 
-let gcVersion = "0.1.0"
+let ghostboxVersion = "0.1.0"
 
-let gcHelp = """
-Usage: ghost-container run [-i] [-t] [-v GUEST_PATH:CONTAINER_PATH:ro] IMAGE [COMMAND...]
+let ghostboxHelp = """
+Usage: ghostbox run [OPTIONS] IMAGE [COMMAND...]
 
-Run a container image on the outer Mac through Apple container.
+Run a container image on the outer Mac through Apple Containerization.
 
 Arguments:
   IMAGE     Fully qualified OCI image reference
   COMMAND   Optional command and args to run inside the container
 
 Examples:
-  ghost-container run registry-1.docker.io/library/alpine:latest echo hello
-  ghost-container run -it registry-1.docker.io/library/alpine:latest /bin/sh
-  ghost-container run -v /home/user/src:/src:ro registry-1.docker.io/library/alpine:latest ls /src
-  ghost-container run registry-1.docker.io/library/ubuntu:24.04
+  ghostbox run registry-1.docker.io/library/alpine:latest echo hello
+  ghostbox run -it registry-1.docker.io/library/alpine:latest /bin/sh
+  ghostbox run -v /home/user/src:/src:ro registry-1.docker.io/library/alpine:latest ls /src
+  ghostbox run -p 8080:80 -e MODE=production -w /app --cpus 2 --memory 1g example.com/app:latest
 
 Options:
-  -i, --interactive  Keep stdin attached
-  -t, --tty          Allocate a terminal (combine as -it)
-  -v, --volume SPEC  Mount a guest directory read-only (GUEST:CONTAINER:ro)
-  --help, -h     Show this help
-  --version, -v  Show version
+  -i, --interactive       Keep stdin attached
+  -t, --tty               Allocate a terminal (combine as -it)
+  -v, --volume SPEC       Mount GUEST:CONTAINER[:ro|rw]
+  -p, --publish SPEC      Forward [HOST_IP:]HOST_PORT:CONTAINER_PORT[/tcp]
+  -e, --env NAME[=VALUE]  Set or inherit an environment variable
+  -w, --workdir PATH      Set the container working directory
+  -u, --user USER[:GROUP] Set the container user
+  -c, --cpus COUNT        Set the CPU count
+  -m, --memory SIZE       Set memory, for example 512m or 2g
+  --help, -h              Show this help
+  --version               Show version
 """
 
 /// Entry point — parses argv, dispatches to run, exits with appropriate status.
 @main
-struct GhostContainerCLI {
+struct GhostboxCLI {
     static func main() {
         signal(SIGPIPE, SIG_IGN)
 
@@ -52,39 +58,30 @@ struct GhostContainerCLI {
     static func run(_ opts: CLIOptions) -> Int32 {
         switch opts.action {
         case .help:
-            FileHandle.standardOutput.write(Data(gcHelp.utf8))
+            FileHandle.standardOutput.write(Data((ghostboxHelp + "\n").utf8))
             return 0
         case .version:
-            FileHandle.standardOutput.write(Data("\(gcVersion)\n".utf8))
+            FileHandle.standardOutput.write(Data("\(ghostboxVersion)\n".utf8))
             return 0
-        case .run(let image, let command, let volumes, let interactive, let tty):
-            return runContainer(
-                image: image,
-                command: command,
-                volumes: volumes,
-                interactive: interactive,
-                tty: tty,
-                port: kDefaultVsockPort
-            )
+        case .run(let options):
+            return runContainer(options: options, port: kDefaultVsockPort)
         }
     }
 }
 
 /// Connect to the host via vsock, attach stdin, and stream responses.
 func runContainer(
-    image: String,
-    command: [String],
-    volumes: [HostContainerVolume] = [],
-    interactive: Bool = false,
-    tty: Bool = false,
+    options: GhostboxRunOptions,
     port: UInt32
 ) -> Int32 {
+    let interactive = options.interactive
+    let tty = options.tty
     if tty && isatty(STDOUT_FILENO) == 0 {
-        writeStderr("ghost-container: -t requires stdout to be a terminal\n")
+        writeStderr("ghostbox: -t requires stdout to be a terminal\n")
         return 125
     }
     if tty && interactive && isatty(STDIN_FILENO) == 0 {
-        writeStderr("ghost-container: -it requires stdin to be a terminal\n")
+        writeStderr("ghostbox: -it requires stdin to be a terminal\n")
         return 125
     }
 
@@ -94,7 +91,7 @@ func runContainer(
         do {
             rawTerminal = try RawTerminal(fd: STDIN_FILENO)
         } catch {
-            writeStderr("ghost-container: failed to enter raw terminal mode: \(error)\n")
+            writeStderr("ghostbox: failed to enter raw terminal mode: \(error)\n")
             return 125
         }
     }
@@ -113,14 +110,23 @@ func runContainer(
         writeRunStderr(Data(string.utf8))
     }
 
+    let portForwarders: [PublishedPortForwarder]
+    do {
+        portForwarders = try options.publishedPorts.map(PublishedPortForwarder.init)
+    } catch {
+        writeRunStderr("ghostbox: cannot publish port: \(error.localizedDescription)\n")
+        return 125
+    }
+    defer { portForwarders.forEach { $0.stop() } }
+
     let fd: Int32
     do {
         fd = try vsockDialHost(port: port)
     } catch let err as VsockDialError {
-        writeRunStderr("ghost-container: cannot connect to host: \(err)\n")
+        writeRunStderr("ghostbox: cannot connect to host: \(err)\n")
         return 125
     } catch {
-        writeRunStderr("ghost-container: unexpected error: \(error)\n")
+        writeRunStderr("ghostbox: unexpected error: \(error)\n")
         return 125
     }
 
@@ -132,7 +138,7 @@ func runContainer(
     if interactive || tty {
         let inputSocket = Darwin.dup(fd)
         guard inputSocket >= 0 else {
-            writeRunStderr("ghost-container: failed to duplicate input socket (errno \(errno))\n")
+            writeRunStderr("ghostbox: failed to duplicate input socket (errno \(errno))\n")
             return 125
         }
         inputWriter = ContainerInputWriter(fd: inputSocket)
@@ -142,9 +148,14 @@ func runContainer(
     defer { inputWriter?.close() }
 
     let request = makeRunRequest(
-        image: image,
-        command: command,
-        volumes: volumes,
+        image: options.image,
+        command: options.command,
+        volumes: options.volumes,
+        environment: options.environment,
+        workingDirectory: options.workingDirectory,
+        user: options.user,
+        cpus: options.cpus,
+        memoryBytes: options.memoryBytes,
         interactive: interactive,
         tty: tty,
         columns: terminalSize?.columns,
@@ -154,12 +165,12 @@ func runContainer(
     do {
         line = try encodeRequestLine(request)
     } catch {
-        writeRunStderr("ghost-container: failed to encode request: \(error)\n")
+        writeRunStderr("ghostbox: failed to encode request: \(error)\n")
         return 125
     }
 
     guard writeAll(fd: fd, line) else {
-        writeRunStderr("ghost-container: failed to send request (EPIPE/errno \(errno))\n")
+        writeRunStderr("ghostbox: failed to send request (EPIPE/errno \(errno))\n")
         return 125
     }
 
@@ -194,25 +205,27 @@ func runContainer(
         do {
             rawLine = try reader.readLine()
         } catch LineReaderError.lineTooLong(let max) {
-            writeRunStderr("ghost-container: response line exceeded \(max) bytes\n")
+            writeRunStderr("ghostbox: response line exceeded \(max) bytes\n")
             return 125
         } catch LineReaderError.ioError(let err, let op) {
-            writeRunStderr("ghost-container: \(op) error: errno \(err) (\(String(cString: strerror(err))))\n")
+            writeRunStderr("ghostbox: \(op) error: errno \(err) (\(String(cString: strerror(err))))\n")
             return 125
         } catch {
-            writeRunStderr("ghost-container: unexpected read error: \(error)\n")
+            writeRunStderr("ghostbox: unexpected read error: \(error)\n")
             return 125
         }
 
         guard let json = rawLine, !json.isEmpty else {
-            writeRunStderr("ghost-container: connection closed before exit response\n")
+            writeRunStderr("ghostbox: connection closed before exit response\n")
             return 125
         }
 
         switch decodeResponse(json) {
+        case .ready(let ipv4Address):
+            portForwarders.forEach { $0.start(targetAddress: ipv4Address) }
         case .stdout(let data):
             if !writeStdout(data) {
-                writeRunStderr("ghost-container: failed to write stdout to fd 1 (errno \(errno): \(String(cString: strerror(errno))))\n")
+                writeRunStderr("ghostbox: failed to write stdout to fd 1 (errno \(errno): \(String(cString: strerror(errno))))\n")
                 return 125
             }
         case .stderr(let data):
@@ -220,16 +233,16 @@ func runContainer(
                 // Best-effort diagnostic: writing the diagnostic itself may also
                 // fail (e.g. fd 2 closed). If it does, we cannot report further;
                 // just surface the original failure via the exit status.
-                _ = writeRunStderr("ghost-container: failed to write stderr to fd 2 (errno \(errno): \(String(cString: strerror(errno))))\n")
+                _ = writeRunStderr("ghostbox: failed to write stderr to fd 2 (errno \(errno): \(String(cString: strerror(errno))))\n")
                 return 125
             }
         case .exit(let code):
             return code
         case .error(let message):
-            writeRunStderr("ghost-container: host error: \(message)\n")
+            writeRunStderr("ghostbox: host error: \(message)\n")
             return 125
         case .protocolError(let message):
-            writeRunStderr("ghost-container: protocol error: \(message)\n")
+            writeRunStderr("ghostbox: protocol error: \(message)\n")
             return 125
         }
     }
@@ -259,6 +272,23 @@ func encodeRequestLine(_ request: HostContainerRequest) throws -> Data {
         }.joined(separator: ",")
         json += "]"
     }
+    if !request.environment.isEmpty {
+        json += ",\"environment\":["
+        json += request.environment.map(jsonString).joined(separator: ",")
+        json += "]"
+    }
+    if let workingDirectory = request.workingDirectory {
+        json += ",\"workingDirectory\":\(jsonString(workingDirectory))"
+    }
+    if let user = request.user {
+        json += ",\"user\":\(jsonString(user))"
+    }
+    if let cpus = request.cpus {
+        json += ",\"cpus\":\(cpus)"
+    }
+    if let memoryBytes = request.memoryBytes {
+        json += ",\"memoryBytes\":\(memoryBytes)"
+    }
     json += "}"
     json.append("\n")
     return Data(json.utf8)
diff --git a/macOS/GhostTools/Sources/ghost-container/LineReader.swift b/macOS/GhostTools/Sources/ghostbox/LineReader.swift
similarity index 100%
rename from macOS/GhostTools/Sources/ghost-container/LineReader.swift
rename to macOS/GhostTools/Sources/ghostbox/LineReader.swift
diff --git a/macOS/GhostTools/Sources/ghostbox/PortForwarder.swift b/macOS/GhostTools/Sources/ghostbox/PortForwarder.swift
new file mode 100644
index 0000000..3671e2e
--- /dev/null
+++ b/macOS/GhostTools/Sources/ghostbox/PortForwarder.swift
@@ -0,0 +1,232 @@
+import Darwin
+import Foundation
+
+enum PortForwardError: Error, LocalizedError {
+    case invalidAddress(String)
+    case socket(operation: String, code: Int32)
+
+    var errorDescription: String? {
+        switch self {
+        case .invalidAddress(let address):
+            return "invalid IPv4 address \(address)"
+        case .socket(let operation, let code):
+            return "\(operation) failed: errno \(code) (\(String(cString: strerror(code))))"
+        }
+    }
+}
+
+final class PublishedPortForwarder: @unchecked Sendable {
+    private let publication: PublishedPort
+    private let queue: DispatchQueue
+    private let lock = NSLock()
+    private var listenerFD: Int32
+    private var started = false
+    private var relays: [UUID: TCPRelay] = [:]
+
+    init(_ publication: PublishedPort) throws {
+        self.publication = publication
+        self.queue = DispatchQueue(label: "org.ghostvm.ghostbox.publish.\(publication.hostPort)", qos: .userInitiated)
+        self.listenerFD = try Self.openListener(address: publication.hostAddress, port: publication.hostPort)
+    }
+
+    func start(targetAddress: String) {
+        lock.lock()
+        guard !started, listenerFD >= 0 else {
+            lock.unlock()
+            return
+        }
+        started = true
+        lock.unlock()
+
+        queue.async { [self] in
+            acceptConnections(targetAddress: targetAddress)
+        }
+    }
+
+    func stop() {
+        lock.lock()
+        let fd = listenerFD
+        listenerFD = -1
+        let active = Array(relays.values)
+        relays.removeAll()
+        lock.unlock()
+
+        if fd >= 0 {
+            _ = Darwin.shutdown(fd, SHUT_RDWR)
+            Darwin.close(fd)
+        }
+        active.forEach { $0.stop() }
+    }
+
+    deinit {
+        stop()
+    }
+
+    private func acceptConnections(targetAddress: String) {
+        while true {
+            lock.lock()
+            let fd = listenerFD
+            lock.unlock()
+            guard fd >= 0 else { return }
+
+            let clientFD = Darwin.accept(fd, nil, nil)
+            if clientFD < 0 {
+                if errno == EINTR { continue }
+                return
+            }
+            do {
+                let targetFD = try Self.connect(address: targetAddress, port: publication.containerPort)
+                let id = UUID()
+                let relay = TCPRelay(clientFD: clientFD, targetFD: targetFD)
+                lock.lock()
+                relays[id] = relay
+                lock.unlock()
+                relay.start { [weak self] in
+                    self?.removeRelay(id)
+                }
+            } catch {
+                Darwin.close(clientFD)
+                writeStderr("ghostbox: port \(publication.hostPort) forwarding failed: \(error.localizedDescription)\n")
+            }
+        }
+    }
+
+    private func removeRelay(_ id: UUID) {
+        lock.lock()
+        relays.removeValue(forKey: id)
+        lock.unlock()
+    }
+
+    private static func openListener(address: String, port: UInt16) throws -> Int32 {
+        let fd = Darwin.socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
+        guard fd >= 0 else { throw PortForwardError.socket(operation: "socket", code: errno) }
+        do {
+            var enabled: Int32 = 1
+            guard setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &enabled, socklen_t(MemoryLayout.size(ofValue: enabled))) == 0 else {
+                throw PortForwardError.socket(operation: "setsockopt", code: errno)
+            }
+            var socketAddress = try ipv4SocketAddress(address: address, port: port)
+            let bindResult = withUnsafePointer(to: &socketAddress) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    Darwin.bind(fd, $0, socklen_t(MemoryLayout.size))
+                }
+            }
+            guard bindResult == 0 else { throw PortForwardError.socket(operation: "bind", code: errno) }
+            guard Darwin.listen(fd, 128) == 0 else { throw PortForwardError.socket(operation: "listen", code: errno) }
+            return fd
+        } catch {
+            Darwin.close(fd)
+            throw error
+        }
+    }
+
+    private static func connect(address: String, port: UInt16) throws -> Int32 {
+        let fd = Darwin.socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
+        guard fd >= 0 else { throw PortForwardError.socket(operation: "socket", code: errno) }
+        do {
+            var socketAddress = try ipv4SocketAddress(address: address, port: port)
+            let result = withUnsafePointer(to: &socketAddress) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    Darwin.connect(fd, $0, socklen_t(MemoryLayout.size))
+                }
+            }
+            guard result == 0 else { throw PortForwardError.socket(operation: "connect", code: errno) }
+            return fd
+        } catch {
+            Darwin.close(fd)
+            throw error
+        }
+    }
+
+    private static func ipv4SocketAddress(address: String, port: UInt16) throws -> sockaddr_in {
+        var socketAddress = sockaddr_in()
+        socketAddress.sin_len = UInt8(MemoryLayout.size)
+        socketAddress.sin_family = sa_family_t(AF_INET)
+        socketAddress.sin_port = port.bigEndian
+        guard address.withCString({ inet_pton(AF_INET, $0, &socketAddress.sin_addr) }) == 1 else {
+            throw PortForwardError.invalidAddress(address)
+        }
+        return socketAddress
+    }
+}
+
+private final class TCPRelay: @unchecked Sendable {
+    private let clientFD: Int32
+    private let targetFD: Int32
+    private let lock = NSLock()
+    private var remainingPumps = 2
+    private var closed = false
+    private var completion: (@Sendable () -> Void)?
+
+    init(clientFD: Int32, targetFD: Int32) {
+        self.clientFD = clientFD
+        self.targetFD = targetFD
+    }
+
+    func start(completion: @escaping @Sendable () -> Void) {
+        lock.lock()
+        self.completion = completion
+        lock.unlock()
+        DispatchQueue.global(qos: .userInitiated).async { [self] in
+            pump(from: clientFD, to: targetFD)
+        }
+        DispatchQueue.global(qos: .userInitiated).async { [self] in
+            pump(from: targetFD, to: clientFD)
+        }
+    }
+
+    func stop() {
+        _ = Darwin.shutdown(clientFD, SHUT_RDWR)
+        _ = Darwin.shutdown(targetFD, SHUT_RDWR)
+    }
+
+    private func pump(from input: Int32, to output: Int32) {
+        var buffer = [UInt8](repeating: 0, count: 32 * 1024)
+        while true {
+            let count = Darwin.read(input, &buffer, buffer.count)
+            if count > 0 {
+                guard writeAll(fd: output, bytes: buffer, count: count) else { break }
+                continue
+            }
+            if count < 0, errno == EINTR { continue }
+            break
+        }
+        _ = Darwin.shutdown(output, SHUT_WR)
+        finishPump()
+    }
+
+    private func finishPump() {
+        lock.lock()
+        remainingPumps -= 1
+        guard remainingPumps == 0, !closed else {
+            lock.unlock()
+            return
+        }
+        closed = true
+        let completion = self.completion
+        self.completion = nil
+        lock.unlock()
+
+        Darwin.close(clientFD)
+        Darwin.close(targetFD)
+        completion?()
+    }
+
+    private func writeAll(fd: Int32, bytes: [UInt8], count: Int) -> Bool {
+        bytes.withUnsafeBytes { rawBuffer in
+            guard let base = rawBuffer.baseAddress else { return true }
+            var offset = 0
+            while offset < count {
+                let written = Darwin.write(fd, base.advanced(by: offset), count - offset)
+                if written > 0 {
+                    offset += written
+                } else if written < 0, errno == EINTR {
+                    continue
+                } else {
+                    return false
+                }
+            }
+            return true
+        }
+    }
+}
diff --git a/macOS/GhostTools/Sources/ghost-container/Protocol.swift b/macOS/GhostTools/Sources/ghostbox/Protocol.swift
similarity index 86%
rename from macOS/GhostTools/Sources/ghost-container/Protocol.swift
rename to macOS/GhostTools/Sources/ghostbox/Protocol.swift
index 89ff018..5f7b0a6 100644
--- a/macOS/GhostTools/Sources/ghost-container/Protocol.swift
+++ b/macOS/GhostTools/Sources/ghostbox/Protocol.swift
@@ -1,7 +1,7 @@
 import Foundation
 
 /// Wire-protocol version supported by this client.
-let kProtocolVersion: Int = 2
+let kProtocolVersion: Int = 4
 
 /// Default vsock port for the host container bridge.
 let kDefaultVsockPort: UInt32 = 5004
@@ -25,6 +25,11 @@ struct HostContainerRequest: Codable {
     let columns: UInt16?
     let rows: UInt16?
     let volumes: [HostContainerVolume]
+    let environment: [String]
+    let workingDirectory: String?
+    let user: String?
+    let cpus: Int?
+    let memoryBytes: UInt64?
 }
 
 struct HostContainerVolume: Codable, Equatable {
@@ -39,6 +44,11 @@ func makeRunRequest(
     image: String,
     command: [String],
     volumes: [HostContainerVolume] = [],
+    environment: [String] = [],
+    workingDirectory: String? = nil,
+    user: String? = nil,
+    cpus: Int? = nil,
+    memoryBytes: UInt64? = nil,
     interactive: Bool = false,
     tty: Bool = false,
     columns: UInt16? = nil,
@@ -53,7 +63,12 @@ func makeRunRequest(
         tty: tty,
         columns: columns,
         rows: rows,
-        volumes: volumes
+        volumes: volumes,
+        environment: environment,
+        workingDirectory: workingDirectory,
+        user: user,
+        cpus: cpus,
+        memoryBytes: memoryBytes
     )
 }
 
@@ -104,6 +119,7 @@ struct HostContainerResponse: Codable {
     let data: String?
     let exitCode: Int32?
     let message: String?
+    let ipv4Address: String?
 }
 
 /// Discrete decoded response for internal handling.
@@ -112,6 +128,7 @@ struct HostContainerResponse: Codable {
 ///   a wrong/missing version, or was missing a required field. It is never
 ///   decoded as success or silent empty output.
 enum DecodedResponse {
+    case ready(ipv4Address: String)
     case stdout(Data)
     case stderr(Data)
     case exit(Int32)
@@ -123,7 +140,7 @@ enum DecodedResponse {
 ///
 /// Strict rules:
 /// - `version` is **required** and must equal `kProtocolVersion`, otherwise `.protocolError`.
-/// - `type` must be one of `stdout`, `stderr`, `exit`, `error`.
+/// - `type` must be one of `ready`, `stdout`, `stderr`, `exit`, `error`.
 /// - `stdout`/`stderr` require `data` encoded as base64. An empty base64 string is
 ///   valid empty output. Missing or invalid data produces `.protocolError`.
 /// - `exit` **requires** `exitCode`; missing/out-of-range → `.protocolError`.
@@ -140,6 +157,11 @@ func decodeResponse(_ json: Data) -> DecodedResponse {
     }
 
     switch resp.type {
+    case "ready":
+        guard let address = resp.ipv4Address, !address.isEmpty else {
+            return .protocolError("ready response missing container IPv4 address")
+        }
+        return .ready(ipv4Address: address)
     case "stdout":
         return decodeOutputStream(resp.data, kind: "stdout")
     case "stderr":
diff --git a/macOS/GhostTools/Sources/ghost-container/VsockDial.swift b/macOS/GhostTools/Sources/ghostbox/VsockDial.swift
similarity index 100%
rename from macOS/GhostTools/Sources/ghost-container/VsockDial.swift
rename to macOS/GhostTools/Sources/ghostbox/VsockDial.swift
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift b/macOS/GhostTools/Tests/GhostboxTests/ArgsTests.swift
similarity index 69%
rename from macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift
rename to macOS/GhostTools/Tests/GhostboxTests/ArgsTests.swift
index 2dce25e..ef5848d 100644
--- a/macOS/GhostTools/Tests/GhostContainerTests/ArgsTests.swift
+++ b/macOS/GhostTools/Tests/GhostboxTests/ArgsTests.swift
@@ -1,4 +1,4 @@
-@testable import ghost_container
+@testable import ghostbox
 import XCTest
 
 final class ArgsTests: XCTestCase {
@@ -31,34 +31,34 @@ final class ArgsTests: XCTestCase {
     func testRunWithImageOnly() {
         let result = parseArguments(["run", "alpine"])
         guard case .success(let opts) = result,
-              case .run(let image, let command, let volumes, let interactive, let tty) = opts.action else {
+              case .run(let run) = opts.action else {
             return XCTFail("Expected .run, got \(result)")
         }
-        XCTAssertEqual(image, "alpine")
-        XCTAssertEqual(command, [])
-        XCTAssertEqual(volumes, [])
-        XCTAssertFalse(interactive)
-        XCTAssertFalse(tty)
+        XCTAssertEqual(run.image, "alpine")
+        XCTAssertEqual(run.command, [])
+        XCTAssertEqual(run.volumes, [])
+        XCTAssertFalse(run.interactive)
+        XCTAssertFalse(run.tty)
     }
 
     func testRunWithCommand() {
         let result = parseArguments(["run", "alpine", "echo", "hello"])
         guard case .success(let opts) = result,
-              case .run(let image, let command, _, _, _) = opts.action else {
+              case .run(let run) = opts.action else {
             return XCTFail("Expected .run, got \(result)")
         }
-        XCTAssertEqual(image, "alpine")
-        XCTAssertEqual(command, ["echo", "hello"])
+        XCTAssertEqual(run.image, "alpine")
+        XCTAssertEqual(run.command, ["echo", "hello"])
     }
 
     func testCommandMayBeginWithDash() {
         let result = parseArguments(["run", "alpine", "-c", "--flag", "-n"])
         guard case .success(let opts) = result,
-              case .run(let image, let command, _, _, _) = opts.action else {
+              case .run(let run) = opts.action else {
             return XCTFail("Expected .run, got \(result)")
         }
-        XCTAssertEqual(image, "alpine")
-        XCTAssertEqual(command, ["-c", "--flag", "-n"])
+        XCTAssertEqual(run.image, "alpine")
+        XCTAssertEqual(run.command, ["-c", "--flag", "-n"])
     }
 
     func testRejectsFlagBeforeImage() {
@@ -66,7 +66,7 @@ final class ArgsTests: XCTestCase {
         guard case .failure(let err) = result else {
             return XCTFail("Expected failure for flag-before-image, got \(result)")
         }
-        XCTAssertEqual(err.errorDescription, "invalid IMAGE: image name must not start with '-'")
+        XCTAssertEqual(err.errorDescription, "unknown run option '--some-flag'")
     }
 
     func testRejectsUnknownSubcommand() {
@@ -152,10 +152,10 @@ final class ArgsTests: XCTestCase {
         argv.append(contentsOf: (0..<64).map { "c\($0)" })
         let result = parseArguments(argv)
         guard case .success(let opts) = result,
-              case .run(_, let command, _, _, _) = opts.action else {
+              case .run(let run) = opts.action else {
             return XCTFail("Expected .run with 64 command args, got \(result)")
         }
-        XCTAssertEqual(command.count, 64)
+        XCTAssertEqual(run.command.count, 64)
     }
 
     func testRejectsNullInCommandArg() {
@@ -205,29 +205,39 @@ final class ArgsTests: XCTestCase {
     func testParsesReadOnlyVolumeBeforeImage() {
         let result = parseArguments(["run", "-v", "/home/user/src:/src:ro", "alpine", "ls", "/src"])
         guard case .success(let options) = result,
-              case .run(let image, let command, let volumes, _, _) = options.action else {
+              case .run(let run) = options.action else {
             return XCTFail("Expected volume run, got \(result)")
         }
-        XCTAssertEqual(image, "alpine")
-        XCTAssertEqual(command, ["ls", "/src"])
-        XCTAssertEqual(volumes, [HostContainerVolume(guestPath: "/home/user/src", destination: "/src", readOnly: true)])
+        XCTAssertEqual(run.image, "alpine")
+        XCTAssertEqual(run.command, ["ls", "/src"])
+        XCTAssertEqual(run.volumes, [HostContainerVolume(guestPath: "/home/user/src", destination: "/src", readOnly: true)])
     }
 
     func testParsesLongVolumeFlag() {
         let result = parseArguments(["run", "--volume=/data:/mnt/data:ro", "alpine"])
         guard case .success(let options) = result,
-              case .run(_, _, let volumes, _, _) = options.action else {
+              case .run(let run) = options.action else {
             return XCTFail("Expected volume run, got \(result)")
         }
-        XCTAssertEqual(volumes.first?.destination, "/mnt/data")
+        XCTAssertEqual(run.volumes.first?.destination, "/mnt/data")
     }
 
-    func testRejectsImplicitReadWriteVolume() {
+    func testParsesImplicitReadWriteVolume() {
         let result = parseArguments(["run", "-v", "/data:/data", "alpine"])
-        guard case .failure(let error) = result else {
-            return XCTFail("Expected read-write volume rejection")
+        guard case .success(let options) = result,
+              case .run(let run) = options.action else {
+            return XCTFail("Expected read-write volume run")
+        }
+        XCTAssertEqual(run.volumes, [HostContainerVolume(guestPath: "/data", destination: "/data", readOnly: false)])
+    }
+
+    func testParsesExplicitReadWriteVolume() {
+        let result = parseArguments(["run", "-v", "/data:/data:rw", "alpine"])
+        guard case .success(let options) = result,
+              case .run(let run) = options.action else {
+            return XCTFail("Expected read-write volume run")
         }
-        XCTAssertEqual(error.errorDescription, "invalid volume: guest directory mounts are currently read-only; append ':ro'")
+        XCTAssertEqual(run.volumes.first?.readOnly, false)
     }
 
     func testRejectsDuplicateVolumeDestination() {
@@ -249,23 +259,57 @@ final class ArgsTests: XCTestCase {
         for flag in ["-it", "-ti"] {
             let result = parseArguments(["run", flag, "alpine", "/bin/sh"])
             guard case .success(let options) = result,
-                  case .run(_, let command, _, let interactive, let tty) = options.action else {
+                  case .run(let run) = options.action else {
                 return XCTFail("Expected interactive TTY run for \(flag), got \(result)")
             }
-            XCTAssertEqual(command, ["/bin/sh"])
-            XCTAssertTrue(interactive)
-            XCTAssertTrue(tty)
+            XCTAssertEqual(run.command, ["/bin/sh"])
+            XCTAssertTrue(run.interactive)
+            XCTAssertTrue(run.tty)
         }
     }
 
     func testParsesSeparateInteractiveTTYFlagsMixedWithVolume() {
         let result = parseArguments(["run", "-i", "-v", "/data:/data:ro", "-t", "alpine"])
         guard case .success(let options) = result,
-              case .run(_, _, let volumes, let interactive, let tty) = options.action else {
+              case .run(let run) = options.action else {
             return XCTFail("Expected interactive TTY volume run, got \(result)")
         }
-        XCTAssertEqual(volumes.count, 1)
-        XCTAssertTrue(interactive)
-        XCTAssertTrue(tty)
+        XCTAssertEqual(run.volumes.count, 1)
+        XCTAssertTrue(run.interactive)
+        XCTAssertTrue(run.tty)
+    }
+
+    func testParsesCompleteRunConfiguration() {
+        let result = parseArguments([
+            "run", "-p", "127.0.0.1:8080:80", "-e", "MODE=production",
+            "-w", "/app", "-u", "1000:1000", "--cpus", "4", "--memory", "2g", "alpine",
+        ])
+        guard case .success(let options) = result, case .run(let run) = options.action else {
+            return XCTFail("Expected configured run, got \(result)")
+        }
+        XCTAssertEqual(run.publishedPorts, [PublishedPort(hostAddress: "127.0.0.1", hostPort: 8080, containerPort: 80)])
+        XCTAssertEqual(run.environment, ["MODE=production"])
+        XCTAssertEqual(run.workingDirectory, "/app")
+        XCTAssertEqual(run.user, "1000:1000")
+        XCTAssertEqual(run.cpus, 4)
+        XCTAssertEqual(run.memoryBytes, 2 * 1024 * 1024 * 1024)
+    }
+
+    func testPublishDefaultsToGuestLoopbackAndTCP() {
+        XCTAssertEqual(
+            try? parsePublishedPort("8080:80/tcp").get(),
+            PublishedPort(hostAddress: "127.0.0.1", hostPort: 8080, containerPort: 80)
+        )
+    }
+
+    func testRejectsUDPPublish() {
+        guard case .failure(.invalidPublish("only TCP is supported")) = parsePublishedPort("8080:80/udp") else {
+            return XCTFail("Expected UDP rejection")
+        }
+    }
+
+    func testParsesMemoryUnits() {
+        XCTAssertEqual(try? parseMemory("512m").get(), 512 * 1024 * 1024)
+        XCTAssertEqual(try? parseMemory("2GiB").get(), 2 * 1024 * 1024 * 1024)
     }
 }
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift b/macOS/GhostTools/Tests/GhostboxTests/LineReaderTests.swift
similarity index 99%
rename from macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift
rename to macOS/GhostTools/Tests/GhostboxTests/LineReaderTests.swift
index 0bdebad..9c25eba 100644
--- a/macOS/GhostTools/Tests/GhostContainerTests/LineReaderTests.swift
+++ b/macOS/GhostTools/Tests/GhostboxTests/LineReaderTests.swift
@@ -1,4 +1,4 @@
-@testable import ghost_container
+@testable import ghostbox
 import XCTest
 
 final class LineReaderTests: XCTestCase {
diff --git a/macOS/GhostTools/Tests/GhostboxTests/PortForwarderTests.swift b/macOS/GhostTools/Tests/GhostboxTests/PortForwarderTests.swift
new file mode 100644
index 0000000..1a572b3
--- /dev/null
+++ b/macOS/GhostTools/Tests/GhostboxTests/PortForwarderTests.swift
@@ -0,0 +1,100 @@
+@testable import ghostbox
+import Darwin
+import Foundation
+import XCTest
+
+final class PortForwarderTests: XCTestCase {
+    func testForwardsTCPInBothDirections() throws {
+        let (targetListener, targetPort) = try makeListener(port: 0)
+        defer { Darwin.close(targetListener) }
+
+        let (reservation, publishedPort) = try makeListener(port: 0)
+        Darwin.close(reservation)
+        let forwarder = try PublishedPortForwarder(PublishedPort(
+            hostAddress: "127.0.0.1",
+            hostPort: publishedPort,
+            containerPort: targetPort
+        ))
+        defer { forwarder.stop() }
+        forwarder.start(targetAddress: "127.0.0.1")
+
+        let served = expectation(description: "target served relayed request")
+        DispatchQueue.global(qos: .userInitiated).async {
+            let connection = Darwin.accept(targetListener, nil, nil)
+            guard connection >= 0 else {
+                served.fulfill()
+                return
+            }
+            defer { Darwin.close(connection) }
+            var request = [UInt8](repeating: 0, count: 4)
+            if Darwin.read(connection, &request, request.count) == 4, Data(request) == Data("ping".utf8) {
+                _ = writeBytes(fd: connection, Array("pong".utf8))
+            }
+            served.fulfill()
+        }
+
+        let client = try connect(port: publishedPort)
+        defer { Darwin.close(client) }
+        XCTAssertTrue(writeBytes(fd: client, Array("ping".utf8)))
+        var response = [UInt8](repeating: 0, count: 4)
+        XCTAssertEqual(Darwin.read(client, &response, response.count), 4)
+        XCTAssertEqual(Data(response), Data("pong".utf8))
+        wait(for: [served], timeout: 2)
+    }
+
+    private func makeListener(port: UInt16) throws -> (Int32, UInt16) {
+        let fd = Darwin.socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
+        guard fd >= 0 else { throw PortForwardError.socket(operation: "socket", code: errno) }
+        do {
+            var address = sockaddr_in()
+            address.sin_len = UInt8(MemoryLayout.size)
+            address.sin_family = sa_family_t(AF_INET)
+            address.sin_port = port.bigEndian
+            address.sin_addr.s_addr = inet_addr("127.0.0.1")
+            let result = withUnsafePointer(to: &address) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    Darwin.bind(fd, $0, socklen_t(MemoryLayout.size))
+                }
+            }
+            guard result == 0, Darwin.listen(fd, 4) == 0 else {
+                throw PortForwardError.socket(operation: "bind/listen", code: errno)
+            }
+            var bound = sockaddr_in()
+            var length = socklen_t(MemoryLayout.size)
+            let lookup = withUnsafeMutablePointer(to: &bound) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    Darwin.getsockname(fd, $0, &length)
+                }
+            }
+            guard lookup == 0 else { throw PortForwardError.socket(operation: "getsockname", code: errno) }
+            return (fd, UInt16(bigEndian: bound.sin_port))
+        } catch {
+            Darwin.close(fd)
+            throw error
+        }
+    }
+
+    private func connect(port: UInt16) throws -> Int32 {
+        let fd = Darwin.socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)
+        guard fd >= 0 else { throw PortForwardError.socket(operation: "socket", code: errno) }
+        do {
+            var timeout = timeval(tv_sec: 2, tv_usec: 0)
+            _ = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, socklen_t(MemoryLayout.size(ofValue: timeout)))
+            var address = sockaddr_in()
+            address.sin_len = UInt8(MemoryLayout.size)
+            address.sin_family = sa_family_t(AF_INET)
+            address.sin_port = port.bigEndian
+            address.sin_addr.s_addr = inet_addr("127.0.0.1")
+            let result = withUnsafePointer(to: &address) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    Darwin.connect(fd, $0, socklen_t(MemoryLayout.size))
+                }
+            }
+            guard result == 0 else { throw PortForwardError.socket(operation: "connect", code: errno) }
+            return fd
+        } catch {
+            Darwin.close(fd)
+            throw error
+        }
+    }
+}
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift b/macOS/GhostTools/Tests/GhostboxTests/ProtocolTests.swift
similarity index 80%
rename from macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift
rename to macOS/GhostTools/Tests/GhostboxTests/ProtocolTests.swift
index 76a86dd..5a9599d 100644
--- a/macOS/GhostTools/Tests/GhostContainerTests/ProtocolTests.swift
+++ b/macOS/GhostTools/Tests/GhostboxTests/ProtocolTests.swift
@@ -1,4 +1,4 @@
-@testable import ghost_container
+@testable import ghostbox
 import XCTest
 
 final class ProtocolTests: XCTestCase {
@@ -10,7 +10,7 @@ final class ProtocolTests: XCTestCase {
         let line = try encodeRequestLine(req)
         let s = String(data: line, encoding: .utf8)!
 
-        XCTAssertEqual(s, #"{"version":2,"operation":"run","image":"alpine","command":["echo","hello"],"stdin":false,"tty":false}"# + "\n")
+        XCTAssertEqual(s, #"{"version":4,"operation":"run","image":"alpine","command":["echo","hello"],"stdin":false,"tty":false}"# + "\n")
     }
 
     func testRequestWithEmptyCommand() throws {
@@ -18,7 +18,7 @@ final class ProtocolTests: XCTestCase {
         let line = try encodeRequestLine(req)
         let s = String(data: line, encoding: .utf8)!
 
-        XCTAssertEqual(s, #"{"version":2,"operation":"run","image":"ubuntu:24.04","command":[],"stdin":false,"tty":false}"# + "\n")
+        XCTAssertEqual(s, #"{"version":4,"operation":"run","image":"ubuntu:24.04","command":[],"stdin":false,"tty":false}"# + "\n")
     }
 
     func testRequestWithVolume() throws {
@@ -27,7 +27,7 @@ final class ProtocolTests: XCTestCase {
         let line = try encodeRequestLine(request)
         XCTAssertEqual(
             String(data: line, encoding: .utf8),
-            #"{"version":2,"operation":"run","image":"alpine","command":[],"stdin":false,"tty":false,"volumes":[{"guestPath":"/home/user/src","destination":"/src","readOnly":true}]}"# + "\n"
+            #"{"version":4,"operation":"run","image":"alpine","command":[],"stdin":false,"tty":false,"volumes":[{"guestPath":"/home/user/src","destination":"/src","readOnly":true}]}"# + "\n"
         )
     }
 
@@ -42,7 +42,23 @@ final class ProtocolTests: XCTestCase {
         )
         XCTAssertEqual(
             String(data: try encodeRequestLine(request), encoding: .utf8),
-            #"{"version":2,"operation":"run","image":"alpine","command":["/bin/sh"],"stdin":true,"tty":true,"columns":120,"rows":40}"# + "\n"
+            #"{"version":4,"operation":"run","image":"alpine","command":["/bin/sh"],"stdin":true,"tty":true,"columns":120,"rows":40}"# + "\n"
+        )
+    }
+
+    func testConfiguredRunRequestIncludesVersion4Fields() throws {
+        let request = makeRunRequest(
+            image: "alpine",
+            command: [],
+            environment: ["MODE=production"],
+            workingDirectory: "/app",
+            user: "1000:1000",
+            cpus: 4,
+            memoryBytes: 2_147_483_648
+        )
+        XCTAssertEqual(
+            String(data: try encodeRequestLine(request), encoding: .utf8),
+            #"{"version":4,"operation":"run","image":"alpine","command":[],"stdin":false,"tty":false,"environment":["MODE=production"],"workingDirectory":"/app","user":"1000:1000","cpus":4,"memoryBytes":2147483648}"# + "\n"
         )
     }
 
@@ -61,10 +77,18 @@ final class ProtocolTests: XCTestCase {
 
     // MARK: - Response decoding: success cases
 
+    func testDecodeReadyAddress() throws {
+        let json = #"{"version":4,"type":"ready","ipv4Address":"192.168.64.3"}"#.data(using: .utf8)!
+        guard case .ready(let address) = decodeResponse(json) else {
+            return XCTFail("Expected ready response")
+        }
+        XCTAssertEqual(address, "192.168.64.3")
+    }
+
     func testDecodeStdout() throws {
         let payload = "hello world".data(using: .utf8)!
         let b64 = payload.base64EncodedString()
-        let json = #"{"version":2,"type":"stdout","data":"\#(b64)"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stdout","data":"\#(b64)"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .stdout(let data):
@@ -77,7 +101,7 @@ final class ProtocolTests: XCTestCase {
     func testDecodeStderr() throws {
         let payload = "error line".data(using: .utf8)!
         let b64 = payload.base64EncodedString()
-        let json = #"{"version":2,"type":"stderr","data":"\#(b64)"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stderr","data":"\#(b64)"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .stderr(let data):
@@ -88,7 +112,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExit() throws {
-        let json = #"{"version":2,"type":"exit","exitCode":42}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit","exitCode":42}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .exit(let code):
@@ -99,7 +123,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExitZero() throws {
-        let json = #"{"version":2,"type":"exit","exitCode":0}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit","exitCode":0}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .exit(let code):
@@ -110,7 +134,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExit255() throws {
-        let json = #"{"version":2,"type":"exit","exitCode":255}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit","exitCode":255}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .exit(let code):
@@ -121,7 +145,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeError() throws {
-        let json = #"{"version":2,"type":"error","message":"image not found"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"error","message":"image not found"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .error(let message):
@@ -134,7 +158,7 @@ final class ProtocolTests: XCTestCase {
     // MARK: - Response decoding: empty base64 is valid empty output
 
     func testDecodeStdoutEmptyBase64StringYieldsEmpty() throws {
-        let json = #"{"version":2,"type":"stdout","data":""}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stdout","data":""}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .stdout(let data):
@@ -145,7 +169,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeStderrEmptyBase64StringYieldsEmpty() throws {
-        let json = #"{"version":2,"type":"stderr","data":""}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stderr","data":""}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .stderr(let data):
@@ -156,7 +180,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeStdoutMissingDataIsProtocolError() throws {
-        let json = #"{"version":2,"type":"stdout"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stdout"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -169,7 +193,7 @@ final class ProtocolTests: XCTestCase {
     // MARK: - Response decoding: strict protocol errors (never success)
 
     func testDecodeStdoutInvalidBase64IsProtocolError() throws {
-        let json = #"{"version":2,"type":"stdout","data":"!!! not base64"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"stdout","data":"!!! not base64"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -180,7 +204,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExitMissingCodeIsProtocolError() throws {
-        let json = #"{"version":2,"type":"exit"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -191,7 +215,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExitOutOfRangeHighIsProtocolError() throws {
-        let json = #"{"version":2,"type":"exit","exitCode":256}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit","exitCode":256}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -202,7 +226,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeExitNegativeIsProtocolError() throws {
-        let json = #"{"version":2,"type":"exit","exitCode":-1}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"exit","exitCode":-1}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -213,7 +237,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeErrorMissingMessageIsProtocolError() throws {
-        let json = #"{"version":2,"type":"error"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"error"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -224,7 +248,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeErrorEmptyMessageIsProtocolError() throws {
-        let json = #"{"version":2,"type":"error","message":""}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"error","message":""}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
@@ -258,7 +282,7 @@ final class ProtocolTests: XCTestCase {
     }
 
     func testDecodeUnknownTypeIsProtocolError() throws {
-        let json = #"{"version":2,"type":"bogus"}"#.data(using: .utf8)!
+        let json = #"{"version":4,"type":"bogus"}"#.data(using: .utf8)!
 
         switch decodeResponse(json) {
         case .protocolError:
diff --git a/macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift b/macOS/GhostTools/Tests/GhostboxTests/VsockDialTests.swift
similarity index 91%
rename from macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift
rename to macOS/GhostTools/Tests/GhostboxTests/VsockDialTests.swift
index d264e80..d85a5eb 100644
--- a/macOS/GhostTools/Tests/GhostContainerTests/VsockDialTests.swift
+++ b/macOS/GhostTools/Tests/GhostboxTests/VsockDialTests.swift
@@ -1,4 +1,4 @@
-@testable import ghost_container
+@testable import ghostbox
 import XCTest
 
 final class VsockDialTests: XCTestCase {
@@ -6,14 +6,14 @@ final class VsockDialTests: XCTestCase {
     /// The Darwin sockaddr_vm layout must be exactly 12 bytes (no padding/zero
     /// field): svm_len(1) + svm_family(1) + svm_reserved1(2) + svm_port(4) + svm_cid(4).
     func testSockaddrVmSizeIs12Bytes() {
-        XCTAssertEqual(MemoryLayout.size, 12)
-        XCTAssertEqual(MemoryLayout.stride, 12)
+        XCTAssertEqual(MemoryLayout.size, 12)
+        XCTAssertEqual(MemoryLayout.stride, 12)
     }
 
     func testSockaddrVmFieldsInitialized() {
-        let addr = ghost_container.sockaddr_vm(port: 5004, cid: 2)
+        let addr = ghostbox.sockaddr_vm(port: 5004, cid: 2)
         XCTAssertEqual(addr.svm_len, 12)
-        XCTAssertEqual(addr.svm_family, UInt8(ghost_container.AF_VSOCK))
+        XCTAssertEqual(addr.svm_family, UInt8(ghostbox.AF_VSOCK))
         XCTAssertEqual(addr.svm_reserved1, 0)
         XCTAssertEqual(addr.svm_port, 5004)
         XCTAssertEqual(addr.svm_cid, 2)
diff --git a/macOS/GhostVM/Services/ContainerBridgeService.swift b/macOS/GhostVM/Services/ContainerBridgeService.swift
index deae0fa..f164e76 100644
--- a/macOS/GhostVM/Services/ContainerBridgeService.swift
+++ b/macOS/GhostVM/Services/ContainerBridgeService.swift
@@ -261,8 +261,15 @@ final class ContainerBridgeService: @unchecked Sendable {
             let exitCode: Int32 = try await withCheckedThrowingContinuation { continuation in
                 do {
                     try runner.start(
-                        onReady: {
+                        onReady: { ipv4Address in
                             Self.clearSocketReceiveTimeout(fd: connection.fileDescriptor)
+                            if run.protocolVersion >= 4 {
+                                guard let frame = try? ContainerResponse.ready(version: run.protocolVersion, ipv4Address: ipv4Address).encodeLine(),
+                                      writer.writeFrame(frame) else {
+                                    runner.terminate()
+                                    return
+                                }
+                            }
                             let task = Task.detached {
                                 if run.protocolVersion >= 2 {
                                     await Self.relayFramedInput(
diff --git a/macOS/GhostVM/Services/ContainerRunner.swift b/macOS/GhostVM/Services/ContainerRunner.swift
index 640d44b..cad222a 100644
--- a/macOS/GhostVM/Services/ContainerRunner.swift
+++ b/macOS/GhostVM/Services/ContainerRunner.swift
@@ -99,7 +99,7 @@ public final class ContainerRunner: @unchecked Sendable {
     ///     pipes were drained to EOF, so no output is lost to a termination race.
     ///     Exit codes of signal-killed processes are reported as 128+signal.
     public func start(
-        onReady: @escaping () -> Void,
+        onReady: @escaping (String) -> Void,
         onOutput: @escaping (Stream, Data) -> Void,
         onExit: @escaping (Int32) -> Void
     ) throws {
@@ -175,7 +175,7 @@ public final class ContainerRunner: @unchecked Sendable {
     }
 
     private func fetchThenRun(
-        onReady: @escaping () -> Void,
+        onReady: @escaping (String) -> Void,
         onOutput: @escaping (Stream, Data) -> Void,
         onExit: @escaping (Int32) -> Void
     ) {
@@ -237,7 +237,7 @@ public final class ContainerRunner: @unchecked Sendable {
     }
 
     private func launchRuntime(
-        onReady: @escaping () -> Void,
+        onReady: @escaping (String) -> Void,
         onOutput: @escaping (Stream, Data) -> Void,
         onExit: @escaping (Int32) -> Void
     ) {
@@ -292,7 +292,8 @@ public final class ContainerRunner: @unchecked Sendable {
                 stdoutFD: stdoutPipe.fileHandleForWriting.fileDescriptor,
                 stderrFD: stderrPipe.fileHandleForWriting.fileDescriptor,
                 onReady: {
-                    onReady()
+                    let address = lease.ipv4Address.split(separator: "/", maxSplits: 1).first.map(String.init) ?? lease.ipv4Address
+                    onReady(address)
                 },
                 onExit: { status in
                     DispatchQueue.global(qos: .userInitiated).async {
diff --git a/macOS/GhostVMContainerRuntime/RuntimeMain.swift b/macOS/GhostVMContainerRuntime/RuntimeMain.swift
index 6041098..6f47c08 100644
--- a/macOS/GhostVMContainerRuntime/RuntimeMain.swift
+++ b/macOS/GhostVMContainerRuntime/RuntimeMain.swift
@@ -29,6 +29,11 @@ private struct RuntimeOptions {
     let terminalColumns: UInt16
     let terminalRows: UInt16
     let mounts: [Mount]
+    let environment: [String]
+    let workingDirectory: String?
+    let user: String?
+    let cpus: Int
+    let memoryBytes: UInt64
     let command: [String]
 
     static func parse(_ arguments: [String]) throws -> RuntimeOptions {
@@ -46,6 +51,11 @@ private struct RuntimeOptions {
         var terminalColumns: UInt16 = 80
         var terminalRows: UInt16 = 24
         var mounts: [Mount] = []
+        var environment: [String] = []
+        var workingDirectory: String?
+        var user: String?
+        var cpus = 2
+        var memoryBytes: UInt64 = 1024 * 1024 * 1024
         var command: [String] = []
         var index = 1
         while index < arguments.count {
@@ -115,6 +125,15 @@ private struct RuntimeOptions {
             case "--id": id = value
             case "--image": image = value
             case "--network-id": networkIdentifier = value
+            case "--env": environment.append(value)
+            case "--workdir": workingDirectory = value
+            case "--user": user = value
+            case "--cpus":
+                guard let parsed = Int(value), parsed > 0 else { throw RuntimeError.usage }
+                cpus = parsed
+            case "--memory-bytes":
+                guard let parsed = UInt64(value), parsed > 0 else { throw RuntimeError.usage }
+                memoryBytes = parsed
             default: throw RuntimeError.usage
             }
             index += 2
@@ -134,6 +153,11 @@ private struct RuntimeOptions {
             terminalColumns: terminalColumns,
             terminalRows: terminalRows,
             mounts: mounts,
+            environment: environment,
+            workingDirectory: workingDirectory,
+            user: user,
+            cpus: cpus,
+            memoryBytes: memoryBytes,
             command: command
         )
     }
@@ -147,7 +171,7 @@ private enum RuntimeError: Error, LocalizedError {
     var errorDescription: String? {
         switch self {
         case .usage:
-            return "usage: ghostvm-container-runtime run [-i|--interactive] [-t|--tty] [--tty-size COLUMNS ROWS] --root PATH --kernel PATH --id ID --image IMAGE [--network-id ID] [--mount HOST_PATH CONTAINER_PATH ro|rw] [-- COMMAND...]"
+            return "usage: ghostvm-container-runtime run [-i|--interactive] [-t|--tty] [--tty-size COLUMNS ROWS] [--env NAME=VALUE] [--workdir PATH] [--user USER] [--cpus COUNT] [--memory-bytes BYTES] --root PATH --kernel PATH --id ID --image IMAGE [--network-id ID] [--mount HOST_PATH CONTAINER_PATH ro|rw] [-- COMMAND...]"
         case .kernelNotFound(let path):
             return "container kernel not found at \(path); the image fetch helper must prepare runtime assets first"
         case .invalidMount(let source, let destination, let mode):
@@ -379,8 +403,8 @@ private final class RunContext: @unchecked Sendable {
     }
 
     private func configureContainer(_ configuration: inout LinuxContainer.Configuration) throws {
-        configuration.cpus = 2
-        configuration.memoryInBytes = 1024 * 1024 * 1024
+        configuration.cpus = options.cpus
+        configuration.memoryInBytes = options.memoryBytes
         configuration.interfaces = [
             VmnetNetwork.Interface(
                 reference: networkReference,
@@ -394,6 +418,12 @@ private final class RunContext: @unchecked Sendable {
         if !options.command.isEmpty {
             configuration.process.arguments = options.command
         }
+        if let workingDirectory = options.workingDirectory {
+            configuration.process.workingDirectory = workingDirectory
+        }
+        if let user = options.user {
+            configuration.process.user = ContainerizationOCI.User(username: user)
+        }
         for mount in options.mounts {
             configuration.mounts.append(
                 Containerization.Mount.share(
@@ -411,6 +441,12 @@ private final class RunContext: @unchecked Sendable {
             configuration.process.environmentVariables.removeAll { $0.hasPrefix("TERM=") }
             configuration.process.environmentVariables.append("TERM=xterm-256color")
         }
+        for assignment in options.environment {
+            let separator = assignment.firstIndex(of: "=")!
+            let prefix = assignment[...separator]
+            configuration.process.environmentVariables.removeAll { $0.hasPrefix(prefix) }
+            configuration.process.environmentVariables.append(assignment)
+        }
         configuration.process.stdout = FileWriter(stdoutHandle)
         configuration.process.stderr = options.tty ? nil : FileWriter(stderrHandle)
     }
diff --git a/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift b/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift
index 986152c..65e2efa 100644
--- a/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift
+++ b/macOS/GhostVMKit/Containers/ContainerBridgeProtocol.swift
@@ -11,7 +11,8 @@ public enum ContainerBridgeConstants {
     public static let port: UInt32 = 5004
 
     /// Wire protocol version. Version 2 adds framed stdin and TTY resize events.
-    public static let protocolVersion = 2
+    /// Version 4 adds run configuration and container network metadata.
+    public static let protocolVersion = 4
     public static let minimumProtocolVersion = 1
 
     /// Maximum accepted size of a single request line in bytes (before the newline).
@@ -34,6 +35,11 @@ public struct ContainerRunRequest: Codable, Equatable, Sendable {
     public var columns: UInt16?
     public var rows: UInt16?
     public var volumes: [ContainerRunVolume]?
+    public var environment: [String]?
+    public var workingDirectory: String?
+    public var user: String?
+    public var cpus: Int?
+    public var memoryBytes: UInt64?
 
     public init(
         version: Int,
@@ -44,7 +50,12 @@ public struct ContainerRunRequest: Codable, Equatable, Sendable {
         tty: Bool? = nil,
         columns: UInt16? = nil,
         rows: UInt16? = nil,
-        volumes: [ContainerRunVolume]? = nil
+        volumes: [ContainerRunVolume]? = nil,
+        environment: [String]? = nil,
+        workingDirectory: String? = nil,
+        user: String? = nil,
+        cpus: Int? = nil,
+        memoryBytes: UInt64? = nil
     ) {
         self.version = version
         self.operation = operation
@@ -55,6 +66,11 @@ public struct ContainerRunRequest: Codable, Equatable, Sendable {
         self.columns = columns
         self.rows = rows
         self.volumes = volumes
+        self.environment = environment
+        self.workingDirectory = workingDirectory
+        self.user = user
+        self.cpus = cpus
+        self.memoryBytes = memoryBytes
     }
 
     /// Decodes one request line (without the trailing newline).
@@ -133,6 +149,7 @@ public struct ContainerRunVolume: Codable, Equatable, Sendable {
 }
 
 public enum ContainerResponseType: String, Codable, Sendable {
+    case ready
     case stdout
     case stderr
     case exit
@@ -150,19 +167,25 @@ public struct ContainerResponse: Codable, Equatable, Sendable {
     public var data: String?
     public var exitCode: Int32?
     public var message: String?
+    public var ipv4Address: String?
 
-    public init(version: Int = ContainerBridgeConstants.protocolVersion, type: ContainerResponseType, data: String? = nil, exitCode: Int32? = nil, message: String? = nil) {
+    public init(version: Int = ContainerBridgeConstants.protocolVersion, type: ContainerResponseType, data: String? = nil, exitCode: Int32? = nil, message: String? = nil, ipv4Address: String? = nil) {
         self.version = version
         self.type = type
         self.data = data
         self.exitCode = exitCode
         self.message = message
+        self.ipv4Address = ipv4Address
     }
 
     public static func stdout(_ chunk: Data, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
         ContainerResponse(version: version, type: .stdout, data: chunk.base64EncodedString())
     }
 
+    public static func ready(version: Int = ContainerBridgeConstants.protocolVersion, ipv4Address: String? = nil) -> ContainerResponse {
+        ContainerResponse(version: version, type: .ready, ipv4Address: ipv4Address)
+    }
+
     public static func stderr(_ chunk: Data, version: Int = ContainerBridgeConstants.protocolVersion) -> ContainerResponse {
         ContainerResponse(version: version, type: .stderr, data: chunk.base64EncodedString())
     }
diff --git a/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift b/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
index 48eacd9..15ecba1 100644
--- a/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
+++ b/macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
@@ -10,6 +10,11 @@ public struct ValidatedContainerRun: Equatable, Sendable {
     public let terminalRows: UInt16
     public let protocolVersion: Int
     public let volumes: [ContainerRunVolume]
+    public let environment: [String]
+    public let workingDirectory: String?
+    public let user: String?
+    public let cpus: Int
+    public let memoryBytes: UInt64
 
     public init(
         image: String,
@@ -19,7 +24,12 @@ public struct ValidatedContainerRun: Equatable, Sendable {
         terminalColumns: UInt16 = 80,
         terminalRows: UInt16 = 24,
         protocolVersion: Int = ContainerBridgeConstants.protocolVersion,
-        volumes: [ContainerRunVolume] = []
+        volumes: [ContainerRunVolume] = [],
+        environment: [String] = [],
+        workingDirectory: String? = nil,
+        user: String? = nil,
+        cpus: Int = ContainerRunPolicy.defaultCPUs,
+        memoryBytes: UInt64 = ContainerRunPolicy.defaultMemoryBytes
     ) {
         self.image = image
         self.command = command
@@ -29,6 +39,11 @@ public struct ValidatedContainerRun: Equatable, Sendable {
         self.terminalRows = terminalRows
         self.protocolVersion = protocolVersion
         self.volumes = volumes
+        self.environment = environment
+        self.workingDirectory = workingDirectory
+        self.user = user
+        self.cpus = cpus
+        self.memoryBytes = memoryBytes
     }
 
     /// Arguments for the helper-scoped Containerization runtime service.
@@ -39,7 +54,14 @@ public struct ValidatedContainerRun: Equatable, Sendable {
         if allocateTTY {
             terminalArguments += ["-t", "--tty-size", String(terminalColumns), String(terminalRows)]
         }
-        return ["run"] + terminalArguments + ["--id", name, "--image", image, "--"] + command
+        var arguments = ["run"] + terminalArguments
+        for assignment in environment {
+            arguments += ["--env", assignment]
+        }
+        if let workingDirectory { arguments += ["--workdir", workingDirectory] }
+        if let user { arguments += ["--user", user] }
+        arguments += ["--cpus", String(cpus), "--memory-bytes", String(memoryBytes)]
+        return arguments + ["--id", name, "--image", image, "--"] + command
     }
 }
 
@@ -59,9 +81,18 @@ public enum ContainerPolicyError: Error, LocalizedError, Equatable {
     case invalidVolumeDestination
     case volumePathTooLong(max: Int)
     case duplicateVolumeDestination(String)
-    case readWriteGuestVolumesUnsupported
     case ttyRequiresProtocolVersion2
     case invalidTerminalSize
+    case runOptionsRequireProtocolVersion4
+    case tooManyEnvironmentVariables(max: Int)
+    case invalidEnvironment
+    case environmentAssignmentTooLong(max: Int)
+    case invalidWorkingDirectory
+    case workingDirectoryTooLong(max: Int)
+    case invalidUser
+    case userTooLong(max: Int)
+    case invalidCPUs(min: Int, max: Int)
+    case invalidMemory(min: UInt64, max: UInt64)
 
     public var errorDescription: String? {
         switch self {
@@ -95,12 +126,30 @@ public enum ContainerPolicyError: Error, LocalizedError, Equatable {
             return "Volume paths must not exceed \(max) bytes."
         case .duplicateVolumeDestination(let path):
             return "Duplicate volume destination '\(path)'."
-        case .readWriteGuestVolumesUnsupported:
-            return "Guest directory mounts are currently read-only."
         case .ttyRequiresProtocolVersion2:
             return "TTY mode requires container bridge protocol version 2."
         case .invalidTerminalSize:
             return "Terminal columns and rows must both be greater than zero."
+        case .runOptionsRequireProtocolVersion4:
+            return "Environment, workdir, user, CPU, and memory options require container bridge protocol version 4."
+        case .tooManyEnvironmentVariables(let max):
+            return "Request has too many environment variables (max \(max))."
+        case .invalidEnvironment:
+            return "Environment entries must use NAME=VALUE with a valid POSIX name and no NUL bytes."
+        case .environmentAssignmentTooLong(let max):
+            return "Environment assignment exceeds the \(max)-byte limit."
+        case .invalidWorkingDirectory:
+            return "Working directory must be an absolute path with no NUL bytes."
+        case .workingDirectoryTooLong(let max):
+            return "Working directory exceeds the \(max)-byte limit."
+        case .invalidUser:
+            return "User must be NAME, UID, NAME:GID, or UID:GID with no whitespace or NUL bytes."
+        case .userTooLong(let max):
+            return "User exceeds the \(max)-byte limit."
+        case .invalidCPUs(let min, let max):
+            return "CPU count must be between \(min) and \(max)."
+        case .invalidMemory(let min, let max):
+            return "Memory must be between \(min) and \(max) bytes."
         }
     }
 }
@@ -117,6 +166,16 @@ public enum ContainerRunPolicy {
     public static let maxContainerNameLength = 63
     public static let maxVolumeCount = 32
     public static let maxVolumePathLength = 4096
+    public static let maxEnvironmentCount = 256
+    public static let maxEnvironmentAssignmentLength = 32 * 1024
+    public static let maxWorkingDirectoryLength = 4096
+    public static let maxUserLength = 256
+    public static let minimumCPUs = 1
+    public static let maximumCPUs = 64
+    public static let defaultCPUs = 2
+    public static let minimumMemoryBytes: UInt64 = 128 * 1024 * 1024
+    public static let maximumMemoryBytes: UInt64 = 1024 * 1024 * 1024 * 1024
+    public static let defaultMemoryBytes: UInt64 = 1024 * 1024 * 1024
 
     public static func validate(_ request: ContainerRunRequest) throws -> ValidatedContainerRun {
         guard (ContainerBridgeConstants.minimumProtocolVersion...ContainerBridgeConstants.protocolVersion).contains(request.version) else {
@@ -170,9 +229,6 @@ public enum ContainerRunPolicy {
             guard destinations.insert(volume.destination).inserted else {
                 throw ContainerPolicyError.duplicateVolumeDestination(volume.destination)
             }
-            guard volume.readOnly else {
-                throw ContainerPolicyError.readWriteGuestVolumesUnsupported
-            }
         }
 
         let allocateTTY = request.tty == true
@@ -185,6 +241,58 @@ public enum ContainerRunPolicy {
             throw ContainerPolicyError.invalidTerminalSize
         }
 
+        let hasVersion4Options = request.environment != nil || request.workingDirectory != nil || request.user != nil || request.cpus != nil || request.memoryBytes != nil
+        guard !hasVersion4Options || request.version >= 4 else {
+            throw ContainerPolicyError.runOptionsRequireProtocolVersion4
+        }
+
+        let environment = request.environment ?? []
+        guard environment.count <= maxEnvironmentCount else {
+            throw ContainerPolicyError.tooManyEnvironmentVariables(max: maxEnvironmentCount)
+        }
+        for assignment in environment {
+            guard assignment.utf8.count <= maxEnvironmentAssignmentLength else {
+                throw ContainerPolicyError.environmentAssignmentTooLong(max: maxEnvironmentAssignmentLength)
+            }
+            guard let separator = assignment.firstIndex(of: "="),
+                  isEnvironmentName(String(assignment[.. Bool {
         CharacterSet.whitespacesAndNewlines.contains(scalar) || CharacterSet.controlCharacters.contains(scalar)
     }
+
+    private static func isEnvironmentName(_ name: String) -> Bool {
+        guard let first = name.utf8.first,
+              first == 95 || (65...90).contains(first) || (97...122).contains(first) else {
+            return false
+        }
+        return name.utf8.dropFirst().allSatisfy {
+            $0 == 95 || (48...57).contains($0) || (65...90).contains($0) || (97...122).contains($0)
+        }
+    }
 }
diff --git a/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift b/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift
index 1e052ae..741ce28 100644
--- a/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift
+++ b/macOS/GhostVMTests/ContainerBridgeProtocolTests.swift
@@ -121,6 +121,16 @@ final class ContainerBridgeProtocolTests: XCTestCase {
         XCTAssertEqual(request.rows, 40)
     }
 
+    func testDecodeVersion4RunConfiguration() throws {
+        let line = Data(#"{"version":4,"operation":"run","image":"alpine","command":[],"environment":["MODE=production"],"workingDirectory":"/app","user":"1000:1000","cpus":4,"memoryBytes":2147483648}"#.utf8)
+        let request = try ContainerRunRequest.decode(line: line)
+        XCTAssertEqual(request.environment, ["MODE=production"])
+        XCTAssertEqual(request.workingDirectory, "/app")
+        XCTAssertEqual(request.user, "1000:1000")
+        XCTAssertEqual(request.cpus, 4)
+        XCTAssertEqual(request.memoryBytes, 2_147_483_648)
+    }
+
     func testInputFrameRoundTrip() throws {
         let frame = ContainerInputFrame.resize(columns: 132, rows: 43)
         let line = try frame.encodeLine()
@@ -184,7 +194,7 @@ final class ContainerBridgeProtocolTests: XCTestCase {
     func testStdoutResponseShape() throws {
         let payload = Data([0x00, 0xFF, 0x61]) // binary-safe via base64
         let json = try jsonObject(for: .stdout(payload))
-        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["version"] as? Int, 4)
         XCTAssertEqual(json["type"] as? String, "stdout")
         XCTAssertEqual(json["data"] as? String, payload.base64EncodedString())
         XCTAssertNil(json["exitCode"])
@@ -200,7 +210,7 @@ final class ContainerBridgeProtocolTests: XCTestCase {
 
     func testExitResponseShape() throws {
         let json = try jsonObject(for: .exit(137))
-        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["version"] as? Int, 4)
         XCTAssertEqual(json["type"] as? String, "exit")
         XCTAssertEqual(json["exitCode"] as? Int32, 137)
         XCTAssertNil(json["data"])
@@ -209,13 +219,20 @@ final class ContainerBridgeProtocolTests: XCTestCase {
 
     func testErrorResponseShape() throws {
         let json = try jsonObject(for: .error("something failed"))
-        XCTAssertEqual(json["version"] as? Int, 2)
+        XCTAssertEqual(json["version"] as? Int, 4)
         XCTAssertEqual(json["type"] as? String, "error")
         XCTAssertEqual(json["message"] as? String, "something failed")
         XCTAssertNil(json["data"])
         XCTAssertNil(json["exitCode"])
     }
 
+    func testRunReadyResponseIncludesContainerAddress() throws {
+        let json = try jsonObject(for: .ready(ipv4Address: "192.168.64.3"))
+        XCTAssertEqual(json["version"] as? Int, 4)
+        XCTAssertEqual(json["type"] as? String, "ready")
+        XCTAssertEqual(json["ipv4Address"] as? String, "192.168.64.3")
+    }
+
     func testResponseRoundTrip() throws {
         let response = ContainerResponse.exit(0)
         let line = try response.encodeLine()
@@ -227,7 +244,7 @@ final class ContainerBridgeProtocolTests: XCTestCase {
 
     func testConstants() {
         XCTAssertEqual(ContainerBridgeConstants.port, 5004)
-        XCTAssertEqual(ContainerBridgeConstants.protocolVersion, 2)
+        XCTAssertEqual(ContainerBridgeConstants.protocolVersion, 4)
         XCTAssertEqual(ContainerBridgeConstants.minimumProtocolVersion, 1)
         XCTAssertEqual(ContainerBridgeConstants.maxRequestLineBytes, 64 * 1024)
     }
diff --git a/macOS/GhostVMTests/ContainerRunPolicyTests.swift b/macOS/GhostVMTests/ContainerRunPolicyTests.swift
index ec00389..cdeaef8 100644
--- a/macOS/GhostVMTests/ContainerRunPolicyTests.swift
+++ b/macOS/GhostVMTests/ContainerRunPolicyTests.swift
@@ -12,7 +12,12 @@ final class ContainerRunPolicyTests: XCTestCase {
         tty: Bool? = nil,
         columns: UInt16? = nil,
         rows: UInt16? = nil,
-        volumes: [ContainerRunVolume]? = nil
+        volumes: [ContainerRunVolume]? = nil,
+        environment: [String]? = nil,
+        workingDirectory: String? = nil,
+        user: String? = nil,
+        cpus: Int? = nil,
+        memoryBytes: UInt64? = nil
     ) -> ContainerRunRequest {
         ContainerRunRequest(
             version: version,
@@ -23,7 +28,12 @@ final class ContainerRunPolicyTests: XCTestCase {
             tty: tty,
             columns: columns,
             rows: rows,
-            volumes: volumes
+            volumes: volumes,
+            environment: environment,
+            workingDirectory: workingDirectory,
+            user: user,
+            cpus: cpus,
+            memoryBytes: memoryBytes
         )
     }
 
@@ -57,7 +67,7 @@ final class ContainerRunPolicyTests: XCTestCase {
         XCTAssertTrue(run.attachStdin)
         XCTAssertEqual(
             run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234"),
-            ["run", "-i", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "cat"]
+            ["run", "-i", "--cpus", "2", "--memory-bytes", "1073741824", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "cat"]
         )
     }
 
@@ -76,7 +86,7 @@ final class ContainerRunPolicyTests: XCTestCase {
         XCTAssertEqual(run.terminalRows, 40)
         XCTAssertEqual(
             run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234"),
-            ["run", "-i", "-t", "--tty-size", "120", "40", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "/bin/sh"]
+            ["run", "-i", "-t", "--tty-size", "120", "40", "--cpus", "2", "--memory-bytes", "1073741824", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "/bin/sh"]
         )
     }
 
@@ -91,6 +101,26 @@ final class ContainerRunPolicyTests: XCTestCase {
         XCTAssertEqual(run.volumes, [volume])
     }
 
+    func testVersion4RunConfigurationPasses() throws {
+        let run = try ContainerRunPolicy.validate(request(
+            version: 4,
+            environment: ["MODE=production"],
+            workingDirectory: "/app",
+            user: "1000:1000",
+            cpus: 4,
+            memoryBytes: 2 * 1024 * 1024 * 1024
+        ))
+        XCTAssertEqual(run.environment, ["MODE=production"])
+        XCTAssertEqual(run.workingDirectory, "/app")
+        XCTAssertEqual(run.user, "1000:1000")
+        XCTAssertEqual(run.cpus, 4)
+        XCTAssertEqual(run.memoryBytes, 2 * 1024 * 1024 * 1024)
+        XCTAssertEqual(
+            run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234"),
+            ["run", "--env", "MODE=production", "--workdir", "/app", "--user", "1000:1000", "--cpus", "4", "--memory-bytes", "2147483648", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "echo", "hello"]
+        )
+    }
+
     /// `container run` parses post-image arguments with captureForPassthrough,
     /// so command elements starting with '-' reach the container verbatim.
     func testCommandArgumentsStartingWithDashAreAllowed() throws {
@@ -107,7 +137,7 @@ final class ContainerRunPolicyTests: XCTestCase {
     // MARK: - Rejected requests
 
     func testRejectsUnsupportedVersion() {
-        assertRejected(request(version: 3), expected: .unsupportedVersion(found: 3))
+        assertRejected(request(version: 5), expected: .unsupportedVersion(found: 5))
     }
 
     func testRejectsTTYOnVersion1() {
@@ -121,6 +151,24 @@ final class ContainerRunPolicyTests: XCTestCase {
         )
     }
 
+    func testRejectsVersion4OptionsOnOlderProtocol() {
+        assertRejected(
+            request(version: 3, environment: ["MODE=production"]),
+            expected: .runOptionsRequireProtocolVersion4
+        )
+    }
+
+    func testRejectsInvalidRunConfiguration() {
+        assertRejected(request(version: 4, environment: ["BAD-NAME=value"]), expected: .invalidEnvironment)
+        assertRejected(request(version: 4, workingDirectory: "relative"), expected: .invalidWorkingDirectory)
+        assertRejected(request(version: 4, user: "bad user"), expected: .invalidUser)
+        assertRejected(request(version: 4, cpus: 0), expected: .invalidCPUs(min: 1, max: 64))
+        assertRejected(
+            request(version: 4, memoryBytes: 64 * 1024 * 1024),
+            expected: .invalidMemory(min: ContainerRunPolicy.minimumMemoryBytes, max: ContainerRunPolicy.maximumMemoryBytes)
+        )
+    }
+
     func testRejectsUnsupportedOperation() {
         assertRejected(request(operation: "exec"), expected: .unsupportedOperation(found: "exec"))
     }
@@ -168,9 +216,10 @@ final class ContainerRunPolicyTests: XCTestCase {
         assertRejected(request(command: ["echo", "a\0b"]), expected: .commandArgumentContainsNUL)
     }
 
-    func testRejectsReadWriteVolume() {
+    func testAcceptsReadWriteVolume() throws {
         let volume = ContainerRunVolume(guestPath: "/data", destination: "/data", readOnly: false)
-        assertRejected(request(volumes: [volume]), expected: .readWriteGuestVolumesUnsupported)
+        let run = try ContainerRunPolicy.validate(request(volumes: [volume]))
+        XCTAssertEqual(run.volumes, [volume])
     }
 
     func testRejectsDuplicateVolumeDestination() {
@@ -191,13 +240,14 @@ final class ContainerRunPolicyTests: XCTestCase {
     func testContainerArguments() throws {
         let run = try ContainerRunPolicy.validate(request(image: "alpine", command: ["echo", "hello"]))
         let argv = run.containerArguments(vmHash: "12345", uniqueSuffix: "abcd1234")
-        XCTAssertEqual(argv, ["run", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "echo", "hello"])
+        XCTAssertEqual(argv, ["run", "--cpus", "2", "--memory-bytes", "1073741824", "--id", "gv-12345-abcd1234", "--image", "alpine", "--", "echo", "hello"])
     }
 
     func testContainerArgumentsSanitizesNameComponents() throws {
         let run = try ContainerRunPolicy.validate(request(image: "alpine", command: []))
         let argv = run.containerArguments(vmHash: "Weird Hash!", uniqueSuffix: "ABCD1234")
-        XCTAssertEqual(argv[2], "gv-weird-hash--abcd1234")
+        let idIndex = try XCTUnwrap(argv.firstIndex(of: "--id"))
+        XCTAssertEqual(argv[idIndex + 1], "gv-weird-hash--abcd1234")
         // Executable path is never part of argv; the runner supplies it.
         XCTAssertFalse(argv.contains("ghostvm-container-runtime"))
     }
@@ -208,7 +258,8 @@ final class ContainerRunPolicyTests: XCTestCase {
             vmHash: String(repeating: "h", count: 64),
             uniqueSuffix: String(repeating: "s", count: 32)
         )
-        let name = argv[2]
+        let idIndex = try XCTUnwrap(argv.firstIndex(of: "--id"))
+        let name = argv[idIndex + 1]
         XCTAssertLessThanOrEqual(name.count, ContainerRunPolicy.maxContainerNameLength)
         XCTAssertEqual(ContainerRunPolicy.maxContainerNameLength, 63)
         XCTAssertTrue(name.hasPrefix("gv-"))

From d81882689c8c41f7da1688133c7da9fb8e9adb36 Mon Sep 17 00:00:00 2001
From: Jacob Groundwater 
Date: Fri, 7 Aug 2026 23:04:07 -0700
Subject: [PATCH 18/18] Add Ghostbox direct runtime and GhostFile tooling

---
 .env.example                                  |    12 +-
 CONTAINER_RUNTIME_PROTOCOL.md                 |    61 +-
 GHOSTBOX_CLI_COMMANDS.json                    | 11839 ++++++++++++++++
 GHOSTBOX_CLI_TEMPLATE.md                      |   968 ++
 GHOSTBOX_CR_CLI_TEMPLATE.md                   |   131 +
 GHOSTFILE_BENCHMARKS.md                       |    36 +
 Makefile                                      |   139 +-
 .../Sources/GhostHTTP/GhostHTTP.swift         |     4 +
 RUNTIME_FOUNDATIONS.md                        |     3 +-
 docs/GHOSTFILE_RELEASE.md                     |   112 +
 docs/ghostbox-api/README.md                   |    41 +
 docs/ghostbox-api/boot-and-mounts.md          |    88 +
 .../container-memory-and-labels.md            |    37 +
 .../container-parser-utilities.md             |    23 +
 docs/ghostbox-api/container-volumes.md        |    22 +
 .../containers-managers-and-processes.md      |    93 +
 docs/ghostbox-api/images-and-content.md       |    99 +
 .../networking-and-host-configuration.md      |   100 +
 docs/ghostbox-api/pods.md                     |    89 +
 docs/ghostbox-api/process-configuration.md    |    71 +
 docs/ghostbox-api/virtual-machines.md         |    48 +
 docs/ghostbox-volumes.md                      |    43 +
 examples/ghostbox/README.md                   |    97 +
 examples/ghostbox/ephemeral-container.sh      |    74 +
 examples/ghostbox/ephemeral-terminal.sh       |    87 +
 examples/ghostbox/persistent-volume.sh        |    66 +
 examples/ghostbox/setup-manager.sh            |    14 +
 macOS/GhostFile/DMG_README.txt                |    12 +
 .../GhostFile.icon/Assets/GhostFile.png       |   Bin 0 -> 1851701 bytes
 macOS/GhostFile/GhostFile.icon/icon.json      |    38 +
 macOS/GhostFile/GhostFileApp.swift            |    42 +-
 macOS/GhostFile/GhostFileContentView.swift    |  2318 ++-
 macOS/GhostFile/GhostFileDiscovery.swift      |    64 +-
 macOS/GhostFile/GhostFileMountManager.swift   |   579 +-
 .../GhostFile/GhostFileShareController.swift  |   558 +-
 macOS/GhostFile/GhostFileShareRouter.swift    |   322 -
 macOS/GhostFile/Info.plist                    |     4 +-
 macOS/GhostFileFS/FileSystemExtension.swift   |     1 +
 macOS/GhostFileFS/GhostFileItem.swift         |    27 -
 macOS/GhostFileFS/Info.plist                  |     4 +-
 .../GhostFileHTTP3.swift                      |    67 +-
 .../GhostFileHTTP3ShareServer.swift           |   308 +-
 .../GhostFileHTTPClient.swift                 |   434 +-
 macOS/GhostFileKit/GhostFileItem.swift        |    42 +
 macOS/GhostFileKit/GhostFileProtocol.swift    |   401 +
 macOS/GhostFileKit/GhostFileProvider.swift    |   111 +
 macOS/GhostFileKit/GhostFileShareRouter.swift |   419 +
 .../GhostFileSystem.swift                     |    21 +-
 .../GhostFileTLSIdentity.swift                |    49 +-
 .../GhostFileVolume.swift                     |   150 +-
 macOS/GhostFileKit/LocalFolderProvider.swift  |   187 +
 macOS/GhostFileShared/GhostFileProtocol.swift |   176 -
 .../GhostFileProtocolTests.swift              |   691 +-
 .../GhostFileQUICIntegrationTests.swift       |   367 +-
 macOS/GhostTools/Package.swift                |     2 +-
 macOS/GhostTools/README.txt                   |   110 +-
 .../Sources/GhostTools/Server/Router.swift    |   294 +-
 macOS/GhostTools/Sources/ghostbox/Args.swift  |   832 +-
 .../Sources/ghostbox/Attachment.swift         |   392 +
 .../Sources/ghostbox/DirectCommand.swift      |   301 +
 .../Sources/ghostbox/DirectProtocol.swift     |   493 +
 .../GhostboxCommandCatalog.generated.swift    |  8638 +++++++++++
 .../GhostboxCommandFixtures.generated.swift   |   292 +
 .../Sources/ghostbox/GhostboxCLI.swift        |   647 +-
 macOS/GhostTools/Sources/ghostbox/Help.swift  |   545 +
 .../Sources/ghostbox/LineReader.swift         |    12 +-
 .../Sources/ghostbox/PortForwarder.swift      |   582 +-
 .../Sources/ghostbox/Protocol.swift           |   201 -
 .../Sources/ghostbox/Transport.swift          |     6 +
 .../GuestFilesystemRouterTests.swift          |   115 +-
 .../Tests/GhostboxTests/ArgsTests.swift       |   549 +-
 .../AttachmentTerminalTests.swift             |    45 +
 .../GhostboxTests/CommandCatalogTests.swift   |   306 +
 .../GhostboxForwardSignalProcessTests.swift   |   143 +
 .../Tests/GhostboxTests/LineReaderTests.swift |    39 +
 .../PortForwarderFableAdversarialTests.swift  |   224 +
 .../PortForwarderNodeScenarioTests.swift      |   618 +
 .../GhostboxTests/PortForwarderTests.swift    |   438 +-
 .../Tests/GhostboxTests/ProtocolTests.swift   |   478 +-
 .../Tests/GhostboxTests/VsockDialTests.swift  |    32 -
 .../Services/ContainerBridgeService.swift     |   549 +-
 macOS/GhostVM/Services/ContainerRunner.swift  |   407 -
 .../Services/ContainerRuntimeXPCClient.swift  |   169 +-
 macOS/GhostVM/Services/GhostClient.swift      |   131 +-
 .../GuestFileSystemBridgeService.swift        |   284 +-
 .../GhostVM/Services/GuestMountRegistry.swift |    93 +
 .../GhostVM/Services/GuestPathProvider.swift  |   128 +
 macOS/GhostVM/Services/GuestVolumeMount.swift |    35 +-
 .../BuildKitClient.swift                      |   582 +
 .../BuildRuntime.swift                        |   409 +
 .../Ghostbox/GhostboxBootCommands.swift       |   821 ++
 .../Ghostbox/GhostboxBuiltinCommands.swift    |   947 ++
 .../GhostboxConfigurationCommands.swift       |   625 +
 .../GhostboxContainerAPICommands.swift        |   227 +
 .../Ghostbox/GhostboxDispatcher.swift         |    52 +
 .../Ghostbox/GhostboxImageCommands.swift      |   903 ++
 .../Ghostbox/GhostboxLifecycleCommands.swift  |  1057 ++
 .../Ghostbox/GhostboxNetworkCommands.swift    |   384 +
 .../Ghostbox/GhostboxParameters.swift         |   201 +
 .../Ghostbox/GhostboxPodCommands.swift        |   498 +
 .../Ghostbox/GhostboxSession.swift            |    55 +
 .../Ghostbox/GhostboxSharedNetwork.swift      |   133 +
 .../Ghostbox/GhostboxSupport.swift            |    34 +
 .../Ghostbox/GhostboxVMCommands.swift         |   298 +
 .../Ghostbox/GhostboxVolumeCommands.swift     |   324 +
 .../GhostboxAttachmentReadiness.swift         |    54 +
 .../GhostboxCoreArguments.swift               |   150 +
 .../GhostboxCoreSession.swift                 |   307 +
 .../GhostVMContainerRuntime/RuntimeMain.swift |   971 +-
 macOS/GhostVMFS/FileSystemExtension.swift     |     5 +-
 macOS/GhostVMFS/GhostVMFSClient.swift         |   124 -
 macOS/GhostVMFS/GhostVMFileSystem.swift       |    35 -
 macOS/GhostVMFS/GhostVMItem.swift             |    13 -
 macOS/GhostVMFS/GhostVMVolume.swift           |   248 -
 .../ContainerManagementWindow.swift           |   538 +
 macOS/GhostVMHelper/HelperToolbar.swift       |    39 +
 macOS/GhostVMHelper/main.swift                |    33 +-
 macOS/GhostVMImageFetch/FetchMain.swift       |     2 +-
 .../Containers/ContainerBridgeProtocol.swift  |   210 +-
 .../Containers/ContainerRunPolicy.swift       |   355 -
 .../Containers/ContainerRuntimeProtocol.swift |    41 +
 .../ContainerRuntimeXPCProtocol.swift         |    12 +-
 .../Containers/GhostboxDirectProtocol.swift   |   556 +
 .../GhostVMKit/Core/GhostClientProtocol.swift |     8 +-
 macOS/GhostVMKit/Core/GhostClientTypes.swift  |    60 +-
 macOS/GhostVMKit/Core/VMFileLayout.swift      |    15 +
 .../Networking/SharedVmnetIPv4Pool.swift      |    18 +-
 .../Networking/SharedVmnetNetwork.swift       |    13 +-
 .../ContainerBridgeProtocolTests.swift        |   275 +-
 .../ContainerRunPolicyTests.swift             |   280 -
 macOS/GhostVMTests/GhostboxSessionTests.swift |   288 +
 .../GuestFileSystemBridgeServiceTests.swift   |    86 +
 .../GuestMountRegistryTests.swift             |    56 +
 .../GhostVMTests/GuestPathProviderTests.swift |    48 +
 macOS/GhostVMTests/MockGhostClient.swift      |    48 +
 .../SharedVmnetIPv4PoolTests.swift            |    55 +-
 macOS/GhostVMTests/VMCtlTests.swift           |     5 +
 macOS/GhostVMUITests/AppSettingsUITests.swift |     1 +
 .../GhostboxContainerAPICommandsTests.swift   |   130 +
 macOS/project.yml                             |   170 +-
 scripts/generate-ghostbox-command-catalog.py  |  1084 ++
 scripts/ghostbox-docker                       |  1514 ++
 scripts/ghostbox-docker-compose               |   716 +
 scripts/gui-complete-ghostfile-folder.ts      |    15 +
 scripts/gui-enable-ghostfile-extension.ts     |    28 +
 scripts/gui-inspect-ghostfile.ts              |    22 +
 scripts/gui-inspect-system-settings.ts        |    22 +
 scripts/gui-open-ghostfile-extension.ts       |    39 +
 scripts/gui-start-ghostfile-share.ts          |   121 +
 scripts/notarize-ghostfile-dmg.sh             |    99 +
 scripts/package-ghostfile-dmg.sh              |   148 +
 scripts/stress-ghostfile.sh                   |    62 +-
 scripts/test-ghostbox-docker-compose.sh       |   174 +
 scripts/test-ghostbox-docker.sh               |    59 +
 154 files changed, 50863 insertions(+), 5958 deletions(-)
 create mode 100644 GHOSTBOX_CLI_COMMANDS.json
 create mode 100644 GHOSTBOX_CLI_TEMPLATE.md
 create mode 100644 GHOSTBOX_CR_CLI_TEMPLATE.md
 create mode 100644 docs/GHOSTFILE_RELEASE.md
 create mode 100644 docs/ghostbox-api/README.md
 create mode 100644 docs/ghostbox-api/boot-and-mounts.md
 create mode 100644 docs/ghostbox-api/container-memory-and-labels.md
 create mode 100644 docs/ghostbox-api/container-parser-utilities.md
 create mode 100644 docs/ghostbox-api/container-volumes.md
 create mode 100644 docs/ghostbox-api/containers-managers-and-processes.md
 create mode 100644 docs/ghostbox-api/images-and-content.md
 create mode 100644 docs/ghostbox-api/networking-and-host-configuration.md
 create mode 100644 docs/ghostbox-api/pods.md
 create mode 100644 docs/ghostbox-api/process-configuration.md
 create mode 100644 docs/ghostbox-api/virtual-machines.md
 create mode 100644 docs/ghostbox-volumes.md
 create mode 100644 examples/ghostbox/README.md
 create mode 100755 examples/ghostbox/ephemeral-container.sh
 create mode 100755 examples/ghostbox/ephemeral-terminal.sh
 create mode 100755 examples/ghostbox/persistent-volume.sh
 create mode 100755 examples/ghostbox/setup-manager.sh
 create mode 100644 macOS/GhostFile/DMG_README.txt
 create mode 100644 macOS/GhostFile/GhostFile.icon/Assets/GhostFile.png
 create mode 100644 macOS/GhostFile/GhostFile.icon/icon.json
 delete mode 100644 macOS/GhostFile/GhostFileShareRouter.swift
 delete mode 100644 macOS/GhostFileFS/GhostFileItem.swift
 rename macOS/{GhostFileShared => GhostFileKit}/GhostFileHTTP3.swift (94%)
 rename macOS/{GhostFile => GhostFileKit}/GhostFileHTTP3ShareServer.swift (84%)
 rename macOS/{GhostFileFS => GhostFileKit}/GhostFileHTTPClient.swift (75%)
 create mode 100644 macOS/GhostFileKit/GhostFileItem.swift
 create mode 100644 macOS/GhostFileKit/GhostFileProtocol.swift
 create mode 100644 macOS/GhostFileKit/GhostFileProvider.swift
 create mode 100644 macOS/GhostFileKit/GhostFileShareRouter.swift
 rename macOS/{GhostFileFS => GhostFileKit}/GhostFileSystem.swift (77%)
 rename macOS/{GhostFile => GhostFileKit}/GhostFileTLSIdentity.swift (60%)
 rename macOS/{GhostFileFS => GhostFileKit}/GhostFileVolume.swift (66%)
 create mode 100644 macOS/GhostFileKit/LocalFolderProvider.swift
 delete mode 100644 macOS/GhostFileShared/GhostFileProtocol.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Attachment.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/DirectCommand.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/DirectProtocol.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Generated/GhostboxCommandCatalog.generated.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Generated/GhostboxCommandFixtures.generated.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Help.swift
 delete mode 100644 macOS/GhostTools/Sources/ghostbox/Protocol.swift
 create mode 100644 macOS/GhostTools/Sources/ghostbox/Transport.swift
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/AttachmentTerminalTests.swift
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/CommandCatalogTests.swift
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/GhostboxForwardSignalProcessTests.swift
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/PortForwarderFableAdversarialTests.swift
 create mode 100644 macOS/GhostTools/Tests/GhostboxTests/PortForwarderNodeScenarioTests.swift
 delete mode 100644 macOS/GhostVM/Services/ContainerRunner.swift
 create mode 100644 macOS/GhostVM/Services/GuestMountRegistry.swift
 create mode 100644 macOS/GhostVM/Services/GuestPathProvider.swift
 create mode 100644 macOS/GhostVMContainerRuntime/BuildKitClient.swift
 create mode 100644 macOS/GhostVMContainerRuntime/BuildRuntime.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxBootCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxBuiltinCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxConfigurationCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxContainerAPICommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxDispatcher.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxImageCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxLifecycleCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxNetworkCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxParameters.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxPodCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxSession.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxSharedNetwork.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxSupport.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVMCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift
 create mode 100644 macOS/GhostVMContainerRuntime/GhostboxAttachmentReadiness.swift
 create mode 100644 macOS/GhostVMContainerRuntime/GhostboxCoreArguments.swift
 create mode 100644 macOS/GhostVMContainerRuntime/GhostboxCoreSession.swift
 delete mode 100644 macOS/GhostVMFS/GhostVMFSClient.swift
 delete mode 100644 macOS/GhostVMFS/GhostVMFileSystem.swift
 delete mode 100644 macOS/GhostVMFS/GhostVMItem.swift
 delete mode 100644 macOS/GhostVMFS/GhostVMVolume.swift
 create mode 100644 macOS/GhostVMHelper/ContainerManagementWindow.swift
 delete mode 100644 macOS/GhostVMKit/Containers/ContainerRunPolicy.swift
 create mode 100644 macOS/GhostVMKit/Containers/GhostboxDirectProtocol.swift
 delete mode 100644 macOS/GhostVMTests/ContainerRunPolicyTests.swift
 create mode 100644 macOS/GhostVMTests/GhostboxSessionTests.swift
 create mode 100644 macOS/GhostVMTests/GuestFileSystemBridgeServiceTests.swift
 create mode 100644 macOS/GhostVMTests/GuestMountRegistryTests.swift
 create mode 100644 macOS/GhostVMTests/GuestPathProviderTests.swift
 create mode 100644 macOS/GhostboxRuntimeTests/GhostboxContainerAPICommandsTests.swift
 create mode 100755 scripts/generate-ghostbox-command-catalog.py
 create mode 100755 scripts/ghostbox-docker
 create mode 100755 scripts/ghostbox-docker-compose
 create mode 100644 scripts/gui-complete-ghostfile-folder.ts
 create mode 100644 scripts/gui-enable-ghostfile-extension.ts
 create mode 100644 scripts/gui-inspect-ghostfile.ts
 create mode 100644 scripts/gui-inspect-system-settings.ts
 create mode 100644 scripts/gui-open-ghostfile-extension.ts
 create mode 100644 scripts/gui-start-ghostfile-share.ts
 create mode 100755 scripts/notarize-ghostfile-dmg.sh
 create mode 100755 scripts/package-ghostfile-dmg.sh
 create mode 100755 scripts/test-ghostbox-docker-compose.sh
 create mode 100644 scripts/test-ghostbox-docker.sh

diff --git a/.env.example b/.env.example
index 18d8ae4..7d79c86 100644
--- a/.env.example
+++ b/.env.example
@@ -4,7 +4,17 @@
 # Code signing team ID (find yours: `security find-identity -v -p codesigning`)
 DEVELOPMENT_TEAM=
 
-# Notarization credentials for `make dist`
+# Preferred local notarization setup. Create it once with:
+# xcrun notarytool store-credentials ghostfile-notary \
+#   --apple-id you@example.com --team-id YOUR_TEAM_ID
+NOTARY_KEYCHAIN_PROFILE=
+
+# CI alternative: App Store Connect API key credentials.
+NOTARY_KEY_FILE=
+NOTARY_KEY_ID=
+NOTARY_ISSUER_ID=
+
+# Legacy notarization credentials for `make dist` and GhostFile releases.
 NOTARY_APPLE_ID=
 NOTARY_TEAM_ID=
 NOTARY_PASSWORD=
diff --git a/CONTAINER_RUNTIME_PROTOCOL.md b/CONTAINER_RUNTIME_PROTOCOL.md
index 4421e1e..1c8562c 100644
--- a/CONTAINER_RUNTIME_PROTOCOL.md
+++ b/CONTAINER_RUNTIME_PROTOCOL.md
@@ -37,6 +37,8 @@ docker CLI / compose / another client
 7. Large and interactive data uses bounded binary stream frames associated
    with a request. JSON metadata must never contain whole build contexts,
    filesystem archives, or unbounded process output.
+8. Guest-backed `ReaderStream`, `Writer`, and `Terminal` resources carry process
+   I/O independently from container and process lifecycle calls.
 
 ## Runtime surface
 
@@ -104,10 +106,20 @@ Filesystem I/O is not tunneled through container lifecycle requests. The host
 FSKit extension uses a separate bounded filesystem transport to GhostTools for
 lookup, attributes, directory enumeration, and range I/O.
 
+### Persistent named volumes
+
+The additive `volume.create`, `volume.list`, `volume.inspect`, `volume.mount`,
+and `volume.delete` methods manage sparse ext4 images in trusted per-VM storage.
+`volume.mount` translates a named volume internally to
+`Containerization.Mount.block`; guests exchange only `@volume/NAME` and
+`@mount/NAME` references, never outer-host paths. Volumes survive container and
+VM restarts and cannot be deleted while a mount reference reserves them.
+
 ## Docker mapping
 
-Docker Compose is client-side and uses the ordinary Docker Engine API. A
-GhostTools Docker endpoint can therefore translate its core calls as follows:
+Docker Compose is client-side orchestration. GhostTools can parse Compose files
+and translate their core operations directly without requiring a Docker Engine
+daemon or socket:
 
 | Docker operation | Runtime sequence |
 |---|---|
@@ -120,41 +132,12 @@ GhostTools Docker endpoint can therefore translate its core calls as follows:
 | Stop or remove | `container.stop`, `container.delete` |
 | Build Dockerfile | `build.create` with a streamed build context |
 
-Named volumes, Compose networks, port publication, and restart policies are
-orchestration features. They belong in the host runtime service and are exposed
-as additive capabilities rather than leaking Docker request structures into
-the base container lifecycle API.
-
-## One-shot run compatibility
-
-The one-shot `run` request remains operational while the primitive handlers are
-implemented. It is a temporary compatibility path and is not part of the stable
-runtime surface above. Its optional `volumes` array contains
-`{guestPath, destination, readOnly}` records. The host validates these,
-registers capability-scoped FSKit exports, mounts them for the run lifetime, and
-passes only the resulting host mount paths to the isolated runtime helper.
-
-Version 1 sends raw stdin bytes after the request newline and remains accepted
-for existing GhostTools installations. Version 2 adds `tty`, `columns`, and
-`rows` request fields. Guest-to-host traffic after a version 2 request is NDJSON:
-
-```json
-{"version":2,"type":"stdin","data":"YmFzZTY0"}
-{"version":2,"type":"resize","columns":120,"rows":40}
-{"version":2,"type":"stdinClose"}
-```
-
-Host responses use the request's protocol version. In TTY mode, the container
-process receives a native PTY, stderr is merged into stdout, `TERM` is set to
-`xterm-256color`, and resize frames map to `LinuxContainer.resize(to:)`.
-
-Version 4 adds optional `environment`, `workingDirectory`, `user`, `cpus`, and
-`memoryBytes` run fields. Once the container starts, the host returns its
-private address before relaying output:
-
-```json
-{"version":4,"type":"ready","ipv4Address":"192.168.64.3"}
-```
+Compose networks and restart policies are orchestration features. They are
+exposed as additive capabilities rather than leaking Docker
+request structures into the base container lifecycle API. Guest-side frontends
+implement published-port listeners using the container address returned by the
+host.
 
-`ghostbox` binds requested TCP ports in the macOS guest and forwards them to
-that address. The host never binds an outer-Mac port on behalf of a guest run.
+There is no one-shot `run` request, Docker-shaped host request, compatibility
+handshake, or fallback route. Frontends must use the resource methods above.
+Methods that have not been implemented fail with `unsupported`.
diff --git a/GHOSTBOX_CLI_COMMANDS.json b/GHOSTBOX_CLI_COMMANDS.json
new file mode 100644
index 0000000..51cd2be
--- /dev/null
+++ b/GHOSTBOX_CLI_COMMANDS.json
@@ -0,0 +1,11839 @@
+{
+  "schemaVersion": 2,
+  "sources": [
+    "GHOSTBOX_CLI_TEMPLATE.md",
+    "GHOSTBOX_CR_CLI_TEMPLATE.md"
+  ],
+  "namespaces": {
+    "cn": {
+      "name": "containerization",
+      "aliases": [
+        "containerization"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "repository": "https://github.com/apple/containerization",
+      "version": "0.40.1",
+      "revision": "7800b4642171561c95b5f55500b19e5dce5acd45"
+    },
+    "cr": {
+      "name": "container",
+      "aliases": [
+        "container"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "repository": "https://github.com/apple/container",
+      "version": "1.2.0",
+      "revision": "6e65319fe476ffe8db8ddaf828a537ed36fe2859"
+    }
+  },
+  "entryCount": 282,
+  "resourceCount": 39,
+  "resources": [
+    "authentication",
+    "boot-log",
+    "capabilities",
+    "container",
+    "container-config",
+    "content",
+    "content-store",
+    "dns",
+    "hosts",
+    "hosts-entry",
+    "image",
+    "image-description",
+    "image-store",
+    "init-image",
+    "interface",
+    "kernel",
+    "kernel-command-line",
+    "kernel-image",
+    "manager",
+    "memory-size",
+    "mount",
+    "network",
+    "parser",
+    "pod",
+    "pod-config",
+    "pod-container-config",
+    "pod-volume",
+    "process",
+    "process-config",
+    "progress-handler",
+    "resource-labels",
+    "rlimit",
+    "rlimit-kind",
+    "socket",
+    "standard-vm-config",
+    "vm-config",
+    "vm-instance",
+    "vmm",
+    "volume"
+  ],
+  "sharedOptionGroups": {
+    "containerConfigOverride": [
+      {
+        "names": [
+          "--process"
+        ],
+        "type": "reference:process-config",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--cpus"
+        ],
+        "type": "int",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--memory"
+        ],
+        "type": "uint64",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--hostname"
+        ],
+        "type": "string",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--sysctl"
+        ],
+        "type": "string",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--interfaces"
+        ],
+        "type": "reference:interface",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--sockets"
+        ],
+        "type": "reference:socket",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--mounts"
+        ],
+        "type": "reference:mount",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--masked-paths"
+        ],
+        "type": "container-path",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--readonly-paths"
+        ],
+        "type": "container-path",
+        "required": false,
+        "repeatable": true,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--dns"
+        ],
+        "type": "reference:dns",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--hosts"
+        ],
+        "type": "reference:hosts",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--virtualization"
+        ],
+        "type": "bool",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--boot-log"
+        ],
+        "type": "reference:boot-log",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--oci-runtime-path"
+        ],
+        "type": "container-path",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--use-init"
+        ],
+        "type": "bool",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--cpu-overhead"
+        ],
+        "type": "int",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      },
+      {
+        "names": [
+          "--memory-overhead"
+        ],
+        "type": "uint64",
+        "required": false,
+        "repeatable": false,
+        "default": null,
+        "group": "containerConfigOverride"
+      }
+    ]
+  },
+  "commands": [
+    {
+      "commandID": "cn:image-store:create",
+      "methodID": "imageStore.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:create"
+      ],
+      "resource": "image-store",
+      "operation": "create",
+      "commandStart": "cn:image-store:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--path"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--content-store"
+          ],
+          "type": "reference:content-store",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:image-store",
+      "minimalArgv": [
+        "cn:image-store:create",
+        "example",
+        "--path",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 58
+    },
+    {
+      "commandID": "cn:image-store:default",
+      "methodID": "imageStore.default",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:default"
+      ],
+      "resource": "image-store",
+      "operation": "default",
+      "commandStart": "cn:image-store:default",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:image-store",
+      "minimalArgv": [
+        "cn:image-store:default"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 63
+    },
+    {
+      "commandID": "cn:image-store:path",
+      "methodID": "imageStore.path",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:path"
+      ],
+      "resource": "image-store",
+      "operation": "path",
+      "commandStart": "cn:image-store:path",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "host-url",
+      "minimalArgv": [
+        "cn:image-store:path",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 64
+    },
+    {
+      "commandID": "cn:image-store:get",
+      "methodID": "imageStore.get",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:get"
+      ],
+      "resource": "image-store",
+      "operation": "get",
+      "commandStart": "cn:image-store:get",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--pull"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:image",
+      "minimalArgv": [
+        "cn:image-store:get",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 66
+    },
+    {
+      "commandID": "cn:image-store:list",
+      "methodID": "imageStore.list",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:list"
+      ],
+      "resource": "image-store",
+      "operation": "list",
+      "commandStart": "cn:image-store:list",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image[]",
+      "minimalArgv": [
+        "cn:image-store:list",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 71
+    },
+    {
+      "commandID": "cn:image-store:create-image",
+      "methodID": "imageStore.createImage",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:create-image"
+      ],
+      "resource": "image-store",
+      "operation": "create-image",
+      "commandStart": "cn:image-store:create-image",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image",
+      "minimalArgv": [
+        "cn:image-store:create-image",
+        "@image-store/example",
+        "@image-description/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 73
+    },
+    {
+      "commandID": "cn:image-store:delete",
+      "methodID": "imageStore.delete",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:delete"
+      ],
+      "resource": "image-store",
+      "operation": "delete",
+      "commandStart": "cn:image-store:delete",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--perform-cleanup"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:image-store:delete",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 77
+    },
+    {
+      "commandID": "cn:image-store:clean-up-orphaned-blobs",
+      "methodID": "imageStore.cleanUpOrphanedBlobs",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:clean-up-orphaned-blobs"
+      ],
+      "resource": "image-store",
+      "operation": "clean-up-orphaned-blobs",
+      "commandStart": "cn:image-store:clean-up-orphaned-blobs",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "deleted-digests-and-freed-bytes",
+      "minimalArgv": [
+        "cn:image-store:clean-up-orphaned-blobs",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 81
+    },
+    {
+      "commandID": "cn:image-store:calculate-orphaned-blobs-size",
+      "methodID": "imageStore.calculateOrphanedBlobsSize",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:calculate-orphaned-blobs-size"
+      ],
+      "resource": "image-store",
+      "operation": "calculate-orphaned-blobs-size",
+      "commandStart": "cn:image-store:calculate-orphaned-blobs-size",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:image-store:calculate-orphaned-blobs-size",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 84
+    },
+    {
+      "commandID": "cn:image-store:tag",
+      "methodID": "imageStore.tag",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:tag"
+      ],
+      "resource": "image-store",
+      "operation": "tag",
+      "commandStart": "cn:image-store:tag",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "existing-reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "new-reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image",
+      "minimalArgv": [
+        "cn:image-store:tag",
+        "@image-store/example",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 87
+    },
+    {
+      "commandID": "cn:image-store:pull",
+      "methodID": "imageStore.pull",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:pull"
+      ],
+      "resource": "image-store",
+      "operation": "pull",
+      "commandStart": "cn:image-store:pull",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "oci-platform",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--insecure"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--authentication"
+          ],
+          "type": "reference:authentication",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--max-concurrent-downloads"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 3
+        }
+      ],
+      "resultType": "reference:image",
+      "minimalArgv": [
+        "cn:image-store:pull",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 92
+    },
+    {
+      "commandID": "cn:image-store:push",
+      "methodID": "imageStore.push",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:push"
+      ],
+      "resource": "image-store",
+      "operation": "push",
+      "commandStart": "cn:image-store:push",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "oci-platform",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--insecure"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--authentication"
+          ],
+          "type": "reference:authentication",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:image-store:push",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 101
+    },
+    {
+      "commandID": "cn:image-store:push-many",
+      "methodID": "imageStore.pushMany",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:push-many"
+      ],
+      "resource": "image-store",
+      "operation": "push-many",
+      "commandStart": "cn:image-store:push-many",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "oci-platform",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--insecure"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--authentication"
+          ],
+          "type": "reference:authentication",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--max-concurrent-uploads"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 3
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:image-store:push-many",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 108
+    },
+    {
+      "commandID": "cn:image-store:save",
+      "methodID": "imageStore.save",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:save"
+      ],
+      "resource": "image-store",
+      "operation": "save",
+      "commandStart": "cn:image-store:save",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--out"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "oci-platform",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:image-store:save",
+        "@image-store/example",
+        "example",
+        "--out",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 116
+    },
+    {
+      "commandID": "cn:image-store:load",
+      "methodID": "imageStore.load",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:load"
+      ],
+      "resource": "image-store",
+      "operation": "load",
+      "commandStart": "cn:image-store:load",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "directory",
+          "type": "host-url",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:image[]",
+      "minimalArgv": [
+        "cn:image-store:load",
+        "@image-store/example",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 121
+    },
+    {
+      "commandID": "cn:image-store:get-init-image",
+      "methodID": "imageStore.getInitImage",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-store:get-init-image"
+      ],
+      "resource": "image-store",
+      "operation": "get-init-image",
+      "commandStart": "cn:image-store:get-init-image",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-store",
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--authentication"
+          ],
+          "type": "reference:authentication",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:init-image",
+      "minimalArgv": [
+        "cn:image-store:get-init-image",
+        "@image-store/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 126
+    },
+    {
+      "commandID": "cn:image-description:create",
+      "methodID": "imageDescription.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-description:create"
+      ],
+      "resource": "image-description",
+      "operation": "create",
+      "commandStart": "cn:image-description:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "image-description",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "descriptor",
+          "type": "oci-descriptor-json",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image-description",
+      "minimalArgv": [
+        "cn:image-description:create",
+        "example",
+        "example",
+        "{\"mediaType\":\"application/vnd.oci.image.manifest.v1+json\",\"digest\":\"sha256:0000000000000000000000000000000000000000000000000000000000000000\",\"size\":0}"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 140
+    },
+    {
+      "commandID": "cn:image-description:reference",
+      "methodID": "imageDescription.reference",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-description:reference"
+      ],
+      "resource": "image-description",
+      "operation": "reference",
+      "commandStart": "cn:image-description:reference",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image-description:reference",
+        "@image-description/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 145
+    },
+    {
+      "commandID": "cn:image-description:descriptor",
+      "methodID": "imageDescription.descriptor",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-description:descriptor"
+      ],
+      "resource": "image-description",
+      "operation": "descriptor",
+      "commandStart": "cn:image-description:descriptor",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-descriptor",
+      "minimalArgv": [
+        "cn:image-description:descriptor",
+        "@image-description/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 146
+    },
+    {
+      "commandID": "cn:image-description:digest",
+      "methodID": "imageDescription.digest",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-description:digest"
+      ],
+      "resource": "image-description",
+      "operation": "digest",
+      "commandStart": "cn:image-description:digest",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image-description:digest",
+        "@image-description/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 147
+    },
+    {
+      "commandID": "cn:image-description:media-type",
+      "methodID": "imageDescription.mediaType",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image-description:media-type"
+      ],
+      "resource": "image-description",
+      "operation": "media-type",
+      "commandStart": "cn:image-description:media-type",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image-description:media-type",
+        "@image-description/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 148
+    },
+    {
+      "commandID": "cn:image:create",
+      "methodID": "image.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:create"
+      ],
+      "resource": "image",
+      "operation": "create",
+      "commandStart": "cn:image:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "image-description",
+          "type": "reference:image-description",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "content-store",
+          "type": "reference:content-store",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image",
+      "minimalArgv": [
+        "cn:image:create",
+        "example",
+        "@image-description/example",
+        "@content-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 150
+    },
+    {
+      "commandID": "cn:image:description",
+      "methodID": "image.description",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:description"
+      ],
+      "resource": "image",
+      "operation": "description",
+      "commandStart": "cn:image:description",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "image-description",
+      "minimalArgv": [
+        "cn:image:description",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 155
+    },
+    {
+      "commandID": "cn:image:descriptor",
+      "methodID": "image.descriptor",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:descriptor"
+      ],
+      "resource": "image",
+      "operation": "descriptor",
+      "commandStart": "cn:image:descriptor",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-descriptor",
+      "minimalArgv": [
+        "cn:image:descriptor",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 156
+    },
+    {
+      "commandID": "cn:image:digest",
+      "methodID": "image.digest",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:digest"
+      ],
+      "resource": "image",
+      "operation": "digest",
+      "commandStart": "cn:image:digest",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image:digest",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 157
+    },
+    {
+      "commandID": "cn:image:media-type",
+      "methodID": "image.mediaType",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:media-type"
+      ],
+      "resource": "image",
+      "operation": "media-type",
+      "commandStart": "cn:image:media-type",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image:media-type",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 158
+    },
+    {
+      "commandID": "cn:image:reference",
+      "methodID": "image.reference",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:reference"
+      ],
+      "resource": "image",
+      "operation": "reference",
+      "commandStart": "cn:image:reference",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:image:reference",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 159
+    },
+    {
+      "commandID": "cn:image:index",
+      "methodID": "image.index",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:index"
+      ],
+      "resource": "image",
+      "operation": "index",
+      "commandStart": "cn:image:index",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-index",
+      "minimalArgv": [
+        "cn:image:index",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 160
+    },
+    {
+      "commandID": "cn:image:manifest",
+      "methodID": "image.manifest",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:manifest"
+      ],
+      "resource": "image",
+      "operation": "manifest",
+      "commandStart": "cn:image:manifest",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "platform",
+          "type": "oci-platform",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-manifest",
+      "minimalArgv": [
+        "cn:image:manifest",
+        "@image/example",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 162
+    },
+    {
+      "commandID": "cn:image:descriptor-for",
+      "methodID": "image.descriptorFor",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:descriptor-for"
+      ],
+      "resource": "image",
+      "operation": "descriptor-for",
+      "commandStart": "cn:image:descriptor-for",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "platform",
+          "type": "oci-platform",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-descriptor",
+      "minimalArgv": [
+        "cn:image:descriptor-for",
+        "@image/example",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 166
+    },
+    {
+      "commandID": "cn:image:config",
+      "methodID": "image.config",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:config"
+      ],
+      "resource": "image",
+      "operation": "config",
+      "commandStart": "cn:image:config",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "platform",
+          "type": "oci-platform",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-image",
+      "minimalArgv": [
+        "cn:image:config",
+        "@image/example",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 170
+    },
+    {
+      "commandID": "cn:image:referenced-digests",
+      "methodID": "image.referencedDigests",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:referenced-digests"
+      ],
+      "resource": "image",
+      "operation": "referenced-digests",
+      "commandStart": "cn:image:referenced-digests",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:image:referenced-digests",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 174
+    },
+    {
+      "commandID": "cn:image:get-content",
+      "methodID": "image.getContent",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:image:get-content"
+      ],
+      "resource": "image",
+      "operation": "get-content",
+      "commandStart": "cn:image:get-content",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "digest",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:content",
+      "minimalArgv": [
+        "cn:image:get-content",
+        "@image/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 176
+    },
+    {
+      "commandID": "cn:content:path",
+      "methodID": "content.path",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content:path"
+      ],
+      "resource": "content",
+      "operation": "path",
+      "commandStart": "cn:content:path",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "content",
+          "type": "reference:content",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "host-url",
+      "minimalArgv": [
+        "cn:content:path",
+        "@content/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 180
+    },
+    {
+      "commandID": "cn:content:digest",
+      "methodID": "content.digest",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content:digest"
+      ],
+      "resource": "content",
+      "operation": "digest",
+      "commandStart": "cn:content:digest",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "content",
+          "type": "reference:content",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "sha256-digest",
+      "minimalArgv": [
+        "cn:content:digest",
+        "@content/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 181
+    },
+    {
+      "commandID": "cn:content:size",
+      "methodID": "content.size",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content:size"
+      ],
+      "resource": "content",
+      "operation": "size",
+      "commandStart": "cn:content:size",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "content",
+          "type": "reference:content",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:content:size",
+        "@content/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 182
+    },
+    {
+      "commandID": "cn:content:data",
+      "methodID": "content.data",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content:data"
+      ],
+      "resource": "content",
+      "operation": "data",
+      "commandStart": "cn:content:data",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "content",
+          "type": "reference:content",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "byte-stream",
+      "minimalArgv": [
+        "cn:content:data",
+        "@content/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 183
+    },
+    {
+      "commandID": "cn:content:data-range",
+      "methodID": "content.dataRange",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content:data-range"
+      ],
+      "resource": "content",
+      "operation": "data-range",
+      "commandStart": "cn:content:data-range",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "content",
+          "type": "reference:content",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "offset",
+          "type": "uint64",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "length",
+          "type": "int",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "byte-stream?",
+      "minimalArgv": [
+        "cn:content:data-range",
+        "@content/example",
+        "1",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 184
+    },
+    {
+      "commandID": "cn:kernel-command-line:create",
+      "methodID": "kernelCommandLine.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:create"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "create",
+      "commandStart": "cn:kernel-command-line:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "command-line",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel-argument"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--init-argument"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:kernel-command-line",
+      "minimalArgv": [
+        "cn:kernel-command-line:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 193
+    },
+    {
+      "commandID": "cn:kernel-command-line:create-debug",
+      "methodID": "kernelCommandLine.createDebug",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:create-debug"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "create-debug",
+      "commandStart": "cn:kernel-command-line:create-debug",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "command-line",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "debug",
+          "type": "bool",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "panic",
+          "type": "int",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--init-argument"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:kernel-command-line",
+      "minimalArgv": [
+        "cn:kernel-command-line:create-debug",
+        "example",
+        "true",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 198
+    },
+    {
+      "commandID": "cn:kernel-command-line:add-debug",
+      "methodID": "kernelCommandLine.addDebug",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:add-debug"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "add-debug",
+      "commandStart": "cn:kernel-command-line:add-debug",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-command-line",
+          "type": "reference:kernel-command-line",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:kernel-command-line:add-debug",
+        "@kernel-command-line/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 204
+    },
+    {
+      "commandID": "cn:kernel-command-line:add-panic",
+      "methodID": "kernelCommandLine.addPanic",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:add-panic"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "add-panic",
+      "commandStart": "cn:kernel-command-line:add-panic",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-command-line",
+          "type": "reference:kernel-command-line",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "level",
+          "type": "int",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:kernel-command-line:add-panic",
+        "@kernel-command-line/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 205
+    },
+    {
+      "commandID": "cn:kernel-command-line:set-agent-log-level",
+      "methodID": "kernelCommandLine.setAgentLogLevel",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:set-agent-log-level"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "set-agent-log-level",
+      "commandStart": "cn:kernel-command-line:set-agent-log-level",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-command-line",
+          "type": "reference:kernel-command-line",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "level",
+          "type": "logger-level",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:kernel-command-line:set-agent-log-level",
+        "@kernel-command-line/example",
+        "info"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 206
+    },
+    {
+      "commandID": "cn:kernel-command-line:kernel-arguments",
+      "methodID": "kernelCommandLine.kernelArguments",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:kernel-arguments"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "kernel-arguments",
+      "commandStart": "cn:kernel-command-line:kernel-arguments",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-command-line",
+          "type": "reference:kernel-command-line",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:kernel-command-line:kernel-arguments",
+        "@kernel-command-line/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 207
+    },
+    {
+      "commandID": "cn:kernel-command-line:init-arguments",
+      "methodID": "kernelCommandLine.initArguments",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-command-line:init-arguments"
+      ],
+      "resource": "kernel-command-line",
+      "operation": "init-arguments",
+      "commandStart": "cn:kernel-command-line:init-arguments",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-command-line",
+          "type": "reference:kernel-command-line",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:kernel-command-line:init-arguments",
+        "@kernel-command-line/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 208
+    },
+    {
+      "commandID": "cn:kernel:create",
+      "methodID": "kernel.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel:create"
+      ],
+      "resource": "kernel",
+      "operation": "create",
+      "commandStart": "cn:kernel:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "kernel",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--path"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "system-platform",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--command-line"
+          ],
+          "type": "reference:kernel-command-line",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:kernel",
+      "minimalArgv": [
+        "cn:kernel:create",
+        "example",
+        "--path",
+        "/tmp/example",
+        "--platform",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 210
+    },
+    {
+      "commandID": "cn:kernel:path",
+      "methodID": "kernel.path",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel:path"
+      ],
+      "resource": "kernel",
+      "operation": "path",
+      "commandStart": "cn:kernel:path",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel",
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "host-url",
+      "minimalArgv": [
+        "cn:kernel:path",
+        "@kernel/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 216
+    },
+    {
+      "commandID": "cn:kernel:platform",
+      "methodID": "kernel.platform",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel:platform"
+      ],
+      "resource": "kernel",
+      "operation": "platform",
+      "commandStart": "cn:kernel:platform",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel",
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "system-platform",
+      "minimalArgv": [
+        "cn:kernel:platform",
+        "@kernel/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 217
+    },
+    {
+      "commandID": "cn:kernel:kernel-arguments",
+      "methodID": "kernel.kernelArguments",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel:kernel-arguments"
+      ],
+      "resource": "kernel",
+      "operation": "kernel-arguments",
+      "commandStart": "cn:kernel:kernel-arguments",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel",
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:kernel:kernel-arguments",
+        "@kernel/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 218
+    },
+    {
+      "commandID": "cn:kernel:init-arguments",
+      "methodID": "kernel.initArguments",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel:init-arguments"
+      ],
+      "resource": "kernel",
+      "operation": "init-arguments",
+      "commandStart": "cn:kernel:init-arguments",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel",
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:kernel:init-arguments",
+        "@kernel/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 219
+    },
+    {
+      "commandID": "cn:kernel-image:from-image",
+      "methodID": "kernelImage.fromImage",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-image:from-image"
+      ],
+      "resource": "kernel-image",
+      "operation": "from-image",
+      "commandStart": "cn:kernel-image:from-image",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "kernel-image",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:kernel-image",
+      "minimalArgv": [
+        "cn:kernel-image:from-image",
+        "example",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 221
+    },
+    {
+      "commandID": "cn:kernel-image:create",
+      "methodID": "kernelImage.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-image:create"
+      ],
+      "resource": "kernel-image",
+      "operation": "create",
+      "commandStart": "cn:kernel-image:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "kernel-image",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--label"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--image-store"
+          ],
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--content-store"
+          ],
+          "type": "reference:content-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:kernel-image",
+      "minimalArgv": [
+        "cn:kernel-image:create",
+        "example",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--image-store",
+        "@image-store/example",
+        "--content-store",
+        "@content-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 225
+    },
+    {
+      "commandID": "cn:kernel-image:kernel",
+      "methodID": "kernelImage.kernel",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-image:kernel"
+      ],
+      "resource": "kernel-image",
+      "operation": "kernel",
+      "commandStart": "cn:kernel-image:kernel",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-image",
+          "type": "reference:kernel-image",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "platform",
+          "type": "system-platform",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:kernel",
+      "minimalArgv": [
+        "cn:kernel-image:kernel",
+        "@kernel-image/example",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 233
+    },
+    {
+      "commandID": "cn:kernel-image:name",
+      "methodID": "kernelImage.name",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-image:name"
+      ],
+      "resource": "kernel-image",
+      "operation": "name",
+      "commandStart": "cn:kernel-image:name",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "kernel-image",
+          "type": "reference:kernel-image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:kernel-image:name",
+        "@kernel-image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 237
+    },
+    {
+      "commandID": "cn:kernel-image:media-type",
+      "methodID": "kernelImage.mediaType",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:kernel-image:media-type"
+      ],
+      "resource": "kernel-image",
+      "operation": "media-type",
+      "commandStart": "cn:kernel-image:media-type",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:kernel-image:media-type"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 238
+    },
+    {
+      "commandID": "cn:init-image:from-image",
+      "methodID": "initImage.fromImage",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:init-image:from-image"
+      ],
+      "resource": "init-image",
+      "operation": "from-image",
+      "commandStart": "cn:init-image:from-image",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "init-image",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "image",
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:init-image",
+      "minimalArgv": [
+        "cn:init-image:from-image",
+        "example",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 240
+    },
+    {
+      "commandID": "cn:init-image:create",
+      "methodID": "initImage.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:init-image:create"
+      ],
+      "resource": "init-image",
+      "operation": "create",
+      "commandStart": "cn:init-image:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "init-image",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "reference",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--rootfs"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "oci-platform",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--label"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--image-store"
+          ],
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--content-store"
+          ],
+          "type": "reference:content-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:init-image",
+      "minimalArgv": [
+        "cn:init-image:create",
+        "example",
+        "example",
+        "--rootfs",
+        "/tmp/example",
+        "--platform",
+        "linux/arm64",
+        "--image-store",
+        "@image-store/example",
+        "--content-store",
+        "@content-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 244
+    },
+    {
+      "commandID": "cn:init-image:init-block",
+      "methodID": "initImage.initBlock",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:init-image:init-block"
+      ],
+      "resource": "init-image",
+      "operation": "init-block",
+      "commandStart": "cn:init-image:init-block",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "init-image",
+          "type": "reference:init-image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--at"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--platform"
+          ],
+          "type": "system-platform",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:init-image:init-block",
+        "@init-image/example",
+        "--at",
+        "/tmp/example",
+        "--platform",
+        "linux/arm64"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 253
+    },
+    {
+      "commandID": "cn:init-image:name",
+      "methodID": "initImage.name",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:init-image:name"
+      ],
+      "resource": "init-image",
+      "operation": "name",
+      "commandStart": "cn:init-image:name",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "init-image",
+          "type": "reference:init-image",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:init-image:name",
+        "@init-image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 258
+    },
+    {
+      "commandID": "cn:mount:create",
+      "methodID": "mount.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:create"
+      ],
+      "resource": "mount",
+      "operation": "create",
+      "commandStart": "cn:mount:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--type"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--runtime-options"
+          ],
+          "type": "mount-runtime-options",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:create",
+        "example",
+        "--type",
+        "example",
+        "--source",
+        "example",
+        "--destination",
+        "/example",
+        "--option",
+        "example",
+        "--runtime-options",
+        "{}"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 264
+    },
+    {
+      "commandID": "cn:mount:block",
+      "methodID": "mount.block",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:block"
+      ],
+      "resource": "mount",
+      "operation": "block",
+      "commandStart": "cn:mount:block",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--format"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--runtime-option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:block",
+        "example",
+        "--format",
+        "example",
+        "--source",
+        "example",
+        "--destination",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 272
+    },
+    {
+      "commandID": "cn:mount:share",
+      "methodID": "mount.share",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:share"
+      ],
+      "resource": "mount",
+      "operation": "share",
+      "commandStart": "cn:mount:share",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--runtime-option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:share",
+        "example",
+        "--source",
+        "example",
+        "--destination",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 280
+    },
+    {
+      "commandID": "cn:mount:any",
+      "methodID": "mount.any",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:any"
+      ],
+      "resource": "mount",
+      "operation": "any",
+      "commandStart": "cn:mount:any",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--type"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--runtime-option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:any",
+        "example",
+        "--type",
+        "example",
+        "--source",
+        "example",
+        "--destination",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 287
+    },
+    {
+      "commandID": "cn:mount:shared-mount",
+      "methodID": "mount.sharedMount",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:shared-mount"
+      ],
+      "resource": "mount",
+      "operation": "shared-mount",
+      "commandStart": "cn:mount:shared-mount",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--name"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:shared-mount",
+        "example",
+        "--name",
+        "example",
+        "--destination",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 295
+    },
+    {
+      "commandID": "cn:mount:clone",
+      "methodID": "mount.clone",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:clone"
+      ],
+      "resource": "mount",
+      "operation": "clone",
+      "commandStart": "cn:mount:clone",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--to"
+          ],
+          "type": "host-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:mount:clone",
+        "@mount/example",
+        "--to",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 301
+    },
+    {
+      "commandID": "cn:mount:is-block",
+      "methodID": "mount.isBlock",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:is-block"
+      ],
+      "resource": "mount",
+      "operation": "is-block",
+      "commandStart": "cn:mount:is-block",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool",
+      "minimalArgv": [
+        "cn:mount:is-block",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 305
+    },
+    {
+      "commandID": "cn:mount:type",
+      "methodID": "mount.type",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:type"
+      ],
+      "resource": "mount",
+      "operation": "type",
+      "commandStart": "cn:mount:type",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:mount:type",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 306
+    },
+    {
+      "commandID": "cn:mount:source",
+      "methodID": "mount.source",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:source"
+      ],
+      "resource": "mount",
+      "operation": "source",
+      "commandStart": "cn:mount:source",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:mount:source",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 307
+    },
+    {
+      "commandID": "cn:mount:destination",
+      "methodID": "mount.destination",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:destination"
+      ],
+      "resource": "mount",
+      "operation": "destination",
+      "commandStart": "cn:mount:destination",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:mount:destination",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 308
+    },
+    {
+      "commandID": "cn:mount:options",
+      "methodID": "mount.options",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:options"
+      ],
+      "resource": "mount",
+      "operation": "options",
+      "commandStart": "cn:mount:options",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:mount:options",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 309
+    },
+    {
+      "commandID": "cn:mount:runtime-options",
+      "methodID": "mount.runtimeOptions",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:mount:runtime-options"
+      ],
+      "resource": "mount",
+      "operation": "runtime-options",
+      "commandStart": "cn:mount:runtime-options",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "mount-runtime-options",
+      "minimalArgv": [
+        "cn:mount:runtime-options",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 310
+    },
+    {
+      "commandID": "cn:dns:create",
+      "methodID": "dns.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:create"
+      ],
+      "resource": "dns",
+      "operation": "create",
+      "commandStart": "cn:dns:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--nameserver"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--domain"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--search-domain"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--option"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:dns",
+      "minimalArgv": [
+        "cn:dns:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 316
+    },
+    {
+      "commandID": "cn:dns:default-nameservers",
+      "methodID": "dns.defaultNameservers",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:default-nameservers"
+      ],
+      "resource": "dns",
+      "operation": "default-nameservers",
+      "commandStart": "cn:dns:default-nameservers",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:dns:default-nameservers"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 323
+    },
+    {
+      "commandID": "cn:dns:validate",
+      "methodID": "dns.validate",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:validate"
+      ],
+      "resource": "dns",
+      "operation": "validate",
+      "commandStart": "cn:dns:validate",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:dns:validate",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 324
+    },
+    {
+      "commandID": "cn:dns:resolv-conf",
+      "methodID": "dns.resolvConf",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:resolv-conf"
+      ],
+      "resource": "dns",
+      "operation": "resolv-conf",
+      "commandStart": "cn:dns:resolv-conf",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:dns:resolv-conf",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 325
+    },
+    {
+      "commandID": "cn:dns:nameservers",
+      "methodID": "dns.nameservers",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:nameservers"
+      ],
+      "resource": "dns",
+      "operation": "nameservers",
+      "commandStart": "cn:dns:nameservers",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:dns:nameservers",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 326
+    },
+    {
+      "commandID": "cn:dns:domain",
+      "methodID": "dns.domain",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:domain"
+      ],
+      "resource": "dns",
+      "operation": "domain",
+      "commandStart": "cn:dns:domain",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string?",
+      "minimalArgv": [
+        "cn:dns:domain",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 327
+    },
+    {
+      "commandID": "cn:dns:search-domains",
+      "methodID": "dns.searchDomains",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:search-domains"
+      ],
+      "resource": "dns",
+      "operation": "search-domains",
+      "commandStart": "cn:dns:search-domains",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:dns:search-domains",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 328
+    },
+    {
+      "commandID": "cn:dns:options",
+      "methodID": "dns.options",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:dns:options"
+      ],
+      "resource": "dns",
+      "operation": "options",
+      "commandStart": "cn:dns:options",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "dns",
+          "type": "reference:dns",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:dns:options",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 329
+    },
+    {
+      "commandID": "cn:hosts-entry:create",
+      "methodID": "hostsEntry.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:create"
+      ],
+      "resource": "hosts-entry",
+      "operation": "create",
+      "commandStart": "cn:hosts-entry:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "ip-address",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "hostname",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:create",
+        "example",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 331
+    },
+    {
+      "commandID": "cn:hosts-entry:localhost-ipv4",
+      "methodID": "hostsEntry.localhostIpv4",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:localhost-ipv4"
+      ],
+      "resource": "hosts-entry",
+      "operation": "localhost-ipv4",
+      "commandStart": "cn:hosts-entry:localhost-ipv4",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:localhost-ipv4",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 337
+    },
+    {
+      "commandID": "cn:hosts-entry:localhost-ipv6",
+      "methodID": "hostsEntry.localhostIpv6",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:localhost-ipv6"
+      ],
+      "resource": "hosts-entry",
+      "operation": "localhost-ipv6",
+      "commandStart": "cn:hosts-entry:localhost-ipv6",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:localhost-ipv6",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 338
+    },
+    {
+      "commandID": "cn:hosts-entry:ipv6-localnet",
+      "methodID": "hostsEntry.ipv6Localnet",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:ipv6-localnet"
+      ],
+      "resource": "hosts-entry",
+      "operation": "ipv6-localnet",
+      "commandStart": "cn:hosts-entry:ipv6-localnet",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:ipv6-localnet",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 339
+    },
+    {
+      "commandID": "cn:hosts-entry:ipv6-mcastprefix",
+      "methodID": "hostsEntry.ipv6Mcastprefix",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:ipv6-mcastprefix"
+      ],
+      "resource": "hosts-entry",
+      "operation": "ipv6-mcastprefix",
+      "commandStart": "cn:hosts-entry:ipv6-mcastprefix",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:ipv6-mcastprefix",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 340
+    },
+    {
+      "commandID": "cn:hosts-entry:ipv6-allnodes",
+      "methodID": "hostsEntry.ipv6Allnodes",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:ipv6-allnodes"
+      ],
+      "resource": "hosts-entry",
+      "operation": "ipv6-allnodes",
+      "commandStart": "cn:hosts-entry:ipv6-allnodes",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:ipv6-allnodes",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 341
+    },
+    {
+      "commandID": "cn:hosts-entry:ipv6-allrouters",
+      "methodID": "hostsEntry.ipv6Allrouters",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:ipv6-allrouters"
+      ],
+      "resource": "hosts-entry",
+      "operation": "ipv6-allrouters",
+      "commandStart": "cn:hosts-entry:ipv6-allrouters",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts-entry",
+      "minimalArgv": [
+        "cn:hosts-entry:ipv6-allrouters",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 342
+    },
+    {
+      "commandID": "cn:hosts-entry:rendered",
+      "methodID": "hostsEntry.rendered",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:rendered"
+      ],
+      "resource": "hosts-entry",
+      "operation": "rendered",
+      "commandStart": "cn:hosts-entry:rendered",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "reference:hosts-entry",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:hosts-entry:rendered",
+        "@hosts-entry/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 343
+    },
+    {
+      "commandID": "cn:hosts-entry:ip-address",
+      "methodID": "hostsEntry.ipAddress",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:ip-address"
+      ],
+      "resource": "hosts-entry",
+      "operation": "ip-address",
+      "commandStart": "cn:hosts-entry:ip-address",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "reference:hosts-entry",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:hosts-entry:ip-address",
+        "@hosts-entry/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 344
+    },
+    {
+      "commandID": "cn:hosts-entry:hostnames",
+      "methodID": "hostsEntry.hostnames",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:hostnames"
+      ],
+      "resource": "hosts-entry",
+      "operation": "hostnames",
+      "commandStart": "cn:hosts-entry:hostnames",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "reference:hosts-entry",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:hosts-entry:hostnames",
+        "@hosts-entry/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 345
+    },
+    {
+      "commandID": "cn:hosts-entry:comment",
+      "methodID": "hostsEntry.comment",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts-entry:comment"
+      ],
+      "resource": "hosts-entry",
+      "operation": "comment",
+      "commandStart": "cn:hosts-entry:comment",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts-entry",
+          "type": "reference:hosts-entry",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string?",
+      "minimalArgv": [
+        "cn:hosts-entry:comment",
+        "@hosts-entry/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 346
+    },
+    {
+      "commandID": "cn:hosts:create",
+      "methodID": "hosts.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts:create"
+      ],
+      "resource": "hosts",
+      "operation": "create",
+      "commandStart": "cn:hosts:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "hosts",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--entry"
+          ],
+          "type": "reference:hosts-entry",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--comment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:hosts",
+      "minimalArgv": [
+        "cn:hosts:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 348
+    },
+    {
+      "commandID": "cn:hosts:default",
+      "methodID": "hosts.default",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts:default"
+      ],
+      "resource": "hosts",
+      "operation": "default",
+      "commandStart": "cn:hosts:default",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:hosts",
+      "minimalArgv": [
+        "cn:hosts:default"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 353
+    },
+    {
+      "commandID": "cn:hosts:hosts-file",
+      "methodID": "hosts.hostsFile",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts:hosts-file"
+      ],
+      "resource": "hosts",
+      "operation": "hosts-file",
+      "commandStart": "cn:hosts:hosts-file",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts",
+          "type": "reference:hosts",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:hosts:hosts-file",
+        "@hosts/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 354
+    },
+    {
+      "commandID": "cn:hosts:entries",
+      "methodID": "hosts.entries",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts:entries"
+      ],
+      "resource": "hosts",
+      "operation": "entries",
+      "commandStart": "cn:hosts:entries",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts",
+          "type": "reference:hosts",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:hosts-entry[]",
+      "minimalArgv": [
+        "cn:hosts:entries",
+        "@hosts/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 355
+    },
+    {
+      "commandID": "cn:hosts:comment",
+      "methodID": "hosts.comment",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:hosts:comment"
+      ],
+      "resource": "hosts",
+      "operation": "comment",
+      "commandStart": "cn:hosts:comment",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "hosts",
+          "type": "reference:hosts",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string?",
+      "minimalArgv": [
+        "cn:hosts:comment",
+        "@hosts/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 356
+    },
+    {
+      "commandID": "cn:socket:create",
+      "methodID": "socket.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:create"
+      ],
+      "resource": "socket",
+      "operation": "create",
+      "commandStart": "cn:socket:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--permissions"
+          ],
+          "type": "file-permissions",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--direction"
+          ],
+          "type": "into|out-of",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:socket",
+      "minimalArgv": [
+        "cn:socket:create",
+        "example",
+        "--source",
+        "/tmp/example",
+        "--destination",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 362
+    },
+    {
+      "commandID": "cn:socket:id",
+      "methodID": "socket.id",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:id"
+      ],
+      "resource": "socket",
+      "operation": "id",
+      "commandStart": "cn:socket:id",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:socket:id",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 369
+    },
+    {
+      "commandID": "cn:socket:source",
+      "methodID": "socket.source",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:source"
+      ],
+      "resource": "socket",
+      "operation": "source",
+      "commandStart": "cn:socket:source",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "host-url",
+      "minimalArgv": [
+        "cn:socket:source",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 370
+    },
+    {
+      "commandID": "cn:socket:destination",
+      "methodID": "socket.destination",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:destination"
+      ],
+      "resource": "socket",
+      "operation": "destination",
+      "commandStart": "cn:socket:destination",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "host-url",
+      "minimalArgv": [
+        "cn:socket:destination",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 371
+    },
+    {
+      "commandID": "cn:socket:permissions",
+      "methodID": "socket.permissions",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:permissions"
+      ],
+      "resource": "socket",
+      "operation": "permissions",
+      "commandStart": "cn:socket:permissions",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "file-permissions?",
+      "minimalArgv": [
+        "cn:socket:permissions",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 372
+    },
+    {
+      "commandID": "cn:socket:direction",
+      "methodID": "socket.direction",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:socket:direction"
+      ],
+      "resource": "socket",
+      "operation": "direction",
+      "commandStart": "cn:socket:direction",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "into|out-of",
+      "minimalArgv": [
+        "cn:socket:direction",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 373
+    },
+    {
+      "commandID": "cn:boot-log:file",
+      "methodID": "bootLog.file",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:boot-log:file"
+      ],
+      "resource": "boot-log",
+      "operation": "file",
+      "commandStart": "cn:boot-log:file",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "boot-log",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--path"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--append"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        }
+      ],
+      "resultType": "reference:boot-log",
+      "minimalArgv": [
+        "cn:boot-log:file",
+        "example",
+        "--path",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 375
+    },
+    {
+      "commandID": "cn:network:vmnet-create",
+      "methodID": "network.vmnetCreate",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:vmnet-create"
+      ],
+      "resource": "network",
+      "operation": "vmnet-create",
+      "commandStart": "cn:network:vmnet-create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--mode"
+          ],
+          "type": "network-mode",
+          "required": false,
+          "repeatable": false,
+          "default": "shared"
+        },
+        {
+          "names": [
+            "--subnet"
+          ],
+          "type": "cidrv4",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--prefix-v6"
+          ],
+          "type": "cidrv6",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:network",
+      "minimalArgv": [
+        "cn:network:vmnet-create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 389
+    },
+    {
+      "commandID": "cn:network:subnet",
+      "methodID": "network.subnet",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:subnet"
+      ],
+      "resource": "network",
+      "operation": "subnet",
+      "commandStart": "cn:network:subnet",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "cidrv4",
+      "minimalArgv": [
+        "cn:network:subnet",
+        "@network/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 395
+    },
+    {
+      "commandID": "cn:network:prefix-v6",
+      "methodID": "network.prefixV6",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:prefix-v6"
+      ],
+      "resource": "network",
+      "operation": "prefix-v6",
+      "commandStart": "cn:network:prefix-v6",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "cidrv6?",
+      "minimalArgv": [
+        "cn:network:prefix-v6",
+        "@network/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 396
+    },
+    {
+      "commandID": "cn:network:ipv4-gateway",
+      "methodID": "network.ipv4Gateway",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:ipv4-gateway"
+      ],
+      "resource": "network",
+      "operation": "ipv4-gateway",
+      "commandStart": "cn:network:ipv4-gateway",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "ipv4-address",
+      "minimalArgv": [
+        "cn:network:ipv4-gateway",
+        "@network/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 397
+    },
+    {
+      "commandID": "cn:network:ipv6-gateway",
+      "methodID": "network.ipv6Gateway",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:ipv6-gateway"
+      ],
+      "resource": "network",
+      "operation": "ipv6-gateway",
+      "commandStart": "cn:network:ipv6-gateway",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "ipv6-address?",
+      "minimalArgv": [
+        "cn:network:ipv6-gateway",
+        "@network/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 398
+    },
+    {
+      "commandID": "cn:network:create-interface",
+      "methodID": "network.createInterface",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:create-interface"
+      ],
+      "resource": "network",
+      "operation": "create-interface",
+      "commandStart": "cn:network:create-interface",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "interface",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:interface?",
+      "minimalArgv": [
+        "cn:network:create-interface",
+        "@network/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 400
+    },
+    {
+      "commandID": "cn:network:create-interface-mtu",
+      "methodID": "network.createInterfaceMtu",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:create-interface-mtu"
+      ],
+      "resource": "network",
+      "operation": "create-interface-mtu",
+      "commandStart": "cn:network:create-interface-mtu",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "interface",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "mtu",
+          "type": "uint32",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:interface?",
+      "minimalArgv": [
+        "cn:network:create-interface-mtu",
+        "@network/example",
+        "example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 404
+    },
+    {
+      "commandID": "cn:network:create-interface-without-gateway",
+      "methodID": "network.createInterfaceWithoutGateway",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:create-interface-without-gateway"
+      ],
+      "resource": "network",
+      "operation": "create-interface-without-gateway",
+      "commandStart": "cn:network:create-interface-without-gateway",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "interface",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:interface?",
+      "minimalArgv": [
+        "cn:network:create-interface-without-gateway",
+        "@network/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 409
+    },
+    {
+      "commandID": "cn:network:release-interface",
+      "methodID": "network.releaseInterface",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:network:release-interface"
+      ],
+      "resource": "network",
+      "operation": "release-interface",
+      "commandStart": "cn:network:release-interface",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "network",
+          "type": "reference:network",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:network:release-interface",
+        "@network/example",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 413
+    },
+    {
+      "commandID": "cn:interface:nat-create",
+      "methodID": "interface.natCreate",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:nat-create"
+      ],
+      "resource": "interface",
+      "operation": "nat-create",
+      "commandStart": "cn:interface:nat-create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--ipv4-address"
+          ],
+          "type": "cidrv4",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--ipv4-gateway"
+          ],
+          "type": "ipv4-address",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--ipv6-address"
+          ],
+          "type": "cidrv6",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--ipv6-gateway"
+          ],
+          "type": "ipv6-address",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--mac-address"
+          ],
+          "type": "mac-address",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--mtu"
+          ],
+          "type": "uint32",
+          "required": false,
+          "repeatable": false,
+          "default": 1500
+        }
+      ],
+      "resultType": "reference:interface",
+      "minimalArgv": [
+        "cn:interface:nat-create",
+        "example",
+        "--ipv4-address",
+        "192.0.2.2/24"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 416
+    },
+    {
+      "commandID": "cn:interface:ipv4-address",
+      "methodID": "interface.ipv4Address",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:ipv4-address"
+      ],
+      "resource": "interface",
+      "operation": "ipv4-address",
+      "commandStart": "cn:interface:ipv4-address",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "cidrv4",
+      "minimalArgv": [
+        "cn:interface:ipv4-address",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 425
+    },
+    {
+      "commandID": "cn:interface:ipv4-gateway",
+      "methodID": "interface.ipv4Gateway",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:ipv4-gateway"
+      ],
+      "resource": "interface",
+      "operation": "ipv4-gateway",
+      "commandStart": "cn:interface:ipv4-gateway",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "ipv4-address?",
+      "minimalArgv": [
+        "cn:interface:ipv4-gateway",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 426
+    },
+    {
+      "commandID": "cn:interface:ipv6-address",
+      "methodID": "interface.ipv6Address",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:ipv6-address"
+      ],
+      "resource": "interface",
+      "operation": "ipv6-address",
+      "commandStart": "cn:interface:ipv6-address",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "cidrv6?",
+      "minimalArgv": [
+        "cn:interface:ipv6-address",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 427
+    },
+    {
+      "commandID": "cn:interface:ipv6-gateway",
+      "methodID": "interface.ipv6Gateway",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:ipv6-gateway"
+      ],
+      "resource": "interface",
+      "operation": "ipv6-gateway",
+      "commandStart": "cn:interface:ipv6-gateway",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "ipv6-address?",
+      "minimalArgv": [
+        "cn:interface:ipv6-gateway",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 428
+    },
+    {
+      "commandID": "cn:interface:mac-address",
+      "methodID": "interface.macAddress",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:mac-address"
+      ],
+      "resource": "interface",
+      "operation": "mac-address",
+      "commandStart": "cn:interface:mac-address",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "mac-address?",
+      "minimalArgv": [
+        "cn:interface:mac-address",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 429
+    },
+    {
+      "commandID": "cn:interface:mtu",
+      "methodID": "interface.mtu",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:interface:mtu"
+      ],
+      "resource": "interface",
+      "operation": "mtu",
+      "commandStart": "cn:interface:mtu",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint32",
+      "minimalArgv": [
+        "cn:interface:mtu",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 430
+    },
+    {
+      "commandID": "cn:vm-config:create",
+      "methodID": "vmConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-config:create"
+      ],
+      "resource": "vm-config",
+      "operation": "create",
+      "commandStart": "cn:vm-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "vm-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--cpus"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 4
+        },
+        {
+          "names": [
+            "--memory"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 1073741824
+        },
+        {
+          "names": [
+            "--interface"
+          ],
+          "type": "reference:interface",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--mount"
+          ],
+          "type": "string=reference:mount",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--boot-log"
+          ],
+          "type": "reference:boot-log",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:vm-config",
+      "minimalArgv": [
+        "cn:vm-config:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 439
+    },
+    {
+      "commandID": "cn:standard-vm-config:create",
+      "methodID": "standardVmConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:standard-vm-config:create"
+      ],
+      "resource": "standard-vm-config",
+      "operation": "create",
+      "commandStart": "cn:standard-vm-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "standard-vm-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "vm-config",
+          "type": "reference:vm-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:standard-vm-config",
+      "minimalArgv": [
+        "cn:standard-vm-config:create",
+        "example",
+        "@vm-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 448
+    },
+    {
+      "commandID": "cn:vmm:create",
+      "methodID": "vmm.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vmm:create"
+      ],
+      "resource": "vmm",
+      "operation": "create",
+      "commandStart": "cn:vmm:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "vmm",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--initial-filesystem"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rosetta"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:vmm",
+      "minimalArgv": [
+        "cn:vmm:create",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--initial-filesystem",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 452
+    },
+    {
+      "commandID": "cn:vmm:create-instance",
+      "methodID": "vmm.createInstance",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vmm:create-instance"
+      ],
+      "resource": "vmm",
+      "operation": "create-instance",
+      "commandStart": "cn:vmm:create-instance",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vmm",
+          "type": "reference:vmm",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "standard-vm-config",
+          "type": "reference:standard-vm-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:vm-instance",
+      "minimalArgv": [
+        "cn:vmm:create-instance",
+        "@vmm/example",
+        "@standard-vm-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 459
+    },
+    {
+      "commandID": "cn:vm-instance:state",
+      "methodID": "vmInstance.state",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:state"
+      ],
+      "resource": "vm-instance",
+      "operation": "state",
+      "commandStart": "cn:vm-instance:state",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "vm-state",
+      "minimalArgv": [
+        "cn:vm-instance:state",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 463
+    },
+    {
+      "commandID": "cn:vm-instance:mounts",
+      "methodID": "vmInstance.mounts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:mounts"
+      ],
+      "resource": "vm-instance",
+      "operation": "mounts",
+      "commandStart": "cn:vm-instance:mounts",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "attached-filesystem-map",
+      "minimalArgv": [
+        "cn:vm-instance:mounts",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 464
+    },
+    {
+      "commandID": "cn:vm-instance:virtiofs-layout",
+      "methodID": "vmInstance.virtiofsLayout",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:virtiofs-layout"
+      ],
+      "resource": "vm-instance",
+      "operation": "virtiofs-layout",
+      "commandStart": "cn:vm-instance:virtiofs-layout",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "virtiofs-layout",
+      "minimalArgv": [
+        "cn:vm-instance:virtiofs-layout",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 465
+    },
+    {
+      "commandID": "cn:vm-instance:start",
+      "methodID": "vmInstance.start",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:start"
+      ],
+      "resource": "vm-instance",
+      "operation": "start",
+      "commandStart": "cn:vm-instance:start",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:vm-instance:start",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 466
+    },
+    {
+      "commandID": "cn:vm-instance:stop",
+      "methodID": "vmInstance.stop",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:stop"
+      ],
+      "resource": "vm-instance",
+      "operation": "stop",
+      "commandStart": "cn:vm-instance:stop",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:vm-instance:stop",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 467
+    },
+    {
+      "commandID": "cn:vm-instance:pause",
+      "methodID": "vmInstance.pause",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:pause"
+      ],
+      "resource": "vm-instance",
+      "operation": "pause",
+      "commandStart": "cn:vm-instance:pause",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:vm-instance:pause",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 468
+    },
+    {
+      "commandID": "cn:vm-instance:resume",
+      "methodID": "vmInstance.resume",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:resume"
+      ],
+      "resource": "vm-instance",
+      "operation": "resume",
+      "commandStart": "cn:vm-instance:resume",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:vm-instance:resume",
+        "@vm-instance/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 469
+    },
+    {
+      "commandID": "cn:vm-instance:dial",
+      "methodID": "vmInstance.dial",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:vm-instance:dial"
+      ],
+      "resource": "vm-instance",
+      "operation": "dial",
+      "commandStart": "cn:vm-instance:dial",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "vm-instance",
+          "type": "reference:vm-instance",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "port",
+          "type": "uint32",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:file-handle",
+      "minimalArgv": [
+        "cn:vm-instance:dial",
+        "@vm-instance/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 471
+    },
+    {
+      "commandID": "cn:rlimit-kind:create",
+      "methodID": "rlimitKind.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit-kind:create"
+      ],
+      "resource": "rlimit-kind",
+      "operation": "create",
+      "commandStart": "cn:rlimit-kind:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "rlimit-kind",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "oci-name",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:rlimit-kind",
+      "minimalArgv": [
+        "cn:rlimit-kind:create",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 484
+    },
+    {
+      "commandID": "cn:rlimit:create",
+      "methodID": "rlimit.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:create"
+      ],
+      "resource": "rlimit",
+      "operation": "create",
+      "commandStart": "cn:rlimit:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kind"
+          ],
+          "type": "reference:rlimit-kind",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--hard"
+          ],
+          "type": "uint64",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--soft"
+          ],
+          "type": "uint64",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:rlimit",
+      "minimalArgv": [
+        "cn:rlimit:create",
+        "example",
+        "--kind",
+        "@rlimit-kind/example",
+        "--hard",
+        "1",
+        "--soft",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 488
+    },
+    {
+      "commandID": "cn:rlimit:create-equal",
+      "methodID": "rlimit.createEqual",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:create-equal"
+      ],
+      "resource": "rlimit",
+      "operation": "create-equal",
+      "commandStart": "cn:rlimit:create-equal",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kind"
+          ],
+          "type": "reference:rlimit-kind",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--limit"
+          ],
+          "type": "uint64",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:rlimit",
+      "minimalArgv": [
+        "cn:rlimit:create-equal",
+        "example",
+        "--kind",
+        "@rlimit-kind/example",
+        "--limit",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 494
+    },
+    {
+      "commandID": "cn:rlimit:kind",
+      "methodID": "rlimit.kind",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:kind"
+      ],
+      "resource": "rlimit",
+      "operation": "kind",
+      "commandStart": "cn:rlimit:kind",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "reference:rlimit",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:rlimit-kind",
+      "minimalArgv": [
+        "cn:rlimit:kind",
+        "@rlimit/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 499
+    },
+    {
+      "commandID": "cn:rlimit:hard",
+      "methodID": "rlimit.hard",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:hard"
+      ],
+      "resource": "rlimit",
+      "operation": "hard",
+      "commandStart": "cn:rlimit:hard",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "reference:rlimit",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:rlimit:hard",
+        "@rlimit/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 500
+    },
+    {
+      "commandID": "cn:rlimit:soft",
+      "methodID": "rlimit.soft",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:soft"
+      ],
+      "resource": "rlimit",
+      "operation": "soft",
+      "commandStart": "cn:rlimit:soft",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "reference:rlimit",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:rlimit:soft",
+        "@rlimit/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 501
+    },
+    {
+      "commandID": "cn:rlimit:to-oci",
+      "methodID": "rlimit.toOCI",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:rlimit:to-oci"
+      ],
+      "resource": "rlimit",
+      "operation": "to-oci",
+      "commandStart": "cn:rlimit:to-oci",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "rlimit",
+          "type": "reference:rlimit",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-posix-rlimit",
+      "minimalArgv": [
+        "cn:rlimit:to-oci",
+        "@rlimit/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 502
+    },
+    {
+      "commandID": "cn:capabilities:create",
+      "methodID": "capabilities.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:create"
+      ],
+      "resource": "capabilities",
+      "operation": "create",
+      "commandStart": "cn:capabilities:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--bounding"
+          ],
+          "type": "linux-capability",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--effective"
+          ],
+          "type": "linux-capability",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--inheritable"
+          ],
+          "type": "linux-capability",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--permitted"
+          ],
+          "type": "linux-capability",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--ambient"
+          ],
+          "type": "linux-capability",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:capabilities",
+      "minimalArgv": [
+        "cn:capabilities:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 504
+    },
+    {
+      "commandID": "cn:capabilities:create-uniform",
+      "methodID": "capabilities.createUniform",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:create-uniform"
+      ],
+      "resource": "capabilities",
+      "operation": "create-uniform",
+      "commandStart": "cn:capabilities:create-uniform",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "capability",
+          "type": "linux-capability",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "reference:capabilities",
+      "minimalArgv": [
+        "cn:capabilities:create-uniform",
+        "example",
+        "CAP_CHOWN"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 512
+    },
+    {
+      "commandID": "cn:capabilities:all",
+      "methodID": "capabilities.all",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:all"
+      ],
+      "resource": "capabilities",
+      "operation": "all",
+      "commandStart": "cn:capabilities:all",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:capabilities",
+      "minimalArgv": [
+        "cn:capabilities:all"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 516
+    },
+    {
+      "commandID": "cn:capabilities:default-oci",
+      "methodID": "capabilities.defaultOCI",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:default-oci"
+      ],
+      "resource": "capabilities",
+      "operation": "default-oci",
+      "commandStart": "cn:capabilities:default-oci",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:capabilities",
+      "minimalArgv": [
+        "cn:capabilities:default-oci"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 517
+    },
+    {
+      "commandID": "cn:capabilities:bounding",
+      "methodID": "capabilities.bounding",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:bounding"
+      ],
+      "resource": "capabilities",
+      "operation": "bounding",
+      "commandStart": "cn:capabilities:bounding",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "linux-capability[]",
+      "minimalArgv": [
+        "cn:capabilities:bounding",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 518
+    },
+    {
+      "commandID": "cn:capabilities:effective",
+      "methodID": "capabilities.effective",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:effective"
+      ],
+      "resource": "capabilities",
+      "operation": "effective",
+      "commandStart": "cn:capabilities:effective",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "linux-capability[]",
+      "minimalArgv": [
+        "cn:capabilities:effective",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 519
+    },
+    {
+      "commandID": "cn:capabilities:inheritable",
+      "methodID": "capabilities.inheritable",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:inheritable"
+      ],
+      "resource": "capabilities",
+      "operation": "inheritable",
+      "commandStart": "cn:capabilities:inheritable",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "linux-capability[]",
+      "minimalArgv": [
+        "cn:capabilities:inheritable",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 520
+    },
+    {
+      "commandID": "cn:capabilities:permitted",
+      "methodID": "capabilities.permitted",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:permitted"
+      ],
+      "resource": "capabilities",
+      "operation": "permitted",
+      "commandStart": "cn:capabilities:permitted",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "linux-capability[]",
+      "minimalArgv": [
+        "cn:capabilities:permitted",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 521
+    },
+    {
+      "commandID": "cn:capabilities:ambient",
+      "methodID": "capabilities.ambient",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:ambient"
+      ],
+      "resource": "capabilities",
+      "operation": "ambient",
+      "commandStart": "cn:capabilities:ambient",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "linux-capability[]",
+      "minimalArgv": [
+        "cn:capabilities:ambient",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 522
+    },
+    {
+      "commandID": "cn:capabilities:to-oci",
+      "methodID": "capabilities.toOCI",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:capabilities:to-oci"
+      ],
+      "resource": "capabilities",
+      "operation": "to-oci",
+      "commandStart": "cn:capabilities:to-oci",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "capabilities",
+          "type": "reference:capabilities",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-linux-capabilities",
+      "minimalArgv": [
+        "cn:capabilities:to-oci",
+        "@capabilities/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 523
+    },
+    {
+      "commandID": "cn:process-config:default-path",
+      "methodID": "processConfig.defaultPath",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:default-path"
+      ],
+      "resource": "process-config",
+      "operation": "default-path",
+      "commandStart": "cn:process-config:default-path",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:process-config:default-path"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 525
+    },
+    {
+      "commandID": "cn:process-config:create",
+      "methodID": "processConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:create"
+      ],
+      "resource": "process-config",
+      "operation": "create",
+      "commandStart": "cn:process-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "argument",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--environment"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--working-directory"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": "/"
+        },
+        {
+          "names": [
+            "--user"
+          ],
+          "type": "oci-user",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rlimit"
+          ],
+          "type": "reference:rlimit",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--no-new-privileges"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--capabilities"
+          ],
+          "type": "reference:capabilities",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--terminal"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--stdin"
+          ],
+          "type": "reference:reader-stream",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--stdout"
+          ],
+          "type": "reference:writer",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--stderr"
+          ],
+          "type": "reference:writer",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:process-config",
+      "minimalArgv": [
+        "cn:process-config:create",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 527
+    },
+    {
+      "commandID": "cn:process-config:from-image-config",
+      "methodID": "processConfig.fromImageConfig",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:from-image-config"
+      ],
+      "resource": "process-config",
+      "operation": "from-image-config",
+      "commandStart": "cn:process-config:from-image-config",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "image-config",
+          "type": "oci-image-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:process-config",
+      "minimalArgv": [
+        "cn:process-config:from-image-config",
+        "example",
+        "{}"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 541
+    },
+    {
+      "commandID": "cn:process-config:set-terminal-io",
+      "methodID": "processConfig.setTerminalIo",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:set-terminal-io"
+      ],
+      "resource": "process-config",
+      "operation": "set-terminal-io",
+      "commandStart": "cn:process-config:set-terminal-io",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "terminal",
+          "type": "reference:terminal",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process-config:set-terminal-io",
+        "@process-config/example",
+        "@terminal/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 545
+    },
+    {
+      "commandID": "cn:process-config:arguments",
+      "methodID": "processConfig.arguments",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:arguments"
+      ],
+      "resource": "process-config",
+      "operation": "arguments",
+      "commandStart": "cn:process-config:arguments",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:process-config:arguments",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 548
+    },
+    {
+      "commandID": "cn:process-config:environment-variables",
+      "methodID": "processConfig.environmentVariables",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:environment-variables"
+      ],
+      "resource": "process-config",
+      "operation": "environment-variables",
+      "commandStart": "cn:process-config:environment-variables",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string[]",
+      "minimalArgv": [
+        "cn:process-config:environment-variables",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 549
+    },
+    {
+      "commandID": "cn:process-config:working-directory",
+      "methodID": "processConfig.workingDirectory",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:working-directory"
+      ],
+      "resource": "process-config",
+      "operation": "working-directory",
+      "commandStart": "cn:process-config:working-directory",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:process-config:working-directory",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 550
+    },
+    {
+      "commandID": "cn:process-config:user",
+      "methodID": "processConfig.user",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:user"
+      ],
+      "resource": "process-config",
+      "operation": "user",
+      "commandStart": "cn:process-config:user",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-user",
+      "minimalArgv": [
+        "cn:process-config:user",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 551
+    },
+    {
+      "commandID": "cn:process-config:rlimits",
+      "methodID": "processConfig.rlimits",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:rlimits"
+      ],
+      "resource": "process-config",
+      "operation": "rlimits",
+      "commandStart": "cn:process-config:rlimits",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:rlimit[]",
+      "minimalArgv": [
+        "cn:process-config:rlimits",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 552
+    },
+    {
+      "commandID": "cn:process-config:no-new-privileges",
+      "methodID": "processConfig.noNewPrivileges",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:no-new-privileges"
+      ],
+      "resource": "process-config",
+      "operation": "no-new-privileges",
+      "commandStart": "cn:process-config:no-new-privileges",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool",
+      "minimalArgv": [
+        "cn:process-config:no-new-privileges",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 553
+    },
+    {
+      "commandID": "cn:process-config:capabilities",
+      "methodID": "processConfig.capabilities",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:capabilities"
+      ],
+      "resource": "process-config",
+      "operation": "capabilities",
+      "commandStart": "cn:process-config:capabilities",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:capabilities",
+      "minimalArgv": [
+        "cn:process-config:capabilities",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 554
+    },
+    {
+      "commandID": "cn:process-config:terminal",
+      "methodID": "processConfig.terminal",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:terminal"
+      ],
+      "resource": "process-config",
+      "operation": "terminal",
+      "commandStart": "cn:process-config:terminal",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool",
+      "minimalArgv": [
+        "cn:process-config:terminal",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 555
+    },
+    {
+      "commandID": "cn:process-config:stdin",
+      "methodID": "processConfig.stdin",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:stdin"
+      ],
+      "resource": "process-config",
+      "operation": "stdin",
+      "commandStart": "cn:process-config:stdin",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:reader-stream?",
+      "minimalArgv": [
+        "cn:process-config:stdin",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 556
+    },
+    {
+      "commandID": "cn:process-config:stdout",
+      "methodID": "processConfig.stdout",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:stdout"
+      ],
+      "resource": "process-config",
+      "operation": "stdout",
+      "commandStart": "cn:process-config:stdout",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:writer?",
+      "minimalArgv": [
+        "cn:process-config:stdout",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 557
+    },
+    {
+      "commandID": "cn:process-config:stderr",
+      "methodID": "processConfig.stderr",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process-config:stderr"
+      ],
+      "resource": "process-config",
+      "operation": "stderr",
+      "commandStart": "cn:process-config:stderr",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:writer?",
+      "minimalArgv": [
+        "cn:process-config:stderr",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 558
+    },
+    {
+      "commandID": "cn:container-config:create-default",
+      "methodID": "containerConfig.createDefault",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container-config:create-default"
+      ],
+      "resource": "container-config",
+      "operation": "create-default",
+      "commandStart": "cn:container-config:create-default",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "container-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:container-config",
+      "minimalArgv": [
+        "cn:container-config:create-default",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 567
+    },
+    {
+      "commandID": "cn:container-config:create",
+      "methodID": "containerConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container-config:create"
+      ],
+      "resource": "container-config",
+      "operation": "create",
+      "commandStart": "cn:container-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "container-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--process"
+          ],
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--cpus"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 4
+        },
+        {
+          "names": [
+            "--memory"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 1073741824
+        },
+        {
+          "names": [
+            "--hostname"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--sysctl"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--interface"
+          ],
+          "type": "reference:interface",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--socket"
+          ],
+          "type": "reference:socket",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--mount"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--masked-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--readonly-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--dns"
+          ],
+          "type": "reference:dns",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--hosts"
+          ],
+          "type": "reference:hosts",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--boot-log"
+          ],
+          "type": "reference:boot-log",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--oci-runtime-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--use-init"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--cpu-overhead"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 1
+        },
+        {
+          "names": [
+            "--memory-overhead"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 134217728
+        }
+      ],
+      "resultType": "reference:container-config",
+      "minimalArgv": [
+        "cn:container-config:create",
+        "example",
+        "--process",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 570
+    },
+    {
+      "commandID": "cn:container:default-mounts",
+      "methodID": "container.defaultMounts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:default-mounts"
+      ],
+      "resource": "container",
+      "operation": "default-mounts",
+      "commandStart": "cn:container:default-mounts",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:mount[]",
+      "minimalArgv": [
+        "cn:container:default-mounts"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 591
+    },
+    {
+      "commandID": "cn:container:default-oci-mounts",
+      "methodID": "container.defaultOCIMounts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:default-oci-mounts"
+      ],
+      "resource": "container",
+      "operation": "default-oci-mounts",
+      "commandStart": "cn:container:default-oci-mounts",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "oci-mount[]",
+      "minimalArgv": [
+        "cn:container:default-oci-mounts"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 592
+    },
+    {
+      "commandID": "cn:container:default-masked-paths",
+      "methodID": "container.defaultMaskedPaths",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:default-masked-paths"
+      ],
+      "resource": "container",
+      "operation": "default-masked-paths",
+      "commandStart": "cn:container:default-masked-paths",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "container-path[]",
+      "minimalArgv": [
+        "cn:container:default-masked-paths"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 593
+    },
+    {
+      "commandID": "cn:container:default-readonly-paths",
+      "methodID": "container.defaultReadonlyPaths",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:default-readonly-paths"
+      ],
+      "resource": "container",
+      "operation": "default-readonly-paths",
+      "commandStart": "cn:container:default-readonly-paths",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "container-path[]",
+      "minimalArgv": [
+        "cn:container:default-readonly-paths"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 594
+    },
+    {
+      "commandID": "cn:container:default-copy-chunk-size",
+      "methodID": "container.defaultCopyChunkSize",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:default-copy-chunk-size"
+      ],
+      "resource": "container",
+      "operation": "default-copy-chunk-size",
+      "commandStart": "cn:container:default-copy-chunk-size",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cn:container:default-copy-chunk-size"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 595
+    },
+    {
+      "commandID": "cn:container:max-id-length",
+      "methodID": "container.maxIDLength",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:max-id-length"
+      ],
+      "resource": "container",
+      "operation": "max-id-length",
+      "commandStart": "cn:container:max-id-length",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cn:container:max-id-length"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 596
+    },
+    {
+      "commandID": "cn:manager:create",
+      "methodID": "manager.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create"
+      ],
+      "resource": "manager",
+      "operation": "create",
+      "commandStart": "cn:manager:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--initfs"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--image-store"
+          ],
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--network"
+          ],
+          "type": "reference:network",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rosetta"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:manager",
+      "minimalArgv": [
+        "cn:manager:create",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--initfs",
+        "@mount/example",
+        "--image-store",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 605
+    },
+    {
+      "commandID": "cn:manager:create-at-root",
+      "methodID": "manager.createAtRoot",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-at-root"
+      ],
+      "resource": "manager",
+      "operation": "create-at-root",
+      "commandStart": "cn:manager:create-at-root",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--initfs"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--root"
+          ],
+          "type": "host-url",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--network"
+          ],
+          "type": "reference:network",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rosetta"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:manager",
+      "minimalArgv": [
+        "cn:manager:create-at-root",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--initfs",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 614
+    },
+    {
+      "commandID": "cn:manager:create-from-reference",
+      "methodID": "manager.createFromReference",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-from-reference"
+      ],
+      "resource": "manager",
+      "operation": "create-from-reference",
+      "commandStart": "cn:manager:create-from-reference",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--initfs-reference"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--image-store"
+          ],
+          "type": "reference:image-store",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--network"
+          ],
+          "type": "reference:network",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rosetta"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:manager",
+      "minimalArgv": [
+        "cn:manager:create-from-reference",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--initfs-reference",
+        "example",
+        "--image-store",
+        "@image-store/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 623
+    },
+    {
+      "commandID": "cn:manager:create-from-reference-at-root",
+      "methodID": "manager.createFromReferenceAtRoot",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-from-reference-at-root"
+      ],
+      "resource": "manager",
+      "operation": "create-from-reference-at-root",
+      "commandStart": "cn:manager:create-from-reference-at-root",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--kernel"
+          ],
+          "type": "reference:kernel",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--initfs-reference"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--root"
+          ],
+          "type": "host-url",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--network"
+          ],
+          "type": "reference:network",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rosetta"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--nested-virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:manager",
+      "minimalArgv": [
+        "cn:manager:create-from-reference-at-root",
+        "example",
+        "--kernel",
+        "@kernel/example",
+        "--initfs-reference",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 632
+    },
+    {
+      "commandID": "cn:manager:create-with-vmm",
+      "methodID": "manager.createWithVMM",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-with-vmm"
+      ],
+      "resource": "manager",
+      "operation": "create-with-vmm",
+      "commandStart": "cn:manager:create-with-vmm",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--vmm"
+          ],
+          "type": "reference:vmm",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--network"
+          ],
+          "type": "reference:network",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:manager",
+      "minimalArgv": [
+        "cn:manager:create-with-vmm",
+        "example",
+        "--vmm",
+        "@vmm/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 641
+    },
+    {
+      "commandID": "cn:manager:image-store",
+      "methodID": "manager.imageStore",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:image-store"
+      ],
+      "resource": "manager",
+      "operation": "image-store",
+      "commandStart": "cn:manager:image-store",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:image-store",
+      "minimalArgv": [
+        "cn:manager:image-store",
+        "@manager/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 646
+    },
+    {
+      "commandID": "cn:manager:create-container",
+      "methodID": "manager.createContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-container"
+      ],
+      "resource": "manager",
+      "operation": "create-container",
+      "commandStart": "cn:manager:create-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--reference"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rootfs-size"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 8589934592
+        },
+        {
+          "names": [
+            "--writable-layer-size"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--read-only"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--networking"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--process"
+          ],
+          "type": "reference:process-config",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpus"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hostname"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sysctl"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--interfaces"
+          ],
+          "type": "reference:interface",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sockets"
+          ],
+          "type": "reference:socket",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--mounts"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--masked-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--readonly-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--dns"
+          ],
+          "type": "reference:dns",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hosts"
+          ],
+          "type": "reference:hosts",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--boot-log"
+          ],
+          "type": "reference:boot-log",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--oci-runtime-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--use-init"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpu-overhead"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory-overhead"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        }
+      ],
+      "resultType": "reference:container",
+      "minimalArgv": [
+        "cn:manager:create-container",
+        "@manager/example",
+        "example",
+        "--reference",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 679,
+      "optionGroups": [
+        "containerConfigOverride"
+      ]
+    },
+    {
+      "commandID": "cn:manager:create-container-from-image",
+      "methodID": "manager.createContainerFromImage",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-container-from-image"
+      ],
+      "resource": "manager",
+      "operation": "create-container-from-image",
+      "commandStart": "cn:manager:create-container-from-image",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--image"
+          ],
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rootfs-size"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 8589934592
+        },
+        {
+          "names": [
+            "--writable-layer-size"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--read-only"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        },
+        {
+          "names": [
+            "--networking"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        },
+        {
+          "names": [
+            "--progress"
+          ],
+          "type": "reference:progress-handler",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--process"
+          ],
+          "type": "reference:process-config",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpus"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hostname"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sysctl"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--interfaces"
+          ],
+          "type": "reference:interface",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sockets"
+          ],
+          "type": "reference:socket",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--mounts"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--masked-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--readonly-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--dns"
+          ],
+          "type": "reference:dns",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hosts"
+          ],
+          "type": "reference:hosts",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--boot-log"
+          ],
+          "type": "reference:boot-log",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--oci-runtime-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--use-init"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpu-overhead"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory-overhead"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        }
+      ],
+      "resultType": "reference:container",
+      "minimalArgv": [
+        "cn:manager:create-container-from-image",
+        "@manager/example",
+        "example",
+        "--image",
+        "@image/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 690,
+      "optionGroups": [
+        "containerConfigOverride"
+      ]
+    },
+    {
+      "commandID": "cn:manager:create-container-from-mounts",
+      "methodID": "manager.createContainerFromMounts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:create-container-from-mounts"
+      ],
+      "resource": "manager",
+      "operation": "create-container-from-mounts",
+      "commandStart": "cn:manager:create-container-from-mounts",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--image"
+          ],
+          "type": "reference:image",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--rootfs"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--writable-layer"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--networking"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        },
+        {
+          "names": [
+            "--process"
+          ],
+          "type": "reference:process-config",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpus"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hostname"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sysctl"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--interfaces"
+          ],
+          "type": "reference:interface",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--sockets"
+          ],
+          "type": "reference:socket",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--mounts"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--masked-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--readonly-paths"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": true,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--dns"
+          ],
+          "type": "reference:dns",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--hosts"
+          ],
+          "type": "reference:hosts",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--virtualization"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--boot-log"
+          ],
+          "type": "reference:boot-log",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--oci-runtime-path"
+          ],
+          "type": "container-path",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--use-init"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--cpu-overhead"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        },
+        {
+          "names": [
+            "--memory-overhead"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": null,
+          "group": "containerConfigOverride"
+        }
+      ],
+      "resultType": "reference:container",
+      "minimalArgv": [
+        "cn:manager:create-container-from-mounts",
+        "@manager/example",
+        "example",
+        "--image",
+        "@image/example",
+        "--rootfs",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 701,
+      "optionGroups": [
+        "containerConfigOverride"
+      ]
+    },
+    {
+      "commandID": "cn:manager:release-network",
+      "methodID": "manager.releaseNetwork",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:release-network"
+      ],
+      "resource": "manager",
+      "operation": "release-network",
+      "commandStart": "cn:manager:release-network",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:manager:release-network",
+        "@manager/example",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 710
+    },
+    {
+      "commandID": "cn:manager:delete",
+      "methodID": "manager.delete",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:manager:delete"
+      ],
+      "resource": "manager",
+      "operation": "delete",
+      "commandStart": "cn:manager:delete",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "manager",
+          "type": "reference:manager",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:manager:delete",
+        "@manager/example",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 711
+    },
+    {
+      "commandID": "cn:container:create-direct",
+      "methodID": "container.createDirect",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:create-direct"
+      ],
+      "resource": "container",
+      "operation": "create-direct",
+      "commandStart": "cn:container:create-direct",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--rootfs"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--writable-layer"
+          ],
+          "type": "reference:mount",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--vmm"
+          ],
+          "type": "reference:vmm",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--configuration"
+          ],
+          "type": "reference:container-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:container",
+      "minimalArgv": [
+        "cn:container:create-direct",
+        "example",
+        "--rootfs",
+        "@mount/example",
+        "--vmm",
+        "@vmm/example",
+        "--configuration",
+        "@container-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 717
+    },
+    {
+      "commandID": "cn:container:id",
+      "methodID": "container.id",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:id"
+      ],
+      "resource": "container",
+      "operation": "id",
+      "commandStart": "cn:container:id",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:container:id",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 724
+    },
+    {
+      "commandID": "cn:container:rootfs",
+      "methodID": "container.rootfs",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:rootfs"
+      ],
+      "resource": "container",
+      "operation": "rootfs",
+      "commandStart": "cn:container:rootfs",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cn:container:rootfs",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 725
+    },
+    {
+      "commandID": "cn:container:writable-layer",
+      "methodID": "container.writableLayer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:writable-layer"
+      ],
+      "resource": "container",
+      "operation": "writable-layer",
+      "commandStart": "cn:container:writable-layer",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:mount?",
+      "minimalArgv": [
+        "cn:container:writable-layer",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 726
+    },
+    {
+      "commandID": "cn:container:config",
+      "methodID": "container.config",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:config"
+      ],
+      "resource": "container",
+      "operation": "config",
+      "commandStart": "cn:container:config",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:container-config",
+      "minimalArgv": [
+        "cn:container:config",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 727
+    },
+    {
+      "commandID": "cn:container:cpus",
+      "methodID": "container.cpus",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:cpus"
+      ],
+      "resource": "container",
+      "operation": "cpus",
+      "commandStart": "cn:container:cpus",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cn:container:cpus",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 728
+    },
+    {
+      "commandID": "cn:container:memory",
+      "methodID": "container.memory",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:memory"
+      ],
+      "resource": "container",
+      "operation": "memory",
+      "commandStart": "cn:container:memory",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:container:memory",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 729
+    },
+    {
+      "commandID": "cn:container:interfaces",
+      "methodID": "container.interfaces",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:interfaces"
+      ],
+      "resource": "container",
+      "operation": "interfaces",
+      "commandStart": "cn:container:interfaces",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:interface[]",
+      "minimalArgv": [
+        "cn:container:interfaces",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 730
+    },
+    {
+      "commandID": "cn:container:create",
+      "methodID": "container.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:create"
+      ],
+      "resource": "container",
+      "operation": "create",
+      "commandStart": "cn:container:create",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:create",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 732
+    },
+    {
+      "commandID": "cn:container:start",
+      "methodID": "container.start",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:start"
+      ],
+      "resource": "container",
+      "operation": "start",
+      "commandStart": "cn:container:start",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:start",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 733
+    },
+    {
+      "commandID": "cn:container:stop",
+      "methodID": "container.stop",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:stop"
+      ],
+      "resource": "container",
+      "operation": "stop",
+      "commandStart": "cn:container:stop",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:stop",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 734
+    },
+    {
+      "commandID": "cn:container:kill",
+      "methodID": "container.kill",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:kill"
+      ],
+      "resource": "container",
+      "operation": "kill",
+      "commandStart": "cn:container:kill",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "signal",
+          "type": "linux-signal",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:kill",
+        "@container/example",
+        "SIGTERM"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 735
+    },
+    {
+      "commandID": "cn:container:wait",
+      "methodID": "container.wait",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:wait"
+      ],
+      "resource": "container",
+      "operation": "wait",
+      "commandStart": "cn:container:wait",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--timeout-seconds"
+          ],
+          "type": "int64",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "exit-status",
+      "minimalArgv": [
+        "cn:container:wait",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 737
+    },
+    {
+      "commandID": "cn:container:resize",
+      "methodID": "container.resize",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:resize"
+      ],
+      "resource": "container",
+      "operation": "resize",
+      "commandStart": "cn:container:resize",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "width",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "height",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:resize",
+        "@container/example",
+        "1",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 741
+    },
+    {
+      "commandID": "cn:container:exec",
+      "methodID": "container.exec",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:exec"
+      ],
+      "resource": "container",
+      "operation": "exec",
+      "commandStart": "cn:container:exec",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "process",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--configuration"
+          ],
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:process",
+      "minimalArgv": [
+        "cn:container:exec",
+        "@container/example",
+        "example",
+        "--configuration",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 745
+    },
+    {
+      "commandID": "cn:container:dial-vsock",
+      "methodID": "container.dialVsock",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:dial-vsock"
+      ],
+      "resource": "container",
+      "operation": "dial-vsock",
+      "commandStart": "cn:container:dial-vsock",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "port",
+          "type": "uint32",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:file-handle",
+      "minimalArgv": [
+        "cn:container:dial-vsock",
+        "@container/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 750
+    },
+    {
+      "commandID": "cn:container:close-stdin",
+      "methodID": "container.closeStdin",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:close-stdin"
+      ],
+      "resource": "container",
+      "operation": "close-stdin",
+      "commandStart": "cn:container:close-stdin",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:close-stdin",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 754
+    },
+    {
+      "commandID": "cn:container:statistics",
+      "methodID": "container.statistics",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:statistics"
+      ],
+      "resource": "container",
+      "operation": "statistics",
+      "commandStart": "cn:container:statistics",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--category"
+          ],
+          "type": "statistics-category",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "container-statistics",
+      "minimalArgv": [
+        "cn:container:statistics",
+        "@container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 756
+    },
+    {
+      "commandID": "cn:container:filesystem-operation",
+      "methodID": "container.filesystemOperation",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:filesystem-operation"
+      ],
+      "resource": "container",
+      "operation": "filesystem-operation",
+      "commandStart": "cn:container:filesystem-operation",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "operation",
+          "type": "freeze|thaw|trim",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "path",
+          "type": "container-path",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:filesystem-operation",
+        "@container/example",
+        "freeze",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 760
+    },
+    {
+      "commandID": "cn:container:copy-in",
+      "methodID": "container.copyIn",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:copy-in"
+      ],
+      "resource": "container",
+      "operation": "copy-in",
+      "commandStart": "cn:container:copy-in",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "source",
+          "type": "host-url",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "destination",
+          "type": "container-url",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--mode"
+          ],
+          "type": "file-permissions",
+          "required": false,
+          "repeatable": false,
+          "default": "0644"
+        },
+        {
+          "names": [
+            "--create-parents"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        },
+        {
+          "names": [
+            "--chunk-size"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 1048576
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:copy-in",
+        "@container/example",
+        "/tmp/example",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 764
+    },
+    {
+      "commandID": "cn:container:copy-out",
+      "methodID": "container.copyOut",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:container:copy-out"
+      ],
+      "resource": "container",
+      "operation": "copy-out",
+      "commandStart": "cn:container:copy-out",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "container",
+          "type": "reference:container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "source",
+          "type": "container-url",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "destination",
+          "type": "host-url",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--create-parents"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": true
+        },
+        {
+          "names": [
+            "--chunk-size"
+          ],
+          "type": "int",
+          "required": false,
+          "repeatable": false,
+          "default": 1048576
+        }
+      ],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:container:copy-out",
+        "@container/example",
+        "/example",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 771
+    },
+    {
+      "commandID": "cn:process:id",
+      "methodID": "process.id",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:id"
+      ],
+      "resource": "process",
+      "operation": "id",
+      "commandStart": "cn:process:id",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:process:id",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 790
+    },
+    {
+      "commandID": "cn:process:owning-container",
+      "methodID": "process.owningContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:owning-container"
+      ],
+      "resource": "process",
+      "operation": "owning-container",
+      "commandStart": "cn:process:owning-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string?",
+      "minimalArgv": [
+        "cn:process:owning-container",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 791
+    },
+    {
+      "commandID": "cn:process:pid",
+      "methodID": "process.pid",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:pid"
+      ],
+      "resource": "process",
+      "operation": "pid",
+      "commandStart": "cn:process:pid",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "int32",
+      "minimalArgv": [
+        "cn:process:pid",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 792
+    },
+    {
+      "commandID": "cn:process:start",
+      "methodID": "process.start",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:start"
+      ],
+      "resource": "process",
+      "operation": "start",
+      "commandStart": "cn:process:start",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process:start",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 794
+    },
+    {
+      "commandID": "cn:process:kill",
+      "methodID": "process.kill",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:kill"
+      ],
+      "resource": "process",
+      "operation": "kill",
+      "commandStart": "cn:process:kill",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "signal",
+          "type": "linux-signal",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process:kill",
+        "@process/example",
+        "SIGTERM"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 795
+    },
+    {
+      "commandID": "cn:process:resize",
+      "methodID": "process.resize",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:resize"
+      ],
+      "resource": "process",
+      "operation": "resize",
+      "commandStart": "cn:process:resize",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "width",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "height",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process:resize",
+        "@process/example",
+        "1",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 797
+    },
+    {
+      "commandID": "cn:process:close-stdin",
+      "methodID": "process.closeStdin",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:close-stdin"
+      ],
+      "resource": "process",
+      "operation": "close-stdin",
+      "commandStart": "cn:process:close-stdin",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process:close-stdin",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 801
+    },
+    {
+      "commandID": "cn:process:wait",
+      "methodID": "process.wait",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:wait"
+      ],
+      "resource": "process",
+      "operation": "wait",
+      "commandStart": "cn:process:wait",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--timeout-seconds"
+          ],
+          "type": "int64",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "exit-status",
+      "minimalArgv": [
+        "cn:process:wait",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 803
+    },
+    {
+      "commandID": "cn:process:delete",
+      "methodID": "process.delete",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:process:delete"
+      ],
+      "resource": "process",
+      "operation": "delete",
+      "commandStart": "cn:process:delete",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "process",
+          "type": "reference:process",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:process:delete",
+        "@process/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 807
+    },
+    {
+      "commandID": "cn:pod-volume:create",
+      "methodID": "podVolume.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-volume:create"
+      ],
+      "resource": "pod-volume",
+      "operation": "create",
+      "commandStart": "cn:pod-volume:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "pod-volume",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--name"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--source"
+          ],
+          "type": "pod-volume-source",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--format"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:pod-volume",
+      "minimalArgv": [
+        "cn:pod-volume:create",
+        "example",
+        "--name",
+        "example",
+        "--source",
+        "{}",
+        "--format",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 818
+    },
+    {
+      "commandID": "cn:pod-config:create",
+      "methodID": "podConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:create"
+      ],
+      "resource": "pod-config",
+      "operation": "create",
+      "commandStart": "cn:pod-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:pod-config",
+      "minimalArgv": [
+        "cn:pod-config:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 824
+    },
+    {
+      "commandID": "cn:pod-config:set-cpus",
+      "methodID": "podConfig.setCPUs",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-cpus"
+      ],
+      "resource": "pod-config",
+      "operation": "set-cpus",
+      "commandStart": "cn:pod-config:set-cpus",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "cpus",
+          "type": "int",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-cpus",
+        "@pod-config/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 825
+    },
+    {
+      "commandID": "cn:pod-config:set-memory",
+      "methodID": "podConfig.setMemory",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-memory"
+      ],
+      "resource": "pod-config",
+      "operation": "set-memory",
+      "commandStart": "cn:pod-config:set-memory",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "bytes",
+          "type": "uint64",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-memory",
+        "@pod-config/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 826
+    },
+    {
+      "commandID": "cn:pod-config:set-interfaces",
+      "methodID": "podConfig.setInterfaces",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-interfaces"
+      ],
+      "resource": "pod-config",
+      "operation": "set-interfaces",
+      "commandStart": "cn:pod-config:set-interfaces",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "interface",
+          "type": "reference:interface",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-interfaces",
+        "@pod-config/example",
+        "@interface/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 827
+    },
+    {
+      "commandID": "cn:pod-config:set-virtualization",
+      "methodID": "podConfig.setVirtualization",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-virtualization"
+      ],
+      "resource": "pod-config",
+      "operation": "set-virtualization",
+      "commandStart": "cn:pod-config:set-virtualization",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "enabled",
+          "type": "bool",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-virtualization",
+        "@pod-config/example",
+        "true"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 828
+    },
+    {
+      "commandID": "cn:pod-config:set-boot-log",
+      "methodID": "podConfig.setBootLog",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-boot-log"
+      ],
+      "resource": "pod-config",
+      "operation": "set-boot-log",
+      "commandStart": "cn:pod-config:set-boot-log",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "boot-log",
+          "type": "reference:boot-log?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-boot-log",
+        "@pod-config/example",
+        "@boot-log/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 829
+    },
+    {
+      "commandID": "cn:pod-config:set-share-process-namespace",
+      "methodID": "podConfig.setShareProcessNamespace",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-share-process-namespace"
+      ],
+      "resource": "pod-config",
+      "operation": "set-share-process-namespace",
+      "commandStart": "cn:pod-config:set-share-process-namespace",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "enabled",
+          "type": "bool",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-share-process-namespace",
+        "@pod-config/example",
+        "true"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 830
+    },
+    {
+      "commandID": "cn:pod-config:set-hostname",
+      "methodID": "podConfig.setHostname",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-hostname"
+      ],
+      "resource": "pod-config",
+      "operation": "set-hostname",
+      "commandStart": "cn:pod-config:set-hostname",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "hostname",
+          "type": "string?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-hostname",
+        "@pod-config/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 831
+    },
+    {
+      "commandID": "cn:pod-config:set-dns",
+      "methodID": "podConfig.setDNS",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-dns"
+      ],
+      "resource": "pod-config",
+      "operation": "set-dns",
+      "commandStart": "cn:pod-config:set-dns",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "dns",
+          "type": "reference:dns?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-dns",
+        "@pod-config/example",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 832
+    },
+    {
+      "commandID": "cn:pod-config:set-hosts",
+      "methodID": "podConfig.setHosts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-hosts"
+      ],
+      "resource": "pod-config",
+      "operation": "set-hosts",
+      "commandStart": "cn:pod-config:set-hosts",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "hosts",
+          "type": "reference:hosts?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-hosts",
+        "@pod-config/example",
+        "@hosts/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 833
+    },
+    {
+      "commandID": "cn:pod-config:set-volumes",
+      "methodID": "podConfig.setVolumes",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-config:set-volumes"
+      ],
+      "resource": "pod-config",
+      "operation": "set-volumes",
+      "commandStart": "cn:pod-config:set-volumes",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-config",
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-volume",
+          "type": "reference:pod-volume",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-config:set-volumes",
+        "@pod-config/example",
+        "@pod-volume/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 834
+    },
+    {
+      "commandID": "cn:pod-container-config:create",
+      "methodID": "podContainerConfig.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:create"
+      ],
+      "resource": "pod-container-config",
+      "operation": "create",
+      "commandStart": "cn:pod-container-config:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:pod-container-config",
+      "minimalArgv": [
+        "cn:pod-container-config:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 836
+    },
+    {
+      "commandID": "cn:pod-container-config:set-process",
+      "methodID": "podContainerConfig.setProcess",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-process"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-process",
+      "commandStart": "cn:pod-container-config:set-process",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "process-config",
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-process",
+        "@pod-container-config/example",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 837
+    },
+    {
+      "commandID": "cn:pod-container-config:set-cpus",
+      "methodID": "podContainerConfig.setCPUs",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-cpus"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-cpus",
+      "commandStart": "cn:pod-container-config:set-cpus",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "cpus",
+          "type": "int?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-cpus",
+        "@pod-container-config/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 838
+    },
+    {
+      "commandID": "cn:pod-container-config:set-memory",
+      "methodID": "podContainerConfig.setMemory",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-memory"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-memory",
+      "commandStart": "cn:pod-container-config:set-memory",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "bytes",
+          "type": "uint64?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-memory",
+        "@pod-container-config/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 839
+    },
+    {
+      "commandID": "cn:pod-container-config:set-hostname",
+      "methodID": "podContainerConfig.setHostname",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-hostname"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-hostname",
+      "commandStart": "cn:pod-container-config:set-hostname",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "hostname",
+          "type": "string?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-hostname",
+        "@pod-container-config/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 840
+    },
+    {
+      "commandID": "cn:pod-container-config:set-sysctl",
+      "methodID": "podContainerConfig.setSysctl",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-sysctl"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-sysctl",
+      "commandStart": "cn:pod-container-config:set-sysctl",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "key-value",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-sysctl",
+        "@pod-container-config/example",
+        "key=value"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 841
+    },
+    {
+      "commandID": "cn:pod-container-config:set-mounts",
+      "methodID": "podContainerConfig.setMounts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-mounts"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-mounts",
+      "commandStart": "cn:pod-container-config:set-mounts",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "mount",
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-mounts",
+        "@pod-container-config/example",
+        "@mount/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 842
+    },
+    {
+      "commandID": "cn:pod-container-config:set-masked-paths",
+      "methodID": "podContainerConfig.setMaskedPaths",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-masked-paths"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-masked-paths",
+      "commandStart": "cn:pod-container-config:set-masked-paths",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "path",
+          "type": "container-path",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-masked-paths",
+        "@pod-container-config/example",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 843
+    },
+    {
+      "commandID": "cn:pod-container-config:set-readonly-paths",
+      "methodID": "podContainerConfig.setReadonlyPaths",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-readonly-paths"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-readonly-paths",
+      "commandStart": "cn:pod-container-config:set-readonly-paths",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "path",
+          "type": "container-path",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-readonly-paths",
+        "@pod-container-config/example",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 844
+    },
+    {
+      "commandID": "cn:pod-container-config:set-sockets",
+      "methodID": "podContainerConfig.setSockets",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-sockets"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-sockets",
+      "commandStart": "cn:pod-container-config:set-sockets",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-sockets",
+        "@pod-container-config/example",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 845
+    },
+    {
+      "commandID": "cn:pod-container-config:set-dns",
+      "methodID": "podContainerConfig.setDNS",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-dns"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-dns",
+      "commandStart": "cn:pod-container-config:set-dns",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "dns",
+          "type": "reference:dns?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-dns",
+        "@pod-container-config/example",
+        "@dns/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 846
+    },
+    {
+      "commandID": "cn:pod-container-config:set-hosts",
+      "methodID": "podContainerConfig.setHosts",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-hosts"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-hosts",
+      "commandStart": "cn:pod-container-config:set-hosts",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "hosts",
+          "type": "reference:hosts?",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-hosts",
+        "@pod-container-config/example",
+        "@hosts/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 847
+    },
+    {
+      "commandID": "cn:pod-container-config:set-use-init",
+      "methodID": "podContainerConfig.setUseInit",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod-container-config:set-use-init"
+      ],
+      "resource": "pod-container-config",
+      "operation": "set-use-init",
+      "commandStart": "cn:pod-container-config:set-use-init",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod-container-config",
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "enabled",
+          "type": "bool",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod-container-config:set-use-init",
+        "@pod-container-config/example",
+        "true"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 848
+    },
+    {
+      "commandID": "cn:pod:create-direct",
+      "methodID": "pod.createDirect",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:create-direct"
+      ],
+      "resource": "pod",
+      "operation": "create-direct",
+      "commandStart": "cn:pod:create-direct",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--vmm"
+          ],
+          "type": "reference:vmm",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--configuration"
+          ],
+          "type": "reference:pod-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:pod",
+      "minimalArgv": [
+        "cn:pod:create-direct",
+        "example",
+        "--vmm",
+        "@vmm/example",
+        "--configuration",
+        "@pod-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 850
+    },
+    {
+      "commandID": "cn:pod:id",
+      "methodID": "pod.id",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:id"
+      ],
+      "resource": "pod",
+      "operation": "id",
+      "commandStart": "cn:pod:id",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cn:pod:id",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 855
+    },
+    {
+      "commandID": "cn:pod:config",
+      "methodID": "pod.config",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:config"
+      ],
+      "resource": "pod",
+      "operation": "config",
+      "commandStart": "cn:pod:config",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:pod-config",
+      "minimalArgv": [
+        "cn:pod:config",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 856
+    },
+    {
+      "commandID": "cn:pod:cpus",
+      "methodID": "pod.cpus",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:cpus"
+      ],
+      "resource": "pod",
+      "operation": "cpus",
+      "commandStart": "cn:pod:cpus",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cn:pod:cpus",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 857
+    },
+    {
+      "commandID": "cn:pod:memory",
+      "methodID": "pod.memory",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:memory"
+      ],
+      "resource": "pod",
+      "operation": "memory",
+      "commandStart": "cn:pod:memory",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cn:pod:memory",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 858
+    },
+    {
+      "commandID": "cn:pod:interfaces",
+      "methodID": "pod.interfaces",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:interfaces"
+      ],
+      "resource": "pod",
+      "operation": "interfaces",
+      "commandStart": "cn:pod:interfaces",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:interface[]",
+      "minimalArgv": [
+        "cn:pod:interfaces",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 859
+    },
+    {
+      "commandID": "cn:pod:add-container",
+      "methodID": "pod.addContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:add-container"
+      ],
+      "resource": "pod",
+      "operation": "add-container",
+      "commandStart": "cn:pod:add-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "container",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--rootfs"
+          ],
+          "type": "reference:mount",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--configuration"
+          ],
+          "type": "reference:pod-container-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:pod-container",
+      "minimalArgv": [
+        "cn:pod:add-container",
+        "@pod/example",
+        "example",
+        "--rootfs",
+        "@mount/example",
+        "--configuration",
+        "@pod-container-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 861
+    },
+    {
+      "commandID": "cn:pod:create",
+      "methodID": "pod.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:create"
+      ],
+      "resource": "pod",
+      "operation": "create",
+      "commandStart": "cn:pod:create",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:create",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 867
+    },
+    {
+      "commandID": "cn:pod:start-container",
+      "methodID": "pod.startContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:start-container"
+      ],
+      "resource": "pod",
+      "operation": "start-container",
+      "commandStart": "cn:pod:start-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:start-container",
+        "@pod/example",
+        "@pod-container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 868
+    },
+    {
+      "commandID": "cn:pod:stop-container",
+      "methodID": "pod.stopContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:stop-container"
+      ],
+      "resource": "pod",
+      "operation": "stop-container",
+      "commandStart": "cn:pod:stop-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:stop-container",
+        "@pod/example",
+        "@pod-container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 869
+    },
+    {
+      "commandID": "cn:pod:stop",
+      "methodID": "pod.stop",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:stop"
+      ],
+      "resource": "pod",
+      "operation": "stop",
+      "commandStart": "cn:pod:stop",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:stop",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 870
+    },
+    {
+      "commandID": "cn:pod:kill-container",
+      "methodID": "pod.killContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:kill-container"
+      ],
+      "resource": "pod",
+      "operation": "kill-container",
+      "commandStart": "cn:pod:kill-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "signal",
+          "type": "linux-signal",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:kill-container",
+        "@pod/example",
+        "@pod-container/example",
+        "SIGTERM"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 871
+    },
+    {
+      "commandID": "cn:pod:wait-container",
+      "methodID": "pod.waitContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:wait-container"
+      ],
+      "resource": "pod",
+      "operation": "wait-container",
+      "commandStart": "cn:pod:wait-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--timeout-seconds"
+          ],
+          "type": "int64",
+          "required": false,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "exit-status",
+      "minimalArgv": [
+        "cn:pod:wait-container",
+        "@pod/example",
+        "@pod-container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 873
+    },
+    {
+      "commandID": "cn:pod:resize-container",
+      "methodID": "pod.resizeContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:resize-container"
+      ],
+      "resource": "pod",
+      "operation": "resize-container",
+      "commandStart": "cn:pod:resize-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "width",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "height",
+          "type": "uint16",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:resize-container",
+        "@pod/example",
+        "@pod-container/example",
+        "1",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 878
+    },
+    {
+      "commandID": "cn:pod:exec-in-container",
+      "methodID": "pod.execInContainer",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:exec-in-container"
+      ],
+      "resource": "pod",
+      "operation": "exec-in-container",
+      "commandStart": "cn:pod:exec-in-container",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "process",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--configuration"
+          ],
+          "type": "reference:process-config",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:process",
+      "minimalArgv": [
+        "cn:pod:exec-in-container",
+        "@pod/example",
+        "@pod-container/example",
+        "example",
+        "--configuration",
+        "@process-config/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 883
+    },
+    {
+      "commandID": "cn:pod:list-containers",
+      "methodID": "pod.listContainers",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:list-containers"
+      ],
+      "resource": "pod",
+      "operation": "list-containers",
+      "commandStart": "cn:pod:list-containers",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:pod-container[]",
+      "minimalArgv": [
+        "cn:pod:list-containers",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 889
+    },
+    {
+      "commandID": "cn:pod:statistics",
+      "methodID": "pod.statistics",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:statistics"
+      ],
+      "resource": "pod",
+      "operation": "statistics",
+      "commandStart": "cn:pod:statistics",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--container"
+          ],
+          "type": "reference:pod-container",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        },
+        {
+          "names": [
+            "--category"
+          ],
+          "type": "statistics-category",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "container-statistics[]",
+      "minimalArgv": [
+        "cn:pod:statistics",
+        "@pod/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 891
+    },
+    {
+      "commandID": "cn:pod:dial-vsock",
+      "methodID": "pod.dialVsock",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:dial-vsock"
+      ],
+      "resource": "pod",
+      "operation": "dial-vsock",
+      "commandStart": "cn:pod:dial-vsock",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "port",
+          "type": "uint32",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:file-handle",
+      "minimalArgv": [
+        "cn:pod:dial-vsock",
+        "@pod/example",
+        "1"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 896
+    },
+    {
+      "commandID": "cn:pod:filesystem-operation",
+      "methodID": "pod.filesystemOperation",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:filesystem-operation"
+      ],
+      "resource": "pod",
+      "operation": "filesystem-operation",
+      "commandStart": "cn:pod:filesystem-operation",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "operation",
+          "type": "freeze|thaw|trim",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "path",
+          "type": "container-path",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:filesystem-operation",
+        "@pod/example",
+        "@pod-container/example",
+        "freeze",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 900
+    },
+    {
+      "commandID": "cn:pod:close-container-stdin",
+      "methodID": "pod.closeContainerStdin",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:close-container-stdin"
+      ],
+      "resource": "pod",
+      "operation": "close-container-stdin",
+      "commandStart": "cn:pod:close-container-stdin",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:close-container-stdin",
+        "@pod/example",
+        "@pod-container/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 905
+    },
+    {
+      "commandID": "cn:pod:relay-unix-socket",
+      "methodID": "pod.relayUnixSocket",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:pod:relay-unix-socket"
+      ],
+      "resource": "pod",
+      "operation": "relay-unix-socket",
+      "commandStart": "cn:pod:relay-unix-socket",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "pod",
+          "type": "reference:pod",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "pod-container",
+          "type": "reference:pod-container",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "socket",
+          "type": "reference:socket",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cn:pod:relay-unix-socket",
+        "@pod/example",
+        "@pod-container/example",
+        "@socket/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 907
+    },
+    {
+      "commandID": "cn:content-store:create",
+      "methodID": "contentStore.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:content-store:create"
+      ],
+      "resource": "content-store",
+      "operation": "create",
+      "commandStart": "cn:content-store:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "content-store",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--path"
+          ],
+          "type": "host-url",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:content-store",
+      "minimalArgv": [
+        "cn:content-store:create",
+        "example",
+        "--path",
+        "/tmp/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 915
+    },
+    {
+      "commandID": "cn:authentication:create-basic",
+      "methodID": "authentication.createBasic",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:authentication:create-basic"
+      ],
+      "resource": "authentication",
+      "operation": "create-basic",
+      "commandStart": "cn:authentication:create-basic",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "authentication",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--username"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--password"
+          ],
+          "type": "string",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:authentication",
+      "minimalArgv": [
+        "cn:authentication:create-basic",
+        "example",
+        "--username",
+        "example",
+        "--password",
+        "example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 919
+    },
+    {
+      "commandID": "cn:progress-handler:create",
+      "methodID": "progressHandler.create",
+      "namespace": "cn",
+      "sourceKind": "direct",
+      "aliases": [
+        "containerization:progress-handler:create"
+      ],
+      "resource": "progress-handler",
+      "operation": "create",
+      "commandStart": "cn:progress-handler:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "progress-handler",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--writer"
+          ],
+          "type": "reference:writer",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        }
+      ],
+      "resultType": "reference:progress-handler",
+      "minimalArgv": [
+        "cn:progress-handler:create",
+        "example",
+        "--writer",
+        "@writer/example"
+      ],
+      "source": "GHOSTBOX_CLI_TEMPLATE.md",
+      "sourceLine": 924
+    },
+    {
+      "commandID": "cr:volume:create",
+      "methodID": "volume.create",
+      "namespace": "cr",
+      "sourceKind": "ghostvm-adapter",
+      "aliases": [
+        "container:volume:create"
+      ],
+      "resource": "volume",
+      "operation": "create",
+      "commandStart": "cr:volume:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "volume",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--size"
+          ],
+          "type": "uint64",
+          "required": false,
+          "repeatable": false,
+          "default": 8589934592
+        }
+      ],
+      "resultType": "reference:volume",
+      "minimalArgv": [
+        "cr:volume:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 23,
+      "swiftModule": "GhostVMContainerRuntime",
+      "swiftSymbol": "GhostboxVolumeStore.create(name:sizeInBytes:)",
+      "swiftSource": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift:32",
+      "documentationURL": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L32-L85"
+    },
+    {
+      "commandID": "cr:volume:list",
+      "methodID": "volume.list",
+      "namespace": "cr",
+      "sourceKind": "ghostvm-adapter",
+      "aliases": [
+        "container:volume:list"
+      ],
+      "resource": "volume",
+      "operation": "list",
+      "commandStart": "cr:volume:list",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "reference:volume[]",
+      "minimalArgv": [
+        "cr:volume:list"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 27,
+      "swiftModule": "GhostVMContainerRuntime",
+      "swiftSymbol": "GhostboxVolumeStore.list()",
+      "swiftSource": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift:88",
+      "documentationURL": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L88-L91"
+    },
+    {
+      "commandID": "cr:volume:inspect",
+      "methodID": "volume.inspect",
+      "namespace": "cr",
+      "sourceKind": "ghostvm-adapter",
+      "aliases": [
+        "container:volume:inspect"
+      ],
+      "resource": "volume",
+      "operation": "inspect",
+      "commandStart": "cr:volume:inspect",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "volume",
+          "type": "reference:volume",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "volume-metadata",
+      "minimalArgv": [
+        "cr:volume:inspect",
+        "@volume/example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 28,
+      "swiftModule": "GhostVMContainerRuntime",
+      "swiftSymbol": "GhostboxVolumeStore.inspect(name:)",
+      "swiftSource": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift:93",
+      "documentationURL": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L93-L96"
+    },
+    {
+      "commandID": "cr:volume:mount",
+      "methodID": "volume.mount",
+      "namespace": "cr",
+      "sourceKind": "ghostvm-adapter",
+      "aliases": [
+        "container:volume:mount"
+      ],
+      "resource": "volume",
+      "operation": "mount",
+      "commandStart": "cr:volume:mount",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "volume",
+          "type": "reference:volume",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "mount",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--destination"
+          ],
+          "type": "container-path",
+          "required": true,
+          "repeatable": false,
+          "default": null
+        },
+        {
+          "names": [
+            "--read-only"
+          ],
+          "type": "bool",
+          "required": false,
+          "repeatable": false,
+          "default": false
+        }
+      ],
+      "resultType": "reference:mount",
+      "minimalArgv": [
+        "cr:volume:mount",
+        "@volume/example",
+        "example",
+        "--destination",
+        "/example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 30,
+      "swiftModule": "GhostVMContainerRuntime",
+      "swiftSymbol": "GhostboxVolumeStore.makeMount(volumeName:mountReference:destination:readOnly:)",
+      "swiftSource": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift:110",
+      "documentationURL": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L110-L130"
+    },
+    {
+      "commandID": "cr:volume:delete",
+      "methodID": "volume.delete",
+      "namespace": "cr",
+      "sourceKind": "ghostvm-adapter",
+      "aliases": [
+        "container:volume:delete"
+      ],
+      "resource": "volume",
+      "operation": "delete",
+      "commandStart": "cr:volume:delete",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "volume",
+          "type": "reference:volume",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cr:volume:delete",
+        "@volume/example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 36,
+      "swiftModule": "GhostVMContainerRuntime",
+      "swiftSymbol": "GhostboxVolumeStore.delete(name:)",
+      "swiftSource": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift:98",
+      "documentationURL": "macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L98-L108"
+    },
+    {
+      "commandID": "cr:memory-size:create",
+      "methodID": "crMemorySize.create",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:memory-size:create"
+      ],
+      "resource": "memory-size",
+      "operation": "create",
+      "commandStart": "cr:memory-size:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "memory-size",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "value",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "reference:memory-size",
+      "minimalArgv": [
+        "cr:memory-size:create",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 47,
+      "swiftModule": "ContainerPersistence",
+      "swiftSymbol": "MemorySize.init(_:)",
+      "swiftSource": "Sources/ContainerPersistence/MemorySize.swift:27",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L27-L29"
+    },
+    {
+      "commandID": "cr:memory-size:formatted",
+      "methodID": "crMemorySize.formatted",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:memory-size:formatted"
+      ],
+      "resource": "memory-size",
+      "operation": "formatted",
+      "commandStart": "cr:memory-size:formatted",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "memory-size",
+          "type": "reference:memory-size",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string",
+      "minimalArgv": [
+        "cr:memory-size:formatted",
+        "@memory-size/example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 50,
+      "swiftModule": "ContainerPersistence",
+      "swiftSymbol": "MemorySize.formatted",
+      "swiftSource": "Sources/ContainerPersistence/MemorySize.swift:51",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L51-L55"
+    },
+    {
+      "commandID": "cr:memory-size:to-uint64",
+      "methodID": "crMemorySize.toUInt64",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:memory-size:to-uint64"
+      ],
+      "resource": "memory-size",
+      "operation": "to-uint64",
+      "commandStart": "cr:memory-size:to-uint64",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "memory-size",
+          "type": "reference:memory-size",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "unit",
+          "type": "bytes|kibibytes|mebibytes|gibibytes|tebibytes|pebibytes",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cr:memory-size:to-uint64",
+        "@memory-size/example",
+        "bytes"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 52,
+      "swiftModule": "ContainerPersistence",
+      "swiftSymbol": "MemorySize.toUInt64(unit:)",
+      "swiftSource": "Sources/ContainerPersistence/MemorySize.swift:59",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L59-L61"
+    },
+    {
+      "commandID": "cr:resource-labels:create",
+      "methodID": "crResourceLabels.create",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:create"
+      ],
+      "resource": "resource-labels",
+      "operation": "create",
+      "commandStart": "cr:resource-labels:create",
+      "commandShape": "create",
+      "positionals": [
+        {
+          "name": "resource-labels",
+          "type": "name",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--label"
+          ],
+          "type": "string",
+          "required": false,
+          "repeatable": true,
+          "default": null
+        }
+      ],
+      "resultType": "reference:resource-labels",
+      "minimalArgv": [
+        "cr:resource-labels:create",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 64,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.init(_:)",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:39",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L39-L44"
+    },
+    {
+      "commandID": "cr:resource-labels:validate-key",
+      "methodID": "crResourceLabels.validateKey",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:validate-key"
+      ],
+      "resource": "resource-labels",
+      "operation": "validate-key",
+      "commandStart": "cr:resource-labels:validate-key",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "key",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cr:resource-labels:validate-key",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 68,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.validateLabelKey(_:)",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:46",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L46-L57"
+    },
+    {
+      "commandID": "cr:resource-labels:validate",
+      "methodID": "crResourceLabels.validate",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:validate"
+      ],
+      "resource": "resource-labels",
+      "operation": "validate",
+      "commandStart": "cr:resource-labels:validate",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "key",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "value",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "void",
+      "minimalArgv": [
+        "cr:resource-labels:validate",
+        "example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 69,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.validateLabel(key:value:)",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:59",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L59-L65"
+    },
+    {
+      "commandID": "cr:resource-labels:dictionary",
+      "methodID": "crResourceLabels.dictionary",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:dictionary"
+      ],
+      "resource": "resource-labels",
+      "operation": "dictionary",
+      "commandStart": "cr:resource-labels:dictionary",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "resource-labels",
+          "type": "reference:resource-labels",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string-map",
+      "minimalArgv": [
+        "cr:resource-labels:dictionary",
+        "@resource-labels/example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 70,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.dictionary",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:25",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L25"
+    },
+    {
+      "commandID": "cr:resource-labels:value",
+      "methodID": "crResourceLabels.value",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:value"
+      ],
+      "resource": "resource-labels",
+      "operation": "value",
+      "commandStart": "cr:resource-labels:value",
+      "commandShape": "reference",
+      "positionals": [
+        {
+          "name": "resource-labels",
+          "type": "reference:resource-labels",
+          "required": true,
+          "repeatable": false
+        },
+        {
+          "name": "key",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "string?",
+      "minimalArgv": [
+        "cr:resource-labels:value",
+        "@resource-labels/example",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 72,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.subscript(_:)",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:90",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L89-L92"
+    },
+    {
+      "commandID": "cr:resource-labels:key-length-max",
+      "methodID": "crResourceLabels.keyLengthMax",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:key-length-max"
+      ],
+      "resource": "resource-labels",
+      "operation": "key-length-max",
+      "commandStart": "cr:resource-labels:key-length-max",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cr:resource-labels:key-length-max"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 76,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.keyLengthMax",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:21",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L21"
+    },
+    {
+      "commandID": "cr:resource-labels:label-length-max",
+      "methodID": "crResourceLabels.labelLengthMax",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:resource-labels:label-length-max"
+      ],
+      "resource": "resource-labels",
+      "operation": "label-length-max",
+      "commandStart": "cr:resource-labels:label-length-max",
+      "commandShape": "static",
+      "positionals": [],
+      "options": [],
+      "resultType": "int",
+      "minimalArgv": [
+        "cr:resource-labels:label-length-max"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 77,
+      "swiftModule": "ContainerResource",
+      "swiftSymbol": "ResourceLabels.labelLengthMax",
+      "swiftSource": "Sources/ContainerResource/Common/ResourceLabels.swift:23",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L23"
+    },
+    {
+      "commandID": "cr:parser:memory-as-mib",
+      "methodID": "crParser.memoryAsMiB",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:memory-as-mib"
+      ],
+      "resource": "parser",
+      "operation": "memory-as-mib",
+      "commandStart": "cr:parser:memory-as-mib",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "memory",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "int64",
+      "minimalArgv": [
+        "cr:parser:memory-as-mib",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 87,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.memoryStringAsMiB(_:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:57",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L57-L61"
+    },
+    {
+      "commandID": "cr:parser:memory-as-bytes",
+      "methodID": "crParser.memoryAsBytes",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:memory-as-bytes"
+      ],
+      "resource": "parser",
+      "operation": "memory-as-bytes",
+      "commandStart": "cr:parser:memory-as-bytes",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "memory",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "uint64",
+      "minimalArgv": [
+        "cr:parser:memory-as-bytes",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 88,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.memoryStringAsBytes(_:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:63",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L63-L67"
+    },
+    {
+      "commandID": "cr:parser:labels",
+      "methodID": "crParser.labels",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:labels"
+      ],
+      "resource": "parser",
+      "operation": "labels",
+      "commandStart": "cr:parser:labels",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "label",
+          "type": "string",
+          "required": true,
+          "repeatable": true
+        }
+      ],
+      "options": [],
+      "resultType": "string-map",
+      "minimalArgv": [
+        "cr:parser:labels",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 89,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.labels(_:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:244",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L244-L261"
+    },
+    {
+      "commandID": "cr:parser:platform",
+      "methodID": "crParser.platform",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:platform"
+      ],
+      "resource": "parser",
+      "operation": "platform",
+      "commandStart": "cr:parser:platform",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "platform",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "oci-platform",
+      "minimalArgv": [
+        "cr:parser:platform",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 90,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.platform(from:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:101",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L101-L103"
+    },
+    {
+      "commandID": "cr:parser:is-valid-domain-name",
+      "methodID": "crParser.isValidDomainName",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:is-valid-domain-name"
+      ],
+      "resource": "parser",
+      "operation": "is-valid-domain-name",
+      "commandStart": "cr:parser:is-valid-domain-name",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "name",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool",
+      "minimalArgv": [
+        "cr:parser:is-valid-domain-name",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 91,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.isValidDomainName(_:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:895",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L895-L900"
+    },
+    {
+      "commandID": "cr:parser:is-valid-domain-name-label",
+      "methodID": "crParser.isValidDomainNameLabel",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:is-valid-domain-name-label"
+      ],
+      "resource": "parser",
+      "operation": "is-valid-domain-name-label",
+      "commandStart": "cr:parser:is-valid-domain-name-label",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "label",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool",
+      "minimalArgv": [
+        "cr:parser:is-valid-domain-name-label",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 92,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.isValidDomainNameLabel(_:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:902",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L902-L908"
+    },
+    {
+      "commandID": "cr:parser:parse-bool",
+      "methodID": "crParser.parseBool",
+      "namespace": "cr",
+      "sourceKind": "direct",
+      "aliases": [
+        "container:parser:parse-bool"
+      ],
+      "resource": "parser",
+      "operation": "parse-bool",
+      "commandStart": "cr:parser:parse-bool",
+      "commandShape": "static",
+      "positionals": [
+        {
+          "name": "value",
+          "type": "string",
+          "required": true,
+          "repeatable": false
+        }
+      ],
+      "options": [],
+      "resultType": "bool?",
+      "minimalArgv": [
+        "cr:parser:parse-bool",
+        "example"
+      ],
+      "source": "GHOSTBOX_CR_CLI_TEMPLATE.md",
+      "sourceLine": 93,
+      "swiftModule": "ContainerAPIClient",
+      "swiftSymbol": "Parser.parseBool(string:)",
+      "swiftSource": "Sources/Services/ContainerAPIService/Client/Parser.swift:1061",
+      "documentationURL": "https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L1061-L1063"
+    }
+  ]
+}
diff --git a/GHOSTBOX_CLI_TEMPLATE.md b/GHOSTBOX_CLI_TEMPLATE.md
new file mode 100644
index 0000000..4bd7503
--- /dev/null
+++ b/GHOSTBOX_CLI_TEMPLATE.md
@@ -0,0 +1,968 @@
+# Ghostbox Direct API CLI Template
+
+This document defines the proposed direct Ghostbox CLI surface for Apple's
+Containerization framework. It is source-audited against Containerization
+`0.40.1` at revision `7800b46`.
+
+This is not the backend-neutral protocol in `CONTAINER_RUNTIME_PROTOCOL.md`.
+It is a diagnostic and development CLI whose operations stay as close as
+possible to one public Containerization initializer, method, or property
+access per command.
+
+## Conventions
+
+The `cn` namespace names Apple's Containerization package and has the long
+alias `containerization`. Every command uses one qualified command token;
+receiver references, when required, follow that token:
+
+```text
+$ ghostbox cn:RESOURCE:OPERATION [@] [arguments] [options]
+```
+
+```text
+       New literal value.
+@      Existing VMHost-owned object.
+[argument]            Optional argument.
+argument...            Repeatable argument.
+-> @   Canonical object reference printed on success.
+[--argument=default]  Optional argument using the shown framework default.
+```
+
+The outer macOS VMHost owns all live and value objects. Example references:
+
+```text
+@default                         ContainerManager
+@default/web                     LinuxContainer
+@default/web/shell               LinuxProcess
+@shared                          VmnetNetwork
+@shared/web                      Interface
+```
+
+Object creation prints its canonical `@` reference. Property operations print
+JSON-compatible values. Methods returning framework objects register and print
+new references.
+
+`ContainerManager`, `VmnetNetwork`, `Kernel.CommandLine`, and
+`LinuxProcessConfiguration` are mutable structs. The registry must serialize
+mutation and write the modified value back after every mutating call. Passing
+a `Network` to `ContainerManager.init` copies it; the manager's private network
+and the original registered network are snapshots that can diverge.
+
+Configuration closure exceptions are called out below. These operations still
+make one lifecycle API call, but the host must supply the API-required closure
+and assign a stored configuration value inside it.
+
+## Image Stores
+
+```text
+ghostbox cn:image-store:create 
+    --path 
+    [--content-store @]
+    -> @
+
+ghostbox cn:image-store:default -> @
+ghostbox cn:image-store:path @ -> 
+
+ghostbox cn:image-store:get @
+    
+    [--pull=false]
+    -> @
+
+ghostbox cn:image-store:list @ -> @...
+
+ghostbox cn:image-store:create-image @
+    @
+    -> @
+
+ghostbox cn:image-store:delete @
+    
+    [--perform-cleanup=false]
+
+ghostbox cn:image-store:clean-up-orphaned-blobs @
+    -> 
+
+ghostbox cn:image-store:calculate-orphaned-blobs-size @
+    -> 
+
+ghostbox cn:image-store:tag @
+    
+    
+    -> @
+
+ghostbox cn:image-store:pull @
+    
+    [--platform ]
+    [--insecure=false]
+    [--authentication @]
+    [--progress @]
+    [--max-concurrent-downloads=3]
+    -> @
+
+ghostbox cn:image-store:push @
+    
+    [--platform ]
+    [--insecure=false]
+    [--authentication @]
+    [--progress @]
+
+ghostbox cn:image-store:push-many @
+    ...
+    [--platform ]
+    [--insecure=false]
+    [--authentication @]
+    [--max-concurrent-uploads=3]
+    [--progress @]
+
+ghostbox cn:image-store:save @
+    ...
+    --out 
+    [--platform ]
+
+ghostbox cn:image-store:load @
+    
+    [--progress @]
+    -> @...
+
+ghostbox cn:image-store:get-init-image @
+    
+    [--authentication @]
+    [--progress @]
+    -> @
+```
+
+`ContentStore`, `Authentication`, and `ProgressHandler` are protocol or closure
+objects. They are VMHost-owned references, not inline CLI values. Omitting them
+passes the framework default.
+
+## Images
+
+```text
+ghostbox cn:image-description:create 
+    
+    
+    -> @
+
+ghostbox cn:image-description:reference @ -> 
+ghostbox cn:image-description:descriptor @ -> 
+ghostbox cn:image-description:digest @ -> 
+ghostbox cn:image-description:media-type @ -> 
+
+ghostbox cn:image:create 
+    @
+    @
+    -> @
+
+ghostbox cn:image:description @ -> 
+ghostbox cn:image:descriptor @ -> 
+ghostbox cn:image:digest @ -> 
+ghostbox cn:image:media-type @ -> 
+ghostbox cn:image:reference @ -> 
+ghostbox cn:image:index @ -> 
+
+ghostbox cn:image:manifest @
+    
+    -> 
+
+ghostbox cn:image:descriptor-for @
+    
+    -> 
+
+ghostbox cn:image:config @
+    
+    -> 
+
+ghostbox cn:image:referenced-digests @ -> ...
+
+ghostbox cn:image:get-content @
+    
+    -> @
+
+ghostbox cn:content:path @ -> 
+ghostbox cn:content:digest @ -> 
+ghostbox cn:content:size @ -> 
+ghostbox cn:content:data @ -> 
+ghostbox cn:content:data-range @
+    
+    
+    -> |null
+```
+
+## Kernels And Boot Images
+
+```text
+ghostbox cn:kernel-command-line:create 
+    [--kernel-argument ]...
+    [--init-argument ]...
+    -> @
+
+ghostbox cn:kernel-command-line:create-debug 
+    
+    
+    [--init-argument ]...
+    -> @
+
+ghostbox cn:kernel-command-line:add-debug @
+ghostbox cn:kernel-command-line:add-panic @ 
+ghostbox cn:kernel-command-line:set-agent-log-level @ 
+ghostbox cn:kernel-command-line:kernel-arguments @ -> ...
+ghostbox cn:kernel-command-line:init-arguments @ -> ...
+
+ghostbox cn:kernel:create 
+    --path 
+    --platform 
+    [--command-line @]
+    -> @
+
+ghostbox cn:kernel:path @ -> 
+ghostbox cn:kernel:platform @ -> 
+ghostbox cn:kernel:kernel-arguments @ -> ...
+ghostbox cn:kernel:init-arguments @ -> ...
+
+ghostbox cn:kernel-image:from-image 
+    @
+    -> @
+
+ghostbox cn:kernel-image:create 
+    
+    --kernel @...
+    [--label ]...
+    --image-store @
+    --content-store @
+    -> @
+
+ghostbox cn:kernel-image:kernel @
+    
+    -> @
+
+ghostbox cn:kernel-image:name @ -> 
+ghostbox cn:kernel-image:media-type -> 
+
+ghostbox cn:init-image:from-image 
+    @
+    -> @
+
+ghostbox cn:init-image:create 
+    
+    --rootfs 
+    --platform 
+    [--label ]...
+    --image-store @
+    --content-store @
+    -> @
+
+ghostbox cn:init-image:init-block @
+    --at 
+    --platform 
+    -> @
+
+ghostbox cn:init-image:name @ -> 
+```
+
+## Mounts
+
+```text
+ghostbox cn:mount:create 
+    --type 
+    --source 
+    --destination 
+    --option ...
+    --runtime-options 
+    -> @
+
+ghostbox cn:mount:block 
+    --format 
+    --source 
+    --destination 
+    [--option ]...
+    [--runtime-option ]...
+    -> @
+
+ghostbox cn:mount:share 
+    --source 
+    --destination 
+    [--option ]...
+    [--runtime-option ]...
+    -> @
+
+ghostbox cn:mount:any 
+    --type 
+    --source 
+    --destination 
+    [--option ]...
+    [--runtime-option ]...
+    -> @
+
+ghostbox cn:mount:shared-mount 
+    --name 
+    --destination 
+    [--option ]...
+    -> @
+
+ghostbox cn:mount:clone @
+    --to 
+    -> @
+
+ghostbox cn:mount:is-block @ -> 
+ghostbox cn:mount:type @ -> 
+ghostbox cn:mount:source @ -> 
+ghostbox cn:mount:destination @ -> 
+ghostbox cn:mount:options @ -> ...
+ghostbox cn:mount:runtime-options @ -> 
+```
+
+## DNS And Hosts
+
+```text
+ghostbox cn:dns:create 
+    [--nameserver ]...
+    [--domain ]
+    [--search-domain ]...
+    [--option ]...
+    -> @
+
+ghostbox cn:dns:default-nameservers -> ...
+ghostbox cn:dns:validate @
+ghostbox cn:dns:resolv-conf @ -> 
+ghostbox cn:dns:nameservers @ -> ...
+ghostbox cn:dns:domain @ -> |null
+ghostbox cn:dns:search-domains @ -> ...
+ghostbox cn:dns:options @ -> ...
+
+ghostbox cn:hosts-entry:create 
+    
+    ...
+    [--comment ]
+    -> @
+
+ghostbox cn:hosts-entry:localhost-ipv4  [--comment ] -> @
+ghostbox cn:hosts-entry:localhost-ipv6  [--comment ] -> @
+ghostbox cn:hosts-entry:ipv6-localnet  [--comment ] -> @
+ghostbox cn:hosts-entry:ipv6-mcastprefix  [--comment ] -> @
+ghostbox cn:hosts-entry:ipv6-allnodes  [--comment ] -> @
+ghostbox cn:hosts-entry:ipv6-allrouters  [--comment ] -> @
+ghostbox cn:hosts-entry:rendered @ -> 
+ghostbox cn:hosts-entry:ip-address @ -> 
+ghostbox cn:hosts-entry:hostnames @ -> ...
+ghostbox cn:hosts-entry:comment @ -> |null
+
+ghostbox cn:hosts:create 
+    [--entry @]...
+    [--comment ]
+    -> @
+
+ghostbox cn:hosts:default -> @
+ghostbox cn:hosts:hosts-file @ -> 
+ghostbox cn:hosts:entries @ -> @...
+ghostbox cn:hosts:comment @ -> |null
+```
+
+## Socket And Boot Log Configuration
+
+```text
+ghostbox cn:socket:create 
+    --source 
+    --destination 
+    [--permissions ]
+    [--direction ]
+    -> @
+
+ghostbox cn:socket:id @ -> 
+ghostbox cn:socket:source @ -> 
+ghostbox cn:socket:destination @ -> 
+ghostbox cn:socket:permissions @ -> |null
+ghostbox cn:socket:direction @ -> 
+
+ghostbox cn:boot-log:file 
+    --path 
+    [--append=true]
+    -> @
+```
+
+`BootLog.fileHandle(_:)` is excluded because it requires a live host
+`FileHandle`; `BootLog.file(path:append:)` is the CLI-safe public factory.
+
+## Networks And Interfaces
+
+`VmnetNetwork` is available on macOS 26 and later.
+
+```text
+ghostbox cn:network:vmnet-create 
+    [--mode=shared]
+    [--subnet ]
+    [--prefix-v6 ]
+    -> @
+
+ghostbox cn:network:subnet @ -> 
+ghostbox cn:network:prefix-v6 @ -> |null
+ghostbox cn:network:ipv4-gateway @ -> 
+ghostbox cn:network:ipv6-gateway @ -> |null
+
+ghostbox cn:network:create-interface @
+    
+    -> @|null
+
+ghostbox cn:network:create-interface-mtu @
+    
+    
+    -> @|null
+
+ghostbox cn:network:create-interface-without-gateway @
+    
+    -> @|null
+
+ghostbox cn:network:release-interface @ @
+
+# Maps to the platform-independent Containerization.NATInterface value type.
+ghostbox cn:interface:nat-create 
+    --ipv4-address 
+    [--ipv4-gateway ]
+    [--ipv6-address ]
+    [--ipv6-gateway ]
+    [--mac-address ]
+    [--mtu=1500]
+    -> @
+
+ghostbox cn:interface:ipv4-address @ -> 
+ghostbox cn:interface:ipv4-gateway @ -> |null
+ghostbox cn:interface:ipv6-address @ -> |null
+ghostbox cn:interface:ipv6-gateway @ -> |null
+ghostbox cn:interface:mac-address @ -> |null
+ghostbox cn:interface:mtu @ -> 
+```
+
+`NATNetworkInterface.init(...reference:)` and `VmnetNetwork.Interface.init`
+are excluded because they require a live `vmnet_network_ref` C object.
+
+## VM Configuration And VMM
+
+```text
+ghostbox cn:vm-config:create 
+    [--cpus=4]
+    [--memory=1073741824]
+    [--interface @]...
+    [--mount =@]...
+    [--boot-log @]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:standard-vm-config:create 
+    @
+    -> @
+
+ghostbox cn:vmm:create 
+    --kernel @
+    --initial-filesystem @
+    [--rosetta=false]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:vmm:create-instance @
+    @
+    -> @
+
+ghostbox cn:vm-instance:state @ -> 
+ghostbox cn:vm-instance:mounts @ -> 
+ghostbox cn:vm-instance:virtiofs-layout @ -> 
+ghostbox cn:vm-instance:start @
+ghostbox cn:vm-instance:stop @
+ghostbox cn:vm-instance:pause @
+ghostbox cn:vm-instance:resume @
+
+ghostbox cn:vm-instance:dial @
+    
+    -> @
+```
+
+The VMM constructor fixes `EventLoopGroup` and `Logger` to `nil`. Custom
+`VMConfiguration.extensions`, `dialAgent`, listeners, and hotplug operations
+remain excluded until Ghostbox defines registry-backed wrappers for their live
+protocol objects.
+
+## Process Configuration
+
+```text
+ghostbox cn:rlimit-kind:create 
+    
+    -> @
+
+ghostbox cn:rlimit:create 
+    --kind @
+    --hard 
+    --soft 
+    -> @
+
+ghostbox cn:rlimit:create-equal 
+    --kind @
+    --limit 
+    -> @
+
+ghostbox cn:rlimit:kind @ -> @
+ghostbox cn:rlimit:hard @ -> 
+ghostbox cn:rlimit:soft @ -> 
+ghostbox cn:rlimit:to-oci @ -> 
+
+ghostbox cn:capabilities:create 
+    [--bounding ]...
+    [--effective ]...
+    [--inheritable ]...
+    [--permitted ]...
+    [--ambient ]...
+    -> @
+
+ghostbox cn:capabilities:create-uniform 
+    ...
+    -> @
+
+ghostbox cn:capabilities:all -> @
+ghostbox cn:capabilities:default-oci -> @
+ghostbox cn:capabilities:bounding @ -> ...
+ghostbox cn:capabilities:effective @ -> ...
+ghostbox cn:capabilities:inheritable @ -> ...
+ghostbox cn:capabilities:permitted @ -> ...
+ghostbox cn:capabilities:ambient @ -> ...
+ghostbox cn:capabilities:to-oci @ -> 
+
+ghostbox cn:process-config:default-path -> 
+
+ghostbox cn:process-config:create 
+    ...
+    [--environment ]...
+    [--working-directory=/]
+    [--user ]
+    [--rlimit @]...
+    [--no-new-privileges=false]
+    [--capabilities @]
+    [--terminal=false]
+    [--stdin @]
+    [--stdout @]
+    [--stderr @]
+    -> @
+
+ghostbox cn:process-config:from-image-config 
+    
+    -> @
+
+ghostbox cn:process-config:set-terminal-io @
+    @
+
+ghostbox cn:process-config:arguments @ -> ...
+ghostbox cn:process-config:environment-variables @ -> ...
+ghostbox cn:process-config:working-directory @ -> 
+ghostbox cn:process-config:user @ -> 
+ghostbox cn:process-config:rlimits @ -> @...
+ghostbox cn:process-config:no-new-privileges @ -> 
+ghostbox cn:process-config:capabilities @ -> @
+ghostbox cn:process-config:terminal @ -> 
+ghostbox cn:process-config:stdin @ -> @|null
+ghostbox cn:process-config:stdout @ -> @|null
+ghostbox cn:process-config:stderr @ -> @|null
+```
+
+Stdio and terminal arguments are VMHost-owned protocol objects. Ghostbox proxy
+extensions register guest-backed adapters without combining lifecycle calls.
+
+## Container Configuration
+
+```text
+ghostbox cn:container-config:create-default 
+    -> @
+
+ghostbox cn:container-config:create 
+    --process @
+    [--cpus=4]
+    [--memory=1073741824]
+    [--hostname ]
+    [--sysctl ]...
+    [--interface @]...
+    [--socket @]...
+    [--mount @]...
+    [--masked-path ]...
+    [--readonly-path ]...
+    [--dns @]
+    [--hosts @]
+    [--virtualization=false]
+    [--boot-log @]
+    [--oci-runtime-path ]
+    [--use-init=false]
+    [--cpu-overhead=1]
+    [--memory-overhead=134217728]
+    -> @
+
+ghostbox cn:container:default-mounts -> @...
+ghostbox cn:container:default-oci-mounts -> ...
+ghostbox cn:container:default-masked-paths -> ...
+ghostbox cn:container:default-readonly-paths -> ...
+ghostbox cn:container:default-copy-chunk-size -> 
+ghostbox cn:container:max-id-length -> 
+```
+
+## Container Managers
+
+Distinct constructor verbs avoid ambiguity between Swift overloads whose
+optional arguments otherwise produce identical CLI shapes.
+
+```text
+ghostbox cn:manager:create 
+    --kernel @
+    --initfs @
+    --image-store @
+    [--network @]
+    [--rosetta=false]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:manager:create-at-root 
+    --kernel @
+    --initfs @
+    [--root ]
+    [--network @]
+    [--rosetta=false]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:manager:create-from-reference 
+    --kernel @
+    --initfs-reference 
+    --image-store @
+    [--network @]
+    [--rosetta=false]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:manager:create-from-reference-at-root 
+    --kernel @
+    --initfs-reference 
+    [--root ]
+    [--network @]
+    [--rosetta=false]
+    [--nested-virtualization=false]
+    -> @
+
+ghostbox cn:manager:create-with-vmm 
+    --vmm @
+    [--network @]
+    -> @
+
+ghostbox cn:manager:image-store @ -> @
+```
+
+## Manager Container Allocation
+
+These three framework methods require a non-optional configuration closure.
+Ghostbox builds the closure from optional configuration overrides and applies
+them to the manager-populated `inout LinuxContainer.Configuration`. It must not
+replace the value wholesale: the manager has already populated image process
+settings, networking, DNS, and its boot log. No extra lifecycle API is called.
+
+```text
+--process @
+--cpus 
+--memory 
+--hostname 
+--sysctl ...
+--interfaces @...
+--sockets @...
+--mounts @...
+--masked-paths ...
+--readonly-paths ...
+--dns @
+--hosts @
+--virtualization 
+--boot-log @
+--oci-runtime-path 
+--use-init 
+--cpu-overhead 
+--memory-overhead 
+```
+
+```text
+ghostbox cn:manager:create-container @
+    
+    --reference 
+    [--rootfs-size=8589934592]
+    [--writable-layer-size ]
+    [--read-only=false]
+    [--networking=true]
+    [--progress @]
+    []...
+    -> @
+
+ghostbox cn:manager:create-container-from-image @
+    
+    --image @
+    [--rootfs-size=8589934592]
+    [--writable-layer-size ]
+    [--read-only=false]
+    [--networking=true]
+    [--progress @]
+    []...
+    -> @
+
+ghostbox cn:manager:create-container-from-mounts @
+    
+    --image @
+    --rootfs @
+    [--writable-layer @]
+    [--networking=true]
+    []...
+    -> @
+
+ghostbox cn:manager:release-network @ @
+ghostbox cn:manager:delete @ @
+```
+
+## Containers
+
+```text
+ghostbox cn:container:create-direct 
+    --rootfs @
+    [--writable-layer @]
+    --vmm @
+    --configuration @
+    -> @
+
+ghostbox cn:container:id @ -> 
+ghostbox cn:container:rootfs @ -> @
+ghostbox cn:container:writable-layer @ -> @|null
+ghostbox cn:container:config @ -> @
+ghostbox cn:container:cpus @ -> 
+ghostbox cn:container:memory @ -> 
+ghostbox cn:container:interfaces @ -> @...
+
+ghostbox cn:container:create @
+ghostbox cn:container:start @
+ghostbox cn:container:stop @
+ghostbox cn:container:kill @ 
+
+ghostbox cn:container:wait @
+    [--timeout-seconds ]
+    -> 
+
+ghostbox cn:container:resize @
+    
+    
+
+ghostbox cn:container:exec @
+    
+    --configuration @
+    -> @
+
+ghostbox cn:container:dial-vsock @
+    
+    -> @
+
+ghostbox cn:container:close-stdin @
+
+ghostbox cn:container:statistics @
+    [--category ]...
+    -> 
+
+ghostbox cn:container:filesystem-operation @
+    
+    
+
+ghostbox cn:container:copy-in @
+    
+    
+    [--mode=0644]
+    [--create-parents=true]
+    [--chunk-size=1048576]
+
+ghostbox cn:container:copy-out @
+    
+    
+    [--create-parents=true]
+    [--chunk-size=1048576]
+```
+
+There is no public `LinuxContainer.pause()`, `resume()`, `delete()`, `state`, or
+container-level Unix-socket relay operation. VM pause and resume exist only on
+`VirtualMachineInstance`, which Containerization exposes to containers through
+the scoped `withVirtualMachineInstance` closure. That closure is deliberately
+not converted into a durable CLI reference.
+
+## Processes
+
+`LinuxProcess` has no public initializer. A process reference is created only
+by `LinuxContainer.exec` or `LinuxPod.execInContainer`.
+
+```text
+ghostbox cn:process:id @ -> 
+ghostbox cn:process:owning-container @ -> |null
+ghostbox cn:process:pid @ -> 
+
+ghostbox cn:process:start @
+ghostbox cn:process:kill @ 
+
+ghostbox cn:process:resize @
+    
+    
+
+ghostbox cn:process:close-stdin @
+
+ghostbox cn:process:wait @
+    [--timeout-seconds ]
+    -> 
+
+ghostbox cn:process:delete @
+```
+
+## Experimental Pods
+
+Pod construction, container addition, and process execution only have closure configuration forms. Ghostbox assigns the stored value inside that closure.
+For `exec-in-container`, this intentionally replaces Apple's inherited configuration and returns an unstarted process that is not registered in pod state.
+`pod config` returns the pod's immutable configuration as a read-only detached
+snapshot. Use a separately created `pod-config` reference as a mutable builder.
+
+```text
+ghostbox cn:pod-volume:create 
+    --name 
+    --source 
+    --format 
+    -> @
+
+ghostbox cn:pod-config:create  -> @
+ghostbox cn:pod-config:set-cpus @ 
+ghostbox cn:pod-config:set-memory @ 
+ghostbox cn:pod-config:set-interfaces @ @...
+ghostbox cn:pod-config:set-virtualization @ 
+ghostbox cn:pod-config:set-boot-log @ @|null
+ghostbox cn:pod-config:set-share-process-namespace @ 
+ghostbox cn:pod-config:set-hostname @ |null
+ghostbox cn:pod-config:set-dns @ @|null
+ghostbox cn:pod-config:set-hosts @ @|null
+ghostbox cn:pod-config:set-volumes @ @...
+
+ghostbox cn:pod-container-config:create  -> @
+ghostbox cn:pod-container-config:set-process @ @
+ghostbox cn:pod-container-config:set-cpus @ |null
+ghostbox cn:pod-container-config:set-memory @ |null
+ghostbox cn:pod-container-config:set-hostname @ |null
+ghostbox cn:pod-container-config:set-sysctl @ ...
+ghostbox cn:pod-container-config:set-mounts @ @...
+ghostbox cn:pod-container-config:set-masked-paths @ ...
+ghostbox cn:pod-container-config:set-readonly-paths @ ...
+ghostbox cn:pod-container-config:set-sockets @ @...
+ghostbox cn:pod-container-config:set-dns @ @|null
+ghostbox cn:pod-container-config:set-hosts @ @|null
+ghostbox cn:pod-container-config:set-use-init @ 
+
+ghostbox cn:pod:create-direct 
+    --vmm @
+    --configuration @
+    -> @
+
+ghostbox cn:pod:id @ -> 
+ghostbox cn:pod:config @ -> @
+ghostbox cn:pod:cpus @ -> 
+ghostbox cn:pod:memory @ -> 
+ghostbox cn:pod:interfaces @ -> @...
+
+ghostbox cn:pod:add-container @
+    
+    --rootfs @
+    --configuration @
+    -> @
+
+ghostbox cn:pod:create @
+ghostbox cn:pod:start-container @ @
+ghostbox cn:pod:stop-container @ @
+ghostbox cn:pod:stop @
+ghostbox cn:pod:kill-container @ @ 
+
+ghostbox cn:pod:wait-container @
+    @
+    [--timeout-seconds ]
+    -> 
+
+ghostbox cn:pod:resize-container @
+    @
+    
+    
+
+ghostbox cn:pod:exec-in-container @
+    @
+    
+    --configuration @
+    -> @
+
+ghostbox cn:pod:list-containers @ -> @...
+
+ghostbox cn:pod:statistics @
+    [--container @]...
+    [--category ]...
+    -> ...
+
+ghostbox cn:pod:dial-vsock @
+    
+    -> @
+
+ghostbox cn:pod:filesystem-operation @
+    @
+    
+    
+
+ghostbox cn:pod:close-container-stdin @ @
+
+ghostbox cn:pod:relay-unix-socket @
+    @
+    @
+```
+
+## Content Stores, Authentication, and Progress
+
+```text
+ghostbox cn:content-store:create 
+    --path 
+    -> @
+
+ghostbox cn:authentication:create-basic 
+    --username 
+    --password 
+    -> @
+
+ghostbox cn:progress-handler:create 
+    --writer @
+    -> @
+```
+
+`progress-handler create` adapts Apple's callback to newline-delimited JSON
+objects written through the supplied registered `Writer`. Each object contains
+the framework event's `event` and integer `value` properties.
+
+## Container Resource Visibility
+
+Each `LinuxContainer` runs in its own VM. `cpus` and `memory` are workload
+cgroup limits, while `/proc/cpuinfo` and `/proc/meminfo` expose VM capacity.
+For manager create operations, supplying `cpus` selects zero additional vCPUs
+unless `cpuOverhead` is explicit. Supplying `memory` selects the bundled guest
+kernel reservation as `memoryOverhead` unless that option is explicit, so
+`MemTotal` tracks the requested workload memory. Explicit overhead options retain
+Apple's `capacity = limit + overhead` behavior. Cgroup v2 `cpu.max` and
+`memory.max`, or `container statistics`, remain authoritative for enforcement.
+
+## Explicit Exclusions
+
+```text
+LinuxContainer.withVirtualMachineInstance(...)
+LinuxPod.withVirtualMachineInstance(...)
+BootLog.fileHandle(...)
+VmnetNetwork.Interface.init(...)
+NATNetworkInterface.init(...reference: vmnet_network_ref...)
+Mount.configure(...)
+Mount.readonly
+ImageStore import/export implementation types
+LinuxProcess internal initializer
+ProgressHandler inline closures other than the registered writer adapter
+Arbitrary Authentication protocol implementations
+VMCreationConfig custom protocol implementations
+VMConfiguration.extensions
+VirtualMachineInstance listeners, agents, and hotplug objects
+VZVirtualMachineInstance direct initializer and Configuration closure
+Content.decode() generic decoding
+Cloud Hypervisor and Linux-only network backends
+```
+
+These APIs are closure-scoped, internal, require non-serializable host objects,
+or are outside the VZ-backed macOS container scope. They must not be presented
+as direct CLI operations without a separate registry-backed transport design.
diff --git a/GHOSTBOX_CR_CLI_TEMPLATE.md b/GHOSTBOX_CR_CLI_TEMPLATE.md
new file mode 100644
index 0000000..bdd5bcc
--- /dev/null
+++ b/GHOSTBOX_CR_CLI_TEMPLATE.md
@@ -0,0 +1,131 @@
+# Ghostbox Container API CLI Template
+
+This document defines the initial direct Ghostbox CLI catalog for selected APIs
+implemented by Apple container `1.2.0` at revision
+`6e65319fe476ffe8db8ddaf828a537ed36fe2859`, plus GhostVM's persistent-volume
+adapter. It is intentionally limited to the commands listed here.
+
+The `cr` namespace has the long alias `container`. Commands use one qualified
+command token followed by an optional receiver reference and arguments:
+
+```text
+$ ghostbox cr:RESOURCE:OPERATION [@] [arguments] [options]
+```
+
+The value syntax and reference ownership conventions are the same as in
+`GHOSTBOX_CLI_TEMPLATE.md`. Direct commands map to one public Swift API. Volume
+commands map to the existing GhostVM adapter and retain their `volume.*` wire
+method IDs.
+
+## Persistent Volumes
+
+```text
+ghostbox cr:volume:create 
+    [--size=8589934592]
+    -> @
+
+ghostbox cr:volume:list -> @...
+ghostbox cr:volume:inspect @ -> 
+
+ghostbox cr:volume:mount @
+    
+    --destination 
+    [--read-only=false]
+    -> @
+
+ghostbox cr:volume:delete @
+```
+
+Volumes are persistent ext4 images owned by the VM. `inspect` returns name,
+format, byte size, and creation time, but never exposes the outer-host backing
+path. `delete` permanently removes an unused volume and its contents. Delete
+the mount reference before deleting its volume.
+
+## Memory Size
+
+```text
+ghostbox cr:memory-size:create  
+    -> @
+
+ghostbox cr:memory-size:formatted @ -> 
+
+ghostbox cr:memory-size:to-uint64 @
+    
+    -> 
+```
+
+`create` accepts the syntax implemented by `MemorySize`, such as `512mb` or
+`2gb`. Conversion uses Foundation information-storage units and rounds to the
+nearest unsigned integer, matching the upstream implementation.
+
+## Resource Labels
+
+```text
+ghostbox cr:resource-labels:create 
+    [--label ]...
+    -> @
+
+ghostbox cr:resource-labels:validate-key 
+ghostbox cr:resource-labels:validate  
+ghostbox cr:resource-labels:dictionary @ -> 
+
+ghostbox cr:resource-labels:value @
+    
+    -> |null
+
+ghostbox cr:resource-labels:key-length-max -> 
+ghostbox cr:resource-labels:label-length-max -> 
+```
+
+Labels supplied to `create` use `key=value` text. Validation enforces the exact
+upstream key and full-label limits. Do not place secrets in labels; dictionary
+and value operations return them as plain JSON values.
+
+## Parser Utilities
+
+```text
+ghostbox cr:parser:memory-as-mib  -> 
+ghostbox cr:parser:memory-as-bytes  -> 
+ghostbox cr:parser:labels ... -> 
+ghostbox cr:parser:platform  -> 
+ghostbox cr:parser:is-valid-domain-name  -> 
+ghostbox cr:parser:is-valid-domain-name-label  -> 
+ghostbox cr:parser:parse-bool  -> |null
+```
+
+These utilities are deterministic string/value parsers. `labels` does not apply
+`ResourceLabels` validation; use the resource-label validation commands when
+validated metadata is required. `parse-bool` accepts only `true`, `t`, `false`,
+or `f`, case-insensitively, and returns `null` for other input.
+
+## Source Metadata
+
+The generator consumes the metadata block below. `swiftSource` values are
+repository-relative and line-pinned to the audited revisions named above.
+
+
diff --git a/GHOSTFILE_BENCHMARKS.md b/GHOSTFILE_BENCHMARKS.md
index 4d52482..8bb1437 100644
--- a/GHOSTFILE_BENCHMARKS.md
+++ b/GHOSTFILE_BENCHMARKS.md
@@ -1,5 +1,41 @@
 # GhostFile benchmarks
 
+## 2026-08-02: installed writable FSKit prototype
+
+The earlier read-only benchmark established read performance only; it was not
+evidence that filesystem mutations worked. This pass used the signed
+`/Applications/GhostFile.app` extension and a real FSKit mount backed by the
+workspace share. Every mounted mutation was checked against the source path.
+
+Functional results:
+
+- one 3 MiB `write(2)` path split into concurrent FSKit callbacks: passed;
+- three simultaneous 1 MiB writes at disjoint offsets in one file: passed;
+- create, mkdir, chmod, same- and cross-directory rename, truncate, symlink,
+  unlink, and rmdir: passed;
+- live read-only enable rejected create and chmod with `EROFS`; disabling it
+  restored writes on the existing mount;
+- writable stress: 25 checks, including 200 parallel operation batches, with
+  zero failures;
+- XCTest: 48 tests, one intentional skip, zero failures.
+
+Mounted-versus-native results use the existing 75.5 MiB and 8,192-file
+fixtures. Values are medians of three samples.
+
+| Test | Previous FSKit | Current FSKit | Change |
+| --- | ---: | ---: | ---: |
+| Random 4 KiB read (`F_NOCACHE`) | 1,302.8 us/op | 1,216.7 us/op | 6.6% lower latency |
+| Sequential read (`F_NOCACHE`) | 12.7 MiB/s | 123.4 MiB/s | 9.7x |
+| Warm sequential read | 17,215.5 MiB/s | 18,058.5 MiB/s | 1.05x |
+| Recursive enumeration | 26,284 entries/s | 173,472 entries/s | 6.6x |
+| Small-file open + read | 2,318.8 IOPS | 1,110.9 IOPS | 0.48x |
+| Directory listing | 513.3 IOPS | 3,933.0 IOPS | 7.7x |
+
+Sequential mounted writes of a 64 MiB file measured 135.3, 136.0, and
+135.2 MiB/s (about 135.3 MiB/s median). There is no valid previous write
+number because the old mounted path was read-only. Hard links remain explicitly
+unsupported (`ENOTSUP`) rather than being reported as functional.
+
 ## 2026-07-31: receive-side QUIC datagram batching
 
 The remaining throughput ceiling was a serialized per-datagram feedback loop,
diff --git a/Makefile b/Makefile
index 2b9ed72..c07de50 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # GhostVM Makefile
 # Builds vmctl CLI and the SwiftUI app via xcodebuild
 
-# Load .env for notarization credentials (NOTARY_APPLE_ID, NOTARY_TEAM_ID, NOTARY_PASSWORD)
+# Load local signing and notarization configuration.
 -include .env
 export
 
@@ -18,15 +18,20 @@ INJECT_TIMESTAMP ?= 1
 BUILD_TIMESTAMP := $(shell date +%Y%m%d%H%M%S)
 GHOSTFILE_MAJOR_MINOR ?= 1.0
 GHOSTFILE_VERSION ?= $(GHOSTFILE_MAJOR_MINOR).$(BUILD_TIMESTAMP)
-GHOSTFILE_BUILD_NUMBER ?= 3
+GHOSTFILE_BUILD_NUMBER ?= $(BUILD_TIMESTAMP)
 GHOSTFILE_KEEP_INTERMEDIATES ?= 0
 GHOSTFILE_ARCHIVE = build/GhostFile-$(GHOSTFILE_VERSION).xcarchive
 GHOSTFILE_EXPORT_DIR = build/GhostFile-$(GHOSTFILE_VERSION)-export
-GHOSTFILE_UPLOAD_DIR = build/GhostFile-$(GHOSTFILE_VERSION)-upload
 GHOSTFILE_DERIVED_DATA = build/.GhostFile-$(GHOSTFILE_VERSION)-DerivedData
-GHOSTFILE_ARTIFACT = build/GhostFile-$(GHOSTFILE_VERSION)-notarized-arm64.zip
+GHOSTFILE_EXPORT_OPTIONS = build/GhostFile-$(GHOSTFILE_VERSION)-DeveloperIDExportOptions.plist
+GHOSTFILE_DMG = build/GhostFile-$(GHOSTFILE_VERSION)-arm64.dmg
+GHOSTFILE_NOTARY_INPUT = build/GhostFile-$(GHOSTFILE_VERSION)-notary-submission-arm64.dmg
+GHOSTFILE_ARTIFACT = build/GhostFile-$(GHOSTFILE_VERSION)-notarized-arm64.dmg
 GHOSTFILE_SHARED_DOWNLOADS ?= /Volumes/My Shared Files/Downloads
 GHOSTFILE_LSREGISTER = /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
+GHOSTFILE_CODESIGN_ID ?= $(shell security find-identity -v -p codesigning | sed -n 's/.*"\(Developer ID Application:[^"]*\)".*/\1/p' | head -1)
+GHOSTFILE_SIGNING_TEAM ?= $(shell security find-identity -v -p codesigning | sed -n 's/.*"Developer ID Application:.*(\([A-Z0-9]*\))".*/\1/p' | head -1)
+GHOSTFILE_NOTARY_TIMEOUT ?= 45m
 APP_SKIP_XCODE_SIGNING ?= 0
 XCODE_ALLOW_PROVISIONING_UPDATES ?= 1
 
@@ -60,7 +65,7 @@ $(error Missing $(VERSION_FILE). Create it with a version like 1.85.0)
 endif
 BASE_MAJOR_MINOR := $(word 1,$(subst ., ,$(BASE_VERSION))).$(word 2,$(subst ., ,$(BASE_VERSION)))
 
-.PHONY: all cli app clean help run launch ghostfile ghostfile-release ghostfile-notarized run-ghostfile run-ghostfile-release test-ghostfile generate test uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist ghosthttp3-framework
+.PHONY: all cli app clean help run launch ghostfile ghostfile-release ghostfile-dmg ghostfile-notarized ghostfile-notarized-dmg run-ghostfile run-ghostfile-release test-ghostfile generate test test-ghostbox-docker test-ghostbox-docker-compose uitest framework dist debug-dmg tools debug-tools dmg ghosttools-icon ghostvm-icon debug debug-export website website-build sparkle-tools sparkle-sign capture composite screenshots bump check-version render-plists prepare-app-plists prepare-tools-plist ghosthttp3-framework
 
 all: help
 
@@ -314,49 +319,50 @@ ghostfile-release: $(XCODE_PROJECT) ghosthttp3-framework
 		ONLY_ACTIVE_ARCH=YES \
 		build
 
-# Create a timestamp-versioned, Developer ID signed, notarized arm64 GhostFile archive.
-# Every distributed filename includes the full major.minor.YYYYMMDDHHMMSS version.
-ghostfile-notarized: $(XCODE_PROJECT) ghosthttp3-framework
-	@if [ -z "$(DEVELOPMENT_TEAM)" ]; then \
-		echo "ERROR: DEVELOPMENT_TEAM is required"; \
+# Create a timestamp-versioned, Developer ID signed arm64 GhostFile DMG.
+# This target deliberately does not notarize, which makes it useful for local
+# release verification without requiring notary credentials. Distribute only
+# the artifact produced by ghostfile-notarized-dmg.
+ghostfile-dmg: $(XCODE_PROJECT) ghosthttp3-framework
+	@if [ -z "$(GHOSTFILE_SIGNING_TEAM)" ]; then \
+		echo "ERROR: GHOSTFILE_SIGNING_TEAM (or a Developer ID identity) is required"; \
 		exit 1; \
 	fi
-	@for PLIST in macOS/GhostFile/Info.plist macOS/GhostFileFS/Info.plist; do \
-		plutil -replace CFBundleShortVersionString -string "$(GHOSTFILE_VERSION)" "$$PLIST"; \
-		plutil -replace CFBundleVersion -string "$(GHOSTFILE_BUILD_NUMBER)" "$$PLIST"; \
-	done
-	@echo "Building GhostFile $(GHOSTFILE_VERSION)..."
-	rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_UPLOAD_DIR)" "$(GHOSTFILE_DERIVED_DATA)"
+	@if [ -z "$(GHOSTFILE_CODESIGN_ID)" ]; then \
+		echo "ERROR: No Developer ID Application identity found in the keychain"; \
+		exit 1; \
+	fi
+	@echo "Building GhostFile $(GHOSTFILE_VERSION) ($(GHOSTFILE_BUILD_NUMBER))..."
+	rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_DERIVED_DATA)"
+	rm -f "$(GHOSTFILE_EXPORT_OPTIONS)" "$(GHOSTFILE_DMG)"
 	xcodebuild archive -project $(XCODE_PROJECT) \
 		-scheme GhostFile \
 		-configuration Release \
 		-archivePath "$(GHOSTFILE_ARCHIVE)" \
 		-derivedDataPath "$(GHOSTFILE_DERIVED_DATA)" \
 		-allowProvisioningUpdates \
-		DEVELOPMENT_TEAM="$(DEVELOPMENT_TEAM)" \
+		DEVELOPMENT_TEAM="$(GHOSTFILE_SIGNING_TEAM)" \
+		MARKETING_VERSION="$(GHOSTFILE_VERSION)" \
+		CURRENT_PROJECT_VERSION="$(GHOSTFILE_BUILD_NUMBER)" \
 		ARCHS=arm64 \
 		ONLY_ACTIVE_ARCH=YES
+	cp macOS/GhostFile/DeveloperIDExportOptions.plist "$(GHOSTFILE_EXPORT_OPTIONS)"
+	plutil -replace teamID -string "$(GHOSTFILE_SIGNING_TEAM)" "$(GHOSTFILE_EXPORT_OPTIONS)"
 	xcodebuild -exportArchive \
 		-archivePath "$(GHOSTFILE_ARCHIVE)" \
-		-exportPath "$(GHOSTFILE_UPLOAD_DIR)" \
-		-exportOptionsPlist macOS/GhostFile/NotarizeOptions.plist \
+		-exportPath "$(GHOSTFILE_EXPORT_DIR)" \
+		-exportOptionsPlist "$(GHOSTFILE_EXPORT_OPTIONS)" \
 		-allowProvisioningUpdates
-	@ATTEMPT=1; \
-	while ! xcodebuild -exportNotarizedApp -archivePath "$(GHOSTFILE_ARCHIVE)" -exportPath "$(GHOSTFILE_EXPORT_DIR)"; do \
-		if [ "$$ATTEMPT" -ge 60 ]; then echo "ERROR: notarization did not complete"; exit 1; fi; \
-		echo "Waiting for notarization (attempt $$ATTEMPT/60)..."; \
-		ATTEMPT=$$((ATTEMPT + 1)); \
-		sleep 30; \
-	done
-	xcrun stapler validate "$(GHOSTFILE_EXPORT_DIR)/GhostFile.app"
-	rm -f "$(GHOSTFILE_ARTIFACT)"
-	ditto -c -k --keepParent "$(GHOSTFILE_EXPORT_DIR)/GhostFile.app" "$(GHOSTFILE_ARTIFACT)"
-	@if [ -d "$(GHOSTFILE_SHARED_DOWNLOADS)" ]; then \
-		cp "$(GHOSTFILE_ARTIFACT)" "$(GHOSTFILE_SHARED_DOWNLOADS)/GhostFile-$(GHOSTFILE_VERSION)-notarized-arm64.zip"; \
-	fi
-	@# Xcode/LaunchServices eagerly discovers FSKit extensions inside archives and
-	@# DerivedData. Unregister every non-installed build product even when the
-	@# intermediates are retained for release inspection.
+	GHOSTFILE_CODESIGN_ID="$(GHOSTFILE_CODESIGN_ID)" \
+	GHOSTFILE_DMG_README="macOS/GhostFile/DMG_README.txt" \
+	GHOSTFILE_EXPECTED_VERSION="$(GHOSTFILE_VERSION)" \
+	GHOSTFILE_EXPECTED_BUILD="$(GHOSTFILE_BUILD_NUMBER)" \
+		scripts/package-ghostfile-dmg.sh \
+		"$(GHOSTFILE_EXPORT_DIR)/GhostFile.app" \
+		"$(GHOSTFILE_DMG)" \
+		"GhostFile"
+	@# LaunchServices eagerly discovers FSKit extensions inside archives and
+	@# DerivedData. Remove non-installed registrations before returning.
 	@for APP in \
 		"$(GHOSTFILE_ARCHIVE)/Products/Applications/GhostFile.app" \
 		"$(GHOSTFILE_EXPORT_DIR)/GhostFile.app" \
@@ -367,9 +373,29 @@ ghostfile-notarized: $(XCODE_PROJECT) ghosthttp3-framework
 		fi; \
 	done
 	@if [ "$(GHOSTFILE_KEEP_INTERMEDIATES)" != "1" ]; then \
-		rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_UPLOAD_DIR)" "$(GHOSTFILE_DERIVED_DATA)"; \
+		rm -rf "$(GHOSTFILE_ARCHIVE)" "$(GHOSTFILE_EXPORT_DIR)" "$(GHOSTFILE_DERIVED_DATA)"; \
+		rm -f "$(GHOSTFILE_EXPORT_OPTIONS)"; \
+	fi
+	@if [ -d "$(GHOSTFILE_SHARED_DOWNLOADS)" ]; then \
+		cp "$(GHOSTFILE_DMG)" "$(GHOSTFILE_SHARED_DOWNLOADS)/$$(basename "$(GHOSTFILE_DMG)")"; \
 	fi
-	@echo "GhostFile artifact: $(GHOSTFILE_ARTIFACT)"
+	@echo "Signed, unnotarized GhostFile DMG: $(GHOSTFILE_DMG)"
+
+# Submit the signed DMG with notarytool, staple the accepted ticket, and run
+# Gatekeeper checks. A Keychain profile is preferred; CI may use an App Store
+# Connect API key or the legacy Apple-ID environment variables.
+ghostfile-notarized-dmg: ghostfile-dmg
+	rm -f "$(GHOSTFILE_NOTARY_INPUT)" "$(GHOSTFILE_ARTIFACT)"
+	cp "$(GHOSTFILE_DMG)" "$(GHOSTFILE_NOTARY_INPUT)"
+	NOTARY_TIMEOUT="$(GHOSTFILE_NOTARY_TIMEOUT)" scripts/notarize-ghostfile-dmg.sh "$(GHOSTFILE_NOTARY_INPUT)"
+	mv "$(GHOSTFILE_NOTARY_INPUT)" "$(GHOSTFILE_ARTIFACT)"
+	@if [ -d "$(GHOSTFILE_SHARED_DOWNLOADS)" ]; then \
+		cp "$(GHOSTFILE_ARTIFACT)" "$(GHOSTFILE_SHARED_DOWNLOADS)/$$(basename "$(GHOSTFILE_ARTIFACT)")"; \
+	fi
+	@echo "Notarized GhostFile artifact: $(GHOSTFILE_ARTIFACT)"
+
+# Backward-compatible spelling for the old ZIP-producing target.
+ghostfile-notarized: ghostfile-notarized-dmg
 
 run-ghostfile: ghostfile
 	open -n "$(BUILD_DIR)/Build/Products/Debug/GhostFile.app"
@@ -396,10 +422,17 @@ test-ghostfile: $(XCODE_PROJECT) ghosthttp3-framework
 	fi
 
 # Run unit tests
-test: $(XCODE_PROJECT)
+test: $(XCODE_PROJECT) test-ghostbox-docker test-ghostbox-docker-compose
 	xcodebuild test -project $(XCODE_PROJECT) -scheme GhostVMTests -destination 'platform=macOS'
+	xcodebuild test -project $(XCODE_PROJECT) -scheme GhostboxRuntimeTests -destination 'platform=macOS'
 	swift test --package-path macOS/GhostTools
 
+test-ghostbox-docker:
+	sh scripts/test-ghostbox-docker.sh
+
+test-ghostbox-docker-compose:
+	sh scripts/test-ghostbox-docker-compose.sh
+
 # Run UI tests (excludes screenshot-capture tests; use 'make capture' for those)
 uitest: $(XCODE_PROJECT)
 	xcodebuild test -project $(XCODE_PROJECT) -scheme GhostVMUITests -destination 'platform=macOS' \
@@ -459,6 +492,8 @@ GHOSTTOOLS_DIR = macOS/GhostTools
 GHOSTTOOLS_BUILD_DIR = $(BUILD_DIR)/GhostTools
 GHOSTTOOLS_APP = $(GHOSTTOOLS_BUILD_DIR)/GhostTools.app
 GHOSTTOOLS_DMG = $(BUILD_DIR)/GhostTools.dmg
+GHOSTBOX_DOCKER = scripts/ghostbox-docker
+GHOSTBOX_DOCKER_COMPOSE = scripts/ghostbox-docker-compose
 # Virtualization.framework rejects compressed UDIF images as storage attachments.
 GHOSTTOOLS_DMG_FORMAT = UDRW
 
@@ -563,8 +598,12 @@ dmg: tools
 	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
+	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/examples"
+	@cp -R examples/ghostbox "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/examples/"
 	@# Keep guest-facing command-line tools under one conventional directory.
 	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
+	@cp "$(GHOSTBOX_DOCKER)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox-docker"
+	@cp "$(GHOSTBOX_DOCKER_COMPOSE)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox-docker-compose"
 	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
 	@rm -f "$(GHOSTTOOLS_DMG)"
 	hdiutil create -volname "GhostTools" \
@@ -797,7 +836,11 @@ dist:
 	@mkdir -p "$(DIST_DIR)/ghosttools-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(DIST_DIR)/ghosttools-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(DIST_DIR)/ghosttools-stage/"
+	@mkdir -p "$(DIST_DIR)/ghosttools-stage/examples"
+	@cp -R examples/ghostbox "$(DIST_DIR)/ghosttools-stage/examples/"
 	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
+	@cp "$(GHOSTBOX_DOCKER)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox-docker"
+	@cp "$(GHOSTBOX_DOCKER_COMPOSE)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox-docker-compose"
 	codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
 	codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
 	@rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg"
@@ -868,7 +911,11 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin"
 	@cp -R "$(GHOSTTOOLS_APP)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/"
+	@mkdir -p "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/examples"
+	@cp -R examples/ghostbox "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/examples/"
 	@cp "$(GHOSTTOOLS_APP)/Contents/MacOS/ghostbox" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
+	@cp "$(GHOSTBOX_DOCKER)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox-docker"
+	@cp "$(GHOSTBOX_DOCKER_COMPOSE)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox-docker-compose"
 	codesign --force -s "$(GHOSTTOOLS_SIGN_ID)" "$(GHOSTTOOLS_BUILD_DIR)/dmg-stage/bin/ghostbox"
 	@rm -f "$(GHOSTTOOLS_DMG)"
 	hdiutil create -volname "GhostTools" \
@@ -952,6 +999,11 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 			codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$$dylib"; \
 		fi; \
 	done
+	@if [ -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/Helpers/ghostvm-image-fetch" ]; then \
+		echo "  Signing ghostvm-image-fetch"; \
+		codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" \
+			"$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/Helpers/ghostvm-image-fetch"; \
+	fi
 	@# Sign the runtime XPC service explicitly (entitlements + helper profile) BEFORE the
 	@# helper so its vmnet entitlements are not stripped by a later generic re-sign.
 	@if [ -d "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/PlugIns/Helpers/GhostVMHelper.app/Contents/XPCServices/ghostvm-container-runtime.xpc" ]; then \
@@ -1044,9 +1096,14 @@ debug-dmg: $(XCODE_PROJECT) ghostvm-icon ghosttools-icon
 	@ditto "$(DIST_DIR)/ghosttools-mount/GhostTools.app" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
 	@hdiutil detach "$(DIST_DIR)/ghosttools-mount"
 	@cp "$(GHOSTTOOLS_DIR)/README.txt" "$(DIST_DIR)/ghosttools-stage/README.txt"
+	@mkdir -p "$(DIST_DIR)/ghosttools-stage/examples"
+	@cp -R examples/ghostbox "$(DIST_DIR)/ghosttools-stage/examples/"
 	@xattr -cr "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
 	codesign --force --options runtime --timestamp --deep --entitlements "$(GHOSTTOOLS_DIR)/Sources/GhostTools/Resources/entitlements.plist" -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/GhostTools.app"
+	@# Restore the guest-facing bin directory after re-signing the app bundle.
 	@cp "$(DIST_DIR)/ghosttools-stage/GhostTools.app/Contents/MacOS/ghostbox" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
+	@cp "$(GHOSTBOX_DOCKER)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox-docker"
+	@cp "$(GHOSTBOX_DOCKER_COMPOSE)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox-docker-compose"
 	codesign --force --options runtime --timestamp -s "$(DIST_CODESIGN_ID)" "$(DIST_DIR)/ghosttools-stage/bin/ghostbox"
 	@rm -f "$(DIST_DIR)/dmg-stage/$(APP_NAME).app/Contents/Resources/GhostTools.dmg"
 	hdiutil create -volname "GhostTools" \
@@ -1144,6 +1201,8 @@ help:
 	@echo "  make run      - Build and run attached to terminal"
 	@echo "  make launch   - Build and launch detached"
 	@echo "  make ghostfile - Build GhostFile.app and its FSKit extension"
+	@echo "  make ghostfile-dmg - Create a Developer ID signed GhostFile DMG (not notarized)"
+	@echo "  make ghostfile-notarized-dmg - Create, notarize, staple, and verify the GhostFile DMG"
 	@echo "  make ghosthttp3-framework - Build the GhostHTTP3 arm64 dynamic framework"
 	@echo "  make run-ghostfile - Build and launch another GhostFile instance"
 	@echo "  make test-ghostfile - Run GhostFile protocol and server tests"
@@ -1170,8 +1229,12 @@ help:
 	@echo "  CODESIGN_ID   - Code signing identity (default: Apple Development)"
 	@echo "  XCODE_CONFIG  - Xcode build configuration (default: Release)"
 	@echo "  VERSION       - Version for DMG (default: MAJOR.MINOR.YYYYMMDDHHMMSS)"
+	@echo "  GHOSTFILE_VERSION - GhostFile release version (default: 1.0.TIMESTAMP)"
+	@echo "  GHOSTFILE_BUILD_NUMBER - Monotonic GhostFile bundle build number"
 	@echo ""
 	@echo "Notarization (via .env file or environment):"
+	@echo "  NOTARY_KEYCHAIN_PROFILE - Preferred notarytool Keychain profile"
+	@echo "  NOTARY_KEY_FILE / NOTARY_KEY_ID / NOTARY_ISSUER_ID - CI API key"
 	@echo "  NOTARY_APPLE_ID  - Apple ID for notarization"
 	@echo "  NOTARY_TEAM_ID   - Team ID for notarization"
 	@echo "  NOTARY_PASSWORD  - App-specific password for notarization"
diff --git a/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift b/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
index 65e1c23..69a2e03 100644
--- a/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
+++ b/Packages/GhostHTTP/Sources/GhostHTTP/GhostHTTP.swift
@@ -31,12 +31,14 @@ public enum HTTPStatus: Int, Sendable {
     case notFound = 404
     case methodNotAllowed = 405
     case requestTimeout = 408
+    case conflict = 409
     case payloadTooLarge = 413
     case rangeNotSatisfiable = 416
     case headerTooLarge = 431
     case badGateway = 502
     case serviceUnavailable = 503
     case gatewayTimeout = 504
+    case insufficientStorage = 507
     case internalServerError = 500
 
     public var reasonPhrase: String {
@@ -52,12 +54,14 @@ public enum HTTPStatus: Int, Sendable {
         case .notFound: return "Not Found"
         case .methodNotAllowed: return "Method Not Allowed"
         case .requestTimeout: return "Request Timeout"
+        case .conflict: return "Conflict"
         case .payloadTooLarge: return "Payload Too Large"
         case .rangeNotSatisfiable: return "Range Not Satisfiable"
         case .headerTooLarge: return "Request Header Fields Too Large"
         case .badGateway: return "Bad Gateway"
         case .serviceUnavailable: return "Service Unavailable"
         case .gatewayTimeout: return "Gateway Timeout"
+        case .insufficientStorage: return "Insufficient Storage"
         case .internalServerError: return "Internal Server Error"
         }
     }
diff --git a/RUNTIME_FOUNDATIONS.md b/RUNTIME_FOUNDATIONS.md
index 9875dec..18fbacc 100644
--- a/RUNTIME_FOUNDATIONS.md
+++ b/RUNTIME_FOUNDATIONS.md
@@ -79,8 +79,7 @@ frontend and is never forwarded directly to the host.
 
 Every request includes a major/minor version, request ID, method, and
 method-specific parameters. Frontends query `system.capabilities` before using
-optional methods. The current one-shot `run` request remains as the migration
-path while primitive handlers are added.
+optional methods. There is no one-shot run request or migration fallback.
 
 ## GhostTools CLI
 
diff --git a/docs/GHOSTFILE_RELEASE.md b/docs/GHOSTFILE_RELEASE.md
new file mode 100644
index 0000000..7dc70a6
--- /dev/null
+++ b/docs/GHOSTFILE_RELEASE.md
@@ -0,0 +1,112 @@
+# Releasing GhostFile
+
+GhostFile ships as a Developer ID signed, notarized, and stapled APFS disk
+image. The disk image contains `GhostFile.app`, an `/Applications` shortcut,
+and a short installation README.
+
+## One-time setup
+
+The release Mac needs:
+
+- macOS 26 and Xcode 26.4 or newer;
+- `xcodegen` (`brew install xcodegen`);
+- Rust 1.88 or newer, unless the reusable GhostHTTP3 toolchain image is
+  already available;
+- a **Developer ID Application** certificate for the GhostFile team;
+- permission and provisioning for the `com.apple.developer.fskit.fsmodule`
+  entitlement.
+
+The preferred notarization credential is a Keychain profile. This keeps the
+Apple ID app-specific password out of shell history, process listings, and the
+repository:
+
+```sh
+xcrun notarytool store-credentials ghostfile-notary \
+  --apple-id you@example.com \
+  --team-id YOUR_TEAM_ID
+```
+
+Enter the app-specific password at the secure prompt. Then add this to the
+untracked `.env` file:
+
+```sh
+NOTARY_KEYCHAIN_PROFILE=ghostfile-notary
+```
+
+App Store Connect API keys are also supported for CI through
+`NOTARY_KEY_FILE`, `NOTARY_KEY_ID`, and, for team keys,
+`NOTARY_ISSUER_ID`. The older `NOTARY_APPLE_ID`, `NOTARY_TEAM_ID`, and
+`NOTARY_PASSWORD` combination remains supported as a fallback.
+
+## Build a locally verifiable DMG
+
+```sh
+make ghostfile-dmg \
+  GHOSTFILE_VERSION=1.0.0 \
+  GHOSTFILE_BUILD_NUMBER=100
+```
+
+This archives GhostFile, exports it with Developer ID signing, verifies the
+app and embedded FSKit extension, creates and signs the disk image, mounts it
+read-only for inspection, and unregisters temporary FSKit copies. It does not
+contact Apple's notary service and must not be distributed.
+
+When no version or build number is supplied, the same timestamp is used for
+both, yielding a naturally increasing build number. Explicit build numbers
+must increase for each published version.
+
+## Build the distributable artifact
+
+```sh
+make ghostfile-notarized-dmg \
+  GHOSTFILE_VERSION=1.0.0 \
+  GHOSTFILE_BUILD_NUMBER=100
+```
+
+The release target performs the local DMG build and then:
+
+1. submits a separate, clearly named staging copy with `notarytool --wait`;
+2. records the submission JSON next to the image;
+3. retrieves the detailed Apple log if notarization is rejected;
+4. staples and validates the accepted ticket;
+5. checks the DMG and contained app with Gatekeeper;
+6. copies the final DMG to `GHOSTFILE_SHARED_DOWNLOADS` when that directory
+   exists.
+
+Only distribute the resulting file named
+`GhostFile--notarized-arm64.dmg`.
+
+If submission fails, that final filename is never created. The rejected
+`*-notary-submission-arm64.dmg` and Apple log remain available for diagnosis.
+
+## Standalone helpers
+
+The packaging and notarization stages can be rerun independently:
+
+```sh
+GHOSTFILE_CODESIGN_ID='Developer ID Application: Example (TEAMID)' \
+GHOSTFILE_DMG_README=macOS/GhostFile/DMG_README.txt \
+scripts/package-ghostfile-dmg.sh \
+  /path/to/GhostFile.app \
+  build/GhostFile-local-arm64.dmg
+
+NOTARY_KEYCHAIN_PROFILE=ghostfile-notary \
+scripts/notarize-ghostfile-dmg.sh \
+  build/GhostFile-local-arm64.dmg
+```
+
+The packaging helper refuses development-signed apps, apps without hardened
+runtime, mismatched app/extension versions, and extensions missing the FSKit
+entitlement.
+
+## CI secrets
+
+A CI signing runner needs these secrets or their equivalent:
+
+- the Developer ID Application certificate and its import password;
+- a Developer ID provisioning profile covering `org.ghostvm.ghostfile.fs`;
+- an App Store Connect API private key, key ID, and issuer ID;
+- `GHOSTFILE_SIGNING_TEAM`.
+
+Never commit certificates, provisioning profiles, API keys, app-specific
+passwords, generated notarization JSON, or temporary keychains.
diff --git a/docs/ghostbox-api/README.md b/docs/ghostbox-api/README.md
new file mode 100644
index 0000000..3f716bb
--- /dev/null
+++ b/docs/ghostbox-api/README.md
@@ -0,0 +1,41 @@
+# Ghostbox API Reference
+
+This reference maps all 282 cataloged Ghostbox direct CLI methods to their
+corresponding Apple Containerization, Apple container, or GhostVM adapter APIs.
+
+The combined command catalog is defined by
+[`GHOSTBOX_CLI_COMMANDS.json`](../../GHOSTBOX_CLI_COMMANDS.json),
+[`GHOSTBOX_CLI_TEMPLATE.md`](../../GHOSTBOX_CLI_TEMPLATE.md), and
+[`GHOSTBOX_CR_CLI_TEMPLATE.md`](../../GHOSTBOX_CR_CLI_TEMPLATE.md).
+Containerization links are pinned to `0.40.1` revision
+`7800b4642171561c95b5f55500b19e5dce5acd45`; container links are pinned to
+`1.2.0` revision `6e65319fe476ffe8db8ddaf828a537ed36fe2859`.
+
+CLI tables show inputs only. Ghostbox output types and the corresponding Swift
+declarations are intentionally omitted.
+
+| Page | Resources | Methods |
+|---|---|---:|
+| [Images and Content](images-and-content.md) | `content-store`, `authentication`, `progress-handler`, `image-store`, `image-description`, `image`, `content` | 41 |
+| [Boot and Mounts](boot-and-mounts.md) | `kernel-command-line`, `kernel`, `kernel-image`, `init-image`, `mount`, `boot-log` | 34 |
+| [Networking and Host Configuration](networking-and-host-configuration.md) | `dns`, `hosts-entry`, `hosts`, `socket`, `network`, `interface` | 46 |
+| [Virtual Machines](virtual-machines.md) | `vm-config`, `standard-vm-config`, `vmm`, `vm-instance` | 12 |
+| [Process Configuration](process-configuration.md) | `rlimit-kind`, `rlimit`, `capabilities`, `process-config` | 32 |
+| [Containers, Managers, and Processes](containers-managers-and-processes.md) | `container-config`, `manager`, `container`, `process` | 49 |
+| [Pods](pods.md) | `pod-volume`, `pod-config`, `pod-container-config`, `pod` | 46 |
+| [Container Volumes](container-volumes.md) | `volume` | 5 |
+| [Container Memory and Labels](container-memory-and-labels.md) | `memory-size`, `resource-labels` | 10 |
+| [Container Parser Utilities](container-parser-utilities.md) | `parser` | 7 |
+| **Total** | **39 resources** | **282** |
+
+## Signature Conventions
+
+- `cn:RESOURCE:OPERATION` selects the Containerization namespace; its long
+  namespace alias is `containerization`.
+- `cr:RESOURCE:OPERATION` selects the container namespace; its long namespace
+  alias is `container`.
+- `` is a literal input.
+- `@` is an existing VMHost-owned object reference.
+- `[argument]` is optional.
+- `argument...` is repeatable.
+- `[--argument=default]` is optional and shows the framework default.
diff --git a/docs/ghostbox-api/boot-and-mounts.md b/docs/ghostbox-api/boot-and-mounts.md
new file mode 100644
index 0000000..7eb39a4
--- /dev/null
+++ b/docs/ghostbox-api/boot-and-mounts.md
@@ -0,0 +1,88 @@
+# Ghostbox Boot and Mounts API
+
+This page maps the 34 Ghostbox boot and mount methods to their corresponding
+Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `kernel-command-line` | 7 |
+| `kernel` | 5 |
+| `kernel-image` | 5 |
+| `init-image` | 4 |
+| `mount` | 12 |
+| `boot-log` | 1 |
+| **Total** | **34** |
+
+## Kernel Command Line
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:kernel-command-line:create <command-line:name>
    [--kernel-argument <argument:string>]...
    [--init-argument <argument:string>]...
     | [`Kernel.CommandLine.init(kernelArgs:initArgs:)`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/init(kernelargs:initargs:)) |
+| 
    ghostbox cn:kernel-command-line:create-debug <command-line:name>
    <debug:bool>
    <panic:int>
    [--init-argument <argument:string>]...
     | [`Kernel.CommandLine.init(debug:panic:initArgs:)`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/init(debug:panic:initargs:)) |
+| 
    ghostbox cn:kernel-command-line:add-debug @<kernel-command-line:id>
     | [`Kernel.CommandLine.addDebug()`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/adddebug()) |
+| 
    ghostbox cn:kernel-command-line:add-panic @<kernel-command-line:id> <level:int>
     | [`Kernel.CommandLine.addPanic(level:)`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/addpanic(level:)) |
+| 
    ghostbox cn:kernel-command-line:set-agent-log-level @<kernel-command-line:id> <level:logger-level>
     | [`Kernel.CommandLine.setAgentLogLevel(level:)`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/setagentloglevel(level:)) |
+| 
    ghostbox cn:kernel-command-line:kernel-arguments @<kernel-command-line:id>
     | [`Kernel.CommandLine.kernelArgs`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/kernelargs) |
+| 
    ghostbox cn:kernel-command-line:init-arguments @<kernel-command-line:id>
     | [`Kernel.CommandLine.initArgs`](https://apple.github.io/containerization/documentation/containerization/kernel/commandline-swift.struct/initargs) |
+
+## Kernel
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:kernel:create <kernel:name>
    --path <path:host-url>
    --platform <platform:system-platform>
    [--command-line @<kernel-command-line:id>]
     | [`Kernel.init(path:platform:commandline:)`](https://apple.github.io/containerization/documentation/containerization/kernel/init(path:platform:commandline:)) |
+| 
    ghostbox cn:kernel:path @<kernel:id>
     | [`Kernel.path`](https://apple.github.io/containerization/documentation/containerization/kernel/path) |
+| 
    ghostbox cn:kernel:platform @<kernel:id>
     | [`Kernel.platform`](https://apple.github.io/containerization/documentation/containerization/kernel/platform) |
+| 
    ghostbox cn:kernel:kernel-arguments @<kernel:id>
     | [`Kernel.kernelArgs`](https://apple.github.io/containerization/documentation/containerization/kernel/kernelargs) |
+| 
    ghostbox cn:kernel:init-arguments @<kernel:id>
     | [`Kernel.initArgs`](https://apple.github.io/containerization/documentation/containerization/kernel/initargs) |
+
+Without `--command-line`, `kernel create` supplies a non-debug command line with
+panic level zero to the Apple initializer.
+
+## Kernel Image
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:kernel-image:from-image <kernel-image:name>
    @<image:id>
     | [`KernelImage.init(image:)`](https://apple.github.io/containerization/documentation/containerization/kernelimage/init(image:)) |
+| 
    ghostbox cn:kernel-image:create <kernel-image:name>
    <reference:string>
    --kernel @<kernel:id>...
    [--label <key-value:string>]...
    --image-store @<image-store:id>
    --content-store @<content-store:id>
     | [`KernelImage.create(reference:binaries:labels:imageStore:contentStore:)`](https://apple.github.io/containerization/documentation/containerization/kernelimage/create(reference:binaries:labels:imagestore:contentstore:)) |
+| 
    ghostbox cn:kernel-image:kernel @<kernel-image:id>
    <platform:system-platform>
     | [`KernelImage.kernel(for:)`](https://apple.github.io/containerization/documentation/containerization/kernelimage/kernel(for:)) |
+| 
    ghostbox cn:kernel-image:name @<kernel-image:id>
     | [`KernelImage.name`](https://apple.github.io/containerization/documentation/containerization/kernelimage/name) |
+| 
    ghostbox cn:kernel-image:media-type
     | [`KernelImage.mediaType`](https://apple.github.io/containerization/documentation/containerization/kernelimage/mediatype) |
+
+## Init Image
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:init-image:from-image <init-image:name>
    @<image:id>
     | [`InitImage.init(image:)`](https://apple.github.io/containerization/documentation/containerization/initimage/init(image:)) |
+| 
    ghostbox cn:init-image:create <init-image:name>
    <reference:string>
    --rootfs <rootfs:host-url>
    --platform <platform:oci-platform>
    [--label <key-value:string>]...
    --image-store @<image-store:id>
    --content-store @<content-store:id>
     | [`InitImage.create(reference:rootfs:platform:labels:imageStore:contentStore:)`](https://apple.github.io/containerization/documentation/containerization/initimage/create(reference:rootfs:platform:labels:imagestore:contentstore:)) |
+| 
    ghostbox cn:init-image:init-block @<init-image:id>
    --at <destination:host-url>
    --platform <platform:system-platform>
     | [`InitImage.initBlock(at:for:)`](https://apple.github.io/containerization/documentation/containerization/initimage/initblock(at:for:)) |
+| 
    ghostbox cn:init-image:name @<init-image:id>
     | [`InitImage.name`](https://apple.github.io/containerization/documentation/containerization/initimage/name) |
+
+## Mount
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:mount:create <mount:name>
    --type <type:string>
    --source <source:string>
    --destination <destination:container-path>
    --option <option:string>...
    --runtime-options <runtime-options:mount-runtime-options>
     | [`Mount.init(type:source:destination:options:runtimeOptions:)`](https://apple.github.io/containerization/documentation/containerization/mount/init(type:source:destination:options:runtimeoptions:)) |
+| 
    ghostbox cn:mount:block <mount:name>
    --format <format:string>
    --source <source:string>
    --destination <destination:container-path>
    [--option <option:string>]...
    [--runtime-option <option:string>]...
     | [`Mount.block(format:source:destination:options:runtimeOptions:)`](https://apple.github.io/containerization/documentation/containerization/mount/block(format:source:destination:options:runtimeoptions:)) |
+| 
    ghostbox cn:mount:share <mount:name>
    --source <source:string>
    --destination <destination:container-path>
    [--option <option:string>]...
    [--runtime-option <option:string>]...
     | [`Mount.share(source:destination:options:runtimeOptions:)`](https://apple.github.io/containerization/documentation/containerization/mount/share(source:destination:options:runtimeoptions:)) |
+| 
    ghostbox cn:mount:any <mount:name>
    --type <type:string>
    --source <source:string>
    --destination <destination:container-path>
    [--option <option:string>]...
    [--runtime-option <option:string>]...
     | [`Mount.any(type:source:destination:options:runtimeOptions:)`](https://apple.github.io/containerization/documentation/containerization/mount/any(type:source:destination:options:runtimeoptions:)) |
+| 
    ghostbox cn:mount:shared-mount <mount:name>
    --name <volume-name:string>
    --destination <destination:container-path>
    [--option <option:string>]...
     | [`Mount.sharedMount(name:destination:options:)`](https://apple.github.io/containerization/documentation/containerization/mount/sharedmount(name:destination:options:)) |
+| 
    ghostbox cn:mount:clone @<mount:id>
    --to <destination:host-path>
     | [`Mount.clone(to:)`](https://apple.github.io/containerization/documentation/containerization/mount/clone(to:)) |
+| 
    ghostbox cn:mount:is-block @<mount:id>
     | [`Mount.isBlock`](https://apple.github.io/containerization/documentation/containerization/mount/isblock) |
+| 
    ghostbox cn:mount:type @<mount:id>
     | [`Mount.type`](https://apple.github.io/containerization/documentation/containerization/mount/type) |
+| 
    ghostbox cn:mount:source @<mount:id>
     | [`Mount.source`](https://apple.github.io/containerization/documentation/containerization/mount/source) |
+| 
    ghostbox cn:mount:destination @<mount:id>
     | [`Mount.destination`](https://apple.github.io/containerization/documentation/containerization/mount/destination) |
+| 
    ghostbox cn:mount:options @<mount:id>
     | [`Mount.options`](https://apple.github.io/containerization/documentation/containerization/mount/options) |
+| 
    ghostbox cn:mount:runtime-options @<mount:id>
     | [`Mount.runtimeOptions`](https://apple.github.io/containerization/documentation/containerization/mount/runtimeoptions-swift.property) |
+
+The `block`, `share`, and `any` commands pass repeated `--runtime-option`
+values to Apple's `runtimeOptions` array parameter.
+
+## Boot Log
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:boot-log:file <boot-log:name>
    --path <path:host-url>
    [--append=true]
     | [`BootLog.file(path:append:)`](https://apple.github.io/containerization/documentation/containerization/bootlog/file(path:append:)) |
diff --git a/docs/ghostbox-api/container-memory-and-labels.md b/docs/ghostbox-api/container-memory-and-labels.md
new file mode 100644
index 0000000..b740fdf
--- /dev/null
+++ b/docs/ghostbox-api/container-memory-and-labels.md
@@ -0,0 +1,37 @@
+# Ghostbox Container Memory and Labels API
+
+This page maps the ten initial `cr` memory-size and resource-label commands to
+public Swift APIs in Apple container `1.2.0`, revision
+`6e65319fe476ffe8db8ddaf828a537ed36fe2859`.
+
+| Resource | Methods |
+|---|---:|
+| `memory-size` | 3 |
+| `resource-labels` | 7 |
+| **Total** | **10** |
+
+## Memory Size
+
+| Ghostbox Signature | Swift API |
+|---|---|
+| 
    ghostbox cr:memory-size:create <memory-size:name> <value:string>
     | [`MemorySize.init(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L27-L29) in `ContainerPersistence` |
+| 
    ghostbox cr:memory-size:formatted @<memory-size:id>
     | [`MemorySize.formatted`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L51-L55) in `ContainerPersistence` |
+| 
    ghostbox cr:memory-size:to-uint64 @<memory-size:id>
    <unit:bytes|kibibytes|mebibytes|gibibytes|tebibytes|pebibytes>
     | [`MemorySize.toUInt64(unit:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerPersistence/MemorySize.swift#L59-L61) in `ContainerPersistence` |
+
+Memory input follows the upstream parser. Conversion rounds the selected
+Foundation information-storage unit to the nearest unsigned integer.
+
+## Resource Labels
+
+| Ghostbox Signature | Swift API |
+|---|---|
+| 
    ghostbox cr:resource-labels:create <resource-labels:name>
    [--label <label:string>]...
     | [`ResourceLabels.init(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L39-L44) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:validate-key <key:string>
     | [`ResourceLabels.validateLabelKey(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L46-L57) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:validate <key:string> <value:string>
     | [`ResourceLabels.validateLabel(key:value:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L59-L65) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:dictionary @<resource-labels:id>
     | [`ResourceLabels.dictionary`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L25) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:value @<resource-labels:id>
    <key:string>
     | [`ResourceLabels.subscript(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L89-L92) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:key-length-max
     | [`ResourceLabels.keyLengthMax`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L21) in `ContainerResource` |
+| 
    ghostbox cr:resource-labels:label-length-max
     | [`ResourceLabels.labelLengthMax`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/ContainerResource/Common/ResourceLabels.swift#L23) in `ContainerResource` |
+
+Create labels use `key=value` input. Labels are returned as plain JSON, so they
+must not contain secrets.
diff --git a/docs/ghostbox-api/container-parser-utilities.md b/docs/ghostbox-api/container-parser-utilities.md
new file mode 100644
index 0000000..d959bce
--- /dev/null
+++ b/docs/ghostbox-api/container-parser-utilities.md
@@ -0,0 +1,23 @@
+# Ghostbox Container Parser Utilities API
+
+This page maps the seven initial `cr:parser` commands to public APIs in Apple
+container `1.2.0`, revision `6e65319fe476ffe8db8ddaf828a537ed36fe2859`.
+
+| Resource | Methods |
+|---|---:|
+| `parser` | 7 |
+| **Total** | **7** |
+
+| Ghostbox Signature | Swift API |
+|---|---|
+| 
    ghostbox cr:parser:memory-as-mib <memory:string>
     | [`Parser.memoryStringAsMiB(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L57-L61) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:memory-as-bytes <memory:string>
     | [`Parser.memoryStringAsBytes(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L63-L67) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:labels <label:string>...
     | [`Parser.labels(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L244-L261) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:platform <platform:string>
     | [`Parser.platform(from:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L101-L103) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:is-valid-domain-name <name:string>
     | [`Parser.isValidDomainName(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L895-L900) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:is-valid-domain-name-label <label:string>
     | [`Parser.isValidDomainNameLabel(_:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L902-L908) in `ContainerAPIClient` |
+| 
    ghostbox cr:parser:parse-bool <value:string>
     | [`Parser.parseBool(string:)`](https://github.com/apple/container/blob/6e65319fe476ffe8db8ddaf828a537ed36fe2859/Sources/Services/ContainerAPIService/Client/Parser.swift#L1061-L1063) in `ContainerAPIClient` |
+
+`labels` parses text but does not apply `ResourceLabels` validation. `parse-bool`
+returns `null` for values other than case-insensitive `true`, `t`, `false`, and
+`f`.
diff --git a/docs/ghostbox-api/container-volumes.md b/docs/ghostbox-api/container-volumes.md
new file mode 100644
index 0000000..3eca7d4
--- /dev/null
+++ b/docs/ghostbox-api/container-volumes.md
@@ -0,0 +1,22 @@
+# Ghostbox Container Volume API
+
+This page documents the five `cr` volume commands implemented by GhostVM's
+persistent-volume adapter. These commands retain the existing `volume.*` wire
+method IDs; they do not call Apple container's volume CLI commands.
+
+| Resource | Methods |
+|---|---:|
+| `volume` | 5 |
+| **Total** | **5** |
+
+| Ghostbox Signature | Swift Source |
+|---|---|
+| 
    ghostbox cr:volume:create <volume:name>
    [--size=8589934592]
     | [`GhostboxVolumeStore.create(name:sizeInBytes:)`](../../macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L32-L85) in `GhostVMContainerRuntime` |
+| 
    ghostbox cr:volume:list
     | [`GhostboxVolumeStore.list()`](../../macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L88-L91) in `GhostVMContainerRuntime` |
+| 
    ghostbox cr:volume:inspect @<volume:id>
     | [`GhostboxVolumeStore.inspect(name:)`](../../macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L93-L96) in `GhostVMContainerRuntime` |
+| 
    ghostbox cr:volume:mount @<volume:id>
    <mount:name>
    --destination <destination:container-path>
    [--read-only=false]
     | [`GhostboxVolumeStore.makeMount(volumeName:mountReference:destination:readOnly:)`](../../macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L110-L130) in `GhostVMContainerRuntime` |
+| 
    ghostbox cr:volume:delete @<volume:id>
     | [`GhostboxVolumeStore.delete(name:)`](../../macOS/GhostVMContainerRuntime/Ghostbox/GhostboxVolumeCommands.swift#L98-L108) in `GhostVMContainerRuntime` |
+
+`inspect` intentionally redacts the outer-host backing path. A volume can have
+only one active mount reference, and an active mount prevents deletion.
+`delete` permanently removes the volume and its contents.
diff --git a/docs/ghostbox-api/containers-managers-and-processes.md b/docs/ghostbox-api/containers-managers-and-processes.md
new file mode 100644
index 0000000..3dc552c
--- /dev/null
+++ b/docs/ghostbox-api/containers-managers-and-processes.md
@@ -0,0 +1,93 @@
+# Ghostbox Containers, Managers, and Processes API
+
+This page maps the 49 Ghostbox container configuration, manager, container, and
+process methods to their corresponding Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `container-config` | 2 |
+| `manager` | 11 |
+| `container` | 27 |
+| `process` | 9 |
+| **Total** | **49** |
+
+## Container Configuration
+
+Each `LinuxContainer` runs in its own VM. `cpus` and `memory` configure workload
+cgroup limits, while `/proc/cpuinfo` and `/proc/meminfo` expose VM capacity.
+Manager create operations with an explicit CPU limit default to zero additional
+vCPUs. An explicit memory limit defaults to enough VM overhead to compensate for
+the bundled guest kernel's reserved pages, making `MemTotal` track the limit.
+Supplying `cpuOverhead` or `memoryOverhead` remains authoritative. Inspect cgroup
+v2 `cpu.max` and `memory.max`, or use `container statistics`, for enforcement.
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:container-config:create-default
    <container-config:name>
     | [`LinuxContainer.Configuration.init()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/configuration/init()) |
+| 
    ghostbox cn:container-config:create
    <container-config:name>
    --process @<process-config:id>
    [--cpus=4]
    [--memory=1073741824]
    [--hostname <hostname:string>]
    [--sysctl <key-value:string>]...
    [--interface @<interface:id>]...
    [--socket @<socket:id>]...
    [--mount @<mount:id>]...
    [--masked-path <path:container-path>]...
    [--readonly-path <path:container-path>]...
    [--dns @<dns:id>]
    [--hosts @<hosts:id>]
    [--virtualization=false]
    [--boot-log @<boot-log:id>]
    [--oci-runtime-path <path:container-path>]
    [--use-init=false]
    [--cpu-overhead=1]
    [--memory-overhead=134217728]
     | [`LinuxContainer.Configuration.init(process:cpus:memoryInBytes:hostname:sysctl:interfaces:sockets:mounts:maskedPaths:readonlyPaths:dns:hosts:virtualization:bootLog:ociRuntimePath:useInit:cpuOverhead:memoryOverhead:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/configuration/init(process:cpus:memoryinbytes:hostname:sysctl:interfaces:sockets:mounts:maskedpaths:readonlypaths:dns:hosts:virtualization:bootlog:ociruntimepath:useinit:cpuoverhead:memoryoverhead:)) |
+
+## Manager
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:manager:create <manager:name>
    --kernel @<kernel:id>
    --initfs @<mount:id>
    --image-store @<image-store:id>
    [--network @<network:id>]
    [--rosetta=false]
    [--nested-virtualization=false]
     | [`ContainerManager.init(kernel:initfs:imageStore:network:rosetta:nestedVirtualization:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/init(kernel:initfs:imagestore:network:rosetta:nestedvirtualization:)) |
+| 
    ghostbox cn:manager:create-at-root <manager:name>
    --kernel @<kernel:id>
    --initfs @<mount:id>
    [--root <root:host-url>]
    [--network @<network:id>]
    [--rosetta=false]
    [--nested-virtualization=false]
     | [`ContainerManager.init(kernel:initfs:root:network:rosetta:nestedVirtualization:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/init(kernel:initfs:root:network:rosetta:nestedvirtualization:)) |
+| 
    ghostbox cn:manager:create-from-reference <manager:name>
    --kernel @<kernel:id>
    --initfs-reference <reference:string>
    --image-store @<image-store:id>
    [--network @<network:id>]
    [--rosetta=false]
    [--nested-virtualization=false]
     | [`ContainerManager.init(kernel:initfsReference:imageStore:network:rosetta:nestedVirtualization:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/init(kernel:initfsreference:imagestore:network:rosetta:nestedvirtualization:)) |
+| 
    ghostbox cn:manager:create-from-reference-at-root
    <manager:name>
    --kernel @<kernel:id>
    --initfs-reference <reference:string>
    [--root <root:host-url>]
    [--network @<network:id>]
    [--rosetta=false]
    [--nested-virtualization=false]
     | [`ContainerManager.init(kernel:initfsReference:root:network:rosetta:nestedVirtualization:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/init(kernel:initfsreference:root:network:rosetta:nestedvirtualization:)) |
+| 
    ghostbox cn:manager:create-with-vmm <manager:name>
    --vmm @<vmm:id>
    [--network @<network:id>]
     | [`ContainerManager.init(vmm:network:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/init(vmm:network:)) |
+| 
    ghostbox cn:manager:image-store @<manager:id>
     | [`ContainerManager.imageStore`](https://apple.github.io/containerization/documentation/containerization/containermanager/imagestore) |
+| 
    ghostbox cn:manager:create-container @<manager:id>
    <container:name>
    --reference <reference:string>
    [--rootfs-size=8589934592]
    [--writable-layer-size <bytes:uint64>]
    [--read-only=false]
    [--networking=true]
    [--progress @<progress-handler:id>]
    [--process @<process-config:id>]
    [--cpus <cpus:int>]
    [--memory <bytes:uint64>]
    [--hostname <hostname:string>]
    [--sysctl <key-value:string>]...
    [--interfaces @<interface:id>]...
    [--sockets @<socket:id>]...
    [--mounts @<mount:id>]...
    [--masked-paths <path:container-path>]...
    [--readonly-paths <path:container-path>]...
    [--dns @<dns:id>]
    [--hosts @<hosts:id>]
    [--virtualization <enabled:bool>]
    [--boot-log @<boot-log:id>]
    [--oci-runtime-path <path:container-path>]
    [--use-init <enabled:bool>]
    [--cpu-overhead <cpus:int>]
    [--memory-overhead <bytes:uint64>]
     | [`ContainerManager.create(_:reference:rootfsSizeInBytes:writableLayerSizeInBytes:readOnly:networking:progress:configuration:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/create(_:reference:rootfssizeinbytes:writablelayersizeinbytes:readonly:networking:progress:configuration:)) |
+| 
    ghostbox cn:manager:create-container-from-image @<manager:id>
    <container:name>
    --image @<image:id>
    [--rootfs-size=8589934592]
    [--writable-layer-size <bytes:uint64>]
    [--read-only=false]
    [--networking=true]
    [--progress @<progress-handler:id>]
    [--process @<process-config:id>]
    [--cpus <cpus:int>]
    [--memory <bytes:uint64>]
    [--hostname <hostname:string>]
    [--sysctl <key-value:string>]...
    [--interfaces @<interface:id>]...
    [--sockets @<socket:id>]...
    [--mounts @<mount:id>]...
    [--masked-paths <path:container-path>]...
    [--readonly-paths <path:container-path>]...
    [--dns @<dns:id>]
    [--hosts @<hosts:id>]
    [--virtualization <enabled:bool>]
    [--boot-log @<boot-log:id>]
    [--oci-runtime-path <path:container-path>]
    [--use-init <enabled:bool>]
    [--cpu-overhead <cpus:int>]
    [--memory-overhead <bytes:uint64>]
     | [`ContainerManager.create(_:image:rootfsSizeInBytes:writableLayerSizeInBytes:readOnly:networking:progress:configuration:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/create(_:image:rootfssizeinbytes:writablelayersizeinbytes:readonly:networking:progress:configuration:)) |
+| 
    ghostbox cn:manager:create-container-from-mounts @<manager:id>
    <container:name>
    --image @<image:id>
    --rootfs @<mount:id>
    [--writable-layer @<mount:id>]
    [--networking=true]
    [--process @<process-config:id>]
    [--cpus <cpus:int>]
    [--memory <bytes:uint64>]
    [--hostname <hostname:string>]
    [--sysctl <key-value:string>]...
    [--interfaces @<interface:id>]...
    [--sockets @<socket:id>]...
    [--mounts @<mount:id>]...
    [--masked-paths <path:container-path>]...
    [--readonly-paths <path:container-path>]...
    [--dns @<dns:id>]
    [--hosts @<hosts:id>]
    [--virtualization <enabled:bool>]
    [--boot-log @<boot-log:id>]
    [--oci-runtime-path <path:container-path>]
    [--use-init <enabled:bool>]
    [--cpu-overhead <cpus:int>]
    [--memory-overhead <bytes:uint64>]
     | [`ContainerManager.create(_:image:rootfs:writableLayer:networking:configuration:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/create(_:image:rootfs:writablelayer:networking:configuration:)) |
+| 
    ghostbox cn:manager:release-network @<manager:id>
    @<container:id>
     | [`ContainerManager.releaseNetwork(_:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/releasenetwork(_:)) |
+| 
    ghostbox cn:manager:delete @<manager:id>
    @<container:id>
     | [`ContainerManager.delete(_:)`](https://apple.github.io/containerization/documentation/containerization/containermanager/delete(_:)) |
+
+## Container
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:container:default-mounts
     | [`LinuxContainer.defaultMounts()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/defaultmounts()) |
+| 
    ghostbox cn:container:default-oci-mounts
     | [`LinuxContainer.defaultOCIMounts()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/defaultocimounts()) |
+| 
    ghostbox cn:container:default-masked-paths
     | [`LinuxContainer.defaultMaskedPaths()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/defaultmaskedpaths()) |
+| 
    ghostbox cn:container:default-readonly-paths
     | [`LinuxContainer.defaultReadonlyPaths()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/defaultreadonlypaths()) |
+| 
    ghostbox cn:container:default-copy-chunk-size
     | [`LinuxContainer.defaultCopyChunkSize`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/defaultcopychunksize) |
+| 
    ghostbox cn:container:max-id-length
     | [`LinuxContainer.maxIDLength`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/maxidlength) |
+| 
    ghostbox cn:container:create-direct <container:name>
    --rootfs @<mount:id>
    [--writable-layer @<mount:id>]
    --vmm @<vmm:id>
    --configuration @<container-config:id>
     | [`LinuxContainer.init(_:rootfs:writableLayer:vmm:configuration:logger:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/init(_:rootfs:writablelayer:vmm:configuration:logger:)) |
+| 
    ghostbox cn:container:id @<container:id>
     | [`LinuxContainer.id`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/id) |
+| 
    ghostbox cn:container:rootfs @<container:id>
     | [`LinuxContainer.rootfs`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/rootfs) |
+| 
    ghostbox cn:container:writable-layer @<container:id>
     | [`LinuxContainer.writableLayer`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/writablelayer) |
+| 
    ghostbox cn:container:config @<container:id>
     | [`LinuxContainer.config`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/config) |
+| 
    ghostbox cn:container:cpus @<container:id>
     | [`LinuxContainer.cpus`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/cpus) |
+| 
    ghostbox cn:container:memory @<container:id>
     | [`LinuxContainer.memoryInBytes`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/memoryinbytes) |
+| 
    ghostbox cn:container:interfaces @<container:id>
     | [`LinuxContainer.interfaces`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/interfaces) |
+| 
    ghostbox cn:container:create @<container:id>
     | [`LinuxContainer.create()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/create()) |
+| 
    ghostbox cn:container:start @<container:id>
     | [`LinuxContainer.start()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/start()) |
+| 
    ghostbox cn:container:stop @<container:id>
     | [`LinuxContainer.stop()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/stop()) |
+| 
    ghostbox cn:container:kill @<container:id>
    <signal:linux-signal>
     | [`LinuxContainer.kill(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/kill(_:)) |
+| 
    ghostbox cn:container:wait @<container:id>
    [--timeout-seconds <seconds:int64>]
     | [`LinuxContainer.wait(timeoutInSeconds:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/wait(timeoutinseconds:)) |
+| 
    ghostbox cn:container:resize @<container:id>
    <width:uint16>
    <height:uint16>
     | [`LinuxContainer.resize(to:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/resize(to:)) |
+| 
    ghostbox cn:container:exec @<container:id>
    <process:name>
    --configuration @<process-config:id>
     | [`LinuxContainer.exec(_:configuration:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/exec(_:configuration:)-7nhhe) |
+| 
    ghostbox cn:container:dial-vsock @<container:id>
    <port:uint32>
     | [`LinuxContainer.dialVsock(port:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/dialvsock(port:)) |
+| 
    ghostbox cn:container:close-stdin @<container:id>
     | [`LinuxContainer.closeStdin()`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/closestdin()) |
+| 
    ghostbox cn:container:statistics @<container:id>
    [--category <category:statistics-category>]...
     | [`LinuxContainer.statistics(categories:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/statistics(categories:)) |
+| 
    ghostbox cn:container:filesystem-operation @<container:id>
    <operation:freeze|thaw|trim>
    <path:container-path>
     | [`LinuxContainer.filesystemOperation(operation:path:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/filesystemoperation(operation:path:)) |
+| 
    ghostbox cn:container:copy-in @<container:id>
    <source:host-url>
    <destination:container-url>
    [--mode=0644]
    [--create-parents=true]
    [--chunk-size=1048576]
     | [`LinuxContainer.copyIn(from:to:mode:createParents:chunkSize:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/copyin(from:to:mode:createparents:chunksize:)) |
+| 
    ghostbox cn:container:copy-out @<container:id>
    <source:container-url>
    <destination:host-url>
    [--create-parents=true]
    [--chunk-size=1048576]
     | [`LinuxContainer.copyOut(from:to:createParents:chunkSize:)`](https://apple.github.io/containerization/documentation/containerization/linuxcontainer/copyout(from:to:createparents:chunksize:)) |
+
+## Process
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:process:id @<process:id>
     | [`LinuxProcess.id`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/id) |
+| 
    ghostbox cn:process:owning-container @<process:id>
     | [`LinuxProcess.owningContainer`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/owningcontainer) |
+| 
    ghostbox cn:process:pid @<process:id>
     | [`LinuxProcess.pid`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/pid) |
+| 
    ghostbox cn:process:start @<process:id>
     | [`LinuxProcess.start()`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/start()) |
+| 
    ghostbox cn:process:kill @<process:id>
    <signal:linux-signal>
     | [`LinuxProcess.kill(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/kill(_:)) |
+| 
    ghostbox cn:process:resize @<process:id>
    <width:uint16>
    <height:uint16>
     | [`LinuxProcess.resize(to:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/resize(to:)) |
+| 
    ghostbox cn:process:close-stdin @<process:id>
     | [`LinuxProcess.closeStdin()`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/closestdin()) |
+| 
    ghostbox cn:process:wait @<process:id>
    [--timeout-seconds <seconds:int64>]
     | [`LinuxProcess.wait(timeoutInSeconds:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/wait(timeoutinseconds:)) |
+| 
    ghostbox cn:process:delete @<process:id>
     | [`LinuxProcess.delete()`](https://apple.github.io/containerization/documentation/containerization/linuxprocess/delete()) |
diff --git a/docs/ghostbox-api/images-and-content.md b/docs/ghostbox-api/images-and-content.md
new file mode 100644
index 0000000..bc23814
--- /dev/null
+++ b/docs/ghostbox-api/images-and-content.md
@@ -0,0 +1,99 @@
+# Ghostbox Images and Content API
+
+This page maps the 41 Ghostbox image and content methods to their corresponding
+Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json` and
+  `GHOSTBOX_CLI_TEMPLATE.md`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `image-store` | 16 |
+| `content-store` | 1 |
+| `authentication` | 1 |
+| `progress-handler` | 1 |
+| `image-description` | 5 |
+| `image` | 12 |
+| `content` | 5 |
+| **Total** | **41** |
+
+## Image Store
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:image-store:create <image-store:name>
    --path <path:host-url>
    [--content-store @<content-store:id>]
     | [`ImageStore.init(path:contentStore:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/init(path:contentstore:)) |
+| 
    ghostbox cn:image-store:default
     | [`ImageStore.default`](https://apple.github.io/containerization/documentation/containerization/imagestore/default) |
+| 
    ghostbox cn:image-store:path @<image-store:id>
     | [`ImageStore.path`](https://apple.github.io/containerization/documentation/containerization/imagestore/path) |
+| 
    ghostbox cn:image-store:get @<image-store:id>
    <reference:string>
    [--pull=false]
     | [`ImageStore.get(reference:pull:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/get(reference:pull:)) |
+| 
    ghostbox cn:image-store:list @<image-store:id>
     | [`ImageStore.list()`](https://apple.github.io/containerization/documentation/containerization/imagestore/list()) |
+| 
    ghostbox cn:image-store:create-image @<image-store:id>
    @<image-description:id>
     | [`ImageStore.create(description:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/create(description:)) |
+| 
    ghostbox cn:image-store:delete @<image-store:id>
    <reference:string>
    [--perform-cleanup=false]
     | [`ImageStore.delete(reference:performCleanup:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/delete(reference:performcleanup:)) |
+| 
    ghostbox cn:image-store:clean-up-orphaned-blobs @<image-store:id>
     | [`ImageStore.cleanUpOrphanedBlobs()`](https://apple.github.io/containerization/documentation/containerization/imagestore/cleanuporphanedblobs()) |
+| 
    ghostbox cn:image-store:calculate-orphaned-blobs-size @<image-store:id>
     | [`ImageStore.calculateOrphanedBlobsSize()`](https://apple.github.io/containerization/documentation/containerization/imagestore/calculateorphanedblobssize()) |
+| 
    ghostbox cn:image-store:tag @<image-store:id>
    <existing-reference:string>
    <new-reference:string>
     | [`ImageStore.tag(existing:new:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/tag(existing:new:)) |
+| 
    ghostbox cn:image-store:pull @<image-store:id>
    <reference:string>
    [--platform <platform:oci-platform>]
    [--insecure=false]
    [--authentication @<authentication:id>]
    [--progress @<progress-handler:id>]
    [--max-concurrent-downloads=3]
     | [`ImageStore.pull(reference:platform:insecure:auth:progress:maxConcurrentDownloads:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/pull(reference:platform:insecure:auth:progress:maxconcurrentdownloads:)) |
+| 
    ghostbox cn:image-store:push @<image-store:id>
    <reference:string>
    [--platform <platform:oci-platform>]
    [--insecure=false]
    [--authentication @<authentication:id>]
    [--progress @<progress-handler:id>]
     | [`ImageStore.push(reference:platform:insecure:auth:progress:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/push(reference:platform:insecure:auth:progress:)) |
+| 
    ghostbox cn:image-store:push-many @<image-store:id>
    <reference:string>...
    [--platform <platform:oci-platform>]
    [--insecure=false]
    [--authentication @<authentication:id>]
    [--max-concurrent-uploads=3]
    [--progress @<progress-handler:id>]
     | [`ImageStore.push(references:platform:insecure:auth:maxConcurrentUploads:progress:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/push(references:platform:insecure:auth:maxconcurrentuploads:progress:)) |
+| 
    ghostbox cn:image-store:save @<image-store:id>
    <reference:string>...
    --out <directory:host-url>
    [--platform <platform:oci-platform>]
     | [`ImageStore.save(references:out:platform:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/save(references:out:platform:)) |
+| 
    ghostbox cn:image-store:load @<image-store:id>
    <directory:host-url>
    [--progress @<progress-handler:id>]
     | [`ImageStore.load(from:progress:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/load(from:progress:)) |
+| 
    ghostbox cn:image-store:get-init-image @<image-store:id>
    <reference:string>
    [--authentication @<authentication:id>]
    [--progress @<progress-handler:id>]
     | [`ImageStore.getInitImage(reference:auth:progress:)`](https://apple.github.io/containerization/documentation/containerization/imagestore/getinitimage(reference:auth:progress:)) |
+
+`image-store push` and `image-store push-many` select Apple's single-reference
+and multiple-reference `push` overloads respectively.
+
+## Content Store, Authentication, and Progress
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:content-store:create <content-store:name>
    --path <path:host-url>
     | [`LocalContentStore.init(path:)`](https://apple.github.io/containerization/documentation/containerizationoci/localcontentstore/init(path:)) |
+| 
    ghostbox cn:authentication:create-basic <authentication:name>
    --username <username:string>
    --password <password:string>
     | [`BasicAuthentication.init(username:password:)`](https://apple.github.io/containerization/documentation/containerizationoci/basicauthentication/init(username:password:)) |
+| 
    ghostbox cn:progress-handler:create <progress-handler:name>
    --writer @<writer:id>
     | [`ProgressHandler`](https://apple.github.io/containerization/documentation/containerizationextras/progresshandler) |
+
+The progress-handler command is a Ghostbox transport adapter for Apple's
+callback type. It writes newline-delimited `{event,value}` JSON objects through
+the selected Apple `Writer` implementation.
+
+## Image Description
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:image-description:create
    <image-description:name>
    <reference:string>
    <descriptor:oci-descriptor-json>
     | [`Image.Description.init(reference:descriptor:)`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.struct/init(reference:descriptor:)) |
+| 
    ghostbox cn:image-description:reference @<image-description:id>
     | [`Image.Description.reference`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.struct/reference) |
+| 
    ghostbox cn:image-description:descriptor @<image-description:id>
     | [`Image.Description.descriptor`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.struct/descriptor) |
+| 
    ghostbox cn:image-description:digest @<image-description:id>
     | [`Image.Description.digest`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.struct/digest) |
+| 
    ghostbox cn:image-description:media-type @<image-description:id>
     | [`Image.Description.mediaType`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.struct/mediatype) |
+
+## Image
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:image:create <image:name>
    @<image-description:id>
    @<content-store:id>
     | [`Image.init(description:contentStore:)`](https://apple.github.io/containerization/documentation/containerization/image/init(description:contentstore:)) |
+| 
    ghostbox cn:image:description @<image:id>
     | [`Image.description`](https://apple.github.io/containerization/documentation/containerization/image/description-swift.property) |
+| 
    ghostbox cn:image:descriptor @<image:id>
     | [`Image.descriptor`](https://apple.github.io/containerization/documentation/containerization/image/descriptor) |
+| 
    ghostbox cn:image:digest @<image:id>
     | [`Image.digest`](https://apple.github.io/containerization/documentation/containerization/image/digest) |
+| 
    ghostbox cn:image:media-type @<image:id>
     | [`Image.mediaType`](https://apple.github.io/containerization/documentation/containerization/image/mediatype) |
+| 
    ghostbox cn:image:reference @<image:id>
     | [`Image.reference`](https://apple.github.io/containerization/documentation/containerization/image/reference) |
+| 
    ghostbox cn:image:index @<image:id>
     | [`Image.index()`](https://apple.github.io/containerization/documentation/containerization/image/index()) |
+| 
    ghostbox cn:image:manifest @<image:id>
    <platform:oci-platform>
     | [`Image.manifest(for:)`](https://apple.github.io/containerization/documentation/containerization/image/manifest(for:)) |
+| 
    ghostbox cn:image:descriptor-for @<image:id>
    <platform:oci-platform>
     | [`Image.descriptor(for:)`](https://apple.github.io/containerization/documentation/containerization/image/descriptor(for:)) |
+| 
    ghostbox cn:image:config @<image:id>
    <platform:oci-platform>
     | [`Image.config(for:)`](https://apple.github.io/containerization/documentation/containerization/image/config(for:)) |
+| 
    ghostbox cn:image:referenced-digests @<image:id>
     | [`Image.referencedDigests()`](https://apple.github.io/containerization/documentation/containerization/image/referenceddigests()) |
+| 
    ghostbox cn:image:get-content @<image:id>
    <digest:string>
     | [`Image.getContent(digest:)`](https://apple.github.io/containerization/documentation/containerization/image/getcontent(digest:)) |
+
+## Content
+
+The linked `Content` APIs belong to the `ContainerizationOCI` module.
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:content:path @<content:id>
     | [`Content.path`](https://apple.github.io/containerization/documentation/containerizationoci/content/path) |
+| 
    ghostbox cn:content:digest @<content:id>
     | [`Content.digest()`](https://apple.github.io/containerization/documentation/containerizationoci/content/digest()) |
+| 
    ghostbox cn:content:size @<content:id>
     | [`Content.size()`](https://apple.github.io/containerization/documentation/containerizationoci/content/size()) |
+| 
    ghostbox cn:content:data @<content:id>
     | [`Content.data()`](https://apple.github.io/containerization/documentation/containerizationoci/content/data()) |
+| 
    ghostbox cn:content:data-range @<content:id>
    <offset:uint64>
    <length:int>
     | [`Content.data(offset:length:)`](https://apple.github.io/containerization/documentation/containerizationoci/content/data(offset:length:)) |
+
+Ghostbox enforces its direct-protocol byte limit before returning content data.
+For `content data-range`, a CLI length of zero means read from the offset through
+the end of the content.
diff --git a/docs/ghostbox-api/networking-and-host-configuration.md b/docs/ghostbox-api/networking-and-host-configuration.md
new file mode 100644
index 0000000..48d5182
--- /dev/null
+++ b/docs/ghostbox-api/networking-and-host-configuration.md
@@ -0,0 +1,100 @@
+# Ghostbox Networking and Host Configuration API
+
+This page maps the 46 Ghostbox networking and host configuration methods to
+their corresponding Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json` and
+  `GHOSTBOX_CLI_TEMPLATE.md`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `dns` | 8 |
+| `hosts-entry` | 11 |
+| `hosts` | 5 |
+| `socket` | 6 |
+| `network` | 9 |
+| `interface` | 7 |
+| **Total** | **46** |
+
+## DNS
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:dns:create <dns:name>
    [--nameserver <address:string>]...
    [--domain <domain:string>]
    [--search-domain <domain:string>]...
    [--option <option:string>]...
     | [`DNS.init(nameservers:domain:searchDomains:options:)`](https://apple.github.io/containerization/documentation/containerization/dns/init(nameservers:domain:searchdomains:options:)) |
+| 
    ghostbox cn:dns:default-nameservers
     | [`DNS.defaultNameservers`](https://apple.github.io/containerization/documentation/containerization/dns/defaultnameservers) |
+| 
    ghostbox cn:dns:validate @<dns:id>
     | [`DNS.validate()`](https://apple.github.io/containerization/documentation/containerization/dns/validate()) |
+| 
    ghostbox cn:dns:resolv-conf @<dns:id>
     | [`DNS.resolvConf`](https://apple.github.io/containerization/documentation/containerization/dns/resolvconf) |
+| 
    ghostbox cn:dns:nameservers @<dns:id>
     | [`DNS.nameservers`](https://apple.github.io/containerization/documentation/containerization/dns/nameservers) |
+| 
    ghostbox cn:dns:domain @<dns:id>
     | [`DNS.domain`](https://apple.github.io/containerization/documentation/containerization/dns/domain) |
+| 
    ghostbox cn:dns:search-domains @<dns:id>
     | [`DNS.searchDomains`](https://apple.github.io/containerization/documentation/containerization/dns/searchdomains) |
+| 
    ghostbox cn:dns:options @<dns:id>
     | [`DNS.options`](https://apple.github.io/containerization/documentation/containerization/dns/options) |
+
+## Hosts Entry
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:hosts-entry:create <hosts-entry:name>
    <ip-address:string>
    <hostname:string>...
    [--comment <comment:string>]
     | [`Hosts.Entry.init(ipAddress:hostnames:comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/init(ipaddress:hostnames:comment:)) |
+| 
    ghostbox cn:hosts-entry:localhost-ipv4 <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.localHostIPV4(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/localhostipv4(comment:)) |
+| 
    ghostbox cn:hosts-entry:localhost-ipv6 <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.localHostIPV6(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/localhostipv6(comment:)) |
+| 
    ghostbox cn:hosts-entry:ipv6-localnet <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.ipv6LocalNet(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/ipv6localnet(comment:)) |
+| 
    ghostbox cn:hosts-entry:ipv6-mcastprefix <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.ipv6MulticastPrefix(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/ipv6multicastprefix(comment:)) |
+| 
    ghostbox cn:hosts-entry:ipv6-allnodes <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.ipv6AllNodes(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/ipv6allnodes(comment:)) |
+| 
    ghostbox cn:hosts-entry:ipv6-allrouters <hosts-entry:name>
    [--comment <comment:string>]
     | [`Hosts.Entry.ipv6AllRouters(comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/ipv6allrouters(comment:)) |
+| 
    ghostbox cn:hosts-entry:rendered @<hosts-entry:id>
     | [`Hosts.Entry.rendered`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/rendered) |
+| 
    ghostbox cn:hosts-entry:ip-address @<hosts-entry:id>
     | [`Hosts.Entry.ipAddress`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/ipaddress) |
+| 
    ghostbox cn:hosts-entry:hostnames @<hosts-entry:id>
     | [`Hosts.Entry.hostnames`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/hostnames) |
+| 
    ghostbox cn:hosts-entry:comment @<hosts-entry:id>
     | [`Hosts.Entry.comment`](https://apple.github.io/containerization/documentation/containerization/hosts/entry/comment) |
+
+## Hosts
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:hosts:create <hosts:name>
    [--entry @<hosts-entry:id>]...
    [--comment <comment:string>]
     | [`Hosts.init(entries:comment:)`](https://apple.github.io/containerization/documentation/containerization/hosts/init(entries:comment:)) |
+| 
    ghostbox cn:hosts:default
     | [`Hosts.default`](https://apple.github.io/containerization/documentation/containerization/hosts/default) |
+| 
    ghostbox cn:hosts:hosts-file @<hosts:id>
     | [`Hosts.hostsFile`](https://apple.github.io/containerization/documentation/containerization/hosts/hostsfile) |
+| 
    ghostbox cn:hosts:entries @<hosts:id>
     | [`Hosts.entries`](https://apple.github.io/containerization/documentation/containerization/hosts/entries) |
+| 
    ghostbox cn:hosts:comment @<hosts:id>
     | [`Hosts.comment`](https://apple.github.io/containerization/documentation/containerization/hosts/comment) |
+
+## Socket
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:socket:create <socket:name>
    --source <source:host-url>
    --destination <destination:host-url>
    [--permissions <permissions:file-permissions>]
    [--direction <direction:into|out-of>]
     | [`UnixSocketConfiguration.init(source:destination:permissions:direction:)`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/init(source:destination:permissions:direction:)) |
+| 
    ghostbox cn:socket:id @<socket:id>
     | [`UnixSocketConfiguration.id`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/id) |
+| 
    ghostbox cn:socket:source @<socket:id>
     | [`UnixSocketConfiguration.source`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/source) |
+| 
    ghostbox cn:socket:destination @<socket:id>
     | [`UnixSocketConfiguration.destination`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/destination) |
+| 
    ghostbox cn:socket:permissions @<socket:id>
     | [`UnixSocketConfiguration.permissions`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/permissions) |
+| 
    ghostbox cn:socket:direction @<socket:id>
     | [`UnixSocketConfiguration.direction`](https://apple.github.io/containerization/documentation/containerization/unixsocketconfiguration/direction-swift.property) |
+
+## Network
+
+`VmnetNetwork` is available on macOS 26 and later.
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:network:vmnet-create <network:name>
    [--mode=shared]
    [--subnet <subnet:cidrv4>]
    [--prefix-v6 <prefix:cidrv6>]
     | [`VmnetNetwork.init(mode:subnet:prefixV6:)`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/init(mode:subnet:prefixv6:)) |
+| 
    ghostbox cn:network:subnet @<network:id>
     | [`VmnetNetwork.subnet`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/subnet) |
+| 
    ghostbox cn:network:prefix-v6 @<network:id>
     | [`VmnetNetwork.prefixV6`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/prefixv6) |
+| 
    ghostbox cn:network:ipv4-gateway @<network:id>
     | [`VmnetNetwork.ipv4Gateway`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/ipv4gateway) |
+| 
    ghostbox cn:network:ipv6-gateway @<network:id>
     | [`VmnetNetwork.ipv6Gateway`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/ipv6gateway) |
+| 
    ghostbox cn:network:create-interface @<network:id>
    <interface:name>
     | [`VmnetNetwork.createInterface(_:)`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/createinterface(_:)) |
+| 
    ghostbox cn:network:create-interface-mtu @<network:id>
    <interface:name>
    <mtu:uint32>
     | [`VmnetNetwork.createInterface(_:mtu:)`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/createinterface(_:mtu:)) |
+| 
    ghostbox cn:network:create-interface-without-gateway @<network:id>
    <interface:name>
     | [`VmnetNetwork.createInterfaceWithoutGateway(_:)`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/createinterfacewithoutgateway(_:)) |
+| 
    ghostbox cn:network:release-interface @<network:id>
    @<interface:id>
     | [`VmnetNetwork.releaseInterface(_:)`](https://apple.github.io/containerization/documentation/containerization/vmnetnetwork/releaseinterface(_:)) |
+
+## Interface
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:interface:nat-create <interface:name>
    --ipv4-address <address:cidrv4>
    [--ipv4-gateway <gateway:ipv4-address>]
    [--ipv6-address <address:cidrv6>]
    [--ipv6-gateway <gateway:ipv6-address>]
    [--mac-address <address:mac-address>]
    [--mtu=1500]
     | [`NATInterface.init(ipv4Address:ipv4Gateway:ipv6Address:ipv6Gateway:macAddress:mtu:)`](https://apple.github.io/containerization/documentation/containerization/natinterface/init(ipv4address:ipv4gateway:ipv6address:ipv6gateway:macaddress:mtu:)) |
+| 
    ghostbox cn:interface:ipv4-address @<interface:id>
     | [`Interface.ipv4Address`](https://apple.github.io/containerization/documentation/containerization/interface/ipv4address) |
+| 
    ghostbox cn:interface:ipv4-gateway @<interface:id>
     | [`Interface.ipv4Gateway`](https://apple.github.io/containerization/documentation/containerization/interface/ipv4gateway) |
+| 
    ghostbox cn:interface:ipv6-address @<interface:id>
     | [`Interface.ipv6Address`](https://apple.github.io/containerization/documentation/containerization/interface/ipv6address) |
+| 
    ghostbox cn:interface:ipv6-gateway @<interface:id>
     | [`Interface.ipv6Gateway`](https://apple.github.io/containerization/documentation/containerization/interface/ipv6gateway) |
+| 
    ghostbox cn:interface:mac-address @<interface:id>
     | [`Interface.macAddress`](https://apple.github.io/containerization/documentation/containerization/interface/macaddress) |
+| 
    ghostbox cn:interface:mtu @<interface:id>
     | [`Interface.mtu`](https://apple.github.io/containerization/documentation/containerization/interface/mtu) |
+
+The interface accessors use `Interface` protocol requirements because Ghostbox
+stores and reads both NAT and vmnet-backed interfaces through `any Interface`.
diff --git a/docs/ghostbox-api/pods.md b/docs/ghostbox-api/pods.md
new file mode 100644
index 0000000..9a02560
--- /dev/null
+++ b/docs/ghostbox-api/pods.md
@@ -0,0 +1,89 @@
+# Ghostbox Pods API
+
+This page maps the 46 Ghostbox pod methods to their corresponding Apple
+Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json`.
+- Apple API mappings are sourced from `GhostboxPodCommands.swift`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `pod-volume` | 1 |
+| `pod-config` | 11 |
+| `pod-container-config` | 13 |
+| `pod` | 21 |
+| **Total** | **46** |
+
+## Pod Volume
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:pod-volume:create <pod-volume:name>
    --name <volume-name:string>
    --source <source:pod-volume-source>
    --format <format:string>
     | [`LinuxPod.PodVolume.init(name:source:format:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/podvolume/init(name:source:format:)) |
+
+## Pod Configuration
+
+The `set-*` commands assign the supplied value to the linked documented
+`LinuxPod.Configuration` property.
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:pod-config:create <pod-config:name>
     | [`LinuxPod.Configuration.init()`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/init()) |
+| 
    ghostbox cn:pod-config:set-cpus @<pod-config:id> <cpus:int>
     | [`LinuxPod.Configuration.cpus`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/cpus) |
+| 
    ghostbox cn:pod-config:set-memory @<pod-config:id> <bytes:uint64>
     | [`LinuxPod.Configuration.memoryInBytes`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/memoryinbytes) |
+| 
    ghostbox cn:pod-config:set-interfaces @<pod-config:id> @<interface:id>...
     | [`LinuxPod.Configuration.interfaces`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/interfaces) |
+| 
    ghostbox cn:pod-config:set-virtualization @<pod-config:id> <enabled:bool>
     | [`LinuxPod.Configuration.virtualization`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/virtualization) |
+| 
    ghostbox cn:pod-config:set-boot-log @<pod-config:id> @<boot-log:id>|null
     | [`LinuxPod.Configuration.bootLog`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/bootlog) |
+| 
    ghostbox cn:pod-config:set-share-process-namespace @<pod-config:id> <enabled:bool>
     | [`LinuxPod.Configuration.shareProcessNamespace`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/shareprocessnamespace) |
+| 
    ghostbox cn:pod-config:set-hostname @<pod-config:id> <hostname:string>|null
     | [`LinuxPod.Configuration.hostname`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/hostname) |
+| 
    ghostbox cn:pod-config:set-dns @<pod-config:id> @<dns:id>|null
     | [`LinuxPod.Configuration.dns`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/dns) |
+| 
    ghostbox cn:pod-config:set-hosts @<pod-config:id> @<hosts:id>|null
     | [`LinuxPod.Configuration.hosts`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/hosts) |
+| 
    ghostbox cn:pod-config:set-volumes @<pod-config:id> @<pod-volume:id>...
     | [`LinuxPod.Configuration.volumes`](https://apple.github.io/containerization/documentation/containerization/linuxpod/configuration/volumes) |
+
+## Pod Container Configuration
+
+The `set-*` commands assign the supplied value to the linked documented
+`LinuxPod.ContainerConfiguration` property.
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:pod-container-config:create <pod-container-config:name>
     | [`LinuxPod.ContainerConfiguration.init()`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/init()) |
+| 
    ghostbox cn:pod-container-config:set-process @<pod-container-config:id> @<process-config:id>
     | [`LinuxPod.ContainerConfiguration.process`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/process) |
+| 
    ghostbox cn:pod-container-config:set-cpus @<pod-container-config:id> <cpus:int>|null
     | [`LinuxPod.ContainerConfiguration.cpus`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/cpus) |
+| 
    ghostbox cn:pod-container-config:set-memory @<pod-container-config:id> <bytes:uint64>|null
     | [`LinuxPod.ContainerConfiguration.memoryInBytes`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/memoryinbytes) |
+| 
    ghostbox cn:pod-container-config:set-hostname @<pod-container-config:id> <hostname:string>|null
     | [`LinuxPod.ContainerConfiguration.hostname`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/hostname) |
+| 
    ghostbox cn:pod-container-config:set-sysctl @<pod-container-config:id> <key-value:string>...
     | [`LinuxPod.ContainerConfiguration.sysctl`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/sysctl) |
+| 
    ghostbox cn:pod-container-config:set-mounts @<pod-container-config:id> @<mount:id>...
     | [`LinuxPod.ContainerConfiguration.mounts`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/mounts) |
+| 
    ghostbox cn:pod-container-config:set-masked-paths @<pod-container-config:id> <path:container-path>...
     | [`LinuxPod.ContainerConfiguration.maskedPaths`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/maskedpaths) |
+| 
    ghostbox cn:pod-container-config:set-readonly-paths @<pod-container-config:id> <path:container-path>...
     | [`LinuxPod.ContainerConfiguration.readonlyPaths`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/readonlypaths) |
+| 
    ghostbox cn:pod-container-config:set-sockets @<pod-container-config:id> @<socket:id>...
     | [`LinuxPod.ContainerConfiguration.sockets`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/sockets) |
+| 
    ghostbox cn:pod-container-config:set-dns @<pod-container-config:id> @<dns:id>|null
     | [`LinuxPod.ContainerConfiguration.dns`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/dns) |
+| 
    ghostbox cn:pod-container-config:set-hosts @<pod-container-config:id> @<hosts:id>|null
     | [`LinuxPod.ContainerConfiguration.hosts`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/hosts) |
+| 
    ghostbox cn:pod-container-config:set-use-init @<pod-container-config:id> <enabled:bool>
     | [`LinuxPod.ContainerConfiguration.useInit`](https://apple.github.io/containerization/documentation/containerization/linuxpod/containerconfiguration/useinit) |
+
+## Pod
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:pod:create-direct <pod:name>
    --vmm @<vmm:id>
    --configuration @<pod-config:id>
     | [`LinuxPod.init(_:vmm:logger:configuration:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/init(_:vmm:logger:configuration:)) |
+| 
    ghostbox cn:pod:id @<pod:id>
     | [`LinuxPod.id`](https://apple.github.io/containerization/documentation/containerization/linuxpod/id) |
+| 
    ghostbox cn:pod:config @<pod:id>
     | [`LinuxPod.config`](https://apple.github.io/containerization/documentation/containerization/linuxpod/config) |
+| 
    ghostbox cn:pod:cpus @<pod:id>
     | [`LinuxPod.cpus`](https://apple.github.io/containerization/documentation/containerization/linuxpod/cpus) |
+| 
    ghostbox cn:pod:memory @<pod:id>
     | [`LinuxPod.memoryInBytes`](https://apple.github.io/containerization/documentation/containerization/linuxpod/memoryinbytes) |
+| 
    ghostbox cn:pod:interfaces @<pod:id>
     | [`LinuxPod.interfaces`](https://apple.github.io/containerization/documentation/containerization/linuxpod/interfaces) |
+| 
    ghostbox cn:pod:add-container @<pod:id>
    <container:name>
    --rootfs @<mount:id>
    --configuration @<pod-container-config:id>
     | [`LinuxPod.addContainer(_:rootfs:configuration:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/addcontainer(_:rootfs:configuration:)) |
+| 
    ghostbox cn:pod:create @<pod:id>
     | [`LinuxPod.create()`](https://apple.github.io/containerization/documentation/containerization/linuxpod/create()) |
+| 
    ghostbox cn:pod:start-container @<pod:id> @<pod-container:id>
     | [`LinuxPod.startContainer(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/startcontainer(_:)) |
+| 
    ghostbox cn:pod:stop-container @<pod:id> @<pod-container:id>
     | [`LinuxPod.stopContainer(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/stopcontainer(_:)) |
+| 
    ghostbox cn:pod:stop @<pod:id>
     | [`LinuxPod.stop()`](https://apple.github.io/containerization/documentation/containerization/linuxpod/stop()) |
+| 
    ghostbox cn:pod:kill-container @<pod:id> @<pod-container:id> <signal:linux-signal>
     | [`LinuxPod.killContainer(_:signal:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/killcontainer(_:signal:)) |
+| 
    ghostbox cn:pod:wait-container @<pod:id>
    @<pod-container:id>
    [--timeout-seconds <seconds:int64>]
     | [`LinuxPod.waitContainer(_:timeoutInSeconds:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/waitcontainer(_:timeoutinseconds:)) |
+| 
    ghostbox cn:pod:resize-container @<pod:id>
    @<pod-container:id>
    <width:uint16>
    <height:uint16>
     | [`LinuxPod.resizeContainer(_:to:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/resizecontainer(_:to:)) |
+| 
    ghostbox cn:pod:exec-in-container @<pod:id>
    @<pod-container:id>
    <process:name>
    --configuration @<process-config:id>
     | [`LinuxPod.execInContainer(_:processID:configuration:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/execincontainer(_:processid:configuration:)) |
+| 
    ghostbox cn:pod:list-containers @<pod:id>
     | [`LinuxPod.listContainers()`](https://apple.github.io/containerization/documentation/containerization/linuxpod/listcontainers()) |
+| 
    ghostbox cn:pod:statistics @<pod:id>
    [--container @<pod-container:id>]...
    [--category <category:statistics-category>]...
     | [`LinuxPod.statistics(containerIDs:categories:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/statistics(containerids:categories:)) |
+| 
    ghostbox cn:pod:dial-vsock @<pod:id>
    <port:uint32>
     | [`LinuxPod.dialVsock(port:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/dialvsock(port:)) |
+| 
    ghostbox cn:pod:filesystem-operation @<pod:id>
    @<pod-container:id>
    <operation:freeze|thaw|trim>
    <path:container-path>
     | [`LinuxPod.filesystemOperation(_:operation:path:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/filesystemoperation(_:operation:path:)) |
+| 
    ghostbox cn:pod:close-container-stdin @<pod:id> @<pod-container:id>
     | [`LinuxPod.closeContainerStdin(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/closecontainerstdin(_:)) |
+| 
    ghostbox cn:pod:relay-unix-socket @<pod:id>
    @<pod-container:id>
    @<socket:id>
     | [`LinuxPod.relayUnixSocket(_:socket:)`](https://apple.github.io/containerization/documentation/containerization/linuxpod/relayunixsocket(_:socket:)) |
diff --git a/docs/ghostbox-api/process-configuration.md b/docs/ghostbox-api/process-configuration.md
new file mode 100644
index 0000000..d94f7ab
--- /dev/null
+++ b/docs/ghostbox-api/process-configuration.md
@@ -0,0 +1,71 @@
+# Ghostbox Process Configuration API
+
+This page maps the 32 Ghostbox process configuration methods to their
+corresponding Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json`.
+- Apple API mappings are sourced from
+  `macOS/GhostVMContainerRuntime/Ghostbox/GhostboxConfigurationCommands.swift`
+  and `macOS/GhostVMContainerRuntime/Ghostbox/GhostboxBuiltinCommands.swift`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `rlimit-kind` | 1 |
+| `rlimit` | 6 |
+| `capabilities` | 10 |
+| `process-config` | 15 |
+| **Total** | **32** |
+
+## Rlimit Kind
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:rlimit-kind:create <rlimit-kind:name>
    <oci-name:string>
     | [`LinuxRLimit.Kind.init(_:)`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/kind-swift.struct/init(_:)) |
+
+## Rlimit
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:rlimit:create <rlimit:name>
    --kind @<rlimit-kind:id>
    --hard <hard:uint64>
    --soft <soft:uint64>
     | [`LinuxRLimit.init(kind:hard:soft:)`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/init(kind:hard:soft:)) |
+| 
    ghostbox cn:rlimit:create-equal <rlimit:name>
    --kind @<rlimit-kind:id>
    --limit <limit:uint64>
     | [`LinuxRLimit.init(kind:limit:)`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/init(kind:limit:)) |
+| 
    ghostbox cn:rlimit:kind @<rlimit:id>
     | [`LinuxRLimit.kind`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/kind-swift.property) |
+| 
    ghostbox cn:rlimit:hard @<rlimit:id>
     | [`LinuxRLimit.hard`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/hard) |
+| 
    ghostbox cn:rlimit:soft @<rlimit:id>
     | [`LinuxRLimit.soft`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/soft) |
+| 
    ghostbox cn:rlimit:to-oci @<rlimit:id>
     | [`LinuxRLimit.toOCI()`](https://apple.github.io/containerization/documentation/containerization/linuxrlimit/tooci()) |
+
+## Capabilities
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:capabilities:create <capabilities:name>
    [--bounding <capability:linux-capability>]...
    [--effective <capability:linux-capability>]...
    [--inheritable <capability:linux-capability>]...
    [--permitted <capability:linux-capability>]...
    [--ambient <capability:linux-capability>]...
     | [`LinuxCapabilities.init(bounding:effective:inheritable:permitted:ambient:)`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/init(bounding:effective:inheritable:permitted:ambient:)) |
+| 
    ghostbox cn:capabilities:create-uniform <capabilities:name>
    <capability:linux-capability>...
     | [`LinuxCapabilities.init(capabilities:)`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/init(capabilities:)) |
+| 
    ghostbox cn:capabilities:all
     | [`LinuxCapabilities.allCapabilities`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/allcapabilities) |
+| 
    ghostbox cn:capabilities:default-oci
     | [`LinuxCapabilities.defaultOCICapabilities`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/defaultocicapabilities) |
+| 
    ghostbox cn:capabilities:bounding @<capabilities:id>
     | [`LinuxCapabilities.bounding`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/bounding) |
+| 
    ghostbox cn:capabilities:effective @<capabilities:id>
     | [`LinuxCapabilities.effective`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/effective) |
+| 
    ghostbox cn:capabilities:inheritable @<capabilities:id>
     | [`LinuxCapabilities.inheritable`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/inheritable) |
+| 
    ghostbox cn:capabilities:permitted @<capabilities:id>
     | [`LinuxCapabilities.permitted`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/permitted) |
+| 
    ghostbox cn:capabilities:ambient @<capabilities:id>
     | [`LinuxCapabilities.ambient`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/ambient) |
+| 
    ghostbox cn:capabilities:to-oci @<capabilities:id>
     | [`LinuxCapabilities.toOCI()`](https://apple.github.io/containerization/documentation/containerization/linuxcapabilities/tooci()) |
+
+## Process Config
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:process-config:default-path
     | [`LinuxProcessConfiguration.defaultPath`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/defaultpath) |
+| 
    ghostbox cn:process-config:create <process-config:name>
    <argument:string>...
    [--environment <assignment:string>]...
    [--working-directory=/]
    [--user <user:oci-user>]
    [--rlimit @<rlimit:id>]...
    [--no-new-privileges=false]
    [--capabilities @<capabilities:id>]
    [--terminal=false]
    [--stdin @<reader-stream:id>]
    [--stdout @<writer:id>]
    [--stderr @<writer:id>]
     | [`LinuxProcessConfiguration.init(arguments:environmentVariables:workingDirectory:user:rlimits:noNewPrivileges:capabilities:terminal:stdin:stdout:stderr:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/init(arguments:environmentvariables:workingdirectory:user:rlimits:nonewprivileges:capabilities:terminal:stdin:stdout:stderr:)) |
+| 
    ghostbox cn:process-config:from-image-config <process-config:name>
    <image-config:oci-image-config>
     | [`LinuxProcessConfiguration.init(from:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/init(from:)) |
+| 
    ghostbox cn:process-config:set-terminal-io @<process-config:id>
    @<terminal:id>
     | [`LinuxProcessConfiguration.setTerminalIO(terminal:)`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/setterminalio(terminal:)) |
+| 
    ghostbox cn:process-config:arguments @<process-config:id>
     | [`LinuxProcessConfiguration.arguments`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/arguments) |
+| 
    ghostbox cn:process-config:environment-variables @<process-config:id>
     | [`LinuxProcessConfiguration.environmentVariables`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/environmentvariables) |
+| 
    ghostbox cn:process-config:working-directory @<process-config:id>
     | [`LinuxProcessConfiguration.workingDirectory`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/workingdirectory) |
+| 
    ghostbox cn:process-config:user @<process-config:id>
     | [`LinuxProcessConfiguration.user`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/user) |
+| 
    ghostbox cn:process-config:rlimits @<process-config:id>
     | [`LinuxProcessConfiguration.rlimits`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/rlimits) |
+| 
    ghostbox cn:process-config:no-new-privileges @<process-config:id>
     | [`LinuxProcessConfiguration.noNewPrivileges`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/nonewprivileges) |
+| 
    ghostbox cn:process-config:capabilities @<process-config:id>
     | [`LinuxProcessConfiguration.capabilities`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/capabilities) |
+| 
    ghostbox cn:process-config:terminal @<process-config:id>
     | [`LinuxProcessConfiguration.terminal`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/terminal) |
+| 
    ghostbox cn:process-config:stdin @<process-config:id>
     | [`LinuxProcessConfiguration.stdin`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/stdin) |
+| 
    ghostbox cn:process-config:stdout @<process-config:id>
     | [`LinuxProcessConfiguration.stdout`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/stdout) |
+| 
    ghostbox cn:process-config:stderr @<process-config:id>
     | [`LinuxProcessConfiguration.stderr`](https://apple.github.io/containerization/documentation/containerization/linuxprocessconfiguration/stderr) |
diff --git a/docs/ghostbox-api/virtual-machines.md b/docs/ghostbox-api/virtual-machines.md
new file mode 100644
index 0000000..3540472
--- /dev/null
+++ b/docs/ghostbox-api/virtual-machines.md
@@ -0,0 +1,48 @@
+# Ghostbox Virtual Machines API
+
+This page maps the 12 Ghostbox virtual machine methods to their corresponding
+Apple Containerization APIs.
+
+- Ghostbox signatures are sourced from `GHOSTBOX_CLI_COMMANDS.json`.
+- Apple API links are pinned to Containerization `0.40.1`, revision
+  `7800b4642171561c95b5f55500b19e5dce5acd45`.
+
+| Resource | Methods |
+|---|---:|
+| `vm-config` | 1 |
+| `standard-vm-config` | 1 |
+| `vmm` | 2 |
+| `vm-instance` | 8 |
+| **Total** | **12** |
+
+## VM Config
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:vm-config:create <vm-config:name>
    [--cpus=4]
    [--memory=1073741824]
    [--interface @<interface:id>]...
    [--mount <workload-id:string>=@<mount:id>]...
    [--boot-log @<boot-log:id>]
    [--nested-virtualization=false]
     | [`VMConfiguration.init(cpus:memoryInBytes:interfaces:mountsByID:bootLog:nestedVirtualization:)`](https://apple.github.io/containerization/documentation/containerization/vmconfiguration/init(cpus:memoryinbytes:interfaces:mountsbyid:bootlog:nestedvirtualization:)) |
+
+## Standard VM Config
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:standard-vm-config:create <standard-vm-config:name>
    @<vm-config:id>
     | [`StandardVMConfig.init(configuration:)`](https://apple.github.io/containerization/documentation/containerization/standardvmconfig/init(configuration:)) |
+
+## VMM
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:vmm:create <vmm:name>
    --kernel @<kernel:id>
    --initial-filesystem @<mount:id>
    [--rosetta=false]
    [--nested-virtualization=false]
     | [`VZVirtualMachineManager.init(kernel:initialFilesystem:rosetta:nestedVirtualization:group:logger:)`](https://apple.github.io/containerization/documentation/containerization/vzvirtualmachinemanager/init(kernel:initialfilesystem:rosetta:nestedvirtualization:group:logger:)) |
+| 
    ghostbox cn:vmm:create-instance @<vmm:id>
    @<standard-vm-config:id>
     | [`VZVirtualMachineManager.create(config:)`](https://apple.github.io/containerization/documentation/containerization/vzvirtualmachinemanager/create(config:)) |
+
+## VM Instance
+
+| Ghostbox Signature | Apple API |
+|---|---|
+| 
    ghostbox cn:vm-instance:state @<vm-instance:id>
     | [`VirtualMachineInstance.state`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/state) |
+| 
    ghostbox cn:vm-instance:mounts @<vm-instance:id>
     | [`VirtualMachineInstance.mounts`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/mounts) |
+| 
    ghostbox cn:vm-instance:virtiofs-layout @<vm-instance:id>
     | [`VirtualMachineInstance.virtiofsLayout`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/virtiofslayout) |
+| 
    ghostbox cn:vm-instance:start @<vm-instance:id>
     | [`VirtualMachineInstance.start()`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/start()) |
+| 
    ghostbox cn:vm-instance:stop @<vm-instance:id>
     | [`VirtualMachineInstance.stop()`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/stop()) |
+| 
    ghostbox cn:vm-instance:pause @<vm-instance:id>
     | [`VirtualMachineInstance.pause()`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/pause()) |
+| 
    ghostbox cn:vm-instance:resume @<vm-instance:id>
     | [`VirtualMachineInstance.resume()`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/resume()) |
+| 
    ghostbox cn:vm-instance:dial @<vm-instance:id>
    <port:uint32>
     | [`VirtualMachineInstance.dial(_:)`](https://apple.github.io/containerization/documentation/containerization/virtualmachineinstance/dial(_:)) |
diff --git a/docs/ghostbox-volumes.md b/docs/ghostbox-volumes.md
new file mode 100644
index 0000000..0fa931b
--- /dev/null
+++ b/docs/ghostbox-volumes.md
@@ -0,0 +1,43 @@
+# Ghostbox Persistent Volumes
+
+Ghostbox named volumes are sparse ext4 disk images stored inside the owning VM
+bundle. They survive container deletion, Ghostbox session cleanup, and VM
+restarts. The outer-host backing path is trusted runtime state and is never
+accepted from or returned to the guest.
+
+## Lifecycle
+
+```sh
+volume=$(ghostbox cr:volume:create app-data --size 8589934592)
+ghostbox cr:volume:list
+ghostbox cr:volume:inspect "$volume"
+mount=$(ghostbox cr:volume:mount "$volume" app-data --destination /var/lib/app)
+```
+
+The mount command returns a normal `@mount/NAME` reference backed by
+`Containerization.Mount.block(format:source:destination:options:)`. Include that
+reference and every reference returned by `ghostbox cn:container:default-mounts`
+when supplying `--mounts` to a manager create operation. Supplying `--mounts`
+replaces the complete mount set; it does not append to the defaults.
+
+Delete the mount reference before deleting the volume:
+
+```sh
+ghostbox cn:mount:delete "$mount"
+ghostbox cr:volume:delete "$volume"
+```
+
+Deletion fails while a named-volume mount reference exists. A volume can have
+only one such reference at a time. Do not attach the same block-backed mount to
+multiple live container VMs concurrently.
+
+## Limits
+
+- Names begin with a letter or digit and otherwise use letters, digits, `.`,
+  `_`, or `-`.
+- Sizes range from 1 MiB through 1 TiB; the default is 8 GiB.
+- Each VM can store at most 128 named volumes.
+- `inspect` reports the name, ext4 format, logical size, and creation date. It
+  omits the outer-host image path.
+- `ghostbox cn:mount:source @mount/NAME` returns the opaque `@volume/NAME` source
+  for managed volume mounts.
diff --git a/examples/ghostbox/README.md b/examples/ghostbox/README.md
new file mode 100644
index 0000000..f2a0b72
--- /dev/null
+++ b/examples/ghostbox/README.md
@@ -0,0 +1,97 @@
+# Ghostbox Container Examples
+
+These scripts compose Ghostbox's source-shaped lifecycle methods into behavior
+similar to `docker run --rm`. They do not add a `run` operation: allocation,
+creation, start, wait, stop, and deletion remain separate calls.
+
+Run them inside a GhostVM guest with Host-backed Containers enabled. Install
+Apple container's recommended Linux kernel on the outer host through Ghostbox:
+
+```sh
+ghostbox cn:kernel:install-recommended
+```
+
+The operation performs Apple's digest-verified download on the outer host and
+returns `@kernel/default`. `setup-manager.sh` runs it automatically and reuses an
+already-installed recommended kernel.
+
+## One-Time Manager Setup
+
+Create a reusable manager backed by the host's default kernel and image store:
+
+```sh
+./setup-manager.sh
+```
+
+The script prints `@manager/ephemeral`. Its default init image is pinned by
+manifest digest so an older tag-cache entry cannot silently supply incompatible
+guest enforcement. Override the names or pinned init image with `MANAGER_NAME`
+and `INITFS_REFERENCE`.
+
+## Non-Interactive
+
+Run Alpine's default example command:
+
+```sh
+./ephemeral-container.sh
+```
+
+Run a command and propagate its exit status:
+
+```sh
+./ephemeral-container.sh docker.io/library/alpine:latest \
+    /bin/sh -c 'printf "container says hello\\n"; exit 7'
+```
+
+## Interactive PTY
+
+```sh
+./ephemeral-terminal.sh docker.io/library/alpine:latest /bin/sh
+```
+
+The terminal script waits until raw-mode setup and the first resize reach the
+host before it starts the container. It watches the workload cgroup and closes
+the PTY proxy when the final process exits, allowing Apple's process wait to
+finish draining terminal I/O. Both scripts use traps to stop and delete the
+allocated container, delete its process configuration, and close all I/O
+proxies on success, failure, or a termination signal. Pulled images remain in
+the host cache.
+
+Container networking defaults to `false`, so the basic examples do not require
+a vmnet network. Set `CONTAINER_NETWORKING=true` when the manager was created
+with a suitable network.
+
+Use another manager or resource limits through environment variables:
+
+```sh
+MANAGER=@manager/build CONTAINER_CPUS=2 CONTAINER_MEMORY=1073741824 \
+    ./ephemeral-container.sh docker.io/library/alpine:latest uname -a
+```
+
+## Resource Cleanup
+
+Remove reusable host references when they are no longer needed:
+
+```sh
+ghostbox cn:process-config:delete @process-config/example
+ghostbox cn:dns:delete @dns/example
+ghostbox cn:network:delete @network/example
+ghostbox cn:manager:close @manager/ephemeral
+```
+
+Release every network-allocated interface before deleting its network. Delete
+all managed containers before closing their manager. Cached images can be
+removed separately with `ghostbox cn:image-store:delete @image-store/default REFERENCE`.
+
+## Persistent Volumes
+
+Run a two-container write/read lifecycle against one named ext4 volume:
+
+```sh
+./persistent-volume.sh
+```
+
+The script creates the volume and a block-mount reference, supplies the default
+container mounts plus that reference, verifies data from a second container,
+then removes the mount and volume. Named volumes are stored with the VM and
+normally remain until explicitly deleted.
diff --git a/examples/ghostbox/ephemeral-container.sh b/examples/ghostbox/ephemeral-container.sh
new file mode 100755
index 0000000..9d60c63
--- /dev/null
+++ b/examples/ghostbox/ephemeral-container.sh
@@ -0,0 +1,74 @@
+#!/bin/sh
+set -eu
+
+usage() {
+    status=${1:-64}
+    echo "usage: $0 [IMAGE [COMMAND [ARG ...]]]" >&2
+    echo "environment: GHOSTBOX, MANAGER, CONTAINER_CPUS, CONTAINER_MEMORY, CONTAINER_NETWORKING" >&2
+    exit "$status"
+}
+
+case ${1:-} in
+    -h|--help) usage 0 ;;
+esac
+
+GHOSTBOX=${GHOSTBOX:-ghostbox}
+MANAGER=${MANAGER:-@manager/ephemeral}
+CONTAINER_NETWORKING=${CONTAINER_NETWORKING:-false}
+IMAGE=${1:-docker.io/library/alpine:latest}
+if [ "$#" -gt 0 ]; then shift; fi
+if [ "$#" -eq 0 ]; then
+    # Expanded by the container's shell, not this script.
+    set -- /bin/sh -c 'echo "hello from $(uname -s) $(uname -m)"'
+fi
+
+name="ephemeral-$(date +%s)-$$"
+container="@container/$name"
+stdout="@writer/$name-stdout"
+stderr="@writer/$name-stderr"
+process="@process-config/$name-process"
+stdout_pid=
+stderr_pid=
+
+cleanup() {
+    status=$?
+    trap - EXIT HUP INT TERM
+    "$GHOSTBOX" cn:container:stop "$container" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cn:writer:close "$stdout" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cn:writer:close "$stderr" >/dev/null 2>&1 || true
+    if [ -n "$stdout_pid" ]; then wait "$stdout_pid" 2>/dev/null || true; fi
+    if [ -n "$stderr_pid" ]; then wait "$stderr_pid" 2>/dev/null || true; fi
+    "$GHOSTBOX" cn:manager:delete "$MANAGER" "$container" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cn:process-config:delete "$process" >/dev/null 2>&1 || true
+    exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+"$GHOSTBOX" cn:writer:create "$name-stdout" >/dev/null
+"$GHOSTBOX" cn:writer:create "$name-stderr" >/dev/null
+process=$("$GHOSTBOX" cn:process-config:create "$name-process" \
+    --stdout "$stdout" --stderr "$stderr" -- "$@")
+
+set -- cn:manager:create-container "$MANAGER" "$name" \
+    --reference "$IMAGE" --process "$process" --networking "$CONTAINER_NETWORKING"
+if [ -n "${CONTAINER_CPUS:-}" ]; then
+    set -- "$@" --cpus "$CONTAINER_CPUS"
+fi
+if [ -n "${CONTAINER_MEMORY:-}" ]; then
+    set -- "$@" --memory "$CONTAINER_MEMORY"
+fi
+"$GHOSTBOX" "$@" >/dev/null
+
+"$GHOSTBOX" cn:writer:attach "$stdout" &
+stdout_pid=$!
+"$GHOSTBOX" cn:writer:attach "$stderr" >&2 &
+stderr_pid=$!
+
+"$GHOSTBOX" cn:container:create "$container"
+"$GHOSTBOX" cn:container:start "$container"
+status_json=$("$GHOSTBOX" cn:container:wait "$container")
+exit_code=$(printf '%s' "$status_json" | plutil -extract exitCode raw -o - -)
+exit "$exit_code"
diff --git a/examples/ghostbox/ephemeral-terminal.sh b/examples/ghostbox/ephemeral-terminal.sh
new file mode 100755
index 0000000..c5246e8
--- /dev/null
+++ b/examples/ghostbox/ephemeral-terminal.sh
@@ -0,0 +1,87 @@
+#!/bin/sh
+set -eu
+
+usage() {
+    status=${1:-64}
+    echo "usage: $0 [IMAGE [COMMAND [ARG ...]]]" >&2
+    echo "environment: GHOSTBOX, MANAGER, CONTAINER_CPUS, CONTAINER_MEMORY, CONTAINER_NETWORKING" >&2
+    exit "$status"
+}
+
+case ${1:-} in
+    -h|--help) usage 0 ;;
+esac
+
+if [ ! -t 0 ] || [ ! -t 1 ]; then
+    echo "$0: an interactive terminal is required" >&2
+    exit 125
+fi
+
+GHOSTBOX=${GHOSTBOX:-ghostbox}
+MANAGER=${MANAGER:-@manager/ephemeral}
+CONTAINER_NETWORKING=${CONTAINER_NETWORKING:-false}
+IMAGE=${1:-docker.io/library/alpine:latest}
+if [ "$#" -gt 0 ]; then shift; fi
+if [ "$#" -eq 0 ]; then set -- /bin/sh; fi
+
+name="terminal-$(date +%s)-$$"
+container="@container/$name"
+terminal="@terminal/$name"
+process="@process-config/$name-process"
+controller_pid=
+
+cleanup() {
+    status=$?
+    trap - EXIT HUP INT TERM
+    if [ -n "$controller_pid" ]; then kill "$controller_pid" 2>/dev/null || true; fi
+    "$GHOSTBOX" cn:terminal:close "$terminal" >/dev/null 2>&1 || true
+    if [ -n "$controller_pid" ]; then wait "$controller_pid" 2>/dev/null || true; fi
+    "$GHOSTBOX" cn:container:stop "$container" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cn:manager:delete "$MANAGER" "$container" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cn:process-config:delete "$process" >/dev/null 2>&1 || true
+    exit "$status"
+}
+
+controller_cleanup() {
+    "$GHOSTBOX" cn:terminal:close "$terminal" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+"$GHOSTBOX" cn:terminal:create "$name" >/dev/null
+process=$("$GHOSTBOX" cn:process-config:create "$name-process" --terminal true -- "$@")
+"$GHOSTBOX" cn:process-config:set-terminal-io "$process" "$terminal"
+
+set -- cn:manager:create-container "$MANAGER" "$name" \
+    --reference "$IMAGE" --process "$process" --networking "$CONTAINER_NETWORKING"
+if [ -n "${CONTAINER_CPUS:-}" ]; then
+    set -- "$@" --cpus "$CONTAINER_CPUS"
+fi
+if [ -n "${CONTAINER_MEMORY:-}" ]; then
+    set -- "$@" --memory "$CONTAINER_MEMORY"
+fi
+"$GHOSTBOX" "$@" >/dev/null
+
+controller() {
+    trap controller_cleanup EXIT
+    "$GHOSTBOX" cn:terminal:wait-attached "$terminal"
+    "$GHOSTBOX" cn:container:create "$container"
+    "$GHOSTBOX" cn:container:start "$container"
+
+    status_json=$("$GHOSTBOX" cn:container:wait "$container")
+    exit_code=$(printf '%s' "$status_json" | plutil -extract exitCode raw -o - -)
+    return "$exit_code"
+}
+
+controller &
+controller_pid=$!
+"$GHOSTBOX" cn:terminal:attach "$terminal" --resize-target "$container"
+
+set +e
+wait "$controller_pid"
+exit_code=$?
+set -e
+controller_pid=
+exit "$exit_code"
diff --git a/examples/ghostbox/persistent-volume.sh b/examples/ghostbox/persistent-volume.sh
new file mode 100755
index 0000000..b6021de
--- /dev/null
+++ b/examples/ghostbox/persistent-volume.sh
@@ -0,0 +1,66 @@
+#!/bin/sh
+set -eu
+
+GHOSTBOX=${GHOSTBOX:-ghostbox}
+MANAGER=${MANAGER:-@manager/ephemeral}
+IMAGE=${IMAGE:-docker.io/library/alpine:latest}
+
+name="volume-test-$(date +%s)-$$"
+volume="@volume/$name"
+mount="@mount/$name"
+container=
+process=
+
+cleanup() {
+    status=$?
+    trap - EXIT HUP INT TERM
+    if [ -n "$container" ]; then
+        "$GHOSTBOX" cn:container:stop "$container" >/dev/null 2>&1 || true
+        "$GHOSTBOX" cn:manager:delete "$MANAGER" "$container" >/dev/null 2>&1 || true
+    fi
+    if [ -n "$process" ]; then
+        "$GHOSTBOX" cn:process-config:delete "$process" >/dev/null 2>&1 || true
+    fi
+    "$GHOSTBOX" cn:mount:delete "$mount" >/dev/null 2>&1 || true
+    "$GHOSTBOX" cr:volume:delete "$volume" >/dev/null 2>&1 || true
+    exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+"$GHOSTBOX" cr:volume:create "$name" --size 67108864 >/dev/null
+"$GHOSTBOX" cr:volume:mount "$volume" "$name" --destination /data >/dev/null
+
+run_container() {
+    run_name=$1
+    command=$2
+    process="@process-config/$run_name-process"
+    container="@container/$run_name"
+    "$GHOSTBOX" cn:process-config:create "$run_name-process" -- /bin/sh -c "$command" >/dev/null
+
+    set -- cn:manager:create-container "$MANAGER" "$run_name" \
+        --reference "$IMAGE" --process "$process" --networking false
+    for default_mount in $("$GHOSTBOX" cn:container:default-mounts); do
+        set -- "$@" --mounts "$default_mount"
+    done
+    set -- "$@" --mounts "$mount"
+    "$GHOSTBOX" "$@" >/dev/null
+    "$GHOSTBOX" cn:container:create "$container"
+    "$GHOSTBOX" cn:container:start "$container"
+    status_json=$("$GHOSTBOX" cn:container:wait "$container")
+    exit_code=$(printf '%s' "$status_json" | plutil -extract exitCode raw -o - -)
+    [ "$exit_code" -eq 0 ]
+    "$GHOSTBOX" cn:manager:delete "$MANAGER" "$container" >/dev/null
+    "$GHOSTBOX" cn:process-config:delete "$process" >/dev/null
+    container=
+    process=
+}
+
+run_container "$name-write" 'printf persistent > /data/marker'
+run_container "$name-read" 'test "$(cat /data/marker)" = persistent'
+
+"$GHOSTBOX" cn:mount:delete "$mount"
+"$GHOSTBOX" cr:volume:delete "$volume"
+echo "persistent volume lifecycle passed"
diff --git a/examples/ghostbox/setup-manager.sh b/examples/ghostbox/setup-manager.sh
new file mode 100755
index 0000000..e44c7d8
--- /dev/null
+++ b/examples/ghostbox/setup-manager.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+GHOSTBOX=${GHOSTBOX:-ghostbox}
+MANAGER_NAME=${MANAGER_NAME:-ephemeral}
+INITFS_REFERENCE=${INITFS_REFERENCE:-ghcr.io/apple/containerization/vminit@sha256:a69ff331d77997042afc3c7389969be176dfb657ec9ed46366c0e057ec40a297}
+
+kernel=$("$GHOSTBOX" cn:kernel:install-recommended)
+image_store=$("$GHOSTBOX" cn:image-store:default)
+
+"$GHOSTBOX" cn:manager:create-from-reference "$MANAGER_NAME" \
+    --kernel "$kernel" \
+    --initfs-reference "$INITFS_REFERENCE" \
+    --image-store "$image_store"
diff --git a/macOS/GhostFile/DMG_README.txt b/macOS/GhostFile/DMG_README.txt
new file mode 100644
index 0000000..5ad4473
--- /dev/null
+++ b/macOS/GhostFile/DMG_README.txt
@@ -0,0 +1,12 @@
+GhostFile
+=========
+
+Installation
+------------
+
+1. Drag GhostFile.app to the Applications folder.
+2. Open GhostFile from Applications.
+3. If macOS asks, enable GhostFileFS under:
+   System Settings > General > Login Items & Extensions > File System Extensions.
+
+GhostFile requires macOS 26 or later.
diff --git a/macOS/GhostFile/GhostFile.icon/Assets/GhostFile.png b/macOS/GhostFile/GhostFile.icon/Assets/GhostFile.png
new file mode 100644
index 0000000000000000000000000000000000000000..7b9531accbe9fcd0367bc2f2b5c9f8b04024c1b1
GIT binary patch
literal 1851701
zcmeEu2UJwcwk=r{6j4;ntzrV9cjs<%=bSUf&NYEmmABBC~vK@mkn#5@T9
z#7BXeS_=q+A|i4YYE&de_-Xdq)S$Wrcxp9Brz#>jqVCX$h~*LZxjE656`)nHx)r^u
zmF>^1ye@m^aLdkk0tT(c;qjSB6jqywCP3;;HCm_7Bp?YGh@gQmcnt=O)k<33UB{~K
zRPKKoG)v`n>s%g_!|nzj)I3}LL6`6cJ&z|Mw~u4YUz(6!{%#1_R6jg+mPzBVgQgLw
z8l>CUbK$w7F&!tJ9b_wAU$$A+6Vx|S>$U0#lTBsN!QDPXM!;qTwKe@}lUCgoRKWZu
zt;g7{H4cGo4KwOY2BW9C;4|s`BuAiIYX}Cx!0Yf&Yna|-wRUT5ci45UVW2O&yIX6c
z$K&h_hx`5hEI%sC;WEIH5CnxsYu&w8SEtHjglW6A=3*dx77k5-p%Az%6oEj-Ah20D
z91e!WgE9gQ3%@525HKVLm4(NnVQ4%i3xy}ZkSHh%iAR#rSVR^88HR+gSy(&*hDPGE
zP*@m(fX@OG07HQ%5{IgMO+cc^C>%Bmi9)~-cyty4iHD)kC@?GxfdfSh7D$1}LZI>B
zH7W~3z><+TFgg_O4hcR(11T_BXbcPqghdjNFeDlXiLHJh$W_&0S;MWsAeCQ%!Na|T
z#|(E0WU3s5K&~1TS1rR&nLxQxM$kJ@iGV~`>wqR#>4dFP5d$EoR2c=Ug5W14)esSY
zIF*oLsv!jZRYHn_RY6<@IT}J#zQu8lvIil9yTl%K&Mhnpv5nSgNBf@Y6HsVqHz$IdH@F+4J-*u
zM&q%d4AckX0>eTRfVg3U!6UPTX8&k;yaAD&cT
zNrI+wyT_G6tYqe&=ywxURK@y
zk9Jj7jLzmFv6VOj00>!F0*Z{pVzQ7B01!+R3TTD|9$TpiFnesJr(=P4gk3W1dcY-7
zKoj6A04HGU07XprBM1p*8B1V#yA0SXvk1%P&tSS*-r6euIIFn}L^DuqIW_F-YG
zl|%uLhY&bfm9mKHCkmiYsZDrZ!`h+ANQjUH<^l+S24)5XLZY+qK*6v*5W@2atP>fY
zZy*qXK#-v@z?%Sg)zx7f!cK%l1HM86FTkRJvjI86@&IE-0gy2S1P6rz3!eZ9?1b52c!edfYiVsfEEB=
zENBK83
    jK>*f^3ezSaK+w%!v<5I#Ivu9U9LY#P#<=k47|<=C(Xg>10Hst)hXb<=
zKp}+7z{dc>KziVF1W*P9iVX{o0@XknV8Y-B2n&n>O!6OP;9@91;#JM7EgLikM1{v-
zWoTen2sDBGGX|gmk%905lml~!L;@EAb6>42fdDWBu>g-Ea6p&fJ-`Go1O`F^F%ZC0
zfKK2$6!;E_4L_@yB<#YKI)nbgF36}x0Pqkd%tPUBF+fQWsX!Tx1M}c9{fY8Fj
zV1T#~=nh0bFx7ya!?YWYRA3YkxiG-t5g^E*044}972)>;6tDoG9R~0r24IGO!n}n7
zgaV|lG$cGA4B!dCaw@S0{DlVn-~i?zFaZk((*7)isl?-OGT;?JD*^`%%2>c}C@dHU
zha;nb#bJR*pej8o{C$;LDBv-uF!B6R4ig$dR;4bc`iacuRw)DouG9}f#)M5W3@;J^
zToBA2AYeQqY=U6mFkXNG!4y^E1{e`|25|K-5m(oTfd~g*H1Hh2f|V{yK!nS{Rl+6?
z1cJhZ25c4;j?Q3QKvo=d*m}Z=1(KKx{zXm1^L_#0|nA9<;{*0>^~s2`~$YA=UHvhuYaclO(lOrLnYzgB&QF
z3v~y1Y2@JQgpOF50jeFYUo*g}gifWYO#iZcNRX#hrFHC<2^=vp)5mnRJ783NI}19(
zXu!vXhU&({i}h8%Su1lwjZ3HU=(JkDQD@)d0R)T9gz%XVN&-QhEC0{7xgC0sU**yf
z4LZB0NNZQwKh|u+_8!n4?s2J1cAb`JH8@-*kI`n*aCKUfs;F9KFbv3JK^hB2
z{r6J;{2~C7UGRw?DCx4PTo#=+%WGFVy!L;mazsRfde!JN|26uWaQ3Y?X+YPRZjZ|2
z4d>xivtYs>8*_i&&_xNv`}79M54{l)DSInt!RXMqoidfxog1v>;WC*F$nPK#*<>;a
z@An%FdM3$WaghvE8cC?}6NOZ&!Jxy0+j%5p5>~~OlSo2BPL308_PLM}ffGy~jVKY~
ztTF*p?=l($Tr)AqGZWEV3Nye9aYI~+QN?A_mEcFlrCR)Cp_0b-qbWqAgGM9@r6@EL
zB}HH)ND4oICJG5GiXx!Zsf}c#g-WAX2vn+GV?}59ObicC6EJ8)I)&HCmgW$RM2=G*
za#HMMF5Vy~a&;IggDwggh(skN#PoB`NQ8FK_4!J4>(vlrWhgTxLAHJ5dv*<=whZCMG;a-WWSV1L<6XWM0to2^kVc{zL76x
z^D;6hT87x?Ga5p{41>!`FhgvQfaMO+(FnWAr9wH}3N@A}%;3TW3_M8#aWcs03_4m8q64+(P2B7%X;ce)u$
zET194`>7d0gH7U*QuqupK~B->=@_F!#l)fFI6a>FtN>Uk|NEKYnLXiy&t;S&CAbohUo{Y^<`~47=mm~Gq)8JBa(>DVP?x!SgOgu2e@Lb9;%3MqXvk0C0QkKi0xRl+=kC~p|KW6
z1|?e{^CJn_9-`7iR*9Wjk>4ptvMd6k+bz{=jc|cdB+nqy)gE_$erL=u7;Iw7c3h@5I9IzSE)
zStJ8bMj|RDM5{~!d_+N!g#CvK{0sP)L>S=79N{|DpXz81zeGaiaETUrSRRs*OP0yF
z0jh*3sOrzbCDV8kKq(Y83iyZE?Pm)sWuZ{WtgtLzC6eG_Qn^7Xpdhi7M`F^L0Vb6|
zks^o&sZACFa(c7rvLL{Y_0u#zQ0
zT{c@xKyz$Zl}t;{Rtoq5F`VO-G9(-xjVqu_d2pdGJ49F8$s8s|uQ2m*Trwjd$Jull
z8QCtP#YJ&>bEF|S65*t=$P|v>#N>z+9yisaWdwt2ui9v(1x03@k?&{G$vm>xK+9lQ
z^Z^gg$dh@wB$ifb$MLxep4k$}Q457|a>z;GNs;m(lMpc3y?Sler9-2=UV}&fZ
zEQD0(YzP@y#pK!W!4QWga@p|?tCS|uVGTBHz@c(e)q;>AM`utgAp{cZ;c#_W3_`}%
z;oOi}Bei33G+vHPAbqJ*?LWHOs!;`>Z4EyXCYAZ(5tEx`ln%u>74p^?+@bTq?9#7fch9Gge!
zvS8t62F8oZ)-r8eYL1mb#AXD2bkLatBC1qI$UtQp6->08VyEIL=paLsK}Cf$Qk_=m
zhe8^)j<0rvvN=w*$<0%H{eEnSiRR>3@Q?{*4YNFvNH-gl8oxm)^ix2nkcl7(QOJOk
zh)h3`Lez)tlOg6(=@g>eKoVjEA`%0|(g|E>BTk~=Dj6D-6_+Envdv*z{xwztzcWaQ
zToN~I^MGT7TrSZ;CzGpVil58klAy|W6oc^J$5AtpUnz$WPa^8^R1)9=5}NpTeorwN
zm?R>{6LMPRR0q;1#0Dq<2R)<+ifvT81nb~rKy0rcYrtZC9KQ&QCMuOQPl#w0(@`Oc
zj!tk$AqQmgSd~XnrIhO6KC(g{6uNP21cw3nAg|w!wYw+=H-|znTSP$*
z6VFw75N0gj8$=j<(g2)cH~DdT6f#65t2hLKh!CO&XiC4>;B?qL29<>9
zS!5^GPRvl-IaICD?^h{V0+w1NkZEvEF_)k>`L*zno+MWh;2OI_spt8K2(z1tvMTs!
zoLZ^Op^7sIPQ6Yn%)pzm)C`SDFBFJrc&RlY%+Y9MD7GC(KqCEYgT_WBi49gBUY5<2
zbDbe1n{TGlwJfR;Ei${so(vjQZssdhHj6663_(bfBi4YxJJ9s(9EZgxcaf+$XeE>G(`nf}6w4;JJ2gxPL#!YO
za_m+b)rKL#36P2;3W^XEoR$^#E2+xN$)FHfp=>k~;yKI#O#s4LwH^-KpW~vrToOFn
z!g8~)CJ14+b7&Z=GU(TE{5S@l=QSV@T#qg&qAP7&oWtO7i*Z7aQmJ+tEn2!$=eA_X
z`4qergaj>LEkH1WA)=n+U_w3zmu|@R2K8>QUdi%!5g1E`lx=V+7?>bh6>!La|H(*l
zu}$i=nk8yXHqVZrhAa{|(Muz$LpV8B$uv88eka%J#G7?I7b)n#(X3{SJHv`6@(^l0
z$nT6c77Ihbli^^GOY97YT^yQ*Ak+%QCLIwTtc4Dzla8NhCnlVB>Xd(WrOLFE6>et)
zF(QBsr=1e6&nUqV1Uv&F!ytDU{8}?lZnrRa3bg27q@4_nUn?Q;!eNLccJqmTrV4~g
zDvhl&u{{(9!$lEk=njDvFAD`#To(dGbAWLG>`nyVLBZPOd(pDvL;;BjdNJ1HYlsLu4}1&o=;@ClL)yp+axQA*~iEUZv8~$#|od
z#$)A#{+c$qX+#Q1z!fX~tZ--)3Mmv4;-AtnsWqIAv3zQj&>)1UhRP+MgsS9{l$Gfo
z+29w1(@!Rq=hN6pK8=kAspJGNSLhBe|HA#!seYDB8Y1dwekiVU7PtVJTFQUslNiQepi+Qei}8D$J2p%I>L@TZ|A(
zfesuo$;1s~reglp$ADiFL71frh!pT%=^%sOK}4ot1q!NFjO6J#Kxn{fL56l7gLAU
zsQ5%1MXJil<^jLWme&-I0i%Iq@#m!rppT#BH3zm0550xNDKsDLH6?5QWD!63T2B)
zUXh0*lv6SwE>A;KAk=V$2IJ#-UHYI1Eaq4kNFej&aJ&Su5y8tbn}L@>cBKzx*W$cJ
zj$NcyI+!^)q7CO`u@rhW#t7Ftg#wX-hek+cWCvNTBs29=xQ~yP!Np+xfyArKNIo8=
zbGaO3o3hG-j7H=rZ6vdX$iW
zH*+Do6e(a?{Y(l`NF+H>;Xw4)wDI4>kkJ2W+W2qcpya=pHqwPbHQb43IruC&PATEo
zj2?*x>EegD1}jIML(I{511g;>;I`tmc#TOM6w6g^vD21eQ&3S-r&|q|;Hk_Ea)t-2
ztIhSD?da*2<1)`+sRZJ2;3k=qH!WK
zymFSqn2oUKNW5C386y)*L@ZS{iL4fg)B?UuWmWp!2($xqL6^G>-cW|tX_x2&0z2LX
zXBas;CB;p`WqZ*Uj8u(qWc##Cy}{@Ug*Z@-OQP|)JyLc+%p!>WIY_n-#0Z-?h|TcQ
z*hY8AL*n5r46YKyc9f5*aB&fMmQA7zAvrXh!lE`SMKYb2tyF?^4}xoC*&Y>Wz!DKaW;LIOu==i7(|rGQ}36a5C0TxZwk7?=dQ&P?WTSb9c=hG)Q%3?v`L
zoUKxTLmh++%VDFi0jklVRJo`q4h}(Jy5(+>)riRv!i`D?mcg{cv2e6cZD2?oCV0SS
zkVvd3l?)HEMJyg`kXsNrPC_=_n*$OwGu)%pDnuBEJcqB>NCjw`m!wAJ_>@*3)xu$B
z3x!G~%Omi}w0^5ZL7;L$rjaeT`@I5}LCL});0mQIsLf{UWd=0Igw?wRLIn!%Bh%@4
zHBP5fA*4u+fJ&m1*mMz#XXAt2c#N5?CJ~4pxmLwTJFMOSCPeX?i4LZo?oo?`HWby)
z2CEGL^my(8N5U+;(-Rc>RJR^?Isu@QRman0!$ufI7Ib4$AP*w@J#
z@M1uCBXqG@7tmO};hkgmup%AUK6QCgTj{MjyTM~@oU@{Gm)Ra3Q4h1J>?S>EqET55
zdbd%9#9+1Ikrc4cACqH~PHSWP50XK5+s1!;mE1S|>$M$2W_+yu{UdBmfySxQGQzS{
z{TJP&T7~wNDj+r1U$@jNZ*pX5tSXbOYC}EhX;{)FW|JL=XV>VMlt8C|&Dq&x(ssrp
z)hcjMN619zwYp4j;GoY`L1;`SUV~L@!MTlAPat?I`|1aF&2=u7$KmQ{vg;kim6`=o
z`A(gk$b?nyZo|Ynm(Qfp!H5E;Hhf8=NaJ-`18HuZRo|u(gKm|Z*#Efj0k15Fn^q&?
zdC@3p@<8|5dOaS^x>~$!)MMB_T&M%q+HtGqK^7_-Z*eaP|fh0xcX62G1Q__
zZE)6)MuH0g7zBjL21Ohwf(s^~h|Y%Se`=0s3^l6iwQjW=@||QyCm4rAMl^?-R>_p|
zcODAmMz;P{kI2}F=-kMp2vA=uDmOARV*WOB3Wpmt^U1KWn;M?o)mOo*AMGlfebbbZ
zGw^<^Hs^-5EW*s=EUL%q`qG}U`+;`##Sv^%TDIo&6JM>#>vUHKMs}TeyJBxF%3s?4
zMi*G;4N02Ovzngd&TF!J!w^(5Ww`{x(YDn1J|{>?aLc8OqBY3_o7cO(QUQMuT76^j
zto`+;@))nOKiwKwoX@^s-F9qWZ2FP>UEcH43>)ROmz(FrTy_~OysZsI|b@F_FU`^^J^#I)(*r8w0Mh{p=??=8xaf{?Rll5^5f9S|_GqOv>B&b-Cwj
zAD{2~M62aXr7v!3W`aw42ypcZrv=&guf_K|Y`t$Q9
zo^2PF^lE{5Z?HBwouN1NJo)}xnM-!_*z^uhKIv0$kjULW#RdwDEjlzFyK3W$A>ZC3
z%O-5;_s}}j{wlTcQs+=Tua{YOci4E)>L1U{Z(f-tL#g&>xQh*BSC;5+%~-Pl`(@Sx0#&(UagpOe_x4v)PjST
zavr}-?X4X!?wb{mX&*XBXX_5ikK8e`q1j<;tQ~pjN9!5Sx4v9=rgxLr5rd3<
zFumAo51JSagK-axc?AblvpRD=?MVyXUt+xVvhnxw$>mv@#6+#PuB_kGX`2e?jf-m1
zb<>_lwzmh#4}G1Cjf&qqI6i*N^oEa;2Q)}`r46gwt<@oo4c>O>qS?KccU=6P{^a&Y
z%l(+Iy#(!S8HKrh5bv+6O9mpNuW=49?&N|5L*-NBa_>A^y?$x@kWwXjbzRrX^!cj;
zEAOD5i8mgdUDlx_9aqR(@$JN5#oYEb>g^5bHRi?ajD_Tdh%8vv(K|=#O0E{>H{|b1
z!_2CH$C|D+-NLa&FhO4uDY>A3ly=vX8MbnI|=
zV1SnYtDFpOc>qqvBXB4Pa5A_u14`A!|5pCbjrwO=jtbLq6rg3`6307lIJsrs@rE5`
zTY^hle6oD_d})$v|B_kto2-gXCtgvt$fC!KcDC>cclC*R7RueU=j)fGN9`Ane^jA<
zo7n$#bU#LuWA4Zy?&2`*ejC|2_N-r^iop7g);Y3{|31?i%pSyqEcEN#)O~st(>3uTu&3yI!Tj?K71x@G0
zT-Z7_;>y|Wee1;6;m03JDE-`#bLMEwv!`#@
    7&+8d{Q7L3{A$6PvDc>ChHjt^Of
zMoW}w`wZ)BHELq6ZabB_g|_%s!uTtff-eZoLB^_ugpi4oYu1H@tju;&6qp
z*;t;wmT638-RJvhMd|m3OgLX}o}8AcNL61rR`O-=r+t@I=7z^HeF~;7TBj?4KYuyv
z;kUut81I%B=6su4I^@YxUaEVH=>lob=MniM`E`#=)_3dt>3T<9a_|^=!Hg}V6*F4B
zJUeB;&#=_4GJw|$b8=-^iihF=H3I|rGfzjx{qIG9zm00)RO4@hOgQ=Z84tguv%H;$
zewnSA`pPYTwrlE|LHh?lfuA7<#6v4&{!a!q($B9z)WrU$qGs5;GsCW(34FaWeEvCA
ztBfkAuwS~rOqzks%qvZn>VFIv5}i>y!XkTrd{v8`>BCknUUG)JsC&xPdsCAWO&9J>
zD6v1lN#YycX*=(kPT!#`s#{T$IYrw~8nmp3yF9I83hnz>v^&tH(-rB~?{r?wt%-rT
zxZwvpT@KP!FKt9u@zp+L@zEK)`^|5~biP?~J?m_#VrKcncl}~qZMs@cC+s9du85m3
zwPe!LB%iYT?U?-cA1{BUsbg2z?dQkP3f9BZ&HWbhu6#QG?Zo9pU6=W(O>6D_JZmfA
z_=&=tJ?Xjia?aiR(Dsh7m94zN&3odB4%VPXd42b6OT19WA8a)&bn5xXX3gj3ZCW>u
zB%43ULQJnyVVO7nMUzDxPWOBJ_>8ti`HOvH*{M(SPronS*FKiJWlABg?d%8NhhBTP
z<1lW(t__iy2E{A*!~N^W=iH}6hoDW1*Ll15YBRXYImwdFTMwV8(+t(%f*BJU<{JX9
zkY6!G8CS*1l;2I`3Sj=#rXjT0d`6
znbY%QyuID_{VS-4#j!Ky(KjBVt?2vy+nDio%@f=<7~B
zYXBb`HK@Uh(s_y814mCqzDIVO^syZ}p`!Kp(DToI`x^QQQ+i!ZlYKp_EZlsf;T(O<
zO=m}CeW@{M@butZihdw=jf#v!B!vS_|51!cU35$o$d{pEW8xC3*8w%_M#dBbWBgFK<jq9PHk3&IBm4el{$sX2jAhKM36~4X=~h
zFno^D479t=a3?Une9vT@5+8qc@>cUkj1{UPj)q^Pc0W4bjR!2(JRayt+
zxCs+kahrEn^uHTr?UA$juaR=VpBEF=3z7K5C^8Yz5K0Nh&>D%g#VR|D<^uZ$CUDv9
z->o9ug0PilYSA7qf-GCBa428scKy`DZDNk2i8TyBAy&OxN6$>SKr$&JRDf6
ziaGY9PDfSx*TOL;`;`>UoL^@weEgInEqAP$F}YiOGimPL8F^T9gH>Zqk0xL3L_rQO
zsddtSAM@x%iMCh8mRouAA4b6nJM70?Us@OUxb?@H+?jJWjBxMC8n{eA?@+Mem8s>c
zHKRL*lod%SDHzh{%O+7H77X{scp~X_=H}cPu%_(fI<$JdyA`L5+QO#l@kKmt`(x9$
zc@t0YMw=IU_QM*)MyBkhu&`9bm_Wz*(unzKII2`W9n+(M7K#6_fY5QVw3wgGtM8i
z)Eq_?J!&FrH^l3+hASeaAEPR5#A}TS<)Yu?vmAOpPLNri8~HXdSkAUF`W76
zc4jKN&UQkLQp3&-(_0*gTDOyGIO&QUGp(PL9oK19>GQ?!(n|f&-G`6U3MWmOkVu%p
zUej&$mzddw-BTxYd$p?(wlM3xW@A+V41kLSe_oUQb$JqAZ8vWlUao}AvU)id9skQJ
zr?|Z&w`knZ0o@LcI@!Z{dEfBa!oZ)Fc5hN%tvTFC(ya}7Jh!#y@bL9Q*DCef;v{&wfl8oN}9XY086nTUy*h
z(|)MR0-pxq33o-$oA%Q`a_@<7b-7ovB5zdF^hLNGZ(;8^}w2=lVjL7bT5WV>)=WE3z?nd%-(*=hae`LtOIQAH1wXt+saW
z+zHlL4tdRaT6WQynr9ncEHJbK*NQ$xJAGT)wv&CH(ysk}HWO^u3{4yN(N(J-ymZ$*TitWZpc?JE#=N^_fe~&_M?YUy
zq>E=<#f?G^&pT0zRj}tR+FGz@*2#>8i{Bj|csZ%vjloB`MK3kIrabtdEGdip!uxy~
zpOIbXWdH10!)BFS6d$_VxIBxok}R+Jc-kBKXDfAFgZ`U8u7>w5!th4oN17I*=bzzT
zB6mB9wtdq~{dUf|o%P7~$js9-3!Z=bl)CHXoJN~V{3~B>#-G@FJ{@(ymsH*}*?+v^
zaGyq*J5Ot85oo!a1bY#Zs9wS0$U*7SFSwtX_*
zZrv<&ZQK;{_y(J@>XFx~n-%OjmX??Ga(D4r?xQU|5U1O9I~XB&^5$|HO#A$TdqI{n
zu>6LsYwYLqLyI1*D*f=aWKr+q#ub#SkpImAw8tW~9UA@h4YKQkoI2F{AD;=5zE+gS
zAlhv|bAYS5L%LeJKf~THqjA#*choYr|N50A_%9joZwc<#WL~kaXF*rGFQepvy=2OayctI}U%vMjSE@{@^Pk~*->^Q_
zURhn3ToZDwzUGR5-(^Qqs9X7=+wc#=QG*_}l=n>Kab_>KoS%I;W&Bl3Ip@={GfLFC
z!UBBnHe)DhUq|2mFg33Ij>6}heuh3jFe?yc&juu)?@7k-_l;;eZ=3c=(wd^?gXdsB
z-9D4MUO--VOS*IDv?EFpkL9`1=P*?r$d6#SS9T&1XZN;Z*It8;gUze`xM!GpB
z`t)mKg*)PW_U0RDQ8TCPd1$D(wxrhE#kA!0!e&G2ot{|Q?{4amEjEog9h!1rm>9!9d`g;&06->pb~g_-vH!>+*@b*`_Q(@k()uz!X&
z&$c4by|6=Eml*$?m{#sO4Kibpbo0h3s?zot{`qNOyzPqLd&;#4R&XoL&xLKK{
z*U)=+Ely`V9DU>lK5=7ABI?-P5d!DybuHL8Ch|W_X?(5U$S5B~uKeP&T
z9QNw2Q{j)SJF2)dd**Q3qbvK&zN5?P9dFeviMmU-wqR7&&>c!PcP_c5ZNtS8x4yl)
za6~n^HaV}pdH(*_t-6lr6Iaot{8AeNHKAYgoZ4TI-wTFLr)=a$+~4o{eup>OHR|0f
zVdUr*@jK6N%)nUV>gE@Bv6$y?`@W}3jd{L(i5F4{Lzq|YPHWa(5O2Q7xieNZ|K-!u
z2lw~1J41NDzz+ZepQ>iy`hqUju@hdUMWZ@R`pD1wIw<#9)4!O_|1%7X$^HuiW3vAT
zW&4k|e?H_tE=$?AYQgO$E4?MMrk9qlU2o3sHzW8ye{)J^+Na%nnw0k6wRg_R;GApL
zIThGBduKH)?s2cv{B4UD3*75#?fcy1?Exk{u(Ryhj)y(o%{|*B=}m#EsMFZC$Aodo
zjXt-nJFn~z{N30C#Cmlq+O;@m!<>A!9n-&O$w=X@4=*OqdYyi0eyFa+d^zi~=I#BI
z-W?B)YQ1+{Gvmpp_yx-ZGkUclf5rbG4eZjnPzY~(lyMF5L*RPxYG9%NWU6DB>TQqR
z_D5w+*Di_2-m@UTR`^T$&h35uI$|;>PxqtYu;av29T4JUspM0P82g}dZNv2)>)zXt
z)p@fd+a;5~Ein&j@$!MH<#pYWI*gjk*+|c;T16+WPmK_-Y_l_WBy8==UC)~r`XgR+
zrlE=!JS%-1htO}(JJyYzS}=HeoupQ$h@bkt%6oir>z)g!K7li5+9OU2AeXy&i!0`R
zd#0XVbuCFd`oq_F-WcEe?k|7jcbe_bO85|WZPupwHKRL!f7hhu;Yt0n9}i~Ku9>m1
z#kk>3W8U;?(6v+D=+Y@g^NE{9#60NX3rIV|D7*7E`L6HVovW46DE#X)HX#!
zy%hUxfNGMJCh3ye`{e~0N6pN36I
zob|@4syH&Ld3mo9&6kw#+OniiVjt%5ErlIVX3pQD`21?b*lt}vIWCx6Zb&bZ=D#uw
zo85P#B=PGU+R(dE!U*x6I?;Q_$Zx#Nl@7l9Zcyseq;}ti|7caRcjb+%O{cDCeDVzB
zOYJ;${;B1L=-PxPSwlTHZLbE`_rV`O5fI1YyIJqw>iz>O^`T6f(T0>k?)|JVSJmTm&hs@NXFk4nd|%gZ
zEB%`{U4!lAJRZ9)X&rpX{=xa$dGQ-Z+&D4g``9(?jpRXPk5`TQ-uQCn!krN>_H3Zb
z+6-hgm{NzAWEcw@ppM^rw6FB_hqyz+HgdwzzGM-iVu#r}$3YEonPp
zcyza<%k5BY&M5p#wjgq&jezO3V4DLPHWm7x%vGaO{?#7GFPk(4xsh$5CV%Yc)Qm>d
z{?n!n1pmjo7)0wBSW9EekIC!h@vm3+J51lO?~SX@$#&7bXiP_+*HI;jG6^*7!Y>^}
z!4bm_Lc{h!!*)Z%cErGT^0%&=%o&C?jIqBY-nLc5Ty9-s{_bA+tTROi`qNs6pkXti
zA;p9KAI0sLL+zN{$e}UWZ%eLk$~d(8bJ{xCvt3rjxaYx~*y#zI+AE6(j3}wI`+ULD
z#1GfE6sL`7GkgB!8s7R{q19*Ct-u;tKZO(+^fR
zdp+|~!Gdjf7-{jBVGZtY?`i4kflae-yz(YrmEUPluNj@D9O@AJ+}pAJ>pP9EBX?Sn
z_j49~Iggrk{7|}HawReO&ZfmCB@e3cf+e}22u;y$<9ckPkaqr{dK8JkeF(`F>
z$9@*X(wdh(y_@)Pnf!Bf#9`9&$rqYz{;>O|a>LQOT5nGrkwK_CIC4YZ=Cy1sTi5s8
z7)$_*D<6?4De>!v)ec|fc`
zDKffi`GrrnbuC2mW+`8Ho848?auVTTF1~wmulJ2o(ocwoEv%6u<*wT|a%~6Ihl10s
zYJS(b!vDUq@Q;6KIZRpOB9vR>T&>86g4`M>z^_Lt4_d)FGuUa2$*r*!RBeQYJuU)g
zxZRd759EFM!1>bGe6}aI&V9+7ma9RgQ?;E4{*ng@{8RdDXxJ=h*mQ^qZXm>F)QOI2
z5*rbdax)hv?km28T6-&|TN>uI_rdL2jbr}yoco`zMhuPkr!fkW|EK~>TreyyyD)Xxl+HVn0hgFKlZ-m+P&l3q1?W$GG$rooPS9w
z!3~CC5e-iaTz&r|Z^XTExR=8{p3+^ZsN;_^W?p)ie(vac#Fp~F3QMR{pIt-AcYAal
z66q#YBupB8|I`xr=^J?Ubjtuz&juUimRSvUx7(d}owBdo>0)igjbAizNmJC5i7orb
zKe0B?%WK{Ps{gEDb{9$F?Xvg%Zw$1n3X3}5$ZJ$<*TB*{Th~$0-n)~!dsVOYPQZv_9ks}fB!n9aX^@T;Buf@vxUj*H;d~Wu88;Sp7$E_ZoecM-R^jUE2b~4&X00l
zZ*03N{9%!FY3O-%H})y!LGftQ6)Y`H27SLYcG2G14Kfb(X&Xh~(!TgI!xuenj84C;
zUWYp5yPap8P428hL?4PWeyO)`N%`DEmb=S3e8TeOwRh^zq;6=Jzxcd!v2E<+SDn_<
zuaACviRu{Ic)RsPX5P4S`@3X)PHBAkNAu!dmtO5T`tIqO?E3pgy}%db#v;IaAQSv_
z1d$@SYE4i#o3*aTnGT04*z0@PyWMTS?JraJ-+G8zb%_T2)c_>;TN;S!OEf==;1Uh@
z&$~a#P*QlmrdDG7&#O6zjLKs(uzB73PbbLL7ka?IrxU9)nFA2w6Urw2dV9P`2RG3~9VrD89
zuAk8R(!E1V&X8ZNUwTe***fN9>e4L-F4?~$I^3vJGi!4D_wLL7B^Ly9V3&6sM;@eY
z{Z=H6<-RDGyV7Xh+q4HhJrsB8T%T%U)u4-voc)D!qo?{%jT`we1noc{*hp5
zGAw>*LU2Ia)0YWv7EtHMvX`P;}
zVz*?!+g|g_f;G3+tofctac!8CXuhs_^mJW$!ui9mAC9kc^QQGc&7$w!TDqGiEB1Ei
zSY+vMf;x7QZkVvFIDYc7dd}{4*8yKM$dt=(yMZq~^_X$G-}o9sPQH>^ZeCk3swMUn
zCT}lpx_is>O{pc6T_0xNU?%ODRM_3s{!F)414X?B%MLfVw(RRi+nV$m?dql!OuN}Y
zJ95I(ZsR&5;yhDY-A;YRx;Zl0cuKXb*n&izGd?)Fd;PZ`(_c5cxGz@6vhwH^CH<%Q
zjl@&D4wS`*W{obvyvd8xFHhTP-dk^VD$H`jv&i30w{-Eo4$a$s@4oDQ3Uh0XA0A_h
zi!S);nbX=hvdM(q!z1QhzH6&p)V23v-eOMrl&V<>p$i(
zt`=v;!Zv{`dynNEoYCF-rC$V2cC%(&t6BNMk9&6CJ(a&SWkn}>H{$tvV{i2c-|tnn
z{`m8L@9*bt1b!p%8-d>l{6^q60>2UXjlgdNek1T3f!_%HM&LIBzY+M2z;6V8Bk&u6
z-w6Ch;5P!l5%`V3Zv=iL@Ed{O2>eFiHv+#A_>I7C1pYrl;Da(UVqBAyk1M=m%(sJZ
zJumX~kK#{H3S~L35PAIzT+O$&@jh>nvgANs{>@vn6UHa5BF*}|K@eO-oA8Y;s>d&e
zKOg(4pck3;uFoWNHsfrMdyUoODJy3^W*_I1n{sB?z3u16-8**=RZm1+*m8{a
zT<_%(7hkt*x_sdMcWWMA%F7;9zn5;|qzm&$pJUDEU)Y#Bn6+in;zO%bUcgH`o-ZFD
zi9Xlx$G5NZC%oMC=0${HaDGc}!xJBo^UkOUOH}*qshX8HzYvzS?w_>oM{dN0Q@Yr^
zh{%WtCWR;o%+r3qzOF6%RGTr8+GqKkb4_+m)|M|C{G&#h7GIb!w8e_zbLIW!Pu==4
zJGp|K3uC+)@^$yO9%Fk9r7$CwT-q1Wsa{k>K5SUy+Iy!Q$&aZQ0Y!|-jo-67YR$O(
zo^@03sZsk{u~L7u7Q!N;o}@GD9*yb{L0VfpC2qtwcaxz*f3PYLxjl)KN2PU~BAGHc
zZg<>>Rta^P5p!N&Ws)22O^z_fj7cFzEPDMiAwm+g1e-@NjvS8aSwE)3mxF1^`TZhc
zZyyF*6R$OBS2M6G)(GoK`FfCf%mO>s3tGQ>wLh+ju~E%eMJG;F4CsEX6h78CWG!qR
zqjaFmeX|iYch>85>o1iB3<((b^6ZMf_1-jP5n|>qO{N)I!mp+=`%CZF{nT%I{o(;>
z0_pr!*S4l_1W35R2k&KS1GSn)LXi@E2V^`l1&#`L>CcKTE(C@%65r!}4L
z|3LgOypg#yF7jlvmZ!P~R?;gjWGr;wO<1|JL&3$kZ>MHEW+$y|$#Q!Zwm*Du(g!z@
z*l|<;cdUI!uqqpJ;3Uez_!iBF_KBSzIc`<5;xeJsxNBv^sb&!$nyim|)~mJ15VMvw
zM?D{v`=Y_E8w(dcRj=5Xz@BigPxrTnCLij3<<`~i)BRnOBBGik9`7NeYwADg!bi^{
z-_aZ!6!oR+ktO7JgDB0LwOrR)Iq=JD6g7X)$MbS&=b~qMi^sN6tg!p%)lWIz=3eT#
zJXdoy_I=;(KSmcHJ^W_DwKsF~H$@xbd{YS7t>>;0pKsA8@G{JS*n*yy
zdG|ZryL4r3UhRrW%{NZ!Gk)sTHi@OE%=~V?S|5EG{cr;wCa-sF_xAhTHz|L9oA!~$
zvcBENH@rH#O|*Wgn(?t@<$#enr*@v-+m*6*gKR_U!?{1Yh*uud%~W3-JTL)0M>%>!
zAY#w;r^hCyL~M62l-^W#I;E&zqt?6J%WIyWElU!#(y-T#V)Pa-`0=ChlWuv6(hu&l
z=^u{5#g^hG5zxUTk_(Za5+D7gw2}33*2sn>lKU5TuG(0Rs&Dr$o?Z{N}HZ-lM)go;c-0r~VIi>iLnIH)VI|-o0q>TlJK^{TFJ=
zBDU4(u=HR=bd)|#7K{DS^L(E!2ZphF)Zy*T-aap}pt$?9ZEMPJI43=Cv1VT5B2V<>
zTc-!KsM`r4fdvvZBwsz%ET%9EoW;rGcofg
z@$-y*FV9>taLBqrHJ6}oY(My9Ynp$o+FG;U!}lv#F`FME4hP}(hA8&toTC$We0$Nx
z=!$Y*AG$u(v5Q``_r5kGXG-C6R`{)TM;_Z*t72{UDPHL=g
z3)``M7roW!M@7*G&sl0)@iFtC1Gg+qdr7RZH3nYp?~wHjF}t8y
z!3*w}ZykvHBVHMD-i*uFkGgR1DAp
zj(fG;-iYw@>46=$8r}aA$hg5PK3Si6>g+}Yd{Lof7+Ve=1kd!6z5;(?f(U!E=O
zH+f6b{UZfCWU?)XU^VjBPH37xqy_rr=zW7D)25x37lmSEV>hhWO(a3fn~xxMUDbU1
zJ@zid>D36&u2Z?R)1QmyDJK~fra$x-3E3dY5Ke8IOYPdVYS-L#wFsJM5
z)`6RMW-EELwCz_pmrr~Ot~*$<&DFtqcXZ2)5#3(R+&*m5SmEpsOX~-iO%F|3BRm;-
zb!Jh?mVOgy^r0=K32Vrjankvjr#7EDvGVfihUdEt`qq2YFdm}3LH|{zJEEwsC70K|
z>>j$jweH&{hH2~8pa*Ba8GXB1`Q@0N@!d%!cxV9Ss`McLz_QDShjfY9JXdWSV
zcZNmHa2aEL&wu}nRlQd6V*g;LU5qffl5SjatxeulFdb<_YGMWC?C<`Uby_cw5awGm
z-alaFJS<$w&Dqb{xCPiFic3|@%+c&Q$%|eqw_LqV&@S)#V{+-FVlB9jJNtf%aoT}i
zbIwR3o$UWcu0ftY{rtfI5Q%gCog+Bvxac!K&)ov<@jY0{gXAZayz4O?O{^M)u5c8i`D_Iku%=Omg82E`@M3RpFO^
zkH$UEtc_0=%P}OK7He&uY=1v|!h)>0czzpq9b)_))_SjRmFxrQblp92_p0JI0LfB9
z8k3QTMNpAdH7AzG-#*J_h9+;kx$e;*;Nff7!}FJhMgckbWT=zDW{6n9QZyPLl68s`wB&NBArNTa}oZj*w>N2Y*oc;Djl|Mc~?Qck3ZJR|>%PzxA8nGl1)_8+eIZsqS
zmB7e(!qAz_ApoRKK{biT+e-;?-Ds2@+o1h%b4qceMMxHSqH%So;G@d%KaUUq^>R}P#L6G
z)m0%*C9zN??!l%{iViu1K(WbUwexA{>h8LDz#m+TcR+SM`?7%0#VS-8KZ_kSC`=VT
zqsbdPFAa&gPDIko%SM>loFL|Q#m0Q=5c1yl8u!%}wXNyo{$o1{inZsnd;$$A#O5qr
zx=)+!$T4vk>d)V6ne{0`J|Vu2a4?L^
z?jJza-kv-_yy?&FfWH?Bg>oG*i-7&MTBd7AnteCKF=HE_hvRF7@1MM{akO-9-qmT^
z{i)f7%Ia0NRej|snlp3%7V#t?2`>%?7#nqOc5ViMr8)c}PCK7@2|ZmojnuvJYpW8k
z#zxy$lwWYu3q-Z^I{%gKa|YU0mXHI*?+ie>JA~1;6M{1@IaPo~9KY8DHXvNnidz5b
z>`4%Y*MVAxB}a4tK$@TIFD`$Fz0M1lH!`TeS-ZJC1M2SlTSC@-D~G4i425(60mIKv-m{Uf
zzL$BSITt1RGR3+e7yUZ)^<>M=^KO!0qs@ytxcKD|!}#vCe#Y_Nhb|OO;0knnMR!-1
zQ?oV;AD-Jc$m3&i{q81kyt&=hgl$}r1WVj{Ewr?sEmFe2_uuOzLBvr)QTH(H!T9U|
zt9-zV;Mhz#{=l;8Hk4i#gWR1%?sos4qJ{Tl)#~G7qmZ5OKR;M55TVv1T;H^sNq>4cVgX!ruW^!SJj^9LYOj
zaoqhP#Z~3Xc^_lIq^d|KY))&FK3a?wn3fmAMn(=F=A!$%F8_TRcNHor(D%I78hFc;
zkR@2^zn*h(;Vye1pJO^dsF{}^D6tuo>}_3V{J{Z|eE2{9^S_J=x=O$~r^*@ET)$a4
z$L3*7Q8T)_oUQ_K-s7)ZQl`9fUW5rTqYq*wZ)le}L}`*uTTUfZ|BM;OG0d9_VL$rP
z>3cfvZ^tuBb(_YjJ@;o$=nh0HInI!*;Hs)^$Yvs#i3P;U@ce|K8V9WEKRf;#qvx1w
zGqd*(f9@MYyWW+(_#-!ef5wkwK9Zy3z~n{_Gsm$9Fp=q!aQKrt
z{EjW$W?Xl9ZB0k}_#r2|%hY>SCz%#|C$s*%;h`UnaK=}x5O-C$K`hF@n#gu++$X7Z
z8!S_Ea)f28!R{^=gfnA+zK2cGX>0H7eVt8ma^o&)@SpR3ivrE4s}WT{M>8{ps9qC5goYdv
zGwSYr=Uh*VqLwv>tlic3Y(AS==e^_4-vjA=kI6N2wU5Vm|2dr?X3RU8iC5jQTMp
zFxO%ExL!(g&Y_R06`so$%$u!Lz-%rcUb!^RS=pYD#
ztCFCd=Azj+tj>3NbCNJoe8cCI{rTQjmn>}()~Cp-x!Roe9v*o?iyW!Cqk*3!ja>j$
z-3wWKz*Zo)rfosGa~F92o^#%F&ZU2OEh)S?vA;irTm1aR9rl9}W}gv-FV9It>U9*fd$`G
zAG>FF`<0DkO0-7GHvoLc*gyYkhh5{~Tq}eq_%xq2UQi(oZanPAqh_>xcyhCVj58UMiSu(QjJs0U
zFtf20r1Kyae1km;z)0qfX_F>cb7)@#OG0vlV6HHq&vh#sS^}gp;U
zXfTj0JzH;AKdyUe7
z6)#oB8AOU^OzVubB3|kU#=PC|7FRtBEb7~`e0Bie(gN2g42g42S39fX?9t4c+fWtu
zPipI4#6QQz1I26&Kqw^K465lWwW_?k%{-Rg#Y)yEO3nq5p;W#Q>H5|s6YrhWd(P!A
zu6Ohb%$&zcm_*>_sj;?|Cd$Yd#PyVcXZ3}3)Gp}SpafA49sR*K7?;r1i39jW-qNEW%2MAwh&Js5)B4b3@6K`{;_ShWu1qx%rOsEq)B;y_<8gJug!xFwYg
z>Zl+I{0O(hF#05Mb%0fLJTrO;kiFsXEls9|%|f*>hG(O#0fvsI*fABO<^$>+SzJ`b
zWxjH5%*_6oN}uU|6w*2lBfHesm0%R7hwi$d%3zMB_Kx}
zt{Dny;H}{j7*#!ID?K6eL3=;%7bTK7bNmO_$U2rVf#n_Ser}(F0I$(zRg>e@WkCc!FJ;0wotuaztaqyO?Z<^ab?n@~)g1Ax7X&b9uw
zX4x-dU;Y9Z-*f`6L4t3qkDuIj4=L`@v?*fP~81r5n
zOUc>js|NRDCZ}EGSqR?6b8-c;_*K9Z>W8SY*)0&o)qKuPpZXZ=Hu0}!UodJiYTLukoD
zkv(VZ0}vIf9RXISs%sVsG%TxPqs^Ukv!XcoP!Lw)qy%FWT#keFFIIi5OYV)U?3l*TJ9&C=@
z;ao^8Z)Md?=oOM>hZ}E4Ls?k*|f+qNZ7ylRRh|3XhEC<;I1_s4W!54nbcIvabDv3jC
zwqC=2jsN5C|GhmyVxFoVZrEK#X)gOIOtH=!E^Tq%ZCGuKtk~UxfJFA6uL@#UT@zKU@PlDvvi-Y2Rohj37c)67EWy)lMsxN{
zF*72&9|Hg07gC|N%sq5(KTUGRi9s$3P2HNwm@3S`ioF~n%kTiZ_*AI{TjvToRJ_1I
zI`_`mFyyQxu{Nl-t9#GuE98VzRsWve+_UlKr%sZ~j{(?psOCr`mylUmG&AXvk`>qb
zX|LfeQ4~YhEuFl;WHsoi1L0jW*!zSGn^3&zA^`NIExp>mIyie4YnVk|*D_^(oPu!;PiA;k&u9D4Hu7j`ViLln(Z66O`i-
zx+QMr+TMvOeitq1{npf37Rx#3oYxws`Bmx1D;Det#FL;=;Y_VW4V9)^!T)%u;*jOx1INOQ3HOA4_s#@wk^8lBTL>%WT&2hfouy
zSyepmJEQ97QcqR98UZfUcJS=<;Y^aD)iozP4YWv8TdTii5R*D=m%D%Qj{+<4^xvFw
zW)c>NBXybb(9z7%Mj8Kg7i@(ceI!Pgm4R|Yps@R1?FBoDr!=#z2Yg=$D$1^fbej@q
zIqPB*{TYgD&*!tE@h=W{Nh%M2+se^<3aKh(uD-3l^u3?tGfaffL_7j2ViX}{C$Z5-kD*ytx(LLBbGpyywvYTScy?h
z33Ie;FRC9&n{Q`FwY2&e3XVG91n;rA(VqO7xlwdf2{`~MfJ{DYPBIz1{@o{Og6y_s
zpq-b?m%6*jv(8Hk!gArZ%@4L{Fglm*SBCYhGqa&xa>d0y=d6$$M4cI06maDOSe|?T
z#B8h?+vA+=x_cVpo$pfmiaEqRn#DXP;X{?H^leAAS?H=R;+%6CRc`MRxODRd4*Phu
z>zrIPaxAL?R{Bu{(BPQ*}FLg?>`_rDx^PHE9
zzv~_r3gDap5sHWqa9$rrY~CMqe+!(bNSt9`E!l@{H6+iRL?e7$TcYJ}ye4-K5zMxD
zJ~(i;>k^93)%rP&0pZePD-Lp1SP?wf4JMiJ`%k!idckUEVO`z2JQ)j;Wp&#tanGDB
zTS^P}yqbEc%T7fLr13stRXKzSvlLR_tjUOjN%Qv$>f|u1C`5eKey1lBh26B-KYkO05N{&~M0@a8PG2noO(NVplJluG{m#
zqU~mtd4Y-)00hrim4xnxqydZ{-_Kz4KZ&K`^YVEQLW8QP-z`twWW6OJ7R!W)_xS-ulm%IYk305V!nmp>v%3`&dvmrw*ML%wf
zYQUlb#+s$~Of!n0u8tyi;h;?+hMODLb@;gWgkf;skDA?U8vs*_3*h-^f+D_Ekt
zyTerl6lQG7YNZoZ<;IZK5~5(38|`LN1QFm76z6D4Rn?n60k(d5*S6RN4YrSwz^+z2
zv??!b|D0&f2C1ub1cnr|{bzCv2_RSHYe=5onrr?SpeXT=Q4dCEl^XbXAK#|cEuV2aj^^oS
zL3x#k9!9N`8|@8-RNZr?x=GE=Hvvc}$i;}hh+7O227FsCv68rmGXaZ}HbZGn?nSIB
zWFmmkg=>2Ybo%|mP@Bzxt%S6yg!J=FiMZ4WRyS|wl;zSlK35645SdDj$I>jwajHdn
z0iX+%&24k5Fz}@uLaT&wm~lR#f`YtKPm-vM(bs
zdiptMyx9R8SO;AU=ib2&Rz{%&u=>HA!d@}N
zUlnhwylYg0R%c$M@}N^xWefv$J(IG}pWTQ9jYpNWIm^gdU2?m12+7arBJmZ_`lpRw
zv8j*fXr5=J3nz#=3$Q{g{J@p`IRw|#RB7hSD@>tf=|UAS(Fx43*s+yKy!M6??;iBA`MDsoQ`d&
zEu>#zBN<(PwmA%fQ7=1zxiNtQzHqi&ga5PFyexBQR>WR)wKUjvviJ~hZIFevI*DZy
zy?E#7Y{UjA;KZsi>_m*G&#K)|9SrDHr*FFBM$euA7+~Z2rV8ZDF(yW)*v_eXet33(
z&h{@30VJIPw>S|$46-Ar=&4q0h!`}Ijg^~3nLnwB;ku|s!Tw$=CE7!>HX|HGv=!KJ
zG!lb@ZFue|JIRtN%~|Da=ZsWg4nF^mCG~zoi6Br0jRgubI_!y7S9==(X!yVV{U7c*
zdd}&3;*9~UdbU0moOd}S%uMjjY7xI`)tsbDj&CUT#ovs5*MezCp%8KkwItj19lo}<
zd`Uy6c{+`fn>}NtC?s@uSGlbmGSQ^I%aVX0mAYvjiVJ1)y}nCHZGU#~bI(`_lO2S^55Rkmvp$Lx{<*bY*Ft;6V;v&34iZ@(aL_7atE
zxCrSKvu<7qOP+Mp?CgW
z2jMrJv+>V{8GBUDj0(k6Z#sp+6b(wwFud;zhQ_us*6g?!*%=h>xeTF38e-b@JR7Aaq+h1d=hIcG%7xqU=Uc5nmTaL@Kt4ys+Zf;Hxw
zboHf-064lZve?ISXe33#aApglx?1?s6h)qM@(7ak}7QBFC3l?^yuBpizj&-Js>1_sl6)
zs4)%M)y<-TuovMyFOdLVCgYMyD_iED@6kE$0u{Xf{`q^``dcHX&FUy#K{1~&Yu|g&
zH0L-n5%8YZ#e0AWP*2ZtX5ij^?J;v$$a=yV#Ud-hsHb~o2Ge}3Q3OAQh$itWQhr}2
z$@O!#C{fnq!3TI{JHc-ToyYv6wL(una~$3$!LorK{{9}D*)!^@P`*DREL$yc?2u2C
zBj!MHWp_rM{=>Wr7XHSrI&8Z|hF{<}^EyJ$WvOidt6XK0@4RMDs<=tIb@W2D`MCmk
z#tgIl4ggV=xF(J@c_AAImZOE?hKsu48e&Y8duJfJd7i+<*CG1TJ)xel2s5dvf-rT?Cnuo*B7kid@WujV~tN1t80$Q!`3zZkF?s
z^;fIqwY|Qz*dW*7cZzQo^sWW-Dmof7gs2(gFtWHhkn<{0aJyj^;RpD4h%ql5_>a?mn~;TOyOICy!6ChM}Au&p(bz7^O+(oVnL(
zNjPV;3i%5!H_~Z~pSiHkd3z?+gKJe%MY0+0GeT)}R=gRc;vci1b%HQ+XRu|P0X)kD
z`l3~ol@caEV&7Pr?L~`g#N(4l&b-}EPzC%`UOvKAWD9c7$s>}^V9
z^$>jL<(3^(#)WNbgnLdwqphY
zVb?H+%iqNMjf_`l3S2n{AVw*~MIDQ_xd}*n6epIFKiW6Yc5idt(<0X_#eJRlB+V5A
z`FsAIH!abyaDo)n)exHLdrU+^>c4u=+f^BVRbSDD&-c-BfZFxA5U4B4rE*q~``msvfNI-?Yk^*hj3qw_~s+yGOPWQ=)*h5q;y5pt|G4t*@`o3U9
zKwY%uU!HZ$X_*>O#>CBp*XM4&<0XRz^{NkSm#;E;Fs3AH&+|1FtJJ4mlsgUM(F36
zIV7rhMlOLqGjM0xi)aXtraUbVb`9eCXs6|GQ?4TXg0u$lGVx1ynhLI3>~HYoLjrqA
z3Sgr=-<2_AmJHmt+nN>I!(R8Uae0qTun@LRk}#F>NqdM&0cQk7Az8TcBX02<%+5J#
zE6v%`xC=$sL^xLp)Hy>Y44BaponXwhQf72nG)IJI%lraIF*uN(er~m#J1#J6c>rJh
zPt}ZH_F(a%H@%TG5fWkU=FUdsYYCC6DrfrnJgqaVKIau^Ouc;6CpU1!{hsr56L|W$
z(rCc#m%i{E!FE^b<}(kZWecxTAXk7jy2(8iaS{~R(QG4SkX4%LN&}Uy5HbeY_vhC?
z15N^!N6WYyKO8@NdHJ{n7WtlYL(Mq?UR#5Zyp&V{T2msOC)eu0;|T;Kr*qC@UeF6q
zxA0N-Q`P6pOe9*8H8ImHz>4}MxomZ@9!*&IL+SOY#0Ck@hXX>nTK!Bg)bqVn-Taeb=Cjh!+^bJN`^Kyt0wt@X%TaC>@uI0hhGTf9vTEr(fyNC-GF;BH|_
zSSR9u-M1XVuvjS7ti>akusgA&2$-yNWGVp_Q*;RkVJ>@emv59G2Vo
zrFx$mO|4_iCtJE;3N%1v#9~dkk*B>3wMn^hFGj!(-W^JFDY=p&K;!%Vt0(2zwKD}t
zSoJMj>d?7;URpWapx9PKGcA;fRr0T5rIw5FatKq+IdiieBwadD^+;;QxsoEEqvK`W
zAewT^I%v*-?iKHj7+ywV3mgzaa8@nBfzF9?-WEF*(;Jss)p8cr!a5Io`L_m%TRTDY7Z(voQk)WB={rI>}!aD+oDq%C4TcWrh@BR0`dwhJV?rV%?{X@TcK)GDmO~kp$8!32xfN~!WDYwEmp@Bu
zkU-4cDu+^<&=2E#qW8Q$kGiHLjwkBL{%L%AO+TQH{CYz?iQw=i0KE+R&GL7O2yAeK
zf+NboJC2sXx`O=KWTjJaf`{+o~3LUXlsD
z3C2vD+!(_jwS(4Xrv+1YOPG0|dVt;>m`hFiM*jCBBClY6PASu}lM4xwq(O>K;&($;
zCm!~-O)y_uwwI_TM#!sY4{BN0;!Ui}kU&~qk)ig=3Y#PNAp&l}+lq0pU+2d#H&>c7
zPq$+>Idwl9BTJKHS2|kRVL>`GZgF5)wF^cdyh+r%{3ICwe^3?o{xYtxT(lgL&Q>K)
zm;|{GjMpakH}SoT`nv$xf%c$j;wn
zsOeF{zdkGXjk5#YM|ZiiFD)z}4OGS_zjP1MWnE3ye0hzijYg@ZzixLDTR5_^In(#&44lBO4IEN*;~NHr&!Z*JvO_y`l
z-WnvGAiJ1rA{IZ!(H%|N7+cP^7cK!LOIvIo2e*K*(vRAG`<(7Z+%9|;wH)_LqU*W#
zImyX2e*R8Z-aXF);GB1Zg#0s!IReqWU;K8#0MzZ=W=)Fk#gSOuD_gaEk6KRLq3LL>
zj2-WkHMMr5X%lN--vDL6-R(^FS@
zVIzh)!kl?c69tO~yMio#epLs|9G6Mwv5h)Rq(9s%oBv(5{G*&9-G21gKhf+~ViVW?
zy(k{f?Sjo)Xj_1sUoEiMth-47u>Kd<3hyUa4s;fIS9W_5j8&Y4$!@a}fEb7VWGj^2KX%GLlF>7+9di`1z5akJSZgSbFx-QC&+f=od>RMjtrp7|8+
zq!ysFtIr&(UP(8kSq5&|k+o*JTp9_c$G`{E^L(!WK?Bm`uw$?Uwxw>Sb
zg?YN)_pmxyof5}CYeGrSrg*PsnmP9MKLpRx!^D$hh?-q2>7ecmHH5;hu(hGvf52;P
zN2^;(?u_3?2r;%Kx;tJFkl^;z`ZOp$EFp5|W`cGr*N4RuZ6sfm=%F~t)Nh+a`lSt3
zxZGDHShYqF$-PrRDNeq+bzZ~izqSx4Zjn0&LU4|eBe6?!F3IKR^@pDs@-ZFY>LZK$
zQ6y;P2!8%~=Y6UHln*1cbxPh|C)iQ$jE`Kauy3>Ni#Pb4Gu?j?9qlBE?tag4FlCY9
z=MrQ1Z(KwZaMsz@_KTKWDMW*~Dsy@65~*gn8yGnBpsA1zi8*Nh<}$NvX(Gmm!1mjh
zqsXz-#?n|L++`GAUH@5w?!PQxS(t0HHd?PT+KCdFH}j8z`P``(WQm?2CscE`>0nVx
zg2;u|`cX+`N^C7-#AIK&W!8dlXht4nxfib0J%Utt(6DeuG2EtdOwcRp^rd(Jl1?1C
zmv8s862T-j{8m0ryU(d^a3-fa^WJ=~TnJ!^hfPow=Qudr(Jc1v{b*IHK4V3?=T=gS
za|AO3RrRELDik}9&Z@8J4qK)HYrCOz^-gs<+@>;V^1r6|2WH>g1=m{X=2{)z*svi)r5Pkc-U!h%90ZU<9+$AeZ34Q`pg%8YFpqv
    
zUE5r5CF9Aue-I-krJ?~f7_g%b3?p}`?^i5gl!(4uf2WZP1x-$;C}5NlyIP)Zi0%I9
zr5=gmx`3?trHrH2*?jHA44Uyk2jdZ^XiXU~zERHH7t6p}I7d@1_?DJ2vE6b>6d-hm
z-}hhm;^%cPc3Fslty8t;(HgX|`I~RUpf&vaUpBHKA{X&G$a3_;gm#2*Ha`i2?Zl&T
z%9DIRa^8YG7bvaILox3I=Me9CG9jfJ$&&b;Q=j}s3L`UlXrikUNSAuMRNY)Ty4vD`
zTVg=Rz!umSs?tvpi^qyB9I!2GH+}P-&csWI3%y|?wkvY?`{=Cv3k$1^`=&kcwqY{Idf42pV3SdKda*oUq%$Ld%|Htz`
z!)l~aSo{W;F!6FFw*3B_UnBtY&~A*Lwp}aK#ugYMnlf7(iR?zwXciCuyj>g*08`o~
zOOm6AS-J4t{D;;Zn1Modc(TxDu^wsh&9x%FEc+zw>tY9`{84+_e1Jp2Gy*^WIZ-`R{TcHY!mx
zN^YfKVSNN41}hcnCzmLHj@b7a9an0(B^*A?9^aFSou59>W|Cko#$Mlro=AECNv4Gh
z33tOQ{0=E#a4DKn$QU8w@+N6o=2Q>w^=AH@;mdvSYR3}jXbNaFD%tX?+R{!Xt%U04
zI4e?;X2T3ND_NSVtJ
zs4`gfstmNTg*N2Vp7M9*Cs9E}LKY?P_brJbogB+`KFN^dKJ%t!$W4Yg_7+lony7RK
zSmHwe{hWn`k?T9&$Bo`F5YIW!({tNLS1F?=jbtWFIkB(r3SsxK0i5blaxBdf#>qY3
z;;tvY#;L061Vxi=w5;@KWUQIB^A*P?_K3jWFouqkm#*EtE{^7%w@@o3_=Lof@Zzf$
z`&puOl$qB}-zQ7$&pBi5^iByFcOKs3P#K(Jb70t2{R`&;M&O*1=w7!#K@Oucqq6NAv0dm
zgs8UCekx78GJF*{&JNi*cbXyFp-JQN0p}s}c1~J3^LhCcB#}EeN4NO@=BTw%mi3mF
zFMgDF0%)Ba!tSjh>Zky=wraTbIf!vGThQ`+&(e5WqtvHr29(DdUS42FFUDz
z8sK~W?JF46-rI{CsD}#yx*k_MTCjTCVI<~t{$o`S(n`9vCJ}CJEiG6L4-g7%YeBbH
z#2R*far;(RWgK_j*FtqiXvwsusMWM@A}%h>)Y=fQt!6eojuj=DR@ZLm=0DS&-WCa^JlxQ&oLb{=h%!|*
zXV_Po1Q#Y$)!86l7P0~F`G-np%9&%q(S7*QxPt@k%^86>C)D~?}|L6f`a
zJ%MGC($Syw9Wl%~Yhl8k_HJe0><2>1HafIUn2jb^vsE70-G(=gfvE6nrf5fV1^-$6d=W{3<
z3rter|Nfu<=3*-WkAU27;V3>AqmN
z5qlR;407h(TR=sruuKNHHyqsQ>h@%_@nx}HOsJi6~dnE3^S{uHkwQFyZg!fG+I13$SqpZY)HkSrqy7GcztO
z4YCXof*(_BhuzDC=S{ip%WFz|PyW1LjWF$>Gbs;BIo(X1hDgdPLKssfJjCwH3>?F)y~5
zcC>v~o=#Qbt>|`oaOTX|YWajr;++I7MT9?|ty0ryW+<`4@_1W=sgkdf2d-3Gh2^xy
znXyXm1L8h5b19}oq!ks4y%kU$WXv+%+vh#ot?K^n2o8x6LChF4r6&{9w}uAX19e(>
zTI`g0LbLUyqqSQDfb{u*%q%O&W<_!sPz+p=4c+0TiSN#{%)
zvR=Yv9dyF$s;#Kf|SCGD}XFU3YL&a}*H`AK@Ptf#{lOI#8*#X-g@zRHe+$@EiH
z(P=*$`FN|fqR7zzmh{m`&-1wKo@-tLX*59eex{wr3YsDm15(7@n)m#}dQ(#4jIBGB
z7GtHYzdHxO)6afR0qIyHsXfph9E~#ABAb#d3F%U5UtwPY1@FamxDXfVp}6Ua3328Z
z@BUkj+7@6|&5175r}@mh=RD4hGvUPOqyisx_H2=a>#Zo4uIT2^&q?o?b@8$DlH33f
zI7f&y3Bb)-e6hFra(FnC3F&@tv15*Z+O2V;)7Z&p6D{P->jbF;Z3lHlJd{&?Ew&Hd
zrmxe<0>C8WivTr*~^J3N2>=Dj+1Hr+dBO^9?
z$}-P;tm(y8uR5vhM~!_L2yi<&`-*n=g3ZJZq`}jVuf;htn#V=CvRPIk9SU~9I6-J;
zF_;xzbLJ)LX=h?w^%GZNRe9HgsJJiXOcNVMPW@_uQ1jo@bQqszxDfsiK%`Ug
zyFuy)$r(y%A7&P~c93yyg_4B~!r2Cik_OV8q`Qf5jjQ_DJ7V1A*X+xb18J7%ehfFA
zLpiO|Z9y=Pt|
zuk&L%*KA4(@0g`=-F5W(b4RKGBRtO^lmI8)Um$^952^S3lhoZdUK-2rVtEB*TenATR&5x5PY)!m>z`Ys5
znp5w42xnxMV!K|DbmJ>6^kZ#zB`I`GMNOTIN?e-9)`f021h+MfV*Dogw^#!?iHY8v
z!I(8yhIkf`|CGLbGt3<7k%dbBgsYx0IwiSoyFko2OqsfTE9WFdxuHF}(o8#92+2pq
zsc-B~*@Pk;CKReJ1CTH}(l|hw&8}x>la#afLT!H+5!4RuwycMOxLNBlyJk@4F88x@
zeYp9(*_rZdd=#H9bU#;Ly0A6+mP(omrnGO>nK8{J+5Cs^c_H-kekv;PFmFHiNE
z6y(6Oc$Zy}=N$Sa&zba7x_!L>?tmXJo}p@-2T*)mr{pOq%Fr?&>7=x6^P`NYb+taD
zRCAqCqMD>`*5~7z7s5ifnK?i`)kw3b#5;+7lc+Lddx96M9c+d%ynRcen6mRVKnaK!
zG)IFRLR~J{`x5V7JLQ#wgB^h`Naw8m2=ZRnY4u%^HG0nsA_^F5H&O}WEHR2i#HE>D
zrtsU%h=3M(8+Nnw^xw>!d9PKsiHK9%z$w)*4s~Lh@@gv)h|s|4+2FU4^SUd%avElOfM_jK07+|{i)elcEbOY`^9Cq5`+`0Kg#_*k&QqW8zWv2`+)8pZGYmkI*}5JUTmf!NdyW_9=o}5C&Dk%V4ZWAqaHuZ9dybhUFSh4DY`wx#;X?6
z887O29*yHwba%-^Agx-C%4_DB?6@jcCXXHT$Xogv%%ZQmak=TURn*Qx6j7eO6DOKl
z;q__#n<)|;M7Zqk;c#;Z$?cad2q5@Wr$g1ehUMYFy2%Xx
z2B5`xg{p3V*tX^dOuVw9Y)d69Pjx~&hQS>PFe?WR?NoI3-}iD@)rroqr#8Sk$nM5;
z_ec;$)|n$6*TDE^%v}}O-E+sI#|9ue>g7Y0YrDEJa|s^%HVb!FG_+*>o&h#l&!405
zEt)Nxq%%h9xk3(O1dZMuy{j)cOh5OPTY={+sJ*#v5?_?fb-g}!y$joJnWR0Bfb6~A
zd7It+g!MpS+tQqY&xuyf;g_|=q(^26E5gJKnzb`r?Y56e#_Xf>a%`8)2qm#QJq+s;
zy6@|LICWe6?VwJJY-osP@6ze!R!hR`fU!}`
z{`!`1?YC9g-X-kOaXlNte00s3ccxg~JvYq`c2n9>F`zi<>|L3N8~YvEa7b(C?P@EO
z{0nOc%~YjtP>$TVwB*!w_Oj-1$tM3}lQP&LPveS%-6$apbyW$a2Y&0TyBUR#y!
zCn-;YI~Bn9`cq=ug94^o4>Btfq1>~W#qvG#v5C!!4ryz&fFwVolSPg+!Vpyqb}z1q
z(DXg8SFoz2l1?~9&=rQVH4Kv?rTrkbbJkofNRw4~$2wjDTM+2!P>vJ84;`|)YvwT7
zvb3)8El$NeQG8Zf@D(0=0VgdLdTBuC9?giUnpB;4kk>a8L23;}Zcw~_0A+@~Q%WBi
zCOe(0e{=@(usuWLKpAL+G>kQr6D3L-t$KK^gqw@^z;6E&GmP6KkVxN(<%(G
zitowPv`K*2=e*s0W>}5nn}fk`7M(<~yjS3Wno*@TQ%*VZ!-SmG!AU6|GXQmt{Y{S7
z-J#n@v0R~_w36*_hQ7k*1<*4ts6-Bq^lWE7@DrLAHL((ei0Rgt
z1XBh7*nNia3HU?m%Pa>~WX1k2!($>><2aMtn$un9O!uF=b8j6K08K!$zn2>#l6j(V
z_T`N3oF}vo-3U{18rBSKRsTCvmR+V10qDvFxJ8d&%Gx0U7WMe0LKx)$y3qrimt00C
zdFF8Xp)5C?!x~#7yBZMK{*HEVQR@f)1v+rm8IoJ$ro18mba_ZOKU+s=;&(#k!P^9QF!7Dd(|yd7o>Ry>ipyf$?T@rRnkp}6P%h#Xm>Ctw@OixW~zV+C0CQk
z$n2NL=-kBNBsX)pd*~aG7NDi1+@@ILe9sXWN0aTQ^f~OjrSTB?E*?Upq!-wIZG;wc
z$bPxm1pm!HNd;8>Nzm2PZlf-@;Opq1aK?Q#1XgfigjIgsz$qKld(C($a3J?@cOKiAFa2VY#^(R%}6XBDC`*uX>s0
z+0KOYEp_n2bTPrxe*t13-4H50?)3f>rKe_flTM`$p*zz2!PEfojUz&VhyEyC7J^T~28x9xV*eoWOxRf0dct`o{Wk_MLbT*v+lLM@4=fc`%%V#U=0KXZEZus;n
zqD0Q5gqN%>giA7pta0yL@p+zsTs7ou29pwG(td=Yd0seK6)YV&3#QZ6#@AkwGTYkr
zYZX>oc(ZM5oM@f<70xmGWB>mCs%qxnyd$wg{kkNkt9Zr;aO@g4Qxsa4d&VZ*;rOs*
z;;z5US9k^i6ArPA!N>XQUK%2WVFlkTRvAE7^_hQeJmanRZ1lTL?pUa;otAJj9>~I`
zlu--T7dmb-Ejp3d_BB|m5-W@~_Dx2aQr~H@x8=4F+aWYaQpE=Yqw{pjSI3IbZ9#-d
zTfT%on!UW&`vf^?#QJR8@563d#X%6LXb{etz{0ub6b{tEjc8jP>@b$*e;oy
z#$J~~fOqv8gUCp^HgPSU5UO{L7=m1V9VIELZ+88W&J|n#dE)sno>6S`>pmD#G#5T(
z{vf7oFKE>nfa6)XX%i5!j4-MCMy0u(ff^&iS*k79vb#x+yHK;4a&Z9ar~bNy`uFeu
zW9G4+md?NTpJ`EqN!Mum+ntv?!kTn5hD&;NHGTo*Co<(8^AaRcaop=5L^mwEQ
zwo@>9i_Gt^0NotG$PEqdX;ke9rFf7TRz|;)U_Bt*A_5z6-t|H(SL{j75v2L_W!Q3M
z+~^~x(S0X)=h5(Bp+)!uF>(yP=Ez2~*m`NuI|EEr_mP6g;==PWq&|t{k
z;eYGH;VucsLy~L;5g5&Vd0hLdK){XjFFl>0mQh-zhgMZ3uiL2AX5J_|LJu!mu`lWk
zWrmRsE+o-7Gw%nqFZQLFj2#K0-s`fM(3lo_ur=dG3||5YFpmX8J|6fK}jRJzBSaSUW}Q)Gf^NGs_}a$)L4&0(CR(>t*AsRtLMQl3G4J=2QR
z-TzU|r}+&2`SyArZCHJD`~+|VgEf-ltAi%E;_2M~ayiEZFIbq0wJ|2CX8L(PpA3+g
zd$BYb5t1WbE)%b=y?&96`K`~mrO;~?F;Z3pL2c?H8wjBBb+sl?*mC92O>bP{Ocleuo~kKxwU!`-^jjhBuM$5j-E|082}
zmMKcv#!3h>J0vCR+H6C8-$;TG3P+;!^dr@H01V4iYnPDL1#KRVeC$nUdn+}4;sW(A
zANF$^f@E+DA)M&W)H3w*Y<(l|cAN6lHkbD(zroqk(~6?T`9oh|jocm%h{vjqp<5mx
zrGIIX&1+f2Ws~VuKb!RSp;Gq~5(ZQ3P&L)wOjmgs
z@Y-yhnWrC{|Aps-Rbh45_0xR~>+|vl*9^qm)zeMWsJM5?IJ#i4pAt8^Zw~-;HBrTO
zj#x4@H(ZJvSQMLiYQ`@Z%Yf4(aF5~bbqruD?97eFxsxYEJMN%5aZsM>hu6B2lD`2n8P${Ng<*H
z7c|rNq7YPZZ_+k!db*jqVjD+`_ZG|zM$`3Jq3|Y4gKbuwf^m6*!VMW=WAOl-lN|3B
z+-=Rk7MRR&kL7Y`C%IHXGip9X?P&ShiuCI%f*thrdkhU|aPO**HX3j{=rr>2UO59f
z*TwfYz&2G_If+}`;isQ>T<=imvbt&i@|<~7-m=F&P_?q>Ziui)or`*cy1*`_DnWcK
zwit%Zcv%cFLL=?U&8KBm6xFumwIsh8s6h1s*A03
z1!#!r@YcsG4T;RJRQ5t{c!8RTL2AJ_kw$KQewuzY#oT1l7?F643T16tmE9%F^)G%5
zZWXkv1{@l-+2waznJ<@WA~@6($v7QEXtq@N?69f`uzl~l)5HsuNpQr0dA2#aT62bu
zyf;d*Ym2g`oko1R&!|vrjp@h5YS}LHl_!U@tP@-?WQb-0_uLS@?%Z!&tBWg}b_t2g
z;9cW}?Lumb|D1|%G*n{Z2rxO3*n
z_dQ(?N<|(I>h%2ZD(5+i7=wzN=fA4Q4d<}6tXl+u8x+}tQef#s6wM+dwo>-jhREr^
zD15e*F1O5o7l`Lrn&jrZV&ipTe^q&q8(GCpJ%SFV7Ndn1?x^Og(xS$8W;fWeDxW+!g1kjoNQw0sZGy_hxe$Kft)QuMqY4r
z+LtF<&N|41OZt1EOn#Yh-Y*se{%?Q(lhLiXT5LP?EC##|wW?EJ1$bP9Ujn;cb}C*q
zNAZFp2lioFl4<6+W3^o^u-tiAI_VXku@8j|b?6ND;;i|L&Zl!m=mqDujswDp{{H=NbocGvmuXAz?oKM*{a^_hA
z8NG=}U>EK!+mTR52OOI8Vz;o{NB6s+r0%!2!tRn46-~`Ws_{s
zcQWnsk~a>O?r*pux^zB6yKR}h5G0RgM%z&)`|jr%&FEbpaU&&EHKFyIw)>fMcTzP0
zMv|uJ=c{j_vRNgw4{6;qhpd}g!9Jj`sY8Fqt7aZ9KIYYjClGO9olZg{)AvjDN^BP=N
z>5;Oip7C6Ha2;^0+n$q{Rbo3O%x5s*mI<=9hY{$cMbhY}2@`V6{OMP^>~%kB;O@E?
zy7#7)w#cJItYuHIS`T098jWUZ3op~==Y6w78#ekdS&iZ-+M%q)kj_a)x;c3yEgQJB
zUN7pJ-Q?I61y$eX655#I64I9&^p$5skNJ=41himsX4ba#EPczE7|zUKcBHQix6T^`heDYe}d}>o4~ln!tGlA2}}N>@CW!`|qme_`uRB
zYL_71E%cF_Yb*Tv<&N$-#%p_rYZI{G#0mwFUF*7dJ4G9U_)vXVVS~DBbzOUD$sgdU
z&Colu$PvO_tHmA=jFcJUilJk~K>BJzEX5&k375AHRi(
zA)9y`$mNciq#L9rR&G9bDmQsVn%Ry3o}D`erCx9|^~?XbEPsWa
zgE41u^HNg!Dg$(RuzO0cy*LAPJ-kN;^3No+Pf4@UEYdgo2SvC@&Gw|a9a@|n_F=TJ
zH)+doeA}|%`m)5q!wZImbVAP7pUaDl#OA_&gS(AD63nvsjOKM;UxX|XB#-vpDm-M%
z#zt&;2w#e{{$8A|wX|t1g%7>28=px(rwTryk?lEv>UrGAHaU6ZntowOAZKC5t+PmK
z^mBc2qP9m_~tmTuJ>NaN`0Ko
z{8)eI@OlC)=K4m$DNm;@mjvL=K<;bOt+Pb%>8crvxajk=afP7=0M*wR++BY%*R`tN
zlm2fsp3Wy&7oEOYlDI=${Ez8vel&SZ>?m_k!~O3rf4{o~k5+SHn$J1FCI>pBr`w7t
z9fM8|ZsER0Co-nc!z>ocjla2`a&bNYxYIx-1G7Lm&h;wtS@u$+EzGA1rLJp(MsL>x
zpj_b--;o3Ar8u}JGHL;T7nZ>AD|^YwbX2S2-A8|tb1VQ@C{-wcrNpzK1wrOcXXy=Z
zR7+sX4UQ$t+=1AdjB2LNgg=CwFxK#
zK`Gi=
z)+1LjTvA*{rVwAR;pNhH(O5cM^2o`hlw7@L*CmusZZB1%RX-9Xel0ZImT-lx0QL7g
z00vW4=glsIT6q$k1#%q$vw%J4Y`IZ3e`s~KSnU2=7B9IvKow5G4$5`@&SYa(YN}i^
z?M9~Uam4ImrZipd+(#W%k5h*vpXYJ=Zm)E@>AW?QIx*y;2iBN(
zFv(#Y9_|Cy*Ceo4+IRW1TxkOmi7*(b(iX){INe6Uq*6p>X<*_OcQ$|^#itvnb53Tf
zY;(Mz>%L}jQ;&n{qU+TJKz@FYCNgW%&^hs;O8XfvW|vV?G4&t_U4R7c3o0JsW>y4%
zGlx5DwRpqD#N-|qv=v{f^3^ub=H)Na*co3_z@TFUfqWYNh)vvUu*r;u@?HyL6Vd5-
zkyvXvXp&LFpV9L)g!hb>O
zic91LkFm~?hl$&=_102ig-GU$oh)&cz?`#!RXez{#^NcuQHX7~q(;l1ZThDRm~-YJ
zbxe`EtP~<9uPssD=8IT`8m-z?xwg=XEg6R_c)Q9kNgl{Kz853TY~8^UQzXgC43g~x
z8hS;9F^~xsOAeb4nfQ>
zO9AJSL|McpH4qC0<02Cr^(BW?1fFv8&j!Yn^W5M%m78(>DMWW3QOkl(!r(^_0m-F2UFth_v4S@P}vHu_q<-&5qdjDD%+aaz3QjX)P#h06?ry>
zvBp+ha-*aB3e~Ba&
zm;LZw3fAA2568~)9Yvg0MA1w3Ovcqf
zG3lE3ywCG+OP7~q&hu!y2h}!Mu5DZ8Q#!v5y^O*G&{I6-fj8O7^*xAn*u*ZeR`E+C
zt;LUN29&ypy(lKHO1sM!apthgUCkUJ1p54R
zM4U;><)zi7>sAs|LswjvnQ}>p_U`pmV)-sTEi3Q2Dwq6Ru(bt@}9HnfS@1kW#Kh7!2BppN|-qlg=zIU$L>Mn*x;u7a{SVi573O39AD4a
zgkI}7u;vyi-+!K`t95SmgGO`CsW1XNo>&4qd7e;XiwF~?;Eud-2k$vEGq-Ql9_}^i
zn`9WQGhQG9=*$7x^|v=VWb>9Z)A7h;TyWtQQv)E*v7%mGeBT#fKMhL)6wFc8IU(C}
z!;O??kmuiC&@+?H`qI~!9W$SWsqeKQ-8NvA^s|Tk*m`Zpdy+h(&eW*aDXDl0E_Vy-
z$w4fAcC(S2=#y@t=`4x75lAF6O0ptC^c^^?tumUaVwJlSrM9!WF2q)%F4qB-H0Qk9
zIIp{7LZaXEBs_JM;Q@?k5=*bL*to{kI!IVp>GGXhU~Z!B9gbc%#cb6@V$PXWhsnWe
z*PK}@&2i9~tFYCk1rgbc8Q002tvYjvIb)(>_Hl7VKotgB#%gvu6FDf1fbpZ#TglaJ
zSQ5KA8o|l5V+KdJ9H|mYDNo$~&)OC{;5EA>dCor{K%}&r=bSCaFpx+WlG^^eWySke
z{yWIGtv=)bOwA^Vopk7=v5B2uc<2ORW@rU}Dx8s$uCI-|a(Z)*S!7vxduBVpT^AS!
zK^E^cY^72lDN0C!yVTg^LT6b0JkNXHRTH4@R7oeYHu&cPQ~PbriU?x)jfd7`2igM>
z9A?9hj?ya_&gkrib6XGGz9hW8$7CkaEQsAOjctguH<^Isutp9!u~qk;rl=W{sOC{P
zf&-2(Mdo{53#yjh?ZH8bnCf8+mghjjzJ*S-?yVnmZE73}i;}$)*
z#eTfIXO1a9bAIQ%i}GnU3)qGo8yaav9NCUAc#$NWImlT|^_fqQg-eKsaFe$-%=!3g&#r#}It2cY|NPH1)U>WvhYm86#a!?dCxTG0
z7L_fvmO{Shliampw1QU;9evNs5HB3K7Q+7NOKnYBW0~gJ>SKJIA~wv!)@rX&9w6Fr
zm*SimP>m$Pq{RewoJq*g)^PS{@iLTY*q9sFZEcU;sAHNO=MN$6=aUxj*y>ecs3YFS
zBnk6;N&aiZ%QfN>f3O_)d|(~l7diWwjHhN9G`j^3LAq(%rM4o2At~^$A3&nVzLlwM
zm)#d+A7Ek?xg}=eV!>{xHqZ@9u8J}fu&`pJ?VIrhLu)H9#%hmm%{dN-C-CXVg1s}_
ziZ;IqjwG*hRKNzth^a160;A~fBEan0B|FqO_c}9NRm!`%l^D0
zlUg}cZW+CFFuAWmb;b`)h!w}Bu-kD;1l#9LN5~Wut5{{tQYGG=wH~H;#VbboJf&j;
ztw>e5CT?(g2IOeEn=HW+hL9{y7@lJZ?sU4gL=0l5?ocX^c|F!$E5zwv761!aZG)=#
z{yW^Gt2D%y9o0;-M(;V*9Tj?F6_NC*)Jzqxielf9-OVZ&=3TbC*ZK(10aM8ZuuXI1
z`7iVKxf5WO=Qngob<=T2x0TiTC?s3ye4!7R4<5np-oh6Y(pFLLd6}xA{AkgsiL4+E
zs&;?0?7$K!>2&I6p7|0xE-SrTljFLnIBcf3$hr~omLGSqlf&eCzZ4Gr{XNdpRMnmP
zQvui}v=Qw_^E!Ft1^V=i_1(>s<47mBTzpte-Y
zt1FV{C|)D=>XM7HW;`aUs+suNq!^y(=8c7|WN}^^+gnAFG@antLIZ8h!FA<9WY_yJ
zKsd>2uPydQW22)qr{%hZWvVAlA7;6utia8jn1$(jHpPt}gdOitRSuL!Z=`MJP=HOg
zFF(#&g5G-_$LfWzDs#s^DrqnwVI^I=>2Xt)dRKkj
z2XlqcHG_`ScOyRB1IJp|wRcc%)iUrWS}4e+Han6h;e^qa2G
zYSxtPSl5|))Mf4au?7co5;3}VFF$Ycbfb6IsuZv)>q{X;L_?3&4VuqMV3yQ>FqiK1
zKUtU0SVEhoGSrU^T8?9H!6mT1kSD&u2R&m~-I19oCiDZ%{kG1XZ!*_cUyw9)g1Z$QxV?vvZk`rG4W?J-0kLhTPe
z4L)$6!fsN^4DlIr{0rh8fW-{1YCT)!%VQUK_b&*+&lVSS8J3?$L}Wp8-ZzE{6vpDT
zN?j$8erP^>fX*#Jl)G=4$?$x0C09lgY@`I#7%rLfEH(JP$GOaOz>u80G6dO_g`t({
zRjZ51m3G^O*bo@LNP;**+6GSc`sPS4bv>W?&AZJtfUEEw`PRisRAMCkk_00+8#uPt
zjGn?lngcT~R2A7k3vAj5I#-8vu)KcIN1e_(DFz8x+7%8w@@$z?2BpU&pV6%Nak{Ge
zIm`6V7JO=E&YX7yIYn|#o_h(Zr3I8lTSMmU0-CA_f
z8>!LzzQS?*uccbxQSz2=O*&xDdE-~|xlCb~4cZQ!HNCecK0T1QgE8w%x@Pc(Y{o37
z`EmMiZyRU45dd)&^4L7pOafB7tB|-%iv~C39(+pWG^J1ol0uK#0Hs=xdC6i5VoBZUr5dPZNXQIar7hn`s
zeKAcRJ(N#R4xOw$dd%8^5aN4ToS*(L3hrJgJxge5l;}+UG@hUIMTThfS
z^^u#C0fWt#Tw84ws6!23y*>xW>N~VV*3&GB8tV6i=aZtqgEX4Fi9yqh&7VO6f+egv
zNTKvyI*n%Vo&mqCf^R@hej<=)^1T%fxMt2d7n|dYKLTk&;4BEv;v)?%*XnY7}3#XX{dblUNLWX>gbC^gWdgS
z-mRa%&iHo{O_#c@e|Ml8?w8OCRdRE8K&C;7`9QPtP`LVHTR^KJvR23I^F03vBsOyw
z=M{zVq(5=wB`fWaCjAZOoRG_8cO%m~QRTSzr#d>_QDR-aZtv^ys-qlGW929PS8BOP7rGRyj{|VY-BBvyQ!`
zF06v}ToR!;-!m|6v{aeq94KCuU=$p}`@Y?Mj;c!Mb?D0tgaiNyVq-=nH<{Dd*O%WB
z9fRc8kNrHJU$u$$pKF!(NnY9)BN)|7#N<~xuLfxJ##t2E`sm1{mk>TWPS%g1&7(Ne
zZ1iW8S4*;49Yd=I5_Jp0iOwrD2ePpTLIpBR;>Da!otZQL6t2WUgqs+dlB1bffULF|
zng0rTKKWPIU0Cc&|0@jFm-l-%o6U&ar2$@V^%^WwC
zaP;Rox1pW&mzI?+t;+-wPDQhhqgjc>Ig?IhVbRmD
z<$Ol>9`-CPHlW|?9><)PVwMAHc~evHMGG`;3St9C7i8F}RWyKMLmlt=h%4%j{ETMa
zk-DEw5&SoegGm?$h+C9pn$VI7pS}Lrm#hPbbL7^7#2(mdCCiSM&g0*2acB~Z7L~?r!wPbDGsyUnLj~3-E%TNcSSrkOHluiL$v6N
zAC+tA|5|(q_z<3?*#@n%Q(k<&xuK~uCvjui#8-&nM70UnXd~jlD&DtbDFUNAw&qore4aoUuINW&_|N$;)AOE?q3)=B1_W@_JERx^r!5)7&Ijn(5e#pV7D#
zw$J5RTWZWs5=wVE#rGwy=AD+Z3Fkc0rtvqDSj*;{Z6a6!rWZ}mCZ+cebD9(9V3G{n
zj@j=UXm~uW1FCHh;oo)0w_IKl@<^Ra#Lk5C1pAnuzTT+RZ#bJO$g3#X3|*?FxRWQj
z4Qx^?8{zu%w4n2f?uL;5WRE$NwGVFks{0BPuzmqF((YBjx1tH3O>JKSeS**=UW*;y
zSpAp$fnPc8f=rPFik~9@-7D_=W>_!>RsK?T|IInRr>;RwM5I+K0{r~DesJ1q2n4P$#WUUQ<^;x0)v(w{3CXM&Z(E7z=`iKdzHl{`?OJ`ppEO&(o9x)tCO3PuebnY8
zU4i%fgC(!{i5mcdM=lwgQM$qG*7yRxOoE}7)XSAwNeoBxWMrBk&&!DXn2@`NRB`7y
zr9ZHdvUZ)h(B4#$kL8y&#vYuX)VlB)ECA`eFcQ*AI=1+eNa$KfuK4XFHRrx0C1KmC
z5{RrWNPRU{SzfIx10p5JtOp-gtzy%3r@}ht{PR!9_*?-{E
zFns|)UI!puq-TQ3+5fY9t&yiP)+!r-O+-wFEbF}g-t#t}bg!GO-t){IBRJGYSKkAeaa8d}oYNmNW=zutq(1f>Yg+$VQm5X-46d=qQ8@xI3+?sQ(VTie8
z6*k;((nPoLDLZn`IpdjOZro3)0u_c%=(#4$?_!1OlHwVWhFc9QYE+Obms|o7nkj?aqo$Xy$lPkjmr}+jh)==k*|PBdcq8S5{XTE
zKH09b^LrN4Zuvm*oY7PUm!mQEK$j1Pw&+gG=~MxDMmkfsVc^S)^d?Dg@W9;oI{
zs5+qP_R*MuCc`}6_f+L7RW2B$w2RPI;K=d;N5(J{X5U@3;A%AIHq+h!Z((m{7Rqd-
zwPXQ;z7e*QmT7d7s{R>GOX_f6M_
z;^REe#D6XWt;+eg19Z=`*meRac>oNk;|zMLb^|1R9Y%7zD%)DqG2PD$CP^J>=HI_V
z`mCnQT30!xzw9>GaX8_j
zV9Cf~pBbnboYz4aqq!K7y~vnxvR_x*^7!23Z%Nq)Z6qpT4&>5Yr~TP;LV2yBt`uUC
z8l0muo_B?_gDNCQm1Kg;fL*BK$c?@F*V@3qJV?r11)Mo@mAJkP);WrTZ{_etlr>Y_UT6ZHDi|)#%kR$2m;C(X985}I
z>}`AKbbXEx%S976mI{)TsS+n|n;_XxM-}25r?Mu9pf~O5)`SeT-?pYK)@EnLlQrXf
zOak=)cN9@Bk9R7&_Sjc-zAI@c7abUwZ8tuffC$5%s-EL`wyElRFq|}LDh=fXm-|0W
zvgMka>XYJG1UFK8-Hw*&7d&X@SyFEDFWNO`r-m#wV@^Ky~Yk*p{%fx+zu8y(N&o)g?%|tDlXV#?g$XZ$i
zqk6~3vc)X7pvG%uW_DL8_Dej5_vfN7*)RV|3Y{s
zpaIhLX3?twR`NVP*1=>F9RoU>Qv
zoVne?w{`-dGM)bq?Pz1mt$v@AndFHG!zB3hCT=jwbo1+7ER*=e_m8&L9H6BLs}C`R
za7x`Q2H`?mPbyy*WwsWycYDvjs^^Y2;Rd1v1qXztls0%C!Ogg!_q_OKSlJ6(U{T2`
z=(l5)T~A1}B8zowlNNX8NV|+TJgYa~e63r;bh8KJ3YKE^^H3>=s-4*GJl@S;oH;1y
zoI+aj0o(*?7R>pAfJ;Wtn&4MyJ)caw9hakY^6&W*l;$POM2NJWPXjGSf^U^S_lp4>
z?7&@K#VT)WIKr)5jUY9rYrFFk{P*ww^s)lnXc&)cAv*a|kDhY}R7vgGrk>|PoFmVt
z&>k%8t(OfC_oU20Ld%>ocxnJL5`rwJjQga!BI5^qb9H7PMn
zSZ`ow7`!`~9~<5>3A!1vNedut?j0pAHA?T=hY&Umm}==Vo;LGU+eqwYigx)zV4d^2
z7moA%H#``(?wkZLw@lpez|1T0={8fIOwp!I#(HKyUX{PvVNUa}i?c-sEb5Gl0jmnZ
zGz!Xy&M`Wu?e&D{D9u4`Ac~Exe5B*si?wJz(0QDl5GF&|kNT<9tcmZF1=kwzO=p2U8}Nn@bDD(ssY%H^EtAXOqtMJXRExR6cP4A
z33x%Ux@Uq0x~quygp>BA=qph&LI(kOO!rc$Cdmy(2{?P^Tu&)-^4xcm{IgvR?Am7r
zr@9}9CX1wd4Pf*d-F82gEdBbCR7g@8mH}9rZUQ`mSk+H;qY@`FQ(lKiw
z50?h_;5z%^24>3T-#8P23blY?PWl;oPSEo_qm1}MQficx17mI>VFzzZd+y^A=<4?z
zAF~j2=Qsg%ZZrI?n@vwapr5wa=z0_~)jdm(eGZa0tCQ3M4IXMMvKfZMUEHyBl=F8*
z%%+>_=~PpjHFh-QbX2=X=ID43dIHs{w#`pV#f6aYq_bIBjStn%EOLU?;~t)w$y5##
zt(%yMMhK2Ut?{S3QqLJs&ahz*p;8)0E1s1eALgtV7x@^lO;NaK>h*)&oDgB@mG7Hg
zPFPu~4=7{y0PZ~B_=a@o*{X9dzJD^Yn-7$vDiD0lepO?0S%6ru*6eDd+}>G~8)3#8
zD6dJjkqe>`v)@pqHNhCZIPmGJs(R1q?&tXfn`?%^Mp@as9!{Wm_(K!Vlp5Z2A2F5k?kQ9huHOeN9vLkZurs{74rT>$q(Cbw2L
zRtFiAQ#t%3HWGW!-XC0wsvY<6;qzezK%B)J=Zp&JrDpZ=jzr&Rs)on)P-)
zv${|s0%^Go=4evd^>z729C9drPfCnqHz?Vr&2iehYMb#ubw0;Z?SL)a>m9yhPJ$C4
zxnkTm$*pv`g0K$Nn~8Yt4F(XWL46fyC!6RG#cIKwqN_>m~Y>G=YN+`U(twJ
z189%%qKYh+qQAO(?F$_>TCUh^5R2R11ABV>e(yOR6Stx!ES|=qeA;Nt9E*N!op1E(
z#Pvu||3%h<{B2twMfcCFD2J=uokAb=HdqSc5@94~yE2dofR}C|S6Q0E?8GDx7&0o7
zGnPAZu66bObrry>;B(-^rl!QpU|6h&tU2eJ*eVMkb%m1qjED^a-O+xK?6IxA{o1lf
zS*D=Pg7Yn4GEK9jf=1ol;E~)%vHBsXEXL?~c6&HsxuJ@Hye9
zkYudPnB1nJQ8Qx!z1P_n5I`f7k~H;9>YAh;Kc5(|xVd8cLFZAi@oxq)*uc(ta?zp4NtwXwn8#V5OH|l#or0
zj+4ug)<;@nhf^JT`d8OIVQQR&$Rr*sM!KJ>GN7+6H`!h^0T-*2HS;RD?V5R`Ib67D
zO|lcnGwwE2Wtm?#+N@>zxODeuj^@cAbe!{g@MauLI$d8QW3S{pnq$B50M?&^v{qlc
zy!8viMhBGr@0KrF!z699o}*yzcnW2
z3uaSrU%yt{t)tsbU8K7KEXtNGb3zHpiqM$%N;~j$oDZi!04eN@G?bB?B*vRGE=JjY
zhBS|KES&oXLj1!{j?cZ&6jocF+w9=h^%TJkI`bwdt5%ND1xfz5RSh@>ILF`XISUY7
zv%2UVe$LFVGAY@;{lk5`Db0J{E(+o3CvkXJZ0xAii5F^In1=3W62y$nk}Vr8YRmEfxGa)?W?>v5xtY^KvI^zRa@y9sr*_Bu
z786oqDXnGvWwK%!;dtB7dAiug_5xezWfE#bt-2JXC1=`uXBd#${z{^IywnBv$kakd
zmt=}5&0d7NLCyt@UXz5!vH9OIn9b7IscCiTN5@GBS6I-aVUGLAyn+fM`=kVI2u`>&
z7y$HAhfC68^Nt;vp(J;X*kW0eYyQcudYTz!>u7Uyfst=WfST>X&*X8V0ow&*M2k)j
zK?k&iS+_eQJ2oKZe#;GF@w5H4xbViSAnRx+NVh}^*R
zlt{RF=FxX69EDEaCA-GDa$?ALtm*-7mAT<&Q}%{)PRO2OgU)XGoCd<04YmFzCJ#&{
zn9bifP4w76TeDkjPRL%ydq0zz;6RB(xaadd;=1EV5LcZt2zda5GWlwwXs}f5
zXib)`4uIV%t>oX7+-7&r(acmgnN$vWGi*Lub+9V5+;g9qZxEsbiCQLF?nt==p=16^
zC;EGWvWAlOqiBp`n*x|n^n|j-?#ZR3zxY#s|MWtqi0a3CIFfTSC+1-JIm^l1S8Q4E
z1OiD|?HT^eg^w{WWKS&pG!%gDoUPR;TmABDXS@i>yJ?jx`@XDtEY$Cy=K=Lp1DXEk
zCLL}E-E~>MvgNc*%|Kn(ZHI{Q0chKi@1e4d(z*d$B0WD5d+Ap_=M)=-AWm$P4Y-Tu
zv3*>a8%&aC*qlmzg9Jgcn{%wRi)IOF9ml$$)*Nh-m{`~`E~DX!14r}N-JufkMKH2&
zchNU+gTQ8nJ9>rR^LGCw={K&NhX-{g$~AiKhLSDeHoUDW!Pa#E9;M^F#)XC1y=wFq$
z-*SeDq@tgGG&(amt6~>lOk7C1%E=)a8sKE*eZU0I84}RWdz^nL&B^4+FFdPD;rO%h
z)Z-6%y3bKU%^4sa?+BhCzhH@5;2X;j@-JA&Viw;E(l#kUzKxtK{Y(|RIfAdunbXO8
zm`0GdMT?#zko`2JK4Rs{$%3AK9JY1W|M~BIp2uKGX|^wt2S&DG6&)`C-vp4)
z(`G9wQXG1!&Y9OF?98OG{+?N5u{|}4HQct(r06j`db;0j1VolM)uAS&mWRF}`MmHqjn98aRcZ|d7Vs$I@dIPpd6$*JFb_nAy
zcc*hQ+46>c%s?l1{SkDEcM=up+u1leGgH_E13c@9DU7(9LwG9kn5!d@SzLiwCq*Z=
z7i&-U1{GEicXa4U^(1iCe*oapk4)?Ww^Ve>B)E`yoTQ?jAUCYi=jNsYHL!I4emI=!
z5apqCu%Nvv`LVS^!G1oKD^&DP*ihS(o4pDQsz1#Ub&h2MwQ>o$&7jV>&~b|C
zh{-?;I5lTh#RD>#7|&LEq5(!=it~7G)7*63I4m&nm9HpWv4Bmh2(yU}a_g!U!q_;E
zJ^vG|yNg7-!nCJu5%FRvhZK|^siEeg`0lPnKtIyT8-gtr6WS>U(wQApIk@1=IYPxs
zrX$b()f~+8c%*0uWV@S<)>p?$$04;pLkLxwmw74pJ>FBr8Ja(;Wfk{UIwv&UkIQG^
zR2FGI-c#bj*>Jt{NA03)b*BNX9=S8#JYi^VjROaP|NDRbm;ci_3P%&K3nnFJ
zLMr@)E1o^BGhJB2K(L6E42^Kd4=CxWC@@VBDine#p=5H-oT8DBuW2A%K7H3cOFGZ6GRIWXv2kI=E?J+Z%}ZQWfV%i-c9Wbh7)kzHX`&AjIvdW7a2
zFY?)$V+fbO(YOz>fS<&^VUuwUqe6pD$E?@MhC
z1kR{Cw;XC^&P4Go?Y1_NnoJO$5n5@jfaR*fKE!p+ERTr0OE>t>E*P!sy>T+XpWZga
zOK@&x=SJOLAO|gO7?WtZlPLaz^9^1VN_cSP49?bWs}D0-QnK~8k&YHrd|b9!;^b6!
zU?xf8ec!Ia4kZ^bI!|@j9B)pLtGFW*y2E;&<2KXvJ$h_Zg6F$^Ikb{ik?L1~Q+Van
zM`0DzReawAdeVTxfGY$e}n(P
zEf20D$~`Tsp5>A>=hXIZV-@Mv11?U+(>*(xz`ZU9Q)xAU4MFGUN#MJ%M?HCunKMLN
zX@ccqH`7RRq(ZZnc{E?Pz5Y!kJY8#_kHd(7MVnCP>iFFsmdDH$EE@KHb4cOX8
zcqxkq-Nq(3!>(Z)72U7J@#iir9
z;Vj@j59buuoA?QnY6~ym+>gJNfmpMb{?!(bB>P`w#mLhKv;U19Gt~Rru+B7DjpV>;>o7#hCtx>=^@8&-k
zWyFMF=q_!sfp1}zN5yhe7iP+*o`;ZAfpB~&IzRc*WWM+c1X{l@VQz@BL7IQbN2&!`
zf30l<#Wfq+@HKYGd1IZW_-7dg|A!K_2xl^xxwsuq@!1sHd$nZ^89ggoAPH@QRfnR1YGgfC)~ow7
z!-Hd+(fX0%mrPw5KyKr>lvjk|uUGHd*f^k*y5-HyZf`()?W#KG4G!Pvd?vK9j{)cf
ziw;-f){Vs#;I(t9p%0i-WMe=TLGDM`!
zAdBr6&?W;d7X4z9lOkjO#-B{RyM20*E{w)96>w4OXjXo-wI&G1lUNbjsh-#*mH*ut
zb$en0%|B*vaP+8i6F&N^e-P&m*aS|op8nH5`98L%{W3W!GXp#Hct%zH`+Mfhd*+6A
zj*7uJdmshF8dN(T^*D-aB5V8Kay|Tw4eC0l+_$Rpx`~1>XMAcbyKrgBsh
znY7)HJCFHDoAf2D{)!Y9K=*%k3f)KIIXteV6}=yfO4E_`wn&J_;#N9C!a1ID=~sC+
z&i)nen7)d5-B*cXRUe%*FBJb$Q(e++wQIgHL=DE1}^X5@J`kZ|XngXauuQBlUMZF86S
z_zQv~HmeoWoG)z)UyY&zT5T3LR;Z||-j<1Y-sC^Rvy)`6LopVOx7Sq_E=mrD9P)Py`
zVD-nnM%WgWbj;pFt!8uG5-gRvSHPcxFft1?XG~yy#8aXpG92aZV|N;vAca+fBhQw>
zJXN-ydo?1B{Bo_nL4KZs)1+r!;PxCSfI7!izIWt4|GLP~BJJTBYwi7G);eA)+{0{r
zcnmeK@t-uaEjQkP8TgsZ^$EJ&c%a+_WxB!bQqFXgThs!qh<%pcq$GCh91!n$<3m@_
zK50?2J=n2^#g@O81gY9o#KfBiYtY8ok)G3xshZJL_l!9vHT!suG~iZ1l^!BF5c#68
z*AxGo?3qjP2EY^GPGpL;?jD_aCo|>hDg_Daq1+{2Y)dU()9ArtPv`?DokCAaWagzQ
zvexnF1f*fV%kSMV)(#LD`R*}%W);+S_Q)tA$zdu0l
z`$j@#{}HQ^6EJYrm(^i^NWSmuh{viHT*xDV9Gn|FAw2#Lin#CyvoHj8LvF_=gpMj5
znU4konZ~{)(_D$7Uo)AW;#MJg5I|nVDwF+c!%P_#fFvnn{0BPf;bP)*@tJ*20CdsXGkCFFk
zj)Z*%VY{&;>*Lbm-_SJdB;PaAOG}^Xfpp|iLrf$Rg}JHKk5cim6s}`(YfK9(C}8H_
z(uwYZw!0)TZ9aT)%Mv}R;4XKoQih;{^P)4U=GZFw(Qavf1iWAk0Om}dD{-i*iH
zo=tqkfth3AEyQxETbITe4~00!2ITqQOPoODOv5r&K
zc8$sFx)*tlqocTHU%HnpWj{A%M;9_3=>^?U;}5{h``z$d+N`2|s!>15?mtrJeU&y9
z@YVH#MCc1ty9Bx1D$8mLf^rWDfG8v^#nGosSh<
zT%?&36;MMHD^4L|gV@b*lJ+5K)YjO917!CGqrAtaD5Q*L~kTpF4Ht7d$uuV}#tA_snVj
zA(U#(IhG4(#?Rw^PF_#fw|L!B<^f5!oxMEE#=S<)`(9A`5wkx8=4Fcl&Gz|bQ|Qjs
zTWonxAYx(tIq-0rkP*-gl8Y7e501;Dq|rR}boV*054Ot=*J{VRN6O16KB5-UNaJ26
zli+`^u`XmWjhe9JX8g&RT1(NwwrtFEQGQinMa~;kV@o9xoWnsz@!!8!X=K?Jx$^YtBMqAtFmE0*Yr5n9<
z>Bqc=H5%9~I#NBz%jM~(k3gb~{VU{@)Ha89g-m2iFqqI#ThyCTre|+!MOsM$Z6ZF$
zLvYQ7gGc9Bwp$+8B!y1$7`j-b1Sv@A#MLms(wM5^V9r55&(@IF=d*X(_Q*Zws|
znrtP|oy%pxg(UVK68QwS1ftqiB<0iIlFqy|U+iMPCHx!|gP1cO)w4D{_vfVBe0UL`
z-Xd0W&TRVqmkru+MWKcvE&)Bq{TB_+G;+RduQ}F3@%d}IoY_Th=Gy5iYq+_PQ2AeE
z6bz%2+lufTZ@+Wq%o_YMTJrc`ue8f*)*UQ}s#*n8n1bki>Uz1kXWr`*#xorzlB`Ir
zLG*#!j7L7nx!fdO8}H|D+EU2~l^G)XCC92M4Q_#b(ndnUP8VMJ=i@|f<$``xG5xge
z3-3X%FXGzV9l+vjA88YZk96v38Pd3
zhqSt2L(8tN<6ZHjw@(7m;8&ME=&%ZO!gD>^VlG0GJl>HqD0fNr{)?ngdcx=oMA?ES!`DV($pBo*e)+b)L+UB(-z5iYy
z?N?4_!Ax3(p-CLQNE`fh*(NUtEq20g2$7oA{3Mgyyv&bj)5U(tw~tPgGP4m!Uh2k|
zN;1Z+JA}KPJTnoQuqYKDB`q8NFSiBP_$)Yu|2vyv-rU~hoY`2*N5|J9_sdHBDtHE<
zYup9qXSFw3jXA(*1QOXR=GTgKE{6iLSCl-P69hq^>vOy
z#ewa9S5A5e)&a;Aa6YDXGT|<2V#4Jw0T%?`(N8z_RCJrR9mi~Dk;(5^z`gDUT-CH2
zFCD|Ir~mWG1pXpYsk|qX;{f
z7Ajg5m7u{Fw2&maEu(|`z;)h+XFE*lX#0U_ZA7fMe7SNlONA^*`m(q{n-7_@j^i$pK>KgyX(P&P2(z;cqK4Xlz
zD~C%C2<2uZWtC*HM9w=$hr_PNg+s0%Gj>!S!_6=jK6zn%x8!Cgm1c$uhQOfVSnYie
z_&_48B3a`Oy7<(~;>(XE`31X>8&fi$?|bK1?tKMBQST`0X(y1+CfCcqmgXg5KkZ5=
z^1-Ou#DuQJ7^#S-pEn7>Ly|dZ?#f-or$`g7-TiS**KMy6GlQw6PhXsjn+eE^wEdiGEGSC6<;0-Tu5ptpY
zP_A?!=<-NLR*0^(NY+!4Z<^=ZcqSHjSZ`E(Rn^1wWq@0TY>i9qUy+(B6riqj!|+43
z#|TMQ@d0?c!5g!!bPxcC)h5Dyq~1B(efXBni(Mn}gqq&wYLy+%8CO>wB`X`_3js>|
zR@|0#+sAvDQ%I*7S|$>8Ii5OKxV(L~3o&u>7EDJGoY(
zp?Nh}v0{&m0Exy-BiqF`Opsa^%KwD3tH{L
z)twrHbro=qB@*EC2N;u(MU|XQdQ4aw@Vm#vIqx~^wY8q#uErfYT$_n)z#skLXYUuo
zcG49l&TDE#w)HTT!4*nnKYOEpuRb>P)66lDO9G#6p0e7*nGJLD3IAWN{w&LqE$0!&
z0Mh*alGai?Bz5y2j`X>a&;vm8C}mY;W#)}=KgVouHXs1{5cxw6UK%xGDN0vB>ZgGc
zqjcoQ?hYZ;!N9m;s9|-6tC9t-BKg=?l@e0!k3|Q?ng4OtdY*?-)L-GkXwV&NXTP=2
zxQcc4^^8dQDr|Ky;=h8#G*=IZb117$ISHiS3e@Z4?|Lu*5r6@y`Ic6scp~{ZgC2_E
zW)H}1QdM_ACT;PKboEjR~n=oevQ0Mnc8>5J4?>{serT)moif7?os#20+8`}%9&Q$N8^l<+s^_K9-2D2Wj~mA(SvkNxASj1*^I
z?U%yL?s>?_+z@1W4rskfPr_{t2o=>wSX|9S`M!tXU7J)RRhfe7r`laBdADR@Lyk(|Xx8nJuOyRWl_StHk=
zq*>ifR?fIh&Qf~_nLD(<@t2-u9O!Eaz?sxp&1@UcfgfH>DOX^Fs63*H3
z>+`d01E3`$H!Da;%|H^^nQoFa0u;)()dl`|h(zIwBYq5awsdL@%rD)Dp567nS^H#~
zqKke%<5S+{jJg|fDQT?=uk!dxCzUq%oTulKwOfFkA}u=r07{Z)JwsV#4yn!H$5
zENj)|j{Oos@{1K&{_w)*)lk=AO2M|7x{k90eKvYgwzxWX5ZE|@jTKN{W3COxa2mG2Q9+l^7^&OB8rt_PRLjJ3R
zbi;3
zDCiAfY3Po0gRFcN+v>OjxYp~dO#-4{$MR2<^XaGrcVr+QAj82T-~GFE0FRyJTTgiK
zNOwyuFOK}1qY~Kb9C(`Qh+aHs?doj$Jxb*Fg?%k&UqB`r9ETG=X*p)ZPNWKXQYQq$
z!D^%T_kEw|zbX%kiSPVpwfYjAd0m`-ARM5hLZ|rX?%9#eGxax=loYmkTGRR)U6|NJ
zSS19y%`63N_w)G-sljXOcPELG^>+|INzOMua$sI3E?{rpLo~xzGwbic-o5wo@Yq@s
zfog4WyfG8%dEYReJQPhLzK3#A?;@>7>JBDh@bXrMRCOr)`iLcW6Hg3c8xI}P@d_Ab
zyI>3%;_58vop*Qr#J+-1P<^!;_!Uc%E4{5)@7A#-ay~1xe_vlO@U!?R%qGP#coP?o
z?PY*Kpf$v~e`7LN>Q-DERd>6xaWV&p
zotL))V0T>`<|QCCqn#jje|2>iR0$m!?L
zI%Ii-#6p3xC5jj_sw8iofLwdv=>~RkxP3$KmnFGuj;H6Aj%kZqHFTB}Os$f4d^x(HOge}DwV`(3s~z)zK4g4mt7~We1`+8pzT@crAi)%&+^0CcQp6xHwEH;`Ucqm>
zyY>66g3C70Ym@$d%Tag?3b^(BRt*n;>c_H%citP9y1#Igb9TznwX%9scGS~9jFcw+
zOvN%Jk|(B|8J|3}I~~ftH~wWP|CX;43jHt$^~hm7-Z#+S27Eqy||K9mE(cF6Msxn>CDSZ#1?y9IT?0XTum>4IXrwZ@R?*2p4$g$adcb9w&
zBqfF5`vU>4E
z@;@GnDFsSZuS?O4F;aIXxfr6^LxRr%fBvj)f_cn(8qFq2eg%MsicX$aK*<{AT~)?!
zzPPlqYbMiIPcANe;oZ5rmA_-xN|KW4D2FEf6BobQ#fh#m${>K^r>%u#-#?EuVtDjr
zS$pnhaZ&Jq6m9-Zfy`|o`ZqT|0O#*%29fz{NLHCs>MOJR(dT@I3i^}c_~+R0mbhHL
zTF9;xX){cBf?+j>Gk?nu`AYe+%79L3NB2A$l(XRUe=ON+)2`6G537{>FiLVNvOq3}
zEPXLG1>Z>$V(*#Igz9ebESK`9ZM9mUW>!T1Qx)RRquW?@gt35qxmfjRMyb;-_UCxm
zamR(p3*Jhb4`l!|4G>suXxRYnKR-uq&)<3dQ>`)fwfCy6sz(}|lo%W{Vsc=%A6D6q
zXI@Vvbk7>Op2=~+Im|R6u`Y4VcHaC6!WE2ZbZPhWO-Iuu-wcJUx(Ral&XA-bN~an%?Z;8h!4wO5G%_>4~$lIDYgicTnE)M#*vW$%NTv1`))
z!5sO_F62yN4^WbR^hyRPyfvn@3-*MZRz}^*an*Quz0OeNTDeqFNR;RISp0xf+M02S
zm;<}8GcZS9UqR0^`^xd$LS_7PZ25yWx_a~*kFI0>>0afvQhqxYO+44h^iwft^=T(V
z1NPuIuQiqpzU}cD_F~?Zp8gUg2)$#>LL|)`!HN&w*EooGbL;{?{gh_|o%t%sc{d;b
zR>C~p@~;!Tb#Jt!ik|WM+J@(Ovx)n<1#?V5bXE;}aV2Rp2%)>pM_9p|0&jPPk|yB7
z&k)H)8sLwAl#{?~$>hf8dR^u*;(iGjqA7Hcu{##nTDob^uoWypatH87oi)OgGVi`V`HV6O)k|K|Tw!SHuL)URLgCi_a~6EPpYIEC
zZjv*9LYkS;xKKF|!GIAZf_ridt6fy}Lr-*wogJyWY`J`8RkG)y2B>-*$~|N~&R{01
z-~ILHG~eDmVAUTXHm?VM3eNfZ_p~_??<#>X+u@R$9a0S;X5|M{L=ZIZO!&}R31qA;
z?vrba?Y~`B(l|=!uLxk-!bYEc#$S^C{z|@YRk-CQwAK$26?2V?9FKy``@h2|9r=*gu1Lf{<{n7FDb;a@z8qHOWdo{|)?qPAg)9kPNJ0F02?pr_%VC1Pz
ze(ai%j#ZFj$kXa?;QrT_Pa2Pvlw}Dkb+Y=AQqR}nD$ET+VAv+r005j_z5?rNfD4X$pQuHAh%
zDe}|}yE`*GU{;)M%sKp1)3=)lWG?+bj8sE$$UN4v8;w27h>8W*x5Yg@;k8voiR~5h
z2CDofcM0yS?eEqmT{He*U)6pe^Q)xop?a57*@GL56L@C{nN~m2`_4!Xc)dd0#^p`@ef@~mv%oY3u@l9y@p!8rmX7u8k
zh+TzKqtrx-rlQ$h&s_))?SmqxTSH`bkp-H1vR<3&={M6AL~==}2@~l8RTQZ8F-ygl
zWABHw2m0+-65Ul6+8M+w+rO%~4!b?%?&OFUE!`uyku{231OU}V(Xb`0VY_Ee
zgp9h{-<|*Y{h#087gCA4u>F>s-fLP274ZZB5=~iGWJ`BkC-ySPwdGxl2OsOoE86ck
zP3(E0(Hp6@ZX_-MJ8leY3{&9}L#~`sJHm){<{)6ISjmk~EKCCK+zAPIEg>{B+=c!E
zj{i^+BEBIYGLJnx>L7jppWPr8*WsAx!SCgW0M}+hZi`(8WjKI4N+`BFqTD-{q?s{+
z{P*`ox(ar;)561q`10wC-LhmamS;a~8NA>>H5IYlC>5Ob9ak
zDm-oW?&OXv@D)E_1oifmo;`AW0_nMeDeFvk*RC8X^j(-~U*FZsbiUx)-FX?A`p}Ae
zh!nx6{`*W=W>&ycPxEJU-BP8Jf5fGtxd}P9`4di{c~bwN*!f=X%t$*|4D(7-&2b}j
zMNYV$7j~e{qKV9YzFO44ok8kjsro=W@+6aaw1Ep^{^&(kwTt1hYtJc-c_cpGf@q)E
zd$tN};o%XaU0x*(?CiVi>#VCi2=S|z=8B5@{HzPSgePQ%V*{lIZTFwX`f-8vx@aY0*
zECg-X%;-gE297(m9y4xLHEeh@PVP~_5GC#!vhlcPfeq^6y1o$ZnL)WbhD;5xsHa%F
zuV<2VH;^~<$L;U#h&)?O?h+
z_zJX?ftB6xk-<`6zugzZCM`Hrb`@G?6AW2O-1Jzx&z11>Jh*nk(OdRAbKVRosu1=K8SN|qIr`hb!1eGyUNR1Yfp>(*9NHC#
z|DKmWzn+hM1>~6l{;E0&@eY@*eUF&rJ
z=i~PQ24CKaK6YMj;<=ZStIaDEa*QX#;}pM$uBK3qi)9x8U+4Xh@>qAWz^a{?d6*P(
z_n-UsfQ$6LnOw&t6My0SPnJZi7Z-O1cYl?_9RUB$fGS7=WqoKVZMM|Lq5V%K!)PdU
zu7sf@S5btE`}VXy<_?P0nXf%!OkzAYxgh7t5*vH7e*_{I!Q9o;t{tD5QTl~Ym9c5u
z9UeCrz27_k7XvNW0SNwfI0_9tH_-k(KQnKhhtQuOu%hSx+Vx@$mUIyMOi5r!z%60B
zl_h_k|Ef6SD`p@Q!rH_kW0|n%X|hV0HDO%nqMLcAW-eT|&fv<7Zbfdn-yi6B>B6p{&_XZM2N3TUqXYdc!jK4{ElBqIBannDT(?9S{&w#S66;)Q>#t3b@I=T0*NmaAG5Xm@w@5kC@@
zKP>Q$oVvoNy9G0T{+6TpJEnPZtH3J?F3RZCJAPg8j*adr*86Ubl{D`=Gu>6_dAIn%
zAaFzN(F9orcg@RC5HbV6>*=37#$OZ)s$HPFP*@wT+AZfk=n^3mt#@+Tk=`!~GX?lJ
z!ccT<9^_KhlN^`e$_X|T^5bs?TjJ6ASY;CRRcs%09pF!2p!_nbKk51`X*V(zC++<+
z0_9in??yj@u)WT<3JeGNFiAw9$WM}>aN1qieF#^$>o`@OTWE%35YFD}fL345o9P=`
z_N%($An|7PIW~VJ8Rz%@c^>~><;S=iua9C1)xkqPYaTD`^Zak{kc~WEbb3eyfrb=i
za!&qvm08Gr1YH*r=Bwp(0Cb{Z#x5lJxIJ>txIdi2@ZfL;b}X`TEaDoGaB)8~p+g~M
zz`LG&*t;4=#6=)!u=mUIA+AAuB_k%h5QRfLS5!bL|@Ej~M}ZyDahFfBykqpvxqeEVKFBT2w_(
z;bDgJy391yYMpPRGH_)W40`X*+;tN*TgHLLxXxUglknuZlh#md!dE)Ps5{9RCVfm<
zKJh7$v`>2g?nzY0R<7C1Y?S%=x>P_&XAy7Tf!iG&VNUVtk{D{uysTb-moO~gPir}e
z%!(NqyVp%rcF!DP1=)P)qgnInDWjeNkM;yFnY*O^33Vb7EIX56_cf!a<_D~=ZU&$W
zvIH!;n}|h)kC}t{{xt>3nHP3bcLEy2NkGAKk8sVd>xFcKSCYV_m-R!ZU3_%Tc>qo+
zwv;aJ!uEgP2O}froclHE_FY+A$*D!ekjW2
z=(EG1&wmV{c6N5hOQ-xOJz<$|kD~$2Dtyyka^LYxufsQS>>BMapsM@K>05T&wf
zU8WdH6?t%%A%EQFj9iOaFLC!FqMrVtIG2c4BFpw1N!LY-YalEpd^8s9Q0s$;7+ZND
zUENg=Hj&R4z_!i>tnCUQW_ZP$k&2}K>*k}%_(E6CWuPpUIrlSfHw!KCjPgur`{Tmm
z6YTkK({a=IZV>dtN1Zq6PUGu8pXZT><~u+;-7054%tf5)4vDyQR40$q7?()WlPs^O
zAPeexK9WWBr3W_et>Vs5~BZAQ*@Kacah
zYp$*`%RZl{itw({d^SJj00rb%^)i63%M^sRC&(iBMaf37p1436=tUmHcwhz
zF95TKA_2t5DOay~!oS~H0zcgWf=H}v9NTS}Qv%)E9Z=&II)UV{3lDN#Y3~j3e5`O^
zZFi^oTFNWYV&go61bLV3bwAwkr!p#+B$WN44&>EoI*>Du;K4kD9R|el&qo$K?mKTf
zcn@;dxZ>yP{P$W(t+4yrA#*0l+ZT0ayX%`80qCMJHDB0ZEYJmw)TAt4VosPwj0tnk
zq&R80dah#pY_9oFUwu!f&e1?AN!ay3i>ra7+F|?jcRe#(Pnkt|HzF;dx0Sr_F9??P
zjmBXcVY}>Cj+z)%u_e#-Os-pisUG%=83w3}-DUO6l^fs6Y&UBFu;4Q_OxbIg4UM;ZRJN5^r6g}Ll>bSm}yJ4Y+tE9JE?|T%DvF~tqb~jx6I(5U6-L=(!op0hwo!2n(A2dLj!vBK$qLc7n^oAs%#i4(aeJ|@
zD}ki8od0T%zf{lbly_)|%~j%`R@Uuw(tGhU1i^heTt%xuiD`&oW7>CKfZp}`4Q)@B
z%sbLog?$6Ctp9Pot0LYVN3)D)gsz9g_~AM|_#PCcHN`;d(^xZ8-9wug76
zQ@af(LGn
zG9<|E>UX9(0HSNHtQ|=UjGGuIWo}l)2}eba)dFm(qcs)WyAhJn?iC#?$?>bIWtpDG
zNUj)};{rk&Q>R@9;)J^#%GXu{d`Tn|`IStT84z^dTc)532-@L7d
z?ilbPEFtFdN`|k)_Qj(NA0U5TQZ>C{NU^B&ES#euJQi}n?kLpw>zD6#_)o0FF$qAo
zwWzASnjC0i{1~>y6*zj)Oz~lrnY=98Ky#;RC2xJmMh|Xjt
z+FHnqI{GO-_++IS4J-6x4}LUjCrz@deX5;5-d(Vsr(q^uZgoOP%8lKbL5R?vAAYf}
zj213*7HtNDGB}EcpZ`(hOOC9`KHBlHJTvOzqw7m_oD;x%>NI1Dyi-Mff0Mg2S{AE1
zC=Z;*R>Ed3l!>%q+SMZT5(C+HLQR*K3<~Q|soizMhUC;kS{IQU7hxedN$1_y%R
z`+FLI+|@tq?QayKC0I9n%h(I`m9r2xR~!&>?~JIKybts4wyLVjAN0r)(iL9v%CgiD
z8#0*Ha*^qh**l*IZd#@heUNs}*r4o*-jYd@ELPT2k(o#+-~2K-0nO+LfVIZt{y6-#
zrqHhe0J{gJhak8Eo0`Jk1A$Iw1ezTrqHK)r8qbc?e*5n2vD!s@-MqkZWv_V$o=D*F
z5AXi3`DnKIgzD_GQL!}w3aA5uXvqcu=hf$V5SYK)<;b{M&68WvOCTfyY5eT40-}qB
zUU|*{<>%YO&yRNMgKz%{0mzIR->cL{0}Oe=%Feu9UVcMVjO|zrPeVMeIpx@C=dTaq
zQ!06XxHpPfKA%&5qvJ9*!h7{@K7EUMHyXRc?hHfRE3tf@rHJ;Vvo8P;Wlu=I0LP|zMAO73RG1$ABr;|>oJ`SG{4b5Sqlq{jsA692CM0%-29f?hr);Qd-vMr
z0%yVM=lQ8_iL)|Zkh`CNC#Kic8?2`uFF%*l`2|4o{At#sL&>EF}>KpA3}t7`k?e*(o!U^CIBjTHh|RL&AuXtLejj&9&b?h2)-r18Emm<84eXnt@hjIFa>WevjpE{629F6cb{^N(?G(_v#I
zo55;%zVew2Q3_}rFey5814B?rWx;86c}1rJ9@h7G$J>8*J#GC#HX#>&2hp;4qOg=riH9yHlL*|hUDNJ&%(eH#THZ&3
z`OhZHNjSZ^pCp!2^1hBR=+C3rfQ8%SpP!L_G7ax)hy8ICWBO`lfKlH!*9K)2(O}okb&DQaBz;WCva%W
z;DwK9MYxT$-T1UochqxEQl83)L}E}PXArZ?F4sUK?umZ;aHO)DS2$XSFOAJ;&SSwX
z6%GA((6NRcvOX|6ZV2V&VHY$B!G30@!?PJI<_4Lu`0H
zKI7fx(r#05e^6@RD&x^PNPPTwdEYDl8Mx?|-`o*S8^G30i8S8^_M6@LHhQ_s?y`c%?e5b*C%n$Tj^zxaLoVlMx9!r9^9cxRo%F*lsg!h8-btv&Ga(_*uA=)JR+R;qRV
zZ?SA$Obq=-3A@z|o{NKXz@a*kAVuKgDTX&3$l8m{cTu)G&J_#nfq)|ZeFc*5j2}Xy
zkh93@@cQrDUskw5jUq1fgfph_-Mz6mKYk<3bjmSvZ=dENQu&3MM>
z=A1q}+BLo+5rul{@%atbkwP=iDc2x;ct20Z9Ldx{esAByoo|HX2y3@DkJl>G3?so6
z-PiY;KGfU=(`xGzr2;$KPut%gDFI(HE;3h`cvf5h-*=>W`YHBF{Hb(Gf#t}O#-Yfa
zq>FyPg1V*Kfxwe?1MWCd{YeWA{8*bEL=ZE2x|r7G@iS-Wtjrr*9pWB(8}p8tdEH6K
z6_;veB_nXQKJKQN)!v4R+Cst7f^3yN`ta3=HxDZsW6rg1^I8aY{g|&}uIjA6t-QR(
zugS=tv5)3M+NgaWuaSb0MaR&ps+pJUuG*Uk-n%dm=Q9{$isMJ}%_^m^qaS3$r^_xz
zf{I6Ht*WP<*}ZI)iH9@Tb9%_OGv^sgo8Rk~yVxq%XRnWjfv}x1OS#>FXD14=fb^4f
zboi(cmu`$Rxc44Wt}|!~tKoLh^R$XKER8Nmws+IkcVAcyF@@l}rZOfsL1kRxR;1`8
zkuIstNr@++i~cxoFTGM0s&*qMH1VDmk-ld%yS3Oix8%I@RR-ZSf59sLtI{GYY1oa1
z$f`Q5)ZMOev->&VUbasAQm2JS^`8!wtkP!#Zh+E9g@jc7NNUzQzXv=9?=lfuyR5zn
zAeJOg{~#74#gJ}{z_wD)HJupkA#JI76&MqpeEO3KIdVD)8GEhrCkJ>cLDR6k+FZ;1
zyRAts8H^_;D*vBzP3a<~j;54Sax?jN*JRjLL0DAZY|vkWCdnrO?7Fx}-Y=RMsjm(4
zZzvkS6Bflr?W}0ULiqoo20KzgdC&k1TWGCK6~v#aS-rml;;F~)T@FH;^cmtBMD?5*aB=OFe)Z<#`?^9%FLG~%m475MbPn6_YkJSKdK;l`9#`A)&L<~FQ
zyCC_K{LU?Sq^h!iL9`XORWAixf}!gTOP@Q9R8q2`)Y*E9@Ci{sF{Sb$nVosg?BN!8
z%dfGUg}pO&7bsyC+F3vLqs4un%w0j|1iN|~j*X*fbtOurH3LxHnt&I)4X%FId%lUy
zj7f+qes13CSC*{ee3Egg)rI*@WHc1G2i?`kpHJBnDyt=3aCOkSeRUZZG8>Ex8rW0<
z|Lf#1FNbM2oS{6PxeUv&+z^_gE`_;x(A^hy5Nj^Tzf(zLeN#_-+}x;{`dc2Vi1Zo`})On|44HqUH!$Wd{%yVgW-{PMo@bf2&`f7s4X&X
zPZDL*8XsgAFIhS=4(MN(C6H!VNe2I`ibahUcq;wT%}%Wv^~*M`^e%>5rNf`Ae~LYS
zX!-#ARHOJizq@|}PL
z@e=JGOtS0IWqSZ073-SeFM{9zmAod2@sie@t;^vAIY2QS_misAX(UgutN6}~BYCqx{90~BfEDNOXgs+#`c@LL_JTx@2eP@%pWm0osT{A
z(f#9TVcpVp-X;8Ms0y90z6cx2eBg>~$*^w|WD@^g0d&h4{>XYcK-LshH<+2oJGQ@O
ze3(N2zK-`SxPSUd`xAiK{_$@702|XOg4K*m+<$|4&LN5@ePozAnWnmxEyO3lrS*N`
za#wS+S^Ifnb{z7QKq`1Gn=2ecdVkT=TY{n&a&|TAib=!xN4}vosaUD_EAAtx^wKcM
zg%F$l4inwnkC;Rh`Nze29#rY?KJR!^S{-+6RR7dZObCr+bqJF-58@0fLUcXf-F5<`=|kZWYzoAyHEat<_aoKUH1O!3@9curZc7XjNu#JSZx=G&^0ZAraDxOxImr
zRTtoE`?^&8b1p9s)u@D1982-a_lqHELT0CnWY270|IBOgt7~R>(I<4fJ7A8P7jW7_
z-sdT4CyU2rd>>AX_;zbKZ*RGO23E7TX3)xx)jriWKyuCM9PAy=MU3X>`SFmiS=J6D
z*rbd~c-6(Fs+t|&FQ1%^AO40Bcl884`9H>r3z#~Zh7aYgx}NSN9Uqtqw>1|5XIGI*
z0MN1D$p{Bldj9o=a%UX&89YM!eY0Kc&<|a)y8wgNdk|85>Ide!yZcf;-rtH)Z`FwQ
zH{Z!mIh~${*>so`kiWU<9sST=uU0PjL5bR(QUO|^8jg2CqRTa3PQpJ^rZgY=P)kYY
zh37c7JJrweLdB32SC*F-3w(FXS0@`(%6YN!WFl;)*&|`8Yo(u`hi5huy{ABY%pPonabWBM-W|Z1OU1U(65?dWCL|T!{$lF}XbB?(am=6Yw6W6a)T^USL)@0(8g_gqKh(CMPx|^Q$7c
zt39T`_h3#b=O0m=?06?=1ySLy2^sE#4z%$r;h`4>k^NW>^U@zL&PCA|vaewdvrz7+
z{k8jpsc|ImZWBc({c8Hy3`!>JtZjaBqI9KXJ_Zf!29rht&Clr;n0@`paQ*ogntj{|
zjH8WzH2AdxM^IF5%Z2r8WPCgH5L@-&v*+`m$xz9y|5R3S`cKu)ugo8&QBkj|v-g_b
zRT(HXiSZvLoNJ4tp>weXoHtgw?X5}ALy&MMaLzS$tzom#(A>QDMz^L=OO`3_QB2(^Dpfc#r*V7gF`j2OmAK#y
zlR;aYLtF=2{AQ*@RXtBj{QA^Yw*Tf8-bgKG4=I&sNzC(OAC$x7?EGNm1NdT=^-fa`Y-t4xatX%=k22;$fs|V8^4S7^o$zQEuoVe3r$dEx|ip3%M?c$+b
zrbYD6Q~OW3)YTvEiXs=^)WKn}{Y><|JYJQC`+Io+h#S_V|<2hOm>PRDR7u&%iYpz48P%kvOvv8=B;`zMRw4^Y$W$Pr5SyhIkCVhdY%OuT=!Mr>W^2gE6&
z&d435;1$Fod&^*X+g1k4HRDz6->~aQKxN%QYKdyjtLolZ168pWQ{|P>l?b*jxKR{5(C->&=lX42F1Ee
zo*B2}GpRC=SDqnPp>|)O7(vnBbx7M|0=9?Qu4TfKDJ-g_9q{L=A4Av<{@uMt3p^{HrXG
zX1Id>d!vXi(yOOB2wCMS1cAKTOJ7*lgKAwY%S4
zZ1OTQOmp6VAH{0AYIciR$&~?}@AUkYi&~+uGbp;n>c3^L7A)l904UbGQ}s9@#O5NI
z>M-pa7g!N68D>@h2XhytjI#Jv01th2x>CwAI{o2Wt|0LR>@~
ztEYaTS$W-qe1%0_9!^o^D3Y!&rW?iYUvBnxo_+wxxKf)&8=nQOfjG+!OTbfHCL9K)
zyyf0Sf>9X$+hZ1Qo8eWlWx}HQ(ih1U8kAdUb^S*SQbORMj)WW^_`l<-)5deF9@b|)
z5L3w%$fit!{(BPmIMVu12)AT4XZ2uM9?;_Y;Zr65lSc7ZT-}k7MmtUdkmt#3`a`is
z@1{1c1Mh^Gi>sO;?aPX{6#<~xS+`&U#@X=Rp<)Mf03rv~H-5oi=J?JBx_{Dq
z@9fU={CF!yycxA!j|rcv347lD11{`?(G~A#FGN;ZUHQkGf;qGv4B~*3eD2GI-wSk@
zDjp{CM=kMuFM(CpJXP1zy>{>es()_084&%3VLZ)szf-NW#C7m!^&I|gWH##!owjP5Y|%CRh~UmjHt3??76K)Owdxo>lK+YNzX5uz#)RvVazt@%l3s2
zJG_+cGn;`%3NG*R>TV{rAJpff=Cl08hZ;P&3YVNR5b+S3KF1hsS8W!i_$43YBp-=4
zb7{A#E-m!gb!5g^d`_bzbqHmfz!r3$wVK@6{s`~}wURJ`?_6d`dcO^RqR4}s18sX8iMy0B_Jei929bB?#GqgyIePULPilB
z^LyGlF3Az3irvrbdkh-S^8OYLDM+P}vilB5SWL6%xkf!Mt^sJ
zI$9$PCw;P%@3kf)e3nbDO9CU55Cbs3->X=Hr#j^ec}N!~@f{Waz|HP>Fm#Dv26is$
z#_qaL%OOAEaw>w99#s{v{X5n56oi>qH=*r*!dU>Hr*(E#bzP-y*6J=`ZWa;paIDB2
z&GeOhsb4Y-VcXwap>M1P@`S$uz3-cQ!GCzI=l1LeAnzZJQEtAE4!oP4z2$kPmtUMo
zU6rCB^LydQB|hkeQ|E-Bx^c%lTkO7_A|T!!Pg8%MAD%sU7dNY1Ao+Z*pr@ZM{(pY|
z$9{ya=3&xoe!0S9@}6^EBgVh6w)vb1XD9866MwnwDVhJ0QuPi%0xY`Qgp2OhD#9*7
zK-W{m%)7u-of(ebOa?ibihEA-j+HOo8AH+o^Q6U(v9JBt5yyu>eWIaEm;!a#%V%)o
z^SZ+d-=Rb3KAh+~%{h~TjU#MwLVg`H0ay_Dp@a(bw>ZgR8peQ@BBP>Qk3n*9OxH-h
z=JA7^cQz)G4wVR4V|_l|0L%vY;^GDCr+;RD*H$b@dOh5EuN=S^Z7%auyRjHc>qgw7
zJ35N_8FtSM!RL8aGw)=vU*b)CPXKm5p%NXW0bG+&{)?boM34
z>bT#)BT`q%?LzRKUkKIhC;V02hV*@jX6KJOmDq8q+&ZH`taf_49xffaDrMk@5dkRe
z_|q=YY(({Y+YquXEQc$M)MAkn>>j>=w0cM~?3I!%l=5|3Zis2-@^&7mRzp^?=KOl>
z{^ML$uJo*>wx0Zw%RP;SWAz`M&~Fy+{0|o0k4YRLJ?*c|lT)2+qO`g?^VNf&Sdiuc
zk6;EdZ3IAeh2IYoV|L2DN|*x#H-e4*)w%cnyGI-6-yykCm!c&ByyE
zNfJ?rnGMy&&N}QYKlICgXZ+{88X=D9P;oHjn$petp`3Rsd0+s_2u_-oFPUX*Y*Z|}
zRdzEn@(cE@448ooBAmie?G*M46ziw^_nrBD|ND8M0(6~HvKm?SR8{$g=F@&;dg}W|
zHW79u=jS{ckWV*&H%=xv)K;67$QA^~D}`6+y1c88u0S^WLp!ba$(O6gNyb#43@zQYv@7vw>7Jqt6A@rB|tQ+P*q@8%_cvZS6V4K;(BMSN>zoUdAkkq-jE!9BhcM9jxZIC
z(K)oQlKqYS&H8K6!r~+ySVK^y{YFX^QCs6N7;K3F=1&|mpr6bY!*KIo5e`USHfDCrl%ZH
zze7UFjD7##!aX}1B6(^UolJItIfFRMvg*l&_h2eE3eHR{^IS5Lm$87VKjE8@ptstY
z*IOc0M@@9uWK+a&bAVW$x>j(tRHVs+R-xOW~=uDY}%l?gYMcc|g-SLP@gL0JnG7WM$FbH9M~K=$Gh``+iWe$9FR22Sfy!
zXDbLrpg~D0Z_$d1Ksuw$->%vfBl3t_ob3q-|H-y{l0OR!P#e;q0$ZSB6gWrhNZ^
zrOc`v3*+b!pbzXgTBkJrcK13Ie@!_}r!uNdWU+Ltwo=gUF;85|eUptkm*%b;fnK?l
zs9q%SzAuh9>=xleiXpP;(YiANndNhiKHBa6F^n$wT7j(R>FVD1waUYPv%8Kf;cyg0
z-K-KJGyz_gbjTve8;v^R3+q?WMK<4^!T5&FY}!%faX@Rd8PizrVkte*XK9GWMrLA7C|F6)1TwPCJGo%jdP$6{CcT&*_m64{20zf>4MOAH2@A
zs)1Q~VZFdVF;q_GpFEWwxn_Z~)6j>b!Z_%k&dcStuaz;x)gDi_5L^ngu|v7`TUWj@
zUof&&boG&v{EO%4zBuS8Bl_>WiOoD!JeS)DPDhU+w5SnScK&pGqi@u7^KNAlqB{&Gi&nMm
zc6@oKSPMg{SvY=kZCXj||54}gT5N)|uY`vWssx`8?=w`_!#^!J;{I|-j6-0A>2Xji
zkB=nHyg)tuL*Xj&$IGZBXM#OfJzNpwQ@FMq(23wZu=4KJ$Qv?xLINRil)N`D^muMF
z`}7Hwvn)YzPX)E6XCUn`u&Yxw5;sC{6hyO$dgGoFM>o)rpVK!oU~{&wy7&dMRlBka2i{+wNI
zpx?{ZIC}3*vEnO!XV1hP9+?gE)
z;PX4CVYK|*JC>3xfk(zCkkrqQmA-*g-T2w+XaQj1bzFrLS+71$>1A#Dru3bgir6)-#@Ykh~ja-2vzx*4K#D4mFNnT@hBY26H
zMjsruFhXBdjDUD@UXyg*oWRqwrGyn;*^AuJLZF14@(l0&{Qc<-9{JDvxO!65Uc0J4
z7|YI2TG`1aMo{svzQSnt#Rtsg0DQM5L>0z#w@j9Mx@Ko~e)?y}4c-aJkLd4#^Uku$
z^GOfc{u#@7##
z4Swe(Y5C!Yt>1hDld&9f
zoQ3NDn&lJ762mK25lBVt7n%RGU!iMsZ_V4hOr<|q(BCB~cq#1^Yj&zDj?Wo2W$Fty
zD>vmdAwI^JTS6zkxmXAh*}VF9v_b^c>|0)D7t(>Zp*YUqd5Yj_R+^dT`SH#2k=Wap
znGVVT<+*11!P(UFQo9>;A*&DyIEiC!quzIm9w52r;mmZ^PL@Q;?mmK*Ex6!Omd#6^
z*?a}k?u4CTtBVU3-~JHOAbj0IBy=u6wB0Vd7JODc-*<8Ub_8-4J-Mkt*OK#l%pxNUn1$cY+-P!hoI@aV7=RBgQ
z4}++$V%az;iY)CMhN7!|iWPnV;<{pX=+|ZEi>+>ca4^JX=whUaPw~l%*r}*ZA?cmB
zztO5-}hbWVK`b^mDNqC9d#GTS=)@FZ7V;SEf_vPnX)ShJ41RJ
z=?wucN({27Sf1s08Z{S?nOS`0<_8`4cwDLBHd?8_7`k4D6s#fkdYL^U>l^@7XP{SA
zMUFD)FVv@fy%q(=Y*y>!WgdZgN1*8F
z+~GbP14^EEz*PV3>;SZMml||6LZrkuhT4@@<vudY+ZQysF5e^ZjUjgnWl
z^1F&u@5VyEs*`cJP7-oOGTSjS{tGnxB%$stTF(uUBMB_e;t?M6If*tADi?e11L^BwXd5YYe4m^^g&$i9
zGNokSPGC#joM>F|bw4SQ++|ij9%~Gl^y!*S-*hOym8`lD7fC|ZdE0~+d_#!E*e5A1
zIz7q$#NJ^66g*O?dLop7~R(d=&3^E@U2Nw@ZgtknoXRso)7ja6=mMf6YAVz5XU
z?T~5{LJ~3zl3$#-DE8rS&4ZJvPZaTV+@yGax9d3qG5&rMOBmg50$`FB@x*(Z*>(HUjJN3SR<%O>xTutZ71g(y51};kwwBPe0+JP3kRugf
zwXtp!Vz7I!++rM}=HMX87LxcsHu%j@I%R5{;{2-TJ*`W~pz*dW%b@AY}K*$T(
zxU}}egIN2mA@{LL3FymEDV1E_xsH+efBxV8AN47|P@6-xhr7Ep3E=6k!PDW~Y2cw<
z{!N~TG!LzHG@qFaj_+$gsOqC{eZW<9$P9xF66=02J}Z|Xu93C?phU~X78DXD^b13uT8q^
zVJ%AcYG!P!;M_T>JMCUakL979?C=JW8}>NDudJEOm_quuIqO9{r?LESDT+X0fi8K%_)M{G|Vid?q~HGQqX;!&Tsrq
zTR%UX_nmk9b_0AUXilem%;MlB$;1cWq3b8yQr7H*{uCxfpnyx}RKzW^&0Ch%B6Dnp
z`kPRG)xC)C0N9f&L^bb-?tZA7Z#f;F^zNql|3D-c)O7z5_&^*7#B^p-eB)L!5q+VL
zC+Y6dQNq#kr~lK=`x`eqZ-DSga6S2IhPo3GaMAUTrx8j_rcIShZ?AJbltzm8*v#1W=rZFy&(yd2
zL!z&PiB2sA&gV6YuNTk_m{J$zug=j2JYR6?`RphU=7^DH9*eG@2G7l8Uf1Ng7tCU4
zXso9E9#^Dcse{~0AI9OFybyzCrH)LQQD5S|P9WU~tL6&wuQE>@%0T#IoEgqL@~}SP
zsQ3TX?0Ysh&dQPdUI&Ncm4q_DtF8rfJ)V{H({=>#=ds5M?l;oQVy=j(tCa#a+$bZh
zcm7d=?A2aDFjDaN=vUXy_VYMP;P4v*GlJ4#R;9Y}AJCOm8nQfqHMW}wyajKNLQhLf8Vn0TaJ%N;EGG+^^b>;hv_mqqs(!$B_L`HEkw8T
z5Padaw0$2fbHWrinL`ONJ+7SE%R-QLSr(&+FBJc|KWI7M-w2ZpICwb>fv8$bQz`w3
z%v`&U2;7u|t{7OBDs>%cWP{J_agwX5WQQ?av`I>f%aSrQP&vpV
za92K`SD#xOK{vk;?CUKTDOWl8*aaB2#&BiN8~)wJ#o_$HVuQ|}?c`s(<)KfdoFv&#
z3*7g;Nn)-*v61^mMkehU)dbbe1hrV~!b&^puU&QO)qI7#`OF*@AFqr)2lG8lI3eGa
zz-}G-@qIx=pV+balSb>_v#NOO
z;E{Lb&YV@;S+E_~-!T*Ht_%ci--=q#6C7VM6qbYn;`POFflZVm??#(=$RfR#cA;a-
zgQh9MQ+Zk7XJqa3gf2VbeJH!#0Rjc2cyB8aH2Lid@z_BNc&4|{^J5U<>0W9k+s{Ee
z?~oP1FOtpUaTLm^wh5=cOS}6#KhmgpvA%>CB+)#0kM&3v3Vu8hFJ*zLXuBf#^O*V=
zeOh}mRk}GmSbW+DT&yOpNFp52#k$e@%y#z`L2^0Zj0>0*Uqj)x<}jt(9$^Fk`>EaR
z2Ap|E^YEvuKq%Z%35CTthiyQyQcn#))I+Q?J_
zhqL@?Zy-qv*3Z+ddb6C!q2SSsLNfZ1;;Zkh6v-&^hb8H6k1@2Y?xJRQ_c32LzX|o%
zp26_E%sW{54VQcNx`9vaz(EbZ?7Iv_mL+Y8Yobuq;}$60j3-yz`DYc23zXe)_Hmy>
zK$|uo$S5GN9%>2gtam0?*W-G696c^OAyKGiraA>x70XG`-Z_9fA8@;Ww7>h=Po>jw
z89Mwb=0(#@dlxCpx5lZ!y&CbSAN|k&kStHVj~51Pfoa#ZsG9flvI@<$Sk{!*V@qlt
zpw_eduGb&XR529-;~p41?XDV(&U{bk2qr
z|B5gIe>EA?#mF6_Nfs0~rjL%whBJ=Al0fJn3ZiT72le!OUEZ2^1XGdJDJy(Zol~;kqlKm
z8j@~<6G!NEZQGTla72kb@msK~OBn%95*E(Ijelr@YjMNL+w~O7SJ8`$-uKV*Q=fI`
z?jc*e#(r7cSsFLGs&4jmYB~QcV}OXzaacL-egtxN8jT?Lx0@t$1+O%eYu_k>K*R~4(&V@Y2G*Vgke5^dZ1!lO>~PQ6
zOp@^P^S^yntm6{glkmcUOA-U;6OPK^HG4uG{Dno*y#bl}qu^YKuMf#2fzM`Pj!SUU8FUi=SX+7&nql%;
z-P!D8>l9;73rz%TF^ONU4UY|BTxxNw4F(8HO&xr1y=X!*jni}t?PyFm&!T(Zt(0a&
zp|XYB2h|{pLI?W?BJt50OrcC$a`A~n8Wd6<-W{i&>Q=5y^wNT6rth*`k6>8SNJ7*#UP$>TohL0)qTd`+1T}`lT(t+*am}Xh%J^9N)Dl@I
zxyP(9)|u?Ud;$QolHMXdqmv7Um|erN-v_&<(nsE#*S`Wb2fVvI#z*oT{a^D_beBTL
z-ZJt{laQ$rHHw!Ci{S74`l)`k_})~+NU^`B4MD!AG1_n0(qTg0+vLyFbXx-PcB=xG
zqu=eWAa`FyD2XSh2EVxH{Rr`#cPs7MxN)$8ko#pNu)ta2_~RW^+==g!|jJQ|M25Oct$rv?|RJkF!C^Gl!xQ1
z>1!Gj5G_ehgZu&901OEy3mGmT%1iCeSYqDUSASe-(qv3a3v)vp*gXI|uAVa?xjrbwR&GhkR9A1T+a`3vea>Mf%(!+rdQsA&qHcBaO$h6fl
zltCLtv2mr{8J{?cU16yl_>AJs83raIQX{f%QG`>8fB!*JO4(bUk&^!=25TWD*!4)*
zSrCs^(6bGCo
zua}PjQf9@j2h(U646bjO;tr?kA$3Xu*9~aT!pObm)Wcp@KM$&UUOP7~yFIgiYT;oF
zE9E}j9JFnZo!{D%l~k(@^CG%UFQ|?PV)F(ST$EjcmvkmER5@chtY_az#Yk*tH)f~I
z68j(ttsOSIp3%;{U9O&S1tA()=~PwL;ucnJ?Y?eS6!|pIE(ivQB|hDxH|prztVL8u
zPXR`0bxd`CY3$2lvfM7%_0T*|QrLK^1rX8spqXC_j6ggE#dypkM+wz^K)A7tDtPbC
zVK^H}H;(+711{=D+kEQBK~k{LE*dGuuQ#VJ2sD
z74^R3?0t0uy83zQoyB>oRaMn9sS%lm^(X+sI%62l$zKB*$2(=ggF5KIM0Q!MpU0QXgqY-;@^J&|X=
zE59;N1vVa5t>m4t$Sm%Rd7&m)iCW;_+_?XlVD74@Vm)1QKr@&$$qLP9I4Ddub(cG4
zzidJL_*3?PFi2E|EuZ5RfQIDPG6&~6mmmGK
zV#)h!7?7d(L*mT)+!|PyUDfruDk^<%HCbLk3_SI9iAE*i#AjnqMNa`1IdK{Fs%J^>
zv9#SaQq6Lbha^@CagGXa4WK1+QX
z!PHA!_mc*>%)$NyJy)?%rBx&kPxnthzrVi-3S3oHSj+Zh!p?0X!9R#v+aZ0kSL~hX
z$K;0(rFOsp$%hZgne#SjSIS^brV70TV!|e%9
znDZpVNKKNKLBotsNQ@~cVV&&v`7%6$=g`7+P=fe>{onsTi3j{x@;s{W2VH?Y(*@)>
zuCf9Va+~@du0Uf#AMxFHUuo8DD;e}fK@Imt*ZIzyEpuOIB0%z&&ovB?nEv~YGjD9;
zEctsTeX>L|PvNm{jJb<(#OTk~H=#5rB`-i*U?7w4$P4HC@$X
zqIMf_FahrY--wuc`Ul_ozB)5!g3G|0Oi~2B
z0?W*$6U#2(F&%ke7L2E!?&_a^InjUeY<*Bbn(1<$yI$pEINaek3UKf1o*lqzm4vzF
zT@1hV4wLLt+M{DC;d7+H}{I($#*^x}ai+TO|!KPd;0uuY_4@AF*
za{dTxJ-}>AuXDNM6aW!$v2o8xtOKW@xh6tC>PtWfA{!drK
z(7A3LSqCkfl531Z)BLB1HU{B63S{l*>8@^@04D`JWe6Fv$z!GP@_k_6aN|H=Y@fIL<0fQy*JpY@ZowMBA&@$kO3s!PP&LGexXJsi-
zYzP5VKNOey`1}`UM`M1vRXFL+z^bd5CU~DMKq<8`@WV(o;1ko$jx5D|a;1*2KJq5Y`Xp}LT+r_6R
zQW|?h!`5?xXx>x4sF@R@A_3g
z*v*PHB}0MPafYBYyL0osBCGJeuTcpf{x20dhOo}~TDdZE
z7U{8A$*cg*~jLa}eoyV_Z-H~Q)n$`KhZ*bySiEdtr~+()
z{q;C1)jn))l($pGV!!hn_q(c;m)}xNhI>+}PBPLUPwnlXl>*(bTi_YT>?L1H+4=`_Klh|ONoF`F%SwAu@~jsBcPujh#OT!T1gUbHjNWmY_3T4
zIzmNv!*@^oGK9_nb_WP4UOfJDIR-8d>V`pu)nux7%gNn_Tr&gmwwdZHZofe&sCnN5
z5_0-af_u$c=5{HZQY?_52l8#q;_uaX`0(0w
zl22G4bwtloH;$o#k`&t+l
zBJTIbMgH40leAL8<)R<=j$%B=Qo6Dz`aIh#aA^|h?1qi3WJ@UuXN(xC4uU97BoGZ(U4u|)1~$l43z
zCoUr0U8<@!;Q(}nT`7-nKW7ccJUOCF6=`he%AF5zc6Sq=H|tp3w=%oP!322vLV$C&
zfSaRsHLeeLb7Iw#c4&;r?19Q%N#9qGwAzX2F{SWUb(7wIEy<(0SuM&IX=NUZ5d;Eg
z3HI%nRXv`=)ptV~p0gK9(~DrdCBjH8fS5!O#$k+Tbm6mYE8=}$R=Mj~u8lfT+pKw2
z{rDL#55P+0Y7=-rww%VUo}D6DHG`-6sc5RhWUPXEZhXdAKvDTM|<|Cc!F7p{ko5*?t
z6C9oWt70cZ!s6|IUAH;nR1{@ibcsb(J@ve^-^H_|{_H%@18_!F?x0W#>QQX4)C&wF
z7bdH+E-M@kZ$SuDWDj*_3%rwpsvhgSl+HG;#B2{ZH>4K!H*jz|yn@M?6lTI6lIAO2
zn#2uA{oJd5gt?}RT~6=b(QJBx!ZM+oY=OxdqJG
zg9ZCr54DS6qC|D~?r*VG|5}Dtf5j|-vl%1H^XJbhLEN(X!Q*w>WNWTaxI}iP%2l6a
z{n(TsIBz+CVD8Ce;AZOz*Kmk6TE6x3%q%N);c*VpT{{BmX;szE+MTPaW@MB~l~n$8
zEwL#UdLhV2I%#~`NJpvrjqtdej0jDB0;D2oHaAdpT+BhUMMUq
zLlF=MWqKt>6$=`MVOrAYux~)*n(*m^H9kRg(l4fwDOFd!GpEX6ywmSPch%}F9s>!J
zPcuJW>uMl$f=p$C^h3j|HdHC8ToAJ
z51QgF;%2e(caL0=2|y@Ui7ZGazP#e&LMwYx3%y@-7C=23w
z?dJJo|7kDhg5XRXVl8Tz*+0ov`d_Dz%ZsRNO?2PQQ$!gc3lFsJFi61D52fGvb!F)%
zKa2j#wZ=Pxjo`$!rs+xM>Uwcb;B92;h(nQegXr5~i0W9v6phwfm$R&l{dsU2EN%6!
zmyCwPvG=puRkbf5e&6X}|1LdK#>7-$lcl`t1AyPo+Ve0Hi@%Uw%~=;pv0XK%NQ1Nl
zMfdpzCY1CPujzkkjF?LpXwMeMNQ&G&?4c&WEr0gsuo|<>@iyFew+zJYYs1=^5vKFv
z#urK+m!VA5+?Ak*9k>KwHu;iXqWJM(@A*eVhyoUjQJU2o2lIfFCbGL0M5B_1NgE$!MqW9F?o
z3q;F)aHGy-tb}fx&|Z~O@4Nt?ZjU7oIi$3&V{&4?VgGMdbrw7+GmSnaN6_0IT$S%=
z$ej&)c7kte_Py$ihMe6E9?n%nlX`btr8rJ*e1@YwwP4bx=vbZFGtHje97tqZ+*LE<
zAxLM06|};%vv=OAr!Fh`^DqP6ND5sA$;$|k7^QpSE-p>-{7bS`wi?nba*X2}$VzAJVmpKNXJ)=AGW^3T-hh46?7HGv`de(C6aPD}G^=^~
zKW6Q-%ayr1n0u$2136Q#Ry)z*-@4#KcH%sm2Bzt(s^8z=?(%%pb@1$3s)S>a*>%BnUeZ3r-Nf0Mt0)N_A|Z4j4VEqCd9e(?J+0I+b@l6?x%2aoOuV$q;>*?)b>nun=BFE8m!ygQp{`YDcxk|8~TS>BnB;H_=ZJiO-
z>703^oU2Y8uuSRzfH7q;Sb~9@fK1<@&$)znjNuBZ6l894S0~XJo-G@A}&9^Jg!XN+FX+Lg3r{gmW!er9nb(uuMs0OX!DCNy~22lHD8`
zXbkU8XnRz^Uc2Q>=#O3Ael+W=*!5F|otH&j;t1qT;Tl3zl|~U01@A&mh1*Di@*nXO
z?y1L)4L?uQ*@FIHX5+_@V?8IV`qoD}BUyXgO=*9BZ89fCMMIF?JEP`fw;P<&{pn|B
z5xTP8$+q;b3-W352IhRns&8uKtKk`4mDTUD;Lh0q8_&h}~
zwsPeWahEnip#sMkY6fvz5mdAXH~_jc3NTEYHtKnv9qqjRJPPq4?Q1ur%@WkSvotNM
zccr#+JiAm#vZ~$>@G@b$s4VNFr2l??5=lUCNEEx+lE5uKiAG*iOSxw@N5XqG=pw<#
zlw{TWPFFwm+^hM6Dy^6`MAp?P{_g*{M_@dbE1mqUCEI&HS7LLq_OIe@3MQweav5i(
z$xCo&qI;H=!7c0+){crmJ#k)%aP!Y?D@aEY5>1#F*w5o5B@aEx?l!ZcTp&h4cX*0O
zs+w35g>MwB%HA3l;Q6hpl*w3;LD?*2{YxkjbCG{_XQ8{{{-T2TSbU0FW{U5x%;FO>
zRtM_*lbB<##+^Y5h%4v7KYoz0e)U3f7G0YJpy}-^UNiI*-D?7ktr+W8j
zQu+H;wUV!`?AO}QfA4H}`#Fndza#QAkKB%AZ9`{YsnK-E>8H#sYHn!~@Z
ze{y4L4p!NP7|{tsqDE$^?4qkqod|ddd|9!d#7okTQm!z*Ix)?1>bfsAvVIsb#U3fW
za!k%(CMCYNb4u?7B+BVYnUq5L20!H$@vEhe(qWX0)=l}ZFvXWYPhY*M8;~zu)uwWc
z_oxr9{dz=|s!(T0_Kg8t90o(Q%8z;YU2MP2?;>2G_rGFB*s3@fdH%P5(#;^Xt8ve1
zzTnezUFySWq$#)t4*Vp(@;Zi0he!C2x#%)h06aj$zv&M(9|hOREBnvW74MGkP_g|0
ztqvQ>J4M4EvE`MaBLKFJUxO(CP+eN@9&B@5X4a+yIwW^j7M{7pt)lnc@pQ=-X#Ik9
zonf(R?imzf#}&9grM3{wV1T)WMfHa3VuuFfxLP2zXP$eDkE2V+lt0Jnhea;AvHsY}
zW6qf7fcZ_c>z$WOfl*%@OJ#zMijp7r{fE1dPT_-b1-ozhvsEx__naPddwG&*xDX%f
z7P7{~72E&$fA{~)vT_H0jjM;SOcTk&)wesYKAEBi+Mwd}u-(tj7}ZM|{HN*nhgCmM
zsov}k?W9G3rtiAFkN|c97Qgn5Fsb`>Lj(P$K5
zLw}DOHv!IRCcE1$I_|FKPlAiZ`P}HFR;Gt3BOUMm?0jqsDdkgpA?iS7W7%nn%;{Hw
zAu73TkKvyFS9OsBi;B>nuGLRRC$ZbA9}*`JPyLkILh`B=uT{to$fG-o2u>e)jyRSL
z-?dC9?+d~>Dx3O6$@nIBXIDSZe`N=w!(jYugAtT1LA8^{51B>O?%FV>^3~B%R3-?f
z^9hzi9-2vV(!EEl!GKRmY^yERRT?fG=?qMu`pGf53hA(p2qf>~Tr>;$WMm-|DT^z7
zAu$F*|GKWPPWPGL3*0)Ek3X*kEdo9_$8bb438_#nf@B52Aq`rW9U|Qb)A@1{G+lWJ
z#R7Ntb8$Sg3t+3drFaI{U+tW`{Cm--i+u3&)*H)HS@j5FX-FpRk51}3Ny6W9m
zz)%0|S^;TeUEbF+n{MBC{Cj~>)e-2wxz6c010zZg+e7oOW&E`=dwlyn0ovnrp
zd6dLS7ON#s8Ux3guHrxKO5;MVZ7>H=WsHyR=baaD8{g?y6)eE|{5!{?J>Nx1rAkoP
znb$GxTSiUVvxbUu_`aH$onFXG5uFk+0r2#^Z446^TBv}op4mCE!xu%944Bf}$H5CHkHzqXjv)Lz`d>0h7)*TU
z75Gyv?Ek#~&gCy@Q&=wj77Q%qQ^KCbdQT~2rki^Z@w@7Qu_
zcg#a^bf_*tIskW9i!}sh%7Y64*58u$+z!AdD;bWRLd_M}6C-`!!LB+_Y#{{(aO-x{
z62|U(H^nrAfUM>-q`W$fyr7vRUzY572yfzM-rdTJY8+QmYr1@L%=w+)f{ifU7a5c(
zrjqf`F-u4$@NVwOl3>@qBZ<{E8K%KOMOBoEi#tEMpLx7ciIF&_abZ|szIwYe%0fiT
ziBpCu?JHm<9T9o#ZZ*k1M)i?b|LXW4inuz<$5nbi?+5ou84zC?k+Rmk%2g$;`Bio&XlQIlVtiJB_Qb~l+jz#)I
zBSd=n>Xq#&)cw%g*TMdC)rj&N>_N@l(@_4=Tahyg&73wh^)Xz&%ZpG?$$O~
zx?KOb>>A_44K+EVYm-Bu}L@Xx>Gv${6}vHb(T@9#@;%gk-l
zC*!mDN_GLaS+M)zYOFB?AGRrDJ_nz!7&JAzZYD(sM&f*RlXG3e(%#Hh|)?pe&h4SXpEb
zyAO#SPeh*|*NuhCNUWM&Gf>lJmPeq@8cb&ckV*rLwKwWY-H&l_2n#%IJ^5E)xQ2E{
zwd1qEobqonr(M-=Uxd@4}iL^E^LJ=iTvT6}GwvcK185s>g=VWR&xkP_S5hgtgWKWU<-Y`J_kpeQCO{
zx0<%uw)Hf{(XWdk^D*?5U?KaNUFD?Zf@!(A0vB%$pN(WmxyfA_sa*7^tIKh<5fg!<
zU^>XH#@X+&wDtPof?G2WU@7d#Yv|)_4{`Z^0G$Ps_U#`{mN+Ivu7=%-wv_dcTuxll
z01uf99L|R>Ff`pdTwb^pJ~#ZYJGxfhK8f%j_Do@1oyU@m?Bc>u
zt#wa@t_DjQP;vQU5l2??=vZ9Qg0MA!TUDVASJNzvw9J+1N|XPV+5Uw$3c3qRI#B1G
zICo6U^op!_5wU!eZ=&~?$bu$Pg6eS9Q1|RvX6wg_t7tj*e4}Gr`^`3T{`~w$c(qan
z56LSgh=P`FMx=f;^b6zebW(Nr7x?g?SbUyp(A<^-K^?v;CoI(nGjuT#rK0vj6Zmwmozbh{W8le%xPXToGihiXQRu
zy43p*2gf7Ju3U=$JkRVDsL*hn`_jyJq9XTOj!^7wQ5>vI8{;$|fu1Dk<)1Y9`W4-(
zm3wmcVz@IFJeH%1J&?)t+b7OnVQk3CImb%#0r%bPdbnwhoN@ue79q-1kBni{AqKp`
zX|w9H>Lfl*lY&Q(cJ0#M0Fib;R&HEwnl|?1G-l@~)K6hy5>rZb(l|??F+W4Dl`cGW
z@d~@|Kd8YsU-g;za9?Esudx!;-W<(Ts=8R9&`UD0{~EE^Ef>W9+yCMJeH%SJAdVO{
zT?qcB$u}nn+^@9II%0i&cryZ)`;|Lj#m;0kPxaWggoO+_rQ7QBO=T_GG_l!$&E)cY|zTr7!ypy+?z>vRo9U?Lc
zOQzAyMo2SzSpeo8n5LZMaQKr!Q~JvHMm6Vi*>u+~h~?=)0q=~Uryep3vi#$;@POLd
znzX!u#)zzagP%Y21y7g7r2vrh95}e?%{Fljp1)&V|GA;C?_GDpD(RWsRjqVYwO1M(
z7H(b-ppzH+UpBiEJQB27)-ZXnBXP0Awpp-tCNO-cM0fY4D@*zL}XTe98hST@h0fk
zM{=4ty0km9bAWrgdo!QMDN@>3CX;KwfxFJdsA;@M@qNdmX~9FI@i135-uXxCh2-NP
z_m_Gd)ovXTu&d{3klx-=-mzgB582=@*kLib{nAbmRXvl-TJ<68$%(13=OeqwfQ>a^
zNz>BKZG=+dssCs-HDVg7)6#3I3$cnd>ajSoB2vL3Orn&+?)hWmZdNKF#rnNKVLbdS
zr!Y_2-*?hf2!hf%i1a7~C+I
z40rl4c-$0OhY*VOrK^v%r`b1a+Y*XwiP_9OSB8pJa3vPA1wGGW$lf)jEiS$Z2E8fD
zN?Eg*4c_nXXxp@BW2JeA7M~^Lxrg!)z%UcToi!}v)S;>_18;FmFP>oO-m>+Wdxi9k
zG%u_R-x`Ppbq&VjA;#fNnjK&%5YMs1L1Hvc4FHpcXBIJI@U+w?v#UW_`b#TXPN;4;
z)d$zd!_*;|&zb5lx7jrS4Mp9sA`UCZ2U)F`E$u}oT+xYd@a1GdA`29fSB!KB+fVQA
z@9+EH|MtJP7|^;NGYkBhj9tF(?-y8Xg6g8(7U;9XGOey=r`S5xq5$uM#b1Lge{$oH
z!X$Tu02_MY`@V&$r)+|<5hm}9J&=L01EQkwb`8GbX~
zeWNpEm|>~ru`oO=$b_On*3LqBx`8arGg^mCxJ*CFIazodohRwn;g<8AnRlEJjD`I%
z1l=V_(iFS;5z>OYN6qLmB@YsEF=?nqg4Hpml`YGYrA%(ahO4S>EZ+TfStZ(jh0oIx
zc3yp>>AgX#=gJA{QaBsw4Zg0`|Gy`|kuav%$T7d#EQ%5#Iw-~66svJTPDR0o9QeO9
zgnP9}|B%U~&iFp|ofgBKx;ZA;K|0)*T-WRagzmd?P4*?ARy+Q6Q
zkiqmFwd+&%7>Ouq96xV}on&Uq+hAU^?^S&#*-E6ORt<=S
zOa4cgcXSZb;Q|igoAjz?nFK5Nj1s4{*t0tOC^tsCeWo123$2vqe{)Wz7`j1qz9HcG
zp3C_2wUhRp?Rpx|-a;z#fzz3P3h>-1X%;A(+9UPEr<{o$c6}paQrO>-;p*)BO6OZn
z>*WPg4E3`9+0+NPM=|AvWOcQ`op^9J%3F_IResmZb0)2O2`YRrrmJ>>O^-~Vp2End
z@D+fpY(`rV#roIuN6DCeHmqABj5PEK)=V&n4U8|j5TamR0q4X%H|(!6%Hs)FI^z1n
z0{p}S{Z*#3ehJyE%(v>4o^x%wg(0Y%DPm&UV6$V^Qt-lT@9(nR~H@QZ}*zj^Rzh)k3yY(M_8p0sQQ
z6|*;`1$jo}d&4}$?gYg@SNfG_m9)=Fg)6~|e$|7mI`|tzJq>~bOQHJO$XNZGb>i{n
zyo#1cf@$H!n8QLpPp_oaQ$MRQg~fH1pYCFdEO3HYiMYL>RRylf7zfWfu`Ap#+hF>8
z9Z+0$Pkon76n-Gv3Tm5mLG?G1S4bQ%}GwHx6Y
z{!3E^u+S=t{_A=EBYI>Fp#3}q?Ci4ozn>B~^Mdtbho1ODku-adKV1N|VCS~Dl&g9u
z%s)GLZvWnxHitY3@1-;QR7B>SYr@`VX(-QOsQ9;8AeTx5{G@%oS~hkhm^uU8Y-VPRJXr=8X@ny27%r55fhzS&{k-<#m
zco!r#oqQ@glcxG!*-3Ef$BT9OQoZw-ZpdZe@tXR35kX8C}nb;+X6h
z&*87u@2aAY?y*Z;x1N`3#*QofJdYPWr6L20PoKn|LbY400+jLlivCF63wovC0!HlWH5m1#C&0`eVa_GE9MuO+?{SPEt)y}xd2%f
znxD3#Za&>F04`lln81JqtN4VHbsxzdC#h#hb`%g*+@rVgmIZ(ryy~B=FuCC%Xxo$v
zHaAP~tOY=Kb5vb#kjjvig!(L+ZRW!dt~Gp!vnN5M(MnJgJ?I0vALGk2G0Jh^C27+8
zp`!Ut&ZzsoGb?R(LFjrkZ(>vjnRSU+W&vK(8w(prEb7V1+)OZ1+s2VBAd1_N%L!Mh2l7
zg%*TxRKPXn%?w>#&zD`NFQW-L7j-SvgyW9ex@?Oz?!G?pzFwvpXoV6H4Pz63ZhQsr
zCv%1;|CPf8_N#KTR=O~$yB2s?|NS&P;rOTBlb?Uik3E1a8L%1!k83@LjoqPrS<^3w
zAPRkCSI0agS9{7YOGgx{ciG%u`k);sBNZ`D<9hm$^!xkEdYsh{0s%r~|8!g%6vG7T
zh$l;UN&@)4V*-c_=lXhOe340+bW~k$tckD<9zE%_LTiTyq_*9o;z^mnIrN7}gq{7Z
zYI7LM6~=pf&$toiQXp!iz(U^u=<@vwz-L!qil+i>pH9k&ii
zl6RoZM0}zmB)sbmQ+>9**V8hwe*vP|26Gg&9N+HB@}EhR_*A!4+K~e0@YGo7X0Gdu
zZKCN+@aVMkeAY)$`asRCvFIElgwi18VnWl|AiE)9}Z%M$W0GsY8RzyfYEIfBZDjl=1m^e}2yDHAKeL>HH$Ojr7gs%NSKVzO30g*U
zZ3Y*Xn0GbxJpTdX0fHx%Mr#WZP?$yRj8O3d3y|sobR7aEnuZ~!*m4Jg{oQ)<=-ln>
zF=c3kkC->r!;JD%q^b`5jlhLx1;V+
zG9;s9a>=fh=!H_+`P|^axND~!bNfu41+AmXXxv@H1{Ne0`#=V}?yfI@w>2<{V5ti;
zPIft|Sh&@^qdKREZpm_qjXX;UftDfY))X(+B0=1Q<)bM9>8$c$4B@4Laf$Ijz^d5m
zI+GnlpWr&a31=pH)0F_BIZJv9Y7#1Qzjyy89xjWE&){{+Gp2BrH^|y|Xd$bSXhy+X
zsKckad@LiD*$!EVw}e>WQ|81bh6t>#X4U`vfB(Pat^^D*C!GsK?R3yEIv=5MEn
zNsQoDmLuBqSX%S70ql;6MxP{@H{CsCN*;u#F1kmA8-@DD$v~9Evkv;6@);4UtKL;t
z7ixCU)r|fWEb6629D$5Z$$X^j6dr(F?_s^z+*j!<8Dnz{@tigHHqhk837(44HHmb_
zC2wxQWylJfrXlT)+qFYIo?>C=od{F!A!QWI3*b5W{`}{SGJ7sjA!IXEBM=NfHL6?L
z9Mj7k)!q8?1Axr@1gNXzWhE=JE9N7in(jI4@(=~NIOaDP^PrK??2gG@8QQa+diK86
zeJ>N2@`}7ebR2Y^)~djLCms8!ng+*QhGV(3#$D#jbcKHbHnB6ZcfG0MK9hFdPH9US
z@aQnum(;E1?sbdETD>#>h!-N-S~pMT);)P~nUqFv0LZkcttwfxECtE
z?`rm+hTs^f1~%x8g@c>>cRRSS6Ndt}AvN^QzBme#m+1H|?A{8XdxFuBNauLxU;3R-
zVP8Lgqfacdr)geyT823{=QCV|d!GtQbjGS=lA^shfBy
zxj(O)0EvFlnK65e=5aW}E6FTARFvJ({`7x-+V8}%pvYMd9HJikUK3+NsH0WZ%y?^y
z2Z;Y`2u{m-@VK;VR@<$m!Uul2=%AetNfyf=Cy-1MB3ER0Jw|P+%DtNrAD2@G
zc4O6UxffPI>DK;OP;&KaXXcb)1+CI_&0XgPQOum!eIw-gSQfznsQS51zDnrl*%_YY
zOjl_!2{+?y>~}=#eXUc~tg5?Wj*0Kr3GtmL%*`JH&%@oUZ
zFLcT7U!bf%-?K78!7EY~Gi}Qw`iThkqZw<(pQq=|DvN}0tib1K&8~)Q`kb9?l}{3`
zaUIyGpS07ymi1)up|fXK!)u@XV4mC
zd(`>J!9(peaiFqqsj9o`oz>!bo+ELxiqG>0ykk
z-7q!+IOkA){d&>tmv~Qn6_`O!hvM!>AYpM3NGh1i&hF#EnsslH%3n;sp@&mck)vS$
zUfHl80=3^j+%n*j13{`&2d+%jy6VcHV`J#i?M)4RAXkr7*yR{XF`)&@+5z$O=b!`pVQ4Dw~H5G<#v?ymmt_xD#=
zYbRmKnLyPS22Cf-;3XRba1*k0C1e-doa(C193x|hJXwAHY7AxH88Mz94a`TpVO?)e
zDtqH(dlBR(w9#68Cx|w2Pie1x4RnA2Yj!;V;$0J$X`WyH*r1|<3%jyk>8VCCTS~N)
z+W(jT-T#{`VL$V?s&c0!?ejc_GxbUqNpHKXbIZOZ{=
zDV*^i*!ffD;F(dpo>`^MLC_gi%hG00J_k3Nw-(E~d^vsD2l$UFolkNj%8rJScK#GH
z%kBmHu#AV(B0BGE?$xPAzeJp;t
zfXCKdKjnSLYunE^6He6m5UK(Y#H+?5T=Ev&pV;N@zIe_5Khf>peweCxO1w4kD|D>M
ze8YHcZpgRAn6N{M3|_qisvf}QXl>|W0K2Paes@&QPm^Ad
zW!s+F-5HW1c9vLBW~v?K#%4zMp#@ldmn`l()1a|4kR8%{jM3dy+#|9^JooL+LMM}Im25*dyW>L);HP}!^M_O31;T0hb-Da+r}X<1b7qsH1-4RJ8u|7KGt^~oM~M88$gefhZlDQ
z^#o`k2kg%okl#7dNmM@bd%9NdZ!{X<`yJ1lvksQO5f7{)x!ReH7YVhq9~x~dLIUox
zi+JZX9mt`q!lLY0xvsgofIPtPeWmZ`4uw
zfV-ov_L(ahZa5b`CIXJl(Gmd)P5>H5l
zdHp#JyW`W9?ztY2p96}z%do=yzGRu$V(h@QBj54a`TueCXWf=&$#EEH=6j!eW6HT^
zQ~_WWNPwd#wj_$(t6#b~ssD7Zr6;zuL`on5aR3XbxhiYO%!tg0xc7YSt_L&!PE;2Q
z#mtC%&-sSEeY=~Po5$pznTHnMiE3yTg3KWY>Xr;7Z_nRP)cBQoJW5>UlU-aW(7|>S
z3Ti=Xqcab{Agr+b$#q~3Q!?=efW0q!%k;Y~*b)^ERvv{8#$xm|%qs_IEgRvdR!SrD
zYE@8)UDWD^o^K5HJ*!o@O*Kp}`+Ph5aRSmeX4OKhO?Xmez@V(A_eGa5sbRHj5$|@Y
zn3LLNc88706j8%vf`$VgN3OL4%S&Aol~j$evyKQ5Za#uk_+1MpnONrMIdZCe@00tL+ppS(&x>
zIuQ^BF8xMNkku2jpSJxD+m#dMky($`WT<|X#{MkF2fOL768|#>L1v=s~4YA>R
z(!&DfZxYf>xi&yGx;kCmDuCosYTj;`XjEaPY*}504JpXqQJ|=1_KLNkgp~h^#>$|{
znKpu0E;=OMHdel(AVG)$>@hFySg~VgRn?UwECh2aN~NujN#R7|9_OgF?^<{FT2}eD
z{lkJ|NvL!~z@sqMcd9cK(grAQH=_pHEu$44ig}_os{WKKF5$clMjXfC#!OK26wnE@
zddGA?TliDm;98nB-KHVgG3sSFde~^AQFWxC4Fz%n{OIYwb~z*lTI_jtq1WQx>+$iC
z;9k3i>k5;x4ntvw^iB96mndK7_}&*|-EvGI(0#3At&5=yDRrCGo-1XuY_uM@>LTS~
zMu3&d!+hFg-a^`HrnW4Kdqyv=Hu&TW2!0EpQ=Fu1OR5i&!A%wM^azCTG}TyyB6x5w
zYjWC&xcY?1y*9d!BO8Whd-~YgISQ|{fFKu~b~F0Q
ztVT(2FESIYTTw7qG7_;?maa3=r$35LHQ7p^F%)VqF4*T
zIF20uMdnel&@y_qJ!ubJ9};qxr=6m^-f7$JYhDQn@7Gb;4(gTiI6-$;9;t(Qap#O?
z4YF$*!Gqc{sxLCjVhPB)!Hvr-Cq0*F2i
z%jDXHJ=8LmhXHtcXt~bEwmS@s%M7mQ+Ha@~qkWVCEHqhnkZp2N*bNvO!lY$Wdk3ns
zgxQ5AkGg9;tKGWa;$Y{z5Sgj&9oL(Jr`wXXG7cMp=S0vsla%E+Yyr}Z1nswYxh$$v
zPWT1U)$%@Dlg6rQ$(HE7Pp=xaotCY?;I7{8MMyy*h>dtpY9uKbY)|htJd<<
zOl&aIO0??if|fC+qE{!takcwB-PRS1F4S>77*%~lL}u=bCLSH?aFJa1dK_BPYegP4
zt3&6{vPYAY`hm5U8W}9vY1c3uf1p@RFt2j6=tUlf23${RCG|9!2{iX!3p_HbA*4aX
zqN0{4mPT*kFa9@Vmywk~WuhBiiov^=b~lzplhg7IPJEMvv^+SiJ7Y0
ziw@w(#7!Fp|AhA*EHNmb&ap#B3>qN^d)X^k^JbVP>wpNsU}XhQ&ou#)php=4RbT-t
zVs)2hZ$_-{BO;~)yc?yco_XjIT`u=ohXG2{E^_g;zE8XlSlU+dXSHEcgDANE6gi_r
z<*X?facW#u$O+A9r~O7H#ZC#Ag19>+FltGwbAIeu>i}lF;P6)^wzwxNwA@<291JfS
z^@ybs#%~EiPD8n(?WpLZTyIfxbk+NywpAe=^K}IfdvBmMGR^60mmp(NPhQK-?(twA
zoWjdvxz|XfI}M(bZkNHta{C*%P3E*Ctw4d<)Y9|XYmt5<{y9Q|BeDZ)P#7hJ2Jl^M
zcXc0_nTP_!at2?aTj!uEAcHI*2_=-MRCEH+eF%fnWq85AfB(+|i|o|AL`+C+%+kpf
zm!Z^JyY>X2l=D?3MpJs^5u-jG6+3v!OC^ufbBW!;GI4^leiy>Ms-*cgRw`J@TxJ`MmRDDFXN`uIAJA)D2q*{4h&xo~%wUqW%z0<#batjvPdbhbUhaXj+K4$_-W6=m76s1R#h$?GE
zCUuzJllFG^t8|sCy1M=qjtarPKTa0Ae|vlXFQYjPre
zDQECc&r+$8nrPvA3{p>ACx;Vmm4kE+Js6=s2Cltrac&-nPgJGzF_+^<7XvZ%h}u
z-kd>wQrh~&3D&mPupTDmTVaFN=<3)@f?kz2UVeo}Uh{~78|E-@M~A3ULUUQW+uR7K
zo`!RIccb&T(%^{Ee3f(E9kLb(mBdSITYFBaTd8r<{%Yeflhy8`th(k^2XOe+5M$nR
z_MvtU)+2CsMx2Nc%sSAJ$%}ZXa?h6`ddUTOUXN62bm^#0woo@dToy3oqieu#PTb0>
zLPBvQB(ktaD}6-KHOnA_Vhog1yN^iB=nSAgYAp
z2rAOaNE2fIuBt9X4@H&$o9ZIzy(M^BI;y(W7NY|Qz{xgSL!n{>r0|q(L6+5Ka*!%7
zx*K(9!OUiH8OqgF?y*9Mh16S3x0$RsTMiU~rb0a>NPdQHiwJWpT8g2O#bUyd)optS
z=XmrnF`u~TO!90@kt(hL#z8PHmUd69c&FbxG(#fI9
z@bcEdQPt4oRYjhFR;%7hn>W{Io}xI3r}hrZspwS%xAh6J$~h8!Txs!^y%=~S2DBtx
zb8+5v+p7|D*6Dia4w0c);N!2Htw~|g-L70qHmFLN%c-)uy6qd#EhcxZXWR>z}vcJ!n@LP&M9+RE+w^>0Z_5-~k6?xH&PXpASBy^+yX(3~x*
zhKD!5)nv-R=?+h4b6x~hK&{wrGjuuxpku=CtqvkcW{Q5dO0#B7XJ=Op@n}rMO=NAJ
zeGcWbC}WK^Sx*GMElB#LDx>NrN7$2Mqi=P1qB)Lk4jS#+LvO5z7&@fUX9waau8FK8
zB1-eI`vxD2%+ayL_{iQQ^?cm_mZ|4SixG>@=64?Uj5J7
zih(ZdeL3=&Ctzg}+)k$kK};2KLl(4j&uD+{*>IJ((5F${3fEUHz$Jnu3lq43SpFnZp|VPyv4*mi)Te|7aXW!^mISAh09`**&7{_6srGZm
z0=On2!QetiLqIwNrV$gp${`r&La6|C--1s6fkV2X#AK?>R@NrupzKcoXbH)m#Q2|A
z!r4SXgMgd}OH)EUH{R+n6!WIm5oaAe&wr2z4n%buMXjXs1iN(3H8VglD&1{IbW9?w
zDgh*!jnGq#8SmCUU=*FEAXJ^hcgk1HDrkrDn74B}%^LZ#<95$U0(hPbx||ubYXAeA
z-C*4&-cVh1()GG?4v0Yb0wg_tS6Q$lJEaK3uO)E0GGtr%P
zILA1jOR{z2RAJ5#lcHf19B=`H!B~kIlcVJ@_oe&ylIuRxD3y3f54$UnM_T&g&-6=i
z5Vx3}J_R`z570@`=WkInU2f3+WbkP&z3DN70+CbxptPI?cAbJK-4b|vhCR3iOf2~{ZM*pZL1@gFfj#Be!J!^yC5#Y0t74(MS~KCh
zTmH44He{veQa#){jD(C-X8U`)dYbpj3So7H8(cfvBKECxkb9vzhSWuZ;q$x4pSx+(
zKNp*-w}e09IF9Pt%Wzp5aMwa=a%mvvxQMgSl{Z6erLtj>wf0P}K$}XHXQv*^z=29W
zPzA2I=$B;8xQNkqI}fWN+~^jM23p1NW#3hm&h|Oz<#FhGCL%bBeI=|ii%pH=A_}bu
zHOgdb1`#_Xw3aurYQ-iY+0V>@Y#}mx1sT`l(8K}G;WXHBaeDWiY;;#2AojY8=`uCQ
z;t6OWo~BTWC})<{wwfQ(UM&*_nIsj|^3n}1Gz;kupKa3)Tt3mA30Qw>1%Fj)FoGme
zED2K;4`q!|-AaZ+J;2$eK0edYRQb}~y+U?OSh1>e9*cZQYGiS;Yt0oK?$tVjoiivE
z)74h&3cANslr_=IWwT5ZKDhtqVjJ9K*o_8>wU#cT&)f~(N8P2#<|JoolZ0EvHIBIq
z58Xz(FK)0vrI2Trhzas(3)cHiS*neGdXB$=u@-@%Eu!X@FubD@q6lq1`(!lQEYOm4
z8>(WwH>k=-HMUa{SXH1C4x~^7KMf(1?x@9ymy$fHTw4i9Bo@XqMus0`kTqHYpP&M6
zTixVg=%rGI-JCN?FQ^RvbjVOg8JV>WRQu{$%lTm2Y)$FCPLnnUq0nK}OAl@S9KL4R
z%s0p>fO(dPYLfJX^l3n{fH~aB#Xc*smU>6&R9LSy@l0skENg2bM4lf;QlPviq@t6f
z9XzY%1iZ&=)_rR=%5yzIHOMGOS+Q%(?qR96*4h#@k^*6=*8U*?H0IRd!4r>sT(Zr1
zssz>e&~8HXf>KS_Q3pL6sOo
zHaud$-AwP6TmdhDJF8A45*2gOC)%_a99B30Y8f45Pu0jX?K=NuToPOr!An~2-HDE?
znj6Nk7=w&sbTyMos?ouw1PC)mAzkCdwU7p2Zqgt{A?YW#FHGZTp<(hMO
z%6Z1eU#CW4u{xH;5Kc||jMK`)eK0A9c2ArVR@cSOgU?ki*3NA((EzjRXnBkDZLtlP
zNW)+bACpg<*V6(r)VwiLESxehxiG(*2WY1&-))!#)HpLTpSA4Xem#
z>sFab7cup->KJ-oP@v3Fl~sp&HRl+eroVPjacM_4qG}~#`CD9xvO0QF2X9ZRCGLjn
zD5X^LQn$rf&M;hPh1P-IpGs>b`ZfKKI;5>)h6930zX8`<8sHm7(U{JZ6S(%(`wc4$
zE-yccOAVoTL3^h%(3%JBY}x@^1SYNO)emaPQTqu&x@QIyk}^iMtj3`uO~`8w$Kovp
zE-Z5C6hP6+32)^Pusz`sv*0<8s2bVUs^}e7E4HG5TWeo%$qR$A7Pm%@UDk@&YDe5*
zqYuwpuKZWh3z$Dr%q%Zbi4eiaB(d{OC>mDc-se|8o{c=vIRFw*ZH)j
zPH21f?!AL{Xe1F_4X&l)ScN-+JP!LqXnQCvhzL29##)lRw*UzB=!|i5&rxqhWtWZM
z`*ab}6p*OS7_E;sl^&erBrfn`JcP^O2b|za{^f?I0J2$C^6#C#RGr2{C7t-(oZwEt
zF~=1rL2t)62u%-idR(yxgw(S$QFG~nWRlxq)mW0
zQ%2by2GPg~CZ4m!$>TkysaHfEm6bNB>)MnFUJY?PolZc=Q*N-D6&jl4yn8@Cg6uk#
zJKfMMwSjrg|BExVHaQ1)tgfsgyiMT273JcPe(E)>5fHIA&IT)TVRLu!=qrH5WzK(k
zO)=Wr{H*>`bw*?0H*?rvW$5tq1J_72CXwZL$}A=wF{!QKmNi_BM!-iW^3#oj7SS>+PF
z&*07`LP@2nWpk_w;Z6+{$|x6qC4P2>5}2it2OJ8;__hAFr~178yzA=;>L6!Kg|~wC
zs;{qr7Cv{%f1LQyS{~$4)!kLp+`o+otfe=NcjBsllB=9wrQ$v>)$I*G9
zvOF5Oaq0lW4T_SMaxKK3o)u-WJ+w%69eq?CM|UERZsV9ZJN@*N>s+|Dz9JBk3980J
zvy08HREOA9uVqxL8>!DGVwv?KRBl5R69a3-4kqN<+V%!UvAeMvO=sKDR9n6K;{ol-pk62%vEjoIh=p~L`2w<0hmhhk`ytNa
zcXDqFE)(ZbeZn+)DLOtY)w(Po)zD(Mf#1o}(Bm*{Az=`}T8tI@j{A=55-TKu2Ac0$
zvZ%v4vu<1J-3wJ+Qn$K5h`;c$QqEF+S`v`uhR8KFi3mOO0qD>P5ugp0=$gc9iU)~m=RR9B%2XgA`IRaL-R=s9JE}(
ze661D6y)umBIN@*XF{uP*dp_Rvu0A&i%#7hwiu2mMs=p0&B&YAki4GH(pElaZLW1<
ztS(OUOckoBP~h!o%^Jc0sybt_R*8TSMK6|7I3U$)A#ILgM1(?0W_8INi7wo0_7i+#
z69KhPCNc{IA!2Fff)QDjeR>gl?X}n1tHq!dr>bQaJ6S+i&5~20*BVw?m06uf=22ah
z*Sa3Zk=N@(KD@m?K0I8nkJrcJIO_4Su8+s{@$v23$A^dO^>}=Ic>L;kIF8J|7KFYv
z(R;;SYpo|w_mj)sd+)X4vM&L~3d4bYT#r2RQSUvol(kA~cVv^|z}a09QpmX!q{sZ!
zK(cf;O2N6&UFtW_Bc1D!@;Xw2EKW7nY9Sv3&@mXX1+u9TdvQfDtGySeAQVxf`07K&
znj`4X%B4u0l?cH`thjV1ps~#%OP-p{9l~I|`Xn}|{D4u2b?HtBznqj_xT>WRq$-&(
z9j7y^kK>4?{(IHQdLZf#THzj9VCFFhmAiB_)h){zg|P0?EKLFwZdQs|$j&w|Wk3O^UkL{GJ~6l9
zsv@Xas_tH$zzdCAk+qoNYRV8($CJl55WPZ5(O6W56P;@Zxp1i6jlbLT-1r-bs
zndyZK%Wfi;M$WvG25Dt^g4v3F!y_g*pE{mXS_&{?Ngg8}uX~6%0&Fr=jxppsg0PX()j_kZBcVrKwmYJqo_S{K=u51}zR$W<#oiHIGoQZ^360H73V-
zj_7}vMw4;QkujP2l!)i|R-q46qY`=CE)Rto!q?UB0{Bj6Uf*D-wGe?=P+GYbDDI?Z
zJ;Ir!%jdZ~$Ax$PkevR22IeXGUT!JdEcv;$Ne7WRbV(x*RH6!%=)>2eyH?(;|HeWD
zBmm%$=&t>VXk=kE%-fZ6S(qBrPZkHL0(elmXV`t=Fk6gihV>$b;eJ~q|``%d79S0?5s^~sgUL?<%m
z9nBIF^m;O0O65}eGwj_@`|
zU~dS;)2AI*y!{dnZ|3mPPH~g7uUsp+MvtTQ+3!Ati3xhJG5*uaRMwhpI}F7|Yak>s
zRO#s$t5<2sV4(_`Xdn}nsKlAZ4u|3!38FPom+w55xfm@=SDEGTqFd8vo~wfE_6chq
zBhO6eT&@k#%qMW;4^LD=nQakW=mZ0D{wBbMr6J3s2-2%z0L#%MFbf8^C9Ts$A)0eZ
zsChDtJdg+S>OawA)cxi=TiCF}Yz_Sdqomd)q(sd;@|t;l%*Ti0;Y~ig$v3Z$*RS4w
z_44hjmv3Kw@%oD|zWVazS6{yT>h)KTZ@zkX_2t{Q*Dnsd)hBLpUDjn^F6(mHm%Gcl
z$kFbO@Z96GkUp}mVX=e-(xhB42%Z{)U^Ht~5B+X}YVa}E@{xqLtUy+_9T8${&B0bR
z!?FXo{Xr=(iRjD@V~eL%Tc7d;)U*Vlx`e!UO8MShV8q@sIFPRm2$~h?Ji%%Ww5w_a
zq|0+POpa8d?D}DT%kEYFllELjeN-7~mZX&ee8MtBcVNW|Mzp+by+bWFDQ0ypY^CLN
zOWbJ{-D17M^mh#RRsdt|sx0>$DSPjPs>hyk3?MyLSG6u8yIOtbW!X!1qSbk$YJSRr
z8_j1{lN}rd3ZdxK8=xU
z#|pG7{)tg)=4jx?;%jwFZ`q>YMrvum&HfOfQdY~I{&N>B^EpwinQNRs!O;axd7O!n
zUc*up3+PW^1ySpwF~8|45dqq?l6bvInL0D~|9pW;kU5z!RjP;|D^mDl`
z)PvS}KG$}RB++b}nb%XprU!8LQRqv7(;`4+@SOE6dR6bzg;xMvE3?n;M=SLQJo6=y
zrT|Rgz7uf#)->>1n^hq~wCoKWmx^Ck7UT(8+Qk7u&(6S!ZxOL~l!*84(C{~b_m-Ck
zsM0k|Lt|ie7aClQO!tJ?+)%8$UzrLZ**~ro3$U?Rvo8B0E0MOgRZSO*l8FXUSSxG`
z=NORC$NOEKBTvzdh}dg&6NSLyiZVciwKke-?X@nK%W6=%^vry?zP)Bv=9}aCc)eb)
z*W);nKfA{3s(`O%l@Z!aLFW&#)y^lV8?~{+8fAq~~AAjS?N1xoi_tE9W`
zFVCJ|o<808Pe35gboRjGBOc!3;QG$c((nG$x%%t)}r5$4P(CQ6<8o;d#J`ebeDjrwV(P=%>!1SAyIjJL@V3ag(L}qy-2VVJP*mKrn=?b=fvNIIjLmP$!>EL
zOY-!9@#(@Vj^A{on>sGu{QVS-W*V)aXS#nU|u!alzK0c)&k6HH{HQ&l~Kfw$gIxJ
zqg*pk^*gIYEeav(Sgl^IhT&EvCrZvp7_tXrg|sITSP01|10a!uBI)J%lmzNHc^G6h
z!B{@%iN<26S+TljWGkgISwN}n*zd)HH-w~cb#xwjAdsI_STENu5y`cokqXKjOt7HW
zg3WN*LZ-Z<7u2n&?Dl%?TF%s`Joog0l1=>
znp~}HPMdHF4D7X(vqs3=LHW;eQk=$
zdF$n+d!BvDgzVfq2Pc$;|Lhf~t}q;MmN{%WU01dIAr?aiozPERvIH!2*MRNVmmH*O
z+#TljW}fgkTd4A~+jEM{4qDevvO9ypy#OW-4EHu+${k^)`M2dEc6k(UeW_C-@#J-z
zAKd>7so|_RSSG7mV`AoO1
z()^SnsIGhmH{cRGVbv6|_l4C*CDh$ccGaYJO;Y{7nTgD{U{x(r0Z=0`oeFZR*cO&E
zJ?HN#fZ*>oYmaGp_h&evHpWVyt8MweqJ|-tV4-vr%i^`$Fpk9Ud0tqv8!IRm)2u7H
zgFDvBJo+~Ga>{y=jH*;x*p^x=V~|;&<^JQfqtP#1u~5iLAOIP8jaN0Y3p+MuC3FL5
zHLrU;NT<;aa0Rc&0d0N;+V!!HcJB#v_k^@YX>O_=9j7}~Lml)Oy~De*tt?VVCadbQ
zc2Ah*kn{6f%1h5!B#<1Lk6jvs917k8l&Fs9+Lz$k`+^R}_U#0>9F?k%<2bS&uh+-N
z$G49UkH__>Bbtlra<`v8dGg}@_dfjay^lV5|7&0W@RP5-|KTT3-~agjgAecC`{4fh
zi@T>!FZcJcE=rAYB(9G*9&vrh$H#p0Cf|N}ynWM;kNx;|)s@E;d2}V~a2kgWWH;fl
z3Oy_bRGDxulI^uXsWBVCzK~>IE31}WB`LtW59Ek->(Cq~w$$1{9)en2xDr6|@v)Ah
zVxg{VVh6b(t1O;_1oRaPCZY+3W{{xKdoP;PXqoJ;DIAr^X3b=jMrExXD8l-D*+i(w
zv6KXD)-4+pTNyDNY8lW}9)K;8`5I}4sH7fvLO(O_ssXG8jVrbr`Z-qF
zMoaEgbdfB)Dm%8$9jYa$60wx%nnZOlpGr!nlj>z|LI_z(08bI}Cv#h={Hd!U!;LCi
ziB2tMHI)&5fmn1T(<0z9H%oSBXO{iu+to;yo52`taBT*AFBxkyvkK_E*?CnJG!4a*
z6xk)R0S#LR3}V6+AuUW*K{G!Di3Xgj=%8cAMzTa=bpnZc^8WrT*d
zb{;kWnfN}Cr%4k_bM=BWw?=Qh-H6e9k%7F*gWK?lfXg(dLJT!6=e(*u4juNxxcb#o
z;tp66*pn{|UK>WW(O8!tQQ4I#Crc7_w7{t&aU24kAUV25u)^e(%0-$rTZG1mX~Qk*
zb7a6@S%m9Y`jia-c@QB%2kY8g)53k?YV>YjN=Z^y|5zJDo2*v4=`f}R9O%_YUmv@G
zBfAfSBARsUJinb-OD3wV9v%rUJcV1XMb~6ZRW`{LKt!x%4L}dC;&?kS{Ymt@v7Fky
z89uzp-JRW;y$YUZS&Wj+vr3n>urIi5T<&@Qgm?G6e-=-l$J1x=?8SQi-hTFcKYzie
z&vE}0_fN1ED)I0Y9^c^2n|ky5`sJ68uUh+tqZ?4y)Gd-g1vi4qgm%F>Y?=H)sOEv8A*mZPibXJ!}Iavis5}BEK#1>15
z6+A7S!qe0}oyc^80;MPubd_{`Xs8$_jhtqqQlnLdg;GDj^q-Hc4`<8-VB|V%W-*)%
zmC2_Qd4|okx+q^+kW_I=7OSomXx_{-=)wlE!tTBNTc4O+tAdfz~&psMmxGZ=8
zRV}MJ+0iJ=g<-HmfU%yl&~r)SRN&59)}}Ge-Dq{+hy^@b8r@1TTG82V_EK<9vIfI-
z1y{&gz6(}RyMpL$&1lFzeOs(`%{r>ettm|nlIoMzS~t*T_Ua~U-TR_F)!l2l!r(V%m$Q~-7o$D0RS7><;5e>sa{{C|
z@XDH&U`!23G(WiimzqMDd0lI(fk&vQ0&$f*BmnerXna`<)?Ir|?3?b%Zd;{;x}&Mn
z#mP`Z(pxPMEk#7QqmazR+7}0GV+^s@Qau_=(5nHV*$LLclzZ8@;+*H3O1G>d589Q&
z*2!Jq;wC-MZE@A;oEoa!4A`_Rl-AaBS8AsLaNrP-B)Lp}I1eIap3%(+&v8|^wk)Ej
zv1Bp8J_h$vmLv){BC-yd*9Vu-eO1Py0B78hf{4t-7;CGx?8e=`==ro~c&Ils_KL3T
zMrBdsh+yG^lFzCe(n6;vw)y}UyL%*acB}?K9+`5<>w&dyrp3y-W66=rkaZib2D#Ly
zk?p5@#z(Y(mY8Xzq}wtXXWpdr9VE?tK~}&KvAR$iL@6(v26-ZXK}}JNz4qNDE|;~t
zQPoFXkG#HqeEat8!{ar(5!jb~e}Dh<*|TTQUp#yNqvs!g{QQ$|eDKjH&p-V5?xRoc
z-uv+W+4K9$z6)*<8CAGGqB5`7yk6`2SPyUO?VGwj^l@cfQ7Ji(n=(Lf$6C^Y4|tcT
z{TCf}@|5<_*oD
zmH#0L+&CzZB#)zo5tP%6mKB#iN0GwTOpCFJwD>?ZLspYmi*=Zj6!9pbkw#w+Muj@O
z8>x4wHZeJKWP@0jK(%p%MK+G3yAi>on!_C0-6EWUL)hXDTK3torJKZBMllrBW5L7}
zur>*1c6AxEK*t*VORq9O@Hkrhb~n1l(3Lo8-#Bx!3jP9|)U
zwcaPUDyqsu@^2I=fOB
zNA#hb53xPsl|(EYM`zmf2}5xUv1u{4I)ILmTuIL*_8yj=#+t$4#99Q{RS}5AF3lP>
zYFcGtc1-iDQEP>Dh?|gI&VrVZDH#wz9@Sl{XDhXx1;-QAV@F+EyjjGO9f10uyAZ2K
zXsNT(GQuW=$$1xRxGT^=b*&wBbfXxE5SkN(4$v8zNQG>M5d^t&aWMj&6`N=VqY6#0
zF0oa{YmO?JoHOz$xr9=R!Nu;rT-b%RT}48)!CA7BnINO9k3-TEcFHW25;tXLg#3!S
zvtt<@Rt&l9m0hS)H=%;S#`}tXYqOgyVsTyQ;pCFGWtWG3xkcsFugPyBwp*y;5^D##
zuzKBbt+j&df_1UDLz0A8uozCc%Pmg^y20MTb?M7JFZaB=$K4(F6Wra!)2HkH+2zTz
zefNZScereCoa2f&ZyvsS_4eiG4=+D^{N1N-e*3G}zy8I`Pe1+Qx4-`Ei_c%a`s&NK
zZ{NIq`zCqB!qdAaPcBdI@9wvlC}ehCkH_w;&g`R8d^?Zh$jVqUT`)Z4gdb?M#H=J^
zDZ_!N8ubR&U~+~%(b6-iDM~XM!~-ZFkS>(yMjcrreK3~C`RWtCD$Acp$oMlx;9<2U
zZ86&aWjg}V8AR&zyWQr&hsi=^BQwMTaZV`imFzaz#S$bmbQS5q8-
z63R5tR`Z#9gr%gB6qTz&%5Op7p|Qs);ORyeOe^6K%UzyY4C6-_TWQV06vz`{e^6Cw
z<6UGe6vExG(5z7UZv^g`%PqAchL}7HfaxwqO|Qv33>b=MlP;-K^GB<>V~w7|;6zZ7
z$I@Dr9x{@z>b>1yR;5lrRTxv{>*w?WtE!;B*0q)hlFI8~tE&Bd3b#gTnTTukc=N-j
z|5A;gT85$WwoWxKOQZ15;WQB<)_!2Jn0IwqDoT
zqX-{Wpewz>Gb5tvN`wr`;GV9I0J)_wF+vofg_U)nq~r>De(Akxy`r4E+xEr{_OvWihULEGtMmWvn1@y~;Iy;nc(d)BXy~;&F24)S9t&PY(Ldb;4#G
zQ~cTA5wRyyE&;T|mW=mWoLCg+ir!%G>3^
zIqJ(AMNR)+JD^i-(R#KNFKX_t%BTv!%7P{j%_&aeI6yEqE9>#v+Ob)}MsX|8+LB5w
zU?o_y5zslO$8sq+paUQr&nHheuvWZ7e|dZ@+VF}hwAdm0D(Aky-mID?^lmX85E$Cd
zz1AgUHXt15B(ANc999iJ4dD5j4dqo`J%|jT@#VqJK91Tu>VQoh3RsNj%HBKlq}1Yw
z(K@YVv;|`dRNa|v$))*B{pFmAM6>gdhYG61#>`3+3Ci
zdCm}Ndu1pd4YVww#=mv!C6$c>+yJTI=(k-S7!}oQDkB#TWSBHmmGf}5
zdTKPhtSr2{R#1I(Dh*O?bu)Gg1+Hi{9_c;K^oKrAs`=c|_=iK2T4mtx7pJ^DwzQWj
z9jEcZQPSwB@E0Hbr{|oD7{=fraG#;CL)T1`r?5pzPoKm*XSBIlU9{WChhtn`y4d$I
zw}x25<({fyK=OYM{8@8sA4jhhu~c?ZYIp-y&~)+J%U
z=`OWQRdtD&#Bo(6#y*p<9!rz}gUBgm2{RZ*9%uD&0*F9oJ)3sNK?|;0M0R#6OKBK#
za!=G^qxT{x!&h>da4t8zQ5Ik8qMFoDE*!P|MYO&OiorrX=s`>+Z`wL4k5YG8Raar{
zfQgD`a0m(6E}WmN2_I0bj<8LwTaRKebO1yjs_>)HS@!C;G$VXWlwczfm{sc{Hebq-
zmNO6=+=AMyeU`6b9pJLkzPhPw*9qaEpM4fM@DcAIugo~+CL+86H4%UwipZLAeb>SdJ!
z+Emq3T?U2u07PoBin7xC=9_58i{?8ScX{dn;{?w?>^5JX<_
z=FRoxXK!DA{`PmjdHB`OzWV9k{O-p;`ScgR_{C?x{@u&ZU%q{O+sOO7%l+la{r&yr
za@n!EtL*&Pm05k%p>|!;4m~_+0UNQ;wpfeZCduVa+$xluG%3JaPOCBU)rVSXO$;`O
z&N{T@Y}8$ynTT85BnLokFM&DE75&^mp+nhA6y1~TN+f8u!{uIgcU49pvrR?7^dr3a
z<^#O;^{0g0W2z}`zcLRQn!8-r%nk{=#=S*LE+En?M?-;8FUlgP7!k2DkM0chW9T#^
zU%w(+1uHO-C0kr)Sh_C&?O9rL`g+rmTzFR*+jy>h_Rbv#FVSrGRAcQln
zz4zXEJ+!WNY!F8tox*>++?83%^JHX0a0fIT63wYnbh^aK%(b>mgq%mJW=l1Oa8`K?
zEIN`i>haEpxYBQNMhCH>%ns9pdW
zGFF!AI`)oC(Pawr%?=b|p*yQg5uclolxwk9p#p(aF3vO5ilJs5vS{Gk>C04E`q8We
zJq1tV8IhC16oacv()trPL5bK|OIrVl^>z}82+4`Zb1z8w#f_QRQgYI>A(XZ)vg^oh
zEO`hku6RH5hDHcr?DN$ZjX=Sg)S1+=Qh@kT5GG@*55~I
z{gv@G$uL>RMU5zwRg&cZ=d~%o$(0+Hv>n`HQcA`#azK_BX!s-EaKCcR&2*cbB`wUAdlyv0{v
z;^pW4<;&}y$@*@Rh@Dzpt{Pej_m#SCM2#y4?`x4iOoH~jTfj}NT!v>%&
zAY>uW#I!+B{^;D4>x9bty`xHY=eS;rBZXkl^xI;pheV`M_i=5K>!KuEx8>Y(=vK5k
zkv5RG96=?*S!PQZ90A>3f-BHXxf#pg!-tPrDb@*Yh{>f*JG#Raj`x<$7?+;9ri!9G
zSc&p6T^oVOgN@P=UPniO7Z9uiSXdtAJR!W$K!tJnmJmAF-FfZ4a0MzwO_84b+}$qb
zJE>?6b{De-?Q7H(*aNB-s%u|J;<&=YbhKhMu(6OSj}{u+Rj#%|ZrA0&%cFc6#*8yX
zqYlJkEXwC*Z9>sf31zUe^T56%gGW|Z$L1{;E>$Ul{cmNP)MVZU0nVEOdr=~11z6kp
z#O7MeqY(oNY_S2{3spF-!$s$Ga2bw5&;EA30VPS4TTg7((V4X_Yaz=0@R+y@(!(k%
z&Pqo0YYXp3qc;kAyqNSBjZrJi6DCoIaeAM|>X_YOVZW1&2JFV%)d+?UL8a=1mYfIt
zbj*VdAEq5E)T+=Bp$Ee_)$(_2D;k`Js|w|IG0w%hc83T$c1pdBSdqt>t0Pn^Hexf6
z!Oe--G6w2UuvIAA(IwASEyV!TNfcGx8civ4qd;}9h?2@)ymy65%_de4*c*GQ#PbJJRS{Ii2pJcu
zQ+J&;Dl!cWb#c0*0i50MhAO1=QzcP>h^CuK5IX`q4)w3f45a}gI}m6bZ#!A8v_o=9
zVsUTA5?jNyxHk3$BqMrl?k#>6u?PmapWNeeX{5=xs=mI#o3HvepZ4|oSk=I>E`9$5
z&z{GN_xZuc`^9_v#rv0MFW&q1AHDa7KR^SSc=P7^yWf2E>tB5J^B=wZ$=`hXlfU`J
zFMj^%Z$JI?cc1_EdR$jL
zloBgwa#l^gPhbXXDMKY2XRi~<=$f40KVw{WcAql&inY3{3X4AUdl)Gg(xtqS089IW
z^pod^q25W;O-@Ww$Kkd~YCeLeL!94Xh(Ntmo&-xoWvb_*MRj&ZaA9>*Lx};1Dv-*C
z1hF(hO5ds5)ore|yK=349ES^6X?Q3mY$=GL`#27Cs%=$;-^mTg-to9~Ahx>(y72EReF8xug3w4P
zm7pjTA>ljaxs{!6gGET!;8|2p;Ox
zMXwp80YDpdPAvyZ*GQ@$(P%`hfEfdFS)>wSP_RQh#sEQx*p3&ZT>AXt-J;h
z&8n1gOXRTEvF6rt6Ue$AnJX?FNLCP3Aez25etbt7YW<$`+q?J{**5w4Q
z2G!OBaKC}#;KfHZB9v&X94eWh+@%~5O{N~sH`1^nG
z$3OVmx4-w^*T3=ngO8p+xxWXHiN{Agyuq8-`TDEl;WgfV)o)+(;f>iso#|^~lO60L
zJMzHwsJx=9*?nYPAG=E6U1wfD+Ov%Yj?BGcZB~{T3=Zff08~sx
zw>)@*(aJeS-mdHK;V$$?VmHx5Wu2;OANz9%({0rd$dzdvG{STaX_8j;^E-5SpZT#y
zpwk9Y4n-3%2F3GcLw9$cZR%(f6TZiJ5%X8`rW|S7YMQ~coR^#Zb!ZpVsQCALMY2N7
zVB0-swycSp6G*%&-}x6eg*F?AW#x8Fx1C$nWz1(bZ}-~dqRM0OIT*%>L;pq~
z%evLIIr*czG|_hXp3+WPi+g&76rs#SQ{7D2v1}=%S3JAbvsg8Hbu3;RvliMiymtmg
zo{`9m0MK38YkSq{PpgMFaEacYpxL!A;T7T?fVG_vOP(!pNspCipSg-6i&4-faU3~9
z5Dc3&7dK+8JSw&>$>~oG;onmmD_)45(yEYI6bsW%Bmip8C}R2t?UAM?g_9?DP#-;k
zi*nq2RESo90ikj4@C2HnvI&M_bw~7)kasaW$(6CWw?bZ4R%RauGAlEyimUJL@Z@Pc
zea`0}tQQ~b_dmXS{%k*aioH;cufBZv>^HA|^@}fl`lH|e_^&_x*^fT`)h|E&;^k*=
zUVmAgafxS7o<6z1f3lzKby=}1>sr?%HJVz7jK}0SP^(hxa`T};ymZI0SC;$EUCYH-
zVuc0=GQc7t)zaKOfX2Dxz15V`Ou>k?7P>PJGNuZJq|PKm-Tx=I!HJ4Pp#WZF#z4Ef
zE9)T1SaaNT&nV3)VdiXHxa@t+qhtWUegh(
zrD_t-2(A0@GLMN$JzZFsM^otW2x){(1Bzf{ohhO+H3?`-F1p>>6&@0Irlxd6(_3jf
zGDigD#bl`j&v&|Fu|q(xdN@sjOZ2NetV(06Vwut9R82vvRqa97=b?a_9`A;Z(R>+wIqwajAetkar+5yOF^n*H8@v(Z#La
z015D7>z!pKf-6*YXjYYj4NvgN;Rlz?MUuQmt#C^cJOT}Ct#rqNb1c>WwzGl)pKv%j
zrvcUWbGcjyW>pLsqFh1L@n!EaHfDS`D+#W+`0263=)Qpkd3lSxCE{|q+xxO2j)#2n
z`1;kGuO1&CyK#5_W~ee(5>zxnNNeCH3p{;ltR`0ek#|MjmwfAQ=&fQJXX`T}3R
zI==k;`0{1Gep%N?W=eO<9kEwjF5HWInNdHE&c{BEzFzzBp{@^gy-L&&eKZ6!17q;)
zT}VQ68zIs-Ch=jc9VpaM71O7YP4-$uvm~Kh?CLaYp$Jb90v~gXl&Z&RcGw9*9CHhJ
zbtO~XgUpc5o=38%(H*Q5!)MCUsW;f#1E6k2;}%4^Y7fdFk&tKwb&U9Sgq~r%(7A6I
zmt|%v2jNsj9-pAk2N2z{&Z~;v23#*3jqsi^HL)?1=&t?_vxTR}uU?Dt$
zk8&k(#C4h4ieRzi&~u7@<$`WF4FR_uLZFNBwQfkA&<@|Azy?Uc*b@((ltXu>pkGtR
z7EApU7h?@1q@0>|;u$Lsm6Uz1fyoo8<8no;%k)k)x_g=!b$uljMs}~j5=SZrHy4wj
zhJ|)Nd9sh}GcQq>VY?fnLqE^KD-!maRBa$ik%A2|a0S)PNZ%uMn=mlzlQ63yu(v8d
zsK#icMGZhFl1`LL(HEV0lrP82HAr&+x0AHXy`$V0dPzuWA(`98UY=_z?4ygq_&F66
zj7oH6aWSk+V~f`r((~rq
zn|8v?Jg$+O=zMOse_M4el%dtm?YgB0_?c7-@)o8sXRT+*!n~oeBKGp=YF3weWzmqh
z)D<uJp=McCf~`en@JJ$gi|QMr
zy;Vr2Jrw5;+n^z7kdD#s1W)5x3ekI8edB_SWYDclaG3xB@5{qj%08MPrNeg@pj;0C
zLw-GBq-}g@elBi4|WKge&0diefha&VG2Y3ft)S?UJf<_Q}vNX$LYM?p#
z;@76;eyug)3`M6U1-0W7fi5%0aEBVQs>%j_Q?Rp1Z0;RvW8ZOK;&Q()_j_N~S_q92
ztvasm_sPmU4n|$>`ss^!?}PRJ*X}<2H^2VL
zkAC&DpZxsO-~8&c&wp3_c-fcdPhLEK^5WT(Cwng-)aIIb&CHq+hOSrVNtI+geLKD3
z(KwZvjgmiQW^pj0SaO-GBNLY9blMiKOSrPp)H!a9^r|3Eg49sJJQ~U*FF|(zMyzJ9
zh{|k(iAmZBH)8bp-Bs5{t#vuEFukEOdSf*Ipd7?Cnb(H5Y9tiHbfjllLzt#p7qz40
zAe-r|UOBvthY0a%J~_|-rxB5+Y6QER&#dD}uvGmgLeCZ
zcYWKjRZQn7)nk=CY#NP}7Sf^2gqh-!9_M6dJ{79mz^qe$t=(1#gC9Nl=fs+a;&xW0
zRVBg2T8*khbQY>7e)_5?U_%4|~I7yb)nd7h5o>~Nxcm;|US#31oOXc`p>o$l@p5aLxutR)lH
z<~d!affY-g&_|}qA`*pOYvvX48|M1S5N2_a9{92@je2}|
zeD&td!^1-to;`c^@z*~7qd)%6AN{RweESbS`NntN|KuCb-hcnaj{Wv6UVnv`U*zY%
zdHn6KjyJFH_BHAVW~|M%xyZG+FBF#19y-^VeLQw$ABnumI)$h{js|)~wCLV&nvU#N
z_t$BU6i{5LQHf6o7B6tdHe>LER-agxF~x33Q2`IoHbkc4q-0VO<2-wQP0yJ;fM32N
zT+x1YGCjYS=^jg|%Y0dSO{EzRl9)Q%(A#BuDPsb~%xeu0C}E)wn!>(>_bG2AXIGIzctP6?xeq4nlJ8~Nbz?WRADw^?eWEu5
zKpDP!TBJy+;UC4TD^vwQXZeyr#|~$UeL_3qR_a98-()hx_H|NaQJsPB)SCXnRG<1h
z=azfCU#i+z=y^vCrR!p|eN;DOXQ+P`T;f=zv$o-$2$*RiDet$n-5yfiUAB}@
zu$ZOYv?!gnPzLCCGZ_~N$;BID1|n$W6FqjvFs29)OgY&Qm%AkcDx=g+2TqpTyJ+|*
zI7_0Nt8eFBgWZwL6op;bl&`
zx;x%ECtJN8U1;oBFxp~g7QIRV9F7~x+DctYg<`}K3k(j0X-XEDPR=ue!O~XD%XNRe
zD8U|akUrf9a|dL>CXtl4@&NI}7FJ1C>dn-RMaZQjBFf;Ju{jL7Q{_9dP?jkU;2?8{|^Z;9PUA1QanI-20B`{(QVd;5d0?GHY>d++_br%!Qr4-_8W
zK78@nm%seks~`XH*FXBNKmF;CfBEUJe)IB+&#NBxWj%lX;@OjDPw$@uRyVGB9Ijof
zJGqpyv-&WTZXnQceKN5mBUT*O!*(!qz$}OWT$Z-8{UExJJ{E(gS+_ZS$I|YOwa_^E
z)uj;(nd+*gO-M)$u+0SF*|Vy;H3b#!c-KdBoiSOjtOM@1K5?F^qpJ4WaMEAyT7(1z
zrQfYijNDfna+#b@7fT#)(HiODEe(n|1B&K}Vg`uuPwJMXbF8(Az8=SfEGNvPTEOr9
zr&Gz}`NbF!3JfD_mvyYY_O9$BuL^vo_$U*m>6216Vn`KWt+n-er*c-gXw{VfBS=p+
z_010a=FRK9HPb^-YLoCu0RN0Y{4`dp@SH1ld(-raB?7;v`x0H5MRzZ|fikPM*Aru{
zsH`TtEmE&+tg)j7vU11Rlb<}J&b}boS-m7qa>r5f#(;!ey
zFFUgbPVAaApy_4q)J4fqRT(T5t~BgQDfftqiEZ=`qX&b_JlU8yvE0ep0Fe(sW^t_u
zRB2o?;vFlJ_W7+7C`U}x%T|R>%LOVc3D?5f>p~*)5EH*hY2RHR`_yw`otAyijdbgL
zsS|oEZkux%qjEFok$HBZC5r|kjE+E#52D6W^zIy%T
zn>W|TxA%9?KK|%yfA)9(^iTfmyFd8*-~QeofAGz3zyIRJeFWaT!K*Lu^B-M*^NX*3
z{mbL^OI{y{4&(|j*1Efp7oyOK1RmeE`*H+zA3f)HqotaPMYo0DKM9mXp?$eu=svCo
zg7#vua{>W$qBXn)lT`%(aim&kaE%a9WwJDL1?Xa{?dOC&mJ1XRF5vyQ1fm8u2m=(vPI1Ww{xMs4d%
zb0sjFM~9;EJuwx+XNgL-ieXQXbQvnTKpD6@tksZp_6CPsl$^Fg=@2w1$Zs)5I;b=*
zk6IT}Ctr^ynV8QUuOHEXVU1~32N6ND+RzkEGGqkRN+UF&7Esr14>dg+b?3eu(!!1m
z4fNS*uC^)P@LWuHgW0_(#FM(0uC{wnYRDv@dugkCoR1b-&tcBEMKIz}Q=%&hSqMPI
ze>dnJPQO!vr+D}VCiwNkXS0fC3wW&oQ9??{w@eL(ZMy>%DgZQBAT1!ozzmx1#)-uQ
z(3)N8rK??R?R?Gm8ZK&rEEY!r+s+6>MpJTU=#~PO#9D06q=gy|z2$Y|?_3EQ5x}9%
zPijV8cNYri%J8fmYa_ZUJ(!@WVdn3~4xOo!i)KojriNgpaUP5zfY^JpdMXe_1$Aoi
z_Dpr;RX18nnuY-fL9|N7bDMK6nj>4v3h^8Z9PC#=oo1I((mT!Ea0PuHvv
zz_Bx|$SC#SG9*NtM9FJ_7^F!kL3ZpluK+XW4}%T%kRsq##J8mi-EQsL*f}#ma5}Cr
zY6vb;MX8>rBsOrAFh;=HlkHVFHFl-Op&e(DPolU14_z
z=5-Do-2=f02+$9lspGP~7(f|1o2P2>)21ms6~8ydz(xW*Mij0?YJ&U(<0;!|el@1W
zrMvo&<Uj=zcBRCD
ziit}Vg=NN>gLM{GY@IIUB*a1hSU4otf(A6Cy`a2|6u_yX0V#k@lYX^Xl$)`fa?9^0
zrhAh$hi_&zI#wp$n(G~bs=|sWsMYy^
z@9S^?6(~618CTR%<@&$a6XBKa15|a?5}XU&nD!D~kEd$HqBmDjo52B-<%wKuXO@6G0hDe-Z(~W
zPEe*~QWFMOAiTBK@O~IKIiUuOtb?&w0A)ArqG;fAtbGZ_UR#>b*N?AXz5Vj5H*c!=
z?C$wDzx~a>{dfN8AN{vK_&a~^o8SB6k3Rh9`M$@)TYUbz`pqvMKL2&U`mEl58E?PT
zIC8SNIZ=9UGYaF|Fe;Ek1tP&rOg
zGwyXv&p-I5hXnjR1W}&909@HO&z5?I2Kb)
zBC(Wl4~~FX@LZX;P{)nU>lOpg-n~+XEkWQ&!_11qv7*Q3M(udn*;%odTDW*yyW`+VsO*lWpi6gWl25ogiXC?nu?3skT)$yxC%WAXNsoU>G7
z`Cl>T9tS&-jJQ>`&Tj_l6s^)q0#Mw?a8ocwZo<pcZmtWGn~bVQ>8^qyoM=6Ios%GnHu#3qA_JSNrl8K>$^&3tnN
z>400I%W!L)slRHsxTxNpdLmOl05sJj9A|nsI+lQ!DQ0WX4yEDd(eW2yP%>S*W(`e(
zC9$xwD?5n}YRNZxh3<;jv8Z%pMTlyHyg_xG1Y-=rG=EPsdsG6+tB`S7
zE2=VrY-FO@m&=BSzD?+$`JY+qTK!IONe#B%?qA{Bd+Q9VQG7VuoUJ>D;|0$;XT@c2
zV#ivQ*Vk{~{OiY6Gc>5*azCm5NVsWvrJPsaJ-N;yV
zL;!8Q+`dE?^O}slTq3j8q2zhCQfSXG-qw24gA6PaQ-p9`bhqR*j_{|(&z421ngW-I
z>dqY6K-xDEQ!&zujFB1%fD~HEPWicV%O_&1D$dI83#GL?-Kybef
ztI#LVZr84{1Fc5SAh}!9GGj51TETGhnAs5m>Aa^&HSdL_syzp6P*i`rkSTDR^Te6o
zR)r)yG!-+qGY!?<;SrHC7=Y98_SRvNVV?NbVwLD(=Mybv$pHA(lg@H4ro0m##&Qa`LLVQPKp>|N#cm8
zbDxdQqYW#bE5S|JW1ZEgssh$>r<}$!VsKW~>S)}M4yA>zIl7wTMXYYsUMr>vRK`TH
z!dmFGgO{ie*CEz?F0-i`BP8728Bw1=XNcgH;#7>8pOOy5avtEt-wkRUu};iW{5Hv)
zwcOTxuC){@4DJL0&(77#vEx+mxE=)7ip&}uPsf;BU6gM5=`>_w*exrdcJL;4M5cys
z1Cx0SW->*aw+yMBVmv|Fo7Zi($6<7L>_7or@EnGd-_yMDHkOY;_QwxwFLqC76Wr6@
zXNTCFlxTg(soDWRtKv|q+p4?mGauPC{O!QV+5%c=ZltQLM9aTj1ta3N4V?w8h(kk4
zz02sbO_p-YN-D(-YNTyaXRPmN*`i;IEd~ngW}F^!#v*ZKuQeH{aX^snXFkt!r;?g1
z?T0^>;PNMK?8~L?qzIwIEelyQC!nUkC~~F;`RevDMR=Fmhvr0sOT@G7pMm3AjMbHD
z8Wj2vF;JJK8LdB5CKG$1yYgC%X*X;CCR}a=84-n}vZq6>jBhzE4YD9ufVu707(JWL)tQD-z>op@*tjHrBoX07^g;}3_MUin}AXm$A*#XpX*l=X+
zg+iVxVufsD&_+Vkw3S(w9Do{e?3ALFmmj@?!F9i4^Xap7|Lp#9x9^_qKp&5JeaN?O
zkL$Ir*Xz3DvuE+q*X}<4*5&Kpee&@)+5C8JF|MAa%`d|L@kAC)(
zUwrlE6<8lUfARe3v!_pcCOWtF-2J~9V`bdO$7G8E)dwbvzBRax0<
z?LN6>QoXEIRa4UFDCth&DIV>}s4RZ;>|X~L*{N<-btX9xspV;OR#^;jNHR1jBJ)^l
zuh==nw%*K&xcLC5-eb`=kwMn9Wf!`Fcc4=v*e$kwN?{F5$@7eye9WPtryQTuMB}s}
zaz@W^Ky^J;#WkZufEtwzp$RZmX0hag56tEc)5+nIep*0tc`%C4-`j1#5!Qy%D{
z)u{r60mnF@%I*$Eb{Vzr?&jVbL>?)wE~~0l{4WceN0A7$`15iHl(KC~=FK5m$TjNk
z$m76>i)Ji!bq^iakT^8fqV&B6R~X#g*)oEW(90Jf#15jtRSD@do$FD8DDNw-wZc{?
z5O@|0YnnjRFX$Z)4a%do@|!u)DA
z7;Di=*O+RADztFwx;O`r36UVW^Lh=&f_$EhcB3CIg*t;{K;oj<
zbQ&vmwXpnKt?2@mxpw7@cAVni7M%^dNVu+MJZIfr7^05F6;iWLh|q`ts5s-eYn~i%
z1IXr*xvLSOo`rEf8{sl81Ek;}tn6jb(m1sYVOc!kX)78&+BI;}X+_Z1ooIi@LLJ@9
zZ%pN5X;Px=K-1#`qfB`S1D=jXHY8KirlCE`)-`?OF@?W;r_eWsrA}oX=a2;C%q_pm
z`FsZfjw(48yGP6Dwc;#ala$1H@wuWS2a&m&37)Yj?d~DoR1;1h%PsYh$%mo#l?K
zSG~n&Wv;?cw_ujR5v403F~1AtaOl-t*cuCrh2yj-ntayClPQ`$U!fkya3E^c0ktD%
zD_WT>-)S&{d6ZMxLFbHEw4$q8btm>(*gq8PwAgV)mu3Y+!pqQR5tC@uiCiI_((VY5
z*F1m>&7$nG7YX>z#)l8f$u|7N&eKW@a>l}o<-%+>ony=Btz;mMHgW~PG&!s#IW&uX
z97n_=grrmz){0q#B0?vXy@e(R3CY%XY_hM%)xF=GvZT%qZ5cw&_v>~R`sf^0w?4MB
zL*wYmlbO0J(d{vayt}_#E^&9y%Vn<}WMuYn9FLFr_>kGas>?GxdyilL&i%Lk;OV!%
z`{ctb%I8m?zW?I=`?xgw@%nf@
zu17w0XJ(EKA*v1?PLnkHXah#lVoh8dnuVXgK@WFw4ffRMv{?Oi%dk_cUXS{y+-uiF
zhpIXgP9I;5K`}Hztt~)+ma%YwHM_=Xg;I_liG{DKCUNrhI26-=Sg_?ytJ%`_Lb3(Q
zLtnjOBUp8yosD6Zbq^IOa;o~YsvV*L263_vMFQJ83V<{|+U}r^#b9PurI{Q?RS|8t
z@C=r-h)GHba2$`M%$D5B2SQDuRe5@;R(XY+zpg5utzDI;_Pz`#S6fUHYNefnY-$0bJ
z5U`b&)H`@)@F4
z+s(5)fYlAYdwGcq&?BSVAbn;uCL`v$my2udgE2iaR@H=Ec?~-lS{PVMGQd71#5$(M
zmIIU(WElD)Io=y;#^8!ob`pdUQZ?NH)fHIpq=z7*x>WE>bRW0sfHTg8Qex@a(dVpK
z!pBipM69(gWUMZGLLPnm?&aq%Uw;|k*S_`#|Ks2JlYjKzfB*0PgKzxd_dkCBgZo-|
z^*R3fzdroxM~|QXs^7d~ACYf^48#(^{P399tSaQyCg-|T)khqU*^miM(R~hfBq8bQ
zTS3W-u^8tIGyQJgAu3&s)#`$l&DWWJ4)`+1Ye`gWUF@L#)g2XmdJE*I=#=1KG!FbJ4CRutH9;Rro2Yoc?7Cz
z?U*q|Dj-fxBYLVa9l)6dVnRtyb1@4hn|jlEfgYOWcu
zF@;G3n&MN!aU4+uP!XM-m8Hph5i8K;en3+F&+}!n7p7=!7#E;HIMAwozNS&Fi`XnXLse+gyMV?>h4
zu{G^jb;8;HF#8ab(sBi}(-&tf1@pp%C<3Bk4SsTHbDcP`*El_BA1X(gqDQC*qbt3z
zwf`nc1gf)7Z^;3aY}Ny;DHGTZ>?JKlWv`ZGjrX(
zB8jRS70Isg%aTLR8iL&ug($hlGO?w{Ys#~_ES3>2hQHSm}s*Zd^cUfVjg
z20OAI-yX+nbiZAfEtf3rh=?c8?t(1TapbGt9It-+=7)d&=E;kA@8k8Y@7;apdr!ad
z?GOIo2Os>ifA#&}{Nf+|_&K+5R_qm)*dTAu3IID5pT4V?1A
z;et4K=Y)10^$HQ39mDLg=o#NGvs<{e=@H>kvAFSy?(P=2RA)!Cg*IM+FdGN}<4UH?
z(QwAVf1z^2sVy+=EwiJYeraFHyTJEc%A|O>9U!I&LuhN;sEA8$?UVXDfLl>tlRKb&
zf&yoAgXkY2wk$3#+#tfz9$6iTp2M^aI-nP}@d6Ryj&J3vm7Qg?WNjT6-Et=4(jKWU
zT0G@PiQC-Qo3w!>r79mtGY|)c694%5zlPmGz%f47s_OC3&@+Y8IEnjh5KlnE6SLcq2g#52k
zdgIoauK=gZ0!W$J(qkNYoV~P%*qx0QzluhpyK5m--5FovBpD^rlKw`YZ+#|hfFZ-Z
z?Hdk?r6rA&z%4FkJ2GcXqK^WotYQm#&l#fAbEfyX1m-S;lgZQvv9?o;mH`8HY?ZcE
za<^8wq3+XmI5u>O#RWi{vr1DOl@=339Tj^`BHn~L1Swp?W@QAqdU&9S1q~35Fzm_|
zL~wNiEUws>yS>&53F_+Ya{^_6n-~QPjeE$bufA+zC
zc*N(w#V>#I_Lo0<{OzxByatm|n;^OBs3TDadMISmVuRd!trghK(QZK{Z2M%!ZRQ6#
z{aTK&ExD3z&$=LVks6ZWpio_%kVC_9&8l9(Ge^<}E~D>=xjrA*G#4*wb6FQJg<=Ts=ar&M5{D?5=hd5*H?By^<
zBLDCk@j!(?Yek(-mN%U9$f?sXDYvsX9S3uw2)vL_h<5qmD-6e0l=7I9)7o0ED>uq9P5U@v|8tpE7
zt2Y9-T?{sB%!+#oI)W+wsoXWx08eT09ClR@u%iF0#me&bTZExyqaj=;$`z2WF9A0S
z;%w&0Dk+vn{SVWVe%}f=J&#K%xK>+VACJA3LdDd0@&l{JWJB;d6$r&*Kik{G^9i+P
zrfXMqdPss4&dtv3#WPYUMOBeX(mn+=e+Z0U{Xi8ULhcw!ymW1Phg&&Z1HwaV$4hYv{JvJzk-@e1JVBL%UOP&NFj*tl8U~nFZLG0xo69(XL6sct
zz-LoU$ZKsq+5xKMXjlULf&@bjuJI0bsjGz}9F$L+N>Y|36^SmqS~~U_1Qci5%fU=J
zEgN$_-7w8bti1pvuvgaL@~#@NujJ&c5PMeco;4#`-sZG7PjdpD<6)vC0+(NlLq{7v
z@m>1@Z#(*w9`reuNtL_Uad(YlcoQ{N33D?_=Y!q2CnHv)P#tSdD9ocasD|JIp;?jM
zeM;WC1|U?)Tmi;j!zP}URV^PAI<`BHtip=bRI`CX=Ap6Z)jeJbQ~gFuVIq{yFn`Ed
z+K0QU*gTFRItvRR_g?#c-#@*Ji`ks(wH~h5qw2Ej!*ASu?VESs{gY?k`p)IWd&nz3
z`}M2;_!po4+kf+;zxelm^|PP+=*yR%bFUXqo`3M-`Chxh$Lqu6am~Dfs5~YGagC(@
zj!7wWI5yC+BJ1$wo8@$BB*`akhoN4|93*b|;t*y{d!YQ@OwFK4Jf-DYCL9${P1DgC
zbCjH%Ypjs6+Oc0^L&h%p2jyHqs%>NvlOA!?5WlK*N2$T_$>_{^mF$L<^ytc?2TMM!
z{(L*?=uiSNzYBv|V`oEEDV%Cc=Z2E>QrIc$;9AXy>N4|c1*=n4*cxFGx-pokMFS4!
z$UaC0R(1NBQH@b`9J$ttSmWV52&KcQiR*~nD6iIr-m=D32AF+Jjd|kokn%#2t!^(A
zdi(QTZm!nn^5bX!>Ne!&ObDHWw$!b|J@^3bN)ks^aIJ7_og6G+E&2i~E4!&0lAJt_
zKC6_7EB?mX-Q9gub*#%CsNUKN+1!ov;>d%Hy%s=OkgpX)U-K{y9
zbtC|Cv}d?eMoG03O$zuSqR`9Kk=k7pNad$0FvYQSxXD&#tRz)c@s7>$bivGSJ&#Yl
zLaTa&&U9#QqLTa-<{e~)A$WUE+=3esdM<7SqbKv++;E5mgd@aqJVhBS4C!_}3z0;G
zJha?sTbT1Oh^EnS07BcG*g4$nwd!n}(en=@nR=4}Axbp888Uy1SaElM+3RxIyDP8P
z$CqDy`SSJW*UYE)AAa{c-}^`ZtRm}W5}FU#Kqbx!
z$^Ki_)hysNMm$r-lQ`uXw*Z$Qt<^t9pSm`!Yp>;Lzn3g^bVGJqc^nZX^
z^3)Cp0F|K}47%A;>YdC|LWi0{i9}OQZ?Vwh)YvWk`g9hhpGXaHH#sq>(y`h!
z^hz|>n$3{TaTW)`#94t1;0tH_Ye$^oOy0V}TwQlJdhdXF
z79(u26uwQK0Eop(MUQ#5$_@$>@ziT-hT4Bw4Nw!pCyPe|O4BD?=)HHROMA{#5`Tm)
zeyEpJ;iNJ3!qN@=LV?!!gvK6LaprG1L3A?R?{v1K3Wr5dkc4k^#VRZ-t3jUUXlqo9
z#&I>USgEMAsFHaT-cp1sik@+eDjVAH0U35}!MXj;gQ+hTae!h!I53#QP9f1q-yl@Ji!{R
zOGTSJMX*&Xqye=RMb9b@I<1^Es*Vf<
z;cLQ_`*xt80yPwS4Xo*1$hxEZCLq_51$Bo`+utl*h|wEsBW*p2V8Rnh;Bm@S4&DHy
zM?EJnw~Rt|?5?_I+VM>MsHu%nBeQL-0v#~Wknu*ZEk%g
z0NxF?o+&!jj8N)wu(UAIelc}QxZOeRPKw!`(kgpX=dF}5DqRDd%)(@kOyE2pNByr1EX86V>jz9=ie@_{N8*orX2e0kMlznzN?^XSW1SPV{2@|{8Xc=
zwg;gj#32GBZF11yO;_<4WqWaX^-G(SjcRrVbI!`SD4n
z;AMbaJ|JWojBCJwsr+_vJH#bV2zIAJ=ZHCqpFI6n-4Rtt@WaC+eu@
z@}brSaaTlkxxDPEsuh=$gK6jZQ~I_XhIco!u5hZi{roU(a3f(|jH8drTx(0~Be*AA
zPp1892-@anxf>r2uhp~s+%za8I08|M`vk!;za@zkd)d3wqAr!P1CoW8AjU;x+Ej+9
z>8@UJF}Dyh$}#vHV<@_ON^3_?M<0x#R$;FT*+(9jy%-E9jA#9?0l6d)f#72G0hgwR
z42f7~#u%24RW}wFW6&u}UC*Wat2JezlID}$4F%2s~
zxIo!O^;&DizP~)#`?4?VczFEs^{dZbefD^LyzHmn`t~>f?C*X5zx^Nn^zZ(|Z+`1L
zA2jjBXZX>7dHBU&_ZPnb3M+6~DvINHtjD+c@VYYLDM}dAYJH!I1cj&h6K78_ARQiF
zH;JdxXLaApi9NKQjPh_mj%F_@PpTOm%ehsb)r%t|v#PQegQG`lmwucS*7;L-z?NfD
zh;pBufdyY?pRemyO6V8W7*9aR{D{gRQQzJ~pk@DNn9vVNa=ad~kCViptqQDWn!944
zx-Ef;3Cv2_bWso`)I$bLJBgSs^qABm!R0{?dJd^MB0U-#JtC>BV1AY-es7^2{4EU^
z@Bv{fT^4JVR){Uu#IAKFc-AvGmxuMPo)y-v&s77s5S-zIwAjK$D}|`@ZrO@2r!PQu4y&
z>=IH298yXN>ZF0<^C7$=F4Wru$2-rfX#@gwj==S@!C7LpWq2m=38hCm#M?)?zF)rg
z)u@iG)I=4RkL3s;dgdwU^c`*1+@HARJZ63Klo&usw3^hQxoCFrJxhL=Cv|4VN^Om@
zZ7D61Z8Zd*yDFxv^U9i`U$h02duQ6_+j@g~Q$kW0tal1>c%99m#L3*>G22iU1{aXM
z1mf#`p999th&Lq{SJ7)kVdjL!O}|%ps#XOu(O6#@LOQ|0VF*UF+9zU!S2I!eY
zPelb(#+M(V978dSq(|Eku7~|BCcEf!XP-db0CQ1=TOR5x6gre+dlMNLl1*{Dx|#_E
zzPhxBSWh|HQ@sFgKL9dlXag~`-yIGd4+y(umzGI4&SIlP
z+`|Xh{gbmZWh_;KO%FZa$OYMk(gA8(&LH7!e1BI3C9zm>u0ib8IrV0BNFbNHO#fGBmSYg0HLouMCN;!_%OF#}cn{5Tla*<7o*X`?rE!z1mO5Z@hOM47We$!rCh_B^
z|4QAY%HgZUd`>7iTW%6uoa(>3dfCP%Z4jYeCaU$80FTT?#M*}3M?<&QQqzS39KGxk
zjkR_FhbN;rKag%!Yccac<8s-jUW0b>L^$2Fx3!>^9$(U9BnOuJ%7P^nC4yvjmdtf&
zBX2=3YwzH4VLYARdh7}u5aHOP)v4Q2H>sNRy2{abRu>G)raNMv5NVa91d&Jb447DE
z&nIKAQU;GSS$E6uB$H5C*cwb3A%dv7c5ITTJh`f?G8Pxtth1&P?+AoE$tOJt)k3|v
z$f)XlxeK!DsKScPuqK+l_GWkIVc%nbogHfhBN$mSyp6Ti+Ux0)XM1l{y?*odi&tN~
z{OZ-_-8a7Rtv~&Hf9oIp_kaBN|H(JM`HfHZUY~!4U;OCdXFoh%{WgxrSd4|ZTv*+i
z_4ZBH(V2~ehFfxxr&g^sm{Fxp%sI*!03r5r+U;O~b-}5#h!yC5e8>j(hJ`M+5bLFY
zz5K!(y#m!(?ugX^1)jK##0zB?P#IfE;|h6qmtYM4U7^E;-pzo{)y2|#kuU=aKY1v;
zAg$h13_iyOKnxNw>r}C*MhbDx>R2}?*zS&ymcWgCrV*i7SoDNMs>m7kCfY4k>da+V
z$Hhs#(j)0TPTN(&b?}##hD%s_%VgFDK4!Pxf+6i-JzXOb~obm95zXX
zTsDY0s$uPei_|c+*Jm^Jl*GPe3sS}DwTZZ4`y)oXNUuP(LM-L7h1gS;m2q#P
zE9*F{@Gp%Q_WP6UM4xGo0pFLKCeEyAmJMA%*3kslg)Q&gF>8`djt-if>P7q~Kx2{V
zt)&vQvLo6wT@2OTbArzII)LT8Y>sqywEi6CK+(+0qtMm8L@IWOU4%e?bMFwQyE(cPB%!|SKABjgmV{^WUZh1kpg*Z{FsxU_Ye<5%qOIvRmkkf15n
zWF-yCVqK=aWRQifJln;mH03BKC#1BbZdGlQIhT@t-Ded*S7{n2)>VzBJb1mdlvOn4
zZs4V2t3SQ{a%ws(FUSUxG`?j+qTr5j1$#HBRgd1f6Vm{#xUu*z(@43Qr#UoHTxFiEjLv_bqH26
z;~sspX4OX(Aa#sD*Ll*C<1GYN`}+$``}Yxut`h9tSzSl3wZOg}S9U}!8CCY+t!hHJ
z@jwNzKs(TkAkF;B-o*G(X|v{0Lru%}%sX@>ep=qPxxRaPcXz)pPuJbEP4ejLiHsuVBpGg`zH3@>*$6Zs;f^4iR&Fyb*d@P$pE1VhB8W%MAO)q>W)sWQjEabzl%nv
z^>hNSdJc+GO9Gd*03u~;xfvQ=N4bwzY1po+tlVo6xE@EWCBz}~X!K=ml80@vFeSES
z(mF8X7Eq&+>ZHi5${ec9`rc}+wKG%4_KM}k>04FBnNTBBL{M%)pFIDc(9xYF7+VR!
z6wrWL`Pa%!MqKu#s;!CDqiZoXYXj6b5=G#$FK8ZF18lS&bYQAC9YIk3W0Ory9R7VWCDvYR?IRB@
zu^s!UTr2X>$w2^_NpQs`-DD3?(`93=%f5U1g5+-eQ|xr_uu>YZ~vXY
z^-uqwfA_!pzkmCWe(=fN-TvM0@T33o@YDZNzxf%CN3!FxxOV`!KIHYWua8na6gx8Thz8E!T!$xUM%^HWvy3NN1^M5gQ5^IFq6NTaudpPZ$~X&v7htNl)y
z=HovsEjiVTv8GE5w-VQ=;|TtZ1eXZe!Ci;rX}3nt0q-n|loQ7CHme3(O@OCx3nc5>
zr1cy(&9PZvnQq)@bAgc)Rs8ivhh#LSl02pM1+2Ttp$Nv(eGJ_Nm4dPbfJ96`E2
z#HtR3BsinK-L;p+T&D8d$w-JZ82R*_U)5iVPIW?Q#@JsMQy9JTEw(Jtl9-cqHn0=N
z^Qh%Hk3}70=d8)|rw7%aD!5CL!RicP2p`>`PIh~f=zRByF$Ixw{on~3zmw5oo|Fok
z*-q*<^@qcUM7AFyVG5|b3RS&BX68M5NGEo&<96#j--*f{IcBvpd%Sa9R9=2A3kz{M
zZ)()QaBA(28DX+@9MvPyJd+ncSC@{?P%y@uq(#J?=h5la)2C1Z(-v#0fnG2t6wnhK
z=AfjNg*e}WdDS{a(S8elJj!;I!q>ac3%Cg;X4mwr4k!G^j!Wxj;s^TnnzdJS=$m$#
z3TFyo?~V2qw`z9atisvnsYO)xqIb*~ht1;}xybzNZMpS)^L)K0MyMhxx1D2>-q{f7
zckcU^wN&1u?Uk0g$&VM4j8|1SRyR&|0RD5FIcRmJdm(t1N%OTrRnE{ey~Jq436cu=
z9dVu&hsE^6)Uj3PPY%|8!ksaX%&+Da>jd2x$`6YgT55Z+)h^UJpKo#`IC?ed!&-0D
zAKOab#>R?sGnU8<)vg*OfSMtep-R?gKWC2Y#FDwSk=(+7g9akI&s?V%&-$bq#NOd8
z1Qp~0{rKM{JUTL|Ng&!{lES%|KV?b_}6dyi@W>FhtJ=?-%n!2kw?}szPrg4evat9)*-_~
zNY3RHpXxq~kfvHwDyR$q>@HQpD&2xCXztV5MrYMm!H9!g9t3*Iy1D8+7A8gt`=)wd
zrM}6V)i+W8xT-$gVFp5L0Of9`*_p;_-#Or<28lUc9kD%krvr;r$yXdc)|epCEgJ+K
z($lLP?;N<(4!_o7vsqaO-W_NP%)YGZq%sZdQU)4T2^1NvWCiVkU=c(gbu^mItO|0k
z-RR6iM|3lRF#rROJT%5fFF<8mSkUX?SmmK5500EJ^QY$^n3E_GJZ9e)UDfk;gbkw@~q}1QD@OlyR_^4Q21trw0cZdTd&2
zS!HlYUIW@g`bP)O?&ji(n1H29kK%V3J_6$m4!nhLp0Tj3DRghWGT>QE2JlV)DdI-V
zJSw+ZuDBR-DnF>+SIN_{GeYpsYb-@eYLC4q!7
zRWy3Q73$YlkVK{*9YCnPA_8_Sh|6AG-GvUIu-2ZmRfkNhwcF`H?91KV<^IY29l9SL
z9zT2a^7Wf9?=DaO;1B-rAOGV&{U85d-}{IE_?zGS!)I?F@Z%rmfBd(vfA&}S^7BCM
z1sOu4QP;OsnsP9LG#OgRg|)l6QHKwqIekD5xy`8tnsKogfap7r>q0SuYoXA`W3ClJ
zW(v}AVWf#!5u7OkAZP>F;n^^uL`l)Kmb+?k@@<)bbOeP_8NpQ>fX>DW8+JHI4iRC<
z0X_!laUk|EaEdtDRh8&mB^qe7L<#db)5t@=Zh~c2L0eOKjbdWyH;hTS8nZvJ;hoc%
z^xS=CTox`698yRPlYQbWF65llJ8P%pXD&LrrolwrQy6{b$()>E8LUA%pJ`7g3uv4`
zcSfk6R;k=D$?b|2E|0a7vl%YhTUvc9N{p5Al&Of)CrF5Z2?Zi!@0hkXWyFJ_o~Ehq
z6a|xB%i5aIqqCIGx#j8g;B-R#n;T#C7v2k}NEo!q$_djtt0IG@+*~O%DpQm6l&_m4sC-S+)CEA%EN!2J&BH*ktv(UO84{0x@-AmxGfG5D_3%$xGtt#(1~M=rvPvXliJh*j0CG
z%J$gtzfIi(T-+-(W?rvD*{u<}J`2}2O)%>Kgv|5LYKw8TW7|V@Ibx->H=s)MP~%H$?ZL;}&kGQEDM<-B^`4EdX|O
zFJMn*({f!kq;={A;SB&7W3dFF6pAK7o%f4YCz6(^9F_GtW}LEI^mV3-5K}Cho(GqHQlJyXdUxY?<;fbLIKI9#`k5X&tkg!AZ0^c@;Vl)
zuj7{8o`EryotI@?;+Cn&*r|D34_+dXcTX>u%f5TMo__FTEgr|?!`r;Rt!MA8Prer4
z{{EBie*gIgAM<#?&wlvX|MqWw@^AjWH7y1pZI4Re$Q*@^*hZW=Qo+8Vni(5pkg2v^<-k>9u(aSgN**gI
z|h!e2dZ$&Svz=Kf~7~N1h|PxSYM2u~G2XilxDiP~g<&
z=x)SX0cItv*)AWO{?2C0UP}yNNov4F*WMk$s*DxYWtL0tuF^?(RoEY!Mc5Ro
zl#XDw9?sm4Y-;?h6or~a^2xLRsU=53=aI7FDG&UtbGK@&EfL3YC1bDca5j^NMspNm8i5zd)r4BLslq
zP6IrK>D<_Fy321xKwoe>_6H@i9k4((eo4S_O^6P~MLfLO$mkloAF7aoK9No=zl
zM4bsuN369-#N%>|nz62dP9@m%GsM!ipk}eU5k0n2KuVXD-RejJ>4do3VmzJu;Zy^C
zf)qaFBn02k38x#Ch#m$b>d?QRbR|=yi1*dAHF{Fb%a=nR6VFjnHPbKqt2DtJu
z|E4UqHRFVnl?mZf-VJ>wmGrs5o44e;!K?bD0riYW&#SszslJFFV;GJtF6tT>gj3ou
z?Ofxgm}lkfuLxmr{ycw$Dx7!ihie={Emcmo=y%IGmUQ?wr*oxm4;$zD38!wpHrHQ0
zrN;cm8LKf&?+pr>Rj4t=^B-FV8$)$h(s|QDG-%vLSL|7p6Y4ElF;RJz>a!Imle2np
z&gSzSwJP7+h3gvpKyT6*oU0P>wC9$Vr04vn!g+Ln))1WFwy&n|_@$}=K
z{4|3mr(^OYt}zNc9fV`x0>n;`;IC-XDt$Li;)^fDy{>&u>+lbx?H5zUCI`zY|I
zockmfga^lK7q_KoAYAC`Zb9R|`m&nx(x2v!nS>>7wbTZ;g3t$j8H*yuh*+k8j^(iJ3Z6tP>l;LvHg!_{C(0%pdI-nqW>b^tLA+a?~7lRdXAN
zLs1+W)FsFCPJE)+H53BFbqq3jbZm~;2o1*A(e#?^LrLoR?enMM(QE>y=}X$<$TpLD
zCmMIp;$l_1)!@yO|ZDv;}x?D
zMHf
zKK-4i@BHp3-}m`vPha5UZ#?|^FMa7}|MqYF;xGNmSHJpC)9&AY_Tt&y^X+s~U5(7l
zJ@@K8rsGOc09S9Y^kTB^?&WLdN2(fGySr>Vvt<8yfHMxe(sGvJEW2F&OsHE`IWd{j
z_WZkzhKIX(b&`E>GaQqpjPyJkjjVmIU5gTQ_0ihQ>D^U3wO(eL5EL#kZfa7w!S1*F
z=-sO@;13F2&G4Vc-JEk|lL`oS1YM`yRozEj!#_0ymH1XFjd}9DfbP+m4?)sqVcu0~
z#fiioY&wfhYt|}?WQAK-V&cB=V%HcPP@fpNCu6}{3+U=>gB>cBYIl{pQ$+|txYJtF
ztBZsY2SZd(_3<8(H5z?A?9)>2Hl~nG{D>Y6FjZbnR}wSFH#$%Peq{0bR$!&kMMFVX-TGBvwm6qZ;-gu$}1t0UZiI%aWLKnh%b{?hZeAA&#W*bkq7!S>(~M4hH%zX)Ek=aA<2)jBdZ%YosL%t>Bs^=t
zua;)|wF3-5h?7~5TukAina_yWGY!5r&%Hf@j65vD7xk`{90NkcX~nkPY`O2R-n{wb
z)hDsG&wa;t{h2@egFpHgKmQ|t`g0$A_U8TpzxP`Yzy0gyuYIY`uh#zHD(t=Mfw!my
zdda25(STBr>YDRc9JluDKDsf3Ck~OQtuVv!a{#lojMh{10NnRJMozlgJS3>Arhk&T
z$WC_~OGIr7>8$JmY&`5_mx}?p3=e9yI65&72N>LR5Omi{nBp`gf4a6zKZ@2~hrFaQ
z-HbWG)tUjTYT6(l&}e@82&@Pf^nZ`yia%A;S<#4r+2(A@;1kAekRT!VEYuU(*
z+5_+<`2(dSc6`!nkzs&VfQky_8wcihb+@57Wgtv-Bu$u9h$hw392Gt|IYtuLnx>$w
zX^CkzxL@z2rewAMzf*9H&c{EX^sJ>5ZuDfwJ`g(3Q={n8e6Rp|u%@P!JeKtpNNgyC
zPc3j%GKN;+O4*)tVogP*VC0PZ0vPLN&X!2z)>dE+m87y;Q+e!o^K%_nLjjphuxUme
z-=(+_r#S$BeM)K`T%Q{VF9w=}Sa!~wPO|~t^BmNz5PvmH@f;8Ck?coD>G)j@7}|9*U51_0t<%|{JOr0+N$FwZ!@Kjo@B1ZRydR(YzPr!=(96$$$0;B1kH7fkpZ~kR^Y?!47k>Aj{MNZI
zFP^`6`SjV%=_V`p%)KrVwqGukL+(W@7K*#A)CXs~+1$*W-7|K`+uTxGg)(3lI_*)7
zs%XmVWRR4iykWAYn>$XBKg;2=yCPQiys{D9f{l&V)V?0|Fc}O+Ky^{Mz2-!5_wo)-
z^lNxEDKHLS#JxnFWSJ#Ao|Z_XOwAn&kE7wh$XA_aw8iJW77z9K_;EV=itXAA#pTFV
zeE`BHL<5s%O`YEcpbXs7&5Ex?N$bya&*}q$pf>5-_a@J0T6NP^)k*n<&m3GI9Fp3T
zUd=}9bg(&^3**w6EQLaihscb!=exI?ieApL{xvRE-SZM|4N-tTelNohm~oeedr~uL
z?rxbG9yJYLAdJ24rloDo@-fzFs-2BDTs*>&w}NnD`iS}1^7jaiE7p-`x?2s#!T8+J
zvOL1QayA4C^@v@=Bt*uY=AfJnMo}a&wfDKV0u~-)|AlUu_cPcED}s|MtkQH<7(%w9LT@wm5Xk4s8<@@_|%oj99j=
zZgw@WJ+PdPyGsMFDgwgs;Ft}+f|#ssa9Mn~`y4Ez_q|j88o_osrp-ENl5bkb0i{7!
zQ$I|jYpCj?(xNeYOL!$m9t9${zLu;|+`~xx2e<9`3Z&fJizB;kAD)QDF2!(F}6Mv
zvsFvPJ-ghP8;|}O(8aVob+u6H;WRD`so>(HWSJs)z_I`?4{=R;x)un1B<-VbtkW`L
zV_kcjH^>inl*2kLIB$A!l~?ujSPe?z*4-m(oXetDq>Dd){)m3_*eDr8+2HfZNQF7TbyP=?z7yB8
z%Q#asu)_!jR3{&;hWX=U1HEc;juU&Rv?8mj{?J!y4`cWrv^!1Z9k~^|+
zL_GKulruXq4L%i@e5LIM)aYpFv2-BG`ISfU$>&#@if+?*m`5jkGKmb6$e7Tlz@2b)
zkRxL^W7q39k#_d&>6bWn6N^Ok(Y@C3TLjRqQD%;!$PxhH$hR&@E0d@MY_V?qoJ08Z
z5soIBdNTil%D=E+U0s68Lf
zmv;~6C(qYszvJ|UAAa#Y-}hu~_`QGfji3MNfATYb_gDV$Z~xZY`;VVLd-nXvvnO{?
zx-xs;^Rn-ktR2)f@^Tdc$Q>lJ$
z&kUHki>7n&6J}f-m@+G!QVr@eky!1jy{*Fo@T#0)o`yzyoLPx9V8rI|(h?e<5ObVV
zlj@_%r;&fBtV?&BkPWavAm&(3!s)4g3xzoW{6prpbmF@(J0tYxxn4M7Hp9It1!3mq
zRZWZLo{OqWp&(%`lL&Mt9}cDGbgDMv<|kCARmWOApVp@5!cSIeoTQ
z$qlUv`6$PMW1`h;Yg(ONK(C8mR23Dgf8W+xRVH(8>uqRwr&PJ6u-3T7M*5I1U920hl`}d?>lE
zC>
z_!s~3pZrsQ`n$jLd*3(5SH6_L{Tpw8|99%uN1pew#cId?u+vD4VSyRnX5bjzCW}|T
zK8oX^0nlBN*%elWJ)0CVqaPm;fN)nSRE74~=qcLGjX2=yJmyh4PnN+r1=H@)U;@wEIxxW@={!Q2E)2A3&+=Y(6-2F(ot>S!8+R7
zib8HiT9{eD+Iz5=im)))c=FLsj;Dxc_*!8p7-PC8GMNWVt0)VA3$ab{0hK-|f}|RE
z0Ec(k;nsB3f)0GJk(;)0Ldnd`10KvQGp&HDpisGqj|ZE$_aZn{a@k8tiz~YyzM?m2By9Fa%Vqp~U`kuh`%#Fi
z`8Q<9oGHFt7Alfm*H{M}Re?+DPKCnpWxCMWdv_Z(oKvBS)eP79kus}|jZ!m^{p7Z6
zt0`HJ13I_D4jc{zT+~6YwhwCOE)@1e6^6_`tcRuKb9Vy`#rQ>?A*8Q$k?uTSPU;hx
z!Uv8<0lii<7}cuLbUUVW7jL0*flrbvdUAG^xPJW!TL9>I=lMzirz7$I6!_N0@U9Is<4(%3pJ?!2#E*
z=B7;se(4wr-KN(!hUI`tGUJ1j5=EUHJ<~vUb9X(@gV;46c0&|4O&P13dOWNxDwD33
zfJU7aYdP88;8Hp68>kxLM?0;O5ZQ$`ryU$XHTAHUf!MW
zA1?RCB_KTB!*x`1@qq!TDi1q$CaLk!8YgCgk~ET=fs&TGiuFDG^)yH^avm0zECEe}}KCYD3B`8*McV81^bipXo}XigXRV
z4{rv=?oiD;@Bnk8cyBlvjW)nN4Cqu@P3ty+i{@WyIsi-OK86;V2|(`B3eO}0a7f{~
z2}aRa;a<6?w4R~apwBr-zVV4}lH7N^%WZ&9c;{Mb?C@Ek&Zc
zSx^-TH^hnojv^6eAdgWjt15HPJnxyAo!P}v49bxA%<4>3b#^9pPNufxYz=t#RVc1R
zNGfgQ!UuW=$r>BW;rSm3mlJ{y*~V>)-I`YJzJf@#1Hxp*UYu|yYNbo^LWHkaThPEi
zVC{xSolHQR=ewmK8-hx20&Y#EqK>(eKg>or2trPltPrDNQw25nw^=f#F*(@v`51YT
z!M|kD$N#8JeXAMQ>q1vyC%zf|h%u&!Luu<_zy}420^lLAh#-hB0eUkZnWUS^_q*GH
zuHFrx6%4Mml5+7_L;-
zrH8V<4~XlK17iU6{AiW9$J0VxAGJ?=e<&a{x~%lN-O=zI8U*YEhH<)tD#xDd&U(Df
zx-5^RBcC5A`Y^8QkuYPf=aFFmqf(eG=kpk)`fyw|Mnh0uYs+ha
zs^9CF5pMp&nONhNEPLWrVAr-#EvZD*1~C09O)
zk*CkZw90`6)Z9jRcwF|qvLk}$ApANA)7j3=kXM?{vTEOVmeaSlr`sntrzfZFW@YBX
z!-Jpv`FrtwU%30jfAsyA@8jbSAHMj@zx((8&TswFFa7#gzWTejPyJIb-g|QQAj@zGZNQF$KVL*MeV3@=HHYJ*iFq!O4146jglp8P!rdJ?(3+h%}vwOZHzr7
zG%lx3S2Br9J=^-E7mDM71`4>XE8$la@1x*p=+4fe^WpC9mbJ46Io>y=-Yl7X
zlG4OMw2^U6z#@W$HSd7CS0~-bK|Z8*no*gBNMtio6`2=-bxpRHa?U(DpxYj4a2Zj^
zBM!;U#9o!g?bZk#{7OAtPHR&$$JtlTi;tGu%-BD1kEsxM$w?T}Yyw^rlo}t|MP
z%qrJlAKd-bYJ|Jy-c&)+z|biDcQ?9m3gfo?NlodAifD97X}BVa3${p>P?%sHa#1vE
zII!2wnSS+M6_sflV-apQCe-gL7>uC)wKmlq!3tFIAw(XE|I
z>~HF54Bm0
z*-}>Xi+7H;l1hMTea-4vD^mz~-^<Itgi-Wf%sj$sFOnh+yDmf(qLb?`(K$Jd-1}g1S*Zw1%vQbNuS*;}T+Lonihner
zH%l*qABzULL*-N!Yrneem+Y>(T=H_cWM*aUnft!)xmTa}eNRmR0m!ljyCkcnzIw#3iV?x)?KAijk}f^Ib1fm^FI`IHMqHnQs~rVu%@SA&S7abB&?9t
z$yj;l65Y%YZV?{gYXqY1gPEqb#sFEgIuQ?^4J&dTlw*JtJi1e4vjFB*f#z|IUw;Ts-Y(Wwl)k7AX`dmo
z>MW!@c)690>NaW-r>PKX-J!ZDtkGf6z`72g$cL`BBt5VHsX;&BW7UuQ@*D7~S4*+6=J(@4h?2!e$XNsR{2#_wFd)Cn{3dp(9=Bz4yJ(*?X~QW;|5A
zKFv|Mmw|v%felnHFWFMDQXb|7VI*!qm1|MPJigE|d
zM?l?#l0~g+??r`tPuV>~om1-CIA$GDZtju|bA+-sYdS~yY>lCNWObKA1mDO8vUvPN
z?MmZUoo#Kpv!kdvej^Ag%5>#~m6@{-&@UN)0TwW(3=K~eh8V5lr}RfPxv2-C;|ch2
z7Y-#aEF7Er=Dh$ni!k?IR5}Ic3}d-%5grlYD?DPkM?`FHTq?i8>7C+6?Xi$*RVEeS
zmyAC8iC3(0F~tt#&D{{S4xb-
zd2|ErT{Dz8tRjDJ?b+3P)^@j@Zf|a%-QGRjy8GeXLnEI&_0N6&$@l-zi|_c{>FvAz
z&0qQbpZTx<;otkYU;N6KfA8+;`r!Hdx2L;@^ZothzB<{i#2D%ln`*+wtik2;9PP#w
zEF+kb?3U`(oLq@1-NjuT=LW+|Ru%i4%(!lLWW%Y^SQV(z8sW#&VpJ~GOUm~w^;EfW
zD6*2cns-SqvXzBCunh<3YS*5Ro|zgEqHUa8ZkCUX0cKrUNCxBKW7^x>!A+W6z|o!L
z(J3pKYTpU?WyQ`!X2|iBRpZxH+IzS)>uM&Y?h(A0AT19j`!3!S+(P5Wy3j}FV8y4G
z+GXyw7tkKAW^osQJ(EpPhL$;mhpAW@Tx^Bv2MC*YT1HG|xtuYiu*D1Lb0K(&dDI?hxnyK0P
z$Wzsog^t)vRbIIkJKzyT2)8gU>g+6vTZ2~Z26PrJt(SX%FNt#?Y#^6nj=SxtpIfv!
zCYx*WpNQkHYx#whmAk89+c>tS09=EOJ!yLGVcztfo~w+5Uu4}NuGLnouHG|Q(J73T
zW|w&130%1^nBx#@R?)NqDKL~M)T0;i#PcMFEi;3ySlxy~c3Kz=%U8s9I^FD-%SW$1
z`uNqWCwDLZ%%A=ff9+rUbASFXecuP)wte(*|ITkdeCZ$6hhMjMudOa#d+nDzzspQ@
zc+6>D4R@Ipv5FMR80sa|_qGWqFf9nRwE~9RQ+PEzvxjP(I;PFSIOEE{>{N^vyTl@#
z+`4k4rE@J66=lMFg#vbk(MHp$s@k(Imp%8(`Lgeq^W}1`&aBJ}t%ytcjYAfsP?3$D
z<7Q=vuJXNb$=-K6cU`J3d);69yw}4e@Ao=aU1Z+S6OPf|ySlx^5l=Dl>yH6aclF
z-PK5-P+8cG*AL6w<)+T!zxP(lx`29ggr=e~13a#VT{zf^>g2;GoQ3ATX-H_I6;*Zj
zls~TKkLEvlypyj?1P?^`tAS$&v!XaMS7xeQ7!^2)?9S?o(1vXSij)cr%N-UJeH1RO
z-!9aobOxK+i~_K%N|~7GTFOr5IQir-U`?KW8c;{A<2tK$fEjaI&Ep_S9LLe>gLLl+
z0{nUCk*=aOD^=LLFF3dZ96vLLjy}LOcae!h$I-)NFqIJj$qQF2^$|4%44v2Ha!qYf
z9Gn&Z)zP{XP9ABw&1X}gnAoe6^8&}e9Q}zvKBLM+Cp{KjNtVqN_IA!;IJy~!=)>ki
zPq8|cx#%9TX;hQ7;s7;h@IFo~h6kP3QAovk{-XKrM+46=Low=M)u?>0WFh|)uLg8p
z-E5g&2DRL~D+|t&#!l4?IxoT$HA#ewrWt@G&EJ(j$m4NOtME8qgGosyQh?Af3-U(U
z*?p$Fx0|`G@Xc&91eKhIBkGyO;?8z=@~12e*NW5fyUp*m?e4U0mv4cSS(v%0WwpG6
zT)1@zDwE!~2=j>Lv9|4IZ8w{5+jd$vr|@MSLEWH(ZT+sSuBx15chI7CoE3pF7%fq%
z4OMpd1$uMCtJ)IsAT`dPt7%VbN(3J2MLb(VxkSEK9Yl7?JK&P9;-x{Y}mx@
zy16~wJ-NMox-GZ!<>69!y7A9_-`x-V(96$#@9A>EKl-&V|DFHh*MH`xfAK3{``stc
zZa;YP{yJ?Bm-~Icl(ZOWO2GWju5O~}zEY-X;9xn#;gs~eqTUZ5n8Gp9(m;1bxVf`S
z%cOtPy+>1X(y!rAAaGwx>o0UyWt&c@F=m6gi1jvX
zSQ*{B2_Qr=>&dJj{
z3)4|bnOp6d>^{<-BdfY|dCWRGLsu8vqYX1oK4tPz1d~ISqvNOxj?_;%al;*L&I*Z@
zA&&_R<}2K*xJMQd!G=lr5>LkUs*ImSZ0By~7RLyUewYYzZfc#OSa)-4R<;O_XesB1
zUPoBClm^7>;gxxGstJg?eOnv--m)sTwN~70H@Vj*?_PiO(MLBo&;G=Z{K#MZSO3hP
z{c~S<`I+q-U(etBt@Ag(+V5W3!yC(sUoLey*ZKZJ{>HVX(qQuMjjQ{ZP*v_?)pXSp
zbR%HKX7E}RIU6dIqwPJ(^q|Vc(b8*|h9y2hu)B+eJr3EL&w`u?k98bEba!UvUR7C~
zFQH(!>hiE(&JTND_S!G|o_W61xpA(_ti6#!64pRfQv$qqU9vBGo%j7=uk&7e)wd?1&r9~D`dqcM7A{;Gdr6v=Hc(A`#`V77ssRJ(W8yn4I-KXimSA<~R6|G2z>iD2
z*qXCYQdhQ$05h9%4!EM*`3P7*xGzVTNE3`G`wHcJNsZvp@!&g
zI=gk3Mmp8obhBk}$5QRBZ^o0#<^;E1_4FV2w%x!V!|-hbP58Wh;t;v5EM)h7475uO
zFre08n7YU~z{FRKg7FLxBiKB78%RpkAP<9&FgRdtSkOi0lXd|rPAK=@y~A=w^@tn8
zu}VAz`}qfGtt&|fA{{hjmo#U4+Mwtuw&@LHXtu1)EChg1rV-y^{ut3%Df(&`B
z!##6yZU<>(XnlT($Dp6Dyf8ms|J+m%+B{QJ^?3bW!a{S)RS`)de&`*keC{;kV-%HR
zdPmb(o*yw1m?8e?zN4|@DSg!DHklYIP$>ya5y-1d-Czm!&U-W)f=FdNj^i|yt*Wl$
zU-Un7*7YKefHv&qh!@x%C((p~pTc$eX^#&of6lxr%;!{@H$__O&npGX2X^9y-p-K<
z0YK~|zX>m9PZh)%b-g42=XsC*wjF=qal=4g%8a(cW?p=!ePODAS#^%7w2>C%w_wAg
zrV%VIuC3*)JZ1(1;BftHIQkG!WndbY(ANjR&8|?$MNT13_ALOeZZCA1PYki?z&j;=
z)+5GtEccr&PRnm1Znn4$KY6T(ZN+KDDSTUgv$m7l7Fdn|0ZY4+iuG`;z_!IHVq3mN
zoYp#R>$Gj#TBj8^r?og=+iWos|4~v>Rk_b7nSw2KUfJ}!(V1cd7ui9Dr|8FSbOf4n
zm9d;c_mWtzDy?TbF^PESiUU5A?T$7ll@E|pr;@R{&3)f5aq{i7-QJzoO@WVfN^7P4zr%xi{lIOiHnY*E@
zlcAtG8(6Wb%BCf(;Yq9R&PtEyPNX`mS-rwF9H}y)2+)V#Mb*xKlGQ**1iBN|)oU#S
zGP5;Fd!(D}GLLAgU05as4_TRUWU=N2(dN4OY-#dBdAz%aEjQmQyE$8h?piAV+xNX&
z!)BRe%DdTj^%hZ5C`)RjhtFeF@6yMPMd2sai5fBEjo>VoSchx<&AOY*5&@BO>KYJ52uvrAeZ_~BGJg9t|2W}*A&TTCS;Wje{g)DCPamOg48*Lt2
zEOhU=x1JhxumZa!skd}_n%su>j1Zfmd>qKU3u8lIf(YcPj*%+^9mory%4N?T%}~N@
zIoKa0%)LvLwMQ6YJ8jnW_Tm1+kH6)(`D1_V2Y>3X{pgSW`7b8?OWggv~?^L<{@U&@yX(xSSsz&X@DU`Eq}`T=vVQu*;Z{t6EW+=llI#
z*26i^=X&?BzuoIy_Wfml*z=)45nW|n_C9y-S$ox9mf8v}qc}3LH7-GVbt>;&q*C<=
zhI{->4S@6P(B+%WHuq(SRxC1UEUl-@!I{ItRY$}|W{Y#=CAT`9!1aR6FdjB&RLPLo
z%~UY~=3%`SiBR*_i1FCKlSSncf*F93ILJ65cECiN#ZZ`-F8=G-?csA*`4A7>YOoRZ
zA2_ZJaCekSSc(fw)~sO-xRd#&8AEk?0NfY}Ge>1LGHdSvAu6E{nuJ%ZrK$&FdC)6i
z$Twr;nR>{_ljep~fw2Uf`riy~4tLpYSAi?<
zz|yF7%#IjIIIM;xPp=z*Fa}-^D(eJ%)v0qDS5#3ieZ1V3rdWes4s>T7J}x~URTk}s
zOl!cbu{GUlXdU8MmLnF9cDLXYWmQp?8btJCG=RflhbmHrqDEemyL1>i$FoCH;Wj>>
zmLqOEiyJPUAyV#2OI`sE)R0&tvk<
zr(Q~%nY^;E4QI}jcEV;Ovg!FSBrx<`+us8c?Qumb2B%v!09;~xt39hTYahc4eV5WG
zfx5St(Y7j11($KyWhjg|ofuXB4u!#H&^yg(~{u)#wI3$O_VGt1)KV6(g-za;T6
zs;$kcYOhLILaNJYvUe3SJG+vYyyZa~lU-Rz$9#VcwzzE`TljL{+}7r&6(_ST?DlSZ
zvivsewCr?>+gLZ@TiEj0HoIAVV^?+OpA=;fmT^$2ikd*xudW4Jt>91ySsbx
z{N{98=gWDo{dDKw@qJJK@E4wb@Au!H-{DvP{_p;m|M@Tf;(zK{378ZWF-!GTUOZTohUcztojrjzq@s3&iU>+vG4|mVZ!w=>`V6jx!&AAe0+cY#kdLb=UCz`vz>5A=U@M>EtoRz{{PP3yU)ZLx6SCu(~Har66
z-qL=vF~Z13skp?nKe*d1^#`
zeyJz%@^v8fgh}>RIriTVco^O<8-Q^DdI>esbqob2s7s|tS%ra
zoEz4lr|8g^0#tDjTaC(yAB&|w$mfjq-6B{dyAmsU#z76O0a>O;p=UeZNDq=BP~qO8
zhLsLY7ifdW(GgQ;8kh!ZgEhY&#f;e@dZ+94h_~m$vJB$ibRXrbic(FBF;Wdmr+E{p
z1X06Kc8`NXPsGLyHbcvtc+B+WdH;EjOGM0+xd-7nRq~3^7|dMH
zQrFwAMLucM?r?`DczQSu0X*1HOvX_Q9TA0UL3BNTjE53n4s(yzsbpZWDdZYbaMTe1
z8T?y^vw%!Zmbqj0N}%bS&3Ze`)K1U^GFo);C({(MW^Pc_MRjY#@nDgHn`*b
zu(!2`-#xi`^4{&XZCU3=yY&a(ar5~<_WZlQ=h^+6{?%Xj?Z5G#{e%Dhmw)x`{l_m}
zKDj&HdRXSAJNMe{SXyq{+~eVyyUog0MyWk(ZIPGD9CDbq8F#emUGvX7+C6yYc-^vg
z*|1x)O6;z+ROIrGgGs}(hjt7
z@5#<&*Nq4VI=DqV+fH2;_}
z6_q+w2`=-nsM(IiPu6Bu(;9uGvoiN8iFln|cE-{HtmL}s;y|0?no>|WpgD0GmHVt$
z^**x6LBd|kV`9M)pM~L*!J^73S0pSA556M~;zM?_Hu2XQt&ZLtSa7_y%LicC%t4#t
zIv(L6n-2mbf|~>|WitfAg}ZFvWrr_fC>ynjyRQ}9ReKK&)%{p<=@Gs#qV{RQ@vwxk
zuh#{`wzkvFlW>1`e)Hi+-@IJvyTAJjfB7f=++Y0hKl<5kfB&mrzWn2V`0ndp?%w?-
zmU}!r?B{dmz9SLg(}lpi1APk3S~xIOhiQC?Wt8+Zl^r3`a2?nIWZIk+6xvKEq4#V(
z%^t}-gdZc!opNmc8ZnDmd4710IWN9wZLj
z)Mq+sfVstt^~?c~cMcD_iQJzX$a8zB->-$EZhEUEQ;W^#0yNbYx+Qi*>w?V+VzWVH
zye%^dD6rVNMn0NzX&Llg=$)gdV5sbBc#w%?SkJ+l+*-zC=IU0p(5&K@nbYq{w3%H$
z1CEk)kgAOOn^%GDTqi*~e|O$O9|0L%FqHUIeofeXTAK>iC3_yGLzwcaemo9ZPq)gY
zfI1K|Oo>yW*lfmeaJ(?gVMSG?)zRUuG7ArLIpc$1O&je7;d2P;$ii%!awt?R!w?BQ
zfnD$xpw}!V&L)i_25{&Npu0GM!#1zU8Q6@kyU=Vzvg1g-th8YZ;?~S
zcSK(Sv6aZnb{Tg;XV+AnnrXvi_kK+$$Mr)|Rgql)fj)3u$fcTpLMSDTh*a|wX0_4AXppQP-9-mVJ~+T_}uwCnrG#>qcJCH
zOt)IMG|PQq{M#(tdmOZQ_zc}0E41(utT51Bxo2BN#NE@|=kMK~ZdTUiVZU_MXTI~v
z=fCjsyT0eytB)_g__M$HH~-6j@SFeW*BQxWqc6uP9iu
zL6cga?UC$i_i&8_5}V=Z&$ozg`WIcgdyA8Y?fYJ0oJXAR
z7;RbTFOHCy=gq@?7U3{z)m)!ecjwSY5Sf&{cl(oWY~$#|sh#B{Y^E4hG(-66rpl0a
z8}5GD_fa62``Y&%W{xF|Ffq!@X0WnWu>vpk(xVh}y%0BtxiCz*@P{!`~eBvWI(c`-rvaOjI*q
zluA%`dXL0u;lV*_fe8Z_a_FX+&A^8GiWAL!xG+s#R>~0EjK!o0vQCDgy&REvxM!Ae
zP&JJHrUq^wD2@}Gg@>D2X2Yg))gW8p=2>lSvHY~%EL&Om^-sS3`qjJd`rP;Z<)8Sm
zzx2=l;P?LF&wle8^&7wX`Ws*A-ebin-0olR_m|9bqI@lL?niaqWVB7Ofj+)~I&?mm
z#L!2IqX?EO95i%oEK@PFsS^GT&J>FQM#bX+MfeJf<$%!=Ei2CtmxuHI@bK>8^7j7z
z?Zf5%yuZtO*z4g^50`$(-rwzS-|e5gyL^1Pyne{H*$>s{?u&Y-R)&VtM>0-+3g6sM
z@|!U;UJ*o>k43RJLjPRbDorDT#6pBk)rp$c1lC%TbDB+0m4uvLf2Uv-ooFjz^tpr6
zQcCa+pm-ODesg
z!ccB@AV>ZfpNLea83QUILa$|}mY4kUEI$G&O_!0K_vANZ=J-f5^2#D8Kc
z7EOf!h2cEmPC};a(^^m0&<00?@GH&`&)|7I>5SAHtI(Xl*jKEXZ-KCq;9DLWvsWh7>)tAjttw%B=E-QI0=gO=L3U4`=Qh#|
zgH1x2Qt^PNOkPFTZ#0>=FqnA_Ic%nRs1U`=%n8v}n9|EeypT$oQJ#1R%4%IB!)K%1exaGbcTYDdG-+-)H=M!Pb2nCQD>
z9onOt#i2*GWGK|q@S4yqmj91U+6m4xp(i?`<~~jeb0xgbL~4nWY`vV
zTI=rS^z3fExII0;SIOzFU-vG03wI$3!D)xHZOz%-zkG
zN0wBe3>Cr}P!&t5C$A1G^vr^#uKbYKKGV{?nANtl&9O@qf6?y2RKQCC_K0~Cm6oMh
zbxKkAui?lnx8>GZd&9T2z+QKk*4Rn_$ic&|##)QYqnWs=h~;MO=*)u$=%SeuWS20M
zON-7bdwKg4P62FdO%rP&))cW8hH51c)NTNes+nlTEJ*+&7LksySu1$)UMXVFd*zaA
z?R~%Un|w=Tk)7`K2iv1!js=!m!>Y2XG#OhNzVVKUKhQ*ws40q#hKeS~XP~o|;+Kod
znK@i(Hm^-i{zG$Lsf9G{{0fqd@hV^E*LhBdIAOL=;iaKAZN!1@+yP}cs#Rlh?Wt)o
zTyV3rBUx#pWZ|y=PH2Qd`n+)4wqUkjcJv6SS;&nwNL6zO3B{r`4{S8dW5u>s*!tx4
zx4!Yw*IzvS>|g#XfBs+m*Z=Gne&BPTe2m}x^>@Gj+xz8gx7!vG@80eY@Ak{Nst{AB
z0GfAXS2L@-&065hRBb7Z@rKX`*z^U&>_S66{QOtt;T*bdbc7G8V0jL38L0XP=&Zf+
z{E+9%`Eq`^?DzZS;obS&oAW0R_4>TOz0Wu2{p~}&dB`^pm)8&b>vP_p>s{u3V;37>
zv*OLzJM|S?k7(0vg)O5@6!gKTCeCF)!vPX5#T`YQF#%C?h)3N+!Xd!8i^$aNd3>!g
z2TJ8G0U^PwPBMoc6Rp=TrkTIN#Qv3B>4kI}S+x^ez_g&Ux&me*ypE;^0g4->7VhDQ
z=08|=!bcm)09}2xlbklre8eFs=cWh=sb8w0o-uLeo@cTZS->$MU_LvL2}4^qW=b+^
z0Yu&M8S{3(rXLZL?2vGe03Uf(7wdhlxM?&2C0n7b00wG+hbQES>A=vA157q6{#r)b*~MRG#vG@p`{0cG!t`A@*EV<2F6AOCMH9ctSwUkF08YO*sjycl94~g
zb-4^MUwp;YS+&a%Z7R>!dDJOV_W(0Sfn;F;>)Q8g=xehOa{-ocrBpQ#y<5XbJ(nFV
zm-}HO&{er&b0W5u^gy8mUAb$zMuZrfwu}dp!u7IcPi2~2Z<=pvPGCkx^}nMJ)bpPI
z>7%d1fPm^$rOUz&-d&mXqi)J7e_=6gia@s(Vm7pef+$6s
zB}ky>qlb(kv-r@MC~Hri{v)DJK~G#vMKKZ{ErkF9002ouK~&s0YCheiE)rUb_atkq
zIHc!OhHAo%vjY>KjwvuRqjF^0IL=a^wc&7){3t#2C83R6si0hGN5bQrJTr{??Ol1WuUB2vZat$fpX5=ddIiIAUT=JliwRg`$WA$hKTTf5hlhby)*0y5f
zA`AlsL{+(Wsucx-dbDU^-KJw=u0dF*z0-B|VM
z4?Zxn^W{=?DY~Y*$q1u)GJCJw^Ri+ciC7c@MY(3xDVTFDF_jK&wy?GuM`V2gv#K2i
zWAQdb=Rv!uS5LNu;lk83!W`^5j!q8?_jN_DQ|9oYRX3%;o2#aXm#Q=A)w<_}Xj6n8tCiz3=xgcns^uU}FX!+%{yVt`6KxLaoH_-wLw%(B
z?6GdbqO_2P5k|c<09C07Gkt){>@GOgcIu>Vxx=HBaI70$NhHbg%`A+;!C>#*{UlSE
zOPMR0iv&!pg>Ey?s>#|w`&wI7uC--KgvR#PieR~3)e&Ls$2xDYE9f$`UTbj`CD$ZW
zcd%VHQ4faj&_96^qfN)7>li2P)-IVksy;zn(;U4@be$&NRi8Qtg+gIP5P0ezcTZ}h
zM#{%2iXk>wEiflZr8>w?b#hWeOj}=Oe4AO<>^76V0jb;q@h4Hzp(bedg^!ZeIYkD!
ziXL@Z%X?4`B3w^QpJw~YNqeqFLyaBf0Q
z0z^W+DwMaaZP8u4TQ!%>%hsJfT6oM{mwuZIVs=)FuI6bq!%;*N
zkWCQ-wn?P7E60r8Ou!Ke1WIrOVb&%67gL^xlicP1nD|;Q?&1b;OiTU{OQU-Fjsx)c
zZaDziz-XYFvauEB=6mK|yExQ7Hkqg^Mv*N2e~+WmC`u=jTey4Ax~NYZOt{+4U0wTZ
zDV$1=vAs&`A3%nU(&!0?4!J>!hvsLS@`EBXt355cb_u@CP+4&2WP4uP!bPPi8Ff~|
zEG+a*OZBi)ymVY(rQuxYJ>87V904DHCXaXZRHbGV8RvT!Zn|lHCfA^79Zdi6#sNW23M@!x$sbIpLzbmfA4p`_OpNMH-6@C|2H3g^Y>pofBN2wmzkG`{gSn#yO3s3>z(gj9$JRA$sbQ)X?hdbF7fQ*~zgY$_wzc2=etsMRB1
zHTj|Nz9$i?MdVJ$jbh1)ZnJ2%VY^DReo|{!br|gB-B0R3cZG*}P&4ml*>b`N3q5--
z#>{qKYc28})m^!pM;C(P(n|I1g{k@wu~n%RNnljDH!9Yq;Z>NKk+B;bZ`LE}7Hv&j
zS1_w=4|3`gM@0WaFUGtXG=XEZ?db3y60VmZe|$c|1rSFtx)
zNf6xHA{H5i8lI4Y;8~aMHcs-u4&Mt-yGZmXj?3os3&ARRkxW%*wR`@{Xg7T7ZGl>v
zg6bjgt9exJfJXCK{FVxSm$Qopx-7PBtCx7tj^}Fx=&Oh|m|Fs|gm;a4F
z{;BVH@{fMw{OiB?@b;6qIjy^Gd-pnDz1q(YS$hK(hgzvAy;BAz6b=hznvo(;2`i?k
zhw~zNcyJlRd+9z8@k)gj8u}+@?v#ZCnft^2`MjUc_wVlS-#y&FdUtvAP_G{@uixyS
zoa@cI{q_C+$=l1TbG^OfyS>ka3*WyRR+z69b_(Cjm)i<5JnrF}P645|dY@(hxdm%C
z543A&Q~ZKWVi4tFG?jr_n7C>&rKAvnsRD6Lx&Q2c+7#?=tOp`ID=+8W-D5=qvi#8<
zq06JGX7bQutdg#xh8S^F^}b(>9TQQ5Dp@)?kq(om3ps=88nABHIL7ut&}Rr&-GrG-
z$I=zHU{*|w{I{-lb6v-?n2%JC5EWKc(<&a(D7weZ(737s-p)xO#u_hNLU`T{0}{zh
zAgW{7#h|4idf#^oN45fz{72N-<|tux$CP>+;OI7UEm9k^s+JO-2?AzRyrXA~%C71z
zbYB2-U##F=%Oosh@!v&?kWHbM&w*l{w82vlso<170fUS6F+YAN_Z|Uz5UsjEE%&sK
ziy_1hQl?wx5q_}sR3-C;vTudf0B4UD_XwlN+8ewY{3t-F`wCcQwiQ}FG>^D-7SVu9
z%1dYCri+Y3h7j$k=UuW(ARelDFGCbDcUoJljTn~{N244{k=0zRVR~c?c2EFsQH`pj
zrUg`eSX#71?~0S-C}SS1g27P7eP95uKv2J7v~A4X$CrY?sk6(>mTi3Xtb(MZ)+d1n
zlZ|y9jU_!1{*?&#*i?<7nMF+gBz3u*8^?=ofbN=)oQ>>o?rk(yY_bs}{(zdSHi!h(
z)4Vh|`<1L$YRV|C!tzE+H!GsSx@+%p_Z1tB)*IlmE0#$%)v-;onD0B^VeHvjenoxR
z_vOxvY18^1L4h$Y9XyNZHWsdA7N*PR*FUMW%b&xeRizmW>c*>Sc5S+N6G+(fc84ZT
z2bN3~5tA0$XK{KB0d`~si9&R=rq#^P{HPhghNt_Y1Wkm=%;}LP!L`6=^sugjrz^IS
zbkaa`)Opv|P!SGqL)alDQ?eH-8<=;UZFZL^L$xIf5HlyjY{fCEtTnT}vy$p=5|K2_FQI^Hv-Y;?EbKtB8fuQk
zW?u4Abx_})MA;s<{CQ#ZHxjbHw~zwsac!Y}>8ukQ8nd(WTW
z-9EWoE|>kBz035##0HWCb`!raHDOn?h-FWY$uS$K+7Gfr6qHmz&7$3d37f8OJOzBs
zr3A(!o!r>h;q>;eLmXacZ!`1k!?=jYXnIa_T=}}87reO5
zDKzY$##&V9I65dw43uX}88Dy>B0V$H51XRl4rqC;`!;}&8aLATNaWmZ-jx;sSY^2r(I}Xz{F?`a`5;wU=*6zOo53oRYxF{C
zgDC|zZD{`3@Q^HBL~MmSBfC4Q;J#Gr;CO&Ut7KN-9j%dWx52f?_%CN3BBH7;`-MEa
zK(D|qZ|Mw@@z}O#8&atV4-aeXdu4Tm2Yk=Vo_oX^v_Syn5l(|saO>Zr*KOwRk-gWk
z(GyK$H?e0-nzjyTYkJCIZsE}Yd%-+-5z*OMX<%nSVe{JyQQ+uNJVyZzPce0YK_b55gUl)7|8L%qh?ZfH2!RlI9=@-UZfHhqTAdn)WT~oWR3*Blk<5FZcHk
z@9rPozI*rf{_^JG{Q6;k^X~ld+x_Er`K@=CPhOute#qB*zbowBO~v_&P5&9&T1%D}
zzT6fsj%kL_#iGy-0pRvlYs;>#b{N{b&D-3)Q{-4z0ZyHl*+e)vRebz;=EXq*gxqMd&>5Xc%5G^f=Hy~n8X{m0KytuXePD_FT}8)~ket*q=Qua^EF-so
z-ZRwAQ)s+jtp1Ao{|RCvfHd(ax1+~8418(
z9N;vwN&m*z$R^&SZjbTeb|Fdf#1D-6eB&B#mxl%E~6SXQ_Cw-gAm
z`NM@9jaboLmrJ^@(-y}}C?zq0QV<@=W+M?J>;CW#KT`05~7K`D95CYmz
zZ5{5g-c!DbBCoqEE5dMO(S{kzq3WpMSH|@BcfT0D&rY+x9
zKAs)?j9J=Fa6o^uCw%DD>GELfGAzVA5ba*Yd7BAC2>=GG;TE;uKiFwl#U)O@jP
z3V%GFN`^=~MbLmdXy`LJgUq!h1qBvt9$N4>hRj5o4I&t)4b9L!LVN4Z?qeepvxSO<
zgLto^6AY1OkJeIzoM=#}IGplcLLJrd%$KTMO!N^CKPe$jVpf-piNZloFyf#@R0x^V
zp;YFmN3voog0`mI{8IeD=<6V&vQhw@c}X^Dho7q|sn2mp>$|P8cXW5}{K{QvRzOx=
zs`7HVWL~l^U6;##?%E5s`OTBli)Xi=d3yWlo9(^Lo-W*apWK(*cC&78w_bx*S!&ie)fL35XpIu?GuagT(fl0qka$!FBwUhD$s-bPBPx!mMj2
zT{|b-Fmn%`No_v>%i@`7wJ}`6%<5t?Bz~*j!-M0Q@|IT=(sU&Nac~E0H&%7uw$Zi`n%|61go-_
zw?DyX&NaJ|eGHuhLsmNXJ?b5}O+Qb~T=TB726=JTepN-FJh|KSj3^9ZlF)V>4DTJN
z-uFwPB7&yGnCXiac5i6B_#nn?zHMK1XaLw~)DgFXZR?);3<6Cae#ExNpWpReS-O{T
z1W`q_PpmvDuB#|YS(pqA~2_9ci04
zZI*x`yQ!CsP0!ldPvLW;(2%w_71ShXOvHwu@NJz|tn>N)55Dz{u$w>mr~kyi{%`)+
zkN%IoaBlqCfA{8heiOF))4Q9z)T`I~+gE#Mdsx6|Y0=$Pnh_@@*LH+X!K9&+&51BX
zZgRw>QLwg})#$2qdA|)>biw5<(~oD1=8}1TemI{W?jPRVKfHeX@a9r)-<>~sbN=Qh
z58u4MeDv=8@j2gI>Rov@5(al)+iAs3*fQHzPC1hbW{2C8cBG+=og
zzNg^q;=F~LF3^%2wm1?KguoDi;x$Pbpo|uLI_C=Yf)fG&Gfx8%P4*bm3q>cT#EPB7
zMT9(xvfbLNI$SZ-W_R|ltJ`62mX#dwH#n>$yJdYl{x`g9aUDZoq1WMYvImO8`bB#o3bTN|VLqND8kZ
zuN=O%Z67&|%VuUujRr_~pc*r*NK@GobJ;4k#ga5_V(*#D;QW@r0
z(U_@Ca9J?62Fw*;5!$DxW1t~M#&;!Gt_sWCNBL`J$X4=y#3Cu7kzSvYQN$>l=W9hb
z(8@kU44qu_K$`q|z^=goyVjcl>f^CD!lA)-Gv`;O%|wd~l1~q8wqTHzc2@<~eYFHO
z^hs`t(Y&K!D)#^7llctA)KarV4cwNvgoK9_>;o0Z&
zJIYiYbgB%@18oKHt4JelG~&VNz4h_j;?VH`Ju_lp$FtQU8~N2h3xO?p6P9wjO&qg+
z^pauFlJJR9JWEFHr6@le5o}2_PjDs%WXe9aba2qxGhb9yp}pZ+#*T^X(;H};9O5zdxrXs*sjkzjK*ON5WE8^V=j`xss%SJ7APr&TQrVq8TRnPs7Tt4)n|Jl4(#>$p
zhCKprHgSOxDg`~5aSJXx@XpQKHl+c0N#~n3GjZ1}1>v{yd1Dgm_2|i@iiMgWVvCfa
zh8V>ma&NUe#OtZ&2V>}{%t};ye%axs)c`Z@$mT0A8<|93!OZ3E
z9+tW9mA=J`moJ~aeA-o?yn5Z(zWKHH
z-h2M!=63J8><^qlXhp$>9Y!YnY}4A5DokZ3ed%0*0w&{G_UoBxhL~V!rL}4;&P3zi
zJ=|_NNorp5W+)@!C*Da+7*tM*vY1OX5D$tFEMTn7+(YYL2GI^5qV$TsQbUJegDdOi
zf{g%yzm^SySev0U^HC>FxHEIlI=Z97b}1V6_#RB80L+lN?|TZ{2oYgEf#%cnNP&q4
z-Bb4Q3eNTcL5XC3cO4`t9r%n4oP*aVXmO0j*(H_-FYkVmpm9Z5_x?zAdHvmu2HkE+
zz(iMb%(VnAm8EoW$(wrUF{9lUA8QTGhVJ6R*=lIrF?-oNy4SXiRz+WY#t~?Haa8li
z*p=}GXe`?esVq9gj1M}&jQi{C_V57{q^Noznrs>;XKHMtM<#@Wz!`~IDViFi+uFj~
z_PzGhBURZD2Ks|zWEn4%?w_Vk;-_VyqCay{I~
z?P+=8?c4p;M|Z+*#OLt?QHPYIa<{CM28$#ARXP6-3N_JNX(
zQUdb`Lu>nUcklatzMLP}R=vDEU*6s4t2dXAKY91f*AHKN`|hi6_ix=_-eg@Yuwsii
zt?lH#MQrBFeJxwdgNoNMi`cqlp5Ycc`x42qvuNf9l37lrmZOdP-zu{aVb1EalB!xh
z`5^WaFT)WNE6G~{1Fe$dJ))IVX1i6xET++=5>}Eni{o^YIb)cnbBRq;
z)f!m|bi_I)p{F>8RKPAsO!jAOi$j&wx!m$nbP%qhfwHE9>EtxHIB}Nxa%GHvuFR&cs0FXTC1$Fs@wQVNP)!mDe0!(snS%aR^x|o1>uAMmz*6Z~6z>e~&)E_M=HZSqo$CQD
z`WSVN$V}%pICFPxhMX}Hxw$%!J;EJH3Sl0DrN~OLxkp2c@|XcUpz=~2oSv+2HnM^S
zdqvC+)QmmSQcEV#OtFL56Ih=y+&?PY^vx?RTA6AUdMFX+|AnCwy
zl?FT2+~?bzldl58oz2F~;^h0N*)rwAQrnC|He)p;4Z&CeQ+gjum_EU05sFcLkZnDtFuWY*-kT4wNf%ldW~zL2b(0
z;K~%#6uu+Q0HyqZA@}M^ceq8hN^ycuRgYGgSiW^vvwsY;*=js+S;|<`r(wO)!6?Ze
zL=8!-sl!Fx&#dA+PpODY4e)D&uIp&ll5i8&Ey-Ln-J=SAsyChg-lc#y~49+%D%mt#58_o<4tadVag_m$$Fq
zZrl2SnyCZ^r%$E
z$$at_>p?Tyb7zj={f@QvedjQay?6JMvQwR_%ko(IS`0KjG7wPRArr+ztgFL5nFAQE
z;W|de=>l_~G;<{&6~ICh@Hnbw4k#+P^=Q!8MjUQK1cqku(Z?W$aruSX%B-BV1xT;P
zhlHP(ibu7B4Fln3oC%)a3#Y=b`43bIimXDpMVL1SSp^M3b!Tffhj*YPZ8Dw9)=sqH
zgLTs+E^7;4Vpgg}0JD0VZ-SB8@X3ojkrA{5?cw}0b^QsZIrN5kZ0lw_-Mo8v`?YU;
z`RVP8pZb^n!oT@H{|n#yM?U>~zy0v*zkL4i>we?g?ag}gX8-7$59fzk;SnLXnwD~+
zyE_r`$ZmFl)La_nyGJy|VNfD4mffxPNpTpat;@OK0i{-#bGxf%H81DO{dqs1&+pz{
z-aS0Ledzo9{N&BUH$Q&&l~3M%`PKbbA1)tOy~A1&x2N@V+wN}GlZYEbz&DQ-v{15G
zwpddd%qUH#gU`&Ic8~j4&74`0DHTt#bBVzI8^zZWCh(~?IQ
zm!3C+D|xKzz#%_GbqRE%+d2?J2~}jpFsX%PYDgWU!y{;}W2sPMGdV%3w^iimyAE+Z
z?lISF;)89c1qXiTR_Un0T|Id^(D0Gss$3fWR?i(2k`a@k$#hep7KmG-r8XJqxE+D_hCZyrVmFD%xPvtsR8CO(K$35O6uL*
zuy8z2VoLU~bS1mA!$S%H{_96Gb=FlmTbWwC3Y#YawLKZ!#HDi+7^M7Q`je9xsB6#+
zIT}o=lg*56|A?)-3mh3%T|(NOzcHn6kp{VDT(hd+-I;C+stD*REK{cts7dg%Tl0_hry>98L*(0JA{D
zooyP3=v0&`RbdQ7Ra_FR%1ggif-YBLlMB(&Me9))tBca$`%==j`FE<@JZ!;wr@Jh5
z)IjrbDodBrMREMT*m!T@!~zP|Rk`mES#S4zoBO${tliCTZ(iQsyg04rH|xDydvOyl
zpWM9v?B+8spMK`)&5PTcC)+wjtO6?c%jH~s$&_CX%|F1`DUHmu4X!YQlZRDV+qU*S
zt5fK@hlk~ZAzvACCU5d(5wO}H_FlNTyLs~b*><<>4-cM-f6Ioftzv@$b
z*<m!LpKHm06GvP#sr@J0O~_;wo4zEaDI1$LelQz;Y35DN#TNVv5J3
zucLr!(N@m2y96xV?H&>IQXs{BM94WTY!iU(L-DPugO{N>Cgw1jS2EzSqqlsqsWnxr
zgiyh~SH#0G1!Y#xN{$D*VzYs1upvs%M~~b}?3^B}o|D&;%C!0;lbW#>`Q9Q#DR80$
zqT3uRLW+}72N{61;yC7y1WJUMlEi3^$*B7W%x`Y)4DkmaeeKoj*MIbn{*iy@-}%XZ
z;irD&{=R?V=U;v0OBNM3+uh~7fA|OY_xI)In>)ZsB0ZNbX!A(5ySA{_jLkr80go^v
zo!;#Z5A6fcgq*yY%izf!*WHFT_tV;9S-~If&-a(N@6K=T&-a(h+esRkS
z{N(-{uOGhl=KgE<58ujuXP#@@w(Z8()8$W2>n?CwzL~Fxt<8;|Be6tO(FLSfaG6sG
z&=&5-{Yj#21>wvs+_bld@VXQvr*A1HzOQ0wfL`n>7xp
z7+|C9X<(*eVKN!lirrxn++6cPHN8!Dhk54CQR;n{**epKJ4af32LH&XY9N8XtE%aP
zQP~=XWZ@TFHEJW}hQl&vrVyxtFNtPtm?=AECiJP{=8a^%rfvYay=fjwDn`&#h;5sS
zzN~4z+?g!o+TleV0@cI%T_vrq2P)lr&o&KzR#vImC3cko?ATcaGdj@ltVq++QeEq2U$>S;&#Us~ueROJy
zG^wRG?3^W*$!b?~8}Ovk!#Cxq*i6(7okoVQ&IZES{V93jLOl)}Fs{eK$dFB&O{fH7
zABl%;s@U!}3x{!qFVx;AOwaw2U1sZ0n)Ed2;NDV6G!E_qVh!C?Namh=L{b~lL8>dW
zYIf~ZwtK*efFP@32#aEo+@HpvmG<#?g9jKRYoF9^hVEEVg{pnDJBJAYY29nx
zC{46MW2L1=Qd~teYCKL(m(PVl1oIBfuR(@T4iPY#FLrSGCx!K6lqwm8_lCR~My_9K3K-qjj*Z-AW_x8Z5)lFb{9Zp
z_7U(k@J%^@hV2;HhAA?u$^tyldm{*ODlBpu37nEOn(~u^>4vGFOr*{Sp1Bhf0?0jK
zwbt4%r74pZvQ>dv2QV-0faq?Q%0^ZM2F2ddiXHXzVO>YtQjRdy`>3iekCOVNgFl0Tf%QP(ncqbGz_vo6A=E+99Z}Ld2ShWg>w@BU3ZsoK@+r;^;E9A(<`Nb2Z6g
zkjtsY-g!n}Dle6neZSvpuPlqT*69>aZ?~7X>;0#vPrtnT+_TeXpWb|MyPnAN$OAe9!G~fAQ=8um9lh|J}d+vzPqnQ!hVtd;9G2@UZvZ
zD0G$#sHx9a7}S+f|GI%9X5mL#fi6u}n-6XW04Y=xX$HXe+JWMM=b@cHeU;pg=nYgw
z3exe*Dqs&!kILHHYcJvlhzQ#BY7nG><5!9@SnQ
zV&kC_D!amrA~?z{vk1qQ%|wldwa7y8-zIIVQ-KMluq?(^VRclMijbK{Yi=DjsTzxJHzq9(r3)iTXCn%R
zaqiZEqHNMTD?7s^xSzg^;v%$#B4z>^-I=)qw$?^eL8)-3=vKQ@m8PUO0Th!8jB0A5
zvVb}zFwrVBs&sbkyg^9`1;aEITFN3{v6{VZ3pTs>VYP*IIEA%VQtDvV-CPZ)>~3Di
z=5a@NpSIg=JDnfyfBzd_y1RY(FaPx)|F{0_zw{m7^}%oc+Pi=FtM%~C?w;Hr`=f81
zKY4ZTy~AUL(*eTRAtJgd738L{AwaGB+-TAB#QI9l?0=XWBLfXr(T%G#$hK{TTcy2w
zc=!74o7Zn%-RG-wy-hox^YyFy4?lkMwNKuD{q_AfA1P2=7?mQ5w0GwMza{{(dD$%m%GR3VC(z|o&^V{6e$4k#^l*WEj>!;Nc=
z`>y#Yw+B{F)4`xQ6Cru+6=+iPaL#>bRa=bqOM
zgp#C*0%czegg6ltdXNib$j?3Jwfa;sb6f2o#Yc>BmHvQ~pu1O=xmEWu3OEump4aM8
zC&yao%DvW#EJ=I?i=qEkqa5LdFldOky4;q#RccQ>!IOfpijYH+!0v%*e!VfXMcv&p
zz@>uf2vN7!X#nb+=UOS!8$xdb*iGR?27XMdzKf)k!{L3T>l*r0G|wh$pMf(VV!RW
z^**B?&0+2Es+O#85>RtNj^MYPw+HGljw1J5%RzZXmwWKL;P~C$Xju3Rcks6J9g48k
zYco_eo!+Wu;`Ex5WbZ`3q1<;(Xfsb8vw$?a>-2F@EQu#ads+=t#9}y)p}GwYZT{mBN(Z*D-RwBqrgm(P;P_hEf%&*^0)oM81{gj{q_`fof234}R27
zIsn~sJT#8b9J+3xQ!G`>@1m<4%OaLl)t)=aTGxB9*{xV+hXGr4XV<0FvjzB9^RoBD
z`SO-qDk5%f;@Q*fQ_pX{~$udVX{BWZQ0TZtu3Wg?drk@Z6Pc%iWwi
z0zmg|9f!)Qw$1{#|5USj5tUhE_a$)W2R8#s6vqP4U?}8%$#ptCdGYk_*5|Ha+Qz4r6vzWT!GH0F>{qBrA>t}a;T
z3{(qtida!3)c7}N01S=FPMBL;_0HCxq4&xwWEy~=U}A^}dn`jca;8Qec>vOk)=i$Y
z1Sgm@UA&2|8s%bssq2t1uZ-qYt1d>wzZA>?|=NWW~HQ?8Yh!$CE?m<@4&}*H#D=X>JcZ6avR0AtkRqwfT
zo?pE^LsqN72e!4sV3`*O?7h3604U#E35%l~
zyb6BYEK@TcJ#B2)W{Bd@k%w1`L1%LE;A$^avS4l=GtizRWd;MZzR1CsmK4L)dsUk+
z_J7sT3lILTIl9Axc6aW@O^E^P+?y0fmnJP_>f36k6Xmkg6K2)eb2m;mT>Vg0;2Fq+
zcNT31QORjMTGoxb6bHkrVOV}W#-?ngmWn3%Og1nF=&F)i1J}C|Xp`}jWKJ5e@?rV1
zU^HuE9d6g`OQFKGHddaVDL8VtDyy%)?Pz*PFd#D{utK5p3Ov-*n%-S1$XFAXX0{A-
zc?>!ST1yvPg>ECF-jgK|I6%oJlGr4m4dFJgyTd(qPC89>-bNUm)h%!5uB=!~z4j4t
zxqE8KXOHNR^${PW4z`+p){Gb|R+%bHlh@VKB5BLK`(k6VN^77=v+&)zSyK_<=7!8R
z_sSYcCOP@6>2`6hnb>;9&@qAou2ay-tTtcnX8T?gg%~XLyA9Jn4?plced!zR1My~X
z(NQ_CiC3UG=uiJK!2vgL4i6ChTBA5n*Vfc*9wtUZ4Udw%j(t@TVJpJ_Go!F_+7K5<
z2xr*2bx;zIsqIKIs!>P}UY~oS84!$s!X&$61n5DwOwCbw6(T$;S}F?`jxG=5>Nr3_
znNc0XD={%JW(=ZLx#eNG=Mhv#=|IVD3CG$zJ8J-yY*QbdA6XWwCgw=P-o`iKa*q#p
zH``MNjBZG|Q0e`Uthbr`1ImF+alB+gEW&`j_NsJBVyKlkN=kz}4_>>4ai8r$zYYZm
z0Z0}vDj&Z%(({>9j1mTP1OEjtxdbe%_MItg`UT
zW}~95xmjwOW;)Vjjj6C>ab@Nbo|ps(kf^)%tlOtgpTGC~^yKE<+qdWQ{{E+*{E5Hx
z{`Y?W?eBc?oB!ee{bzper~jL-%jZ7(nLRJ({h?|He=k)3s?VqA-{{`SDRhs)#zCr3
zOgKJMB4o4(!HuBhSaCdfgBqc6PM{Y6fTCf$aQGC&;GnGF2q)O8XlH|Eo?=nmj4Dh8
zA&t>ORA#f(fifIs#-k*v!=s96s>p8BE}XUrBWTi4g=t5-SypDXo3G_&cG>qvABGq1
zo_XOX=x*B1=@n~m0M!}h-TR)cW;0qo9YCyL((JAk%iQ;U?^#5o2WY+TdsS`gWI*O#
zA`b03FJ_iibl-Ff_O1+V??3q|OgT;9Ghh_C@08D)$hLqEo<*#x#B8(R#b=*=#o`z6
zX=E@uuv0NZ2;3BGINFFfC;?V;4wxSj#O?<7heS2)K)J<8Z31O!4v?4$=1>a-ZzE2f
zYEe|M-Yk^d^;xsBdyHCa!n3lphj|g(qJ}I~dEKK?@Xb}MmQXi5QsDfiwFxyT~vhw%;;P=Ar
z{?-5KkN>a#-Jkg2+g|>{&%XNNFJtrV#of(*fBEpk^P5*`=vYoDL-Ymdzq;kJ4R_Pf
zK{X7Se6lSCo-hoKdnL)%5W^FuE$DaQetEc@&kwIZdGpDePwvmJ_kOte+lTu2)w{2K
z>;B6hzx~SF^GAE0!(-cSPTO6qn`Mie4-B#56u!c@6)Suhmisck$%tdZrN`6HZ6FT&
z5Ck23n?s^A4f^p483PNA9JkM7ia>ajK~?z58W!Eu^R^aF9?2DO^N2O$4VThZNl^lY2mifP^8D6LtfX)!F!w9zVajA=m9JyY}wX}6=(GE;u85KH#l
zT-1`Nn&tuoaG0J8nSDrgkofCSl}-R^Hn-~--YqSXh8ehqVTA085`cb4WgUwdsPdBI
z-n`~MB(s{V8~$`Uc&*FWZJk-#D{4bI+o9fJ+s)N}(ikY4$(ExjRojkgG$LxZxrx*;
zDLN|%5yUW^PW^(hdEon|BNUx592#8bYb9W+QLd9MI{MXSj&Vqy<|xehXzb|GOxDB{
zn$Qmcy6Kz@D&*NAfKi?*HV`ylm8znPl&J|8>bz1#N5oph*&4^aa_1#pV6A27oFm1J
z0!JqU*YRVy@}Ly`rap%33Y8J;NMViAUI)xS?koA!EkTj$7UfYED%|S&MI
z_}nT?Ib#f8!l+Gg_#{OhI(|qcYDKda_>6${o;foPE&ge=#}hE8%fWLEQ;jqw8Z-vU
znOGkVzORfNtC{BLE&Is?Qu=s9eD%Z-82L4H=SY8n`GF1t7h{@%8$tNsF!`R$E_v1I
z1S%-DTV=Yf5&6<>tB%u)QE)OX>gr;&!v`P2!bW)7S&5>!fk`5)V+LFe8K#TQ>xrGb
zWRhg_FF`6fl}bHB2pZi!peKRNq&7YRJ;|=3XAE~KS9e#@$;_qJVc_?0Z*+FL9vdxk
zlhZ&90M)aeXTA}}+08Z9Zq?}`9lLrL7ohNNM{z#rjZ@A!;$=Zo5#^&PVIIyZ4%50X
zu9fO)C*gk_A(Bg~06_f(MK`omL{}Ae9TOH#P&Kd>CXwQdNgol|kNs-L+w4xAb{)#<
zw8C0jwMZGmi;@nskyPbH+&zE(;)7>q{qe`I{ItIR2VeZzzx1iK;lKEge&s*-
z_y4P}fBj3J{@}&k&E5HOU$u9od5?!#b9j&3u3S31hM6^!FTJKyT*RvsAk7&-;d{lV
ztdgyuR4s(=FwJ9Q&pj(OU^L8E>n)@vT_G~1)V&jmRC-s4!=Z|(uCBC+b%RB_kV?*n
z)Jm*ruUKgLtGgX@u56smV1-gR^;koaDS;S5)iQc^%_&uLOyW
zZd6vf=^Bc|t5p1-mIHu@#gCD>^F%~MmB<3VPF0Jh24c6Q$P|&;%e$Y9q2lMB@Tb(C
zmvF1!{^a@^M55oYo`URClyF!H~yn5A>|Lq`1s1T#Fya6g$EUYM9Tv
zCZ3>Ip&yDLCfcs*Ygx;R3_a5J)^w1y*RjcCQV35i(OxswDoP)&xdYo-dXMIfIbJK{
z&Bsc-UW?*LHKdT~AKyX$1GC
zhP#Ek+p^f)w(wZ7S-bh#eDREFnpVqZOuHdcGgvO0N>w#gNg=97_putSig9L0h!g-4)<8NLf2H4en?Ze!+>kqT#10@p@+7dNfe#kh_!JWf)0TJKxW0Z
zDs$h@5u0%*EoXF_6Mcf7Ls<7U-Lo$}OR-h#M(pR^rCKn+Ns&hQzLUBFS2SlekxcGt
zSUDRE5t+L-ay2a{%4V!00=csnP&QyzIYu(P(s^Ldh*fq(lZFE>dq9b#3TEh=(EvF$CI-{z_Ko5$-dj)#44@<@7l$a%MK<
z<^rhqTQll^4UE0@%G8waQ6*(&I|o!Go|u*sO&R*|gQ=^+f+cIQ
zt>N?S4aiJQ5E-mBdY!CEJ=XLU!MGjjyRy4`Obw`@C%f!$wx4+NN!)iAiO{2;hXbJl
zq|A=mtQ(~*g~LKIlj@jtj?0lm=#ylWUz`Ndb+1V^XJ<$~+FsRYmu_u(dn1e@A2(b?
zH%H$OccvM*V6Px^hpRj|67dugXyfH*1F^FzhnjbHbOWJ=4SQ~jyG;fP2!}QHO0D$kIf`?@_35o8U@>_#;=myj
znMobGds|zhZ(R*X
zmu+jo*cPTjPvBB)1CA@#)!FiqaE`+S&+lG7
zIp4o|^XmNR?|Ay7f93t}`~JIM`=zh^U;j^k^H+c27hgQPegDPFth(&?-Px6JWTr@F
z_sVQ$8Ch6Cs2uD;F_5!frShfH8Yly@#0UUgn8_L(21uGZY_TO}3R4Xn{-)g%C>W1T
zyM?73Nv04R$)QQsLo5eWrUcKDD8XEE#@sK-#|zlhT&#CgW{{dS?a}C+2FqmJB*$O?
zZ#QStu*9bn47HanT>(uxbh~?YuW*`Epe;OVGM&2vX=Zy?Rk62z)b^O7rm8$B?NNH{
zZW=`K6_`iYZggOAs&3U{1nr$m%jozb?B(50xGm-*F-Gogk(E_Bu5n@T>_%Z*Hn}a#Pr>ip_8r~VxFA@
z_;f-T9Q(RmjR#Z{V)DJv1P+-1HD29=*&?%8f%Tk4)){(e*0d)%>TS{72Rp)fu!eDS
zW8=VcTG2VUNk4Ro1~D-F{|;Do*e0k8>s3c@hUb>JmZ~~89K9euIlGpuutIYP+augh
z;rQyezWVyjo4@jtf8qc5@BQ`f`To!R{Lg&+%Rk?!?Zwk45BK*Ue)az0;Sv!yu{FTD
z&b6&T*phsZ_FAeLVd0#?P!^CZreS7#^^`M1(Lk7Tt=N`_$Nl}ot2eJ+z54jw`SrQZ
z7u>(yKlT
zMbUyAETSPdU7OKR_n1LP=afR_Zq%rgixaS`J?ZYilWfzDVUyOTBTjOx(Pdn37QxNk
z()JHc$!efMlCeki+4K4x^0m)S{axt=2!;%X%AKV+hTcEAZ)mDikD=`$5)D(y
z%8Md4H;>x)>avE%lK02-gg|AcJBV$2=EPuKrJvP+qi7^R5GGd!ek0&;rGZp~M{9tw
zi&0Hng9N8~T6^w>APUQtUUlLiMc8BbOrny8F?_N;)Q=nigs#MB$a%X-0Bx}jAU45g
z0_OBZc=@{9^#DeFBSrey6SHO}`ehlQv3Dc;E5by7iAlWYQ64H8G~KhhBdE=ld05XE
zARSwcQ*1EmX;UOkEVNbaRT<%oqGbsQIHNL2W1AfLX~2kKg+(G(madpS4B1tZwJcOp
zY~mpjvnzwmi3A;!J{nfS#D+Fn%86n$RfZ(O(QZ*$9zIgsL$Ssd6q|3lvHhq`bF4Ms
z@feo`#+>ls<`1XS9`tY5S`!BetKZmGm2KqyVW5pCkG(U((f=V#Ull|!jX9qUt)&q|
z%8cZ0c1YVt_u2D6Fx9QOIjt5*{}Wb?1VC4baNlkEc;*O_1W;Mai`UI!szLqRT*)DY
zdjj)FKc@zmOTsJ*P@)D-Bo!lxc?7@7LHU;WOMQEO{n7Oq#%>yi(gB3vE__8Q6z*=7
z`*bg$%hQ6^lwzycXSH)YYP((>o_zH!Ax>KjdIAX^MObNrqLldDSJY_kdDbac9Xq>}
zByVO1)u_yObKWb1&2WlP`;j8LJHj7{A}6mK2QX@)CXV;mIw?JYq#M?iX3h;6k7RJ=
zZ3;Ms&ZLe)0bg>J5$zZN*Uc6=-ePgM8P$xBvS;M7s_O70=kEXqMug3Zl3@44%|tQm
z_z#jZP2!@*0jZuB2E~nWKly;>Svu1ywNfqDk0Jt^fx+ESa4q}Cwm%P|uB=#7x<#nf8V2+JmGvAhIEyfbMA01OL;FpMw8DS<1J;*mJO_E7r-O8O8(LMIco}6fnwo(agX2bK6^F2`R@koa&%;7Pa!&)N8
zZrJs7O=+nQo-Ka^&9d@qlU*eghIMAHSd2SsZMpAz*0wgnUv|&C5$;`S9@VuXDkpMG
zwS6=v2rD^zmbJrd#d71G1~%{5b!p04!b8IxZgtr))@l@}pj(^hCiE#-nT5vzMGD1<
z$bC;t>B;ZN-<3%dViv_zY_|#NySt?jMZ@TMIM4^IB9~*dZPz?QMTwx?HK)RzqEN|S;5fG|WTq*?r4dXu0-oI~Hq&$C&v#P~;CgD&Xg)imBdWP`a57G(n|J5?FMs`?
zK7ab+-}!g{mH*}c>aVr5^}E}=Vfw%pwx9?oyxz53+!x86OxI_Le_A3k~ajc>jC
zryqXudmq31$|XN>_tSQJbMx}F?oQjSNvgcuH$$L3R#=<1wwNyuLl7Zt9^JmSlO+n(
zGf~6Y40UhjA8P5#&?))`1g5U$C(sUh{fT|ZDl{KiSBh89C
z!|s7diK*)p?N&Irc4dg?qF5cy^Hi1YW){O<3j&!*=RQ4&2_}Vux-+v@KbYUR&{i5?
z(>xH7me2ZJH&oKGfP$;qwF`tuTG%hEVg&xjMv>2yx_mzi{MOLyuDXuuRd8*{(t?#|Xfis}T$-nK0Ot!?oQYyy#|T
zUJA&%d|i2{O8^{8Zfx{*q&>_zk7{OA`f)(fVg>gyLy%pC6Xpt2rAhiqg}^ZqI5S4W
zV5s3%-1OFMqJ6Cnj!O$>T6!s%%Z#^-hO3nt;u_c~RRuB1(Mufe!3`L%K6mbzV`eV>
zo$d&8cw0#K#NpBvRhj#xO@S^ppE|BfzHYrjGzyGE6ZF|19*xT%(Gii!E(&un8(h}N
zq?fE&qchW{H#jj~4K5aem3zZHmhue@Y;S5st^V##7j%aiDv=5i#2nN(!6XzfPP>RB
zP4SKB@`%c6>!u{{=&ns{wHYd@YLjOsA$<#PxgUd|d@mvm-K}X!WtY5k_j0eCm2^;u
zm_n~75zm=)$r>vgT(mQVMQ9{zx=($mY@<*OMKy|ZI5YB0)GMRKy;ZN@QxU^6E()s<_`+`4M!spiN&YuqDg
z%}ob^>RAFw;Y4fXNnW*zyEcQq;->`IAsVG4IE{vxQZhS$reW5lx-#*`rSOa~RnN6k9Q&k<3!%h~+
zUCX?OKH#h8a1^+IOOTO2jrxM_Sp{s|0%FX8q~U3Y!xK{IA~9XHXYPBxxxfEpzq|l%
zK#;$y!f8Ewdi%lq&%furr{DAR=F=yI-@RlOglMQL7p^R=9Ol
zn4|mBm%YxLFTh&Du_Ql8Hzmx}i5ZRqPB7Qi9ua!-vv8onP(*8P;@;{V4fmz{)}uk0
zDU8YIk4s8TpbSAq2-B^xY#gH>G=OA2TpkcP-Qk+ZfsQ&C1xJK){zXh8Jy3eeM}azm
zJVFaH!kvZVcX6W1-Gs*sokfbLx%$%0AafKq*!y=s*~2Dq631p&JG+__^~}sE53a^qt3j8Qq`Z5WY3pu}P%6~u8KG%M
zY+a?B+SqG13$~c~B>7RR%0ON2u(pg(21h_mRu=unr)GLxnzIRuR@JD}Of^>zA#n`o
zPQ`2CUWz>WF7w-EP07C#9^^bG+0a^v3^KKx)M{Wzf~$ZQfZI}|jBlb*CL@jRtgNu5
zR+wq>OsSOMpx8KCba~-8@ko??NM(by+MeV-*voVnEVkQiTOYmp*4IA#@(=vL=l>7?
z-oNqV|KlI|m0x`Ib3c8t^Y-k?-P`@Hs+kq`kLMEeVW_riYo~uBq7lmp*UC&5lbQ%+k|pVsvJ8B
z6(ChHiBon3SISg=gsRw%aT$Zk28+f{V!+5CTu8JwAu_f=U?c&OkaVx^Jvz-?!HLKF@5%9AnJ!+6DHNzkN7cD*|R$FRq@xc>3hUhcB)l
zU-$Fte(}-sFTelv=RbJ-g(t^{-B)L4XNU8Pv$(PB%yG8j>=5Ui61pw7#dh5}0x;`x
zcMlIiy4?|Bc8FNsmdrTp{ET)N9L$^O88ffu6*v00R#{m1B19|rYI-l4pt!rkxhDsOk<)6G&6YA{V&iAAG2mUXQ}ucV&p=eA~M
zQ1NI@XDMBQEIOV>DE_c@)xfqjHJdNVqwkeT{F0`Hlnt9n{xh`=Fmnbz_!92cCw!DG
zI75-Hqz-@}LJv}gRNrZapr5HsuSYm@HbRZEQ=%qt2FKmm+Acd~70c`Sz6?;T)2E0t
zwFMl0vDxUV+9~WjGc*^|**2k@P@d%9>|~aju31D93gddH9AnWkamq}Gb1E#;qo|&3
zPrP@7To~<4GPec|pIpqACZ!f_w7?_53^U^GR-?cb=UOR=D)XS-fGP456=uV4G~nqO
zI}anBpLcSk+3-T=riJx3R>^GlCFAMp4qt}Gywb|@<$EMF_x+vdlZzUFD)BN*`_l`u
ziYObHphSIA&9TqBY>p^zE({KnhiZ49oZDb#>#%^{j>pmwV%wzQ1hdSX=M&V=24GoO
z*tTtz>2A<{+{sEJ+jW(-xRhh;fNqM
zAxBEdY=fkT!)+#d#t!<)vueMpjV3V9p*<__S3P*cqZNKnhyd6zH>wf^TjFySw_(AT
zv-GRMje5&e)zPAEY2?s59@7@42_L$>WoEK6S{}&jRv_Vd+P{HqnUD$Zh4njRfQ-6X5%ws7ZX
z=kA<;{4(yH#pU_o^7id}mp5*m9S+^7E%PY7WvMx#T~kj{Z$nvP^>DHXsup#14%&Qv
z;dKj>HjjBs>wB-=zx&#q%(;jJ3dINt=|xLt*oST4}@QjCY}A
z@7mQ?EiXfs!y;t({CpDNSa`TO!KUd`_|X+Tx~nnm695#oF~oy0szZuH=Hn5#@8N#|
zHn_q7RjrB!Q>1{OAv0GTcu@D&qmknmYVJ;_>j9)vBm+G!@s4!&iP6@+Kk0<*FxpJ{
z!Fa`(LzY~0_XIsap^xoD*}aSJRD+x8wme9xRxa1X$t)`mhclLPTV_N|btA5au%~?u
zAhAGQ8}29%!*ILF$u2EWS`o#sURr1D7K5Fl8{ig46}(+y-0Al=>eXQvwO4W#w}RP7
zSZ!()k!k5-#XzxFbd?DsA;@-&gOesRUko2jWv{>DzU$rSY!C8s%S@hWYeksToic2l
z&<@_4ZrZqP+g6RUIAat;mqnNsy0QW8tbe{?I)S=QqyIZY;k*+p-8-Tw3F{)>_7z(86HkDY-9Gn@MJuVotL;
zv;fA6!axL^3pGSSLc=L_>N0Q$ro
zYO8TCYw9jo4e;dYu_?U6S9B&QB{L(IN=P#Fo``&5+P~nEH;RL7Sd?wuD9{vlikEJ3
zWr%$FloYn}$@hTC9##8VCoz!uM#3&d#jWz%tqXy1DTbnR_0A_Jb9&w)`*H?YH5<%@
zzE|XI*heZeW%n-WBY0v3$$bfn1~(9n#D#|y(wwU;Hnk%R{|xX%c9oAJ`C}vD`@tA7jXN~(7aE%sxd
zwV~T6hu+l~*o#yXy%ScXtwJmWL4l|F9;2cKF=u()6-G1^ZZ-OVhPd=&<7`G0F<5EP
zr!)>4hkBLsApJF<4}sIErO#$z@`;oiyqobH;mKR3@*QTz;5fYyzyJVa>h
zLE*Mxj4gy38P(EerHv_=#W|`Q_AJ9r2s=1}{YcRC0fQzW*6K`A23T>-2$}h~#LyOd
zoGVg%N>Am?E*3341X{itBM%S)BS?`D*O;s%wgUQm7~qRY7Ypo~q^|+4gqH#`*v(31
zhHg&hX<^lB$L8k%Jr+KMTC2PEovK)=UP7~Od3TyR%ZAC3pei$~aoxRDZB^G@+qOM_@$&I@
z>=l>yZh!K%+n>94`I#GW|NQLs+2Q7$Tla2U+&ILU0l972TN}u!YW1NxUqNL#Aj{IK
zW_%^vr3LrfR!OZa%G?*Tn7c(pZrgQl7dI~Ny>|Ef*4eWsk6%37e(^Wo{inYB6Iai+
z|MZXl*MIIm|7%w-9)IGE*O%LI+qOIcs7lZth&~k*ER%3x29#N6ZPQmX-I}PfLKM>M
z72pRfx6Iv!Z6TdTl2M{$VH%m*?6c97fPcccY!bpr#M)we%f7O>Vu>?(ad#jdpF%+k
z8!W&roF+yhqjB&l;@i*!$n+8Tq2t+808mdqWGE>v21MyL4;xoWj895wO?r~q%WrM_
z;`E6;Vv&qddb7scTT`A=MH?~1A{^)~bLu4>X$Ugf8T(aTcK_lx(hIY@46(~yOh}jw
zV$R#RSi(XTdB~zMRf!IYEYp;3bZ1+0*GN@mX2hc3Nh>_boI_b0XaW=iXF8(IAR>jZ
zx0b6OTT!SFMDq(XQ94A_9iw0-0@E;7bb<-f3YDN%jbr_4{h>J%@*LRbxwQ8;oT_0O
zv8rsGNrKuB77wBVNx8=hkE*P)h_Kb2-DxoMV8_qKNyU}X`L?%`9$MK~u=4zLcz8%@
z>1E;P>*AQlx8D2ti?f@*<9Ge0f8}?6=ezIufAy!|fA4L7{lV?+<@UjsUtGOB8f?MQ
zBJPd6g71`?Pn$#rGvrob%fp1E84UD6nIPUmxQSM@^`iBb+11tY*|QfT>CG1mHvM{0fIG=Wi
zYir<0JcoA*^{A!^iMZa%3y?V2$&5hw3UAh_nFBra9Fjhr#uk)?6M_wr!I@r_THT;a
zExz3TLv&h)yrInKj;^e9mYi(;Sr{-qcXzi(48%21hMy31T@_Ps;B|E~z^SOwd7FI=
z%rv^0`dsaZp3D%-yOG<5hJ{bu9m4GH52eecZdmix@CI$DFnL|S7nVOtiesp0J6zujQsI?mHnKqs|$A64mf
z3qIWkcO#}duOYAvbGy4bts98yHft8*IFT#IrLx|END**sZ}Zq@^GWnt2M~!DEU~ksG~XYn+tdo0
zx4~R|8O53DVPL2vjOEjc3U2UOHo#~zmsC**I}x{iW}%&(XsmUxv6p3??LJGNOZk*@bgD@-3xNB3C3LQox+j;IHhF~TPl;3dCS5fph
z`-aA4dhybpuxJF6pv0S@hN9v-oJ)+LSI&3n$!z1ohHh0|xkEw9p-Q
z7=e31xz{1EQuhT^r+H9>B`ct2(y8zeAB{(`CaerB)%EICYLem9yqwI0bv1|>m|10l
zc9@g6Y^Qxw#h_wbbQHoer{78>0xC*c8LpEE0fVKksL*~5W(c}u!lc_Wn;PECw7Qno
zQ-rXf0k!UdqPozUo#p~KoWY083Y!PNm&<0lbG^@&I2}?z>dDz{x^45%O~i@4do)AO
zcB=URM(jI_v~4>9CN)KgyU`C{#1|cK-cxA$9Teg+0afip4O1C1Kev09ppxr7iyKRL
zRnyt7DjQkbv5{R{_p$1Dy*+<%_2_v0((Us8%}>2{`)lsq{M6-o?Z)~2%XRzajawJz
zH_y+`&5?CH9%~{pFE-syt-JS|J;X&gcWTVjELjk184O>xhZ6&JHw(Ocd2P$@ymsgQ
z8~3iRUOxKh$^F+ZzVn~?#3w#`@q^$06Myu3|Kbaj6{mkw9c(qj-ie;Rx
zxD~j*M4OO^%%QtVQ`ROwll>vHI47RO`?lN+SZh^h<~Bl-sqWkiz9WMM@2Wjue+vwqox>;t;@tDs9)q|6U
zw9J@?IwTBQpGdelLEcULz+Zu?N9Mf}$Jgm%P*)py(e*W_L+YjIVnqTypf9>D+=YR8W
z`{uv%BQO5^fAO-PA8y~geDwbF$4{?p>*cSQh8T@8KvxNNe!NDZ`$g|ETOPGzNX!Ie
zLK?PX8TE2qRUHv)8BkZxuAe@8`s~Hi>+QwM{^&U#K78`??>+s(p(bs-g~`
ziAY5>AkavJni=SGkM5uw1T=*qh;4Q+}0-Q7mQK#LttfDr;Qd8Q1RBouga
zYaJR@uQdLp_%h#jSdP=OnyIXugA)SoVc~HaJ9Cwh7j2wrz-vr08cQtIk1dT$mb=-h
zKfw-k*4~K_FbcPlGrkG5Y6Vx-vFg)c$Ze}mpwLNopYCJjw)OS4y|})5biBSoU*5j)
z#@(BresJrv_b)$n`|`CjzjNc_=H-nWXXj@PY}++qGFGU)TfsFbDDN%{%S}n2dq!c_
z*=?O$nsJvL`v6iH02{8R_luX;m$z@d@u~ZVLwxw~Lxlem-|_md`XAl@=^uOl5C8jr
z>HqgP{^re#!^iG@tkGB3FEfu-$!S*$Tt-`2?>g!>?mc24pf&;Bo&0o%jmk9IBqQj9}s
zqr26J=9cN<;S1GfwNV$vf|l)1n7ikeEL_ZX7DTc=iHX4aC^N2;aNwk7Km!4B_IE;LIB_fF*q$QuWh$yv@
zT50TRc}lk091*cV`*ckJdi468l^%ZZgH#9LH72hN(3GF|m`4XTPfyI0`8Y;Y&*5-i
zhqcbb?cMj^dGhqhKlvTM{QvTQ{jFdB%Rlym-~Z^p|F3br4(EsShwnXo{Nalg>uk}h
zmLsn@j^4(YYa_J?*hpD=w+q=jdW(NhB#qsLu>GQ`=pFX}iK6{x@pKlM}
zd;WzFpMU<*i+9tm*V*Cn;`Z6$=CVug#YN#^%j8dM5zEXRVKnNyiQ2BV3OBWWwmomW5KqjD&3a`P%Vb*v_D!qtqJB5BpkmlZ3>nrAuL-42I}MoDUiD^Zzg;gIn~(*N23YnN|?HaROkU|jj<
z@$v!D7Ea}>n>oB0W_yruRvVqFE?Gsj0;$deWn0!h_CGuOeRu$+u|H%_ALAjXV8uKP
zce;Y8+6$;?7iw*Kis)Gb))VNvyLzkch;^bNt3OeB!Mjbto|aSR9WtqPilR4-X5!d7jui}zEch9O2n9fda_X%hFo`G>ZY<&alAR;CHF(`#@mAjX#CQzU0q#2yFR|m4Yw{|d+o+&
z-n{d5uig6UTj#H@xOwx&jq{6Jhx0>|DqKfJr>QC`+l12T!J;uMQV6(M=4KPN7+H++
zuAYP&j_&KcM%e3bJh=1P&1X-ZJb8Bf+Hbn^8-MdB>xl3B!+-rh|C2v-ef{LC-u$$?
zy}Wvn+cmt#?XzG#U96(uEXyV3X
zI(cA^P~l~jpT5&
zh~n7>dcI=+tA`aYu^|j7BnANzSXLXx$BxgFWMh?vCUGK7$f{}-c~wwTjuHEWlbwt;q`r#~L&+_wyCI=1CkCxYzZ|6cgX>}U`!-Ko9c=7sxBdKd
zo9(K(X4A<+gIa;=*5;pV`S~heF2J_hjHcnQV9soEO_C`Rk0HU~^ulP5SR;Gn&orvG
znDkR_{^4d_C~a0j@83sKH!#qcIj0bcd1MHaq-O`dJQfEghK`!X1{?vHFAHB6hszh&
zSMR?63%76G{%ybg*Zt1l^BWJh&cFYUee|zB`;zj*xg(e?K9Wq$NDAHMha=iYzv
zg{Q}dZQI$|`Nid}b+|Z-3-lrEAX6pmfDF*~B@ijsHCAwopNmayoCX5F#
zckNBJY81DI2dYZ!@77SiJKe0%tqtnx2RMxvaK(}xo?SpMb*U_ECFn2*GB?VP!`)>D
zwzvAaFC5HHKQ^w!a2`I@d+)O$oMlO5|0A-4b!
zK{8f_wU%{lxtaMo90mpwg%X^jx_1?g%DPdtxm;=(3_25L*w?ku8nK7HG=0LvX#?@2
z?v!H9&CJ5I2W#qp#{Lgg^b|jKtOX#GT*v4tQ3eO2m)-~kutqd8DjyExBc7b*)$q&rWr%
z#v;CF?27K%vK$u6$yn9nq1dl+on;lh$H+b~_o|FAG8K5x
zx>|**v8J4#2#PZ++>5Yx&B~uii&@mH+gL`SGx=$2W&NStP;
z*#?WXSQ61-7T!o&Mmbf6M6`X-eBM2N80qy{z-#lcq2yOIa2Dw$Y!67?Z`8@=2O^_3
zP(^2Z{i_z4(ZAxTsH>!!i6y9sIbIEMWeDWdBy7cc3FJnOtGKn3^UO|?oNnPhY;PFZ
zW(YlxfuBd+h~{8fA_MTUL?J&-JkpE8GUe_i2Y29N5_xTldOpXt!m9
zYnr*y{5tEH+g0_|mRHB)^Spj}-0DW$e{knBAHVwz4{m++?aK#;xO?OF?aPbHwN}-Z
zb>xAc8UDQ80b=Q~+(?Ia(R;Q!i|}s?+?qq`t`0a5Vb@p3&GOE@Td#fmLFM+rN008^
zzxkd2?3y5ij
zP((+0Do6riiz^93c`P>*w{(u)P!uL&^FDGl_6HJ(#&`AFc=_<5Dc-DBRh>Qa0QGnQZ1e5MpFB
zHQLI3af6)D^(tS!2FW6<%+`d&05`L0ti$2_aPji$>6hMn`|G~$v;XS9{?Gl-|D|vG
zxu4zs%pZI5N!Jl(cD;K2U6#}J=zHAxyocv)*0x0%x
za%u*#!C>ZBFRz|Hef0F{qnF#Wm-X!V_VB$Y|Mwbn55F
zvP*<#Jt`)psIzlW_euxb^
zTI?8O5#-A|XF*e!58lsrxNROS7VlGiU{7j_g+ZDzH~=!xU8|-YF^l7yw=|dFJDyXc;EJqjFpt
z=x4~;Mtel81NdxtT&fpsIa$3LfrDsKx7t9HIX$9QC~%`>PJkr_O2WYL-fZxsvl=Aq
z)PfT+mv^xkD8qkY>QSJZrb)%=5cGf!H`X@85-*rlrOn-_s)#l4nl%lOTg%zFPaVB8
z%b;qc`CoN)(PmPK6L#L$o_NU-R_V%E=60RE<#wHY-F2PYRp!g%_Tu{bcwzS*-1+n;?tjDUw?B91
z=9}k-dpB?1KD#(@o5ps1+>SZJWK*tbQlE-ek$|-Tj8@#S0jU_g=^+5KaD8?+v%b2z
zKD&MS#>XCDmnZNL7FU-j*;{lt$v`~&~?pZ&W(`gdQyeecfAyP4O=?K&%g
z1nI2m%c{^WD;t@s@zJNSIrgGOg1vcXZPrv)bBcrR8e=1tTJr=YF0F!Q1G>3gdz-L)
zfw){{4U=(-w$=~b`Cg`k*v%#k;YNBO8Wv%46V@`M%xcsr?Yfcvz{-aYn7@2tJ
z+E;S&IJChlORHL@e^cN!*lU;H4ahM$mQ!gas++P@ky~XR%cH6(x9~|}1n~((Gs;GI
zCGRUM-ll8+;C8@Ru(VKfl_}v7;oKU{KkpVW1BPHV1u`cgys2gu5h9^Bdl6~tA5Qgzw^!uRGpojnO*~o176o18{QZB0Ly1?q{0L$9gPik
zwMaVE*==DF?(nOt>le?SK7RVa%j1*h`Q$}Cdidn$-g*3!A3gsCU^~CKb@Tl0ip#^<
z#qzW8bGLAdh-DoEeaHujb6p+-x+s}-|vvhz)xjB0}fvi
zy!)jRwRgaR@@6yS@z~vzqw6A@CI^yD8z4r8xa-{psT6j=#Dp!#Kr;cvIO_`qabGZGL;xn$kj<=K2e*Wj5fm*I^!oc>Uu1_T|OR^Ye=^KWPAo6fqn!~f?G{@`Eu%V!7w#Dh1oYTLG~Bf4Rgy_F{0W#~e({8CLqfW->knOVSL
zg_+a70g(I)0$}JeB}i)OcK$6E>=|*N%gg58phkY_X>`uhA~fg
zh{n8=G$AFoyK!@=%`{cOw7a8n>tSp+STwshA2@P^`%0HQXQ0AEZ9R;$Xa{dGJ8)I3
zX6>UJ53L>8N^8tb{u&5_y>{cf8TXnS
ziitxr6;$zAsKRhJ(k4YVhN?ILdc|pm@ty2=s_od0jTNFUl=uVHgj9zuLI_JUkZxHq
zsT|%}4Jr!h`7wZ$VYUmjAlq?DX1?aBBH{*h9eW3FzB72t*NQ<&Rd%yIjyOath))J<
zGmn5Ak+!X>)6LvuAEh>%9m32?G3^qJ8AMFa!P{UnPaz4Ed8$*jzjZ)dbZ>}}$(@|t
zepu&m@DD!v^5bV8{m=f{@A!TH_kZEzUwiSF|I5dJ`@ij5>+J6NhZSewx*F$+<
z$_G`>lheW&^TISkB_dAPZ@flUM9~k)X4Iz4M{uCHUYZ-Hx?B22>Mpv`@a1URa)V)c
z6ipf^3}_2qjXX{8*#lN)k?C(}IqjtQsRi4B>%PX9nVK=*&$)00QH?WXe3ld9iicIyX|)
zM}#_62Sqj~x=FKcClk!&q;IAprOI60K?%O~$-Ol2(MngFPvwF%daj9Nx9oFhdl+tj
z8`VE_6r6fmlfdecO=yY%^7)!@R}H6z$WV2vHl<1}NITpmE>nvRLg1*=o+6;7<}ucO
zZ1ff2HMr^CM=LXh0K9W6)zFG-PTFm0uNd4{Lq#CjiF?&x(-X3pRQzT-3tc51?Y8!D
zl_21x&t@})Ff$<0omvA!-X@DFxyadw`b4!A_k^&DOm#DFo>li)DA5;WQDggkcW9Ez+xqrX4uAkiZ4I31QpX}_ilhr
zozAYO0A&-byPLuvG1oX*mgkeLs@yW&gB~+1MF$uG>taJsgQUm<;Q$8icQhCm>hgD+
z)voI%l}AL08dQKa!$S9di!jA4bc0l=gN1iBXhSmv#)K`vQCWKyt|8!{nfKW8vvWUg
zc{HosURH0_$Eqzex9$1$%NI8euf6%&*M0KAH@#3|L7+54T)h0QfdE19iCV>Fa7H{W+q`oOsR%a#h=AE1O-n^Ur^2w8D4_>?boxkN1
zx9=SOvp@X9|LLFn^VcsQf8zd|hd4WK*IORxGF8pNCNEdA*kx-o(}K+2_>0zx%G&bS
z)g8JKJx2cezJqVhSG^xKoi6a7ulA%+vhD=un+Om`ia4yQ3gn9=ZHRnq7yF
z)sq?Rf_iXTVN0eT%TgGymZLT0zsyOdz$o`hW-I}(X5M9mtgP)hJxYW8yFUz~e9cV}Ee_h8^vv{?XINkG3=I5!j$YZ%qFHbkj4;
z-AGCxbJ9SM(bfz}uV9?f0JnDcb+&5jmoKh9di3bY%MY*X@s&S%_~c9PeE5$)eEOwh
zJvy8n&Mt1RxH$70%PtOaadvhVeg-LeBIK}ds>)M#Qfx)CD%>I#BLu5zX|ULKi5CO(
ztkE-s*5@k6Rqn3YRaG8QTdu|J_K@p+6SbnToFSHEDK+$e9z_+asy`+GtLI@$On8-k
z%ZwZ}zYS+}nDegRnIL8jv_|d6|!oQhAzxOdRq}oBncbn!&ER65bdNl}lH3uLQ{!Y)
z$eS5D+!|9QYg(dA&u7rO6KDhB+n%A>7?00k(G`a51=M3w18h`s>I9Pq)og5PHrWSB
zXbs`VK1ayJ40W5PmHkG^s-C89v_rAVdc`QUvJ>Dc7Zvrn{U-d!C~mh)2~Cn#fgkns;V}A9$s5%Y9l>4X2BgA-8#ztUcioe61}H^hwhsvUVfZ
zVZ04ah$^EN`?8uXg|VWlv(pGjGO4l9X>;uWAQsl<@Ngtq(iTobD>650A6x;DpOYat
zOj8}7ZqB|kg5o!(!z{G<0uXFmRRwi+`zsd6s;cK|1Lbpzl*&rwkI6&WIMp6TsD>2=
z^thq3_;bx>UjgwZmRA?bjPRIwZV4{@(1$Wsq7s{F77L^4-#!d!a<5u{99BK{kkgDY
zlw@rH%rr)BGtep%0SfW?`X&w2sKsRI-zTU@w~W&Rixs;7k~I64NgMlYQrLKava3Bp
zZ*A{`Sier5DIx5XUoyy6L{wJ9;;-4VRK5{V;Da|=WAq4}T5Qei(z-RCXU;Izipt!&
ztl`V4tg%6(>=ltWabPp_sCA59U&&}s_`&!E)#{29B+!S~S@pLvwKa;U^aT5XeFUtR
z;Nr=SEm;;b43BH|)O&4=b>-7g4kcCOApQNkKXdCsRys%1-CJ(1T7^rk&_ETqd4uE>
zcW$)6w&k!)v^j!LzO>u31y!09&Xd&}+As%qIOj1Dm74+_XBt|QA&`0&c=q`I*-@KXD_d>@0`8yu?JuO=?C9@
z@8+k@&+Z%!H*Vj$b#^#AULTLwM>Oq}=7BP*FcJ4aVbjwSSsoZmLotBOn%iP^-r@f8
z`g+|sd+_nQhckQp(bMyb8^7+Ke&aJ=d-E^-*?;&S|Kaa{=bfMb)PpxJ;__I>q11+L%9*D{X?33e6Jq2&f#7+U3
z374)>BE47F5a!Ds-1sgqwhZellk6HlHIqhi8G6j~*^z^61g)huSaXX&A;CpGeC6<^
z{5@@9pNcgeVGhnVnmr0}bb&@<&6qXq(bzxXM5JNsFYJ`
zn6F7hKvU`(R@7%q6@Av$l|GD4sfBg2J`~300`Y)b-`0o1j
z$8SA
zJ$?M-$)oFh@xmT`bp6G59{u!}Kl=RD@yX%*aDI6!;w&)_qE<|uX&qAuZ+9JA3#2VRFF{%1Q24Wh}nc2T;x9#R$qDhbJ
zRg_(Y#3Fl&El>kMI2{Ofqz3!%gc;;kLbm5VFQ}|U*;=xq>7D|Z=;JtElMSljVMBugfPjIx$|VY7VE)v8TkvP22%KDOhBiZySrN18Tz>o
zyKe6dW*FqlyT|cO9XoZhbb;y?iZIthZ9tDm4AxYZsy367LQjP!vSwBd7)=>CNnm{`
zfQ+47%bZTEc!k(WjH>c8-NLlarzQqkS8C6Kz$v!(rp-J;Ktg}MAG($Z}GsAtN7sCX)`IFtDOD1{LUf@P73QP7r*xiRo%E|+?YM4IT
zjI@1v!X~#9HYhw)ZfJ20jju*jg;Ufr>^D%aoC&crli&d7ogPMMl}iMar-B9i;Hi9F
zS-o{v6;bSCccHh!@oIZ{ef1=-?f#8Vf9lO|{Mfy(yK#8)?Cj>9%lo%(-ZJ;&^>*Bj
zr@^FIcV}b3xvti3JgAFyNRw%_DVRV;+Ax2DnPaOX4!CpY&gGqp6+jgCq?Ok=8HkE)badtkFG;1d`pIb9(?ais)T~v
zTlH^w;rB9?wObZRaHeakXbHHj@XW2M!$UCDi5!wmsg?$R)=nOkU2Qkh#@hb=)wyq(fY?dx++
zp53lRtHfk%<_d6k*B*JcfVNYk3SBu8+1ciXp>i}kGd*DAILJ#>MbjmFOEJ`W{7vG+|5iTFk!bOnWBYNoFj}c&HbrkX4baipsc1oimS1Zl|Ca9;}SHA
zV8t_Mo}krPXP3K^61;6m^#~}SHxCaQ`tZ18AYSJvvS*JLhg6gK_UB;Sl){MF&2kyo
zL$@3te0j^p%#DjNQRp`2SBbWUiLm2yG>>&>Jz|tD3+sZpsYJ6q3_J0^+_?B#$Gf?W
zW(1Hm`!=M3p=8(GURiu~D%I3P4jc0;nr(WVm~)q4
zjIGxzTVCDVMtE!PS}WY$NEd)&W~eQ@%P96%HdWc)!xgNPFOrJ#EHYCdX_kp^Dk##sHbTi4W6^)ilJkJ9~jH7EJeB{BTMs!7B$b3`5Hj6&PvygnmmV!>m-0`-a
zRo;%?wk*JxFSjgm4Ol7Fjt$m9<%{=*;7G3|}H`@f4$~JF7h4h;EHYHL|BGY@S$ld}%c-OM`gb
z6WR2dsxqr$EgH;Fh9Kl{8cQ?dzEI9TG+=LHTvVnM(JrDXU?=15hKK|I0sDlhL5RF~
zb-6d?i#^E>gU+nw>U?D**8}CS&temcd6m6lF)6fks?HHBN8+Y*yAutuk6K8CDJ{4%
zO+wKz9Axd09{1?sqjYQFS>5d(if#f2(^PDjO=#w;QTGkdf>KDqz)-G*1^ka({7IpW
zy27gEfH|&k>&$LbhSJzJ+(d?&PP|`j+xCd@3ZCMu31_3vm}Ni?4NVPqb2Iy7!=50_
zJZ?UlyVW(*MwPZ|Y!(2@lHD_fmR9$oGeXkow}znA%@rF{BKYo~54ff^X>(ISln>K-
zsYj{GRC~_Zjw%pdhb=47rO~T(<#lzIW!Lp~{qpMN^Q!YV?tJ!BZ+z4Jo1eY#2X}7X
zyL0FMVVzeUkH=$eZD#UnfOgF54GlCl^;A1ID^d?^V%9W|p9J=8;oG)l=jENtd#~SZ
zH*a6~gWI>OaomoXNBRa+jt>I_wF*Is2Rz0k~1oe(Nl
zRU0!A#SsKjcoXS4NAa2p`PPr65-Z#>EDNfxXeP$`xy=??6;(TFp6{NyhzF_UlGyyH
z@ZRO0l^X^l;;-i$mBT^{&~vx!CXw#6aS{Qb9(%yVF-LH_fB9WBDY2HT
zJ^@&F=Mh)&a_Zx|t7pY+H8U%tB!gxZhg3eW9_td;xm6vp#vo4tXn9z~wjHZ7JRsH>
z^z~T_0M!UOl$)6VgVU@@*ap$LhP$)Vs1o_DU-8~kyD^)Tm`=NA;J{P|x1A8xm^n4e
zFCSfys&^agPt}IX6Y*|18{eH&YGkR>0m7;~%!+hSxIqP|m_m{S+HjY=8xA>Zo5f)r
zp1pYf@WY4S`mMk8_x=9=#jpHzpZLpv;pq?m<-QUA+JhT!zy0j(UwB~^=Vv}#xqZAZ
zZ3+gXbD6ZXxfZDj>E+Smp%(PizG68Hc>eVH`yagj^!cN*7ti~{_pg5btq*_lqnB^N
zw#ys$4(sOfvt`Tu5V67zjtE<1pSrona>RFr9^iW|P*dUu5q*EskI_5nCV}92I
z*RW+$bHNG<6e<9wgg&fA?bO;|(L{A824$J4Vhn64r$JTKD*$Q-@KnXK{Sys~uX~pt
z^P;gna6mzZw{*a1o?mtKq$M|sWetC|nO7$|Nd??%R(EZ1cL(5IgXEdR)vLKU$t)tL
z_8mGQixsmSVX+2kOY&CQhV#VMz1kXaa2U4hBT*G`ekOR)ch}q++;Bjyr%hFE6BJeJ
z(dwCd4uHuTI+m)EN=z`~E^Oqmi!m6}Ud1(7n@ZEmh86ozcM0ye1Q4VS|;)U+f+yR!aio7
z_Xl1Gx6Iy!CIBo#zf$R|U~WOZgN0jdjOR7gzjcZ33lyJiHO!Y~bJR?23k-5i%gKdG
z{XPPR*he?b(d9lC>KYn0=T_JgB-9L+Q5s9OEe#JD>M5?8;|vqabm){e$BafuO{<7)
zyW)7koXce8^~(%;Lk8)O0snBV7^?D-$RV19%A?@UU%Tww^gB#G-C#ij4D(tghPjN5w#%2Gu|4*;!Pd~Vg@rF${aRI$4BaDu(0yz(IgM$`sTj=?m8(Rd
z$Ug{(0+gCxm`qFy00S~n4}@v?A{B88d#+hi3Hg|0%_lN_0CwU)m%~zCQ*O>J6*@E=
zZ5cHF#p&3pYu%5z3Ub>Q)%Gb&5gt`}!e(XAMn2t!sXb^jx@U+oB<|2aFW8|d#-gFf
z@WX@#T;h>xmIIL3Sc1;^PY5t&sQuCk&^R0RZ&DG3jZc1kqyJE{c
zigsIhb@lT4`fB0kCtm->pS=4Gw=Uj1kNbCSzkc)L<~pp*tjZ)0ZoZCLpp&a;$hFMc
zNQEZONN@(Qp4pE9wnn!PgVptRb$;XW{>L924)NrptK0W4|Ht3+#*Op!C%^Y^{+EB|
zFSxyU{m$!Mz2#N*hR*72iiCv~Rd-ReztuMNfPTZ6+mSreif+bb*F2>>jn*np>7U0`
z*2YRt$Dzdv&}k6LWHTDo&zsCl9oFuP=>x*fAZ#uJLs$eAB6CA{nF}-nH_ujX(x0d{
z_v&O(TFznzfA2
zVRv`28#!)AXgc`x?rUy%HQ*
zxf|ac-6$C;s}T`KMqsy*
ztt{2`Yxw3G*qB?G6}M2vT4bF-|E}GT*-n%dWR!%t=0wc$W|mvgl|hz{lQf8L8Qr=E
zGu>|Wocb30`2Vq329PD|S%?rjqHYTl;C$#`FMaKn*<1H?Ivzf<{;-staSjweg3r
zSsh~7GTGEti|U;v5)rX@9&B?fZP#dtV|M0dO)G8KQsO|E3CItE;SyT9?^~~{a_fSx
z7?TBHzXi%CEFT%Y4Q4b^bMvlDs=hTDFfB9Zm)kYcCgf#0F;mr{eM{LWfL1O|IVJ(i
znIGDqawFTOdD7ffKG^E?a0(X;$lQSTSk~fe%{F-%+n5p}vP)5@dgFa9t#5YUKj%`?
zgs>Gp6hR`8c(qYW2CZ#+O-%?7+KwoCOm)(uhgS~{GwZD^fHnqmbTb0DTQ#{+V61Mr
zh}X6q$*Ps7TALY0w%wQ&Ci2%{e_)omF|E?`f{SVN;aoTi$FsgKC%1MBB8HO|q>48a
z`G}Vwvzba=itCAr8hH`cZ?Y|XteDNZXSFX;7@^Z$#to<(819O9#ZPFwja0%SirG?y
zVLXIkOegSItfVW+6G@?31+F+v5_D^(F%)V!tg&T^n;pyD^SJSd@)z->W|kTGDP(Yg
zG}}pI6mUypw>RDxj~NEBnXhW+69K)d>amt#@dKN%QAAu67rW&1@raFrX7PRxCsxXM_qBVD$UXzD7eR#X*OIx+s%7=91V2>sY0)=YJ^Lf?_sqi
zzai(Vr}t+dcs-p$S$A7jZrxkuu__B&ZpW7|pKiyxbNR7PJox%M7hiSj?9Cfzuid-<
z;Ns%a-E-S&qmhKoh$o40N!;pa?nfcvnIcAN;{xEsO3X$QMclf!+Hg4Bd+qM!%^NRX
zKF^L{{T&a!`m?ux;Q#aY{=|Rsr?0Obf9&q-us&`tfkr3L+1aCzS<3>dtfU7q4y=CBY-g7v8MAfF2U8m&o%wH&D(_ke&}M
zx>&=UlnSPP690yG#iAj4@(xSiX|lKw%lWeh`VVv)EW1p)N21&W+vLOn>$VOOK!ieR
zrKiy{CO9=kQOj$MuB=pdX2$I>OeI-0bF>BuMw=D+O4@YicK_nLI7=)6W>8bN4+eNG
ztIM{oc0Y@u@DUqk>u8d`>}kHuR|`MuFz4RUEjNd^Av9IcP0mV&ctv51G`ySOm9Il)
z5*-Xbh(_B=3BI$=IC?UeFB>!=b+EllLO#+U*{`@6RWV(1E3t-ax948)VX7hnWkoht
zZ=f`5HR_mK&-x!Tx+n(qS|+P1R<5dtTysJS?ZS=n8+Hv@Aj3Jd5CXF-o96l9%Ol_q
zA3uC?+2fuJz;b(3u{J>!#9S#lL?_h3$k(S7=P%)80VcG_Wzv>ayRhzgCG;1EL$!g1~
zA9Q&5Zzm%V
z0q2ro0Zb-cSO}n>J2ebpm^ttLQb9l~qk3AL0=1FHvnkvndq}-Kq#x%fPJR;Fa<4
zZrQNxf5hFC@5|<$mbjFIg^)bNc7>_PEqEr$*6ywe`x@?I21+3F*o@OcXr*57369km
zTNgG}z|3j&N@cD?<}}80ZTANzEK{Ui^)%{jMR3Y}+m1c+SjKC$b@SWVvZAX*#ZkM<
z^S~}$B?o_3wMTf^j-#k(($N7%=$$}A$>P;*2im+VD}0$7Iye3)z_hA_7f`NW
ztWMY`gdeJFR+m$Q4M&LDOZli0q|ME5VY4{B9i1o}JBB$|s>@p;Mn4Utv}JZd`&9KQ
z-3buTznA~X^oO?pwpJVftG!tftlhR64w_N0&}1TZW^(8AiIt^(batzro6yS1LFuhdK(#TBKtsOSL7#6J#z+_bG99uO{YZdo7
z13F%g*$~iEzEZALr|A<0k`u1lRlP;H{Er9kVik^|W#g5)X)*?%f0|e`ldrqG5utid
z??vZ8efyjUy+nQ+W8B`qstkw=Q14_u#=U*$8?GB@Z9;x!D8diNE@^55FqU$68J!ftuBT>~wHfx7b-#$)
z)Njj|%g}~=J?5qa4L^RlaHA1AjZb6O44m%s6*x)C!
zJ`7Oz=rlG^pxk*Q`g2t@{w(*>@y|d{lEZKh+qj@$$i|@*~JQnZF%h32cSV*??;O>Z8tb66YyT`
zd&jcOhPT^;C7e)&LmaB|tqx*A_
z_Vnr1<@v#3)tfu@B_=@Rq(>d_fTIt`z~*rG+Q^p!KUKFK4&iQF9zS~W=)*@3pIkqD
zmJi>5{xk1B`bSS+K3s>xjhpw*&u%yl2R{!xgrBW-=2#GCCx}e|?m>je)SDYBE2~xn
zzotc)GupOCFN>v}crMIOO95Qew
z%)+L!tIEC1Y}v&9fhrA94qEK;b?pB$FmdR_@HrLGp?98T0
z2A80V;U=CqQzY%lkYyf=)*~dHx-@<&MOCuCvhkDNp?j|e=|(UO1An`7Xz+>xEj6lf
zj*~UnJSBTKbE}Oy0^W$?H8jWgp_}$yURyEQ5t4;jxKRMXPK7lI}R0sl*8nK~rnXS}E)37U40ARcM6P;fA6Xx45$>tBHQQrt4+FL2LLa
zLfQy3OLcQNK^D#xzfHWeky=tQq0snkf
zH_Ah+o;`ekcyDV`--li^Plu_%8#S9HhR#U@fi%#81-ogJ;hsgqGyWiRa=Ky7J@ynX
znz{M18Qi%EO>=g<-8-4I8z4etKp$&^_Gi0s7tu1H+XmPC_G{cMO#G@~q|H;48Ru$BOEhwkAGfv>gbj{4}~
z2UjnTcV54H=OX{n-~H&>#6|2orG`SR97=W}V=kZg
zpmbK%Yq|UCrhu8{tGoFWRtjImip-t29s7Du19u0_YA3b_(~cV5iIbByf|2`eRZ+*X
zV6W4#Gvd_1?qh1c*;BZIQ+;~sp@aa#-04D$E;78s7Zl*&W*mf=^0-Kk?tX~#t+uxx
zzIFS~{r~;%`4@ldzwoPm?0Jbk*o_wf14=hx?qi_zX&D0!Bsu|;OXbzdGhz)fAn)@FVD~KouA(g
zKR?9z^7C~#xUaBfzQV#}x(m|P*toirccAjJvf3MkSc@mY=aO^*RXV?g%4k5r*`2A9
zgx`6egh*Dajmoy~mE*4;m`^QqZ=G#HOprAzYqJ4L=VG(IZ`*Ch`Mr`6)fwgHrYf|f
z9Kj$6Ga|dO0!>|D5sn9h%eb&FHAVnLm1Y|(u#%Cr6<2xXj6jl7PE{4sWV1>CyoUOr
zX?B!`imxxisvs_S`-&yzGOtzh1lDl;81uWwl6o*rWM*}TnSJG;3E&LXvbWk-O3Gxx
zyK77!V4}K8y2n&)Fzz5x*3|iRgEyJilTJ-8Rx_*{xPtYu&y^CaAUY<|+=hYXx15EP
z(SP6EEw{8C76OxnXxnobM<^Ys6p@fzL~u
zf*3PTXQ<|bBrDZndsWb8;cA1`Wh(ERYADuJGb++IGB*=`LV6Rbx{_#%W46Y0pGH%S
zoy@3DI}NV0h*9k{AR{{@X=NccA-Ot~`P(@8wWf9KGRQUplMCeP-F$nPQM~Dy*IESz+ym~6wV+)s-d2}Vfw7_heYDK0Ap
zX+~Vr$exFz)5Rm8jLbtZ-K-p2MR{i*Md)Pzc-mAmuAq#-j)0aj!_b-rV#><=5T8RPdvKDJl@dx=tH8#epgdKPWAC)NT<
z^yC*;RTZ}Fc-@_uSJ^MGx2xmTvu(q@TOWVp?k|1q#@F6G|M=b8Z``@{`o;O>_4U>9
z<<*wy2i+ehs7Z)aob%qnuYDceE5{yK`{WleAp4lx*{$>2ckUm~1nF>36^M`8V(0TOQe5+f&t>(l@BaXFG$Qxd+Q17F=X@)cE#+(bAggw#wRi
zGnJc!%yeMTS?w>#t=9ziy2BYy(qbUQH(K?TWN4QsIRZc%Os4$~C
zm9bR&>j|k%ogkyM+?u6(3zb)VsQ^TTrV>!ti*-QtmT6O#js+1>c5d&mhJ|=X
z5PmlRF>k(zmy@w8;p@=d;+a+NR62qYVJ@Wn^y&CO`Ap4JA|llRG3uDZq=_#X|7f}^
zs~a>->$?QdnVZ2oH`XYQsa;TpFf%_tyF6~&+YjIR#K%AJul?));{W8kzVWaBwMT#V
zZ|A+k#m^?rz?*x3FPN#TNqrFN?&>yrFPIZtZTVaT^Y2
zky}1`^5p$z?>*l>cy|2qyN`eB-S__fv+H-)+2#59z3>}naT$KT;^MGY!~qs77TO{X
zE`cUsPR**8&?x>GRm0}U4IZIn0>RE^dn4T*k|A}a!6fhTksiTBfj|IlBG!`!Q=uv!
zu)u~qRlFg1%%Uci|n8VEFw5C$ppcA
zUVT^(#0#@iXG<%&wX{YR0Le8T(ONOhHiizmn6+=C3hRdNxu4Yc@u%h6mq!})ifHtT
z$kb-S9cSh2Ys(5h&=)#0Jr)CmhJUFl|9Zt5fST}`>kU5Xuze$`J&wS$w^)J+JO0AT|SkZeMjvapk5
zNllE^D@ml=Sc*VZWV76sh`T#hQ1m$ECmGiz#6Xyl)KlHfX+#&?#)H(XYGdojNnLA0
z_3qKa$i_^>)G36M(SoLw8#jX+cZWd>8&uZlrZXbBMj~n}iF`E$ek`fn-8zrCRhrxK
zU?(wrDF&`)NmHYHWI5vuwbj*~T@hjCMKXM~+lhQj?f~17%8kc~U;$z8>J0PT+Tyf{
zU`i#1MvDL#8`L#3RI_)m?zT{;ZQ_=9gbi|{2fzj(!l~ovnm%OoAYHQp#b|%6JRv@C
zC9knBsfT)CcPA;=U_eBq2uE$`O4y>G;uwck3VMqZ%N#07yQ;FvW*b3668*hoDx?e`
zDXya|vWfd+tIbRbLF(6740%LV1!uD6u{%M)4W*N=8$=k<14SaSR5jgDG$~heegZc5
z`Gtt|fWsw8MU`L?VvS7|!U9@!`KoQOVvC5%Oews2MEtz+Dq!IJl&S!k*GH+&mREKY
zRh3)9;2vR~T`m0F07KX^dA&9_xBz5S5gg4-oxzeB7`GV@G?s)JV}*02x%;bllgrnz
z_X=BR<_Kpu6HOc`LKzxP~>t|@L(XKq=&ZFyb&qI#>`u8&t&
zFQ0|oeDnU-eEi-wzJB|27wh#0ciy;pc_WXkdP^^12WzNu&?JOCC7X>
z_<#kHfU38-ZQC{M?Cu-)Zr#0j_UPrh8Nc$|KJ(re-~GP-OLOLxoMJVKGb+TFLj>PD=E?#w)_NJ?0ZW3wHNX1cBu(256PKO{{vp1*gZf
z?_^<279^?+?cL!lIyA_FZgJ@+Y?#8V12C6WEwDfYes+gx?c_{y{Dg?8
zzPBAV=FSpDN9Px&L;0Koo9onS$9WLUBueBZ5cLZ5>1q#p7L
zz}l2c3sf4r^~L}vBj)OA>lLek>*KQzKKkIJ=MS&@+2i9EfBxMcefZ%&EPHu=_P`G}
z4skPZx#E1S^A!iTa9=AHArJSkhIzDBHTnSRD)%e<6)2a_-F~UT0TkaOiHw%j7PVKECJ`g`bv0lEI85#?
zfkOr~*e4JAGF&J5VR%>97@|%;=28quZ~|frnc0m97Yx`{sNG0frYXCf<4!^u%ngwB
zph`Iq74hLY!NAR*WaPqJrd;|DI=jJgW52FF-8M5>h;%1o<~{nGHYaywapg3cW*AQF
zubYb~`D55d;wuJCwtJkI2bzsvGfHb+ZFO~4#6gE(@3T&>xu&9XUyF#zc{b2GVJ{*h
z-C-kksLrmnf}ZLcJ@?NY;RcY?;Dploy~W;v_zP3$-My
z#Ro&x=)T#u=!>gAMi-j>A(JCf8y|jPQ7nyl8g9K6O}k)@YF{q9dUSVj7Cn0A#?I+x
z>}fNavZ&Gpj9E!hrnP>IIV0SWm26oQxK)fuq6|@K(8yhXq-)56SRN9@IChushO_P6
zUuExUTs0gE^WG;TYN|P6hF%tdD$NL3;hTd*dA)Py6d0z^C*b&s`h8U7DmJIkFJqXC8%y`m!)V42$>
zWoo#DTB-g4ZL5szGYJhOh~Y;G_srzkwXu^>E~vd;SN7axR$Wcwzpk0`vB?p*G@TMZ
za|4a=d5ya56VfqoiB=Hr&DV|t@nK2aP7JYh{h$U_k5ylJFA`e+y?#Zv0U}b9Ls4DE
zSNRH?z^FQIkT5|WlM02N9z@4P>n5s;>%Op`d>u6nK^)fJS!FYS(G1hv9EI_n5*~PJ
z)f7#utBQMlnY=U*njxB6s1x&r1w~I~ARkzuGdE3$AZ8VTHmF)BKHCNsZ~FqR-aFu`
z4Tjt@^H_cCK5ltkb>ueJm(QPEACLELe)2OP`;~9r{`$+q>$lEcyL0DGm|b08cb3wh
z*#O@FRKDtSI`+~}U%vs4;O00DWYi5HaQp7vTla20d;Y=<|HQX{_Q~T%-}guU%s=>v
zAAjxkt+PW^6|y~Avuv*GO*DnlAo;zL$(Y(+R^9{3yL2x})(E=WEh4aO?7d%kylvJ*{jJ)h>t&h~@Ia_=
z7N!sC+LkasUpKC|>v!LO>zDrGU-J8Y|G)C}-}=cv^~WCn^iTAsK6YW|?|u2%(s@<0;Z>EDD;9x++J;zWog3c_5mUaovMIK8j7!@Tn^4un!B-kcbWuj%dX*y;v*C-u
zFpg`+EVO@y37^9Trf|vhoO^76Gqc4SbUKJul`nTT&vcIACP38(O=^R~Nc=T*hf_6I?zCg`%27tIW5=1DhUQxVO?#D$ss4An_TcLp()Xe~&_v@a2Q
zYE}TYZ8PUVP#CSuh@e|_EGMYS2gq_KV%aP`GYgZukAiG?RJAm*bmk1N=}FiYsFb7t
z(ptWdgx0xy)myx=HlEo;n{Q3X%FRdSWPnzv@(PgWdK)$Xb`uTE~7@K~-#3AW!j
z;bp|Urm$xxpl+&imtNAfUMM6)QQ@plbAB~#nY0VHX08?kLhOl=c0eL;rlYaxYtBfT
ztP>X?oA
zj?`8>R}N79-h;YYrCLgpcacE@F+I0g!>)n925wB#-E0osKoO(u>c=iE<80&c(A*Jb
zq$#m4-o;fC(HW{e0suO*3gjtN8@#%+(}AL~EwvSnAt&yMviBWu)w3e#gfqzNaXG6^cCioTc3b!z7xs<U(A*gwl+TFzV0wd`uKLwa0FB8s}N$^{@v)xbVf
zz)rtx%-n%g4o>ill9v__{1m{Z>1@J;D6fTWycSlW7p%&WI^{POgzME_vT0WerYZ9<+f3Y
zR%Bp^ek1I)Mcl%c+cdUwEX95&7SkgW0MMpAPeJSqk}FqLW*!@vdCa=b+PaTjmD}~R
zXOF{fe$^+w^)s*iiVJ-5#^tTsH}74XpXIjA?sTJN9ftNJBqPRO#zs0JP+-R9PF9Xo
zud%GQPP5w&?%cV1>+z#!@cuR5@zvXlmw)s>`m;aw_x{ekTNjt-H*3r8G%i)u)9b;S
zNSXzxX6NOj({gq7w!?0OAlw3CkYE66C9*~x!U5Yl1?lM?Nli_=J{RLu|E=&=N{$=Z
z-MyL7@C=1Lnq_ybpe~tscFy}_onYN?xH;h^p*b$OGJNC%i2cIjfe1lRbbX-uU-BoLYuVl
z+^LKa3(7kfMao20wY_kQ%ry7TB)+S5Vt4g4aF+=Oc9gMYrJJv_z}Cm(wYfzcxLJhl
zHM1d$+MeAW^uKnE>Rkmozd-?L}u;gtz6l7pbq)ZwibYW5Bs`u!@
zmNnT&nOWD?jb0vyvvu|I>Vpp-e)#mgYkTzg>g`|n=qKKK@5i@#c5!)kt(%6!ip%h`
zh;ze=SPu6%a0jWiiv$dpOl&GKk7dvuQmM!1jvj`fChv2y-3*;2lmu4DZOaua!l|M#
z!{kwdWJG%8nmB>nb_OZ?0t@5jmz4ROh|>Iva%+w^=R=}UHtk$1mg`?ycca`_xY5&>
z$9P&+7wBUSM`dPiRkaRl3L}oD$`Nzg333DDRhE^f_Kux3MO>hd?7;6rq81fuOybJGTfBigvz@tv1e%Sg`U0L47p
zW)_mPH49McW9#8DoW!);i<+Wd+PeyIpUo!Z1dIW!VNJ*Afp|G
zM^_#5+Kk_uGi0gm8)~Oai2lq>4Q8gW-)@qYWN|J^S@#^9y*L|Tp-t~Hi&zX4Ga)IV0n`9_
zjO=;Gf;IZtKLd^H2Ks&l#N-PeQ>mE;@e9IC4q+zA2D7A!HRZ@aotm$ADeA|kr5ZQ0fu>taAgz~(6KB?cd+&X9_7#S#d^DhyJ>K9g5r
zQfn!8k|13C$$Pxx4N(?h1I+kc8jHb9yhmPpVU9hmjyh5(Ce+SO7DtNdnZb(SJN5`8
z8+lAS4+FBQQD#O*lHw4}cugCOBgB0uU>;j9f)sQ?!JaLbMiGOLrR9*}10)6GB%ekhoz&UrQdJinmF*SEscps#LL-
z5(X+#OsVCXQ39<6JPZ(l1%Mm2;r)h2z5`{eX@l)iNLrzCUoM4%08kIxILt>cKQOe%Z&r?|VP`=^wMtym_;7`|<}*uV3WyfcNYOB(%&;B&4HH
zUX@M^MA?1U{a8m>9-H9S;cy7^XV0I#_u)IwUVL;_58r?JbDw|jN8f++h4ZuXi;Fvr
zwc_0DBJBKdICDGjEV{Yda(6m?kj&`5RALq)xXMiQS0z4{<=q5(i8xp|AM)HcI%lMX
zp^PStPAq&jbnm6=Ozv!j7N3edywC0Ao3Fe?8ie~Qx>FX1BnbCxvEsXES7?m^1*UTp
z9z=3xxB2p&3CdFgb`b_QiTA1s^h07(-R|b@Sv8t>0vN5WywGi(G`ZSYN^S%qoTpw!B`7+>IiV=_%UPhn
zxIy5IXNBE-Y8fwbNaHGPaIzxmRZM3Z&ZJ6K&u>*v1*jQ7t
z24ZSKLxwa#4C#kD?V6Lm(@d;qUf|L*0QPa3h98mXO?i_)Ne(%N@$z56jsRU
zGI~RUN?KAlXNz`J!B44y>CQrzhPzy
zbm}Y}+_j#^ZDA)-J4`F}z}>yCra1kW3)*{IK!A1NX4d7^
zfcCd{i-^MVyQg_1?SYS{Msfp~d3JWCD=O~1Vl|&tN%9UmUdnNyPg~noYpw21IR`MX
zThGk2vS^gRe*>6%8$2}}1D(N*K6WlT5*zH=(?lo|bti+Kdteg5iqO!4ehtHy6Mn(R
zsoixd+bVPKuYe{wh!f_K??Ps3V3~*zF*s4feA1M#4IvGFM#IsxDzw@x%lD1*a!#}EhbSL&@
zge-)2h7-9|yydh-rsHz}#?DMlc(**d(fR-^D!O5q#REb=ns(nNLhQWj9(Ym2E)I{?
zf~ut4(FsC6VDqrc7W8uzqy{n}hdHw)opZuouR_dHPD#?oY06%|fdeQypZEAk@1QOH
z_U0|L0a;R)a8CoR#~8i2i`Cq=jRU}{l=xQ3Lg;)E^E#{pnww_%a>N*9Q@1=axfP*m
zI~EFETPCb>+p0E0qVwwb^7*rmF3#?M&8L3t>$iUC!mabT`{3S#^TXN*eCvYmgH}yk
zB2d!NfP^h(N#i)0@S<7ws2JU>aO}E$|L(nex1T(Dv?YGcZ}{pP=j)IEkw5ptf8%f5
zzHxc`=B;fzb|rhxAz2hZ06{UzhE2&@;gl4Hsw7#OS|c)*24F&?9ZkG8f{T}0mkA+bq}o-F6XUN;WXirFGQFov4biawP1j96eX$VgKp%AR*1kY5b~Is8R&37<`J+J
z3qWRadYV-*EdnGFz1X~plrDC9NgPpCTNMs#ZJ89yL_}3qZPP9GlowWA;ZAdyF0R8N
zj#<1mQ(Yr-v)6BY53mEe=GstPCRjJ5J?fq7;$TMCEtP)5wHl0?hp-bLP;&%K`DSho
ztLp6IS_esSPp}YwV?!n=bDwntSZ%1D=VY~&Mb-EL9Uf+`g{WrE#j~nJ9cZyt&3j8?
z>ck;hWhMoR((6zx(_o0RS+3Z?Za1pr$oQbB7uq7d|25}EQBG7;9Vu2In4Wr{lX1R!
zc6I&y7e4&rulS~K`M3YQ-}SZM^2Q(k4J40;kZG1BZ6
zO+u{bQIt8*Y`+;LXVIBi=T`2v4u=)~!ABpy`|zz7_2{}keEa<$|H7C5-qrT#=Ec1@
zyEH7rT5%qJ?tT^?Zb7fq5qw*C5Wi^KU3T~o!uDs#%7?7(hC!<=jW#^0f
zLWoAJ+LDZ8pF07t-1JD-0rGy4~oApqQ}7C`(`2q@Un4mV*=|i$PSB&W8tN
z1l7w|lH$S#08_q217%vPV^z(yJu{h6Yg9c-k4D5&s-qv3e8XxVm4~d?oG)Uob)%7~
zl%SrFXd*eTXx)kKL7STh1=#Wp-+{Rb%1mC>v!!4!EMWsnH)VSf(_Ro+HhN%iM#@T}
zr>&h%hES%BobA-VVMtkXdyzS8MV<$@adXDb9Lp*<)g-kKsd}!t)IvS8Ly^z3igtf?
zdiAC(s5N?X99micfk1x0Xf?gP$3hN1WXZ(>+F8*|-O1S05&^M2G`i}~YQbvj+zQ}`
za+-Yt5iLI+z}V3-II~aZgXwCImj-+A@!gK6wG|@V4IeD=cwqv!z#K
z60e!73u!t0p-t?Gy<+ZHzB7SZo6Z|7iVM@B=pTYU+d$YN(}|NS(vydn&q`7Jy;)N^
zL~Ns%hUR?{G#M%q^VE|y%-AGzVCGfXvcr$=nmP&UvD7f`GaQ>EDv}xtmd2<=eO
zGho*$q(jfRhXT_lhP8=EL0+<)+xEciT9XQcVeK6aA>Gh0UsH6p;QAY(I)>K%QmVJy
zT};u;YC#t^U%qu!5d-;ZQA|(i#-ps3qfS-PIz>>bOT|})@Zj*6=Ee|
zckaZd_*Cux+YeyJ=d)mjZ}S#PiVrI;-di#TlVw4rbLz
zT6~G(w5odV?7|!;`EW^L)m2pNOoq5*R3$e&812isk~)Dch6%5LJSDwQ#`5H$0(&uZKjYejdbHN)eqRJSF<=ek#;
zJQhZ@J}9#pnk50_g^8I$af*y;n}X?1AS<`(BRZ?=$tlU;c>)-+FFu-iVv`
zZ@+Ql#;xw^Oks$x$jDV4TdVP_%&wWA8Hw(YvA&AWVN;b=u@;5ynH!-Bj+>0bJVR~UUcOG1sFs)qjL$(^
zfncyQ6O7IR4$V%g@dZ$7B7%`)_~w$-759
zesp~6t%pDQ-ou~j)pzfFJp3FT;mhOP?cg}9!|LL6osU@LXVs7dMdi~dJ0&q)&B85H
zIA`zU6ps2S!qIg#)3Sjwo5@{=4n-9ZX6OXmsD$V$bRaw&$gbYXxShU>Jt%p*O+!%+4xN;0
zjce|>tu(aFV#m_j;Nb?_$Iji|*%nY@5Mq%IOF{hR%WKPH9@)X>$$&@0iU@CjzzQcb
z%^9YqE35;`-L?b>)=qaRNV1ylvV8A?B)iQV=2{Rc=!mg|rIZHi-Oc?jRT3oipb;=4
zzKFGkb?FS?AZ(%Xr5V$!i}WxZnl1*7P7LiC!>N=(Ji52NZL|hBjUUGoO{Ee-LSWXJ
zeTpO0VFo(obHp_XnTauNg4AwihCJDXSZ<^`Cw)FZqIGE`Ds)d7n;}Q_#mv(buEkJu
zH+4-K3(L%4idp72GuwTVSWNf6g?s`thLNXa+sVhv`le{4>1@!<)VEX>xbNN2=-`n+
zvy5n({cNPq*m$H=njt)D6J!SMU0`!E>0Pu1H#7G(N2ZC@MkpnFh148O*1_f~7=rdf
zm%>77HWbwrZB_4rHN7+j#!*}Ekm7EZtIs4ZQ&o}qg;>62rRrG@Jbj=TX3W6Y)o9iM
zg%B=bhkkPE_bbgaDQP!Nl^kp6ktRyK5eCE%m(5*zv?+c1mDZ&jCbFoLq;1uVc!W~r
zccNNlIrhw)iqx#7b?dtqud=c3MisI<%)(v654Wz$u88F_kg00e^y7xsDkI{L(_ZnD
zh(OVrJ#xNBY+^4Tv(il4I~4lGh54B;rYqrVn$j3QOfo;}Z?wat$@^G)LWLSHpRUn?h
zbpkuGDI9;aQ}eih@wlogdaz9gVCn(@5DBtQ8BDNS^OfOs`oSV>+ekan84gJ#3?990Eykgv9kq3BckaCY;>F{i
zdFyXJe*W%fKK^SPpE*9N2ff|CdG~O3cD%lx=8zG5X6r8Jh-%ihyXbM$C_Ob_qp~f!
z%$J`%`RJoY-hXi4?CB5x_0Rw6U-#*M>3{oM){4LOLqAl=TQ_g@@z~vF8XJ;hu@|81
zi3aOIH+TFr8_lY=ox%XRe=GPj!57rr?our>Lp>>42h%+TFGyl5XVau3lknR@o5sKqZQB|-Qwq3Y+c+~vgL_rIJ6E{$u?E^NIn0%vV0@H2
zY6W3+a=@GHzaNR7!4!_$29ht-IEDJ`Oq0_?SIeG+#sHXByQ&U{b8-)q4-G*nJk2Ue
zb!fdO?iQ1;uL~FhxLMH+WW91f!{yc0^Dlk)bHDOi
ze%T-R4}RBYf5{tv><@kTkAM8|)t|n+ez|?=t;gFj&)3qHCnP3
z@?ivb*_6p(1&evMT?qq~pJt{i
z^kggIu*U68W_uS5aWuG;0TRP-W(7J9(X3+pghfMAH9(M%bj#W|(4L}jO*Cfk1FX=(
z#hd1Mq5vYR+G@qY%xl{TX~rM#iU-}LWmog-I56v(T`7{yJ_9Yrf(Bg)>N9)quh|{<
zNXi8wIg1Q74cM!EsY7}6C<2+tz@|u3J4G-vfD6xT-T~<`I
zs#@!SroW5s&MPA|K$_3mvR=6yJFBO2eEyuvNC>o{t9r%KWp5a5Gv;;kwNCtFo~*SN
z=E22o@yiIWkcG2pzPY^nTnGWrtRT;f1mB};)G&Tr^VAsbt
zx*x+rS;KbaI9?H!PpLZv2?|x+&YfMNG5fSKX0Hq%^gBo8K7zykk`P7OH;X{MfgZ2m
z818+VL4a`O?wMOwp}EGadB>c$+BFg%;+SDRtufe^c9URE14n}nD`DC0W`q0B<_Z=1
z360hj=1v)zoCO<4P$GuLnk^;OvQC9bJ$TB*q?T7i44*q1(v=NF!MeoOvt>27%NDB2E~OTZy?~1JCdaH#l}EGN8H%K-M5(`^RZ9
z1EKzsEjI)gbs@;!QZr%16Zg5l%4Oq&V)<7ro*4Y+%2;UV+GMITLko_rat{GcDlmB;
zl|G>Uja{g57TQwk3^M`U)fz2ycM;}yx>pbjV$VhA5x}|nxEs5X-YKXUQ9N|+6zPI1
zLUt98L{~N{b3@mb*FaufJ%9G>;aU$q_o;7x^VT<9*qxi__g}yF=HYBrUDuZ8QqebL
zbVpMkfsq3@U@AsHwVP6~B8a*5_3`S)t-BB2cyRUd>60f{zvA0J`N_|`@&EqgKk!$7
z=!b4!T;968nYESL_>CN6{^qSVF=J*y(9^4ftZ++~>~3XQzeRHcluiATYS6*;GKyC`zhXbHR}tRc{U;bK@AG
zq}5T_VnG+N7=0m-psA3@&a|=8NT2czAIbx;)?yJ+m2ha;xG^2)APy37bkB9`Zq%CU
zIK}B@g{@G^QgnDJ?9AB#Xwj{i8Bb3(g`Jj}YeiRcbs?tn<0DfM(89i}%PlIis;V|R
z*|s{y%A{0Hq=~9p%c|%+snH@a!|AHKq4Q=Y)InPyW&o~?_k>0^>{mb{MI`^_JuF~_t{Tw-+A+Je#8C3aklIt
zBHW@%0oULbCVMU3Q{Poj#`ciVHF0e|Lm!!%Pl*PWl}s$|X2@}epEv45yln{BmJBJv
zAuBd2t;@}`8d+;O42hDY(5e#C@-R|Q$<{teiB%MZKDu~~a#JHbN>CEh(UN*DlOr3d
z;4m6Hm2MCRSPc`)tD7cnC~#hC=2lxOJ@0c@gNI?na_S>UWyJh$3{+fAm6`}AZ64NX
z)Q2lL3YCv=&#i`ir@2&sW1>fk+Up8~=VhD?y)#Lu%IEK>K4^Vq=veVSMm
zoUqJl$o22U3vFb!w571D2GUL2p_}AS(AU(ht(uYvPGVUl6uLRFhwZMV3_>{sqV7se
zL|@^#C7nq%r%|Ry7nMNPotY<3`I+Ol%G|Zs>{SU~aR;~j1^uoXNsFMOpMl8XBGQ^M
zTykL;kUNk8W9TuJM)6iKyj}j
z*Imf1v9x5|Ukx#*0(0J-*$!rMQUrI-p9w6Q!Lnf1X2>j)4ME}+B@)p|`m$(8%4kHY
z+D(9)rV6SHS*5DdGl4PykXxFy(XdT1P^maU<8BWo5h{0wX0^CO>7_%RO&tTt~48r1|lIl@tq*i
zcdp*dDF8De(bLfa&4OuZ13a`7h`HLm*~FHHHq$E#D4a{+6JM0((ap7AXjaoKq?E6B
zT!X>C42DU**cV$6-x@mH95lfk)O`T9USwjrzG05m1V(*GL9=ECr@w`ZVZ1rkp?nSTx!-rz+&SN}NeZhrWmZ32Y
zB2K}iNP6h(SkY-&c?b!!X=PF(_cQL3l-PR1Ft>=^@$Qv-!iho6*$`O7!@HAH>XpJn
zN-&B-o?ivQo!k63d&qvEPb8iPYjh<^ooT!=ICSX#K#h$Gj
z*cVpqe~G=xOfYHHwd_!!f@uphc0jhO-I5@%8Cp06syf07m6ayQr>olAEWDF>OjZv5Fg
zk)Vju&G+T!FP=XAz;N%uy?b~3NB_IGy6b=WFaI+@|J5J-Av3#q<7VX%LrfJ~JL%Yf
zw%Rgvam)j3e_G0=F80+t6N7P~_r_p`UIK}sXg6bdk~uMSs|Gr3k0gU3k<>joM6k43
zRb_4LYl_VV#g#B<$-?R4S9Op9nKif#(KBmj)kYQrBl*lryBfWlhU~e(xLdi)&0W@2
zf?z~)Q5xbXtGQ-ijJ1+?i*cQPMol|$6%{my-2g0svDQ`P7VID#Ahsttj!D1DRdsrl
z1C3i7$ni57=eR|Cf!0mFh;1>K?4%cdLPkb?0yMfjmacC%3|Zwa(-dp^dT3c*7}XHf
zMSsP4uDnl~u@*tp763-F1a~RG%o*;dl_o-|Z7>)Hq4VGE8VR+4Zu2gg^~0HKAp{PF
zoj<4=)A?`I^4s!Q4KtheK&UX}59}A$*H^#r;TOK?8@~SE{r7+OFaBk3e%~Mb;HUmR
zzV2&oUq3s3>FuZ2*T*yW#<2iz0+~JEOZ=8SDK}8_+m&kFFm8X#{p{@Q`j}t-==~3#
ze6XFpc
zV2HSc*ieXDD9XZ4Qv8VHN~P?or1CG7A4w%uaZ=zUkbo2+bO%XDKtqgVT2iaKPoF;B
zeeU~m_I>a5K6B>B81wzM+Q@bK^xkWI-}^q#yo@pCn5zWmPi?MZ1giP`M2~mS{%TTv
z(2QJysJ)9tZKNbgZ833tsJeNjm$No(SQ>dzEi2DTKZBz!SP
z`0a-n%=Dm_YG=CXn)0Fn9;kLUJ!~fEsGZxbPi!=`Q!1N`wf2ZywR<7L6zGkzYOT9F
zg0WoqAA`4WJ0aW-ghm8aujqdts>N}S%}AkGYhQX%qg+z%6-*Rr|GGOI`~`tkdyT0b
z$n=0^%}vg8V3M=5w4azIf^w9Y^`D>iJJMk`4sHl1;%N?584fkB7~By
zQfI3tugY!Q>}VmN{Top#l0g=cjH+F`h0?`mzgR9KTI7|!rsPzv62hVm_mb#dKnB|2
z?&M)BK@PXu9z0KJTijzEGpm{judWv$I!0(#OZ_dwqGRd9HRV-H79HmiyQ-Q=qVwl~
zz4rwn>a_G)wHjLnBGtd~2;Ur(6UUh!YwAI{+&Zatt7+$%m<`zaJNld!q5F}VC7eQd
zM16j{=Jlio)KRLcWO|Q{Wi+Y;yc7=Sr>A{OtJdD+7FpGWRi>VtQ)muT8*9Z7&TMKr
zQjy`&pE2X`gVyk{U=?Y&j#T9vTd=aXeItDO<^fyZ*Nw^u>1@|p68=_?Wq|Co6sCK*
zMGE#>koyK_15(`NbxX!(FXyzUPfn*Tj+w5bCl7G1ppNx@`r?eFpmvnZ|IVFaQZ!>-Yb
zri1X7Ao~MS-e9WJS1mE4Kv=ZFaxbhzR-+l#;q(b&pw|*;vQ{58RnU{W5`9|x5cXNb
z=pf9QN3hvlY?;VRwG%?$!UHjiMWq~CBv6fvUZv4sog6QVL`{9AZ{?yCq1jsXbw);(
z#RaKjnOm-X(JOPzWw&cQxQEsOAHjtagswAPqD{xx8;{m*+Swl5x9PaiL*2WY=9J1fmOc)o
zrJpuarajwwb$YeuCALGz)YaJBA2LEqaV$otK^^75M8evrp073^bB=a9E&;%-)pU)7
z%&oijwYvMXZC$+zE;SWKs^?76X?2K6oz+cBGTm^Mq&_8dh7*Y4rEo(hZ_bUxO6
z1=fnykXON$n{)u?k#*7-wU(e58Y9E%4s9%1wM7bL*QPu8vqvfOvuhzEtO`I1w(stJ
zt&v!1Jt`PjYY}e3U1>)EwYLDaa}P8ODZ8m*uo%#xXDC!JLY`>^8!O0e?-5>-sVl=M
z+tRbC@j`z~a#_|G0|bv9ki%AY;Ka-8>*sIX`|@{w`)~N){O`X1JN`Rg_kaH1fB3my
z%y0kZn@>JmUwP|cueCAvwR3Xafa&CrHs|j}Lq9ZMfGwxy?9MH>$fu7VzjNn(;GLY`n<0+T!Arm+TOeM$bm8S63CJi|r(=!;Lnuy=_^0
zL6x%s!X|C3S6woM7d*KIwM7r6ES3^&E+0c7gt2EtYdcVLi{svc7b9vO(Q3O-ZNT}Qmu6;2&8MVZ>Y4@hJIRpKTSu0SBnPh^R_lSn2TNy5i
zrPx>5Tiw!-4ib!>;$N6$D~~doF%mGKQB?Wd%|sU*Ts&w80oPUCVSN}Np9~J5=QdbW
zYQPI-rfu-iRYyAgM$@zDC{d1iM)!SxiLgVSrSGx>=>s~EgE=$-!hi;D7n!JI7=z**
zv^7d=a@|Y}UZ@`x5$Y!+HaRG`U7EgWIo7xAiuKHuUD1f-S_oSI){U?zZzM)&8FKb{
zXM-EInI4BY-nC@;+mgf!J78$1Srj^>x7@@nN6K(aqPZawExe@EoqLP#$R5{7vLJq`74WwqFdvt|0ObDvL
zSOpE84)Vz9qm+uv2>tOj3Gb0}>>@RF?;*wsDW((k_GDPutIO~uWHVabd%L_=Yt*EG
zQDkWLrm9>13re}GR#k7?F*-Q}D`bKtNXz?>D6z3*g_@l+#cdcFN;Z++)Exk@rkQjb
z87Zv~ruoT4FNy@Kbxj%34`!EJO5j=rbjhy*-SVk6t`|Y?xLOg}fIxnKiqtP6W(yst
zeF>N`A);&Fmsa(*eBeep>dlsDOG
z0$V{fyGj-&!tZMBgzV6zVsL}tJ8f~0koE4a({>UjMYe@(26TJa8~0+k^8>3(`MUYQ|lyiCOW1S_nn#3VGL1!LcOU~B&&+($L7rC=WZiBLe~?%Te19bQ6rsUWVOF
zM_9+gar6;tC=@OTi>=U}Z`XI&5M)>F^k=EiMFfz+jLPlS
z$1k>*K79DafAPh;|MEBgu1~)5o$r0H_NV*DKlbs9tBdE)o|hZbtJ$<_W!=L%NkH5+rmp9k-
zzSgym=t4&UtFXE{HuDjS}EtOImbt0zRu|eV
zGU`PWk@lt4r;aqQBf@ftUu9P5S94lrZ|<480{fZ;emEd9Y%$i8sWQiHy`G7cI6ZiY
zj{aGNJu_L&~I>lB5I-
z>OyM?+RDfw4gCKgK3xGW2GGEGWTOLGOji^H1g=`1q~3zSj*<`EcEo(ob5IPbF8(AEid-<{H=Rm`3>Ltt^fJ|_Rsy+@A~xr_5X11
zv;U00@!MW{_H2Li&HL!e4Q;hsrHXGo3sd_?76v@We_)5!p+PM~+O?h+13vL={yd7Yhk2
zySwZ*;h89F9__=_)8U&4mzV)=+hB)-I*$!p7k~uyPGuV1KxCFgevm4%4J50WnY-`$
z_ITwJn_5Cp*C>D<%aPwXaHhK~LG@^t!iUX8OJ>_WRR&tSBuqRe!GI)s)nIwf750Wn`QwT1oP9yT!Yp$Du`sQf~H(K^gp=>gd?&0A12xbE?g<7I1qRN
z`Sz&FNy>?SR*os`fMloyC%I)3+}CbNZNQdJv;Mayvdn9Q@%l*fCyoqC#e~NGXSZpM
z#G*%9z=5hPcytmj=c8AH-I%t9i_
zStz>B7Aa7KJ*s5WBRa}WJx{W$)en1#$viHgvATM#bmThzuZIvrXzOFU8WQt4n2x@#
zDPN-qIte3oY{@mP2vR^Q9ag_4qr*M8y(11FcwRCIf!`HQeCc-46i@u4S0}i^f
z66t>ahZrzu96e#qmX4qk^(iC_^m?W&qEya6m
zs&rkcxSSBL3;SV})ItKLZNuR;F1nUl2&64fO2Tm#D~`?rlx(#
z9{0wtPbW{$SzlKeniR9>K|M5B8w4m#H%UfVp`>~ytY@F@DJE?i!Q>f@Xh!s^x!1N_
ztY+q>Ey$-Wn%jPTUAX{++dqv!xPK;7ba*8z<|u)_2VbE*ZSzkKYHuNN#tzBJ4`nAQ4Q-#k$Q2RX2rYT1%yT!Lets&q4uRZKnXvn;-mR
z0`LoL5FuqglfiLlNMHVX;V7y-TmUkY!kUk8GC@Ibfreke$=#u3u|Wx@(d`{GQ%M=o
zYg4VQNTP!yV8TOo<v0
z%U}P$-2LaDS>OK6xBA(7^DFlw`xGINBQzo}m0C}^wA$a-!!=gH(7ltYsp`UM+fK3F
z|M0`Fyz|vZ>;8Va|HgZt`RwO^P(v|
zE=?*RqBVKjVE<{wXVXYk%uLg0c&9uO9Ov%
z_R-yYt6=af{s59R`!x|xvXnY6zUd~A8M0W6sS@=eC*Apq30+A-TV74oo~a^
z57I3r;mLNvLy^a)I;Qya>W|iXK3+?x*0Yzq8`jPF#!#kBa)1=dc{DQ(0I3rqJc5KV
z9~GB@?p_-AHF!;WJ;0#9sv==~WD@&ct4owaIjskqn}CDtS5
zq1si8K!E%57aw%*kV2}enaZOZ?fpFsrOs9QgSGoQEjReyz$(GTk$?ao7$Y7=Oh@iU
zM%n<5{#gl*BWBZEJlrV6x04X-KDD2oYI|KxW7@O1n`np*)lpHDA7dn=Y5x4@l6wdQ
zzgD}=Ys(6${mE6`EK|cx|6dUrq$(M%!uCHZYU%(D#jMq;HFiEVpKYK=QiBPr)|!p1
z#~D_1s_D_eUQ1+6uigK;J!LmHy4u~i!xV(VO+ewVrvx
zeU^^z(y@cjXgp~**p*ZuJ_hX
zJJ$2})NI}7XRNTWdR2ATI?fFbGn+yp0quNn3FGv3MhRUhTD@E?CT!yI6dS_N7{RFS
zecxB@DxO8pl(&HUg6XsPk~c)I)ml}nd#$zWb;zTu3gvP1D&yoZ{%&PsIO`dvaO$$;
zONbA;p-JhrYOl5gn9>KDo{?+bV^#?e`iI#8Bj|-ePbF?m9<@JYRGa`T_GGdE71y9@Qaywl{TxM)9
zz5KD4ZryzSYd`zTZ~Wbd>&*vG-~Z~nUwQoO>FIPi_>1>3Er-!_S?dB~K4U}>R?oFN
zEv&WgwK8&l_Uz7`JLKtfvHioJ`10fD&;H_H`M%%s+kX2yckeuT{`4X*$Ykf17ede?
zwv5g6yPs|k2cGB4Nw$6Ll1NM?3Ub@Fh#cU~=|Ne~$|hO)lq@xr>6fty&iEgKFKB2F
z;*`j#(1yC4rI$2{sf1x9qR)bh8T0{Ww>eCc0>+SZtWj&Nncb`))g)68d|9|&5>?u0
z&kuhL8r3U#-s-SEUTgHG`jl>I1dU>v-<3U?w**Vn|GTMCqH-1)z6r85X5ClxjrMO*Ax&0Y++)
zLhd0d%Gn5!c>CLTzxvVFKK`HnFTel0|DA99fBlzt|MAbP-|*>|GwSs>@Auvr(VUSW
zo)2RBlc?R}oD)AcV|y;-DiT*WF1BsEd+*Ly-udz~Jb1R<{rp=${kb=OGB4^QuYJ>Y
zy0yjCDQ`qvMx5r6Qj0$HyGbxS4&lch6u&axeew!Pq2O*6hHj7J{!lnV%$sQ;3jv_a
za~#?TLl(!+v^deqRr&)cXY2D#THiVIoK^NO;`cC0WQ8Nnl^QC1gWe^_kXy
zN8m&a2j}BC=8}jlfiVJgbK6dS(nZs+wMR(M6B?$mR~v>&#S)D8kE|+$CYTKNqnRGp
zXQb`Ev=Ep81M=iNolX&3+PJu@+Z%{6?~xOf0cbiAkVW?q60255NbrdOVtTiu%?XbU
ziSX?1$Yl6f83r770jyPfm33Aw#lroMW<#oROxA_AO|H`Op=n(cW|R|ed%AV4>m`>4
z<1X0uRaFrYkq81cM8lZkP{yRt_*%(>q{%J8ff|<$I8Otw!=+(*
z01Ol{SLvXCoSDNCjAQ<1FcC_sgK-vZ_UL9@I*aFM$XXUh)(}piBcXOm$8VTw=~w~>
z#?qE=DetPhFz&hRfIX$R`mdJs+JMEm-XgoJDnhCU_YX{>JCc;+y=N+4SYR$h(0Q%q
z`nLYh^YF72KpG{1?+lJ#>x3t0(s{-pyGkn)DPkcx83!o4!~^VASj+?kMVYA*6b2^%
z@*telG#Fy5CEv)oK25CJTl_6ZvU=a`nr3VhZj*gjJPrUd0)e$k`e*og2Ekeari*Ns
z)+F*!(H)Jv>vT-Eb($+B2ryapC02=oK3Z_QF3Z9(GJ;7Z0`V*~zt<{nWZ_omOa){Q
zVAE!vE!kGPS#_^sJz)cbZwa7p-uTU$}F#zj88Bvu?>*VM`A|%Z1YE3pt~3`jD5aIGanlf
zN&B8?a0K({oI660P%@%)o&hsGgBX%BSvU&}^@0}GGJ6&bu3ASy7@=-f`+?LcHV1H4
zB-2AA$Q)n|=CMl(1W2BLeZBU{Ymy|o1J)5V1>n(~9{5>Jn;|*pN_a?WhG-P1PIxosPn5nIG*%Ztp@
zmY2cP#nsENy!s7y?tSr>KL3NapZwb6_5NEQeCg5S$J^;DFVghcsHMt6-04pSk57$Y
zMMS39b6S|*APU%Wd;aLjojZ59U1s!8|Iq8#d;jGh_!HmxTmIE|@7}$>-Y+k1Y}*!y
z%u`0XUx-j9@O?=44Ab8qYUCitNY4dw3`(xR@UAn=>^Zl+my3~~0io#Cl=Etg33MW>r
z4hI%rPy;^^RN`PF7_otP=ib{lZr%Ey|Fu8!`~T2){O$kh-p~Ei`j$`Lyh^&
zQej7PK{@oQVmV38XNn@~Y7dp+sLBYk_kDN1>173mY(LJIeCZQaHB)AQe)IcYI$3kG
zU_7`xW7`;AdnqS+B&9KsiszV^xdmRhjFx~vu(U_@lp)siDnzYaUv~$lUg^>$*JpE5
zg4?BaXdwi>qjLk<`*N=89;io;LbY5shZxP68u~c*#+m1L__IRPfr1tchq#)a@Ykzq
zUlpnG*Qkc{3=E1>6}cztLwWO(1l!NCx=f&TE*_A_gFLP61L$0lmL}8j|YHZDiAIbkRDImc@~xO{S_UxP_V5QCL-n7qC{IoC`jiEDhX(M)F*z
zP84b{zZ;`?XlO>=T$MxxeH1SM$zzKZ478Ot`a)Y$bSVo*(cykpVXOOqCsle(q@$G-
z1`-;?a?p3<3S!m1w}Ge$gj0D-OorAKtJS&1mg(UOnS0gYO{kl`tfw2HKoC`H)!x{<
z7lY}6waIDX=(}qzqKFOz5ml>tFN#Z)GTKjC7Okt=YLsQGBwB2x;Xu_I(t}7TdG_kp
zOFS;G4uQhLyfzKb>(Bb7`(}_t?d!UFbswnW`Nz6M=M)UbUzW^8f6mlpL<+5DL~h$@
zi!GR^i>p^&`MT%(oqzthzw@f8zyBj&+%Ds<{Jb2B5RTZ`P$~$?{c2SbYTUGUz+eWS>
zZdfv?)n^Dhh-{-veeiQ;WSrpoz+b4X7Dw8Lnc4x0NOm$x1&yKRwoUfYQ>uOe8(3xe
zYE?%dGq>D=Ng>ld-A5b{xZ@z{p{ZW$*NqwCz@aqQbg0R}!5j##wZa3UZo?1%H02mf
zt?C!{0;~e7pk81;=b8B%0^N{Zjo^HcxuuiJ0e#dc6}++iP(e6QL#4rd=J^EzZ~!xC
zrr&6FZp%)XL!=Q03^XxsqJ@v1VHyLM}XEJ
zV?{)8i!CoAPVe8pofj8>^{@V!fB#SZYk&9ubN3(o==zpVzWmC~)9Y{Cd;0A9V$14%
zjNoL$bDn=#E^aCat!g&{M)L4dt?KAoH!rWY?fnnl`||s*U!U$jTwnd{>p%R#-GA}&
zM?P`m=Et&cT=43YH!`o(QRg9~@|lJK0zG+^ElMCD2r2K)w0Z|a=pS@=&3DT4P%lRD
zyi2b@?Qz>O%V%H$;>4v|5J5VwDw$bczhP|yy)H!wbqShXT}Hv$h?Jh;+U1%XkQU3<
zFL}Pr(cw>{Lv6NTkjB;l@IxPtn1(5fFjgwpH~rH>A3wr{E#pVkuyHvWosk*AaWnG3{=6dJc;jO2`$DvCXdFNtT8n3yLL@Si-f~n`Dm&@b;1%vw0n+<9%6oXb#3+E@rp!w^?=#er)
zM$f(zP|!z4`U7~cgBM$NW6axYU%Q|Ny@9#P6`2hphP9>(9hi$2>4*;H?WJF#9$(jC
z@15+XGFxw38h^tQpGi=jDuUTaH6#Qj>B1m407fKv1Ua>~g#1h3I4bjn0fu`7{dA7O
zR5g|uM@&~N&?@L*D-18Hx8UNJ@*uJ3Xs>ES=)cIWS~YoRS84O7MQXQ%-7>uriSetSaVArbH^k1uiq0S~k3Pn)@#Nc@D
z-k5%Iu2s4rdQ5+J@4c!f04SEoQbtkRgOtw8g&2-0(jvt~x8OFUt?-!QYm5_9I9io-#Pi>hl
zj2j|mt<~%y9xSrwVB{~9CVs@#7ABgtP&BPo3|8%pUTZgS&I6_~bb^uhJA;Z(>tV<_
z2c;X}Yzzj|^FDlGTVsr=h1Ooga5|ZSE}epPVnrMb;p0^^UYjiClhgs_vdoBs3v6|f
z1pKC)OkBUWGd$FP*ElK8b(;DRb_kQ%K`8LKshJ<*6Ke&4ByFas;}Uh5|}4YAPeuC4LUwBaxeqA#7Hsvg`o<+|5KNW9N1{ZCA-tY?rrQ{<`f{
zzx;)teDnQZc(mSn`}P~R@7~#RyS%*c?9BievVKf|Sn6#7sI>@09`zJoOmT(2*iO$M
zKe~VK!PSi$;Qo_8^!iI5x$&2O;E#R!+rI7X+aK&}U0hsl+ZJHNmYEiVPGF~r47VqG
zk$TL1_Jeb(&C#sJ@YuR9TSSZqPCq3w0qpyAcQF*_Qh!UfBLp%ch+6x;_8JCnf|7oY
z3(;PS?NW;4?Wgi~Ok*^@0orie+XY{^$o|U5fhbRAXu)(3^~zv$vFq?I?&=bWRdwtU
z0Kg@G7app+J{K~i*kb`P;akdBw!kR?gcE4}_cIUD)@4DJeb_~gQIp$(E<9Y<-8gqi
z4U#!xqujQPAuFJ`EMqli$0Y$(?bX7;B0
zxNUK9=fT}7{=om_PyLzi|E{0>d$)h)C!c-#6EDAX+TQre{b$dwFY}_j?W2GiuU06K
zs0Uec8zOqSOTkiEApmwStgD+Bmsj!b?YH0j;LFdq`*)sv;g>%DL-!wl?bTPm>GI;G
zjW;rGYgCJxJuiep
zHUZrOjW`LdC;1{Lq#UqTfxY(YeeFzJv5RCAiC1GXIsaCTui~tJh-X_Rb6qCrF!wh|
zdS1ndN6lCp)qv?=2R%Os+Yjd%z
z7pkgD@Fa$4Z?YhDRjc_~8h}t(FS{}8DC$9$honqQ^)eG&^TfKVI2CY&c{xO6#!yEz
znrz1R`2Wz|8C<))D{5cC2pdMKaHoR(@wB&XBPokx&K3dnx`O;XfTywN=4L-$y|S59
zYU}h~C|uNu^nU$Zkv&5D`;d9sGN)%(gmvNB=5KY9CnD4Du8AeznMAFM+>W|%Ey5h0
z5P+tJLJEz}1jHU_rlxlJ7}JA%K28hk`C962mL;~-V&^sD00~n-9%G@zOr}jIDhhE;
zu98Ib+{XxIB3mln7*r~y%``@hoQQqv#2#t)S_k`
zt5S(f0=Oz@yMm?8jidga{%3G)P8_qu9q6?*Yu{7UJEM}(@;*pO6_lGWKUl|BM=wme
zdgNCKI?p}uq7tjVXOL{JwXXLiYb$@4dEz=mG1BO{=4&=lcX#c*dgfnzu3R+ZoLX#K
zc|h_gKIP?G(6Y3i`KGC;+vVEE
zM)?f{y6SqZb|NZa032cAz6;xOKFxFoRaLs^R#a+l$!cxrQ7DlEkTg51_7d-{9gK&<
z*M*J1O%<{_@^)g^Bn27meZp!fy*EeIjH4W;0Vp&&5@m&t{!Hz)q%`r{HlWj9Za3m1
zt>SXEgk!qacXMgN&oT~K?W?BlswIVpVVlv~3Nt};lZt3DA|v%(N|OUIsA3pRw}XKa
zh!rg15t-UbRfS$_jl+h!&haieuz<`=G{p59
ztLV8;fR+fD#cP+rXwNwxLXRqW&uAAd$)w7G&}i%B&6^*)aqH@fU;TyG-vEk0b-(`m
zkN3CV`ryqE?!L#!i^~gl@^CRGgiAfYc>4Isg9nc;FK^ZL
z^-urU8(;U0ul}XK{C%JJ#!tU<_k*?XTO^o)By9dlcir9H(VVv3b;vxY)!k|1G+Xhj
zn-u?@%<{u1+P>!nj+-Q7zh3)Z4egdQfRdD?vG&@VMRJQxH&Wgr`rEo~%G`4b1m2ZcQ2Ktu77@AuacoW)F8z(+c+ksF>=M+y;kkl`}O`@l&_40WD---k@;4R`Fg1w
z%em>=A%eNWZt2J9#@jTr(PH9yFemp#YIljF;Se_QBKV}ws(%w!u<4=#rZ@-ro|7va
zLgk7FK!If)QGnLF?`vN+lskm@?(A)MRp_=)LvOb+@GQ)F1Ai^?VzzztmijyQ0Go~|tui>F%%>iEAdvx#Fv*&;I
zPyf-s^jClPKmJD_{^Soo{l<^I^pRWn<+tuXeEjV4bRu@JizU7URoY}t_Ca{UhRMt=
zJt?N~8m!f;ST}B5+&INs?|tpdAAITg>HY_ge(hJk@MG8eosYcwsqNxc=1W^%olZA0
zF3F6@Q*Lx34gwjXc0FtsA=`e$@d-GbADc;)l>+?e!n!owVTvsVuoqS@h{4e93p|#f
zaT0-WDis^jV%M7UYF;^=tW89>>^sYY7M5nZ7a~}-;QCT6
z6M$wRN0-tFX4CWFgoa2o_(VGRhO5ag+7Vbp
zi3Tb5wc5Kzy+BkCHm0zY&4%kN+pW3d)W??g%rj;K=gB+`fCf+*#xKjkQMheHyznY(
z#>;)!^zCFb1+DS6Rz>&RA2oXZJP?r^9I1{@+Q37tvSF-@BINorzYWeC%VT3I#u{B{
z_F5}58PTDmPR@;PbHBRRPJe#PZt;NG7rNFC^YA)0x`H0kld?TB2cDF8hR~;w7hUKi
zW=IY&3Y=~fYG0ND>fbSR6mcZhnAuuCHy2kcLRYCh8HdKN+c@GXO*cT9Qy&kI=}%32
z3`c1x*dYy_W)Ka|k{~-Xy*rtNm*Z+Ly7dT-nzJZN(NA!G&t7=aX8T@OL`tcscI@4jVdPOBW(zOOajFJ21DHH~Zgi+UcRA(~7*bEg=Y09duI
z8*Ps?H0kf*82W&R*{sRoDW7PZUHLQ;gv}H|
zQv07W7zifisf*T>QM2`M#FUDHMp%hSbC~4^RFVdU)$f
z^aM1Kehlmxg=5z!UG4FR$&HHgz87*+!FN6Gy1Xt~=7Gpe`;2}y(wcwmRAKo{m&9lw>b&7^1xNEH?
z9r%G7*Tm0(TDmR+Q#iW*o|n6!J6fRF+-8dMvh!9Q9NP-+zP_4Sg=s7)O~K4s5d
zZR=!AY*d%7#RuI|cwWwp`KPkXSN7IpwB;%D
zg1KGYeC5`yk9_5wfA*_y{@A1S)%PE~_1@k0ka>0M2222zJ00`kjcCmk#{m7|ZbM}!
zpzT~rN9Zm1DJ>1kALRxz4>kb%BTPQU--V4UwiGH4{sOxw52|t{$s)^
zLRMayRX<3`7utcC-eSnLGl>`=k^$m+?e4x@i{j`(go^fF)fJ3Bwh6;(;$UuZ(uoo0
z;bCuTglNT~1T6;#XW@E5L*#&?aMabF-^3JO;l|L48+yVNQ)j46AGI?9QrFdbRkX?{
zMS5uLKbZDJIgd}z^n|KuU1T$Skq&1%ul~kPV-xQcE89+m$V|za6kJ@^3((fsPcO@F
zj$Us{fAkrXYwPf*Y8T=lyl{4eZ@Cds1u&CaMuJ+8M$ag!d#MU$n{MqIinRveaoVef
zT*$N6Dt2s{sNVPL#+JFo7Gw(Y8nPP@9E-N?Xbpg&KV{Hp*qJqWB-sK*)!mKqxfNOE
zMY&LM5tsKLKK$^(qd)O||Mq|Uzxe&X_}@JJ;lKI(>tA{K<*OU7f91nRkDpz5S8Y#O
zGhl#@SC3RWkix4BFruoZOIg>8tXnrPH}XqwzVYSv-dGnOzJ2ExfA#Y}iCC|^`fV4d
zTNiQjV!L_TZf(5Ch{Tpuzp4!xJz5g8YEt+JU(TeQIb*0$MowIY@#@-LPjqGGU`{Y6
z1d|l%nc{rA20l0NbNn}pXQ~=tj)n5RR-v~H6xKpS^eWpeo)JJcIxGkPwb}$)DHf#i
zw`F;Ah>WJg^2zEpJ|`)V2Fx;vh72mv3vJ#qH~;Dg0Gj<2BV#DHp(F3#C74KR)Cnb>
z2f%K~wujpUHR@9gEwvvvSuy<+EnvS2hb!)%UJG5Tg1Nkpw;
z1ZJQ}D1_%-2WXB+t=$52O&jR7t`(0$+kmCp3Kz>mcl030B~4K~17VdP1v^^Le5OE(cB}uC^5%zX@&P?WMsB*
zl_WIze{kt4jRYWhY^zbbrUa(i7!*IGxR;A;L6NE}RIi)GRE|uEeiVe~w4+ulfx_%
zatMzphN`3n(vLaQ14}Tv#6)Ks4HvPllB=p~U)N2oDi(k1V>Vv7nqOs*wF(-lT*fZD
z7Utg{xrc6;(A9Y)bj5J*AfTr(S{p$z9Ci0tbykCvfXT>@@SLte16@SvB&b+4MJi=|
zo@=&2mSM;m!@xLMB906+FoS-kc*P}kK*_v-$IrB2s%7+5mR-oeUC%b`AlXu5R<+h$
zhOgw2Onv^9e$6ch5&mOj;~>s@9#wtAEU=p#*fmMQFx>>Ec
zTeHPfQgE%+qH?>IdN{=$1yKDc5V8p%Y$>Vz^Dh)nhL<#+p%1At@AxDb%#2#n0N2{ZLLak@B%%spcaNN&Kbdk
zL(+0vxt4iQ$$3S}*qUP=TP5stTKJ8zF<)RM%o2dzvVv)T*P@O_iHyP1>e1c#f`Jut9-f
zZn5>O^vKAT6sigBl??=lh1E+w<^rnWPP+|YXvH}x`6WoFCHi4_+6NE{yY>IQ3
zlu9D!8GgYh$N!``Z#}BAxr-qsy@&zH<8-=w{OswS2lu|`-}&yp_Md<6yYF59;NN)i
zk<;ZTK6>j*Z+`gj{*%ko272AXj9igcAOr4J%{~FmO)^c5ezU6!6(`=jxa?YAeCtc^
z-ha0*AARMmfByQHKXc>e<*iq~Zi~wkFETE3yCgR@w=KM6Y5YthsN<61{FK{it%?kk
zm6Li1q8N^ME%HsH+gjHmCwvS9E*gnbuzNhO%h49-gL~|*eR12=g6L@v+0Ga@X~j)i
z(dA+zv=c=`7Q_tVv>DUER#tZanhDXjcE2$d!?aY6DE4}kN_A$vT05yEUTAdNOj1{)
zbg_ECP70iNcdy7raO#34Odeu($qXV6jN3>9Nay|_n=$CP9+T$Ba4;dxjAp5Il86Zo
zf<>wtOar!N(>1BvHWO%gnn-h3B_Bw@Je>+3)G8*o%)Lr@|Eh|?yt}b#&q&JcRC>f<
zW^~WaQzEDLh|KC1l`1`LL-=gA`2PVWrMy!C)}}0BWFR6p37(3{RV(1V(3;dj6MptH6%*^MBqF`LEoH>2SdzQ%+63g(DuMXK6*NL6ex
ztTaJ-o4PvF#!Qb!7vrr=CrO)IPgU$9+`7A&2E1))mcgz#JltJI+iMsgz3g!MJw~jx
zr2c05+bBoJ7<)um9xXsNI${gA*61_)5*#fKW_a0S1Ko?Zf;+MpTFY|bW9&6W!G(rq
zceSj$K;wO=)sZ2A5PGCEX&khon(E2G3#!N7QHe~9CD
zW0(^6)c^tsLK-NRKy^9mtFS&GcudRSuDnGru?odzFbbN3m0e92W7hNqA@dbf?`yMD4S!^s&=bA1JI=9+G$!(CFg;Yv?Ha?lIBqfl9D{I?I0&nDu|%vg|vA9k6*M;IeJ|6
zxf)$11SG1v)^4GMXT;qW%dn%=*QwqN2(@=tSYpU)$1V461{A8LF>&gAj*+En*EYSOq2i;Pg$5%9>5j9y5zKw(#T8!S
zH+=ZuOP_uH2fyQ+e_w8USAF86-*DsV*0bkNro6*k1nR<)$M~YHr&P4pY&4SPw&3SP
zKfHS{DqeZz##i6?;4}Y_-~Ic4%Yz3`|8M{0-?)AM-X~uBD2lz;zV@C)ta`_RO~58O
z{7!_|11o(SbaEC|QK8~6X2eV5!RH2PBxV!*bPN!rHZH>;cf&#d
zF#l{70H*f|vZGNnxLK{`BEHHIRh8D#a;+Lv8a~-myZe+MeW(RQp2%Zk$f_j*L$Zs;
zv=6FDBaLQuV=x!zPX}OL4LCT0;>SYA7!XH~eQ8-~>&vG!T9*xm>
zPo7(9G8#+Ah@F_^4@TD>u@T%?iD{{Bc4VCW-5W@GKMufS?On4p=g;0`DY1%H%mR(I
zH_%(g(tNBa&~CLWYhOBlZ4d%zuHL(gTBgb)s-rE49#b*`B~%>C4TDTy#)?LZ47|G>
z7pIFS&!4`1@BM%4cm4MN?7#Sf3;4mm@i3p}r#|)a*WSB#|Nf)P*iuP^?{l%}n@&1E%*6IEi-}pywzyH~nU;g;bmtNbrZFzOd
z3&sT@eOnxDOiz+n_S-Okuw5{tUj7?F`<(Lyl`&lW^
zxay~s*e*5A20#+!WnDf1yZfL6=#JG3z?R$E7m_wJRe_;Z@3neGc=vBet0f3osDEal
zG!Ni#o%+Gl-bgtbq8*jTnxwjdj6;i0E$5nTe-eH3)?C3;Gi+
ztL!)LjG$+BT7Zr&*lRJ-h^sD@TUq13r7im`bh*#dHWr
z0vjBCwX0aO&Tq1=iBLf$SaBK{apD
znn$fBtX!7IwL{^mgAaG3YW%e^t2u_!SHM$efmYd{>|vi3R0W8%vxi{pRzcj25)Lxm
zr1}KT7KBVO5?0}<#*^?}y*>-l3j%P1<
zVL>zqyuAhO;6M`$t~AH?NHMs%syGhwB6*XsszB9rg_ixe8A5AwYB!d#mgX&cHFI8p
zhpW39TQJyF`*ykjg4lZoSU7~OdqYDyY@q`S%&gi~3ogrdDOWgs{gMkhDuS!Lr&y<<
zgbIOG$jvxPbw_N@m`vZuZWNfI?!twdpem0}f%ZdTW9fA)>%Gx4$*NPf=zP7rMlF4p
z8g7=#qH+c4wQS2Jk4uOg14_PE>MJ3)KuskRhH~cFAJvjocYePzBb9L5bZZ
z#pUWihN-<2oxYBK!4QLj_VRvG%n{Ncv1$nb&0wvaCQ>l6U9Cb^7CG#4(Oo{Enkc3R
zjdSxxD+QD8S>ZbfD;
zVB_%HI5%z!A}r4GXdp9|8JHfx$|ZaQUC<&o6~R{apcp66m6b+a2Ly^nOVCu);&m@z
zz+>%%?;3CI2!@2p`dSF=>$<^=$O!8zW{JQ+ChkzDEgqeY=Vmd0fsSbg2MUw$u-#@pq4mIWCatnqN{BqN_8wEan2`FVjRqt#WM6APi4iWoCIL
zTZROlTVN+H>efr2eD?UxuYBqMyMN2$>LTLfAN%But6NVVKkQY?bOQJsZQZ4v@%m{=
zCT()W9_ro~KD>7?FFyLx%^Sb+OYdLY-2TA-@OM0V^yqK?SAXm7{d=#z^hyXYv0r~5
zePz$qYr{jRD$m_i6*C6m@tCn$^OmorKrBz8>o5c7f?iZAi7qTQfK@wZPSdQzG@>n|
z7^0v-8-_RM!I+U+vLaIVH&D9{%W4=(KsR%0F|#s4$$Qi#&ctA&lc)h-%Bm$jA1d0L
zs8E(`Fr=P1@Do==BqL2fSY~GN5gOR&??b!ihXH(5KLM`U+R^%eum;hQ-#p*^6Vy+&
zf1jeD5rdw_{lLj%;K%|xa;xPbPlefxxiOr2s%PS~d+n8(a;uhG?Ai-Jp)$4?Y^g#5
ztca*Cg-*eJ0kQdRfahQrNn{!kcTW(Z4VCTLvjfn<3m}0uWax^hM^UI!;XIp^yV1$Z
zeO%5AVH=Pk;KQ_wGD==e-A4+f1D)DyXXqV`l+q
z0-QQYqPqsjQxII}?IJF3Tt0vH{EJ_C{r1y$pT_Mkyz%q5?|ku!T@We5fg4=?&fYsBL)>(h2bO)tz*sAIqD
zz;`X-zWs%kGGK&&VS`&e5`db2IAE_v=avB0(QzyKiML4Y8N#Xsm8ta=m8RQG!rW#)~dDkO`A(m
z9ys(>CYF7}?d7AvrvoK+DlLc}tpf+sFIv?&ZT7)e1XrkxOajZaTsN|6F@-BxFsUV#
zs^N@(L%+XFF6o$dxtH^MYBaWO3nmJ((=;;+w01=ZN3bQXfZnEeLSVqs)a=$dE)Y#y
z!9}Vr(YLP-EurcOnQ+cD;H~15#aX8p?A0jf03Wf~plWHILKIat#}N^w!whM28XXSn
z`s(^r>X2(-n-}+2V4!F#?gRv^W}r2K+o1Lj(b*8xgh^FZATTRBdrCW>0WlC-e_WAj$u&6x%CtSIwkEm016VWCXgs;!jDX5
zM8mgl{sD$>1`m>PYjs6N?G0LYp&!LxuZB>-8BD1~sikEt(sqWh0E9lj#X8;1UJ)}e
z>{F(}0QKf(fyXJp^+8D4ujXXlmB1tujolztO#>+{6~>xMG@R*3{X(Po{s7P)wS$1C
zehw@{eKq1x%n~
zt?EtV9O$+7h}^cVTal6oXMcD4=(@h%hKP%ds*>qfl^6+we*)s&aPGm_TQ
z$Ye$r60x|f`kAVdq(qW&9BJ>BJ)-0JGplb2q)>?aMXMrSv1JLOJ
z(Z2GosM7N?CYXcn|*gF#7h95vF?6w`?ZgK{ML<&U;Ib!US4j0V2DNuRqdy}Q^{{ktA{je(G^%tDVj1;X{d^debv|KIGr{*3%ZkMPdnl2Q?YQ>3X%-}
zp00(C$gs%Sl3JZqWyLY?QZ9#-79jg~6_^;^FAKmE_X?_c??um0`7asP{--9Pp9FF$zv_|3QOUB*Vn
znhB*iPOvgBIt+JeCbq3CSku-vx|-QnH!mMQe)7eyzJBl7`%mMYU;W~b-GA`zE3bXi
z%^R;IFHhT5#%YTS6vJv|i5;XN>~U(KSNsiLBBIjMWR|Qr+-Y@9cg>;*p%~b&<#bXJ
z*}b|MOfO1pM+^XKm8F&44ONN=vMO@hP-fLU5NNLf_~tbV1$5@d?zLK^rRw9DGE9(R
zl`sV~m?C*>pv7({?1&H+T%)JOMBROrRDQ#wmI_lEEFXABMlG^hE&#~zmryw?qc(J>
zhx*jH^r{K>?Cz3~C!*K7W@IqDr@^wnvg*>1h?xi1h6f5fqp@CcrDrYziV0A@M3j9P
zz%BZiQmX<2fo)5{y%Do8(|!^yG(qZF{rn@n1t}z$V+5QTK-bP(T+AHq0o}O1Ocm;%Xl7vF;f-Y>O8maJFUi0
zbsN*}Q%e&gd+jn{n4rg$lC<{fCDDLMFid&iFxI`gGrU9R5aZL<=b)~}kr>)zq0Ei7lzK-5sQemOc61l4
zZv>>#K%P!1@7bCeo!YNKPJ!vhu-O@03oK@G
zU!KRYIt)5dl@VSROk_qa!At>YEX`$~$1c=Ojvg6PTw&lD(nCgA*STGgupC{;rqLxgf6$IpDWlOD|el;RdDE4eTDt|n2Q;}$UM6bn6d4~$wD#5rBskfm<
z1Ufbj+PY{m9cuRvo=UbXxVwTw)QQk*y#rw)P<|lo=pGSOJ0~g%SJmap;9A`hOt}MY
z278spkM$Wub{%c#Q4utt!RMp@B?%8q5$H_mvni*LeH3<$iI)1r^m9B!E=DMLu1lfn
zceHQ@#f0N&z6%(L5Tf}-Y%CeUbu%OOwG&N7twl1D``+LR##(#W3sa9*DVI`4K+cG$ga15E
zi2hU6t6JXtCbEs2V6EvErdFHQ$;hpc02f2*ui=zfBJWh3Zdv>8y0MS2(DaTH^A&U$
zu?0W`*Rqhi36?sEh{$cbfVSt7Hxo}EfB0)}{1{^=eh0cf`LR#kdimwY4BO;!ft!1VK5sqrqRinfB$Mn$b%pmvp$nyThm3s{h3-p;kkYR~P*w)f
zuBAC@4va1Az|lS*h9rp9We|4G#?)Z3mT)L@eiD4C`EFo~h^hhMg}}&2O~VW24^7r2
zF98Gcdhtm*^5z
zkb}lGVYV*v6v($eeEXHxKKdX3C*Sv7-~Fi{`F}t7XFs=p@}swE)f->Fw=n{-FB!>#
z6rD50!*Ot-~qJaxyr&7aof-4iYzdc1|4XX82tnvPlDKN}H;9
zydgAuB&^eD1LtC8fIJ+%fsSr-{Q5kx00~RU2${9cx0lIs4h6lp2^T8N82mQ;JFP#
zAYI&y_F<3>$t@+#oq$8@%t)@OggC4_sy)j(G1Afif{e2HUd`k+#m%~+(!B`4N}svC
zfNT_|@U|!j-5m}bdeV&!BO_7aNmv)l-D`v~jN^5?psy}@(<>BlB*^-ZE;XEWoVpe&
zikWorPueJlDg@O&>_cZqkZTco{@GZ=j;b+e08#`FYdNuEAbLnYt*782QWqDEbNm#|
zexxCk{OvUV2v#W!9tlH5r}Ml%wE`eRI{aRx6~y}4
zAQ+MdWA*CrYXkt6Q;v`_snp!h2itqU=)oC<^sd^sZBr?u2FnZ^ptRn8ehp!i;iS{^
zh8necPfjm;&U$)vyC(FyipiPt)cJ=4ksh7N@^;2QghGaIBvOxwBsd3~FtBZruJc9*
zqt!avU8y57tu1t|<}adnJ}btY@A_O2UWC;_E=d4zr*yy6LJ)utsG*6hG_i`&jf+s5kpyF37R{=<6HzTPs)2|^6;NpG45
z98gkV*fWVjIJsjEK|8T}M!>@+lh!!|c%VD{)17lXkwkIsu5W=7oIyHT
zGQ)!%NxhK8*cjv@_aK9jH)3Pl``jBpleo&vcizV*KkWdU3e0La&a9wO>E@@WWSL{aD7cpa03P{+{nW{Re;kd+*(U^k4szpa1%g
ze(dV`c=ZKIEDgIIgc-h90wej|J%|9(LB=rZfL3^`bou{V`#n
z3QzRxQDyiGIS&u^=wA$)rvu11M2_7@)(vArsEACf56od!Ney0}=QZ0`bCuL`zfkfW
z$l-`~Q4PLO6HgZDL$xz0RUr0i8J!^PE|r0{Et|o_=2U)yz?1ea@x+c!pi){@FBR=R
zilfBn6z*lbFTy-XW3Gy%9X3*0t0moAT5d=-DD0k#t{s)~a6X+7;F+riRBf>glnWc8jPb8pcjbBT3!esB%@684>KY
zP}+7A$<&8m9_CZs>3wlk`-qtvz*@ff8Y(AqgQ7traE#gX!J=3sTpG!Olk%~h5?
zrAb(I$`~TdUjYZK+xk&%Iz7>ZF8j!J?`!QXDx`bWz77#qnG%oDaBAMnpVSK4Gnxq#
zT%6xKm|wSfs`+kcY{@O7fq5xr?p1xxB-Od`Zbu}Hnxh6D!ixn`b?<9m;v`XPEiyUc
z7S&6Ap7QE>*2-yC>A3h^B~UDhs(vBsALVV=5ml;k&9^k)|p9J*J42vZF`FF8^&
zm}J({|4a{bO5>dhLDN_I>M0^Ebh9J9h0ctDRupK&OR|AkfHwfQ6pCP%rl%S<4wfX+
za*?UP^*0N?&=J9;r2^AMKwUjNyYTo8Tm-aQOiLC>b7mFe<@mgzX$%Fk=jhd9!M{6Wc
z;#f@dL#AaICUlQ+d@FSPmFGTF1tsV9Ir1-zWZtp?cfCvcXB>xM+%FU%6{2AdP>;zS
z|C-%Mt(jUfwoO=GHA>mG%2ioa*+X7%gp`M#G1v1^ffO*i-k5#k!CtM&Z3TXXRP~n7
zNmLqMYwxPnYt_CyAFew*WQ+g&5w$9U?L33-O8IyVe`srxBal=Bwb%2iwfsIDZ(d0B
zO52uOxJD|UwN1pTFle2O=?hnBn4gM}`z}RT?fWh_+ekM;UQY9lwW?}0
zd;Bs3&N%0LqM}l-R%n5-w$Tk#wIEUZ>w7}J;2%3b=4=gFlaa@FTG!t{U1DBskncmi
zLdN7QbR$%BD*HNEx`gxHHP}%W!uVCm+jg&B9&rRDXE-N*dqGR$;?=TUOIfz7;=Cdl
z-D_X#On>*t`TeE1+bKyToZ=kEM(;S58IGg=J35)w5v*Eq=2tZc&I)TNwQ6rH
zhCl{Xas-nH9c273oZMWVg7l`+wd#7mCb@A_-XKHs5w3Tg_5;MG)eB&5S?H2Eht9+?
z5M^Dn-4XS_Plcm+;VMrv#FX8fI_&AGl@J-2)pPQ8YNjFOAx(tO6vAF8s;I~jnyB<)
zY~IMkDb^92JHdc^!VYfR>A};751&2#WB>mD;7|Yg-}y_w_~@s9^zlnqmzOvA`7eF&
z^_t5{*4j=ps98{nXOPVT2xGRF`wdRa5NNA)arqPla-%v4dKpWM;M9+2)~FjkSJv4P>vi~x}5cL%F?m5ThS
zM3#=>mtKUwtaT#R%fcnLtEN7fk3-#b2G6GKG_BZ9mV@X-#uhW&qmFE7A9UC1Vl>kQ
zm1?&wHed9EkB2tatk!mr@P(RJMt3L%G<3-H6_maFnWtVg93a7Pcp_2Y^a5q33h9(|
z%#NZL=zZTCjX>l~W3qEgEq`h`OS_am0;B-KDrvU22`n^=qqrg7NAJZMp3O}HnbHT-
zhadLArJjNqF$3OPlIXQ)aBp}@Sg8nOow6_H9FHaVYuh%JChppGP$QYq;giddmZ4`A
z-caCY0%S_1pny=F!^n*Rup>?Lkj%s4jU$%v+XP7u53`Y8y~_;9d0ld&O}@M8HbZAe
zauv60dP_+uA~}{1g|)A1pdun7ClC4%VU#-*G3txOIc-f_$GaJhOoh)w?2SOA{MJc3
zKbN|?2&%4vo>jtyY4q+07C_PMk&Kth+`pJP4jbfW&WUxJm5A69sI~9AkF@6s)n4&(B
zv$oxTa`^M3hJyzIRNj|U$;=qRYO({JgJd#CM&N;D2O{U8>7UQ<&Pns=?kO!#m9oj?
zCpCYgS7c9ucVKdKvPR9&r%C|@B1e?bcQ`Fsi8z_AJ?0JF^vRGCrOo*&*HNxO7_vVS
zjCJJGJYEw;>4#>Hv7y12Npoo?KE`L)wk{>qnr@~yl7{K54HZ{L3F>Gk#1
zjhlH&uv%1$KKAigj_>Fc*pb?wDrTuEqa$>J*H523dHnG5>gM&+CqMrWzVgXWz4B-N
z?7#QgCqDk}-S-f2adq-e$8ci;#_VEs8uS0q`d>mRIHtX5J7YN$9!t3ouTwo>{MyHTq#2w6M+FNWA2PKeTJ^3BOXgCjKSa%*Pjdtm^+pla
zQyYd7Q_UW*sT~bDs%KOD3T7`<^=aEEBqKL7nC`a22WH&$1X;RY!9e)_FLI;73#ocG
zXwQ6tA=Po@OS?Px5myPsTSEPZz0vrfNO=3t&G|-|FwQ^-jDcGB&Ng5(VmFW-T{2VV
zX}fy%{Q86YcYn`+_jmr4ANajr`P%gl|34qy#N|gma{2ljcOTq)e6ek-uS?ar`jFLK
z&9+XJaM$PO<$_UF6xcjv+_=~tKYZ||ufF~a_Z~cd^OryWclY(+rB}Y?;^O9pQ}SZV
zQzB8UD*L9Cf!Q7)wcC^j{R{z-cr_i7k-2lM^8#)SxhgBS`@I@XSIh!5B-AigF-7I3ey!GiZ`ADq|~A*{ztA2zCT!VlCcfrX-SJl2&^^)RvuQD%HRg3=HeL&QO
zT7u<`(W0R3!Cm{lm$>&?e_De~D$@d+~2yI#pBmwgaLIr9+sMf|5O~Z+t
zd-)EX#agAIIJEoa(kkO&ErSEC9pzEYVv=^uCA-$X)^04oH=Tgjw1`Pq`*JAL$>bQj
z^j=k&N&Dl}S{1=syICLt=(JT?3mVXO(||T`uxFv<6<(aEBQ(S#`XKbI5)-90|6cRT
zqQ1)|JV@qt!k`jDz^nJc?~Bp&3f9KJg2L9i+VXQnd1l5&ddRY2V5|12ca2jHKMr7K
zn3V&8mFOyVVcTRICeI9iFA_;vp!Dh@is)ezG;M~q9We(r=9IU3WfaiPp%P}DjRq`B
zqiBa6bcBQg5lltnG5=GQD^@WzhZ_&OgflvN)7i@u3-MyZpys=di$fIPXg
zVc*5j9->07b-n7ktB6i|E-^r`*YdaT?(2P*uays+Ab#vqf;Rva38R2=n&K?q&?>v`
z$qJ!OVCc3qbAWY!mB>^l+XMKu)>2RLi0+d7At`~6TEfXtLk6rBKGRlbB)MjT>N#5K
zKT|wqZY4)<9ye*Lg)MS8Ui;Aav~c=dGD9Mf!m$Lt^%(0o!x^cgnCZo*#}`{``55~X
znb&TRh?M%Y2FwshW^$}o?fY7-?SBsYD)_r58TX`|ARFH6=DqFn3Xbd}b;I#+(d&A@
z-fNka0CSXes=c-?13??rRi6=R7YFEe8a|#1RFIU*3*U@E3aT_*qWBtATK4K-pCzS9
z7laD4PGnAx-DsqfWd=0D*zL8te$F+zt%=jVKyqJhZ8&dfjY}rX124z?;p?@IOQCP+
zRcckJ#nA)zzE()fcoqb$c{k1ICH+^cmh-pl+UGTSlDW&gy({D@`93P*&3BPMY@s+D
zwSSD~s-~Hm>EkvnZGBU97teE~0#4P?ODs-nm3L6`Z7`5PWMoF>cCqnt;|=7ETOaw@
z#ntvJumAX)@BfqgPv3gygEyaEKe@cRiVW?eo(rdThIY(=#F9nIY_%~g`rPzYtVle4
z{P^kPXBSte58k``nV);>H~p*s()a!GKU_F{aPLmW1t?vtl$Ep%YTGUpM|5(_FNSHG
z&TGxhb$L8s3Jv}Zl%n^ak-E-S25`hGx>+JWyE8pv&>r-t##oau^fJd!yBcTITP|zG^RO&>+9ryNrlacfWi0_HX))-~K=SYu~%wIQ{Ma
z8!U8?--}wbCcsLPRCaDIg6Xs8$cMJDQRJ#3%+CRBuZ|1T9X$wAe8u>zgElmZnF~
z8;n|&Cdd_jaqN@R$rvU%Tvz4b#9eZ3447y__3Fwk(OT`pDMO+9Q!QS5v}`8I4A~$U
zon6c6MG`Oey=%ME7Z4~@vJ8nXkhr}E@TCzP0)$*L6@WOSW>*%5`L
zw^^1~#dJRC){2#8%rIx~QJLGRdi8h`maV5!YoP=ZqOoPl!D=*$9fI;Dfb{6TzOH6$
z=N>o)3*Qx{NxAB~$!?m;67nEkoL{d
z#}b*tL&TszgBg8<38p^7vGYq!j)rNmeJ$1Wy3ZM|sy&FV0|`MGx)#RcOLp##M`BbI
zUL0yz0894PbXXwRShmrdq^l*IAx+cr-X69G9?b(>@6R)~)9J!BVqn$o_@P)Sh#9L3
zF}mf$rp9qe!CA-~gP9xHcJxAbfm@JFE<<%X##JTmW^{pnTOF>I@?_
zf;BNl!dKXDOwGas;j`?n9bLt_xn6=Em-is(o4St@B3{TC|8P!;W)5@Eb1hvXBhsdS
z>Wh6u&|_S$P%>!~OJJz7(=xE$>|U~1gs?3UO9&Tw9Cj3-2mUqt9MRHwO%!OCtV$?>
zUcwv%*7zgRzK$V8tdVlJ5O%#hf`%dbIMoO_8J;NR$1bftM(S31vx~k-bwl=ak~}oP
z_OxyKj%jeTtA+3jE0K|nOX?bD1e_z+T6;hf2N-DyAl0Ssu{Hxv=Ptpej#-4}q5Mi-
z;BR#@T{#K;V+)L=Bd#ZPhcHr??hR_%qNyQFQ@$D$&o~zw?W2f+$BuswU^qMTV!HL^
zPpC$Y49;ASj-4(yG-WMD8CD#Gd`6nf0PXR?T+AFrglvKUP0~i{+#G;a75cgVJZaQF2hpmHAp^ix2jjAhFEtL!UZZK)-2q+LjP?h3I)smz~
zDcHMPTb-)2B@jWOka2)XFq&@me|0Z(&f*imTZq?!VxIPg?gG@^Y~$6-Cw-c+V@qFnUTgx&l*1=o~<4pWxPa()fH4j
z_WlI~PU!9JJ0E=F6QB62|H&Wx=I{9U-~8(z-hLOK_{6QZ-}~^r_a9^ix2RgZ#>LT_
z<$8@buVFf+NNQwGJ1>ClE#q`?y8rm`m)?Er2_D{l@}d~bRVUWCt;1cHFapDTY3Q9qovl-|C9R?u!kqyNYLJyT@c}bmcLS!
z-5^bESOo^nteQI78(?k`5nb3p0+N#0EeE#&W|@2HIC4xO#!TdhNAJg^ox4YIVUGONDU&wbwrMJ|nab9FT&e
zd!8<;Mv&NTEq@SQ;)y^k21gok;=8|U3gusr5EF8
zNO4X$xBy4*CLz^wN4ld^O|SQ;JEYt0f)cj5maa*M$kFK_0GB{$zclIN1j-I-(26$P
z%om*EkFvp;BT|=9bJR493N)&)0J0;q8*5#!TG!Xt`U8C+GTjl(7v)lYyqKf>9d`}&
z+Tt^sGH7ienHa80$C6Uk)e!S>Lm^ZI?Rs=Il>cSm5!!Zk?H
z!TG2M+aN_%X?3b1)sd6zke3m&(?QQ+`SjK#i`rDVq9R@GDBcysY?OWD=Ffil-GBV#`pyS;-g$QY{NnOPYQEOv
z$C?V@jEP0yh%HCKRz_(-Un`*Y_29unRBpjv`lnxe^UHVt@E`lVzwNjG&iC%!eZH=@
z?b7gsySQY86gp_>%R)yEz}j~;O^Jxe2{nDRGY72D^W%=)+RcM=qnQYyxLxnKV#bwdR&l?yc@ElNl6jZzR4&__}!)#T`fG9wYr$
zOlmjNoN+6o17WLlmk>kS&c6_t5oxuurCBOJ6~@!GhXG^G{EDlbo@SWD>g7n*b0zkw
zsUZ^{u~C_?t35V&uiSm?^uCVpGQTOh&x)R
z)&@<5^44~dmlvl8j~{>Oov%Hr58r?I`Okjt$I<&oUis!NFE?Ipd9}qw;FNL7jF^>u
z-j0oiEVz!Z=&pvao5K!ro7J_J+)S9K&x}AI39usRRhH7A_`A$Nvd_Ji4T5&q&|l~d
zTkKTGq_GUi&|rWMQFqZ>I%f`KdLT}TV=!a7N`=Bq3U=xNNA`WM-i;D@K1$Je_7B8Z
znT5erc*YFsV;Nw2G)}t|(lT-pG^;JmPc#xp~;wlNYHBjj)H3HSm
zz^a`ygs#K`z-oUOOOT8h)<7=RC@?=s3fdt_@g(KVs_nEah&^~D
zRXDWkm*@zPf)(`NlLt=G-O&i_t}Fd7%g2VX#nNUz2B16=;t#ewDWTNfjn3S*+*DVI
zd_%=_d{x^1+qWg^4w=6GypI{P|jV;Nz(*~GKH^R
zYZ$wi0uXSz9@hgAD8)lt{lWr3kzBYjg%xRVC^`ubW<
z$l)|}X0&AAx~iJX8NPwlh1IT7hv+i5b%r_`weL&UZ&FNks}Y^iO=9(md87K9J{#(q
zP++{U|9r?VNmV>T>=sDx*=Iz+r}Z}IZU#EoRhkHw(^S<$Av3VFb4#f~VA@)})+&Fb
zxlKKTMP)Kbxy7JXcN0;Lou*-CqZOxl=+TpnVy+g$Lv*!zVa;JNNKP@eq4m+z7&%V}
zu+=cs($UsFJfVUl5bpU`?fb6H0*-8JU9Yt_3ZcR(g)h4?F_eMng}q(eU9`X73zo&`
z$n(m(b>mSah4n-R)Cl#GyHYpQItq!@$#K@4dcl>C^P~1A
zED}wnzizA{fK47a7PZHuyGQYXMug;69*$TeBm@Ddw(}PRC}aGP9iUvtds4qhEN#8!
zzE?yN8IeB4;c;Iv9|#6Q>|YyAa8<6asV<|ttC!=5X=>J5IAnmdx+WqS89bfh>SDW*
zae4L9%eP*7>GN;=?3dsBCr|6no%`=xUtgatu5#NVhLs$58M%48zVcn`>O$HP1yxg2
zAb|bx(}(vTY!?^3u7Bajzxw1^{mK9Fzxz$!{B7^v`GCxe(}kXo{*#{BR6stu**0_t
zSRZNPrO?RSF!xLXijU!{~XMb8pn%T~3
z$yA#l20a*rg5NAma<1vahVxyYdRx}#q-WA7^G8H;vqR`b?
z_MQ-E2Spp1EufjI3|4yup}=cT7dU*-4MeptEe7G{rzKgaQg#pNFuO*RJbhFf9o)8U
z+b)u^JR_kLqSBTTo8DEm$+SRp8+8x|;n3C*adGeQhfkh8`V)Wj_x;g7`CEVPXFmMQ
z&pr9N*KR(0y1x4EhpN!4_Nk~iu%F%w!qy)Hz<4;$%x8BqdAi64PoBN;&RY-n5AQtw
z!moV(?}5)=di5JKFOyeWTy1#~c``~!c54Dna3YV6&iSDG(E4^c&R6Zvub-2()&e?{
zT|NF-QNu|1+OKxut|t%SH{$)ETqY>NeTYeUz4~(sT#ZIW&UI7&P(3)DaVG)RNIwKYOdw-q&@rNUSA@U6XR~@>OxC
z%iZl-l6xKRV#*)4Z=#NsXKU4t%tok<9Ww2Bz$yXI?E$A+djb2dSIpqH#f6C%4j;?z
z$#7m;*y;)d+!rWXn>{Y;``V4MqW9XXyL!(YbQhHy_O%*_WO*z{c$d6C)jr5-0<~IQ
znJ8;LAsvWq+Z4%!zoR2#3vjJnEyN*b-Bl2z*-Sn5Rr|j7!ZL4M=0zsHN|xz!sYh4?
z8ThUV`e`*OY5>MN!CRL`0tbL8(={|2fu!R*-KzH-Z#kK-RfWoJ5H|!jc4N60bUy10
z15AQ86AbFcFdca!lIE`jQzb}5Zn06hm`ZiiZpgUKRiIML4zuqCVmobKMrDqtGO0yM
zHM+iSJ8gNI6=K~0GkTt`a=&$z15r!yVHYdXYm=K20@fhTeF)Xsb+5Crgb{6+0@FW{
znmMZ~%+8!K8HZ|xDXwFsxgxdO5&f-1Q
zWVbq`5~f-62Y@bmOME-R3M%bhYj0>xoBbP(9IyA;L){CFDT_-zsjbG*V4|uYl!G?K
zFKHN0o>R@vEjNe{hfYqXUx)t4p~n%&Gxy6E7m{Xb!C3^iEqi7myLR0t)eJqvzhYKR
zj|x*6Ee^eBuVR@61AIE1Jz>&J$xZxhZ72D*(ffN^xno&`(wZPyt9Fr(+m>A#LpGqG
zicrn4NkaPF=%t-;6X!#saLm&RiYa5%#+KVORHJ-R
zlGh~>wkk(OBz@v;VFceH`Emfg(ZCq6@;N?>zggUtePFq|>Ufp=<#{N(!Xoe$q%t1hpu!sd?LY-~$6t7p#$M+|fyONf0~CE~4q^6=rK#}6(qZ#;hV
z@aKQ(^^bq!NB`KL{DW6FUw!Z1?JZ7Pt}eFb2+Uo*+OtsY2qx*T_m0vRgfDz|S}r5y
zmIr`DUO7v8j#5#gT1!QAI}C>QxezW7BBjP4tu%$!7j$(`1&tSQl3p5G?T%Ue?$2gy
zwuk*ju;F%qn+^{~hd5V8J|p6@RK^qDQ&`((BW$i1(h>SRGv0-GeE@%Wtn8X+!Ne-Fl>NU^9h=z(w
zeSTPF8sbgV6EYdeZM%GW{rt{@yT9kV|MkE01OMii-gx{|KYafqH!inRymR~hx~@&t
zx6JoI$l{pYE$q|yg;0kxB;wk?P8WG~b@}+=^Ecml`@!|S+Yi3@%b)uR#(L!=pU${C
z<<)7s%DfT0h|qQ(4k`lIc~+LgE-g<0{iTYreeYM7LLr-pF`hw38s%SldW+pURdt}aki)3!W
zV*swj*LfhyX@T9)E(#P@VV_6mXGp;(B;+5H8_>my%x&AYblag>M^8pb(+VR2lGuSL
z*7ft}u#X(9^AyW8>=vfJFEo?g73XQhuC7R?v0fg5R+i&5RF5N6kBAJCmKjphdtcSv
zxutU?d~7sj8i7Cuf$WMB70fwQ4j%(in`BF?&8<4mIJ8(jN20qCh|?xq6V9A~`1hLi
zP~^ULap2()=kh{RATeE&^|UkEO?AeGFIueX;2yD>O&JP{LI;GavH^=pNF>(
zlp4_odZ&vT(G#(N*)E{hYx8h-5t;H$IJjw>82RY-ko3MRE-KXKNy8|#sG))tnHt;*
z?=K?^#vK|6vqGjx9V1&U1lQWvy7u7@ZV{m=s+iADfO$my1{k4Vmw6&lyKfm>InkHJ
zN*4bjKfD0!yURKXHQ_$8;!yH}4Z5q!{=k@f;D5gas5RE$+Rm%MY8M#XSG6C}@O4Js
z)Zt_sz9zJ$sCg2%?x{Wx@vpXw6X{wd?WB^$*nxjYtD2kh<7YDl-KW&Nb3-R5@}wKSY{@c<}>~
zIOb@&&#j+J)Z^H+0oPXWbp5P9924~=sZj6?Lc62Q_8ys>umB4-Dp!dG)S)iHc^O0@
zXu~`WHK?_aBm@i*nCecAtp!7S%?1(;jFL
zW?T>eT~l^oE>nY5T9VUaGN50zw3QxY(r@u7!(iH|6|M!;_!8jw|D#c>iXp!dH3s_2
zF>{LMBhCdYC#UP6YCDFN5g1p#1q=PWIA{=71CyM=jmW5;rKY+#3Tc)upV^nGOTbX=
z1Vml$yXKnEnq?@6J{?mVGD7<{fYBX1W^m;9oqszI*TC?bUU8b#*$Ol0uucJJVMHQ-wsPlVOC+x2slITCh}5KDqzk`LpYn
zUVi!gckg`WXTJ1Xf7^Hb!GG@$T<`nc2X{}~)wXR%s_}tPB8JMIO}8tpNDC{qBCH-T
zLE5?(Mtq(5{Xh@Nknj(PhMruYDI<;w%NSH_87VC{9Cm^ORTBb~RHq&#bX&O+n}P#<
zoLm9HKP8f>^nnRLTW+H;bo5(gPB(J{5l(d1|a>K}iAg_gph%FuO
zLsOlGV8_j=GxBsgk>LQy23$J_XRz>S45#)p-tEfX_#)Mjx9AR66%8$tT3rlo>a_PI
zYS^tR36Z_!`mcHzooKOkk=O(fuT^Wce|SUA2Qo)Rw`ePc={R?)Ef-3kCwM
zIa?TRZ+{n5kAfg01`Lf_opD-S@7#IozxAEJ;XnGHeb2Mz5B)#xoz~?`S2y0degEmR
z=O<=sy;
zo9IR@4II)pp<6t*aXIZ(@2XXxmtqUzh1UVJ@R+ttPF<%sCj#8IO*?P(^ZfB&m?(pt
zwDh~0>dA5Fp0u+YwXRpm#iJ;1G^>-e#!b7%YDj|yN}mHqA&vuvcAC<&6)vt`W-#&+
zAE@oFtM+}rUTc?-NFZ2lkx9=#c#~gM?U<^sjd0oCjq~z2>+lej%-X5!#3N+xC4lNDT&hU@YZHLU0REwF=R#@$ELfg_H|vg%VR)CT!^2Jw}`oZhJVRAE~+(S;nBpL?xDE(>xveuAX!C0c50+O!&aMoN4vnZQLONp6s5@Z9~18Tw~
zf(&n|aMw3Cu!W9hXw*mbxb75WgX{rUPXlUj+;a!QiReI5Wf^QA=gVzddCtF&6KytK
zmoNlxZz`|P(XU}ho1jgV)Zr=asuXEIbuw)wt&X}J8fQo4S&~q-``dNf!%obDKbv}0
zE95yOrxDzPpz9tvhbhw5d%%3%o~g6Fd(q}7w&JJ(`{-mn*HTOZ(Q9EUasAP5PyKe6
z)TFcw&_PecRS%lDuUfqWtNJ`QYaUF`0jTP=FaP4T)C=j4=<8JN6G`TSa9*AY62D@v
zv?W`*Tz4nkpdGyRI#k2;48fK^7<)#|tE-{4w`QO)+dth{7OmA77*iKziPV~_x{taz
zv`{OfyRB*g;t-FSKtnBavUT{}cpwu*DcVTRpj@K8sajpDr|D$c2gTL%5QOuxtIis6
zYTiL(vF*uHH%o)fPUC9&eI$9R6dT8M9BR#`Vp|F7nztnYL1k(U(9vm;^QR7Eu!vfk
zRBg|B!O2b0k_WdrAK^%>FbHmMd+!6VFSgT`DXd3%Y?ULnDK;_?C=B0NQw#X@0l?0O_aE%nb@RrJ
zFMjU5U;Wj0e((4EuK(V5fA_ryj~+jNvgN4b!8?=4KGQ4e9Yr@xA!y+
zQr)$>c5(UuBQ|Nz+CN#8M0hobK9*lMIIe*DZea+KQb1v_JpkGv*RpMtQ6MHZ*khmW
zeEgmKYRN9{d6~K82Y283_{U!Tfxr4apZb?x`&)ng_QSjQ=&QHxJa~Nn;p2p06oHGa
zt=8Ha$ITB)>tfNG9QTi}+8Zl2TwHF?pFaEA2k$;ucWyuW;xB*x$GacC^4d4%cD3=e
zZ5NRj;%JVUWQrFtJl-Bffj+-f(|SzqDy0cGs_LAB`R;1yZ6l$VuRcV;l>(N8WE|v`
zgLc1&-{}3Q8GB($%6TFt(dms1BxbxYnA>&|LL+*uYFD(5A^%;Z!tg_ShCv6ARl8Ei
z0r!@r0gDO()E@ICXx1rZf?V}jAC;==2EDFOKal=9P@6O-`gkD#6(p6|eUB7$atoRm
zR4sCJ7=9f*HrLJN2&v^bh)$%ws!G9udkBBiwH)0q7U6?0z<7}yVl9g1{jf{L#B~@&=MAZ+2H6VLMXD^UX~>kIlmw?
zGGWzyfaxtaWNcfWGz7rL>Ta#%I!SHE0^dKyS=udyEN%!
z{-;55!AmmZ$aTZ>4}dIigQ~*xQT=skPZi+2b%8Nv_@vIH(1EHltM6J8jYWkIwWPXO
z(LA0w06X985#(lGsddT1j+Z1NiSAYFdhK=r$mE&ap7<{a3kKqWmbYA0G1?ZG!Dh!c
z!XWR+kW`_o){fFsASs2g&tZ>ld1eQbFedP?`+hQfy1nC#2KwN9w>n+
zjG;IU329g>4^v-3Tq2r$gB*23+n&0l8*=p^I$gCGHIU4(oj5`(4yH2kSICL&#Ev2v
zTc{0knc$*ZzkU@;q}}vV!}zHPapa!`ze%=CS!i7NUC&{~oCMuSx-t4Vp~
zDA}v`iH$DyIK#5m4bh)GBg4W3p8um7G6f}9L!){c)Hq}`6CT|@z{gmh-{uZZh%UWo
zHx2fHy#B7?OcNQoZF!m7#Y?Yzg4^?7e*MR8KYIPav%B{m+(TfyJZ)P{=xDI4=Hzrf
z9(kp}9m^RVA-jRhKwUq6_+j>T^XlSX{Ij=i-~RA>|H$wA_TTiI-@o_4UbUSz6$DNk
zq1+amdTJ)L2}N4Yq0UK$${SzyL#_5=nP({jpiUc*@<=b}7*m~C>PM4m-&zxGvcZ7=
zV>LoVqDh976odq-Dg$~-P#V71RCoKJ?z4iy8V|Nq2{xY4M^3S!DAW=8Ih#lI-rJ^h
zIL@bDsf$CMFgcN|QS}SS5S9jmsWXZua0ml(Ot=~htOKZ3c1rs@a7t
z6ZXr)X*;1%9bPt2UDeWb)+&K-q?r(6LPAXj6$1bPzYFv6Td1|?_q-EAP*{u%rVsp2
zW$RR?2h#5`pECAl@JuL@uy-p~{J$_*Y%njktJ@FntXkjyr~kn3`rY606F+kMD___@
z`s&M%o<05W;e#lGtQc&)EmKAh6+mi-Tmz9Fy;O-OK>oDl{_Od?@4x%-+1)#j-~5%&
z|HS_M-bY^jrtRWt<0*I%JSFXLLszoOB%G^01G7mlDRnVYrrFby4>h7vLRJkzQqcGV
z+M~kyyHje*Z>_7)ShcRJx-H_@u@RQJFSETChFKopOFxw%rc%};F|%Jpv{?>^XdJUN
zM_kP$8Esd~B&|~;4n&ky6@(d#5>6xJV8E&dy6okpdczanDvC;YMGw`ezo?8;Yi@X%
zv`_io(_@a-0(sa7$IhQ>RbT5O?00PIlxxEGe
z*EzERDbWivCF-LBGon)uYbvZf3(>7{R-;*EBcJX=`}D$&Q{$0(Tr>lv`!D7JbF|l9
zP|?4Z?twZ4V=mt(lF5Yy3T+k0~r}YDkpbhI66-ds(zF(
zk6Xr;j4Az`GJDkUq)l|@1x)Bre&%-c4h>N140sa*jQn6wASE@!u6hbVboDX|Rr_wD
z&tyH$CrR(h!Q3UjL+>1w?nZjs97Y`Eo=lygqJgWD)}(iVC39C*$lVqe%`E7?uwq7%
zrYq9t>$FjJZzcdd;6x2-D)jW;y{6~X&o||+tJi=G?KGaVuWOOsRg0#F*yVxA9_rv=
zhBA&@&}8rXt~<1(W~f8CFymEbuG$!t&Wd5>@{R8n#Opt(_j3fw?uJbMJ?O}h8A|qj
z4C!?pw~B1^thN^)Av)|((=3g4i4W|lJDv1P_=!d#x|Xs5r|0fQ_m1`^1vDfmos!Rq
zGRUgyeP8W1=a5sZs^_}&k_|1>RfVp-_VV*z?I0*aDV^k=JiC#!Nv=HSCiM|?RPp2U
z8`PAVqEt_~t*I7je$E_R?Tpd)6$PzPvzi9qh`d5adALTRqc#d40n)IJRgD2RYmvlJ
zz&Ke|9lNxb_;mC%aly8x?|>@RHBWBo33oN^yJEM|V0CvdxagQ7C8Tw7D69zvbPn*f
zpE%@S_5yJ{zd|dmx(6C^C#KB5%bbD@_VRA_A!tpT*L(#ZS7+Sr?z8tm&rI!ExWp0H
zt&XX;&0ZelwXMQ5Ezcf(lrEQoM~tvd+psj~>-Io{lNNmFq0V9M7q)hF*Xm4iY$T31
z10X(yV&XLQbq-Y_;XUH&uYj9eX{3Z#DFKcG3cq5avTf>~>=eYuGm@saH;xovR@
zUNSCTdgYVX>+Y|<{v&sveCgh!+aErQro0KxxK>wY-P22bfQ_SLjYA#
z^QJN?)HR1INh=F5<(@92!lCO_edxjqb+}I!<_@pY3I3)9S3dU5dAbU0r#xkzA~wdx
zNDkm4cy2x|Fe>2}UOtasdVneZPXvRO5)2r2AbbKvFm_hm!#Oi*?X~1xG~*NVwcDZ<
zMg&{3>N?+5kuwvL;8WmFPM3W4KLH^NZ2ilK7+%qqzxqa=!h<=Sw#SAc7|iUhABnL-
zD`Fs!A^MniJ?j#VOj2T!d9)sJe1-N?
zjCrg6LqSfrs^CBeG5wE5cf3o@htCnfwLb*(gSEGpt{CVA;6(}UEEM%ZUchieKS4)7
zNAIvAxNSKzis358Kga5PKO9lGiivaEImch;!T-X5BHLlIdGY`%y6JU%w5Kl781_+(
zgmx?F%cC^Oql^3^SqGCC@MAZ?Z#aLh6&lS$zj}=M4g926tXmPs72q+bNoJyD1zBy^
z@qpZJBvJ*z7FHcnjmvR6OyV@AH`KHy&)-iF)BJ?7{GXZKq5pv_*r+{-$R)o9dRzfi;A1IE^|2A0T_#q42V
zp+4858+2JBAlrOrmRYg@kRw#Ln$!i29+b;5Hcb0V0o$2A4kX7CmE9;#3GM%lQxn)Q
zOvjLOY-y~+$c9#{&mI(xjieg={mR^1BjMqfveQeB-c^Q1i{s{)=~_2)bF0S!8rtj
z7di7bLt;Arga4X;HpDHJBe1kf%>m5th98a0gq^6IpgHG(#J=xR
zTe}kUf&+7*=2|B>YW~l5J5ywtM{R$ZZaESdXw`vnJe(@;s7-vI4YIj@b7#VHJrucZ
zak0fk=JwL7pL+D{YrpdPk34+#m4{E?fAr)*<|((6I6?6IY^TDUM>A=3xMxr@-)ICb
zw(a`K<7ZEw-hBDiqx(;O@t=P6H~yw?`9pvB4{+P=KfHh1F2ebXG8gG)YXI4~S!TzZ
z;#z1qLx_w$ZQBXHL80dmhh9&}NY1kuwZ&XF`OVdnf9VV)BT)jSN|JKPtliiqkdwO{xJI_xBmYGnWkbJML}s`u8~`tr5)
z=|Q`&Z5Q(;4iM2@#kIw$>iVts-~1iFke{_FTk7ORS|RZ;4pdH5~VX
z{?)5;+qT>UunCs#UR{;jrelB+uaX{%Jpyfwa7N_PP$*d57VA41fm-`2ZSysh
z?w(T!9_&VN{-4y8fllGw!9+RpYD@sA>$P9+*Yr0$*F-JLL6Mp5eJs6pPwY&0S4Opc
zT(yYM(36g*mU(L4VwHvm1<9YLpm>N53Vw!%8;-JKa%s!U
zcy+J;KVyFuYipWZ2VyHCzP-<#Z%#F{RIK747Aa92ilQJ6;#6!>5~-GGvW=Di8L-_p
zV8ecB8x1rJ1Ag&K0}c40;TOBnfYEk0V74r)TWV?^D3an#ku|aADQn8in|bGR_8$>`
zSS$X0XutS^L*~tU&)Mhyzb}ThR;;MXObQcPK)K4H%1m1SWo|Y;ZEkeGWEN?`v9k-8
zca$--CKQOh&5g5~$qpY~sR>K)ELKuvOIa){rR1mR4m0;KSPcA(9cFAOAMhlf!Sqfh
z0Bi$$Nixt4x908@mA75c+%LlyHxPJmO#$3!UrFqNIE%sHXtt0Cv$fX2O^%Tkq`Rh2Gk*6O7gsq(J7H8?HEabu;1RLF
zeRKg$i>Vw@hqOKA}f$MrZq6COm4XXUR56M)K07pdscQy&P%ZB#ZVbmS*o=&H~*Y!=?h
z33(xEJ-9Tj2cXDVnY!{_=&=M7c2BYEvUZQ<9*j}0n9hXBR&t`{o|W4a;nAein{sEd
z@lEv5XpmtuS%KD;Rb5LuyYefI9WrH^x=IuOG%mIAaFPa|;-t;6o%q?4UIYqWjpmL<
zlLiNMX0Qd+9)-ZHafQLCLa
z%!cC;SLm)xJ-yy|1;(f%XVh7j)`LG&LY#a_#Npx)V=dID%eM)|>Q5fp7;~Jla+(_Wl
zYKAS*lno#WM)4gTN%*sj5}=82Im{`Tl3>2
zeD+r!U48M*r>{SK`t*1>#G+TQOa^r)p=)9yY~5fwISX!%)TMSqxIcgLs$mgr0-JJExe4@G#|eQDIMxLjMj0VG
zvK_7T#f1kuY^+qlG7bFkX4Z#Ij#~FN-?|At?{11QO){FQ5&VTjwzFc>1-+cYi<1Le_PEG~~Eg_9V7iUv|
zftqArK&3%fA#gYz0DJK0%?Fnc-g@@6Pkj1cKX~w&doRB0;&|KO%MR{`nWb506lZ|L
zoml2{X=Cn;xoHP2Gpf3B_BI^u!#*t64WL@qwE~ib8me9FQBj&9)?y`1H1!(!03t8G
zu8qPtdmXr$W*|pZ!O}#ii%=Qp4(^0r3pIp+eLK3DK_!&LpmIuO``mRI;h`?4v1m6Z
zRkXhgZ5p0u#mtfxbm1`I9AYRe_JmFAfPzaYGe@rWj;ecFoK863h`wr=(HvZHDTNEF
z-6dF)o8pn42r8>kKoPx$5z+*QDw_J>snX|K^QU7lRU$ldOSaz}Z5UI^sLCpL*szM4%*DM`pNnpH`=(;9V%AybwXSt+oQ=Y$lZ
znY9PAxEVYmYYI3AB?Lxk}Jk0ozg$6AMVG`A9&434mLIXotRMc$40xM(G9B|%4Ge_9A#!}19nRz3eT^F98_;vm
zT@H5+e)sTXUfk@8jurY4Xfp@A8aB@17BNvtIv_LB7^s3r^h7x}KcpCp582T(SZhG#
zHogO{JnK`E>95%&i0YYnX6Rlkx_iqLC%T*<7kfv;n7*Ea86@VCxYOJsT+^NUrJWJ1
z!Ju)?-E5*w@+c)@GdILqiwY5&@w4tW?`^B9A=GffvJQn>{2OcuDj
zr$@yoq^oz@USFD;Rn{1#4jGdyb`DBnG9oeCmfL(TG~ZMVL%MsX_x`U98!nU=Wuz9&
zJL3x3XUc)u%7*nCi*ErP*y~T@4PqD1y^7{=4>tH3+u21WKGPNom|{rzlaLl>awKzE
z`jZ0>m`Vu)%x1U%Q;F^n$q*w9_6iI0yv#=A0lM0I_&Tf`%WoWS+`fPR-LJjzxsQML
zUq0Qw_VDtx=U2}T$BS6OR)Z)XQd)kgu;33>R$+(|q0FtRg&&DM}~A#n~45K<#hWV`w2(6!9~b
z5m6{!l>r45{n@s=43^Hv^*X2%w%nGuPcr~(xygt^-45fEVqTX4M~iQ~_0=t}{zrfN
z=f3kpANae!{EgSX;xD~)@4>^TPoG{km43}zqFy(|YPM-Nxat86jIBqAUTcNh!$%Jv
zJbUmYU;FeIf9>n9ee~9ymu}p;3%KLpzB~@rK4k%x`yzb-cXMek5n-Z%s<6z%ql)|1
zU^6pp1_GE_e0>B<_-r?xKNpC~%&447kS22jVA}VaJX$;GLgrzzgJ2BR9JEiIfm5?C
zf$!p<_t&J&=h>hl^Uc1kS+L@ejfVqy3ZtqenuBxD#}1G
z?OKPm0wO}?2+AQ5J{2^7lhaHFDhG)mlejC2F_oknRx@KlcvwWK#!;(L))27Wom*xm
zwLCJws;#>$d>J2m4f!CtldWt66wjH^bP9WG$5ah{2&eKxcD!OX1dC>i>gvL_xXrK)*!RD*xOU_q#)8%fHt1F
zS@3o6F}FFVeMF$S8{q9^_OiBXa5vxmP_wA&c2?-(VBN+oKqMqAlcJ2;!{oq??h5(?
z6|*gNYWNDu7NFj90GQy($Egd>Ri6NVTbY6n2LLibNmO;GdM&GL
z{TZM&iDbsrxNYF_M*hpxtvmz1|9+U6TwaMv^ge+m88GwFa37M;_B2JEwa>(I=!?0c
zdi=>niSeZM&OMsIUf2X@etr)6lFOn*Vq-+%7}9*UQY#3OW~v^08Xs1c&G|G#R}x0+
zah;Kpq6E&H__ykF^&&cozwc%iPC-XY4JeXO&qRD?%_NsQ0+VH^cViaWi=^CArJUIM
zX#I7d2o>^wnSC9g3XBvZMRZ-YWhLvzNeX;Lo8SqNqLniV&$6W|onsdW%+J#Mdo*Y4
zj}YHJ)Ti-;vrL@d6#WIrT32|39-n%PEjLcx1KQKu-63kDA(x}x(X=7QV1_PSU7cDk
z^_+|0o52*CDo6IQ<*IHC_^BDE_!Q=V>PeP$t>bBCnx-Dv9g^Bo+vof#D4@?Uq1Oms
zE7n>EwnfuI^I!C?s}nBFK-t=qA2865X{_#=jDqJl3&zz}4G^ub?yb7Gc-FN9UJCQB
z&g|Ayd8aa{&WC#4s-k!fRBCXLj|airL&uMmFgGpNRQW9BrAVUe+(0Ug3aBPBUOnT-
ze8ob|T2*k&ir^UcBgKWvuAT!jN7}I8(C%UkCR;pBMnl_oZQIgks9L0%wIU2>hO?$v
zW;ECbshHqFX_ESR)>6I85N5o)s=4^Y`h4u5x{FCIvxsE(fWN|}1n>}niNiXE-w3;T
zxVU}i{@Y*u>c>9y#b154ef`1X*Dp_}P^`MJOPGk5O2@aChp4sjS^n%Xuggu6>vMXWeXcIfHwYrp=`
z$W!aVbb)Rl=q*Q(AsHVu3{1U=!z|pwJ@$^GW^q`LOcFr&ftNQ^C=jy;Klg}xS*t1R
z_*(lzuk$W+aqNsL4wDEdd3am9{HokNb2HNTI=B;Vbo>v_&j5Iw^H7vn4T!fCQ+#0}UsWbxE^Jg4=*d
z4RoiIhvH{|VtDtU>}Z6qwVqr)eC^3s{_2N+`rrMfzxcbq^YEj8aP{)Nd(WR=J$?Gj
z%6yq=7(<~#IU)%lfatKfISB75uUKFm4iWL>@#D9izWHo>>vLcJw_o|{M{eJ~ck9**
zR_owL_XBy0urLdv9`0_GO0oF1>arEy&{FrMLBg%(`0mgjgSlMg
zO{AS!Rk=rZhezec2hQlNx^WE0z>MN>Gp}G};DM~}-onjnU!u#uO>|!f3wjn+sr=VS
zk{N*V-~vXUkq2Oey1FXX9=2tL2Ju_4p7q>k+qTW8-qrU|N5nB9edED8817T?r_()#
z%JsAS76y4^WB=>bdo4oFlcK@U_fa{qrzrH9KcJmPQa*1}U_!G8Gi}waDKzUUQUunG
z+{)$AN_n!LSJ1w@i|PZGzVoD8$nk(qiXMoDocHH=vb>#Bl}51wfSs}bgtdY5~U6L?cy>)V_S!5K9=p1L-Uq(?ntw`
z-Nt2F^;2;}Xh|@KtTr?5NMIb}Q%VjUjc4+nydY5A%?yDp%RSbL903>hW}U#Auu|fB
zKCm$);6~4f_2FLy{Aj!*d)+Rk945PAc@_sZO1#w&ksv{V6_If
z7?O=tN?Y-VPos#7v=}T}m6jD}t0_pPiH3y^1&?qnrP_!^zLXPZ;g;P7Z)`RG*fbrr
zAxYqKe&Fp!k{jsuY?>Ot8&#(3!Y0AGJ;Dr~0Lc&A*2m}iWLe?jjxrc5W}#klD6*Vl)iO&tZw8f#S(X&k5i+`D!DF#+pw&z
zTmvQ_hp^*TVr78<4iomQ;R&yzzoT~-S@p`T4Ma-VKo%N(U0I-Fnx%<*XgLLsP_xg{
zY)vd$FqZLs#e8N551PxYrOg}g08JcCcoJo{f>4#Y*jZ+6ZpNKBRwg`M?Pcx87N;kj*RMbZG7FwnKT+q%-tD!6Li`wU&1
zu&Lo#znr<{jB(SYzL2EhC(W`?LG?DkcQ5d(kA&xh1-+1%E
z!$16;FMijb{f@u%<3I7={k^~Yr>2xoy7PRyTko!oYHRMNCm^$(3n_
zZfN8KyQa*U?@Fbkx$NOAxI7S3_p>52A~LVxuX^vd*Oc9*re0Ea+$zpsfxR6%g8
z1^Z3x27zzV=L&shoko}9Lqz83)dyerw)cMEKlq>gmA9VYpZ&_CyBD_sJb3GAr3M2=
ziGd!Ll~FL<(30m&22;P<=varf*7Il2-g@%Zb3FR;H$L)(FZ|Yx8#iy>ddV%8AIw)!
za{|&79v_E1eAsT|}Af>PJPmiFw2~3(w4H&X2mb-_h{aF4gM2itNqc8&d_X4c<0L3ca
zVy%G76@gJ-9`{tGiXD|kyv=R7rkUix;N8~bB#q_~Bc(H=<_6j~4l`?J5^1P>1Y@TE
zXA%aN2C>!FX!f(YkL1ur2TPAw%*Io5W36S-W+R80#n9B*WgZ9Tbf_2z^(Bn-LanOJ
zL3V+J5Ca*f$r&-S3TTRkiXwWd8wjkax@EPlwVf;29=BY0$mEx>3Q@4(M9_P<0LFak
z;s8#I2|V3rg?3VokU3*6F*#aluS4)Ki_+gqEmO#tuQR<*Rg*wNtQE%e8k(Ce0L}qx
z5@YTY&Zkl4;p*i)K1~hppE)E$lUJ*MJ%^4ZG
z=nhIl9ZThQW2Ijz!yBOOk|J<226pn5iU@*rDm`>n&kbTkEs)}7g&nb6;r@CG5z$rC
zyJAR??yhhWdJe0~6Q6+ZueICUx>5~;7%E}}{LekS0(yQ@mLi->(j%=jqd@~d9h{T5
z>@G+?(uZOSs;d)mmV}2+^Qw3#(EHE359Jgg
zDs`LgE24S#_Tf56D6qnV7n8|rU=a45{4Lg(wG&w)H2D=tBywXGcgC`7RMP6^Qd#;?
z6-I>t&^e}YZT_jMtWllZdjz_y&*-1&Z}8+MwR>2q-~!2&26M~7MUu#
zwD@>9QMP32$lX`?G3E^7k;Q7>aHU
zi6+3RQexCLw=f%*lTq5RJ!|n%-3
zQ*Lf;p5`@tRl8}hkQE8PfxCv+_Ax?uACBv=*45SJqi2tv_2XCH_|&I9{~PPrH}Ah<
zadbO+Eb04459}~HtC$)05qnsn3GJIhu}8xrZE+rM!Qf1Dw}^A->r;5I3YNKiM)?~P
zo;cG8C+}Casr~C>2-kkI^Qa`%S=%X3FtR0*;JXFWXM=x>WjG<7UR>27bc%Jdt5WxY
zFzMv!I(Hi5fj)UexVD^<{ZlJWz8YwAAz8vBt<98j6zsLnrOt@FsRV$}AFVArd&UTX
z+Irja)W~)U%o0{+%}Ea7*`}$Eh~UBVIQT5X;IUWU<%gkd0yN&X&qtZjg}!J*bvj*D
zr%N5cXXf)VjV+DInnL4({CMHkpxmElqa_nCM40?R4P5EY->1uyuvj_D@ltoN)Bjj#IOgY$f^yzR2Y@PbOy~!!ix|#q`zBOLtU^r
zRjFbvE!6UW@)wWlF59k+;B?(?!FF;
z8*C`d*D)@_y^Ph;jA!x(;cSF+9#Mk$ADbG0AH{6;OV9CO7mbNstU5SKklRLd+s{_Os&lG4J6+bpCCb@E3PA^;g)Q>C
zEqBvo`dH?OG@If6o~=@XSYTXdV*7}-=3|ChS8BsqJJcf`(n1gG*47L5P+hxMQ|}cb
z4_a&aNbtWJ>)NCR!;Ck>xc3@zpeVWPxmcB|N{q>w;8+){VrDcz^$4d%EEyHd+z5Tg
zOupHmZTy&3b=pp)vpPrHY`+oU%XP>sTHn_o_a*Q}N9=2Ur%^@k&w_OqBxurSX7Ry@
zyemBU=(-^zQ7e@wFrdZIOjPLxX`7Z8YTG{OZ3b>k^Tl`qalGoNxhsR&Z14@-4ATADw`8K5JUh0G~Aq{Fu}HKblachSR^^+2O{kr4)D2f*QQ3U)iyCJe-8iYmK{
zKBSu2@6FsJtEOWEKUO#GHZf%!-zyp8)~ro`!Kgf`l{@JFE6y6vk`S<`9w6m5sY>N-7r^6+qRSj#{Ci7$1;hd=z2?|9pL
zA3S*zKyc<$;sVyTF3T65*dcPK?ee{}Gh@Ydp55iGgt@t`nM?-S-Pbz6ENg4FLgGec
zwV;X}?H*z^VIDsIDV&}KU|n@OU2U}qmg<4OmEefaR-tTG9_g?v7^%14cN1Lmxp010
z9!-;?ciIp=8{SiEW1WuyG691p!4v>J)^M#fP*qt8VB4;Qgjum%u4-_DqSDNcB~jcs
z5cT*0P+HZ?P$9SIncYcJ$(AsD7{R|M`c(BD^yQ?C6t(DvM_|c>1+v7JL
zed&{*`Bn7goqO+e#KG5!gCQJY)dV2;C0P8s(}RRHf`s@4H|HquHwiHi?ci7-s)_-;
zlE7y&A+hsJ@)k{9PFKa^GGwwAjexEZf2$F8Yehh?ucNL*w~VRBYumJFZR?h3M{
zvckmA6Q<<>q-A1DugC=814=b!fe6#dPU$1UnIz26MCEx!XiwZBR%D24LmMA^-xoiGiUy
zi`Y4;h6r~BIH0w{t4mhY6^CegrH*WP2%P3rkttC&W|x)N0HLtR5?IYF-(7<;+uTFs
zMssB@xpsFS^FE;4&%sIP98pM))6;vBuRFy6QW8*Yw5y4n1)F@LMr~$?ODfjxUdbHD
z2A|t$`02vdGGn{Wf|9?_D@qoJFpG%g
z3-E@=TJ8bPJS>U*j9;pE{SGs(0lrq4g~psTV{J^3-845?687(1mJlm0zK3X8hsSD_
zJPmXhr)^oNS+#i>uUfUNPq{ZMOdS2%(Zf~hQ|Tu
z-Z%?~az_q1F5Bm3slg?X)4b962pwxdZjcoIPy*8vRi;l-pTX;2QAg7n#yQjG2E(|pR;L;{we_fO&PaoJ-iX5J
zub$&9ZO}9@)jd1m27N#sUG8XLQl4}MV)$%jtM)lLofL(7C`Kz8=pP!KJl!*;+(by5
z^wc(GdIRWY_a$$Jz5Kzz3Y5I)3pPzh0oc$t47=8C5sNBB@m`NHQ8TMn0jb
zl80AhGDm&*rkE^T>Pv)-vP?}{YrE2Z-8A{1I;&6`uAK&N@xE+avDYw?HfXe2asZ6V
z%OehJ>BnjDv{M+iD)I?URQa%E-llXn!e_X4B}BZl&F`zz6;U@~Q)b(F*Moa3^&qX)
z1=9`?D&oX%Nh36&wkZYGJ>i-IgA4^C?6Cae?!9-JUw-Tp|NU!ke&T9-^ytZ3c3823
zVZ+X`8t8~PD3X^=tM0u^3?#AX<#GA!+11tM;dt@<*|Sf6?2GUErf>eyzx3nQ>&er{
z%N8FKrFE`H!|T9Nz@Bz#a5rLv()Yn8nhohr_W^Gc2}eJ^q5r@}ey?3Isg&8Db80mT
zx|$W*nV8~{v)=-F_>HL^BJ1bIo!L_I1S{17D4;6%^0v;}Bzm912#q!7jiZWVK;1FU
z;gC5RJ(+Avsw{hvpr4usrg?NeG(NrpY^$s;_32b)h+l4gU^Oq@@-&)$)wpKLQJE2;
zcwy|*x|yi79uoqNAdcAuXc5b3wch-FOg}ui9hybSZi{gjS`oP$+7OqRue`s%FzOHc
zRHu-=Bt4M#Z^*(5-7wRhT4p0OENXe=c6$BE*S_Vw-}blu*1z-Qx&8XTd~|2sLfGSH
z&v|`hX9d!I2I_e@H{IySh_Fq50eC_TF@ANo?
zAKZ@~M_S{01V=J_YG0mslG4Jb8pfxGp3!OmaEtwoQ^7*Q%|PsgrK$iGA(68gt|}qJ
zFuHE?R;c9CJF@QNYITn5R74PuQ4s-iQY~iP<;&G4kCCIns>(v-0*`2B1xE3|qo>_4
zx)-(?mz428p?kOs{V8^M<%cB$CJrAC#3gP)1mLxA%)>E72XPraPL59jrr|VjCVeK~
z=$J23h=rCM+6HjLG$gHt4r&T%D%%#u5mOz|h8}ox|DYptVjiG$PDm1glE%!0qceAU
z(^JJv*H%rht6(J8U0ZP&&V0aSkx!^Lw6BpT2wN=9fFe^e;aC0^Zdx74lF3DCw
z;=-%wk!I*N_ts_zCaJRN$ApGLXM6vGYHz9{f}o}(>{+`3cyTJDw|1-AVjWe)E5aCT
zFh*94j0v=H0?e1@P)sJ%7$yr~#X>0sW99;yvQoZy=h#(oiqeX10A}4q(x%%e5YQQJ
zUTs1%>MPKQwZeUhf!2*SPT!!cQHXH3v%(|N!4}9ZLb8ZfZPx8-ntS=eWQ0;@z}BF-
z0?uuQj`)yVNDyPkSX`qesxWu2&L(?J+x<+quL$PlZ8Yi0%mb
z#&HEfqp{Cxv1A$JeRD@v#xfL9gMwQ32FQL?)mEK`koIBrRhkMsZ@GdI&;yV66u_uz
zP2yotB<7dQ7L4Fs)-+=4VV`t$dg2>xgnNb>ZExpQWS?n4B07{#7%*8_YitdTSwUnG
z&SrzWWp3%3#3?FDSY~u%1XC6vPZZPhY3L^%%mO@wJI!eB@=DZB1I?+j!7@~9C9NCl
zb*F;etUHOe@X?hj7Pn4*+wN93TA*b^p{uZBP3=$&s(RT&fAQySSE~~q%v_bVVoe9#
zd@`=s<&1Ti=@#ShNzPja;26}Qo55UB*xUruyK&;0|A{>q
zlC@XF{3=Y@stIAF0_J}8{xJk3bfXD?S)Z2Pyh|nVtv$?pA+)6&IoaLpK$i0d!Zb$69N%W(g1z2>!6S}DK
zjJKw$sIb_wWMrUXOQkYdqBanC!nuH)TmTa*S-}bQV``%>NI3!5Mp;?UfPfimE0&wY
zep!>Z-a99rL7g3G%N7{wu42BbwQ-Z70(P?J#rh3Ot|>~jf_(u
zy64KrEusH(-r(~Zs-LiQ3Z;`P340tKD0I0sPdtsCuoGG6rfgyWKt^Tg=do_ii}b8l
z@9ym?uc(l&E=~+*rVUo+Vh%YqEsTh`g}X(BTL=;2y{4RlDbfRQj{}PxkA-q@_Sgbt
zuRnS17&m|Mum6?zefyvK)qnAg%O~sJ3pXCT`Q+;PCb30LZC!f7E?^guw_qF}cA2f&
zIxKg4`t^w*!x~eNVU6vc9*dr%Q$s4i~
zqio^V*AQnX47rt)mMGzxtv#RfXNm>AEDbZu+)&$=r>dEsB!+F^-cxla1YnuQQdY!z
zeBfx1nFvE(`>aZjaI+>nCH@&^rd_7K%NCscps|+*3^U4wZgR>1kXc)DIEzewQE|}x
z*@ZaqyHK9X@Zad2OsK)(k{B4DIx)I(x6I0}Ho1nfZ%|JGTg)Mhp&D0UZrCZss7!NN
zCc-+mlXy!l@nd)2X5+I5wA{XY0Q8N+^Uw;UnCWeA*LpY!7Ln(8HbzyVego|
zyFnJNkMV@~4M>B>FfHAnQ+%Fv+S^n0pn9BLJ55vKjxZ&TcvqnZwDBb)j1f#m_fnSz
zWOt#ma_G>2L0QC1ZYVrSKJEL6XUK*6=nWZzSmU{`rAW1c%dV(Yw(u2f{=;J(j)!$&
zar8LeINrKA-gLi+b+Ois@FQ@5-w3+_Tyz~XqiW^0PFrLhst%cvTT~xW7r;g40exY1
z1AU|W!u`ftHzRHW7lw<&;UeN_epu`1elSG%3O_hSzino|Vjb3z66{6!Bb*B8Zlfq~
z@Fp7mv)y7t70Xw_%Z-Q$7@t{53uUsF4ZgMLN|Up4#Ec10Ns5{8V+*8io0&&3M%Gbk
zoTfWy!9U$L=8Z5=O~<4*%m7V{NfU`IHHm2_^_3#GwJn|vahYzg%xvwi!)zhuE#(}z
zsfBDtR(4_}*>+5$06MxilMTFkOeGliDPUpO#{!7zlTi#zqNFHEss`d{;YM;EnVGuj
za5s*Qn{yvvgM)Xp{NW867Jvw*|!^!
zT*5nq;H;Y>*6jUdqN~|*uxSY@HH^|3*jnD&Tn*Oz$#_pgn_I+wK!xB}fndRY={
zT$mxAuCf*fyk}atn+Zh(5(d|7QQSIx6i!RuV$#g8bE`~7v&>YB<@1oC_lTL5WpktS
z-8dhZLeJt&2=CNma*s+TIIk@BsQhTIoj2_JF@K)&GH)fYQL#`r2*5l`-A$9%`8;&3?JzyI!sk3aYE
zPyf?L&%XBL$%8FVH*Ve#fj3}3A0p?a2+?wZh;YrC7&TESueN7T9$QxSn4
z@S*c~S4j*}4j0HMuCv85boTV0utuYA=-0y-O59Y}NegblSEpbK|~r%*X3)
zZVRcR@JBEf;2|;8XgYGM@g8E0xZ6ek@G
zG>nyQBm~SE+M2^{%mL>7ZCkTX?3$ws$PEw?(I>QEcm&6G;ZH6fJ~}=9sUP~uzx?n1
z;O9R3@H3w{y>#!z=cmgj&!1B;X8|PZOXgb&k>pIl>7G$C7S~<3A!0?u<@2j&m(QPU
zPrm&1Klt)je)GniJICXlWoyMzC8_x+#i@YMHZOjuCL;
z#cZ8z3w?1Wd$Z>7C82SCEQ%Z5<^^Np4^J5j(H8R{!ovPLBB&EonzX&Z0vg;CBgRnW
zPFBHvF%H`9dt&sUWoKp+Z(AttC^9^#QB>y{9$nb-3WhLf{uWeNLC<=a0Rnu4kj-s*
zY`H}&)?bO*SLSA0m03hMy0d}t
zYBmYkI6=2Bg@!vz9&q*#%^gxS8S)74?nO+>%wsVZxk+?f8ajx|CL)r_(hbG^h>U-A
z;uu9{W^dBS%?;I!ESp3(O*5N9rW0a?2;hC8xOGhPY`eM?Tin4(hzL(TXPfh`!iH?0?#P-6ynkjLC)|IQJwS-P_~=WM0_a%T)BkIq5s
zoY`|sfz4{Cx~e(5D`W6iFe%UpislpcV*
zgKW|ronaK#;VwjD=G8$Fc+gL)yA`#_Nh?Y?0OVvhzPKR{c>9Wfk=M%fRVPY>3F#H0
z)~a>)f59HMaVEaZuEF%645hkv9%Rr5QBvY00RX4mRs?1Lq-m>&T$Ik2>A$qR?pDeA
zP0P$(+sFW*dW#79Dvz$aWR|fL`%Q~hRHcs@UMpfkJg^%ZSEpb=aOL5&ZR_IJy%*l|
z_1FIRQ#W4t;J5tv;p*b<%@+;XNIE6{!_A
z+eWrr#Xl1GcVETUDuyu&F
zVmsxNXOEs;J^I>%kALd(|7_i`TX$cy_VBgV5$%lZD>ZJG-Mf1b$1u3!vI@n>#OJB7Y8o)ebn4tjLZ)wDHXN`1wEo56=nVHQ
z(>w+UZ7!ISBBIOyexj_76_uNTwJmEwR(?+E_Ha0|LeDHpboqhYJuA8FE3+d60=dRI
z_YHgQ=38cCi?wAxHF8RpkF<;-}Y=y0P@uYkot6AuFw9BBBNwi1Yg!oEE}9
z^(Ht#HnnV3VHkfwsiOvLuIHv%YjyG`;f#~?iirXuO!K{&1$tU_D`lF{cVqWnxmg6t
zq!44Wbz%W+9*l$2p$@jEGqoQC-aKohT3TwKxwV*T9!GB5v@y-sT4MonP0GQZvd7fY
zVRkkEWT^*{V?rphiB7Co2CLrK-I2fJ)=7YRAO7@Zu`n`(LN`jPR$UhZiy##-1Dc8g
zo6Q-pSkaaHx-)9J6oH}))&%ERl*hEMdx^v8`U2P-h0!X|me%}O`0^ko#j4VP?8+0m
zklm;4v}NT+6b5d#!Vd?#apA`sapM>l7wg82b#Xkb<%gpkF5=>NxVShT4xzm+hAwQU
zx;o|M)hSQ8Wo=p8mZz&aUDf5~)wAcP=TA=0p6BINT~*hqc86XA%st#H#dVXX>f!?g6Q+4?8_^FiAW#roRgLh)(Jw&{
zT`Md_QyHBcIp@6MP}P(&nrVE174{6a6uB~XNUDp~1X^azsvyfukEq(%0CRS_DY|p*
zLCq{*ZcP8~HX1ErYN|W!Jff0Y(z~jG%#BKZcTzWMENLf7L4nHvgZuM@Hj)!&?QI<6
zEksytT!Ny+-FzzDK%t$ztT9o7sa~=gwlpN=_|O|A2Pyumv6bNu2w)$pPAj^h;yY*(fg_iMSlxcJQuAyXh9G?mTBF-+$!YkVY;g(yqYX?te
zN|xBQsV!ry?&iAAOzC*Dir&%?I&(Yul-b55HfBel`-bp6c79=p+e&GY}x#2k8
zy?Muu>+<;t?0v#pMWfD|h3Oi)o=SIv>yfNTTt0dF=x}j79*%E(O66iuGBJN}{;!;MZB)1x5-(`&PsQVd{ijoM5@c|s;^
zYG_8SwZhF9wQO`KHMmBmoQPX+2Rq?xsDPOx$v4)C9pnrC8*y@`A5A4Cnu4icJV@ji$OQ3ryrCZ`QvMdhsh
zYj))Tz9zRgIjrnpJnaXCtFuMuZV2Csfxafvbl_7^d;0wJ?DfZA_{3-aY2otz{cm<#
zhq!Rf0mg8@^Mmi0-24EOA8h>18q?6bD?N(_sg}6C=T8YXHijp-RkqfBplJ`NwhHqd
zbs}{tI+=cAFV1W}lUbk(zC$F_5_8S^RF*RsWqlsc;5#*Fs!xPrW*XO0a`azRuXnXt
zDsLyhPNAhJ4{z(Oibydqp2?UYA_Tk*zT(KGDI5air=81UG!Axmv9fO5ph9ASGGh;i
z#CO!1mAUp(MmUQwpB$|^J0KgmFCQU>epKv0S4C*lT*%vy?Zy&YzzEEo)n`@HQ-hjn{fF9e?_7nByC;+Z}Lx?_UM9K%@@>6%`Dzz$n6v9KMrWgN7mR9}g=DCdK8GS3P9qPsH51@F
z@5+xr0Su$rB+#~q8ve5qRTYb-I0zkhPGO0_(N(so;Gl9^eFy;9Iv%Y#r%J(5!8GWo
zn9d7o*4?q9iaFMaNAV*M	u{Ffbgopd^0vp80jvuG>VFsy2>;aX`PyLWbbfTk$gM
z*{gBbb&RFZG%45wV2J_fuB4uOpDJX&YZ&V?g1*&_K4n!F7YKCInzgM(-BnK}=t1{r
zq-lncgrSFkqcxpbpPwh60(FVrjQ?kw)IA>#DIu_in;V#Au;o4;$=oIc#LRl8Y6xwH
zS}Y8pKrZ+E2(TZIk&N;9X%x+Q($NKv*tU!aP`2C^wpeyjro>0l*sNDX6pxvhpSHs&F1;MH9}bkvPruk{FxPN)}bj
z%+`=mGXW%kojyGYV?W^541W*4GdI2V1_KxlWdGsV
zl_fOwF(s?<=?-c(LT*UI0u_U3iu=2_t2!Kms$-Cnr5q{SM1e(i-n@N(+pa$S+26c*
z@ydGJ&BIzZ*3H8ar>m3e!K!8gpwdj_JAcjNb#x;Q?!Il?lgE$l-+SqJ%rAca>+gB*
zi$DD{Kl+6)e(sIeUVYpBSKO;=+q){W>$sr|I(cObu(6xjDL*DDSrtwq&?akjeK40e
zOtH<3@Fn)YZvec9yCA<_X!B^~Ic!ZmS(6R<%`l1&=GexzccDcjw{lm=&UAwYlG&*7
zwy+b{RfN164Gx^ydlvX=!Mfdi5h5IjuDgp3!?mK=wylnb#mP8#Z
zwu(K7IJTf98At`Y-(X*IvK;
z!{2^#|Mq=b{qXT+FlSGk>n>}fo?YS&>j~dH_U&MOP={FI{`kq`Csz+2UVimcU-(y#
zo_+Pjm){$Ha4fS!_=4tP6|!bMIsx!mMxf!Ly$+E)K!2xN!j;NB5bC1{HRszCX~yfz
zDFI19ck3hCm+jr^&VhGFxD1U9UFjaBY%5*olwVv&#vTR|Q4hE%v}5waK-KPMv*Q7R
zt=pPfbXlZ8#a-{YX9uSDt%lNQi1C1E&?#pr+rung!X~n}iCslRII23kyuG&ca3MW~
z8RXJNQL`|&$|OgYxv?pw`jyqfdE8j2lLEJZ#I9<11P4M(UXgp#Wt!5YH;}uBWp266
zd{MU1?xAb2D})cq$ww!_I9LtjU``6pAjIe7Kp4O@hXwgD@by)0a37RsFM~N=+j_?&
zvaYRtGiRV+*Vy_fh&jE587tt!>X92&7CCU9HwFzBdnu#;Oa;*PFtl%5Mo1wXGwNon
zGA0{VH5?({Sb(TUh`-gU3>FqJP;uHu^Q~~FAw{V|_fYz6bS#%j-7OeVrSoNBh3bqI
ztrEB`i~vv^7MUV$(dq8(3a7GdJ8j!l_vVMbeZ$}V_Pg(R+Y4`h$Gw-|e)}EoeCfUK
zdEwpPbo-T8aQEh3QR{U=fU&@RWN#-lw}a0}-nj~&|KG#-kpX3Y#SnMrhTXmC?|H{9
z_uGHsF986y#G7y88((|&rB~nj;;Ro{{o;eKe(BNIUw`=eTMr*Rc>MGk8gW?b5V4k9
zyZdrvhlxWAbRlbl1(_1o@a7B+4LU0r=_`a8sQrO22O3+ST4cYBlr*r8l<3!9ZOYOL~!6%9f=x2s&?r~+o0VQDr+4M+qUJFYprdoM)OFF
zITRfrR5cMY=Z)ia3yp(q*W^vZkmTmB#k_>IQYss=`ht%ui~D%A5pmFAcQaqPWp$!D
zVhU#cIC?1ztb11u^*>fwoUQ5F`Wm*T2!ovg*l{nL41`_4JG>Q#8+&U?%d4a@P#6(R
zMZrZ|tkqSONx6;6#O!joTW3##P>`b@x+;yTu1t5F6608#67R5f;4bIJFrDCV4|@g<
zsEK}8f^N1nX4Xy05!~q&0$Dh_1v3P1w-g`TPN`OT)D!H?YOjS%zG7aSR5YNVaYtsZ4
z02uUfu4;l=l{G?z
z8YG0k$Ie5-Y(LDZL#UMP-nX^))R}Ao8-Paih+C=f+Y428R0v;
zFj-AwUPf6#$*~;Rwrx_m(q8Z6gg%hz%JjJt$Jkt>yNlvf(G}7nPFSXr1;t_--9#0F
z&!N!nfoemQVLK&VjYF9Ctvj#0^~P5}^SNKYb@77X5VtQ5$79x(Ckk4p
za3M}s1D$m1tMSDardUImKY#S(aJ+Hn_U%WH9)0R#U;e(o@NGZ&;UE96|I7dS(euam
zZr{GV%FZ?stwv)PWu1cCYVOgdz
zb|^sDkvXvOT&W}52U%?=vDgy>H0lR3uX+-EYkh>Cj!8HJS>AZGexF<`Ly$PmaLa6S
zxH6gn$jY#pglD9vTy73HRWs=397T_ygcy@%vBmf1&_nBhDl@DKsP6~
zsx~g^YbwhDG(5m2oAX9h-ms7wlZmlb92oq&lNrp6RkwAcjqsJwEHNpZ5YQ|H?7XF*
z%HX0=07D@wE6gJf=ek;vK>*DTwXoDM^G1b-!{2=T;H7(S|E2%IPru{6FZ{|s_*$M0
zcV4{t+Jh&JT+6x}-a)*g99FK{wA|$VXMnjD5q6h3)(VSwcKQ6t)x#&-gU`JBTd%(M
zv3oDP!;eQZb34p#Bq4J18m3$9ZlHSGw@d0ItAh)okyJ4H{0YL_w)5}w@nZ-R2P*KG
z6_Qv>@*iS~rk_!8fO<;fv@*~Y5gei6ws~z3BGf$}mDV`!3-%|76y`_XI=FMI32}wnqjtU4ov6D+_E
zk(ivNtXU=6${~$RmCIBRGwKahTT7GQ6AB2dWOY|80ch@Cxk+?N97OXBtWAjoVLNTK
zJ)H=}-x!r@Iisxhy%E?}MY-9V4>T?fTY
zHk94vzRX;p&;aZjT4}RxO;GO(%S0}vwwe7Q?eC^|(eEoA@didIFPrml*8()9$_}QawL-)xK4)=8k
zhxaPbP)PEzV~0GKf+ib(kfLvTr*@^_Hc&n^L`%eBxDNi!o|vm3ub^jVl^MA5
zsj@txtIf}1UxLXhRouGZp+P|&0dl_Qz&;p#cLf#WkR!S{PM=d_<{m8^nO{axg8y04
zRz-d3R*cfbp+|O0b{Gd|eD4W4AYiR?Br
zhs!XW`A$h>Dh(AFyS0@RO}b_0x}V9HFJG_(8U~-4Uh;GR*M7i5{iR8N!5U%02v}p`hB&
zD$BXH1LBLo?iYPc-vDUzaXuAaRf%h15Fe(w%Si+~$7vw>bXa&5V&U%nw>^09nNNN3
z*Kd6L3&+#p?z(@xadCx9{;YCrQ7Os*V%3me=oFV~$5}5fd;0j{@gnZtx%v9n9)105
zum9+e|KP_z_KDy5?O(fl>*hKfGdFOxp@58F?ZjQqRKC!I2LMXKF=QDiLgW(KQUl>L
zXGGDVW}09IY6(1o4_kT|8bO2E!}ex$RI{4@2HMAaRj>(U;hjmiQvl&q5quy8>=%T8
zX>X1N*iC$B_n285nmO3D*%P`s2-|YK*RXfp`S(~bXP%hmT|x=Ea=VmQ5mmXziG4<5
z%uO{5WWZWc)zVux!hPQ~1&OEkA70rE}GMXLXh$wV20d97kj%_>Kj{IIEc5PtLYlw
z029Lw;gP^G=p*ig7=UftVg&^@z?ezwJ!ivAU89t)ndZTo291{Mz5LoG1#cVZ+DAcc
zgO>FC8UCQn5_u{bR8dw`Lcvk|eFB>TN_!_l*kg#q<7?^J(y`Z11KhJ5PdScq9@W7a
zjOvsZk@6r{2^Sos+>KN0pi5M%L1uncv7zpq^bC`Y@d|U8T>Em*
z&YfU&jYflu81>&8^bFzcp1WKH7$-&hnjL~_452&hYSEe>YaUt=i1T!rq5~>xVDJcQ
z&)W1;L7kGyZT`Ftu1;O+U~GT+Ffp0y$
zcxTQrDrco#%7V^pj9yHmiHryAG+L#d+o)s>dgGW@L;rt{j!+MF6e|5&)wzHGmg$-Y
zQGsG+onXm3Q93*j0pCqZfX8p)k3ad=CqDkh=RW)J6Q6qZ3txKe8{c?*RfYEB#X200
z$Ag)*n$t>U2#(g*cy|wHD5Rew*EI4SR)p8e&h9u8I?gCbq1(DMQ+|Fl4K>)A2GEbs
zYJM$4W81V4+jJe2Gv_d4ZbK`lx@B%HoqTCs+}`=KtC{gf*TkJ-ePuEd?yP|A#2Sw@
zVPcp99Oj!+9R}F}Wp2bMJJrf-j?HMcfh^6GsxmBYVjt)C>AuFDp?jCy7`pb+rs?R$
z_Q?kW&@<|}Kzv-)S~mnUb9P)am`CNIS2z8Wn6}&6unD2;glFgK{IW4so!(dr(tLNwSCNp=#>APTM4MSq
zBPnW~TC;)k=mxKe8=h*@vR|XHMD0^|Z`+B1VB1cK6S|&0e&flLC*SccKlN?z`=L8G
z-gW=>ow~Yu{_Hs~PIn6(Wda*+nbA9(U6LwcN?Eh&;`Z$qUwmo1y1I4u-cS714}9{E
zKJ%acC;ykL)1!C3^p59OPq(WyNn)9Um>>kP6?)$>Yf1xrD{?unZVO`jR8gZU4~K)v
zB~Cx7@uV_5&y;0bWA}d^=trdvQYXSGdL8M3Ta%S0+=sSV2Q$%0LWDw*lVg#lSTtbJ
zUeB5e;&f-)qSCL%D^cq}_@yyp*zUGm3~BObTM>^{wCb?SK83{-Uk^x4-q+
zwsp93@!Es82;oS+!b8Xw2u8OGDfa+(@9$)3Nuf6fkl=9yGgpFN0Fe4w^6TdI%~Kuh3iXv0?N
zX51c0A<$m+^D9yz&#i9gsY}#z0ic7hDN|-eET)-EuA5*EB)kdd?p6U4*hB%r*d-LP@>yj~#+rc*nPJ<|vGBf#w8ScblCN8NRErp(!&6sxds4Ol1O$+sW%q@8Xfk@tvNeaVz)j`0swI2
z5^5Mo;P3FRq7o}G(FO1T$u|$mgNHsCSk%>1bvHe%0PUpZ(2G|gM2TWXPo&4&m(~+)
zsqv8D2t=6qsN*6Qx3#-jdjoPYwS68{if$gw9k3z{PxjIkloj07DEcsNOu2fSGwH{m
zY%}aI5+=erno6(;o=?NrKAVLf=rY4cVx}U`&CD0eIiX*{;uYau){KoRaA6S+Cy1$P
ztIBh$=g+p&<<-^Y$-QshJbvH1uoW6uA|r
z!NNS2*)d!)9+PSjlsv%~(?c8f$O;%t;3nMQD^$Tu9JHCkVK?O=czdu#bD=)!=XK!p
z`r6$xo5FR7RHCg{SM~OEW6dAoH*VSYedzA@eds;_;Lm;K%cqZj{PjQh!>|3(M_>KS
zr(gTV*PlG^jukg=T&%+(4u@c@?&_+n8tZa%0F^*$zh`c?1~SW0v^eXj$OM>~!H5A#
zZ137;=|IBTSFpxyIJ#D>u99yWi!f;`yoSVMu(5O67XA_LHC{0)%4Lr2@EUZ$ts7L@
zi(sV9{s8`L*xb<_Yh0-rZ%qN59!2~CW$558F0zKg99Wypo~nw_XeHkw*J-RcSVU%4
zm3c=8t5sNASf_5^R7ZsKT8$1?oB#a5ujUFD=U7MK?
zVGGU!lZ%UpBTCJ3FEwK^wvk`O^@(
z!!Bqx!*cl-RQFcp=3FAWORVSXxuSuwMrKSXIp|2VID}uT0B(+sXGd6Dhb%3f7Z<{I
z!Fbi0%kx1xi0;%@=LF|^r?y|W+|oR_9U2l)Pc_8e4lVl+Gc)AY5wWX6gv6S-WiF@8
zEEg8Q5h|OQV2mE_mRSlrqr2uM8pK2$lTah_?kFFe*XjG$os|(Gx@rz=Lo77AWZufG
zRJ9MtrSDqJuvQRpUdM$*=IQ3``&pNt{`{}syZ!dVJMUiR#f{@(Ri3W4y`{U>o3)uR
z19#W#mz4HxXmdYAoSr^?dN|&_ckk)b=b!%gYv1z&-})0D{?Whl%YWzD<+F?9ZO8NN
zbY(^(`h9ju;}2>^Agi`Q%W)CjRsg(p-;6pAYqMYv8NQ$v+Pf=Yb2`r*EM!;LBM@(P
z-DYmc-i%~w%*jfZc+?0^2h_{G2RH-F$ae)ZuW{^seGySE-ayZpv$
zPeQeNVeg}~_=A-P42TtGz;4yJbz85)GLJ`ZJ$!Qc)@zTy{Cl7L2XDOf$@?$8*J2&w
z;<#=uUj{`Sc2{CQnYj%{D@*uV2Zl%=pxWJpos@ixU4I$Mm&*+y*cjz(gv{Nny3XT9
z4G*vGN@W=Qr>~L+E7%826{0VJhv_D&Ils7|OzRM?k{GzcN{3mw+#mN`my7ikt@|L$6?
zti=f9A0~e$i7A9%Mxm6qGeUQMum^Nn^Pjr
zNbg;~U1e^k%hT0XdF#gUz3+YD+rRZ4-~HY1`i>92{4L*haqFNPlUdu=+V`%!uezVd
zNmYyO118W^`S30~woR<2!SYp=taL8EZ_~IQ
zH0YC}+>ObwHueAm-A!*ceU7>x^XUo_-3CI6WCl9ICyeQ^>|hgr!V)?>A5smGo7*W9
z*HSq!w1X1;F0xgLO4TSWN#|3`wVsolRN(t?gKn0c_!CJ}CHu%Vc3whS#5Mq7FfxJe
zp7apsSsy`D>64;4ew>8i*!UIG(zqLH>wrn%O@WU6%DIVP7rK!Xee*aQy=PSqMfqy1DiY
zs35x9f(gwG?p2#Zx;fL+F2zZkB#5aSTYJ11%(9X+4BtHyaRJ@rMF{_clS-@&y2>Lk
z2OH{Jdm0by=#H7d4_A38NY~w~wVSkP63eaM5cPR#ja^b5hE69t4Xy@3_{8;6<>DlGISD@
z5KF68Yu*x5hI3U%aX3p73a0DQJdLisb)`}7-LoL43FEMPY2j#YxzRf3%=8hNFwOFU
z9WS(4aiEoXw#2o;DcmVVT^fXjMi^TRrPh>C8(b;TXm4BQc4|9q+tr(Ie)+{)@B4Ef
z{2Q;l@ctKWzZmY%o<6Nj2t2_dew(R>t$JLz#k`4>L_$@jhUo2#B*K7XbXsH-JfOj@G@*yN7c2Dtl{S5>vvG8)jzGqCO2ildfX
zSy{TemdBqEFi$w`few4bN9s6DlkJ6!;k~MgPm+gc%T0B_NB|mxd`W0|;&;0?X~Z*9
zY*wcjsB=HdS)i$LLI|97_l*Pyc@hOFlx#Av*>
z42A$WX(NJna&pj$i3Nq)VZbd4NJ3j;Jd6}~9OCH5%WeD0>#zURPyEpT_J993o?OO1
z`MYoW>Biy4di85>)@3@ml)VsRq^xRdPOiZa!A?Y_UuLd|!{PAc(bG4dy!q(rjgNlr
zUw!(E|N7nwuN-gP4jjTSj)&v&MVrR~eauAZh_aqU7^bz8HavsvsooUaf$`?0ML`^*
z8dUI3nSpbaXKnDRTq{Unu=At{oWA4$JeIW>1BU6)_D)S}^c)Gcl$t={pP%M+GAn(3
zChQtAaafDxX1BRSuJS;y+~nT`L(@)Ru5M*po0h%L9%>~LVjwzJHjpM;cg|+aRh-%c
zWXk*VHKpp+XZ$dt+*O`Rm^&#A%Y#43_tUWw@_nt=jX^seWWK%ph)@WIO_+P7fF
z-7UCBbyn&F8rL`j;f&Ay*Ox03;ol)h^jyI(OSztH<#mRuH+!ts1>;Cjp;ujTlYBC5vjnG>oTFg&KO6%54q!c9&CC1yg0*R3A)X#}1nL+vdAb<_KPmLL*j0@R>Mw
zv20hk+Vb-GRb}5gu6Mup&bNQ?ZGY~&-~Bz`{m%EjZ!I3(>}~7Qi4M=4Dx6iuO$D!a
zQ;}{Qvm7pHpj-63eCS9`qs1Zs*J{@Nm@=;JZx%aOhQU6u|MvMv&TsEuSuqONeoZzN
zOg_1a;CQcP2Fq+NLdz`~;Exxv7G*W~{1><1``xen?(cv8qaS(o)mI-rd9tm;y0}=!
zHtxlPm?5e#gZz~L@k{vNiDrhJ}MT3j9P*qY0x`j!<;Q6#*spk89tTy
znCdUwb32)Sp9dD0bM$qddHuoETQD*@~pZ#EzlPBwi8MLQ^~#^G?N
zZBum)m$OxpifIFT&0BTh+VnZE8V7;t
zv=zkYpneAIr7JP|k4(hd8wkpAs=5l5r>n-*<>k}2-uU|a-u)N9^V@&&Y3r=&@F}SG
zb{3doyQU=N@y@-O1xKJE>xX^(vVr8bwiy)SIA>3yX%usr8TVq;WQ}u;%f4{SG$Zfk
znPtZ5(VSkoB7%clCJ4QzAB7w2U3Y(pRbmV{;o&U6t9q?a^c^2Cch7C$WSD??^z!J5
zQ{gl<8S@!6PJKOWnS7YS%-JOLOwXRx0t3`x`t%+)Y^0~YpF$O#JApHOc(-gem_C)C
z0EhM$Nn@iA?-6c>%t}qnyR~cZENuC5UtfOXYj1n$?f>zA{I|aEN8bMrf93Tre+u_+
z-+BFw#}6MrI~qm*taGY&F#>NRht%gKay+Q2eA)4MaryM>^#`v%-X4GH^*{W>kN>wg
z+MO5Q;cbVwx#HkBthLm2wQDAEt`OsK3Q=|nGOOC!nEz}R*tpR>vfQ0kBkb-tRU0K3dSwSUx1HVT!zMzD6Azf0&1nEPvylhJD;CaT>>CQK|&>?nUk>r!0pm3
ze>8o8b3W^{KBTHN;|g|}-JIGV6lMo12UU=nC#Gv<#5ca9+{x(TmT=6ZSr0^AEeyHO
zrAex}?J4+r?o3M!+=64f0gL4fSTTqLCd~7a7m}#<-hS{Ws^0UuYZ{7})2xeua1%#y
zZF*OhJa2>JH`1u{kM$W6wmtoKS5|q1+|+EED}!-`k|{M+Z4?nS$8Urs>%lTUIMrA5
z7&Mqc>kw=R0LY7WMR4Qdc!8>IBUDG&e61zwd+cz;+4Aa{#R?ZA0W(`G3}z9A)s4%`
z%jcJ;uD<`m@moId!Vmnw`+xBJzvU?CEV(r&BUc
z--v6s4|^NA7iv>isqvVTtbbq?NT{vOP>T%r#9i2#qtFQ
z9c#DTs!2$ql9@F%m!*%=wI#?=u$fG2$##-oR
zCCZ+Mr%V$fY*v+$utPn4c)x!HFJVZRi4S*Jf=_)K(JR-Qw{@Kgu_(CuhXVRNS{@IfyMMfgA$x!;8jZZ
z&X>+OZp(d`{jBNUKn)=&dbSEW&RyYAl;`S#wtffWcFCYhzb;{LbJ++w1o!BwIf#hL
zIv3?af#+iDrEpclyh*|^JSUZ!oVT+D+g@5ggI!%S&P`rdCMsQp_F1B6=MqlOzsCoN
z51PfE(Uo*Wjf!+F^R5wq@FX&cYkG@XeNFI5lWZ7Q1$DVV%Mi#iRn^cPpz8eHsG2c!
zw*Z$tMhUjl6&fkD^jqRQnOn}+vwI9~+9%zDsd2a?jswggmsg@9II$_Su52#(gI*%g
zTW&K*wZRY;s%j$o%!_JL*JlABXAYj$wgsqF>ULqgTD^ZG4WftN{Av||z6}w(m@f#l^s&Z#I*&}I`l(C!T
zpL1uPsImbO)U=I56aywQlc8_xtH$>9tp`t^Tz&U<{_MAW(+|9G>+Lr$ZeBgRy1G0~
z)Z~!{#x6lusQ1mex{zfS5!Ss`-hcUR_wU`gy6O-8@Vj1l<@SI2pZwo`h3TcMF%u|mOvJ{K-IjmbG2!#|dehv~CZR?F`w4=pwQN}rCXkwDW$#XU-}*AQ7F
z)FK3_6MW!%vw#OpD~lY?cv8m=YD;&r}yr?-z}CO-GfAoxuWx4BpPQa0eUH!E_=g$
zA9Ej!Lr`31HNf6C(cOr(%&oZXR;ra&?FztAN&JsS;+*0GOc*>Sez*mqdUu2dSt$cG
zoT?1Gjga)b8YzeNG{c&UeI{Xs$gBv<$`uFJ6n|1EqC&c7L`i2I#OKfrBEng1vM7*u
zAN}7o_Q327buNN7t!!r!=KB`dJI`q({KN5vOp#_=nzb7efVFEtaF<$*Fb{K7_aB3?
zhunCpnOB1r#7=FrUJU&+kih%mR%Ko4mj-fVnP6NN5AVu$MLpgVUQ9n6-015|Wx$j+
zbk%b66^rPkq%x}7i`ayO+O<8=30x`2ki|_plr3V09}(a=bp3k)yts3z`HtV
zcQmAg>e89(qZ_xP#8lFXC0ewp>rS!Xip9H0LIe`S^gcopD@KfNJ>;ah0X|m-aR@%Z
zq1bS8o2m55DgQKlI)YedrzU`%`OCs+W2BT+iR!
zju$bJmbJK1RWlICoEwD&CDXlk?Z!E3>``=L^rYdbpTuQNCgW5U20Gv2d634tHbJdF
z(`s?$WHzV)%ZK@cHuY4i6&$2;j=+@T^G^*!A6AfOJRA*eRh=77mnRP#!oUCf?|tY)
z-}C(RJ)ijavtRwS&;I&v{PCwh`LzdcK0Vwx91q9C@vz{HPCr$p!7Yb2>*?67ZJnPF
z`6=clJ_RZhEF5L#5@GUcxuY81wzPRwKaQ494Ei!4ce#6Jhev0^^oHi~?twvFgfSEo
zhTBPoNF(^d;F4UVAa}f_p)wb#FcAHsDXNPGB
z_FFShLz~krALiv2z5-HxS+as+c{v}Ot8OS_PknN8DY{$5AOMYX_Oy`a+b43#$Hk!)
z$sB;3Y^LQ#+lZTmckH*;EVHUNGnj=5xuH*3pKG&$X)w>9`&GeG%Qda$b4+&?G-%4*
zyS4sw%e06adWPqp!+`F4hd(i$w2qBG&PWsN$Fz;00&3S$|ICiIo9&-jS2)zxjV)BiNch%XnxjJUCH=x4ntL0jTus!1IWlw=Oh?@FqNrR
zBKC@vGq1D=CMNB_Hj|E0Ix`6qw>!IKAZapT5ouRprFI(aeU7DNyU=;nzt
z`RFpNnB*jl!;M3Dy!qyn$B&;pxO(*?pZQ0h|H^OPd-1&&x9)n|F>ZK-BRHu{YF4#8
zd=#w=xJD^K+la~r8n<2PtK4bbEFH?|=LE~zgqQP#iS!dbHxe}rbT8eBicMi;o?YOp
z?B=WmRQc`|5*MFVa3jd5oEfu5pl)!nc2qou)}{Q8M>;ifIb~XT}(DvgSGgOnYtOOUF@z-WbxHXOiA*!RqvhWvT7%LII&|
zH)fT!4y&pvn=YP`DAQjq%fh*CQWTJ0WizQTC{fSOW$0{l1)6Bbv9l&)L}p#V)>_2`
zV9x1No65>~oP31=R7SZQ+_+DS0h%03#4=cxoi4ZMTUwvq_VTUo`rvzh=!d`c2mbuq
z-t!IssLazzTNT}DEIdrVDvwFPL#GUotX~YCQ#q(Q83+b@fvH
z!%@KHM?ZG?PyhL6|M|c8=%+sQwbPcz!{O$w8_|`Wi2^LQ6NN(1C2de+rbX+iK}3Ft
zN}3%sO;EC$Eu733yQ&T=1PF1Af6Ee^)MmDA8(-h3RKS#4ot0+;i0*Rz>>i6-;=0jY
ztdu~}+qtC`^+tQ>IiKPgyNXdriZIYutBXtNtjYSXSk#ppJVj_2Yp14^91KC}
z9-YE#8AW|XW@-hIhqZj9&b^EgNlka-Ci@1O+o#d|EVJBR@kKINmPn;;SXzL
zJUAaj0fuC0cayH<*WF7+=3x2xbHi}A0V|@^vp1>B#62v;cEDpqCsfQUL5W(8d5dQL7HhDvtZ=e(S%ao>BdN@Sa@E`Cf81#d1y<|NQ*gk
z=j@%Un^TASxNQE;^4jUAcN{^fkIZdr18-%Ihp_r#6Q{*~f!8fH2}aKpWss_BRMmDm
zT@|iQS5F^5c>V1!f9H39*I#+*&Ij(^xNqC#v!_p4X!Y*4)x;{VsXt~F5Gx8B(({yg
z=l%=#U$}qu^z^6y?AyQVd*Ak7{^$Sfmw);H`R=#9a`)!Vr_Y~MWp!qrbUb7S(?y+R
zE6@XK#T7Mq4Bc8Hnxq<;!$H}b0nS~=W|HuLXxyG?gdsHnwMybRhjjop&10N{K8tIH
zL|tYRwOZL5VN@CxOn+r)RHr*ZF1W|8OmW&!Ypy|AOo?gg)k({{abPaUV^h211mjJ=
z%9ujHOqbJ5=IqT9mwlAdVfgCN5E0jKH|@n>l5lf(${Kk#F#~3U8R+uYOaR&5h+Hdv
zU`_puGMWZjJUaMQ`3NHD2Gk^I9
z-}df%zxx{xA3ngH8^=e_uAV>3L$K2?nR&4>Fs*fL<@N$0+zG?65T4JUUp~Kla)l>f
z{`yD0@YO%Kb?2qyt=k5yxG+}JMp%Rm1g;^QW>bx*gOfdGn**wfTnHvurZc{m+!2(=
z3h3GST*G^}xoOd#I#snOdo79mL(J|h3vaa7o=OzQsCD6U=a00zt=PO5{!CIRgmZ*F
z!nqD!Gdx`Z-(&7zx+Q?1h}ZLY^5E#h&kxe9k-}pH)J&3`M-n72H6ZkG?EIU%RynJ)
z&&ECKPz+XE8W0igRw%t1t_7CiF~#}=1WI=x4$lnkfiA6PvCxMZj|m8So1V3W0CiI;
z=q3d|)wKn&6a37|?{0%>sm@`AqdIQOjah#NLu{?+eQaTm3>rS!-*UH%%cml9mCi)&
zeQH5>qZYA&T^7;v#X(_Pmb~xKu@+1AbzG#)8Lzh7!k6os!=UYg3dbb*S^Mew$Q=|e
z^_nE~=!h^T3FtGCwTQKp%{6yRYL`DTMIymbLTZi8s6!EJZ3d61wC7j-{MprZx_bHk
zogez)_y710zyJF_^vc^`0nnLwbp>knjDzkzm4VaAaR;5w;S4j|Zw8L;PfXCCm~Pgl
z>l~nDhG#IXJ8KbwP%{^%Ol540YW^7Z?=pFCw9wb8eeI8tFN-EKG3ia#*89tz@72BU
zrauRJl|a+^?pYQchAFzJ_dFaU+idIZzI?X9%^lzIrw`xx!SDE={RiLi`~T*xfBY{#
z^{@ZUAAj)+Z&cN~I9?o=EzXG-CwR8pJ!WX^1z!W)HmbI128@cx6hA?*$?6O+F7VCzMbnFwG^Cl&4h5THw&vXP)|@};=xhf`n3imZ%~S!q1KbETzzo!%2!$wOvNPB`
z@0R#FotF6kb`hWg5S`dFY+;n4`|)ME-`QPPr0VLC_?SM11y>FtJmg1gR#j`!3nwE2
z@t6>6|JQC
zdCpw~>(BkY*u2opq@kC@pD1%{xd~!OWte-Wt}3pL5cAYih`0_`$tg*`Q-DX5{^zqJ
zt)&DKtt~d47G{E2q=PqcRJAWmnK0Ben(S+ncg;0R28*#Zp5Vsjq;#q&XzI|x0l^bJ
zA!q?*&yPk6^|qOV*8V@%>)bSEduwMC6nW#CWEkDZ&9E3_Va~i~12(oVuWD~}=aj?p
zwQn5;r@9Ff{dlpZ6E>dwXt4=qT$)}xFt}gOb}c-I8Jc|8{GG~nf=B8Fi8>*>moGk2
zYS0KN)GQ1$LsdmA*D74;f!)2VDeQ9CmT5kcXLp+$lv~+sjo!WMbtGm(K~F(2XBbi=
zuw6vAwW}oasa(8KO?LprB?E=xGX3cR{nIpTMV_mO&VH!^7ct^XBn$pLzJ6Z+`J7
zKKy;Z^Sd8;^~)c>b^NBa*6EZzhQ{7VDX$v<_sXzt@4*6MMpyxEN2CdW+5|MRbK
zjB(YTHY}-Iku-&k04MH9vtBf
zUo9|z5xGad7pZeBe|cgmF57g<@TLnIIt$(WTciodc*v)xx*BUO%sfeTyLrR`m`Oi<
zXzxxG86=zF>nXH5W~#8MGg3O!;hDo{eq6`OdiAxh|L~9g(Es{>^9zrj_^&FQlB|Vb2fw>i#F3;RTjn}Ln+3359w-&
zGmEtvkKK+JvaRW{Yg0`rlq^&i&o6gRPIN#m!w@bi@>-HJe#}Ar_t{+{LQK4s9;>yD
zO^?B`-|hXIPFX^HX9f|;exPV|SlhO_J2xvR4@&mTzou$Hb-x)*gd6icSkg74f1%Gy
z9r!4!xhC7^wNYLx&}8SB-2NBTU3ce}*S5%F
zzN2=W&D|J*6R?M+=6I4`?%sR!2v;DYwr6^?(K1yst_<9PXL(K>BD!(PjY2^)%N+B-
zy$7EtW@CWCBro9400XrlrJU3QAMWj$4gj4h<}~w0o154rj|eJ+C=fR{>&$Lpx~wL4
z42!=_cDH>k!eMJgQ_#oubsgNpv9=A*ueRsUE|15q
zxiN!ObKA8HS_M4Fn8(I?krfY>ncY1uwe!Rn4_)wUfbs{jJw359
zO>NeE=02MP!`$8B=&VADEihqEf&zQ$U}bGg;MMzf^D^s9Lbf#r!`(cB9zrt5QR!$V
zqhJ;<6)_wQ<4`NI@!*9;Rb?lmfSF}glYy+Za5F=-L6a@YSne~J%r7i`nYnD(#)_-S
zztJOHG6%D+a<-JFZ6dYL%1S(JTu^hTSqb7?3%^yr$9D@haEM{!Npwiwtyi
z&M<|I)<8FGT-g|lNMvzOtQzVXV*;Jo84cxB?Yx|pEKn6E4}>IJ12;3F)cLkg%$j&x
znKhn}T6w5?v|%Fy7dku5gu~zn4-N8Oqdu?_8c-9VMfhXEr_H5Gh
zwQ4r@RP^J~urW`pxo45k^W?s94AM)j$mixAe3
zWw0du0E{w&uUPwId)CU6poo@h3glC`1LD)S8msR3EUi?A+C_m^j(`yEaHNJzpGXn(4OL^609q6X-Bvb~5Fiv~K$i
zZEJ~TCc+eG~4vZ?5|!SXF4dMLh7JP
z4q+&InF#W<4quFezCT2?`c-A4Y1N!=@~n8HvWcz4VX-+0t{zV+ZT*%_Z%sGRxWrr*H#u5r+a+JAF1yk_ranR6y9Go46yS|uNoUZ!W)5~qkcfI$O
zANi5@|Llj~_ub!h4C~6iyi8?oLmXUFsd83RAG*Je^AS*T-{WzM*9ue_-9}K@X!9x
zm%jQJ|JgtN{6G5VANl>?{leqNPjBA5ar4#%klt0cWmPyWnri2y(vTife#KS(osPbXQ4f{MvVZyr=
z*Xbqzr>LyD(doi@Ct`Usn{BWU0Y3Pa-Yjq}THR3O=0$8((X6O+e
zn45EojCRoOjxbXj&HSF*#!(c8+x_6Fg=K4RBlU_iZ)p44*k<*@$4jEwNJc2Dab|~&
zA|!XDQ9GGcqi?4YSyyWpA~9uQ2));TK356j)ZlJTzY|J|1qIGa%PQ^Xa^X_|JiGy|
z$bs@G3kM#9>dnooT$2of4JFyDQQtuf`TPXNTLgfc^IV>{-O1X~nv-P=64&*BHsJ|IG3$L_+g#iS+fScj`Tpk16d!snoDC0f_H7YJ(`Ydl@ciPR$VXAzt
z26W5Z%-pm<&h#DK=&m~TbI*(%A6}h1Vsk?FGKgw4@hG13nGpg9ZuKx6+AMvIl>)S=
zrRYg3=Bm#=|9WrJ6ZV{eFsK;bt*6}O{DT1-+`Sqr4(BI>6yD0y%h{jkXioYb@`Uof
zdH3aqZ@l{H&;Hu|Tkko%_$?Q)d>w7Ol&^y#o3QM#pdUvFbKpZWN*mC&!mlo$J$-V#
zd-v`)zWU@#UwrhTANaGs`5Pbkqd)wO+c$2Shg)|xolhEWR(m2;0tP0NfX%BGvg>u3
zln7|0=ynF7(HL`jt4$sy=D|2~9*i2ytp+4Cm8rg3d95{HH;!NIKiy*Qs7;F(nxBpi
zTP*gss)%4qZ8rQ5Cqz7&iegqU1B08(f^LpM+dJ?5qTA9Q5HoYD>J^c)JheGl-Q6pe
zTb#D-Y=mTBxx*u>NMwrdu_9~Ray!H_L;)*S*GA8Y%7l4%5bzAsigPzwTqq*(I5t4o
zm>5fH6vrYKT@i-)VZsOqnyBnD_`wft+%g(foc|`xyX?$G^h9DY=|H%-g&o$#<>~oX
z-}w4p`}v>ypZ+iZ+NVGB=nsD5+3n-)tJC)2%_pvPFDVzh)}3RWH>I0RO+bbnYuVv&
zxVpT0>+!>9`Q(#d{Ix&&rFQ8Y*7_t%5a2Z!9y9r{L50wA`002ouK~$Y(>^5i|-=%k&5p
zTn!jB$;=YMeIv!>d%fEuS&$+FfP>+J^?_T{zq^Rd1l>Cf4V$HKkYfRb>#%S(y?om~
zKPTjh$;|7)WNhYsbc2P5A%M8Nx_tKZ^5)H(-~Bz`^wU4_tv~kTue@{@Kwn)}Zt2c0
zgBQx&&27YN*NBEWkoXh7c-vLqQM0ExIrOw+OAeZ`~v{ux6$nm~CGe+BWJ_8-ib}X*(eRbAJHy6(9%|ws*JZ
z>j2?qfAS%L<_Im%8vqWgO$Ks@3z~`8@BH4AU;cX^`RD)Squ+S_(T(G}efO538=2e2
z5hDX~<9-wl0jjK||Ay1Ave=Mx(6E|)LKen^DRVOxvH)WoKQ}iqPW_DT%8gqM%SMqg
zlL)FPrnTqi+1G4}ej%9P)9p0I>_k;oXKB~jj+m312Au#~t2cnoO3XZ;
zg|kf4+jho-RL7!eI!K3Q?JBqNuOpzLUPkqjei8;GZPZhEVYy!#mZm@#{I0CwcFd9o
zhF{%1vw)l})cm#II7M<2M6LQ-lQU~Aqpj$8(eo>x3#n@NsBYc@86dI7o*X@wf^3<0
z8Qg){7if-7o{d<+wo*>}mFh88u;o{I$`iPiRKyN0fjqZm48?@2#;TAjc(&YJGjFKc
zcKl*WTM6}TUWS+?cULhpkp*g9IBdtioM?lsSfvsCwzKy%+Z{!9?1aBsv)+F+K~zKF
zv)&kas_()p_hky~lXhX@0h%fF*i6t(sCUkg;-+YTq@1uq>K6;<7GaruCNv{7IJRvQ
zR@TOyB7&*FCs{d&zua1dVYtjD&Xl#yC)U+DYu}9eEZdt;-(>+%uc$*vxA5MZM(1TB
zzEhRw5dgCW^G;CNQQ3_IjI%!w^JL@V$h9CTv!&5+`H(;!vgvmB{b+T!M;JOQyQBx%
z5lFsenoTq<(#It(aPFq#BJ%9e_%|~xN`oK5;r4N3~Pv5)w_GO+|m#3?%ZfLAyvK3>a
zmX}HbKuk>)FH?Z8_2Nsfc*pJg_kQRn{?zaP=12d}|JncjxSqXu@BZc0Wmk4@nI}l|
zB25It2f?_Bm~Axs+y#d7=-5fJ$6>8vX4OrJU(<`5lF8Z3Lg3>N$Ewq|W$Tg`MXM2G-x|bgk2=-nW*b-DgGcUb#X5v}%z#*Z>IN3VyOFNEqJ?X1!DsnX_6W
z%{3vZ-8g>Zjb7_uZK)w?!N!BQs9W+WF1w5S5)Hn5tvGC({6fR&NY5Zr-NintiYo^g
z5WJ`C;ihKF9^9?Af*a4`3iWJS6ac{5BdXegL6|r?m=O!+XmIk3lQgFGT}`i)oC0{z
z#P=e?{q;w0y!+jM>L-8d`z}xQ$&Wtsif%l+e9oeTL}DPawyXk|qxw7;Vt0E#00U{I
z!sBO8Pkr_EH$V63Fa4Gu?Dn0P+}84gTQDSqhXYoyaHS90Ez@`?w63$OGJFw~?IsW7ytELt+vn@+&P^oQ31^ST
zX)fPe#AaF3!WbygjOEmEqbt^`8Y4LsT(bGqhOX*xYxuTpJ>nn+p{6lLZex3$ASKU;TGL^`sCT=)#;t@e&HAX#&`exU;fr_`<4atw$-zz4D@|C#&8U>
zE8L?Eraof|Vu8-eruT+SMa2Fm8PCT|?gLMSZ9-_IJ1>FEG3`5WvXeRwk`&}mv
z7#i5NjS*it6fA<5`LLFX*POQ`nyu?ccuvj5fH*1#nLzjdrZ2-yjJ;2Mp$LdlOWDbC
z2h^(YzrftLQ9Y=I;3G%RA7I48xoFe5wdR&PDM7@RKusTu2QzqCVb_a}2M_O~ZllSa
zNzK2;dPeQRhS{_eiMPKpDcNVc>%LQB&<)%bOdRW_=U=!a!LFam+|b57t89e2tE{&?
zu^(W(BCOC=K5mOf^#>(>C;WC49Ik=S>nv|6K
zbG6geW#f?Sp+QhK8nu~#GYsaBJ5&3P=
zyezcF;6t-BLN`E>j{E`L)Fg}JW%6RR8j+b@Wy`tDSoB)=mRnCQ-qA13d){ayel4e5L8hm3Lc*fV*L>cX2yCaki
z%njXP-ry2&_V(#hM`~=3!A=F9@y&%aKt^tHt*PNvj#$KUPQ!)4%I&~;=FDCz#7*`d
znrdIq#t+RRT;5s?Hy(W8B?nebB1Eimd0mB%nq%)gB_8SCQ9IWwfcDH?b5CTB!8M$Y
zRDWA-*_{FaxOQu%*_3p+wKLnp*=NAb7Y90AoVxz}z~SKQ_O*^#Th(^s=H1ij>I+}_
z{d;%6>F~}QH;?yY9evBpZ9>gJWITlmb(r_Xuv_Llvyquk9zVYS!V8a|Jo)UW-uRC1
z{I2i)fe-!0ul|#}w`#?qfGvwoMK#@U_qCs0$7xDUu;eT3y={Y=PTgnvg93Q#6^k0Q
z9vnfX6mNuiw-8trbNn+vn`M>crVOtpGR&qJE94a3LRZ{^1wV^aE~HeaP({bWwrM@w
zyg7wIsIE%P*ztRkB7rr4<9{wa(evM)mMK1WB>iDU;oGpFTeYEyy+gt
zbt61r;iPg*5RtHQsxKrY5JqTCbw13rbBW|&SGA+ERvhN&``+MIW1O^RCb;S3f|)^u
zhbuj>srB&_)>Go!=6JZdoU*0YDk=e*)-pawSy6rKPNaz0vCQ2qvbU~29uC`9gcNl5
zW^ZuQWS`%(8^&W>-B@c?mC70vn|3wTp|{H(jK|NyB}!~s*mby<&?kZ7#D;8Uw4|3K
zhYWyXlvXRa1ETJgS+yx4s!QU&R=o!;H_8@m?H*+Qn*a1R?fDWgrp#F$L#iHJd58U0uk*_-p@8
zyEzxXn&*g7np?!hAGIxDCz`5MdcKml`7_fD;#pSgibr(;B8y
zV6p6;Rlb(#c{`(rM=%D{sim*|CAdc%P`+)a$4{PBUwzxRzVz3A{(JwOpL+k>Up91|
zPMuq-LNl0I7}#UC)C#CK0S3zBx_K{+-Sz@<;
zI^_zdCT(Cfnas9_k%5$72y3o}`c|JGix?NUZI?N!}|+=_C_+IlTtM|bzv-^73S
z_doy3f9Kaf@yB0wx4U=lhFf)JCb}zS$3o6+n1Px~^cu0#y>Hbsfe7faL)^BF8adVw
zFb~5iPtZ97lPu*J=c@M_{-Q&ob0Dz?#Z!bI#{md!JkPX-O@$x~1+`-*iDOwYsHNi#>#01zSfyD_NP=Nf3eH>G
z#j@@WC2MMrI38?5YsD_Q&j>Mph5gy+0#s?h2tS$`dGN9T6*9ZF8___dP{8S?1orjR
za0KfchOnTKCZKh=46-pFhLRirG!(%kDVL!u>q35oiHWVfN6G}oLQ@|-*5Z(%4KJiF
zMO7oJlB}1RWoE1yrRn0dQEMt#jFlN3XuLbk^Sep6vEEDET+bS%f&
zV=`c@B8i9Yh(*K%?On;w3^RiaimDRU?#tS;_Cys{9m=YH94|LBEu|mcco^#L~9I&d~
zolGjZC~h{kIr_)9qKJt>9zu?4$}n_wTd!C=`Z^Ut7Wkao@bk)3Bf}=DR%YH+1AJPO
z6+0OHt_UCDxJ@gbNA1*w>fOL;MK@@3trv@ibl5{xcZe-O?Bxl*7=6>!FN-f8?q
z=IN?ViHE5pG$SyziQ2d*g)f~2D$zME#UyPHj_@f-Rv=J+6gF$
zGDve_v6kMzGNQRKr+wit{KcMtEVe6*Y*Wa
zy%X**ODeJ{MkU%-&dP(+r~uJ+j{RJu2~MW8`(o@In#|z!EF~H#-k9AfUZb?DySXF1
ziO}2`jz^;pMVWh8aJHe#2vJXCA0KKtu`PzGvz{6CnLP{z&6#M
znY->eKSB-n-4vX})CWCMNVa
zGe`NQNJBeK6pcxiKoyGObj`+miY~-`g*dO@G
zkNuwC{jtCEcV7CNfBPT&SAYLk&byv@|1--^=3NXk+yqb#w0bJ;+aMOqFhs#{HuV>7
z*gMy0xjX4u6l1S^9H#Y0MC8smt=b%0bwX?&M{HN;Z}TDllCEl?#OPm_*DG=$2xJx1)Pk7e`W!AO*MBLN(lkFV9ZGG&MfMf?36m
z&l*qm*<_)E#x1>8;5f)Ac3|DjkgRSU4Z(7494w}k(T!uhQ^gV=DK^6we^?dmIz+_i
zxxT`H>U~@aj>kf3NU9RbsYI=+$`vP0yx7G)&`E3%WZ`WZ4W~F7Qi`O1&3*4A!wAgW
zrZNTZ?g)0wyDOIOJj1xr#l~i78EU)SN`p#MQIxk3nd*RKE&k{
zC2fJV##;_#$Ye{qLc>;m*}9~dJFuE=TF_gi%anh-B&;A8BK2e3X{TAQ_ML?*3^ryh
z^-61!=y1>|)qB=fWg2J_7S;w-gf)oM(2JzA%gthjm&}a5B-LfJs}5#>Q%*HW8;p2<
zlv{-9DTZih1ymOYF5E4`_ii?!I@{DA2uvR+NDA|27j)b!9LfsQA%QhPB9G`oBS-m&
zSdpVzXEgSn=9wp!RnqY&99j2ZtG?V66zM-%Zj)1jQ0Jit2wOmpP)II<`u
z(7H|$9_PK8mCS5#XNPsP3Xus}v-o}Z@DVK{E9K4XVJ_iROM9X$JatY@g)j1tmp?q(
z(3Qqp+`hQGKJ(D}xmnM%P3sbVqZC(atEw~-Q0*SH%j>H1&eIBmXPr5cAXvhkARl{-
z>J1g8CU9l2E(fX!@0rm7Lp50&{CrN$PRz+B7PBkkkX3}YS2vptJv?I64Nm5g)_0@m~*wet%%(D=<(yU^Xu<^^cnG?+ws
zx^f2w&X3UwYS{?p;L1L@tfb9_R7Ax&@h3`wvQ0yP(A
z)g3EP-2dU6$8f48T^Fko-3C-9tHb11C_-_~+0mZtf+3C?gGC?Zqt16G1Er(f9fcl2
zhVBqVGlGLiDuRO`4x3(Z@g0YA&11O+cEjBqI6ZoD`|!PY-}l_rZ~86Y{d<4!ulfG(
zxgXy9oKK!`g$aE5fvqq$F*O%4_<_wy+)b;da-n8IXYRGw#-lUusaANAIW8u_+aV$0
z3Sw@pa6_T8Blrlko7*A*+ZM(k%M^m#95tNc2)VP|BDfo~Ym>w5!*!Ez>>;q#(o+Qo|8OkxJ=BMhd&y((WZ
zWOi2x3Ch&e9HF+uSh**Y7++uz*;4atm{CFoI9{C0#H{^j37E6NNJH&_!H$Q7sk2!>
zSX1L6vyW-$3&oA$b{U6Y4(C{MAFt0ahU^4)9s9v_4AVoEEd?7@wegxulcD>IM%7kVGX|LibJ;r#SH+@F
zSiXqZe(wG6``GfQ;m_VXElxEGwCbvI
z5ra((s5SCf*0_0m{rKw9v(G&H>WlAv<42zV!7qL9Klw*L_x8K5eCPw;kV(+OFT`~B
zf!V1x>*f(6_yGxLIzm>-tW&zPk?zadcaG!K;3`MpGHnR&I7-JR0$p<*jSW=9N=mSF
zshISeS9Ks8)8=djd_f)EjU)-gnpDlOv6qQhdv8eA?rg>eb)t}XK;7y!NR^o(JRDv#
zoVK^blN4k}#2hlgHq}(kA$JF-B^wP2JeouRi@yUfJ5)nH+g}+dXlzTb|LKSZr=U^Duo{}nM`=kW$JY2}8QhTBb8gHG)y3I;m)bwU
z$Fs|V7gIC>>3SH~&|B3d?onQ1fH}0#Xs#X(KGNp$a{Hyl%tNVCF?E{^0|tXzP&QAa
z6a?Hnvo&!9nt8HAonN7_-n>yOBEmIh5CqA>-P+^&=KS7UZ$JCYy&wObpZ|&9_u23G
z%yQK2Idj8IPP}AfMsz&?m?Ayw(hW{lz!4>St_=F}?RZ9yT2B#SCYw{mlc1PUhV$N6
z7dRTvdhfC|s+*~UG`nbLlLw4GiOp^5?p->yEClBdpcephKUHVlRS51iX;rJ?6jO6i
zM7ukp2~fkDw?>SC&^=6a9m=-gCR-52Q+~t391?V)j|AF+{6r9q+N7t&6WBIn)d3?h)bEU$Fu+{V3HvHp+O?3|;hO3I!9MYkG#+
zv~K7|2Z`3=*6T@xrHF*4R)p7$)d$FyXUa=FVu4~PF37F+z@!ml*kV;^<6S&+RwAze
zz#1HD;=j2dd3QP4Ry9yI#+#ae)gkHbmOI*vW|<)?3+cAlnS()6bf83(dv76_i+sHe
zF5Yc)YQQwzydP7*&`++rkM+Xrmzf&1Y;OWT|EAJJ2~a%66fmt+CFO)FnRse3B9T|fLDps#z(s&ZqsU!NrR62lDep>_S7rfTR*u>_jAPP1ZU}Rb#4`_D#SiFC
zFoU(Yk~_%>4khYYhI(#(OI5T7VMvoPij|Hqsd1923;;BI)HF==!iflI3a#bUf%lMh
z+OOtjR*++*l(*AR9?jc`o{kJj&``(;1}fwe(oKY2x7v>xU82HOg|SAk2LJ5p$N-~3
zcxCzGwhy*ZImIVoda}gMIl!`N8NHermyJu{=gS!fJXmdVj@sz=!66t9AP~=i9XFBp
zPHiV)7oT#o$G=+Fg1Ck@3?D4_KvvL)HZ?3&Vw<()ncz`#Q`g;82*GOVar|P|C9)32
z7_J|*mZ3DXwPi9Y-@NtWL|D3Q4oIorqz*N6JbCiq-c$GD>h!{|yz$9T
zee8>0{=)y`|Neiw-ZxiQS3vjfGR>IT1-^G6`*P(d;K4BVTFD7CN({$}<-YjTP>t9s
zQwM9aqamI9fJ5Hs2a;En!C7Is3O5lJXIO-)6TA-Rvf7~Ou8H;#jmWS`z
zdC5<8(FIW8ra)SZ`HRnOHd~8roaJlq;@hzpx&>)w}G^T5j5p%d?nE^93SAgZ7{iri>)B`u53_x}o+5`{?g=-Wb<29bXQ3-JmlLAfc
zgb(y$4BQsMsiYdcH?JPi=p_3;5E}Rp5uky)L0fs|b2c&K=G^q;b^dCXvn(%3BNXnb
zCuaT`2E72&lowHFlL&>#7;!2yVW-k{Q@CP>5Q0`0PSgBdXH=W51E|g{kC{>%yqt5S
z8jK06U97#-&6;DFW`N0nZU@#~#7(AX>~5lLl!#lm#d4sMz$+gD*&DJYfaZubrsc=K
zH{=vo-EQG=b$we8-+l1R)AxVR@BY%i_4~j5lOOl)yneC)#3FtLw#)2A)P!K3Rt(6g
zH7Bj$z#rlh#@Yvb6jV@2pB6Uvi;00-9LWODB7tU`i!M{uM^NBw@*w5m06LGS{?
z1dt>?1LiTA9SpUrj8rQ7g^=ni-1jb2yL;xS0D!I|seyENH}+X=7-tZ=DLJ*;gc1gE
zXZ*L2{_
zH~iq2|FysKci;MJfBhf+y}$R1-TVC?c>jv4?z6cUc4k?Gw`m=vsZUl@JPc_p&)ZEx
z8%FaatFb=gsyYjY#)N2DpuH>+G2X&Ghm34e6YbrZaF?m0)Z4JZKa4DrEFz~5FvAE^
zN-7Vwe=J%$wYx)oi9Da=dA8h;Nr{)*A1xO(?f7vU?1r3S7c1dRItxs0Z^bEwdQ*$Z
z8#FwqqAs6d*(6YotW;-=os~QLn5RW`s?dj(_<5BsHe`T!dFZ)fhXdo7E?=jPs}545
zHr4;ot$dUTdFX?xJI&31JDOPP8YaQCs+O4;mv*8tk)L6+Pn
zAm3V+Io+IIF}A#;BjG89X|$zho~0ueGb7A^046=nrJlJ3%B{!En}ZU0HgiK{?M7!I
zf-SKG)s~8loo%Cb(rM}fXfc!BDgMwJ$MT4g+!HFQ+H))?h46>Qssn2O%pAG1(cME+
zU37ZAcZQn@l~Bj4fIN>FbA1)M_c0M8i|nJR)TpNl!J;W<7vWK)YCp8>e_E!N12l+7
zO^5g7N*+a+M=Tghl}mJO$}pypg>kG|KKC4Bk^emR5UOp5v(F$e8dUD0`uZUHyE{Ail&PnaRjL57
z*Hmez@@
zU6NGfFO25KEcoO_L5*8oYy$r1?jGoX-pnKx^PbV>vc+Vdd_;cXTyy
zcspA$LF~k=W7+AnZqC;ao;?1wU;6&<`TVC}fAh&(Z|tjey50MHKD$p9X7jAeOP&4v
z;Byz~ustkJs~gw1*J=CB_g?&^ul~bc=d0&Fhxzk<61y^C~@%1CHXYiS`Y4(VcL25VBV{
z=*{s06Lv-5pU;DkKgf1+>S-b=oxKT{Ej#*I60Q!-)?L;s7}?0V45TpuG|O6O8-YGN
zzlI)qO3wsuX^Fy}b$JTYe6GNW9Vgb$F7*_PUAfX5-xno>!WxGlfsG0{7z|+`3@auC
zyGP|@94|@C(RMR(oYBo(bT(|}$>Ur@)X}hj1d`pOPrgKYq2p>}&|`=&
zFuXO{=0>HMhsx%h1$TY>ao7w>Y>aYaF)^!vkh`uQS1kXLAAbHve)vcK{@?%NpZiPy
z#eea4|M}_udf)q>JzZt?g6&4mXSB(H@Mb6_S!EQD#3`V4k=9+lBv%8ZNIGUNq|;HC
zIgEr|vOc41R)z(mnVC`HspG&(d46-Oa&_OitGehS%fEG4Pn(w7F|Xc<#p$8(>87Xd
zB!|oHUjrgyEP`0BS9KH5kv^MND1yb0R!Fy4ztq)pIp$fhK`0tQM|9xgSY8x}IhbdJ
z%<$pkqtvR+*&E1|A;DclM;6fAU3?LIFe76hJUtk7!6ryHkeV2$#7rSb
zV{%2M!MOhPBudt`vV7B{;|IcJZoxIn;@mFPSwT4l1bi&3yKAj53(G^Drt6wjA#bgY
zI$hK(@l&+^aSYz!EUGW!yr?x4INjJ@AIoxgL9%V`F+l|p(*Wl@>oT6Jj;J&fD7^$F
zX9h%gSe*BEGbJZ3eaceAKPs@EPKzahL?CtuGPoR~Dn~RiW&KRgnUiI5^@jXird__S
zv$Gb-RmU7@i4o#fJ+niSPsFE{%DRLNPEgNkAl&SYhi^Rh+y}n=qTs@rZGTY_QE^juI;6w${n$J2hPgVHx6%MSq|fr!37J
zbA95S^(svmT8x3mGI-BYK?b9usj*vER#jF{lSAp0m1s5fy~^rUEh`7sBgf%H)>gg4
z5hFe;O~^23fHV7oNn%>R?oKFiwHb20zg_Z2&kr1sUtd}adX^I0X$A}5dvm;}LD_R1
zae#C^pV-V@mx3B44}J28%qCTb=U~r}jjnB1BTEYm=?^mVf!&aWlrCmwH!{&$@Z7p(
zZVX;L)m^2LW66`dArBs|$8_hG=+=w@bWIIFiSQxR$1z}=krlHbcx;*?Q~i`#RcUC4
zN05-&)u=+OWw5H9l~pNpkC%&AM)jULRG_PqqYjW{fXB^NaM+$5i>QRb{CI8Uv!88L
zq%>e_nX|-q&8A8SM?>*2<;u0}rF
zH`nbB52eKjTPrZrAgVS-@klvV&p*I0t7Df13_I@bGqnp?4Vrpn8kp3~RYmj9Zp!UY
z$pW}@^J2&#)7mn7KGM-r+94pWL?s%XS()uCM5{8m09~~=NrK`_fz85vTE_3A;_t=?
zNP)K6{MJ_4Jw2lta*K!IZdk_fM(1u-_5c8L&y)~{HvM|ciwUzeuZ-NovS*I&qn
zP;DfSO;?vhHB^!b)tz%DuCFh!`^-D>2_-xwe@@|{sJ(Yh8Q9s}(JrUR>3WQc3>dm9
z_mshmVQg=$8KcI^aZE*k(!{8lRNW4Vg0g9Wp&O&Fvj@^dcWWCSLowrt)?%it>`8HF
z?(QU$txy+PL{6%fhQGQ$$2}(ME*f+&B^}qC|udJNE8ll#(-I
zhp592!qsNTtu!Z$BMuNG82@9
zWco3rO0tfDePCV2*vb25uq;u8VB~=s$Sy*)yse2*5f7S1B$O3bk@jQ#&t6?MGYdGV
zc`%Lp8VCE;rxml;uG+L`5TQTr+@@MrWvyaecV=d8l|@IMXVI(`rq$yMrK6~T$uG5w
z!NiRhkxj2j9l$_cH8`3|IDU6JISyZY#Xp1eh6)=yQRX0`Dl?3it-sfhw4}N$CH#Vx{=#EQitXfNbAM;7d
z-`gj|pfb?}vByOan1;iQLEG28r=L6Dyz=tP|JCE$H+N>WU7hY3g2h_jX|8&bwRF_X
znylX{S(fDOzP@>4Veh^D@ZrM;-}61+`Ar}G&};9$S}71gyDyCMJ`w9gA#`?D*Hn%W
z%5K(W-7}X*F}c2CR8}Ff?B{JX59v^O~aH5h;e_K@l>0V$*XF`
zI_G8u>E>NYqY<7UlXr`m&3;#BtK||$ny(ezws+ddjEjoCaLfu?0CYI)*~B=5yK1Cq
z@?8xJNAV%p)L#0m>gKm|_bQml%dQIM9^uyWFb~8VE1sOMpIl#m;ro8wcYfC=UVrV;
zJ8z!DPB-V@Wa0pq}oYiBBC`qS{UBrmAjkZ+7pO-umUQzWm?Zf9n3#y=UBf
z#l7$q5ya19P|9ha1k7lNl#r*Mcv0t>-JLN9#fWHgppIJs8&ze8L*T&n>>0x>R!lu2
zq=bgxB-RS3%vk2b!dE9(#g6K|=8m8p+2slmjGh46!*b_3omjApYKX3wmvJ4ol?=^0
zw+Fu#vI=DpHqlBTePzkPuQk*rVOwni=gmTB2CbNVGkfOA^dw1YWr0zp%oPZ?0Mai0
zi)PkvL8=f%ALwrFebF?m6{@XUkaiQh2acO;vyJ5xC!_PkPBT3YP&!2q$3~>NH#4P7
ze3>@30301gn`K5O2kznnQq!124&gK_NB4}}SRe2X`cT{!s}sI*%fQ2=0^m+|^=kt+
z!rWIE$$Zb$T3UCO^*zdGDKh!Eu&@k0s!%Cw#;U>`@~m6oZaJC`b~dDQA&X{qsOILJ
zm#ZLOU}Sjf4*xMDk|Mey)`}~Oc=xRbJL^Y&L
zpRU-n9>4mZ!GhcD@?5uQ%vLcw+?WU!bQh}7=x{Zz46v15#ky*=h-owYdBCX#K7?b9
z0~=XFjq11u`<-kO($3CM0KvWCX-n=f^lMRo!!S0P9m_qyKf^8Jq7b2QgWr|YZYuK8
z=Ez+;Yb|Gx?;f*yXLTi=lIl`LLaIdBogz74?+$PzPe?zJ_dom0Gxyzn?*wPe
z1I7Jb&`vdv#b@8#HoXPMotkI6w7JKmwoPudHm3H=R}KX}K9ZFD^U&}yENB`{aC7wx
z$MInjH^+>ho#C;TC?lfX#XXZWnyy5ch)f4cB#&;QyY?{{)Jto)c#3aLx}rMGEMjTH
zoNG4KMB&0EpqSrOL=|mIcIXaG$9AQ{(B*E?tUt+|QIIQHugWY=VUFh}BFx%YPv-1E
z%3Z>i4AtM`kQ4}XRcNX#)08z?iuHhkx372jL
z4@k>e#9V7r5KC17ZF}6^MLbf0#3-Tb1@bi7U^K(V-Q$ePht`6z$w<%se12Q`A{lVscjcr!SGAC679|v
zoQUv!dwssW7qMP_>FrN^`lDa`(ii{pzx|a5*Y7>|)U#{Rk;vV-oEdFhb*6xPY7Naz
z@UhbaW^L1LMa=BXeD`4&*dV%+vS|xFXHjIbrGmvq@Bwp`s@!%yNrgwo!l~uYSel-5
zo+_|-SX1l~u=dRK2tp#^VTPTm2UaWqJExlMo_YzuxQZ)~gC_>M{f!GJCR$4Vt4ZZ_
zCHV+9Y;G;M;K7n!a|~vRmCD?kYi0~=8!9&>Waze*LJ8LGIVF-H;_m5z_4;CAn!G4#
zi(e&00-zES?zA9NpUtK2adkSK)^ZCoYa6n!=}l&DJ$UE&_kHu1f9MPMpT76vzkF1;
zFt;a9o)F3{A@n-mJCjIU%kPkxjCrL
zNeb-_P{gHVM;vY#b;_k^?K!PIySEJ_vIg)P;&ccQ#{Arxir|qORu#$8awLW1Qb=18
zX@}t@KT;h1dj161RaGZxr4|=D7z$nYoS1afk-Ysz_y*jCYHJ*~Nh#b6>1!xU+<6fRde0aa4x2FTcI{
z0??g=8{9|*HHk7KMMo@5k(K`x2^`IDbcZi)+{IMzP^~$&R}m^#WDuxAK1B6C>mCQ}
z>gr_hdGlz%J;E2IE*`Pg)ml$Kc<|(<7hd_)r@!vc{2zbkpZ=3S_?b_wJm=nJPJ)^x
zJMqnVV|ITg|Ei-1>)|Vyy!+r_=NliAhfAn3IqUjNs_*P1zM4&AJoc+qx(n!6K*jXTk#?e)+UlW~z*n^q?n}NWf##pHNO>PRh4N
zK-8^YC^81hnS@{_DHQ7>f|dN1bW&)8g|!wASv6PaLAV{vq!KdTRz@vzdCp;)kXB;i
zt)WD;$j8FP2=9?NSfj#a)I>CZEfsfCTXmat&Qa-35kpYH(4+h7F6DIVnTVBN
z0$C|zExgvDYTzqTwF^H!C8|KiC@ZPc5HUo&!hx=>qJr;eHbkNp{0y;CRTjo|GOSP0
zFbhDFpSt4uiV`qGQIomS+=a;3A$-t(zhG#n!mym`5I^wFW^;bN&Fkx%
z?t15qhmRjW`oi~r??*rW>31GJl!F^!RHhg;q{^%WHbhSt@n{>~h_|wchce6(yr4tT
z0rn_O&dqQ-A&uzT^i&JwwYWYSw5_~#Z&btMJ#^tmp
z!`O~h70nA-s<0a+T;nl@1ja!`sgu|=Vsr@NOc*=V5*f8WL?Vlt{%$FeFhC%twZfnQ
z6DDkex{>MP&*^hJ#~UG>m}vA|G_fNM@bgb~L5&|KRXF7ce05pd@}}|gqfuG=cHiFa
zGhoJTMU4$)=4x0@18!`Kz9(W!ISSEA;K?$iP7|-
zB%|KBZ_j5#ujN4yQRs4!7YTya6plOJ)twKnD;x-1
z+$*4aQgye7$^bVH4+}DJS|3aRuC3{cYzF6SbI=r_XVh7|Api@@8MmcELr2>PIPEd?Ld$8)c7Jou(4rNVU9
zw+vpW1fYg;{?aawo(A$)L@3CaxmkeU*5)5KztrI0krhwCWDVP}|6abFogX1ee`H>etRx~4;1E#B-lLQyqn$XAIyxUR$I5pSct_8Yda6^N)1}B`^Z*hS~1Th
zFLzI@)zBYg4916(s2Q_F_mps~jCqlRDV0iHGyS|ix*wMo-IBJ{=+5=JW^0|ma=H(9
z_`ck2j@#(xP0c%?;?Pw8RaNetd$S?10c)xxkzw}Ds=d!uy9tasj%g`IKz{ddUlEIm
zn4ceJJ(o=SRWs136Xq6-c<$!b1AwaTav+>P#@~u1PxPKLfPuxx?;a{<#e59LS{_Rk
zFTg!;10vAnYf{f0)TX2)vdK4;U-4-1oOQNlzIYvmW2AbSypgFXgP1M@VvY22>c+A0
z)&*CELHP1g>GWJ~#E1*@6ioM{GJ|XFUALUyDaLY7k^*y?_v#VW;}6~wE*G4;(dZmE
zY?%qOmUIWeA_pc62x_fB{Q#ecy|P(hj}jP+2r9`m?>-4Dj2*D@@;}w2g8v|ql6t&Gr|B3O^IltsDo9F2gQnwoBnzW3^x
zs~3Ld5x1ER;?Pp%7Dng|*!g^x*>54@J=zqce0jw|qtK5@(HT_APgS5Aw}F1^ZXN+lbH@e1O@aKr)5;=1X0c%!@a-aF;M*&_bgEi$aN
zF&_{ju;atAIhYYMGXohCLd5ehLzmn7sJN9}G%G8pY`j
zh;^rQRV{X>L2dm_-$9hSsp9Di&OAeRN6j(k4Rf|zmrMxK3?rwR>0})_vQvn=xsY}K
zbrm#3LuP|)Sk4Dajtx={XS~#+VOv)=!ZXGH)h?-8vX3v=ZTqZ3e>}RVuV`O>I>lNM
zqtWI0QB5K1P-`jqkI5h1Ku*}kDY}t;kgJ+oA(u0delxJMT|1xa_I9^RMjPQU%gqSJ
z-|gDO!m+dWxd6+o+#)Ed`g}f^3carxg3FBobC~0NTesKyJ3syOU;48@{!>5ohrabA
zA9&@Jm#(jGPJUW;ia2?!YHJ8fJs@57-jsF^r>#WEhicG`kP^ENq?=q96(0(jv|49p
z(nFS@E#)@J?WSxMP$;ezV0O?{nI_yydML05X^m~_3v>?;3_S|Yg$~^lreKVUf@xq<
zws$klR;8A{2&*Bn%Q#S#yDCj1XNdy_nliAvH-*+T7tzcfbl6F``$UO`*rXv;$>t-~
z|FECLYtkfb^hUcI`!?fLOka&-hA`<-$zplwTq;eAg
zSF(e42&h%l`PM@NGu0F`TU%AxC3G1h3gG8+U#zHfDK2CeYG#_c%_DRtRGK5WW_dhB
zSiPD$Z*i%mN&Vxz9UAPR{W0YXl}04<4_VPr);y7_TsT{3-c`xh;X%IeWBj9ao3+s+
zLorb}tk|$SM+;)ttF%s~)WueTU5abp5^RXyVP+LQ<~6CE(SgdT8A@a7Ntpo8sY%$T
zKu->eZD@!nV6x>xC;f)ImrQnRN`a*WSBIyHJ6EiX~mEZmO)+vKs=px_AFs
z_k7`nfBg1)FTgvqJWggIfzQDHHi_nVKn+^qW@epwM9;VT$&;H#zxUSThY#NS-p_yb
zTR;A(w;nv`cE>`qWcXE2_@o9U;G_mn
zwK5Ga8^AbG2LddlNd^aYL`XhqK7Lm~ckMnlwohH%GaHqhK|bF3*z%qje7sl!{z%Ku&p=#O`cUQISN$H|C*SniPVn<&bC-;bR?&~MlpZ~)5
z|C;apoP#6C?o#*NZ#GSy7^?f(BZ8c(z7^Ywo(uW(3G%sfX2tzo1CNPckaB
z+7}F67U<$(XL~o`3{I}M8~?z(
zu0z|yx%7qFnsJLJ+g}a0>LTOB2c4O|OXIlRG70cw{hEmUW9A1u>O#R4TX?A>*2(w*
zykS^Dm9>Gx$!_KRuYQXAW&Y;dk8iIZ{>I<`u2j
zZ14zuRaxl4K^^%?H=rlRUy`ga#7lhCe;D)%srSR~r49vnqE**zf>`CY8+y;6yGA
zT*frSX_&k^bPuQ4bfcM}!hDS29T_#3?C*1AO1MBv|^jt7|5Q}qEmr3M=
zhFQ>C_CP|=-A(n$u`sran>NUW0x)iAohOF%#
z!5)vog_`yi&I!se-U+{`T39OBux&jfj>nl)
zNT$mQ7`2#TIJE3t)u>$^v791mTJ+69;VteN9GxpL5z#1H@RcKDZ0!K48rFqaX_23Z5Qu*n=@q{V1T@4^xsQ11y&A?Cvs?-Ed_aoREoPx3#zg=^I!VX_dfOPQ!o9>nQvy
zbFdkmaXuy8)ZA9p?agiG`PH|7<*Tp#lXZ2vy7%;a=RgonYwPo6Xo9
z8x_t>l2uumFmOu5AmnwO7QOXKqb!$EF|h}&N01=6Id?1&mgeYDXQrG*m@)%y$ejj@
zQ{>)e<`IR;eXh=_Ncaw{GkO>la=CQ?JcB09CJZGi$dwoz57`%RQZ#-AC&coAcuJHh
zVZFfxlrpB2si7)lr|zMFV}cJ;kP%HyFDn5lp1GnF81peqmd)^_Vk&@_kw5#r5Gg>
z<|`WNiZGZScE&ZQ|20iDa_nC)c@I?p5v>k0IN|?s1_lYP96Rxm+UheHXiCNOU``ou
zNv2WUf@oE(ReOfyM5t;cgPaKTVQ3x7i_<-`E`{#iJNKEypfSr(3y@g^(sp*Uajo9F
z)rXP2X=Ki}?QCcOwR^zqoY7f5c);F=rrpdeQ~fHnV!7PH8m}qE!0GD?!1t2%!QgER|rEj
zB@+r&U3Czy{1i0El`-rtTK~$hN(Yh71+1(!cG`L*4agK>LYg%>x2o9K7)qZio38GJ
zo1adrHLlD+NQ%E0rHP7~*?6x{xjvsVQ_om#
zdMhxWILy1Na%b+WaZ+W|Kh8mrl}=uWAk1JS=a%{XOX@b7yH?c<8z@1`i+IF60?{bD
zm<@b6baxlJ4CGe@+({$a#4>oW=&oTdo*Bc!!;ccQsgrV>q(h7;DG9C32ULijPRB%2
zRb(m&=$bu`G|UKn)I1u8q(LBEG3j=tfMGRb%0_&%5@S3X9|O=i^WV_3sL|Qt3cKlH
zRRFONZn}8vstzNUp1N%8+ltL|+wpYML1$!!@~LP?W6rRn%IOGOqROkrXr~1cDnYA|
zX!?xnmfbNwYyHEdLuCE(B&t`;lqtZZ{2KLCRh@SZ<;IIhv59Eyq9o+fA*iM2ZDRSF
zsnKpT3+;H9@dFz(o@y8Oz||>i07jm0x!p!N!d$)<>eH77gsIsr&~Clfy{F^UFTV2M
zy#Cg|tln82YX$cMag3QUi%*JHVoQW_L=r|b1J1Ym=J8FP_uFqgeEj6`_k8XqHiM%kAb!p_f~nVSi)lXi8?v{pL;jeJ%X!*ETK9Wf)b-X
z0M|QoH`PE@!h9U41Q;F&xOz*LWkbBU@B)=R?E7pi
z%4az34gkwAVFDNoYV>TnSI1?li#O98&M98~C4HjJV>|!}_03%Z0C%kLwN9D+=+Wcv
z_>OP?zAt>{wO1d#`RdL6tE+S7&RQ{i4|hyS^WEdf0yy3J`MuykM40*ByR6>5dFz*7
z{Kt>4-+Aik_s40i2=k!4n_)LJY)XiV6;23~FppUD9L~<28x5MZ5=W1<;95#%hW3{A
zd9X4qKIc`Nof}83sGj6Cb$5>d+Ct&e-C&o2lR5;YXmVpz?)c%wM+AWR97cq2trHr2
zUuX`bW#D+&1!-rOa2E(fY~iki2CU7c@iTYAOTrp~i0EP>FTv3yOAMk1k7~badMl+p
zSZ~Q!>>#aBsfxTxDW2D!&cD;mH}xE7Q$_YeV%A5HT4VTwNn94AzO_
z1EQzg-OSp|*8<$b*Ww0q{){uI8)Xg4Vy)BZUR>RO0e|MX9O_@iI{+M92+`PKcWPp7MOb>*>qg@wbN>HwIYT~lW;(q9
zfH-k1%Yw0G{N;~wlTT&0un7ZvYJLHR=O*22hqxlvMBnmzU
z3oxiNrw7(Vk~Yv_mIzDH$i+Dmul-VOqmh{~W({~ON3?aKbC+r5?Qu#4DP(d+4m~O<
zUU8rc+U_zUAl@R>WnM-m-1YG5#m7{jGN3UkN?iRq5#_6U>g
z>I4Mn!YV=<*IV%THChWRGYOXqQW4}X=&=LnQub5T48clDzT8mJ$;7X6$E`|ZR9Wp7D^|o(OO58^VW3NM>d7nehgxen
z=~5jt?5+^T1=OK?Dg;iq8sRtId!GWH#DlR9yc9aReUkuLM6nE5r&GjY2-T@R1Zw(7
zJix3H6Y?JhZwrgxzFc9O!_S;`BwdHW!!ox~xB=;~4yeEkJ_Ggy2B)MM6(^fJ$djCB
zz!Y3{YbE>A{gpe0N0=}8dg__?Ke>71t1tZQqbG0a%{UtfW~?J(xV0;v@j}3Wg4NVk
zW!AU1H@7$EJnuJNeeXlx^uf=6|L3ax@$HjXr_XWg{2;-o?07}>K_8vt59}sb!c9eN$6FLkk>5ZL3#PT(uONWO^&SS=YVX`m`u@-As
zH|tr|p-O0a9^D`c5X?EJF*!?slxNk{kQT83Zax%~CPK1WGOy+fm6`3_)H1Zd)7gyL
z1~?T#^5ugWDMLsz(_?IlKDq}^yAi)sm_91K7D~qR=ULW6!cAmwc;C6F;+q?aUqJ0U2dO%tM
zk(1z(#;Bd^+~=Ep{o-rC^vYYmcy;e|y1M6phgx8E<(zboa9<#zjr$fivb1$agj=Xf
zDyv4ghey-*A!3>vYWF+2K#KL9A!31}GUKg<8F%573tG}6^8>6hqjDoONedaef@|A$
zW_7wrd03gk&qQwI&T|qZo50OHV{HTX>hns7B511z(VxPE9{(*snP<-oDD1rt#|5V0
zs)XCtXmr*%%n=n;scoF$WW~@~duN(k=H`4XV@mGxJeBIFc%KQ3Z-SwFdz@p|?iEBQxu+=5|B@S6#`uugra$8iEn9
zSyl94(CCqe!D_QJPMS0FY2^`Uc%zdjw{fk46bvJ?@FA=vKDFW4O$Kj#9X*>_Wf7H>
z5_)nI$w1@oei*1uoy|E_H+Yw+8Df0^Cs6~yeVK-Wy=vxu3ueJ74n@a^)9LBQPx@kXw$J6a<%Kr^CK>*$^yXF*R8!4Apb1jB0SLrU(x7;&o61xBng{x*4>bM
zWB#5k2x)3I?NtN>D
z>F4irp88hec64*9*p7jCAqF$g&HJc12Q|cuYydh7&ecPjtyM}Zl3FF-g{J)9d2x0o
ztPCO+rr5xIjH<5l-avX-x8;zNN_>Wv`>WMX&b6kBq1w5twP$7g<55gi%CJYh1cI>a
z|IO|AUb%Nw@7%0+DF&n`%c=qm*yOeA
zbJ;o3L%VoGAG;)aifiO9Sa)q=1frE_h7X`SbNjd$jLr#~hE|f?9`)|NNcW(+e+qyS^Qvx6
zMGGins|NXbv$`WD+$!*SHl5yMdus-@yNj*8IXN!g8~V`ZBx_zA6R$UPdQ(hGw%$~0
z@##(t3Rcl>8vFygD?3)`Gy@I0fL|sDoZJ*Mvyu&dBDb7eAf|jp%ah6w;!F3xgq9bCqQpJlY3y(gPO-x%{faT
za${7{Vsf`Wa+A|li_{IGe^r|)qf*;ndOcS+fi9+RRtE2|N
zxzu9{nyn`od;n-)h5&cdp`#@%|2f)4cjJJv#QL1ugg1xKMzPe|=mm9%mF_NNQ~?%3
zdI$LQnE`{eC>K{Uei0K0p^#9#LnH$UmJ!@D=Twi&JCqUT(y6PBF;~l8EIg#%am5dQ
zyNG4REd+YFgq;xsX@T@2LK|(0eXiXhbf%F6E@BB85LPIF(*_2Nh!v->I9O9%GIukq
zwM0y@Kjp7Rc({kd?do*3;@)eozuoBn+5hM_{<;6d4}ITvpKfm|cSeYaM$4l>qnDDPP>w>CHLkJ0b+{68J6vAQ`U=!Ol;F&G9miOqk<06~>O<5VYhreBJp<=W-wK@u0zH5oQ%N+?
ztHD_mzRVr&gN&)XV~NR(W>WrlRl9j;3%i1$PAJQniIFk#6|wd1wBKiPx*WedWoU$l
zFG@*R?O^bJJ$Pz!5#}bdvlNeEdZXiI87U3{$XYU1zQB!UO#Kl5A~Sg&)r$$g9*iT}
z8~UP5@ra?+j*-zxX6ERQ@Cf~ni6LXn7ka4Yb*Fsa-L-Rb?Fz%v6gEO>S)1wKm5{nc
zrVXM$TEQ{-lYd@#z|>ukLSbB+d&-VV8N86yd#-`p&Z;)4Kb{)QsXZDRm51c(!^}s3
zaOVmh3>DM@_q+*Ul=AYC5+`jYZ|#ufG?6zx>*KC4ol?)SVP(=n>@cs%<)@(JwYw$jz3}5Z=t8%-M`ren<1@FCk>(Yf_D_$>uZry~tHz2;rGgP-+Qyq=
z(!@2ICW}mtl@+Wr)*9i8ps~HTN$g-u!4o=!ymXh#?0P=e6ra%C4rz<#8N3vPb2eC7
zFf1DFGpi#)aIeHrJk|Q5isaA(cto%R46&m_X4o>_H9kuOuv)bZJ$RSf>FKAR+xh5g
zFaO-T4`0W;BMegV%fJ^cXXBWQiA&IsKCumUzPY(QpRaFj-+1kvZ~e%(eD<^7eS5pF
z&o{A7Yn`mkKwmJOv03%3rH>x&7LEv5$c?;Qv`j;@fn?EQKCMRUhws!h1Iy3m;3TVC
znNYE!;_I}VAP>nXU_I*!BHU(;Jb=?Wwam-_uyikVB&`Vu%7P9Z2fyR;h!Fxn!@PPt
zG#Iiq&!DW+h0NqC6#g&`x6I8gDl?q^z0Gs%9^5RlRxoTu3~1Xh>#A)ocZXwpPgR9q
z3f88ij2by|GB6rdH32Z*{I)ExekF=fRR*pC6MWvnH7B>yw?KVApYZ^UxFCUt_nth8
zc=}5}^!fLH{d2$k&)>U!Tps@9=BBIMX>rjGB6aG5jw+Vrnm#7yW5c`Z=Jxh_KYaO(
zfByPgzjE*1Q>W8?*3N|gD#id4zN<6`10uePZ+yiAglj#4-Kj64E{^CQOIW7+
z&fXm7PR(-hp`@`TAuY8nQ^1ZDl;xcR0zI^_D-c@zzl4`J}
zQW9u%RVJ*>s&ZF13#{%0EY_)^5ZR*@)QpE&cWSkr=0u}`E^ZmBo(=7^sf^Ip^{VXJ
znwD!mVo2V57|A*`_P!h{3>E=OF!T&AH`+ue&xr?@zd;sFt>qu*^R0<%2aV2a*2lB-
zG1n0_3vdQf4~@1ltG9FS_HJKm0gZs4;@S08-UbX_x(St8Ak7*aD<(+%m9
za(IEl@EjW2ck|$Gm@PuGkIIopOAAm0rHUGzhI?<~abRR%RnhWYWE)_$4=q6z*U8A*
zx;c~8=$&1KOyp)3GP0&kx|mhgn8!AdyQ>ga;j<_L*|`Vy;g6-@AvZE%x)D`v)+?Me
zIEU^OZ*bh8&U4M5F_({C-B=N)ML@b6NRHZuqjYD5ly|$^-XyfJcUQ@@i8HReUkoEQ
zRAx6~c?526&ga|wSAOIh|JGms$>08C-~HMvFI`_hxqttu)4H;YL_W0EIUHqxch?Ff
zCYP>GxUa#cR(4vLQSHJNouDGR1yFUjy5h3T+$FmWvu1OWsNG1TRG8Sj#;KCz3Wtm
zFjEp?6Pi1RXD+H;s&;kSEQW!gYexBOrs;^sm`)XZL;rdy}9*3zxej5>j87C^d6J5twZY2vefp!PnJ+~4x
zpQ_R->^!JvlX2@jIq)vSrCL!XJsK!}X|OC~BbZ5Ycym-l&XMliqk*y8t*W57*%w0x
z6(7V6)Jrzb=WRz&R-t9x%?_lb-05z41%va?gn*TBfkRZ*4I71K9UU$X@OKDIGt*``
zB4xVOGTZ0vM(*>t&lJyYX7=nF^jQj8-8(aD19Vs!oP`E*W`26=bpQ0m+yC+d&eAK_<_&7?|mP9`{8?r<*|hG
zNonC^NooQ&XUVE7QMAl76&^L=u?}@WW_BObI+N)@XBR&2)tv@#OuT7(+Gb`4mRG6d
zR|oE;iaJBcwH;b$MiM>?5er9QBejvv?SVZdss5q&`RZ9IK>yM;bx}OVDv*UI&uepg
zHO+S1DBocr$X=FJePx|@Hce}qPw4>HLQst%&wZX5VWNX%Vk%y8nPxoLBi=qRb)pu*
z&O3aCFEgX~)0G=IS#iuYxtlLvu2&LL!#|pJoR%5hd-&eRzwJ{$@I#+^?*U%^+BpzR
zz`}ond7*%|FcTKp78sbY=5lm|hg)?P_M7j${*{;hN#XI;Q_q?CiW65Hh7#W41C
z2iidtxf`^v_rVxKK$;O43-L2k5FK!7_IUr|_&>D894P44Ft-r28=6hOw3Z8()dE<;
zX+3Z<1|C-VBmP$dCkN~*k~!&tp$Y*#QAP%~J<~6fDjEJ@n7IY@lm{?RcAIY_pJAxJ
zw*zD}=4#jOLr3-Ad7HTba_K6AhB#`-b%-e-;q74_;Tm>lS{aVobnBr{2wt(}qjc+p
zwaa^Jx)B~fX8|FEl|>8(RRU7nvm9dFbe{rH^I+j1`M1KC+C0otr>PHvcU8(Pzypq0
zR3RexQ|!8U^1}5j2eQlHu@)#p3aw=(66qX|i-;8#7VC6c_pa_e_2%0TtLxwYpZu$T
z_D_EK)8DrCx%QT{&%;(Y&>quyV*p)_Qx1rz!+Gh?ZO%3i?9d(aR0~``{+gzFchd0X
z0TDdajR|@4GE?5+NYd5XL@K*YkveWbRcFz=#9-!OvLk5mAs!ZV=bf6s%(#G#%QhLp
z^&C&tB^rv|Otl4O8?krIh^eWYnd>kYYq+%o{BB^MGqd)t^Da4K=qiD1x8_iXT{N8n
zDwEOZ+_jcn1i%Gzt6}MRjzfC4eK7w%OubXmP!wH
zYg?{m8-FCyIF%W+ls~SPKC89PkIlS
znHdQIcXwYFCvB26k`uN(PHTyZ0qj`l6)v(@qN@2^t}CF!2x%&z5oN{(7wN^1K_FRo
z^Jv2iW*mDmEq7?vS9@;*vEz0bFG&WG<^zxL|8AOFP1zWqDDC8VFL@evkzmXNB*EDQORb&_ESQIV%4|E52&uyP-)_))
zka(O(&D=Y074zwFqov|-vXw(+eFkTF9~ps7@Q^_
z3~iWUY|QYB!KzTDWe?oM{qXt`EWY@q@BPLPf88(t(mRjdJG;lt^=)N=!|TWYnW5U5
zO2(wotZjT84CWDCeS5xse17!OYrpi?yI(uqyU#5w1lU1j99CR>0M)fRnh{;xnFZnD
zj+S#BQy|%Kb+Lf$y$yXn-wGq@UhXwEk+cNNY=?uJ6*)>;4f>u##9C%$?(W=MR?p2v
znwlu0!n_lF6FSzM3T-w@9^GPXac^o8MtyMy{4_nIv%*K&LANL3Gtgg
zY_hR+^Cqcy=W${Zp_>||9eWSaQ2=Z{6fxa46oq|6Z)@j#7fwK#yK{MOtGpN4qPObq
zLQ%f}0GdCnajm629P78P%`-E0%{HrO&45fT;;r1-1v+-um~aUBM{2ID%?0OZ&%4WL
zrJEOrHCQJTeD3g2dk8=-FU*Is)Cf254k|o=d#Y6GnVTKTi$f$9SNEUY=lJSZ-ulAl
zKK3(z;m3df@BZ*9uy0wUD(6nz7j|n$%OsGZde+ADfbK`j$L`Jz2Z$~9)yKBAaM0aH
z?aM!s$Ui2v`r^7N^$Hp`^dM#mFl1eFJU!j4+NyHPE|vd@$5IbRkydSx@`dac`76xa
zgk4#Q&j=wj6yy3ve715YOUJ5SYecPKd9EsOl}-!kAIKSU0PX^ZxVt!w@2Mf8&Xici
z%=oVwI&I`W1Qc|QDwt&guzhCqIwFi6Z-IlUGi9~Ry1h-Kgh{cW#}V8hvG-{1ssSUV
zyw9~aXK}4z^ckKnB^HMt)y+;TsCT`+-kJTo{*90QjlcSDfAI^SdG)2&Z*Kc)-3tqX
zoHWZl@;%|ULCWIb@0fX5+SND(%$+S*XI3R*1#1pAt7zKZSi@$ti4``Zx9$-MvQ{%$
zduJ(GZ_cNgq4r^nKq|qh4P#_bq0>CfRJc%+R(Iy&UGt*J-2{wOdipSJB+L{odCy9R
zc7=OH7m`XdF!XU35aX7d9;SEb=E{%}$YhajrkKT5s`HeWQ4!GSqC5fJ-Mg|&yDQH7
z+$Fyco+YE{5sPt6v`X;Vjmmbj@jX`W)Et(>B~ZYyb2nNmyVzG8p@xB9u=R|NSM9?}
zSI(Sf)Amn(qE?PMnm0{Td|s205pzjhr2GonLNHWx^`}U_ZDVq
z8VWSay@mHSpRb;y2uu(yEjceCVgj7U&M+2W=e>7s`VNiL5LZ<(5XlNeta$hFdBj1c
z=m&nUVH%(|vT1QFM0Qwx81-nG4vk4S{e+vCeP_{5T|xt4AeAk3l71dqMxfB&)jDrA
zY9ur33)k9A9R(hji$JTZvIr8z^3Lu_E0cl)NR{u@$F?Ww7dGiayLVc>
z`S8`Rz4~*F$M^0(w_=^*YGaY9FQIItuS|T^nn``CQ7(j({cISi7c*Ag<3mjS8@e^`HV>e?e6p
zBL%TIL>)nVH^MY07`E2BIz9FF+YcT-diX#5qrdLY{;4m2;-f2f78km>nPDx9m?e7y
zcJLpYN9CYWd5{j-7@OOp)vuxr1a`qYH=?BqaQJ+EuIRaXTLR6&}m8dhgs>=W|VicW^e)!vdILokADfyi_7o
zl}L#^H`&5{<`~%gLyEvUyJ?{m%XQWR;aD8cchFs_sy9a%{EqBG0A0fd`BslzdZ_uJ
z`*9BmUJ;46EbLvkx4Rj;1n{tknpxZ$cS=~BW!6j$5s-E>c{Qn4E6Fn{y2Ei^fVJ%E
zo+hquZ}-i0e(a<7|H4oG>;LW_|FMVfJ$mQehgbKmuC6>5cggy=xRZAYxA0K>9B{qK
zMN?b@&IKuQ1KsA~5!L9<^FFipqoRR)4Z&>b=!Q#IAe}#us06e6LH;vx2C*GlZdRjA
z+u7)VU<``9YjCTo?35l>|0p20o}oS<13d;qw@zHr+vyC7mr^Wd9TY3*8Ny(tsXXwS0E6>8#EYGeW+i4QW>oMv5q0Q_g@!#A?uGtz4B%SnL0#Sh-Fo`Z(Bn6Zd1B_NaT@pkgL?
zk#{AHwI=MzrQ+`UnvsL$+KHyQ1g+@{McUI0u*%$>X&l|^83Re$(fc9&yJ9Uj3aPnp
zIw3rbHX9HK0SRWp2;Z$S)>*6#d^x7n>E^^ErDsZYNA#E!(5#A@D+DX!h*olig<2WD
z;1MNRcMXt%8Mo$t0oSpjBiM7+h|tIhAG$R}=+)dW$*!k}Duq0OBuPbG
z(?9%p()Fo&lDmGfs$7a2Og!frr-{BOIY;
zU7yJpAc&h`rk=+vgH2lTi30j`b%H&4>5ZR%{hhD2Hyw59ngMp*qRYlr1NsakWag$|F0-ZeSN9={
zh5@26Gj*cZ2;>@d-GWq!Su|+fJeHmWzr^HtSIuMrFNdQnv)2ljor!f<(B?~R4nedw
z>rM&WyJ`k|dCG*DRmr`HrLa4++1IUVbKD=0ug{?4WZ(f5mlyk(af|oh&sDM8JuT7H
zYJaM-l4&n?3A$^Z1uYg02}qHo}Jn_MjH-Qi81@-NL6fbCXOX
zjzUhysNOfU({gmxrd-1hz{NM-v!vE>_
z{NX?N@vuJMY#Zm^L&U-_r~h{WVD)3Fr`aqKAere?UK$hZDqg2G64^auHS`0$ch0R>
zfuV~!Kfq_5wPjaxBbu;iviSOFa=AF(msd^;BPezNYyFE2>#hb+#U6OjOtT}mxr3tC
zOu7n-lpmSRPgBREMJ$tBZujrB!^Rl22|sG&Z^$KFaglqav!Z{Z^DEP
z3Yfbg#cT@fu4;NR6OunriTTnXJV#38`tj|_>yQ7@@BPbv{@?z<^UuHh(%a_uui~lG
zIvD~ok&S5-+()~{3YU<*5;1`&ZR{iPFPMY1h>Oku0jA7kY0*-3at^t%=#Bs}b5O6#~H3qP)c}_F5
z8!~A(LVm4@JvBcXVHl=O^;{QoSWrEoYPr$!Hlz56JRFH5^06YOFa&H15a=#zJ1!~H
zm@BKX+YKyD+s!)pJXDNlTzxZAU~C3iTWHlptu*5fvN`B9rYWgE@6M-p4o0eFIDC&9zNkoyyLPpFr(te^xcP8>v=GorPuK~
zynmxhl5hq(8+NEFTKAK)k*ZdS?30D6StbuY-`%YSxMq}9dV%g%QQciR>#yplvU1u4
zWus6ZKBcHZ5HcvZ#{ba!ppDy{G;o4+YBDu7TH}O
z;>`F&@XNnr?QfT~ncJ+L5`b&?rp)S!$*{7P;&_1icd{`+)z2j9vaK}Zg3t&Z@&)dw{
zqt4u^nSAGz6v?YzdS%RMuBu86Ln?|02PR`cj9E;Mhl)o7j9O&lEU36iV)e(C9UN2+
zqqG6-=BGHhhaI+QfWc@L*j4X5c=ww=^x-dj>DzA$FTL=j%NmxIVKaQCC}!O|`@C~=
zhnpH-H@L9EwcJ!K*L4^79err=EG%V})PQgMG#FnWEs?ChQcl*I4}6-9-Q{
z!Z{Nd9_+&inD8vlP^wGwGZ3P_KEuD}=J{XRz)h#bu2k9{*KDwvfuI^|oyI~>CAePQ
zaKV`EGH*t7J35^nZYrkZWtz=JiK5wU%_Xc
zN6VcH*|b}8olbU{4RbTB#mQCo73O~b{!=^a#h2dx(I5T7U;8V+^?SeP>h>lx)0ct5
zS~*W1aZk;GinTcdJh!c<+=rU;gVQ@0OW-nOh(@MFbgWY6pqh@9)Op97f*ds8kk{Fd
zzu^Ia?y1nggK=$`SuBug_hlSb%pCeaDvKr>eJ;i8(i`5VgMk1NC#WejkyIn
zmZtu;X0H!}G~DQW?{*vj+et)kq;=HbRgbL~-%==jR`Zp0B-A-mhi3rxtiZ8D91cYI
z)m5zJ7It&HZ?5wPzxaW_^*4V1mw)KHUwQG(D!V$}JDsl9THKVNLvD1s=3|6IpKyd)
z>PlR+8aQ)4saAKq0T!|zmYvn@u>jVk&9630h{Nh2=GNjm`a2w@2~cN$DVYGkK4kAR
z#Z7lu;aK$P)rlCWYeF5T1ZcZ}V`Ko($jzj$ni=@1Rt1qujADJTR?>kPd~lfg)l2N+
zVUTDH)h6Qx1x8E?;OFeSe-9OZHdwhE#=nQ6q-v2%Y>=`xAyp{7&)nGM#P)H*=dR9h
z(I{Lrc8fZqx812p7;X3&nJkDHDw{hWX&;=sMWG+#k;Bfp2&gu+hy0cZEGi%?KhC5X
zf3#^d(C%0f%T=QQZsBWjUnnaLKFnq|c59UTuEA)gmZPqc??P%CW&?0}#F{pT;GD}Srb;J3G<=pk4OLVZqP?+J7WLqK(2(nNDD9x1R
z1T$b9m+z8i!{{F6BXd(z&Qqt$C;yHk8kH7m;D|ho;kr`8{!h-lBY03jWyW1QS(g&l
z!8u-KJ+2hA^cWT}|eDrGqO;i>f
ze6%~|0;j9fTKn}k{`nhke+9@8>^Np`cA&O6PPkUPz+YL<802WRFxcZ83Qnc{jFhvM{vYZPUM*hvm1FUfFZ9cJ7v72z|g
zhuqaw)EpDXKF9zA2(t>CA$S2f5QN1P88$GMRh1#!7QrxiZQKD`-0}GO$<6Kl?Du@<
zCqMI%mtT7D-dne8+4+2~ogT3wm?YMU6@EHh#ae8V57$M04$^17qN>jO_R;y_ORxRn
zyANN!y8n#ZiE_m$bhI=K0&SYxJUQS;BnDF*21b@Np-c2YHX
zAy8^+bvjG}h3>8)V-GV|*uh)Qt~~QDm}?TIY3W2fNT{27Tpn-nY
zpAn0tE?4!OPEWn@#)F4XuK(wM;$QvW|8KtU1JB}ovqv`rHGukFYM%I+RO;}6m1?_r
zYBZuYDS2A=>OMBOPLF!Lh-pqte-q(6&x5Phn1>%VWqH$SzGEQtU1=c_tf%ea`M)C&}SpGZ8vIPlG_|BJFc#(E|)s
zy|?_UWbjMZfPsD)F-kM?pm`}T*?G5)N2z^9S#AyHG1~0i1Z{ISxrXz(DKt`BYO{iM
z*QP|q1Vb=Kbm6?K4g1_uA1WdHp0m_>JqY{Ken)NB`Kr{`OlB-h1cay{o5Ar+aD&EUcY-S=qswG}DxL
zS<>9u4SiYWp#!CYNE|E+!)_Ym%VL!X8mosYtND~Ih^@PNZ}uoXbh7bmlP!auZSqbD
zuo_l(y=kD(#Kl44vG$o#9dy@tL-)+=rFKEX%%-tD^qKO)a1R1`X0%;^8>))KY%oPd
zb_`-L4zmtcA}u<$l^aMg(df93V6X2g*zVx1@9_8+#;S8~xLkcAoL&=ChM93+rK)!y
za%0}_z{f_w-x|yt=D5+7d!M`OXxAtGwHah;;KVX(LM29G3RA*6&QW1vDu~pC@x0D=mLzbCVeA2u3a*cpy!jv
z>h9qH`TWm!cb%oG0%}?Y{g~N!AG2~2YnrfGfN7L^4PeB*4BE4*^cU`p%i2-@Lfb;3}&akMUX!mgRi
z!Q+Soef*gsMJAojod!K{;Jn*{oM_4xXwSKs`F>+^f6gNV+H
zxC1|=nei}>Qe=`fKa_h_-#ocFpU+R8JbCTqx4-V|KlELn{q8J#d~?la+~D#q!=YQ$
z2nI_+gAw0iZA{XVU)kL!$y?Oe$6a+l8cBZ>em#53ZlDLX{rwxcz(
zM3lrCtwKv#c@Z$K0?cj{uwt=*4Efqo65Z#W6r{DbesLg%{HjKf
zBlvv5-N|SObQHE@`icZQI4D8$35=ZA0rZ2%51xPigP;4tci8fmU%1{k=(6mDmQG1!
zRdPr}m}KNSLew7^+BCnOUFCS|y;om)<)4}7{imJ{TlDml37+bi%u0d~Vs6lTXBAb@
z-_|p(g#gxj%!|
zOL+v-ycr^v5K9S@NE5Mb!HSa_Olw(03?`%g6L7;iiRu(Y4VVrFjFph_70PEXU-#Hv
zlS$AHw9D%rU^a^YcE3i<(vGhtT1ElQ&@x5jzu7^b36FG8C+K4e#|S13R|<&bSuIpM
z2qAZs7>mKhc`0~j8$H&$ii3l|3-4*GvMR{E6U3YV)E&~pL6eB#-VD~LJ|J>X=98BN
zu$V!?mK9j=i@RH9pd_FYFzvxliSvMy&u(M+M
zTC1Bj(RRUqbQ4q%@b>L9GOfl!iJhXmYXGN)322}u3JsOu(&%_MP;i&5%YZw)wC7l+
ztL3h)BCJ#AbCK+gQ3J^6@UUATe3@;|!34SHxM4|0WB_*RlSAoMI5|HXPagvgVN>@3
zV%#fHE#78tZT;av>5GMo-#f)x(Pj_cJ9pdv_>X<}fAVMl;PcPF@8wrtb30vK-KRif
ztrcPs1!0=eu)qLwU*IwZ7Tn2o*&3DSAH*2cAn$O4xl7_}rpuF67S5U2D$MFXz$CRc
z1vD8%F@;jYi^g55XnEo}qiFJ8=YdO3Hyn?Huw9&M^TPyWtPOf
zb7yXiOjFH624ZYrr&xoLk~BlLIx^{d`R8Oo2y}K?z=LL-$)|>d8`WDdkP@hlW%-e`fkJ5+yzFvYU@_4QZ{5U*(`6>K#b?>P-_3Ll_
z%QxSB$s7?YH0XTX33kki5b)3k+MJ1H;a(aqwCSYfCr0sPvE3R00nb)tah}Jd
zo+mm;3{CN@VO{XUrhvWHAyU@`vDPjxbyN_}>9^hB$e3-|l^#4_|%j7vFvO;?=#U!VmVGN$0XsihEw9
zu2P+YCCxO;2(Y=5)NK7)mvfa}*HL9A)hS8W`
z&}=FK+Vsx_o%@J7@6C>0)eWzc@E$C#?X8B1iyy@XfpZGVNmdlBJr1mng?LIuM%a~0
zBM;=aD}vY(Omrbf+Ya7Nvq0vSo1hlWGg)v87k3*+n(nHUe?|l5nY&eOGUGt-0`d04
zu23gaE<&l%!|Ey%oWyeFLbd7jdT5av!c8*ayFb_?C4k8zKzalEnKov8H8prK+Z4+U
z7TDB3Ti5)FKf^1>E7|5|VIb_!1J9*M7^7e%D|6^S|x$
zpS|C?v&yDrj$zesnYy+<`c>8;sxcHUOjAR+^9QzYGp|WJJNZzyM9y5$EK1X=`h1&q
zLDtdTL|Ylc_vXw7eQPbka}b{HQ4BO-b~?Ek_LfMP7_hl<+qtGzT{AhcIE&TQU7MmQ
z17uYt
zhUYMX$;Y#-d77ELf+Qjhk8U9o-7N
zzu`B0!_WNmANc$iKK<3NzL42hr~7MNv6!Ih9b-%35e;L|8hc-$d##{ruFa$w`$6(E
zHQKX=S2Y|XMnQ3ftjee|lO?!mdWf+V%q3EWAQ{VuJXQCWmpkY3VP=)7tf`VTyNzyb
zIX;rifjOq3rtXL{O9j|a-qmE}fU2$Mv68FIkKShQGznsr#mvC8z%cEY6;-W&6p*L%
zAElBi+T>Sg)+C+s3`j#}?$R#Pf;eOXRo#Lo_`==8%rFR=iTqWeMjO3x;}m3r`3$TV
z?TB(tmJ<_aVP@*?ycD|Rq-}=cuFnuzchF8IrkMx2sCztafh7C@gdb9Rm5HuhI+j#V^q}rTkrS+AWOVni$m~Kh
zacK4$@QCn*c6J^77^*K@R@ek4ibe30h^*pARi#TWeP;T2_3`Z0+}9(cu}s;yt2!*W`MgOj
zSJjL$*YUJMky$k-VCF=|dlq=Q8RxSniRjo?Zr&+$`5dzY!Ol#ex*3l7Sg|V9g||WH
zR7&ber7Ca667C!!o~JnvMcUASLhY)lNBA9kpjm6qtm<{Fo2o+od-2w#v>MR14NVPW
z{v?rV7r0#0I%3^B-Mjbj(Mzws@e9}cv4Uf8M`j!Mm3140>he>wdg^XgSR%A{-CW=7
zb3T4>^XBXCeDE8;`CGs3+aBLupLaS|H?2X9h7mU7?vUe-Xr)V!!7>eu(sqa6jyYOJ
z%!VhN^yBb3n6$dPLBTnwCt9KSk-5lvI%Dii0Ja0i((;YBNR`?Tv`)HwZ+`{L7
zP%IZzE2;nPal)f7qLzKtuU6p;?XZqm%YCu2=s_`HHl|wqs!RY?y}1#aRg4L&HZx*H
z>`wW~{a8k72e6^v8a~daY3Kh>kc^
z`?>FY`k7~5{OY6I$Lv2-uCJDHPwv$0}C8*I6UbI9wR_g;JDwSQ*5?>+Ub
z+Y(g7%EK&{J4sO2|Cv@1I<*`JP@z8DAT$sP@O&nncFK0Kz#H&SNEswT55|x2$}?-5
zj&Y3m%#KeeQc-WJwF)rh*Fm0OR_A@&D5gdX{-q+p+O-B&eImoOZqspcY#5(GW>h+M
zK}%MTzDP6+fqY0rE&T831T+yXM%N}u>N7JcxKnp);eS$Ok$n-@*h2#8
z0a34FM!C2j7r_;;&55GvE}7;nYKj#V9PG(`*jHXr)+_XIInMCqOMzYeaZkM)l_}{z
z8m>&{;oP9QYEp+V??DjZvz&#PJVRM)6baRcAhWd$4mUa+cBI;fLWKsY@QRH
zS>A$?7Eut(+6)*%AS`U;DmD}?Id@7`!!o<8_Rj9&ckG_{bCe7mD78D+-W8wOhp7Ip
z0uT`=t}@j=XH^>O%a(k~m<`r+gG8ctbwDcc(X&^{qTH{8aJL%+zTv!wj&
z#@+{XD-;mpQ^F#+HTNN0oye3su1&=~-28&e807*vYDi81>~kT6cmru}zJ)kk+sZ6=0^}Sl43(H?9L@T8Kf{
z<}o~?J?EJLQy`_6FJUyPRI~t#6z-g5`YBSzW!({4>8xkLjhZ^2;Zie)TV9@cb1`d1
z>i*E39etPask}r6wH8OH?8?jyi7Ip@`O*L(=}_QeP%-kpN3@dT>s0&H_ke4?_ueda
zx{4YlyF6(PG_2`o0qN9;%F)QL7zE3v;Ao{Pk~};%`rR{=5GkcUlO`*F=yzjz#n%rqTDo@-ScG6kDtaxh_xU_MJmdRl#bay=U8WB;w-kJfa7U}83pA~~m=
zKGLqy67`ZH_yY1pXC9;y(u9CP70keZe
z_X&H{R$y`qcy0H-y}7xruD9NJV0HS`Cq8xmbpP@BiTPS_y4+)MAVay3L6D!2%p(1M
zCN6Y0alNVWTjdsb$d3dGvc%HKnpstI(T=#;W_G0MwDD(}!vHLajuXLtp^xl(X{Bt6
z!^?FAD7Tpl0y~tkaSqb^K>^GAOmlS^gL)y8~8;m#puLYWfjhpEOIu?JqFYKRa23yF>$H0&@aApJP
z8Bp|LHY2TW#%=07xyMwane9w)J{HU)W|FD1!|6iDI#CzIk7}WkcOnC?4M`_@0<%C1
zHJ*O*^~?(|zGLg@pZYVu=fD4lKfc0lZuh91?5LX$tlwY<#s~2p!f|n=5VbVI9BY1+
zF^>_z9hhem-~b_+Y$l}c>_cFT#!P5*YYGvS#67I#_p7$>jt$t+xT31}nfPOygZ&t(
z0l{1VcLX+2yEU8b7`Pe=Vj{@J3iRyJQE5!$SbZMeQ}$^_WEYK;C`bEUjSX^AqKMj!
zS);nbn}Df}R@NaoQ?(d_P2$ulwXKKrm-1z}INn`5Ma5KhR+(d;N&1-qm3=<<&f@)&
zJ%T784v8`JjIyC5tObxmbgMqp!DeSM8j0%MWFv(-YvvQkUAc>Tw|%aCZiChCy+M)i
zJ`W(?fMG2=oty>0<461Hd-xCk7eDf+{-Zxw-LJm-mfN~oSF2Cfi^MUsrQ1QDbB`6#
z!*7`;+ags%yB!@)d-QB1#Vj?9P>n4%adDzLm>si30uC0&B#tmQWM=Mcv>Tc#
z06xIz+yfI)?SiH}orwe0luemx?W&hI-ziq@{9cioTA*LzPqR
z?Gbveaa?%IEc0N*ARo<}UL&}3Hw^5Wv$&!grU~JxDs@T>psjJ;DPU574g;8eo4@Cx
zeE`gkHOP>sA}k{05d{t=Y#p1FXQ1+`%18cQ^~LnD!J-#J)CDFWB)!9%^WSplNy47u&-ZUR+b#9H#ii_Lt>EfofM@LGcjjv
z!`D%?pJyb@HMgo6O6B^CSgc5<36`b*Xrm=hkg!t&hpGXFY8|fLJ1MV4jmUk}LELr$
z6&u{wAY>0Dt%ZM(an2&YEtN546mC_?QzvXe=hfU~R^C#YNS9RfDbeQ7G|J=D-sxcT
z{IQ8(S3l##%xQyQ*4?AXGJq0>uy*uX@zlMmr{8(+#TQ=rZ?Dgf;ZB1c)oZP$13(|6
z-2m%k&LDP6c$??EzP>r{+xOmj_~5H{e4zw2STBSxNZjXro2Hpu}i8
zXY<0%BZ3o&?ixdn;IdHph+Nuny|u`Pd25rL6lE{xfQxR
z-+KJYi?97c_U*l=pXRDs*Hv?29z#=ilUH#ZzIIF8@B!-scM&kr1&6C4jSAKb0CeYJ
z!yp*6iz^VdOV+y395Qov3qqg{XrW?j#H{Y1guG>Wht2IqiT&1+It?zexi5kHUA+&M
zySu8hG>*aWr`d>_2HVw&WA4cC`Zkx~
zfOw@V8&1sOE0+3R>-q3lYaK<3&)4DqNTe{6aw|@z^=IT-nJ4L?y2c>YrTlcW1q(mL
zJwKg(>6c&m^d~?1Gk@vF{*@now!4_yOk0I7q3rUfiCZ>k-*HH$GqvN#k4FzOCNUif
z1HlXRx4ifhxYTx?jICmIW$j&{g@NhysdO!2!*+(`T_d5)
zug1?NOsT>CfNcW9qPypAZUZ8)n`6x1N3q))fMmsxrAAR(tXPDiSK$7AkCV6ClbhUy
zpZM{Q|IAPS;g5XieJ{ND64vST)QV;9+H-F5CV&M4N1My6L83!QVj
zgj73e~79hZa
zXh|S23d_h2xup)-JS42Ja4U?FuyDwdAtb`c0t_f*E3m^~{LO!h!!iMau6JctX5PGc
zALpLE=A8a8#{BJroRLwLdGnmTe~-21nsbaX$2{$eZKg`&?RjQ&`mWB3HH6r>{p&rR
zkKHHXt@%+q&daGs8FwBuLD|K7jB1bM3b!cdh@?0vS5EEMnOor%s@s*~FKahCjwQgf
z&@CSzcaec;9h7ZxmNUXREB%2Hr?3rkHefmjE&b3n%H_d^y96A&+@B?#RiIb&;V{_Z
z)7$OJ=4kcMlq_A2yThp~qk{qMU
zdGbMvhDNiaG;Gx1fVWOoTBQ+Yh#`;qAwM-clyjn)44YkRzFi$#k92K)mY{Kqz;GGR
zAgeuPH>TZpmYf%uR*i5U@b>3tygJ3w=gCJ>6KM3kDy*ePny*k_>&*+2H1OTiyMT_iIs`0yybYo+EFxRwLGNT!QOti_j0RbpVtZ*ILIJI}C>du&S{g
zB&Y2*&Mbr+meeUIM(5=kaYp9%BrFKHUx
zFgMm%H0DuV2?;H#?2h0DLiNU!hx9foPX8NBi%aPbYrw7wwM*T)*IWdmZ#^fNB9U|U
zwO3ZTwFY4UydsYly?rtq!u4G!lxMg0pd(6vBsd8IAHDkM6CeNdFZ{wcyVtuvxZiJj
zS8t)>kR7w&EV~!B**)}(KD6qfTaoEuKfKc*Sey2>)(
zCXtqxZq?3g$hg4V8r@-mc`Oj*u$JdVIJ3i<5DZeKz{H`xNoHp^LW4etox8ica_^0<03nU%t*XkTZPm6ycI8&~Nxw`DpR87=L_=V^8HP-wt1U$T9KCyM+9PnR
z)rGDmZ$`vQ^~BT!&14xZo?aIfD6^ilXkAZCbHijV3S*Y<@ruyTKe662XY
zYd6c*^CAdT=G7oqn|`03&mM5vXs>#N)^T*RrV+Y9Bf?c^MyzrH5$)2l)WiotuBs1}
z0iky$PeLz5CaWKq)rG2H6o5dR;?~R8B$KGx!cEmC#^}uQ^2u#>E(|JlA;^H8D%FRx
zuUl&SuslOfU^s(=1Yk8C7VcD^*|}SNQ$dkhCJhnC-9^ceXXqRka)E(f$K|az#lQde
zfB4IP=(ql@zy8mB`>X5WVQaOJglGBMrsX^gfjK~MvWwGYYR1)zW_Fuvv58uz{AQ9j
z8R5=!#CajDlBTAARmicA=&}NZ26>ce*&fEFRL{C=vD%6eV@YkvgXV>{dcky^drQsE
zp_IgO+`e6yMA{!)EvaGxQw68=0cZdAo^QW(&1rNh)dcNoSyfxr?JIQsdZ(y9pQq|x
zg$rd+-KY(8=XO&-%Igd*x&uTkc41%9k}{?cdKa;>5jNRa-Gx}JUG$%r->x}#hII0J
z=)RF#+UsOg_O?s2-WPL=K4N7DSzFhs-@@LVg`K5;Ry%7Y9YPnK6k|xR8)fI-RRw0(Rs*QYx3Uof#KE58Chf9H8}hqYcOH-K3c}5b+UQDP
zsz}J(2rX+`TX@~xwpORq98>eSb8IL>XXZKrORuuDT+iL7GnBUE(IM*(Ds`{zVFl_rCo`mpGntw+th
z?9rpy3A`nM(t%RW{Tvc*M<2U$Z#9h2xg3Yi70rI*Zvk;;rKTPoy_01G8bSgHRKXOy
zv%hvaGpDhVDvYrL8a*RF^sgk9XR401e8Y-1ak)Y>kBH@cGF4+se>aJpOCFb2kP;8z
zi5jT>@3ua17O$Op$jfng`|iodpFRJ<_kaBVeYn1X;W=pWYAIzI+^jm4AgId9bhMJ@
z;(C2}c*wn$=
zF_KPY$r`20c27H0*2S?7MY^3^%GJg+l0BBj2bCp202RBtJYLUuq4T||z`=;?^$KWS
zobyjt{1UX$&}Z33)omM6@}qIK*Y4et`UzJy*VqGa_Jlcv+U>g+S+usQ~%3=#@b
zUMp+gKiq%qYv26*7ryxJd-pG%CmNL-Cv8QS_;v0?5QFBPKpm(7!J_8+`Kx!o|D(T`
zd42NMC&>sN!KKLsE+<3vG9ND$wJ_*aS%9vdix{Ph;vu1_Ax%j-;yiR~KKi6=+Tg~lNrOV_C^V9dZe(Rkz8O)CtR#3`F0zp;wW
z6#*=CBi0ee(L`b_#i#LBX0weM)Xs=?7#)WTSCwB4;h?%lc*INyR
z4D>nSvvP@NUgFx6vruPqLGne#@f)nEh{USq3DoL{IM5#j&-x2iHK5#cARmN
z^JsBi&>1DGR7}=7miPX=C+W1&jv*iqKVDTGW5|>kz^Ek)a1#pcj#JYYderx?^Gjd8{NMktfBcXB(O>%humAAPo9l6Ta$N3WtvHT#tiiKyoN_l9t0#Ck
zEu)sVhy(R%x{^`8JFjP~8r>LaIhh{C`1%_2E6F^C9rW!;QWt1-l9ItUc~akx6we
z-sZoosBTopS`n)~p{kSw`lDPx;JmLc8x}xqlPl1@#s;kFBqE%6(OkDRoC@Zxp_G9!
zE1p9RF8Xd^ELdIPmuZW8jy*V>ed#RFrV75erpq|d0X?A
z+>D5+TWy1Ck#J67Nt$$8+O1Cdutu!KGk1|5Akb7GiCabltv5+|b&l&+EJaZR>J%3N
z;5d$m13d1YemvIx@w-qzVm~Z
z*N2_8uh(m5yOuWeiyKFwf?GucXS+a0xA|(s;f;c
z-HptW8bppY91E5ndD$RfCIQP
za_>~TTTm5<7PEd)VjwziTLjlS(5qW@YqX$18ynK1nk*ID5w3M2;&S)av*$10d++&w
z^cVky|K*?g_ObZzke=$KzA^yQW<15G5!D`|{oG3M8+R(}+)gb|?I&1vlhng8!d=7L
z_ZSRHlcJbv)BW^{-TTC$omH4#Dn~^(2Wie~ckXhxcay@8(FkN(&z8GgQ*~eSWUnE>
zpzQkJee#FxmD$y`i(n^OO{&-K>R2l`x<||p)-EUrr*l~~bE;^Wh+;CejR&Cp!@fIL
zkB(z{@PK@eAqr+ZiskTR>tO4FPl$K8Ty%+y9hf}brmJmY3|q**j7g!{KT|uZO*asf
z_pjI&FqRNSU4YcZ95f?$Hn5gd0NC3xsNDaCOo+Tt?A_V91qLt+nW$!#JA!i0Jpu%d
zg(pv=8(Dbusy_BH{Eh$9ANVu>&L92J_ny7{=>9nFj&-ru9s)8^8?-{c&}Z$f2<)IZ
zt26{E+8Crd)RS^id4gIElq_joavUnTRDA~
z1&#JWm>A4h-8{u#9MP7}N)jIG9-yQIRk1idfl#F_OJ~2M?wx6IJjI}@W~=#dfilH#
z4CkPDCp*+tjD?QQ8vTBonVzi4c`rCrt)ga4t_NHCnCTGh&(^{GdOEsvYrnIXnHIwBs0{
zI$hJ{uCc>vBRjavjnT8CMBW2&th*|XAbtL$D8hir^=ZDU5P1jq;^8ghE~bmVGlno1ihQ=8LcP-F`?eWu9V
z?hsPHSQ{`hS3Jo%fWyOi2rOcZ2O$cGIF6M9PTcrmnm|7(yrG?*#jSCL1aPdwqjAi|
z*0C-l<1~7Wwx5)UE+zI-^~_iu6{!A)CAVm2m2BX$4iXhUbv!N=P`noBP-zjo3yc+O
ztwz7NfA#s#e(CGq{QCWUJ^%2kOr5u6SFokWaKk_dL-p98d4@B*Ec>I6-uuCi{{GJU
zPkiDt;#Y-px`ddA<3gs}Q{zJdw_aNUsNlxt%Jljxsle`zkThZy}uqC1yW^FFZPu4nI<!*ZaVdill0Q9B6ANs!jN@{Fu4f=X`73qf
zI7Cu&(Av-g5skQxx8Hf^8ISeX|LPz8{lDiknY}Y(85UZjPq}RnS-yei$&LAo4o7Iu
zlZ0Y4&H^8g*w-1VE~RU`bBv1PP9{{0hPiqDnAW>UpelIYQ+GR%3M()#AG596iUc-L
zyVemZsN_}X;&AZn?Ap7IW2s7MdovghlI5zzY|AdDt{;?`^a|DQB)hQ7{fRClvIV-0
z-d(Rt8xU1o2O(thU~P?YW;evOdNzz72zcS$U0km!xhGi(ETzswpkomlJ#zw)kQUA-
z@j4td8C+_Mm<_H|lff!eA8WBw-L!~c?utWpkbcX@u^6HH_TidC6+rvza#_-N%2xLJ
zkfRK8{y34Y5x5*d@_H@dygjWjf}a3HAZ%iV%GS`z09WwoQ{KPH2420+x87QR;n#l0
zm%sLzzx0>>pVj@zPky}nobZsDubOM
zq%lI+*+p=^vV7RP*yWlWXj_>>t7o&3Q})clZlFXqGiUE~4>>6Y`-(Ugx(CQeajLKc
z+vY~J;lk>HQ-{5Xan=&|t3lkiYC<{Baamm+h#=Rm#x%3Q6)q~_4ix8b=TWQBr!b%-
zpHrE^wRlHFrn>_GTrw%3G$2`iARgD;w_Z4gUaM+}
zh;y88h~X3vzZ}m|sB@#ye4ro}k~8VR^?VDM*7M{|?V`%}RGoT1GMLgrgYF5?>{F+y
z>Q{CREFE6xc{Lbte{Wbjsa}0~)0A-q^Kmjo9NVU)?3C~dUn`2nrq5FbXED(h$yb^Tp?jtMIPBUX(+<)f^lN4T4Dtm=`wn8zbM`o*bcC{ne!5>(fUi$o1v
zY}?^LNK?x5DMGC`oGe{0y=sOvNX?;%76z+aIGoJ|dc_UQ>0BZ0r(poQmsfUnuBC@P
zp{7!i)>UoSp(3V
zt{(mpxIB6Cv3-5-#qk
z4`2TBS3di>FZ|@4?|MhLc!6>oI)|f#FNk1Ur8h~v$?7Di$14-{
z7BS9{WO9UMJ(or@n$eY9Btx1J$IK}t9n%8rA>5VdbvRl(WHDCkeZ_dSn9LF-gIZkE
zY-Ar-hh^m`y3e&jy%{kk?>heBK63bozAdT!sOb0jyRa%HG;MF^_HhM-aX}vIa>N11
zXf(67Ly{{C0Vg`{>mdi$9UkXlU#mJ066c*VZSh*&y{iA{U4
zz;ZW_qE^PK`ntP!CD^f;o`L9x>l5O(Y=m`gjxTu+?t5aQ%7u32)|AxTqBlwG>jN|o
zv`dvnW_Ksa+!?VZsH$BqIq*CPP$EDV%o2SZYaPd-CW^39B!cVA35>8ff&gd_qf;WH
zZSMmGEjuQ~92tL;IMBS(hIuL@Gw9D5yN+za5gY}D|eM(
zh1)l3+ObNbR>{hCSvmZPGkT2@amQdcY8XP*GydwB{iArJNFt20#BOI(tWfG3ML?Au
ziBrt~w8#`}6XZ
z7z5q4w;EdI;ED(y2luY)PO$T#9FVFH6}o%0_O=|XZd|Xssu`g+d_TH*M+{~P+252y~r9~^Ux*OHJ?%unr*^R8;
zyM=|7`F3o5cpIzBcJ;shKlDsZ{|yPaoIStzZHjL1I!(qQvRBkyDKj2G0lI-L
zo)E2bwMwW*%+gXaQQgI`JAHNU+!O<(4bru<5CmHS{MrQsNKLg5veL)4wZP)*#DeXt
zO0okd#zYHOw3j)Jd9b3Src!kX)&@`rX_b`i1E@~K9#yhj794C6LS?FpckOGqiR_Hqm#GVmuSJ08g6UUS~`ZtfkcZ@jX9mA**Wbr+o^=4k_~iF?c9W{
zUI4}dBfFbR0<(zKO&z$tDV5L?XI05q9_1~h9qs2lJ6*7SFd_~#y3Fv;Qkhq&49Ka1
zt%bDf(+6w90R22;X$Bn=CQl>Ff1Vu3Rak(Q5d~9e20TR^>G0R}OljHOK1qd$>cABY
zlB!~G8l%XsP1nWfoJM?fca9IeMFpe*xCo^v$8mZ4IF9EZ{ouV1zjw{u@Cv`Rb2k;j
z!KDt{8X)|1qtaU1``W0zug{)6`}Ai%^UZI4YgfIwJ_Ik2VjNTcs*OSgnUV*wOzk-_
zj`z}!x_|;9S>kRKN%7-c(ONF+g2r`Uv+}ytFFA5ZSU#b`47%Xz6S^fAS`N=atcjO`
zqqx*vFDrvH8cQZAyCVj5ay4kRuX8mCS2el{WBjFI634iek{lS>pr^vS9ZhA0%0PB1
zi!&8Np0>VgX?7g1+vN&o1@lH1?}Enu>ax~Eg8BLe2>e-~?zt3h|
zU3;uJE=LeA?_a$A_9uV-=YMY9J$?S+YZ(_|oKu}(!=Zg-KNB=D4UGUgPD0?-{fi&J
z^PT&LS9ec7poX#)|J)PP^nOAZ
zlU2Tx0Kx4?H-Jx8KzS`op~-bfWgwcuCU9E4$0al#Hek)Z{&l(wTW7yp^Axj$l0itb
z?QnBv${sA{=`KIuwPw?v*#R{vbM#Bi+?`pPofJZMz3$^QAx3wp0XVxUdwWuI0$X$6
zBms-%L{~Cg)5ru&gOHTc40Kkc!%-&$9S`jt!JvOKjBsjB?77Y6e8qWM;XGXRSOBi2
z6nP?y^k155(db@M1f3x$45YgMFboI|R;8XUR28wb^sf7wxiu@u_e+^jxax5nJc-(1
zYjo||k=Sz#wGtZ6dhE811xLW8ic=$x410x@I8M}NB#n1zR_)qFt0FCYYZ(k0Pv(*n
zswLN=iQx`e=P&}4w1G&=0hBYC3-!`!XMU3b`gjpRAX@?PTsj9&Fd3~Z4yHZlnYV|L
z7K*_Y^1K8j9hf)(V1?#?(;UI%8(Ix(T_O${I>^d%t)(i@Ys#m`?3#(qE)!
zaT4Ci+-$QydO9E2WVH0;nyc38&M``&jA%}1WTnq>4UXyLNbebJd(-H_xn7iZAm&H{
z&w$}}O7#I%_0DV7mU>RCvZ07JPy!Hv+?q*q9%OtJQ@UZ%kOXeVEyz%o%JZIXm6eXm
zU|fz%xJ{tMAKc2E@cb+#-;+If2~|V(;oX9va$bQ<>6CuxtT~>%_4c)2{N&j`e0}{;
z=^Q8LhaaR`(N<#)vI{IZ+`3RZ@>Mq7jIrID>obGFED^uaS6fF
zAcr5DP2rc^r@Bfdta${Xmv)Ug))72z={?%=X(;*gCx^~ZI_RPVL%Q}s4|B|zqy5D@2sWWMduC)ww%@DAXRdME(qE9J(7ptU&In6k|aE
zdshv+t4l&_Iwh6jXLhAL5qd2$n7g|Wp-P+k>NUQ%H%ewd`n0}Y({APwjhKB0bmwlc
zgYL&>z|E+@zyr#9JF`m%jq9;qi?w@PMXY4mSJC#U^ia)pxHt|C{!LJ#iE0wLCHm5P
zWCXidrz3IMbGVy&3;SBK`Q6u=VpX`|=kNOMpZvT3^}qgw&wc8hAH92b
zT<+pn0$0OZ$;qRGmxMFXseM;wA!Ai0$hvJq0L}q)l65l}U}SY>U#Hbd?-@jj%NsZH
z)}M=d_{WB;gArAUadD@+vx?mc>^;TOM6h5J%_>JxON|uv6mZ41%SlPWGE3NyUYW$Y
zRmJ6EOz%k6>8P%qnVVfUf$m;mtkeRcX=^*Vj>cq$%9p(w90iqMiRl5ds|0|m8v?f7
zNR5qDUQFG4^)fNyL{{g!g2f4q>6p<2QE7;9{?p0n=I)B^3mTb*$x{D^=FD
zQ%3aY?gU#8R;SL5$We}>$Yp>3RugHB2ByYpRi%{s1G_cHlzv34F=m}X3HpT=-9v|U
z%_D&G1WfS2jHjGo=DrglP4o;^MGiwyGWD7H^Jf+3Qfn=sX;+O-$hQd~yaWz&$ze%ynnPB?$&5*8;FaEv6%{_FIH=q`}>0J9DzghL*QZZINUc
z`F#W+54>PdLXsk|uUBglF!N?z0(d_;>Z*esN?~T?w-kh2-8j!3C9#kBw@Eg59`a72
zhQuRRwG=TfKpJpYIecDVv`xzER7~`=Wmg-DIjM3bLmErXQIQ|V(}?=;`FB5j{^KmW
zv2+$t=mZq%HIo@#aOJDrL&wTOa!>i0ILG6Z<9`V(9
zVXrfdafERKAt6nXw!%|xHjl1LE;6N1ooF0!0I`*_(1?%M>Qt&yT!h6Yem+xp_mmra
zl%Adcj7I{dn`YVeIuVr{uzph@N?@Aw0O#($>&onGYUP<2TEkQw$053Q=dP}S7(EghPi-jiqWdNts5wt@=3@3m&;wA%^{n@pN5ibDu%k13ww
z`g*hXipwwj{4e~5&wcLY%ZIwsMRK$X+bLXR(bm?|0zw6Kh8BzLbr3*SKJ3@;efZrM
zuim@6JYgKJlq8+m8&-Y>f!FM|SPph~OGa
zy5SK8m+H;la`4fjVoCK4MD5&zCAU<`4*w^uHW}sO5^F59lEF0;u*9dlO%w5w6nt(B
zPkYzMoIBI>CxZY97BWoAV0LO&N>Eg4z|9qsYJrwPC!8MiG?1#V)g{+FMtdNi#t=6$
zfVX1igx(1vdLy&b2(q6o1^^aEZJb`l$U1NZ+;```URySjxD|NnvmL0CgFl_vG^X2!
zB-aYevvDEW+C)XK{~(DNke<_!P-^RvhT@1tsCS5hh`lJ+BG_Dzu8@n$gicViX;c(v
z8A5Xl?)uXUbJvnHQH;vMxTdKd>3)M`3g-;2;|R^((A@_?u63*cR>i^NZgH*e{QCEQ
z`49f)|NJli(q}%k_O23Rw_QR
zAoH0Xe-y#1O1P9nX~3t_tPuS(TY-Yk2PBmISQjfC5~>mQkrKmM*~bx$-q#YM><2wZLwFQ-GoS)>
zGB!r=uy{ywPpV)h-OGi9v<5nlM`MyV#T%#UCirua0_owYhJw4Bp3+~#;6)K
zphPhR)zVq83Qoh)@8WW|io9mOex1MN7eDrY`>+0|-}u%~{qTqHFxK(p5=%n-MN%^Q
zGhBD0C}{Nj1T0p9gT$)>zvnw;0V}*5_!#`?8b#W2e2{sIYvY&%j8sb4qAhixuYv
zYLs0Sg0b8OaeFBPx-rIrfnC)a3TZ)vwwT5?THhg>qDh-At0tKssKu6WFL1*^>a-q;
z!W314J`=D$xBnct+c@0VsKOPbBij)+z_;CieyywKSggG6hn-slp}++d8{O&SWIji|
zXFc8EE*$Bo(c_<}uhYo_wCsWu$wzdcNZ~~P|No582d^U{z90%#F?YI0-+RM=Vl%fTRU<7IpVgQ$ng+SUNC*_fLd^?(HiuvTm`Px
zoMyMopw3g8O8$8YoaO`F`Y~10j2qN*i}5bOt!m|*CgIIknL9mGQD?a0+XOm4GiMQM
zSAvV=9@^GFr=rP$%))PJ#$(0ZlXZW6_x+E)`_K<@95gwJM>L%Cr9yWM?}1ip7~r}o
zYc~??7cV~g#HT*_t#5q;=r{F-^DMMYgVsRmu~iotihfT0!*CU6?>nyR@Ct&amxn-B
zFgcW~X&CIFE?!1eCBra{`3WVBsv;N1+HbkTZ*7dg
zd#@ycD}XQ;0X&&oCzjb#xL`O*zua!vv)@3KjJCQV_l#+I0>LV~p5;{kiahdWz+lA?
z4mKdCvOupSLo|+AIoBUxSMIvCBc5hYTPU5%@{SK*zWDgZKldAd@mpByqYrjBGiz^y
zTgun`b=tK`ZS>ulF0{%3X=hgLk6wN7?z?}#>ec1x$J))LP4W<51nP`&bTKa2jD|UF
z7~|>Alz|5J-i0PQ_q9eTZYtPakuct7G!^qIB^)oH)U%=FJaemX@2nLeLQ;JlGhiBo
z;7PqEy-Eve&Lu&cq@mHZ&G*hj*OBt5DM96xUnQo`^Y*Z(z1EmksGD<6au7Q+t55e!
zL!2e#x>SalJ9Ubh@<|phc%n}^WNWbP33M`Xx}yQ@bhloOT?1{Z3~Fd-HPnex)I^Og
zrACr4Rb}p-I;RmS*WsZKl+Fs|>rv$DW;vaw7^tL#lT(koeNbmA@aRVkamJ_;9FF<~
z(Dh_7J?~y8K8nz7e;5%S&92S{L>UKps*_GS-X@8N
zwG^01+Vy$h>aeFc*X1tz_(%WX2mi_+|EK@6|M;K!#9MK_&jPxz!q!$^OmnhA`>p4&
znT({3W%x%7R8Kw_7FH>Bpf;59vc1zZrl4T@`_5I*qtSkFvy*~cgNy7EVY#%pL$2T+nnu?X1S$~!&>ab
z_1fJK>Ec;6TOtR2F{r|K8VDiqQ?rS;fekcsCs)4J9nG+bVWBs#C*-K4g1R48UR7tjN{I1h*@9shs_O7hj
zyR7{NE|<8wiv}|B;-mWZx1avkfBRQ{>u>pu-~YjTh`T43CxL@J)^X{gBnf5xu^~sz
z;a297qon=SEI-IxjPFbw|Si-&Ec-};W8LdTvHjabL#Y(z^_*$({F;l
z25m0?jMA8%_BsEKerA*@IvvPhteO)Ic728?`_b{Vl*i3sjREd=RRq^@R3T>x?OoML
zR%kRZ2ax8?4N$
zTR&R~?72QG!h@g({7`VKiFoE|aT=l&(5OyAhDiWK`xi8VHBP-7D^smk-7Ww5iS#G<
zZ9%j>GUu$Cwect(8^;K}LNoRPi$IdKGbVRmp-rl@<2)%HsKpjEd$)-zT>;G6Wp&P%
zmU0hm2_*`UC>@-vNrz^&r#)FcrF==}y3thxn_Zb(!^xFT>s5?nxpIRN(&%wgk2u>{
z(h3Q?fsrXCO^!BQj=*q!F8P;ID(fbQ)-xAlF}$nVYm{@KD*_IlIIEOf&8gc~K4f9=
zBvLK~>#V}f#tN$*4p}LvUa{=2XBVSRv)XRyO1isZEy{`loD5NTgQ)uEE%!5Pt+bYt
z#yfMG9XWqwsdF$YB~|5=3_U9W%KCLl>D4m(R`s$AAVg@+DFA4iLY?;}QdIxoH1oU{
zFaODffNB(ub#%RW_R&9j_2vTsKZ+jJU7ZxYS2s!@qJ*?9OsGvRTsz;acrjGv#J}^qcEq5V)6u@E|RKNSEUk5G_A6LuPWrj9^Y5|)eW8zyz1E=?z(JVAt@
z)#IT~ANOI!$-9ATEgoW+&Mv4@?4VmhDG-I!phWmjFcrQ55&yaCLUz|FwSH7}`#Rmb
zIT^0geU%r+xyfL4s#2{}feC1)%d7j>U;o-SzW(i>xn|zKQej=qnM^h977%J8!$%nU
z(R)|T=tsxh<+wbFh@M7>62WD_%O$$4dJthZK%d@z{Ll~!=ee94
zRKt$iqjjba$_|oPoFm~pE;=g*&H}{WW;R;0zru)XS&vC)G!$?>wC7xTpBz+=gB%)M
zQZnGSJ@k*x1_k{1f~{Y(xIq2_oPA(;3T@P&Z-C(R^koHMe4bPJTLJEfeUN0
zN-E}l6`|%URxl#vY!;{DhC!D@*p++lzzgQ_=}Q0qt2E)Jul&CM@IUw+mm?k?_BxhD
zJ2n>EXRi>>>vb7?e(}6hMI)8+`icl12dldi>j+6IETg6ATE{WD7OClimZf>ysq$Pm
z+|yqdf_`tazzgf6Iu;
zIQh0sef-E9{$01NQWfvKHZYt$-u^HKISh>@1cJHi9D7T;d|jkef9f|LF#0qYhcX0`
z(u>AY6PsU94?0uXvBDz7U}c5z6mL`g35|H1oD5A6%u4W7dReea<@)GtH%<~BRn*}<
z`a4_}pT4!YnB6a4)|b9~_ka0Y|AXKAdw+0J!$jFtW+?Xbk--YV_o+aoWbC!&(w`nPXmiB55&HP
z+I(BYqfM(}k=l5|aKu6rLg2vPTwFZ+Aql|qs1@NQjmX@!lfYarW+_=w;$#}AX{gf(
zU#&1by>=~12`D)V3xy<7+-E}P3t4;by3PQvQ-a?BmJnRFym%N9>j1iH2$H2SJ750=TNW=NwpiVbo8bMF=i1P?tYFD2{9iGrp5pg(t{C9$Z;$i715UeAnRHrQ;
z9pSS!%^x-$pS~%8-HD-eZu=Cno*N6S`
z#jDSM;R|2-nJ+zD-;jN*i)myPX0aZ{7UzD-se#TG?>MQr1G#=uX|p`EyuIjbQ{tL#
zl_6fep;Al9M{c2S_SxXNRcBK&C=MIU?8>!5>nCFAFrLVTN7<~mwj=bUav??aX?Zy%
zxMq1pkUO)wS438&e_B9HlYwwYzQx8aKQzI$BBDm8M=-4#pTmhjd97kX=m-
zkbxVLI2HWqT&0De>Se8UtV0GW!s>QzP2ChdwYXkAyj*elO~3W$Kk=E5fAIdRyjEq`
z)|6L6F5Ncm)MT?2kp1dOO_lP<#mc(w>#OVYcc1o?CYm#5mv%HiC`Fg@~U$4Q^9
zpokfzJce4`F6Fw6@=2pTwyS91wLAqII6qT8
zG}UX_TtXSc8AW8yYUZ0)a!X0>o9P-r>yjBp@
zsKy&asM*Q_G)Abpv%1+;ou%#w+Cl?LEU9KQPpvSnND&~_-7V$Ughrzg3PjbdZZyZI
zfy3v4iGpVB+V&^R2~y}sG7JOXdPN=y$N&PErbh@T)3c3pIv>%MI;
zvmTw;afD_vEc>;XD8EhyV7U`tSd5e(g8kt$27y&f#&49SBZ0
z7ati$M3fhLS+#$R^Ca8d%|i$o>u3pLPvBHY`Ejh8UQ@
z!!480=L>0=<_WB&hQ`|jRBh7g&fS>+WoGLFxCBfVL(>$PgP&<0p-!P52X>}OvG)+bby{V5=9abZ1J{#hMl)1K*n7Xxd+!pvDm?=o1{DE0
zz8GCs@ufLUt)mOm?UwrR*TT-!u$J6csKZ#e#4yIf^$a6+	pTc8=UWi9S@Ntrfeo
zw!V>Swra0QeSYTVt>b_
z=V=9?#{EQTYMpFdi&TW+pc=0S<%BIHnn0^Naz&`>J(&rwL%Ew~x}X58w}uiM2nnh*
zaW_ggivlpfSx|KFq;i^tY42GtBIUB;LII5p2$1fB^(o_Z+*AIPWg0^(g>APQa|=Dp
zz1CZ5)&Ls4GhvmKZ!;^qDpsf|zI!^-35liEZ-wsMS&d_@wJsWhCJAwk##>J@vtq@`
zLu%*ss5g}=Wo72I)kf&snHEc+^&}e_EMMbLsNgmQYxh`HN1&?rwA;)|QF3BG6ul)4
zT+B?6nWZLRwNZ3gLkDu?$6;!wYVs>76E#<9VW2mfY_zY^T)dZM&wE$atw9FL3zQLS
zW08RwA+%FRW??oJ#s?U)06apLak;x(AKriega7u;ejY14S!YsVsgO?Dpn0ijHJhJd
zq4T;GG@pI&?Bk#O_;37;KNpBM*N4T6{EcW{v+9g6y&cEg=
zZjre??d)tN#8l_#6PG19|1b%m(|@IvGNGMwnxR3jVItff5xS^goN{y(1`Miii)Rba
zV0$FXJ!V79&G&2NixzK{<$=p_9P2>o=~RHnaS^AalstmRu@>?C<@=xi{7?VlZ~E#k
zJbUkYCL%FN;LyS%K#|C-Z1&lSK_k=ws7(PMzIgBbXWwJ=@$_Q?J-F2Sa6VuVR1b_F
zi-CB8ot-w&^M6p+sJmE0)`dYetZIU*J$x&xa#^R|^p+e}nL%0IR3FDdBSyDFGS$Vp
z?71~fAYEPATO^x8ys)&bp}h#9AlwRp@Sa2DZZGV(sc?4dR)w0
zrfR7jE8^fR17C%tD(hIsv8d4?!3Or#r*YUt$%>%dEfZCpM$Yeg%w-SeE}dr(kgBZ2
zu?UmY-WqB2S8jQS8@#(*#45(+vb5iO0_9m`olvi$eHN;b2@!2dj4q2$?$$b(=#O6P
zr%(CU|I^?9Km1pJ-#_~9dvC71d-AqUx;VlTg>goWSX|nGmdE)>EpKOlYlYSr0C$Fy
zfXx^zzLNv?(5*VJO)@_g1WB(k5R!P>DJy_+m28)e1C}11GY?P!sfOYqQ0fu}mK
z(bZ#_p+!GD%t&9(4DRv23{s5qm^RDA;bR>MF}#CCH#!|SJs0kgs6uM9fQ(oXl4c1e
zoTukrabK84F;KJIa_hKb_{kC=-Ak
zxM2%zhjjofv{Fo^K|WJ0D
zTGC~i`Hm%#MRm_;cXHU>(9|o{LelCqtS0R>jk1va-%i}#a%0j-6|pg%v3gQka^+sK
z>9iueAT_D}(Mj#y=|=$grSx%GaC^mW@8w&3QMAz-P^G2MSZ+nEU0d7JvtAo5WN>eS
z>!xK0+QVduS~Ox@#I$;2T1$Zjlx>FPROczmF!|&qDDYjoB96=5)3?^bhtI$F;fr^9
z#BsT-V;LjUod*#{e#1J2)s9X}T_lomW+lj%FJE12f8(3q_|&I9_4486adFGEzEI4z
zo59u5BdXv1%C;3SjLz7G@TT-LndL-gK+hU{6Br&&C7ue?7{=A@u)~_1=cCNwy3d8b
zFquGF$$wh|B#+~W86lbdbKB8PMR*hqhn)M)XRgZKKcKSK{Eo671
zv5qBmYxddQsTfTg^e@8~>Ic@CW(|z;q3V8IRj1vpamn3ohj!R0_jZntjV`*z-dTY8
zt^2FgrgAwJpyA^L&>ldqQNzZP`Dn(hTVYIlfXylsCjeU3H2@J+05$K#7PQJi4cemw
z)Ga4=2E7Oj6)(#N8&>NGw5&5IaVy6K9wd2y*tHAYTp+Txa5UQZUT3oqjsUpg(AGKb
zp1!=l{_qFy{Doip=l|rd{w#r=#l?nIG_xotr#eF$=F){U3>Q3y$%
zL3>wccO~M8DjUzD8k$*}z1Da>)0)+tm01zZM>M9+56SqaFGnC6ViB#`=uA;i<0Zog
znFA4F7N?n88p|2<3d9ivu2+w;s{!;C4a85hcn!*#Lv)pJe)>msXG1x*wyp;=x}HXOIRa6Q4~E1z)I(4fNqvq$V4^v?glGyogX+B?k-#r)p+sIzO499
z|98LpPyXpY^rIiXcYnX{p1c)YL5HDSp=&K3
zhs=%Z(MuIck!FmY^NK@jxfSbmW@e#pF|43cWh!w5quq@aal(<|`L~Ks)1(Jwx7yk|
zq#Pj!@Akq5ulou@&6Y#3QQjFfvkkO*GfnyS8T&MdSfS%4xUM*u;Xx3R_NhOjP1*;dZ2=HtC?SnsbLKe@g@0BBn+jbo&4Pw3I4IAB
zx?C4WoJl)jLVB^vl3U?il_Yo#urg)Gr%a0@t5Fbzq>(^PznBs;2E`vrQCwAA6h*J}
z(AZp?b@$NqVCJ>F6g)5@?X;rHCcw%~%Du%~66dRRlBN=uWwQF_DFY*k7~F@|ZnO8|
z?3PQdgDr{fy;DK>B6C#g3Hh;#f0`y}mYuy-XxTzd*`j14GyVbs*A(%(+MJw89iUpO
zv;ZR(ih(CjE^ohl`R=n1zmt89bu1y%(ixWCk%qv|&9+q%Y&nBCX?b)1&{g;MZ=SvX
z{4<~Z+)w|^mtNk#s><+6oAYeWTP2PJ80$DLB=_E(GWFGiu+qT^gPHt^NR%?7yGyyC
z);_w?k`-tgGZbh8R^FO;Y?~j1dpcC5vwGAS-Q8I0pd}9uVsK4LBOthyvR&=DnXdKC
z)I^Ebo~{YKr=Ep=gW_Olu)EY2=a4#x$h?>N(ed@Ar(bZHZ?SA$pRmYK@lBwW^EC#z
z71$GAQ-%T7Vg##dZ#CTVtRiqWDFBE@@Hp1XhnG(-Z~ww?`nmPw^8UMT_Qo~4WEE)C
zhawpiP{K{ox`i2itbcX7UoY;TzxUpEulx1g)3;-I-CRjAbCm;Oca?jGirJs~C*%Fsbrm
zbXN&m76LOqj<-iFNW=%8(#nAV=Bm{GLD&6i&IYMtjO_FkPQ#daX0K*%5EO%1IbbUV
zFM&jxqIW7r#o*=Q+ep~zIm_)ajM8n&A+t?1261+u`4PoPQU~+_W^|rNrgJ3S>4Z72
zqt&t^@LXAzUcuR>*uaW77&ZH8BTg7EIpOzaRpq$}z8tXHXp_
z#r%#_1=6}Ow>l$ECUfz&x#wHXleeqYHLB0a6o7p;=AAgsV=Gk0zU=|0^U#{5v^ye}
z;5IzEJSYrS76KM3SEYGHFW7GOt{}JwvoWZw$|Bv?C>`IF4MCbz%xpExXSK{kBJ4@H
zv#2RDjRq%m1Lpem**&^_Z8~8f3}cZ3q$Dqo#ihZ9ni}o>Zf(ElfkCzXmT0a;QoY7-
z!a&DjEQ`=vML7D+o4j84+bI3$GVGH$6A<2UB8a!20vSXn{_w
z5lSd?GZ)tGz?`M)dU<(GnA{V8u;>Dg2urA9%3geP>*90D3&VTa*L+UVgfJZ6x9)d-u+NJLf?-YB(jdB!
zgObJ-G&*~y#pk#DSYg>o5xPwaA#E|$M>)8$Yf~8`iWi55Ba=VBz4ww^ZLp;DV8z^$B)T&O`mZx>us;`_M2x0B}ps&TP+E_i?Edq#7aCuQD}tMvH+6NE-tq
zZgX3u3=QgeYp|-edT}BI3`TGb5Y_HzLK&Mxb?usYw*9DIWkBjE+eOk+(;5!BTgzB!
z+|ImSmCAUnO!8RsP^wFFDT9w5rON5dff5>|yT!C6P2jhUTb)r=RkZ;#Tk^Os(;T#6
z(P>P+xeNt|}rH7^O3#LmeOh*SfrZgCD>9{NMex
zU;dRp@eK^w-rbrXqb5UP*fe(Ie^4RXW4G2;7228e+_{QY+9W-zUq5qFLIB2>Qb=K|
z*k({8GyzmP9XHTEoQX~dCF495SY&Rqps}Qy)_!jgxjVDCVsCY8ul-Q_TD7}&S=lR1
ztX2)$GfVqCWlX$xduTL+XzptxB91_#8haW$dy3|WC6TKBjul*#!8N5IEr2}kLTh{P
zx?UA8YG2#jKzD0Et00vs4W}3}BWfUX(bSdQEorgHZIPC34Qe)SYELAx793-Qum(^XT@hKUhnlpEHcg~18SasIQg+$ecdT|SE)J9n(+}mG@OA}7=H3FJdi>MF1a
zbnczCw+4+Udw67ian7WxAzr$jxphM`A7UwGRW2iRLbVNd_V&bJ^D~ta35go%${MCf
zIf|>c+0LqZ(Tzp2&-mk3`Sh=&Cz-UnOZg(Ij3~nq*vGqM0!m_ZLwdAnvhtQso+nzK
zrtWi`Nl=IJMM6WS;(oJE=1d0awuHL1EJoVah?7JQVrM_8IRtY&MGA5m(07T)Qf46^
zhahWvJ}<^5!1+(N{e?<{0QAJpaN%QCk_U}HQ|{MZ!%Oc@RXm(vwZT0tZj}kswtbcc
zxnAX=Pn!|AL!OPOVz*Y~N%Jhp7aUBQDD2A8BSJ)k1aZ!)1u2>Z)$D-Q9a!cG
zbRv!?>vBAM_Pu8xejn&K25=I7*$CL;;jF6RdhIasrZAhmue)|VfB&QVH~F=%e(RH;
z{LF{1U!WLVjzy!zQ!=2PRITu0+(B84WJItVFdkP}WLI{X#_Y*NUBhNI(IJ|B=1Y$N
z7tR&MuR26^RY?kKoN6*G{nzW>=Y4l`j3(7lHKfkO$T
zNmSelYF`%DnN6cH=#v;)8y@J1OS6iWi3`!Is;g@lB=>reMW^C(La#%{{fb1Q^J|~^sn5Ru{+s*PGF`59^y#GM#bk_;GDn?S
zsP$k}@f5OHuk+PA?|=8@{RdA!_B4(=jf#Z$WI=UCqE3awtis8m0rL;aFaqB2JR2ms
z2_&kiW}#IWJ)e#pG>B>m$H@+$E!drQ7oO=iavewR;__pfE3?*8d8QLrE2`#TZcTP|lP!7>L=aI`g3OiuyF>)K<|KyppahJ&3Zh$G
zOX>Nj9#AQ+v|IBg)EVqL2UB?fj1K)g0U<=g?@ogN-McGH4BZI0(~<=n`&pGRqRBXh
z@);QeJGj>6c*y?Y4}bE%__KfT-~1C_aaFu{t_`4Pk>0k?M7{G^n)ZRo(uFM2c+)gs
zlr=eu?`M{FcDw4;0b(|o*)fWO9&r;uJ;|QbxrY*$UTJ8_p!o;MN4XAV6lN?jhadg9
z9%QF%L`#gO4WW98aneM=(00MPgvaF2(;d5z-2twPj7?<>*rLEKl?-N~Wx;YGlM~b(
z@w>plaam+#+K&-^`pv^D@CRHm1D6Hf
zt(~3My1(zIZ{aWe+HY%K|IXk1fBn?wKKJC~Z}+R0B|vVcSZX`ItsA(oT%VNjZ|MU7
zk&06)I0OuXuvTPuW*y6vkcw8$lIrPsbJ(7|T~+9?wfgpq#crUW&;>$7T~$rM?;YQnLQzkcqU5S0ItTi@i
z`uVQzQFJxYWsje3WEW=SX#@>$_-944_jui2@R0PRp`J3-r63ZwvLmI{eZ?XsKt
zor`A*+LH~$8nfT?go5TC$8iZDYRj#&=R_b!O9-uD_vKn~X=h;!%T3Jr#}?hDSEhi_
zWUK-%PoKW}==nSE|AQ}n;pd(lPxoa-J5+iPs8<$oJ|LAaWlEq|L=`e?t$uj8zI^%e
zQ@`P}KmElo{x|=h|F_JOeMmJJuptxC=YW`S%LHvF
zHCJ~B>_;GpK#j&+Xp$=)oqSdCNUxzRx{1s!T~$wCst!qQVZm*@l}ygb!p00>RYj~a
zZRLdRl<(`S+h~Uw5A+EdX+cL>&&XjmASsKwLj1)(
zD$fB>h9_IJ*;Ii&*W)Dh{KKi#7y0V`1^ekYzy0lXdHUh|_iyg=;Y}JdixcZ&Ywu|f
z#Iz5q5bqvuWT;#0`K$Loc=nIb*UQ~oHp}kzT!=X{+zV3bda{%;)5Ahq#;-)GjYpZk
zFhYCSc6VzCAq|6=n^kXv7T;Q-IdDGLYYN&n3GSEL+&dXC!t2#2s!Vx|+I7Y)(;6Ri
zS8gH44aoM;s9KeaE8nE>Hc@GZTi45wD#&3TgQ5kMWgf>8;m<&7=;*mmIAYe!mgPn;
z=w}<@A;LrT<ckhN2M&QiRZBviIxCEz
zOYL)FS8?(wrQg4zr=!Sbjf5+&O+p6o)o%4MYCT(_BF
zmW{Jj@8YIsJ~aSMl(Y7P>v-7lz3=?!PyXsZ`)B{nZ-;PhpSIHf_nDoYe<|+k1ZnT}
zK6M{(msyQ+#P&!!8H}%UmipPJS`Bg?A=bU!U61aTNLVg`+InYilwy=lA3b(ab?uH;
zOJVhP9`1Ku)emfYz4n+{?p@WmT+SJ5)GJm)9E_&-RFkNLPImxK_*X-h3X;r+-q+k&
zmCZ?*eO66hC48OO4-H^l)WT=_SS%>IWAW}uL||rl3Z(ZqSz*k2s$CFmI5}>sUsOxI
zc27#xWMG^IdpueQ#D!%Toccu#t%)GI_BF2$xn-)fSXG*6CelMqgH_d@KiQYNsI1PO
zFbiVbhGmp_O($E8+$L$Im+l%;&SW~K*H;4)C;aTmn9n}^G5r?n=Y}pKuf?U6fZ-lF
z&qvG*Dj~DwymmJ#HIf(ASPM^|a9skyS1+6BfB(<@&R_l2Km5)Q-?_ivcTe961Q4-S
z!_$T)C*TQ2jT*&uH-^>G1xummoM))5GhMrFH?v_P^(nwbbZMcxi#}T1Q(>Qx7D|%>AQn?pl^gZe!)X_L}YZ}W3G~Rwq_2MX@UlluZ1G!ploQ1An$ll0i
z7DK-Euy&~O#Ot#iVLqzlYdU=j(nbaC=;2xbRaJXNe|NRJH>CaPZgq}T3vHwV5!`&p
zX$Zuy8FPkoyGt-LlM!Vx+^vWLkdGr3Hxs+}caG|J?s
zj9ye5R0GXe2N6AbnIl%LBaXG!G54rmY@}QF0_QTY4@Yre)iTmU_!F
zz@P?M>8ugIs&vqed;r;bCSm7Yd%!iyVkq^`pRY_*f1mI1yiPBPeeEn!dFq?jqn?$}zMDUDb~+ue;X@B^9J)?J7TVhPIt+V72D1#`|R4seoPZSywuKC!6*)O@HMi)_a;g^XV%mB6TaHz#imyrH*7T#ie3cja|I
zs7sL3r+9)-gCLsbI15Xa3PE)hPZAn#J>lRgOGaAcG1BMh{fKGVu8y&m
z6uy?h@tom#dkQCB;f;JIwFZX*o_1v@Za8M)Drn6?qJhe8oPEMIY_R9Pc8aHJd1$#W
zD6p2CqDvrF4@{`Dw_w*e4y=X3;`t&mp@b*Ast#MJS=J$!L;^P9AgQEqU-!=I?19s8
za&8AzxUn4Y%*l?^wU$1Ba4yYRq*RZ6ZXNS#{T-NS79ZSGOam5l?DQ#Z7CPAw@2PE1q
zUw$(XsNTff(cYGU^h8fvR{ABXvhA$OT>#f5*0DGZnZiwAfdQZ?GQ@H5suUO!YZPVS
zENf|+C~&Crm}qLq0?e-i4Dqx=?YgVu!k+OqlluE1V6kLGV<-n$+is(`gLmlf-X
z26Fe#+SlSta_YYEA%g+}H%;smMBQU_iqIJDpp>K~ZzR6~tp&LlI#`5*gXbqbyvf{^
zI~kmwY&zLcDQ+x`GY=v;M%ilq>uivVA!BmNz;g+nkegyx^}0l6?n+WE`qS96SToTf
zf^kT1nK-$9qNzbOwKE?c5{2Uki4S#Gs`KYmlld8gW1@SG5lYJ(^szPAf$}`5(aI|j
zIfGWvxH}LFap3;GBl<7?`QP=g{Hy=m55M!1eBj-ax3y4Z1gd_y#<}r)dOCiLrLbCm
zPmqZ5Xm7#t11B;HoQqsac6oOkYh3_TC!<4spiTJ!G)OEV3LDb=h-#ZC5y&bD2NbTT
z1e&Nvwi`N#l&{lmzMci(5R_66uSDA>0nN=uh^<=(wdv>KKhx-G&V?n1j;A^zu
zhn|KN9NOD!BBR|a>7zPKL5DNiTZDrAKcT}>>t7zHZXF~i=yDy0Hr-k=Nk2%gwa)qk
zURE(Ml%49EXO6B1={Z{s_>83n9s5Ak9s#h{qWEw>kK!nL%G${UDi}u`L@41j{;S|e
zPEN1=QkEy4wCDxl3QCJ6LbAi^8;X7!O-|Irp
zBOY6j
z(6oLi3c7`s##9zD5{$ZDuY2ztpK6X!f=<31kuV99uGn8L-mcqfJuMp%faiCuvllnW
zaS^ed&eC_Q|eDc-x
zb#STvBA2y(P`WV`FwPiGcZ)X$Xcv&U2v*nbT~0Opn{&^wUZAxB{drDo+Qh7W8F`0`i2^109b)bkJDynba+flkUSlT^Z2jx05k=v4Jjmh6Gq`SQ(&@4olz
z_Yco5cX#TS0C0{IbM?i^dNFtm20B6Ss|Z2TFg7&{?yAv6wbeMBJM{*}dRADH{C@OU
zmGCX=nMI_Nt;^FY7|aHv7Mi6ERbW#z>N%5W5A!5X)^?KY;afzPs>-l`YvS~ilHjE1{`-8O0B&jTa%UvoCNx0Vrq@2Uc@%Qfv|uTuo;$aT^UciJQ(Bc2gEniZRE!B-i)9|IWYk%m3tm@aKQqv3R|f
z%Pn>+VeK7pdpX+elNZm4uBcBvzMiP+$~@-8(iq2y278JEALx
zd^?W>axLy_Rd*$phoQ$>5e(62Rh62o+)iu;(TDn1yL+liw98<`LY|JA0MP2`GM_!h
zKLGM-I^%j3b|dzoIN9WJEcJ^jY--w4Zd@NaRv@^qAjyUFumEPtCjc!8KmlN0d+$#B
z37cmoxmGBLrx<;A{&ekvY-5bd_0A;SfC_s5I%6nQVXY7m0iw6ybnL6TV6Ccc2$(ry
z@$602I^9`ZQM*pKR&;lHCW`xMGgDQuI1qh!kDRz0DF;k#A9s59^}59+YnIL4yQ)?M
z>}E{KrH1%WiH~m7c2Mv@!tA~M?)Fux4S_7ZcLTUSXnZt9eV09rky~%S8N6H&0WRF%
z_i^-J`QQJZKlU&G-tYh5olagZPtgQc91E=-#~5}LPD6@Q`MHzOC#V}$B5tz~QD;g8
zH!#yV2O`o-SUr3cFACA)p_rIp%zRGF!3wY1u>cgLp=;}b;Wg>u-0_m}h`Yn2_|zDc
ztnS>stBZ)WRxm`pD^ZqiKzZ`upWQlOvd|uktgvW+k|A9U=w^`e)j4$=i37EmPw4&}
zT*(=1-so;mM3fjrzgXppVmP$f@;)C?DZ)grK&=Q(bt_2eT2TEgF!$uE{VLsPtnp>YCe^?7sG~1uD7pj{^mtY2t=uvwkmZCg
zO%Iy;1?H^Cy}fuUDQ_?fkU%HT3Wnz>k@VE?(}QWW9R-{eSrS{-anI
zVg;7E?09~Ab!JX=N_7DS)|4iJlCZJwU*Erc{^~Qo;d7t=+)v*>+>7wXZB1IHA?6=t
z5pQ?9gJ7E82GcNw+-T`wa(LG>Fj9FG$f*U&!5`=frMRa*a5@X^F<>Vh{X)A^%Xm^O
zH3uy+bE~^Y(iI(19@+#YjVfl0aICv^h>yakX=s2drjm{&pI=XF)D9+tI$G68X-&x(
zJenWJ>w^;dS)g
z&wl&ccW-~}`G*hKZm*YDupUrw8ta5k4qrsg*Ftx9EUvXcX4d;3{`i9rzr)DO-5mxY
z@U!#Z!Jf9UYCVohV}}D?mJ+F0o;DuTWKql$kb{4c^8W;8>L9w0W4Xz9uu{W|^!__x
zTMP)TCm*J+bheGVw>o_E^LoxE$>i|JB{z|_=wEj%qC>UJ^nSP_LZ$n_GQz+nRyjd&
zxX@j6x5lWf7+}i=Yl5t8M5bA?Vb(fOFd#jWQ!U|GQJD-ye5mijBXCuzu^}PZT0DCe
zNXx6tIhZ+C0eKupxAbkhrgK}cnDYrhpZuO*`uV@~AO6m}3$Htmi?_FaQ#as@
z13VA!6GNOV++VD;TV$RRIPYUJJYPp=oSV>2Dny_F<}a%{g6cNkyZ7!m)PhKjvYXE}
zg9iyThS;GeI$|B6mwvt0If{lvOZ+Txiq0nz#Gp+K523}Ji(S>RqO$ijE4`Mw*+gDWKMQ{Qip&{TR{uQQax
zmsb-p%!g_IlezO1ed~+ShLLPrYorNzLr_zxNL6xVyYX
zMEGQ8Fl?|p=``nQ=yo``&j@@J=a)~3!0Ct}sfK5PP#w$d(}!Ual_2exqa7sKd`#qP
z12>$rdY+h%CmVsTwJ--&%L0I0GeotAOVQ705^QiC$K4?zD9)8Ucc;VAI^H-A4ekPX
zHZdX$^uWoF)hkV&A9$W*{$|Jf;bg=tO+7hYyN)-GS6ue4(}(NEwf5>J*-{<@4#n;4
zXj!z9RSdgr>raG(aDuaN`SW*`O(|VoQ-o&bIwDBn^*gU+Jz;36DRelQV@R=I$VSFm
z+SqE>l!C0PhORLdL+eeL)*osxkgM=lXM9~Re&rA*qDA{QCep1mwuSP@?#H=Lv#QNI^a^e#*wlAjw>S;2QqPzqs2q}~Q(F6)y)OZhnLGB7ES3ialTk6u1`
z^7dE1`i;Q4-wztN0l|JTYkfj-b`dLLSe0cPk#KTzVXekToW%ptj@aTHk6`30vQs+Rw{+!dVFP9G9n9ETUm7Of)=ItPq#02
zZu#P)TOu)HDf5KdWvWs=9t^0uE0D_->Y3@godH$
zpq)K|@GEn3lG0KA%z2?*b-rSOH{I=C&dI$DNOYH{fOvdvx3Uq>ka1^YE^N%cl=!xZevzS7vtB*?-$T
zaF{XI`8VH_%yk?}bV)kcb4;jAH?`F%x`egVEQH_@h9tll5U0~FXiE@{nc~0)w8&N9
z(n165wMbrm@Wc0h%WwM1|KUIRJ)i#Adh^EoY6O>cxl@VjU{I{@VZV(a-U?TD@(>W)
zbLK2nplu!mu0M(-U0Hi)gvRLBAUjas=6+OXYEo-n^Sm|!A~1cMIqxQb-@wP>^BK13hsZ))Yl2+Y(PUt%Z#Py
z)7h_pBuIWf;(J?~PPeuIK#3#_bobu5_fAFi;VW{>X98j`tD)ZBsl?0~YMH55){#NK
zwWVB8?-i=YxkQb@)S}Q1g;#yT`QNa^5mD(~A$f?}x#2N9*xQCul3G-ibRg|6)6ShT
zdxLGXn0styvIw@ixr`yYfmuOAhi2{CJ5{Ufoekt}*)mp{Wb~ldZNi~SbZfqO;{!Bz
zcXRLF8+asQU%|V>CD`j%_4ZrwfBtL#;_v=ve*T9)dWUg$clT5~axFRi5*YC0
zFeklrbb&FdF`tWil)|V)oe4NmLYwIr(WiFB0Wr|cuCpB^)D||Zh+bb$Ix}_Fsibhd
z=ds=T4JoFU?Fze#9#S9@P>W<~JWSRu_cmAO-nmsN(fWB@E=LR?qF%O~{`=gU5#;I`
zG@)zwA$O)u+z+`JwHaB)TEq7irqf_zmmjB6%&Lm8395?AD(_L%QayYuol|l6HuM<7
zMo@>(V6|@cF)daZw)3SSiL>8U>3)Iav6kpRpuLM2Xn7yTln_E~&h~wkzS9ETgHw+X
zyfFd{fNGZOu9=jR*5~`FWffa~fpVCSR?Z1lSC5~TKN_Ma&klZzqg1e|=%|$1tEN!F
zV3G#JFsQ_=0o}5Wm7y!NI7VM>@(RkT+VTpgKT}n7wdU?tov*K?gNsmk->#vnO-{BF
z23L=ALK<0h4by`WyD9HoL50x3up?*}fN@x8
zpL%c)>KwP)p_6{iox3-(s#JPcRd%LY@YPThOOv15b1rV+d!Mcfu&j)fsUfCrw}wL)
zBEf116v&-UOuM)BIdEMzVh|A
z-ulGLH*eSrSboIqg49cBY^6^c#Ut9>#GrR!{dhIJ4$$2OTa{%iBNByZ?0_zgh4x13V9($EVP^znVD&1_
z7rugBY1&j$`xE{%e1;Qlu{a-nSqtrRf&rU4PlF%SCIk)P9jxMn!Xny!dS(R%b|mL3
zlm~=~w*X;ZCesK3;y8{fyu5$?Ghh7L7k=h*ukP#3y(7G&F;q9dR2rVDM3V#R?-kNa
zsyhgc>i+1}v!8tM>s7BVPo9|TYdrfxh#
zQfTwBB*blL_=Jy|3?H;p&%(T}c{HQG1iE|y^B4PIBbun!N7KP9=2
z&_g^*fzr2g=o`}WFr|eL2qN3g;8J_N_-;nrey`n<
zV64HIH4wqv-QDV*&`PLkkConiEF2d<(cu(kAG>h3@C-wgoefhU7%244?&7i5aX5!_
z*{R%-HtKA1N^24_L@-r7E|Wh!U8xuf4sPiW2~wSIDu7S42l7Y2&Toi5b>UDqO3d-+=k#7O@jGGHH}Nf+2_4_u}{_m
zl1-{1aQ^C;+;O^Hdk9$aICv}sKjjb
zV0&WlkVxGMV!BBqmQW^2LWCQ7W(qiW4+7IFeB&`Zs8d&aqkp~7rHWFwUWAR`*{HRG
zr(z1u*t(rl^pFiY>*+2~O;PS1r^X`=NQ6CwvC;MkODc6gr992Nq*gEVQ@bE^>dOBQNphD1q|#_56Y%$>Ws*Nl*j
zLs5>$I>MrrhNFSk8N(fLdW1rg9T+(Xt7?-Vh`o1PWb1z2IY+_3u59J})J)o*4MK0X
z$4M73{@{Mp(uS&2ouf@SL2wL*51_EKuC3hcJQ;Zo@@3jo3@a89T^WbD2jBZS0%k~G
zhgR2U1jq37mOzdcNKakF)r3%td}-ifeKgNqqov+sTcGp3ySsDO!`3hha+uahQ`ad?
znf%c;O5EK&sebd`v+v$NyjXX45`)m!X|;=vamFB9zK+SX73sRW`{CjGaDV;mXTR{-
z&wl>;u-ilKWAL%1&b4kCyh+;BQ?*f?!QF9*$vqTEUDDms6Q2JPE2@hNSqbY9{S)>^
zVXPJM2Re=wJO~!5N|R;iC)T6X02f0qeOV`l2-^XABcDVNW=_NuO{m(#WMrs4RcVuB
za-Y?KT6cgJnX5w#&FbD&Cal_dxdP4}n4441ALK+RxIQ&ggp
zaLEs-?)c0kc*I@6+0+nT^l1%O9{gU`uD1Sh{P2a)bb9)<=ghK6>h?w
zrd91Jok?oc8&0ySjLfLcC}|PxV!^Iv8)}9jL+45G$dZoZGJbsqmIU`YIC_wpv-{N4
zDuIq%!XMm0H0P|YMypP=cKEMj#p*}gfBx%VzI**@>#3};1(Dz60B=4Qby&gw2|iw&jJU>_
zejLCGfZGqdSP=H%qbRqKyBInGRh7G@Kbh;|N=zYh*ikvSxRH_)(9X9gmzAPeL|=^`
ztauu2Rh^r)ZBd@v7-VJB(|^#Yy!t*WI~Hi>MDbjxy5ovJUlnPZDy)>(v6FrMdUqd3
zbV)I5UuaL5K<93?PiJZ`)qGp~;6rz{2t!A_b4aotvkeUGjixb-Ou
zp2tKtpkc7>xZJ|#<)Gei@GJw2gI60g0k78$fD!vT?z&kj-sMLfGfqqoD0l4#%>tno
zMjSLcT`J;G8=2h+={LLkIB?vlWvE|$RG<6o-GBKv|Fy4v@v}ev(NES|7alBP9BNxG
zE<*YXl{5UD2hL6q9%w;jlpx5NgBzAwx~MrgY(h~p4YI04hkH@F`yErYou>f&tK=9`
z-BK3sbhIcee9hlL(>L!oxpRv5Idz+IR?b?&N0gwF?8H68-&MNON9w%>NU
zPlu#X#!e}OsTsa#Fb+WTV>Lz<1Jb)2+9D`;IC;%y!X3r#o-8|Hc(VMQdK1620fDZx
zZJX2^Ktp}4Iy!U#@Lbu6%X-$`spk{U{nE(;Pi_|KQ*pX)2Dy67@CnbR&YhRI1f%P;
zY*5#Rk92*79RAl4A+PnBkJ@5b%;1SsX~h`^11oGLQ4TC^pz>61p$!(A?dz^B-+h4*
zzBfnIa*_?VT{u5)xBFrpi);0WDdhj?r(}{)=^vC9I_&!mH7xo|hqY1gm07Z$@wrWv
ze_+<>VPUMQJF8_Y-Hw>rCJz4M5qFJJMQ^ap9}>l~$vjE!vbaDoZI)Zjcj;nm`=l>(
zMbJ{OXc3*}7j9Tp7*`COWNBzzow<2Br})HY1Ep@;CZL_C4tctRx5{%3V?IoM@fec!
zHgSEAA-v9O<-pzY1T`vM3JYx}Mtg_KtvfTbH8s$(d50vO!kC?jhG-%s&5c{Wx8*;g
zBXwMq1?2P~eC`A#R$Lz)2g5kgdRDXC>0^n0b0W)rarF;Vn19z
zeD?h9kG=gfKl9}T9x@MJXxf(I$cB9v8yI@aqh;la)g8Cx-OzyL@hu(L{X_&>QO85Y
z+mbb}nzE#(fX?1I-l&Q-)%%t?j75$rxGaqwiIIN|Hf2TaM2Sf%(3%^@TW9}qthH`#
zw>%R(P9X`;$>a%dn!xQrp(!4cQ?s|#4n@Quy|fFzx_MI`7!F2LsTvcVB-0secn*}4
z7&Y~-V=0k1*5wj+f#qU)am9+@i-(Us_Vm-=`t~=l_|b>E8e5Ce5m;;O5bM^|z&Nfo
z7ZPF6B-}W3f4%?72j9Ja_+UMG%5|ro;UH4yi3>mwZ3K(nRAitaN-k|d-s2-+aO+F~
zry)|Nv~U8zhK5T+&Kg~)K|};VA_xYui;n6Bd>8?CO`^cXfyYKIgDlzEsYWzyRrbg7
zNye_>gR5@!2?c(09Y+xJTaFedelyKrq*3wQb%pC`IHA&GwE4Iu-#E^}HlSzfH60Xg
z4tJQ)CNW?s@+e3p_OAu&02h$d!
zlQCk&GB+BdALuj9rDW{xuM;*@U79=WH%Nsb!Ca#y^0T#m9HKfQX~U>2P+-ln7oG!X
zPpxo2bC8SGX`<8XQ0Z!$8WxrsER-N>0X!{W()?c-*CokVOT2VP$mTRI>&f#MulL@6
z`9Jy>|B0V{`sRK!^c05#qYn_>*n|;as8>##sNeGZr1HWM<2isB{}pUARHwnkVOK(>
za@XFbQ@q~?ZG}nufvRV}pPz0t0UZIhoIptM6gT!ne6Kc7IOI7Ei%WxZtyc#ahd_Ev
zkep37)Ulq0D+|IfvqfTD6UgG$Le=l#GCywKU{bJ-X%cvRdvQohsa?IZ!?sl6g9a
zwXF)u)?{K)%LyMk`y@@KU~u^+6p;O?-_2P?6w*bXpe;xj)QkkmJZ4nAMI~`
z?XAD_U;G?>YwAkl}arR%DIcc{AkX+GKqB<-W3NK>4
z{o;)Y>=29>KCsUEla};ZCDeVAs&N}QolsLVbin<(ra_@c3>ou>{5Jou-stWDmYcH{)Yn%nWbH&-kV3(qd*i-vX
zKyzeZw2sb!P*Rw3Xh0%IRRMppf_!x`9Q`<6S!d{WhsroCo_W+GdB(IUa-!G@6EX`X
z$H(mBJQzW}tR|V2Ls~AG2(Dv|JDn=I;#$GOIfwFMby3MI5?F_aduH!ZD6B>!xDInL
z(!*jh&q;Meb~(Ep^%-pVd|vQ*K87R3NnK)!Rz5OvGO)ZBgVlM81SX+Yn&CtURzV8^
z#`FWu&pXf5RjaBG4?%}oXL@LR$kqht6-ziI>5
zL~Z_M34<~rL0$GaKY4P7T6NC(^KyBVlrM}}c{;kd;vs3G&I^llzBfKl$L-cVE}t(^$(f
zDJFo$Jl9bAIy4#w&tW(13;Xiri#XPozWn98X!LgHEKGGu-5Vmzl96g1B!%cSqmQG
z*1F5HvrQ}M*QAA087}nJyjwg#KKK)tz$n3-`t7kgCe8?QU{|FiBzH9x_%E#8y>zW^Sb~
zL1lir#~JTPf%Q8p8#z#*c0~8Ix$0F`t5wFxHYr_YVa(ZTMvM(SKguxSCPJnia!nFs
zR(7ge$sNHx%08c6k47?^VL72k?d(EzZNCj2cFJe8RMM?}B|J~5aGwWl`TbTGP;}>m
z=W?%^00~p8Mlh+UV>cxlu+duyYf9aq4#QmFW_F4#I4d?T{)#4mYk$=Dz
zN-ib`m+e{4K2CHF-3W^DU_3wG++p>J8o;=Qy=J;hc<6J~bBI|WDsP0d;`Tl4wy{Xr
ze^{{1?C!Yv`}sPh>2Cv>7(&6TX~MdRR`q|XB~rhhCJQG-R%hidG~yB@ayQ7C(triLs
zWojm~HwF@3A)k-x#yXbLfa5rX_U(sF*~8X^24X*C?%@P>>IO=6g`W>HD|gn6&(#I2
z!_v*If#%srWHk!iovF57h(E7FZr@QiE{jj@3PIy<%{8LqdBF(H>CZ{5xqrchH2?3=N0&q*Vr3bL3g>o27BGeu%M3-=`Lq=_b
z0a-ywMln0M9E{1i@3qzeSqXRtV<-hny-pdtKDlZLD@=>&Jc=GFW9k+P12%dksv2&5
z?P>Kemf!kKJ@n|5XKz+-75PkyfO|U{5NKs?#FsMw_9nOygEA
zw9ejpP3}34wYodUzGS*=(Idcl6mWDsA$5jw$Z!vKck9XA4v3z&jP4p&XIK30o$3*+
z(EycbK&3Tpm)&r0YPSEsNFHk)Q;lHWo!3&2v4TlUJ;b74`rxBOk=mMgFsGp{DIJ0m
ztK7SGlF`lFIYJ&Mb!}p*)q5O`+8e`B2Lol#Hjz8-VLE%Vs
zyOLx!2B^`M^e2~^vxZdo&Hvk~cbG)tWV30CqYmCEoE6|C?gbTn4
zL;5@OnyH3`Q`GHN)ywfD^Ywf0{i9d+FOK7G*&mD!8v0486YMks(EYAF2OXEU!0T79
zAKpBC;d5X7)F(gv`r%dOj0K&3U@!IpyOBkNOSp(CmYPL9Q&$S61em8Y<#+`vZEkmi
zV@eDFk_3iuVkeJni(pKa>}r-_A*E1ebXlbfxVBsa{h-}|oo0goQO)hk7im?6X_z}P
zW8)7_2@L5FMre5J={Va;1)g9?k{Ct4r#>uAcB(wqC4!7|WiVD8YY84`4525%S*w|e
zrfl1gkB(9|CWXO|Ms1G<2?g}ax@2W#f90#+`uL|m^U+89`T*r5&I}FTN!{#-A69u!
zb4wdb;aXf#$Pb>s^U;eRt%$Xr!hVq$V$I>*xU$F*1E1puvjXbravtuC^IWMIW`pt;
zCaXr4v)o+awh+o(BjgaZP5@Q^Wx$CZ%!aaCJeGSd3A2{|tDmtt9te?R3C1i?#b>tgbxpT)@6TYAbgLC3xZ+rshmH51eeiGn>3{Z*
z|4Uzf^LnFOFq?=qxMm*bfO!j!Uh^JR8#?y*Lfp&B^Uvsr4OT(iw8tDPHw+_Su*?}=8(UEPHkRa1lL
z<4|WlhEdZH!q&kc=44uR^>A1^mh~=VpdCbaELMSHf*u1N_$Q#Z+3HCi5z7hijVRI~Je3wVIvP
zuU=h$-#`2Lzw(!V6>pwBfByXL$;S`Bxr4DFU(-WF00{J2f#_`0>Ee-utTBvpnn-b}
zrIlyB{?Hwob-TZ4aeNg?W;wZZ)y2V^x8IL)t_tjR*wl~|mf2@>q7s^0_?9Ydg;@lWT(J&m
z`t%HYWLAn<6I5G?C|nU%b;X)wa-G^0IJ-D`Zc-{aJ5NdGB62l`4feq|P32qIEcL
zKr`wz2gnzrQTB5{Oe7Sy#zlswi^XA^5S-shTgPEo1>u;~1TLPLn|@lWG>G8}WDTuz
z*-JM>TVYUnQq=w;SKFDg&mA-g030dkPlh|dEetAnBos-_YX!M3cgNl3qnGb~_|cDI
z#c{dgT4%I57n1{84;wtTEW=Wws$#{?diCo5Q=j?t7ryw@*L^M2u`Ud9NeDBRA?k@k
zXP1`T;~b32wmvL+eLmMfKTN89N{tRu+R_xBfm{A*wR
zT3qg)KfCT!2TE$Wr{{)ti7T*{j(ijn9p_*c==J@p_dodV{p)AzxXgG(4pw_hu0&<6
z!wyCu(IphPs)I04?Oo>22q8V$c
z(M2pH^)z+=G>EHU9R_419Y6akTJ2@6pRvr(8>Uar%~z}l;&HwqF%rUYd$a-iSF=VA
z?iSOFcRkbY)9#aI2^z2_M6Eu@-C#vZfK0_8B03G4&^7F>*-K!XTgGy#H`gbGRFx-w
z1d}!l8xT&Ls>&ns#JieU^fh2!yp~<`1ln2gjA=x|<6zyOufMDNjBf=pj*G-HvQn0)
z{)}u9OAS_Q9lPS)cYgB6|HyCopZ&@&ULWLn=zG(qYsGRsnVHRRzhT@ZvEUS87%iFNkcIc0s(%0xu?b2)0&y@8hLzT2i_8K?ZGLGAw
zn1+aknNl*~4N2xzi)3n)c1MVMqSq3QR_j>DCAwO5td=kbI#m(TRduZ{92Wr4Oji;z
z0Vb(GQPZi#3SuG3Oh{#2uX%k?1CSZ#%u)-<^(xvzmv=HX-a(cA(!3TUq-){w2vEyr
zN-@E$wkPxESd=n!=yA05w~?-*yU*6^vJXmjWv_+I%w1uE*LpcOw0GxD29z4^>t-;o
zSyi!^J4v#cyVgNA_BC^eg>r{8T9Z73S)IG2b54ynzg7dW;(C8ormm$Y^|cOp5h*H6
za!ZTeUA3>fBnbv3*zOrGDWYsG;pSb1Dr#(Rr97e=z}+1$Pgb$7iTnHg$N$*Z|Gj_z
zUwi)UNB1w^Jbm(Zbf6cS5mC+vsXhXQ33oMT$MR@^lbn>QL&sstfOiQRu~Lw1NAxSVr+iD0+
zTfs|WxYjOr-3tpNQM&>-4r*4XygSdM8>l|j9rD5zyi?V-S+HzIY?yc=iz?b{LM5^6
zd1s=Yk{$Ixp4~2b0$FOM&SZ$e^XcwfrFs-lricc|mGDcuqO0oaUS$_Q>iN+FuQJ1-
zGbl#mPRos;Ib<&F+U-B-Lm!o6{;m^6M~5~*2z62B<^FHyWnpySOgK3?Pjz-_Ubgb1
zEznmd(OGl0O|2T}kk7)LSluO1yF5!%`x^VYGrf})Y_(an2zKs?u>uJ-eoQOBcuuPx
z4jiojJ{>d?gl`}C!}z+v)w!;=UV~uS!C^803jrq4u~4IXJVzviZ)pNu(tFqh^l7c+
zEi2X76p+TRs%pck(i^s;?f#Et9k8fJ1*-b=x~;;MxC~9k@#OC9`!~OojqYqH|B({?L4nII$t1K9su0FCqWb8
zWeMCK&w-h=jyJTJK
zlvG+VqB>!};xkS4l`3sA8booUEl`gX2Icn6%esq*SJ&$&KK{9%`SKTb;^oV65YcW==S$(|I7>Ko)Nb$(a%RzEe@gd!a+
zc4?bp&iF%jRCV8OL}(3McKT5hw(hmq3{{N9V!6F!8t@umXmr?u{K#(bl$UZ($E@QJ
zK`sDm$&jWqQ*j}t6gz&TfV
ziYw&sCYbFwLB@(;wqCIWu^}yl8W_5=kVTNO?DE%=3MiA;1JQa{WE5-B2BaIn<9;Ni
zAkzbU()s57gYpCH3yp^p%Cq7Q3sC!|1ppZ2Nl*F~TvO(^#u#?1ytx(f64>
z=U|N@^XpuXHd5;K?b>;3(D`iXDEVRtJSTbou7r$Nwqu0nB+zp
z4s-&l^087`;t;(>uaWM4$3S4_b5yp4+f<-q7zSUN*Xo8$1OT2$CroGQ034;gQD>4|
z$0A^f|1{o9(-p2Y0J)FN)@qN;DS+z|WYh-zh@v(GMNtb?t8%%waIHYAVYmUVLplr)
z(vvrX$I{$_b}wkq>Jp=~eO#6&xmHtq*#acRaGrRsRzxuDO47Z?Ojucd1F=@vJAI7k
zIE2|^X70T$cvQ8<;noRE^KBCk4{4ibPt!qFAD1PB=bJv6a@U
zXfs0Mz#kzq=CAty$JM_++n!}vVc3{+t$psz%*uLYR&{k(BLub-r~|bCJrK5dHVy)0
z5UBMqQiw2?9Rx<85JJWQwk(H)BkT`Wgg+?4f1WK~)m4>MnfH12Z>>4}VT`%XxW~I7
z5SE!JScvK^j4^JClVZ}`a7-vyrKGSy*Q?
zXj29^w)xjH5ZHUGcb67BL}v;vssSK4S{aeqM$>060f=OuDu$1H)#;EOA)uLSZ*oV<
zU&iy6+miC6RhgJTZm!M6LdI_wMZB^th
zg6*%@Im@z;!2
zB6s70mLF{eN`&fGBx~>5%FBg20%T@vcTVV;2=~<#_o{AfMI&S7cIC%~vOHwciVm15
zEO!tg9(@t;AjLX$EE+2`or?^&vs#8D!xGio5)
z*^bElGh1=S;Gv?Q22h6C0K%Tk@)MFe)S`S<%T-mCIYND&P{w!wYGq?E%%8?HS9jZ(
zL{~~>s4BpMTLrDJ*er&|^s#|kHW(UuLE&bMa&VD@xp)J5h54`@newx>yr&Z}pxc9^
z&j%U=b4+JWkKCyaNbI6f??_QePt*5fQGF_nH@NJaL@5eJCMpTsM&!8t{HwRW^5ysc
zum6`n`JKv{g5HW6jjJah;Z*zTi{XyDe6I%x<8VHI#KnC_uf|Y
zCMDBkq+0mu+Qc02aC7IH85ETy2*jvZ~
z`d|6pt4Qw90Met^>S2c75-d_l!ah|&=VMKw1Dl?Ye0pnr$~eUj2Mo7vnMYwU$H-7k
zn*^NdRSAu7lNUTT3HGE#XNY<=w8jJH!!taX6p?wklQ#VXtr11Ws3uPPnOf3Wti4wQ
znrvR$P^{>E>0plyb#(aBaoW#W?$A<{_yN;(+!>sS5)8(!a;dYxP_p{8v`xG}6rv`V3$h*pPr-~O-Wjn
zT4o)+#;L+gdJuw@y`8lbwe5`cnEVV@)v5-(R1Ub$RPS49j{>P)hZYX>HKv!w*$#2S
zcX(c-UO^)!Dppe2T_8w}oba|%sPTq$xE4D~-=r*~Gle_xL`FbuYo|Vk&|Wk)L(8(l
z-7$>EKL9c3?RLApdHa*E-~0r@F{VyWJqu^poptqz(>2zXS7u155GjuCFd4y*cEAzLcTCtYh
zJ6w5sQ?SaaGL?Q3#Dv+K^3sA25tSZr^)u&4DAZ`}gRLyc#)S_s27Qp=d=jpqVaPff
z*NW&ts_^^tk{j77f5EllEn;Xskg&yuJskNWz2j*Q)j(tp6H4cWyLDH2W*R5(AFK(6
z<}U;Q4O`9oDpvmLkAK&zPd|V2_5Hd?R2Sr_dTi5vyt>gdsp6~?ppn86AMPK2{>y*#
z@p^N6_1PG&>@1uDn?x2xH#;2lcG%HN5OWF@9e#%4B@x0^jC*2pU3>Ws74MQ-$m7EWVV1Y
zb6zQ5(MC*jgu6;IjqQTO&IX|LjJ6ROo4sX>h=HJ{;Y0-78|-`1@$D+l#m)l>Bz0>(
z>sqWJLQmZbga+34^FfCskkSQ2WS+jX%x*9jlw}fCwVK?oanO2Kb9!ycCNodZ9$cHB
zh8Th4X4QsYXFo7ea}sC_y@fGnWF+!7pWeTJM&y6}_y5fA`=2~Lf84iQv%AXSIvadk
zl<(KCUq`UXkpAKGPg+XbI3=35Z`XT0Hmw;?NDs)8r^F*>+cP>3Cc6{jTD4me<{g>V
zR;*nh)N5cL=5Qy85>S7L#7?VJyhWnHLCVKDGslRkTDw+JZNr^hc3t1A%S^!Vp*C+3
zp(*N$gb>NXkU3w?5l^>~fogXxaY>sFCbfZqM~AXD3>BRHShW4&HkD+As-qaF&FiXV
z6T-BWZ^}I%W9AsR-|JdycQPDdj{-t-Xw<)2*R@L>WsHc}RoAL(^-Q&%Ij^r+kD|``
zqtLRFgMDNGd%2Ge9Tu}!NuH6IGgY2xnWs5hC`4;v2$0uKX%m{>(r!w@b#>mEv5gQ}
zlqgm6T5H#aH1uJugww=^^ORQUEY^uzOWQVzsEvr2Pg&cKxe9A>FCnm4MgZ~pb>_$o
zeE6_Gd8+^CfA?qq)j#xm|3ClmC%~(Ddy2kOt))B`4%u5^s87=Iws%>~9HvGzknLde
z>iW)X+R&@k%PizhuU1d#l@#^|PMUKzwV@u3$yIB4W_J`vxATO#59Q#bx*6SAf#E*p
z>9affl#}i(Q1-E$&Uwz&Zcka%`Ju;Tn$+kV5v4=H5p!gfEbAE^1EWcramdwpk#(Oy
z6Q0B>1pb6~b=Ma$+6ZrDA?7%7^T^Z2*qg%7)ZOfR
z@=dW1af~s?m@t0b`5>$dP+-m`XLN$Mg7QT-;BhB%!r^(ODTWXhyTSGoMLAc8FDY7#
zAO=aNowl16kPNMXw&(D88pX44wGwz7=X#mYl05N0PI4HT_Vpb(#z^EDEi0;xPG^gx
z6d^d0U2Di6YuYO@<3s@cmXaC$q%5x+AgE*0lieHTBNBjfaUdW0lH(PfgX&ReO~5$s
zVbF5qP!l81By+tOnt|xdynhR5p4FYJags;fV<>^>GE6DWNGH;LU!e|O7OTShOhtB_
zZIWj(#SAw(M$;Y+7cMqbaS4qYq4+bp6?Tlr%nV1E0IXGOO00=y<>yLgP73ET?{Qzc
zUph_g+EN*mcYSz2WX`l;2_xsLr>E!VUwrk8f3&#f(=Bo|xvBq)WN@ZK}SzZl1AIsK3w@boibU*!(U3J50Tb-1V(5|0O=U)RIdTTwIK-aDFo
z4aK!B%Ar=Eh|z3l1_me^&wRA}{hhsckE?+I!=K?vdL0DArQQK}8rANF
zq+(s>z*;ZR;#J%2$jImC=Nzwp{OiBQxPAT04{A->%Uvi+eo{SMlIAS&mL#jThzwOO
zAW>CsKYabmul~oiK92cWU}Vgw#DP~`0*_2YsgGl2|MXg}rWYRoTAlmcjbgBI_
zJJmL|$}WIr&3&o}U}f2`7rjF?v!V9Z2#S7mbpnLMJ$nD>nQ4s|(yFb_0LDm4pf3Pw
zZ`)A3piu$`-SZQL2i3X_ZZCPeZvF-XNJC^0Y$XM%pk(ru#9K(;nvwKRbC8CHqn
z#5xg4^lQ~Qg1uceiLX|{AVMGjAGMJ=CQX=HuO+!pju}W1zH@YDr7csIbtow6Ge>$`
z3GIa{18I^ExF;QWfn|$5F9V0{P&uq)j)tQ^B68AREJFsvbKc&496x_^{hhz{C;!wR
z|Mv68E0c3ZoD+mNS!*vZpCFAi`g8$d?b*R`6~y44Rk+9x5_?soxfhq9p&~ZfTc)bk
zGSju?Kr7L&mdNha49Tv%r0S6YM#*iPaouYz0+3Epzh1oz)!9VQ!-k3LDhZspV1T5|
z9#@&rpv+WB0<{>KHl-Y~mI`4FUrnjU%Mhkl@LmPPZDfG!+I1-<67$2LCRH+TSsRpx
zBr*UET^6Xg7izmsVGld4;x2B}xu$F89DB(>JV4trNeG=0aD!pgs(o!m)V+A!%gatU
z!qO-6y6;`Q*3u4T#ToUo3u~R>t0Bh}O%Tmsy!rs-SZq+V%0xQiOBT4SH5m?t2Ue-%Zpfc3`
zwU=i$y5UMh9Fez?Iript-+L3SO(9VWtk?_7lo3ApBm+^!x9|72KfnFI|A+t8@BZh$
z_mBVSFP`SpEfQOY_F(U5LDG)!1WL!eBW|DCd=SosU}g?(pN~q7c+Lfa{Rw-U$nha!
zic8kV)&V-&gX;AyFr%t!FAHbRwJG1#w;Vy15dVnCF%ZqihQ~j`%#m0r>EwOr(aiif
zhYP6$-!CXcGZz97ai_pVHwUT{Tgsgbgk3gl&Ma||8aC8<*j0>qHR#rKmx9%bC7(e_Epokma^eOP$Q7TG>3j>`=gYH5j+57?5$}I$tu<4MESto
zb)KC&2&LZkv0L8E;W44mzF10YqRuX+vC{@kP4h(~Sz@l}bGpn-gKbAbxXW0J1#aY!
zH9cTk6E!vTgYl2+GxzqYQ-NDPyThy3MQ$NfUAUl%bZjrerm20nD5}DF7feWcv54l)
zfJr2R)hQ8miJqIK&jhV&ZJuf?@$rOAJoZ?p!(QbFad$?cWmfhUvD!*faTd7K3?DkP
zb}ZsngI;pCmAo(rCxrkWYK7hqR+>a$_w?|v?g^1;d4kTxX4aI_`_HPBih}<4-kFms
zv_|gY?pIV*OM7?k+Uw+W0Jd3c(&JCz(_GwXpUMcVwcOipDK*t-JTlSN`gERVzi&yA
zPKu}}aLRl3yhg1nWps$B;+#*bK793y|L^PNae}W+bOqh9941-S3#R8;sO)~dQBUCg8HIn+%O)S9ynFzMT+@UQDR}0Te-o_98EYTI?N5g!HhAwTjjl0l`3N
zglRBFFtJ&`eDl+<-~XdA>UMj|Ok`l_3S5LkXoqS8(iU>i5i8BIrGuGK)RPo05o2Zq
zhK7j59Haea%^my65=6ptj@4vHb|*47OU80xO)qyXo!pu|8}^eGe9@#wgLxi35w&~n
z3xf2=vgvm=KVKO`#;}cR2C}DSsrKEQ_D}N5p?Ft8(nIi!0ZxZtKcG%m|#qtt=pl30Ip4*F>97QxKH3cMhKntT8$U2!;d4cX)y4J#}al+oqa
zLC%0Kmcu^>Pf2y3!a>?KkuLzJfE&8DW!OYy%sEYFj?96`W(IUf`#K{s1vSqx
zGLj(xc0h^0D9gsDo)6~N8Dox2uv7r0+MVLjrEV8o?R(E3b4PTHnUN7AVp_f*F~*EB
zl9j*s=`a4nKmVKm(SP{6_I=65(>qt5MmR{VpIxU7)+KgA@Yw&_GJRd4TtJ6QHVk`+
zf<9|?p>dXqse!a6Ia5ZgrH4neteV*%ypso!RbUS%>W$a#k
zwjXaq?1qyg5q8YZ#_Z)vjZBAbpB5paQWsyDn6tS}AQQLS@O~J^dsD_sGh{$I&#bZ
z`4I>DZE6>QKnS$6oJBewtu$#2=6vf`qireQ8-m1C;vWgp7
zk+JD6tQ3#gl|p2=Pc?$59683Us#O<4t}{H%WeBi1x;<%T4f{m
zqB^9A@}&;bj*+?%3tLvT^}zZ2cmR>z-jT;%xIJBgsO@f~(nLx}meVcP-v|relt?vn
z9{oc=csjk*8Gsur(r;IY4X94Ju(zddK|@iM&FhuHjAb??YQd76Nenk?I|PY}@i-1s
zLZ|j??ZaHM5W8)uv0U>J05F3s;{v4qHV=Tnrf0~j;+48YdEg7-Pb>2Lui+LJ`B0c_
z*X8*6vqi;DZc|fmN~1Jv_yL~yi_TqC@bq>R0H8}_YtuxyS=6Vnvr%hZj5_D+V=cYR
ziqpczOzAIq4n7Hn4gCfJZ6DpSQzeghY(}daLlpfZc!x`agBepcgu7Ox16HA_Vo@nwtXayttH5^?FZ*?x?C5
zs(HZXrL|Eyer{Iv2p>A8z~P8wQ>}<_CK>>e8%xqwYOjQ^84{wB-V}c3Fq6fJHQ9SYX}nAHMqKKYI86t2u8OH|L&>
zt|?4KfIuRi<_KB}7y<0POOs<8x~by6D6US@AGIQs&CPnCnA=m%u_SO5kVmdFOK#D^
z4C=|dWTU2W<}fGF;tE$`>Ue3a3xR<{r&Y8d9)R2K+y-0}e;SHw%6Jgg?fG~sq1^Dx
zbuH&M7K1SCU=wO@c9xt#>^h(ZyV@k-nRc)c60$w;=ODyOu%Q-OnrSQTD(hXVO1sCN
z!%hpd{Ptd#wu_crRjs|2IeFoAhO${WIHK8N#jD1IodwYOhn~*~uVOlnsQS9LTSZ##
z9~!8oigv4;CFX66ke?^#7$Fa4zuLoK_*_sQa!_SPj0hA}ApqpAnWG9Za%y}+#GK}?
z6*RT2=Dg)hgiNPhpEw&)%b&gp5oK9Eh?z6u>34qd<~M%-um6{S=Qn3^QHfW84Y=rd
zY+xL|GDEj?D&Q@zytWBq|Cm{V?vF99EM-Tyg;LL>N|UxqdgpH4>J?vPm6v7Nd160C
zD|facYaq?jwI?w4l2f{2=Dp}arUg~70@8&7W4!u
zGhPRGHO4F9^41)Ipxl<&;k_Q+LH6%d(Y!Yiu~ywLd2BlFZZ8k){w{;ZZZFgW1IwBR
zdtDQ1_fj#Ty_PdEu&**kuZLEKrphIQ;C5L@#>l8mr9ZS^tLCgmz@26Y)UxlM!@j~=mNv6g&0
zEJ!AyTU&c0PtYzv7D89}Y<(rdF=K+@vfI_Q9)NcON+ozXgB*5-AQ
z#H)!@%g!foT}?!KI7#Y+6a!C$oE&bP5%^
zxzXYmo_~bmM4<^6MAz-XE%>g?(*#?*5PdFtsWy|7`ub>=GBUQKD_H(E(lu3)d#@@=
z(|Mk+_F#rm{*bJSkXf$OVkpFjq3_ktM|f-%3*FSDR3;=-aks1iCb7X|d3Y6rBtU#<~gVowJ3EExm
z)C|%_InC9x;~CU_u+atzwYU6~x$T#OhOHZ;FnsAJR9!v@*{lLM=k4j~>HYhkfBnrr
zAu2S^aPP2#$a$?>9sP*`KrU}ZEvu-#*LCHL>wdj`^Wody`{K)A`IYDA54-M>F@~YI
zh`fy%7)QSYp!P1td6ebhXaZ4sxq5#obzP46ErTy7wOFziV053jZ09iY-;ava11CxiqG#7Fz)ZLKkz6IdkaeePSpR)o-7IIHMY|quDB_
zoPufrAVPC^J@ukXmeeS_-XHqhZoSYF3b{$@fsQdVQv7E_9(E%nxwsD{rSwAm2G_Mo
z{OH$y{PgL!-@dulwaBd}6_3L%$dbmf5s08h8;0MFQh#K8xWD`5H~(nY$NB2hh#456
zJ_KWXoFjwaTC$p?r>Y`g*bi+#s4I<-W_!BTrg-hWS&@b-a1sJlS*atrQC8tTS`tyn
z)CsGqnE*8&Cv(IwbnJ<{fs6`(m}A^VzC1GpE=5Dvf-UuY!l^;e@Nn`j%z@ygGpM&#~f3xi9M7lG^Cecj+;wr1S2wrTem`pvVKgX-)Z#>tuu(6c?z0L-E@(=fRS!^|Sah>=PoeWVb@XlN&(
zVFHPqb8MH>YC6iWC2#rejc|I;7;-sj`GINj6k`#lKX
zV*@)<9Fp1(5Z#{Y+%%jo_KhpER`}?aV4eJBE?osrL@?sqg-)C?v)9AWxj2TLCj^!?
zix*)XV~E^{F`_5Bg;JNjEe&wbhZql$V5`GpdTHoUDM`o)kl11d9_zkuq{Qz*^*DtTt85swlXwh`h@kqQ!1SyjM?XDnWdi|UB-rjY&d!=(0g%Ey
z*Sd1VoKr%UeQmdv0TMGus7bpAah|$Y@i8Ccc`3fJVdDrW;k+r
zfMoRXn5_iR+E9Tl;8KUby18Kig1xPqYh~3g6q+~j+2a!+4#(SD_#7(Qo~2w}d$W&V
zB_l+1kZ?YsjO+!y^O%wDr>75%f!f=FLUoh0?}%v8SJ(rE-oh!3ov%xLl~&;#Lnl7O
z_x4#)2h?;EU1uY3n9C_4o;ic3mt1%nI$eR^BzA?REm%p&ez`n{*)@T40
zok+3~7&Val?DjpO>o6VM5q%d;#6)I0T_a&jNbqD7nNgqzih4vv%rS(^_CORT9k?wy5MBpI~Ml(mT_epQ-on|{p=(g0+@;yOjb
z-zvU;|MAtU&wlk+e@xW1u9;JDQ8bc0bn>+GnE>`59C
zk7!R~_fF5w3l1|Z3`y*-p$2DunGsR4Y>*H}(McbLj#Rx4yaNzf2BwU54VScCUyHdExs)i>{d
z{`TEJ3G6XG8E4H(W72z%h?(gg2pkd)t+LY7)^}9o81n|i7RuC81W)Z!)U|V?Rf{CT
z=c#cbohtESXqD%z>NSR@WtNNY2Ddxm(Pd-I335wVCLOq-8of;eU@-NtU050n-76k_
z2%5cp+q;O$Of!rlY2!q%QZYX#)WW(f%}p&&{Ofne6<~}pK7L#uK79DQ|K)G}=5M_I
z@Nu{ACc8@Yo9%P&aRENIb?BWYx4_m7n}0an_)>2kDQ{T%39jXiY`OX6$So599fDBpfUd+BH?!9cZ=&hw8nP+|Hv7T@yg;4f!Bxa-e3iTRtn*Q{J)Tb?MQg`Ao}7f$ExeXxQ9e@C
zLhjx^7}>E^Bfyw*Dum3L3Ik)NJn>FNgbK|GU)K&`%vm-?r*PeA=qlzI$yk?r%@0^$
zwt^5Gx$Qw4@XUr351b>f`&!r5E7*@|y#P_WGLwwVvDbb%jrJ_&7XyAH#)yb5?pGD*
zvO{uh4J_f+SF)EX00giX_r_XWn*?4z^C2q2@6#AHzbh$mWtm
z7Hda&1t5Z}maqUFg}r{bS!=DwIVx5?(FuUe(zgz&7xIad-UHz1$m2_R1C#p1QoNQd8x2
zt-ZQj4aYF!oUcDV--!`1VhkWjtkOl824(}^wXFTvrH1g>
zq)@*y1z&xGavz|$(=N5F7>EcW*50aOAF_fDH({%h2+_qMVjzKJF%f%L_<0s-_ie}7
z2$rVFG)&COl#5@aN-7ou*eHgYXhmCj&nR+`m5Di~5@<(@aOr4>0|%0f2;_*h7VUkP
z8Jg<8Oya4eP7QpEA>%uLC4ACbxkYnFl16|TIdjg(WDOPZs*3sH`NMa<^ZhTs{QiC6
zdR{1no@QXQoJk;QFhUcFF-CP?aoE4k^63H;0dayP
z9SAZ;({9RCoN8~=8UnL@j|vw0`(2()5aCuCmEvg`)#>mQ@t9lEND)Mtf!MW+y8%6O
zR5TP)nVBKAJ!Mp2#5ye6aYUuK<(cphQXBB*$T6hp)6k&IEH6LR-+mO@DYBUJJ&Z;P
zs^5lUb2yWhwlE?!AOm44c&0m*ra*e#TFx+j7J-N{5ZJZtRxPl$flc^#BHAuBx~qQ9
z+ig6JG0pytR3`^aGRGJKlul~w^^l$w3U-;quzA_Hct$63#@p<0wRJjEm
z$8kzrT2t-kpr17^5kV7psXU;KM%s0m#gIeTQEG%cOA%|;QeRXNp$?jGHcW4AQK?cg
zM?45O4l@G^p(Ewfh3meVV8oaKXo61WOt`w{N!dHibC4w|K330PJtH}~g}A_yePx1N
z#Z{W$2M@p~EOU%z3L1D8w~SpSSp*^?O{0t<0$;OIV_%GnF;Z|-I@CF)SJic2dzIDS
z+H;I(J&w*u5wB(z1g{3>OgB>inK{+}Eag+c#BoCY3jp>;js)9qklnX&5LjUETFbgF
z1=V%QWp7{Cq6;k%LqK5dlGGM`xG_1+J=|BpZW`~RgM{L`O&mE(4MdditOhRP~M#T@ex_>}XiUzC}M!ea<|
zbikpF2_*E%V#1?^d%ArNKN2*fK|d+s8chsFBI%SpeORE2F3Bmq2dOf~{a{TbYUv`4
zeQUndsVX}0=+ep>KP6$xyu1Q^wyj!w7db^Xz|rd@Jy4%&2Lk<_NFc$^9d(RSW`lO+
zbX^{aj&(C6{G!xJzqHc+HlA+^g*obP-$r7$qtnT
zgc%sR%~f@w0Po@1%d)E_KMFoq3q)62=9BjCVN
z!*u&@D}7uy_R-Mod}&0f+(WB0v9oE(3hj~Ir-Q?=Vx9d9jw}v<-S2#OKWGzS`Tl|~
zQPp&c7GIdMlp_oV5VflZ865V%_XiHS{WumO3b&9s9o{tqIJ6^j?;RP_ot2#-BG2>D
zahj)ZIh~qXyBg=-yssS%x{YfI`Hk`D$Y?rMYb*0;2=&*R#UQC&^wC*LF5pAXGE9d0
z|EuZ}eHY>8(p2rF)^0t*46@QZP^hC$i`i+p>nG1o$~;>>XfTQ-DG*2x5c%T$A~2*}
zkarJ(p)OF`FQb9B2z88kT)Lx!pGY{uYjw_XdwLpg-u})nzy7C4nTgP}n-uL@G6BeR
zTKNT-FJ6qsSSI56!~OZbzxd+I&%gcMkL&V&uc5qm!~mQTNv+VjT9T=bZ-T{AcmF>
zhX988^K?+7$S6gzq5d~x4?e!C+@L(h7&(&?-v=^cul?bA{_+Pu{MP56e|Z1At}TB`
z8!(FQb`xALDp9qnH5%L~t}c=X{lzpd@{cED8sDJ;sIIzTZPNVZuR&
zdsX9cdnt$p(7ma2uYy7_sy|;>e5r1%14tYc+n5;wY->$wZYN3Bj&M^($l0Qd;sHg-
zCYNsAFk07;7cM-?_a4fjWh|+^
z&9IeMk-)f(IZ`iG=c34uK5r0V;N3Vj+}a%KZGoBGWs
zar^3*U;oek&ENAk|M&k2HOs~6t!E+7X_2ktIS}tV&0r1!d|-w>}A-s
zR%w%QQ(CQS)mrLjmGiV?h|G0O9rTI~U|+7sQb+V@hhG)Iyu|>x8JTjK-x@xx7qsXr
zarkw%CTR%>=)D!!s_UZ49t9$n3-rCo;<&}_mSfm=cdue`uUd=YCiqf6uO5`UU|@y*
zyp2p)M766{)#kieu2O2+XtnR&lD(mJjhQG)in1s*z*PIp{xg)s;%y#cFL3yZ(E5p8g)~toKa4oJvCO&yR
zWG?;9yZZ9WSO2$v@E?Eov)j*q{>!JQCotsnw0EtwME{&L!T|`1ClO;b!+>T*4ny>)
zh)|4Vq{w_`4*iV7Jk4zA@M_`F(zz*56bl@H=#F~0%sXQX3&igBD!CzKW*;9Gb%&-^
zLj@sQqNTUF
z%GeNn#`Zfs_z#Fg@Q98N5#a^v_aZa@218k;&{?eqXs}q^lpC7aIfjpS<4~aqiWQxm
z_)*J~Stq5hG09zZ(av`M0i{cQG^+~j%!>uq+Dr12y_ZsvWB!lKvf-Qz6VQQ<2=X+4
zpH~l4>q^@UXQ*LPNzy)hM<(zYU<9vg(Idx_ga&6@h$pnY;dRp1Fy%L;g>Q=-kM=qF
zn_&$pAAp=
zL!t9(ZLU-?LbhDO7B(hkdMm{#Yhfv*eteAi>iPNWUwr*P?)9AGhKRGyv?X2K&^){z
z%V~iIqKa!>2wc~C_x9cE&p!Y1%O75sPVSH{S{k}eS+r}Fm&cg5+ik|#jZj2UinzF&D)=n>*?u}>1j*A5cy<{q~5-j>txY(B1-S6=i=9(MuO^IU^efB
z?lf!oZG?ajCL8?Gn?m#mlT1W9HYIE>C;d#O!o-fSYo%70$etHH8*U^vyy$}^6paB`
zf~rRosIY1-ea-2k)HjDJcl#8!fM6x!X(K=*l=ev=Gg-B*Si$yrnQ~->fyqoA1JaP>
zNO*dLJ7xs~YmX6>)w4zjr7_8F%uk|Y)Tj-
zTCzMQMAou5rMb#k`m@+2u(3l`L?EN(FQJQrph5H%K%Txzh;O$kf5#(c7hK}r3Oe}q
z19$2W(N1?Xq;7sdLqYX2jZLbT%NtkuWo9Cih!`_R2FA!45o6Br>h*``=U@5a^S}Rp
z{8Qihl=pjuX5~)OB3`HzQ?Xy>VA^4;pBj$)MAdn+(Pvdrr2v#9S;JuE~?XqeVkyFgQMAlP&k)lmWGUqFtSbLeUXWM^V_1L0P0ycV!wSI2Z%$^mxJ
zQvkoN+PgUhL}ct$_q&{npx`_*Z*%4tF+x0vEBru4NW+jb`7mwB{LGS246Ij;MqZ?tk)sqJ=VKgJ;O=p55wnpkU-7@id3P1ttUr&rbstg8Cx*%cjYZ0
zuba$~AY
zzR^vO-fwnf3`V*q8A0}w7r1NO7$hseIdgR82Y0@}sx44#t@cz^)m}2eY4De00H(Hy
z*nSOuQ{o0f%Dbu}Ru1eE+p*N9vxiRBy)tC{+mH|%^(e)(%nZNCG2(YwVUoB$e|&l$V^2}Nq(|>R@2?XRKgMf$U1hbIc-;9+c*Y
z=e5;WWQ_of)CUkTZ?Blw*KdCE{^R>GZ{GNtA3@~lzV-@eU0hdk+HqE#gKyrv9pmW-
zKl%{@yRPVU5KY+n6eDR%i@_GIZvCa}voXdT`RE(h($$7N2Xvq}51bfh&WIUZu?Mo$
zwkNB6bpJiZ<*J%wp!a|Nn
zJZ5tV+DPNmq8kOtqVEz3>oD~A8-CI(vdu=iAi@i(PHp~M_6CjGvOf|0SOS~Y){I<$
ztGp&xbP^*hqPBJXeV2~?2i(z3Z0lr1PFDaK@O&-T&N0%@k);|C=4nH`kfy9P|GavnSQ*oU
zK`}`*+)Um7DLo81Aa|ajXi(ceFV#w|}PC
zDT0y5^0BsO+Wm-_hN*k3F!4H=AJP0M{k(s
zB@${6<68T=vemll#l(c0#Sfk^Dl3fo2A=8%=#Zay}r^~_2F1>Xe1Z@;j&
zt#37vn?#NQbv{ls9H})h
z9NLVlH&Nv5r+my}@4YPPNt8EiuT&-YlsE55yZnDt3KYlz%J+UC27D--Oh*+@#7OnH
z0huw1vG>C~6y2;Yp1TzmN@n!8!i&aC4<@Y_-@yo(L3lq)$8D8@0p}xJ(vFz3op~ih
z^h9nSd|Ip{El}#}vz)5Asw|B>!)dBiGhSkA#G}};A_JOSsd`GI-p%4jXAcPXIZxP!
zwcn=Cnlv%>NEm3Lpo)_qMwNz$I?^h4a;BseV6A{Jpo^wv&t&7Ql>k+1Kvk_3kr~r9
zYB||0ouhCm=mfWXx`6JdI22Es%ksVLS~^gham|e3@K2nKMToWjxA&EjgeI3rITS=>
z?5%4W!{eISY&7b8aWJ7KxE_k@-r%Y#(Q~yfaUPv6+EPgLiVbX!IY2XoPDui2Q(gTz
zGsUp?PkOdCk3gS|r#0&gczT7>epSn|#L|ZgrP2F5Hz=BcO5Jo;v)B`59WlI+x1=0<
z*BC?XJ1ROKNpmltdZE|t2#MN?6v}X5jfW|B-R4%}Kw_Kd4p!NEd$UU;ZN2JT3vkCi
zr4rTNRKBNcZ(l77h|0^r4fZZ~cYzihy3E-mG3U&|H*bFS&D&o_j1iWfkc92)fqy3K
z_g3tJkK|hSS_R2_T2u=Mwy*|5G+&KUign>
z%xLLjX&E&rI~z;b5}+L!cFP`Feh7dxjV1lGQo|e8MD-0fy{X#0V^E
zrU^2qxFFZ%&`%IyEr^h|kJrb~zx|!>fAQVDd3{*o)ATa>QJAnk@4>B3UCgsDJ4Rf*
zfAh^xKYskhe46w2O23g}?tG2F<8Fx%qo|++AG4~thaqRUPu0L&-wx$zmzi@+gJFo5
zn5f3O?6#kQrA@8j3IWoL2!_OL&d34V5446JYA=Pcy@T^>`F@{
z!kP5y&?vh=sO%;q4MOZ*tmp_7j=}(y8-%e!N0QoGWEnMP!}yqcFwgSS!4D%|2dgf@
zvMJMy9tr5Hj5Fpg5bAWV7;dE&5}%r+2gq{C`hi2v2f{;B3;CdaB6L^+cnp}Lk5OcV
z%|5izy&|M+*%2{Do|P%*vfeRf42H(5c8h|BNy*&7aFsJYZ75H$%xptXUEwge_1L&^
z+Bzb~V`WMR*}icRIl_5h&MC0iCZ4yaSGDWwuYdkqfBZN8{Ga>P`+ePJ9?md&9cuqR
zj?b=dUIrDTl*b!G&waC#OPv;m{6^!Ta|XIwp`$GVo+TR%5bEAfWVF4Fl4Q%QQqa(2
zGWLrWH6`ETqLmqHILeq=tX=zlUu#un=1`w*t|cQ!t=MjnRZ{4@3io^MOXXYooQ{YL
zbu)JI=x+bLw=_FrBsEidWGhjM7Oz@6MMPG?jveOly|2~F3d7I8}`%PSVWbLpfhs8)KC1tq2=Fy>9~J`WZa
zz4k5cB{IgaZYSh9Sv>4IyyoW^Q@Mo?V50#M2--eUI?Mo38o>A>td+>)KDC=>RcO;I
zsBNs!vF@B@r{s`!hsChR4Ez7796`gW`UJz`!f^F=jUB
z{j{~nGOfSubS{u%#26A+Iy=dben}z1+5zqukyBzTN&d9zv*D3?tUq*hBH3EV8zp)z
zM@sD7f&IjJ-K*>!=NOtkfQR(DUnNqyHYFoyNn-0`j=mw4MfiQ3qa^y6YOP=D$S})S
ztjd1M9nJLU(OpU`Y(p`4sAax%50T<93?>
zVuYF|+@2jiBlI24=)%8#c86}rWw{D&`eNeTlS&(6)zTIrsjSbbTLTlPs%uo>L}St6
zM&ovsEGAvQshhZbdi7@S^Vh{APfXAOC%w~$=bwN5_9q)V=8VifZn~7y+tDRQZEOU>
zV1Z=(yRZwrxho(PjoR_1LavW!c4JbBKRI<50-Nqc
zx0$bVa_5!_X@ezY3p=u*k9}?Da0l!cyu?j&e|n*2#r@?xakX(Q5HGkUaR#vSo%=ui
z=ya5*vxA-C1SES9&Xg_GfE%p+pTjo_P02_x0%gRd3`6RKi_GyPLW2R)effQ0AP7Or
z5pl-TxvcD643E48;a0X#3PNTKTQ~)S~`E!Ic5}C6@qhdH(=PCDANYr
zi0J8Ou$0Ru8X-02Egr;0sFp>W*AQ}iA1vgU81t()AAbC6-}|rri$8SB1xhC5vi5A-
z{%>?;p+A}9B0K0h3ead}Ib$=@t(ztFH)E#i%s95Cz+QD-Vje1o{vHy5iro^~AaRf9
z1omgDPAg3W4Nc38ObH<^uJ1gwdq1kZq{v_vv=tgt+nm_yQ9dx
zlyijgrFEHClqX|~^eZ6FSEM`S1BhsAZ1u-BkGJV7Q0N0&iNkf@wauxAM;(K~k|72Q
z(NbTk&nF@Uvv}p?%#f`yFmJ=zvlS+xzyP3DlTJYEMbJkNpaH@W*Agn%@8T3jpa@SL
z4LuVzBEqPC+Z31DW96UT=D-?noA6XgEooUX>z&qW!-Xx=mQw|iqy|%~&LkLoVBuP^
zMY}Qe8HR`yaGv9k6|N0f%$azM*g@@zwBwo{O>MeA!h?cc?d`pY+Sig?Vr^Xxc5z*n
z9igx;lLUM5eyLu=)68ASfv?}J?|tX#|Nh_p2S5DslV5!G?$zxTq=$;>Xk*!%vOAEF
zl{gQLC@!&A8c?pWN&6$PgCzTu@po)!v|p
z#1cZGQ`Z6?BHTo$<6TFqif4P9IUn8C#}jPbXT;BqXdzxkA|t~?p=ly&fOJYwO+&^b
zhjGnod?CjeEL3@p{fm>y{CVW4Dz~hkXroIa+mg$ik6RQwX8
z-gRglNzfh~H7T;oTrO=sjLbw|8$9P$3z%(!fbdKQ+d!y^@vIm(PDkgJ=a4IQ7N@+*
zS-xu|pL=RNIDoPmIHSMOO}WYgMe?k*o7JHWM&LH)IN+L7=(X!Iq)w8^9Dqh*n(7fZ
zuGitnQ2K*3Ffnolu=ny1dv;PKoG}6z#E?uw$+&unN!ji2aRYE*EK;3Y(Y)F4hRlfJ
zoWz8x$!jXTV|#IT2lCcDOr`GP@QJ1^rDb!?Us@_%3A^3{NX=MEZjB;>lCjQpN_%1C
zRLb^9jjM~jkc53m>@6?fYUz9D2!3kLQDt9ZcwYff4A#h;fKIboK2aWNyU~sPezTTwAm!N983_99(9atE0(lxSBSv&+VU@)&8Ze>0oZeHQTJ7c-*LwTSH~;wK
zbsysu1aazV#R+`?!R^cF1=!Z;RoDHlJ@Mh)`%gak>^tB8-hExoSUQdw-16(DT#;I9
zt-FtmA#;F(iD}y^#shHz)FayXX++m``mAc1z?7S}y*y;=Tif-PSHAL&lJe2%E2Eq^
zJyOAtK2e4C%o~fYs#R!M+yjLJpnE1owrF~h_J)uWx2^>6@P?gp&b&p8)3}lbZXN5j
z8C7bh+L^l<5bao~H*E;bz)KqRIMsu(B^)F{_n_zT1A^OKJ_^$2t{f;6@ZyTq66VTDUD`}9avkyB?RTsNYRkcdoH0vNX_YzBnXN~$diCg6sc
z6DXC7&oNZ>iEh$l%G8dIsbep~D68sOedBz(<;b-P5;D12D>6s+B)d6BW{i<@&UYX0
ztm|+6^*{0BAKvbF%;{WUw5X}?J^CCAKNba$@cE|Afb)--xh8y~>qh1D`jlbYZ4@YZ
zRdb1C=hnIqTkke01H=|->XuHhdbp)Pmw$UW*2GnFAl(!)7JIIf^;7Bca$
zZUuxakgVl1SlyV|$SE}2>`W&F`jwnhX^Jy)h}tzJOW@4p&{q*~2bzw!%m+4YrZq69
z838o=F2}fe8@9c%r?f>*Rm`E69X<;wopUNvA0y~?Q$rqJ?bO6?05!%qbt#V^3aC}E
zgyfHgb+PZ|{HbU;ggj{+s_x^8W7q
z_4N96gog?0DAM;7LtRc(AQ(ff2BB_70H_GHk)v^8Eq@=c7P_~oJNmSP@$AQGVtKmd
zCrP@G9)#!c5eSL~ID-L6c0t`&t2C?C?nAn)s(8Ic;u6ek=x;EP};edAX*G_>}NF7LS?65@
z;5J>NCC)y{^{n%(U}@&43^J9a43JgrYUU+r+goz$xEo`RoDt_r*n!Nnb_Luq!TTjsmMb4-W~ooE5ou)qs-w{ciNC9Zf#sY!GR(Oj;?3$<&n
ztJe0201Mt^XlLb#<)#5=YpNHUAL}$VobM&zIrEQI;K2iIah-D@;^DR`sbdt8M2=+a
zertiic4-&=+>j^U)Av=U+zrCkxYe;La%9On0}(?FZ99B~IE%_|nscJ%((cF-<3v$?
zZ)VKlKDa{li|%>F%2dHf(!)#T943gB*~BneF@#f$P5{q6`Wd=9FkJ5QZp?9;(~ny8
ztd<|0toT@m(8w(ZdUWZeXU}rpN0L!%nd27jb!vw$gV9S~Ss|*YSix56i8yC8Z6nbs
z&$vAy?r+}xN&HlbF5L~oJ#E3))y7<8let>xT@a`^g
ztcjOM-x~t#X))9EdFLZ{B_N?)^_Qw~*ZfOu>}YFaTqXfsj#0F@JBn
zW%u$Ecp!Zk64B+3fk=tVtFGcQ|7m6bsX_FcA{*7bD`@b1{}%S#*_W*I1f1x~w_1{H
z8)&ta`K%0fM+zKDT;F<$xaVq{?X2Cts&q`=-Jiv}u6r0eFRiN=d~D0!NFv6V(MMdb
zW{2PK%qTsGp2bR2AwHpXBTltqdpu>p*r7krEb!rWGzK;#?y})w+3hOzfx@@u91XWC
z!PMZ^lo=~5gCtmn0F-8Ew5C6w+CG%Qawgd0JA~#J_ud+Msa%MUjin4g0}tt!Rc!~|
zbuR+)jCG8!t;s?(CRhQh=}6|#*{b)BgMg9`F&;N|t;|rl(0OLIPC6oj70j4V^S<^s
zZ@&KXfA;tP*+2c|$7j!rrvYDfz0k>1t4f@yJFpsp(RnO-Iv$}7PV)LXb>Ujc+H~;N
z@af`zn@!RpNKsG7@v{Hit+I4~1>)sVnIdZS?qSZk&2mR=T
z3(#$=7x%6ZSkSa*th#`*ZXRnID-dimjAg=qB1Lh&YeHl4cG*i=lFYUc5
zb~-bI*t_<&(R~$*wXVH)MQRFcW4)Q7-nk`+0$Z?lXgVuM*5-AUtfXJP!kBqqN#gy7
z`(OU|f8*c#cmK_A-o9NMuU@~>36B^o1V$@RQ@)v|<ydsUT<`pc2GcMCL(O_gyVP2R@PA|bjKX;*nygifLosPF`JoEEldDFLg(N{x)x
zq~wU&oS{>{xjq1Fk3)gLMIMQGQ3bEiOzX?oMYvDu7%kG#@5Cc&>7d)Tm?8uA+El8x
zS&`Czf{#e(!1Q=n1|4Fp-B+D{mf>2VdV+|}P--d4l6JP!Tv-5I!qv&%dSnmu>vK8W
z`J-&6suqjGawu0CVrba0gDplWR-}?cXs}IH?X}npO|N!D4(r4sG$UNO6`5w15GrJ{
zl`k0q#-kroovXBltYdFlv>?LmxT{SdUYoQ7MYKh&
zzc@X=^zhrI4>hirIyBG6>PwZfobs&Pr&iHb%-+kVgT?5%vnM7L<)KHKl>|V)^Nnp-*7;os&Wg2to#GW@2IMwG-{n76x$|
zoy$N0ckQ(oj$C346!rYH0
z)d~nEO|@14&(F`u@xved+RRt?Yk86l#ptRI@p0)u>)i>Qfv8$7{n*l@Ml~X02|O04
z)vxkJ#Q-e>wHFa5Ty{l(h^sEmv|4);*s582*ZOjVv~)mG%B~yLk|5P7E9@oIB4~kx
zS}?oJa33208CGVFK(4*hCO@{A)H}^gjR4LOV@v~F!YE`W7Q=9+`~4l|b7;t8M5cn1
zapdMPqPr;Ffndvh5u5^LFk;L(pPxT|^2xWp{PK$;K7PE|Fluyt)OAga5g9|sO4TN+
zvXJurQkO5Uy57A1>f`e_bI!EdK?FdI@QB3j1r>6p14FD78rKk|DHK+n_d3x$kF@rt
zS}s#fFtm`m{dxlG_2j;;VtHmD8L$A`C5y7C7J-J5od*;uOtCbMB0!5f5P|A#ES|P8
z!frtkAD)@1{Lf@g4lN|wa!DnK$~jg81l@V-k>7^ao$vdwA;GoE{3gsud(&mc@k^CB
z!rMRm!+r#|sqBjc(WhS{PcDPKAVMF=05SlfKwiIg*R&vr5`vu`A`5$W7L#Q!t>Kc&ao44=(r@!Y{
z{`3Fr4`uEEVnDfBZ&9F&*68xJztL~Ffq59nRKSaP@yk54s-lhF?aPxtBGg9SrLRAw
z;X*?@3P+8DARe^*`NqJpzC^egwNs`Xj~_e@oN(100I*?!p{Rp!*f1Dbrda(uBg6ey
z<}=swE$K!8%sD`&Cdy_sE{pR@{g3`mYfV17!zLNomdh#CfM*>amR*fhZuuJ%v!~8_
zS9HY^%{ysDsf3X^xy!o6%rhw+=8+oDRu9S%??mL)Lu3RfN>(5pybW%p*>V2eYUwgkxqPu4}Ko;nr)UE&WMA7cWRc
z>3flDtxe{T&0#NMUA^Sx3u`MV;q}uPBa7pHVT|>E{=0wjU;9J9`>S8RBc{+32ZW4>
z7$e=8tdJUTt8^!kkwYesbw;G1&b4JK572OdWEV?-%?^NQ^1|(UhS4(RUg0{*ysJwi
zJ?xGQqG3lm;qyW7y_P_5H_EM0px~=V&&|k4S^X*UM*txwv&PxIq!nbSM!|5TQs$#*
zKzmCB%y>224g>ViFNT3ag(XJps)|A)A5D<#n!hNgVu-Bu0#`ccC+QSGd2MB;_fJd8
zeRsirZbV>R+iRt40)!)kaT+Ey`&n98`zltU!p0)!n1i@(G@TIgx#fl(o{YIG#g8g2
ziYl&BFGK{|$&(1g<|g;aos@6*6iCwsJu*NCTgO;-K4t}0%rOjnz>S5ZAU4b~^}qFU
zTqg&2t#;dbP;GiSbQejT7=>>Bk+nmUS3Y!Fo19!=#<4{!))0RX73}r
z@856dF?v7+3LC_e)uQAHDmA@+hUZ~sCJOC!x;O2d(6m{nE)fx<4Z|H#l*_rs=z1QV
zMCih-L+%(3AY+UnNwPbq&3xG#6<2_OI-IQ-xw+}%P|&Dk!|7^`
zPU*+ExyN+d94As4ptTQsF9Kss^TyGXvbyCDH_$kHs3|zJbK_zD$^4&`dqbP@Eq(Z`8Kh8KK`}TS
zrdUQi_IwVSQ4RAr4%S3S2@$(?
zHGO0mg4B0os1JI~o9nVnxL<~ZX7V+Y69~X9i0wW%aC`8Y4Y#4Zj6X1xAIbREtHi}zaPL8&m0zPYXyBgPoDt1cn!CNHXl21ALO
zuAvtg%e^DIHtNFa+GUl2hu&yWUC&pJK|)3BmX~kDoax{;WZny}HvrT$;4Rk>7vAod
zP7<{$GmEHIhaBF!#>mJaZMoLDzOMtKFUkBMC?(67L!pKV7RMOcCaPLB*_AQ?6P&jz
zMvj51+Lx8FdvPy-k_?cAIq=D=SR26j=1qO?yRZJc|K{KO(GOmK^Yy!@SFfCTjDd>C
zks{fOwYL{xHHq>9RxcYXI1Q-U2R*bFN@>&_(Yhyc_ZC;oGtQnWDGX1W0@d((J7tNN
zvkbveL>;H5+u;_0xg#^i=tw9ftuqeIbVZy^?sS=OxgzG4
zRg%={X$XKQ7E;|}jdjwAC~Nz*!SUQQn_5CgMo>9Grx^a+hL|jDv6N2nf+fv`c4_p1
zU$uc!OHZwZ&PMd9YwhEi>Qkd_F0#k)o;p+6iVR-@QDuNsn`q8?n>}!@C1$p`KCbl5
zH=;2(P(`5H_MF0^wt5Yf6PT|<#~l*VlCw!Ri^Y0{z*sR*yY6ePqwx1Jogm#U%op^j
z1FTuI!~MGMRm`tiF7qr?a@Y^Wmk0&ny?nwID@=TuN;@T%eyufY=zK;S%%l?ndu=Di
zonJM-z^ZCsO7oVGk&;IvbyFQQ+~Z#wUaj=Y2L*OlkLvb^QZFJMGY3A4U6l?J9NuXv7pBjj!4Q
zPK^OZ)KV(;fbzW5Enty0Azy%GZ0Wa7<&4uaDb~{s+)9yVMlj~>rcdA80$IZSW7&B+
zBGj;#>bDlY9%^%O)sFzyBFT|y?A1G_($aJoay8}4uK2m#5$q&h+Ndvo_`_G9eD?f&
zcNdeMULSB?_(C
z*JF=sU3>4aH=0q>F(!gK@_0Ccgh*?NlGMa};7LHuVt#J0dOwE-ijEZgH0IPh$QWa2
zs;NVj$$4-nZG(BN>VeZr{X57CKka81FzY)<#AuvS0atrSzU582dRz1l>#uX91KPOF
z+qLoT!~4JR=l{T;__w}z|KVx~4<53D#|Ak6kg^1OBVKDxMOx+t
zhm1v_>s+Wt${r=>qmDi146gcgh59ary_ZfV6P_T&k#W0uXR#*EQisOFiYeIte{qMpMcUFa^4yxSV&JRUn
    JITLO-BK
zD5ZQ~Fo4)Divci4G+qO-f^(*waMkW4Osrp}*2ow!Z!tzx$&f508W3aGryBYY;)~h_
z^QL4qa>PKay;tc#5n&a|s!7h7W9roR8^-}O!x&Ao&f;4W9ZnnE}?AM9=?#+C6b{n#i1kq0qyTp=R)d-2f=kKwUWm
zz;Pjgo=+ab)24@eAQ$O0UJ%gL2DD@#lpN~CjgdXVN4F^o+J~ARkq0OHt8^D0nh1oHE_SYf
ztLQSq0t9xqIl;vE%yw-JBpdCP-)Cf~r^cLi^xNsA-64@y?>Vsy7t+0W+mCT#!oBi`-ivb8ijlF+$<$D^9;Ct(CO`%qf~1Z#ok0
z+Qo{2(S$@3gDfA@O58m!U2Yy4_^cKInLJx43azd_m(F$-bj=Nwph_yD|AUBb7+Gs=
zipDLKcxP+7KEYmGR@(blajZ|y<2~>3Xt_roD&E*=WMpRTJ!Xnr-L=(*9ri9n
zDuFZHuT>2Q*)I)YvXG%2YILll<2Dh}uZc==3st5+GkS`I!z_=|%Gh*WO|2@_QIfN%Ud09#nhky4)`V{J?(DIHJFYCK>Od=U9FkCYJyKp>;~*QxO-NCfu>rusX_DR;lc=B-_qe;81D4o)Z4_!uP1Q=*9qoA3l8j{_W2LnBz$TGX!8B
z%TJ08oeIb8IIOf+HB>wjJueNbHzJ^!0OBPCh6{X(Uh$^qnnbDXY{@fMo%0IROnVuS
zwYCcpD@z$Jq8y7Hpdd+Az{WoiXe2q6u7G55E2jsds#{GCLblz4x~~-tTU8ZegeNai
z(L^67YDs_JOG}vaBTUgEK-s7aGU(xCKI3)ght4+8)yLZ2cD@fZ7QwT?E22eg=$q6A
zY7Ej)w4r5bK9Z~wxFXle7@EH2)oA|%IM@mB44_KVlfsKspTg9k?lNhNg{K(fEM>(~
zfK(G`N25Tu%sRj8N=rvfxnIoBQ{kizdZOG%=~gNt16Z{{A_jdgiAZYDuS<@U5|M;g
zS|(zC_4WJT_b>e5Z~X86K&>6XNT3mcz@xB$K@(pTt9^S!1@yM(%bzFW=zfoAz{X%~
z4S}%1=Jf1ITV6tCt%hg~jSLOMS~@@>Qy)Fv+Jbi@+IUuH;3HvKVz*FB`dF-sMUDYg
z#{e?0*5$E%RJOj%pl&(SWUTwXo=YnSQndOOsI#KF^$ig@bId5A
z%$kxKv3Fhf1;o?SRDoKO!WIbRh^MDpB2}b7W+3{6Eh;Sbwc1fEYS&sjU~O%!s;aej
zSoFI!41=tFt!u9go~h0{6!+SpCtyZ8b;=Z3yMT}tGl}c2S%O>LbTJhA6uf=4wMxOz
zlfxspIYxR+cqWjU)&~NySLwa89R2iK1#PgnH)~Z4L~vbd3#@f*cyu{QDcVfaX#_~4
z<^e%xV69z?0zmgw>#k}wc5y9k#C36Pl6d_(ZX+ab{P1!8mB0K4f9tpY<*$GFrZ(ri
zu_AJYjTM;IW&YU*pWa~KW`buln|MdNvvwBQS;e+@J+&^CNyPB;(H&QJ$8~eQLlfPc
z1RKl<4;p+7chD=A+ekpfu}M*yT!{cEIZ(fyHv5p&@>=Syg{l!b#sG7SSCM%8
z;pZPde1nR}iIJs32CkYF4K0ABp&?%f!ZPN)LEJxln3-RE{|5nF`;w6mOOyuI+FM9D
zf$lq1iD_@r>Vu=0P^V;NPbUE)Fb`-_WHC?s2^vK!$wCEH^z<2M(lX<8{wGo|@MNaW
zvdoq^p|I4S&V?25GEUWdejyA;n6qy-=J*@=DF*a*{C@kK;l
z&+3&nIlw4jXEG$-3u=lU(2+NSg4TMFRq=ZJ;j8ESH#sxrG}_ZMIS+Cc51tS1Wj$zx
zmUl38{J3)Szw{H6%XC116H$qNX9m5LFq5pvLe}0(scjCQ_5)61GKEC7FD?jdjgwLU
z(2=D4o-$50Z0b5_jC2pN0|kI+p}z6UM)g|Mm68Kg1XpdADS~p71V+TjLG>pDWe61+
z@>c1uQs^IgdQh&C%#=J>%p}ypiv~Cqe0n`Zzc|sYr3oWGVA|6n@+|Y?_Do5d)9=iv
zT1PY`<)iOAIw&(!k6uYg?bVyLZfK$1q3+0ZpXKFYPRsbFElLI)Q{6YKGV4FxDFB&c;Ave9L?OKR_wphN0r^1}6;Ad#!|<>A
z|5^nk$w04vG^SyB;+R216`$|Rz~vOE>(|x?yaOQCBD@7q
zq;d-qMU}ozsZTiV^bei4G})N3_ugAf5sQeC&Ci=tSK_`35+mQQDpmroUSkeK;(o^`
zpWwgwdw=ft{_|ga_0`vN+%&b_$v}o(V-;@P6EPTVZRNZ?!hs}wq`A^{>~*25GPs|y
zg4@V(o41i#znMAbc#IP0)$2+#qIZ%{HC5A&RA^*wgX+tQh`noVd*+wzaJr+)Q6*f?
zwZ*6we$#<`$U58_2K0_-{!pEhQLLB;t-u3LB_l_4HrVzbFEa
z(k>1LInM0qNC27K)aEK%L!A7s+dp*iJh9AX5n;fgn1NpD?oLFT^@OY|+;l1l*iim+
z?Q7LmY_Q18LD+?zy`6=0Xk-8ZDW#(!0`(xkH(4wF(uscq7ckKQfMQckBu>2-JV`OKY#P~{m+=lF#{8gKO$9sn)awomVyKjM2<1Wn9hS=EK$+O1cRyytH_KgXAHdy
z0LYf=>R8OI8IcM_UGSOyVkX;wz*088^rNw4Oi#9su`~!psYqRU545w!YYeEHJ)bZuE^S3fD>76evL4ztVG1NRwu!DMEszXmgVw0pweHm
zv{V~Kp$Mz9$O5*_xR0d)r2$rcog`Eu*f3y(JX;-G1X07i7KZsWIkJf(!`&}X1o3GJ
ztaY*Bna-Bn3si*|cEeMR1oejOcZxGeB=FW4Lla?pn3g
z7B-8l+G?EX71Tf~jht$q7P(I+WdI(Bm-S6z~WE+w&E;luRQ(YwsW<%0tF{)yZ5LK$Ks=yTUX_bbyc7ZX?BU|
zPQyqMAr`I!1O1tbr5f-cVM=YXVhjYZHkW$hB|j-ZNu&rOVqHeZxBZQEqIYYP(C|eO
ziRu&F%k7|56Rf~0B@=&Pij>mvlSt*S()v>%oU_ptQlXVC5
zK@m~AxV;+Bl6L+_szMM$vi7nu5-Gq1YHg!=(S6_Ecy7-D)!DJFASHQSD^&9U``QGz
zxfGnObT*YL{N`u4@9VVAl3YtmG>Y8UM(cQXVJ%!2cHx%s>dAV_uiw<~`qj_=-rxQ0
zZ+$l2eDm(<=@m-ee@2&7FFX4;`#wU|#mH)TN1)Ifqz_IAO;^p0M+ilAKnF
z$9V4ST+l&u0%uUerH%1
z{T1dd^}P~`({BVt4aPa7vA`Eqbb1g@EhEvE^HmL%!O1_=Qm8zxOxmjvty*odwyntg
zHi~f5gxdsCoGRV8BHL{Mk(MqhiFG%3KPzX2((I5Vb}jGQF4SX$CaL-$fKLkLwDbfs
zJhTl!RgFxLnaRMhi1XNLHX0$MPfHBcp4U_m3&Hjxk2QBs)hO<@RPV6Yfe&J>iK-(i
zF}z`&sL&1{C3-QfWHElBBH4$dgbv4>N|RY|HfPu0U2tnpm3w9NZ(_(eQFM~wB;UTl
zMxAW}@iJ=fz2yFNyWKur>*L#ZKim5X`S?&7Ka^FH^n4;bZE&I
zrb3e%u#|tw4NEnO{IrWi499U8ISH*)lEtk@eV{$59oz${-7-ebkvd=XLkDaC4f3b%
zSm2u8Q=2{)OQML>>@P$k9Ifdz=Nq+Ov;9eZeE-wWzO~lgn;l@pGHFRgB*wsLUR7?c9Ca98iO9f+kL&&0cVDrtd3)7_
zU>HLZF6kz1McW?j974oJ4vd$ORafRAr&c!*bVOkD+rme~R7F*kPICAR&yiMAH13B2
zxuJ3ET3MNdd}4FJ#y+jR^6cS~>Cu2`^3hssnMFv&T
z-EJg&nxPRs#=}JPC_KvNL7*AUpVY&Ix;gf24ajUS2L=e8|=rc
zcQS|il^i$Yw8}KtuY=M$)y|bWdvj=OCf^&cTs)g|o8}XI2p|w+Y!-rJ-ZF+>e5Ac)
zGot}J8-zxNTy1mSB5&WkegDt@_=~^(*Z%N~9q?FA1q(xQKInA7SO4$EShOLk2dC(u
zQ+#vCafX%|DqIyQ&;25zJ4Tgm3bOU~wDOP*&W#@E3U{+)#9kHQX#~|0J0G_hwO!oG
zZmN@S?OJGUkBm8z6F~&`3m~2+fy)kF}
zJ!uHs5(UKCC^7@LiKnMn1j!E{uRr&vfA??yr9blK?YsNEUcGu9VfC##+?AoE_@(qf
z+~{WG2XH2tq_ZP*kP3_F&QT{|zaR46dsT%J0c;_a2a`2ip02RWu_RLCZ@oNJ(})Mg
z%mJ4cF-AIuR7DyY>1W##i->3jPie4oERfs|t$L3ncjbw#0Dv)kCvL4}g$Ffj8#w`M
zMo25o>@ldeDd&H3CD6!jBE5PQRjbVR;rp5GnO(7bSo`f&@05vUH6s
z#KLhPJTk<{2oW1EWH^Y?<7a#M@DU$+E#jzC`(EO#h;UWjzpXc~Gtt}4*`$hS&*az$
zL83OZ=#wfC++sLA6dOV_(^znIcV*#4kf`%&^>Tx1>c~u~dX5Ncv>M-QH?^RY^Hv3}
zy_$n`Kyx@ni#444`tUEA_h?vsVH|o5!3P1J5hGPaW^6$(|(TCa_1u-~m$62QHOAnZ_!dlC6``;@WYzx&y>o;$xvzXkR&7m&$l
zn^nKa4a4x03i503Pe1?sTi^Ni^K~b3ff{`GXI;
zjAT?5x9n!Z?2Zoo&9ZLFucsGxFa1t-7{CZiTQ|3hEj{%NcT8y2dnAEXJ`q7p`t98b
z_6krQrRXXULh0LDYwL%+IxY02_zEJ(wN^jYPBlZ-yeESJlq9jXCVx^2sPJyr@9nDX
z&Z5YSA+#HT;F$9knIq@SCoq*4Yo=WwcdcvJcfb4nPd@$hdR}#v-MFEA6wqMqMl2-d
zwo1ZOEl`x1PLUs<-@JSGa|FkbLr8QejsVycj~474bI#cylY?M414q;2Is%>Ph5Nf3
z#_R3nQ^8}(9BqX%(HeTkBWe4qRzw$jY7pfvd+w1Xhv#an(V$W2P_?$l6@}ovh{!Sf
zcyslS+6w
zGEir@F=-UPoYj{3k;=?Dv#NG&_W+2#YycTJWqhI_it3!Sx?5Aa=ZF>6*hMvkc^5K#InXz}xTSl-hhBTH-*gZOdWKXk(hXa5
zDtmLxL9`-Tt^t`Nb1fg}B|paSNLbq{1grL1TOZ}gq|M7-*QO^NRxR#AF|Ng3u@9pW?|)++f#~tH_KTnc%Kk#$#Q&DHzhlmBG>^ToP)@%sGb)
z+tdAOaU6h6@++c{8AS2&t~25{{{YU$d+p$jqXuHxRA%{Kwi
zT$%1vj}~a@c=cv6+oKS9;=E)R6daWQ
zWF#Z|;5C+4#r=Y?>JQlwS!`I2tSZ_5r1>-u<^#1f^xKbm6~f|MGf@R>xJ_5e%cU*@
zlPWs?AF>slASlQ~7tVX6(aF(ElMO&7B5{g2t
z(~`TJ-c=_UWiiy=o58g<2<;#_AXHm5D3Q=+4@&^(``$iN*q5V}%1N1`khBo~{4hl*7_v!rluKe^
zQD>qlcXhhcmu{ej+`C3TW#qdLUwyd0i4azmEh>e-f=3RJXO&6`ttaYa6>)#Q=I!Y_
z-~H~jF0v9q7-=p)LRIP+EPIkiMC2;xg%(-{tC%sWqKrJ4@GPgnrE2|f-Fh=G%E{8|
zQbip|9N;&yOoH!1A!E#GodsPIYRg!0(+U@bw#37Q$;&6fy}5dPe01!BZx5`7f?Dg+
zR7Z4?7VVM01-K8ygYj61rWxdw-~)|*IJq5
z`(J$VbbGq)53`#z8sc@@=%bxEb(2k&?g(e*to82wFP=YsJu_!c_CTR<5o&%|#l~&i
zvJE74Mz|!}OSx1&kS)kcPVJ-7pplCz_ePJ*P=M>kKy}}@en*OKGE)<&4CfgDGlm+-
zDGaDIipEy}ATr%<;qx#$Gk`Z0i7|}U=zOcPQv|^?&r^t$gN-pHTF(OJ7~XkW+#R(5
zsq!SbvpdBY0}X*II7H;g5edy9O1t&yaXoM+OEv3_Yu#Q&-&!tthJX9
zqk;!WNaEFermBmB)M|GbjiDM8cF}f)T|}N!un1&g?RCF4LR0CSX=K=8Rj*UkdXABK
z;0>Qrh*pooBL*Ua5%SQ{qkfqNc|WKr8!SSfxw*SJ2QYJ@mng1HIZ(pryXYUSf!;D>
zWX8BXT`Ru%`t2Y2*Z;-8^cR26^YhX=LLZ-TA^`eg&SL9~RAH^ET`Fs}sH$M~MxU8@!2s(t+Pfsp4dfWnW(`r^X3c}b)r+dEb6bKJ
z#B*k7n5RV(V}#AX3uKHDbIMQCqE>x^h_$`BFV?Dv*sDz<25`o!D9{OtkYJ%I;8CLD
zje)3=qfZo|9lEQoYwx`yQEi{C*>}xB7`sG-t*T*gZ7q$T>L^NN#z>)v4?A&X`3@hM
zEcr{(s=bFDmoyV8`XENALi3AtoOs9`)ypb?iDXI@apvPid#AW`aUn5Iy%)&Lb?wYC
z=cpb-ElIX>M_`OhF;i#lwG4rPCZ%OysR+x*$*R|~$)$374(__mF-8hj7auFZNU>2h
z3U7-T$pRv4b8p-K>V@3pkEC7znA1QiiTCCx>sVkk&>{e2X3i*}%JLfjw
zTF~?S^p!?j=lhTN;`^`v{{P`Geeb)sufBTs^y(AsVy%O8x3ki(mWzlcjv(D9rbeiE
zV7BP}0$;N(In-5u{;ea7xJS7ds0U0rMD0S+z&b)@;pV2Tw5)_E#hI=U!Y60}%#osG
zNN7q#j?9?R`L4%`bcJI+P#Z5?FABAZ)cQIj1nmJX4z{Xn<>64~HItqhPJ&y5WT1I<
z%9l)=oD*F)s!s!AM9=&VbmtxXXT$2^mbAeXEWN6oob)3RFnAIhdU8_5aHB6;voPlj
z*F|+gdZ1GwqW~Myu=djs*ryV5{*F&`HIT3NQ3R;ldYyY+zl9YqqN3
z1o**11$Q?!vtxWYu)XkpQ1yjKq(xvY!6f?_EoSqumI`{&Pk@Y4n&%GG{U}891WLL2
z6S8*Klg}X^8fFgX9fY(BD%otgI$ITk4%BE~
zmF#zzt=RX&7F3aQ%*@d;9Ln>F?&COp2NY(XA~!RR6jqm~KR_b2+FE9|S&~9QR}GVxG`L_NMC`64hZnydI<2N7Q|1u)&ClZfX(JLw-<-B&y2?>sGELNcQ
zb&Z_g{q7fv6&V)%Ma1ZX5f~7bM@Ei0rY}(2qw9xgmjyOfxT&d`50Q}HajydecU8vh
zItv*y;IvcgYDDtr>42GY<_w0+ghK$R&!@+RL*KBk$^>DDi}r`I9k}*8s_b{CLk0ol
zUQ3HeuF%zUQOXKu->RZ?BDnPe8ZVJbBr*`Soq3piiaBD=ob*umh@M<5*p&=>)seML
zp6j`Myx*U0pM39&?_$KdRsehLKG-A8KLPDQ+AG4ni~VB(21Zuhzj^bE=lh2-djN6o
z%LABr1w=%|-cslL<`a>L0&QYmz5yBe%KYe54*(_(=-|JQv=2OUf-1!N#yR{Y0
z!}t8}^TSnp@3krbnT=@O?#o6I3Sxl%24m#9%BS5jq(D|?s8Fn8ZO#e0NlcD4b*dNd
z6rpuPogr+Q1&oYrCA+1mGbEPGcomR=aZ6FD)daHWm20gcb4CPf@4bkOb&*uZQ9&%w
z_65{(3RW#7-u=37mZ*Dao!rMBZb6C6fL3DKJf=E_&}yws
zr1qTJcUepJ68>K0^YjtMVxhop!jG;hl_|M@II}$q3~wv<+J^Io(=uCGnw>V*C<(XF
zs4nqTF^-wFq%zoRZv@xchjK~fk*YB|ZB_KBq9hV56nd0s8D3XbAx}U??9IJ)M6BmE
z($$Lskb9lLeeGS$G4?KX(uNfqwpR%m?>iaY1h4z$FjBP^yX|=c6s^kAks_fx*0lo|
zk;4!%q!qs|Jp+(dbl2i_aV@UGCT=&px{d3~UHReT^(X%5kAM5O|K}e*yt_ZISFc`^
z=p#O3%rWNZn$^#WAv6Q7%=2vaGC3Pu7kx=Fivd{W8{&5vFPpsmh&1m6+=?qC9O+BL=43iuMntU8zaXY
z(}wwaw&8&kzs#+rQ`ihTa2Ukyg`gPbQWgX;rZ+Z>h<-B
zUoQ%51bZ2f-f>ZO5U9+T8U_7^IoR?dpkEnuC{V^0O@ciR=NOXU^8Av?>?X7%+|~|y
ziC3NCGa|_DJ%ri9=t+^MVn*}!(3#QEKoqo+6jRv%z>Hy&r&2F=7&i$zM^awF$L3*g
z0rYmucCoH1HP*?CAj6MEsfE6`sb034OM!=An`olzdzAV7Q7-L|RN>?~>
z@ZKX6*sPFFie3JPiZ66dh^AEsyBOKEfgwh)sv?GK&j0}7jyl|P3?+(Y^0jRB6J3P3
z_=`@R8*}1A>aP}nHa}SeT>F|bU4efM&C_O@0VNd2ohWOadypyPer8nV{N@Gv`pgi&7J#5MDK%#VFjDVNizH-?
z*S8C;6N5d+x?)=^E6bYn;$w%rD#$3;C71uuSXz}jG~8;^c$Dan$ZRrJbWLVAxdT8`
zlUH%=4&QW0
zkx4GJv;j(1V0ou|I-khVvAIm<+(M(<1Xp|NU3=6>h4u>W>Fd}W(TZ)8H){^-{`Y?B9QQEBu
zWK>{XdsX#MrH)xqyy;Hq(<;}Hfus+P*WorTm3o29m~-52V@_#*i=Zea3-A<7)xDm?
zaK@pcD`$=jRNp=$r#z7TsQMY%;S
z*a0dbQCohSpjsJ`&{+0bFP9~n=7?~g5!*Dhs^*+9QFTr9J#Y!hn%ujuDYwsAk|SUeFOF8Hfmu0ET}%p~%*2Knv9h)X?J@
znIouEW&<`P)3NFU5gpC)VT6yLWR-J2?OAI+=a~8~*TQMUl;qkA;xlv{Pk)N9n0lY~1$Q-e3U^zlwNvRPXRmnqqds=ehQB46}A=xzFNJZ98lskV+T
z2iqS);YB22_M5Y|XZL^ucJ6JIA-UNWO)gVky!YsmNgJWqwL)xGq#J|9i*85Wc<@l5
z@PHFcY{H|G%vETf>j5}Mym&HB|GnLU<(7B1n`!*HemlFJ-Ql)R2M?bISq#w&7WF)`
z2CHh4YF2jWj|eMkxc8PDgh6z5MR32qXFh|Yk6X_I$nL&Ymz*CsG_40
z8ssq34_XkRW7HWaIyca_1c1Ppx5bZd-u-m#HRn@UOR2q~q0&C11GfJ?l`%*pb{W~!
zptWy*=exJ3Pd@GoEo#zw9@<%~3U-pn7o`Uv#6JoXQ>v6_e0Z2=)`au9*xvb^D%FnR#RBG!KY;oZA;U$geesZ7ryijfMU
z3~cCgct7uAO
zH2HvlmjB3+W3nT7bJIHQ!g)mzRKd&*Mh=<{>pJj3t4fxDHZy6!N~j6r1J7Qz;wN#YIuBdYu{LwKj2tu29*J9~ro+vXdpS3%jWHrL
z7pF(R$^jLLS{x(BL{($G4)K<^WItrR=xTaU14Scp%orJa*R>Q92RHUIYt+Xvs%o#&
zfUzo!)U`3>YFpx7bixFiGgKLF5OvpD1tNz{s^%Qq17iTum|hEvh`mb2hI^^yBqAb5
zazhs{7?T
z0JxaQy-jh{?!_;DY5OGFdynZcs!wxPx$tgSQ~`tMHF+g=%ip?o40#9_#MQ4g=Exj-
z??{biMGQ-S4-Ko4JOPZvUb{#kV)j4=GFeNFtd5GOv$vL$dv>2#MoLnGVrK585$(EJ
zrp_SIQoGjP>ssr+K%lV8Rt|pX;d)hjZC_YhzS;QXldO%}`R)V1{Qm3z>TmzMpMQ4y
z#V_7|^7@les*8oaOSi+6Gd-lWl6!2Lk$@sCj<_R(^gC{Hv+;{4H&ZDIsfL`W)s$n*
z88&%}Hij)X%+t*pHY%djyeh^X5E)yv;WH>nFh~!D(!Y~lG(sL6hw^D=Q9IZBYP+%d
zp_fvr6_16aJkd?$aAY>N5gH;WNp2s$kKfhDcy_CsXtnF(uv@kUInb60@2J}1<@K2v
zQG37mSy0zvJVU~MMC4XWJXQB7kop-`tMG8j$wuj%zY{)8z<#wpW_7|!IHAtfa4G@-
zBf!0@mL`)!y5FkeB?$~E`2==Vm$U*LhTe?cypI*?XU~drm8*B*O!1^!nGq?$6pt^7
z7Oze-kIc?7+Rm5qX-^>AtM(zgAT2ooDW4g#WF)2sFV(J}j|xVFDq}6ez4zYxNQIFC
zYj99&($VjM_IRy0vC!kz>v|96Vfq#4ho4D)@T@Nl7JZ
z?^dcpE~V}W3)kq(ndUgy?ZrT&@E$>~a@QS0tpRKap&#k?EJ5?t6je(?c$S54f!Z87
zf%W$7@7(XtnXeL42`AnCVZo4Bg5Rjxl%-{qs%mrXz4mpj&%gDp&%X7okIx?!16{0T
zvyoj~ZViBaU@6YlOvpG>)IIq{mFDhgq*-&$FeZs1KUj0E71_2TEoN}MPy=;jGsr>p
z!xKfdR#nCbhxItDw%9KLU>eR*hHM>sfH_1wV^^Jn|1dV^Y(L0lA71Jt(NUZefxXgfBnfPdl$;~*{(<$
zQ5435KzaaU2yx1;gvN*%!NB|HcOO3fGKZSo)w~sv2N%l*e$rfnHc4MJ^=_Rz3Js1N
zbA+39*wZF_ppzLrJ=u^YNQS4iOH7wzj0|OgFVJZHWHx7;>?#_KYYgLms8zeb(awE_
zifiw^vljIOb2R40B=B$zi746L=Z%&>!QZAE6rb>+989})5I{>^Xwu^+BoVb9B)
zOE@gyfr>GOkiwR8)cg~;D;S)C8S=OwN(7}Lt96|))g31xTm-U
zV((5ZH+nL1@Q;m|S(>CCgSqQ*+C`@)iO67}Hb*!T0ESBr(f?^*Op!|Ne~Tz6`EZR{
zP7ax@_DvNLaeL8#XygisLUSoGoi905wXQ}G
z+8Y#u7F3DVW7pmt5!a>dd_F-srJN3-aG@%-ypo`fQq{D#;CbxKLAavwG7!TFC~yV9*P6~lMC8;~nM#Ge(Y`59c<3O^ZkvUw-3@YA
z_t*tt2q8qQC9j~?
zqSKTL@14aMBm|s!ghl5jVgN!Iwnq+TMx@8pIuO_GmYJ3rMg-bX20*Za4Q9q#N!8a?
zQV3A^b^NrPbo9YVb208og4FaMGNZcOr5GxF-ZM`06XFOCNh}tTbq)omvV^-jLF=mh
zA?%(SpvNqAXG0*Q=j&=x)X)zpz(8A(Cp0Xcp|Rq$$k*jP49DVpq-i@_mVAcbl-46c
zCOjc395FVODgaU=?xgmYLZzQMkfSu#gPS5q(QulAbJ7$UgGgkKE=`kDSEj7m>QUUP
zd#!6545v;5rXeU}Eg)~VwQ_a4hR%oz7wZcHR(mOc{L(Iq2l>>YHND?
z>wKm&@yhcFdGgUYFgO^?za>?G`0VASUn8e)tZK+Wnn$@~-tfyj`31S~L`
z0!t+N#4S$$vLyNprIoo=2*?*|txQxGCslErsGe!~K!r?Fx|jlD#RAYzL>jS{KJS``
zsY|yaB35995bs23rD`W|rzXih*_LX1<2ixjG>rK=VM@SYF`(Y{Y|35%k?yw>|
zt}C*?d;Np&-+r3w%Dlx4((80g<)woWx~+62B-IJ2kIBB@?_YfR>4(4YgZtwZecCZ_
zqy;muGKr3;DT+CY3>)r_v>W0y*NTD!Ut5fbcDWlyoRJuR6`roWD(%mofA;zFHwdn^21CHk4QlSP{7scD;2A8l3r~vI
z!F}ag7JQ20z-i*?vPr2vIy8YNm?5wcp;paHZ_ql>Q@3)yLI$GIm^reM@#}bY0M``C
z07NMmuBk08rQb=15wsXanP8>|=&s0tSrK;QOil5+ICR4{FfNzDp@E&)F?
zw5P8X;`;RKyP*Dsx+VTOtx-lW7%r`?)dkoaL!e>!d-2emrx1=L-P({WEw^|n64cU~
z^yi%&YE>qVx<(qHuD^2z5K!}Dtz^sJqK4g4p&0gr;iO1m?xUSXC{z2B>YVk2FQ*Bp
zv~5lE!Yulb1t9Hf=SdJq6Dt*R$e!hCcrn6S3}N5!qhg;
zLyqgRuzkWFV94RW^(S_AF@rWT+{l(3%7vALOhvvf3Lrjyuz}X&
zj_Ak#_kaEEzxtPdqCPFDq&%zH()9L#>JbKG2;;CVRy+&Mfk2o@6za4H7O(KTo{Teq)W!Ck
z2Zd+aA4@j)ie#8jgPzeG^Ff@QF@khCV90r4%3%b$$}>M&XvOMLGqKGt&@(yb*dV;pUy$XJ3!9b5k?(-d)_qVUFr*fXC
za@0h$E!ML!pLtdhrS$WjBnz2<^ik)|&!_a|pAM^R1)E)gnE^|o3Z*sX
zir2S4`u6)D(*|QhdJSkAvcMFK6cwsLBD@n+1kmHLUv4jd>=%Eru=n2f-x0CkpM}Xf
zZr$js%%Q+&2~C8Dn;g^Q5ZuEGdhfTZ;cnI8nd(<0-B;Jy_p3S9iGE81X5d*lI|?;B
z!^)JQ`Or;IkHXBOOKy7FM`ws1K!{Ym*ll%LdaXDnt~qiD+=CIm4{T;I!UgTw
z+^SM0QV^3XQ&q9gjA>||SK|ci{00PCUPsW8kfKQaFsMHxKdnd@<*=%^3jgYARP_TA
zGPMP}dK%)&$$rj{V-i1^ZVje(TEa}IS)m#P?|A5|)f#YG^Bir{9VETcy$CVjq)NosvfE6pGX4HLX$ml5Y8g+e``_;G06$BLEoo=i&
z@I#+jGe|O!8Lb^>E5fq0GkNPjD?E4MnMS?4bqaL=vUZNp3`M$NMI^MMOc57Td&7A>
zBEe!N)-6e_D?{t77et%oM00)So@3)@ZjSj}?2~AjD{_gOqxJ@=h;a4}K-2I`OL;Wx
zjjs2XewgO7Au1G{p`WdOFPpj0?9wh`*a2Lb*!?=82y#gPL&S=;7J}V<$@H5+Vt&Z8
zf2LFuBOcT4TR5V}o*d+%nAfNf%g2iyFud_=*FsH*CYwdj3DS_mnfg+hnn
z+O*15LUaU>*xJIeQZ#%$N)NDU7k7uFR@fA3@qDIe>H{|Ny3R)x!J*50(8rTH#BxH7QuHQpIYT4OA3GD8iG9
zY$U8bo47HJ9sPq`Pk|C0ekT^RckP&pm^SP}q`WPr_%LQ@RL_XA0^)Sb{R?uXN~X1P
zTIRs?!y;sV>mnfz>E_=YH9Le~-C=H;#4W6NVEGS`_f)sKM3I`#7yby2I9?*a$lOJrQ?1cYfK2@h@>X*sseC0#b8tltEdAM=dGcE)Lg2DgXp)$
z&{F7(TnKcR6pW*l@G~FAgcFl}>=yF6t}`;a97i1ePVSpZK{F-=7+;I%h>1wLpw_Bp
zX69@tu=#wESgDEF3{Q3W%Cw)sG(v`_p!<2@WkND%-71l!vkdZD*WTZK|NW1Ny{=oD
zjdrC+AQ8)}|K=WL*v&xuT7j+#a^LT3-G1p8e;J6~d&L^O1)k>9pt7mU6$?3C04=AA
zmJMVE-x-Bqe%55Ha1(P7%UV|2F1c9ryGFBe;k-wky_9diXJY-?mfuVq^f?HUlUxDJ
zYMIE~n`#@fd0o~PhV?Ugj^->gGh=L5(b_?&_U>u>xQRta2avU^M;o?lSM{(odV;<$
zbFfvUAtaE9(9@j9o_=}+A|CtgcHMsXqaPqq56)szXLJN{)-b?^u18%-ad?S^qdwYFw*?Gy{iO%PCM;)fOI4;EtFrZD7WDL5=4?AlFPQ8?BBRl0iaK>d)T0x9OJ6=2gdb+gz&{1=P^&M9a6%ldRt)LpR4
znMS|BZ`2KKKR{i;L3j#V&9OTs#eykD8Fx0w+GBmu8EVpT@&pewQ9EEBg5bx>maj&T`DPgxm(F4Q1K0+*vH1Yq88+G|4jef|7TfA_!n^}qDR=T|PtpH+NvuF{ijl+s)O4QfZx
z6Iwf^a5xJcQTG;{?G@dcZl^d83<6QV+hZO&V?22}5Hoiw*(#@(A@)V6__+*rMsU@F
zQ^&Z9Yem}!*T0_ac^H*ss*N>sD@(O*^=4hv?Yn%ab0&j=4@O{J-Z-6!_A*s;v&xll
zd-YBPa$V`>ee`~?3LtCNtM08Hf}g)`ir9{|bYD&zL?pMb1<864h;?}xX($I%_#x@<
z!pMlruk}&Q;99A=&wP^{J2$(uGFPK1sM5HRGaj49+iQ9EtcFHz*U{#RroOI>!2PY(
zG~v_WNrif^A!#H%R7oN7G&9*@dlJrqC}LMb)g$5?@AU<%sqk{S%CfYnPt@v=H9=SMO5ttivxYItK^o(V!)F+pQKmp&MyZdyMiP8a-Lcz;6rZ1{<
z>%8l(tlP1qCf-XrN8=nm6%a-!F@Gtu5B<9V|2(g7l6z+Ibl7CDT7}GJ8O{|=bhZ;g
zOq#+8?4~qS3{Fv-hO2CfPL^z|JWRh^Xmg;1K1`@=@8%JsSt4PmrJo@7NFY-+Qw&Rv
zcv7w5Hii?>;i2^FT{*Zyq>;A}Lg<9FnRV|X_D>-h!-x76V_;yWNt)h?PqzgOSILZ>3Zx6iL^{^B3|2bs{PjY44E(wU=p!+OJ?~4t|d4%RHZPV;MFlP=(B%)bU(^>eSg0V*h
zqq5dvDDxejlw*P$q4w#b9}|}p$-&$0#*S`eu6P=YJ%MSMn_7f*5uvhvXv7}&B|@pk
z$L;hZ0aRDj#?a>a?Iy1zS%x7L-!&QOVV3;7olmtO}DD$pq6}pK#(471-SqD`~4q
zXd*o#GGi@u%?N5vu363M)~=d#hd$Pl8$H=0l~gKJjPR-VMNIYUb(_S6jF
zIf~OvS|^QTM&1$dexLN)STi`HVCdrn-6@TzhFE9y8NdDR^I!Zkzx+S_+rL@u|{>_9E${_|h?3>FWchLx~F@k`T@7$}3~!Y-Agx
z(!*UYt^;wIQ=hohR^wM&0Gt`Lurub4z$)n`fOX|shDVXHF8>-t?A^OdWt$#=|J($c
zRr2Z-MXNv|W$81t9tK4CZ11vsE&)dE+FCA=k?V}hLQ~n^?i+}ROD{N(Dz?c>-@M+F
zOFj}gg5;RZS1qyiX+MUa{Gbs9vI$h~eFnk331VsI9m2XhZ$Bp@*L5vxp&6=<2iZypu=MlLo_0LU=MC#0~(d0YT41v^kxqceiMEi&S|
zu4VdA*HDzJXa!M?$+3U}rQ?8eznd7jcM-92rF~pH;Q<>Q_7AHF9Bp@z3qIt)qni|
z{KG&0XMgDr|L_mjb$Oh|ZseiAU?XPUBr@b5V?>=PivonYYG<2oS2s(yFAr>VCOo*`
zobWTmgeu|rYXE_yo(+qdj&m@MU}UD@e^axvNZ+qWyaU9TDJWdm(xa7^RyPy2`bNxh
z>|xnFe7
z0g=d+`5}G=u4KXta)cHsDzHmLq8OYrTCdNm_ZFFJ5k|vmR~SkPYLt}x_S6s@RVr|q
z`qbU{3hM^t)aQf-sm4G&hUHW4RzG_ZnGco%!aT1-Waybx_hWAjEO~ZDWI<-rt6x-G
zQtZY#IbM1fK61}L6wf#*r5JQb2)kssxCeyKbyNn_0T4|ukmeR-6Qyrvmc%C+kx^Ca
z%4;o2e1!+~6#~Nudwkl|j8cXwy#O*2(+orsmG_2{80>zPL72R7azQ!)Us`ZZQ+
zAb-B=eM8S>vP040BNGfNSEoi>@=9R#lTt_k!oK*_Ty3eM?d<}S6_bpdB0`G
zTC0607D6Iw&0QX3<5aV9Jtv$I+CVdb(Qz2Y7|H3FxV-|BtSYS_G4}-1JY)+PkFrzd
z!spiwLlk4=>sT>(JTh%q0;_9``Nc^#LR|}FL{x1V(7CdhEI}5WUZ{t!A)pva^*yH(
z5n_d^c0oUkTFG-iPE%RP=3o|DcD^la;{E()zM{bo!!IVWTvXN4mSPkJ&8{b;nB@kwe+H^
z;0~33NSvS{e_+hW@noiFmmZu43hq4{VkpX4r0o)0>E|IMV{%=Wnp!hD?{n@HQ3lA($fyTxDO?T_ktw2Ga6Fgv2Oy)%C{YDu
zJv!}HLcL)?zCl6u{k};=;%JmJj_6%Oj9TrWVm{jL*FZ#G*%7rlT7ii0FzRVIXXJ8^
zRE}b5u%O6TkymKiE+*e_h#E{iO7QWhZd_Mp1dC|hZ?3hvaKFo=8~f3kVA2g{yAQDM
zP4HS1#5|e_Gy7eSM>Vmu1)^%=Igw~`KT3NdRDmO~_l)f#BF0WohrdCh+EN;2t+lN7
z6!fg8l7b|A%ZyaIdiZ0L`=LcdYEuV?^se1&WoXuvGQ{eP{wPxF`DySw`HLuNh^GBhStc#~w<=Q3tPJHRSF
zwthZIEhA$WSq?&v&Ar*gmGR*v>k&YH^IiYB|MKg9_kaJ#YsGgz`|iVskG{gWVmfJN
z6&#@AIgt5I^-y9V5h(24Rhu)DMtuaoRE0A8v5uOCsT?KVGeXK8y;G6yI^`k-Ww_=F
zlZaSp1r)R{Nn;>_C>ewPr`Yo==+iJrwx4GzR<-_Ef*qJ{sB~e22tB-O*{6`XUHZa`
zVrHgT05+vIrwMjXL!ClSpDswbA&7l$(!PqPPYYC)Bp-BVnv`wn@YFIka1jN2`6>a>
zDm(SMB{6F${^wSl199&WgN!>6;WX8pTxB8hGSv`+bbNUugh5>s<+p-PhWib^^bmdf85y_p8F2bTh;qscby`droiC^L@Cf^
zMy}(~pvE#NL+@ue))=W8*!sSj)12(A|IP>r)6|R!jjIsXTA>-~dCon
zkVd_}{_OtvE>^_4KpVrB@kRTDdxBDdRRxH;YUTD6(d9OUrxc#dhFYH5Ckor(+hx%N
zksp;Gj$6Eb&eMQ;U-;;tOVPL1ig;R+Bc=>?Ch7=Tt4WFB$pfNVtqEm}JQ*m>9{4$$
z&BuHm0BUfy4M=1G%3_i1Cx%ln%^}0MowRs>i@s#F2g6z-VV|L}9)01ImK$}W{IAc7Bkd-=S3jnl2ear+*VoR3qhvGM`
zQoZYO&Rxt5RgTjYB{{Z7G5mC2Hm
z#W6FJ4g-2MQV2??u5AFq=uuYNh9Xc6@Kva~F3C!@A|+x)4~f=d-_rL+kLDCFInE;r
zHC4=&MASB(a}gOMV5iS45fT!o+H0*(&aQq)x_L#WZGO9lCUQwhN{#HLAl|RzgH7#c
zAIu+!#NMrWLnm4|HwfV5G!+fDG6bpDmDjb1*xN$TZV+)@i@>f^vRQ?qrha>P>>Vr+
zDJ-wuVZ8)j(yr;eKejYuJ)T|)8ZnroyLS~e6G5!YcOgvpxEPb;i}3R-#`H~y%vp{H
zu>)dS)Srj{fyt3|rFyNwP)DmtXbQ=RNPqgEI_J>@U_n*{0#%jQbzMuAY1Y*p9|V{m
z$_%SwZC&nj{p=Be)e;06X5SxM%5!g55bQ%=P)PJWHfx
zhqn}6}we&aX(%zygNKkd%j
z^%9wg<^GccmQ*cAe{`b#4C0yE>XnMpYppAn7S7FxfxM&i7qg}iQ*lAf=XrfDC&(ii
zRU>1-!-!23X;XckjFlLv_vA+hFC$g)Q^Fn*5po~x!+1}MCNPeS^vBZ=P{T$HoJ6@*
z>ZPyI05r*UU6EHr&{08rbxh=sgRD4N#E=6a#~@Su$wFCxsq34$Vx`qdC}&!5
zEV>-4y>1d=CISfL%1gjz3MGeeNqY3ok5(eyp+SfQRNKQJ-?tS*(rGAm#9$ntGX=3E
zmwkdDaSTrVMC}3Iz27M_g$-xaWN2Ppq>xWb@0?A@@QkI}+C!2aX53LjmxwE4#Wfl8
zDJspdb9y$vnSe%;}8S)Sj1SQzVU)rYqr}R65VQ@%oD{s>0#zzIGuA3oX
z1Fv(fV65QGG^Ge8JP#|O}*^;3WIG2>g#iL
z)2p(IZMW8UgSDJNe>iXJvo#V`1>l+?f3Xe`0h`;aIE0Eb2ovHIxxNnR**1y5Pbm`m
znyN7UgQo!iwKic2C8i=1Wf1a^o)8ES(Sv@SWHsNL>$#q;wMv0WRxJTsI8tG9`G_ZL*KPg6)&Fv4~n
zkT60_GN$*9$Li06oPdkQ=#ZDmH+wLhrkS#MN|z@E>z=Ck82z6PK+j-K7&0pM1tPpp+*3V%gR>;VkLzF)%5o>dC5&&r(hXeMV0m8T>q9A=I;{2hNNo
zhC`pB(Ax4-$J7rpMv|IQ!8aU;0=3oKfGt~n$hjY-RKFkYMUdRP1EIC93ZuI`8mFx3
zDXU;@M!0Hft25A>3I@3%uGB5=;&o*v_M;Sb*|=_zd5D{Y2MCdwy)_btT&Zqqq`Ltg
zsImEQU_}?};c(6pQ9K9N-nl6QuJPlgX7XqmOzemIt0H}4)SJUU>MVKMKO$QzWhAs#
zfkYnqb3&}Yi>9_~UUyep^&N@G?$B|Uwod(3D@#b0DA*XSdkg|(?as9fwjoWS4jS0#
z)@oBQoAx+P8@$uk&W0M*9^f3_V!s{D<@MZk3|Ka!k#4msK
z;~#(X^5LswI^me>MXq$^2C@r4<|PKuY>Va9s`}z4yAcvz{DXl;F(vhc676O%{u|^s
z?T2wsl%zXNle(Y?74QJG9Ze;cY_1%gdOMx!Dvb|tcO#YtIxGdl=@K3^ZeVQCONzf1
zRFY_G?_I|%!`8~r7#-}c-BrpI-K~u&gX@i+ovGEr0@j)(D<{k%BJ{ec>6LKj0~t#X
z3d7&&ksYKKHe}SKi^~rMK+Llu5t+79e#a9Tw@@OHnVs+<(6K5BuS74XfCLGKR|f)W
zMhHUFU)V@Tfxz`g6R7EFcc8WHU9JAoS=XOHK(jc~?83f2DR0qg|8WAS{w;Eq^2b&g
z#x8|x964(Qpi$ORi#s7ycd5#9|5vdpgIZN>bSM_N4czs`$*oY_WHm<5=n^z^Y9zVr
zK5tEM^l5cVjEFSeVadayITCRSULRev7kb#?6t3m-Ho@W?b4_42%d9*#Ii@2@8M`PH
zsRmNv&5{ipJU1c#2$I#~YvoGXpq+N-rx&iEcQYV8zl;FIg0=g=O?J0`S}TkLAXcs}
zOmt&+S2Nco3H?%EM-7{yhZHbO&(QH`$OoT#*TppTXG(O~3uAI=H84C#54;pF3I;UC
z7htUGcHiH9_xgvCy{^k~$!{KZH*Z&`PBsS}i8v^e`k!B45$i`k{DlHHE3x#|q`X{t
zyYi+p(lZL`aK;XeOH)%GC0lk$6u_uK2OP{W)t|_VP-8wl${Ue+@Vp8}2y!E3$3-^V
z%@{q^4Coj%AxT9SizN<^&FKdTGiueltL`8ql62joWG@!$QYMU)iJh?Kup1Dlj|>uP
zT{xr&bbnnFy!+=*PC+FoEMC^#Y?n=vct=qMRQvpPsN>%lPAN(-a%iHUtEwdCM
zr%*HV)KOmepjaP6UO|ng1>jz<-@X2<`fV*O?>Xjj;$*Zmf?>TM!u!XZHu6a(&O9#W
zF=8f>LLo{^Cu6OoM5-DArnV>1cO*uk8V;SKNEIV@zKy;{fSuOBxa<@U4-W%m@~l3i
zUX9StT9<>?6xTUUztEKtqD5;T6lSsYbVw{M;7n4)NEagY49_S8LsA&^pW!yTs&9E3
z1E?zGToje&Kvh4qqU4+)$TU0j?cF~NpB;q=WzJ@U>bac8IMzzdjgZVGS^(Et*Of}2
zjSlj5B=te<6PKdV1bwQ}*YnaX(AGVikSI4{6B>w~9Bxv0dgLnqNDn2t4wOv8%N64sl?XK6i$KUx|f9|(`>j$4d
zm)vXSXv1OP-G7F6&|AiQvSG~>b;q|^k$F<%V4*WqHknD+{AA)tR0+_h$UXAVxBkhJ
zsZ@JV(=|g6I!c3Vo2=3wTpal55VfN)ssz^;DWe{LcBT5Db6q|9XNj~fzSihvMJ
z25Tvv>|WR*i3-e-sLhPHZrX?LAA%va%o&v#hLbBbHV;CMTqCfFa6!aexvt1SUK#$y
zN=+i5O@*wbQc&Z>;Q8is7fWncUQ2^Cneu&9<5x2rT$hLAHNldeL4zW;S(;^^zj?xA
za^*wFY8E>J44cY`{p1`8SfU?dF%Bw2V7JG-GhK~~(I4i7qYycCwNq1y@dY1`$Kgi~
z>$+x9aHNd@-QFW(j$>7o5^&Mp~6z^
zNes6_z>`ElfV*n;Xef)#p{FVRV
zpa16T>)YE~y?pq>gsVcYO~`?mzQelKx~1qT=W(x?Z;4KYir%k^QN5if6sW!v;V50O
z@>E1vHe#wCjKnfKsCvjcSlGi9KE_ZvdbkqbAD{8YGlUAEwO9IDgws4Y&L3yQ&`*3}q{A1;pIzHBAqFU%K27J~`c4BFfuJ-aSkU
zWFoJ%mX&BRk2xYmm5DUZNXSsoFGAn3!&@A2yy6J-bH}4|y#6>uc&*?>06pJEth{8v
zAx1s|+K8oJV}4rmZNLBl002ouK~%_RR+Bwm*m!mL+;?J>p(3i5vi+Vc=Rd?dh2$KZT7{H@i2Afit0UFv)1C7%;WJh4-6^Lno@g&Gb
zDUvjM*A`vn@`cSP+F*!Ik5X7D<{#`CI+KAA4kV&;Wjo?2+8^wvVX=1!JOg2M`V`>L
zK}SD$kux%tGN20Of_BZR+QVTAr=ClX_Uef}^R_Ps7`xh&3{U_Zlv~zH(LvRB(NtVS
zoW12DJw)k*LJDN~o=jHlQLy?OI9JJ}z$wV@MVpQ7*2ZDvpR>b?sG?^*&K)ry4&;pB
zhNGNI*%**|T{rUn`Sp*8x-Kb^62@lwb%(+=V$wN`r!Yw8pzikvh#&p%M+>q0p(=}x
z%kD7<>~XjZjX|WNS)BiHxTEl^llg?FdP%**LvZu!&qlmFmlpqAf@Dw`TS`N?qBrPyz^VDjCuQ
ziqzCUYe3>lFeF&g?*PsYUXial10e+JQY3BX?D3MARqrAfW!G$*4cN3DQ^h!r(I8t9
zXGCivL4z}fq^KSN4-kv=(qMXq`P9zLmFxDCZ|^_+;TQk*U;d2`w_O#N!)cuIfYZEE
zjN`li1mBY?B%i*)Qz_{4A4ol^$|B6^Od{Aw4;$MIS>;oEuETLCeOp~oM1(h9XFjuV
zTbCOvS$=c%=y2uZFePG-S}l`cao>yGYN8v>r~-MY1}A{pvg)+sxBhxRbR^l;+ApFr
zFbEl4?9HhyBM@k4aTKg)=`R0y5(o%um?UblM1R)VXu^4bdZt}e^yoIVU4Azn+11a{
zU-+DqLXdjDt}W+9yEq52*1E3Td)IdFqP>_?CH-^dDH_Lu7|_ZlZ6YPY2pjNFBR~mD
zB2gtPsMEsnr*&h4m4RMW-|;+
zsdXEg>((=CEpO?5Ja+AN;}^VcD}Z|Js?J2D?XQt)8Ikl9D-l)P56_Bz{E)e#8+(Iw
z|BwIgzyIsM_Fw$x|MZjf@*y2no~@WEk22TodB06Y!^NHLmtwa(6`YgaVM5zYn+8V6
zLP_Ttkcc)8U595kgET{b;)u-nURgLw`M*AwafV_!o&Yl
z=dh^R^{PU2*!kCc`68ul3c9H?G4q(tkj>rhTqmZr92x7nGE$gudKTwk&WS`Q;`vm*
z&!;`##lOQ+lu5vb*`sxBLhBiZs1*VOA~BZ_)Mf+;|3=`3e5xZyO`}EX`cZyL{&;QI
zUzidy%|X~4RHw*Aa>%r4cB?9+pI0Wx&f)f9LWxk{t-2mh4V9p2LBJ1r`dA`b)SZ${&hxax61dU2)=MP6
z|NbYBdR(`cK)l=0#~faDF0AJhVt`f{Q5V4d*xmj0S3h{km%Se<9%x@EeKejnJf2;{
zHTd?#!OS5Y5bRP*KYSjHC{)~ZVhM~X3hnB(@~Dac*ab4ybzLN@Byq?UxvMfS=@s+|
zMu7q{Ttd?JJvl^($$CSC3|SPk2k*TGBh_t(#;9Yhb>(fM6$P(>&ODq6aaw`KAs8~s
zxFe>%Q=3kjr_6P@w-dZiXo#Gco5I&#_*S)FZeM))E~$*(n-&6KtT!-WAsfu2=_ljhOW}e
zYOkPXGs@+zq0ds)NclQeX`OfvPoyV4{G;(hSo>~lX|aR)28c2J4X2(dE{R~db)bNu
z4Tm{wiqE+hND$On^f$om+S2
z^>tc2Ru(g^<4u4P!3OeLS}l-Qu4~;l?+^UF-}(!``8Pj(er>hjo?s`2DbQzy--Y7&
zFjl@2UNAJgbhimq+Fd+wN)b-egU^G>rw7L1+DY|p7`YDuV7z%k#|itioTWq#14k_25NRqgHEcK87?f7lSd}8eQs*PQw`1a@
z`mW2}&auKqOwv%>g|ok;qza2MIV2vtWVkKXV`#|};7*EEAD-8>R5Rvst66`NJ}&Jv
z?eZxQmx%|^k^<-Np2#+81#@1$^zSMMsXrz(!=3nyh}dc(ccpgrFe5eCkA(K)DPuW8
z=>|QdP@RU96>x41NRkbxK?CfKd!ZUD@bN-@jb=*-yUz@bOE<
zKOmY2yG|~|B9dBI9U<)!Po!|5Ry2~yF9(&SqsKuD?M2hO6xE>&=@S!d>0sGJO*oQb
z1rdlu_3jZ{akArb!Pf|^b)A(5>x@LXL#HrhaRh-LeHz}?8t2f4vOXdMEfP>=kSV4*CJA%1Hcqqfx
z)A@bmuV+u5zIaNRDINRy7t`E3K`^EShC_oet~L)~z#OWZfptZrckck#Wt$1nu~T%}
zLqwrxxwY%UU;LoKp^7MKR0eF-R^-YnEG1Q+&GeOlXCR`gt9GML
zY!NZaC*A`higt^gP^q;c6&cG{zzLTCl7iNOp>)-?jEupJ=;$e(O7f8FmMcEL{`7u-UALPM
zrT~^?KQJd~Rwi-6`!nCQ2j%Kf_0`v3fBN{vW8WPOV}XR4%JmGC`OFd0p77Zt<5^qGd`L|qgg-6WA?&#zl9B3p-D-chL
z9_SMhTIJfSu60+Ha!1PTMRV|
z-@;}>-Z!|kf7@L0!Z5d!HJm%y{(#k`;65`Ft@}`%w^j!3tkw(BZ*lw*c%b}{$0Yem
z_p=6UsaIKb41|@nLH5L2Jq`Emm-|c764YV3JZ(&27(Ppv?(SaKC7M$=;kw-v{ggFx
zMR>`LZ8Le=(IVKip~tHThTq<#9`)jPN-sJ^-vOe1hyg?OrdWR=M3l*K;*KxC|?3Qrsxt`
zM??T?x)74ag;@5yZa@3>^^gCt5C8W6@>g${Jx!hYoTz-#Ida^IBsz9;x;PQcTE`hg
znKwU|Mcjiyr-m1KDnnDS&#x*Y-
z?s0GK8rh5{FsUaGiP~1OcLN~%xq^sS%w=q-UN3CWY{cHOjugSmJURN2_foR~nu+@tkRS;sJOC
zSr|%+(PK~B*?WK*M69(m_G1YNPh+ZQk~FS$t-Pd%@u`o{J(}3$($?>hYDQU&$^EE$
z7@Bw62Py*gEnXssF|yqnI(;&G(nc3S=cW#YTpe#c6}F-<6Q;JSe5|mSa8Rv
zmthfBT-T*$l)qK3c#4ctlg!f*WSIPNRnRsz(=I$i8yw;cHjjz`s}z5_3Ndx+G$AeO
zVQ2_nW#=4=kokZ%9=?;PS$m=YgyCz#44t=KSROl*46t*DR@}L7X}L$g`$?1IhD|bo
zKw_=MbNkfAnRO=`wuCRDB@YI^7Ryu!*U>$90M~V8E}hS{w8qSQfnYB}I*b~Kt|%-8yF|I$#+wH)T>1KY6I7lsH*53QEKYjZ2>8mgA`;I5AKMaEF
zAswso^>oSBLrnA3=P)fW6DYK+2&}R7K~9(b&zP-+9f@eG#1KGrO;{kn-JRx{huxq~
zjw?PNb8o+acW~S4Ffg^5e(5trs_#1SdqxR}+B@Lit`F`KVh9Qm8fqANp4hq8WR<%2
znQ>d0TACz96b)s<)wxL^-~>to?x8BN_x|#$AAb1aaSX_xtyc{d!&3x?WWFglS&^W(Gq;NsvFsQ^XK)^r0riv`%7tBQ4ia(^D;e
z&*D?REj7VxzdpHBjA&sAim%(XmR7`NkagNg`jf|5UJ1Y=*nmZM;Q~f$c;+mP32k>k
zDAS|GIqg^gxe_*_m?SY{x4Ew@X?|J+U((iFwZs&R}n0AgBZCZnB7vNJNx8O;nM#
zdlV}Nq|hf?@R5Laci5m6@nU;BJ3gt-LWH>fotW5m+K}g4kuoptJHGypZSr%
zSF)jXEEsBo!_-K?Pt5WLRo>G+(|KH%Tuh)wv_f#7+JmTKt_7sdjOezm@dyM+tZUIi
z?=Y|kH;=kmyAdIwG6J=W&6T!*>Z-1ORL!O(^U>X!oax8z-Qwf$Xh@Cz@k1h`koO0^
z{xbgKfB4;B{gp5O;17QC;pJ1xo>to?4zn2vEC~gq%bt_&@*xMNC~&C*B^MFdWK1dR
zI&wV?ZRbc+mOlb>YRat`*(${9VrAq~1FAcqtyDoo<`sx$S3Szc4`LFmi5bu$a6_u#
ziRaueoFrFh!{qem^+*xW5_x5xm`;&I6>xrz@O=1s&Mb{WeqF1F-;f2Sf~d>6$u!Vn
z5B<$_sAQWj@NgyrrC)QX4j?qIzD#9d65rrey2pd2yUyl!JRq&WFfBFfMwDlanVy-`
zr#l3+e8ug{fHMRuN=GIAu-=*zo}@L{l7QMa^QVE@-4mISJqrJ&Wh&=4`=aTOzQi@R
z;*0{KL;6&fqx@U8ddBpUfjOLa5&gvSS`O7JvL}{
z0>dWPDgu`ZDH37d2?Qgtu5?GhlH=!`&g2W%KX7w!QZ^(*gYE8jl{yDXz12kzvIIR*
zqR)>L8x1zx*_ys7-N{rhRDr+C+k^0q%_QbV#FO|?0k1k!l7VH6B)q8j>H{pEYngVH
zFpVl1yBm4FsRQ=&^+iZ@M$E;MKk138rU)>=+s$Pdw%Pt*;ICAu7Xt0AS}|7w2Bj+Y
zZPJ<7x*m`3KfnG_2CnN09fkRm=XXh?io+y?^?e*-ue-bUetG%u^;ch2Rmi}6ZXh84
zUV~3#AH4z*GG?uZ3POiIkI|EgyUe)GchOY>yg2H~n@!*rhoGyi|Hg56As@AApRJ?n
z_xl(i>CYG1ML=uSGGMppNYyjqlQM=%Z;neU8Jh7JL05!ww}Ol
zX$sw`eN?&53yeuT=G3OmLc@rY0)mZTGSI}AUw(aEA6`G->#?h9S93n4xdj!R>hH{2
zLjT-0j}?gSe!YLU_uI;qSXw^hST_C4M9w}ruq9Wpcc)W^IYQk+A5V;`Sr9u^I?jZa
zTG2C2;K)U?Y6Hw%MAR^o5y5J~v6z6TqkYKQkj~FjcY>Lrx9WWC?`s0as*i|W?m@A8
zx_K)8N%phbf~0q-2Jmz3&Ebf`-wxrC&>zTYIt?yUkQOr6e1a4DFE1W<4~?KIxfu=O+2M+w$^ERO(Yn
zj$P&cp8tXfj(KT-zfrlWiBuB|?7Cc+iFJxl$7z?e)5gPfnMFyz%J9Zq+V;-`5a*J_F?5p{d{otlVJq+
zvJY%V#NInFn8S&{@m7q#9^+9_Npqx&bghiwPC-3c4KEhV90^fM7zRTH~M~m
zG|eXDwIYT1qD;(WxB9xC+3u>^{dnwcdsFNONbJqM(T&@}#}E0~LBw~TAAjdJe(CrA
z+28p5?RWS4{o@y(Mi!cQ?sZSm8Z=Gji-w`h+&mm^U3K2Hp8PsU%2d{tbckclDGVbv
zl8iI-2zp4*e$f$uHN=M)W6;fquIl!J=A+O780%VsO722OR(o=u16y@zG81BK*Lo+g
z3dsm`FxFZiJi910GK?WfA{HX_C;&-C+F4X%(ohv7|0Sa?fY1+|n$~}^$+iH)?V9db
zW@ZK$$UI_@MzA$a`;@+p!2=9|AOjM26s0i?vsy`@
zYBQL*NXqcCOZNDTILjMsAJflL)q)Bk1Y#shkTSx=L0bsZJhEhuPAXuhLzTapGGh$1
z!?fQyHJ?pGbkw^v!19#iMMPKUyAVD9oQ9u%`b|I!!{`FVFv2z6XnzbXropL}7n_JB
z%aE9LcYZwJ)T&6gtn|bTOZ0PS5Tj4(5EK#&hxGyiTO+}c9B6@%3`$7SKWTJ@iVq}n
zU0tu=fBp$kxfZ87(^q_=EP$-8T`WwQ9*3o66TIK=xo)4n`k`{`ATA#|9nhgqjf&v~
zxouP{(CD^acJZ9im}#=xbzRaytEvFt-jHX!94$Q=u0J{X6qx8qve6B$b#<3tBFLxy
zoH&VtruvR@Mzw?s+-{1z*Xt084x2?yIX&;x!4&a4yH=LAi6XlwfnAWCq{I
z;jCI^eoSf!i{n8`Pp>PmW_}oed^>e~NP+y605`QoQ2*{pG?@SKm_`n%G4FC7qjgx~
zg
z>(C5oQl{qw%wq_)ck0>k@)l}Q#N;TYt1Ug6^bO$)jLv3_?hMyb=92YvA`iT
zE}xm2(?R6Q>-*1};D7h`|KeZ%^B+IIYN9v*wYCFik=OI<#oRcYr#B3M0+nyib+goJ
zTq~ySCYviFGuGubT(Zh^zPHxMH&Gv1f6D1tI!Fg>7Hz*!vnsY?x`K=b^2+PVm9bU`Dc__G9`hmM;DKm{;A~ahAG?Yf
zF=nO010Zm}?`no-(-5(6@Q~J6=1SS2X+T3+SsnYl;=0Y8D+$;m3XO;cx>%Gn50VN5
z=}|hNXkRN)Op1qUHij85P}N39=DL*A)%cqfw9l=l}fM
zf9Ws&(vN@qM;|_ZvDOv2$niMP9}$sj#*no4*1*OQjT13WlFqzVtcYb&KQf2-a&=((
zIGp$pATs3|z>+lIm_tEa=Jr8`mtWARK$Jru*SbzZY|Z!*T9&CwxMj8FfgY`{In1qQ
zK-^%&6bF&9B-rjEs3B_(dEJ~!MhR}7LJZw6;~(WaAroEaae<;**p&J@5TljNC(>qw
z+T5Oiv&vML6wk)b5WfBZuGNP*^<9rP@5wN!YPdKwo9bA>AGWx3O~G;sU6`dBLGUaP
zvlzk+&Hy~@8uJOHyR)UGDo02ppApX+s=rcK8St!!=m9ygS^(d
zUAM4Ejb>qi1T$xJHe9wM0rVjkbUJNt<;r-ffzg?1snC0+hK}Ewu|7c+S}FufB_qY7
z>8URdMd)Mb<#m%o0>aqCN!wRQpih9j&x#;%nBBHSina2R)GiWj!JQA1-sY*Ja0;DR
z5z#ZtBJW~RI
zlr{D#M!@6EdMtheX}IMjqk8-pR$OP)H_KEdd5)_fgKrHGc4J|BcN7rN;95V6Rl3`q
zY7MW(etrE(qtoLp|EI
z76uGwuOPAH<G#gw>jON+A5Tz)w
z!=k%Pxh~BSWTtHWw9<)%h{Rey`{vtU{gqGu>RKK=kNjHP;knA
znzYGz=dG~ru|T+k)S)$qnJV!5`5cAO{p($pd(|*vcy#9nV%;=W=Rr!{h1#r=w`#cT
zg_pRBCaK~$uK17iACVE7YYlh0*vt$qc#vaIZLV7aSeH07a+%W^eaM4??3C
z%8LS#6jp&+FTkYup>G8tMl~6|3pQ5irkqZc4hesBVQ0#^353OU7|^DF2ri3OXf#mO
z#AxW@(VOOeRCf#Rx0ZjV+rlar_hUaE8zLZ%f>bxFc(}2-vqbkLyESE4>Lj!#%~U-}
z877ugS3|tA2yFMar-6`{|CKcYC9*stpbk8&YU#Z-8RQ0Uy9k-qiKrYP80#`2xGr-W
z(h}G7OSPxeP>B{TE4#8~U2GsEZD-p%FKVM1ReZ?!Jn``ZdV>+)z4m|gt3UWx|Kjhj
z#qYlR{KcnFqAU(|^TO&8U2B30u?>d
z9_aB(wxH6;d+6feW#LdLFZ*+b`N{SQXLB)nEu|R)}qCIeRB3)!~KU8D!8nPp3ObW2F7
zhL=Ca=4MWZLFRx8mjL<}c{KSx)rO{Nux%bzKF{iKMrLHzZg-+uBHK8?F!UaLeq*w)
z3s+FOwRUF}TAI}-h6^!c#^eu%L4E`
zcJoh9VMxe@n?%I5&RRt8cV^pUkAe5gM*xj#9S^HgINU}#2CQBhM{+WCXQ>bfVGF1>B1^h{=qQ$IE`
zt81;7ufO^cV(l%hh>sO#z_z6huwL4eQL3h3ftC&}?~m8lx9fIh!siZaD!
zon9rCqfJLdcUM2EDT13^W^
zXlG+0BG)OD2Z%V)z#JsU4OP+zWS|y<7#xZZq-hpdfK*AU
zADW!8C7#U#L}(%=0cxB!Lb1IK(#;ga%Dk43xDTqoyi>VPuBe1_O3@PMyO^D%Ggqh~
z8zHcdVv_hCcIJ-@U$V*6;lG
zU;Z<{`e8qKyZpxIyiP3F*_``&9_M@qJSG@~Y
zNqqN*(?By_&8kj>v<4=;0n&S&Q#P&g6A^70&OpF$$Mds8D$(yds#+)VpbBK%Ue@il;4vPy`eZpd
z)A|PLv(0>C?=ATQ_M^I5R+(WTy??PH^U5@1rCS{VDLph4IN2^UCPvtHpTh)*MANzK
z-MLmS4RHhzCmbCn)H+C*A_8z-nS);)ZYF>zUZ`y}VtA~TQ-kYxd*x^j7_H*Ap8Q(c
z36rYsG^dtL+lnlY_;zL>vi!Sp@QEZh@{L^UTGjow?|aMlAtzhU&Qqdg_(2i>JrHM^
zyc?8l;a=<6ri_2D>*mq|?hZA%=heXdBLDNpu4=i-yU|DO`mO>!)z)Z?CRex4V%))K
z1m*qb_ZV!(W9#hU%2-!CI$taAkNThf&2Rk1fAc4Q{0BcqURSPV<<=|_jfiQ=h|7k|
z9pvMxNJ#fhBT~k~Dl`};0^w7PQX-p$UCxrSem>Mz=##gki=lRgYIiTR2>Bceq<~Y8hSDls+iJ%LKH60aSaLdQ5?~dNY)#RRkP=
z3JhjYdq+pYNZ{F*mMx!iC&>WRiLKs`y;Yq*vv2rua2{4>01b-ucF5Ji3#bF{+A1P)
z7H~{s(Vs;gQktfAH5mS4>0$mP*l5ag?i>x%22M=*yc=O$5cXJ3ivjb9?`TECayvos
zH0JuG@nHag?hsOgCnQQ;1W|FOGz^&sxOC|jyS_9YCVfu^nrCYMcpyqld8>~omkY&H
z5zu(jpkDb#JNQg!nu|0KGoUVIzrOwS{`h>mt`q9@4JlwOhk=~_{d}wEPXmB{)T7y7
ze);vaR&$@|g76}O`HuN?sF=W@qYV(AO*nzkF=EOQ{hY4eR>MPm@|@Tb=VGdb(}yWp
z?#JdF9R$bd*J+;Z{ZhaHFkM=^OGg5zDvf7kMvipTa(0#G`YeKO7^VuS-UtTRV`}Pc
zzdEB%0IqiQjiuosk!}MDF#@c1SSL}FliWzradmeUu6gv;3Kfgr^0R`81K)9w;o5)llChfY#)U@GmR~&Pa*&
zs`gaSokMH*Yt9-;#Yz{z;>kDw)(_3bygoxd?JjkQF1Z9t`>5E}?7b<*&JqWCtvK_#
z7uS=krj@E-;giK!7VA!Us8*8)LlgF)A0wPo5lt<_GfhcfmqNykrP7GP>2a6HMn_BnP5M|Rz{)=N}7BTx^;KlWxI@{-|u
zyS*R2|H8s-2{Hls6X*zJ^h4#SpJt2-F%3t&k<22@;P@CB-(`lp)ihux=gh#FmufBQ
z6n+kCI2!OeD|#H45nY>vPj%b(GGmgAYl!LLh^2jRj=-oE;UP~#69L9I
zPTgLmh>2G-IOAf~?bD{`oNas~99+|9z}~j@sH$e|U0&>K$OX^bQbtN9)M|`$n%tYZ
zB>T}-QahI~y8#k48OtXpqLCjuDHAk$}x>I)L8jW)<(7T@3Jc%iXa%zkB5`
z|I)|*@qhfCuRgte^OK)_`1lFZ!;U$Suo`8W;I5aXX=yE@*dN1L&y&cbAyd)S%SCdS
ztvF#s=U}Ba7YeKa%qxvg+(q}IGE99kw16MW=<22iMhuAW6Hn>p^kz9xYFm;hA;DxB
zs!ix~aeBfQtSW%#KZS>I}h>or$@MG%7f08xeV1;4Du90(q@VqFkYWjfzY|
zEFnf*xMC(UPWlN;DICf~F63!ufj}EP(SoD7;1LMB9vamFw1vLD@3DasQ7$mH)>5a@
zfV5pgtm_JCevre~g~(04r9;s4Bz-~$Y|Wrtx~iDZS?nQc^<$UNnq#MBW$m6@w9bW3NcY!x!X
zm1m{?G)ch%j%Ot#@r+uXrLLndC|e){?T
zt!9+`Vn;vcQ9{5F)CgH|y7X(R3W>*lJRbY&ufBfyaC_UY@l^PaxF)($lD9|r8;I(4
zxm0dn`zV|E0Ocl1mnoCj99JS{m>Y^P;{Vjz?cqC4*TE270i=2x$Eyb+W+2?I(kFoQ
zqC+4>o)4$Ri>)T)GHpCq$hxEPXgUIPnhfX|xiqFo)i)IBl5UU667tY(`sOPfm9Zkw
z)hL*)8A8Slt58jrxe_ag$9{bH;?u`ZUv7=XK7Z!i(H8v%%u=UHaofEw?bBij4TV1za>wlde;p1|qI?Emn0W
z$V4QlwBl%^^rp-ZsV=3`o7$TzAmA9WuF)(@(B&dt{<@e{fm){;$*9M{(}xji4$V;cl=Wlv?UUvayxIh?M>r!h><
zG(?a3E;Hd?ZiKvigiURN;-mZVDbfbyK!wbLGirbZB?858o{^!5@YyZc;`(OX;CqE;w
zuG?wdi-~QQ*s)f`N`bUB)Vqf)#DPuGCiTJdjrhZ#p$B~(L|hVob@i^@y)muZxnWLT
z7A6OD(z<21;0p5;LMLIIJ06E;1kW}i5wZeKGI)2(UIOv(D;awInf<0VJ%!ozz
zoSc|c*DdF=4zF_fIWkD)g>FQRuE!d^h&-kh_W14dr}r$noWHdcLPf;$R?3Gt8bNmv
zX7JK=LZIiUE1_!^LMRQ+cY0NN3OHTc$mnJW{%X)SpmqQdEDwdYZ^~dxn4}QdcdeyR
zpDTP>x|PU8c>~W;yk&LG5*r)VCTI%fG@uRV`~t!(uX?*VkVb6@mx!l_N^?N-igmCx
zBW*@Zb+v?znrx$Z@z!+P%4fcGHYZz7x9w@|lq!!@8|rpeSYb|?YOsu%oFkgZSccr3
z^nE&tUWl$__vA72=U|)4*Ua!`JS|cMZwx~e5$?zWW45cQz%{gxuB4kZB-F*EYjPES
zjI}KN3sVZGc>utEkuAhg)jN#h{emK%2oxZ)x8rxnMy9%^Z|={N>50{(t493D8K-^rtjZ0_2DBZ@0(SL20RhkzxN_YepTB?mX(S@o`{d}_%#lf*d`>zd
zdDfmcz^eVI`r@mvK78@blVp(iLAG5v>E*^nXHebYVnzPMd~eD#s1m>9B8_DFiEH;ks6a
zq_*ZmOrbbMAFr#reTpt-+7Kph+5QN1qLmXjm^O7xmJ!-Mly)!YEp@}+}#CV;p7
z_Tl4~w~t@!U6Rt#Y$VRfwP?gg@0|cf|B1+J0nxy{@Av(Rh|DY0!g4R#76gjiR&2Bz
zCYeLHg>!6Edfij{!Y3xxD$xjG((#v*1KiK>bzzWwBz4d&_nV7LRt$lm%jyBHbQS{x?TloJp!q7I&0Cz1yt
z%~dl}x?d&J8toH#A^(uYBxVC1#(%81An-+%x8pZt}t
z{^{@j+OAzAGhIgmgb|1h*3thCE$UK1N7nx{Kpv|8mp$tw;1r2I&DE1|EalyvqlK*p$;GawQUvNAX$IjYKDP{2_=H8MQkCYl+C8jH8Z@CJdU0;pP%nAElB+
zB2afC^17zE`?$ZOE5-l>W6-uRR#Y8gS_lP)seqq_Jld4pjLVKHH3^1>kE7iKv$XRCX
z&ZTkfVEG`ewJ>XG^hYQl$LKZS=6A!NEw3vB6l3B#N`hiqGN))z_RgB-IZ*6f1wgeH
z{MpP+%Q{%C!KzY<=#9N`-z?%veDTo?#doju!>{n~|NTGw+)o_^`>+l5`p4u|(@o@M73|&g$
z0Yv0EcS7O1Spy6Rkb9=1hc)inYEXBTjUZd~MU3+PfMlHx(l#Zi+U_dD;Jf4+AP-?c
zsz>PyI-+JOiKHHagbO2#fA_uI9c}-95)o^~bn${5OOaUY_MnrDg*}YxHE;((Na8Mn
zRTOo1bw9MXPqUaxqfmtPBBDjt#zbl!2Wlc#mmD9+fmtyrMtMdMg{`k6G_ESk&vUwb
zQ)ZY3&AgOF2D6!>GOuWoF(V=o9+^3y)HP!vB4e#wjMQPn5h|*tk_WHOQvyK7V$j~a
zbxfZ0*_=`|-qPIyA?ZW!Hbe=^a#|tE*iX8n$n2IS3g$uSREBhi=A);8jnEX?ioABceg6Ctpx2U>
zo&R5dp#H{B(@{hWvQZY*&Fs2A_U+~4$4{T`b*C^HB9TO!iJ=zwWQg9Kr
zAShU24%DI*|A9FxoopJS8(<~Ra0EmkQwb5VR(97J>x@Ho!;?Nw4B2HgGV$7SUmrD?
zOwt^M*|zSH;Th<5%LNf#y&|q_k;uH}kM-#GA*Bq&6d*x@)!m*(w$x#`N7C*%-E0jQ
z!IXzSwhU3F{0{$V!A3RtppkLS)9UlT&j~vhg=muK2luQa!^4I!50Qz1Z||aVvN43dEJU){+8h
zlvJL~2`%{OQbD>rD62%4RsIwaUJszxXU>N1|0uI|_qa2Pi8kFbK-#bjgISe%=j)mc
z5Z;U-zCU<7&r)cS!f~uz13b~dr*D}wMtg0#*DPztRKo(>E
z)?Ac6g+HcEw@)C@&2!UNzgV`M+vjz{;fRMpR5efN2Hj!mbSJE|3Gc^D8zvX2x7kgOzeuDk(Bd3m~wrndWVDac?&54AewihO3$3es9cN
zG+Y-1upe|6Jbdz$uox2kh0b_-+cd0%Z--_Kh7>w#a;tD1*1tZ
z2wxKn&_2YRa#fBnFu<)#Cb9LGFlLD_bX28+Sb3=`#?cvbK7>
z`ntunRuj7$Y&F$2yFs3PuR165BTOeMT9S-hm-vNU#PG6$Ui$SJ(OTt_5r|B%`?{8A
zejIM1%Kkm11idbPe8;2^RN1+*yK7tH!!fH+gBG^q3dnixm|}{7oRUEGYPzrDL2FVw
zW_mwr@7`4e_HF{#wZ=#S1Z88NnJ>5Nx~&LkFJyyNwaWrwwvU!s^Ng~fLQ`m+D+5@0
z4d@n~fT<|3tAsc?;k}8+-jB!L8}3EV2+4k67b5WC!iO7(sLpS`-~ZsZ{^URWoxk?&
zx1S&Py4^kobIF`0*2+sW2l8iL<}j7R6`yoEyL)rsp8`p#o>g@_0xRVlVFP`xyjDcI
z`wm1nu`Ydf;)GEWT_!2n(i}!iBO&4mB!}Rb=`4|pqsCN8Tx_Xn+PBo49nAU$T_HLD
zlT?GHeVtj;7gYcih+pfXPg2YuXP=lBWdZZP@`!qF{qdD0CSFySByk8zn3sNTM%OEo
zGAuDsVwyz!Q58cQdKwukGWD%VgC+4cYpqyvKe<7Oje}Pw;73RpE-ED~0*}+AB#_!@
zJ#YA3lE4%)0KIAmgXPtp;L2Q?T5YJe9SnPC_TKd_^k`{LB7lsw)Y7>p&gOn>l51UBdL#IixpY1vLR~ga
z*rG?^g0nuZ&#ddAlR$}sI5K_7VCHKQLvHCTmH%yksMm=KOTxtO)>slqacb=riXe
zRLUNNgMn^N+7TK>aOC#=!E~h+C*46L<#89OVKUN`6r|ey?%={F44Ao4
zBi#Ujnk2wxwbL{XDL~nI1T3Nx#BeF1h?{&Cs#6MLW-!|638S|G)EAx|!a7fB%rR48
zaa~vDl7Pvo2gJJ8_n%+?_#glBpZ$|xU)gHm3SGL-d^Uj
zP^&LPGiJGT=b$C?39MUym+sY#N*LU|WbX>P}t@L9|
zU?xu2ZLKBQd3#I+7UT(m$67D91)vIm+S?MiX7AR$k{&6!R?vJYK$mlYrsVx`cXt%=Dr8xxL
z+=&5ic0eLBvmPZ1c&$r!IczaqBy%N!y|?_$X8Tbct`WHrxz(uFx?B{1mAntPSwn$Ow9EuaLdte9ov?
z_^&4)$o!lH7(h>>ES?yhQy_`MB4Fc~@H@oeU1@!23^S7Nq_L{YIx}lL6{#W5^K+mp
zFdNR#9}lctE{$CpIn?_;&ft|K7IVv^cKJKG3O7I6YX2gnr;t&$;K{UK;#826R_CXB
z;JI`i9Vrf|n>v5x3V1^itrtlml{iR(v6juI)#X+WQ(6(j<7pj*M3&XiO?I^2xg$3u=I|Jzl<-vKOS5_W>68~#;CC>!J2*xyt
zOZD~OnuP9!Mnq^L%=1t&KwX%|cu>WF`nZxFNX9?^7QkuS>PGYV`oyF<`;d^3b;k8{
z6~nzp-!HltPIj*_PwiC5p&F;;$ME2hmoK=A?S@K!tV7+pqSEJSk71*nN{Nw+$V?^{3tU>vjV`
zZ651xR&_Z8lEYa!wsD^0d?7v__gMMmS6??#UAdAFOtd5P(Ty7)0A
zayIobrl%AZUwisCGV^xXlg*PNyJ7v3qF&EcaaA3GjKwB0u4~=awPbwi6DKDgM?)iV
zO%*Ji3g_J!y7QL0$k@9g*4JPEAmZBh!aM)TbHi8y0@8$t60hMYIs!6hVW9f)cK?3Y
zwvDRe9ARBmMRKKht>vvtlAt)laga<8AH#Qi(&W3QbgJ5Q8EYwQ>6YmRf)R1a_jPye
z-cplKlZEqsq0t3J9D<6v)g2)>W{W9xq@Q8JvyV?FhMc6;eruSptD9mO06a_PWNy(8
z!sdDYY(7DLxe;c19Pnba>9+I9TxQelU!we|w!dj|V?vrv)&rGPTatoVcgaI4N)w6k
zD?_A9X^*oGF&2YVoE`g}M5x7Tt-QQeM5L1%P?7wIUN%tH$+=u|751Yp+&l-J@bgWW-w6?RMR?_hR`u2jxy2dEIW2
zsi=`_z3pc2zxQ|ltN;C9`Qh8WZ@1J?{yDyQ3dJ$ps?*N!ahU(bbe4h1!2=8Z9~V=~
z3-$}w4}C_hwc@&_UUIB-ZAZD6O@eGbfu=&;bsb6)GApX)-o3Y!eqoM5>h3_~6gKH<
z=gCj6K%zEV{wWf#6S-ntuIu4i?qqa;kr~%5$++Lk?AsFK#P%$PhZ{jk<|-a@Tz=5n
z<%9^SYrMo5X}eR(Hp!=K5~tfjM^>N?uUTmi5<^yDlS(~2Vttbyq;{(w4rT6aArZGr
zQb|ncg48pi1r+v;q0SuVaIEEikPGjy+`#%2Xz1~YRR~D7@C=d)q%A`yUf1$iBGFxHH!e$=D)
z&ZDU6uIgQ8q8ZVS?ZxVV$oOPvUpg_#kAc1M_UIz6h1*TlG3H+u
zv#i0cFq@;1&}$hzs8@=ifq?Fi?jR=8A26c~;6UXL2#A_z)5ZF7zsM@Rygx~e59zpf0VI^vB&be<7tKUH)~ZBjtVnk*)%D?pKq
z*~R)q)Z#|{?T0(b2)j?Y))2%M9#(zYqgS#;B{ab4lWkx+33-O4!c?r2pm(Uas5;2g
z?vmkbF&0E4o{zx)p91JKWdfc%$cZq10vUnm2}Ce6F_fsLS3<~moQPL0ZFwa}!Fbe*
zN&p)7op3MeBXixf>L6kYXd(`K+w8*x)T166!#)><)}R>}nI&;_Iwy(|Xp1o|oih&(
z7WWVb>PRVc@7=q=I0?(2n(}I&GIe?_frz};wd8bTZ;H;m#fsOrZ}0p5^5J7#t0^(1
zAF6luGKInhA>
zY+atyPlp&V!iB4cu0i2>q4FlQ*jM|yFe7$)R+>-|1jsOl5fPFE2Em}jvcMQQ!f`R?
zf(`66qNqrF4FIusdA_2E2vs!^E_J5D#_8UuYRXt?-CRsPU}Tp@zka8bbB|W
zF7LMUbK13Ux7(*rUs2|b)#!FJmjKa_2)b3>nIUjFlWLCU1j=3a*ZVi@N1R}-POH#p
zX`_sMuE=VD#X8lZ2m(@sAcU$uCndq3ni?bs{
zS$Oc6H$bV15(&=;kIFpxD)p|1rm|B8q&4bx8Ntzjdgu;E_$|iDkq_&gr)G`x
z3p#_Q`q8--Wz8bdR5ch&#Ga{v6F03Un$PU4-CY3Iy5(BR`70L+5y(q!5Mh1}&_*pEJy;oe+sl+6Ibv6XJusrpg+U~@BY&Si5}4is~A!U#MbrGLUbtz8uiMMztC
zhe*?>0E1=gi|$^RQz8hhvM>WEd(NPyd^JcRo_Aet(Oj42
zZxLZjIUKrZo8D$~8%MYKY<
zwb3ibelYymGUB=}3m$yUE6BCdh3I%?SQ*rgU1;Vq?|Y^>lxg7(Ub6N2A~Sn)_`hOP
z-T{E-Z$(tuhE%{^#dDJypGJVPzs|ED*BbKLT3GKB4kB~LR*hxR-H*LB7p=yr7vUmY
z6;Dybq<*{`cdZeK?j{@cU^5;M+#d+=i;r<#LB{Jn_TK;Q|N3|T>aYFD|MZ{!;L`hm
zSWF{cC5zM&)Q~KTpylWQ5~(hIURG?udNcU!8mJF64_2`x8EqnR%rlM1GnDht)K+sN
zhE$nYmRXV#%kV^5y(qX+(_I;GrjXATDUY5il=FK9gfMJGL{))!=bSW$&3X8Y{iB;J
zg6zk>lg!Aj^0jqCFZBCj@~?kmoqMkC;<(*Vz*EH8qC13n_AmH>4jKz9M4QzfY#|}H
z&r`r;x<^WSwem=8cq%eF@E@R(nTJ(35T8`y+F`zzlK%YaSyivh>b&D(SJhxJ*yC#0
z%KH(pPSCmDE|hT`g7wwH>t4976-XgH;$06=PJX3R7A8)>lLjaFcS~Ah`oJHSG9E@E
zqCHTW@)zLIgoErttmM%EHdB^9$zm>(@Cod)@)CWukH4!B25&N>?*ZB;i^)NBgC3i8;)Qu{~tf03Cy^
z2#hO)?_P4vf*;}P=?N2`Tgf_K7amxt(&zZ4U9tx{hjF|M>fTz!WlIm
zR|T?aclW0+zrNzCuFymw-W{1IE*d*$%!`)X51f8#y`$T}dQ^30`rPTlvfNRE`KfgD
z838blvtR%*p8U3f7&1Q}=#Ps?jY!qP|bk*bDUTDL*ma&*AmlfWNtI{@-
zQl(lfL-?G*{-%*0n^t_#E7X_vv}-f$(PDsitbIK>tB*WEqm2wWLEI0|
zYR;jWwNlD0*b~_VWAiWtTecPh>PohRLOe65pxDXPA`Fp;zw&@4c}N+&%B
z$sSDqBYl1&fdr*IYcw)aV?`v@${0b>v{>Bgn{xV~1bxh<$dQ>>MBq3{N>)u&cVU+(
zajXeS&v3$-vAEWCdwF4Scbke@>#=)3`fvY@|MJ&=?T6ogF3r{jZ0I_&Hw;y&u*@@*
z?yG6FbJ%(+{3}co*y9RSBk_tLF=oz;n703D^;*=B;{?|-T#KiK^HL(pnjbnbgS9vkn9ZQYad+AHp26=FqR(*OYg
zuC>ydw9c7#(uLLpin|#Rk!NL;tVU=w7Fga;;G<}wF=OS5h$ezK+cKxhLZn%MSlL9b
zh!vyoUwV*`wN&c$fq%)enhLlz549&u!&x1gUFuOWNW~_@VB|k?A
z(qyF7EZt3XUTKvgr;erl7ciae7=qtNBBMRiYflu1WDmt-IQ?V`nvK9IC}~1Os5=Uo
zz^_Ec-t~A?bzisHhki1bWKJ2fHHuNbJsx}NCNG`KG%o~n<b6xq(H{ZN`_>fvUVyu)g
zsspL|Ct_@?Nr`kCm{>AIM0n1S0CGT$zuiYTJg6sJ1+gPd*ZNEW#0cQ0dVzW89+M@1
z6`cgOMUT$-=Zx;0-e*y(X^&d9uK7yHv!UthP|)&gGB|8eDY;?#=F_6ft}|qjf~&5Gn2G}C
z^GOodO2ET5HCe;3L{*I?0T{68YppQjqc;CoCqcb-*894|eJ9AB0;3#uOR6Vu8M`Jj
zm_qQ9HHuECE`19D`CawJ7hit(__4~ilAiuaKV85o=p6U+c=9F)`D*BSXFTfh_V$@T
zuA7>(cm`}eU}b`q;tpPX2kEG%3KSbcpZrm`P&aby3Uk)DH(D$2L^+!V-qpUwK?H2%
zrN?#J5_YGW@1xoe;T*}C<#2!Xd8LLX44D-*=(5=bv&>E0&&*^~;kM0A32iu`C@#-F
z0}O1MbH}c&_fE*ILDmueZzWgfs%PRFz|t0bfn7Q3;;?2fTobo*rx+w%kM7-7`h1+l
zDLsn{&ym#Zsmgf-xiXPh?
zhd@R2d?H~TdJ5<~hVzKjL=y5?7J2&dtGD9vLid1bMR|V&ogOFguC)^84#>E!4?p|<
z{tG|);`jdXufN>7Hf-K$9>o;09`bqG5iy=g^M;+081Mf6`A1*0`J$>gN1RA(-ufRw->f3PYf+cJ4E=~TJ#HuN6t((d-Iv1ZGRom
z7uPPWc56j1mxr-!3{UHua({rt7ay^%XvTfV{l5S0zx?Ze`)~f)Km3EA<+@!$IGKD3
z?}kJObzN=sH@z>Nd0)tgp{&Sb2{?hjW)q|NDRtU1wG?N(Z|J9&%Hx^2(oZRfz@?Ti
zV<=2QEgBM#dHWfZkwd!q18U!
zBYtB;vz<8gOZ`NgTyy
z2DEx705D~`tA}#-zM8;y4hbjSC!=IGDWH1*vE0T)BYGrSn#!k5Nl^EUjMCt1*DEJ!~ZH
zMHN$X%Wuats&#)f*&#h+7&PkT$XP=mlBbczk@z{S!q`wCDF;{p&!eI<=1yG>h7G6W
zQzk&S8QgpGX%ufMu?oVR&2V~xF#5&tGR-mIg}s{SJ3Q3}#uePeFipZbJo&3Mo*g;=
z(Nvf;kHL4iqj^R&9TEE+W&*(omwt?Q-?m5BIgGYOkU-y+29RrAd4)&^m>21(YJ#GN
zLlqv$K=MeSc?5+FPd>(@UcdkRN6k`@fw@h;LJ*M)iQ@e8M)8xF@Y5po{I^|SvsUA;Q
z2h{pU45cbP7Wec`$HH>~3MgGww9BQHTFdO0f3enFD?*9}
zv&5r2#1lVj3{}?}JyPR~Wq*H*jnXuPg2IG#kh04gHhRuCVlBmV3UYcln{AZPO!0)6
z*pgS~b!i|aBO=$LyBwPe7`ZfXr2Fhz3v4!$k-=^jGm)V7dUNV$YC(bnsZZD7!xLlI
z96SgUc5^mxP%|uDvXrm~-8qv~pEDJ~bflx%yJ|mnmry0xEL*R**W)4YeCUc@Xu(~u6&xr?4HXU%55ea)lll1&5=-UyQ87pJK
z6k@=WGJ4MbQ7R~Bj6=^e9~+Mcf8($J>fie7zi@x_?UtsaL?=zLXV`f%oo_+G{I}^35NpCYuOSaZZ+GI6^?e$m`iX#oi`pl$9`vO5ahzU7wujC9hXJs%&yQ_6r)wz55$p-o*jDgnX6#3Gb$20*?2yf_?UBy0XpMcx-mxM+
zzQ}MgUhnn4`=yV+|4;wUhnElE{_Oh?AHG;a?Z=vZm?~g$Vu|_A;g)r~yso{64L^X_
z#g*`p?%J}|iYUeE#>%yFRa2|NBE-v`;~=atl&qN*L_~CSaYfwLmAP6mbV?mLviIS^
z3}&Wj5AO?IX^H7G&?_p2YYe}pfve|-35xXawo>5GQGF(3B7yEI9}gw&7}X1d1xN~E
zFz)9jg2NG7y@w|ju
zfr;?qXSj(VS%;gba%2E$>knWpWjb}L2deuj((*d?+Eum5VlUw9#>s`=RA8O}lSWEwygMm`33cTA3mF
zInF!>0-hJpb-+9>JuAKBIPgh=Na<6R1E(6-obPcO6O4CrUU>mN{^wS@fC+YQKoE*)
z0w9JT>;uo%%7Lypm)sq50XE>Nd;t$1phwta>3XFd2F0IsciR4@r$0Ifg(~_NuA6ow}rsVZ@MVhnMW8rwe*3C6ZLvVC5|ld+vSbajDzbnKerpr&fm{T*v*F@G>7lq*8&I~ZAI
z#sY?8(dD;VscDz?c<?LP
z0}-pu$%Rqp+*aBcxu-`*^NBhQ6M_A&&_d4IqX1W$kH}o>
zTEYNpC2K|k2x#@l00lt^1?#=#b8g$O)7IdS`U3vFW#5%8cY8*z%NFgr&wd{fY4j<(
z<6L&`)&C7m0NrH$qwvg~yl$qV_lyqal@(yo3CZRrfV?=;MufPvxpRIyL1eBAx(af_
zWn8!0H{X8#!B^Ms{=>ia;RCDUy5*@kF$~E0kIsbhkPu8B6iKbpP0U7e-#wx6-FgMR
zdoB6znSIrs4^_w->_ng*WrEHBirv@`weqx|DaCE?&29!!TMa!%ru(#U(v_>Yc5_cv
z1iNrr8diK+72!ayIn`Vt!+EJ13D%a7Uf++1nIS}UakwZ{v9+dIWPLyt=DODHWkp1;
z$SWj8CUotdL9V;^y#(wdW8E^Zv|MmG*s4D!?qKikVlEt2q)uCtRgzALkqj{E!PJr=
zOMG)kXhRtQ)MC*s#@`-AO32TcC=@2gUe6#vk5PRK0N&&@1RrUGnX%Z70Iu5wM0c-<
zEAz3d_7+V!4UF#g%Y`UyfYabb567oBFVJpR;qb_GxLQsN8KE^rxpJ-S?xmwON~Ed=
zx*w$yOoiWkwTO(pi@;i`-?dh_(aP>(WUR|`XrqNUN9n}Wh|Johm5qW^wJXwI$2NU(
zNH@AWI<~->
zLw>;2tdWH94kMuTsB|-PO0Uy;17bu&dM2c%bO*GI(8K$3*HYw1MyzR)SauPvJTcv*
zj7ATW@7eDzyA>IPiT8!T0;k%gJFysYnNwzP#7E{7Oa*rLu1zo%`Q?M?uPEnU#vG^c
z!opE|WoXZhxcjjpGXfgwF?A(XeAc@@w!X{xMp9tY-H+K#It-!vKT?{sy$=I)Hzro*
za>IaTHl=dRnb;Yj7DnlPB1ZSkv(~t~J@o5sb7+lA94Ji=v+H+7*^>`}c
zoVP`F%iNm~kd1I-VoIwio5BhRsHHD`nN9r6tT{T#fl1Mr;4;v5Y7=!KIvJXNcR$wP
zdHyV&+;J^2^fB3ek~Ks2&WmTZ)1ZBc3)77YbAqZp8axMEr2>Gnx03BvDuA=_qRr+*
z3Bqbk&IOC(jeKBb95GR6*m%#Ay@B$Wm
zSAS*HyzX(!HKGBqyx@mK5Gz8&$uloH9BILw_pVY-Z!tQ~K-fs!hq?VRTskQ)$B1Qe
zEudcCzN_A{CUzM;rAKuO+v{cz#={&cOEUuTxIeC!mk%F5Xo^!>)rpq$%zuW6m2gx%
zBW6t*f-jd^`oQx&AmSszKzPv3!-X>oSiQ87n63fX?BdGHkz&dO-PpvM@oiSA^^zP~
z`J5T`XR+3BOzMnHu%iy&z#ty33a&^T%}kMK?dS0lP~#|8g!<;dphNUzn!^=`#ove;
zCePE*jGS}^Pd%3;nq^n01&Mp#PIbPF=ApmOYeMpHgBt?XxPX=-=
zuRBH@39-w|7+z4L2fdn;2s7kFmCmQ{BTiOMM9hS?-#msmBN1{c5pK(jmANiA@nn73GZQd$Z)nDB
z7fa}DMd*(iza?FHXkqd)nAT_SvpP^;y%8(g-NGcjbP;m+*q(<`SQW3oGS^B1^=KA@
zp?`uN$;6e&+*`=DXQfGNl$x8>&^*0(iu5}dg~KX8Byk2>uaH+Da~Amsf@DOlYrWjA
z>$=o29wn+Byc9l-OZs#b=JASLsID$e_mNt6A0Ft#!77M|>sssQG>ynB8Qj{C8vwXg
zbmQ?Tve%WjmrLhCJCyFCx?P4&FS1@p0m;S=l
z$+VU;L#w+0&2oW(?
z;KNNfE5G|(f8v)v{_}tKw_aXezWLdAFCRbXOixPU%7nc%6jflB_n?cZEbz<%jxXe3
zPWxM!EQHh
z-Ke&GMl^DkoCB!Mi09%ZRnv-bGgAfKIS?pMAA;+`CzeXBS>1&;zXg#44
zU@GkqvWe>%F@thkoc7uzj?nfXm+9$hbXrpwG;w;oU8TItu9~@j#b^zM!nhb1-w0n3HagS81&{nyA`Ui}
z@sL8ULj7{-W%6N)^C=gR`uEpqUr)pivHaJ%^iBK+Pxa&m@4RF-8MDX-At2h_5;=FX
z-(fe%KtaV3XFk@00G#?ajxzTN#~CBlbX*NR0*`%0AlKBc#$41{nbO(}kWSqY>u77s
z`~?ETf*Azy+$2H#?%uoV+!4DTxZ+ixJJkl(XUvqqIJEC`hNmi*mXs#$WJ9*w6%
zZbU}#asRGsduSFGO&(0*$ufJshBvOt#ZxU7g5CSRul4fb<42u$0h`c0)3?wU)hur}
zy|!a@7s%VXX~T;mgIXwgx+^13AOU7(u1NLe&EU@zw`8-e{YTN&H8)5Um>`!13gX>6
z56ZYcj&T$)!`0%db0A0qal5WSRP8{76d{oSt2PKbR3qNmES($TW2g}(vfvJh#+RN9
z%?VYmE@?qwZ4XrwBV|T=*jd~8rjFF&l&T{0i!VOuuV;WnbmJi{+ryx9f^sGpatiOE
z8vE`3`LW+pVR{ts!hE9T=Be_e93}tO_v`2bAb0FYH?L<$1x(v3Iz{7j6PhX*E+*7&suMb)lH
zd1Y0C6?F4W$Bh2@A7}Ltw_?nW$Z9vBRNh3)qIvx$D+`r526Ci@tfOb>+K;`r2!+Vd
zn2Fjn7$#knp9mxWAf@nmJ!B8BaIz}|9l|W#9Di|?GpdxL%Aj4(BeoayItRX|N7Mz`H%j=U;643?)O%R3JsVX*{$uSBO){mrkCX$FyAHY+|xs87~_R{
ziL?n2$f)}Nk@auAwrf8jaRkFi5Fm~dL5gHc
z=a4)+`?A)WWAv()ht{f(DTD&WbM{_q&N05P_o`N{TD9V7$f(N2G;Gtvi}Q;nQ8RMi
zyB^i-`@O2DTe7YtxnpK(fT0_)^q(6Mg8^Wy6}G&Rg;iXs=-4u#1&$hWE&1Qtx=a^m
z-4en5a6QKMvQQoJVO`Q`Lc-={gXZ
zD-+GGZE{DO2CkI}+q_FYS3M>}CzY|=A_coq*FcQkJzsPxn>W+Qim6?lxqOwHkdk?2
zZ>OislnZS6r*Tq@?P_9$ex+I~4NkRahNZe*1Hj*COmh2Hk@7lXcJcw%esUo^1
zUM6;d5GaBj!Z^W
zZBBd?Td2F^dRYr>RXh?%As(N%&~kYBmtm-m19e(idTnAVMr>JJAGl=K`%6cQTXnFtDx*)WQ=9mKy2+
zs`{d;u&J^I#bt4Lk086b@h9wsk$DXnx6RdV2q3ks<
zRJcOZ2Vj99rcuWq#DvIY}Y=ZHs!I|Lf?ESF?4g$m{ajdUA>bPRUEqLL3*
zrU>Em0c^5o@rAyoCm|frg=tcbJM+ruVx}`Dp%m0BizrjhW>h7>bcp~=kH*DY0JV3s
zbLBW>MvOi&&fJavLaN{htyGUZ$>K@lA|jH5c4b-Nv@vVm86lR?Pwq*q11k2;Frfyy
zt#X+GM_MM}5OfAao0&O-g8}yR?K_UQf#%&Xyo)Zmn|q!rdO||$$hysd0EXwKu};5g
zryK~K3wCO8_uwG^8Bww9rVZ+51Cm8pQPq@XE`etC-X#RCD#qN_S;iBQHl7JPv^_ty
z+m206wFaY9uNe2YR0ALZ+#jDF`_-fjd~kUAXs7O&2yygrYt>!YP47i7T%8?0~qGBduUMy(H8NX
zv1E79BfDpXtgADeerl5T;ewTZ%U5JAv!Sw`1e69!#>DRMW13j=bEowc;~m!B#2M*v
z75P+aL`bIFifb_>$(yPJev$e+u8KW(l+oRh*Sim2=$v)e(>-huxr(X?3$h1vr8}7(
zAjpW=ygO*pc
zr45H)3%9}!wI)I#NXlMiZ`+D;3a+#RR#jKTd_5r*67B;>xNzfm-}y}fM^LJ0j;h_g
z^~oKNaAJJuQi_^Ys2%FZgif5Tr=!W@aCOtUOrze@*hFBw7Y0LQxNZd^au!RuhK?nE
zK}BS)B=Xaz&wt_1|KRWatv|8%_Dllj*$;l0yyDToXGyH9`sP{9N5^qy+Pn8Yem}yL
z{@a4TDo4-NJTsKay{_CmYY`c-E(eHAL||Q^GEc81)b!IJ1sH@||9pZe#1`rZHN-~Fw3@A9iJ
zKfZtWUaXfy9YdwDY+W2GJ~@ZXA}`1EDL4V)U{fb2v<1S`wT+PDPDHMCCB*t`AXW=(
zbF^!wVFd5=&Lc8B{yLpMHB&Nuo`gI{)~l|TRWB1@5YNA=aNS2^pG$uuFg?%A);0SgECn
zL_`qmp$~IiM0(YZt;K~w6De6Hpn$c)WKXV@S7ZWtIAG6A3F?Nu51h)?EK4aGDYEN+?=h8j{I_8eNKU~Z`O45!vm
z??v@+dd#>fE$(dHRNyo)P%PD%(RB`4Z{+1kZ=DNb@R14Yfi8qait;JVP{+#EV9u)x
zBZPTy5w6}1FrM^*Fwf-55zMZYR?3*N=RmIMsaj;~!yll<9Bx6YDLNnm7~s#ImbJy$
zh?oYzAif&jLw}9NL!N`p^96it?9MTfAFjEL)6RR0QyGw!`*MWhC(o^1*NUZorI(fi
z$8i3b#R4lLbj5Z*s&{)VK-ve`+s`d75iV>pVr(+zK`6c6@1O3Edq%p>cv^0x_hQCU
znXTvfY!TBH0*So~k?-DrcoGmgbQmBL5o#>S?~SwmGXfbU2ZzazN+lYIID@@nLl|IV
zS4Y4bsI8ke8>FA_@sOA`@MI>Mk4Ha*uXvWE8unptb4EjP`bXeEF5US+?yAgd<)yg0
zJgut1GpPFtVuFsDU`+W0pjeRDc8ZmwQ5|ZHBNR6UASNWGUQ~(|g9sEcKnFuXxioKb
zt?T9Gz3vW4?YLL=N~2%pZS!)6%N)u=uptq#cir!=ni5nV6_ZZCOmUYZO|daUtCK#{
zroysXL}4}A)J}7w%+Hb&-&mz9<{s?yvpZ16lcS(i!6mdBiY3Wc%jR+*3$ey
zXS%cqDFJK~qOAY?lNz{Uv-*5UA;l6{uPy~eWq5~(0H=DP1M!KD=FxT3x;leh6{g!N
zb17NEe6I75Uk!Y*#JVlzIdj6pk<9R+vQdnbR5L$qqb!@44Ptg<%J&NP6xGvkG**)#
z0PQq8;|tva5AXms0T0FmDk86x)mK+lYY<|Z{>ncHS)I;4YZa5iJ34`)s{k~uN{G1K
zmLjc3dZu)G%Jnk``XrE~put%^o)cI_`oRlNee`+VUOs(#y%zqRf9o&&;QQTjL(wFkt;L`7^hyRPSB79l=A>+wY>X~aB2U<&CGc&HsW+JMnYm2!!KOqiz
zH@MzLxHYGwTA!zFgO}
zB-VumFNs+x#9?IRF5_1alm8T5RIc>gdeKRKWY|?&OsAff8nsp#g+{RYg!-{%wxRK3
z+n||cIH0DYGQo9Q`kYm#USI^T%Tb8B@~8UMw~I8u@%mOkx}})oPg{xFWMuxjK4fOD
zYjse3hp9TEOF~}+SN!HHSo%Sl8}Y!KQqP?IXB_#;xVs_e~BQkEn)B
zhGntS-FxqThPqHfiVTFOi`9e8z`EADtw8ASBG8*8G&RRF=3#cx>&}MHbY_c8XwP9|
zEiaA^pc|Tn6fjcZTBXT8h*N{ytR`xk<9j-+fOz`%f|xZvoMwDctzfgH7I104oD)E%IJ>13xFoIHDf3M<@+w-xdbd~JEP
zJnM2{rFD$i)Y3dG~4@4|5a{rtDSU
z>5R<$v6j-Z*fw6zP_qj;B1R?Wz`*r6yNp8+DYoz1b$j>joxU%gCnCd(j0A{X|M;rQ
zz)duqB0>NWyZ8P68uC<7C8yCB$0r9avkoN9K03_f^v~%Sh8Yx*R_9H&GqoeEHB>Q|
zqrWJY9~#9h-LuX#DJLocDy1egPdVy(CL^x3JR1hu
z@me!9r|Ts0f+~E&%%n-Ql+%{l0&umSrt28XjY18Y2bEn>j
zxg>yjxalv`^Bp~Xig`(K0(X^1Tg(Ebcc?lV2PEEk)6yJVE@(0Yag6N{%#(0Fw&0g*
zytP6aqRdHmt#q$K9G0q)U5FK+KaWPv)gP{6cSD(Y1mgrE(KVf)Ol@jWn`}gV1bmxl
zQPeasX~n4t<@4!g769`8@*$NnA%Cl5ik6IkhL^T!E;wvK~#Y8l@tBOrvUCINH;gE_1wBcQq
zsgSj@tA$GV#S&NOr&=Jm}=G5Sw+)U(hbSo3B)>dHdQCYvgfS5
zg$0GGYKwiB(Sy&HRm?JT3SjTb@y1ms35}AD(9so(Zil9xr>z2nTi;Vn5z}j(+i`3@
zs(a;nx!p)=X&fy{1D-N>g3y-WUD5_46Ste^i$1^Zpa0o!{lkCoJ1gTSfBfZj-R5Y`
z>b+d+@}VO^Xr@cHKt=Y-^>p&Hh&8H8)4A?cxU<2qH?q3rvQPcCyX(k4>ZyPE&1O3-w92UdT9K-zqMRvr6EpBb=Fuo;AoSD;k!Yru%8_6Vy}_
zwB#_0oG+kqd4)JHSqA7Ix1SUA2)gYhPT<+9kI7juOD-oD^;l{T^mhrOGDFfIoKhoP
zh6S9`{AVJ(S4i^RBRewlVH~~In*9F;=MIZ8l2z9aF{plK#q^R@qq-gLzS-O?w~b@$
zEkklsi?;Q`#fdt*OsJ?tPt<*4?Xa?q_J0XwSGdb$;b7`;W_XvtO7EMBR16T!V8i+~jynL=nbepr
z_~ufAe&0NcIRN0gZu&V>11r9@s#rI{+?gCkN&nlkwb|AAzTIA4-n~O;K4d6!IX&o?
z9bYc=nT<0z?w^#AJ5;62nx3;~g
z_G_3|b<}L{;V{P$BZ4PED>Gdz%-iXBLycq5t7gnoV5mD1(jc9|2nTPy3}~j2Mr64%
zb6h6U43{c<7Zt5Jxd}&I?8sOvrl+ZfbO^=Exd<5ND3yf&TJtaTPUlJX^uL3l!Lx{z
zLoP+quz9W9>*pflul?0u`m?|CQpJ_0+Ibc{&w!{bI&7Iw*I}mV4Cnc`F=Nb3rGd=o
zQiBU!&^(w1FAtt{)(y6%i_IzF5KfU%)m_|=*64ecI26=Y1|GA}F$1XT+PtpJ6$C=Y
zzcQUBZ!ekG4C>5l1?)>)yC1u27d_?pgbQ7+Di2u8rH((w)I8|EIMpi_Ar&K781F6r
z!|tx4s&{Mu6zm&om@`2*;Vk!)?Om#+1(?&N+t2;z{n$-*wVsO%u?K$YPSKT*>P_XR
zCFQ62LDfc8qT3yXu4}EemO99z%#J~erJ$;c=KBDscr*6*|Htl9Tl?|YU5#l%!W?_p#EC>;
zS66o|ZAzpnPbK5(wnS4i(#t028qY4Fl~G2i;(TW5xk}xQw5SXbwvKG;N8p3gKJ!&l
z6qBgx$NeGU-0`L+Si8DtKAuNnpo|!&QyLLntu04uT>u^r?@_mpW&+ZIgP=UR@z~Ix
zx-Q%<1oHmKz3boqAOGfG{?%Xp;SYZtd6^&7dlPs?T9CUO9z(gQYOU1zWx{=jK!CY&
zHLI$ea6?&!FgFgs8+zSCa_u)aLZE8Wi8{}U^*zJDS~h_xMiq*9E-6P+q047e6A!o!
zv6C+HlHy
zt#w^j#)3plgb;#~`V;8tSExAD>vO3V{)JC6(V6XhW!HU8R|R73s*L)}HQ6Zwm1K-1
zNKA?2GbMnTqqFlHm|Pme<{Wm*C%^NYSW_gDd4p~yXXe5XF{jQxUxIa-#ZV(56zY|FC%6>j8nTV
zu;ZkgFkw>4*-I6m3iv8^`HM%y`15NTSLwTUDavWer`4vOT&{y{$}6z@{@9<7&7Nms
zCsOg?VV*=eNP3VMo6d)Tvml)
z4hP2aln`k;!Ek{&S;seNLV4zj%w|0HzCS*zcZ$%Wyy@`)@GOA|#mLOHh60JuK=awd
z=_51;V`>#YRfjXvknHllRim_tt#Dg1B4O00%0SHX$vQaaq1`D-`B)6~dv1j%@#rl?
zI^yD2G{-gKs5gM_WD+|Jr)6HJt3!#fMH_qLxg@{(&#pk`|9G_8r9F`6xJpEXC*+#bEAj*o(>ZDx-Ad36ZAeK_z5L
z$IhDRJCe0=iJ7?+fbIMeQ7J4Vav=a2UQx!pw_Nt6b6^d0vGp`sW6&!Af9P-!TN$mx&
ztOt(TB($-HO-v5(ctp(Tte&%=e>ah=M;ql%mK9$?H^fv#$gDUcK$&QoE|eSwy0OhL
zuV3(9FZGh~Jn*$AG3&DxLq_JK6Xo!@HsDdGUpbp_t8`xD%Fvig$kJL{XL-mPm1$~*
zM2x$heoJ?YS@7w7vdb!6x=A(0>U;=HiOy)kZ2&`-Fy1>SBR7YHdUyv(>a5hmw{QjX@jah-QwFp8EXCPf@Z=Nv?gw2JNl2g4zKM
zf0zc$pgZRrowh=~*bON>BVv@7KzP-8b=UU4rEG^q6A!>~3!*e7f!*9qGFHazrp`%x
ze(hiSg>U`CzyDYBx_$lir**v-I%KQEY5P4&4LLA?i1VL){ijyRh={fF$`xc)*@J?H
zn+j7(`X+j-s20Xt)NpmcAQVdxlOvf*oug{)jzb>|I!iB4jzb62{my4WFJTR7;N|);
zMiZ;ad(PPHGSV&!fsNO7a>Uu~+7oTZ1p0Ez-vY&5`0klSDl;y7YY7DK4bz
z$aDV%AzV}k?X~rkX9@PotVMPwEox*iE$08KGzGP=dC-}#l8&5cm-N_*=S^mk%jK02
zoNyCNwCkpe$Apd3V8@7w7=DUCkSpVoNZb`~6YW<}-D8ujhuhi~DZ<{jG(%g&wfL~d
z*TP@dqM2h=#Nny&{Mc%v&i6JBG=uLv`6jBjf9l8p&!E#G%`pf`l)7uc@nr~i294lO
zeamSkxmay0#>4)4iUEpIuG7uI4HTR*Yejfpi$yCsCmg7$&o=mq(^Eaq*@Pf+<(hgu
zmnOjUmqT2Trc$2K>?lUXSop9FM+qgzzpycny*Z8wANa&Fulitxyn!=Mf3B`
zbAx13Z;E{#s%^a_Es&&ri`0%$c+&dr^J;<|-QrYqz8ewE$9;cR()Jj=tD2@f)sTq=
z*
zYHqNxaw!@QV02jmBBJ3Lx2b{8N{;Dzc=B;t_mkgcv!lIsLmGwK_mXb6E-Lvvm%>BF
z(R$BPN<?!|7&#H(h@q!49`Jad|ZN^rQ
zZaV(YJMSD2CXb#xU|P81L?ZSv-_(-vum2C2v0$020j?0U@C4NiY#etARcomhj2}c3
z;{JUUBO=%I{3C~h;P60wqR8pAw&3rc3oydZhCtY01s`E{Q-L
z7(@)QN;UtxclRb*0*-mhrSePjtAm3pEJIl1Em?qdZdB24cRRo2uIh5@Bg~n~_eiCt
zR>7cKVi)gBUh9&}x4o&`|FFn=)vy2BFZ`9?_|D#)Q>71IHf5>;`RrlS<=1ZqVI(+@
z09NZMKU01mBa!Vl{LzHV6R0@-O}sr+f_kuZjk}RlX~>S1u~yV}5f6_o_%L*}h03js
z9ev)l)M_N}uT|4|h&lXzv(4)!T_UCc8|AbwLQhDx>S^N*en-=kO1
zA?J~p6OTtlM6Qt2trWs^3rF=ZT~5ooNsvvxO2nH92~J3)THNt0K^YO(N(GJXR&&xt
z8J&8|jq!*;Z=Lp~&+lAlgi2bbo*A}x((P~U*_I7y+2Fw4?~==)`kO*%*bh`OfZG*o
zp_!lV*pK}`|3|<5>%aD=fB2(6%3)
zpF9>LqDt?=XXl_+m|CLDg!1`{ZUSOHL
za&DRIqql%aYBEt`=>uIDLM_v?)oD?lcGITl2=-i!MjO26bmk$KyYNN=#cWk2R1@iF
zL&bk}Hz-s6Hb=kGGb8gIjDJQA>p=$*-ToCyn))q#6MkF^^>I(mLwI^}ThQMO@
zdb&!)&`<`lC*)?NwDI9aS>Wtd?(htkBeS45UH`>A+>rZ5h+uRV~MTEz-BO{zPY`;zw#JYjq>ml#$lI
z>bYes^+L{To%+f~hN`Z^`$1sw9|YIc0I&$z_IQI;P8kTN9KX)#Jivj=F81j$Y`@Z)b!ORO@WjiSW5!CLOH{Gy4
z<+H_L3j1)yWL=GzUEgLS72`HIz~*W9Yth6+Zy6E$Wjj3sKr_YB6DT}GgPDZX_B-|)
z&}p_|hFHX-OK6>nsqU#9&hu
zj^p2Bnwd3qn@P5a2=>f+0k@Z>Fsg%4nxF%nK_Y;Bt28TfK`2!Y-YFAb3}2=B0NZ
zPZZ@wsAqWmLuHrhg7%;a*m?rwe(d9_Z9orStCfBj0^@pNO{SMu28djdWBDt`CaGja
zsR+=X?4$}!h}NGz2AcT{#&un{+m-gZE4%9Kj&S6%6IEcX#U4C3m2GCS87r>qVnm}e
zM-!nFKa04>w>dR793##oAhm6b+3#8l&0Sm3o}>(f^)OSDPNDCskLluMte(QdtA>^m
z_jWimM?`e(hvu{b(AxURvvvHC<#kXhClQ7nIw%>Gcr|8eLMXPJxgstqjI!$ghZW2Sd^YOP3vsaT0X-9Jnqr&!#2n
z4v(Ik&lvL$lH`BJ{aFX?90S3+ikPJ`#D24IKx5f?nh#^Z3%=SJJ@faiqa>PyW
zD$M3-i%oTIi%LHvLn2OhMOP_k+@m7PS4t&xIOY#_7xrGGO^vf>qM;dAQzHCrhYat58-S{(uhw{Br?b@-s`^W?x;y3J#EE6
zbz=niX-o8IP76+l(F=>iY_hoO!Sn%(TAp_6XNe1NUDC#uh*hJ;;21|)ZYR*CsMjpI
zjCO#;oBtu8-J4Fs3TGMCx#+FkDge@JKgi}uLbXoV`xeo91(7d_2ehWv!qUy)oyXL97*LYk{8~~(|K0CyBXXbTF)_Cg5_`LzfvhPX|+}omS
z`)0rKCDO-W;JRYUbqqF&T$+`VrSlwvHf>bp{TUN%r+w0@&o)KA4bkYX9
zy>MKbUkh9mTDOAGeuf@q7!~qccMgoOtbQiiSiu0m8
zRLh|0l~II4@!X8_e%@JT{C$sLq^+gEm%yo0)=GdSI>-jsbO0Gsd<9#|Qv%Rw_iGyGECJ+7&!K
zbGT7lT|JBo$E(w2fgWOp?88RmsY?(is{m6m4VW|kj`0W8>oDpNXlzcNjg{+`myti1
zu`;fzdem!pcag7`qonhR5v`sNdx~ZTBC1R4cDs9Bx7*9h7S}vFO28Fg_3Y^yz!boW
z$jkx7q_M9e=Q6oKt6ByGyy>rcLc!2iyyt-Ykafe!^12tU#_c?P=sD7kMP21Kp47b0
zGc-b@06Ux%<+MS+X+WCK0NHMZWvXT#)ET*VEs5Mz1*
zK(V?v5$jslQtN@a5=jPL-o3l7YgV49@xp_%m$dhjq^4DO&Vn6|nUo9a2TjL}C(?vx~sa
zkcFze^BIRhqE$(y5vNPja~)yDmtF>E)=^Rr&NN$&J=9Qyrb1oE0L`j;>~>c{1qEh-
zgrHE&ETw?G-l)4WaH*{4kjS-`7EamBEfl9x4bME&yWu0=)fstRm)?!xmkal|w?6v1`R
zBcLl4?uTJA?0^6l@c{fvy4fn7DNUacz%b}Q9NtMmKw7Uz*SaQ
zo&cHhg0}GK!m|yOlRz?>h^76gJy2+V0`VN%pOylEZseujY0oictPpAeFcyyJ-Sud1
z-x)CHw7CMBHR*F~&M!s)dp8o}8rxk|3-|IUS;)dr#Q%z=`>(&Q`ZKxklY4#T6+Mq|pT=(AM^Efo!gLY7i0Vs_MOK2x#l}
zXux^BS65`e^O^tC>iOd1mbWqil7Z8vQbT{MDPf>E}
zqr;lWueU(Wh;V=_rV27*AlO{9>f?F4Bg5|K7BU-nj)S)%%+S$<1x!lPrr*ZU8!--T
z0|Y>;V@~-G@3nW5?HYqkk56gKuJCOSeM6l)^WvE4Lvt!B+eQF+Qub4reUj1B@)Q0S
zmM5F|2($meH!qt&cWF@KlqEgm890AU3{-?tu6ap^J>4mvV<&D>Xj~F#KR^wsD`g4w
zAiI0_<~$z))?UJG-#{?1djsAIHYH(A$?1^n@;V`+AZE4}n5%9rqL!xSl=KQwnOcL07+LtTJ9wi|70>C?;g-NUd9
z6M(|R(||L~(em{Tga)_By&rc;m*EzqYE$QBx1D_@=cPJcN{Z4-3c0T9<)wS(4wb)L
z5h&uGnn$D4w!da;a64Oy1r2GEE`xNZ+cW`x;0rVVGznbS_sBtrubv~Qys{8$O
z?boTYYFzB}zA2_zqCC}RwnCGw(VRlDpl0Eqb#VPWD4us!&akOW^?vNT<}S#oyZR{O
zpQcI5izD(`-iw-fK)=H6TAKPY>E)o@e51=30CM+6Jc*c^U0cA!F$aE!h_U-oLGJHG
z3-g|*$VKkC+~a-7Nlu}bl&+j|bA%=^NliD6rI%i4c;G})z)~X{VMI3B7VCSnX-rE$
zW>W}ccceTt>l57tVvj_Vh5_)-r~qN%$teiMb|@uWT3k_Ey>u&rj8Gz(`(8+3)?W
z-}|#50o5alQ%<@^tl^QV^F|bT{goMU7{
zUkyO4$m_tgTq`x5sG_uYlZfRwSJjZnSsbNGte%$xvt4g5sRl}oAasHh#%WRjjj3Q;
zw$sOQIU?UM(7IOa!dkg*D?)$L9A?#1&YVNW^zgNQVmYKZQCq_x(@+A#a~Xj^?UGeQ
zFxHZQ6Kmxp=){=E_AY(BdE-=pEtFlmawQ|HYCkMhP~9#esOExlc~N9|i2l$bd-*HJp?IS9)*gf*(_BVqw2q#D5`Z8z
z5JBE@bZFdMR$Ju9KGv5_z!;fFaCu;`NJRn_~rfk@ex>WhD2x(oAk5QOlFAeqwyv%
zyy?UtIy@`>RDlEKbReZmi7Ax?OZ9`4Nzd=*%3&xD5cMbwmWa<8%^KiA^Wi)%z$6BUBq|dPRzP9L@+~Adx3h`%6$`x^F2noD(v1
z_~~R=w~JA?2BO>$6xv?D*1BWg*
zF#*|wpC-PEiJ8Qn%?^s@nJ|kH8ecjU3<7?alTD%f>TeEH8<_NE)ES{X9`n9c*C|&z
zl}6^ZR1Ht|X+J_b>nW5k^~b`8k!;;kvfcU;>>L(NA!Z0ae{gXCIjqSv#(I~U^ac$p
zlc>jjP3=z}0z|I_f{~s(RUqI1Jtfb1ALQPTwXTlxI+s(n#f)$(Ic9*Ym?$IwGfyP^R-PeraHJBQ0uNllt}x8iphRkVMLnJ*aURpS-q#nKA~LqJR-pPi_Q>LjMQjH
zYO96>+3Sb#CT1Ury~J-m&odbC#{wFbmP~`6$|tq_no({tIzSx=h01!
zeoa3X@G+qAU`BZ8cCNI7@Y|oGPumlA+>vQ=W#qLQs4WvCYi1Nv^s}@=>V!hE4}d)4
z8Z)Eiquza3pds=w4od0WkFD?Ti(1CxoEpHa*SfBdcYhBRgD3-O7rp1NSh$#Qnw&O*
z>NkS!y@%nNnwA2Q&TLDNCNtzNV{ggK=cSK$!svD7-o1DK)^GgWul*ZeJRTNH>xG=C
z8%M^gU^yeM`WPO2p0T}fuaB8nob|ytF
zghDh~yHwIV9tWqzeCROD4ue4rH*4Gu8c-*(nfch}rqodxdq(QDVm{+JvqxbAyXnSO#9`ce>hNhldhI)*C^x_6S9La;M-7R5Ybw76PYC&N)S_`)ex0eK>kRMNjr)V2KEJ+u
zc_&_*KE@{aO`Xe)^?*G+Ujz}2pn`&O7dR77ITbWjhhT&%F!2}D|2XP3;Vj)aHL{+a
z9}1jFZ%O5F>8H?L2u3D5yrNM}p&m>_r$N7HKv7q6#lZm4#F{Dh8FroBGthhjTv<46
zGfskRjXN1Hx~K|w&eOO=zZ@9VsNXd^Y?d)p)N}_m
zT#;asQUgU7Vri|qalGErk-rWOfn*A&2@dPUp1z|K^t!3Q)e+VMPovpOvky7w^f4kB
z_AzRr{nn>kbWD796UF5UC@tyEbn51)44+FkSJORMGIvZ7TO-CbDC-$j=0jduk-g_Dn!}0h$
zow|(L>)8$Rkd5LBY&}eta?q~N8EaiHhmbMmv6cW6BD4pd^Z5~w;HVMZRhjwz-Fv;Y
zv^Fz`twY;Ryqbj+tP(Klm>)UEFB2*&RK-}j@FdsZsg(I-7zhC%4~;L_F$~Mw3*lK
zM|;DX*qRVRx8HInRgGJ%=;%NoES{KAVsBoVxDiX!J0qT8Td(+^0=%&<=wZBFZRqSIC-V9|L`T
zUr6X9mJUhg0ng0HSmuv=GvN7z=V7;+K%r8>)wCdq(omTnA51O$$RKXz5=!@L!`
z_k6em{(u=F>z0u(fLL1AsxmUxweo-y5)s#0X8VQ?h;VbJo5jvVWa=P<9#pKz)$GTk
z-4>!3nf-X_1aT-T~23nh)6EYL7F4Y(fJ|5M8ChKa){Xr1#
z-$hsGD%?9CQT-U84iO(2_}WL*4XUH%Fx0{_>-V8pne|sXo3A@
z2VoB2RKLWP+p`#sfL*5Ix?~1xm%le~&dha49j2H;8=`7ci0O`)=R0a?*BxDf7L4(r
z66jx|105L=v(ajfC`n*lD`UBs8ND9x{B#YBf>#wthI++Tl%?wuzf9F0p^Q28(>$>B
zKX)h2jLwo}0LHzCJW5Zq7_>4)>z!i2w0K6kX7|3^&Io9VTn8-mA?LbXmS^_}5d0?N
z1S{d=6zZT2v0{pLx@Lho=eoG%gN{i>&ivrW;b7KSUa-EgMnmEIG&kd{NrNLKB98XZ
z#uzSWF-78x@&ZinASQ)HVJHwM7^xd0a52|h@zVh;`y&~*+dIiLT?E28
z_)RiR58L@g0d&`)tJ#&2FE8%{Q%E}WMA)*fPEvODuFumj*@ICwVxo^Z8o4CkL@^a)
zq0O%0qHRtcTttBgt$a^{YT&D@#Bl%=0#viN`*6;PjAEzTr)8s21;EU66NRA>Yn{6w
zl2v(y^Yz!dO^wP^$4{3-d7vX?aXzAP`&v&$-Vy|PDAZwjp7O~wD?OjtHjhQbbz3jF
zvRS_PJWo=4=@r3^q4g3X+;js%>i`jJSKsfS$%DPb)sm?cHx
ziHBc=cjm_6FU41!;pH$1?0AD}#sx%lBWAQ!Rg|We?OG9WiC!YBx9>ovxP_te9VOy<
ze+);YLld}4FFLFgh6@5t3CK
z8tk-MKL_%u8kr2LbExjU?f{!^1!G-lcoU=7;M3V6#K6x4Y*^aV6Mmdu3IA1<8b>Rl
zSKg`)gjk*s)T0%$lMEAhMz``%IHee-Oe%?OX7VCL6NVQdOpu!a^6LVkJ@`3j#%Gj*GfHEHdUxxSCV)^-5cyK^hzTLsFZHKxO1krmJ$#n_(&cP*Ijq1S_ubVAL
zlps9C(9VH^>Q0^JiB1YO76@S7^1AYNTk)I{pj#_$o_lscUja8GFL!4#tfBBCyElGM3Ek{3x90{+|10W7soVf6wVQlt|c@XSe@Sbq_%b~
zx%k%5x6?Srut<7nxeOPDc=Tgu;E>ekpMhr_$Q7}!96+zRVMRs>L=|A6{M|J)RmR@E
zWsFqzIwqr3f+7>xC<-saYsu|iIx~9L6HTUG)JWtL+
zb^?llOvnUHas?S%O8re9wn7MRdfE{ymjMJ%NfKf6j-Hq3mb|}L_3piUv&*kWVtt)G
z#w=?QVx}b$Z=gr3bHl-uW)}nE2h3s9{ay=Y_`KZ_ib3a?c~~}JGk-Xk;L%>
zyLAd-T1LE`wWE)+FaAsi%|WGfQ+lryMF)?dm?IP87ZHH^BG-6|^bCKIVC0o+Iq*iP
z1GSK{7BiqRV}Ye{N*9;M4-KIqSWQ<+-_xZxQnhslQ(3BB)WgP5J^Go1*tV4P-XttbbB2mYij{u-cJ*+go!jGL@}P5!
zKbs1zlf!f;h;{|SA+!eTsm?mz+CY2ot`bXF1<}5@I0e75Lawz)?%GV%!}{77>2yS-
zsqgmM*@HSul%V$`3u+m&ZVh&
z&;2Ta#bA}-8Gvkr{xyTXJVhy*iGb5JDnCDENaQSuFmba(z>cVxJ0n_o&1x&pf58DMWg|4PT
zTnwnlIt&B?Gx@AB3U+6ny4sOc9Grh_kd1ZOu1sfRS{i
zzx0DY_=7*Xy?YmPk}*_^Ls@3Ta-y7$4HbA+Dv9Xp*DhKGIl8Jg*wMY~K~6*99i3j}
zrND@)p4F+KYbq^A&UIag)Xw3FL-4^ZyirukbwCRl9H+OY^Hv57UpvBP6FEHZ>&VXQ9*Rk$Z?Bm_HY}#DQdl
zn-}T+77@ADC4pyZ(`28RVO8LM7;KeQgWp|3j=;9Zp-jCfn*DrQ=m=pmK#btl
zp<5sJ{9omk;ltdIp}bSEp12<{6%|
zsi&Otqnoc|lwgt!%@)5vvBqz*4LZyVAIqHLVd73gcX}egB@-
zc4tRgEj+aW_SVUrfJUUed@^ciXHKhG`PXEMUVO1iAl_XF%I<3jDh13cabEdm7}*3Q
zfXwJJ{6j$df_)u;>dwe(O$W!%3b{N;u8o=qrt^hPnZdnq}S!)*!c;5{YqSqN8MlduKjpCKEFObzwXDb`|IQDkFTHa
z`{U=wr_Ya%pB~?Qdc3~wPoM6eKHcy4y5H-5->;9l-xcq`4h?3LO2g5l=5h&aD>hNv
zRYZi1pkH3D2<%-*Hhb4T@w0nNu`KK0g9}d?dqAhYU3fB??b{xZA&rn)W>w!GySsyq
zdd-tk_&{kwzL{#bOc!MHY>~2}nLa{yuCbjG-=R6rB
zbkB;Fh}3_z5d$K?mOc=H$XuaS?I1J~3`9hgpk<0u(GMI;azKetHNB)0zxMqFb4
zG9z1?BRF98Noe|a@UU!?^iJPe)jLT^{{k}#J}qveVbds909DuC9dFw2F$n0H!ry#&
zm4E6=O=l&^9klA<;Wk7P&J0IQ0=g+@q>5g9&-va2s0cv4=bt|W9`XF|?3M<63>->V;MUFSHNNK)1oiikmnNM%EKe~d?PNv^={
zx~Vi7&^oCaaKPuBM)&)Vu1=?&3a|o~-Bne4m#&^_3QbLtqMiKnL<>g5Q!|*pI8}RS
zqQHC@oZ<1|Ml&;^Zn4c5F8?@>9nVzvxXwZn+$!~r3(tPE7_yFF_r_zbi$j_C;ljgR
z$XHlp6e(#n$+v+NTXfVSmK^jC#bcYZdsbE)Ae)GXV);ef!>vu&VV?q
z=)#Pkb(}%Hfu#BsGwmQFsKH$829VuBUh4=a>cG%+{xWcqxr@
zyf=X8YAwVYotQGQz(yXQX9R)npNo*Og_3n|OJh>}vW-x{@<+
zjbT%md1Zjz*Y&a=ynn7=|J|Set-t);+O-y@-kjSzg}&18RKX5v{w}&2ZGs9XJMn^6^B+k3WelSc*0YQU=)(!(iu4y&v`5gjGar9abQ
z?#u(ClDwmh+(e>ROq&
z@VM{wa;qU$Bwg<6>sn}E7B;*;sSYkg2J+-ES$F8kbgN+-E9CBxxs>j9cU(&%{X!Y;hK;r+XOeXz-|Kk}!)
zhrj>(zy2TpAO5Q!|M;t){@L&D$Af2BP8}_eK_L)!Rz-)04QcBmg;7bP-SYD_X~}f$
z)!c`Va5qLeU;0!FK3%yq%|#-SCR(Qcw{4kwse}#ob3(eDbVbAru}s4P)i>%qi&7SG
zPK$j+48+Q%wez00bYP>wpOQf{0&VS&GvT#T9(Ib|vS944p#Y+#hE>I$YiuAir0a5il5I*{@RuPh3Mre@fXd7)>@6d}^GG{$_jCzqmV-s09GT7nl(#~DW<
zTsRwF8T+4sVJCJ0B4BX+}xpU+$0LkIW}wa*av?njw#~7c)bX#2Sa4AI@i(&bRaAOz$BW%A*y!m7S6c*J5*|4A%rM27aCX&XhVky~BB)2RWXVmLidSZc&TcqT&HvDkIr
z`@Y^^5uwYgsinCHDvS_zSTGS{52T2Y{5Tki+wCO)vXM&_x1a}R)mgY-+s1Y7-s_dR
zfK9u&CqkmvsX%c&Y;Q
zi$JH)r(P`*)7tESh9{IWq@>HT;Wa7o1=-DOEwW==NgZ%H#N$4{3)OiyN?rD!P~k|?
zw1To#vCisx`yKR^>*Q@VBCmB@naSdjVrZO6BdWC15i;T$ekEKm`*Bj51oE*TgxCf1
zWcq(2zv3tg!iNUA#`)84SdbR(E=;>2fYhjxyhs|1sI`OPo07&H()}2x$WW2l<=;-Mxv4sp>eKlEXfBMcP-TduijKuxtGgw}ZJ$9r
z4=K>yYb|!0a@AU*XLix+<`8fpJxsQ&K1C=x{+qUuKPzHgLI0UhkTwL2=dKs!AQ2*y
zWA#A{cB`A+>soCf9srs(>N2pq9$F)Ixz#Y~vAu~qT|!{0c%D==kSF~vMj`GisY^wT
zWccqan&?8Vr8}?AX?j)<&&ZmHT&vD@aye0x!Da_-JHQDsYh4_e5h0F{*L8jM&F3%P
zufP3o{n;-*;L|6rD`Fhbo>0#$1xCGwoJORvM7U{*<#YBJ14}ShHFP$
zp^*mRv&iYWc(&6L;wEboTKxi0bD%*rW3OvcxClm$yct}VsyYDd0)xX`BQo+rJy6|H
zq8$GxlGlZr%%{(viAeO;5KZ5%b63D2#=B&i>
z0*Jg)>q!TCnSLO~9HktXgh9%lK+y$c-d<9@Av^s_1e-?1(zUW5r4pqdBq7i0
zUA-Us)90;bc~!l>*6s>o@7~qOg=VuKyKdL@;r*3yUzzVd+}^!h#H}h`UanYin0d0h
z7%PvI9f4i;L?~s~QR(R4=87g(WTQ#0wYqxcLO{y-%%vB}$)HtRN$NChFjS+*y9Vt>
z1cI|KB$08izLv%{4gu8~!DFL!nKikC(S^i8%tTL=-T;2?UK#TDOaFD{lOhlLnz#JRb2YsqlJ@TZ&lLYK*60;)j
zwbIEK1Dsq>b{}j-Q3XEcFbSa(B8#SkMyy7LXNt$8zu7LoCCrg}%i$C5!wr2Ch@ghD
zgrpA!h`2zgULABmz>SXNioj__V*mbqZ)>xFAJfiX%Wm8?>{>?b5B=9}a&f#HhZSA2c(poO7U95W%junIMAcL1hI{dX-XY0Rrj5
zOk8426L|Owk6=YlxiT5kkra(}tz6h$;RiTBuzK#aAC+QYL_l+eA&*F3ZU33bsaHfN
zB60=XmHGio@BXQF3Upqgl?zV5K2V0a
zCSw)LrPOg(T;vNOOByW)jnTorO^M2Oc(xUT#bE>vUl?R)k6if5nAOvKLe+ByNrTvr
z2i7HJmx^m0eVI1-LDwcSSa{sKuUsp;7*Yk(+cnp<{9%-SB5I2!zX1jKMQ+qI8cEEoZ>|{IMN6SnxK4R#pDLYG2GCNt>3F*Zp}yNB
zC#ZtGu8a%~C3-9^4}uEK+3wA`RLCF#SB|q00dOsY9gwKz0wZ%JqN~~sk(`?}lMbd}
z=fR|&fAWuhfW>cBRtnmiz$`+)Xv7RkNtWMP6%F)pe7lJVgUo
zJFO>_dgI)Wjl^U3=g*H%pFZCoeSfX{qd(tk@A~{{KWgts+erYamBI|%uJ!V=-re$c
zTOaQG<=yq+L%n-Z6TRQRdm-B<@R?m)nKJJ3rITbPgKY!(mI*m+Ej4R4-8wsORzV>m
zw#qiwr<$i@WFmFO6b#0zDY2{7EUHJ5%xg&-F9#ggAG6g{9P8G&nlw|0s$MH4|GZrg
zsJ5CWkeRi6uXSCxZt;3&5np|*pZ%$K|KRt3-)IE_!)<0MF1-$iv<
zWfmE$*ou9a87OLxNBCogwZ
zpq3dV;0#Wat;v?eX^*$1qBGe{WUI2pR2L+Dt%wYE=SorS2t=lOp(G<#_Yq+-LM|aH
z2-mDLNxAsAlt0LnbJbms5Y=%K24_|m8`-LnMb}-KGZ*di=FcIqq1qHr
z{-QORqDisp7P;TulEC|)*DR6NIkYUa{ZXY{YEIp*I3ALHv*%jz%ze{XO*g`+hM75h
zqxxj&>@h7rHxHHv(-h1JiohEBUN#}h(wqYiYaUhxl5t+ulY@icADvIHI-&L`kx%!ec2tNVW~#CeZ^eA#u1XHtODg4dMBp&DUj5
zVSpibd=Nz5IHn^qsvcc;t;l>Z)HG-?dR&nSW{|tR&dq#d2lgg@1meIsny`u@v)(
zPP{n;;MipPS6(ylF3I~cT|4D;!p8k%Is7X=(t*-_UmD#5XRVKb0rsOO{XtA^OfxF4
zNJKTYxBh9K7I4KMaK9SIT^ECyUAq+f3liA?Qf
ze~fXC;wm92NCcT$&eJF{;cI26sgP-Xu5kVtxgj$V)CtK5Mudz5V?vuNd;my&l3)yf
zs5p{S42vqRNdbhoU~uRfZJ5M_0|OUd%ZRXMkFpHpgh&O?Yt}7T2t-UHTX##x=Zt?a
zGP^o+ML?@0)CFpnplJZ#^wvFeOJ}aV)y`u2{H~XVj3L1Nctm98k`8chOHGD<(X-L+
zkk&Y+Ub;dCEIUVpweTRWb!k;=W(G!Qo|&+3eE{pq7E!OVOI$NG9`i&A2iDE6XawX*
ztHs@#GGFT^7#Ry*KCjD&I53NL2AaafzZ!V@!Z3&iSDwhHijNDiVllQ_yi>lfVcT?{
z6!PM_-c?mJf9p4X@lXHK%l-bCn=~J5>hGh$)~{9%xzW~cZ+8Q*1Do9
z_-J`m=v_PdB>3=t5s4mktWYQLcmiQEvAT#E9tekV2e4LDp^7;}d`<_=kSh{Vc72Up
zVK)T{&$N;$T}_dc32H{fmHXa4OVBJLb-y)$P$z8-7z?XKNYWgFMp6@+r&`P4t#(Id
zu0XSkxzd97n3Th@8~*>JHrh4`oVJG82|zMV;k{xk5oL3coyBxykLz#7JjU})!dpYJ
zR&d%MJ;i%4c>Z{~_v
zQIDRCmAUBs$#Abm_$*AcYteJ}wpe)u)|F9DC#{oQBC~d(8!K|fezZ#B{kr$=d)3E}
zuit!g|N86ur_cM-$NKcCK7P92?|a{OvG=_Qu9Z#Hmg3hAM(;knyno3LA8zkI+`j#-
z{hjaJy7_WzFm9Iz5wz{2v=s5E*>~mTb$`GUn$J7+6*yWRLG7pVbl9lf;>9&z-IJ3|
zH<%n0Ii$H2ne75g?vmXr13;G@;{j$Qh+WkNx(kDJUCBg{EOOBxsH;1$ckHXLE3f2Q
zsA3hn>wob3zy2Toum7|E{J;Ds-~HY%8^jnEhq=pPRmYXU@Hgg)=n4SxX?Okz+D)A-
zmM1sDNz3m^%Rb<*>c~`G1B0{U(m{J3vs%-V7Dlh*xo&}&Usv_R-eIXh600kg9DSZ43kprz4{NV;XD*+jIx<}kFb*I&;;8G1c4HFS`&TRS30
z4>5Y31|Z`>P=$V2+zyOGcuvSR#C{UH?i5W(ZGtEl2f@;=us3El&q-Z<4#X8HSHv!K
zAabNt6b@F~ssP3qFe)>Se{zmX0n-;V-V`*k)?#n}%62eUInM4xbS!^fpsI@%^9fx7
z_&Y^;(2o&l8ZX8^f!=hl4SaO$|Kl6lphB}<`U9ATmtf>fA%}y*S#xXR*5o7Yryac?l
zLfIzQ2%QlC()XP@+F-ABU2B~pMb#;aP_2K8B!Zs}io~z$On5llw%-V{Qom%WJ4GGWmEwtsxWw`6yQ6vM5
zXe~-E4_rw`m@8_g@3eF)BdZHunwZ(qRci^d69L;l0U}n(?%KIlWLHP5$v_1M6Pzb$jjj%LLvtz91df$<;t}%~
z{>K4Y&ZjC(KF^0CZUe4xI-%zipW+pB?-*M%%sipBdP-u5+sn&WUw-=jw_kqmumAZg
z@oD4bHkE1&=j(UpWIBxt-y1#1A$!ab)b15=SQSY@a;_abW~?h28F9TV04!j^4JF&q
zIfzSR>a{58cL1|MOutmpgr{L0pquI;LH+INo~z+=ICY#)o^Gqo*)He&Ow^up+i~5N
zVy_aZl3>6UQb=+?XGtN@6UT`z*=c68yN-AdYehsby0#5O9o%UBGXNG-g9Z*)VG`Oy
zEQVjIqDh$3j6k>u#H8XFvsGnHeFF
zF>NduKfka;phlH6W(ImLg``H269{B16XDvd17cl4IxDTUMAbtJ7?zf^mc#^Iws_O|
z7p)Luu2iMnU8WJk`$6=YvYXYtcR%+2^y%^Sr`NB(dj0yF{o^0Me)-2Azxn#{D0%kK
z(1k&wdPinr(d*j#dRd=8zkZ2+_kO+qaQp7}9{2mZ`*-@=U%Yh3yO-N|h$
z@BZrl<-huWfAh`9m)pDh=LcrI$x2$;5roY`IMj^C@PtOS;vxe?RmBpQ=?#W{!P5d7
zNZUY!76lc7Bh!-pNed)Z(+L8!>QY9U6Cg0flCoi-gX)UR*LUm87#{NJ$za!;Oak9%{jeGOb-Hg$
zK{x|}O3+g_b}J1bJku;I9<>=y`alHH;UyV(<`%!7$Xp?&gzh=#IK#uPq>z;CC@*q(
zEL`;}d`u1)qsn->wql|)pP8UN$dVa&<54n@dOqUhK5(ry%2vc!0jrO6a0PsoRoQFy
zIZQI>69^|Dw2}Z3U0WbZc+c%C4}zH`cR3~NZGEux6R2*Bv*5!jTzRUwC;DGw{t`hj
zClixw`^$LbP5;o^JyRx!_q0$sNG4bv8a@F6UInt&b3WE2NQ9Ge7eY$R`X@U-CpVJqu_#s)>QyRi2t#E$N?j=*_#h}b;4oB0Sg$yM~*)^
zDttXvguQ0nvFvqSk8(v&j&k`+Kk?yA`0XRFClo$%8Fjb<;kIrYI@L>F0_
zPmy;NuvW??*rJ6P0)Z@ZH;e#BPcvns6Jt@2D-yt^XCVd%Lr540oZ%|{j66h%837&Q
zNn9i608HZ(KwsBQhjv%9%V%_HcT1#)*8Ek(w@znFvmn|CH1;hXB^531Cc#>lnFE0q
z*KYbDiJ)7CrloP>W+Z@QSFR+Jt#-#&j8j#u|1+$kAXR2#4l5C3G9}%OTZCa2At1*{
z)g;~Ix~>4G?j_}wqB$%cstBOnEj&jN9>bWS%?1O^Oih$w0;;vyRusE7iaAdau?v@W
z`gL_X78fgGHJH%g@eo$+aVepw$S6%-t;K!PQh5$UQ$4rwQ&qxUdXGpLyJ|E)
z9P#K5h*lA*{pmnGmJ&!a+?p!%8s0?Y$B*~F{Fi>_cYf#R*nJJVJz}$Gx>o86*Tbeu
zbi{$kg)Z|my6$qLip&Lev+li?L?Tf=2p|=O;NHhj3BW*h>2DP?TZ$d?K5D2`0q82m
zLc;4wLIUF}$e6B^1FKq{Zt`sA^H>_$47dV-btTC1F>$`p2u-AG)BPyQ?Bq!5BIJ3y
zspW+FgLrp;RWhSC_`XSVJ+IdFQ!bN<@qm3KucP
zOc}A3M)|Qf*VRjVJ2Yvczw8NN0DL^`S-Ky4-PVf4E=1Ip0L)PB$T$3XC&!aSGq0>-
zN3WEoH}<2edJ~^M-CtiH-+c4=kH32T!#{le@gIHu@sB^*MkG^!4XYKlONg@BO#G)sOct?@9GqFWQY~#VVF6Lqb%9
z$)?)k6J3`^q)q88`a_059wWoWYObyd41+n0noiDIS(^gWLIaBA3sG!O?gV6a6yBFx
z5w{#bBThv|J0zocT^Gq}NmD^Aus3SqdXH;GBzDKg&-mg)|Nig)mH+U6^N;`O
zKmF04_>;eQ|NK!d9GU=Q$xv1&LG~5$AY_{uRCbmKW@KiFkQU&`gP*MF&@G~6t$}n4
zRKQGs>3CSX!0`ETc7K!XH05L8rihT2yE@pBf$Fm#!Q{g9^Mno*+U2mE(@>g#$QAM>
zK|^mm2h8DFf*anrW21U)8t^22fM?d27D%_gh)O2UCeoTjhuf|
zc#6^!bP1qz-k6B4F0_Pc#vUZRK#o%@bAFfEqmw~Mz9}Xo?&&75)DntQ3>yD~6xwef
zxFXF6W~9mTC;#WCHS?4)7-zn`5~|h-Vw_YXGR7C9;Zr0hePtJ&vv6^u#`?)F77GSi
zVQZy>*`
zYxOPy)fHYzi^CG8$4wqA8^3y9CZ{flW=qzmMrBNv&rC3?tEy=C
z3ijZosap^sAES_zJH4ed&RgL)cg_0{UxQTS)QtD^=k#J!qmBdI?4HnCFP{ddT|saF
zGb}%qZqFbGrNOs*4k8GNxRxe-#1qro_Dr}rKKV50T6E|g#wzZry|jl?&k75pu+r_y
zl?23bh+#0U4hFmfgIykowR*0KJ=^2@+&ec8eIqRF7cE_lKp%CZuH`Y#(GeX|fW(ZL
zCUm*N6KYu|8<=M_DUgsA1$C{;ZB8rytB-sxM37xL=O+ZhIwFe9H_
ziHZYIHY)O@kS;WeP|QN
zwSb5%=Tg(gBD#9Tf?GI#@Q1t5OVAr2rXSs2%w&C$;+jRgE$))Wal!JY?}n@eWA6=%
zW3?3PUz6Wx{=SG@0lNxkb8}Dc$?5w|fK&_>uc3-D5Qxl`WKHZ6Xg|(G
z-Br2lR=1XG51sN{OVKc=CK>OjM6q^X8Ef6h4SGn!b8c{_Vnxodomv=As`yIe<|Ms8yxu4G0&yVXG8$A8oxjysm6je`U
z_WbQLV4yq|D^hg&@TTmDBBRX9>U6F2UKv#yZjHvdJDhY6xzyq*5mJ#E&oZVxm8g&q
zZ(163=tvbyXxJrXnAD(XY*$u#<=vF_NmhHcsR6+A!_CYG1G%oVvthd32qgAn3&0xY
zPrE>*)!rQlEzisqwX0JqE1tc(ZV-j;xAYpZ#x%IgpGg5bh~CaRE8@DADOa+jv&pn3
zBA|;P>4;u&S|~6uUOk#tE6Eg^X|I;rnO0szEFiB?Uw6V_tShRm>6D*C%Rp|DVa_Sj
z;HwrCb9GmvdEJ(Eh6n~~w-kvtHx|N2$#twG{PO;XfAsp_{mYNv{N(fQb*&G3@6R7Uee?AgAj;
znj;3)FVVpI{4ncM;P))0^i$UcQ-|SFo~qr@RB}00Y)^l+rA~CaWE4-r8<`PVyJDt(
z6;0Ls(<)PT$6EHY3`xgrUx$P233##>L8<$gqq7UcAVPJBu(8U~2(1(EnRdtsASqk8
zi1AngTz5*kB970qmwN0fc*FZ9NPARyd!Yk)D|J0h*shV(Vo;f!JX5@9CI!}
zGo|R`V&GC(Y=J#M3~(9kKpGgR!v?eg+g{f0ysc%&f&i&87IQQQa*Oj5QDGGiou{Hb
zf$7A}c__Nh4K-|ilJ!&@VxnZ2B;Nsx!epr9nthrJqCRFA3bf2=I>cFJ{4yxk^{fhi
z<%qGh(jgIS?ehkwPb|hJ;tDpqwqM3nB_^iE;$i5?dCk(RM@a^mxf+|@5xH{dW#vjV
ztZ$bp0j{U1s(u^<8D~30A$ZHB6!zj4>7a>>C(UaynC9R^EnX(CY`U$kEXzEBB1QKU-D9(3A8(B4@D!=&pdv)J$`O49XT?zGzc)`nxo6MTSl$D{?J$
z6gl$RG+a;3Kvb>k3d3sAdl%nO#p|BA;sA08^yf*?`s-1FEa*HkqD)-N{$pW{iDAAlX!;M`X+5V2MQ1p%*EzicXlt6Yy
zgO`AKDu%lPA8B;B+tlTt-^J*N#fCa}j(x)eQjN-xybzh_T{|-E(iL3{$<%<_6)B#(
zFfJxgc{8iDsb4ai3vk9*T?fvUMl`q_$)aix+Dp)eGOFFyN=mSoAi4KmYr&@60R*Su
zKK)gx-V_u8q=*cg5+%$yc>e`VWt%;*Dvb6^G2phPk!kx^e&AM&0t!OrLIgMC|2xw2;d_j?a0L6w_%+Ek?%B{IQ87PUe
z4Ro$sDq2l=N0Ygt9Sp;1lPbD2`>tUh5>Z?FSnges^jaR0jZkD;&*zT-SdTk%turEF
zI@}|L_L32Fvs-VuWu@It`YRdHbs)G{e6Vqnh<=?q*r6RiftA^H1}~MIRO$rjg`BRk
zW5qC?B!e?Clw{Gh^ax@Vn>5OMyK--K%Q!Cv@If7qp~eAZu|mtt$j77Cl8uw%1W2+f
zFE46#Z5KpD?w`)hsk&FfcRfBx#L`@i~^pa1X=K7RVd+wEJt_fLNO
zlOO-#55N5K$KQPO)#Lu!b!X^2iw3%7yo=0;>$+|c*Ee5(b6wXL-+KS;?|k_7_rCR=
z@4SnM`~CClYkl{d*KdFK{TE-neDST9_wO!QH@)00Y{ZSy_{DQWqX72;84LSSogEpq
zy)LnKN80vwKPuPSk4HzZm;t{uNh&$$t_tLJg-}H@BMmXjI~7=hU*73pqM6-~d#`l`
ztnMZqcH|S6@udD6v91t5t2w%k*qeLDyBFMUk*_4;MQSlh9d}Fw`?$$6LG|R8$PQl}V@%7S@3y6#2t7rn6s=9m8>@
zXE#RBTC^FQ+0?K(4lg+5I
z0V5(L+Cq-nUE-Zq&T^XLbBs{9E9hQ~ie~t
z2kYe?!!DHJUPNSGv#L-a#6CTv7$4n){(3~jVs$51BI7FV?q-?~CEzgvAdwkaqz(bW
zjCI~SM?MlxbE2nHO)_5ttsk?41k9i7%`}LPM8@*etL5%$IYAIX%}D}eg=zGz`V83h
zEkjgPa;$Zx&NSQPK;R`xu~1F^ckrG&=gzN)?q+c+O!_9N
zHXRzpM_QO!2hSE)?KpNA6VEuPSeX*lleE&c0aM7RT%VhJ>Cjv7IrsHtt*YAlAdCyVm5j%JG-w~J7GdV`8?u9m
zj8UBC^gTjBJVybi!IBKLRV9w3ri3hxa4j#QNw@jZ5gYqc1XRP4r_Ut`|C{P`Ud3pk
zy?KS|$sa2z0P^RuLb5aECJ6r`1tFig6QmLJwlG~Ss32VC4+D{zM6>o|_qEov!r)US
z`Yo5Ta%<9M%s&{aa8yl+4RMZ?fVS(gZtvE0)!zDbdsn1_ryEw@r}U&eO*8j=37kg{
zhcJx4KS?O38jM83<1wRs7R%16ZM%6zHHD9*>LJbz)G^iqp3WN3#d3uV?H-N*RYk>LRj5Yx%z{}!L}+aS&ip6yQbmL7y3oA8KK}f#{rqqK#?Mx1
z9johMK|Rc2b6!_Ssmc{GJ|BA3NXjiq#SeyyC2`()#B($nW^s*G#70eZ_pk9Cf-Gyr
zTHtY!$-%D0bwv|yVDgmwvG48UAgBA&Jqfn~tD7vLTyf+a{3mQC|1~?4$EnGcM&*lb
zj9b;aIx~}rS!I#Pyyf1Fh_zxrdY8I}%_^0>lno`TiUG1qbn%Etup}*wULw&St={Z%
zn{qZ$8CPd$_;aft!yqid9kxQDMkl1YdiQn7m$+-2!|GY*1E`MW)|#lW`lza&{@5Z-
zs;i4uQ=8xG;#!HwCZZ{+Rg7nfy5Fa#rP89h5^-ItI^_S6D`kqN%onn9EN0pVOQOIo
zw>{Qcp*L>F0pGqzo0uvhRdpu#u)^Z;sBV0I-5)=`e)aY1Pk!?F!$0`+hd=sw-}&zL
z;me{`S{)M
zeCwxv=G));&aJ<^fBfe4JD*;^_uVh%8iSLZq=6d^TDIW~swpDGsFHLPo~>3!yU-R{~be6>B6pxGJY
zuu<$>80@!c)%_a=L9{*B-MrQiK)zw*EO-~N|B_?e%(
zu9wGto%@dr&u(Sr4EtG&1aGvCu9{Ol0W(#*!W4FqAXc83X5zHn=`_P978DUSbE4Ob
z9f_mEyZae%WgDS|le2#kp2V5TQzEJ&Lc3X1lVY;|Y$tYIe@z`VW-Ze&`@TL
zz=M(U855oF#!U`B@*VZm459x`^*zMG%&c!=l6J1_=bq$eo);-VN%atzzk9Bw@q`qD
z?Xv-DPOvL-t<`KixgJUKEz4vEf$Cmstz1=IRhd?!0G5_kZ|2IpJOVlt_TUoZtJ0b-#QD{9VuEz{6;`gf@6p|B$x9aAo~Z_CyPQgy#Kw||
zj+(U2f{2JE06mqu1A`-rw!~_&m1;y}BC3n*l}jSD0#zi4$drWXvRGn)!D3!ku875n
zNWwgvsQtN{PN9DOqjl2Njp+j$G+X=8KvHHWs&f3)d{{Z64N^*9rLmdxH}+S8vf5j;
zahu07^$Tr1$;eo4=5&k6kTg_d_$wBjkE9FXP-{l52u&r)vdHU+2?Pg9b~k(FWwS~$
z6^U5ZAN6UG|4^tW5z@35L0gYSulkFt6OlxVGFc+upzfh
z-Cf1XaMn4qo>clBdStLA-!*KM)6A9it$QFc&2
zDuPs5NW+B|LV4O4rAe;HLY*`oh0c)r{pCZF*pEu>5Du(s?X9gI
zBA_wsAi5}vX?=JVj`g{AHIk13!$WuZ#Uq?TT&S}`i=1^e`{RM}eUJT%h5YVbAE
zn;<&0D^mLPwUP`av*npgoo5eFkjw=ZcDI!C?YnLtvfa1>aYV=@JS8Mws8;da0Jd4K
z%+#ta*eHnCx&(h+JGENnGNZ=IxZfK<7jwnlRfYZNkKeq0`StzFFYiD6mmmM=55H;N
za=rYEfA+(F@=yLhKmOw%vOlfl%e#eG$T5}>lZuYm*SnYNS_-IShf#G#`~Tb5Uw-xN
z?|#^i&xmNTeF0hiX5^?}1`%Z-T(3IyK(k$$k}ax+a@7R)Gu?@$P_-kE(5Dz6YMlYA
zH&CL&8Cci#JpV3ZWWCV_QX0KhTWMJl4Y!@dlSX&vr7}y;Hb>Lg#a0Fx01cD_-b
z3MeJ5y!5MO#T{eak=ACHz;s%=ne15t@BL@3DpTEs2<)zu5XmbZ^(Uq12_ROk>aK%3
zI}8;uO*7XvIu#*_$8>LOM&PzT_48C*mU`3TqxH#o9yP#jSo&RIqmUGKB3+~#@TQ_93vcb!gnT!VYkqZ;5zVD?
z%f01LTLh7jWluN{ekj#C?>i}LZef9OtyR?~SzK*|R(pkYHL8V_sEw}&)({cW(*-5`
z$x$vwKy`zALFy(EatP~{S=um#&Rl9ysytiQt+mR6R{hDnl>@xgY#_R-I4vZ1h~k_@
zmr!6WYo7f`-K&R>afz!s=a>LN$3uGB+Fwcaiyo^0&XIBmCuVn7y~2i(B)O37gG4kO
zjA>M8KTyszbhx$$kV~vYhawV#z={Pe9Sp2oPeHy5CfA{fFzwz@cWY)($fwdoFEF)g
zOOYg0ZAdEUZz?T4Q&VI98AZtVluL5mK#Zs%-L2IF>x{T!R)d7L@n&|jYinP#7sM_N
zf6o(FEfE=^G8Nq|u7x5g=l+VQX!j?8MoR=@c}NDZ_XcpS3t~n?T*6=^1*s6ySb@k$
zE>TUsY1g`~X^~@!)-c7Vixu{ez)Ur?i`K}DPPb(V@vMlLUXyesv$z57sHmVC0gN0$
zPiWMT1lyw&&u)^xn85B~%RmKgk%iJjn5T>hkv`;aDjRq6nJc?!Udo$6xYnh#;5p4i
z+V%iy)d#$uG2GJ~SGqt~ue^}aaE*Bk&qRs!lp=Hi&LPEpY{R2}`pWJ=`CmM90ft{l
zd2vk$20U5n`F{O(44b9Lm8UNk0dO?x4J_A4kwCLsqg*+%m#|rJ0?f#s=mFn=j6izQ
zwGmoY6frDP%9DljL_gUpQUy8iITU;p3--~HXc@+;63m~>Q=^iHmt$fAQ5
zV;qHiuHlgVm)&vCBRmq*XDQB3DLM53BoH~97te{|)c0=I1`EQHiW6OpbctBI;{u7=
zlwV>59`}mCx>i>K^gpJ5LlcDM7+sE@no?f37*ZqD+*>zeI1IAyR{wD6vgC^HmhY=1
zLkb(4t)ao*+|_&Us(w8BQP}rKv8%{J6&tAC)twpF%7|E3UK!VQU01yHx;^rC%LuGX
z?1mU#m7SETlVx*e_i!>Lk;{nM>PbfJN;l0w`F4!F(-tqKXCiKtB8ob6
zIubXCkjR{fj@DHO4Py}3wE$F?%*`LWzWMs|SKsU}fAaX@55M_WKl=D*&!zyEOEUcTM+y7%Y%{hM8%>+woHx_4@5ecjf2ce{O9*B9^JefxHMce~yJ
z@5rdljz;mTKmPjDS06w9+)w}X&wuaT%k{^PPu;yYkypm6pz8bg*SfSy%;S5RVO>C3
z53H&)BCgvNfE>bfJ)5lV(5W7+L`;_;Eu5L@i;V6usB9xQZ4onpmLXR&Hr85KUiv|F
zSz`5F1i-Gwx~1BZm(#-Z5W$UZ=>gnu)0%FthgCsy7^|FoW+9^~HUT3y?!>qVkK;`TlNMdt
zO`zZon+-EGb0!|;bdcDcS5jjRsl!hr*+X%M^To4A>MC16m5K16nm%py!Lm>Z)dmz1
zkSq4MV3`$+NUdz`H!Y6g8ddM(#A22CeTo<{!eVGceN<(+3=i?fTB|{JKpMJeK)xi%
zllBpCpVN?A-(O(T0V9LE{oTUp-djMRl3)kcJTZTPA*7_dQzmK`JWWJs?V7%3)4zEz
zuD}{xMhE}~%=N}_a7M6ii3#P_H&1{w-Q=c))W*tR?mM|j3qNjBseB5~GvTUB>&yDA
z);#%;r_-W0Aqlale1MEV!+OHZtwdsZN>(Uhn7s>QQ
zD+3Yc#1T|8*;Vo|@|fYKj3a0_<3DguIjeHi3Yd%OG3Rkn0yO^Nn<6FZ8`Nuc-fUm>Qa1DR4|np6fP&(6keCo*$yOu+-H!-&S@o~PvvqVLt=z@nOTAMUNqy#8b(s|`5}{?y9_V-9RS`n4iI9?4YbZou803VV
zqz^L+oZdgy3^(`DQ3	!a!LsUxk6%N}f?5v0{Zc7h!6Fc~s}SswU@&8~Tub)ssqy
zZgrJ#&NnQScW7YDb_tlRp^KevR+J*(wA}{G0Td}RD4G^^TG-RoOjfSNrY6}mvy0h%g0QVoGt{c`+X*D1I4zo`U9wF-
zPCwGjRi*8+x}ci!l0IA!b~qu2obukDpf>$Zjz?D^B|VmxyFmEalxD3{t78e3|yBb$O7t2>#C%$r-C~-@inF}XK
zWkhC!_s8SU{mOU$!k_=5d&gnX0`vYx`g&O1lVhFwc%r-`{{Xb3`3%f1Tm|{29Bx-;
zmu43utkr~oMinCB(u(7@U19W@W{lRMP$Nv23et+%z=Ht;HKiwa@
z_ukyG?^SaFMZMi_>$>7v@$&Ba@L|1we_dC;dw0FOTQ7uW`);?jv^TnOEvbCFc10jp
zvMEjdTPaf})T}n@BS%_h8jQ`Ql_a~kOnk55bhT^8Q{Qy5s-_05jMNb
zMrx~uWW!RCy?nUczWCx>-~Zyn
z&wlvg`!DZ46!Y=vv1{M&{FndYUw!rUH-F+!{_J=;pejHqoUM-t2W5
zzxJR17ytD0r_a~zW!F8C<;7Mi$P~V$II~WsiIur>Rc~`;zJ0h>f+*C<&qqrMSif_&
zTe;*gQ0Z>0YpoTi1d!{d-U|rvhes0=$gZtt8Ws-6-eMHe6^sQ0FU0XC6lTOh9rlY5Xm{@XQb`f)HOeoUMpl)KnHC+U-T@rE^Lgw
zLYhoK;>hGS;d?DW6{ft8togZ`MW7*|6soxf
z-zHftn&?Q4v+2qCLyr%h%N{RHa@}-@UH@UaewD^ve>;|9rRa%v;i$K8>FY)H4q40u
zn@onAr6hu6<@~NVR%Na?bOm%Pv5p71lgY$AiPckk*9GxfDpMd%GzrP2u(~>=%_%w0
zEr8wGZFUBTh-)_6Vuig8rX{7kpo+%OFl~!%OKlaDLnsiS#;xHC+ZSfpPDY5v%a!O^
zgDVpwxPBi|HC0PQXw5VnRAkzdqZ1E)eI>v;}zLCOpA~2#k$H#959Nu=k5D
zFD5VB*pq-4f=Iu0HWN6OUb00Zrg22@zOP
z504R4jk+NN&0TDXfj953b>H>zeg6FT^r^o7W`F*)KYo7PKR@>FmdvjL>eU^UA}NS^(Om
z0Q$m1dBm|I$D{<23+e=pcsoy%N<-z^xw^(GLThk4JZRtn0cKh#({RcoZ1H
zsH)f3`!^pSUw*a!;153j(I0)ju5bVGkH7xU{*(XYn~&f8!ms@4eCaQL{4f6akN&?O
zzx?6e-vHhHKvV`pTvsF_E_tuVqp|O=pI$%z!8hOhiEvnoNJ%kydEG3b^s|h0!4|YWl0t#Te8RS@P``p`)bq=s2Z{)dz7TI<#JK7
z%XXD)Q8WpV07Oc9XzxB~a
zpZ?^}{MhCG_1cX=>QR@wFe3x8Y84>8N#FEFUjfDGj3%K(EP64!r51r^oV%5k7@}g0
ztUAkz2^AUI%h{D35fNjYqyZJ$t@dPMV2n}nBpW$o9Sr>$&~vcap)VcXgR4bPWmo)U
zEiaGtV!7Tj4EJ-@(@3TGmPw<9x@8TQ{)X9{Ab1v1`v>A
zuwf-zYh)nh2}IG2xysz7ev`6B&vtdL&q_cV6QNU@V9@x3gYG6pqMI2($5l37i=Lc{
zoj~>71W7{{(@vH?6cLN1iMcWCpwUg)Y-?oYg6kV3fx^haXu?ZxqGT!yf=CVwTI_Uf
zh8tPA^fgkds^U}!R!<7EU8o)8v>bLcv#3_)YpIO)Cig>}#&usrIk57)LiqWyh*J
zwxF}#q>hnn`^89lmZ{Fjl?i{-y8Zp)?J!@>Scu^usUr$tICUVxa
z7ncoJlk9G9k%4h!lB>gFs)`c|$qaC=DF`ygFtV;AhE$SuP{z
zVsir^qh>MT`GM9Y61EE_xuz}MJ@8n7WQ4P!Nmv^>4A8MibSHmJVnlkGCnBOJ_CxbJ
zW8|7LX7KOL;4YQf1z(kIijQN|tOCYqaCQrClOtta>zY-R>YPec1;_2vGq=H#liCV|Ky!6p&vhf7Pd;?>=YBTmQhwa@$~JRcb-1t)6;R}TDW<1+?=AS2*+WbUszW?G};tefx_&d3eLJP2b7`!yF*7Scn$Z8Kpe+N
zP3KuYFPHCdHz4BX=A>qnj~yhWKj(XWdj<7_$YIXaesF?U*`EzuWr{TA74KG
zbOMim^rKJzw}10L#if4Xum0?(uYdT1Kly{#FMfzvBl9>82Cxuuta%ZOSgR1ZLQ^4{
zqa266=DdCO>7RZ2@ps;O`-6Ai{;Bsq`02NvzH=Az{_gzh+2vd3`ohos^ame2dHwS4
zbmZg5$IU73@AKxkK@3*qY3xs{@o!@bv``&^Ubka>i5`7+0lj!oo{$8XfGUqoO{
z%uCfx-kfkc;(Q@97VAI!)t~;mf9tROqksBuKmU`Tl_`c%Q7y?;u4F~O^$Zv$qz#84
zi;b#TQ(a%!@e|@MTYKQ3F08C3Qf5}W0#`rPswHWpNlB%FuJ92Uap>PE2*BNujb~zL
zP*`QQH_dp>My6aCEzDM{Ky$jaN)`r-hL4*;V2Mr*UGAmTubx2i_|KJe45A8c%oF<`
zYifN7AwfJ*7&vB?tYn3D5+bgHbFGoX@mR?%^JuT&Rm+`&2z8ZP$f_=a>)5i@v;5eo
z9E67W8dnm^n`?2)*oTZ;%Y>tb20feVIb>t#@P<%BcqcLw^N48k(jv3D1BZw(QV}cD
zRNXF+R9#4;9>yj5{P@3)!)$T@T!J2@VZpLfeKRbz@&aiyPfI$Uw2y5`z!}
z>Qd{cqk%TOmz8cxOLpvqq3HY`vi90z%sVs-O38GssmN2_h5{hSsR;%LlMKD1Sv;M_yewq8NDpB)7s=`+bQ7XMskM6a
z8z36aCG30O!2p1UR7wNRuJzL7ycPLX#8SejEMag4akLZoK&Tp>DyM%bVst<&k9
zySl=Mjwh>DE%O{k_ZGWwmvFY@OU(yuEXk{n!za3(G	oFn21Z{lonn=T>OCkGO#wdM}*8)t5u%h-jOEk+xkoxE9
z9GY6|w{HH^Jdbam3;MoEbOfHY0^#*0(QWS7`OH5{fknO6Yb*=-K+rRPI=aQuxe1HF
zUC>%7EHMjLwRk%-uhFaB&t*5#8fKkT!z|s`mbehGw$xA(01E7wLkzD9kx)fP&{ClQ
zKn<7bo)SB>B6DaCS*mJ9mdG5Zv5J?ue(4uK_t(DkPOTaTb|rw$qy3+*0K321As|c&
z_qp|HM=wU&g)ag!lI?5Q)M;$lT9u@uW(5UtKybkdAUl@nj7g#34{5GcZ9ue%+5;h$
z5E$9alkYgtCWr?6%9joFXlrPxF0)*T>4$MS#62YOd%zjk>+O@_=iXM~@#6LzlblZ+dvw2z*
zrHCfAGuzR5RcYns(C`I%vU}B>INcl!%83m!`*69aRjausgUF!;MKvc7(7K2mQQF-m
zZ`IW<2<>cFB}cBog^Ci&8RO6q=domFv1nblF@Z8_ErM%$VnQyO$LXZ89ZlzwoC~+N
z>*e$F%U74GM?d`Vqu=`9|JP$&e)?xV`^|6un-72V%>Zv6-2jKG(^ZqO8c&EIGQn7D
zQQL?wGm~o}k33F~5?J%{^3@MM{`k+|{`iBR`0-zP_uVfZ|nowpzV{r}{z{j>k>cV9ev{`jp&b4`W?GF7Mp#ZA6gAt$@OmSh^TE}V}
zr9?sj&}jLEn{e3K*&o4DRCD&J0l!}K5FOsp!*wuaS|Q3V*qs&Oz;6BQS|3rhi0OdC
z#$fu1dw&q&j1BeP{EK^9GDVN0Q5G7fRYR3lKy~RDDj+t5+l5O;VuU+R8Cg*VJ3^rb
z!W!1=a*Vs6j$Mv+vNI^Jsv)S{IbAThT$%>GVZ{lgb&6r_Kxa;F`U!~ZE{BG~f2lv#
z$kgY&x1I<*k(s&HVzlo->{fBF{Ak>jnaET+uA)24bP*Q)yA+N$@$um5DjhK;&g`~3
zUClJSQN<{N({C^PVUnidG~TjGD5Y^734QFPLUZXM1l`zb=`DnS+<7wOpvi_^#>4o-
z`a~T|PpsDjrQnEW7bsz~qlzj@#;7JxHbu}ne+0&%Axe)mm!eR%OtNo@K6dV-wGrSI
zS@n%(AQpiUgV4&>$jl`rY^@~7C5}@sN@ux$NTw%Hv_nMMuKQb11=}`qF7$Lpc<2G@
zxJV(;4tR++;ZXCp$^2ZG8Y9=TO99yh9U{F}B;}jBxW+izzYZazLyv3AGEM0xCAJ45
zV|e+tyxZnmREb?QT)8f}YHRP>PCNL|#>&RD%Y^%vmG6qbYL
z7%2}qv7$ObWQ{!N`C4l~dOk`-oE8Ae-bo*(T(TlvSIRvCTLY5&nv)o^g%n{#1z-`@
zE?;YMjEHncG1R)(Z+w8d(zS{+15ImkjNu8W;y5MAwIavJ%+qmmcXv6B@vDFRb8kK6
z-Q5~puKUOB*yJGFtz%IR56=hnPOaN4O|kSXQI4Bx+#v#3viuEccv!1)U}R>DIAWeF
zt~S(&L`~oHRXmQsLO9XVA>Ee3F^+)r0~tNHg9xnR>Bw5-WDLZJb*3olk}YNXJL*1_
zG~^`^CITmL$bK{soEK(b++`Lu
z7{hJtW>y<=N#&s+%<5iZu~2K4_yTPgP(Ug&a~#9!k$$Z{Eo0bWJ|*H6Bq9mhI0LAu
zdIBIW=NcnVH`=wvRW^#qj8zQ=uE`#OkZaVMr3U-FtcV;kmRGAS^0HR3?%vFoujb2F
z^L&YqK6>#xzy0q{dHdGe^*g`wFK^#GfAZwLaSRf3o|R!VAR$yqZ~EDb%DK2?1yn^&
z)~W!;F&;m99Kq)=zW3~tAAbJxU;4?P`VZcH|GihQ?q0rl@$K&*Pha@pc>3bS{gWq;
zp1$+=(P`bxadWbDyl?R_)~vGnCwd4|s#j44AUWrZakv|}d)JQnS)8)L@PvS>Kf-WO
z770bF3Ffi@vt}*(w8~s@Fj%$LIvuCu7|Zr-($Z%Yt9Y~|7@!^3d}snkkU1xKgPR+S
zfmJ-OB{=8J%$Uc4Dm49U^U*!%(HVzb
z#3>tzOVxt6Y6cpV6&zPFF%)21|AXLKmiaU*ZJY3{$-ITR6rwM&RZ?kPTQ
zCw8^FS;1tq_pAx2)K#RMU5J!+ru5`B>Aza!MSL`#jsyN0-hBf8_
z_1im2xTl=K-RhIYt>n8$0%fJ-E_12*c2a!{n0nswhB3yPT8o%nRzouM2KUjYGRh6N>$fT>&CEz-YiMVe%yKgL^Mwsqau
zCixNFSG3A50a$-rmXR1_;#yMXrs+dPU8evb2UzVjvu8gMRdR{*(lvPBfzCrWgweJy
z@{rS#UU3}&0&7ieD__uEvntv;$mRK+HAA7*$Ja?REgj@C0GMIg5j6
z5jX)Jeg_%Br1X}`TKc;Nv{=g%P+(|+MI#waQAIz@Xg*BDg@7@w_(D-mqbk-3b@noQ
zW0kA$+-2#tow)grs4)&$K#T~C7!lCuwm>~605C;pQhkI#%Qyt?d>q9xxvMG(fQmxt
zd|eboGqB|prXs0`2n=m7SE|-^0)vsM<=V(`qMw~gPc*X`0RwvR-0t7PELF2vY~^~X
zV-7(7q_|KHYK=`vRwrHbo4G#DTBY$bm1dsraM`CkK{odr*#S2tY2_HlDm%JlhFQek
zs+6hX-b-}m<&qI=E!hAy^icO#w^RkEzM%L>>wR`IlZTiHra**BM*u*tar1dIf9CJY
zZkd{$B0V6Q<3LS6ZDqL}I=Xv!f|ediu!OXum{87@a8gJT?+j*+EcOzva1N&Vr9Sdo
zD$5YBpi1lt%dExJ6EGXSOs=FqTUt;dAz8E3&VDS!K!#Qd#5l(7o7eAu@buUI`p*dR
zVtCl;Vb1OksynYdktATuWZIG%*|%z!MV^kKnN4gC+wf0`pvVcbD7S`xh_nUcEkl^6CAjpWHovd6|>vOPt?aUOs#E^405CFJGPS
z-rV2cu63@O3P9nx6GUWO&aYobJRgBPJvzPp^vMUGdG~|Qyz}IK~kFxtlR!BS@nWu5NpH<$}jp>&#Z2G~}7LbvCr>lxJnmN)KhJ}iv-4PLa
zoMNq#0%}fxvVO@NRu@OQJf=bjqKe}fO<=Y`Lju74UERK3uV2mcC0^a0fB$R0bN~9g
zj~~DJy{~;4wcdK`-C|rWO9TsypA-@#DjQv!7ztC+(r6Y1jLggZn!$*C`|bB$-@g3w
zzxeVepZ>)!{Lc#oV&1qd~-SBkEwHUT%
z+Swf2y-!mZJ%C!sT&t2R5ekM8sLA7WV%3^cZUqftwULNbHAalIz_`&^jEo}Z>YlF?
zE`}-8Xn3HZ$1Z|}oYS{ygkFJ3x5#M98myQTcQSn2pU1Owl~J
zo_vWUrEO-c)wbiTBcW89bVs2Dvswtb9qruHP(-baVZ@lRSp(Cf)jwIGMfp8odIpFb
z<2Yca+K;V$Si)#x
zQJZ9R07jBT)rO{Y^9Dvg^iZsEh0~dYW?I3f^M(%2
z=mSZb8iG4-Wm9aH#Zgf=Njj2)ue8K82zi1vZ}6gmnzn?3x`I74KTRN5Ix~BG#9PtKVUZO
z`i&G5lo602sh6*+dt#0)JC2ykxFW9y>>LU9I&@^fAbWc#0u7mTJyf$~8e|2brR5Q0
zq?*+R1uDN(1fk=P_^^yxElok(947#?mTqslZ%?x)2Jj|H5gHlA4j$4AsL`SzFhrUrt6U634#C7FY@>=tECLcLmt12T{UwOE>WZMSz;#PH0*
zE>#>=vEfLwdt7TG@^qX8+v&!p47iVO-P?NZIC8nEMpTt7^O1q9jjah_WCYY&sUU(3
zIe-_TB~-HLQXwxwj^SlWLZG^QOLG*XqnTf&&(zYOs*4A(CNgpy{%%EpV-LZ&3#O7;
z17Z#Su4xnWiY%~AvaKNXP<5Btj=f9w2jXj-%H#-}gx2CAhE{!q<|_=@TX4G&V!(6c
zoIM?1Rd)8KfVI@8cz72BWUgAplFiy*%4DU^xoyVO){w>k#OXBVTrNa)M#mt_(V{A~m8E_1$~0Yh@jW_4nI;rR;2{+esyzo7ZCN4KLmQjAluK#9L9Q2_DC6!sZ|*U2N{@)
zIRcq=DQcLrFpgAuLZB8|JWevS44Iuss$|JqUbCPvjT|N-#wq7zk(C&1B6UsP-CbV2
zynFHL&9i6ck3YHn_@g(sZ`NGn?#=nrk6%Ck^u_I~SNG@hT<74bIv3{BR!`WH7trFz
z8F3UASnJJt{o?kcAAR!V$<60~{Bu9~Ge7qJ2TxwToNK
zlvmM-N`>q(W~8mx#Kz``sy$H3-V7djM9EevLJL=FF%!t{GF{nA|Bu?^L%=aIMqDnJ
zd6|*Jw5|9D+S5g+s|s_jVI4Z8m>S2snJ-EH*1*k`lAD?b+oHIV
z^pj7&`@P3+z4e7Bm($DVZ{B(9=E>tcA2^-H&HyNkQ?6ND46p9=pe}5|jaqe#EOO0t
z+#Dq_Z^oLF-XEK%)3Mf4!18dadASlECa4|1(@nX^Ozn1JMfQ~1I1+{BlpHL^ND?SU
zPx-NmL!PM$8YD)D=t-`^WyUz+bc*|XRK@E%JbJ``_@DmDKmMNwOVWlc3^aLWw*l67XmRXQDTFkW*DnggF;r7;6s--hbq1SRv>3RyIZ+OKYU*gefZtgIuGGiqc+CguVN*>SJlE}$cx
zp6?QMl8Jv$4)CtN2LY@L6<1)3jr&xuNT&vakj`v#bW$LnNo6>$Ee|;HARNs@*
z0uL3-n+8xoC@<`hko#yRpirU77?B|aGhm?LcgCt>&4{k5sH)p85V^bb_PT45xQddh#Ri&4o}+aJ@b3R`1~{t`uwG33Lxpq(0Eu_tzQ4CqZ!sK_iuum`vz
zycuxQ!OmRz%ZuGRaX(ieXsJ7zK8#nm>V9Jck*t*?YO2ATUC9v^tQl-auddO=^%!|s
zOGLVa{S?F$R&)8i-7F(%QZ7ns}0ri^(=Qpxj!NAm3<36_9vKKaK+X&mCsb?
zM3ZC11tK!W7$~}+=z^I=O?mbNM|5o~mL$Aj%xD|VWnmGw%&J&rg&-;tQG5S<0H`W?
z%<7}&$doK$k0)@y5%0CqJ|XJ_JWH5sF(kWSt&;XWdJaFy<>00#Cy{LTa{Rgtf}PJ;
zlkiOM7p31y;teu{ASBYGhWpw!%c6mecfrgAapvAaf*y
zry2Zv87(-lCPefJn()I$0#aKwZGbCZ!;+RLDX%Y;k^|ZU4pP1aU5fgnSv?ipn9>@p
z=ydG1ybR3JJy%5Ze^VtK86$J8wTRKYyL+l>{X=VbQpZk#z=ft6R}0z2BL_jTzwX3G
z|5p8tY~3RJ;a#~!0GXqTmdWj;D^e;WH2WHH+?=%RP2yz8JIYM1DOiOG=qaR2PgpcA
z3BDB$)dfY^>BGJb*>lzC>Q^MGIB!_z!e;SmPKtI?hfUz@%4hnoq`T!I=(d3H6e`>U
z!oFDDH4$0}l7J54odP&Jv9
zrZj5GJSGAdr|`XlhZt2g)w0v3zo4$=0G7XNiD+6-n^xlg^pLD#ky&cRor;)~M<&A0
zJVNY$5S+_K=+P{vvc1KRU5;75psZ#sh}J_Ek}*&h-rvpJ+w+STcb`0a^WlfDKK|s*
z36CMt#o9h>_zaLgCD%Oto7M=qB=b@A3Zv$936*WKUq7U=?fZmnTBXS{z|ch
zQ*!i968+V1h3RI`+CoEs{+W(EB11FQs(D`HBvZ5+Bf=vXBrOzIOD_^@)_w6fhCXqQ
zjDnNrZVh>!HaIylGogJUWrxF5VDBp*2#%3!RR;4IBBwy#68)dcK=ycuY7!Z@jxkbBBtg_%nZpCAR-Mo~;Wk9wI1{ZoYHl$i
zASz9#F>Do10}mT^JZR$tYpK7nE9!tMPl+H>p}q)k*5PH;PIQX81S6v+0Up+|t4|^(
zGGvE=-WmdE;Duy={*2^k&FyaY>A`!#P1*8VB1EVJwhl{rU^j;}fY&q=k;e#N&Bb=O
zu^a?0*Mt2M1DP=)TT1;1d+&Aaa;?pLC^SP7U|@kKi;l!HmBw$W2uloYHTS-**v~wg
zJTO`wYUY>4z&Xt3BDmcxXlM0nJsB`mh}Z~lY7-qZR(Lbs`3_CsS2LWhetySnvhEl(J
z1hlsh7(2&mtG}#+lj~bC%;Mg!M-Hr_;a+>ukmP%Hu7gc7F-CSoED=J~-T0F?b
zJh_`Dl1r2pe3ADdP~7UeMOQ6?V2%{g9qL=ku@x9&EOSyq^4ZhR;ToXTNzp|oT5iKq
zT{x;Za=@d@2Vxahpq;c#*=`C3@PZ>m;2;DCqY7)$OA{X$W|mxDbrfY{21a786}{Gr
z#4&~tiPd~^3YAdM)tc(hwCCF@xVuY493vUzDjb=}suh`m!_(%jsoXJTcauPom^ntw
ziy2wh1ZG<#(Qj{$E=f}B=1H~s=|fdjlP$kQChX4Zdc&AWJK5kd6|F7a-eo&mICys*
zy^Qod}P1=i5zap)IBUy{%kVL3b{pBNTR{w;3
zn>-1O-TzU|e7eqZlXSa%0jM#C?5%T~3qoz}sM5Uwz%>h*LdLq#Rk%Ob?d|#b%kwAC
z?tl2wDk+@cV!9gEy~VMXqsJ{2Qpq%l+l$`Tpf)-p+ZMb4Dz82_ug2
zXdE{;kDiY4^mKZ1jK|}2^VZFis(SYP#c%%G-~Q;MpZ~T0=$GGp=lxGVc{!`_`DEM!
z`3~{q$%#>@6p2$+LvwMys&>$g(8vvIavVbuK97;anu}x#^C)^wAj9LCtFHsXMiqID
zvAA-g5!%({7Il%yeW%cwjEIaQQkE8Lc(BGTFPDb^IOkeQ5Ya8-isKmLl)NawA&g^X
z>`^MO^<(BNkzyG!M%I*%eB9lwyK~K%FJ8X*xBuJ!=Lg^Y-A9jcj2wwIFWP4a8;S~|
z*pd)kps*J%ZMLcv2_YjW$w>ET0{~85VvP|`p1vFL`cMD(|BH;D|HZ%mqYs~d|GPi@
z%m;71_4M@S&E@vZ<+#baH}lAW;243#yv*aIP#})A?eSFVtA1FKhei_%7*$|#j4|g*
z?<8Pm&dU_?ThlO77)%~Nh7=1d#<9(8L2yp%E!Sd>(P6f7Ymo@Ltqn{1>0$!Zy7C(4
zsbdxA!lOqx9dS9c0@Bh7D_>KSZ%XhDD^K{^R36HG7N|4NMSy5ADbkges
z*5WBgW@p$=`%3Bh3(hWrn&LIt?E-`ePCX#)N6;8nL}aZ=O`VBLRH!lGSRE^O&#`IL
zu9C{@a61pXCwaBi)sR^Fr$s~37D=f)L*i<2ydp=4kdxM?O6%Ub*hhqogd#zy#KhS-
zsyl;ku9oI_Bf@6%8+W>Nb)qj-X-cF3wR6?Ni2xWaI3mp|7L4OlyvZtyu{)D#AYodP
zseXu(jD*3>6lDhKvBL))WEC39qbkcsJ3euBI`8vweH7OrLsd6z0wd-pTQS)RY-}|;
zxBxF&i-^dP^vP{%!!Ft`=3tnn^t?Ri1c2%T1%(E)*%P5X8M?@WAuYArCw$ihhJM@y
zwwdW-23GZyyIzMh6l$CrgHb78tC4yt$DSQI4u2(LbMDK_ODm{mc#>6|0aG?DP;JUk
zLyZcpi>WH8uI#wZsu}=F>%w^3hB}W;w(6m(mn80Z
zhHI$QPD2(KVuaQE*s*_0T&zqLhXT}6*03T|hl=d93)*TiLhd&?*Yq?5+kcS@
zP2om&yr89MDz&mFy;0ScqCjlRLQ3C@b&Rp9h#Wd*B!H0vWh+Kr>uE8N#u*tlhCbjH
z7OSSp*+!c_pAl|Gjm$Yq11(hODhe)*VayYeEf@$t)y9;X)g5t2K^@tNClTVTl;XlG
zTdQgeu_lY*Zw2<(XceO3W`sgFVUeV1+Ll0ykC%{LK2)(At>~{y)T+fE8u3IatQ;L~
z8Z#o6dotQv)@&!xnWkw?l+IoN;_30Q9Vl)mF|CrF;3kOLS(HF
zdm_YV8xbn~(b&8(D9LDYJ$&fU7MbDKrwhzIy(_j4p#=a#UQMl-MItf!l#4RdcW;q`
zj7%zMf5E1hI{2DI^6h7-(V4l&p*oKEl{oWZUe*`C@cx&+^Z~)6Jtvz(3^Zv#x?;eN
zr2bb5%d+f4Ef23dR8ie%&`UdEDS=}3KmjTHO9|SVi;{9E{
zzMaos%}+nM`|!h;&tJUBc=F=YSAYD+-~GY&el+LZIOQovjs)jA-`-!Izq$YP_3e-D
z&(GK8uAR&%`DH|C(jku{aJo4?I!^CAe)Qgxrysoa_UAtHxp&^&-u=Pv|KW!}`sly>
zFaF-=f9l7czxnt_AHAr0+oWK`&7*-8;4)1df{mFY&D8YutPVYPPoUIRW38&Haip8F
z(XIZbQO2P{XsIgn50qxanxz6F2j(Qgxg5=T0GPAJ2qS=q$T6@uxq^9Ux=%k9EV%)f
z4W9x`R7I_|7=x(~>|4-@T%4p^0RYIw7-I;rNDe*Eb-uq`CW-i?KmPh3{lWiy++4=#
zrq)7tKWN^Et`ibF0?=#X6r<#=qF+i=>Cw|K
z{M_IA_`^@W_uUUa_{`gHz5VF*?d9>~)6K#A`}O$I5UM{;6e!BXluOwL4Yn5CyV98%
zldQF@#BS2r0(g2tNy#mbQELS&#t2PbEGh}HDT%q3uSww;dQEG@7-OtjwMy2qLD;az
zfm*Xd-G@Z20#_WFgwA2G@aQJa7u4dMAo-vDgJ1ruzwp!F__Oc*+I0*Jvh;&zk|qiM?uqHUd=dK7>$5RwoIYRD9@qq2f*
zlNw^Z^pq+?t`21RAMe|T%vzN#k`fF-6T|?ocJn?*(Evq1aA`em7imqK0I>Nga%(Mv
zQ!7FQSS2yh9-V2zZqCw>p8NvJCXMKQ3Kqq##nUMrb>RfjkIS_d-9**hNiU^s&dYO8
zC29&LZ&$w+cu}E}64?Mo?ex6f(Dd_>KXV!VR4=iRHgHvGG^Vs%zCSQbr0JqZ%BQd>
z+E1MoO+U&5#ZgJB2A8tKB~pc@Cc;j!fpZ`*yeV1=FU?8mS@wLEcVPMi64z=4d#u{K
zXqq!e067MT#VbY+3*uGlIT??U+|G!^NUv4vGT6cyC4F6ZD;le|ow%=ycc%w%W%f%M
z6BGww&6?-|H&p#9ghI222uOx481^4;Wjoka^ez`m`?FA6&ksvoQvCyeOc!$0Xu9e+
z)SBaT)G8v!NYbK-dAUeJ;zkd`@q-b8N*`*K4vysj0!hhy42STbR)XBu{SiFU+0_IP
z7$cUr(=0HC)ZFN*9vfTwA40l-Jsm1umsW|AXjx?Kx9k!F7%5yq%{NsK@o2$r;)dc-bzvgcmdJ&!TFDX|6gB!iLT=vSK5yf30;U*ap}3L~~SJOe2I
z!wA(XY8)vMjxmTy&t|F>6--oVZdL5U*ql$au{xdI`<_Q8qO=wTBx|@I)%eB{zYk_7
zE;Pd>v#{%0*zTg(z*vqm5a5~eG!d--MG?z_e71%UO*wepYN+OA;VpMdT87G%_=4)-FNUs^fIx(p;do
zvFVur5^=#No0RxoiXcg$WOO+aYZ77!D2!c(WyC7N4MxdJGCZ5uHFd~U
zTv9eO?#eN>3Ip3_fMgnOwq1p9lTOJ3nd6W;v`RBfsG5-h4){82?=T(?_(+pNdGh;`
z+C3G3a-kyD6m##c|IpyMD2F1Cab%trE0F=LwQ`(t3)LdYI1a5rCRm5MUJ*wg>g_{6
zw#!ig+l;)N3yi<|i=X|m&*bI)GO`n|%T#WLE{rvNTM-*Yg^1M%FL&WmKRF_>yNe}u`FV%?xDprsynZ|JdWeg2sEsO
zEcR;092STQ1-Ix%!O)ID;}~nMQ1wt8N3ON*&-4DSIOF+?m%sgg{F|E3j>m6{+$^hy
z9?XomnH9bmwl0M43?1>B;xjlDwK7tPsa&!`oJ15^a~-Ffr%&P!zxqEtdHT7}{n*cc
z{K>~Z`sl~rd*{jR>-psI<WAPKT_gOnb?hGfdoy>=$c8$+v^Yam>q%
z)GT+QBX*8aRcmrc;x3|dabD&)M!*t266Gt9j3Cr6_4E}%Cb#Hg3~&(x;T74c7Jy_7
zR{PFGr3a1)u9y=%#W8RiI8QQpnU`PvmCyhEU;o9g{^7T3#mM8bB)3`UM;;kbL9Qt@
z1KCw{-9j|y#UhSFjp$WG+6tKFAmA&IZEoY3m;T#2qmiR|L@kS6IY!2i(L;>nTm>FE
zLUUHu?5M><(w*A!Dnj9RDQ+seGX~fDYSE)9RPA?NzFx$IT
z)3D2>dc-d6G;>v45jGiY{VuNBU+cw+U@=OdshVOU%QkC@Y-YnN7!gUU2w-kOP@_sq
z1&Zk5O^wB3B#<`GmuySgI(S#TnJgC+6c&xWc0CM!Ad+7>Nu-A-k}@+=auV+kbYEKK
zlT|uuF(`;Czxnc#Eauqm-7f5rvxDI3go7+Py-QJ{N=&h%t`ZpEQEYJqg$_{5m1H
zy1BR83S28j&N+2x#TDz;S820}F);$E-8gQ27VN%bLcc6TH>Ii{vbw8;ZdsM>P|Dws
z?EKJ2qR%t7^@o1Gwfvbxc`m|<#RfWxZ|qKjvQPAXcS+E-wQ{j;tqz$US(9ASRj0pA
zSDU_jA^fa&+NU}Jcs7c~GH&s!=_ne$RAok4GpLlVz{zn|wFFY@LKwj%yJJ;xx+kH(
zVCi+ABBXe4?Iv;0C3eM*%oy9FECAM8v(!UFs0W>62yhJB%Q>MBkEm%XCfKbNd9e!$
zQRI{47bvjiTmY&T$YUI1WKSQ6gvimp1STIHpRt*$=))b+X6B0E9^@SRgP6=PM>2GH
zn!FrJ(|Q;^)rqDF(OpFUEaT7qD4PJ;|3}cjSoZZ+Qwde9RdZ2Gw1nYQ3?z_X*owGH
zAHvYE?G=W|6II)pff3#H04$r$%uwo4oZ94EW!S-}cIXn_M$e$@%p#?t_Dk%tFgwe}
zgKbngwVCRwhlRlz5#lL^if4tJPH{2Jd(+%)MRZ_ttfG!fG?mcjr&(?hoINK%GDpDS
zSDd$AfxER~eriYS1O{!qoN5J17E)%L!0fiQG97&E`wWHY3vY||TuF6qij;q;88f;g
zk%;IykwD7aPHm`kYavnU^lj@CB2;i3X(%ChG_w0eL7Az+cP+}&d~X-RZ97RI1Vj!0dyUt<7j>h|{X;`RNDXXlT9boaw^BtD=xGZjPHrH;*6P
zJQ)jbo<0BOH^1?}e*NqJ>Z6ap{>7jB@zc$tfA-IQyU6%SHTP`&5;Yr=!#=w
zf{d=%6v1?mQzuGf?Y?Y)xpM`IOpF*twcZxHBGE5`Bopy~D-L&)tH*;3qpG!sJa~
z1M7rTOCwy_wrlJHldISA~1&6(h~h-u8AH53qnY-`K5*?6$p!D`r>CY3Gtiz4tPcs~9^xmAji#8;iP9
zEom!KR`fD}Z3tswG+C?M_yr=k)`Yitcbty^Yt@vY4uDQX50Z;jBBsGMVCtwU#NItl
zksg^1=Nc^vK?{%py^E3iUjvMh6#-(XcP$77q4Z`;Bd&i7Ftc21Q4TB)k8O!!JlLjC
znO=(AB^+y{VWtOh8t&VTz}#r56V&CL>^2x7bSZMD`(wMkp+C+PlFL@Fh8wWzeW=#<
zJbxo3B`Iphkb-JQ{UJ0MfOduvEL++%gaC~_43208(QcCma*Sa|_abRm%ZM1+aM)e<
zY(0YK-M!MH)vjU2f^Gc@a+NzX9m=w$E8U8-23q=e`k!~8C7DMf-njaTAgGB6TEwsO
zxjN&t##ob8EVPgA7J`#KSn9u9Y%?vAB~_9;0qOZwHZ=kO_T|>?^YM1{fy!5%lZMru
zBGI$ljm8+Utp%{}!Ny^&0PV{j*Q~VbC4JBbh0pawX(0h4c26^bY?zr?>F7*oY+2&@J6DMgMK%S|5pBfcQwkf6b}LXJ?ZSq=!Ux
z<@Kns%$8gqsTXisq7hhYuBzyH=+aylFW0#-=|VdSavKUO#L&8twQ5yuoLZ~7fKE#~
zglZ7UG*SGo>5H~aJ4R*y1w`-c0K
zt%n_wPGQ2IY`r(j9F(4&?n8Bvs_W^hBu2C;nXX|w!bBjdu)&Fjsr*FL-1D|~K$KU?ezxnv1Kb-aaxZyYk
zA_B=(%ll*)?Ftyd0OwqDt*V-rInT3zRT$&+^sRSqo*XYiF2lOfnO8
zffT2Zv1V7vY^c?>)LNYLQmb~**yzY3eS~l&8cWW#E|+z8w^;e=&E+?L^MAv9{^;@J
zk*2N^Vx;U$%C7J`Dj{R+OQ5t9-W+HgW8sycIlQo2422YH1
z)g8`0MOcVA9Qhp6IMsdlu6b@LDiTPt>uJ%n^tmTY@ww`e#b(Xp&85^T|
z7@uXGuwS`Rql)*;>SLfV-~l{iC(uhZ`%I{%ZuOjdJ6&;O0|HHKsn-aXEh0^WR^z68
zL-l#|!)5yviB&Luu$-_Wn1QwQggU!6%6FKd54;{rgnm#+F=Et>{j3tGL92sn9-1Nh<*&p)0-e5XzEPA3%`Eg&97*2
z=Fs?SQ695hrJy9Tl{e?6pWMNMMsw|D$tIjFHsy}EFsO)(vTa)rgZuBvNp1=Lt+}gN
zx%ZX9N}DLrpCcJ^mr501-GZlTZOwDH=x_5$yR{wrvBSgZsyx%hRBN{3iXFzat_r%P
z-Eobog!MCVEp628&&<1=Tr#5
zW4F36kTFiEUUBj|k^y(37E$z70MJS<#Ewij<2*UYEsJUGE
zM2>NU$auqA0^BCAdI!g$;Yh~FuDo-IN@5{oHE70BM?CFNs27*%86=Qs$_Eb4h#0xq
zW|#;_SNYZdK>z<}9f_x+BEsG?&3gB7(lKg6DEig83J}D%VVIOTvEOKy&whY%zA^yH
z;PSxOX`F_Lye4)8!&3rrg-zP1ldK>kJay^{7<@opqEKs1-M|iNu6Gd8XGR~gKt_&8
zmzbF-te}_fNTbljdwOnUQQY0~8l}~)0gzvIHi;F89&tzzBmEQfFn1%YQ<5tRJvusl
zbtm5tN@&;w?FJ+LA7jQAcG+`7m)&Gli)2)miC68qlwGP7+nyB67=!exxxnasrvV_w
zkkGe3h7N#w&tdxj=^GGZoZP*E{|pG}@Sv5Ly3;$>`Z4{cklw({bSH)lZYoGtwpL;yd>xd?;d@cHk`qKAXa=>!?Do1C>mj=}{HuW!74?
zCdlYDr%p7cqKd3qQb2GOYEo$L{{B+Tr|-P?^zBDK`2JV^?Qi|#%paak=YRgs{`nvN
z{x{$I;KvtlKKjv{S1-=Dcb7MB=A5Nb868wn7#W$Vy`~lEW!`poRoN;vjV-ydk-f#k
z*l`dsj^XY04*N~TDpnUW<8;!F>d4IF7(mS_IuZuT;1a<>*gajrS&+19tF$2bg>js|^=IGs<{$s|lc(<;+RPINl#HTD
z{U&|{f&gS5fhak^r?8rdAq_;q(i^p(RE^M>gPyAisM;D4S(OX*^zHXvJp2A1{{C-1
zdUSmH?9-R8?k|hybKT!p5z9V+Y3)^p>Nwk?cx&-BTamUiskPQ+DUDucNjjJ@oUbZ!
zj2zC$>fwyj0mPg&=UTPq(n7A(Mk0s^Q4Q*F?sF0uE%LAFaoJpJozGLBxr(dme4dxN
zN&&yHh*_A$k+?ZYE)j3;<`;kJt-ts8etyNed-GX+d&kAxE#OZWW>H7d5rx0Y0
zgto+O6_93PWOkBhkSdsMMzSjv@jDD+i~|e}lBgyqE)~WOfSv5n!(}-JfHh0aaiu-+
zp@=TE%-&ubBdj_OS0icFQeR7Q57Kn*W(<{pTZI>4DCDmzVS=EObY+_K+i3#PS^wHf
ziI!;T(r?IvRjX^88j%J<*YQ7JJa*THe(_BmiNw^LBq7bM5$opN15o!ohLW#&HGfN8
z!=aL<4`+*;p?5fiJpkQK^`p{44oz-&9WgY2UheA}4v=ig($e7^BS-e$12hj2E_9`vQ7gJ?
zx!O}Yc>v7xP;K!OT=H8XAZ0FM9K#cr8Ox3dY0T-m1N(caOWgm%T7r!eX+9_lN>ang
zw+|gnd?1=c$Z?EuiiSs4@AdFV(UY3BrNvAaK9
zOLOT82bnGbBZgP*K$V(iFO{E&kt53|G$F%x%J6p9)^?(KS2B>tIMgN0$ZP``_e8zz
zbL`-FolUpkA-bpJLP-BNM`|6;l>v81Z@5T(dGo<03pzCIT2^JdKXpic5MfED#c%o|
z{j9KRmR9uyWmQ$TieHL$lA>N@E{sQ_}N
zz1F&{J+3TiRs}gmibNN5u4SMn+aj$9Q?7ENc3MYRoDT6WT?Hn|;US`jAsZty2(P!v
z>^?dhCg>&VnCDeHOQwafLIdxsfl)SyiaWSSstg++W29Kc%b9xMHu}
z4jbbLrWy~R9+m97Wd5zALjWbBC?k*roIv_0D%tn`&jjU~6}e0IjRQL1^^KM6Hk+Sx
z=A@jf`nz{Q8yO-d^&5FQo!-2;yz}(&-}w)I>Xf*<_$y{d#%un3I3vNn1cJCl5;kqp
z)tMEM<0SDL#}Q(mcKy83LoHUVd9Lmb`SUAq*Rua`y1BPcbp&FJjDX%3y%VNa&yk5P!d-3Z0
z?9=;CKDxWT$K=iLe)&&6{P5$`)8lw@diC-LfA)?4<;ADpeCypOkDtE1igR8%VOLdA
zkO@@}L}e0~MHH}PkfWM}c2xt5=gS3=?|5m!dmS=*dZ~ioJoOW6{PX*E-ddvb;bDXs*hPRJ}L
zO}6AAMvmr0Y@xYB78SHR((3EB&zw(MRn0l&6{OIVwsy1nAP@8GYc68RkY<-m89B5Q
zf$d-8-m-|ESv@(W8q}4i@=V9Tunq_hLX9Gi?T}a{ahL17BGqK;fD<+gHs(>CK-=Cd
zt{PfcwPr+I)-3k*q_|zES`oP)*PRhf6w($k0$`SQ^}5|9s>WhOueFTkc{B6a-$K==
zAaX|c9(hIWQY#$^gd{;DAgt^GTg%|!I>GwEvNud1$mqNuA;GOp*w>O-nfc_kqzIL=
zH=2?wYBE`vp&MVJ7b@OR@6Bh`w5)V_Kojs=4oV1|=r8K$3y*1nuPDE=lEtZUfa9sP
zBjp3RkoNW*awi8`Rc>9Vj!ji%TVt-8YX8$Gwn4(u1I1d57-J0hEhZ(&arve*%a$@K
zH84FGS>{O_ip%dK9xjOhTCWIqVzzIhMF9Fhj7%L%OV(jn>RM3^1J%(6IXV$sYY{v~
zj&T6H%AlI|5gKOHeP3w!lwP!#1c(|VG_bHEAE1-D`jjHAX$KV}
zu`#n^ipOx|Y}E5mwJ{d01-9zl8HinPTN+R`wSK(o5)I
zO4Ng{Go1h}W!EB7wTVbd;Y)KO09>)>)mEC}!!$Cy+1aAUu$fpOVrj^*q3oXbh=hz}
zMjp`<1*#I!wMRD}JCT#oBf)b`g2y-_4n5YMt{Fn)sx0->?3bYZs4Bd)%d9QeV{>4p
z8%D`{m6jNG5X_Mcwwu8+%hd3p=|0NbPaYE{88#yl!s7iteau2_8a1N*&z#Xi7&VMe
zxYp&eEYR&Tkn*~Bw`aZlg9pdpY{V8AWRJ)*A2p@V@O}d;dXh8x2
zH)0pLcV`R5WDa@9*=cPYL($mGmSqa_aydr;87!uI0uhe7p)=QKxFcvpNFk$%n&z|F
z??}SYahyhG4hx}M0Tl3LcJ~3lYM9s*{~pOW}woP0qjlck%NR@Xg6yNf8Ejv
z#_+Iy=7<>9_ULYp7Rc0*M9XUI+yFBck$Vz;67D;1?c}zvwdtLABc?O7=h5-
zfy%;>*HCBeOGJ@#)kVqN1HMpos@IeU2x>_s>f5
z9F|e6Rhe+I!Y^HG&AQTiji->{nj`CI7I=qVlDoy|L|x3&fosU7cX8#9OLG(
z2RujiSdH!LTO8-7s(h{oEXxCRd|JX~?lcPha$6
zXn-ZIz)7(3dQEl*N0+v`Uw}xv9*83|VG!*{8=lF${&CfzsLU7&Vup!qqDC#9sxA*e
zDDxHz#N@1+ee5+N!TyB-aMjXe+;#=3<^{_8Cj9mM3N$)sX1oz=*B;SXuMKRM4Qa3G
zRLf?3xr((_X_--L=|?wq@=FXi(h1{0m*^p%Cr!G{3wk+fnELhNNeST9GS#7{m%d@G
z>Elt|PtifAR~`j0G`JK&2?QEncXzBydU{#Pu
z7fLX}u(%~fqWiNiUbGO8fgW$hwE)0CKfl2k?%$dSh@S8FACN5dfn34;GTkd3749qJ
zpkcD(7}}3oa05I-Mv*;G;Pb4q{)GNXSA9Y`eQLjpLU!2M+Z|SiY?JdE
zP&h*75+J#>)Qnc+_*;PNe<0cHO~_g7KOx
zXK1x{sa0)f@RlS=P>0ZcUTvPtrfXo*PlgbbGlU+mDJG=(Gx4?kzDXZq-UqgK#vb0sZ
z*g*RGZyEM}kyd&u@d#om@>-2ES}NpF34INFEeIl$5ph%j#b5fx&wk+xPv%_m652pp
zZ!FlL9Hy~*_8MsO4%s~byWnqnzSN=WTild22q}Ayk*DLhd8DoGwYos?_p|L+s2Omr
zo5h-u5!9sXIO$c&rjoMx1yqs=3~R{2dA=6MX#nAl+gxjrYG4XoSuh?oyT_6tuNnb3
zRa0}ah&wem>)EsWk3YGsiXVOW=~sX6s~GdiTQ{Hl=o^3W?cX{b^YP>tPcHjT*Vbr}!-9T$ddA`02aPUVeBye*H&(`2YJS|Mb6^
zmG8a(+1Ib_Z9vAh>Q^nXh_x<$xN~wXX5biZ3BA6(eC~ts5C6e0
z-#mW&`qit`>9Hk97=g6m7pP5F$~kNqNOllV0TU0i$ksxcVad#6VF0I63bY8(mJ^J&rCP}TORCXFM)CnmrSJy4Ag1Qkf{qGQl
zDk&eV{MRpAZ2%YZY
zVn-N75t)E=Bh;T?OfLyyYJr3nztu8Npd;D5I2}0~*0TCJG;mawhcQ^SXTX*y8Id;z
zLFa210}WNo|2Hn|?~tf9i*?vdvHz?|Nj)oF8Of@s-Zh=RNdl=3Uahq^(y^IAZ7h=+
z%FqoU!&B?@;=eJ%O8D#NuLL5wxEi_l6?69OM^OcGN^I9HVMdTlj9@OWEi_feeteF(
zgepM&bzeOI;d^nNPjgEE5!#8Dx$&YtIQCh-LWF4W>@k!pz`s@)1Ksmz(B@bvR6y62
zG`?_XVejDeXAWz^3r+n|9Uun=6JR%s$xSPL~>km|h#YpprgoNHE9V-oabZekAo^@!S&
z_eM(S2m{cDYEGa(K2DCzB=71x@hX~E1yHuZ(xMqQfrCrwiLCU|sbgjht8ys>+~
z7}@(jYG&qf8hJF~9AVE0y(57qA*M7FL*uUfBwh9Bm_&N$pg)x#vPF#gSK7cyj&Y0}
zVgypz{sAJlY>Z3$<*8j~8NrI+7#^WP*I(S+a2vy3d$U5bMhn8+NAAl;R#gnq1`&P_
zIkeKNd!Tx(fOSw3LhpM|+j?J5zoTMI
zIbz80R1{TpdupxdnGhZDj(ZUZWHP(I9=>p%tPTHBy09ASXVUuS
zaAaavIO_72_z`{X?AxkwtPFWCoobZIMphBQ}#yW01HIp+@h;z1N@^sY7EV&n!g?6<7&;+48?4mfWe
z#}Re_jttaVN}+7LbR1(GnzdV(rHT>NN82JgMLtqaJ5B+5Dh^`E(R*%2s%8`L9iFRM
zk&!vp;+*R;SB!y-Klp>Mu6lX%=)_tO8Q9w89{B8t9nIW7ylHBGp`*giA^rn;-nM%k
z;~=ms3K$VKkvGf_<^ZwoF0bEy@5x6W|Jfh@!B=kYZf{?o@6TKny85Mu&{1({_YW&m
z%6yK)Up&W<&|TJticxG~#c>>C43(PNQxy>k`D3K3-(~r6c4yL~55C44=P>fUKBc&h
zf(m?XGkBA8Mp|ABVo4h@7cP@UoJNcRBNu$~r}Qb~GNO&HlZ$-+JeWg0!(d8RfB>
zA@MxZJBlP@2)4odN%FN<&!>vzk
z2PJk*+l3@RNL{ov<{F{xiy4Vkt5~T9tTVG-P#)vRJS^%@thGv)QTr?6daABV1L!8<
z1Gu5)fzD~BI4LxZwUbgtI&KR-Ic`dqp=gXwV{mM3U&mf(WB9R=s6h|tjbEwCB*N^x
zEo;j_QPqfEd<66@8MSILyjHlWgR6|ZM=u&r1u2g!IcQ{7lU!jwt`mDN8R{dg16=I~
zsR()9tSj}Y*97mT3p$7$hV{2pf@5uQVf&t}8SEx@&O4(5$Pr
zT_<6uHXVD(?_D!#dvF?Q_+A8UBIi?-F5(Gpzd=_tSnV4Wkz<_3aRO1RfeUt!F|Hvz
z{ZOt#%LI&bqMMw
z3Yz2=tOFt>(4Ko^jEwBc+7y!hdbC)9?u*FXK7_gva1jETYS7{f)3Mz-al-*X~Q_rpfBGmlOV+^>@o;oC=o@|6(*ITddvQ~YzQJ|GVFt9`s=0|$I
zY6n=-${BT&luG^bET?hwHyfYh_U`ihA8r;T!>E7;%^+{;sG3|DeY~?
z3HIch%PN>>(}UXVp_VtS#Wkq|p~kNi;_dDEa@JlsHcxY1O{|!G8hIKcAh8UM
zfX7g57r+vyCqzN8mi%v-;Xf&;R${3F0x*ck81NTHw^%JVlY+MjIilvOso|#>58kF)
zEiQ$FIkF~w>|42%TgY183|y*um0}u9mgX!Inb0M
zn!ApsbtR*SYXoSzm)jG2n?ptOlg0s2)%_ny>#T8VWt?6m39edmUhXgR?sT)h{p~M*
z_dDOZKd<|{T8w!q>z?{jjvS|B%*(9BV;nh>g=9*Bq7UlvBzuyv2O|y2bkCERIaoy@K{@E{S8^x?vmOHsu(=n#+qh2oO?L)Z*pBBF4Z;
zwoD6`%lzdpeeT!)?l0ZGIbY_AJT$yYX1M9+B+~RWGPI8#07hQZcssEmY$&$&J6H3K
z-Fam#NCV_SCm6{CC}zeOPzwgp{H9c|-R3oPbYPTmplGNV$3V&WG&?)Hd}X0?Xh+WL
ze|eaH+>a}H&9Rz1F;5c_*VxjE;vVf(^LxdqW_s=g3hlyyDf2%40`Aym!h(^81
zcEn&y6t%oSBLdpu2Y_w3P~`#9RTf&;wE(0#u_K`#S4euxc(y_~U>q#I93fd6&?gfLn>{)-@;DYi4);po{RJ%ERSw
zq$E|VijjCDoW_M>YIUJ
z3E6V9Z*-{WYI&JCgRwnPl@WoI^gy4~h3Zb}-KZEKeh9Q|R`mRwrnr~&O*s~>o??){F
z5N%Y&s?Pp$T5(K=rz~NM9O(JG^5Y@(_GX*R3^>6fy5*=GtVcGE5hFdrsm`!pDr;e_Zp%@yDG@<^
z6m=;DEA+pPCcL75ua>wf-l)8n&|ppW)4fXVy|hZKD27dpg>0gcN&5hpqOgqJmpjc$
zj3dX;8rF0zVNyjL9zl+g3@$6^Cfj;Lvl>DJOUt7+8Pr9W*q5$IEK&1`Z0sDt7^wr$
zLRvl6(yQ<3eAhIs`nNn+Jq#(#DA6W`Iry5=za>S`wd)p?aw|hzcjg
zIELiz?(c)qW@`}OL@<>iYDa=dzZ|CQhU+Bn6{)Aijy|IK-R
zou`~Uueunfx1Z-Vp$bM>rtSk4;laX;q(hM_C&QxVxEe!na~Jv&Yu!J2`zIKm{-gi<
z|MmMn`2OcU|H0ke<#L`?aC_9Or^8J~tupAvr!_4Vb`7t)G_GNIIk`pvva1OYHmh}fYm&nHpit_`
zTx;$Bp58PVv$z%?-#q&C<7eOc#y1{6ey2FyBI^?z5#qyJJ0vbFBL|?=;Ib{Qu&1vE
z`Y@rjKbh>=!c@C8He+UVCoB=cRqK4Yd-UYAE}#D4*S_-R&Fke_E}-E?-KpcqNV)qA
zZL}*Kr?#%i@Ccj$nFgcKKri8`%c57{bdoS{l?Yg}B2N+8Sxponcfi-)JCespkZaB<
z?<{34K+A{JauJ+eQeJf8fpN2H+nAF8PbUDeDqp_llY{^1um93}@4x%v#mh&JpGJ&8
zj>tn!$9oh$f(u$W==dkLO3zu)3%x|x(yBh4s?U7V^nYD}tHb<2{42ju<$4CK3Chsf
zra@pIP2Ew=bw{-Y3)n_1l1@O1I4GUef)fo`@K$yLq8Y~q{Q9gC1XcDFglQ2{s!@?8
z(liOy;XyFjBUnw$Ie`1KH4Zb*?C_0tJc*3uimvehA~MQ=Ly4@qqI0vXu}7B~p6M__
zADK)9GvjERTZxC+SxA(Txiqt@`q)(@M_PBi+v6%bGg4_f`eJZLLbVM|-`FoE#vXfy
zV55Ma?w}ect{-AVD-kx{a1m{rT**c7hnu{(=oD=$yMyB@%^}|k#b~1|*
zIig!(kq_T5o6At2dCBoqYkK;P>g&SbYHQ=G6QaL|!D9d+WtO`=ez0IISKiC;*q#*oNPbI@E%H(lAzaXBnJ
z?DD}EFTAZHulMJ{-ErlT5kbvttE7_DNa4zVj&9M5Jk&Ez|KzT?6gyixbDckr=xf`x
zdGu+Q2qil^8)+!tDj
zGX~g16(sDIwZ<4naP04*&ndI)(i2#mmy0`sO}154WQ>t=rcFuXkRGsn;HJ=%U;4TG
zR~Y{($d4RkRB6{+KhsHMiaG%Plyt;60roLs@@Q-NtO4Bm1kW`j{f*^t1vO_&3
z`9;@tq1$3{Y14>4k1NW6>||>-wXagD*t_OHGPve65!CL9qPI5wr5abB{Fg=Ts#@U_
zqd^>H-Bs(-9Gf#-slN8BaY7|g6`X{dajeGfiO_C>dk{4Q=&bIoB-dVcK&aKs&NU
z|4s9I0HhA0{UoXUInTAGR&kg}Qj^L`u&#czuu(B~&59Aa=n;|HF@)#>$fm(uJYTxs
zogrm_EC+Y4_L(f2Ut>oAh3(#F1AvRiDU))q3F(B{P^^mcyzVda_3O*47w6mCi8{Xa
zwLkj!!ykO^Gf#i;{olEL@q^PT*1DVXzUEW}bvUvH%v7{G3au;zQMLAjJvw8i5-^|*
zrGDW4sMV3KzfP@K>+ZdGzxeI%{@#D{PycIjJbC)~)vJ4NDDbk=U~$Nm7XV-%*R3_c
zCSYUpWEN2={s$ubWOf`y*bRdFuc-f^^>+p3&Zb*T7?U;@5HBN`+j}StD(weG`SZ$B
zD13wxBSRx~#vSG3Q|>WnRF6`QWP+?$E*xXZM^MV0nUMsLD{y(O}meukIJ1DU1Hf}s&Q+N*LaQrjTr&7()(`SY)S?|a`_
zi64Fh%U-sg2Z0OG6i9-!nF^-ULFo4q$nK>&jD^}s}{71j=
ztAFha&p&-W#%ai!QjU7guNtAU?N(``$MquYDS_5M`(uUz&(P7OB@b0BO4=uN5dFLi
zPBDhM4T5M<(6Rpw5ua
zQo-{Xh#1BMk+Ka6sW!X|UC^pV1~nrcq?DFL&`j7qExJDfd7`Cip}gx_(M-Fv)*?g4
zMq6aOq;?Nkpt!usSRV*3!s8m#pf^Z^9hJBt6(UrKdMwVEq5-soc(p3DMW!R!wyIa4
z+r*6v%Ie@+UR9gd*-nJ^*ZIcVs8A($Ck6J7aXP4@=QyM%=59*)sb)V4BKp<%)0-*R
zD@Mlvso6p8)VYw;ofF~l@(s^~gxL|0k=1AlhCv_(vF34e
zfOF1FDAl5X;&BXN^y73IW3aHQA&sA)vx6wbnv-iqZ@4`3TK@T#*%e%Fg#UQiEY1Iu6EK!>2=+-c7Yy$v^?U|?g
zGyB^3j~0VSrU*6#5fv>v1?X62#u!@F6UT87F&Bwl`oR+}4uhE)#S+D4w6D63%RSpw
z0kAZSk*R+AS~L^B7MJNLF1n)R$SebSSI4y~;9au0(UMCmNVlmh;6hHR+tqYOYanF*
z0K|y2nM#iCG59_0!I%uU?jl18B4Pxti;1IMX|CmUcxpoB4BP0X`?qM-t-^&#n$C`n
zD!bh6!oy5tNGchYh4k@iGPpYc(E}F#*(l0fR~$s5P*tn7v~Jt6C(fHcsmx}o{dB0@
zzT|Ci?U+SC#Yn)NWX?I&%Of-@Ib2t!77wa=>0Uq%>idSDxL8kE>|xZDF?JvxZYFxl
zd~waXY)yZ<8ghWv%S5-LQrpK{2q$?Vwm^D$hq(T~F2;u1?3-$o+B_H@mdopQreZ}x
zp7J>~(oo@j0MS&gT2=dkdtEqq9lnL1Y>2$>eB3*2M%)rXnE4agK|_Gt3RSUznHXs;@fC%$L5x00gqGrFrVCW73+*foaU~hMKQ4;&
zIF2{>m-jz-`m4Y46F|(x&iDpM`#(D?>O7~1+jR|FFx-gHO$;CqIqZ*@{Sz~_$gwVK
z(OYU7e&NA5VxOfPt)xnOQ^9f+G#^)UE-%_r_{acoIj=QK7Lp_*#lMb23zmwJ$h~7w
ze!_@pHFii`4cH=koFaz}ht>1Rj8$Y|uDZWpuU_51dVL||haZ0O2Y>kWci(&Z^7VH=
z{^%RW3Gl`Q<%PAw$W9(g-ih2iASGcJ;Tp+8WNb$VOK!IEEpoqta$wx;ny3ZFdgtxW
z{OkYm|M}Zr{;kh^?gIwz-rQ5de8)=cFsAK&dcva}{4DQWwHDpPYD_GJIT$&TWG$q<
ztf}!-T@X95WdxDlj^NA7sxgLo*9mPF%{jG`CJ~XEv*>FZ4OA7W*Ia&3fd0G+jZU(m
zYPpJD{t8qgw8PALR$I9?wpm6q
z`i{E4=?!oUY?3^XUFb7*r&W};)1o3{t#!V6bXx1#?|U5RmD2g@FCk?
zJ4!mej9$>k2*0ne8l{XcBF7lVX{1S6ur)}*s8u2bblkQ$(c^AbZU$kCI}(-cRELOO
z{ndjrl2utC7mlmEoTs=^pleTH&fougzjz_f=gV=rQSe!7&9xZF
zG4!VMa4W#=`VmO1s&KS4GZek!RM<#2!bmb8W(bLbXH_-mFVXn~aHJj8m2lj8FR_1K#X+%Kt`2ssTz0es_
z<2FUf_I87X6q6O#IbN&e1pRk6Mc<%tg<-VgUPNYyfsF`il}?TjVla2xlhU2odPb*V
zLOBGb7dq{?84P$&VgR+b8Kur&
zKi>WueofI;iGz&^7zsUM1N#S^VRmj(^o8q-PWR!wL)W)1T|=0&(_D=ZF|=we&t{4g
z%vL6N8927lROl#J+i%~8%v?1U<*a{fjwiYx$u`pp^>h6>;YE4TXGoM}6|k|90=SOD
zUs5eA+BEai@-K88Bc~yJAliFs$5w2a?SnwZ
zsx=`Ybd_JY8?-3a!U|N1oYqesUQ>Z>mYV|ERgfR7rdq?bz3-Z8E}sQ-Fw*nyRyiNC
zDngO9W&ElZdQ>%IoW=<(ZTf0KmCrRk3bYCBA}zlpp?zU}+R5S=Ibw_)
zAd0I2r#@*)nWjO@e#Zq~7hxNCBMB}}xzZ2!V_mn2-_ztRfEY1i&unn_DmCL_8$40M
z3Q4;ctrNYgZr|q=yuQ0T|IE+4|D`W|wt7mLo0sbU=s7fW6Ww8A5^}idF*3b9oq$Bd
zh$`)Aurs=zlHSS9Y24fxqKwfrIgwtqEFq8ywCasD04^7|!Y}t?;+XNkK5@}IY$Aj&
zBO^y3F)!t)?Gx9yN~i(|@HmZvg@}Z^-s<%B$IEP-Byqs~ecj%kZ(m>D+^tLHAAbEC
z=Xv}13BULKKd6`(tdbeAz7rS4oK|=YgNY2$hX?Q(NQO?F_={Qb@WHrZWXd`8&8)&D~L7u)6F;jM@kZBlgyHuH#Ib<;&81(Vb0lf9sqK|+b1jziLirA%vGJs
z&vQ|AoA|aApYaO
z{fnRb-1{${JwHx2tJYc?O*G^hBgZi$<{cScKXc8@H6v@_NBe#X+!J4A3c~%QW{`Ey8>F
zH~gPy6
z1PSd469y?RR(XYz(1dH)A}G?tGkEEBCIsgypU~2a9V~5A*Q0Rp+8C#a)KJZ~x@5S5
zARlIK_}YN5I~kq?b~&uaBd4M&9WecLw<`UPJn&icW8NmeOOe}s-U`h^`YTv^tsVW
z?&zqK2`(a1L2nFGC!#utEz;R6CL5>=3Rkf}ded67lR7`8rap||cEwnvaWregYx*ne
zvDl&{J20rpMW`9vM2J*s<)*g~l&>sYXo?z;N@XdEMME_}-B{xK4^1@S`e&}C%PwSG
zKoXH;NaG_O?^+QzPVS=+exx+gjhO_hLD>_ij1#rUujZhUm#EV#}!{*Tu4(j|xnc0#j)>~2U?9;Dz+7dRSV1gNzhs9?0cHT(ww3`t9J
z9EY{_p-x5D52>Gg_!Vq2tRtVkPWlx!iSJ1p#MQ~oGz@%?a%5~VhI71}kXWR5n!`LO
zsKMK2FP$|F?xM4VJE-DyAf$rs(xZ7e1`un_4pm`JplL0OaC-GiHVW3$t}2St0`|VL
zU4*s2kbb8IgaVq;a@OnL1rJZ6ha~`v5!y-Z`n@~?jB
zb3geL$K}2vg5GkD{;2)f_S1V%%BIS~LL4Uc)>=zbYE7_L*^jqVsqn2^g}cP<_>4}R
zehAStWoE3ov>-sE!PFw3jMI_h6xszZtX#7q;~3I5=#_=_y;l4>!%%#=rX^Mda2%nA
ztCDwlp)coov6x4OR=g4bBXiBQF6-`g-rcQ;@$tvc|Ljly^!@jqymdTVlmWF8S2l87E7Psh*-6U~1qn=0e#IgcU1
z+mc>a)Ek>PQ>G-D8K;wtd)bB%Ajc6(w$g}b#8Kq|&@T(^uAt_53VnszztFnHF~%6W
z;40zV`y%u3ETTL7;db7mN2l}U{JrmfcZ|mx?OE3c(iFIvZ+CqSas1Y>shL1T9HyrM
z%N-*SvB-#l-L~@6PQb&l0Yr1g=-;9zwrW+)M~@%Bx&7X^zWK-FIIY5*1>iW;IkT6N
zj1PqArGtzxX`9VEhrPZ^Vuu`|X7%Obbx+FRwF=-Ec{+}fSsvzKCgxmgR_2HdEW1ym
zED45&#M*FPd1}*VtCfwLwpPVjh2t1wWX)Q&TEvMp3F79Y(IOU6tiSoIU--4Z@x|w_
zUga3Z1|!FDNN9b%aL&Q{e{KwNRjtY57)SQ7j!#vUaZIN~(Z{+d>Dd_Z;+|h6RBISf
zggrZSE;l)?;8wh152u^3(2PJJxdn&lU@H9$9I|#wC)Xk{tjJ|UOE{K>`_lUFd38(<
ze-T+^jh===lT$v5VO-S0A`)8DTyymz*`7c#OyK^653k9v^2T*TWM&Ky5-re(-EBT<
z-%FPj67A<9@QFRE>;vqXBYh*=>g)`5-MJM#^59Cb-Qed6c~%t=a3E4{(2K0~_lR-%#9PNy0*V_FZl)0mX=w2MXTelNC40t9i4<2bbJ
zGdGd9Y9ZnnM-T|wY}MPGvRgBLXug|$c2t41*N{+j|0@D5F$ot`(q%+;&7Hvv#9E$k
z+0lWX6BaV^WUujAR!B&O>?A;P@c+-m7
zbik9Lt{Z9CuS8jd%I9V#L3t@fu(pW6gq9wwrUPs~h|YY=l|nnR>C7wur9v-C{Afd&
zW`~+-At2QU8973ZEuEMRB(wbhMQpl5|edGd>f{Dkuey{aHHo7eWxXsx2X<%h+?!g4kH9~NmsovFQQRp(jv=Q^Ls$Zve(
z8|T-bWWD(0<3AZ=0&_{b32BWM%yxFxM<0a-dl1u=1BqH#n!=J@w#JwxEH8%SCzdZo
zRcTUPqf(A&-FdytbBwro#DDS6|H+?y=g&U)?7OdT&+|f+>y~cmg+_2~Q~)sgJqJkD
zGmwI}d-x2lb~)6%=w^5W%ptuoO(komu@#=2bF#=ntsQD8=8&ZOQfsL+W|fzIIeKwe
z_^G570n{uFndd+kH}1jK^81Bsx0TxULIAecRpzzwF^-KG5R~M
z%@z?EW8|U9t5se|pcE=54$yK!8nl?OtDX3CY(z$N+SF5Y=dM^eA~dVjUq^OX`y`Ma
z1ekM40S>JU$q0C$2?1FlW=5g77Ygj`PNbT@EVSbe*))a}B&i8uzk-NRhZJ1_D2@7B
z=mS=b^z8@_YI0RY$C>@-2%>k@dNQal+p3ytv8~z6-xt;GN5>ZTySkGmecABxD&;b-
zejq`Hz^qQp$gv}ap+2wX4Uwr`M6u1}4Y(HjFvC;Q;eU=Ol$Ac!Sc5D|GJgT=?=AeX
z382xt;v(5?Il)ccqoIK)+Q(F($y^vV?1oOG+O5(Tz!AN1t-fQ2HH0)u2+zbi$mMXx
ztm@FIOVL2vg&f_pr6_~tY~6=hsaRc6{naXR`MmA485$+)BcxnkI1Z^n721VV_4$_)
z3PAmL{rmxhoXLGjtZ#CklxF-RVjQP2Mvg&-dc2Nr=AvBtm1J?`szqU9dd5{Z(rGMI
zl2A>lK(B(+cB0yaG5R1U5Oc1zrsR_rBM?_gM2A(q-$txD-nHhYA)ImagvMyBOcNdK
zR#;=b{oizK0xsrknL-We^oX^h4MWYv5$f=d48Lk!m|oTK@BJ2LBgS+k4AXW!-mpIn
zyZ?(usroNgvVdf7c!c$7n?G|8ZqFK-{BCkEl9|xPiZ1b;y(3~j!04|e{95!1c=43Q
zD%4z;#Tl*=9WcaAn~wCVaZ_cgFgx2uM9CI!f59sgDdGooyQ{w`cK>+Ww(O@C2(T?6
z-E<|0pa&IAmh^uiuAEl{HE!C~K%`m!T5HX9{m3yQB6GNz-G{o7q)x0Yb|2DiO%^hn
z`w>FYx!dn(X~Y?@0YGg!VjLPa)2qy2&kUGxO~kOmDHFWzm5P2KqVamCypWwK+aN0X
zlIu*-;)*Ud{ry^{uxTfqw|?%cRyJp*aJTOj_Qf!BS^Mo7X!d_^hb2WBWG1UJVzi+g
zJ14OpFf}e~c1iC6El1Nl?TSEbXG8VRt`WwmNgxB-NG>4Wxv=TH=vW`BI$ecEhNQ0=
zgX;MlGIq`!k;UcRjALM!>(r(-QDL`l&Y$_r(=Yv%AJelK?S;76xNFS%OaHlEz_zS_
zki&60G~!Nm`EWh<<*m*>+nxWyIduf+D?GK;{pem$c#O>ew|o!A5!$CLpsZCl%IH4f
zkd3GvAM%uI)tZ{UjL81*WG!9&ks0&CO*FZo*Kd#{0waU6mJzQ3oGP@|=IJ-S`PJv2etdfT2oXpe
z8Ap0cx1~(5t2h{ukWest%qfS?PmW_GeKAGQ%D^@=!Z0@wvDUg=COv@TTXwBjKskV}
zwHE7gp47&v<>OaN)mj(?ATl&jA4B5MQc*CN%eQe*uZV`?r4K
zr+?~mFJ8VpJ$d9by0fR6Fra2zdQBQo((Y=tfc@&!FoRsL0|a9OcZcQXBDERlIApCy
zugbKw=|%|T0^-3xb1v|C7^V>;vD=lKPR)!A>36gZPOtqcL2T6S04sC*%*?j*mzLOv
zEv~{eMC2IF$AI8a+q!FF%>hQlNKecA_wAU^eqR0GQ+C0kza_2PO0M)`)&+yorM+qQVNl!AeuA~94bV5
zU#|XGsyiGQa-w#j8pyp>%D0>SbR*TwbA3)N2=(-O;
zTx$Ra3_0gztFRRS0c7TJ9I}Jyzi(}+I#66LQ$a}o)f1cO*KYJ!ossv@ez8VG#MRj+
zB5a}3kdo3YaTclvjP*!dvxa${EyTFWKSR}3<^wcGS|u8Yy>2cL(N*Px_Y>IRTK~%y
z5nZ8O$hpARKSt_p9%BGG#$g?V7DIMEWE4;>{4}&C8tMOgz-HfA___PDd9zgY=cHh~
z0>(DAXW+qN10sO6sL?M|jKWOS+R`>CGsP?kMC5}8UNqkzgk&i*x?nsGDWxMKs@Q9M
z94kc-qCbzf^t1{@zrsB#eT?G6&!dB^Lk%{m3yz*pNA?u-uATM+@`*G8(J6w6w62)0
z2i9H~(Y9pd^TA}ny?EZ3-Oc?zA)F{`JhVjwj77_pXCM_^4q^-Z}G
z%%pWS;cYPNTdYbVGxi%q_h3uAUWJ%d9&l;&%@myf%1Uq1AjxsYiSFVn?ABVA_kfPbB*_|Mj2z98;kw+(^n!D=J%oGbn~UsH`P9!{
z)Ve)4gQy5~gp5cfJ}f`lND;*D;lvoHD&F0nf97Z2{rR7Ji(JFBPjp?hqb}LR3k<(@
z9Cq@k1(qU1MEZ!RZ|0m1v`Jncd@{^RikL-=fcKH)>7;^9T&!wwRY&GYNz6;JpdFr>
z(vbvIvGlA~C?5$qtRi_iuQ@9vYNb;`L>#A7F_Ya0I6Plh0M}d~=dAOa
zdAVN^r|*652hW~=Sa|*F_G8Zinu|nLIe+$Sv9nG;#|PRjwqD(s(Rj*m
zL^a`n2i_EuV~oKGz=f{50Y_@BV-{a)*EtCMXyw@vI`l(cP
z_uhFUBcl|;0^t&l!hH0NQ`nSABGzO?9;f4zXD={sbDVtWRW}xF8EO7#51Rxu)nG>4
z0}lQ0o9a>lq4Xyt?Nlgoozd4y&Z~Z9PPcLG;^@i{ByJu(zPtU4Z~e(1KfbxC3eEQjr58fl~-=HJy1-S_MZ#haVb&{!!QM1rbiZsav)xLWdpRai-U~(0rj++BSq2^iu
zj+h27$(cuh%q-6oN|VDLZM}rG&W~6#a`VWh_HSnFW1Tig+K}4{rg*~e&bKp5fK+22-FQX^a-r-v
z;d;n8ouqZjDiTx(cO(fH)Na~>64X@JEev49Pz>yt8LSG1wk3}YXfUspZ`D1t5d$7)
zTY60)x>GZy4K0Uf#l_Sq*>>W0Nx+izD=CIopFs`h+Rvpq6uoU4&pr5SDl00Ll&di@0u#(MyZ>1?_>AG(GMyEQg83(Jx8
z4CtuR5@-Wd-BT|pRYKKvtzxZNRV+zGmiyF#`MOonBT=Nr(L67yvUX#hwdxA{n;o!x
zRBuqL>0`fExsun;{BoacU!ZI-rgar6Te~pr|H2j|_y=~}*##7a9vu9-7Mo?GUw&JG
zJdA5q(S%4d8BRSZ=DomGCDj3d<;Sd;tdMRHvkKI#sv?!EhYCcmbfK|^ev^E&wpb<_
z-6?z&qgQlEjplYwv&+%B{{foX|1Og(lQm&NE277TEbKO@12BdLSTaYBV;skk*R3{@
zIgW9p!D;ICb61oGMpY=r-k@dh9!;##33LBTx-u7wrOJh?pKe4z6C&o^a#QBrxb^|o
z46PZ14T5DMv2<$UKf5I^TH=vrJG4Tf5xQD}(#VzKt;k{SKptDTG47f@%KDV;tf~
zHH+oqcgIovHvg1nr~H_M{jZwhaz}b&k*bQ`p6N!n9*b)%Up*yS0@2oua31eBp`_z^
zxd@lml;JHxJJ1O=_E2AJNoF=8`xfpI#{bB$yC^N;02zNa%4p%SZzc@fmmU2&D(VM_k{aXldcKvpiPfSx9_P{3L^UurH)=C{B5t*SS#
z@1IRhuWs`r49UfTZr%SSy3$`$K~$YF)n>6jic4IRkqRjxhaZQsnnkIDJLI}gv
zoNu1I_4z;e`d7d5<*z<|dK?EXm)U_XA|j6@<8oO7qv1N!9JadCirUNOM(kl74YE2*
zNyw)5k>i785`MBVaPjFgg&~
z3k-MWA|loAB_c77JUz=-5RaAt+y8&HqoQhp6I39_Y
z#WiaaF+_HE&S?46kyl4^z)3?J$aB4+F-;OuwInV
zHbMXxY7z<{>g~7Ud$hkmZsO3uO)q{NV~2)7B=Y9wBpcEo*Q6ePTHBzat`JuN()JQF
zD&f8p9=*|J*ODJi;T=b;%Ej^e&HAYyJN^3K{@EO-%lUkqj)-jc@5&4bH=+}$(}8CW
zMTT83;)7t?XN}B}$C3RqgM46D*1p7ORPT7zt*srs;R`ArU%&0@kD&akxv%h@(h!!!
zO-W*mW5{m0Ba-!2VbObJ%sELOhjz{BtZsP`0qqfC8+>3BBLb#77Z)wB4XJj*VP8mZ
zPeK!Rb@uv=9mfK5ULI@=)gA2ZDFM0@GOjsPL=-z4Hd4!D09ZjRFJJe;YzL
z4)ySQSR^zl5>f;tLf%OGMmC;lD7rc(@2}GDy$enqkez?%Zdc!Xl2|$c?2{kYRXQ!a
z%48sN$e=_mX2*HGTt;I{jq$^iNV}R)16&F(Vn6MT;INBx7}c~-ScTSsM19tHB
zbixv(D{iTURABHp%qkBmMf=%Gk(+ohn4qaOpBB%Dr>YiSr5Vu(T}ff(*BP=aZ>{Nmox_JR@pny>@h+AXE)QUG+#>*MHx|bS+z7?0=t0(
zye_PBwkCxLb;$taIJ5w0K$pJ^fQ-3VqYg<%i;==8OeWO0zE{GUCWXmhx0N=Yqy;*|K!p
zMP(Bb>g8gWg6ux0j&*cDI0E73XVSii>JQWynUQO)Xp>t#Xfw>cp4S&Ky!vVz!|J+H
zN+16THU@30M#6T0{jm}Mf3p7V>Gte64#YC6);_1vjSB%n1VDl$c#}A^q!Fph*fI9J
z_{9;9aQJ`r%Y^;l2+ugi;~7h1awJir2m)vT-RIkDRrw*a*8VtdVK{wGf8XA}%UZRn
zGPAOP>hSRK8{dMU@Hi)iO?g6`-eAo%9eSpRl1p=1Dt~4ipJWAq-qOmRlfei3hU%h?j
zJKy-n|L`{r8ES)1Zhet9P8QWx?{NBfKna5bB#(I*yW45qhbvOm2jHv^2f1rd)!ohg
z?7gSD(r8wF+BEIBFGVJzlfQ5vb^t*N-)78l-A;-z;V&O@<>}IpRkuJZ5BE2|U-@7k
zIY_bhIhu^(N7UHQ`t)gk`c#Gd+n@gIKm7Z@?EclKuYaMFxCir8RydDMv2^&Rn}O&&
z1YVL54665P*LwW}g$P%tK0I_zr$r3_QjPuh>Fwv+H$Hwr{>T6N|MFk|`d4qCePez7
z^{Jj#WB^9!yU}X}0qOb~KGj}X4*HyZ_IbW-7+!I&{~QNp!I-$THgOu{daPVgLt*JH
zOr8Uy%Ub_ULC+1Ae2M+ZnwF#`(JTbHtNL_6JbXt)Z5f7*te%YL9^36Fe4_{7Z4Ldk68CtY;3^gATRZE?cFY1
z0~!D#KmL#Z9cK}
zuurRv^s&6Zqz(QTfARZ2`r-F}{_|h1$4A`09(UeM*n~2BIz9IpWRIP5I
zEe=O`7gXA{gM}~*KMtKoCLS*eg$^S5N}}d^6cWS+Gh=yiTVqhFE7~JB8em3bW;p=^
zW-gjIA=+)Tbbg*bI(~Ij3Lt=oDEe%wGD&MXolZXhyz`Ksl{>5@uMLIw&nWh*LvnZY
zsZ(W7a>wZ*<%TJOmsa;VM_61}cOT(ME0-;-v|gOES^Al@wWv`58v4AfuyY-gS?>BN
zJFUR|bef6iyj0r1(*p|n6@g^iW=Xk5?R&t|RAHbs=cdWXNR3gc5?XSQqf7!w?%V5!#eTcd>3_mz#FbwG73
zb;x%{;M#8X*Su$IwJIRb^qS|u7fPn+pqJ4-x7GABufZC8XL_#Q&D2>#l*X;?>Ov%t
z-gu0#ybd*~h~t8u+_7W;<<8!2c56-r)Yq$`($7;iC74?l+XbggbT5E$`gzNOaq-%G
z;nZjjFJI7{R$hnU>A}TduGFmu<-R_o*$WE5)F*V?Kn*H|ZctOu`YzE%>g+29LY%V{
zhUE>L3fgVOEzR2tHJIHo*D&mUcS|#Jg-5{M@E48p88Gb=?LM06<%n2eKSx!J+>1yQBb>*R5o&=6BdI#rV#aFg
zE==mfTj>Q@=}v7lbt@6AE*0DR)U)lusDi4hcYDNv$|$csf11BoA8+P1L?>`KMi^{|
zC1vxE7nSy`{Ls}7qQ%&@KOm}Qa3bAsU?5W)Dh4FUaNWvahSQGO(^H;^Lztx*=(0o{
zayx85-nsJo@q_K|Gw_K`y`U0K-J6_X6gELc3n?s;xiWI;l-H`{lz-;@sf@k{ANT6g
z8}~p!sqL3}$UcYDG4484>t
zIwtYC8)ybHy%(D3;dL3XYc*zJSIN4C!?VR=Cf71K5@CL+3y%+JL_q1{QAws<
z>h&ba);Xx%Gf#y85Zni!KApEGD)Qg{+kgLyzx$u}`9)-FS-8_r=SbYGr^aJHD<>Ai
z;m~KZEjR9azPnv-W`34Vc?Gl55UYb(%uo0&gwE^+fp7lb{;&V{|M{=}>WgoE_V$Lo
zkpss<^1r}ZD_43gJ5ThttLK?PNV%V?n;nxL59v`)kZXA%>N91NrqeJYmH?JrllEzK
z>ylI1iTut_70N?mNk(8rguL}r45~wVD}@f9)(nh_*ca~r1!}%L)u9IDBO>~%uf7Jr
zut$A23is4~|G*uJZ1gdln>xH8QWtLGox)YG#z~HzX66!~5P#3;G8HjQER@$9O-Tfp
z1U`KD;y?Vy|L=eLkN@$rkE@)9Fnv1=Y6|g)0(>MVS`FCUvx)-jgR{?-wRw%1Usv;C
z>t4E>8L~N{Q~Uz3GCkR-`|auWOD!iIbZ779-qoiMl>KXzv|=w@$cfqOArC~z_H>Q}
z+B54{b}r7jQ2*o~{pg?llOO-;S6^j*h*+v`!ruFml8VB|=s$FFhO9yGqD^#U+5|!z
zS+|DSD&Pp+o|6XdD-oT7se*L6^$2<`A;JK;eo%y!!d&aI#z>%VJ?S|n{
z22Kg(^aa5-(-@lA!H7oJJ`r}9r%T*enZjGikkL=~OsIx@AtqsFE`KA>G#@;M2mlW0c1dWuVnRd`6vb2L&J<8R{GvYdi8!f?d#R
zI2vR(x_N-?NCGy&0}3p^M|OBs%lg175NRm~FMukjR_k0(IZVJ+Q)mfw%`m_AO5ljK
zI#AACd8;FzN_Mv-j(cnK}jBYx~hAvl!4ZuJ9r&aI>c3VM9!;(coZER
zWFVEU<@DxR@T`yVoK@k5jgXg^bPX4T(1poIs;c_b*~a_AQXsy7RF`6~OVEL{X(cCq
zOpP%iv?SOG2}h+w5>`RQ9NKZA5wB%`rcpLWCvVG|)?YtzHHOO(%lpTrjtZ&P5_cjn
zh5b|^dNrr&5Wyl!04g|s!gnusQ}{@ovuj(&=P<}w)NouH1n5FD7yGEHWaMP_THBiU}5wt1_$45Egq-22ok
zQiGi`J6^G-<}>1G9;`|Ty4itptn?nU;Tse(rKmVH773KeS2`@|Cv{q>W{#O9U>g8o
z8t9hm0JfRFA!c3O!wAG+8EEG+eM>G}=6NOv4Q%Q4*ciDy&5Du+ey7J0POIiW+87oY
zYGCjy23QBmd3+@uBv)jgKIceKSH}p3xk(+eYUt6m8Rpa`Lbp4e2!C(Ht82W4nxEmH
zj5UW~f^JmF9Wf`FOMxKAJ&lGuX`lsUMx)dk=$5V1-Fp|@|72e!#o`+G>5RM?Fe0pB
zi`h2jpJi4?Be4j(Yr^{r&XSZs)0vZ>37ri|@??C@pe1ba(%oRpMA2@W@oG?mk^_TS
z_Hl8TQ8aG_#Nl`yt_)sxl{RHnQ|3E@sEO)xrmSqiSfsV_?Wv~9FsfB3x{fBf(Npa1Q@
z`S^h#pSy0LmpngLGI*YzC_f=?!hkZ})5@MRlXT;#rn4%~+f`~C4$4awRSk(2w~hTJ
z`;ZYm)l+og!)}7dEo|kL2MB;XWe9L@4|lC9*{P@^(?Sz-m$~Yc6kj04`AL7EQ%pP<
z*`GeW0Ufc(rSnibG;Uow8)NpSrzC_-l~sK*GGoD_
zm^sXVQ>fEwXF66>P_88I?(W{FB11;sihj?!XWoX!ti
z?3HGUQ0(xWTT=?a`s(o;;9nwhUA5~R2UE9hcH6~%*3UUz
zr#!o>%$SyN94SP-DJHbP4(RSCG~}4nIL*1s5`yTs${9k|lkZkHGnp(kGwas6Gn@(<
z2WY$?Oa(e?sd|?O`OZmjk4q>A^+7={8DDi%+^I;cHrr|q;gI|O{dUi-559@6Wnrcc
z<+1=NLi>zt_dR+ADz@u5bfAM%Z#@WsaLWCt%6vYO-8PelnlO80B*SlGD#`gs4-Pn<
zm}rC#b4yBV6@jPH@w4K{H1tpm*(eRrPewZxZvcjSWY_fCYZ#jz|K*^!^c7Y&qxrIf
z34oJFVHTNQ2!<%_*Up6ugQSQN3luSrWH2U&(Kc*>F7AWD6THQ$4ufb0LdaTmXSk0y
z7!lbcs2z?(vIt%WC9zFMM$hibR>W%HUUtXTJ8@uR%!M=tbabvIarf|z;K~$EDdi=@
z$fEGGB}fAdrXof}+%ie{g%TRo^AR&|aInEK%+e+t>oDA6aIP%EHM=P;7(Jr6+pFOY
z-=FvHy*nX66j1^y5w)dfj0#uZ1%E*3$-^9}>s?*D3E;LK&`+;10N>;-V~S~cw>P87
z0n}BFdqwKa`GyrKT-3zeGCBPyj7xXxLxSTr7P=Uye3c7hR&`{?eF!=~=GFL-l~sb&
ze|;A_{8T&^EL!PXrna6LZ&9XY>+FGW^wik2i>w9$0BRu*Up%H4S+BnanVn0Fxju>Fdfa8a
z!rE(Iq~G0GXw0}*uWD7X;XP=ik`t{AiE?_cs~M4xeB}D{X@B_m@lXEXyWe==>o?a3
zKVlE)(N+;83QJ
zLJU55vjxS{|3#1r-=3T3+JYBEMw4gnZ+!6`@@N0;|KtDlY1cQt8RuC5*Mr{6>BYt|
zF^UY2OLg%}KceMhSogyF8t6fhazK;JcnW@%Q#5BZ;aT@3YFB4*BoUn%j9lxnR;pK1
z+dY%$o|$WweCs-baELb~5$(CtzWQzyTiIb)maN(v`)nXy=)N4buZ_G4gG;jUT^!+T
znt`+%l$=UmtdxkOFtV!MmHWFTp(0LGWcBw`d;yduNgtl;1MvK-|LHHQ!C3n!CWX#a
zRPTK>dPoONJ0OjOd%hDup>xS7(Pu|P*3CAv#uULIpU?e#KII?7J`1Vo{~z9@U>zO?2^W?MglZXngfG0Q}2;{s+JF+duf(
z&%a!ckM!#UnNmhwg-VRmK&vIMPZ^QqyHJaa$cQH86zJL4_YEa{P7$r{J=FUYwtJ9>
zDl*P1jLYxJr}fA{SY0*U4#pyfG>B<2eHD5BCCVIXmIuvg3=!!EH%1Q#)G2fgu4_s<*?*LN_YHwIqbeX5>mrT5~UqH`>tuFXq7G*je2}c>*F;c2Dr|ox80``8uYm
zoUsT4XL(+{Pb=qeI!sB91#92ns7~ruS02-b|3pi{5#e9EeR4kYpt%q#_Qr|Y?5208
z&sccC*aZ$f0z)ZlGI+YH-jQC;H6@i|G!dYjz0r0;5t+%D49g3UM()B}W=JQk__1c4
zxZykyjn1`HLYJbSHE8XF$#GgVke-Ii-4{}Umfm|9%NDrkPY`eij0=M>BPr(Al&_M}
z*Kt}kX@;15c6UuxbWiznlaNMN9gn1&v=&L%nlyVVyU(PcDuzN4%ch
zX&fP8U^BW4!@qkK>o-!V>A>5VzXy1Z%mU^;0yZrgm5n~D`Z#{}-I8_Jj|!{|`6Y~`
zRz)mGK-!A1eM47w>U=~`hAFj3Ob!<6P{nlz(E7pa@M<(@nUykX{rl@70-n4Vfzy4C
zdRD8uy(k#~_wmRgEhX9CNoCnkqXqzeU
z=u9Cr^Imj+V%D_kE^5`?N)N=bBwsn97G4`6(He1tR>_Y+_OwplKPBgjLyj5DkOtjI
zkkm68(*bYBKHZzcuinNyH()>qt?E$Vf>cm{g^nTvHr_Q5wGsEWNX>T!8fsS&xKIT|
zYXdvIk;7z9dkmmD0%&Pn062X3DUV_lBw39rKi-}!+Xt=>Dpy+0@Y^|jMt0E?GUsK<
zxTUY39^C^rkGI>zgieM8`qb7k5vXQVI7TwiY~zcw?5u;*!#^#|z_@v-CBshC1zp=Y
zM{V14ghyA)bJ>0geH!W|YR>6W%~T0mUhaOp-r;_Nm(zRM_BaU-G;5ynX|$3QWl{o~
za(=~Wbhk#iLMND0}3hu7yFb0{w`UjEPk;LJzy0ff
zD|`TgY43^vyL+5GeJ(k#ZJcv1)}wIouG_`G3jj^|rbZ-~hSilf4##?z%|y{aGZ_pG
z_7sT`KyZER&j04W`S1SjZ+`yGZ{|J+U5`YBDRHTHZqJ14(viA=UB?whOV7}jqUog&
z5i3)3adzo4kKp9EftV7>NO$
z-Id!N%VPr_{$(Lh7p!h&=6&3&9L(-ur%=BtOc<#t8iA>_X=J6nqn#<~b!0mrruPm2
zIU(A?z6X!nRAZL64&2#bdD%;
zGNKzt+AB*sxzE{qYmI67iLEc6mFTTbO*}UmSg8r*y$jX#kN@n)|Li~i$lm>WluE+v!D#BM+lK%0CyQZvn<4c9MuS9-zFoF2bgBl@BDksT
z<*gtkDy>+v8FI-$?G-ka5Ois1{nhDBJ;^d(q{hH*gTmU8wh^kXazmmYZjDHE(zrgS
zl*#lfd+6cDNU@(j)6pVCVz|L6F=h=r1=;6xmC)a=t}gEwKaC!Zk72oT<>14x5o8C3z^J?bOFaJ!R4up+cNn{8%s9*&!-Q8qvSH)3taeE3LjU>zr;>Tyd7pB|T>X{W9L0hv5UPZaX*K0m9*9%LWNmz`n%q
zRAb#k2;m#=^qE-MF(1~J>ckDGb!jnjS+?^t=?72Og(d*?U|{QC?)TCnU7fYaHB`42PNGc
z2nvONvBY46bQe8s=smhb;7Yjzx{7eM*Txh=bYrKhN8p
zn1+dm^DP#jlX9U{00_&i85cZ!(HmOxx4v@n;P_>>S0AV&$~}tCC@zSIiqm~)5C-b3
zJ9Q2R$Z_J@tr?*nTO`(^8-0%4gOxj0djRZ|!yI6%-NjU=7|7HB&nDe*({r}y4B^eA
z;N}WkNeN8VMy5*rT&wErv#sn9SnHba#%8?UGTI>Cxg)&T6<`(Qk(UgOB}a_yAgvr&4?0|tYk8KBx#l?nyEL&!McwPF
zx*;un1G&_=(Mk#9VaO?$%4%m4GEmiTG00?{MqxkCe%9XATz~u1zxn#tfAf+9@bASU
zt#ii?cu82xjq(JDi2I1mNE)V0pOyq8TNbhT!SBT($$+ikhRf-M9Sei86u&YT5Zx6Y
ze&c`mfB&2R_#giIi!U-0jE>d0yc{bML*+>8_R8RnNEQ+1njoXUKWJIN?6opttyGcL!;?(>M3B*>($LET4`QcdN?pps@83w}^7XY@<`C59n6a5{bq|&3
z`Dh(YA;}MevD#UvsQ7`hB0yw*_Sb*?Z{NQDl#H5lE6tGPhYufets7}A{&0%mgGg1O
zB1*RhGXbqWP)b@no&c?hWg>v&P7D<4`SyIiJvnDyILVNL%M$Hlan}Oze7-%O`?_>zx!DE>C>lNj|NSR(hWg6
zfVM@+490pqB3DE(M?MC)IPcSaDD|>)i+lFJvJ3sz(Oi+cLNuwkUls=A2#5(|06lXa
z?t~oL%3q>bY_b-wB1Lfx%>sI)6XwHjSvczojs_0Bh*6#C(<4GwLr$&~J6}Zv=4hOv
zHiP6jXP>7z4JEC_uroK2b6Q;O4GW2ohCROEKFo}95H=tBDy1*N2NyCPn!?&3vdIwxtDI@5_G_Cn7p(^9XqPs^{tcOvAWNot10jc=2k@C-5I93;YYG6me~
z4IHq8j1aI^+RzLVeRxyMS
z_{B>t4hW@;JXA(|g(~^w5u<07!br)zR7r@9=ozswC5CB4c7y6{BBjf@McPe}+UHD6
zkTw>8LNP`h>m_|L$JeGbnpfzmRH;h8)Cz)cSe1
zC8^|+6Bm_D(R)L7(U5$ZQqK=n>}T`RQsJILxF;C=IvTzAmU9ZkDF$Mtfy0P&o`cNj
za9k7Pti%GZimgLtT+{VN3+_(bC`p3QbPxKP{p)VHIyMhV6~CyaPZTHHU{5QPW218>NyRZ
z%nkt4qhcXxg3)PCUqt8y4OJZovD2TmN^IdRYNw@9Jk@>rf-cjRE(WvpJ|*H$CIbAg|nNAraTyuOCkt$kwGxNeTIVnX{^Sig0Jw$QW2v8;4{dtnDe^
zW`JoEQH2VRn4;8Qa{)&28(UA58E?Dx0=!2j$eZi_BA+}J0n8KtBmzMmaXSJ
zbXQNKn{rmv+}b*TDnZ!Z9qzkOZ>MpnzHR%G3M(ey;(6z&sjBOop$8(@0z&lQ>@JWY
zia=Uf2bXs|aP`zmC=Kk8QbOK|T77nrS5LA6SCHV@?Yc;7CKj9Spp^xOLLU?b>Fxl@
zG7I~hbIwnG@7urq!;fd5OsY5X<}H2y;I!c`D4$wlQ$sDq7?heg?Siukd-vWdbx3k=
zcf`dA1R|)%DLh1ZPj3ll@O;)jcPlm+XZL;sVD%en_lcsh-|Fqzd-vND`}AM``@eebU#I#sBCSjt
zcvgIo!?5yTu)9|VIt=8D#DJsEYCmigY>L=I_vInLL?oD2RO%GS)mO4tqwwtXG4B%w
zefAe$eD~k|`@i}(|K{I)SorWL^m!!KQiE5gB+zF(^q?hQ(s#O7$U9PAyu#@xPk`Hi
zcwJav&loXA0$I*R7uG|A2dlduD<6;bSZl2~Te%mj%Do8fGD}YQvb}YM>9c_6P4&Nn
zx|I8MstG&LHO@JOYOu=n4~!+WFw;Veu{X=KhCq9Y&z~qq4p~}Fss6^W8xXOkhP9DR
zsupdJ^-Jx_?u&-=RbbE-6w?sr(Ti1xShP3QH~!{7{fA%v;#Wad*C`9q5}Qzo&e6fe&yg6omp{!8t8mFwqpRRu#^I;exg!!jcUVo1CYfV6)&yL9h31rVpg
ze5S7dDN)W^i{v?Vc6H<9hedKf51@HW<$yozO3#_Pckk0=XLN&A{Q7GG_^1E$cYpN5
z@BjR#zs&roW!v@sXs9kx=va{v+BgxJlm5Xv=&sg44hfEwl3_~K7_Q8#q5;Cr{5ss6
z#FnIjkzVxbiM@9Qcs+DSGl+56owEotwX)pNa#@ddE3(cj$~^>tyU3BDAgo;Qxlygd-O6{D3&t*8ygLIk
zz%jX*l>XIKDdA6P?w67tp@tW;j*OLDXf}A{J-`Th+@yMU5w;d(gxWy1=Fl#;eJi%u
zD_CJ$BRC-iw3eZ#h-)pft>@N7%XO#S#R8K86T$093g}OYxcso+X2Xx5uUA8N)h3Z^
z>0~;dJcW7n2*yqAl$bVz`<$*i`^*uf87(Rz-N?=>;&Ua%t}bB;MvXmEST|F5DNc9V
zYurH}t(5LYpQ^3Ic+LmT>O`Fu3@!dMm>6xZI)r*4@7eE$@-9^k?~Gg2n+8-ut1X|L
zZwwMF&%DJeOYI6;j23e!-`?S_)2^h-_o>l!wr-
zxX>EC(37sK?hN?+*3!kh?f>FzO*Io131N~;B`5wP2cvOX7e1OG1hq@9K*2^I^sYYp
z?sSa}aH*|q!omwjJgpT?rkk|CbGh+C)X-~xDBc`-T>Yni**C3#4L
z9#J9KL)siUCDo`QTm$L$%oAC$ALxEQpHBXRr+kNc98#3Q`t@dnr>Hnt!{9R3Z_w{y
zlDWz0hv{iM2}YB7ksgIAmBS=Z^P5-u4F?Ul|7S3@`FiEe!j5SM+DAnUj`jNODf;Ko
zf=1;wM&4lLNhpTXd)|mOKk-7kIfyKQL`;{O3wy%Dy1?od!kvr==E}7m4U{Lxnmq;Y
zn2UDe13=H;BFmC8w0ty_P5?)UX@$Kw>|^EJuLCRXB-wJV%UFF01dKV>JA+DXM4^(Q
zlgEI48W~BPvoWvI%zYc6#f63R#%9my-Yz%m4HXxx^I;kD8ua5dy^qm`NS7m;Wpcvq
zSb?OvcT^?~UZXylF!&m5^=Jt-jcg1^7T|0ZF_4TQPG8H<+l+*q0!OX$N?BbE5bz8%
zIhv4Qq|gHiNEx~01Kv2ondadPV6P0;cSMluv7TS=j~~`Q`s3gH{NuRAzBUdWjJ<@!
zKby|y(1ya+td16W1%)A>4LYqdktYs`{KdUHepo6tm9728sr(ZWj{Fp(*;DPRkH<$T7sl0W+M&alqAAV|~cl!Y86m
z7r3kU>9=P$;_J8l*Z<+)RyUnqOzg0;qV}~tHWbr=4u*iH;Mi1Ht0UAwxFcW3GKI9#
zE*;)41Y=w+gN(J7I6zr&TM3RN^erS;6+Zj?i-TYM5C7f2LE-Z+0yvqy0>O?%1Xspd
z0;fAxAb9GWqw9xKkqmd6>~nO08`V?o*MNO%QIL~=nHC{Q1c%MjoeY<#4~Z1s1ougD
z8sq0DNP90SJX2l{k6YYEEM*iO8G|2F=~va+d&9n8nE&zP$K~bCB^`f^e-G&H3XuC8
zysmZ#bK6S}=H7zh4S|g{NH}1H#kV@tMHkKI@wKK%TbfBWSx
ze!d=|coFF}Q`S{B$MV{2A^G^Q^ma4}J!6TUqiKIcdIQ~Xr1zMa8SdAZ((70k86Icj2tya36GGE#y+rWOe^%
zfAWKW@}K?Am%scaGc%VGCWhwTNm;LqDtcau$^g;EE;AH}BRL&Y_rdjm*^?q_!l%Mw
zs6*Fq{Inoe)t2EKp`Ka}W_f1BnPdk_Sf&J4tL7c4>IDyWt^|sMuF+_o4f*4mK|te?
zbnxCJOPM9QHPrMz2IspvC{?)Ta?`6;DM?Y{a*-g}=(Uzk3Fomd#z4KJnYr|7BraV>
zxv;P`;t{T6{r@Li;|y0a+bl)wr@9?TX5?c%mS*r$LrS42FzK3-`TLSaIzpogQiP^9
zCVJ#{DpUtAr2qQZ<_LCTzse9bPfD}yWMwA9tBipeALFSvZT7TV(y-@w(i>j{D}tvp2c
zc`ZzpZ#Z2?!c|wXGLfeDKe|B=xtJ@2QN_a@@L)|8?;`G|6oLG+VA$|%o*)2J
z-lhiMN5}!LrilQqE2e~;2#Tsh@cG=`(x|Im)nPUvx|)oV^^&Je%5Vjg*(0yUFGwb1
zproj-u8x&t2=yGjaaFf%6?zJ6akkgOKnrf*s~Q*sXhb`3#8h{ZwpKB7mO*Qjnwq(4
zQbLOSlW+0_e6L}ngit9vsTGayonm)r$_-{zrJNhA=kcx;P|$^NN2ULw4_X&mZ?!e>
zT2Myc%v|PE-m5-66nb!!UZ~%-6=L0_;--P>w!r=F!s_ZkNSH-*#1faNlkbeEy-w$P
z_`sb;K9XfI3xftxg3K`P6@jX)v$m{O7xJYOZoo8u>fjnP){GY$^i3RVoNh6GDp3^!{*&drTFXZK7#=s}{DR;ct9BA~6YGQaxz`K@n$
z_D8?>8vyqB>gOnbRM>P)h8G>@E`_Zz_;{JVJ{)mxr?Ip=p(#4FGDWQM5gpc-oL`UZy8{S|-kg
z3%4@bBAAanyPG__8mNZmsP9kx_NfZ-)vvz(>3{m`F&!Kea$~((5IHd_X__w0Sl=H5
zk6CqBCW7*nd1o#%Wf4cuxUQExo@n6o(V`1Rcap0SeVs8T=o75d5g*X?umAP`^z)y6
z{n^J9N+`}5KozR$oI2YMrE#?|YAjS3A?wtBO5y3!PBmP?1?SnNO{-oT?K1VT2}?P<
z%0@o4PN%!Jl4@m8!`}E9H2o!yqAJxL$}Q!SWP@1;Hg&8Kpazp#oi0A)9hFyA_~P@A
zK(IT48LKZ0?5tglI`=-jXRF}UuG!(%L3{roJuK%G7;gMSbR#p3syUcL)L(;$)r}+6
z5?8p9R4P!%t&ERH?O*-ffBM_CXaus+-TUl@hib@_yShor_N-2!DuUHGr?wutvoaB(
zRn>bROBp3=0a{kH-GW5wl#I^KKI*DyKTI;RW{}Ra>KqX@ep8{>xA%N4_O7>2PlcK~
zeF>;4>@swy^s|gxF?}PpJ^;_g)B9qo?6OplaVU?bw
z7JhEI)Em+f9*xV3#f^Rk)hJ}7`T&(VQUCIqR}4>4H7i;Odit(bFR4V?a4=bgUBg9d
z<(6kLnBD5G>acxnoADU7P1-23l{#gH4#`uwS%uSnwtr`RZNOHsS`t1
z9e~FQPQ|VY&;_Ppx_|}{2%>%M!D9FEGitpI!}2#JD~C-d^EDH^eWm_ur7c5>H^{C&
zTgEn4I%q>U^0cx)jnM6y@6odwRR}IWOt7l<=}FzY8da5<0FEcFl_i`YyMuWv2#JH7
zgAPGTT@$H35aZ307#VjFa)XIYa99k-CsX#(#L6Xyeeqf6Y{9ysz{E8x5yXU7<>}o*
z&Zd{k629JNON$V8(v$8^Y8=b(^z^i3A`-2^Gb#-G)H&xU11jsQZ!s*sAi#JfYye<~
zEmOTrgHL9kI8Z=C@(W8a>{#m_6-Rj+5q7uFn8CB;@&fep>{CbYN<9Q5>G0ZKAvrcz
zXuHM2Vc9haCa@OH5oZ#8YS)3i2g+Mn^s}7tI~{c`7I
zLVl_>pVdm(LPWN{0cgY`g00aUfe4+aPCa#r>){Vn-6Ha~r8ON6kffARnW4oH8Fh-uy_JS?AMDe61I;gg`Q@*^{JR-O
zH?aqLtp*-4mwP2hp}e?DpYxua^)#me4AgdyVJF%^q!w$&jLDE%gpgn!@NvsEaD$?A
zfT2Nrh(vt;m;dhH|Lx!X?8C>0VX~kcj$sn}L@Mc!TgZ}3w{)sl(JG^+SpgF%A1l;d
zr5@mj`1slS_;IZjHQDhD4jop+Ho3}r;+*0;A7D=97D3e?4L?f#3HnBX@R?!z$>tYdJ(xAx^UI4c#b?+8EuoPW0k``!}-R{)bM8`1eFZx6*;OoEp=}*;!jJd&xAR|mbxtFyYxl$ek
zk=c#6x93Ps6=ed@5X-Jp+FT?fvrnBW*&_v`>+&kWAs-;K&7OIJUPl8obZKX*Uaf9s
zvNQu3%;+#+fs}B1!n;+$FzZ~pcL?TM3#uyL-q4Ld|MTDd(QkeC%b)*zt&cg~j10qw
zJ$Zw=u!Iq4+4>*~VkV7eu9Yfrdk$ybIx~eLfvBV1+GRwp?<7+3c1Wpnx%BQVdI<5awI*^YC7&To1s?g@>49;Py0Mj%a-q2uSsoNc}wTv1dWhLz>rII8w
z#PQ1YQ^T1Xtq4}NtB;oWO=Pd~f~2;d@UE(2-%kFRL&L;C9hDH1a@nuAbBWFu^f+0)
z&IZdEvb*=$N9|GPs^s9rMnG`*q|OMG2@DQ_L~GN=q@B}6rxgLYBaM#@nVFRFb!0@k
zwRNcXaGLGwrT9D1t!9{HM^97j5|=TFq-VrpR5m7KAuQEIsG%$})SVxhJ~`Z+%wfO5
zuxCLytsK3w)Np)l_^Q^n!k~N7AE_+V^m1K!T{#$>*z>M8KY(}FtRINiyY(CL<%OIe
z?lTb(uL7EmIwC_Rx8WG2NKG4X>qS)2G>q>CA&~1ry<_K0Ix9$n(!`g@i
zjhwv>X}X7@`y%uLO9o1q$vKA1WJK0=&dC+&sf&ERy`3$v99`w~u4})2I>z3axpdm0
zyJ}aJn&wGg!iB|ZQf;VV6n)pV;v%nw9Y8SGLvc_SZ0v7vz%*!KjA+^p{HGr6Ky_iH
zR5~EhHosrFX#0oL)x5JjNBLzL_RHPDd=Ey=8|F#OzmGD`t2|R3xuh{61Z=4OQLP)qBKF)kj@0J^!-XkY>SCwe&HN
zvdCB$fIe$Q={a6#c`dW#B3qo>3#9E_fkIV<=dfAk;xq?Zheh&eh@vx$m64CNdSGm$
zVC!oSKc7GT?Qi|gk3QSy1f3q4vi<-2
zN6Qqjp`Wrw-HA0pr04F!&DUCPHSn!GUhA~7F;7PAX2=XipHh7+tx?Y*W~qz%JI9{(
zQeo&JsXWt}Q3reLgL`kohq*4*iDNF;!B=ZZP~ka8?XRNK>mZY7_j6aQkYh_koUIm|
zsO^Tj=WZZ>_Vb^=ef^8P^9ecqGr2%_dcZ?CYa-D72f^VdQv;1_&zw@7@nh!iSt9@e
z=~<)6jBKRvVBuvwJgBQ3_%N00hoC`1k+rZ+`Z7KjQ>z@$w|sLIzhZIaCe4
z<_jMrP2w7?T=MbjlEtX^H_#}U2r%m87~@+jr{jI~hYtT;(`Hhqf(i8AM-jZrz1zzA)r2*4;}*3EkMUTgBsC$9hD5=Qq9uX30EV@IxC0_5)BCvCfm8-{jD$
z6G)US512VfXv?xgtU{k5McK?)Du?L6+x~Vy!b>r<7EB>p(moP6Kl}MFGKbYKfU#CO
zS)hHex_ahZ2x?UN-q3hew_2GhVLymHQ&H&cUEz3(vek#O91;SvDombFs3jf~!ON3-sg9_Pxn
z#+!r=x%ZuNG=2uqFQ<2LL{gZ-YYu`|lp~vdBkoXx+cpK(wmoN!<3pDhVGRCR1FCgR
zkvAKboSAinT^))$n|
zd`T16nyIF-)lIhA8g=cim?y`Z+@xFlP}d~}{4dHG+v7GSB2KddH7&f#j!~C4*Mn0n
z-R|ecK=Z++14TszQB_-ojh>IcU8lwo!_uey9Nv+`5FjH&M9m?myP&4=Zk;p+FWy!B
zCGboy!TQfh-6S(`?GL{|ibKv=ZL!oaT8^+&j5N9owK%Lzx9rXPi4L_o1Dpv0&J5AV
zRX$anX%knQrw!yIR~045r`rxgk42@j*z)_WD^o9KSWayX#gERlw8b!z(#T7lT!cH=p9p3myDWw-&&L(i`B+;1A?+B(>Ql@XU-
zQ-6h$18-BG7y9nudWm=NmH;*?LbDqs=3KmuZbd%o1~xEYQOsRoDo2A@CRmNcY7hH+
zb>wguihF>Po9g?8RR`u;WjWZ4P^$Xeo3@a316?aU02*=!MWdOoo(e+X
z<=}I<#1%&bXiK^li%Vl4?hDn7wOFcc<081W7sjxo%7w7&NGXxI>J%h>AsLI~RP1DN
z&ctbd6>ufgtJS?9YTh3v=bk+(Y|N4|;1g(KlM{bV^px(we2doN*qaJHjmTKT*w9E@
z#dTeCgK-#byMUWfKQCL=N+j5bwVu!Vkom`d_#5B&i2WSbR>eghU|!6#k(HTw-D9$Y
zde{6u2?-cLu*w=QWiM?G**_S;{U%R50?t=6nU4XylGmlF-nkkMZi*IhplW350bwg6
zg}}w83{58)sB=)rrJo_GS!6Y!yJ)f5Yk+=0W3Pm78z3aAY%ayfpZ?uX_x|dU2A&Je
zXk(p-nEnMVv%bp`Kuc3Fm6uzqEWN|93Zmxdh@uxi$DY@!(;$*wLJTXi?(dN%q&k9$
zst=EE{OspH|Jl#KR0zLR0Pi|Q-40&LdZ*gRG>8O4tA>+)qYLt+-OueexJy{temh&j
z&|y`bTG;A_#28SIu%a7%j_yl`s&ViJ*#WN1Ts-GIpHD-RwnBA~_s+dhf0&!HXaWhjO7Z?e9!D%ww)JYzIyNooh@-EZND0}XcW{P@5xz9MYxf=9X6GC
z4cuIyp15p99_x6kuj{Udpu}%YN)pGlgMPph*q+zMH>#IV6;CH=8
z&Z(`O{}opC4MmcLv(H8&;z74O%v?>OqOQCnz+6rZ!%Q(ub}3Vtf(JT=CjXp0*$fud
z;564j=d$-g=Tz=#Kq#OKr~5GO@ouEggs~#(q!Rk7IVdD)agXSD2un4iG$eYk{^7?=
z)){<&?m0gJAbU3HV)$y|YKz#_PwNWEhUtv96abL%c$p$LLERQe
zr4PplD|W-(kyO)-lS7r%qkW@NgTN>fIl=QjL|9Nnz8fsfk!b0DV-6EPocRnVvcG<1J@2Wbrtx}IuN6J5|^INJ?=_Jjy3PorXaQbK-P!ou${QSO+upDbf%uZV-
ztvR>OX(e1#PGROq|6(GE<|NT2v$6Z0y3}T8rH2Q5%o#o~5)5ty9WQ3?Ab>trv%@Te
zH8|a+k&j&^Upfena95k~DwpJAnOKl>)#>goqUA(FW>>+O-$0=*WjckE-GtlysA^2a
zIi*6bPKTtfbs{*_x@k{RgPR1ERn>6-g+O}0>;@uZz-Z5rSB=^>Yn=zBp|s7F3+_l%
z!wsxY&ZRn>M#*#!%InygMi
z1gxG8)2I8iF@7ku5R}jWPZhdT%9VN6rNVXsu+Mx0GeXNmd@YeD-DD_4Dy?KP**t}a
z{PgMh`R9+H{P;Wi0bY>Is?P47uC{hfu6LnhwABS6blh?SKMOx^@+}lel
zATOSlSWe=*rjqq8oP%z+gcSh05%xv({FBE2sNTp({R@~BY^P-@KFUcpdthnoZ3IYg
z)sX#!r&b~YwS88csz{F>MWaqXpH-(x{Oy1G4|Sd}Xot%x2xk!1DfO907%
zgsrM;oxVniujUcXAgfx&F$zh~y`Sfl2++|?>}N${sS~(`fKsD9&N(wbz)A(D&8NFN
zme2~Qt>l!Z-jCZKqu})P?DO_~9@#~TJM|0d9+Ij~5v(dV)Oi&R1Wk%a5eNCLZ+)Km
zvCfW}PN{VZ{YHC_s5ph(FWZ2E#X*>Kzh7hk3Q}@3M_s20ifia{(^^xIUA-QOR$Jgz0z;x6
zfYpTpn>9ScG+3$!)s>eBm0Q5*?xw(S&7=3zI&DuWtFF`NKKtlhclYzHpU)<-5&=}<
ztFO_GfBv8U5;7uSS9{CtZ(E1pqhc!H8
ziLVE{DjZ&P?rklGBB;sI4ztGvr>e)ou;vt70#eg@3a7j^QQ6cWFnqo~AsU&gEUt*$8FVtaD&dgQ1mh
z#_jdd=uGWdhFY20R6j*vb|jZH^A0SI^{Gwxjv9qwB?EIBfCrg$_%F+1g;@p_5%~KO
zIr1F`+da?c^|mls`#CkqTcZ;Q>-Jo_JFg&zRld-KGtXy1
z*+dGke~q`a85S91k2ubTVcwr-DMtleuy@vJyCV(vQUgkJ;H!xLnL;*^RX
z%D*5$;AqfGhKj4!fC{}x;Q>Rh`9N=Y92OOF6m)O>k2w$sP}U2rQXLTtb>O+my)7|{
zC>ImcNf2B?fsxx~&lGm#O#Q0Ti*X;Rzq(%^63mRQe(n()cz%=)yPn&a-9oW>hFwZF
z8AP!JIQE1Aoh;SkpFc5=RlZQmRM9^Lc*j```Ti-~B#r{zO+>cSDS7z}PS*
zW1dH4xXe_8Ktdt815^zy1&-HRO{Ze(7!MdGMHEM5E6xOmD-5AcI6OQYLlY
zGRB4+M^p+-VMq4qNY;6o_v$M!WUSVPRC4swbEB8~L8OOD+2;m896DNE~yPpBbwTvxI^A&nbnB}wq)2&kRX&NM&k`-u~nHvu+PLr{W
zSdSF<9=E;F5y{!JD(Wy?O!&vHcuan85D{f%#Y;~S^mOa?f%n+nIAPqT3XW@r;YWLB$n)V=XK6ko5z
z=agPc(4+!EN{g$uT7^^RU}JA$H^?i$EyN<
zW=cE27|D`miq6*oy?1Tv{zZ!^EU>Szkj?1ugm=iT#MzVb(P5s1=eH7zIsYyhTf2_3
zyYy-8Gh91hjukkjYK|+auoh#nz+D9Jr+@m}fA*(8{_@LTj88gAHO~VY$TXGH+@|nu
zy`1?^WJ$7d4*=p`)zCf01ob@`X8)b`j1~g2A!K*NRzqMAe~&|JOsNbK1KRpHuJHj@
zKp}zV@V&HdqN_{1OOWSma>fKIg&=^JkjiH?-(4kVwIK!=5eg${+=o8NJ_nQ9+;Gx%ymf(mDT
zyel(fMIb^CYi@sTV}8294q}E6>ojW8lZ0N&a)NT>s0~k#g_-(!^O|S|C6<~%;@~3}
zfP*F@Gc}G5fr1HV9h9?#FBWc4S;BIaVfxj1MR(&^1Sgbx0+*2bunM=1K1%7+T3K}>
zrMVCvMq$TSr2
zXq#lZ)ai-3b5c6&__JIM%RWXSh}JMS?QsQL@ffM6@1-^AMHNv)q+E-v(kbqW01A4<
zYyokniy6#@F=!eW?x|ultisC0uq&Aufg!;J&(<}rEE9A}R>uZM!?(=L?RbM^*bzLR<;`wnG_W@8uu0CmAHlWzxdQQ{K=-YBrn+H=1
zA`NQpWmmO25A=T=95IJa%MU=iLRNu-G6vKZ|LlSAo_m2|ORCi+b?PasNLF}dxX$%U
z8m88%aJSUa2rTf
zxF(En8;KvfMj$;dLM%KghUo5^_U0=-KVEJ$$X
ztV!eIxFAR_2769f$shOyyA8W2eM0-(P;RaFsYRvUUCcth$mT$|fs(KtKubo{?j*9L
z$_WZd+h283&av&m1#^N8Fm|D~AcRV`^(q#mspYi+oM$z9t<{CEzk2@Y2jBkPAAfV7
ztzB2M`?N;2KL$0hOhqqi0-h6Gg1MrbrYk3`j22?mZkT5K9KIxLP;p>gbRjen%~FDyBYNr}9>7?Awqoz)Pje
zI7m2Zz2Yhz92)fSn7!R*Z{E*Oo18{dhF!k&j#QsaF>JwD4{fUy2Xe5CCi&s99xG`f
zCA{EDt7Q=^V^TrmWQf`8V>RcQjT7>Ju6lcWDoCAuETxi%Er{mXrMpzjtad-D0z65K
zT!s_`Ne;g%!)qyv`yB_XfWDvG@X$=Ks2Q&Owp;z_nW)Nr;_I*W@BR3jfAOFH{`2km
z_URe9Ol!c>w#obS;g*8T3F{udYTZ7n>KtgO?>#-$M6PJBl1Ln&HgQn0Sdchd88X(&
zivnu4sKTxI%o---RP9sr@Y{Cqci2=wR8ACz#KF-bDc2Hxv)kstrK9egDkz~UC&+#E
zQj%|pZm?F%kWcqLCg;fHO=BcNaV9gCu+B!Q^R&%I`#9(1U5-<8?^RuzJ|bi?e2nwH
z7zx9|7}rp>)qbUzfQx&WQp}9stAzL?ZLQkV#Ezc(3iT(Oy!J8LjcQr-D1gKHY8gE#
z%|6vyRN6PK0c~^JdBDY>4R9S?ig~~W|oW@YulP$xnKzm#~=PYxjR&EyPwqKggPt-d=rmmK7
zy1VNg7gqHW#Y<8!k}gAa;hA~%m-RU`pJ}GtQLzOr91qBPjg?h
z7az@zquUsA?gv+J}&Y?MTJo#fhp@V-n#!gR0rQ6hJ^lmun7-!<AN;Y7%uDB4)++^~q8?1Gcl`;B_(ViG>B(u-gzCLMQZy+|+
zy&fX&_evRp7a5hWevK(7t}f|4wz}T8|Y=j{=z*khdZhBi{DO
z;2-_*_rCLOHL^woGw%Uo`WKUJKxNMqwY$b!k9@3PaORtLH-#o`4YCi0hC~tF5CqrV
zne-%;LL}D*JzGBnIYGyCs5YaHeKo~NLDP?#nhvPoI;@7{wceBhNZhgCVQwTc`czdt
zK7`zi8R#>?EJ(`mDI!AMKAEu|OE{K{_c$RgbM13}^~*0gz1lTro~f&eJbFufVTX&1
zQCr0Qnc2lJhR=2Ct2s*li`mfeS_Ahc=Y(A=S1yM_x>J9m?ujJu{Ke0IUK+zuoaiX{
z_N5HBmAJO;iXdfSPIm`+x10kIHhT2u@SJ|Woy^E(o~0+iOY<2v926M?y(4c$pigH6
zh`qOXS}#;0%=}wDj{&z>zeJGeogwCR4Nc(jAyM_MZ+-Z|4}SRe_BAtxD`(IA
zk|9ZMQFj0b+O+svlB_my6u_^^t<$1`*7L$MCEEF}&V7lzL@EtcA76
zU?zgdv^X(>3L_cZyUvysJYl%!R`_KuMtN$u7*pI^D`O?q*(^`dCWGtoNJdCp;Mxc0
z^z*s9i+bZ3G=QtVGf2}FK{cmjvMIPQR|FB&eQKi-D*^24bBvs~%bL3jq^`$fg=Cz+
z{?rNl#XtMq@BGHMzx?u-j}PCFU`kd!)0v@jN(hjBGyOtuM;v@o2y=`cvfRsBrzm~K
zPYuclmod_MiZ9QU{6LbL?k*fmN^-N$IdKOB^`CU!D?ifVShM5f?lR$DF}bEm+6>LY
zAiGb$(jwl~NsgmL!UxG!;EArmrMX7bW|a2s=>wWN{WNJX8%HO5S4V$&}l+qlVa^ZWoSoKxs|H
zyE+`sbul%{^o8h9Y^gt{M53X9h>*D|CUm^d7Wgja&kqpb2%94tU?7%HAGkshSRxrk
z&o$gE0(7O`wwO`0RFBF?@b$d{D7*l|DLDtf(8?=y+<7~h8i5x@kUSGFU*E5M#fP&u
zwQeB{(!&h~z?95YK<&NHsay|dBpyQL1|d^G3>m(W7_kbCWcVMM&UFpEYa9P79?qichJT`D}DhITp4qV10&mRcmEuF>8~h8heQc4TS5>2yvAM`&{?rJm9Y9GClnNm2s_L)QHJ
zxzs{8DUmjJxfseSqh38uth4Re)$h$+_wndRXw7Lo`2q0~I1M0Xg_8hR1{p?J^)n$<
z+erD;%hVaK$R>{Yl#LpWo&l_foN{FGPlX*2b*fIw
z7vg!&^V6pW(DoTpsGSwqiiDVKRLLzxQJ#X+XqO{xYTB(GU|JlXSarVm{KHRv@_Xm)tA;Fj1sMpp5{MR{T&5O1?nQ?cGjllb>x1pA
z%Z08rpQxHaukA|A#TePsQKeVlvi$btmeR)=?yQ-dVo5bl;Tit7ASO01R3%&Qzw5d86lC5NeSk?RORJEVV-U@x0nYr|S
zfj;|C+uub9&N(jOP6r}_b*j40+0VC6(9s}Ls+|wChK)A0tXY?66(A*tZXz^SOwbqs2|D`XzoZ?@N%Wb-Mjr)n
zZi)Z_u8fF0r|KN)6eibN2|1Znl`vUcp{n|7ZhlF1Vu!_3s^T>rAIU&8Y0tzb&m26&Gjg20C2fQOzcCm
z3cgy-FeE_fPxsO6(}tx7(=QNyK&nA^s*?>pjeQV0!
zs1+OOM}2iiW?^ZDN0^|vGmsG~-~32I)Q~@vU^fe>F7{+NEw?{abKVQe;-{z2+gz^(
zLa{B4Dfhf0BAILHHIZ>t*!Fz4BW!o=?%p~q&he&p?V?kuFXzbtRPbVtAgW#%VmW`B
z9B?WwFSnuS$yloGb!W;<=4ewYMN%oZy4yug1KL_PL2HdVbuf*-
zZEg@i!%h7K^eN4D9|_OY9{NG&W>t2d@s+h(4R!W9zF+x1RRf!7;t&Mhij(!XEPPsm
z*-^O}M$j$zD$F0*DEQ(AESuOwpFVy3K~#3N)>>K;{unw*(<2jsqx^aR9+S!B3siRH
zOh&xESb#u`<*y(Y@w!fjDH1XVqUniZGutm?xIu@8dwIq+O(^2xLoq0ZSaGk*TbrOn
zz%j^>nE}%DbxZn^`ZEn)Dy|GXB^UK>8G_CDoH}!a0|Vv5iQND^n7&iLzmTsN&UyN&
z!{li
zf|~kIokF>>PHmQ>kJ3Yq@S%OT%muCtj`VqZK7oF$e0%Qi|K{g^_`BcrZ5hwP3kw~1
z=xzWM02_qCtLr$h2QTWnTszcnE&63=7?i2Xc!
z@3*(-ewL`XQDw9DR-Rf!I@D9JF@H;oes8FdiDa%w)
zj^Luf1elu3RSrmC_{~RhEt02d4tB5S#m7fPQg*?Sv;{WU
zZVyK{QcRlmb>Okg8n2bqFjy^!3{6r2qHDCca==QHLXoj|opbitAk?}ZD>7GR=#<=h
zKcx#VFynb@?_QZ7KYMuMI?$(2*OsFaux(%=)9lu86{T6nMM+m3S;=-oC`xxTkj8EJ
z>C^d>Klt9i`WJujX+P`qS`X6wn$w;dp+GiZJ?ZXa%e7G5l`C)56;Q|y#l)7bPOH)~
zUa(9WBM@MR8oB@Y@$@D`I(rqHE
z5s{7Fdy{Tpjqzqsh@^5QRThj$cMx(!F*DJ?z+G54Qp2Y~dILJ=oSeWbga`z=@}Y54
zIt74h&SNT1hjG>EK3?~YKIfc`5e_JOHcyTMapYxcFIm5(Wb
zY!ZUxE=}dF<3q}7GOIoSs)f@U79VosoC2$=;EWF>r*JlSH-Yh5`|8XMsL!t%>2blj
zJ{#q54%zNVv3A-|)Ba6>5DBQYEg&*-;0(r5>UAjvg*K6R;4u)Qz@W}AthLhW*;)S)
zlT27|u0CETDx6
zPCiP3@2&?46R?Be)1{$9hN+!N6LkAw(nX@&9Ns&UV0EuphGCRos^BAK<;d}X)y0l1
zzr85*kBoktdHc&EAl^!8Rwm}cIz8I%c7G`jU^1Q|URo_BUV#KW;$=?5$?!#-YWqb*
z^mJZTA-LSaG$$y@E)Fz$SJ3UAQi|LyZM=}FYAKHElmHuL$abvB+uDM&(Dl#3D
z2GCrYLHD5QIF!mj1MW|?Ao1D4K=(PKxYWZ}=w@=h6u@*6bx!w(I4ub@X=c
z$o+h3yG7bDR*Y*z0E_OSa2;#NLyT*qo4Fp{spD`^GzlzIB)0zV$X0YvcING9#cWC3
z#l%Z~f(^Q@5&g|?e=`>&Vl5~C0yuA$FaQb_()CA>XXZ8QGjpZ*Pd)FL$(#{U$NCXD
zW?1!VlPOj5P^U9sw5uZ*BlY;ssps?TU2A2$>nX4*F_FoPWaK_NcyW%;te&Gu
ztF*c`d0;wl5{EN@N{Kc1#$7kJ;-iS;~AR-EslGG?I)76{M
z-dHNt_Sr}LUYo~qo=RpekQ$j*wcCK~oJ!I&yTj0kt+qzH8vu%p#{iJcEOairLh3ef
zd1iKc4Gn(IV2ea|n02&r+r^d}8VwdJPI}cVBD9znwIb7n4cJxrNc0%MT4W?l&0L&k
zKr=M0d9np40$yrBrK4&6$i)Gus3%Uuzlo>&cDnNw3=J4{`RLodl?8)0&=VW&}a7hW}Tvku@9Cek;Imb>t+LC?WVD+3HDhE0eftc23
zXM-*hK#_H3gD{!HEnRWTlh?Z_6#(7cy&jJbk4Fdxpu|n(WCHE%7ZpL}8>;Dawbiyg
z8#o5SYb*{NN7Y_tm3UIIg<+OsA^$LRTWGZ{c22^%f^H>_bdumR&}1CE=pzd
znQ_j>732#BYmn1>Ip~J~5HP@_2W0C@Q1b@;a^1V)c1i$DD*^lx|K9&F6pBT^T1f@4
zJ--F%OK5>dJVax71RZfda~I&#i0HqX?o)@*%MzO3uY^7!-2HnciU&$ViORSWio8
zuR9ANA~k)1!5)AGvshurqb8&3M7m*)Y0m(`nOFOenUfAmGOd>%)myJLB3;4{@I$fY
zZWEu%9?;7|17Vp~W;RL;Q`Hgq5V5Y*X{K*SpU6aYpK~%ZSN60wSJm(d7=??$W+7si
zNhx^hA%+VY{IkJ&@$qedaX_jv8T
zS$M+=YDWRg7#?xO88{Fi*VHJ+Q1%0nS|n>1h?V!~b@Q|SxIRQ3key3}Rdt9bqK0k?
zlRL*b?hWs+iw5@F$rV!@0|3sfd%7DgMyp`-A*gj;M=)+*Ztv{Q3_L*K@d(+#L?W#5
zVG2YrDAh0_1DI?S5RpPCU;0kWDL#pc(h+?owA4%`Drqp7+V?LZX9k611mX
zQc`guJVV0qFgzZ%0c>SAB$7>Zc-N9pm#=5Ygv1Ckv?O4Ty73xUh`Z_4&fn^Z((oe9
zEACl4q~O~YJ(~`5P2}csuCwgkj8C4MtcJygbA}hr22x
zs?$f`wnG2`002ouK~$B+X7vfl8LTuGH`MJ1f(xRNJU*(0YBZVbL*n$AZrJcoS*>91
zop&msX2FSWaZGSd5X?Ct+Uc%ZuZijWyDqZTU48bcI`V~);_i&cuVSd+a7tuTUJ&P~
zN~8h17GOV3|32pi%bbu?-PNVXFZL}m`Up8jo!!&xl4?d2pjV}(rvK!Bv~#CutUE@J
z;-LEC+Ll*p2A4+vx(bwBv*wl0TDMuKpQ#Rlwvf*KsnUiQJi%3ti~vs6bG#-w9)JQi
z+6bKqSurFU+6pp*=`uZp>yg~&X#QJ7mV~}g>tKXrRc`rG8UgD_#CVi3UD8Wr!f?{J&EQ^
zvLA$CQ;=GaP>?1w34uC95YO{GRgB1$<=Lu^h;<6`A67=LpeY=Y^wl>6x1U|?=tf95
zQ8;y;`zd*1)r2;UsAU)eb#WeIIO9F);ij49Yn?I}mdM^LwS7HWkYO{-ft(D}7^Wqo
z-6Wya#J%g|BY*V$Z=i8%a)Q1&lYVznlAaUjv_W#eR%qzUz;o>@x6UyHB1+kN&Kc*(
z*-&&tG6{8#>AM=}@{8WjB6@vL&=}Y<_zOnl}lw!&o2p_I(QOBdfft4DBCHds$yEGM
zySh#-si}@3IbkYYCBrPekuZwUpc(8)beY+^^W0R_)F~lfkt|5F?XE&0o9b{ANLl4>
z2L|hSJv!$kiIzZdtyR^}w>LB*vdRsaq-0v9X)oP%_GJiI?zL%vpFVy1@ejZGM}PPy
zzy9UVR({YXq7}jnCR)ZMmH~&%`J^&~>(AE)>?GW(YI$Q*p~I?9Op7dDJzW5pp`WDt
ziW4N7j7P+W?p*6bpOjGY2jBm027zA7@l%16Nd;bgwYNDOy<6If=SG8%WvzG>_uhZ}2fy`C|MBns^2=Y^sj+j%IM#$al~GDn(84Eln_8$Y0XW{jPz30<0NzWwF-(HRmSU^4>3mp}eM+W$
zo83pUuQ7znAi8U)yH2SzG2^B4SiM&sH>D>zWg3jHTn`RE@-4f9j1b?c9}el)PKkj>
z3z}rmuFLv;dnzgGd#C!j_p7`{-K}kBQ77xOen8yDwgW1;55Ef?O3M4IuXF;=gS8*~
zRG)qqkdeXZ(kE53II&R=l(z*=oqbMKr};z7w`u9dMN&*}`Y?saQR%l{SEsko)!j)o
zvdoi$smJR3`Ns4`w0cWkqHLaB`&z0wh6`mmP!AB^_W`w+Tz8M@tCV5`j5!a4#$@%d
zf_#Z`1T{KD4`T9AXuGM44i9O7tmxCr0HXbbF}FGEO>G;jb7z03+E%UT)R0cCHACDu
z@69dstaPs`gM6
z#z*V8O6>P|tEveoPK3v4vZ`dsU>mSdF!AmPCOcf?>*RV@QuP>%YpwY!R0WGKtwx9C
z>n)F1<)LLInC=mM|L1H#+f!SzCns!4CjA3?096gzE2XQGaZK-q(R&r@BUK=i(iBXI
zp@T!okFuJYVz?}=lR<;*=!~mctstzV2W_rCei??wqXD5TJ$W9-nh!H&4Un?AAhA0K
z1d2fPK2LQ^tCR+YC(`47i96I~t30?~=&w8*(TK6jvxgl3HyRtO9uKo7kOpot#wAdR
ze;Az6AN8E+u2j7Lv=>aKwpF7A5EP{T1^-xJ7LfX2yL(sN<*2_W1`6ZNJN-PmQ6O@q
ztq;{vs4;V0Lal`FORz^EBh_9)n(>lpZ4j9`fM``0Grhp6hAX=FBN&oeMlexlN3i4x
zi7vVL2O=|^*|@lI4R%dW_aqYvH)Nt1H(EcUICrEXS>g$WWDJ}Nq#W@>AkveinHo2IFAWXzk
zssqXHU`YZnlc0G`QjnJ0a4>70G+NAHX1Do{30c%|
zOLbfc(Du#5(8U=uPL2~&B4W|)^ukFAnKIghcL;I|;9c?HocffclV0k0H&2qB2X0}G(ugD}w8DYK
zIFz=2kRIIPFfM+>XR52Gi=ZoE(jgcj0r12&2kK(5SaUApMY>)J6q7ZL1%@8_<^0_U
z*2U~Oz5Jiz2EAl=J@?zLof#2}MEB97m}o{3r0wj&fp5aFKijWeXU&vqn5si7Qpl{R
z&g7!{-Fcsne{{CzEsFY_^9m6P3EtZ=$0*5}+&=$ULFh#08pZlMv~c|xuLbUlQZv;_
za-XNO6fhGEi<8MaKmn(>PLNQGPB?W4V5RdVLq|IDGG;rD*hiI2AEjq>_K{xV^Z(+;
zK0;>8L3J^Ubx|;7WW>r`OL0GwC4kTYTI*67#$+0yimBCytb$W7rtCx$^Hg0<)D2l$
zg}%I)5=X&Jn2U6{s$!p*)?a-fU~i!aF*F)&D?o(W$kK6o1IDnm#0`K-iqgH}+FS%#
zbM}{zXUWJS|b<0
zqF1AReO)f)Br~(OaL@Ko%v6sBPVa`AkR9Qj2+yPsp>^}#Up60pL@o(if8M>d0d;Zn
zqF;lzF9tjnX{*~RM!iFl@`Reww5v-!82vs4He91EKm)F{YGsHH73V1Q$^b$pBJ5q7
zRQp~wZJuoa&vp}|swrP~U65(czd6AAqH-8K#{D&ncAJF2>fvGObbBgFJ+W@8-@Up|
zo$f;M{_wDX`gphFplw4caM<{(`5dA#{d~HKu!Mj
zQ$lpVSNS5W^Wp?8Gb#}&3m>$>u&_B(0{&0uz`$w&vE+*bqCFuix}~BPpX_(34>LMX
zjo4O_GIc%(;KRqy)>?629C@Z|qZ>1=?7dCj5Flunszu}_L)$EhIVeZSM#s1T%AuE}
z2;M%3h{sCNTy-=bPN8~g6{4%pv(auGC^upv80Q?IQMI4Xh{#xq8$IDh8ZG%gsVON&
z{OL2{*cM^$u73RQ{
z60EAU;;XMk?cG^ER+f!+$yT4R^CCA=_H&<}kQb7-RLO|e__7kdb7ouTpWXoApZwYH{oap$@OOXri_C{YtgLWW*acc)
zL>nn11%ZKjeda){d76x(FY~2yql;FDIMZeVkjwNwFMd0?>`D
za~R3_-B`EtvFg@ftuvIkgja1%%Dvs5n#iP?!u2dFr<6)UK+Sq|e$iD|j>Z=!%$r-n
z#dvp{Y^2@*tX3DV8*@9e#{4;`vU7KH#UkNZ33|r`bklPzhY`|#SKFZ|Ze4`N;%ccm
zNA)G%+tdN1oN87UNt4vtB=2)4%4&fv1_$GuBJ(-DtFWBJhY=d*l$-UT6R3$IV&$4$
zZ>fB>l!40GZu^h(3R`MV_NJ{3a+ELDrukp1)nQ*%T1Xf;Lsc=%SJQ{}U=^>^#HWn?
z_8c;SW_Xb3hE1>40e)EzYA895%-}s`jzs!Qz07)u%;e
zR0%@T^G}YG@bf%1U$^RJ29q`0Srdl9;PgYVMUbpMhB*xkYw+U*i<}5W<`p*^b{ad@
zm;s(^EfWAh#3N$)UU7jOds30ii0X5c8-*n15UT{Un>ANCGILkb;a;*qs}wQAa8k(W
zOVBSSuY3o9>DS%?bTQzBF*vVPK}`yDk!%}XSQgB=EV|TfvAwdf2A%wt!KFnLod`D*+xyPr>^xavf|HsJqzN#D8NmoS@BH5H
zefM{M^zrQNhHhMf^lCr+_4g{gi7bjy^A)Iu@rlzE+vlu`-K{BvO8)k4nYEPQhH;|W
zPg!`Ps`oyT!H```RCg>bDd@>{-H+G1)5}t&Bp3de*xBo$#H@!oyl#QrmI|ZYd^qIOdg5!pylA}L+13?vy&Y+oA7YcSQH+P*Z<^4
z;)5b+RByhVk?{ENRPfB2999uEsW=w@$+wMeHv
z@oxT}o{bVE4NZ@XTvLjtx1)U>8`at4j|`3hRIqDMjk&c5M@kSdR!bm@gRhCK;IvNOaC?9b&FUyssPd
z#h>rJf8#s9@moLqyfz*WtW@5k0$3Tmf@Jqqy9CcZ5$uCB#!+j@`KCzZ3XEfKA<75w4mf+oC32tr+;)c0
z-rk#in&=EZ9;n8%c@F;ckAM5m|H&Wz>dUVg%ZHZ${%(!G_EIJzA7GJBvF2FhP}O8OSD9rw=Jf=T@~!HAo!xXt
zsH7@Bg7teDBp#2I=@6j?fW51_f;f9iQKf{=C6q^NJUO8pvfzd%*2r&HsjC-8+g}~t
z=_zJuQUFEIp#02vPd(_joTvb>zzP(+b?^HXd)HbkGn>8Z08(apLET`|SCfZsmNGr1
zGIvVmD?OZiPN|llfOce}y7znVNceSI-aH%YBEL;w28i}K`|RD_Q#=b11YYmcm#K_M
z3p_%jB?=Pu!`s9OXN(q4<69bxICYda6k3KXf`Nlvb2{{BB-t_wKE0la~A7)-Bs*I6^e+|su4qp0%fddm}iDcp^z^*3Sr
zCLItpnlsQlj8h1vtDb2o6S#4;rNG#@FnA?n`UEAcdSnG@6tz}WHft3Nyfmdwwm3Bb
zh{~A77<-*_-Xpx9ed>Bg;ibbXzoTjKC7ox16T2oOQMteJP5{MCjo{qa#g#9KVt_qc*)#f_=v_9*UWEyK
zXtlbXWKhF}gr#4sOe~w(4=GxsyZK^>6dmfEGD|N5N_0fapi;%sl;4Ahwt*R{Xw=^8
z<_x5wM!;#KnrqirYPks_QFlb;6pe&NJc@V~^CMr$%wwFDIma-YLU0Oc0wvTD+tWcOGQWJq8rV2S7KNC`^>yp{fw
zI>pZvz1?HfAta9^WAEq0GGW0uHX_h#F=&Lw*(W0O@|16?>5Giou8@T(Dogh84)YZq
zin3Norq=N}C3!@3%P%cB<3PO7C0EeB^#pWameZLl9QnXB{Td?8WR@Y)R$X)lOJ>B`
zwb;M&JD-34Ii63^p#BO!^ugHXtBD~C6xPInkT|EyT2`YoSGQ2zKoRVt-lOX7+J0BH
z4a#>-sS|<)n!&xh8*iVg%0{o+7tgmQZTxGXwc0(;lm5B_JQ_s<4NZBM704>Kt2&dl
zyN<`d)|Qod3iRwI0Y3MIa#(4D@Lwv0PFKF
zK7V|W4-KX&^tfgMy&DZVRQIr+1`2Hd*k@ZYt%URGI+K#OZ9sL
zJm++42qEkAc>tI|XTJ(dx(Y0xzXNT9WM;}KK)I2bhVFe%tCv!?cfPoF;h&JVx!U;G#UF``
z?ntcCxNNQKhAhy*y-z+?ZG-=ABos>Re-T+!$8*S4XW{ww)P0FAf}O@?RN|7bY%<^V
zEKZ-8eqOP$Pe+8pNH@-|NH<}srt)U3Y6*s=s?uBw@I24f002>0RSndsbFdGHek|&s
z`PEnFhyUQifAO#WpqZb(ddtV7=73ZFq-0OC6UbK&c8`g!k!IbnmX;prZMC%kZ*&>f
z3{B9~d7*v8IH%f0LXg?jRa>*=!+j7_MA`L2g@H4n7s-dd9b8>zqH5eV^}EWtM}+`%
zopVl|7akcQ!(N>^VdtT0_f9uqai;hNlb?0EJD9fw(;=84c2sb%Iu(s5)Vuks+H{W9
z7$R;mYZZ3Rs06O~SaF6Wb)D$_E;AG$#--RUv_8Xc$}b}ll1YZ$UcJodFh#1}65>~G
z>Zz37b7f6}2vvd89tpWc_xfk_I@}oxIE6LMjMqKY{nY9BHZ0Q)!{xS2eQ84i-BugX
zq>9j*G|`l~OeH(GRgKq$_HZ3}lB26~rPAYi=hP})^?jAP7wgn&;2V|Rqh*^5!8I)?
z^{KV_@T%j&tyO-=z{2@Yjj!@mBKRY#A&1LCJeDa+P$#n5%lR7qL7}3S7`VPsrWCI{
z2W)g;-huMi@w@RWQh%DoH!e7Py01yXv!H{d!j#_f#o?4%8zE{LXH?Y*?T9i9tD*pn
zWJK^zfKv{m1~uPZ`->#xh$e5WDVrYgJ}d2Z(AA`G^mJ
ztTKML&lP-V?0qG50bKfp+_VJMjIuhbv%5Ov6Y!Qv06^Zs`~h1AQMvTIo=1u;gSers^J)VD&O`25n%*n
zgx4^hZ=q2fOWSME36`)=WoCl1L(md^$vG__0vBR>jsfG??Z0=Ud7~qjrenHU0yvjI
z*9ds!$Poj5HO=#3=$0`0Mw%Z+%hOd5r-x^J%;&DpKmY7^fBRdI=9xaNryY+|qIz=~
z!ka`1l2iqiURU*V3$Q>devrb0SDKRT?#D_|XDdTsx+a)KXrM(1Jc}vSL#mt+u!{7@w0Eh-aMf;RGr~rOUBF_ZIlqe-Kr6blOAQJMEmm6bUF&87YQA8
zGi9R?u_g&)41$&~tA`HXUq0Mm{hnpkNU)5L_QV
zKA&Ix;UE6w!L^_w*00e6ny7zvoD{Dg(Fg5`eqscBoJe4A`78u}~tbim=ow6m0vl^gJZB;~V0uUHgJ#?)5)K;+x
zXLkm;alEv3cKY~i70Ky-Q2`2;545!a+k!+6AsLK7bk{!5@*rQv)nh5wjGJxydxJcu_TEl8KnBJjotX;-BC1Qi
z!B)7=STYEb
z<^E6lb+Eg0t%%56O3{?YyX`hYvbu&X$0DeZ@}3Rs;c`Ofz0%ik&g{&8?tV&-0Z~nS
zV-_Ll!qo!D-iKgIJQ=8Nso`Q$O5cn@F+Em)opTV{bwa0)AJF9MJ&SH4z~E@cQeW75
zMyjBgF6ej3h!Qsetx{H&pT9o*wZOGZ6><%$xF)TtM(w=^Ue=KjDi2SeF2Bcac-b(3
z@NS~z;$ryCqNCm5+T?7a_u=L4x?r3UmSd2W?v6k-dY>~Mar?e?T5|7{0?l(}$G}<-
zHyMk62oG`;8>)>bR)J(UJtNIStGq^x65lCylgLU$4@B3Y{q7`pM4z%=Q!a@YdLg@C
zh&ZOt>dK)fJQ-#f1RC#&BrjvB2VdIYh6yK-XsCD8A|ExH>YOci>^S=LIP9tU$}-6A
z>duG^;l7MECkb*eL=W5bXZV|HAj~G*@zvdm8ldr1J$=0nPHVXGu?DNQY$$|3>3LNZ
z*jhE`xRY~Gg_33pciqfCbXUxEhI9dr;Z!lkU#0e{b9`Di+W)nj<2BCSXw8A-SPl%%
zr`C?Hb9U9v;64XRZ^Sz|Jyk=a<${KaBh*Ksfl=Xiq%5RQose^~W3r0*Kxw3&Xdq9H
zbx$voGyy%8lEAB*XZfPsZtX)?&y5XK*UNK*XnSsYkyp8N?17=niL*fjQ*_;+5LSNu
z>G`d1K7RQ9FW`)nb$Wm^D%4GSV5n1puxvW2kHu8u`cgpl8^bxb3(f*MA7N!eunIxO
z3i*7hTBzyoax3DgNUldVc(!=di^2+^%d^$;mNby
z=c#Lz3sQHN@C(O{p)APg>b*|^&o{&JwY#dABzSfKSStY9)iZ-?wX*S&Qb1_JWXQg?
zjsn8n%)-uvj_L60%1>Y6zxpr#(dXa!2cN$FI`g9(&YTc58!U+-+fyRK4G6Lw0~y^h
zq!a7FJR1mvOntg|g*<@e@5(90yELlR!KX|&Opiy3KPO|?{$KssKYV=1=c$!^o_?OL
z1C5tdYVddjt=0|!pn^q6G21#Os=I1e2F3ftGPeTYd5VOLtWKThITD3T(%;bB$bk*^
z^9VR=XOB@m+(9J3=Pr$^0&w=(+b3o1qKQN$2xbeb3e{)ta}JCyO(WYW73vx$pTtUw
z?i%%v{^UphXy6=XV=DzpOEaq?>`9W5gmMpvBMOMlRuM-E5WyVi*Kq
zkByx2+;g_h3peW9086RcG_RUDsj8Mj+b8P{$7E>`YawC@27=&^_Be_bGiIX741poj
z2&%7DU{$V`Wjb|mxVK!E(RCR>nczeKvMNaJHRaO{za3COOr3MK#wbh11-9gG=4Cw7
z!5nOL&k>Nppr>#XZRHElr@FQVLN+Rb5@8DKe0eXoh%%q8N`AsgTwehuM>S1YII8@3
z((vvoF%8x{jm*yhR_B`4ael=mrptA-XD&oW7yDGzKGVzUEq$@PV0jetxCZD7fh_fg*BeT+V*#+AUgmKkkX
zfziXs3-p{_cq!vU;_-MmTEacmHEi%C8=!>?stNCaYe>{41%)b*a|!`B1G^F{&A8Ij
zqLD!zpRTY%$E)72t^Uy644%Gh_f74sV3PD)yX=_a9#DC&G%Mi6M?Q!<=EAApx&U=z>5lZ
z?f7&+qdjYkP?9hDTac7A1{S|-Am-}&Jkty!gLJZ
z8cR^Y&}IG+W(-D`?_O1!PAs1ik`(5OcIIi_<2g@lZynNm?|HK$4A%i4(KW6wR2kNO
zAaw6am>YO8N%Bv0R(3_CC8x+~_=B{omF(GTWjDh#OSv
zZX$x|3@tXi0sA#?Qa@KQjvS@(SfUTYjsOS{*IkbnL>pU3qQjNrY!DcM99H5_DbBNqnx
zfIW@^M!AD~S1e{Gn(Gk^qL69cc;Zl?u%BWxE-D$QAtL5p?#8KI=M)ov&YCp>nBz?AppMdjr@(@{9Z#{(5s!Nub|NVW4cnEIz3-RrY!-3FV>#(
z_kLlU(dMt6d>%)ire17ALZ+`y=-vh9B
zGcBLflH-s7Lr72&34{b$$1TL{#xWi0_^4A+YsHH#jr23E?22qAh7ynluT=^LZ67TT
zmefQj(!%IIkXOn7{Vxr|H&0^Z~G5_^6h{AFaP|P
zKmSi3K7K?E`x&W$A9s
zs34pJAsLyAF@+p3KM1CTSD3YemIZE|x3~TFe5>xq#<^5CzONkvZk$TOsz?P=gbVUW&|ILBu?S0ulA3B_>F(@7r$T0+WW(Y5B3+GT!QG-
zhL=9ej0;BRGEs6k5J5N@k!yL!s&6x_;8G!n!MS1%p3(fqY-sgn8RN}J6|(R6oXfyF
zJoe0%n?2Y}59rpAsOvd6v3d?uC#g_{2@y1^e=?0FL%4LgCm${|lzKWLyZUssunLY@P7Wa!7Bq8}5h?#V)zqV2m
z)wJT~OkZu>=v{R%vm`KUoF0wlz}aKNIij0M!GgSw6$*kve^h|KHlq~>Vo=fW1gz3~
z(POE*?d8gn?tjZ}O3~d{A2ofo}yQ-?s-n&^KyL!1_+AGtU
z)wB?Y(bJe~6YlN|mn8rGnuKEW2ur$3foZ@Ky`niYt96)$Yv-B&F@0Y>kGa!R>;OPy
z#qo5q(|sbM-!nIZjkQxWuf_@YQy=-?wIoDz(x^s{x`R4si7|tDH3|q~5=3J$If@rv
zlgAJ1ICC74y=cj|FMYl%PPBbwtI9@
z=Y%_FcB|W|p_HOM$E+x>djg#xHj`1^qW9;0`e5#QnY^`Hn$hdAB0@verCHLV+Umaq
zy85wf0U8l~PMxi@78f*gYk&r>MW3D?DRl+tSp~^DUd`QRYBMyeL*69lZb9ZQ3Y)m?
zF|v3W7^toP!P(E>{_Su5)(<|2jl4zX6lSv*FVxU52r_?k#AKhNeq2yq^No@1V10Nz
zJ|u$sbXP|*+37+^7!A*MyQ#0a-B6)Le73}*Rj7J)RlDuJx`F3z9Y03s(MQKUFrq&0
zeNL6Ao>&Cb!=sJUjh0d#=(Ep0=lLuF@eJ=E_g-q_OG5lq6K}bx(!ffidp+>|@BagJ
z0V%a2mV%oJQq_&_S`Qx+Gs$qGm;r%qw?^xZ<*ck9kUT^oavJI=Vm5M-OCq6?P$i-&
z;7Lnt8N4HctDA_m9-p1JPv83Di|>8s3vV=-_AFhuZ}5G~v}SSJ7^14{m?c9ZB==-=
z>p_*=1kO1!G0}`l(-VwaELN9gENB{_Go{|DXQP|NCEm^`$Gm3<-k)<2&uC
z@#SA{^_9Ik!O*WG7zNt?&Bc|9(#)0lL5l%YDwm|ag8zS9{aLK8S&|)wt%%s)xi_cE
zny0L)tcl%K-PNqF9@zsanIfB0w@A?@+Z0He5=@GeDAI&wTQW(Bqy~!uECbR54Op-Z
z3pV^9$btX?vg`*x&=0aDK(GNrA|(#)ZgzJ~nOT|l<~`@z5#fim;`>kgqB{Ey=ltgz
z_KqE~)`}GXXTTZ|?C=cV}&OW`fo~TmwKRAz|DOs6v&U*#JGLywaXM2Y?^``e#4-`bWR_
z&hxdNfGy?C!(9g)_5214qsN;YI*Hp_3?0#!V|Wm7#_}FIHoH4>7Y(na>meZMnaSgl
zJ8RNgDbu9yWt?ObrvGb#oMv=2VrH1&1PmGpy8Fskhh!gsBPH-R-d~f}yFeap%?;bCCHP
za=)w}5FRFx3)w%?Z-P*mUh|ofLG6;fSnw^EMv`TK<
zI>lQ}m8vkve75Ttn()plM5!iGzgEsOFKswW=)TZJ%`KmasAKEy%G#o}-7EV%Wph1w
zwbB^olSE%eEXk#Exw1{l&MmKd6dz6)tA-+NrC`kPd(?*nK9xfbu5aPi3SR_RNg$g+
zGeD%j?%@cksI%jT-uPjgB%`~s!rkR0tid03W#3c-Lv!hw*mF}=X?)I@{4zhuO@Dj-
zpq3ucbZg~KmDw^*d7TqWb>qCbs}R6c!36WnfWwc|`J
z<#5-u8dj{AiZmjEb@3qDxZpRJb`f-i8oRi5H)@%EX7m(=NiH2CKZj^|ciy-?S92x-
zH&$WubM4YwngOOwXyfHI)-p!nE3Wc(a0B58-R2rxB}6qGYPV+ezM_SgRwZ%W)7R=k
zIP}?#VJG<9RZ5cs5%Z=_Fu7!1IAPPZn246UTXkk_Z58?7wtzy3;E6NUut|LZJM*Cu
za5g`DQI^wg9y~_Ecx|k#=AFV^WhY-#cY7c_n6UGBaj{Z^(l>v~1kD?kDX@#eRx^w6
zDI!%RvTo$<2=B9Qfq(N=s#V7a}JBo6zapJcvTO
z`}8w6V34H3O7Mc)4U;1=GR+1ag=Y7H27Tdr8^C1|3DDG(o6z_PzO+or
zg#SVDn2&3esL%!a^^C%46>Gly{{CF+?#<7B@GejZ50T6+-LVQJbjz#pidKUb&Wq7v
zHNP@9TwegSW7q^r$6%s*$;E0
z{V$iadxX5uUE_`i8JW0YL!>!4L$j4MgqmGl50+T&%i@@jJD{^&q0ZccUrS!y-C+CfE}p;l)(?K)_kZToPv3uj#^G)La5gid
zy|dAe==uqp)+ABQ#Vx{Y?~U%Y7J$V8iSBDTnt^Cw0E1b%8G&=BRM>Nj1soURCZ?g}5D^
z%8stn;#MkXFVT3E;ZnLM?mcdD&uaE#yBqhK&AH}RkKE8H6O;F2!F-%7N-mg!k6A?Xzf%fZm+|c8cTpIg
znF=UwMk9%!)pNM7)OajG7q}JE3ZT3{k~$5jeQD5TXesI_l?TAg6=M7wRUpuUMIiHhI$U#E_R;z04VyoT10ds5k%8k#Hxc2|vHr
z=PO;L7fHW4lzSWrCSn-ql)*vDedRmc-Hq`Z8UC+}wV6>TXvSKrG2u{>i|!_=qia@^
zsvgz!E4z*H%N5o2HJEZ0s;uTW+)`*3Xne&k`dwRz`&4nY3-oyz+(8?}2%u4mtSYI6
zRv
z!BvM(ns|kNV&${N=8IY#22k&7HwaRS5g5>JWXpuf)!d&L)pZ!A^fp}c2OHAz7tqB`
zH+itY1|`twp*W=Yn}4E3HOVsUuFt)-1J=P0OMvCIIxt3w5W3p(P{PlFx(UDzm7#!Ydjj&AYOSsaFjih
z5=LBeLBG&&-if|2c28yHS_dRZpr$t&IxpFJ?&_Jf#RbNVU1Up8T}}5v1K2G{SPSeU
zH3P1Zn8OpxV3UhT;Z6u5&`s1ziww;{3*P!kKsA*f9A!ou7=EtaY;xp-#sUKEz%>90
z%8gPvcw_nE3pJzHf;71)HmW-7n(9eph$n1o4an+u$gAXsU&U=V1Y%i_Y)Z!DIt_(M
zE6G#cOQ@;Qv>UB1(#6(*J$wG*IN}o@eTA3g3J??N2Y~H~TMANF5agE?T3(2doNvgA
z%*tKepnp)>B-&w
zi#nF?vWI)*u9i>4@)cmyqkORS8~1QH8%Njj>fV{z$yjH=(zJIrG3JmMI)DJIh=}EG
z;Z8C%Ru~YD;dkI}b&BsOtqnnJS(1%+^7GMU$Ds;HyBgN;22Ltj+IhNGGHB07YWQwf
ztKl%BJ*bhk_ny_~KKp@heB;d*4-c8`cF<4*>M_G~lZmQeUM7C3>jDUATc2XTM(p6O
zti>!x1jK#lV};G2t#VNCGe)$<_EgoMiDgR7a|pt;aDHhOP=S
z8=5Cap%71&Y?7B(bYZ%d!?W>YN4qyK2nw}xkB&(apcA?3#xL9O>dNAVNa%WWK23zb
zcszi*u7<|r5i`>g((R*-haJEDl7WbNW#$c=rdKn|868gHfWFSiJx)r=GjS3gSqN64
z5~E#h8H=mrW8A)QiORwhfvRiy3}`LE1>7}hGjU#A0yhJx^*Ikl3}%#&WUu80xy{#L
zE05kHrk<5c4fw618HHMy(g31~CO=op~-M^DKbJ>wgj!z5;j5*L|6ijs}wH1h&Zvgb3Z
zW2%bDndMC*u%?>PPrbfV?7j%)lNI9!K6Pbme%fg6))o*}~5OrJZouRWNKyrZ9E5!zAl2BOFH3;2yMU}PoBht6sUWR
zl4%32uOrOEA~-LXIV3Mk&O;toStx{pEPGYQax<@_@eJZ{_K69YoNQ1@<|SvF%eFv-
z9d{ASfd0}K-?)47n(o@@WUEOt_NYmgA~h%=%p^23h$n9VZp(d1;b7tN(9!-EM>myT
z#1hyFZU-|Dm{uv#UiHUZ>qjDuI~eM$FMQ#1AN}YDGK-TJ+l+o9!}ZN+L;f#Zc6FE~
zbnA$|0>Ev$vbnbEZO9D=RJymuM34QoR<>3Z^C(_}j}dqCakje12C!2y&7wFfY1H1`
z#u0sLTImr2u?!Y-qD}v}yQ~Xc$DP5`JpSZA`8)i{%jf;`}J#_ocNE^|&!20zd8+A0S_6SDkyGXEq1o*~OaZgfVkY3_j1jGur|8^Gq1x
z2sQVrwlY_wm20u~lM6UrixpQAD4(i~B8#}fI$t_voIu+QIpbljaMjKBBR8xdAL7sN
z>q+3pfA}*WeErpD@4a{TF^Lh{b-|>I`wMQ!g@6ef&`u
zm^CL8%WEhpb0%F1nuMylXBP3CV(9L^h#`KGexoKmo$x}Y1P*}75?~WU`cXPJpFqNq
zw(#L}efNueFrF1)4r6NO6efZz0+moN2JGRa0BZxn?K&pRtl<{o1gE*wJiHY@*>j=c
zmNgB3!LTe#M#Cjb896J|Ibzq5rsM=}?T=C>-4ArO>aF#({$l=_J8{z8Ig}OqX+dBZ
z*%bVC9OJ4pWU__%xh`L)>~Ia<<>mTNLxYjS%!%#tz3zPAO0?!tG%^7#BA{st5?t`6
zgF_F?WIe+NBqFj>18JBYd06J=Y8|LY35XdLPfiAU!lp6}pL66Y8fV$xk|lSKH3utZ
zx7a8RVNShF%O{ez)_T)Je9IZfFzue0Y(aPJE`b2OOaaI}hr8mYHh0(b4weHRR;Zoh
z+^KAoDLRi-_2R2}8xE{S=z+o;D66)n#zWd1Cz{VE->L1X=XUX7Xm3PyRqvr3F~``X
zr$%Q1%-s8?#u3*ewu|=Un&g(bJ?x%9Fl&O(IoNa5S3a-qWn8Bxt^lc{TP4mULehrt
zDJU9Mm046ZM?O@w0kMp|ncO7;HmYIO(-H=BiP)rm00Y3MnT5w?3oS-{XO9T=qQB^*YIfZ&R-5$9rFMo}4riV$6#v*1xs)?LJ$$gpXIBd$+ZRa}fLhLYPTw?Z%n3
z*+Z3)qq8vs^oYShK=j((L=q0B!Mi8)OaDpskO+|7=^jG3r>mgHyo;Y?;@`+F`4BSV
z3rZN_49;pb444+CI^V*qHk}g5*zA@|n(Rq*jTqf1JID!T=`wn
zCXj-N(v)8gBtgc3tqh~+OYErK=62k9
zpwIh!^Rpj*nYtglac{5eWkxX&StgPm3}eyWgz%`x0-0VezZAD7;{rAUcP9xYZq+q<$hCZh
znPG)f#bL0b0jY7xkEi9p#xTzFOiGFRYT0#KNm<<8z4PrCzxit){(b-G&wuk*f9c7S
zm&oOD$)PadA8%Tb#9%A}1j`0zy0%#WG2#d}TNiHIFpBA_#8iZ@Za0sXaUy-`1rv8;
zttaok{hiNz_RC-U`X}Chkx!l&;P>|oCN=L0xjBai+yaK4?!;k}c;J$G;Z&t6o=RqI
z9=V$tQiDUJjD_&|a7q*nrRj~{nGg4y+kfw@UFJ9+b~n(rAKSOLa+^65QB`?TTJIHl}~-?i=TYwt?#Y7r*1x}6(Pta
zPYUzS=8iL1!~r-LbnfiZ&;>?gFs)&R2T18x)fi(KiGWm>Q~^WrvF{YEEzp;LLE%ad
zdiZpbxK1MgwS>tClq&tbw|mITAT=|*CumQ0H*I#q@YGb+)2~OB`}QG|p%&8$l4e>^
zn(nCIN)@92rMmCL6<3#W(4qvBbMIUOSt>1a`W}_bI^}FJ@R*H|lE2Kz;?wJ-P&Jjt
z2;d;qua?%>Ao01)Thk?xx%1mqgP~)(O}rU?J;F7bQMIw$_?5r&;3MDbnvmDH@#^K*
z>CN;LVocDTOj+Gv$azHcl)DO79Vk3=b^QSB(nk`wn>0X%2wFjzo5qlk7@?(JRM#$5
zDt#43*9=nUOaTUm0vJX#*oHqjv&>CHlAP2%6Pr5eJ{2klK)`|*aV1@ClOO8NAaC`CSw3XA2
zRB5)hhQDcBff=~+4$1>-yl}v?hG`{JJJu%3l^GZ?x;|nVd=@;W+b9ol6spQE-zPJM
z0)C9@B@TABuIil)v#QOVq8Bkojr#g0y%+q{Z6i8i5qL!sH%bnh(9>0cvYMD2o#sW@Pw5$)QL>@S*2ptq=0y$E9Ju!^B5Tz(Sn|%
zL1+ZCJwDN@(quV{p>fO}PxE621h{+#Bv~O|a>Fh8N4v@ThouPCG49tiQ78{HW%5)a
zK`f9%bT{T)C3SNd`C?8@-V^&*3nrB>ru9EaPB~~wJ|M^igFrYZ`g(N23qhQZWjUh;
zf4aMSZcgkKJmnmjJ5nWcgvQqCqXvWI*f)7`q5Ln#h_jZWDaz%@2R_6GvA`^hab&=ais6o*Om-y}5G615B^@qxFcn
z1y_2(vk+wwuAvcbH5`V!t>tLsSr!0{QlNQ^ll}mi6q$GJ&Yj2MOhIC)OVh$LJ0D6V
z?y$Rh7uDvnKXti+Y7_*mjC;VZYQ*8pO4Sl}-M8xlBP_z#3SX{RWbnWdwhrHCz43;>
z@wv~P=Vp(~4MCW}BsT&bZgvfBokeG6HgLXpmP`CII3o4EoSqUvq9#TYYZfpMKPV6J
z6F=nM44U96?{JaOievyq_aZZ{o#7h#KGO+3sjeBC{J`#Zn)=YHGkuRYo4e)@!v
zfm)FGDywQ8K~VBI#+w>IPmiLua5tKM)3cG=9I*~`NBCOHByH6RQeC^!Eso=$sNT)i
zih@;R?*y=p1v3sdm;(q`rK+3796yZS5K(iT9{iyVG5MVEY($)!ns~xXmDO--V4r1;
z*d&&x6wR
z9&1RTn`{r4j6%mi1MPG6!Kh_Nce%%L977dddseZZx-%bl1}2hhGBmfHoA*I%e69zL
zn``TwUeJC~Ni6z&YBq^aU9;jZYFE*|sC60MNmat!o(k+%?&sH$stq%0HG^?-fNQrg
z2_XW{w`?#ggvT-sO<>&u5D@~$T=5x}bR4t>k(LBT6EkAjb;VJW5V|JiGbIp%TbVRy
zaJ#kVH@TA`!P$>0`o|bIVC3G=%!RmeTiC8TnXhl?QDrG5Co*^?{)7{tJDjUz@MJ(R
z%JQ#O0^IsxuR;Q_0!k7?_P)(UyRnyY!mHFpN=jNu{#v11F@dTqjQO-1@D=0;lp$Qu
z0tTPSxsTQ`1M9wb&eYgIiNX;
zUZL2?wsv>zJbT6*QUFK5g0ap(aQJc>Vo|DqL+U8Phr68nGKQDrqz|2kEj~089XeI=GY;^Ac#s$H=R?r&{B$^ahMWDTlF==Rx2y}X4W`K
zd3jX$@`wA>;@%*KlRMoT-msc!8H3-q+Ry>D@i02+pNh1&jA(%7_Zm=}Z78@g5e*G~
z+*Q>d}3xKP466&_6LN6!@t-l&3G1jwbS7
z$zBzz&3y4id)&Dl*3QNjGdHlan$A7mWmObND9>P7I~;FVBi7w}-+SjXpZ@HdpZ^qq
zEcftk%L1Pf8d=C$V|ILyX0w8yFA&!LxXWSd5E`SAF
zUKJo%2WIIwY;=T=6%cKT*wWlEqkn8>?wx2`tdG08i&kElIT#XkZsXKCV1Ev~u0`v1
zo>^_N{CnSh@r@t+*nj62|G+nY`S0C5eTlnS;hpVpEPl+=@V(D%9By{gXh)ah(6SXE`_-CFB#D!pZintdG09Os!N3}rpp
zm1lBk?4852F}yWB)u=Bbj|#N}V;5aY0oiidfFG~+$_IE{b=%eI;*=7gLB7c-{y
zN(Lym)Oln8P*pom4O6(H`dG_|l_r9eiGg>kYB-jD9J-;>QTdn%77YkcK#ovO%_N%N
zWkc%n6Jv(MyNOXX&ij!LjL_mlR9u2U*Xyu3nVE02m{6XZs!l0|Wb3c!avkAGzRrP`
z?>dXmV!p!rZ!|!;VO6nPzcejVN4(mp$gOr?`ZX?|i$Ua10P3uV>TTjvX@1+XkA)Ch
z^2`KXRASO!O8xp&)oD%mJXP|Xj4(E9Ob0quRpT41UMrAD*Ln~@(nc8|DP^UlHPr0o
zFGZ4yRS+mf=rQ2}*eOHAr)}tH9+VrM97D*Zfu=gI(M@W-M<#GBRS)BQGG(jGr`^O+
zY5gaIw!5u}nb^`m)0Uhu8v_|s7tb}wi&zRKB41fBkM7DXuY<|sp(s~#?C7;~adJbz
zo6sbNx7KQAzSGkxZ)R?h^rdMQz%f9SdT6QH=^GJRBbVsmhwV|&V0wCMYc~uUGK#RB
zNk*z@pCZ(Qv8AuYJfUN%5*WrBRC}oCXs=>TQ=Pd5i~*mKZ4%~zxaa;vHdn(fCMn>a
zT=m8!kmm9(DblWhe#>MbU5gPDQyie$SrEqll`51_;4Pmdw<=!Gk^bc0&Z`p4s$yGFO4*
zj>2g!#?+iXdqIHMSlj@l$S~MMdzegJxv-$TpQ=T-&bG4-i}UKg3k_6&2x;w*D$
z^Y>*VjJ9zR6wnB`x(X32!;0h}$&)#7?a`fTB`b-(-VJjwc2c;}Raf}wg%9d&`PE)A
zUeyM-@L2RnHV>hg4d;X|7%6lY3>j(!b)J3XZeVmOxA4X1wgsTLM-W{j8_g%<>Z1VA
zL}br%v&HTLZ!~VtjMqHOI)Ld7fVtafr%h{M(o8c~OferA#!M|!XkZK;r-4Xlf?7?q
zWsX=xc=#GszjdLAkA_n)&fOG)I`b|>63%V+E4uC*VhrXPd5&c;w_0w=!Qoayt-ShshsCI4$m-?)i4`i7)US5
zj`Znbmo3+}Yqlwmyo0Jy3eIjV(OiM^Q3_4r=JDd$dq41%-}LEEeS-Or51v~oorjR6
zF&bgWFF-9kx_Bro2d9#>yTy`wXb29jmR5p=0D=T5w6xap6|6Jq98AhlEDQ^kDPtZS
z^6K+vZy(3H`Q^K6;7e>loXp*2RSI(tn7c0?i9Pxto`_l%q^3PE=cLm8s}r1u^lZlC
zIKKCtU;QmV^)o;GBcJK+r%&7r=h>IU%S?m5ST~wmW_HQyc||O?Xeu?C&A?S{vxCic
z*3Q(vpgPj6yJESKJMA(coTBn!X~>tl8xYGp0y-Ei*2Eb@$_FLfgMC6SI^JM2a9bi2
ztKt~arrea!00u^xjKpA8W@iGxvFum|;Qk%}e&}m&eExHveEaRU*ORA;N5k`sN$k*#
zP?Q5`Yi!pFXAqQ>hIhO;^MJ6wy1*wTB<*Hm?rUF51jEQlQ6Vh><14i<1AL7
zQ6A&TuJzVeg24J@t(fzf%Y_-VP9NDxNsz)-rMkzY(_*e^VkT~~DZO8?4;RXpxMy3t
z;7aohpv~l1dl)bcyrhCRRp87oMehf<4vQAKJq$U->myne9FHvLZL?WXEQ}{ZV=ltZ
zb7REdmtjm%phHj*6zF2s-|*=+HuMmXFw+K|G*aP$-@^I4;ju`o(aJ(1ITNa7t{j%@
z029S#S1{9{kcVGaCHUZa;uALK)aFVu24d+JA1S=(LQH6kaYv^!SDKJfEjMCTeVz|y
z*O&GziCdDuYIS&NUhPPw#4ZrKSEkWb?p~SU%ixT5(DsGkiB8RK0D$T%=E_D2w_Xy=#Mry}>
zN~6%~QN}HNXN>1A^_iJxm)q=Oy*gZZjus@LAd@Ry4;wC0%OGKTRqAn8QG(SfGdAID
z6EB6#HmEyDoCkV_iz*(H)~0HiEvwC`S-hAoZ_g|+dp1nd=I$=AC6(vB_}=+J-B;}-
zbbnwYu3I|eQBF`@SA&`Xv@)~{bm)1B!}}{a8v_8~;whc@ivzvO8q3+=wf8<7HBc^{
z!n|5Dl(}Xp!SaZfixc}Ziswal(~(GU+1@glYb#l6@xFDD=&G&xK($W@6;`5?Nn=Um
zCOX@Ki5h(MMrsrk&^xDevE&;-nf;PzVgT^OlGYjUCOpx4NCLHDrx#Sfod14(!
zOrK)ND$-vz@EHb0Et_rMRf9t^DwbMk^1^rZAW-HO7j!fzwRfXZi=e95{>g!;#C_Rx
zRaFwGRl&Tv!!MD&nV_FWWBFQf@G}8`eV#4dV>J?0UBY&(rhs7E4&Nq7D)L0{N6WS`
zb4Q4BN)hYN-+%b<>rX%Psn-Ei^^g+^ZjU~rTNdX6UM_Y8lEIkB-o|4N^J1%N^HYc)
z^Ai+HJ0(0eptJWW$3&izu&~wVfOf*k}#3gpub-sRKwgnBnQ2FYmX%n?LyzUw-{VAAj-U9_`lA
zZ5&NxL!e#H$>0&I#(Ds2K$O4SEV_L&I#@trE#^9Iw!-h02h2$g^^I@~>706LfDNGL
ztOnZFx^tpkH7(O1rf#_tnLqTk&wuKZukME(=2niv<#x!S!hA55gD7)M$%@*Yn_ZCr
zI>Ho5+*s^cTZC2h-s;{V)?S_G!!}?=WRm@MGBdf8Tz!L@a7g^q){Q*rWyqo5orKqQ
z&{)$K)132N&1jBlx5TR{*I*#9i$!NfNbZAuS?Hz(!TtS4`_rdSzWHmT)iV#~uFGDz6E2kU~3d4id
z-8&0?ym&wJeE8#k?B`#9^@(*IM?XAto~;0muF~5vvre+Ay>rhIM1awBwgLvD)1#TU
zM(-(+rP*GOO1#lK%i7$KXY$$RrYAV|nVEnaDNuLMtlYU`b@PF{_80B1U{%PS6ol_h
z9k}P2dpFD1(rImbe#&`nbK`1M&c<1?XHgzNk5W*(EddqD<021(Z
zEaqhlFMJuT4+%3PdY~)g@@q}YLt|%|JLOe9m?W1pQNQu{Y;WGD59szU3YGG|nmB|W*Q6*s?&yXC7ywJ>l=Fs$GWiMeNm
zFsxCM4RmKxdM77bRu)D=3>r{UBS8|)2sNTzy0&X!J12;YO#nL%lOZejWzY&5z;+6W
zzVyZO*v+lv?WrHwVkIf|6H^;Q6;y6c62|0I+8@oP10mn8AKsMyp)a45f+TzMLNuO~
z*Dlyvycuzy0cp&1U~vg%74s3-tY(QDI1rZkRT7&V=NeuQ8f+NhgXW%|e5|`hOd&xN
zj3|8dKwzky`aE6cz#^1S!@7!dgtvt(pMk}dT>$%{~*iMkj>CEAbBVl9MW
z7olIgRF(U3GfuV8_m!*5JXjBz@&{H`U9k2`sBFz5mpTtYf^!TpD;Q|uwym;iZjIZ4
zQLDN;Yj-EFmzX~Bm(-y91e;x}!aW;X1HgS}?PQ|cSp_&Rxkfq5azl@fGg`IOZGJz!
z8{D^SBV;zklA4rJI1vbA2&0-g!tl6t-a#lB7nWiCh#P`qQe)%FHtZ3Q21j?Tpg_ge
zTElkUe!03P6f_4WWlCR)CLlZnTym}8tK?4=uuAZFKy`LQ4T=$tX?rDHdVx0=95$#E
z%*c+I8i)zhkJPPX6;1e1kC6xm101VJLwhXYOoZ@*Q?hSV4O>7tE|PVZq1`2iyMd;B
z-;TDftgPK#J2$s8&)~bY3`mwQ-SX1Yi&T1%yj6w3q-mBr?WPtK_K?-)*Sdc$URTNyW?>8eeRtb
zPAt?-FgWP}Ha!b+CPdNJ*QiQ$of|t|yz2bi8?S%%jn{!OMpmVXMvn)h7O?RLvQN=L
z3@ArAW^+W%=NN7>1aO(TYlbR4<+&#@rdDe4Gb{AoxlfricvzQB;Yg*;3_@(&-zR{$
zi|L8=ofXUW=9ui_CxbT2)#Ps`U+KO|-3x>_%k1;y&2_9;E0{-6>SKae+srj6+5O^y
zAs(imz7$VivghyB7eDV`|Hjw%!wWN~9Wme@F(m@o6>ttG#J_Pjvqvd-Xn7nofMjsc
zn$aT;y_*Qryw-@dVl4u|un1pHUWP6JzE&(JRgE^l19x|K&)<8`pMK;UKl-JoPq4Es
zn2NL>?>L$mhdH@OCor0;26oaPA*6mdA0N
z8Gq(a{npR@z>j|S+uu5#yi5++ov*^z%5}B0Ma-0JB)@jwBpk
z?lnV|vJ*o9YQE)jVC`YY-Fx5tFKp*yl{AC
z@5=j!^E^)%X-a%UuY);`lqt)>L9o`bT$nDJX=m?$-I@`I9G4Z0H4d^H_>&#@D!X614)jhz@p$$!@W#D?80^zR+B+jD{p|3bk`*
zZ%lsEY_b|EgZrE7F;-0PvroQ6u8G}fH!>fCwYtpem3o>R;R7X7lY;=w`jm^dW`M_}
zDWkt|t$XS!xi}}45_OZr$78x-NvQ!ujL>aP|7UGIelY3%$<3goXk=jQiEAKhXP23U
zg$)9G?MHfx`zYJh)or4llq^mAUu*r}4k@tH&mHbm5$Vh=s=j+7-yGck|G!i{%t7EI
z0UHgPVRA*FsOe>sfzP~*5vd8+t*qqn!uO?=SH&T#1gADf-*s!u;$L))S&jvBFiBIU
z3g0P48m(51kPzW4KlgN^g|2Yw-+5Z5S~B`U=&uz>zKrbhBdT+rW=r9&7Xml3QZriF}P{)KqNhZPX(+zU5Xk
zBTp|GsrXv!wh__hzH^%zYE;<6=2?!Hig@ihh9;
z6I}%EsDEQNI+giVo!v>R!RFk`v5O3obE_1Z10F!A2Jslt*g{_cyOF?Zk(!jKFK$X9
z$QtNfx>C9b8*Hs3VpY3b2B2r?iqhU7i10HSZzUG7Nvh%(O{aeN6r%<)AmTIp!1lo?h8sx#{X@Gc6jQX`aj7~K9|;{2;?
zPDdR$$y2kxWB~^Zm)q6oSfL@>-KCkjgGW}g&3oD;_@COjtJ-250MrkK&PI>F0<3CR
zCCVx6uTExbkdTBPvpP>AWEO(SvwY;O;n7uA{pK4V_}GW+;a($~&CGp7Y`5K_?Juxr
zFpdGw#v677>U_X_Ddy;zI-|ajhLOOp&QtU~z|Kq>396#%k{_%!d0GWuR#56B0jB5$
zV0m_|mAeNpR#0Xn?=Je3MmS;3tlT@zjo38N>e4}CcXz>nW)2Rk-}yWLVUIk|Hi$iI$bN~oZw4O>Rp<5Kg7W;lDLKrgcs1+Npw5Xc
z{4$^a+1T;>2!xEzaGYgVaBK0mY{ol|C-1)f&98m`n_vC@Hy{Ui1_&fYt_O5~e7rlAHeOj6;Nn_i2cbz@IE+_jgL!sduBC3r)upv^BR
zTr%TSJT8CDwXWW0vNk@?llz9=xgHBM@#qT9!ltK9y^8aqy9@XC`Ec4xPviM}=SM&E
z+Q0f&|LJFMy^C5b$xvnpI)R%ldgz!1;6MPOjLc)iF{{ev3!Fy#%1ETwX))xWy8UwM
zaW_XbEcV9pXYc;Gf9el@@*~TTZvNs$WJ#D?h5eA`*n3Y2*G2zTos0sU_huf&?Lf^;
zXV%_nVcj^-bhq5w&2zI4+j19knWXx*)#cIInO#}2Tm}<7tGm0gcTy$_^v+Fm(%_XE
zA)C7zZPvNB4*jm`+IkbHlovfCKxt)J)43A@uk++N*ynv!^$M6-l|O&q8u-R<{_Go{
z{^VQVd21a{TH_pD6I|d7Xj|O@dM`a=kcqDIdLv?SxRg5|Bd!KB=M=Y#t!Q$IJb6__
zi3doc#SD}b_yA+3Ag@7HFWm?Z10TUti9BZunaD#Pz9gU~sPmcA^&}vn-RRv^JQb!V
zRU!kqRLrAhujwx4Lf1f1>bjM)4Z9-cj3jIq3_&5)b>af8$wqvk9NKd!uB&PoBmkP)
z&C`@(0kgiH3gmRy6b32OrZT9~DlBwKyVYEDZE$Jn+q%_pm?T?T$*VdIP?P^KN>05}
zSN>0~tA#4lO$u|Gw;D_s$CQ5;0A$nHK%uWiok0sg1Q`o91xa`JrfHmoyJU;QvXlfh
z2FST_^pa&NL!=Vx^UVOFVzB#L{GSk#1=hfEvNwPY2B9`P*fWK
zAejRZv}$gi&G~L_uy!%|T|{eHqOi16S&IQ1wW4`YaHmj7dchzFQ^BnyaMlba|RDWhI1eyG5rgcgxD5996pv
zOLhGyc=*Dk#5NELp}t)k{37`WOuvV~2<_-u-R16>jRv7N80#%#Lxm5}ZU#}ZKrBf~
zg{&BMrg@NN9L1A}32+_;qZikJCTvd@j_Cq*F|m#2%!ms=#_j7L{m}*xd31dPqV)Xh
z^<}D~-OM5Sf>F`I0D}xgts9-0?iLXd%Ot5sSakOwd}iP<)wxaqW*9<`4q&vB
z=!R@8BRFA18cGPo(>DN7!Y2W?siSEHJUC!{&D^8(M9B+;BHhWP5b
z;H7y;TuXy~5k-3R5P!ovFf;Lu(%%b?8={GicD{~%;Wj9PROp%(Ft>yGd&)xmdTWC}
z(U(=TYDs(YR1T-JoHJQ5)24S{MtBBH1+Gb%=+4TMd0WgJD)?*$*q8~$T8p8|++N>dldA5ogh({0v7)a%{FszZz!YFLC={IA#
zSPGpj`t*o(2tP1KECVM{inxpUWIYbTja{XdW4BB?QlN#BxSOfl&G7U|`0{t(-aq#{
zfB3^6`{ez@1K<&hZvmsWim?GFod4vc$wze{u&cmYR4@rgY&Poz`
zihuJzz8|WfLYr}ITMC+Pf;!x~
zxT|aLt@t}Ie=Ih=kj7MF2~D%(n$X7FhRnPH)~p~{2*vVscz2(trfE^{Du&SAtbGP4
zRhKVkE*3{ToO}HJ)jp<3>g{&(6BZ(0ftKDs!W@((8s>B+Gz0c}`
zBbGBA=W}5CzKO`VPySePv
z1pun^%o7IU*QQjeMnmA!snzbLxh?kS@Gw{E?8?fjrpFHkYxd=+Hg?HJ+`?U>f^5zt
zr|tu{bn(i?c!*54UQi0kuzh7z%pH_0O%{qq`?a$5X2d^{h{(!fp*#8egRV9Vdd_AR9DMCUT}`Y9@10bCFp_(gD0v5~dMpM^ihuhHYWN>>#<6~?6MHKSU3k~fPL
zE^(v>vpTLmx13%w?wMx4a(fmwNxrcK9V(SrIa0YY7!B^sw-=2T#tN1K_gSVs>@
z&Lh>_cH*37Ga4={)n@cDH)14wU_l?Y@{lsAguL`jFSON3~mK>{%CZ{-%#gLS@)D#0;I1y&-(}{>R$l7Z)%^j0cJneHFQEk8;+%53x0?quxwcln
zt_Iag@FB9OTa6qEPMLC-$)5|7c>l$I<)!tBkG!g#Z?nb?7xgcOmCxXUcnnaJlTi{)
z0>oVM0fD!LuHL)OUAddwqX#lIAJrQ4N+4`ZwwCEgvvo&{frbZyt99U3SGKRf*0hPe
z6^}`;@%pQfqv_4$kRB(TU5(t`3D&METf!y;
zI8;;{I>MgZ;d^iI@B4E6*iZiC!}EtKu{TxiX1Ob7e9jF&gL!D!2J-_OUk4445vIbW
z%Y`}>k*PyfE0wiY11{$W9(i&H_hoQjckjLX+}CSA{nKCj;OocvuwlqVCUQ$Y
z1jF7%t!Zhe)@<+_*st~*x;jrvR&=0cP^S$+m>bw?2n`Xt>`SF$m3vcaCn_Bvc%4c2
z3p%=UhKiYWRc^WR05Djdn@4MBhdVeTSblG9t==SNH(el022*dI-j`cvb39UKKRoRF
z7kwPwm58VR`d|MeZ+zhk-}&~p;_j8IHiX&Yf4j-33*RA@AiIbIq&FJsOzW
zKZs`bHT+v;#6mNC8fona<0XZUg8B3N0_A54YtpRq!j2HYUm1gP-0Vau5gZ`
zqJ^1dZRQV(`wfxj3_t`vHM4fm$r6q4X4a~HMfB;1Qy!<61O-|%8EODSY(n~4`fg1^
ztcpU%VznkDyZIQlJE;3$_^LAaRHDNBNO=|071)&)|mI6Oz$RgcAKgx|QQ>jUl;bZ+E
zRTOs$jZ0C@5!?<73E%jz!4TYCiO#CJo}kKyY*6ZT$;_4aq8{0!5}0F-ryOj8M_1KQ
z3jo7awI&f5=hjSk89bOQ#Z(ewFj3v*aEGHMhy<@t)zwYl$phQ8w)vD)g>~grVv>Jy
z{TpB|hdfO3L2DgM3p()`)mC*avl8sk*tK_V6Ja13NLMq$bz@h$S=C0n`$FS9Pe!%|
zscQL|A&B4#fWG^l)sRi)0S_KWrYJbEZ3Xu}0s`2RM$nw!mEXx>pb`sPci
zxIlFueI_Tb6R4+mt0{jvR{(DfXd!Ru;mbWLnFZ=K8|h7BvuI^*H(%>8i!rs547IYz
zq2!seCmp5*u<#&&zk)B08qu!O_-O`4n+^d8MD6L7U?gSlD~CH@H%UcD#R?XZ5upHg
zJ$ZeLU^Z9EHCa?jRfyY4>1DuSvcwHfPFLPx|jnrBhoJPR)?cX70|
zyTyflT&!_;^e8R`ppKp#M2QR(u9IEUdFJlEu1008dv+W(GItxhofpp)H;;Aq;(ovW
z`b!`G_^S-gq6ql_guVlVvdk|Qucn}-ZG|f!GP4xrNT^Myh4}N*#3I{gH~MN-yRdPc
zhx7A|2zy&+vzxoB-9bXey4PK>Jto|z&4+mNjRF1*)L&_WE0yFsbMNZJTJ-KJo#Jkz
zlWed#ylB{X^FO?HyvTp1hQ-@AbgyMkUOKYU8-M5z|L&JwTDuW(Fv{=@8#U9&w)I}!
z!9G=QkUCvp6Ra7Gt%Si*t3;4|$k=3sZ@$)@=B&hOoA;q0x5hZy)nIA<UAGxVul)+_8ME0Q&{N
z)q>2DM=MnjM2zUhwy3M5I)EB6%mULHR5==vl`et*$&-Zt>J`(Rbm|rdZ%`sv%^2xoU|%K-1KRe
zqFa@vM3+!u+&C5@V8HwL1>i@%{^^f@{6lZQ{m#>uUyZfQRqUyw7+fC9H7BWCkP%JG
zq}_FQUxK4?bqQG)E(L)G4^RkjJEWK&c;F&V(H9R#Aox-P@kUIRv-Ah)n&uG$RxEUz
zdukBqFkO@_1f`X|b61rGugtl>-4_pHs_r5*anyY%#YvRrbR89StS(gT*|yI7h!~Ja
zJT0JZ=&Wbep`@xiA{s2)l^XHt&5@ktF$WXlBy*fu4YE0vq)~^pDVQ*RDG@RP5GvLv
z0X3q-c&yU$aiit4le4S@4)f%s)o}60$g|EKp&Cy>JWfQFnqDcHQUESxC6+SC5Me$?
zL|^&9qk6+IB^dxJ)%B435lN2PxeG;2kn4J=l2Ct!jWot?UAvW?RrItUp&9LI8f!&m
zHCrMZ5lZrVPV#PPXLM_W0#I~ttIJ_NYV*kgtkE}PSG&GW1%=2fyTo*}RFtu>|BGQn
zn~S+|C86Z#hWp|Gxp@(N%X(VrD04rNd)!6ns;t~?V@?KB`!@3d<^M)chVU3(QCcul
zAEuSDsI!YcVTnu}-@yJ4?X*@AA<-g?9F?4dhB&9h3}S7s{rV__n{FhSX@oe`U6=#}
zSe7s+rA@Z7$)Nw7-Xk{`rdL&OnZhZP_SL4^JolNE=$`X`-n#O8^_PyOmv5jWyoL*+
zs(?;i%z^e!%5p`4vwUD|VOnD{#Gat(W_GD=)rsKFUOQ@`TcqdkqNvUi#7O*-%yp?1
zLKql?z+6sq?M`fyFO+qrSLG;}b=LOC>nn4TW5=ymt~FP(T8gF~^*bq6GcKkcpOv5@
z$fFz8IRVQCOqz0|?GhZaP8GPLb_enx`s7J+d)_O%G0PyZOjMDYC71)(Y?k>G_h>da
zxMg4)82#ly`e8B7(1WWgYa8uJ1Yvep@AKT5eEjqu?xHvo)00(i6AMvY
zNo_E#AjwYH46cZ^Fz=YKpKj9BThfiS+|6bU@PZlq>H^1b%M^I6skqR!!n?W>?wr>;
zjd5%QnhLliCpD_A8jX@oMas7@dAcf4wz4krJf#DJlpw(7Jt+06%I?&$SuN9eetlO{
z7r@iq!z`8urgH{OqyX2~OkqZZRJDvCSc5su%1YA!Wj7PeIg>;yQ@AHBe5&d^PjiGj
zkG}5S=ffMHeC5-h`aq98iI!M11-gho74py$ZL@*-O#ml%sQMDS0b}^9?r>XU&7XR5
zMsi|rrIJkxK@%LyJF2SG;4P3}$ONpzEq4=3>*{?bQx_heFzknIZndifwQ6)KJMPSF
zZwe&k-cVIro1(AMI(J`^V-`z$GiZ!^XQ@X$)MVAe&~sK~H4u)wu)90F_4fWf+?FQN@q%SI1(&1zSA)yB!GQ_u7%==kpi8`*;1=_kaHW4F{J61F}UK>+!LCi2)TZhJnVH|^*XprkrMB(18Jul}Xqes|~Ru7;iE=ZW0Cv-U2K2xS?WbNY5)r>Ej`
z)~OE67GCO}dv{$H2~}I)$K&!mlSQGsHmo^zX1A?NG~Q)l#kOj*%G~>*AyN0lHE087
zO^`$8`#$>v
zU-`n@-+9~PaC0_UvDkUU(GdhuI94-fP+a3wNTT#5%m7V;D`6U{$zGVDSZQ!jV$qmU
za(u39yl?@u#7yip_7+Ui&?A3>QtJojtn*5Rd-HM
zrP+yI1#t>K6T)`a^kYp8ap#Gn4JN~*x(>Lmc4Mb2g^Q{~0Fy7t#E_|Rnsge`d-AJj
zX0Qnv_QPm=H_Dt*1w1Y`<;>V8VLK
z(7et{mUChpc!Kd!^y45Wv95S|xiPh}Mpn|)(Q+L!g-Vg1*aA#$=C48f-|pN&CSh36#{rD96a!#WTab=*Y}N
zOwtLf8V9~Mjn=wJsylOMr5UUfkgdHQTr-W@nfY*@nVZGNq^#t(tEaiTFVLa7r>(bG
zOGr1zjTipD6`VbB3u(;DC?jXz8I==FTG55+M$G?QSaXRsNAHGq#j475{^A$8#b9M+b@pv=69y)@
zv=!d=D193gSg4ig)eC4FK2-fSYTD%RF2O?(8VkVCH{m?{Oq+|T{qjVZ!=-A&xGO$Vm4&fc~*7n>DgSBcHo>c&KyPcvS`scLA8C%c=9ol3Yc>PSp4+x-`91p
zyOjhuf>RtoMG#_Lsxr(bWRsqH&Q&#$rfc$`w90@v_Aa$vOgBCi1ZKvRLO?$EgIjms
zJ+)U}IiA0_KlXb6zTf-XE$_R7L~HXSn5ig=x_oz}l4SyC?1XI4ntX+eZ4>zFe$}_;
z9dl|~UEjF7LslI}xLIu|c(w+R
zp?fVoa30=9bqu@BscbYkL^L|W)>;aF!E_U}N-_@aCZ#67UidH$XxQ@ZKKB4I%G0zb
zsyj0y1{2|l=MtvjTCVgq443zW%i`W-8;+ZrLnaEee>Wbk>xgk)gonowW{_6^?BQX*
z|9<=>3lh?ob&2PW)**E|9|LgzZ>mNLFC%n(Z{k;{e
zni>HJ3FYkiv0LnU3N54;QibqW7=68uW5o&{%4>Od0$A%1$R1Xe``qW=zC2b`^;&At
zbhqQ~h!yCH_%$P362Bio^9_v-*0~AwIBb9FFkba+;JSUyG=o8Ak6AX7RHL-
z%x=M+H!mLTz=dHM7B{pqoEaQ35Okvn_CNy`K>I9XM6o$5R2|CDG
ztP6mWu+}-khcFY+Ww&i}Uiz>}K1Zp}9W$S0M6K(5n+^pnGQf@fv3xt(
zl%=S1>4{IrlZ={G(->29^IKu!PIq+I(&QymaHqb(TXsj^$7^W=obSRA
zdIJZ7Re;iT35t18ts}?t1^w7QJ*8KPvyE=%5|>j
zN3{BCs99)8;nwC>D7dmpJ$BlFSwtM`SU$dWq=?O|Clk_fK^6qE9lO#XQ#iVksoP^z
zHo`Ps^d_^-Ha5~qUJ7)xrD#?Y;3(AN)rDJ~)3*YYf7Bjw?R;|w&24OUSWosP<)d9f
ziTNBgH)B3rjpf(vfSC-zS{^#)QuNp;HJEh{Bci|;`u`1UHx#Qm13|Iwax>C?Kv$g+
z(OuyZTT;ZlbcO{6matc#dbsCR+{&fmm;ku&kpBl)fczAMT8b2Ww_=zDX0=2Zt5;cU>c3buJ~0qi~*S51E6PM5tQ=G3%!7j!3V>L2&cvX
zY7cSzhKOTyBSqy_A*WflAA!Y$7PwU=H3Rv^q1R1oY6^SnW;?LWJMMu|ZllkP7;|M6
zy0U6lZE_bzVRttSmD|SmMWmOEA<^?F2oVlxR#{TkakN@Vb=4p%rC~|{%xK;_d@A)(
z%)I&ew|E3qAmCNAB{(xQ;X{DRcoGb_jDak>O+ztMK*{c>bb{vKc`k9na3%z$1TWD_
z)G1wM>dfa;#lFub1y@vqR00x`cO!{|fhZ!4ST{)J6Z#<%t>DNpV$)0D(U@qMO(}ua
ziS;EKGS`#>-7#R<(>-12;?S(>aUvjMrYr1$=wKGtcmM!l_Hchby*obl#%lof9#}wc
zwda}IMVzsM667*pbN%-M=;%=GBNz!cHnBi;I7uFMW)QiCj1t{4Rq=8kbElyBeAINl
z&q0N2XoCh_#@UQek8F4%Y(HdEza2i!BTbi4yER?VE?6MTo@v8fU0D{k&r%mkwRnQ+
z2vh0HJWohBRXS~ExtpmL6aDwzuRr!jf7gdT{-I~jUI1Q+h^QRpJv{m4lpB~D7nuv;
zLa@LN9F{dPQ;?O4nK82;-;1_u`Y#z3bMImZS=3!Nq8o_2h*#eG)?2^-7k=i4zy3vK
zV3)_kI0j$#j8})!mPM#Fx0R_uh38#eU3`3=$=x??hhy{0*2l^QY0@HyZZJk9pgVVR
zA}(i3X=m*g%MhT_mPIFspEgGwG
zz<3sk^iI70eBZz5SpLeZFa3jGdj4nr$shYS{_Vf={JYF5DwSWbzh`SX}(E%*;r{=GI`&)0n{(+bO!+-Bz{Nm@I_ErXc
zKG;67Pwd?Wpp0!;sM$&w$bedy%F_CG>7TnR%frP;G&mh}pXDpK?HF)k^qF1u*pO8`
zONn&>oMWojp~=7$afyBxW1~#8c!|@Dhwg`mot4DS0jI!$+m_Tf6IV%ed6=-}6cPxu
zn5pVUv6sI3Zo#c9?fHEL@Do4s`44{ZL+^a|ZMVg0UgahSu#-~-NQw>La;4dQbrkeP
zVplavD7z#@DGsTa^b08Cp+;Sp&i$(H@@tS7E=kKEii%wN(GYM<79zWgQ!=kQk?Wtc
zBC0BLOL5RJ*hLVHx@Qb#=f{;!a|wc!Q|YF45q$fqHGwe_pk%NxE?^KTd7*k
zqHt8f=H_oq_KA_PC3CnEs{v5?``a}umtxrOF198Nb)A_HnOQrni`?=gb^H#q(AycH
z;8GrS=P>bTw*8T*G750?CfT_b)K}jQR{lH#&1-qqJLc?$H6Ep`X02rA5@At>)3oVHkyCFKa@|9S@iN8{2_}n;
zS9SyhJqYD;%d!J}90eEeBz5HK_$T((VS2OY_Q9
zR@)*`7<0H0dU`LJf;Kh3Z9B8k)Zb}K*G4x)5-~H;0cRrpEPPtg*!iXPJ;
zFbOJG#+=~hCc+R6^3OE<=BJkooI%k^&tZQ9oK(4sEa<-0@EnJ;f_gTtRb0lC<0x
z|6>5oeP-^;f)$+SL%~4shh)nDSH}PEP7p;Yvf>x(Ws-Sj@*A4YQfYM1gaFM9T^?2_
zfV3gms%bA7ObZu?BAn^kRXw)Gl<8K;Rm>o!)Xc00O?1C(_nJtUjZE-zmlLZtt6P=-q%a+)7EHTu`_8k&MddBPD>VV-5`x0B_
z>Wb7FRN@Rd$4zz;da9-jwteVfGm9`+rEXzvqbNY0J61C<5q2xCoE)fR%wOe!5r7NhJa!rKOg
z3+HRCYG0C%-sip!(J2nu)q_xc!rh&}{K}KJzmq@so8ou>o}YX1{8_aJTla`#
zNASZ%K8H70Jy2~ZX4yU5m-zx4hG7va;xK5$tGaGrF=J9;-f)X$5k{-#Q1$Ch_H_aN
z^yOFHd+*z?efU#<;1B+m4}LJ7J%4bwYD+10R3c6W2t)f~9SqHzbnuLc@GC`JA>T{^
zX`wQJ6=_gW>43>;1A3MEMd=qC;4gtmgmZ$A&E_G^LI-tQ!5HrbHt5mmU}rU1h;aqi
zYb1%`)@|obkb$gPN3a{LP!?V+c&hf!+*>k!@5`6{`LjAtd+BBW;0Is&<-hm*pZ*g+
z`ZxYp|8hS(fA+lM?&Y}C=uvafXPH#0y9aHcVCr;qH$$+2(jCBx;0R@pa6jC`{K;|m
z8t$Hc@4N4O@DBgs|M4$6^L8)wLp3LQiU_%0%wj
zqC501cmT0HqQFEMwYSg`2yFuNaQeu8$9YmDb%JXYEp_z*>9b`>Yo9a~;#n`P?<$#;%p7{moeCqYt>Q
zsI$(>Z4NglKx;7)zem$Vt|Jp5swe8AY3n_?A9M=M%o4W|IQyW*lA`en>NgaQ(xqR=
z=459~`TEf|P`K7H%ZFgNqNN3ScS(P>@RS)T1hyWzmIGt5nQ}VlKKZq?2L#^O^{do|
z&9z6gpjZgvqJwaIJ{M-x1I*+0+}eG0o7*Z4V8vOebRGO*Jq1X_(bMq3b
z%0$<-nc(^BVUu6Q4ce$?<6@)R7KM6+tg->UgbWd_ZOvAhzh|!%%QLI_Sh^ri6YwL0m`XIGWN
zzfXL*&ocw-%OJ1LbOsce6E%`(irNv{am{Jc5*v4uvLQ&+4qkWvPur
z9SN4QO;c`fE&9%Ed{3ZvtyU$4h7#mMfV;adj=DX}x{yhHh?!ANYR{Qn)&k7c30ZTj
z%hFJ#gG4huT@KY|c7K1q_VV3FKlIAA8z%@(EEjgIBHZR*r`=DHts(sz-5R^wtZQq9
zR8L@2SKI9Wi_d4elDs^?Y$tT3Wwj@bam%w=$aSL%dkf2FdunCp=3E4IChtwE5$lK=
zHHQJ6h;S4yfs2s+4*DpbRW%(cfbCrt!kq~x^G$J1kC}0Tr49RsMzH_qK@BM@)_K2Q
zyr}=dKl|VQ*vCHl?AZ&8Rn;D=IgZ1w(W%~z@DK(9dTOyWTc*(NRVE4wh;>9P%7(ei
zln4{w_k}i!OWjsCNxU!%9_z90++X_Eul)Ky@!$PNe)cE7|2&giWM=Pe=c!my+2jWK
z@-x}D#s@CYxCTtMYaI`hbNQ)o5tv+#3a~EZsW8rs(@?9hyCqwQO?Db=#U~k?DQub$
zKFm4`)w!ifhlp_7SQ{obfHH9!QL%4T5D#N2Kku9A_W9A@=RJxSJt!l
z_QQ*Q<+XVA^}E0Kcb@%;U;M%U)4%uEKm6M3?|kRIw!0Ni+z-QDwX?K03v?(+VQZq9
zN%JN|aoI8~l!xEBt!}s->v(zh-MioV-WwnPz<=}~{Hs6y6Cc;qO}A`6AFSKpZL))zkk2GidqK3qPVUb)OIlXDTAoZ53AGNc|8lB#esvi+Y%^p|U{IsSlOKF)+{`opLrPw06
zU2L#s;Y_J;@qjN4e?||fD|;lKC&P!6-=CY&sboemh><&`9AoKt;^S2g(n?LcDib`e
zTi&*;**jH_F#%P<0}OgOvN-0&-HlO@rMUD+@f7+Q{Y
z62x(D6m@(f6|Ag%?o4({)6d3WXsb)1pn^gL9BxWd79(>N#>L9)izGl_wlWZ-M4)3n
zXUI@)f{{T8ui@LbGO6&`6Uz<8kl<5pR5!ZPrU%)8;H39Xv(7x{7AC9i?&jC?zy&(5
zWe_?bcteafyka@G-}W&KBch&`FTPd=7Q2>YyRoGNRJ#EK%1~QxBDk7JkCSof9w>1_
zMh`>+QH26K)m_l&ox2C-ROw8#-;Dl+>eiUgZ-HdL0k>-{U28L6=D}`4Ny~VtB9sNJ
zcD3|QAmA}XWy8quR(FHLDc!G6(*<(Mp9v5}(d1x-ys&#*%en_G<67cO2x5B|7{DV|S;vu%_u4eQQKq1DKFA%UB4FAS=V|)wD7U3=+a;
zc%w{%t6C~45BV-|h@6=;je`~qwAD?gyTvX#gZeXxT`}7?h*=WUrz<63?0Olq{JO)*
zIJMpqj1z9nqj4#s^fYg5EsrO4D|7^3gwuqUc*X!k4!F57Hjpx!E&`q$%`y_+7N{eIe!_c-ACTXLDaTbi+mE5f$9T#ibnMPr?
zGt1hS_n4sY*Sd>X!(SQQu$aBD&NKkNOdJNlyNK{u&P_o;H?zm;PtdujaA-Fl$3d%V
zUu4RrOVq7)nS(YSC>&4l%4^4WzP*3&`_?c1(SPjz#j{-z@x**t1mI&#NgO*$;#
z4qNbLakzzfaJM+i)TVMKYuX^q!(y4yg!XXiMr?T;5i5?vV;TElO|7i2y!OHGe(Tph
z_vR1$;Xn4XuYVAG*WDd$9+0V_5To;FGwd{&&C-}nVr)l<@U_Af@F4?KQpkc&MAjX5
zi?58L?&}MTGuwG+`5?Qp6YmDW1$|fdjew=GC1>p#xHrSyj=Mz#2amNI*Wxe->3a8Z
zYw3pdT5;T*kcCZPh;a2UFRv_0a=QBAzRvr8_0{$I2cP~of9Kh6{i%=q&Hvk9{mGyD
zv1i}@?u!?vuVWogRy^@IJdRiggeqtf0)Pk^2%9MMr573zad&t3O4!r$+4<~O|MqYH
z>974K|IuIi+Sgw{A9B%td8j&-ZA=Yqw42>~@9yS|866Z#@q3_g?Vw|=s^ZfW%!fYr
z&Rxfo!-G-RU_E1vRbenYUB_ZJpTbwc#4d{kDK
zd{-Gl)s2ENcc$qWT2d>`WYOQZ1mEV+)fvU=sBVX#n|UyEyQB)t`t)7A?ADE#C@fKI
z(h>o~KH*9dcz%U^L}ab6vXwdm-n(XXna!v?0+9w34H0{@DpZ*|CK+Z1?^yuors6tF
z8c`xxb@84f;y_i}WW}Zs?`9a)!sPwq#86e0WiSr^98&|et6WRMhoICE?OmKW>OuJp
zJK;<|ox^idkDMDroWd?2V@S-(#DfW|yJ{rpa_0<1%Y2m$xXuf9U+fdts{{sK1OT$T
zzFe@HvmWS2gB~P^E!o}h7kEbHN;LM&%fpRFQ!Lf>fhX9@gVg!R8o(iR^7Cc_yjbz|fT(
zr$&B~s3xkfQUQQrfI4O*m1$!@M=;UMD$`7@k9tYfBi^V>EOa$7XKo6Z(B>YU-L3Hz
zd?P$0YEVcH@a*nnQy0wK**;xao9#WdyH!{U@o(1B)SqzJhImp+uuOtRo%d>G!HAuJ
zu69g76x24df~?kTE^)$)0BrNHfpS|>2~~SgdBRQZ9%6^!gC-jr_yk%MaSAiB+}_ow
z{OqS+`{>8+IJB@QB+iD=8))DHe7XkkdcO?^Ip{Q-P726zx}=QFaD2y_iy^X
zFTVTs_so{H8^SEA9EizlFCxyXtt~7T;B8TDZsEQRt8K-)i*?uSO)SJ+Ih{LfRZ*(2
zd@Zx+4)?p`c;a?+1#Fqearf%Ows*eu?mzQS{oHT)iO=j)rCPO}Cm3vrV8#*bwYXRd
zG-@j#iG++WAkV65I)>zC*rcoCXiP{EFp`L@HpV`N@Z9aJd3Lhff*(>OD7TVTYB=Ac;mTI%<>O9jmMUz{Y
zG*@|G?|e9GpMCelUw!TFzxg}QKm1|*pZ|kD@jv^Y|8pOD{pIg{^E>Z9e?Z@@cscBe
z^|9iq`yDzMzLqbP@%Q0@j_&1tgg;sK^0L?VJ-+?T?{vNUFa6~|_3!`t|HLQXh!^kg
z7HH*}GBwy|b)$A_i|yRI&U2efpUY|zZB>vRV^bMnvDOiXPRVN{$k4*7s&*2g%e@WC
z#jnSL?wu59HAiG?`&;wi*n5+)p2Glpr<6qFk-owmw$Ch-1?Xc;RbuWm82f3HuaHZ$
zYHJ#mJ`1BQtShOg0(o^qW$&}Aa2z-m&8rK*5B#Q2egF5p`PN(S9LF7QSrQbwtZlj$
zx*OmO`IfT`tVta)gHyr97(-B)M4~E754+SK7)XtYGachJESJZuM%M_ND|G;}7VR4S
zO4ARPR0AcQdPi;z2_w=6Yr0^9`DU7&$)4q-5a8ed48Xy2h6k3?ajKm~UUOEhAQ~+y
z6>(i0X*<10bsd}+fk0-zt&+K1N#JVMEg2nu#F&p5n$G;e+&yWmY8-qm%l@u5(-1gT
zn3_VMt?iJNE-|vQS+07i!^9EYAp~sH$FXolbEjhpOU|Jn%x%+~#5q-i)uTp}$qWgX
z&Ov!#nR#YbZJ_q~;7ePccT%+$MU;cQ#b
zi<>0ZNVVnYFIA67d||nj&qO$zKFqB6^`d^&LQK(UtKVO}#5UGHD2;#DV_}+FOjD;X
z6a`ahWK&@dOv%_#ZqW^lhKdl09xx>qsW8jzroP}Fc{q8+TqtToKp&bQFoe!h;^ZNHtfyy3iWAW
z$6?3a*bED25GxEp2;hprZMDy{wYl?_K%7rd_tL~CC_xnJtto9p_xYA}C)}NCKH_P#
z))5-zLX!YV_OmF4HUNx;*MjCEyb5Q<^mbtyI&An5oZdWUqD*iJlDgV7Ag-#~s;b7_
zv9JD23UYWh+n^ghEv5vg*j}eK&&d{5Hv|;ON`8)O7#egnQZYG~`^<4sEAS;0beKn&
zK^^aGh#fg%U&vD{;uj@5Nv5|OZDyHUzzp}NqiPGGaR8{QA-5yUb0^T7*%KveSut#5
zOI}OwAFg$MxRMW+VcqT#i^E-$J(6tCn1pf;#M<3$B(jBh8$jCJZe3fGG0-cm4QefB
z`|R@jy`S72pMUf9CkuO*Uf(THJlcjjAm^$#uYDS+^9JufF!=o$u}syp;da
zU-`37mc4j@uP1~Z0c+yiu>do3xHsKEgI2LFq|wQ|In1erSnJL;n{>rG0INoIdql*7
zz=~)KbM`~t`8wh_!jC5}f9RM0&forp-}?{!;ve}5x88}6)2XS|z_FGe$MpZ2UWynS
zEtodR4U84$5L}ZBa>+XJ+FC0jytB@8pScMeufy5!iSc+OmRoGJ3kRpvnDLI#&4G91
zBdW#^$@>2O6a&Lcb|&kH2wx7jy;Buz*3SLn{=Twe#adwvU$!64+`Bnu&YdmUA`@Jd
zwl*?YuQKFWHO_~s?7KVv*e9R<+OIr(`>p)bfBeh;kH7g>{_LOsV;^|!weSA=ci(yY
zy((YpX~dJY4)LhIKsbWxoLCVn;z{_+Zckr4&tLo1U;Ex$zy9;T=Ntd`|I1(fbARC{
zs%oFL?#$h?u+s{7xTn<(&NG=7@11b3Dp@o%<)iK49FS$SaICiAoO8f%Nm97|BBUQU
zj!=Q%cHAA(xTVe`(|HCOPYh{h2GB=@fx2e|Gyp-dC56uUuxA`SaDG%WL79x+0PyEufyI>L@Sb3--Gy}$g$kNlP&`_hXS+igWqH7fH}
zGjj`TE7V!Lx=r2cCMsY0nS^=;+^?ACR8?Nt#9(Jqu2jSrk<-R(G
zrjJy~nqxF^JdPiqBiDH{`4UsZ@-Sk9(@X2%5S>hVy*Q$~cJ1miv+x@fY$R>2Zdp#Z
z0`}fjN!gJ=WlqcFuy_*kbFPR(H9cwmkwIS!9=h4b!uZDI);cSRJ2QR1rK1C86O8EY
zp=Y5qUE(1TbUP&^=D2L0JD0r4`D2hBdAyyCiU~=tZBkb=Gs}x=WIKby$oo(ILSGB*fUmi&W<)B{#QcDgchZE
zK0*}^a0Eq^KFKH>?8Thxfv`NN%L;RLJ%p8*Iy)u>s|soFLd&mBbEi%xQAu+zy5
zP`eSmF)GPal&jL1GEYK(^>S#Z-RMz&0?K$E@EP%%h#K)4*j_M1&ZAa<>44#(!U#@n&|JDvGpW*w
zxDyK`vm+MRaXx$(Sgxz+WHwM23p^t7GRfXCXm3}QgcVG@3m|)D*6NK(eLH&E6V%P&
z;j|!8mxk!K>1d!Jre=FhORB1)J86hx@DYL69eq!*}#;FZam5-snwan&S#
z$r#O@?6CV6=gUvmr$6>G03x&em^sA+4>3C3))sa98t&{dI((XC0hksUyOIX=vV}E^
zTf3$Bn_TE}GkEyATcg-<0P8L&*n?SRpJ&4KNEyfo(Dt;bT~S~BO^b`enA57#H3(7e
zTFU_BuFOqDa;-4V`J5ye%}F27&+4vS%wjp~6|hRsp|oX}Er2MNSJu8SSUfp*v;(dx0>@7$u>t{&8;5Aay8$qhmOL}-Xb
z&qB+cwbDTM&fS$3u^iE5PhbAW-fDMl
zT3QkZDJgtWMT85TFlSpkm=j20Fx+@%ojaLg#Uu^gU0EFUF2AJ_;Fxn1AAJYZ`vb#1
zcc}}sbLVxBxpj}(y?37v-Dw~D_>;Rk`?X)aKi2+hfAOdO)4%yI{I!4OPk!#pAAjqu
zU;hXH;FrGh-ETd6{;Uhu(G`ZnapyR!Bey@?_q*SF{%gPf&0qiZU-9+gkN%0D{lEUl
zfBE12-~N%$efg#P7w5EMhPj`oox2}i^se5!9v*g8?!6z*^zho{9tG?qNnIjaS_x29
zM+E6d(wN#l5H0{9&u!*e5<
zX;?qxE(6-IcQF;(S!h)D`LLM}bzVT14kG}B9i7vyc$8}nb8&l~Cl5+H9{}_bZPt}|
z@uFV3!%zOiXP!QN<=K1BV?8Ob)6W{-?U`NR?lbr3GD=xmNlT!y_qpXU-&JBxCNHwe
za*hq8Ij~`7XQn&CoZb6uw+mk$tHh@E`Ed5dKAE9=@6!yIlAH;`xVhRbyVBI?m;xRE
zrqK*&RGzBYzztC);(^h+-7MMl%Cx>~cvo=NVu@j;-<|=@(L_VeNO@)M6cF{8c=L3t
zNgkNNhv|`Cl!BXg^YpB7P6~4`Ig~=GBo6CtOnPY!;U<}z*%d~3R>|grCKU_^FATW4
zlbE?FjaDQv>+a3b@fhh|gRKQH_Xs{+NE62liyy@2uM?s?=j3QE;(cuGPkbE;Z7|c
zr{gFg2eZR-Q^8F#U`cg#SxMVLg4brjXKIV}D(mF`?3t`^Tu&N@c`C-+^&W
zV$oWrl~cF8x!Z)imzi4DQxhex=_t?}3^{r#kJra)<)YbR+C_K{)kCym>K#4$@nzww
z7XqR>qs^>FWs?KD*L;e>!sXb^SJ2fn#hJ|yydZ0I)|T#`Z4NDW?pBMP0EO<((Pp~&
z<&@rvLTo{?ZaNeO+LK;ZXbEd3WHnRb!BDvKIg7Zvmk*oKkN|REq&Bmixi}?Krpzuz
z(a5tDZvUj$%e7dQ5sSia)*+@|IRMSZNft*w1c+TfeV862gjN&i$$+-o5U4PdVmx59
zl$<9?QjQgWacN%EWCJi(ou)eJwkq^%Kty3Yw+04fQFCUfI~ZYBt|prSHG~~1k?LzT
zn7IX*OetyWhC{`NvOU*do5KD#7s0+Glq~ja$lh@0o?H=4
zSACjVP*{;#;w
zx)95&Rf_1C&my&gx~6BcHT+-;gbi^Wyz8mT_xmf&+(m-kuLFAP$t%5I1X};j|>Cv~o|a
z=jPVExrBUK?dob@J|83QRD{DIUzaoDwZqu1zIRsDT52#}5tqWhyCV$J|Cq^E0P`p`
z(f2|T(H1L&sRM;_P``v$Ly=cXQ`1$MFh_V$dq!kUJHZUreaW_{!KseJ8=cwv#PYa%
zVlRJuJ%6^}dF$cT*Pi~lKl9Z;{inYApZ@3H{*V8Y|JQ%^|NQ^_^56fpx88d1{$cOj
z)izl=j=QHHc;(eEe);2H`ReC>?jQM~pZo1!`pD}5dN3eoFp>FL_x*iSMw%LQCM9hr
zoRj@pqK~VPAnt5~z7H$n7i-!xoXmiTXwbH&%xs_8=H`m(7|XMxV%c#lpwEZx;e4TO?6vEuH!$Z#i%n@s
zAzFEuPQ+u`TAf+U?;?x8kwNvJCX^S+M|A796b<
zmN`?FB{c_>K+5zja}4h2-N2m@=u+=x3#xNRH-{?SQITbC>~`{SHNtSuw*lCDQ(Jh|
zm_i(xoe%}6YBuA!aVpASifUt~Vr#9{YUhGO`yA7(=@Ch;(gSE(viQ({JP+Jq!4-m*
zB1ywG)mUlZ`hj3QbR&nn;xIkyW*_dAC~)_>nM6{QbP%`lTS8HpS3;*4(&g@#t!s6%
zz=!fdX4}%$qZ?Bxk2p)G+Lf~Gk0K8EUo17+^(QNm`J?Kv5o*m4igEE=C>ZXH`!z9IAn!!wPY
z0g4OQj8IW|aJmT>17~su%a{hi<@V*7=@D1f+TyMqMhe8tEi?HKU0PszIINt>i#7mx
zRxw34Ue#>NOANwvTDOHDlQ&t>lwQVy14L1$e3+AwgECz740m$V%Bq=)^7yk^uH|l*
zjPjN*YZNU}2J&8rY2M@lX7!X+mAxhZeq1A8!pUN0yDY|wzTKJ9XLo8fDRnBo6QIL`
zKbKM|DnQgm(QwYoKwlRg9y|Bt?IQ6!psswtEGPx7?(i^~0df6|nK`g(?u7fTyFi0S
zv&_9>RW&cDD!Xm1CC5fHz?26_XTYV<;X%v~ZSC`z1!oFs!nFN&T|uQC$_@eWyP2v>
zqG4_vHfZela#TWw@FICHC$TOdP*o0RWn~(vYWn<(I1&y}T?u*FbyxeELd#fSQ&J6W
z8#h{3Vj2b{!Jf_$ki4lR&|vbvBErPxYyhL5G(+}PY7lTW4tkG(UiW3lx`#SDi`>M#?;;lxll*oxljl+g-ws^$qqIN!Kd+1z4|
zxknf>cSQ6!^K}h?I^1A4Y`AyzGUW!Wx(&@Dycnia+%NC5GC6U6&KYF_-DrY0&1Gp9
zz0Y97T$yZnWx{M{(uau>df-|utq5M#?Bh2xjuz}97D(v5L3>PsJKd}>8gA(9BFBaq
z!Ub*+WWiWO!Ls2FkPVDyXlxNSZ)AI
zd4b^419!7zHJ~$PshSVDvyQuUb+@vj-kGgqMtiMvmZLUnZQ^&RY!33~H#TmQpZ3<&
zoE`#$xfi;P2LRw94TZa(4;jmQce#3Pe0iNxXvK0ga<_-GE49f{n^g(!4znJoYO3~|
zNqjZjs+$ZIqh__V!A2`+pb~Ld?#{x~r+De*C_JyNVMp8A7$OuCAoLWvsP#qNs+w)$GAO!&CiF
z;^�k~gFOb2e%Q5*W;7d}RO!3Mx31Y$qvKGdFjTvSW;LNA41{k>&1tr^#|gNJ>^q
zCy6##p8Eat6lh>?gmn`&V74vTt_5T`^*Ys9FgM#fWBJ}`MkgVwUF(Q_raEl0-+xhe
zY4)3H#ef9sp))0gm5-+29Je(bk(|F&rGiJG0vF?v7D(7Toh}
z0y^B~#s0}6nO~G?oM*urJJ+#R#QAVi8_HK^=I42a$CD>V<~|?JX{IPNIFW&;`gzuI
zShy~XBNRO-mFfs%tjld(I2KmeKJDSO`-lAUmp<~-zvavS#eebtcG@hpL1YvyjLXcn
zbPkiG3hQGs?O_h%mV_C4*9d#qds2-wb5ype)s})FrSWA!wF4t$_na(AfgFuR&7Egr
zRuT>1`>Jg2!KyU#0YN%9`8pV+cVHbzxr%G@;h^2Eil}==QZtXDSEspo8`xXn9#NTS
zu(R7ea-VWK5QN%hF0~mNtwY(|ne29VW>d$xxiVbWnaW5&zM|Bu3%WYd)5Oe)S~j{G
zG2Of@*AjG5v7$$D!5FK1Znx>Ip{&wiO=JRQ>>mW7@9Ig6C>8K_DFT^l`Q$L}xaJoK
z>lSR*#$hyWCgU0OjTJKw=?$kSt)#-Ms5~zTTOvxU_uIjbcwD>5E2jr7hsq#|k
zJ2QeNl)Q$t*G48QJrCzXWZBXweH@oPmj}7i-RbVRw}&uOccb5LxTCJ(U8pQg`%RQ4
z3&lcV9S6OvbEl0+`Z}Y~C8;3ClLGD-bzP@Sl`{(-u`5|i6QDN^`pygOB~+zCi#CvY
zUo1cjGrp6if_VcNK$wXFan2neBxATHo3S1lsD&i-jXE}Sv&zg)66v{X?|OI`s#mH~
z00fScNTq<_u2S|6rmj=jHf}eDE9Hhnyxj$Z(~O%*{t65k#HT2bk+>=$X=4s-49;AT
z&L&$P;@o=0X~4~`)Js@Mv-O5&R4A62BqK!D$=fyB)uKX_m-(M7
zo8kE>nZ#g)gtu|+H-aOq+HBSqy1j)6PK^)YNq+I4)}(@L@F!>}i-!3sO|~0yHYhW+
zi-qe#JS`!n`7q*hllNEG>?{1nUj|Tviis!1(0PfBuPV(X3wiWR_^4*UCJV#sKG|c*
z06L(b_7YD@Ejvs*!WAXw2@oT#((ZEi%a`jBxk|`^iLWpoGa-~rH}{sXR?CTGeD6YM
z_ZkdGyUjpTRzkjAJusD~un_s<0&#b#$)FYpeu0=+Tq_CFThVG9Y&3V2n0A#1064F8
zxW<-E$gF2b!sItr-vBm5#o`-&^K&2i)W@GPmABAO6V^Cua6mZLzfEet^#h><0kEJ6
z8Eo2NsH)(;t8s)U_8eg_%T178uv?=&Y;RSYC|sSxe9{3TONCZ?=d!?Q{;@bqbL>(X
zka!ZrawR(GZpfSZ>Wnb#oyXn5^+3fCU=haQuD4BT=HXpne+ElIP8v706?;wf<^tcE
zid|qv_-s6V$=%j>-|laG<)we?Z~Tk@%zyu%fA;Lv*FNy7_d{n}IHy~Y_^oQQVC(Y4
zc#?bID-H{5Ce`FITzbPW8n%15Sum4B0FAX?-nst%-~KQE_@DT>zwpog^s@czp8@{Xe|+-h1z@Coi2z!&r7ox5ou&PD4JlA>BCuoBlD)UbxE5
zs)FwH#9~NTLE;*hX$r(nvNTtdnMUS1R$ExficZ(nd-3snZVs70j`BGL?TOJJqlG==;1yvMNo^X
zfnL*f|H|f+Hg!!2rJS-a(u+9{TNN@p!!%HXg%|ytEy7_;k$HaC*j52v4R0+fUY6Mn
z;^pz3t>jQ?GE2`1b7m~aoqNr|oIdnS=4<%G&3HzR#;}`?s79}UEg0ppHSK0F=sK;<
zJa=+71}3yIF)!6NZD^BIiJ4humi$ek=f2FWpr0+?kF0nd17e5veI0v
zD9qV&qE_1KQns&x6>~cB$GE$$PtOeMu!w+HOoq|7YLA$~isiE=V
z(FT)Pk4|#Dg;EF5ZGDM$?yFK2ZUmk6c4eE4;tC`r)?3k#rk!go&IvMeb{&)^BGMRm
zGz=j5+WyEVP0^~a_f8&9qD|7)dg46<+B7rpSFw+-)!NB^T5f$F@YThzCSFC~YMGhx
z5EZ~K6sD<&F9TZ-z}7`jbTJf_P3}U}NDTNy$3bT`djskXVoa>c
z%w3sPTWS+NI(nsIeryBTRhvi4_4zb;;y2Z`r@M#wHx5H$*lOWeZtBNF!^78kZa4qT
z8?QY%z*(kBd~OG@2t{SkdX&uEWBn&An#yRdeK8MT(GkFgA9w#=5C`<=fDAkgl1
zSgfwKjt@3o`Fnrszxv1j(0}XS_*Z`Z!>`A?-`i`2xo7sneP@E6*?QvFFR+S>0&zU&_8NI2_to84+VD4!rwQq;DV{>m$NFTZ@ZVs-od3*5ix_n+1M`*r`k9^UVV7nNssBHWKB
zYu&k-RoQvs{sH$7c=o(syui8f{`;BP`^@u!hidJe%(_?{iZssLTSOIcZZ;C@0NwOy
z-&7n}(HyaJC#4*m29lW(#y=5qGqc*)(if8}DiV-a9!x
zg>5B!@AKpc&d%HhT1oAe!c)v7i_g-%uq-6d*11J*(dHnNEq>-^>j)3z?!Eimg~qW+
z%iH~f0r=Wi-}r&=`@(mB{jGI81*W;(0Hf3o&RUd#ipPrjt8FwmFo5}lxyPm8(txEF
z5k#$Z4J6cdJu4`Ec-JwG
zsULY>SkGBGzZ455>9XmjV`4>2w^E^lc_zg>eAFcsXOHm&H~sbXn%IQys$EhPRxu<&
zubY(TEz498L~&)i5ehF9+j6^`Qz&`rmJquV-sEOucgKs@GiW{P*4xnI;l0-!vjd-T
z2f`_8nB=)N*CUNJu&_ur<}gaF8iP&#H;=Rd3x1ld)c%nsP5`7gpt^8l#+gh9{
zps2O5G3}E4AZFmSX0QnYuJd3#fu<5xZ3Mi~N*?uUoAgd}%xu$>Yo}5uSG_@=@S#GK8
zfqkI_n8@A~flMOt49n&gH&tQxrGr(|T@kbFE~Yhtn$!nl^8GRxJj`<%cre%;)Cxkj
zlO6sHQi_UfL9xNJAbI@_+gl9}dK4i$`IOcQnnntM9CQ!HaTkEKnRm89@*{c!h;N<9HxliR|SGyfM*p}V4+Ogw94j>^Tgc1uO;0A}A$VzT<
z6LFJ(5ReFNxItWi5CRE_2m~l0go7fCiI5NuM4XgJ#5e}ruC6}pz5efg=A2xNG2d?$
zlw0MhU2FaS_r34)%)=OCj@hGLkI|q*cU^tzCz+b0CisjMlF`7DYi_rQu!s$LxGlav
z^Rv$%-~Z{)0qDN?A;o>HUs$wpBt1ekuKa{7FO2RB>TUGH>?-Z)%d$@C?}HU+ULy
zxdSxEIGww{89W!Q8^N^(9BY%S3Z9wyc<9c
zkG((tov+Tn`|teQ|LOnKU;fYjbARz$--<7P`}+LrE4Z?74oa|8TWG@wdHluFriz}t
zU_?{4%u02>J#7lb6#DDi+sMcGw=kCQe8iHAuUif@up;)NY^{_R>#E1wBGB2fKxm<*
zVOmvqdqtiFH9Ws+
zSfTAOq05|Ab&6X$iC4&2E3%q_>g0}d&WcdSPLhg3aQUm#9^Ucbyk=HbX|OR<)s0rz
z(QIq0+$HF-rHDo^DZ8@vUMj;y2?pX+a>XOwWb%ZF^>|1D>scXSZ7YnU<7Dj>V4Rb~
zxAlHlfow=ntVKXuIvyXEs@`l|7e0IRW8twWLiBe&p5Om_zx`)_?U(+>zwtLwwI7e`
z{lJ7o6s7#Sp9DHA>zu@<30xX36p4kqxoSXysnS1P?3qh7OGH!3gvc6rKELKzmbUE#
zp;_`qqt{;NDpT>(xOE>2kFM4zcyq2Gp~n&-6=iTLTP@2@@28Q~-ctWV8>Eq%{0fk3
z$^&2jxT_TUtn>_XdGdd*Bwi;H68Fkj)Fq7>-4;JuRV!9OyWAR-^e(25V78m~o}pgj
ztT#vM5bDZH&&V}iGNd3cl+vOHhTy-c#dBLY_hFEk!G$Ol#^s5J~1W{oxU-6&F
zg8n2Utk8Dis=h~ym08ra$)CbCs-Jm>+_{zt9+Dlc
zG4xqPFT!rtO6gK+Nea1_dw9p&&~mJv3H7^iFod8gU2qL$BnA#W?&-{EmKuVFDnQk|
zx(2j%LP177?Q}Aek#Rqu*Aa3_tW$S#a66EU_PN$4aN%_0q;X5o=f}I3X26X$UYFOG
z)!yuPfSMwZQ#4Fn3gv>i${6I(T1*(W@b4N`>0DDfg3J(Ob+*l$C=H&miS`L|YY11j
z27Kx!=vbX3&rwILi6gq9?@DO}$%x(U*-l-@M$3;kt5s&7>qsbA+Q9tD0G@s?j0u!J
zzA*CcPOXAOOxdoYf&SH8qj0EJcG8#P{Pd|YhmdV^k^^(9EfJ%4i}|4D#{i)kK6%Ml
z<(8(K!hF8KQGK&K-qO2PFzT2Pslp;LsA7*@bB$MkuMNif)7Z(F1fVi4QWx6NQ^4_)
zu*jL<7aFPWUe@@>krNMeOXqwJHfT~8q4zF4My}NosY#rZ
z)>=4ks7>njq?4~-1iP}OpiuA{vC1b(eIrTd+)RrXUcrmlq<(N>)$;*R)#p0uklWC$
z3E7C)u{a*WB2KjjSqZEp2jDD`*T7N(5n3`&(i?*HuywS$OPmg3fUaoakX0zISddE_
zt&;ctH{-anrG
zpxvGih9T^%%+u9Vdcyw`fKE?m)u}wCbS1p)n91)tHL=cb#6l0UPIuMXQH?zJD7@rY
zl=dM{1AM&g2CkMU(L$Pz!yo5E8Ac5mxdip?zfbLa}Mh&*|&W6?xr
zHO}RiBH~?fT5xSvy?;D1VC&*_;dwQHy;O?#mtW;0@N0ki2jBYEH-Gate)IA808;?~
zxI$PJBkuLKVd0PK3gvxqq%b>E{-}hcGNoruI2XIanY~$E%~&G^o8m&z^%k4u@IT#M
zo?@t>os}jn@7J7X3uy9;NqIr6cEA{lQhfnv*OcHTJKuzj_
z9ZvnwVZL31x!~8yHvu)DRN_nhamyo>>F%FtNlA~FGSJ<1G;<59-!f<20^{}_sp-r8
zw-xN%v8cWGRjT@A_DX%ve6A%naMwEBWD}18L@-DrL76QsvQ>eW9pM~f9~23T=c6nap#6arb<9tcCLC=M?HsGXLM^J0)4u*mrkKDwNAF${eV>&
zEx8l5UU=9?+W)^YFPFXrsU^!v(olsYp@15_;EK@B;aJ9c8)gKpYCx
zyho#S3Y`EYdZ;r?9s+W3-7j#(74$4Ta3dUxE4`aUz}}Mg##+%u&8#D2IYkL~;cF)o
z4iFy2Y=-7ZMRWS5qZ=K-qK7EpsTrp|XYOtfLizT#pR~G7eQcqOh!v|9ChN86JkNm_
zeC^6=-;2SnbbMcZgf5|u66G^qrBYx)mLY{=#g_S$+7k(%DQX4dT%|^tR{fsikax9S?v2=)qkdA{@WU;o}ue;s$inMXAL@n*BfG0;GQk34O2=V=!SK4aUo
z00Y>-(_AH$N)M74wg*6y@`GWpy7yjp@pQx6BuAGE!V`VxlC)SxrZ~spHROY?i^|uh
ziqN8KD~dyYIRTqH3|tx1E;Ij0rQ*Hyw>N%qdb;k0hM{|o|(xA
zUeDf}>w(X|ww~|#@%{YiKmMKn`Tz8v{U`p(|Hl97fBA2I>pMU5#n-=)=RKwKNAHkb
zP@)?l*A3+|P40=Hh{t+#2PBAy)zwWb?6>{)@vHtjfBSF!{@?q9|MI`^pZp7d{--~F
zb>83ccvH&<{a}FSbZI5baRFqHf}7#dE~Rb;!gLFFtgJe9RLF*%z=`OQv^W~Xf+l0Q
z7!o^ZaqI25RjnPC)|cXT89{`)+6Np)HUDd&m0f_igmva#m7~glR0Dyb1&Sr3P>ph9I3C|vfysw;%Z&698nu$EJ
zBC~QqV7smbm#S8?ky(6`Aqy|93GS8`F+
z^CvaRE*s{+94ctsT8)BjxLPPHGi2BJPRTnIv@^4|eAyVp~|L0_*Ovwva6!EPxUu+Mi_b
z>dD>HW6TMW85QY~zP&dZImnTWq%zOii~0px9)=_tv1LJoxSy@z2LBhn>}j}G7sB!u
znFx?ey0%!3cXuMwaYp7W`Rgj?aIFC?aAJq%X{{%aPH+lHwJZZwKu1r)TGy^)SMVwl
zyul>6rVt{~T+ZM-#`q>I^8;bX#1?1-*=#H4!Ejlsp;@nAaG*8~c}N62wmn7_b5e*L
zxpgoQp|~GGVA%=wC&v0zm1&_I1|0Hh7vkRcNq7kt&5&WaW|G-xSn1=RA&Q%Ty;}K`
zzfnJ)CWc@-9<2#*>ES?o;xU@Z1S)Bo3V&g7Sx!H!6OC?-p{aKRW^zq2>l2G4aYa-o^T6;X
zgG;o7+Wuh`6k?R)Fmg@azDH|?JSrF@7ll%sBpJ&~3uX?Xq-~g8Yuz*VxOZ4$?E#Uj
z#yOdNM8Y*X*p*khE^7#DlvDC(Mebcz^RMa@jb{o!3DH)<|M*DRcrd^$VExmCWKngR%haFfb&>Vb*>ZTFHj*kPNd=89dFrS+7+e(d0?X2@>|ue7!H+3a)B+k&Szja;x*=Jw8y?wsd2VkQ^Dhi0{j#z7PBJkc@EI~x9#{+9I9(#ZO
z+2iY7kALsq`}H6H){p+FzxMC{*Z!6N#9#RHKmFBLPlYMW(91bmY~#&=9z+GIU#>Hi
zRaZt(Cdn#rH9uKhLGG)gsM<3nJeV*=fLpdIM!Y(R;R09VKHih1sn)_l{6}^
zRJc}04KGhZ*c6DFb$vXF%IA5!;I710bXA?Js&NwMs?2^~_5NPx)H(hBUhnU9y5B#h
zn!A%(-Ou++U43_7&pfBlSUU{Pd#+f;mLTSa@P1WI8r>e3=M~wzbQwxCBkgNJ+Ya{D2M;huyBN)t+
zN+DG^b`(d?MxrB5gt1~*)j28JBTr4N?zFIpm3^+N>dL+jvhi4WTWTQrJ6~Qu_`$dS
z^soN@uin3^b44snn}>p0dQ}mfCF>Dt$%@XUs#ugO3TGi3CHO=EGN%w_J?Y-K{uEgF
z{~J~$(Q{=C#FrJ7l17L4p_X`ZG&JWFA~H{w-X*w%H#%SZo_}x8o>DoNDMPCWl-1_Z;$@YRb-StziQM5+VnRf
z;!WMHMlRLKN>qh;VxU{08cux9k8O~oSXd_60;sCfF4nOYgC-THZnTCxi2G3p@5m~7
z&-(iZ-yZh*;tX3#wZ7K&WEDLoqrzU+%H*x^RR66$MMf}3YYMeab?sg0?gsuaY9u5Z
zzB}EvPs-Gv_@o>%|E#4N4)*q0tf@{gEt$TWYa~$VqZ9yLJH6OUc=&UMMfJ?p1DX0p
zHT;nq4NtSvMVHbezWdIqyQkJ*
zAgg+>h^c-WDA=0JUhOaJ2f#gE*wgM4gmDg8PRa^XBVq;85Cv)&=lM6dDlrv2g8AvMdge<#=_Kwd!l)~!_39hBQ2vTwFN*QA
zFNNV7^(L43nBqI2%+
z?g?sb5%o5E>;A;#tUF;lA^ElBJZw?LI!}s-;6hch#e?ETduBSw;8AspA6DT=n%=ep
za%1h)U}f&d8%Z#hT-Ud{&$&0KVXf0y_1FH1KlvZ}5B%Z(;(z5|`0RPQuG4F9FMiKwczZJQw#pJ#nf
zH*!Ttxl{LiW;45}VoOnz-aT72;;C+uqp9@RAw$D>zQrp2uj`ySkPK>F-K0>JhL*@o
zvxIZ7Kj86(_lsTp^2`3>Yxq-t;upX3?XUmNZ~n&De(LLaKB8`Ek=Ct2{Fo4HKjxO6N40L!~
zL12}&o$in5U=0=S@To>-YE&>*aGJpxBQ*%(J$Y%NpTtuUvDTiduxCvayP28IF7Gmh
ziHf_4RN3HxGK`|k?S%e#SI632=|<0VoX`9m7+r^&13Vpro&%}THXo89Ir>%-#_AD)
z&o2?tzc_iv`C7Ykhm@>tbjDhwy;@YGReMFW|B}gKc5C6K2D_NH_)<~Y+N=pCZb#zB
zLk1M^IwGC+Fm0r_EuEbTO|or);_*Az!>C4kU6q(A{aR-`)ov1yV)_wSZ)munL5v$=
z0D%}6tw7io#U(I?sVP^5KhcaRN>q1n;qDq~?rI)2SMZ>2glIu^p;t8tEH;?Y2u9k%
zB7o#fgF_3SU!he)a3%leKnQtZ#5wg?56PKhayf{ZGv?M;TC;3sx*dpLQu!&1c8=Vc
z_er&Xh+3skK+IEXZL+g!G0Ik832=mzkIbwZlMky;7TST&i5Ii?kI~h3^%@~kM~g#3
zd(%uEBT(fXRj!<+&k!C-Im#?WcOa;3Ce=Mx)0#y0`LL|+en;@6qML+yRW0qSPpE;B
z!eA!~rm@$G(EO^-UrF>O2~>-4Cx9$t(jxsjXEkqEHDWD6lZ-%@XM$0BM?lzhYUm4C
z87%VyHHw3Pif%2hBI_zSI*{ZlOve)N+?VQ=HrzaqPC_Gn9$#kJ7|xg1bFC90?T|+H
zYm^F(DCZor&(*P{0@a*A0a$A{aGew}JGdJrY6$)?f{wW#O69&bxNlCCb=nREq~Hcs
zErM*DYiar#N>z7SyhBtwctqHz%+e+Y)oBvD;Q@g12D?h_ZdWPO+H(>l`kX7)+kONz
zpfYF#$>;m^`G>ck|Jkn-xUSwiCddlh8eC3oY2UDpmCpvzec=%cb?)q9otcDl8f)at
z3U(t307M5#XBDgKLbjpK^%i+BP&C2F)9Vp=WNyX*;X2Ug!rd9K6?s~dBW5aKod7s5b_wyMH?gfHtTKMzxLn!8~=m<$-nXc{CEE!
zYk&CSr@r>#?d`Gl;OLfmlF=RHTf_s6=U4gL*T;_^zkDqIzF+*AfAl~0C;zek$RGZt
zAAX%t&-dfoH&|>YpYI|UP&W8!XnRfe4II>nu60gMcAwh&cD7?xX{E5DU&In5tVE%<
zVm%D4O{x~VWbQU@?05P^IBkd!Nm0}@tm37
zXm?Jo6(dyfgeoJ}3Tew%#6g`a?Zu*7P~%KSqD9X8TD3X^_2{uHYweY(*(%R~?fnpf
zpQkEn@Adq6J>J%N9ujXK-o#_;hs)QO3zePMDOKaL6+zM0*+&O&_{qqZiS6zH7I#vbv3F=4%tfh9(9MN+}Yh(Dyc(ymHRv}LIEdeOR$J_j@C^0
zR~x4A`_y2+a^vU+io$n%skT;HL_kKLFiTlN{wdEMr0ha|AbUN5~W
z8=;|$tAY{sm66L^FAoR7y}chnH;tTDjXt?H)iJWVSuJBIOd{wHp6P*~M|a@T+p=50<~-h8-~$f*z|KylN^W##rYIlRAD$7F
z;L)e5szzvgw=N?l%H(9r`*;f;z(@}mq2;Azi)<-e+uyKm?xCdS2un$QKGi~%$1c!~
zdtwFcrCct+^et3`2*`x?Erox>wArfD)V@Znwmp#*LvXWmGpImMjVjrQN+KULciklK
zWqU1b(RhVSd(00{2iTwVLg9*X5PQ9`PiQ|C#fBF{NpZ~O1enhq=96fl8=
zh^`0-K$ctq2J#AqnOf@}q^)azn5t5nsv@c?3Eq*%pS#<4)GvPtDFu0X
zXD+l$cmqh$_E>7%TT*pxst9`yRrQQWb}*XhlfroQ{szq85yV>_r5o!STqhG4*ufZi
zd+0>l(1d(>=1Q=WI^l8Ol90(F!%xu%bC`bj%5gKs!~2Vive4R$>A8$Ubca*GWGof=
zvQtJW^iV_0k_I8RlDeLoVux(SNOTN?(bJZ&V^I{+Qb%n>hv>U`Hvcx5Q@2N=&?pAF
zvDOMQrD1LlsE{09+7ZBXgwl4{c5ToNrQSMoM~y7NlLo@3x`ctvra=##lXf0c>+4~d
zwRfYp{BfY^7m`|C?d`0(MwSce$SlW1HO9@xcqHgZcPCfS<&F`M%wDlPSIkCh`K0^o
z$6D}=KIVWp|7rYPNfCz78tA~ntbNwc@rfCX3;-9Z8(!ufY|BkBkHj6#GPQ%?e(aCG
z_5Q7&`tbAL|6-!LO*rl|2{CHMTWS1PP0RfJU
zaX`&xV6Vt0u9HE;4oLxG=2dWiZyN8skv#3NoylRK*!0O%hXx=s_ul9Ef;<`Qgr+Vv
zIJX~5%>yPhX{4}i*45qGgyi~$+DDIO^f_&KTL#?>EFf@BJ>FKE18Yqv`w^3>X5K$G
zK5%VxV{KOTb!8Ag{N-=_i~sq5cy{-5|0Klro1_WS<$pZxAOzY##^$-MeT8@oX;4^B3S
zJnj4nnKsvTrJ~ASiz~XdchQJ|LPvYPOLr({vT@#g;RdI4SuF2_Aci%k2ckN4S~Rv&
z-S*}P4v{cm<7hNgap-VlRqPo&!t0W`uz;Z!kZUc~lQgh@f6kosE1z6yCAbLv
znd@YbAzHNz$wn*{;>-dfGnde@z{$c>YICkh-;9>(9LQ;C4p(3jU9MwzCWWIUw(Cd-w%H3&;0{`-~ZxY|KIg>
z?Z>_@O+yehdj>sE&fsnhd~5!hOsk+%ab06_RV5zv^$^i2@Ya&GQV9yLu@XgTau0r(
zEGN5omAqlgUppmannvzVDiW)AEC^7H8tftNgu*;UwYa+35$M9gIcM)jiwXCr8m2&{
zLghIc`PS%}FGw)%m;uO$i&?3gp&~HW(%m%;N!S0P>(OH>0S74Ff-iU6<}h_5Rz$O#
zot^TYbkrLh+!!282v4t0kJR1dtUd%pLwh#ZTP8(wc@cmIe$?E=W;ePLA?`Y4r=l4g
zf0Z!sI#4cIeY5V_9pu{UZa>67TXfK+a&{t^J~vEdiyD!e!SV*|!3*$dud6n%r|+c2
zjDarBo`~t%CuK;r;L60N*%nYVEEI--^cYkMcfEaIJf#?eU*_3n5NQhR8y>Z$11}VY
zo^>RMPH>4_QOghr6x4eg^%zH6wVHR%aYpEoKXiA*mVx<979%u2Niv+#RLo>1=BP`X
zFkH+1tZ!G8279dqXtTF}bWbl=-BJ~R5R9#l?L^kNt1=ZqlCMri!}JZ_>JVcUGy#UR
z#?CR(g)VPOzp7gXcwzbS6mHbcrS_k9#oU_)pPTpTB1|k4-gKfqWRT<;WViwiO-S0+fLEQx3*Z_u<
za@G+J-DpW_oJib=XBF5nAg9$AVjx2AUWn+uR>h;94bAJe%q+3iYR;qgZKVMxL#4vW
z6fzWB)romH!8P49t3CWXFpf~MS6oL6-(s+&c7X7(j{vLc4x~9gg+gNruMO!vsGOgk
zu^dz7L9|C)dN##-(zTRttc4@$ls9(tpzX6(M-W|Cxejids*C@y#77;
z=&s(Tk(H*iVokc3B{v#;QYGjID+CY}I4i>p*(hp@qr{mH~j1}Tq8zcW!_Gk
znTDb=`?_jx?}>>WdGfkkd8=Qkg1oZ)4ov_uNE8aC-6SncQZfCmn4LU3Wgp_x*snqm
ztW#Rt62S`QF+$vIF;`NFvk}Y2n3K9gx`u9C&%BYH&b|eo`kI;g
zr~?MxKjQJmwYZk>Jv5NdtD4{W&i*U^_z(ZeKla04|Mlzt_HX^&|I7dN@BUl=_rLqM
z{?3no^rNrNIRHL~qy6KC{$l
z%rKRk%8*F{wbc`l-5TKKABw%_N)4MkuSZl?wh?+5p7ll0fV(guHF&z+bfGS67K6Er
zW2#JRos3W=IgI6xfcM8zN}BZWSXFvoh&CRn!$ujkA4POkt;f;?(vrDa=Gv>$y-qAv
z_Vs?&4wBcEQb^iSmaM{Bq0^{o$ILuOgFUG#pwVkZUK%h95_z0gWXP9t~q_+$`yYE<{(z*wFq)GFgT-bma^A*ybgCD_R#Cf@~(lF9^VW)?zMRr&@3bj>7=
ztk7EMR-HDQj_^a%FFRKTLuP@7dw}7GWk5wehrMTBAX>;|WwC=>rg6QrEfS50OpqPK
zIf#Y5p||%tU-dVB3cvQNKluL7{LGJk^rLTn=eyVQ39hQ+_Dc(*ZFv=Fz?(P(c-hhu
z9TItT_l=ldiuN}ySN#$Wx_)ohcv9u1)D3L(kP1`xR(Fu7&N|*fU=579P^I9O
z8=vd(P+c2SBD)9~T(x`td3p3b=z*^Y%nXhy-ce@^)7>t$s?;{iIfCkh;J@d-qd$ez
z^^Ixn*6F~lP`g@y@DUQ|Jcne&$}G(;jseb#LKoeAgIcmf-m&2I@|>Hlp*}6=q9q*+
zj`Yc@3rgt;0q!w^Bi?G*y0L754|=WD-r*-;jZzG~KHRK+&=|A$Z8zwm++AGtihVLw
z^>-K7G@yW6Yawr*Yw9jHA2Bs2r^PWRJjEh_suW#&*Oqq^YZ$r#WJLHq0%_ex-{y#L
zYtU1VscmUWKF|`UM0aM@T92+?fhuY9dHXcLOWmj4x<3Os*ER-_C=Eq;k{KYPI}1|Y
zHE#<*veX=;VUrqvGDiTAn%A4F8uNgrO@lvPAxrZ|qQ2smvQ~9q{3;}hb>UPAl&`K-
zU?rKtaJ~X@^nP@iC@RImO!q;3BUZZR_Y0K5T-jDnTh(KFR~Am5h|rnKOs=J31+dz3
zzM_(N>lF*x)(l02_UN&)3h64WWk0v*!0}(omazIJxe$&f3g&9!&&fGFLKMS15l
zIyzQ_BsCh-8amnaydO%is}~4pp%Yr$N;m}aOg{weO$X20EV`FAYtvf)G=l>=MSlLA
zUU$GY-DRTlM~Z-4%sZ+`~!?gr}U
zo_5d^9RRe+83&B+*(tIXBOqtRJXXd~*R|0#{fROK#hUrY2Aga2Yf7S|$JZrqXee9`
zNO$KO33TjMxMYj18L&bFl}#^vy=7Omws)=t;;t|Ck_Ef&9bJ8{l1F01n0B&juqLs!
zrG+>2w5o7cOF{zrbUOCcUPDSkn`vPbuh)v(hypFty03TihuE6YRUZ^V^_;~Zzw_-iI_;VU;S66nJUa28h2{jthVYb*s0DEtp-!7Za
z&0t|0U!7!t>J_W9vWkmA=E-WIHYK~>ENTe08~d^IRAt8_w7mdyR}6G^#p3Fy?h3$r
zO*!ztFSuff{gWobYn)R~!iv*jXV;Fkx;rb|2EvLk=9wbaVC}{|YgP&mOzLop##+qc
z$yz%if-)}7vo}duBEJX55o
z@Magy775^%s*x;jT^9h95lbf6+Buw60jreAm<(&oG&tV%lc`lTN!Js5_32PYnkA*0
z3jJ6sQ@%X4Vm;oLCj!ZCt{rs>)eNr@w!sY4a=2S*M|bF>=qZS`s|1MsSXmX_U-X3@_RCk{G(Y`CtB5|N6JT_q!My
z>Q}`C-bn;N53Uw>@Km^^ID>&@8~4YUW=sfg+m~ooeVX~>od@-Hl>OmqPuf1`u?8wL
z7*!Cv?&OFmu_!R5hMCikjLv**)D%;mW+PiuXeIH~)OMh-IYPC;eac~ksHY)l(nzsf
ze_s5XYFe&H;rvjO@03v8j)P<3DDMie?Fn}KioJ|7e0dSbs=!+7;W*brcHAEh($JFa
z9;`KDHsXu>8@l}VgN&Kndo{OWzMZrkCwdMEs?|`Sx-^&R?o!}|4!3S}M3vih9alR7
z5Z10te>?@$FcG*fy+{iGXC=+9mH~M0r*P_QXu-HyLI3TS--t%*
zD}y}QR8_3+=AEUA6}xTV+Ae4r!nOPEgVYs{2d7KK<(6vNec0MspJqj!wD1ANz{%qX
zCJB&=7uCr4M7Q_~={>C;VwO;~PvfK>*6Xn`{Pz9&Tt?PZxx%LP^%+=rSvcO3O-#9fiuK00oKG++<&$PQb|oufWciK1dcAWa30fg4B@UXntLfR5|3
zB?chTn&X1whLZZc>9RNk)A8y#8pt0M&>ukcR=>=?)VY@oD=Yh)bF$NFEgf^_Y%0ub
zNb0A*tHRhS|JPgrr|D?pa&{h8Ee`1e+j?NkQY@8gYO1Q+ZJq}#oaa^0%P7}!x101*
zxyF#|at?Zh*0v`|4OUe#{a3Y`5fKuJPRcS)t2@zX(}qO1ohPY+Pk6^#E6lCgi(>5N
zIEo024%zKwXEIDqwk?9oQWnN_j$~$r20_3hXReV!IU<(bm1C{YB3)Nf9a=wXn?N>6EJbc+zNF0|jeB60Iy)
zt|0Sds^utXfsL9N5~UqqfcSiUY<+$~E#eDQ>LGltIMz7llpjmh-qH7p(e@WtXD^}J
zxe^hWQ9ZMKnO$>{g8=dxAyCQcwn>~z{@%>=)m5`-(VBL{I>sYU>2zPGGW*JUzSr};
zKYr{?!wy<=Sl<+
z%;zzvF%GUS{{{q7d8gD^V_~dl)`T}V3Of_r77-EWsupkGvodOl>Qq!mmv+nw`Sk`!
zz_=CUUba`4cis@F)bDT5PO5tEP=8*fQCJC3vq~*!O}CHWIY%6(!ZFZQbuRC3@MhPn
zI;owX>d?+f{RA$aBaeJ%O#j`i>pJI@md&1{ZQRh$QKfNCVqh&@_Nt0ldCa@sXsd?n
zfXDHf}ed7s!-Zd89pwvV+Uihb~jy-|e-O
zS8J+wnGuvZC)^(V-ADmx?Je_+2-}9a;-AwIXjHRGnKYGTF}OyH!&Dn$X2|zmeb6+P
zN|WqH8Gz`jB(&QgQ9x;2yLC@pRNeH5#yhf{9ZTOpaAIK!+4k>L8lG_IwC#RbgSV>A
ztB@K)cR;1c2LCX%t<~KXwn$WHg4ud0iKK6@d%UvhekOAcAS3aZrgG}i&}P#rYGunj
z^Db{$=SapgO~q?Zm3k-FlZ?sZVj1FtOdSR#A7=uDUE)9b@>bE
zY#^$nDwCAhKF@323UH0`dTf;U2~|H<)#BuCcMYi`t?UxkK!;@7LR{uA-v5$iQFoce6_Zm&MdAO^I#YDZpDkwEqFvHU
z>Y{z0Q^wK#%WdQgHaxy|SCIM)DIM&Mcew}|uR)s20`!G0T@hdi8!?A)l3@35=d&?<2
zf2794b^9P6uEuqCR}3n&ngN92&+-m&l3X!+A;sQ+)EwzNQhm1u;6tgNPJNyFxNyxQ{$(E6Sh$f+
z2u)qmYIN+qZ=_u>*Iy6NWu(;#(@<44Uy}^;{4w)#gRbFs1LarOSYD3QDafrngL3!nMcXu+xw{_;}
zY8|Ad>p=_%Osn;7>%VS>R~M?*SZi1HWA9)5#czE5GgS8SxQ%%#_=SXpdup?8WL6BZ
z5_V9l-2|pE5P>CE(pgghw3uGCa|Q>3B=g+o0wi2btcc)x_!d+FaTED-ukOedSX&gj
zb_VjgQrKi3A0csN&cyl#O9Q@xDK<#%SSk#ZxiwIP#^bRhLVoNOE3&+410KD5?eC!z
z9Hj81*1ZrQuBVy3kW6Pz<8|aBLZ!QGR3lG6pOvTI-}}07l1ewa%duiV*5k9i-*)U3
zdx3X>!fJY@7ujHYc00&82d9vQb8wx$o>GNb@}Vpa0D4&fyYo6|Pa;s|59tGmdpVMKb^@*W%5ZwPW%mZ#gw6iuy+*=LaE92
zJZg4VpL0cUt$4ma_YN(>x#?cAGxMCIMwB;5uK1~Bt)ChaO(-|1JZi=Q7_k(6bs7N#
zupe8U{C;dzyN*;|s+=kWHS0@yd>&nE#nMEvZo;y@NP*AgMap%{Z7dA|Th<}8vqlS8
z{@8amFhT;d8kHTyW5?dnjW0hofM5M%KmYST_r2fv(QoVzpWTm21*Hc$AXa%Qm3HB;
z`M|2wh7Q7(ij#~ax-`AyKoZK+2#p9RX-vIFubsR_Lw)DEMiX4I*V-!LOl|u-Vc&DQ>7MQ0g^jOXF|8PF`XM4PPkTfFnYDU5)7Ky?1b#m@Sj`Vx_v3
z@0_!AQ}iSDeyp{<7)0kgoQ2Sg6>gZ9_yFAI$Bd~`ssy!aBzOd+gw1~G;x`-@^nS``
zf8GDY|L*^w!T_!RM5oTMn23O!!!3K^L}|c?GN)z(C{3$UZkur-M(N{H)@Xui5=U?S
z@bU+8y7q~IMFbISc4}(LKAlrCIzNQ7h{}A6Q4?$7SZCPl*3gmm{(W@;k@r+c9=?wTH2+S
zueM&rTyVoAx)y~Ik9s0|zK^Qk%oI$sxE8I;hyR{4Df@&Y)nFGr(KOZ?zD?dcFk%Yp*Z$-LPLAo29$Esf4Axo
zv`JD^f8BDX_PuvBd91a#dR&5Z-ei6S*rQUgLN}{fQW*L^$&On^;c%&XU`$2A<=l;13Lvd7z1s77%=$?$HCtM=xegD3F!nd-WvJqOU?%YHcjKyF{?)@rrGv
zHokhV9jcK7HU?nzVZ>6^4y^+rBi4Ql;_G43`B$SEG#n-10tUurXYg<%Ia@=jJibzu
z-mMpr2Jd;U)HWmE>l!%Kp&L~x%aF=5=f8nEdGugqr&NBSHBjQs>f4&5D(MlU#uz7z
zj5mUj=jc%brHiC-2-z-`w>5}bX&v3}K4~b_TpT8vDJ6I1xWu&&)$1^bSAd|e@uSvw
zAtUx$1kVwrBOprz<^jm?b_YFjDGO+McI$xDtx3oP@$q>+eAqwt{m%g8tJZ-_5a(kJ
zZ2}NZH#b^eO^~)q9Mkw}47v*D%)wZzp^6`{YnmdBGctyX)a&yb%{tGbw+Kjr%PE`v
zrF>oW-#uC^+_9@FHDC$U5xA>J(0R>OIyI_R+r4C^R8N9_{o;Ugs@s0WYG}*p6(V3o
zzBvJ=mArLkH4&g^o~0#c9tE^1t{6_gTnEW>>bmlre!f>`Ki~WLuGOzrh`7dJ?1)vR
zY@YxD002ouK~#b43{tFM7tZN!ptNKad2n4_iF5k>s#9HdNnmxK(2LyT*6RbG-^L{*<7
z1tV@w%2zlTv3zv=MnI`1NZ
z^OVIA#4Obmz^!|%EzsF&gJ;8PFsiGv9*;+5i+6p0UK~XDoE*f9Lc65dmZ{@f?2`X;
zk43!WC&81Im9e9aBoHbQV#TWL>v@gXf|-?9VxF@uNLPyRIEsXAuJyk2Rh=5H1FvUB
z#M&#f)LIXSy7pQCP99JB!Zdg{PF7V3de2O~8nL@&Guu9wsMF4a#{+Aj5YNN+3%~Tk
zU;NcS@dtn7@BK)CT=zZ4_)@&lM~F83EGG=Z{?>U(^XAgAr|?`i3UfQ;>+FtGH$ab@
zn}raj9Gp_8ya&~rHmd7BHiC;K61#(B7tN!#F0#fPs@p@4BXk&^)-#h+s4Mtam*)JH
zCHHJ3VvIkC*&LN#V+ZhBo2-J|3+LV7I_A&|pIwkEM3b>%qrIWgUKIeXcGi(9B_Nqf
zPE#jv=cvkTKebNZ^#(NZM}_LU&h!
zO;Zu`Ok4u%{m&i*-5lj{c^r22J>29YI-(R?T2v2#HoH=9J1Egi@@r9$N|VDkAw75@%r^|-zWSDBNqS#nF>B
z4_K&jFv`k8jYaP?386XOVdy#L(3r9C0Y+O5=UQv&D_GId<2R&EaO#a#`0uIJ)RKu$
zLcC0q+{e3K$L*)1lD_A-8@wiUb8oDlU@d?zcvh8*RkbDwTitAyi^)L&IdEIyACIth@9dsa71#nWW
zqi(DM`t7^g-L==M_AX{nQ|<8M5!f*Gz8YmlbiotnP7~5jTgbW?K}v_m84S1|oM_C}
zj#deo27HuQB^Zm#fWzxo4>;!HEAD2%*cSm7v5Y4e{HDu)lCOz{mTYNxM5H|FNk;Ib
zA)f|XO0a=!CX)M5F-Bua04&(cr|)Qi0aNdB0HfvFFW`Ct>a_zDx)szS7X7;fazP+A
z%>!Z7G_lqW##;R;03mm7`k78qbDMO90lY?OFS(dHfYs&!=GCy6`gLK$&${Q+(1gLf
zr6XJ2!lZBi=bNRuMdLA9O6QO^D3=UL5M2bLqO=6KP?EknM0nh#ZkXyO9#pj4y_n%$
zL{nM_n=~t03R`i#HcPZaGo8G>wa|46O)Rh53jZ2f9j5arWrZq3fsr~(!-J}zVgs>b
z(}E2?ul&w8KL45Te4#I}R@|5F&WIDGr03|tYdx#uZ#k3Xc8}s{mO$+tC3zB6y~$*A
z2K*GA4I>h*sv_74l?!{XylMbfYilD+%zC*(Fs}xii*j&`AojXG9&OaDY_024y9J`q
zlGbBZ2+ZoI0ovw}Ki-ydwnz9{=8dvja4Ek`)_GlI3nK>_*gK?1qe)fjFV6MWpbI0G
zEK>K@px~4v!;%@Z0fdZS&yK(vI9yj<`i99jHXu1ib%lZ3lnyola!q}iS7%jaKi-x{
z832_p6SvUK*37oq5B)lp+)eAIA1B25rfY%Z0PS@nvD27m8_AVdjph2wvLIosa}?tx
z62ma(C>=1wNb*Kt7Mv;fUONiNv
zDHSmhv3O2h*X3aAs|<$RlGYB-=vD>j?Q5~Z3!(;h(_eCNwt`4ysCHculV{yUC|?SM
zT0utCRlRzxh!u~u=eV$)l3odmv<#siP4e+z1gqC?e|diXd!PNeKlg|JrT@`if4+a*
zkGHHR%Q8liT9&3luq`=t_UY^(xL0LqnXs~e@px%*iSFWBedoKf?yRRb=^L_X3l^oW
z3WnvbKyY!4d7woACGSJ3)C*FnI)=>v?1RM7>i})v3Tw!l!R(~YKU%j?Wh%Y3h?Cl)
zDTFRf**oXXXd~%|CW_v~a*tYwB)OR>x3r%!lZi@)L$`;*i5iiHDI2N4x
z6%T6&Lsttf|IuC(Zm=>Yk`e({2uL<5r>jX-QYxN2meY6EbPc?8dpHlb)z-$+d?Lw`
z6_^5`78P)Ug*tjnyXgYdfN#Xs?VM7e8Z|q9)yfv&?Gnlp=vq6f$39Be7F|7-kB!Wu
z-@F(MrjDy#8-+M)g|dfiU)8wZ2Qag;45t!PApTO$1>Jp}qmLT&z6RO;H#&l{0hel~
zZ;V8ba^&&i)djO@(nm$wJVrfvP4CwP&!9GFW|3HH0qv$p&&6pRlvR#V5J^h{D9IM?
z(>kW(oU0^ZV|Uf3!XiIyTfRXdml67HH_v}l1#FNpV+Hz6x{Q7zH6d~Y>9Z;VoHwA#
z+076zhtPx4s_~rmN4F!wxu^2t?FO<|a4|ObV|n2Lp$&p6-#Q!&RS1_qk*O4oqj$U3
z*6R?$1$JnaQJ8L?;<^hZC?2lFa6b!I7cbn;ZDv=K%bLBpOu>~^^R794pUf`0b&l0V
zSaPkF*S$RA#sC_$jR5Yg0c|itXl~6?kRf+ksEGycaQ+EH**&V>fsVSfO4JYbx)*r)
ziHOb9Qw)P-=!BEC`37$(e5nXtP>9|eyZHJqK8|jc%cg`a8BBK?b+N&QLONuZ9b9#j
zSJk(e9mazpEFe?ReAg*G3K><3m(w}UtK7q=;F$M2IIkPZEOP=~-i~1Xn9-vyz(^3}
zUAb56ps6!PP*P`gtTb*7(IQ4}G-%%U@PO>o%D>T-x9*@C;E6AQwdv5_QQE}PfLfl6
z*z*;u8*42$^FUR$W*hotn=Gh1M$Z`@MAYy@pFEC=gjU0OMi(t`sDT^Qxx3-I=cmh1
zcX(z=nBVkuw^&GcUsabz6_v`yMHr|$r&5f6m5gjc4@cd~lrM$@Db3~$|FvUL%<%
z`K95^Q<)uGvbFoXt>9`Kw-|KmG7P9&N-p?nV&pxNGtFH^^>MUNT
zudC0|5NuypXX3j0`Rw=iI#)MY-Ou+*MZ~NC_g?3!%C6%JnP
z5^wZOwC1o&!Y{qPMZ%2s@@n162yZm?%dK8Z@E0>Pubf&zEG|f7_DQ+Q!32@!A5Yl?
zlIU)6ypP91*Y&(w03~PUHvAi_Di&J2@rtU>ECQL?sDUKX{VJi5sJD5}VenknU9Ro5
z=DC?6R~E~YS}Bm;0oz)kq%fuDO!B&3tATZdl>G8k%0)SX%~9V-iled`dFsrVah|F!
zE=GhVuar$Q^E%n+^SsR9p`Y)UvzerPCsi41GFJSgW?a`=8j+||;x-@K?6iQhZkD8e
zC2NAVRI>YA_dp)?+Qf*ez)=3u#aHZ)wSsY;+Lf*F=1JfzVN4~wSKRot@S#`Pnu^Sl
z5|0fI3_-2F0QcSzOl?{kt#w;lNez^B;asif{q`Wq%KrG?0Dkq~_k-W_dw%gpfA`nd
zdW1@brrz?jA7ep?#;xE0foNc@pH!s9>#=vrus8F$?ntCvq*K|K2+pY9&kpHRby0>tx!|1j_^>^
zO3E%71o&=%o{Bf!19s)>164uo$%=>=zHJP00NB<*+B6s;5ZWk;eoXr;b)3y19v>lf
z^;EZXL-dT{-9f4(fAkfbUjM$)`X+g<(V9?q$mufW
zu05-nXu$+8C4b+C&vSe|jHh4}UH`-^$(!EGqnk6ZionxQ;0IkY2BN*h)o_9^z#81g(503F
z>C*{_lA>x@|FyTS&nGAOZdFY&xayL|)i6~%8set?JQv!wD}Zt6B`l;xq^-G4C%ZlS
zKT?4qTZo(78a7T4ENAj#=B^om&PJV0cWEMHn0`q2^?-iW!UVz%Bu$J~?+G@^yrDDQ;j;R+qXdBR^EhJ~aYGNT^IWd=M
zHo<6q>Tt01-|Y6bH%|@C{q$!v;z|FiwQM;yC|skPMk^6(#o9`1uZc6%_kZT|?|tWU
zp!U+=GahwEA}HX#9RIP%o{>h3s;9=)rC%;izF@ld5jX{)uS`vLRC)1lgn-ydW!*MX
zJ`F;vG3;I?g_9&_YporfC?v*ZUfonIt{vA&0V(A?5bz362@`luiW5WYL)ZuxBRCO3
zlv$p}L}T%~&Vw858cSiut7ikTcMOjjHRE
z@BO$UDcS48Yy7N@cL2olf0ewaV+9+keN+W<0h2=XPL&m6d-hvwgTdi@WijPwOG%{e
zVdID>w9bsEoAeed>Z!`s`|CAIH|qkMOPOFAY~lv5$xnM>n%
z$Wtr$Qm6*^_Qv=+Rn**t6h`gjE95^|Dd%on7eBo94t)5)lc>gZ>W6>ecl`r@`j`J(
z|LuR}`#<}AZSDaA5pZi+0JvgdRVrwVkdoBO>gbhuaVFkOPeoUEXgO%G<@9SHW+1$K
zV^+XIC3u^ODnyMj+bjnfDpnBy1CI3G7u-ATN!QKvr@5hoZtk^*fa!>JmknYjF#G^5
zN#!&H-QbEFGH%dF+$a(m&agg(ZZb1k<^rT$dB++
z9S%x0lA>Q|T>~IhV7@3&HiIjc8Vna5!()x&4c;?n#ir7(;~O1FI}~c*9zb!`O_T~%
zPQ_Xp{noMs)tpY2cVz1JIH6zUt8}1hwrT-Gh{f@=gA1l{(T~ylnL6VC&yjH4ZgYm#
zuxN#)jO8RPl%o>6BEn7tajPv9AL3Oy1*>w!gyjf*AGHJ49Ny^%5@6OjMfTpSRa}-0
zb>aCSS9{@O7F8LL;8%~P*NVYs*kot%USF?ng8;nm^Jb|q#sT_B+6~k8MpK;u*ulYl
z2NWfhoAgk5&y>3MgxiR_wztVJrepC`F8yL9&R7v^ueH}up?7V3gZEiOQWDYhq=_l<
z*gB0(7?zT%T)eJyPZ&xcy`_T0FL%B&uXwi;p;1#&IT80n0uI4m)F{)^>n(sOv)DKc3s
zqsrqB!{7}NrB0~^J1_{Dt%fHEwtAJ4ahxvmU=0uqUs(zCIR`zzbWlb^0glQ|uVO3D
zjW`<3L{N3j>Zbw5lvq^l0c|vz^DCD3&DNZmDnE1~!aBw^04A+>s=g6fl9{yRLvJq|
zc7FxpvDOOkoJ!Sni0he*_}#zz+u!}}R&np@SPh~JX8Ieu@u=M;-j&(*U}1faxVMB`lLYNz`=%a~cBQ(qpPP`vKMdaTFWTFZKV^|#)m$q1*7Ms=RF
zDLc^F=c>vq&!F}>DN&-{fWD>}U21L$QZaPOFt&M4&6;vcg7;n`cHr@_kwii@$S0gL
z&|2=69#d>-Zs8{9dS+E?B=VeUDQefM>T_kD%u^_NnIf;&Z>z-h>~4re&FpjVe6RED
zDqPPx&(1<+pJ$!Zc}atz=iCTX^*LRw=W~}sR?~z$sg3@@ykB;UF)o)G<|pqkC!Rvf
zMcPoD+l{-fX+3S?HN(t2d0kp^fxY*7EY09)dy_w&YTwgcwI8uoXifa%ZCCfX($V8o
zUbXilB1)`|3pSj~UZ)~6?^af4$)mh2PTp!sWlE<(U4xlZC4|?=L12nC_(wrm3)&)^
zS+({`XE(=s6-hG=oeI1?5|!&Zs-vFI6I(!0=au@{bxFHppgJl~S6W>!`9i*HOvm?|b^3l)6&?VLjqp2VktYu4nqfSx1+N
zo}tQlK1Ug_yPHV+OXGeSN@kkz?XuCsQ3u>*PS`ww13M|FWqT!LiQbc`J2bYMnOB}6
zj$B!xrFY1abx!&>Co=o_>l5*j=#)8(T{2l9
z39hwg>O|+HU7uE0nk$0+;8h(1LGT{G)NRZ$x(#*j-oCz4dd*)g;Tpzpf~=lUkcV5>kZ&edReG!UlB#EL79
z_XM8t1zAIF*{;9C8@q6~I
zCP3fNEIRDwtzlQ$26tCU#0$p*5q;1}8;Pa7OS;-xYu{ECPg+5&xzNhGMLUSwB0!m?
zyDaK)N#Kl3Z3u2h9ay+fAfbUwaX!3H5SE6IiXt~
zpB^D`FKy-!K@wjZL!!+n{m1UFc1xCgnR82nGjf;`50(0YS*0~70*1f#*~S(j@d18c=z
zd#`mPD=;!?q(Mo2fT2%lI84jqe=rkVgwN)EVDp4yr3GAu>*Xtg2Y?c<7_%hXPH=y`YX?%cPDW$AsV(Uv^FR{hZZRq&rR@6Gea^!CSN*
zj969RQry$oaexkn$!tmxGABx-=Ni)uuH}Pk9IipF9g=7-R>THF86HaTkM;4&w-2BF
z;1|ESfJy|(HTG*5VBJTY^B*0hZW%DA=vzA)U0G{8Qk|LufUMxN_~Xq)P3Zgbh-S$udOa9*AA(0)q#-QkL^kk4ryWr
zK(sW~r}krM#dmehAK}1WO$Rgpw(D2p2LsYJ9uZsa+f5R^MZeRsK%$fc_M7NrI171=
zo-IZrVz2#pXolMLsZLrf`Df$tSZnzKn_2`O+h)mCy>{%!lE@7py}^=|=5=3LCA>XS
z-nr(}d{%o!?AO*=2O+H%-&<=-HT#8Na6#Jdu!ec*Nk=T@ep%pl*Lpa%zVLmzB3IN#
zL%z)=AE31eLA~0X46o&yrBG|f+hafW(u0D#PA`aRL*q~_2MaL}YgM=F)QDIM9aW+Q
zgb8{hVs>hqNV5gbD)ozrQ@~UW(6``H=QdP7fyCQ`Z*S=Ck52&j#>K6AZK@oj2lj#3F21M`7=9j$=DeaKVssN5F#zwjV?HpI}q1Brxy`HZ5dOF
zGB+@{PbWe3g(`11_Q55`&$c1Z)C)6N8nJ>q7_p*X*}y|h3VIPFVz0GByV>)2OJ7Xo
zk=3=hZD1Q)r+w7IL;jP0!DIPT=<#1jJ-acW`Zr-|4-)q>)S@pe<1aPh|J%rK{D
zN~EZ<0S_>i8*JPukC5{M+MPgEg=RpyA=YUaZx49w
zf!+Fxiz}36+B-$jm>E#zIO}`I3>&jNGdshP;x?fXh|yzb>u*=MeN*qCJw_l?;i^AH
z4Br%n=~t{+%N4dpOK11^TH3SC#n|gX4!+_r<>T6Hu!A0R1$2G%Ni>V=VoGzNbEI`N
zI=Cb;umA_NI!|PyZ?^T7`Z4pXeOmOBITvIGL@O56Kr5)~d@WL@^(q2mKATzt>2wI*
z<}5DK2fNo+1)a&cai&G@1cw<`{IrDUq>}re%hP_%6$X6@Re`5A=E+V^&r8jZ^%$dd
zb*tetq<=STL&AMYH=1jX#Qm(|es1oZAnDBg3y1O)_CZqUfQoNjz`I$~3`8v6dCC|R
z?!Kcvc`jYZJe?IwbNlL;^dA+V0E{P0Oo8PmD+-f-;GirkOjWfr{s@zJ_rI{V$I4-~
z>f+3@ypXb5lY}{xrfnxHjd2B6I3TjBu55!Nv1|?q}NARXG)UiX($bw$q#A83a@TMFviu>ia1kb5n7|^$TX9;;+b2c
zL=nNTl)icm2dn$nC8>|iX{tl*KTM>$gHktQ1R134J-Wfwqo9%KY?yXnuoy_<6VYSO
zO^@aR&FiYSM||rW4~SG#1~J@nqkaapaCiUKHA$0086X9jrxlBZL{2x@*QNI{U9RRi
zud2rNUJ-&EyE*=-h3eirFz&1kZNiizYCWIVxem$9x~}_=&=Yi=w$MSkZ6LhZO^Yha
zJ3lly8UbU&8ahj_iS`D|X%q(o?(Qx{s6voysmZMFzOI82Icp-WJcwv2vS&GpKDQ0a
zGz@c!-l&XoR9a&aYMf_7CMP~fW@
z(uaT&^<%oGd5YeALl>(WAycjPSSYL&c@7!fCBJc_e$vaWC^3Yju-Uy95tV&P)2H(5
zXLdcGd7W7sd&*q5SdMJ@H`c7pJf~1%$&hMOHx?rIyrXrky;76R&eU^O(fP`n4uA6!ae+v
zRc#1TS*yxhj!8`pyN*#^ry^smC00ka(ls-;eTy>uBPCkWutu~8P+P6IuJDLBM5xsK
z1%Fx2Kd%v$p-m&If`JQZQ;5OTa;(NIcSRg%LN)d4`t+bM`8
zFtP?Ez2}MONR
zKqrusv-D2ct&0i~4tv(m+0(?_psU~hgvT?Yv>qETqZ81*UaPT}53>p(w4JD?%masu
zHvd7SDl-X^^>=+p0nbS~7f4X*V!yp_qeQ574FqCaO^gUmsHxi!ms#wIk7~lIO5lqu
z;<^!D)zsHHU0r$703s?6Zi^Wgq&3E9xE121-3t2I*M;f24Y}Y}>xJYyjM*Vav)^u9
zN5nL5$`M9{yCS^gS^|tzBAT>zV#BC6ICttrNrLRE>{NH6`C*js@e$(rRYFJ3)T=8)
zFX_O1`de0TV{X!vaHfH@23xA(@+8rGJS96jcNaSC06#xI%MzokCYP9C3D6wz!PHO^
znRY}{^k^?0?>?0;TqI1;F|3sns$p|#$(dm1F-CZBLMU_&B`o4yqG$awnqLZnT@{O(
zY$j=VN%x6!T8-bhH6kNn*l>J{)2b3AV8(3>Fv>g
zP42Wsu#$$_TaB8iB}3dGg=X~ZUUs(-24njE4}&bu_f^~0d#%Ug!M6Ne1vCcUIVZE`
z`gtD+QEgFN8bE8b#{L;xTUdC=Od>qYb6W}-NwR!J^PsX-QG8H?QMLA}tjeJ{&~sW`
zBSu)$8}?u@(ob@pO|2E6OkXTgZ%=waZD!enbo(li;`7wkzV_kUKlQ%OLn76_m!$PNf;m}5xhg!#hvR1Sm0@hq_^hv55y~HfS5^3Sa#!Oj8&y_qm8^c#tMlWG~dsYhMXb$
zBH>oN#V%B5g_t|*6-9U0jM$IIUJJH>Ua=Nm)8o_dJ8U-ZUru^~bN7H3RVCd-6I`>K
zmyH$H)9t*lyzOp`3sktZAQ`-#vJF82*U9H~
zvMQEV`L%EX1s-Q|`oxebrW%k!!S%Uk^Ta%Z46e08e2}X(y>Ym*j+I%@=XG7@Tqo8N
z0hN`a(51>*D>N7&%9ya+?(w$Q7MFpLcFwEgz!f@wn6+CG9%%jqn9FmW%tXZ64@o#l
zT9w@-S9fd44u
zkJ5d+ruISRE>YX_&X?5b{&mWtH^SnWmJ4X@sHX*stD=#ued`6D^w
zQ1f|o`vKbI>dvhjfH3@lj9&*%Y-#mSuovQqf^NR!}>&16c|AgRtvX
zf(jgo`4D%t94L&0nB;9AaFbDU5+W9j!+Q3?KgVQdXl+5877K0g2@_`q*Y3JPZ$~eh
ze0iY*pZM!e6|~k%BU70!Io0RrPu!s~l&n2(8R6-`S8YYEh=2paC+E=nb9=JJB)cw+
zTw=&xeaaDqIf+lEBuQF|<$9h&m4~Z_X=os|MEBkI(mCEi9x%o1CGrx}Dq*!+qor>H
zm4C6q>TOjhF+9Cvi2LN}a%%*#^zA}7te#cP=^l=Eugj@gKmAuvIPI8#BYlXZ_~8fg
z$(fJn#$Ixphum#+2CB-H6ar(GaUa82J~pppcC*HJZ|?VV`!+dG`#aERQE+x$n(&8-eP764zaaBiSZDWFRrFtRi@)AtNukG^eyAB^C>vYTYp3`6^t8bOmD&rClI
z%<2jDCm+{{f?v3`g>VPAB38trN6w^Pd#O5KKgum;OtoR&4EF{kS#rUid*~U?j7ar!
zWBmtfmS}XbT8~Sy_gdFE1mDU2z{34H)98J*1*A0v*?!@+EPt}HULT9?P@
zy=O0Cc-rXhY;9$flz^X9AhI=vQP|ge*KbRs^0Zc6)@x`~=87HM!sCyH|H8I4tDwbB
z>;@wm`0D+9`&*xX_uF5?C*#vPq7#4Sc7QZq>+)*2R-_N9Js301hMwa#)%#yci0lkR
zXqt=B!1F1Z9^HLiRoYrxMRM;Es*g^!tEruS+Eq(*_c@8>l%lI*Gu|BWgZHoU*ngGh
zDdSnL754Roo)6A-7&s>xjsQwYnl4)_L?>8wk$ulY?!7=<&(rEHQ!Jbyd;!NS?{pQ5
zYgRB%!MuA@`(U-+R!{P&J$yD|t+XT|uU64tSx4-U9($pxkJg{v+@SY`cI=QZu{vIR
z<20`4f%%`(xv67Ci9(j5M-O4u^Q)^wU2<}VuDr{_`Io%yAc^C$BTiR!Ua7yE1LWV3
z5a;vXTP1ts7@{{hqwm*s6u`x4TdvY*dmb9kGL<%Z5LKvaFVJMHev4kH4l-n436POl
z!N@DSI>76BC~l-}mkl6Ko|D?Jb*@yMS++P1MS0yVWxt5fhf?uzPF~L=tX9>RT`XJ^
zk
zmH_^EQzr~b+F5z>qMT{a)i0;n5hM?uYToa@pHM>V7Z-=yN&&A@1@i|mx!%2N%t~YPvzR}rxVPgE7qdv85Y!LlkzOFBYv)YTxXE2zQe>05rn
zkfIpt6Q3C&&Jl>LM#Qc4Z%xVawNp~fE}$M6HUCv2FJ<|LJ&=R$>?IDF@@(junbOn~
z?`}xfFjZ<>W{CEvwr(W5``AQ}E&FJ{0<8*-NzGJW9#}Wuahu>GWwZxmgXd_1cT3h*FDc=OP3A@4Fsdo
z8pAHz%#@{U90nG4o5d`Exk#72I(2?w@kNl
zbeW-Qf7TS=mtbaV@8jz5-LA)6PN!=Jp)NxwS9O`Fl)kquHk$l9Bi8b9Sf>7nNkug7
zws3E{YL5-;F_Zy?x)Y^46=Cic6ude>w|X+-a^zHhr#jKSAM}RUt)hb@qKiE{%a&v
zj4`G5yw9$}=?%oEaqTFyY^Q=0pa@{?-DNBmxOazQSRS_w_zC?tfYuK&k<~3r_tz{T
zZp6e6XRjYSc)*SSffoGJ3h{Yo0vlYz$U^^yCp|-TbK1Az*!@~@7apV7G{-IAX1Ez)
ze(-3`Y#y8MaQ|G4&Kom5Qgx1Lr5AHjRnpSPI#y$}j)u~QfLpjODWIP;(cNvaG(Am3
z`ka=rz2GYfjH&GS35P$!Vt1|KDD;LLKNQ8ju00yw9nFkIU`NzM|EF#P9{
z2fWSI{1$zxOcv;7WpOcN_D>k~1h`B$l9-7aaz6grf$mPt9?J~~
zmEzP0AXZfNTAub?TO<`UmV)k{q1o_VfohPo!w*XTc&5eI60C2WPz{(?3j4x)5}|45
z&w0Y3N8w-V)2pbL6RdcDDD$V7TGk)Hm5(KXCg;2Jq^RRMvjWk9jv`EkmITBTZkBT0
zxc&KP;&p?3%|slA?7Ms7m}@r9{1pAAg!}nTS<{udB9@9%0fQq&p#gXTV1UvOTill-
z^rw{ibo6|1~*?pbl
zyg$yHGdI;(5qqt*w+2LGFC9&P{)mQIHH~WZ(4-P<5#(MVuj@RYmoOk()$XXFP^^@Q
zUA_bJXH2>4PGG3}74`t^bDa{SVs*W3T{CM%ygjxkRdTMydw$_-f9cQv%GH%8Z}ZIisSdj~+X^|%(%m+ye$W7a
zgv4K_<@c5<(m{sKcCK$lL(MhSx3jIQ>;oM^)w5}`04C~qOPT!EdwvE#{a5Johp#Yd
z66;;VUN%R={z&Ew$Cp<6SJ~$C;JT@}3q{gjQZWgmbjFQtD
z24xP1%A6r&pzcKP|DYm}{s=?C&J6;_H3MP`)~nKRu|514`V*#i&IslxI;%MNr8ov?h?v=myRN*a{fZvN
z8c?FuE8RIxEL;@?&&8Z%|18xuN=Q0~A%W8;CgHNV=^@Woa0S<5KqJD=w=vq-RI^|$
zo6Uq>QY*kx4prvi0New^riyNElzyReUojn%plF{Dod638h+wSgcILh4^!sl*Pua6)
zeshR7@}at`ixHN(A6_ehixxplpq*KFo$8aPVUv8n3D4?xNZZK13m!Us0U8z^O}VfZ
zm`tr!l2&KD$j+pOh6H;y&Pf$8Ra&h^&$ZTTsKQ6}7P6zr)-tYObmon6Rp*QAlm;mc
zeEPIO*1_{iFlG55VXwZ)h|L^p71NIGH=w(WYF#m`!$ti0I;Sao@Qq~aDJ+mn!Nn_ATZwPsx_-E-kj8{k1$$VN4
z)YX|BK2ub&tOIyII*3Mm*+q1jW7Hq1)~ISDEnB=YP&!R12RY=;J_(eC#~7OI92`zlg_Vw8
zT8PTUZk(&eoxLGTp(>Jjs;cEXMuz6uyyH%1u&TVW1@rT}yJO*8=F>9s76a>Y?Hx1m
zXd^xoR@1NEOFeQ%3U$DsrIF*ydal%#S9I6WbYGq8z*be|IaM$(&Cm|N(On69iHTFK
zVlb}~Qm)!vp9+v`t7DUR!m(@%P1qJN*nx0&&1S2HvnkuT&N-P?d6j%?m1`tUKF1lm
zESNWU0YXE<-F;3rAw`DX_*wxgnU~6Oy?sCi$lh5ha}jx{=F!Z#7w5v0`OsTPE7=_W
zy0f!X8V{R@s$P5GaRp+V&^8)%daJZ*tyhK6$a9^ODflUeE>In%gG3L4D#~?`m5|{4
z9uSQk)qS0#lzd$W@HD|1jgvZIF&sH67@3QLxSkh01fd~eu^cZ_P7V6Z5B89#*gMjy
zW_z}Ex2CmgghlYb`HZ!e^?9NmRm{ZRtGe?@8L^iUI@GOhojvxjg8wFH$I
z9+F@Fj!z21^waeD3Iv++Zr614>hqQ3
zRHfISXF;oi&}i{KE+Ql7>nWH252Nn@3hXPN?AQXesa|2It;!^^~37_dpOdg
zMBjNZ^c1YM96x=p63EO;W3j>&X5a=lq@mI*Gr?dlI3SoRa;k82(bIa>Hh#xy3;b(!
zgH?{2fE`R@R5j4?j%lW#N*E@zwgz2f}o=c7>2=gT9MOi#Cw+neW$ZU=J6n
zx0hK}dGgBYQ(2Xk1qe0;Xsx1Z%R)Ob$^3@nBh!O*=)cXU>}Zr0Q4AF2c~n*7rnqdx
z*{3eaR1}6p!@@iZB0h0*QJfE#c?|zUM_LEEdd;k^du~m;2MzXffFELDL-C5nKg@_b
z?dablJgs_TrbZxy^PpI%&OpeLAqxF`E%TPn)1=xEEnS(jC(zTFPElC`I}D87!=m#%
zfoaAKSaErRknpG!VR&ySW1USM%t1a>qbd#D_xzj$gPK!q!=>k>F}G3o1JZlwGbli5
zwAe}8*p}d!PvBT!Y;{$rEff&3rddMwKIG~kA^06i@2n)#qD9{7Y+2COVv?H
zx`X@T)D&5Ie$wd`&|2o%nuP!!T}K)8-DEdAi5yC*T-6qwHGL6W=G6Bk64do8U!F?aSLLMHCDg`78r=Nu9I(X
z`{#ex=L^U*Vy1KC*YbKUMy!7FUm8ercO77ack0$05WR)=QXF-9JtepP`fHZMmpU99
zbTwi*4l3JqH@twC4Lm=dJh|2l5$ZnleQnW*WyRp@;N9pft!v0p_Uhci2M++&W**rF
zYW~?tf9=o=Hsk~3H0E@p_@lj1+NmQ>Ph!{D#=dpJtIBd#Pcifz?YrIkX?k3;dc{U}
zZft0f8=Ar5eU?V^$p&MucKsPb#&IP*dExf$Cp3m#3PIuj*LlBIGVeP7v=wk-g6}8shTX(q;QrFq!27OLG
z1(Hz}f&(K6uF(9X6aUTgkcic?6^)+|UV&gl%l=pE9VuZL1%FaLZ2Y>D_{DXh^H-Ge-T#r~LCJgGwuoC3tBO#8y
zeVE?fi)v(RJXM+}*T|c{x=D_9ZL{=dHAU$V_zBOby5TP9V3I-av22aoocU)b*gN&8
z((F!kaq|^;7Z3M0bF850m|J<#6Au|0gx2jco3J8oN~4Ljm#)ceORI{Qbfu(bEUVSp
z38E&@Y@K#!8?C>D%;OmmOLIMoWZlPxBo<8-g+rPYNoee~1%6rdhJr_$90A}A||
z!jzd26i%l~;U4RpH;DUnxHX!C=-P1d0j7fzraa=lnv*(bNv6}w^Ogl0WxX-yIwLpXuJ;v>#SO=jV|bWc%WzT5{QxMs4>OMo-0rEEi3%y&1xmGrwACkz
z0SSYJ-H_gJa6fc3P0G#s#GHj-B1qLsn2U88JQ5AVbpTn#L8$!YCHjEvOWFkrrc{AD
z9|$$b1c8DqYGgSh_;?tpo}SCMRJFZe__%BN>J%pIibjWAGpMEc3Smh1fC3Gi2+D0z
zlw%9vxXVNiwA17IwbldODW5b4(octdapNUKr<`P^hmlUgz27t;WH8Q26G}I3=P40C
zd7T7!fVKoe2@1?Cz-yiK5;@q&Oh>yz&}V4-NCP%&b<-h&j->E-Qgm3^pqb2b?po=#
z>jrFnsRUJ}<>tm$MmkX49bAmnwjD)f%3LG$Ol(7fyGD=Li>oTH>q7Ukbwsz_4!Xqp
z;Vw6w^2Eo$ofnCPTwP3eWKaZYVANFPadP=x4Wr<7z<|z?;z!kMc(9p>dh*MN%^wYaD%$;
zr9&kiL#&F0o!50v+J!hzg6J%*+ttu!P+U;m_ScyedsiVf0u7+srqcuo&8Es)J{a|~
z;v057Qyr{y4KpR`yM0}!N@h{iVh}(btr3DgZa1nc
z*d@>8wQ5Es&oh;G@~X^|H@GNsJ5I{;f>9cfCQeq4kEbw^tUl)+a07t6P>Cv>tJmV&
zCdqT~Tfd#({pS8h|KT6*51)PY<;TZAU}lL$I~6PvrLZ{No}sZL`WnOk{J
zAVy(;Q7M(`jhfG+`UIw$DKw>2x4euV(rs0#5P-Hvs7#voGWSn})npbl)?;-UO_1EB
z(3G0Cs^obS&g`mA9b2a>fnitba;aROKjEH8K|cHt(cS7S?(XJAXjOHN7~70~x!{?c
zNuafCLOp8hIaGWK-jr18BC%W5+yusKsW#A{4fX-eh_=Y3^6)>Lsa;3Td$*xR-H~mr
zsP;(0{0gX)oj;SR-m1zezic#Bb!huK!-bVKjjKy%$rWzYxNO)FF)W9lw0~F4Knc2Q
zEhS%9b#u=8u63*KTwgOX00rbc2N+Y*c@ZINTB9r)RUNU$OLApO?rtAcH>we&e{ab{
zO$WBC@*I~%L#*p(=?XZP%-|(&u>uj4DwyDGbOSv+CF)yUd)enVXO%h1<80_wE)GCB
zs8=0jf$SnJqnqetH7*8uZ3nHF
z_w5x!cQ4S~ng{r8tElItDGq(K#i;7Nc4opxWh%ba@Yr2wxWORF0xd{5%1I7eZO}kp
z;J|yX_gb3vDN_)uI$i(2di)y|#bB4T6kaIe-LE^lD(ng)Qky(e2h_AcfUHiSH2Z0<
zs^|jjuoATGIHv@v4w{{tn^gtRh?}uVk3!wsM@-8Mdf|_x#-!y!PS_vd7PU5LZ6c!zZ@%F48)gLsvSF`{L>Vs(s-m31nDm(DWC-%jMx#8T5mnrU<1XDAx8ALXqX(0
z!VO(A7zm=-0j#yo>2H7g?OWe`!yHpjZ8=1_*z$|;@t7jaKn&;3LGOe$6ME=7DHyN`
zq6`&vcWCA}Pzf|vKyOCDqO*MG=52_n(;&UZtKL4_byYPYWYfj0+IxwXRGwa&l^tt&
zQ!g82tWf#xw?XJIr?iRmDpy9(tIu5Dvz3x(X%fUV#u^82zLZE@L%(7+sq!b~jv6~E>tM=A~
zL8Bv9_i>`p(!4@!85?--g{HX}h+5J&cDLZaswyJ0qGPRq1^JTAS*8dYb5WVQ213uO
z@b)y4z)}}(Bsj?O&R$`i88JgxV^0FFiFRt0DTU$_OlX8dgY3;Rb$%Hg#JO_6?ds}-
z{kGRybsfc3KaZtQ3E}DrM5vCSl*Qhx=xo;^@d79_zk$i*D$EGx$*NjAL}g2A9ue{;
zP;_cx1xJ@O>N{BQ%og&E;_#SMZ%3vjy0I42`2L|xkQAgHa$QjZtT
zb-39D%`nA^D)iML_lk02iY{#hN6S9I$wfqs76Ns9wz(yxLL=L?2o&_7`7P(PlNsbf
zplwE>vU}}E2;l{|JzXq-Tgrv3sO-nWyd&
z@h*Z@s9A;3GmF*6`GQ>4DQwoR=6eUCt2$8Gi{$12-Y&UgudE}65o%g|lkU>e#7q+b
z+OY@JlpPslH$$=z0ho34ln6B&v*ICXIfKIT3zV01wyI~RaRegP$@H<5$ad;9)+ob+
z0QQO*rmOarCP5f-l%0AD?khMmy|S>@0hKzs8!XE=%wPoRaOs^S&=(Ci|J9|@W;Pqe
zu!mpRr8c^=r-hD)0t%^Vf<{ehByR!&-ZATZ)_3WkE7QS6tm>nWH;uyx1N8&_lUm?H
zkg$H0jHNzGf7fmfg^=>F9rFZ$Nn{SY+F}N5RqFF@v$HOs_j-`}Eq5}US7BY#T?Oc>
zqx)XmXekh;jd9t=A@@is%H^YsDl$g
z0cdbuV_#J7mkJAeudWn?3XB`J`++q@ufsU*e<}Hz9n_m~5#$p%9f3M4ssAyhSbMmH
zgOd1jl?@|!6FhbnSd<88CM|T(G^M)dh8kIuS4cN~3g!B@w2PZ!fOaU|9D>b0&|Rh4}Rn;T~pkrBH~
z#+*WC@5Y%#2e-()QF-=!9d(ildar^NjV(!mK(kC0CvM_`ZG5?9R<0Y85h2S-l4Z@g
zi9Ts6YFyIXk$6ZWU9#NP4u%5ZlY%^TRc8-GJ&<{Jos*aJ25V_J6Dk0WP%}o2gVQCO
zD8Cp$;+6ZPiuIE<9foV_*V0HmG5t@*0WcipJaL-DczuH=uowizjKp-s&Lz;Z@;U2f
zjb>@)nOJ6{hP>CT=vsn!86kHPZwadgAWQ#PtJ_;T4G9g>NN88y?Rn_A#I;tnu9-3Wq?t1w!J
zuO8~2L2s@@RAqQkjRjFH=!+4a#Z@i{6asti-BqdyqS$(g&P_^9QgRp%1%fP^?pE1TkD}nW#^&dtGo6?*b`Q8Y1l7kgHidEUC$FcsBvhuC~0`sc01j9
zQtV%sCYONr`Vh?}eTo5#;L-$3P;?(|-=WG(k*g=yBOvv1wQ1q(wPNpeF7anlFc@yv
zh9?0%+A7p!>{Zsv^mQc}kGCD9Org=eAKK|sQ`z)P^YR=O?jc5-J_DVZ=Q;z>6m4oS
zqwm#}@iGKqn3M!MxD;G%zq|qn;oaw)bF$m!I(zTEELWvs|k5kbvDgAkp5isV`=&*4~cKr#17NGuyR8^Y_aGbr;j?bq>y?ejEd$>MYo
zO=P-cJV(NP>>WX=kvl7|%f$clx&T(S*1AIO!PIRnFTkd{h&Y+oxs<$AQJu`^mAB|T
zPw8pUu_JVmdyRt@HQj?`i-d(sl*d5-CRbFB@EN|F(VQc|fu
z_Y9ld3#&Y1++8I%Z&V`>uB%S=T6p_FfbSQ-e6K(7`@Z#${G~toJ74~Go?~bdq3O02
zVS>#SC5hO35lAaibmaU$DLF&7DIU_6aZ8_cIC5d88(d{Q(d|izoS9@@D0TyJHW@IgB5;s*uz3NpzM!D~1Wogw|DY8)*y(N(9xAP>&h1ir0
ziS8MX*033B
zC2-D#&?aP^bW_b{&j*ON-l2OMau*5yUm{`_b5yxy8i>arCi0?0M?6vu8^c$)JAfbg&{sY;zEF
zJ(?aNayxPKUYm%ljJ4>c2!{yIt4yt}EqSrHxPoi%0GJaL+!GQcmoQ#HQe2vd4@2FW
zT3Xb{ld#lvJ@xEVFL{a$GmC(EkdnsfNQ^9hwAA6;A@nX-jmqMR1r$Bz*Mr?#sj(!-
zZ?S@HG)vuZu+g(1x9#0!uP9X3TD!FCH3F2k&_HkgOC!K%3-%l*iHVqKJ;BP1waoSF
zb*Es|b_dvexajQ4RDBj?L3B5@>OlLl@>E?3^xivRn5i>yBLvjK5+7DQ6~@>|
zIH~w;N9cQH^-q8Ai|>5vbIep5<5gZwPXEcUIR9#31y5NUxgV@Vr8x}%nf~zTu0kwF
z2mdIA*JCH-D0l)w{8FsgSgY_ki(8YO%U@|hi*3p`iuwUs&-K1LbEP5=;JM86
zda*7;6X!bAkRF&PF%nmL)Cyby`M(RA5MW{R5=O96l-_Wm-PgybdM7;-jO8-Hy_aCl
z8~6ZpbDInV`pRxF`npbcuSewRZk%)W-urDcGp}sm5zB0nL}Kg^-J2S|)qWjpc{Ss{
zoXE;Ra7B)UtgGdf>SP11>uELX66KyzO%(!0UOnY(=*DVI6}^
zZBde!o|#W&j@G8xdj>~T(}=kuR-WY2?#jE$v7KoXRsDEu;dI5D@1_P6#D-evYk_J!
z%!jKS_Q)oq#U`n;$xJT9V~LU!ZY(W81Bl2nStlQa%#0O}$If(Jlvb|nz1KZXEQTkj
z0U>}32(3hj#l5z!{92IKi2ydLc@7>MAKv)o1Lx|mKGxSh#9#cgzx%)b3%~f|U;lgG
z{^{@Jxgfy7j-WZfP~(^zC}g8qTzkRi9a-AhCM9Wq^1MuLC>F21(a?5`VeNzws9gy4
zcWreo{
z?a4x~{#kwyMzSrQqEc;lG7#Ltp)oY%awHcx9SQ;ic_Li?`Z?$cl!d9)$cVLKYiz~J
z=y)+oY8rI9ta@F5dsKFI(`tw*==GV6?~|ctI9mfG!fFPj)YJxA)deJ>O_1bXTaz#?
zyDRCA5jxyJ-8mRK?QgTwcC}DZn(b
z>)IY{Y6~=h*sBZZ8rW`WmrqPcr#Ip#I?29!W;*nU=Z?U`FG7&qql#0p#D?td>zTKg
z)LN@e#*UZ!n)+NK$4{OE$Xf>D14(y;K4Xr2%R$~*=c+Pd+3?`7FcMyOzpZkLk9x|wKfG=1F-mbc2Pu8mnJ3$P7^QIbK(_3ikf%R
z8cj`Mks88``9Wd^)xDxKX1cb!){1*8pgc|l`Kxiw%5F1t$Bv?1-6u<0M`Ldh=*m3s
z7wOWZRz!pyYt{7VeONDS_J)eE=NwYF)!ZV_W^{M$yFOmBHQuQyf
zx~|E281_`v`>(b3<($)}Pv6My7AcYvDKQEqM}ZtkiIK!oj97QeurtUYh!Mb3XP8-l
z3^GbaK^y}?W)6hJisC^M2MG+@vJk<#OQb}Jlqix-HoN=W_HC{Id#fsg=c(`CYRgjh
zIeV}5|KImss-9cj&RgxNc75`m2xuzqm`spA`RxzB{?!YuVi*|vcF@_J+>H}=WO2|U
z^o2>+ZkW>B&3QblP30dW2{7|PiS_bd+1}9h$aNh&&VZG0kqqd=E7uFm%`6NlUfy1%!d#wVny?3Zk;P!
zQ=&AdEX$o9##~~0L20z0`_$BPy1Qp}=8Qq6se2c!cUA7@2j07UrgyMrtFFEG({-PB
zB!J^urnx3%oI#xpG>L1|Q7OQQcy(2a`Wr?%k7Rhy-tBG?*44+AFnnAt7jz%j-QB3x
z@RRCpOTpq8P?@Qi;PK9svOEMPD@ZVvAI>Mpzj$z1t^u&Dl9)5JzZ41292yFtW0DM+
z@Z5!JdjHs0(93xEa0EyZSixyLbETyW{ccczn0Ne06>G?s$62
z>(g<4+Q+f8wKgbP+m$=_@<4-pGApWxsKT*#8;i2ckY^aCvb?lkpL8(IP<7L)y6zej2x7~vOoTstwU!W2VT(fuf
zW#Qo-KwqD#Yya1N{=5H!Kk*mA5^Cl9?8t%?wY2J$W{Yqf-z%w8r>ac&a&L}{@93j*MzVd<{IQ1
z$lPjF^eR}@gM|Nxq3GCkhpU2S+09zamB9$X(#5eCbt;*pTWA&V`V9Ia-PJDRRd++#
z5Iw8O#xq$4`MGLJbnQwaI;{Mv&=ov9GUwEqWPu1LS;MgiGm@9fjA{k7Ohp_(@;#3U
zAryFKq#6mm&G=gq49QZ^fZ`~;Zi7C-mft9}moqR+FbT
zQmqTQ_AYK`u10=f{?OJ1s!0s&B)b_|q0%X<0Q#%X+7p9qQLWR81Yc>_=8(Ro4Yp$0Wa8|-tGl{1eFA#Zett5Wf>@a7fa`2*r$#(6MFKv4
zSzehQ7k>Zhvasmo@a$qu%$2{wyP((r1<486Fky!PPFzGvB!eR$0+izi+x4I|N;b`S
z&86y7VRH}*=vq*aCc$A;wwboSapokZJCLxOABHX$&R20baeQ9J+!uqBNndOel1Z0d
zkys^QYtsD?*`R^5TTnFLg%Kv<&b*B{8ys#{vyEPyex(N3but}~&xpseYd%T?2p6d1
zj;dsMCVCez58WtwD*xZ0gx0Y1ZXKEi!jBw+~P;0P2XZV|`_i0R0W|?etv7+A>G0-Ry_LRrv
za{11;Uq)ab7J(jJ&AAfhzX(gVd2BuCl)K$sZ0{~0Ky+M%HNDW`27@_}rpE;~lZ{3!
zHxsGCb5CQVV`TYmX1fZ$Vuj^FZ_i{3%p3H8>33;_X3sZ03w`Ftuw#h`I8OO4t0)hz
zT|~s0@yp`E!?Ecapx(7Sc$!hAuVgEJ+EQzM`_=rzrfI+|2~JaU4}KYqwiIc9!oX6`
zb_2Q7IBLwC{5}Y`ar6soveK9n8%~=H*ud>VUiJ1ohJYnaqtM1Sphm?#LP2I?nU9>6
zuYTBCSa>zj)vhs2Ry9YAh)Cg^R^{Z)#oJQmS9P@bwOD~I#8^CVRdrKyrB8brkO1JE
zXb*E#_W;rS5jh3P?
z?t^@nsbYe!#Sce%ic7s^>(J#@L%#zZp(gpuypnNd+>~4$V^|W
zx=iWzBF*+bZ8d%l((>h0M<2Njqo6tsX#-Euk6l%lOUOk=Zq40b+2zgd*sI(6{JU`X
z>;!BrGFf)Mapo1qjVNa_CJ$|^tQFp-@I&#sVOPU!U4k(;7S8(Ndd)U!
zxO6K6os~or*II1a`8BCLQm@AL*hh{;7Y20Q@7>|Z#)947*}K&{?ajOT=*9ZefAaVL
zrT^$Zd-L|~vxjFpH)E*<-Xjo#?I^c1vg^!)#VJ0cHKN_4x+te=piQ<8bIm^JDvN*=
z&S~CR$!Kkr^Q9BJaq^i$+|GmjL^o|1JTuE7c6bI(i8_D5+B~X?mS#YLyc*&N+yX&n
zHCkdY-7V+OB+`YXFCkov3%1zk@v|J1W-kQUq>~?K`Rb>K%8+7b<
zXKks92E3!u74GBI6GWn)Lc~i{*ICxGah?z(gVFZu%9;{}-l$aZjnWNZZh~~oIEJv8
zt!QANhAx*rzXjM!EOP0BBeiMat;
zwJ9fT_~?Ud+TW_wOifUNB4SCsGX@t14_XXE9_p1w`eFmmOohnY(0;$SH4j~b6he~fwlrb~Id!u2ylBwl-9V?9
zLS3WEp3o0m;dBx~4Fa{qZN*nOh3(v4#7k81nn;kUQ>e@zOY~4Z0{;USG}~pYiebz~
z5sk}7t>w($z_sCKiSxHiOp3ZyJDVtQf|AM>bFk&O4)eyKrZy;9c=+rRvo7DpP?Z$sTr#!z+=+103C-t6-$Ax@kgrlZf!jG$M0ZP~VI0%-sb>4$?5dwZUPq
zI{T`4^i+7rj(iK6o3Bt^y54v{)w~sTWh5z_6k&IDIl|4V(mc9JqN1vOg$bxOCi;}7
zfwB0Aq-V^`pc=x4n&auI-$h$pqor&D(0d;di)a6)5z4)#WX}%cfkY3
z)E}O3HA#&;5p>Oz_0pYh*T-Crue`WmqHzqUM$C#~Z=hAJgR0GpL58OEEZy&2b1JE&
zveab*z>;*?pb9NU$U3{6G7x3`abNGl%-kIN$cUioSjoLp0h}nIbCjP|h_WaPbF?wI@
z!-3w};SRIz?1Eo3z+p-mQ{`@e;y?{t-qToW>z>?7TQ`zygq^1bVmSx8t`(%4ERbUu
zc1J9qXtUm1anLR*hLWU)DK{mRmrIE(3`W6u7hgOD0i3Ox%{JK0IawD9hufU8YqnE=
zYG*z@=Ht`#xE|M|pRV=z?wVpX;EoTT-+lP<{^bXEfZbgtgh?h_V7e@JmB(>-1P$|<
zMUOF8tcUbnRg{7^6XQ{!O@K>u>^Uv`cN40xy>l(EZUq8YR`UL2-$D?r8lBlJCHcgt
zf=pJTE4n+6n(|~`aohQIsKsG=C)z=aBMHL*uV(5YoT2EckD){utx-vQ6i1^nGrmpk!
z5OFlH4tJ1G*^9YzK&}KD
zjMT|axvdZ>BFO3ng_;VaATX*%s~bGYRaSy_iOJDvOgmZTfKqSfbFt_)ihvT6KQ&wt
z7lMF$Gbu4`Qi6RPMg;N9d@b*?-tB9l8>z_vrsO75{zmtvEZ=!Q!RZG3i3y)-Qk
zY&csDEw&rkBGa{8RZJwVa*xbWm!YfsoX=R@$e|l`vQ;UnQ{4p%&$Gy)Vy-f&He!ZR
zRk6C~SLVgk_1@<+)Ttuwxy+cUf%#X(>pNtxwFxf*V73Vjw+nCGEj(A^ORf_Nk{gXv
zkk#@tmlM;Mnzynx7di7~VP;SiR>8C+n2K#hu54HpRk$L70B}}wkC)J`s+p1_k@>lu
zoA6kn+IqalDwvz~UsX~uM^KrHI$F{AWZ0yzB4WHh_k|mFTM>S;?oI>9RT*pFo(103
zGm*|uTH9a%Z&?2Ko(sV=EpobQ3X-Lwm%88PQ5)kmT1o^SdSmIQajb>c-0&T%&c*6Y
zefhNI;|4a+>Rok-MGT9pD1>YJ95xmn>`6Aw`qPLL#Ze|_PZg3mU+fGsQX6R|K(Wyy
zMjz{*N`Lt+8*pbKIPEHb)&LSWy9g_|;EPvgLd!1)I6OSjK>2j!XAeC3o;H9Hccu-(
z6c$1tW<0wgz>{aZjum!&E>WI78{QAfGxh_3MJ&~AH9d(wi~*n=k-#~rhKN8HQfS1M
z^t!s6L7t-c^nP342N+duQdLeZ2u5+l_+Q585NRf4e?oCQVS%bl`ApC_j}N!ZidbC@
z@2=EnUtvGI)NKGfGa{AalObF&o19>!QCP#HN0l|YyCW6_b!0wWyMZL0eh5oFarK1p
zChyv(aP{Sr8>B4+fT4w?@~U&J(p|-g9T#dCTplzRH^wq!04p1JcE7hN1i2bwxi&%1
zFwo#R1`p4~i|2PAeR#ppjW%sAZp*9DZSoPd!UE4%;g;2vG&x8f##bth6DQ4DQ)hU&
zGonYrRET>yY71Vdq5;wX#IjBmI?Dy?s(N5AV<$u^xGM9+N6(W1VrBHDj9gF`s%qVN
zXZ!NYB{Hi~450xA-Qglvt?wjeZSrqi8I9m18xe^BMtrFE*5Lkfffr89nBmea&V0=m
zgrIQ_!S?Ac2=UTw70WZr&3ri;#Pzr$VtF@O#{JuJff`g8^H;eYFg45BJnM9o_qDS<
zB-kJ{pc0c@2WN*&HPDl5OHRAyK<{d^=Fniy0*&#>wKTjqB?(lq9H|uI+|}nX#iGx7
zqEWLaN^s6(9w#70Q!|l|zlxP2zumCl91l2Z0;jnR#JcxU@7^6xkH@=r$J@vK`t|kk
z-G1|KKRxa1b(`V-+2t!A-d_*7)7M&aloC?YYu=|iF`_YswU|3jj}{C)D!`O-EY2!3
zoir;2FQwk!Ptrb%vPZV>ijuYw8nn2UV5atzFA*Uzry{9nx=t>w@PMNz&~+c7GFa}h
z)zEZFNdkA6@#%sF0dax#ZLe=GL`MPsW))o$tx(Y^w+0NL}ZXQA74Cha_&OBsFKq2??=W;!)%5~-oPnVpdmZx%q6=BRj@+70og
zv&E+}<08cTvT39R5QBeb&QBkzt|b&;YZM6WX!T>>0uXM!V5}Iqu?17((F`3JaK6>I
z+1!qEA1J=$R?)+laxvvg4%gCB|`
zg}tk@)5G0@H4h7trj|t+{=D@dlf0=o_Mv*+++hjDJ5!7{yb)vGx~Cb|YidyF$&W3F
ziQ4kc&>RgLv_*G^f!~6E)@Oa`t@Xd~|MPqn@Et+ugAx@k-!7!dH12l=?X4=Z$5OuX5svM~e$>4K25GTANKXX;MmJSe(>B#sw~&
z5<-q449zYjS2wJEF~E|Lb}N|6Dd(u_f@Yu@ZZpKHu)CHot|aZGF0^T=G$hMnd(HEy
zOBUWeA?Z~OXT`}hS2D&DQJearVEboe_8P$}H6`HVMke7}RaJ-}TR)#nAfw+tD>p*V
zDb++N1kO!6piWhf%na7XF_TmDv%Df9V?#_aii*A|bakOAhQx_aO5syF0{H2ty;O0j
z`=};d9!>h0xppEXS-VwPH+(rE%$@1P1?rSh2(*~vRPP4E`0BCie(HT3ehGv1$?({G
z%q$D%GF~{82tVhjW$|ZB?7GRrj;IkTr-azZ6MH!C`l|
z?M?v014PghSRE^95yIJdcF}yu$C#BK%i&qsoHW(?^AX_!kL|3vtyC5iq4Z35Qn<8J
zG`a|Ex2fqWP0MID6Oi|qzHGR0XcOuEZnQOFuyOu)92?*K+RLwg{DL=JpTZUB7?{&T
zWd|4hDaKIDGK}mEwM~X5V8g1hlAQsxcg7%7)yhi<%bdthgD>xdnF5(TtTsJ(Q#dq`
zg2%XbIC;|a<#j;A(1~`b4DjZ+TF055sTr(uw}o>Q-SM&I`)qcpm9`Pr|EO+o`F)vN_m{D&DfI066$
z33BgLZLx=Bvx`Gh0jtb?bOC$!>sRmIzPrAA%+Ef1_r{AO=LEP`ns$UFSWn>T!j$u8i<5$|j?y_uj|0
z7$r!xMbzH37$wTgb8nt2=C*e+IiU&>mPuvX35u(X+IyS1nIG3)9CnK79a!XN=d
z@7lHFE-Fg}`p&FcYq>GP%BQpt22aAlV^L6Aoo?P9UG1i{uN)
zHl`dx*vwBugVq>yhfgxF$tyP}GFvaU+c=R{@*u#3FiB?&U5?aKXA*ejzovq}yES1>
z7@hQMXV=$dp=m2KH3jHwxaRPUAY?2AvoT2F)OJiPXw~!uao~xOI{UcdNj6UZ)LlvV
z)tKPb-NP8ol{xh}Fq@CXtB@1HGs16g%#s0l>ai&h>0%Y2;qcu%)2CpAA*+?7)+FO;
z08VqW;&GkoDybz_aKMzI0!H|ZWQv>mu(^q-6sT6j3woyS+5jHr4XkB6NJ+iBUz7n(
zP;_V)e%mQpnM}hQf!#$FM}jeK5%j8zvQ)wiUS!!>7LFFDBT<5*QXFFKJt#&u{)Maa
z1mJiC^FVgEP=hl|wqd5hSI)_B5~lJuDic9pM_a@+b0|Vggvu&&>#SW+bYiQPV>TVj
zs5Ij|g%Js}*E~xvoERW|rN1N^3{8!yVFCQ}|N
zVWG;3HHegYYV+C1@TakXuNoCTqzl*4VeY
zjrL`G@9+@o!dNguGK=%~W?L%S?zEzjU+v4fG)>ry##ug9DT^7a%5Y|p&HUA=u5_dG
z=M8a@T~)m}H!_K{m(C2NNL8Zxj^h-rwErzC2>u#U3ne4i15X=z@oFVKh2M;nag>xQAJcSHvR%hU>=HzxKh`
zKY0#R%n!Z+=Ce%zA}S-z8NpSx&N8)mjNxQJCc&;&k`T-;m)N_K&=QkZh&iH}-wD`S
zFjz_t#?*T<0Ksw~F44Q21364yVw$7QLe|Wj7noy^T?d=qKGT~j){5npY`RjoeZkl5
zD&p5SC}Rq;Lm7|rno)ixmMj}wZzuMw!?CjC?owI4SUHusGaQRv5qF2mFWQ+}LVCd5
zEKDdp0f!0h?+`m2=|iCYFeBo~4KwqeQxqo-&3mr(
zn9yB36Ck59x_aF$W*OdwQJDeiaCT=NW#-`$_qw?)Gr9M9PqmTYt+w#2%<2`flndQm
z6>CWkObCOyJhxK_-9-hZN!QbBt?u4bORzSQeeOo8>*Se8Z2;BDSHP^8tn#qzuDvg7
z@nf$r%{4&zAoS;k;$AYdhGlcWhezPqGhDBBB;G#mpZn>L{_Vf;-}v|b#^2jJ*X4c}
ztcy~IW@sOjozcxJPfZAH>WAi7H8~#7ZcPXp8mu%;dP$|k)VrD%-gLBORFi6TU*==%ovW7EC
z_y!yV74kazb&Ih><~n7LMpH(?GD+oNXD5rS>7M7z?h)0=jXD=dpOAW!MWlU}w^&og
z$i}rR6KgGiNHJ-E=KMVV8J;8{_F_8hhhqeBW{~sGnIj_2f-be-oEXL3%{K4Wk}&6L
zo+?5QnSXF*Yzl1|($CI6#u=*ez0Kvz=Bp;u-$(f~ayUB0K<3p`vi*23VV
z?#pbj1D%Pi*{EHzF0Zaw&TL%hLRW-OxXaf-s^DLEVR|5Fjfc`{YXeIT5TqiLCDEMSMT3D^09J}r6sW_mSHi2rPd5>;&Ys4Yfo7?Z
zjGE&#=xp5ppSp=)`4Ksr)ZlZ-+%j^A3-*Y_xXk8J_Zc}TXNN|`Mw6mnp~psb2@`y4YkIc&!w*#8qwX>vGx2xsK$b^f0Da>{(7`<`D~K
zlQS7)GK6fHS+L$8XGVeMB4U%7Gv6VFdz~g6GdEjZotfYK#`BLqzMMW8gV=bS_9Puj
zt&?5Q9iR~u+|Jbn*}%%qgL#&jG3=KsdNjaXxxKgefC$^WY52^n+zj09SRTu$WSbjWhei)7dVy#fwtqK4Q`Z-w?N++C$G-^E<(Zy)#G$@w(7wKGMux>I;xEN2p2@ZDgRqymS-44B&f
z79-y!4b`ak(CqWf%so@n@NSJwqmDFlUkeJhr6$JqK6cjiT91#{FTQ;H!ymr+t>1d{
z>%Z~EZ+`F97oQ(?_wxBi-|Y45)$7+k{Lv3S{qzTKpWbZbr=NfE{oncW(=U$KZ}QmU
z5QO0I8c4d@m_lKoa5tg~dl%do;>vZ#N3?g+m8x+O3`1|2duCZUC*peeT2g1mip)9=
zj?(emiJOoR81Zd2XB4{{IBk>p^E{?^mabC2J{`0SWhs}0-@**KLTFH|-dkk8&&doR
zvnaA4^bVda-C4P-W37m&>dgU<-N&)dS6tP(Rq9mTVqmL~*?Ut^5OBrqo=L^L&h||9
z=B**vtr~4BR_)Gg3*S2l!5>@0A^B|01S@M;QB^Y~tGm!yy{`oz)2>ImWk$73o?Ki4`Q$?7?V_I&q&Z$eS{a|u$)o@t{?h)4XXX(x
zeoU{_^~T4?Y0Dm$P-u|l)JW|!s?+!_?$64a))U6q$mBo|~-623_y{K8rR*M+vn1DT-;H1fI7F0=6O4V+efsWs%S;^gDJ~1@Y1d~8yg`>6?LmR+=P6=Eo
z8tSf{N2AO`3y!b~Yw}?UPjXco8A3i->!oy@MnsS-dKWP9*QQm(eql6^(+Y5@r2HWO
zL)wA7>9K8i5FQM6Zq31)xx_F^QQKKSsq{JJY{S#Kcqt#miqFSvP#qhppW;p*RU-#y
z?#wkbZn2kJ5mbDgG^2Yo10mRWDKOUc{S5$iWe|1f$+_tUBx&P$U9xMlgB>@U2dl0Y
z{^ky^D)!PLS07aQoi-8OD-bts0)zNw8J63F9S*|aw71m&Fj@wL*kdHxB>N}^7!zXm
z8P7dvF3>0ekc6A2=hX6?PosOxSMvlOdR;vR(Rc}A#D&t`H!GIfb-p%&rd;1mB`2jm
z6zH4!ad6a49y=o3Ez{;Kng|t{LYZ
ze1s%Xv*E_9YjZOKs-q?t7ol|_+`s#nOp!A;PakR2Y_?Xd@L!4gKeafYIbWQ(16JX
z)MGKLs(lo!;}ZMY>y8>c!Lf8Ux^RKY>;^7tb>5ysHzGVcDeq(#S4Ga#$)2)UstHsy
zHM+Z3tO)8YnG2FtI5wW1>Uzz$Z}+>${d8m=
z92SYo#h=~BUD(}2tbtp?lR2xRk?+bPl=1Hp&dtcn69^GDYll2$c+jP4^iC2;?&4pVIFd(_
z%*xIf^Q4@Cg>pFblR2^Qa=G*<1KoWe$zir`9?Nn!=&hwte0gPGF3Zdq#MD$+?j4s4
z`7u3qGBLc_!yDK~deohnaWY|3a4rcC0C((^E05g{qw)~lYi?k{?Y%%|MFM9(TKGww*U)J+n;Ex6^3B`N>3naYi!`iOm1>2DYU5(
z5}sDf0t$AG?!iC6iaKHeqt-V8$u6C!b#v@QM=bGIB1BE^PVj3p@12x`5P3E;)x3_)
z-8>ip#XU&P2n!UzNZ?oXncK*P4UMSjsmZnAIpU#O!OleM2q|XnwvM?(z)-s4(V-Py
za$4ERVbUyM2->DN4w@vqBDEzEB<2E09AN;X8-)FE)EU4Qqqvy6i%BAY#fWig4s&!%
z*<&z3J(jbgL#wXu(}B-N(+vwHSLuWDqLRxIttsCWXPq?Vd<*0EA_vG>K|sSpDC%08
zc3o1C!Ke?FR!JpXn2lazF@1Mt!CMfqf_6(mo9}`Paf6O
zknGPrJgYq0!?U-lDRnEoW40)_XZMe#}jpmK&iKTUfCXY_!E`
z=r8MXG(hvWdvXvdli@*fdwu7*cDD7W(?ILL&SJ4oQHFK{HBFi_rQ8u?7r+jM=ueq-
z%HnGdWOL3!4GV@oeegDAFY4SdX6+Ub|LCsZO|0i}9um#c`OlEPtW-<4IeB=O%AV2(gQwBdI5b`huU
zXXITB?dUosc`|C0?t6fUDrDndDOs*0%@U~~>U-)1+8^9bXvkc&i7dx9r(}0h@1bsy
zK`z2aP5`Dy1IA+|tFwy|smzMCTJuh1i0v^wqMOw=k0)n}BQ~rv(?=!4a%x>Jn5-o3
zPY#lrkSHFw{Ej3rg-O)J9ts8qJ4T99VU!BrVm7Q5RViq8dg?)z+%WUmvKV6~GkSNT
z93#pSpXe@_Ar}7@ai()cSP;gR@cL=j!(DvylY0P}0xNyIu7hEBcN->-n|=maENX1a
z5@wVdB=53PJfKcao1-w3L!vRxN8yF$mPdP7mU8ejff*jiCx%nEKsZh634zB(#&RcF
z!^&cwDjUsK=f;SpKCa1ntGn0o+Neqk%Y&A9l8PWL*0{qFI2{pxzXW_NpFt@Z3-y?nV|JiolV^ZSR({e$1FxEw(S)ePQt?s~$U
zZqB}_OO>2PHDm5s^QQaMqq_D^Uk)HQ&n%7%rBtI^>0dCjeI!GA33%mI$Mf~5$EV}z
zsJCzO&D-PiFW&sl?|lBFAHMbV{FCo|=gs4rzxLPv`Y-<7zxDd_@3}oSp1QA%eD@|_
zefk@ZpMLN8ANiBV(>LBe9;9f9nlUbwlZQF&15-v@V|)x0KW7c2MSiclbxGBZrKpKe
z##=WPu#@A}GeZ@FF?TmLLg9YoMisHb<9Yzn%`^?BG2s6tXfRa1Xuaj0$Tbz2+U
z7rn}7+sS%hxJ{$9$IL2|&;_;a(%>>PMJ2mQhE|;aVQ|k%gFK?;c2eBDUNKD(JEHF1
zyTU#9j>~GUD|d!9u(`@C-eS|ynUI&M(lldPG+eT=8iVD8(U1)yzAwr4
ziP6jmz@9-51VIv*k-vacobQp=pyz_Dq=ENfp~b%p9l|=gI%QlbVt_oJNV83SYs3dD
zJhHby+dgH)YJE!%{Kl-O`D)OAT9m9Ajyx#LX(kb7N_^;W^L2txE!gaIhPc__&GhME
z&L9v1ajD=&EXNCyLT#>f&Dv8?8y5$kcALpM#aG(nR_*Eg_da+A`2Y`nMj!E=aRnGH
zYbOJxhMwp}k5+V02@
zy=xGf5zK*FNXKo}2
z&iSrEpi7OG&LLE{k;84{L>v#-t1$42loE(uPIE@1tpH=gRZZ=8WizjBb
z728zqCr0nMhtOiTFn~D(le(n3&fqKTU_ELc-R69}?w*-QI0sr%P{$Gy1hxcQ@i2j=
zy5s5EZ{HoCe)jIu&)$Ce+2a>qJiU2+eSExT*IItJ*7KKlAAR`n!OQjH#pU5yym+x*
zK3pzqdHCHW;u0PfC=U;15gEctWB?dL*r0{4x;re~teEOI#UgQ7b%54pII_BLgA)LB
zW|%!b7BdAh>$p~RA3Gl(kGJpk+sFOt%j1jB-~Q-_ud@4_-~L^_UjA2q>+k)|zxtp3
z===Y~FLifu4?8xOo!KQK`tvV-^H+cQ@BiHI`Po(p=w#9c+JdlmZlqS2gqio;2COn7
zIALY61!eibQ_*G0;}wqF8OsG?@?L^;MJlz~wz+BgG?hdetR8%)5khz`cbBQ>1gg2O
z?oWov;_n_I*p2isY_ELQBD&@Arupj65XC>N+M)RfXt(`2LM
z7%-lI92_uS%?21_W@?BN6x4XwqC$Sou!1l16BRBgrznMO`DG~-Yj>W$yh(J(59e>y
z=51J%&>QikhE-t~j>J812|PU5yLa()^!1uQ|8rmabN~7u{@?y@e);R){942!YUtp&
zKl8OH9<6TWsoscIaxlJ&=~+5mYeb1O3K|Titn5C=Aop0_%+z`byrf-wz%`CQ39l_8
zUFJjTORQ7f0juzn5164BFgr)cfGrTRN_8CwxKLXt(!<{Kv*>*8HlKIVEi{sfIiACS
zw_8~C4B&RN@>>P12y_j*67+V;l-k^b&^(WY<#DqRDKP}CdQ#0Ke*#3jpn7nMu0mIL
zAje$@?z<-TP$VtN+LwpjhMHQ@NaYueU~M@V>^ljsA@Df_O?|85BD$|T^6`D+|8>CCUQwv{mj}?fiW4snH?;RFcUyVWwnknO4Pq1fy77zLGOpxUV%hfCBb%5eiHv
zQOhLZkaag5O!Rhk<#t1=MUp1&Y#n%RFQxsn^kUl(%^Om^{VZnssbN(8OaW%%+-4gR
zj_LCaTJtDyb5r=j*_|0%ObrXTHG=39P3G3Y6o4U#O;CD?c8f+1{Rp-pldVHEsxjS-
zI^OvJ;RMA*`b=ru)P(ZnIye8&3=k>-Ggh5uX3nsitTbEUVFtJ?!3*Xz(lC?rge%;H
zdAQCj8k36E5zs{>*uz1EXS9wU*9)sL8EP&qYK#$6xH$imTadIg=L=~!>tgb~{ydDy
zIDA;Q5obLpLuZpYac@}Xp5Y3ll~g^x$pjHzFqKX%(vH%50?
z7FaEGq9dxA^NPy0fV(|D9iM#j*(V=A${Pb!Ao}m=(c-FB`z#dNM^QE=;>b%dHzg&UhOWG{@F{AIVKyrE<#1YRZTLfWv}y
z@aC>E^3^b#b7|M8&^ruy4$dB4f0xeON4Z<-r)eTNwLp7s&LZ#RpTSzuReRH-)~L#AbDRyfF7fc(8v=-CZvYl{iPfb+
zPRDhdyDmRPVX2294otNCy_iRIcO69|z&a`>pSP@uMHT
zdi(B)CvAAF70;gEefsI$%Mb29`pW%>A3VH#ae4KyUp%`!JVb=8@cV~#ceyyqtmESA
zvNC%=?e=mDbWuB1Tv-Xbb2ze4Syk7u1-6bpX(OtesmrPk_pYuyqyF|$MRN6VzkPFk
zd^+B~yS{q$^yQb2+4$-=zj6QaEC1k^{@H)=|M@Gw_RD|QzaFa;l&v;s3G0?_xtHolrIO=S|^fte8l^5KykjLhPL#AF6Caub>G7pbA72!OJt2;Mi>XDVOxLmAD
z!u5S@P~(@)d{%W_98g(35q8)+0rRlj+ZGv~RNzzc0^)xOGiy#n?Ivi_#d*0!@w>TK
zS0}JMcO!~;GdDiW;K;;r?Yn!syV&C+t_NPd#V22}KlLYm<}dx9zw^bXUwq}`58u6G
z#;7NG2HjG1wsGA60#-JIzCEHdNzzgC4{U?Y!F&plZkO^IngIPdHvfpl;8(BQXz9i)
z$E{Za5PJ+|Jo-ptvv#DWi3MBb#7m5_2G(xDk3z#2q_s0ueZj#%Q_Qy7a+sJjN}0~f
zr@O1OM~KC%MJ`{ZO9%}<@ihQ$T{&twGC1g}M8i#uiiASbuyl8qGOkXX+4wIu-9Xi2
z#CE42b&hM5$GXr5u|?k?4`ymW#YU`B)6C2i`W#Zu;<7Gz^Asi>o>y&CW{#kzs2O=^KX
zc6SjWZlxhAh%$G=x$4X#av!bZ4%KNs@QRu}^So)o#`qaHy=+?qeU~-JCU`L)g^IfwYYbl{Fj?Zvke#oq@%}w5dX9
zbfG4%M7w`1#Pn_rh%?nbbmj}i78HfEL+EZMVz%m6#UB9d>kG=3<7SU_=WdlLEes5E
zhS=@Hn3+ObRgPdJZ=LEyoZuw;5uuPQM@ho(Bv=EcTkYam$_`_`YWH%}Ov!5Y3EYz~
zf~(UEvF4NN#^4ro0B6+-kBCuLdn>o2VI11wq+5F)!3k2z5hp1D4}F;RO-L=UU_=_s
z$n9vccG4D`4|Jz9WiWuQL1I9I5EmBfydkS7C&Ky4CLmA$l60lsl(WoaTVUc^!|CoD
z8d>k8lxgnS1p?@|VjIBS$A95Iw2y=^OqBs=SI=>3U}mgC_&V8yPH{<<-EpOqbJKx
zNHWMqc`Yj89ev
zqosyWX8;HvfxGn_TO%Cs+czUMq(FNWpFZ@73pnJUc{2|qBnQaZJNzbrTix|G_DnM)
zpXiQQv3Gy`Rkp00w>f@{;eT|0n<@<#t4+(OF(Q_ZyFTH}VT`4F*90cj$L_s%Rl?k2
zS-~>7>p7Jayf0i6=K}j2;s_$_cT%4E7+Q)8dn6Vd~;TXi5rxxKmeM9<1f{jQyP9Ias6
zrQ5K&Gt&jR&FhrEh1DD5ngCd5UypkGn6KU(Km7dhd%yj~Z~xZkZ=W7je7IlkR>WQQ
z<>|1e&!2wy`QyXgs}DbX_~ffEKYV%r?3vx)$KA#5@7MGDyewZA_oLi52jWpOy}P<<
zl2ID4x^BSW^gP2XVOFBnP|bD)b4%&S+PQ@s0=fI~F(03fckix`kNNI#KR!Obd%Q+m
zzV@|mK70A>m;dQ+{-^)9|JN`6?Z2J--Lntx@77E7VhTy6?i$j|btnyISMKzsP+|)U*<`G;h@oJd2UK~OQ(bK5^i=6Y<+Kr`wUc*t
zvVGzeq}*3vc@%0Nb$53Gm3T`+4|C5WEvzzo;#jk)8~a++ovjE;Qr*MDj;HM_tP$?5
zflSdm8@*yN|EAoqb;0p^aym!hX0|iOop{UoE*ZOpIJmp7@MKk*7ETPyX@6iRpPCg;
zrmjF4^$}~?@C((oBH-u^b8^*0ga_^+>csq^Ze+Q`eKFRTNOa{eTDz!M8=-KMRVr(XDF*_;z>-KtK=jLQ!$Fuv!rgB?k6|$Y`PH@QlOZ^
z%%Uurm6_|9#DQH22SWkLtirWTru`sPUR7ME^2aewU7BIhpU_>V#3pk9+3h$HTSs>+
zsHs5HgcT74dr66#?n7^+dTkp3lnT(~NW3)X{mHkWYO|V`Z@019Q3+Rrd{qaL?(nl?iH%h9)qdvQ{$(ICT9cvJgy9WGyVzm=1r*
zUdGH|1=PrxAvXf1fSh$uUBe|%44bOkjXf8k32H9rjM8z$M#)B_p0!EZFU`9Wf)MWJ
z8YsXMTk<0}H%kr{k!2F*-kEcyno9E7ef&_1iij2fi$2}9xWS9!*|o=v^NtOdAcsaYx0f@efWc!T4yXoZy)VHz8SvriA%qd){;NKg(*A{5Onj7r9xZ5u3K
zVIM4{3}HN#a1y)1p?awG0U-FRYI=gIlG78y-pp+IB`LjYP2T8AcR#_?YK@-bVs($|
z_S6g&ULZ|^g3C>`4~J_Z{NmxwsTJ&1Nc~yb9G?SvoikU{=&vBi#Os0Q5wg@R85ptX
zM)5!u9e2Y;%IR697&2j;avjrb1b3b+(gWfA81Bfu*NRHf7p2)P!e5DTu)%5u&7-?X
zeREDdmr`*wS?1BI3#^;+Sj=NFc@i3Z6M5pA^|g=h
zzxvUAjUblS;Ot-FNdrH%F~ttlRkrDVrwz3XH;HBhlP!y*AlJnzJ9jmV{*7*6>+QP(
z?s+W_HsKt(d2SjrLoBQ6b3AYD(W~$tX5O;fJ}9*FuCAjzEO&cY(ZlQ>D{STx4?cA2
z%rVQ{n@2=Y24mK?v$~2BK7}DPfZExMaP=-eXfiG5
z=2@Y8b2vCZo0&!v57XO)w7a`Fj>F%(ZdJB+Zzji%dMzunlF-jt-m3pJZWA0wHp444
zUdYTb;5QqLQj)4!S07JxTdPN}`kQZFe_mOa%frL-
z4?p?Z*T3tTJUxAJ|MJ<3%U6KixYjOlNAGn9)qp%N{`ODvY{rT$`A3b~b=1rfh
zU=j`jE|d4givdoRz%akVa-6w5P$}~z)Z3sZja`J=rRvv
zsaBloN)-qpyz>$1=Xg*mnFNSxuAi)
zGa|ZnRYxp$WNtI>n+z>^#OtN9P)u>K99AMhhieP7_Bf?s(r>qNV>%P!Z&>!Ds$<;#
zn5w)alPtpi+={Lcsp)A|sIyBaB^Er4j!pHc4Y*?l%iTk9q2W8p$`CSMHU+c+4wrPN
z1wLgJ+J@nfcy4*v8R*C=5tvG{+`UJ~s1vihiqY;?l|UHx8rWe;@PPMbL=ebqRZ<+$
z!kS^(naeGUHAT*YW~mh8M&!vLo>qp8bJ>_JUn-0gn}y0SrRH%{^GLcw@}E6S?nuS@jtBzPUB6R@4VUiut
zX*N)ltZ|mT-BviW{<(_G%&QO{Mh&Y>5MJQz-Z0!6cN?&Y4{@}vq6?;7REb>E&ayDU
z=w^6mnFXsnQ`G{42O6m%5#&NmSD`YiSR+D1EHH4!h>q0Y?lc?q%A6%*;A_U3_PncUGQL3I)0YGlNXSpqO<^
zKC`OKmvviAHh>x5hHhWx-%i$xHgb2k!)PfcoCpe~-H{15gnMRsI2BA`llFgs?O`xv
zW;HIC)zveOg6mo=y-jVZqkk=+VZEy_OGvm_6|T1~6fvgq5as8tEUUE?TqG@MCQ)(;
z<^}x2V&KyThkRXvyo$A1ZahBbtJl|8ub-~h<9omHkAL-7|Mt`M%N5}s@QZzR_glYx
zxBlU?4?g_l$G-cWpZe*a`H7$UUC&>sMcV{^geeJUqKRyT5<9^M}j2-1+6s
z@9)?B!&+-QdM&J_09ATUdTR^Vqmvb02x^%w12{+D9Mz
zXshQB&%XAxkDot(c=h_#-}*a$|8M?{U;33_{*}k;>&wI4%a1=<%epJCn<3VqfV6XX
zau|ZG4$9XhKK$sJ?We_F8_czq`_#4d5D^xZRc?M<4>Kp^R4KNMJ%bslsjMK1M7o1E
zWp0FS!#*-%ajXfofo9Z<^nl*vv6|rmnRU5anrBm#$#qkD19WvTM>LF~vU^u|s_vSap~4q)mf)n0M?=`!{ull=z4l)V5k?Or^q&!Eh%Sk$LQhX-kHe+L>!z
z%suxuUia0P6(owo0R)2zi_H8OB+Pm(?@F3*N|Ct;H_l8(5CJbSN>lAufo4GdKqFQ%
zyOLNUukSAGjmrg>h5I`^J>h!T(@}r;7rygv{MkSHfA~NC#~*zB6R{q#qqAYbG;gzR
zjt^I%P}3msXz#2>!K~?~A?(GAmkwsWK>;~b4w>@zH<7vSh#=SaE$6>ZXT_0p|BM3`)=>sIMT#
zsa}bw@(Z#l8SQ6d#idy-Fe~*|V6lMFwZLPoZ*7)}8P8d5ro{D0yp>|26eQa-
zD4Xo}cnfW!Pe{Kv%fCsNQ9&mcAy=Wo8ES8u}7|vEQt$aCKaRTX3g1kx`q&+bp`b
z`!dk*z)IO9HzE=M;UEJ1R=9BzK<}e8T-|&mEn4NC3s8@}yGx^M-Ju$S;b~l<1%wHHXznk4rPfDRU(pT1pLS*>G%GNx%Ianh
zJQ$wq=9f7-wd+clM`cQD13`3Pw^&^$yno(>AIGsSaqJD#)LOEdH5U&zWXen{T|TTr
zafJqIN~t0+<>IRBCbfOTZfeCC57y}RWlrI#h;ur~
z&o|pJN|-qLN*c@tHgV%hlkNo7<$^iNKslCbDI5Nl9YsyXoh~_M+4J(`dCEP@4&9t3
z%dzwBZvC$Bd|(EqnRdfn=->@RI5iVM&s4e|+es_bqtT49#gIR$Q7+5(?h={bzU(-r
zHcf$c2IMAuXj>v7;)M)rY)-P_JxtRY9F1m5b7rmZy(e@u#z!>%;j;|n2g|39<;OLh
zFVI6p*|8%(o}z5uS9uLT`or
zE%hzD-S^&0%A&b{4Dtk`yDG~%rNJw=XeZI
zLNb^xz#h=dFL%q#j^jWz+K%e$Q@*?IME}!&`b+=t@BOFnr~7BmJ=~mW9T&hepT79)
zH-7YkfBuVq`~UaVuYcpGe){+Q?C<-zAN$U?FLw`b-@N+r%P-%2@zj~&cDeJryUVkO
z%iUev-TB?cFK%vF7w6am0$Qh=+DBnU`9mdk)y_mAtB#%f=t;#%{Mqx5
zzxK%oFQ3=(_|N{?ul=pR^Y{MYFaCqie)!u*UG5%UeE88zM%wLtpo)6xt~5&?^es4?
z^dZsL{OBuR`S@f1@`rtQA8ue_#7){WqVm{nhJ9sRt?_Q?%!qJ~4r-lZU6ShTqt+$R
z9Mx-t5)z02ihENUr*o@5c)>aOecD318z
z;$XTMI(K!}SmEaxV3RJCbxfCgREd6d=ONmgMeLsrr_9t?1U
zTh}H?;@uqLN)y&tPPolAn9+ek882ymaTa+t#u<0tM*_CiB{L~V-nB266{K`{mv9$k
zHF`zBTD)tcvV9o`!BipJ><&A7AANVR%f+6qb|gN3UEln8{TqM&_x3XZ;wTHsM&3e39sXxJ#x>qjJqv^E7wb5p4FFzYi3A`=3+
z>AU1OWa?jS)@?T9-!dasWy0NZzEd?z85k-%t`swdag;E+!f
z7C(145rNLVvpkkT(QpGb*r1B%kcE-=%`K`2X9m6kF*j2D$|*(e6zY!&QL_v?L*@v|
zutn%9sa|E&Bk^7oP)~nO8J#5Gttc;a6V_mz#!}iwD{fgDHq!;U)hG6ag#p1Vbcyrt
z##o)xiqRY_y?VIQX;BhTxPz`mvl|ECk(CrgV9=s2>4aIdwN;B=w!OEJOKd3P_tvnT
z+P$$WcjFe!<1{*|fHdn$mo}caD5}e7v20E*^oC{bm|2(nt2Ib^kAkbu23Yx^ZHy`J
z%%<(aPMfxwv0*%;Lj>aU4zH6_>q=NSs|B0`RDmv~PO`c+GG{0`%OtvCg{UsU
zrrZZl&$3gdo5&e4$O^F8GIU@t0)5$%a~Vo0GBX0`8vm)wOQ#WEeakYy$mJ8M*B#4O
zjS2DQ5n%>unAon4w!W&_v>V$!CSa)sE*fV_({XBk1$RNq?%mz!#ifW&Hjez#+36Of
z$hu~}$drsKp;-zFmiL8>(Ukx+L~0|bP0PC^Z=O&0l?@Y
zBgo1^R1KO{VZ#v-bZoi~O(7NYpr?@#8G61<4neU2Rxmk|gD9L-6&k8G#z12K!p76F
z%0o=In@@ha4Y)^~&lHHmlY%-}x-r<)G-KbC!v+^#=VpjN)3iw6?kLDzYeMoIUL)8f)g6$66O9W)J;qkS?dPjXcu)
zHJdIGc&~3s^7f^iSgLgRytE3Yk;UXr8R$ds##*bj#N`^vEDlNqkqGOeq}A+XbJ-Me
zWL#!}F+8o9YsD`$$Oe~{8{8LveiNG@lqH#sDIXCG2=Y0L;exC6tude@add(K;mcrU
z=6CVM=kGrJ@Zr1Pe94u{0lu?z-}{eYu5BW$Js{R>B7QC=X-+NiW6Ug6c~CLh~?U3Xa{mI274EbMySJX5=g5yA?Y&50&#FU+m8
zyE(S8;u6Pon_N!{f@0@s;l5~oHVwgcbMqs&I$xGW7__@OMn}|LS(5mo5i59DRT4Wx
ztgyDM$|5{x?q1oxVjoJ(XAFtpGh*3{ren&NyPa+V^Po1hk}bTi5Urp?!~N!D(`JN%
zTcl8+#V7_&KHuz6NkvHYatXHgZq{zh{Y&(^+`W4H#jpRo3uvm7H(!1
z>vA!8*WSne;rD;@cfR*)fAg>Xf4}m{w|??xe(z8J-kC>Wk8!!be|YwA_u%g4m3cG@Rkf>o8?rfXsKr1G
zjA-UwotM=={gdDM=)->Zx!>RONRp93J1EP{H~`6llbMYU>f_k%?tlUe)iNPg@M!96
zSjP%Nk*p)pHY&v8pa_H9Xf%Tn|KP8@{K`+8uaIgQX6_4CUX`w9
z!B}=TtuN#WiH}G*2_wTlmy0jxb~wpuj&GxcYUI6KhzfP1_$bpOrnskeSH2kWFv50k
z3@QP*8#$@##_2+GcfMSY;0Uw5ceru-v700M{JT7PoB@{BA~R|1gPD#~#tNz*>sdBV
z5-iNjtCJc5)7Lc$IEj2?l)-RIWsPz)>wJXCYw}RF0#l%inaCLoJjCbBGc_w6@QV&x
zg@HB95a!}2SiL|mhEFYp3I+L4~036q`=a%q$!zW`*+3
zCKCfUW|WvAcb)<`Vk35zhNp;QYEGahTnc7j9nT*0OibX-OM>en38K@4*+5Wf27VAb
zNia4y>&Yr)!?|g~N;ql!Xy-T)<
zev8XF3XUX@&ti_@jl0c!Kn!n<)zL#hV+|)R+~6c{)ZKDl^Xihq*qQ0)XEYq$Nj1}Z
z1a(7vZdbz;*wqEldDw28&MM(f^ClQ2Iv}=?uwr$x70B-J7>3?@qFr@oaCMzDYB9HT
z!mk-t*4^)&%f!C*eyiuHmE0n-_BQD~v(r2V(;CqanLEBQq_8kTUYhh3aP@#aVOQSN
zM2a(@{Z4L|fq~TV)^6q_I&ZriH{n>jX9gFasr-!quiCT8>;^oG&sMHuA|E~GOkJ_O
zOo#_^E{;w|-4mnxWn4btH?0a&OVegBXBa2*Dh1ou98YuJa(7KL-0hQS&_ma=Bj<8q
zU(TesL;={lVwg;KI~`dD;c7mT9TukHUfl$y2{qCX*r=|Kb)lY$cog#+c}!ZYdf(`4ADH-RMIsZF^xABd=x5&+GCt+#J&26qYC@BvxB2|O3Nlp4&&L}cREL2*dV|iB}*ILVJ
zmm)XzM7>jht;t56N4Y{4Y|wL)}@
z=?^o{oiAe8NHSMtW^Lzon7&makRr!RBEPcXs+YKz*9xXPaw+F{CA$0aaR23(pS^nh
z#ohh0@YqL!BkQg5*l`yq1~^}0-CZ8;tLo|9%aY*|KxA{Re$l}C*Sz7pZM&Rt4w<@K)g(ME@JZ!L3+h_K7L+&w(I
zeDv_JE*G{U$K&IVe)z+G^pAe&SAO+Ze(hKO$>+cG&)z+~LioeO%ZC>)*CoshwllXh
zO_kLN6p+=`J%^z-0jp07_sV|u?CuwS{%1S${yy&R*7ZuExR(UpCi+?jCW~^3*&@7h
zH{63EK!u@q+U%^feCGPFvh6BgqD&zrNKloh6VlGR5Br)F26y$k^Gc9pi{Jzrm`TCj
z)m30ny>247xz$lEPC&exFE6QSTFS|=?#>Mhb0GKT9Ttp=$+ob}G#}&(q)Edg8r{xR
zp^iXhF^o6JyTVokSt-V>MtJV-OrjzRM__+acHXTVVNKeWJ$du03bXLNH}*C}s~$#o
zWs9V9ceGPgu~y`+UUs>x+MS(%MZnyTqwntnRr`tv97nIfT6TAj$1Ae%@F@hbfpgb+G?nr)dD$tqs%nO6b~TWtFkToay`zGd
z8P{aOsnd1SWC31Sym8sh((=u=;VhQi7?I#7F~F0MZ#}Ua7O_Tfa0?GZRRdKzCz=F-u%>=9)l3d0MaK#sOE#u&|wZ;t>|SL9O_s2z3~x
zf91-D7$st{jTuYTU&IY)}E@MJz)f7VGXBoU!g|HC9(%qdV
z6(Ioh3}JSPt6M%V^!X6yB)RP%TLyTS7%%21XK%3IGS}j4?OSm|Tne8sv&7vB-{a7pX5jqPx2h
zJGfyD=MqJ?1VJhm8Ir2!)uQF*{~;(dmk(sWa)$yDZRSVl;F%*bPA65&gro!l&`Rcd6CWCP`FN_PwQ>LpTtFnTii{Hk+$kcSXF
zH(l7s&I}8H>TgEXn|F73_PVXz|?ufR;yCHU0H>oHX?bjnY-
zb}7z5$9<)gC+3{-1az~=n=T$rTT8dW+a%d&Yg<;7xR`wT=UU=*XlM8rIo=ddXJC{v
zVPLDuSc`)JrR&nQA$Y>Ws;%1AS|)Uks}*}6;cHzkRrJl4yUi?CpH`4Gj+ylc?$7sV
z;TI4QPBNmlXBo&6RZxf8ilTCCk&`k+t
z$6C2J1;G3%=GMDnd6!aoRcM+3FLP-)Pt?QRI3r}X01O=wI!l8bg$c5EO+b0ii_XXE
zP1gZcTcEoP#%Jz`@Jj9&Fe0Eet!=$V>)wJ
zBT25dqkEkWjpZv|zI=H8d>>Ey>G8`iKKu03AN=y)|LZH(i;uqg@z=ijjUW5=H^2Gg
zpM33WU-`<%FFttj?AgQJ-JMVRBC4CYy^0;R2!!)uwRZ39>(hSo=GFIq=d&OD;0M3+
zJHPYW-}~+F|Mstc`J>-@_xg+L@rdR3m-WF%A4UX>de_RVz(U6$pcOrA4c-IvRqp>jLAQub^jv%UhWJvD
zK28NhIM2XvYiaYR&r!7mm_@91v+B$QBhwlUM|E7B!-rx;^NA`GIQ45>hF*XTW%u}j
zWpe7~1Wk&>WkZ+HF-vgg?mqUB
znR~@D-RnZB86CGbR^V>o{sE7Vc4R+30N9pqa~O$mhoYnaRPwT>;R%$L
z8acP&0eC{58(#&n@`QQ8*|^bQXQ)0Qcz!)7a1JcLb%Tf)Cs*54^cAX+5Ls;1REY<`^bVuI)I3b_
zNRr;La;;8s5)#=m-B;VqSpw3p-@uG4>gv*FAnn!V4vi=DX~tBHAyKhxXRh#DEQG9y
z7<;X8IH%i5pFl05+t$ufcyDM9mh7I8#?T1i&CHRq)(f(sG@vT8rpp@Rr5c2`iDUxc
zzO0E#NM~;jg@BNE4P{#{#^9;w>O4m+_UQhM4H;Azx#AHaP|w;rVgaa3j4@kD%P^Zj
zM){%D;#yZ0D=I!w#}v}jjRJJNbIA$sxFH2{2Y|0l-5_^#&vvYv)LoG0*>bYn)xT-o
zk6IO6FlMbdnfbx&uv9~;S%uwZy~2rU!ri=$YW7ZLakJr|>Y)V0xK&la9A2f+knD1I
zvJ(Ob&@L~`)aVME8W}L;T}QV$)!MDCX13VZf{cGR`_&S5ps5M&>}hNHI`-iaAg|G*
zKNlPUZPD)545B6(c&20NX^{Y#NuFe?O{~8SHmM7VzhR1M07>Vm%IRGCACJ68S1Jk9*!^6j2hB@PZZL%7oyS
zU?FYOBAG@JQt0cF-4kELpsH@`T=6AmR|51N_}+&zW1iKmnYq_aU!1)eVF3_qixUxG
zmIu~Rr=oy~?Aw0MHyU}gB
z_=;&soSK`NX;`EW`8Ao=ZL#=s5UQu8;-^cU{?!P#g@kIi>hFB(qpyAZ9Hr^(T_9D`
zBVN+~P3G3#7aR?b7phByos!Dlyp|Zk2T2)$tWzBTy09a#4}JUEw1=^*fgADw7=qP^
zi0nq&STD_koTgl+YU&IT95BONw+7IOUXVT(vw8>gGQ%(%Z0@?d&wf=tAu~uo8*5RH
z*g6iayBV12>a5WoejMBVUwD|AlRjOH6zW*79Tx`r7z4K!>YfM+@Zy7K&z{}iUE=PddH1!C<9b}5u8&V|
z-n@PN_RX8uuiw6U{pR&&?_R&UUf&(Pdv92K)WfrQ_Tt5PymwX8PF!Y&eUw=^qs0Ny
zCz5sP=%x2boj^p^QODa~_=P|GQ@`8)**`hH{`F^-LQgt%qElJQJ|IgAY-+M`?`U$H
zPV7XvqcU|)>p*}jW68Rk)=;ia9=nVOXOC^v&sCc{b%5sPW>1gT70VoT6q{tfc<(+o
zOJQYf0K(lXDKv=gu3fyGU`9<2_X4_MMu9Fg_)$Ly>>RuJfkI
zqgpH;%q-lFoycBys~gn`GfoYPSk|cIQKthILOh9Q2o^W9&e|o^G8s$M4>J?!bz*_W_`-yOQmY_?sfOtg=KTa%$2b`Al?WHk~X)
z;hTf;A}BPop|iEp7&bm`dEWA@Yu&uzU7Hno6RkB43@7D4(Y@=gXFovmRN?en8iO;M
z*%mCgbyJ)fGhL@x@YEUtlB`kg)CTQ1=hz6ChtG#-%vCDT6M%t3O`0^md4pz@kqC7f
zv7EEemVTtsAel#>ATNaZoGkT+Y8z`SCg^U85Yt9(-S4?m)#SiTgcOnNy%mparbeko
z;6{m96ZWMCoW@JCZ)y}H;H3H|gNYKLX%?DVFh?sQm9|O#D3=-4)Uzw-QNb%rYnG&r
zGFlDcRHSjKZ!)_LsDnvN-^Q8{mX+2X;hCcew62nvu_tUv9Ar%aUCJc}157m!2_sn_
zpq!h732-nsVz@j!+jt$yHF&!yRTfi%)a4q}P`oJ37;*`{$BA>|1Zjv*F37hyeA|lN
z0`*i9Pbed*&76CfpTX#hY@{k~8^YGIa(O@pCXs;>t3z`vc@@=@XJw2SW)%>rI}p!F
zgh_*~QjW`2lRi`g4eX}l$ESX7xP~Tlx_cJfnsrxq!_Oa4Yzk)soIXLGIqJ1+@|JnI
z7=SLG7{&~6H)aW!C7USXJ59ljH66~A_d$Q=P{Y$s^BkHuYqHRSwut05XF@6{`rI{U
z!s4143_Lh!g-keHpg*^?4Xz59KqKmu+!t<1Yx6$dvvKp>Y7_x06AL3b$E>lO^`R%zZ!
z0D?ePHtWrtbZd8H4Md9WYNKOde4B(WdBzhfyy-XG&0VhA$;BBPRSG*+8}8EYnN|ph@J=N^Enn_l(#84N*6PhlQq7LlNGZ76-U;)DS5+a2G+$OU6lKhJQwAqK
zX0umJJtn1+Ew~c`Xd{l@Yh8Z#@A~+|m&W9q7CAHc%iMo9$}vt1vbMI~S?=abT5j}E
zk*sC(U~h;xVR<2+W=3*}w+bmcce`&luidKL8gcR36wDy2*7B<8uG)>5wz+{i#Wn`^
zpY7en@i3t0lyiEd>es#RytM%^6oi%Y2IR29CRA8m
z3m4-wM4N7>JFCMyE+MU{0faEaJz1#P$cJ>)f+|)jr5hf0x%k7wig@9B=*5U5YAMX27488BF+V9?e`sU3Ken=r*!~8)gz@TvLD~;KY0{<+S=mR8()9l$
zTKPRp(KODoQLhdm`nr>0YekXXbpu8(M-f$+mo8*VxR<**V@i3)sy1@c;SN;qoj~8+
z-|>B2ce-)-50O~_$i%wfa>2vBze&8i)|;pL!+-F{{wM$Af8~Gmzy1%u`i*a_bzk{J
zN{6W!Syi39gxu({lz0jNiWD9XQr(7X8wIITTw`1nsucjZp51YqcMu{CEgG`@^hY%O5W^ew#
zJ}qzE%1L%LlJKQ&LVdDeZo_3t!$w;~bY&KV!=JN*Rn1b_!QztjAx()BRtcD^skyy+
z2=2jD;Wi_7BNUNnJ{P)c?4F5f;9sG>vgQE`r(@A*?PoO({h5-N$}BuG`M)w$JEKq5
zNHEGy8jVN(szS;PVA_3o5Ul2-x0@brn78G4@5fVg-~&Oz%;AI$
zL^G&N6?Rl`>#Fnc=x!zs@C8o4WZf3#rl+pbODJ~p?J9Sqs;FKjG(;zMB}o68@JAJF
z1{eh(K*WWnPL7nMR<_HD&CRR7@!s0zHxHM~e_aU$(9s7Z%rrfET$Ac6RyA`A(@OP}@Z
zlqUHb+C?(bWQ9Z`W#;4$HPKYXam?zhW|k(Opta+i(qn@-%=sjJc6B$zM3pSvu&%P@
zJXZ8NVkR;qp*o#3}C=vRmmx+iHp&lpVEon$B3^uB<(cM-_
zM6Gw%8WN+rMHHIOGs!ImregkNx60D2lu!m;NxgU1*e1<=@2&Y9JbVQP7ONNrZ&hYB
zN0#X-5C~e-hqzf2SyzEGG^*O30_|98KEqih^oXeWvA6Z*a^V8K&0j5`n`35raL4n@
zp7_P23sZCeKPw@$Il{usi=cuj=UMxV2~@Gr=<41pN@H;Nf&+etWur<1Sy=ApRz-CJf=zQB7o&l?&cO|AAMIglSvSJ?
zmBrZ_)7U*~mj~RfHZ)Vpt(zMkrUY!ZO911VS>|=;u863vE=?(*7*cBCFq?R1zLHKU
zv-$T=PidEgSKYn$OfE6SPBPDs8fJH7c4l@jG~6i+)?m!z$Q7}cA3GbpBKQ+_~o2r>(h~SXH{AI(Gk|x9N0+n57ok?
z__-`I%g?O4ZU7$EiA&hs#h*RDeCu1^czC$a{m%RYGX}zeA482>H{h8((;WafuGYE>
zn{d)PznVB;c1*kK}HlDij7GT*P6kDI8}6R;MmqseA{GWjg9D
zING|(Jcf)vXI)rx>|zAW-oC#6{O|dFfAUZL{x3f}UVd=V>}SLE&@v|xQM=mEM<=ao
z#UX&)y6hIbm5l9!bICUwhWX8gA7t?tKlU+yjrJMuu8
zyB%4}9o0KK*4kABhH~QNtCB|${Y$FYcE<8pcl+reh8>qn?yQL%!)zyB7ZRF|wDGc5
zR&{oDSs1Y)p8R=B<*=;mh69R2NA0XdWv1I%vK*bu41ip+W_#~g)Vk~BYN{X=fS27R
zx^5HR(osTjrc{X5^w3@|3&76pW*#0v5ZCsRPPT>npP10#6i0R(cDb`>_jvbYPmlJ+
zm-*vgzx>5N^9TN;zw$SJ``3T-Ti^cix38{%d3YXf?Q5;f%1Xu7Q2JQtZg<4;+$nsO
zK@}uzGC5(D=*CDoRbMxTcp3f~voGg%CMN5Z+i(M@%q%mx&P@0+1PKM?{D
zi6C<-`-Lq&_h
zxRh85_kd0i9W)T2Fo2$v-+5Tle0J4%NcAv%ibKwiXGjtq)L}$>tSW1KuFZrCVQeb8
z+&rujCN;j>s6}ru@2O{YKyrQ22~8C!rt=rttWI^_59YOhV?XB5RVCPwovFguXtTFJx^w8GZPoxCFXy^BSe0}!^!NiF`fn$-81q?dYLjX
z2#PXLF0XMy>`%;Tbf($0s?KHm1ntBSlM?WDn
z)Yw}lHiv2&$5$$e&di!Z6mrcxb9rjpjXaTYF~Ub=;__>qe_<$bonSm}n2fBaTZ0zC
zU@Q1PK&_e?=5n=xmwd1n9gBARUnL}iCdmdRGaT~V5+QaCJDkUmbv$AFm58+zxJ+|FYdnn$pZjRm3gmT=@XWGuUSP3uxOaAid
zrgS$pV6hm%euEo}BB;gNwbk(`?ws#V-w{NcU}m;AHNZ?jFoFK`gDmHb%Y&dH;H;{e
za?o4d12f|g^K4N!L%_{?o~VFhXO7;UPnIV#Pd#Z;d{(}2-R|xc0x4MBaNGsYid{uh
zj?TBxAMN7ACPY|BNKJf-zt`+$v<6H(Ew5O2yT4x#&*I^}e&%O>@~fYGZD*~xgfF2&
zh7uuOo*V(C;E!7SEVcX#V@S$AvQ
z#r?zm<+38yx?DUQj<#;=%AJ{A1?D&J%t~%1ZZSSR3TSxb4zMnliYckGcwn(Eni0hyE^Z(|LeeBn#{P3gY0S>J*sbQeHgLsx+UtsWOr)i=)v-W1ZQ0?R3v5A6*
zpXE7$U7~dAtNB_KvS3}dBGy`Z@%d=|l1Q07uw17K{O88g~JC!pA
zYQ)WexfCU3~LaH_Iy%k*ROi{sgYd)U)qU%tuT_j^A6cmJpVogaPnI&;V6
z-eb8hf)w<4UM}mhE~cim%;{L6pf2BoI)$s*le=3dc-jEV{61
zHX*&=2w$X3F^d2!`=(|&ApkRya$yQzu2x8(!_4DiAy10RfT^GOkz7&xI8S2&hkI{&
zJwU|L-EHx&z|bHOAO_9J70Mj
z@UGy4(U-9axlqN*k~(lU9E?KHGqJPwD_9qp&~98gT>Lw25EFiJUeg0`JLPgbTbT|6
zcVP`K6;u&2!-Ry=I$e19eRQB;|sWbp|u_X{HcZw>rIIld$
zH$m3IigQ$_p?44W1sy{~C_!UbRf=^}e?G8|N^BE8GY4UhNdvH|%`a1%dI|PNwKF--
zl_IDvElXk!bLR#^f!T&?51K2Ozgnyz
zS5o(lpr|THhTi8B`)pt2O_f?*$PvThlQlmf6EWnZ5g-_ZQD6b7oiXD;
zIxHB#E8pyUA8gPbHlNX@MKt@U3YA?EvGd@s;B!#obaz%Z2XHx4cAVUU0AN_R-Nn*L
z)=ECiWSm2n=B$>rsxL)(45AMJE;RCqQs=E+|sUI-V
ztBwIo^imf~>^egTBACfpfUV_>Sr)4abRkoT{IaI-nsAWT%`9cvFK2#LQny-7a6DBf
zsv`xd+AJu`w<$ZXs@j#QD`gCXTIkfmijM`%j7?3qjfW5=Luqvt=T(kREJ-|OmZojB
zd8~b8T)e7MuhRChyAf-dg|EoXA*mK&xeFfaa%tdtJz$2gWAlPRqxp08mbx#u&}e?V
zy#EM@{q7I^{-6A*pZmQ>#+;%ARs=b7H8=H9y&JnbyN|A;Dyw!k|IfjN
z)wL-D1k#$pj=B4~^O|+++?jhH*WA~=uX`Vv*WB04Yu8cxs62q`J~DTAF$C5*eu*$2
zNh*fu>TG9oC0O%(BRUUC7CM8Wsr-wG_2$jfkAM3+|FeJRU)%e5evkWm^wzQIQ!AiB
zzDm^S_)87wEWTVbba%uu%JzCDqq=EMjMLjzRpsF^9*0c2PAqpv1gGZY<}FZ6tFBDG
zyUiN{JtKw996Ot%PNYqTNAQB!*Nq7rq7G!|
zL8zXRI5v7GW$kAXVyMg-04PhyJz%+qIo}jr@s2aJ}gYP1OYz6TF>qYHGA)P{rhGk8T%aC~Y093jsm;7N+56`ry3I_;2MIQS;i}os#(J
z^fz6$f{!O?x0Ub4-y*)gQ!YZ@)4X~m((VQwD-yu6$WkG}nu>Rp{tFt;gQ&W*SZeT@
zuzfdM;j+~+E6YZGJC$t{0-H}X^<)Ezm1=U_)1_qon}(W@K;~WCdd}I^ock(eX7A09QC02>XoiHdmzeTO
zN>@H_I-)Z-UuDi$*Hb$`X_KQ*gT!MRE%tRX|y4Mz;3>7S;wtUpDI(kS<_5Y
zEhTnWCMR65G*hqH{5b>6HPO(jI=Dm6g+$Go8>+IB3dh^NX*A2oMwcAFZU`pKvlr!z
zx3i0301AuAQ#K|413wER!Ol8QgBu!=d_G4yH9-0EaqiqB?cSl
zaVPlM-viDQ%*--3nS+Tg<@7#wPGu7ZBl8H^^2~5A6{IjQsapx^1kiVGJ7>U}SJkdM
zwzT;C`0Qt^d)jn2cMIy%!LH0~a56$0F^o*>Q}I%1L3e<;U4rQdWju@Afp86=J9HX^7s24Q1B%WEJ?S@a6J(0a%rfiiUw`)1j~_rI14`f-;miS^*zvrFGWMX4@|Z_x^H7om
z25X1IEUPta#*AZEclOy*b|Q}|l)iqO8P@W(EZlO2f!mm>suYRj@439Vu=N;Ncp5*x
zz}I20<%!}mB)l7oXhaX%%Y|703UD`C4KJ7FBLj}G2#<)%CFs=JTlE|-l~}fo9$TvU^J!n
zTAxt&^b&3!sP5~rkA3Jf%+@8BQ`xmOt8;V%l0~er4?cLX-aql}^+*0&f9ToskFUp$
z%Y&I4{hD)hpEVMp-W#q|$r6JHb#&g5i5m#H5HE6kjuK!1VHj2yD-
zgX?3PyKrB)jmw>k4uGu8JZyHEKIZ_j9->&gE%x=#{OP~=6W_gieCiKBT4AU}7b2J-
z+Ch$Vo~6&pto1hZyP1*mVN|V$S5Gu7)TmUU)Q8l$ERC0U_qs@Rw@>wr;)g&%f}63D
z0n^}%oq_JhoH;tjk^IVpFz8K%J4R16U8KidP`}F67>sfk2bw5Q_`p->_)-BU$qnY}KX%EZ+hO16(SL_CweL}V!8(p{yym*EPTsOXWQ$O+T
zm;dg+^T*#Dc=z^Q+}+#U_2eDPnvcpOJeDcZQ0|wtXbhPSkH(J+
zpODGT-<#R%zLv83%OWx>YqOk?4$yGcPP6IItzNWQ8o9+Nqea4Q2{Xj
zVX-9kf+WB0sS%Kn(&*h?jxY~t>1PK`MGa0#=a(`%@vO~2VHAI&s+yj_qNZw*01>~a
z_+h#!63M&itP%K)JS^hEpT;8VJtxT-E#T8ftG6k^a=wL&{dN^iWaQX+X6DXa
zP)6hVT$-4D*HDzuk*p)iy8B!kY%}JF9~8%3=_1BS*R=mR=VcCeX;~!cdvw?l852yQ;g^)M;do#fxzG9D%m3*|~t7vKfQ9!Q0>4gW}u0s$dur~A4y$`v3
z_&iOQRqtJC8e!cmR~$nS1Fhf~1Mgfnu3WSCY4N@>IjoA!m#-KBqk&|i-~PM}XFwVn
zZX@oU9!YyXsfTiA-{=rz#}nL8LTv;MjBuJ&!l?}~7^-Vy@7mnn>Wn0Jg^hO1XTqP3
z6}5mc>pi)!EK5`ws+E|TSkyb{ms)6?Y-Uv#Mpb5LVWUJP3?s>zPoob9Yn|ov)9K`|
zDSv4*>*@~kt}M;gQ8UK7-OQ}RE&67J;B;RWDQ@QBL6=3WfP{iTBZpjXwU;MPm}-Ki
z#6ypIi7mr&b$!I;P?lHmYtkQu-?2SjB&WIA;h?9_?
zv%9-XJ;w>$05fM+-s8b0*)ABx$(0cc+7J8zuv4!Nbf@3|4P?-!|bcS!PySqZGNx=g)BBZgL7%WmTn5Xj0c`LAV&+O9kjupHIdht6*JO
zSu#MP4em8C6=5FfRU55Xe5HEKSFni}Q1j-B&L#k*Yn@wi4rLhK+vd#c&h8)k)<<9c
z>O*qSrjTeI===+0FX#ARiukmT#5=PyE2~*XSJpnd8w?6E*gh&V$^3BR^Kudo$XtmK
zcwE)TE+c>kc@Md@DD?X0fe{3EzmZ#Q
zAw&FG8nj|p%Y$l0@>G?ZeV5NoN?gNgXY&yQM9xawn&m#a)os?HajD!#>$1SidooBO
zkilM;yEW%^pWMs!IJ6AhyV}Yk7LzuPqm`RNj+%d+@*y5P96^}XnXJfTg+~zF?d-~m
zKpQfZfeFqRg~bYTA`f?QfA4iX{;U7}KmM~n`%`aTy^VEe2(;@~aOW*HT`R??gz&O^
zS8i4>bB#G>6;GREDlL2B&8jf8C&_i)sX6ot_t4xmCA8Yn)@5OFt5q2W%iYvB7>>i~
z=mnB8w7uH_zpT4;dHCXsH{brwcmKWr`Jc_)VSabFs%&qbprb;BfHDFc{BSp=(Wx+M
zBJM?IwYiy+U7qrpjbTf0JFc7$aavnz?}Q_}OANnd
zW)~F%qgJS{N>uH=_fB){;}A$!h!t+phvI@Wc_DZvJ#e;Z!Q5FzWmN6!(b>#`;*>sC
zX;u4r-GHsTF;SbDgHrAjHcNu4ZUAvBNNBT5>BQu{*P{42vlqqBJ2ADxWi6elOzoZy
z2bAaxAd$BXcns#=$TaTl#B!}MUS95!!wXkuia9d!3R
zB~=F8Txx(DQWjT{_bPMFrv^Ky9_CYJY=c57ocAHl`k%Zm<@C(cs;MSUzRN}+mOKqI
zIs2F#4tf-HHouy!%ig=0R!wqmPKNoZCgmjw5Xty^+Fin4$gPy#sgbA(@2)!8A(mGp
z9|xs!*9FbWk*UA!&iO03_vS0=eb$z&!`O!lPMNEcUr+0n|NOkIiv>9wfF1%6rEv
    =;hzV{17bEV@{eJQ^EM8&5yUwQSGYU&Itx0xD
zH=IwsSJHa6Kvgkvm^3oiSt=|@oRnKL<`>O=l?9t2cmrbYXx{JY0E-R#hK^Y?V^WBn
z`dd|{Ekk}&j7`oKcAmN_b6oydg2X)ixCu(Tz0Zp0ERtI=kTeJez|X(y5$h!BaVE01
zguC5o;KXmz;KsI4gtdYLT-bml1MOif7Y!iE)H5JUYZS^gh#=|GRhiiYlw<^8%K$rL
zXmJ+*q-T1DsDWp%iRx_u41!u=9?{ju-h+?P-z`ynD+gG})a-5*59|#2NF#WtOgrP2
zR52@O-cAL9j$U?ylmKX#b5T-rSKU|^d*_M(N3g1H>`?RA(>$Y!G!X9=Js*GH)@15a
z%AGkDH(3-Hx*V;7qRdQIX)|{VgYC+!y2N5~QVfswK9ZQ-L&GlpUS%@D#JPecjNPzR
z;S0F^gZKZ-?GGB27}oA4zC@o{ra?7mK2Vc%DVSb(eupR@b^!>F6&C|YY?2k^vAn|R
zCz^}Kr1momvVoxi&YwSU9ap11y~=m}S`F4ib<_UIy~_7e1F<&fc+!MX5Dqj#Tun^^
z>=d!PP#K#?)oq%yA`Flh?i@Gz3O+|?W&&nT8M%dD$bNELx^v1i%k{0*LXEKk0_YS+
zRrwNKtv%*?IX$%4`OL)85lp`wg#fChpD=ntRWy(3)cpoRNkm|7VE6>GQHCCwKzKwf
zzBT?f0=R04-G#}bTU@BKRThfJm#9`B9wu0k>^iIgk=2()+|h_O4I#__CoZeemv#B>
zcRzgj+;*N2Mi27
z{dv&0>y{RTUDsOo@BQXIpMB2RXYO;lPmj>p4BfN@5CoJ-3J1o95Nxr610<90AIF6v{clxOwSC|&0
zvfl_XPRngAJ*eqU)qwpF34^Z`NU@v%j_WRsjp=?KCnHof6Gx16My6JMZz|(;l4n>)
z7-y)RFWD9#{-5_$hDo-kz}S`@PPcd`zeqLX~v1
z()qL*afyEic#8^@8chR5W8+3Fq3;*a^jmB4LR2+a|$n#
z5xoFZC-j&%(w0{zY0kx(`I+8lK)aN8W<j*>}r(>DlnDn$Z&NDTOLJ?TAeY
zR#lb}9o!%rz_4Y5Z^m_n*lXqsDcBxtmGPilY=
z$k+uC#%MrKB78Y;fZlZxH98aa)+uf9byu?7@c0pL9&l&9`@w$ewVU7fBR~JqgC`$+
z^IJC$9+{c9e|JtzZSpLARI^22ZRxL}dS*lH4^B5*eI3>k>v@LgoCQwPLgGlPXxfoP
z3rVBm@*(!7Yn>#aQyN3^j1d%P*#3?H>FrJV)19n?g1Gv47HlaVqjO(u+cx
zRisxd#s9LmfV$rn?teH@<|@!DA~QPArkf(`hjB`^UI#jTAFRUiTE=!V&Ea_Uefhhvz;De810vF$d^g<_Nn!g@}9*;J&}w7mL_dy|?;
z{e-hD*Vz;*R@5%a1}_bM_Yye8ZDKyzkIy|R2^6h;p2IzzW$;AGsI_QrhU|#~?0!Tq
z9vL-FlYni$bfVN*f~Z5bLeZ&Zqaio*a{caS>a>z0s)|mZ2eivdH4u{f^)ga7)kY=s
zW#}xG0s&3=H7dM;R91^THBxWsKs8xfW!VARSB*k%FG6SM)^%NKb&pR$zKH=9i~=&I
zThR&=ccXx0Q;7C*r{qpDUE3VzsFu>1P*&|e#3)=yn;>^R<2YB3{!54pxqlF>P;M^b
z+02|8-m7MdMu~9Awtsg!J*8ip|Ejn05eEr26T?<{p7Iq6dMzmZvWCB?x|iJ=-Pa|@
z+%l`H8l*O}4hAqACUc(mY=md92~NXN`l#v-goGMnaO&9I#?_H(8NOe_OR@u3jHP@yp=RMAetjfnLj;0gSQ4B8CuxLM^BC}3V
zvr!A!Xamr#X;H^Nn%Q^>{_M>=PmTL@C0#xWc3|)H+3Z{j+0xF^@1_44urxEh)#uSh
z$yCT{*m&o?>4F|FlpRdh-LJr*7KLb*biqy)f%ImLo@n{1`bFc$1pv8+k{X_N9uSQ|
zGB?YegZ|$q_sk&5)-a2E)NY-VaMQAVTkfmTURtKi4=B*+A~@7055@->iO+u(V3Ctz
zU)h3W>v$Ne?0kicMA=$P54yX?B;b0@M>m&uKJ<_p58%BO)IeamCUY!kTgz&5kQTfC
z=d|hSA65a0CN6dv%zc@GhKi
zIC{Ei4|cA2DNULzFm^wiv76CCOeuNFQ0BhNpMCbKdZ3hCy{|Fz7#WAK$=+SfxR0ac
z`rs%Jc<Iu8qvA*@qcYpP-{?)(d
zcmCjUJ&bU->lN2)w#|EsC#|_qrJK&N39+XvXetR`@9F`AohF?fmtGl}k)#=5u&B~}%jG6>BWe4HQ>b68
zWA7@sL+YVkz}aASWAY?L*UN6yx~)zZpG~GnCmFFLqJ87XR>LPSEB21ot5ohx&1a4n
zJrs==N9g1|j#D7hCvW3)ZBU0Vuc+#D2oYS>++!;mtotVOKA;re(lwhHq!MDP>C;V!
zmXsj1uT_PLid_IIc)dd<9zEcrhp6K77xm&AzvKr$@%R7zzv>HL_^Hd~GQ;9&(8x?T
zk*^36WG|xv#EjvO43WPY5mDtkyyFfzpkV+TYH(t;jwhg+42x!0F0aRgole3>b1%
zduvZUjX)LGS}hsKV8cTL&}b}x+Slrm%ve@U;MhsvR+S|F#+Pc#7PV!BsaPMSP_G8<
zO~&E76%GV>AhWW>%4e4q*`&Q3UL&Nh*)U7$yy}_2)wQLx7?BB|u531$lv)4-vq{a>
z33AnES)cMMF}kjHcN;C6dWR-O(00vk$w>nvs=&PeCulY_Swn2isT!#`H}+v(6^%d6
zUaUhzA6A!F5`*eHBqd<`YGh<)?|6A{8$1Puq-^1Qi5)oaVt=m&VVavLo#ovg
zLy%2X>yr9lt!hX~FR9&CihwN5UqUxk^I}8A4O~w%1o+$BvyX2^2+4nFctk
z+PMJkOwN|rbv1fz>wYPasU2DUMKJwCBU7mAStgq7$!g*S&HWA>Hn8UMrL<_38gueB
z*hZs`caLLLMBmXQ)9yhmwbK*HiPSjxd8zhLaYWANN^)L1zVD6K8I0jO?P?IjlnDfQ_T
z#h}8ns+*);fV*p=16nR`025_vP}o`AjR5E}s`j*2cc2qlq;=`;5#8MOy=cThD^mol
z)s9VY+0x$*ybYT7`DtAlQ{a{X>}dN2XzxEl{}(;4G|^TeC?6QnIz=
zay1mOYZF+P8~KH3=Idr3@#?b&Z@>N!KuPZ@0jql87EZ8B9J1FB`kjZ3Xk6{(JE$$I
zs^X{wxR{Z7RPHfLh^Gh8(0IB0#pqMVoeAt~>F`s2V`Iw~y+udt!k_|fN5TP(6<`59
z0jrmRk%Wjou5JkR6+&o%!QFj1>G#A!gbDK|eD#Q3nn|ByZkL;TdvRqELS(1|+t-P6
zH*2cJuDXLpch5|}7oBOJ&s8#{E>q?$S3i{re6`7~hYcziD
zCNMurIZqjiU5!3UHD6gN&F<#QYha_^3AR{&}%Uf3L+ph90OBaZ78PL1l3v%W(zjpjtpQi#*^90++Z}iFZZ4on#ios
z3ay#tsaDdg1uPBco1rz0s*b4kBPw^sj(t6LM0N%mxt3K`WD5I_5Z7Uu8U&^9jI7!b
z*;{4>P{uMQuoF>Oh9?i~X4zf%H$SM$#ees2`}sfj=YIFk{?t!Bc>ENs5f#vkt0e}_
zc!+dC@0oJ?HMj#(2M{$+0?q76#-a-*1d2^wO6A_Q4bJjJ#G^r(WZj^mWE0h1O(*1s
zavkkb%2+~_U@rsJ+=BnQIqAd8tIHJw*oK)=O~7Q->g?a_E#Ig4<<#oap`o7?PCa0A
zBo`tpXr@G5bw7=+osP=JIVBjAIJ4g(BD4Vl=u91bKoK^?OWQ3prV=dkF6T@ICbFeH
z1gvmhTTVq(y&tNpK?inNb+v3NorJ#K-=(hMI#jZ+$kd}8l1m+_bX_o;ZVOY~a=3y5
z)65$fZ?envLS;H?r*;xjz~%zoeXXU77;&`5txwPF^cD<6*cv>Il5I3ae{h?PRwcmP
z)~fDQyTzKb41hULMF`Nk+3XZkP7T>rv`AVT5sjY~U&9p0-FT!HMm0^aGil~*^cKCV
z7W$6$-rlD=qFN}&L`FnWW69>yA_{SyX=mL|B6G)la=nM>ADR7yBlTrJcl8j$rk>de
zvI8zFx1iV+bRn3A;%!0N|S*!EmC_LA;pP-lZ?M3=H%_p4kI
z+GWk(+PVBxFD>0&{ferqQiy9c#L(|^)=$GKHbYmfIA{Q-+o1E=()l8L5vLFD>oeU@
zU-gk}kU5z^DfFd6jDp~-h&@t0ZA37$%5=$ikQiIid4VL{7r-Hmklm5?C#sSGN$+!F
zt~sk-M&X(s1T`z&&_XG8u6t(Z!{zW=J99T$G?_Ig9nr6v!#!zFxL=}r$DT{lPqQM6
z8fM|3S!nEkIEAXv<;lVM`dH9`m93nvh5&jG6Vo!gxVVuTm`ZQ2Cw=5|)j55Hdhy02
zZ45A~;2YVbtzK}-SnIFV*SMXRd5-@Asv;_4XHavWVoL3SRP=!h$Si9~v$&_Ru!HIb
zt34;;ifcAI$YnVvd+j(*=q|I&&nZ!}YwL<-qZnCb-iDH#UA4x8VXT_DB`17=&a5lU
zc(h6(cV<9F3D2u6L5Bb`b`Bv{Irbif2Tq!8^-bcy{{t>$W}=7WG#Oo-Be>3ee=sgL
zC$Kfcpwp_-$m?Ca_U!V;s}In}pw8WH%(X43{~78Ys4?B8k_iS-({nNlT^$t)^frQ0
zW<0Rwd*$3u-P=k?z@i-~v$Pa5RrH&=?L&`TV?Tn(QiBiykhy0|kgj1$it{sYU`w5s
z+4wk6*w@tUj>g_n(WU@0%GYWyy8f>@%%wJp-6
zW75Y^Vo~p+?Ij`THJM>{dHStyJb!@OKmO1Ck3aSCr`KyPHl>I)QUpJ-oh@F<$F~O^NxbiS4HV7NM)1C-IY7Yg}Be4rtHg@na6d5sHhB?
znXoS26-{+|q}Hv8N3veSmB>V-23nHR91#)$?H%%SR;KtvYwo1AMGagvUC(oBbXI>7
zohRC{l^)lui#D@NNi#yXBjwCz?5vhKWTui}0r7BI(Ux>(Vedjomr(#SdF+a;2Nyhi
zNRYQz`|7vi^WXOBANogs&3hlj-R-`t2YTe4N|)^6M&oJ!n}#t8QmF#nwUS?|=v4nS
zjjW@nrc6|wEb}^Es&-nYK2k5BB+eu$LCGAhn#+nzxSPSC2yWoq(`;A-okUfNxVPor
zRY48#`cnLFjXK;o+9F_SMs!wJbu}lo&W2{Cvh_CB8p>nu6sgcqom?mAIO;wfM%DqT
zPP#MBmV*JEI?-j@e8u*>sDVGZckL=o@{D;^=QXZR?
z#_aI{U7n<5o73WJd^eq$TE?)YM&$(24+3k2mD8wgt?_ld
zghkCAnhqtidsLI+VR$(`$JKS%G^c2VEzNL3l|1Fx%{lQrYz8lDbxLK{fgp&eqWS8;fFi2(eSK?tdzp6?L;{lLX0*#%%NAM`I$w>NLf(q=>bAdX
zW*%x=*b@TIZXnfN^{T(0wq#Z{Q_jc}V#Gi)HD6v2su^l9Jj`J&2B_JK@wDlVMQ&?t
zPq$d?@)0yd2G{|hKnYlCgqY(+zQ=f`!|wi-)8?renkn8Gz*hH*UF@QJJn^ntR~;eV
z{b7||yjP4{>jm9`3{Axu)T^XEL6K;yi}j@w_b#R#Mqj?x#mpj(lF5gJVP}2hLr>m%
z^D&UtZ$53FP6+^l$J%Q;4kBIPLDNZ8HLI@-ClDEwJA=*0HqF?`ecyQw8-N5V^fPUHEpyrhd&5Y|(kDqDMQ>6B0
z)txhY&6K{K+X=T#k-+oanoaJ~p)xa0i157nBZn)9Brp?A-hF`Xec#C5K2(tzhd(ip
zR#|)Rnn_)q-)2*fv;dv=g&E9jnLcH|N9S3%`5JrkJS|gmqLj%u$b0MDL>pGdSkPbc
zulBe*{h{Vu7WLh<#}o<8dBP@z2;^MAK5pv%YV*F-vh$oBH7S5*HG1psPJ0?lw-iHT
zvQX*rR+p6O^FsEEP&YAOs-Jzn^Z`1Af8-3^CiHdIDQwbcD~<*C6ruY)$=~9Iu27|#
z%zgu;QUJ=`+!x{MI@Rwt!(DYQ6ZQT2w7`g>1j7ysDS^tlBIia+I9z?bU;f%t1{eB7
zJpt!?Mq!>e?Eu}bR9_2u=+um7V04;#b7?Df;0$+`Hsnde?iqktyM14rlulhn&f$kK
zRAk!~koPRQLY&Vl58!XU9XLOo$bgLTwGQIh%`HcmwD(p>qi}sue`c*zWKS?kE?Ju-
z2W{F~8@42oW-oV~4Nq!^k$_V|J{428)F$DRpLq3+R~bhU(jwpgbDq|HKhBNpyfK+l
zCWtz=YPF$QQyOzuCEP)A4g`SMxt6ifB6L;_!_|gwxbam7zq)D;KG>ga#?IcJbBaHUS
z)0@Bk*WUZZf6H5c;2;0JmzyW=e*N8tPhLlYGwMvM&}c@Vy~s7`w2xD`n>VR#i{{X{
z^D@vY4Zf-ap*+(H?(VJXF{(`iR+g#zEuKPRu@zHE4k=WP6*#m_bxUl7ReI?FB5XZ<
z|AXWGul>|N@cVxE@BjUO+wI-aq;=qWWfkJc<472G>>VK_{c>5V9mQ}8?31HvbV41e
zLi*l%ri6y{DXgW-W;r4=HM>=JQ+I41JFCtF^;W8r{f=bpxLhtqi{prhwG5ne>&z-#
zZWd6Y!ctLBPJuG914Krxi~Gg&;5RB??bIqM3G`4{34>TrJXeuM3&E5s1vUv+#
z74*Ey-g(R-B>ZcOGQGpAq(!d1^#$!^s;GeGkh9vcraG>(Rk=(=t4Q5yHVQoMM{589
z002ouK~$v@yoF!}$%iKxCL{Jvf{I5zuDitZMG)8#0F;X)?~uf5p|(#Z7uF!l9Rvr)zSo}XbK+!
z(?gAb>KcIPVfC_wcj65>=&(dORimdGB~IUuii{Izx1O+~g_B
z0EjAKXc_u-+WoW-8Y_0mR+%A^5mV%x^~2P1{k5j3>+Z2X1teC@YA0k?f&TJHi=O%`
z9eYl?33G
zey43he=99==T1{{3@tim53?CqQ+TCP|VSzK^4(j=*<)_!&&Zp4Ir^mQOw6ee7w
zi*oH;a}24TPnjXQ1)gSB{d`QKsZ>%sb~V2Ni42Z?2q_#uxkc65ZovEPgqkxk)ZC0j
zuVaT48ItZqL{tdMA^PFYm#~q0sDpHKU+d&I)#IP7c=yfskVDs;6vi-d2-8ON|Lu;&
zjOI1Tz{=ms5oguFJdGVG@2;0-)6#@>M~nuRrrwo|HnXpRW#!&SRDuOqx9X_ujKgJy
ze7Rxm-ga2Z!CX0jfq?3+nKWcmSindHO5}{(j=mbPQUQjEtvjD9bj@!@^`&gY2vzJ8
z0qC4Hw}>+Dfum>^+f|IB=q|Tgf0ea-PL!&qCSW~W3zb;DXy{SP(~9(fmJ>@mm#(Vg
z@eto5!n0)1PQuPy6Tc@;xK1QO!x~_yWIyZuX#p7Qo+t(>yO;7Ll}ugjy(U!+^W0gD
zE>p@ByE2JTt-LaXQMlY(BJ1Jh!N=ZtY=(#$<1}Ad`+a{J#Q}g(ZZsyvmw;r;S?4M)
zyA!c7UK=X_-QpNXLWP+1C^9p1w@9R9NM@XnB+*k({?;5L$PL0~3(U-P2&|pS2W)N`crV_TVPSG106^}8>TXo@TF3vKDQ
zsz`Ha&YsjK!@JU~e@vCGEM(>iBPR(uXl6^vLrOEa+&sCxJ>LD|PyWu|@jL$LKl67J
zho&f1@bKQnLN!i2!;)RYe82(z*79y8L|Spb#7uNj^j9veLarqY+dh9z!O-o$o5-i
zHdQO>F{+n{K50R-@XF2B@`yT)ee5mj59V$TXWp~>q|Z={j;AaMC(oAsd|95qH-eS!{3+fM;VjBKl-Z?WRwFPPM(?&k2O3Sw4mu
z=NPmkRFV*q*=JSAXq&k1BJ0rw4<0g$w^x4sTl?pI-&=p^5B`R)e&vIT^7Ytek~P?A
zm!0t;CeB%E`FI|weZZ+ypeykK24lyAbP5;mH3Z8>q|(QdjfER9^W|&WFq09pWA!M5
zslluOdh?m;oW%{R?bit}eSmTGb2nU>jdI6kYBok7b`PDlHCNr2p`_H+^XV+ToDG^U
zM~5kQUCnE=@hrMw=I_<~oDO6)P(8vijV4a;Vhspy>C^}j#
zKTEfJ6UF{i&46na2~sk4rQQu>3leB0bveQj2k7k?|aW71**4|`LRZ&r(^S*Kg(M0oks|BZ>4bfcVzEdwX
zJYCohUsqN2ZZBV6!;UJ|O3N)+{7}3ur`4
zO=-@5>8h;GO7|?gA%S?aXu@Le+si-!)Nl^vi|8>H9w2B+FO`wP3%hj8DWUV8#GZL;
z4VDW{6y=x^k~ZN~TR?PMX2EIgcdB-l=geCJ2)a6ZDd6F%CQjN|-#Sl{L^}e``>0Qv
za^Fo2U2Qq&-2niR$i0tHUWZQNsqY%eRuEZZW%nzmH76Y#p<%xrF6HKGjD@#pi
zs))W@gy>}LEX4r`O%s+}v`l4HCai~PwsU|j92Yz2y$`$V3u=k<%)r@e2Pv3~ktv6W
zpgWoAb%jZ7T*xfHScOsz2$a*TEx4Q1wEBh=vPmbMKcIVKb!1hUyDw|V6QOQr?`Wm7
zMs*Qu>DsD?RU1$CEGg9e<9C*pXN(~#Lm4xe_>jCecEU%kt*5LMct{jpc6k-hTng8M
zm1MLqqpt{5RHVECCKo09BJQBX69zOIpU%dcLBTL;hyN%X?zA7Npt*Rq8
zP4-xYg_Z=9rkRk(u7ZdZB_hYp;aE^1Tj>_=tAgu{R3$43zwxL#uHsD)TU(bDj-7U>
zel8+1gCLzK9*6P{+GDeKWF=W!uG8s~bIP#Qo^KW+3z#LQ(-rK@S{{K&CE~JzNez1+7>2AQ;tWOVdg>2%B_dB_r2I>
zpNqZo?i#PX@!+`DH@5(k
zlxGFdNeBCEuQ}QzJu(_$;K{o#`h|3L;F$wcQ8Ip0yw)^fS`q+GYt}0BB*|sAU~bFJ
z?dI{*ySwYRzVuVS?MHs+zx2m{=c9+XyW8eg>9==$afiFRc=2NIT@iU)L+FzG%Bp=t
zHRD7xOO!mL?oLBQtmPRJn`khpFg*jfQ|3vBG31K3jylxjVVcsyVdkAX-VZITv)uG0
zky(3(u6aZpJC#t7S?-qS+*4aZh;pY2lh|c$dv~z#afGsifuiL)$0?)7U_x+~t{p~;U>weBu<9bK`E7T{eNuyJ3z-#-q`tjhByB?%05r%_oW=Fy5`6P`pmJ`
zy?auV$(H+Sy1prnmin|}t~X>>qJveXXsXOivZKp}+$sX64y=ac1Pmy7TvQlWmG$J(
z>H|?tDH6tvT4LIYr%Ef4oV9{U_i?k#)|P7h-|H=hwbQ#OtDl31+TuMgoMjqmrr7s$
zhAO6&0F|()3ZXLee)7TgF4V7_!|Hb9s%1ZY>$D72plgfk(s>NatxUq?)abz|Spf>M
zWvQ8pAo@G@E$Nvcr6|i&grbf|y9Ah3vA4qT`nl_r@;z-6gP8UXL_ujOCxz29c#SP=lz|Q1Wh?KT5w<5tN7U^
zD#*><(e+FbiFCIrX3H>j^UMl!4Nbk*l-%Had=i-po!fpf&2#%4{=R)+a~gJ{e|Ruj(yo_^{IBY=xdOZ>Ejgg!j>9=a44ayL3QjGA&;^
zz4WanOjK93IGCrK1Kmq1%}*D-WZvn>jcS~%FRHZRt!?h$7NZGCIu+K%l82jgH{JK1$WtxkEqMT{^A$PZWM5Bcvk0(K>F3tVA-fh<%t>Tb
zLg|m%@zjj>r=DL^r>CVt({L_(iRd${OrftbwiL=-ZV|6;bksUYS=TNIu`|6#fWB_n
z4h>TQS0*8d_oPs&2hqjUtfek!IwUCoo`X8a|=~knG(KE(x6Uy
zYrb?XTg&^AQT<4$wdValePU{jadsFwX;{mR=DIJvbFiI~L{&uujayaT@{E)^mrYzW
z#8Csy$YpdQ!AeV#{i7iP${xp?i!b-#b79u;hP|@PH1$fmt-u&EHFE
zzxPl4&wuwTPyEG;V=XJ-df@I3ce}2U9Wa&!P)WSjLX%deV8&@`^K3}SY?fbd9=hXu
zr?e_G%jjyXsjIop)<(0>$w_lPlTrL+K!xld`4wo)|{W#9$j0mTjt9}Fw*s{1W~2A6=!>>
z`t95kt}Wh13%CV8(o3qAi%h>z=U-OKgYPyn>%qda#{_t{`Sthmm1q9@f8Q_t^yfbR
zvtRnslV@)f;dY^W&q{@jLwk|F?19tOuh1?!kFuayV!EWgVoH#v>_48Rf<#mY>&b6E<_T-`P=2_*z@(oS`T4q~HgGPdfvwv=}r(TlGSB2B&_ab_{}DaDDU
zX!(i=UbJ1#M2B{gg>H>32jY3imn2pop+;Iot%{SDf5~Ut+9w^yfICOfFgN84CE*y1a>!Rj?w!Xtzll>o$L49#!iA+za2}RAWUEh*`*+dCqswGx5i%lU8pG_X9w$DoLz3|sMQNu^8^Gz(3Wu-
zycxQz_EvXL<=NXoBh{yj8a`G#b=P!6rj7I}km!6C>rTEa;_P>R)rz;tLsT<
zqlFl%&3hvvI3joeO=4%3=$&fgnL23A6(nh;(w^*?3L|`~bnCyb%m@-r%BOdarl<|q
zEBACSSs>1gvd#{b$gG;B?VwftdNni{eJ%Bq{VsItk*FCt{9XS)2fe|?rhwY<+Ruhp
z|Hl%ytbBt}F<1@hr7|v++zPT+7}V4v6$IE1C)jvFHQj0pdN2JhT~h$XoZtSw$t{vT@}Tg)(=)$dp3Tyi)mohBWJ81L}NI`;?vT
zbL&h6y#w7FeAcwXodP@niduyLX=q$Zb;Hzz*tw#Fj*FU8-Hh88cdx&C^Trzw2REqz
z1~eQ@vM|`B?nr}q*}DHaodCHrB7NC<;1V_M2!+|wC@pR_zQTyAgd1b4`A0?N-g?74
z+PxV^#-Vg_)f+gjX^yJe$1pOq%8Ff+bzhK_0E$FHhWzsaFLX)SWT{iviDd3n%^#5{
z`em6}>;$o+7jQ;n3L@^JDIJu4Z13aPduLWf#8!53A){hfGiFEAhZ4?JAbJQ*Cz|R!
zIIhQW=#@GMaC$2sB?QvsY8J3}#~fhvlK^%!AJqzio&j6bH1@p5f6-H&fvS@zi`}p&
zrsvgB>S1ap>fU>soWliF-QLC#_4eBjzxLH5xBoByrQh=V|KR`Nr+@0buYKd)
zS6+SVvTl&Ha)X0JjSnXWuJ1#`VGdg~qj{E-i|%Ht;NYS!+EQq6Z@hLX=@4kXF0^H~
z%)H7Kyw{J9#7!VX7ImE~q|cofVgZhF_s5qp}
zS;=#oFe~GZ5Nrbv;uzSg>2
zXv;`KsZo@EzGO((9Q8Twk)(MCbthtLc4$>0TE3x-295A3=*iL^3_~$9cQ=2U3T(su
zGUqHN^kE_k=4+|~BkkCGU$?cd74EAvHo>P>?afEB8%NKw7WfMkayMU>nXQNjX_*8P
zm1ZoH?XJh*_|-w^g+lBCQ5z^k;Cj^Efx81NJbQ$vkAcFATmH;9;s?I_jeqJ7|E6z#
z^LpIH!v{~Qz;dTgh1_@9+Kk|dF3^!|!EAw)I#Em-3O!GVa(ubxmg>hx^*TJYdu!X=
zyS~!)ZB}ODRK?KFeg8*}5nJv>VYfU^NzK3%1A$X{5uP6fi;hwAwPI
z+gWRO#0rY^MR$qwTw}&3=UFOcEncJhJPz*O);{{#XXUsywX+MiWFItr9L|I^xOvZ8
z1x|m~unp5&c4?;Cy(74@CyQD&S*+>ny>8oJ8olBRXLo=S#+zd5albhiG<0VQ`z%p?
zqW1RANPCGdsyV)^(D6K-p(=Fx{DQ>jpCv`j>M6s@`a5xfI?ZEB7tZcCno&E6(=Omn
zO|^jguH1-L_O|v86*JJG?&Wx+zw1BcOw6K)K)T&WL`b3~P&rfa5ogU=qeCotMpbLE
zsjdFpRdUcNm_aoX=ezWSSDH{zCsS`WhAh1SQc3;R@72d5haiP#i?klY
zq=F<7u>q1jl4EEXmFSq2!ugt~{k0cGFXbL$KNjf9N{MTF;8|s~i?LCzze(IzQjxTw
zv>R>{s!O1`N|7ow!o4k+x^@Ioty3na8lh?77K>tn^-9`do%h%hTChPe>gS5+NiJC@
z1FOEGnp6{p6VjFGv7|yV)nimI+>8(%d3L7a{ImmD$Sr2n$7z7Th6PYh)Sb54qU4Eq
zOiwSg*xbmeZiHh^_dH$~DylbPA90ja4K#Ez?7W%UjFTi&Yc3@cN~wK~ju~lL5fiZh
zffXTh>`U`~Md0>MJ8x8HZP!{D777)eo!cNYG4Vfz_KwPk5E+$0R?C@Y_S&>b?SZx>
zCe>aBxu)CHhYJ>P_
zN}O_z70w+uhkb3Of%`dp_3Y(|q5C)o2FFRLYfoXa^tp_)oXBGL=_7qF-S_sxYDKFn
z)pP0U&U4+Yj@CSHU+-e#j;mW)?S^h{R--9t9BVK@;RRa5Ba52EJe6s}Q$!N2HPBT<
zblHhQlm5@HA}-IpHiQW2+TQf9f)k!h7Ns*YnvhM5q0oWKMG-(8ybwuzL~ZJh_L
z<5PN{F-Yax_6e0QI=$>PzMv(eS;w(Mx)c+fl96XTV9(aetcmvPt?z7dcEs*Uwm6Xo
zZEnKSmK!xEy|7$<4Lwc0xtm!T#0Y5{(UJ(sh${(O%bU|~M?k-qb^vWB8m9U7M;^WV
z?%v1cpZ}l!#y|ci{$N}m{`i0U*B?E7_35)`0*Bn!;3-4Xk+h5Za?{?s%vRU9H1~^{
zDqvr}+*Xza8YWt6nR)eaS2J6Fx?Ab`E%ysyzLuYszacLGb6;)?pqW2>@^n3T`h}nP
z8xJlw|C@j1pZX(z_}9Jp>Hw%fSHI074oZWoM>s~B6ST>(uN1Bc{6R*|Svq>Wc
zbqw+@zFauz21(n{o(Z1iL7%^9B(aZ0n)RGmMOKXmNx$BLCUh8b*Gs)Dbi6~dJE2i3
zRD>X&HJ8efVpQ{!HZ^c}n7Jc!cgCqIo&I(9bHLt_NLm{m^_PMg<)p31=r-Q&W1{LT
z$D7{ir0Dtgsby7J0po8O>_%6~yM01e&o32e>nyt1=bw#4wt8;_#+ghMBhKQWpJ1Cl
zXU;*@hLz?9)QFWaG0y!Qw>L`vG>zYcBq6vhGk2e=tRb7G3G3ZzX5>nYP?a;)38j=M
zt*p`!-y`LlAD-*b4{kd+y8KSS`hCnGDx)^$GV00ctoCJP)9myUg__1)KR-)FCu5$U
zzbVp2NY32_J96v}tpU{KNT3h3oFb>2IOT@L>DXeQxtz9i0_wVcvt`SS(Pnsk8pU*~
zc~vrSmS8{hP^_v#M4Ta@y1TR2S7kYbtYka4IE`;Xdm>Pgwbl}1U0n!wFr&-lK%8ex
z1G3cx7t4FMnj5I^Kb|eI>iW_tM_zSlg0`aNw4en|*c=9G;b0&())qu?PdT{TdipJ#3%|$fVm=#VN
zNE`7;_Q&oER+SZLR8`#sU}bt|F}FXqD>hLOr3tqE;?VdYAJeD&h&t3{0^G=Ld$15}es?kIMkcf-s|t!Y|5D=X@BaLPw2{Jht@VUsAfR+FkLG^(KVvYQp{M5S402-`@Cn3d_WrsvIdP5s+$O!)0a_{
zGFYg{>PY9Tvu4VO*rD^-%qrQ2YQsw-Y8wOU#Zs-909aYi-;KTT=GzbMZsU53f9N0h
zp@0A1`6qtp2Y=|t|LdQ)eQ|yDwYP6BPpHkzZmLYEhFsdjg4$GwjgiWC)j7b%h_c?~
zU~U(;3sTyS{%xOePGlF_4mF`Wi47Y%4a|7K(1Mo~IhD7f3w2;azRVqv#7|(Q~}@L
zBir_`z`Te!j$K*Do%}wvccc9_jo32WVQ)UatDSYZ;Mrqk{qmdd$Abs<5C6Wu
z^#}fzANca$_}ORA-eQ5g&=yMbmi)dtqKdrUrQJ0^C^%LW?Ph3Q3_9C_Yk~mPp*c0F
zJ5y3vTVi#jztxMF@ZBn_j@`Bv_QS|!bd>ct2CX2sL01cn%Mj+aZhYO)7H!$Oalh!}
zX)Ml^PNKolW>%a2L)~M9;(XeL*u;A^^TV@cKsS4EGwm7G{x~J`kn_eT
zc&fb4MljFrp?c}|N64zu(0EO-sCX&J_k40QvzWBnnhD?MN?|Td&2EH3J1%y)PQoA)hLus4LlLvJyRXYb0i@xezk@j4G@hiHuIz*E^Qt
zT7YUn;Pg8+AFQ$%*7HS%7w#2^ab#{{X*Qkc^0a_c})fwvk)3xqiR0b*HVpEHyDz)fAeRv(jX4as^
z6m3YL^`gpN>W(*MF=?zuye^WPw(h(BJ{~~PUH5;{td5wUG-p3m4NmFABxG~faJOz*
zgioHu_8CV4n&m{$*lC5Io^l$^zPLhB*x(8Q7`z6fBpKalni(`Br>GWsu9!*=NWc%l
zmn3D)1x+wh^@l-|Q70g|OX-WTcgwWOmK#&fBJ+{6);S26M0U{vMKYwK_;sYINF30p
zTP|(=hzOM`Yh4KHRA}h;9&sr%k0@UjJ7C;<(`Yg>;ykGYb#$NL)=4LoloKj;+CaV8
z>X_0k)=I0<#`h+q8>EPBEt*O>(Yi7b@>;T=Sr6$FQODW9#N-$aJ!KKllti9{tr^|d
z-E}{D`0!&NeM%x?Xok6g$~@K)3&n2P$Zu@s%#d;kSMP1OKj8Jug62Ytw1*>i9)e44
z49^`*QHo%;d;gV)Bf62!eRLnbcbfNbBiVA;m4VU=JN3Ab)=&2wUtPx?|
zb+(6HJfkj`HI;lv-BEB&!i)?UiMB>-kclpjMTFYR*f~dFxBaGsvR&7T%c7Y{*RPcy
zEwI$Nmo#6?_7PE8fwg=sOB>}_&#xmXcQLZchuP~+MgJZ7{DUa?Yj3Q(yM6oo`pbXW
zxBZ{~&ENkg{#W1qC;sJs>#INW*FXN5PhB29zPo+C_ca?G@9)xdOlK_F6v_~w`J6g$qI#;V6C6qn129s7u?T9=D}oU?%QwG;xT{oB38PZ9*#vXJVeh)h5ub0~MfxrN2f
z%rG}?H5Fw}_az~{E*M)LQUurXh*UyDMv2p_EFC<0>ib-9t3pH>Xs+>AI#ANwk=*F9
z3BBx``oKn*Swv7ugerHVDc!U$uh7!iTU%o_Fvy5xRTyt>R^#19*MP}4DzqP;Z6OaGMKlZDB>+kr<+YfFZK6>r>?fXuxfw6-wiqnmj>`f4bv_4dsh>&Jrb3`FsFc&N%rQ1m*(q
zUhVH~iP_
z_N)h`?o!LTGMI4yuXePM)gk84rQd7
z(Y=R-m_;b`4`8P+WE6EWsof?fl(^$Md$Cl{p}B_$Nn!jjjr%IVWH`a1HsK*8=Inu~
zIKE!<>63>ae&Zn|@dqX7>ISD~v+3*>W|b9evEk*hYU{zt!O#lGU84yMZRc9gndc6#
z+SRJ!I8yS@*o7J2Gx(9(K4z3J%dCnNat}qza(oLw9!ZB0Toze%WEiOksNL!8xibsC
zF0muFq@#=-VzFpST1VruReSd|LUju}(`Z?!Bi);398+8Y)W~R6)lrp^5f2CfdwHCu;Rhx4K4+Daqp<3ziCYai2@5W?41rO@>(Af$=qrEhpZ&Xj@eh6epa0{3^1u4ifBLnzp1$$nk4Dtp-HV7r)tt^bQ{;?S
zb3Qa6X@XI@^&{La=FL9A+AY}=@MyFaak)Y`fHYgEqFZ%3a`R|r>*0eZ3H`DRAKSW($oP1UiiQCt?$b$n*eOk3*$4WS`3YXfQ>moo}dVWm2#u5S>BOoO$L
zy>2cMAp)%tH&!L1GBXHq?8waJUR4nSgDW$vobFZGm1dQy9n}Cj3kxjN49C0w?<8d7
z?()h|QJu&FXeXZnKc%g$svWs#Yk5Y>fv*a8(4}%W=rLa_wF6QcNEx|fTX2{^CC9=~
zG1LLGa_3!^c|Lw%&mOY^$CWRx^}${Is{h`{|H(i6YyXM=$-nXK-}%|Kt`PwPa-%sk
zO%cnoL@A4?vPx>(91K+QKhnf?l!oa7=Bup*ixQgHsR=Suvts-X^A@-$a;*J`>AqIuywLHExnNmOuhb9!Ui7$ykh9hlD
zm?X~XnAu-nx2&y6*^i%~=bDgTW+o!Kkrv@-oioA#D#Z*}rkQ0oRMNAmYXX7YL&#f{
zq1J6W5y@0oiM_)XQRB~#eFEZL4|j>t6Y7yM$4t;=)yQ#&w`pvQ=Fi#itrX*DXj&~=K|feolnVq9Caz1sA^i`ZcFYr1MOXs
zw~K@|GjW8=y%3o(>{~yQLb3M_^X98F%bb}JMb{IBv|`a)6o^DIF)=_QhxC43a`)$1
z_hqwe4Aq`&*PF5DVdB0$HCWBoU}|pl;-P^_l6^PdAV5HGmSYq|^<1dVj1>^e<>E>8
zoEnYGGs@2=@C0GhH}-bb#ls*qYGy>qr@*s@>u}=g4MW`Dnf{QoQ)n&B6QX{jFsW-N
z(?ap?x~`H0cWWWoNrgu4T+0dN3F&!OHA*4Pbe;f;E){vsk4;s{CvU0k%-zXOuQ8Z(
zPHosxvToBCElmIiFQB1vwuv4zE=hb&aISiTc|z$_#<_-!ldOoXfZUpuPNXjpFF4Vs
zLS-bo-81W!SWZQ)s9pe&`6{Xqv-Y*MF?RZ8={jUfU$l0zKb{L2DR+x##H>Rza{?Ry
zwdnKOIv&fHS1Ku|ny@uiRKt7S$f?O$Sm?{5x(fS#$YAEB2u(>8aN1bz
zlSqB_?KkJ$kso_@^ZKhd7#OwRqwy0E)r>|jc4QS}^wZT~haR^^Hu_q2hJ&6Jt!I)M
z?1vqUfEiDpJ0RQ~b7<+>4aBG-PdmPWL7MIBj-JbCl`z*LFFEVZJDaV!&^6Qp3tv`J
zTN^RT*^9%J%Q`TpE2D4b`X*>@>QZ(Gu=mdtSyjtDL$i6h)&{VTUC^X%9n+_KKW&+E
zP-v`OcCoCIu`{B~lqgfmR;79~H7XIt&I~Xb%_7n`MUZ@YQSPmO>2%^j8O%IO@|j$E
z9YFj*MkLCYn{r9ae7QnIv{5Kz3)CLlv`tSN%e%?F(?!Ws(|LcF{Kl+LP<}bhb(br#l>qC{eySv?Sr(#Zt(nfMQ
zdkVrLE27~N>k}R|vv)s1oSJ8I0#B%iID9b
zs6&GLRI-jMOKOMd;)Lo75=H47sOq=SrhZn3k78LT7&Wyc*fBvzO$MRVAjihO)T0~b
z6MwgI2S0d`4{!LRzv~D7(qI1K|M^e;*-wA|bML+T4I>M~04rfOh0G*Ib&9@?5bA0g
zU~cfTnhi+LMg#9JtxhVdU7eMg85AY6E-u2bP|KGzBf4S&X5H+8(`gZzv7bMG{`~!K
zK7ap%*c-{muRne5)z?1#nO9$b<&`(zc@P`kczVhsqH(q`G^eMr8z1#a5JizirKm!5eEbxtfdUeFM
zuTGFsa$kaU^FWI^Rou41LK{dXy(#x<`tL`6l?7Ev*2^;9{TE$;i
zwq^SNBs8^3hp%cf6&YETk)W0>vosdH$t1xCiSjX{i_XkUDh=OEq4+fwb0Yv!o%HLuVru)s_)i
zJ%&ND*!y%2b-L}pV{;7A_5L(nnc;4goeT^OOCRI{4QPM@%X@AOx)xIbFP9OhEqY7<
zl~oilo%6+vXRD_kp|66#xaq|bs%6NoQ+?WTKHFRHUQCYc-#Zq!#(WLj50WB#^SR
zMz(EJ&kprQS_R~MFse`1^Si2BH5>hY7r)9#G$TggOlubO?C!LdhFezb9|=Z;nX3Xu
zd*0N_1!yvD3xHm04Qj$u5TDgE98tBF+-1G#p~asRxk~WVhCtAS2%c_-QKgNs$u3vS
z)Re_1j8$W|o43^;^1PirhC{4K6WW-j9T~fm-}j5ZOH|{s)=>&R1
ztLTCK*dD?Y7jz_wS;6V;$aFw%R4<1yKc5
z8ND)S%zkL)X=(X~g2hzRn@`{o&@HZAP^b#CHT_rb%k3#eLE*LT)k0j^3&qUqPL)|R
zy61K(unI({5vVSV9;M3xpL8uU(+D4H9ID#lQhjH%~vpw0tlps2=A@Y30X
zUKLG(@65~cUaJ}@Gx=%S%S4%4vE*H+`qOLw4~Vo~ftlUc)eKOp#Eka5R$F11)XY-T@K6js2Uq
zXbliF9u4D}TSh4oq_W&CvNZEUs9{xUMs`ZX-nO(Zi|2b4R?E4vvUPhh&a0Xag0*+)
zDHg@j=XFQOxRQvsiuY=R6Hv=nRmJ@y-!Nlk5MB*dunMuWcimlFwKFmkCYGs>0M#vP
zRYtsc?h$zWm=7L$X1@FG^^@_8e4P@;*^&Q
z;yKCK+#AI$
z6)0m=Mg_sxMIm@`Y8k6C{j&D42^~gRq_4?Fs;aDY@x(m{H|2}a8Ck)r_JA){7(=)S
z0ia2(8ew^5iiy^&2;fv>C2~$~y?&9_BE!bPM_UWzzG7WWc#v5GJ=WPN{bSPSn~Cxw
z#KA6#?eXQQ+OaDJP*r#UtmQa1ZtrrrJ$k@MfB(I>9`(WV{mQeOKl}%N#sB9ofANc7
z{+UefH|BZ@l{W+0)EAuD8eaHd9U(&wUhW&WbVkL~nLN{d_rh
zv>y<35YE~s)hnu?3Q58F)rXu8HtiOz&txe^gVtr6Y>dNgBp~x)>CwP6gl+k}M-19o
zd#}$K9z*4A@2-*O;XZv`J4m~dj8GdGJH4|2g~%&hjgfhQVkc8xq>K`t-34e@>ZgFK
zrpQ5C22(N2*=>fK;%6%>(Bq@BQqziLQg2L~P#|qqT0hp)>2;A&3YX~8sXMvu8M93~
zCUhrLG4#l+<*N&f?&9pMX?5iET|@S~;%UOPjZIOm573|JJ^{5LxEXWDI9;+tz1HC)
z#``uv_p5zy>WFnABf@Aq!rjf6j^2K5*#|@~wq9tBV5F9`R-$ZXH6)0}1y{P62-VW)
zo%WEO`BiQ0)E^Yhb{6kaX!U(3OLvDuJE&fpgHt7)pEcpUOs{C6mb$%0b@x-MHiRx#
zz|1RhQlnIaKxVyr10yIltE!L<`%YU2i07fl4tA0tBGY|Q0jM+`ozg3*h3Zw_bZow1I4x?ySf7+aR<*Ku;#XjZ^x*Fmh4L_cE
z3Z4g<6$a`1XXJAu(MkHEp%6$GSQL3M8xXa#pCRK@HJlHn?y<-yQB8HiX~0>jcWKoC
zm!T=bZfzvS$82p{IK93))@pv%(5i%}WKS)DVkGIUoh)KoD`R{vqirivYgF~X7af(O>HU<1WJYZWl_3?Y
zp~73431p4m%$HBEi_CUCoP9rMw*g!J&A~i$aGr)qJ>}VizOK<6WSvSE+C_~Pjq$gJ
z&5V*Lt{dMw&FE%3(t7l6XC_4CWTG%5?ZVu}_KfuH&MGH!7A{blbC75a>WP5S=wM{7
zi!OBl?Q6AVQ!>>M^TVw~AM9DBxy@n#&<#hQsv3B6ZVQ3R
z^g0ea{{Rmk;^9N1@%lH~PyMwY|A~hW9=!gc
zH=n-pn%hN5X2%YJLa-#@FxW(Y5q?ohLKJXWPM+|pDwISE+>xNuZyr4Gi=+H{cYNh5
z-}vS?zR4T@{O|v+-~8)-;V=Ic-}_zP{?4-}YwzRkN_W3;i(PkDTsIr1`A&g-#JoGsX^I8uEdRu(enr
z3wS2XL1zW>*z3l(fKF#-$}AU?HI_)4$q1CuinMNz&)RnF5Igz
zFYB`RmMT&+lGK3%$X&=OZ5}fHvQ*&N#LkdX#Fe-ar&l5N
zb|qKufQ>k_tug4L20d4$X#ug3m0G>++*6D{d@X(VMy*ZU
zBeVhf5_*U#CB1t^)@s{ijpPVb5FUF3uDc#y@c02^^SJu+Yu;SqJ3sg8ANwP}_P74t
z|J|b(FK!+@zPo#$SYSxqM_MYkv*7M$1*w?yxtLZNS#-#l`+M^3uq`-%Ex_~7|3`1-fr
z|H{|C`Pcr&*Z%xp{E7eK&;6zU=D+@{U;g4xKYjI;H$U{+<>s~HxV^i*MWy*_0lG~W
zYG#wl)4OXwMbcdXK|oM4SqN+}SyQXC(=nuY>VxcTDr{f}YJoV~&zR`IyaoiaqEf-U
z4m6lKa}`kP4qIg0$7?ljan_D1pfPRJXz?WYtn4a7NDWY_q>Pr>R&{rmT{Y#op`&X#
zv_u{S*{qDF_JAg0r44mz*kMST*4WU9G`Mn`1?Hd`3l4iFkgApSEy`
zx>??Dnp1@kW@tfL|DCat!w5~9@S{-O)p
zzD5SXRVmhJIxsYc+7P`64A#q;Rl8VIn225LQmdiJzVE6^85LyX!lVjC$V1e1NTkg6
zgAv5g(QHa1SRIWtsXUb{QHH8if!-!&p_>G1ml{TStK4lKwg!@gQk!fgq_Bu;N~g3#
zm4NLM$7Q`b#f%jv6RAT5U49{$B@-npnj*5#Rt!784La5Bv
zQo{L?)eZ3Ea;P?i_C07w5<@q`i0pCE&3ITd;5E>Luqcf2vWXNeiL6Sb(Lq#h!@|t`
z1h}&Yf@#RDS}FG>%$28L9l)ST04i$eXR>*)Gkq6*JG!D$CfaJGu-)f+78D%kP?z?4pVoJ-nG|ZrWNGlCih@szkClR@|;`*{YbjH&jp+m|j^I
zUKDp95l#K3F20&iDS-u)nRUd4cJylUx~yww5*>WiHQW$E6=gH*r%E4SkViCv=Eejo
ztKE8vmhG;qDgifNR%(ndqwSbRy5}Czixp8wUY6b7#?4xv{@A1CxJGx+JeMe%W_;-n
z&65L4h_e(>){QFx#@0?cgn1$6b~l(8rCkX;*+>>DL$oAF##MQRg+u~wP^2`}dztOM
zD~pcWp%PQHTcRp!Emm3Xq9MBMcqw4BBvftLLLZ1(v5zuoOZvKNJv4Bm=am&(mRdOw
zR3)>ra;L_(${KXWy$CRpLQf`)wG?mL4{oXP$r;^l?D>tESrBzlRYr;pHl^&4r0ozt
zDzG7E-?P+R=zujod+WWueWneUEe;TAfc2nyJ>>hzL-z
z7k#cTDWEV@OpKL?Dlvj6J2vVCjsuS#@!>=6Bi?`a&Wu0&3qSq+-}mX?@!Nj!pZe23
z_J944{`_C~fB&VQ{@EXU{NU!28iYTsQZ|^;$c2>;hPsTVjtgB0$Ka?(PwxN#hxki1)eCx|rUqvZ`#Yee8zD(C3as
zBhq(@w@!_|xvcDi}Q5m_t3C{=i(Q2Gv(?o&0pD6$`c%-WGvX*4-GQg-Xe
zVkvN-D<@Uus)P%XvUY1sXhm#wXnIQJP*suWu6!mI7`xhY9%aizlQ3c0zA{r5xZVy*
z-$ga7n0=LEZ6y+)D$h0vq3(-i#%Mwu89}KKV
zBfeKW4!rlG-16`EW#9IX{efTqPyexh>$Bhf>6^=g>ovNZXN|&mN_G$&|D+H|Q`Cz`
zZp{eLlo$E?2wF-}+tE0L#>}h-rbum6)r%Lm*SmLbpWhvK*JM0>^x%!BuYUUTAOF-R
zKm0x4{)tb2>O&uU=jj`-K6>?)C$GNp+)7OvN7sv4;B8v)x*fw~C86$ToGQcF+c9`1oR&JA2oU;z@8Wp;ZFEh&k?IpEc
zgH)|RVMC=A6_Q`xn~7ACW(r)dfeLjfWA@gu3!Vq&Ft6G8a8>T4xl0AmXa1<+Ac@vl
z1(B&Fu6|&;aUBQ}Q_Td%L)XIll(AEqJ2jHKn%k&B^SxD+n4U(bq#LR@W7r^@K&Qk?
znS?%`IV?yuCq#C2!FH>%q}i6{Uxv}k;nyWertFz4#hHX1hQgC)kwOdVD1L_8S|NHzO4H!@2CbV{@s8D$O8X(6iNsCgK=!Ru%O7@ZWt*^Uj>
zB6>g2kQs_l-nA|s5px`1z%tAZrCZw`58Z9GTvbv;*A!Aym`3_##SV50nlu=e4I6oi
z4TK?S#}^}}K|<{Z?q_lI360$JK_!SZDiz317BrxxaZ+e`*htOKE?itIsbnMcXdiN2
zE+L-aY?2}2Q$K-w(7gg&KFU90@wuDh!QT5;-T3i?MDR>3bL=e5o>&#D^P&svxF
zU);X>%A=3I^+=_Ic2%6P+blfoWtd*YTIAe_Y9?fU*wj#vTm*vqgnZ2aRm-7R_j<_tR
z88q{mgMrQtqUxkd#ejh@H=|YI*jv+k`b<%(XTUC$q)#_pJ5_9v=~f&om9_u4AIWMX
zk#Nl>_Jxr~wOO=EFj?|CyyRI
zdUSaNR9AADBZuq{qwN=sE!N(7J@$L=-QGU`=JocP$cIlJeCAUh{ehqJi+}iszT^9U
z&c{FV>9<~ex&RJ$$m0k-I7SPcdvK?J$+wtfWZv9dKU5daZ`1Bky)A1s)yDpfiv&H9E9{vCIMHb90ZU=Qir2@jx0ouxqk+rOD
z$jjxDSzK-;oGEzUG!)#f!>tE{ILv(#v@?XI^FMyG+lf
zc!&}dNuG6PAK#RZv1z=iuBF&OZ_ZWpDZI!r$Er3MsDNZEak$K*c4iosQ_~-YbeaO@
z{_JXR5zt%f;9Qx#=|#dwnk$DS65h3STg?#-)c3wIHGdEDK&$18Dhtdd{_U-^q>b!X
zsKKsPvsDHZ%%4@UgJ{kPGqtM`Z~)dmjIcNee=3%*$Q+^-WEnd{SetYzu(wg*86u?G(R$P9zMsv(jjL6wpxf3e
zm0cte!ht~bxV*oHoUWpU!~nQj+|IF~ioMsnH9<|`!`_#Tf~MNnfSK{DE?qB7GP;bR
z2oFigs)YiO>JR6$&;GIyH*=HrA&tjmThS3qUy)M;l`YIB24(s0JHdi`D(V
z_KH$-bOe@}n-?oK)V`>Io7DutB5v3bI)DV!>6-!YwIU-TWQ@zqoc(&R_pY=OWk7U&
zI8QioRfg_iRnVHE9orF3woun7BPd-0J0?wGI@Mz{t6etZSE)|W)`}FlDX@#nmIM@C
zdiQt?PO34obMPiywHF}^oiL1=rqZ{E8ML*#>`5EM25;W8s{@M
zDg&U&PiwhzZgu}H@$-dMGhhaF8y2rh=xkOJD>iXUhF_X6ia?oN+
z>BsYjBSTz}FUH;}WXM>1T5MW1{Z(p|`vXco61~l+Ps=LKCfv)VYjmwwjK094j;k0^--8?{lQ
zoe>n5ZV_?4?#sG}qDP@zNMVtP9qum9+1)YPr6QGLnk}y9;)xSiMvB=pFcb*|qF9LI
z2%#Gl8JY4Q>hwHI8Etny;}dB{bgG`Fc64a%sV|ZUE&6h&wvG`#xLa0LRi8h4=;~ykVn3FaiH>JZ$JCgulb%|_DjF#D_?#03t#-&
zkN@~re)6w>^>2LP8~@!Gzw*VO{@Ry+`diOmyvV)vjF5B}`XeX@C}gsL*jnCr^x(nk
zufFo_-|>mheCn<5{?50*_q#vx`EUQwhu?nfjn^Lli0i(6ai!UEx_cHPDx!`pw<>d2
zq0?56NJ}#}?99x{Iwr|)A4SFRSE6W6qiZ^=_;&qR0Gg^GrYkk?zPsYC9CIg6^I=r9
z&tk~!9e!DI9m8mb<9g7H-jLj}wd-a^(p~AfQ-h&t4={J|(v-MPx(w_L$?mnH6p)Mg
zZ5x?{yEWI{1B4KnOn|(sRjAMdB78@xMN}L?H(EbX83jndFCk((xU#Y~-CLzOr*hF%
zv7s{Pt2yoIRfS=lqnk2G)3j2e6u*=h5`bp9DJ+&%$oTCFe`01B%EUsqq|@iE2)5y{
zg=v#d;liYn?#M246nL(B1yb);A-0@U<_i&}E4z2z-sPhQ{_w(l$PeDH4_*`yZ@%LH
z^dI__U;Oen{@kDW|9hckkc5xV^o-eSZ7Fi-NCp^X%0pZ@=}%w|)CZzW4JV`|j^~=beu{d;5*Yuf6i*
zwO60K`fPbunAou^_6N5+Kt=5qV9Re7mKzlSPl*D1zXlm33r7hR0SjIv=?gqH+EscM
zqWG=b?c6K#;l;n}b07Y$&wcn;|H|+D^MB!2{G0#YpZ|~llmF`O3t#@or$6$_E3aSg
z?yk2lA`cR_OgZpQ1=LAI08UmPja88?$AHi|o#>)2PS^q(DbALe31}c7!yDuuhKpg4s1^NY4sHSkLbV#8A
z4*gs6Wt#|9zV6`3C%miIYy~J=bl62=mwtL*PDP~6HTwyUIf|Q2wiQLN8?V&*t8FucT{kB>*jj%&mC_2Vsu7f1`
z$_B5*EVG>0AuTKeBLk!%Co%h|!s-|2$t(`aBqL(Uq&wbD0zgzP1Ejr#ideN{r5@GX
z;wW2}QJ$mD9xs_l5awPn3SN*yKa_&;6V)c|sn7KHv{`N#w
zMl|Rwlt%?UNtoAIp9Q4#Kc#*Y7;0Kpe`)*8%etvjvSqaCP9jzG9&Of^_nKU^EIEH0=xHB9
zSK4R&rMBf{vj^%TsZNbwwLDl|{n`f?j9+xVU@4Xy2&Se@jp?q#<1{*i|1q=4bX
zU%RhDT>uJt!b-V6Bpqg?OCdL+2bjBX8Iso{-hT7Zo3B5@h%`>H{^ftPcW2i8
zm>w%MiieTT8rOvqF{;VZs&^W8f~){o?#!&%S?+6Tl1C$bmy7wr-mL+y(y}oUp%m6C
zb0VMs9yPH|cLNbQr6Q_WOA=T%Lx
zXPTStiy8B@B$6;N83JMqk(3hHXgd-~_jbat)e7vRM%QLiPqmv>FNPwlRWp+T*7gk>
zHh&+*xzVhg`*B(87(3R@-ZpXCi3Yy8n^@_b2U?w69
zz#e-DjByufWoaPY3|7}W&B@i>Qzavn2QotLZgVdMFS|uznMb5AQ@o}1#H^GNKvab_
zrY$IhndeT};Sedch|=;61TM>=F~VJNut^6kNSnYmXY44Htxi@~2$?Em%2@GWx%-|)
zT~@~q5E}YYJ&&1mce9Kh=@bII4HbH8WXZekkteR9PzGpXfjcD$PNW>mzTCKWq%G#w
zI4H1p%rknsZD*IYG*HUiG9xn;6Uwe`Sfz(T{c1JpTmajr3V=oJj&l)eQt$zm*;K3D
zRP_AY;Z6Es&{4S~UDcndf`wWj;jJLH{=LdOte^?f01S5BWvqt}@$iQ6i0{46_n+r-
zeC}h9|G9ti*Z!XW;k#e@!k0e&=})}(?pNL2>WDamT0o7n3LZeLvafaV%Vk{>bXp#9
zdwYHV{pWWt?p{2<-8;?vm1hrMd+oK4e%I$d{fW0e{~aIx)W=`{$VZ>P_Vm%4Z#{YI
z^{3AsO@|5q*n1zD#}NhY!o|$ZF2?o@Dw(rj8cYfaxFohL#rsAfi7Ezgx0B6yBovi~
za#GW`F0EcLWbI==-+A1yh}BexF$kdjCAR2t3mrE%Wy@U=&PDW3Xe)sFHS14NpVV6
zW_#xx*1dP51=Zp%cwe7Sd#`NiJh$SEu9QJqML&|Xt}`JBi6VxD=HtA_`cv2--9+pSEcF>wX>Zxi9Xa+o~7JaX2Ue<
z9Yh*MYc??*Rl^HODv+EWa$S8*_rFa{V-rc4TpYKkX_Js
zUY9P4^@9wY9XQYb*Z*^Z8GTK)N@yplC77m{_Gp|MP9_wQ08y2_q0YE4cVks21E`UH
z2`x{lN^>@aOcE~DyKZQnxLU70_oZh(vt!@eBjK3E&}EENf;AHY#24vV7g%{ucoLcA
zJ*bmeg-D7p>5&GI?+cYZvdKs=B7E82yEGa{3Y?BGVpc?GNS)e#Ax~h3lvP>_we}8M
zj>6ud0T`XW6InK8dd+r)7G0QOADiuzuBs4KQZpH%w8e{z>hQ^iL^6V{2@!w?uoexy
z2h52AvFwOaI7HjCV@EOFFKSdsGxO?Ql#!b~%(iuBA{mNYc2TBVf|2>oJI~&DW1-Tl
z)MpH0Qv*P<57hIJfbv_+MT9Ez&9I|n$TUI|!Di2Ijax>
z0qh-Xxw&m6TTbgjP{_6rGX-YIV^jSfl}f1e%R*J|GWTR?Li66|bvyfY#nq_M?T8ML
z7g|Ik#O{p9dZ|e^H$)GE(i1sn8wO~zfQsnpbFkN=t_N=Ka;45;hvCgBUq@#brn554*Dv!8zb7yLXVaJ}NV?z_9=?izR3Ey9n4yDddny4_qZ
z47>zM;D!RUX~YtWM*AAq7Z?|p5K$H@x0tSWmL3fan!L7Tb7Y9yF6IY
zvr>_}+*t(}_VtL!f(V2D0GS$t(X**5VaB5wax?SHpcznmrve@N$spps5$WzQ#1WU9MdEsFu}tV;jEv(bBhj^~yr~rl<8kEWW-&wYj3=WIJJ4jN
zR4P6H%-!~}wN33^+6?wC66TJoWtLTuvjY9HZCSFA*s
zg2Ya`f$|&bgLT>A-b$jZG+3Q^!rDdMNp4}cMi$-V^vq19!m4oV-DRzX%IozYv6k1_
zh6(R%h0cjdvZ{_9myQ@HkdfsCy-E`!Q8X{ivFnTk0v9p@cU5M*S$Oi$j$I#oQ15+^
z%kc}p@2!8~kNw8q`49eU-}vg+U;ogXw;#L*TVH22zZ9Cz=(`~3FB
z-R+CJ+q;8_XU`r#dGz!XpZ(A$KKAzaec#8v?K5w_^U)`-J$v~2YfoN#<L
zM^}P{Ee|oAbulx?#V@EtVrPBj{ksRo554*5*Z%77_=P|4@!#^Bf6@Qp-}9g1Fo;!M9n@SWb2`eHi
z2veMDRj1uZ^xFaNEP0z!8tk#cNybolW{>u^DPg8k3sj+q`yBa6$(!JfF6k=JX_=8i
zp?tCZW$i$=5i=L84LSNZT4g&c(K6U-yw9ZdZ8Pl|t)fj@TYz{Fts7zH9dOqpb|;#O
z&6J5+pTa|}bTh+hOsh25OfrF*R#TfBMeh9C`5bG
z(2sI|Vugq{?lb>q!l^o1!yVC6)|8bjvaSbhRg_HEY~Od^0Fe%}zcyBbAu~*PTY=5B
z$xEq1UULyfQh=VxHDIok$joe_y^4Eyq
zLRFPTZl>8<@IWSa)8iU7P@3|i9j09c8lDx^9m@2meeL^l=@^dE8#(oRtO%U^IA^I<
zo?=KHKQ?Oeo_`3&z=8YNZZKM+q9%brHo|4FVi_RCLYXnP1pR7W)y9-iSmociEyaix
z%A8i#8zK}2>+52K#oi5cpprl-M%cK-Zk4a42>1pjn8t-F5mOlJLe1ZoQl?uJ;LH-+
zP-DiBI!jUYS{~9}Xj$eCaUW)j=AF(VAstv6ZEv*Y8P-nRIahUkH0=Pi4Aoo)nEX{0
zVQWcmWljF~^}Jlx^~eX8^_h=9d$?v!$-pJrKj!2pl9QlhB9mK6aE~hWP$iHB5k9Sj
zks?X!-<*}mok(16EE5rRxsek(QBa(o&S;ggB#tAidb;2~subIn$W#nc!(2i-Nz_&a
zEagSU5jPK4s9v$YY(h7LddTY@S(N3Nt!>LJB?!_TJJpJi*pcpO-aJr1LvD3<2`7zo#jOT$wfx;RqiEKH=OTu>T
zhi*OV;Y3d|$`=V9N4YU2ywP;l%pjM!E2{=Dvxp?>=4PQp2{x|5L4P1VwvtNli?Zc2
zgPL~LYmZXI24-Dyi>4zWYy^q8=H^u*n&I(A`Zs~$&21PofbG{V>ufCWqnq$r$l
zm1gStWyKZ}4fj={ey_6bfw>$IS3G=n;Z78UyJ>PNfNt%G*a_frSyjpfWXB7kH+sQ5
z801fQockKUSSbMs!itw0kIKE?n8c#PwS4FyoU)z5_4r^70~`{5yZ?C;$0B`kVgYf9&6W`1JPS
z(^s#zw~rq_Az@{evG=~aeeuD&@4x@v^W*L=k9hp}^6D$kKJ$sU-g@iR&wu`%&wcts
zpZ>Nt-g@QHYp*_j_1V)m-+XZK`$r{nXB^L;@5r$og0^T&pB9T86utng9;q^PNoU%P
zMQv7g6{5%_4Bz}9zg4is2OCcx@?|zQc^mxM(+v7t}IV)>q%Z
zyExx?>+x^;jX&pye&}<5_W$uq{?&i&PyHwV$$x41`a7R^=fT6rx3}-daU_zgNx*Hm
zzbZ{fo3OtOVou=3Y`f|v?d1T!6OPA_{3o)Ef%j)Rwj`+-o4s`jsE$O67PJmBI~i8z
z4F7h3Xn{$v^Na+w;B)!q@
zQ&NZQIa5*E6>R3npbL%+6p{fzZd!KJTZPWL>&x3KImP9vH_{{AWKV3fm34IEFN_S{
zIxkQtWUI4Kpo|YK)_{^FrH&#~^9|Jrm!Ri1HCCq{mfL-YJj+jCyk=JvWffVqIF(HI
z-fAcNQt1n_e0aMyAD%`|tva4}rPDV`O?M$ovQIE)e4w()L3KCmqNp#)p
zig^x8tms%By7cV+xp%&P3M*R`R+Uv7-RHNvM(|Q*p?1Gdp#WXTIF%P8=qBz(?yl)E
zs+4OlMd7?;WsKZj6G&5)e`mc$SkXM@z^n<8ckgS
z2|u&xM~Hv&8=}|PJ*h=*(&*M}T}NOy2BtUCb~p%V_nkQ$snL4W=lMB>WU(r-{E~>s
zFujy@hF*0K+yJt;4&4LNGt1X#Jf&)FHRpQ%Vn2JdKK}Lt0DBjVHbWPhS>UW!nMJc7
z?Do1;0u5w#ajA6{P?Vxsm-SVp2$>R=Mbi5ZQf+`V=W(PjqcQbi7Hik;3d5>UQEM?1
z#}V{7`G`0a$I^8OiQ0L2coFZ!vVBc163ktRyt%ocxQ{L0mvHo6MI{NL4l;;XlY&;8
zsahR<Nf{%-$MKgs42P(oS1_Y}06x^Bg;G@9M#gT@332#reqGRHE5{
z2z}+L4OFSj!>Vd6lX7OB#Z3`=BSL*(hj3_bh<$#Z68o1?YM5!28(G*p&_nI|VaX%d
ziI4iVR3d|$>*3rxFE`#hjJ7Ic9FlcFyU*%f1#BG<3$^!l_|0YI5fRz54+(Qqz!gwc
z$ufzAITfOwRSEOxb{soXXSq@mB#=qamKs!o+61CDm7W!Qr!TKeEARXdkUgK-z|5Uy
zrtcfa-MYD?63h*IXBC$Fo)q-G(+rA&)KQrcd+hfOuE<1c1TECTM1nB+|K*q*poi!~
zFQO&(^p=3@Z`zkH(r1I?8#8508kP8_AWWbgsNJ!wbliUYSX?1TIa5%O)-0NSxw3Y
z_O9kxfZX>TY($lY`c?UbD1P;ucMqT5pz4Fep55@tjZt2w9;@38qYA`BokH<;ml-Zr
zH^d{e8;6@6z|XvQJoJ3~?Z?0Q@A%#y{DIH>=YQr0|CN9BKmD_R`Y%3v^6F<*R>XiujkeUZVR_ES1dCzk1}7Q~{W(`t3qlKeuy3Ucz`H{nS1TLTP+DxZJxAB!bi}H)
z3YgUX=2a1uF1TP0#IvVw@|h-S6JfEVs@&I!ZDl3JKTq?(P6zC83T>OH7RspxmeI7T
zS}f5d5(;!8V!Iv|X~fg3*~;dH&DY#-(LV`gUsZ_O8dAA3H|@k4=4@?%d&GYouZiyc
zQ#b`o<3HfbS4*!kJSn
zn#u~D3Mocyg3Sm3nPL41z}#loNsDUO@gx8UYhFMwu?U0NXuwqbMX`rCb$MdYv(%+B
zb(ozcY~Pv5y`cN-1$yRcT~=k;APXpkN61>kvW|Ib7>V=2w6atjK^X&HEGuw4EfK+%
zei~0Hy*0Yjc(bDU)taI~CFw!fFqj|`-No#l#CpkT@9jFSO7lAjE>47j`V_tOI)(I@h3!?m;L^xoZXW9$>@Zlpy|iS)psgenD?
zN6gP_Kh2wgKO?JJ5tT>Jy-KOVX
z6EZIA5;E?eZ9EFp>KEK-a~bO-9iW(N04xph>nTlI;%sShYSVF$FtiW3PlW>?EZ^x(U`Uj|x{=4VcdmO)!v&HZlQz5Uwd&DU-KMCmWO+@H-wkAsdk
z_0K8}p;#GRa-k(_X{RpD!fmZxwtz?Vw|Y^%enlCTO48`h=<~s4C{)P2QN9e|-kDie
zFmrb+pomNBzZ8+u5E$F!JePGT)5#MbX3qujh(END8G7>u@9u;++W
zRawW+&h=E33nkBO$75CJHWaXy?fw6w>R*3#U$g8WY>YXdcdfPeKKqZ&^D?7iM+&Y2HmJioPFzI63Dd$0Arzu)uB%a~(~Sv@^g{IYgw
z(%9FgYTa6q9g?@(jb!f@{G-&Tx}=3~>V#&D&UkuIFIrj8L})N8G1V#Bynn5y5$mRs
z3sx#2Bf3zvW5rS!0^UFOoyg)!uJq<*Z=lo)TsX8F%r$Oy1!;Dp2i>Sf4{E#V1<+!8
z5JU8R4sD&B;@8P>YnCW?&^LziPAOEla@-O{g{;&V~H@@}dPrmy4N5B2)
zkACYb-~QI8-~RTeKm7GKU;E1IPd|S1<&WQd{Pywb=9^GmRsF@g_cOfjj*N`BrO+I%
z<LnaYq@dB0GkA0_YqF&Ih(bp%
zstbq$P^BumUETqLh7Y;sXsY#_13-IrCw`ZC{#S|;b{VjXm`WDSPi$@g1=2oXmP^)<
z?LXYosH*1$+`D{rnL!c};J!;U)M8f*lhN3X9<9-O
zDKf|-E{!;k#sp(gfG~499GwST_1JP
z|8vo)YkGx^20a`CVg=N~fcM&>$earW96OsTZAp-bRCjsoF3_DP!6})n1Jx+B>kZD#
zAw+c_QyO8%R?qaDA|SG*qhjDv~AT}o-$WpY6?b%T)Un>Z(r})
zqd~n}Ws}zrjNleTidoL!MN&NimFCmzhJ|G)3}evSXrJz?EHtKjCNh_l!TNdh%k*O-FgEYB3b@b|3s(2jy_hg-&U@$ist$iBVU^@wJ(@F7$Sb-Y(Ic
zk!|JYi%=zfS55&jN|w7i8o8pkn@PFaT*wGL&6X|G)O~WTb&IN&&&^cd-|xY!mECId
z5Ik=G4NBt0JS;&lTdVN{D1?-uw4szXA?<$SXjvi|uYg0t5>6ZD8eyOGf5%3;SZ7T^vTTsZ}
zCRCTm%&M-?Q|h-R=|@!y(de_P{>X|@_fl&*npuswH>2`kmxym(c30JQIIs4Q3g~G`
z1_)NQVb*=DDFPBX3{e};oFFn)Od|r?38e&iq+bLOIYG9`T-YvXJoXV-9wz8wT!V=W
zF>v$*cGs98R;7?fTTDmv9z?w)tI-u`X^n%~JrD_|MOeL7#>K9hLK=yX74YFk&m8iL
zawjFGh&ao})A0YjcK0N+ryceLbtf?*s2f@Ifd$NKkbQDH{&zUh!u>gVsP)yW7t08TJw;$#`T>h8)K$`l-2HHdM4V?
zWMFzXB35QgErukkcgIRboQ(r7UghG@_jEFXv1g+zuvTP2&gLpIfiuyt`I)mI>}Mh&
zZocr_HRFz+%=B>E!w?b{BQr7AN%sRzVY_kKlpth_4%u2$h~K%;WD0|>)~;I
z`s(&`fBl!f^0iMId^fn?XTOP0UgII-V9`7>a?^9%P&R<6f|uh)9s##F@#VJZ~?10&RFm636Zp7;W<8HJ-cxdK|Ps
zrHU)7i{R>l76H$^2qIm#oSGAw0{0242!uu$S0Z-1%`>r4u#u5k#K4Y0>gC$bNp1oe
z+4iJ#^rk^hw@p1W)8dRMJsk_AxyGlOHrmPh4CUtRwAcI@@a|I{GabbejRba8M1T>Y
z)mFgi;mIRhkA=f7Q6!CsMpqke)0Xma$WE0&2CzBP9f
zWwR3jc0|fsSP!=Q1u`47-o;_yPuFaPExL~t{GB8Q)gA@o+!%eTOM@jY8;<+E%IT@{
znXw!E40`E^gWX-?18E4ZFHeSz4=-J-1$emT!v+9PS+6f>I}_iBU>L8ciK#!~+`;9E)W%A#W?$4&-oTpNQeskz_z#wm99G
z{_Obh4T#7kH}po0S#vMI+X+*C{<_Hm6T0_^xDsZsiCO5&r9}cBFeQyKXxatvxH?_I
znZ~_j<_ze*>6*?^_dWzLV&lAT@oY#kf@Mcn9plMNA!=SPCi4$^;>PO=oDTLt5*nD8
zOEpA~DbR=R2i+h2O(sT08gc{!B2$Y#=M1Bun9k^`3_*$h^G6d1V5WiiOEw@;yKLEdhL
zSjh}zkosTN3O2g;FZ=cMy@0JY_7U=k)R3gPBZDb06Eusv00N
zG6+&U$)M~aseO@7LvrMAiAY`b)}FBw*zB$b`gvzYt~EBp=&I3BEmvY#RfDm;904N3
zDilaMGa(wMcJ}DNSodiEN;gS^nXbriRTjL^4FsYsZEc&QpFv;C!EUS(a7}i-aOrUr
z_2l1!Jw;HYo|#EV+;(QjGUq6a>E8g4Y?=yX76A&=)LlJ+P7_z2)}C9pGK59XR>K-0
zrDd$>uBy3mzL?n>CA6uK?XgdAzjtGOMadaO-HV4p%P}IZ79BGYNi&GXN#bgad|07Q
zk3lxNd)-#IikOsCzMSjHAd54|OdIerOTHav1L2@mtK`av*lmHy!4U|{vl$V44`yyR
zF^%VgOeaLJGjE|KP~AeA8IhdYy_O86`u6x>kD`oSg%3ssLT{>i-PT3IR4HNR#gPap
zS<@WshHHR=RT~g-N#$uQJx|rQt|AYbd-SfvaMsGIzE?fmGT>(gQ##2HGM||d$}*l7
zsH;@6GKBkq?n*C{g76H<;{t}@vvsl<7C?3(m)!}bv0Z>n2G))52N8V0ynf`@zr5b>
ze!8)$f8-mFzxSX1jd=Nwmj-Kg@Z1gZmXT{AI^u}`PSqF3PFH2N%xTnPl^AG>zGJrL
z3|gvh40B;-?|P|uM(#N1M$>R~f#(RZhtpHL!TRQ>ul|$2{7c{ch0kAq@}>*V&$}yb
zYvm(us?*|tO_&+G!5_Gfwawb7jpxR@n%9XpD<2=$s@{d~eD?k}^BaEcxBgH6`+xNJ
z{DZ&oU-+q?`PcsF&+@N-_nSZR^^ZUO^ouV(@2Y85cSI&+G!U5sL=C(u(CC+i6%O6b
z`Oe@V0&Z-o8}duXRnzI0K*z$}u6~q@r;9Zy1l#st)6K|1P;UFU{)BX}Oe4#4$>DTd
zGZ^HqGaGcDqf^<|;|Oh0@b`y{^Wo-N*b&h9cvd7WTX&tvI3*3?#Q`MB6c59;echu2
zV)#qw5&E(mbqPa>BmD<;dDRD4Q0;}~N;eIa1(=9zTM8+XrgDxWDKgT}-tUa#Rk5yx
z{b9tBBCR4kGZBBzanD2J$hcUnfE9>vqzu;{$<*zkI}}&U{oxwO6QmqrMGBGcW8)H|
z#%UiQ>@CuJOXTfP-J+
z${@@L`RVH|uasa4xl$Cb3*1UVtBVbeIDzWb+mFTP8s@xQZ}Bu6fKKpr0sML7HgYhR
z3+bSe6A(5HnaiZHO(&wBdnsXBr625YHZ$kg>1+%NT|e>=ihd
z(*-N$Xi|+Q>9MQu8qt+`2+8A;xJ&@*CUR+yd`!1!jVBOZ0b-_Y9VwP(SNWG7yp6^-
zPRTeG<3&s-CTKUM4QZjt4@2B&<%Bq0>)1+OimkMT?h!4h9CyZ6HKtLy$p#@(`*l==
znhb=WN?52D+&wt+$%)kHHDXv*k;}9rKIppc$
zj}%K-AU^<8{aU-Vc7?gX7-}0UBI4eCBYyc0zkT~U_WL?HQSa)4#&C2rzKk=zhE#p3
z^{N4qnb`ZKYOgkg>)~g(7K~)wry9LG1^=|3KlBskc%m5u)w`LIdrh28RN|VZ_{Qc_
zXx{D)w031=X1W7RX0q?q(~-%s-%pS|*xlM7C{`+LTQRyb$r7*lJJv8QT1qnbMeu=NU=$YR>yYS&BT0yP6(IK>gv#Z?UF$gfXyhrPCliYV_AcRfAh3tnWFThtL4Sn#T`RTK
zSGJdF&4#svyL+bZhthVh2D%2aWf`d6)U+~^qa~uGM6jWappqd9Whi&0GzX-r1bpOp
z1SgAx&WMs_-Mo}n&L+XGO6>wE!RoQMOUb$m>7Q!(RFCxFHl{#8=YJ)JyDF^Y$*tB@
z{*9^aJAHD8f^KkdvC8$gv=eOaw#{32Wa^@Ib%}*F(=`aJTh@IuW98~92dfp=A0AfU0$AH_o
z8#%X(hZ`Rr@vwM%U_h%65HTOU=3B0rLCyQ;P0X&YGOu!`Z4YJtDpO;-+g$x4RiN=_xt@SxjtR_Ft>#UCQ&tA0NCO@3>c0`Li&=Nz~=1Y
zyTW7Q)h(V9!`%1&&M$uP(VK^V=(qoEzvOm!{=0tPPyf09*Pr=!KKf{V?OR`q
zj4yuh*_^Ub1LJ{-^i#BbBLnb%AFVTS85eURtqS+9jev=M98&Zt&Q449L(^ipa=aTd2uQ%d|%@I6dEl`%`=TyOJf(
zxO5m{HMS#KjfixI=;@$w{cW!mbd{2tSooLG|8z96JGJ{^Rk+5PEf107Gh(iUN^>0i
z-)(SLXD%5C^P
zOCPkSixI&j*t4s)!rgG#81GpoJWDYW5}5g51+Fm+SD@t+vOL
zJsnPvl(XwJfsDlAeQVM$9~6Z+keUX7BMqd4UR^TmXfZ84UBqZ>JTFBhv(L=LgvvL^5n^^sso3t
zF7zcM84Wke+%XjjMllo(VWz&d@0ujEl~B#xR&b6;o7U-Ty;R=eel*-n1Q`f-(ThGVK=JGiQY(DV;Xt
zK|)?8X|`DiGBczn|LooUqc=~#;zwSK7`cLz2id$(yVI$|HH^TyA+?yzLig?=CGH&y
zk|6+gNc0B6$6l7108%9)tO`Et>=9p_02)lpz8>shP9CB`H-?Bn@7W{Hsy2cKICb%C
zflSj2RQi)=ig>>295eLY)!iWvu){vNypBe+tmJ;~IC?yiOo|n$=-75yFzIM5tGl&#
zgbo;@+ahQ(WG-S*)w#0S5ib_3b29zRi&ZiS+q4F6xm2p}dsSBiJ#Qy6V;XyJja95Q
z)tOb3FFJ`DLYHsU@U16iYC61{^<)lZSPYBqOXK)9QRDrL8PwpmT(VQ!zzyfZ7!un=
zL~;eYX$1SyC%GC{^@Mbl)AE5#2`uyGP;951L7
z5u!Qh5&J;JC61^gBebW-MFI(iu2_P3!vCWxe66N|!BFS5N433dHW2SkRqFNOjW+fjU`1ruv;^PA!Zg^Zw$+lIW
zsB%?DF)s*52C5m6%gutO`=Re-CH$Nb9Iq)cAiN3i3u+(YF#%1nS{X+_$es}-juYUBO{pIg`@0UJ%`^j4pUp&`$zK@Sy
zYnlX{%`C1INVItV7`Eaq?u~anpKZKKyj}73iSHu5zwy2I?|?JL#y_wT;wZe}cU?>e{DympmBuouf*
z(`KDp;gB}BW}F$UukrcsO2gfwU9`lQfYOKm$;;b&UT_zhPp9q0eCbi^P%u@7y4R9f
ztpufWHG1cD4BUmjo`GLFQWmDOpZ=JW}ypa
z^fO0Bw8jd>HY2+xGrA1r|M
zHsEv$hbs$QeX!n(C~m+cNvZHg;-&}z&5}TP4m2y|GOG?&vzuy(Q!>z}#*+x){4$;c
zqzgv_Hv;Sgi=JC<@O%iLoYMteb*wYu=_pUwIkG!vY#gBo$w3W4r2K>(rnbNlP5Jb9
zBV(o~<{T{m^7#|#R&e|oF7l
zk@ssl&Ia3DfkDJlJ4yqm>X{9D4!ibdWW=i8GgSrV3UW#>JLOmCOBxEe8hX
zczlrmM@@=k89bs}`RsW`VT4z=$-gcVhl4$JvMdD$zMOe5j_g_3BXLY~$y0&oc%0P`
zWO_sNss3}&GMPkAWOjFVMJzv}t4V8-%nv>Rz>~eS(a^bcbI>GGmM3LP&*`bwra{$M
z8WKnuVm#G-I*r8X2A(a#v@W0U-s+TFkJ{JTm1{AMPu0XU;wCpK8h?U}5hGT_iqF5;
zU;Xs)>tA`T=$Hzz7dibxwp=s|qnQ~e>^U3@HIwKj;5`zVM
z-<4&r1RQqaQ6yC6fGlghnkNm=tQ9Kv3G9+RwL)2RZ$V(yZJ1y!eRE-Do>VAuzVK$9
z7roh!*)?45sq_O?Y0PxpH-i}|-O&Kk6A`2Fh&)ae2XU9-E_!?B07`UuPRpq!l!NM=$rqYc59U
zzKa;5q5Yv!!`D+Yak+#IFwMcd`~3OMtEaDh`t)D@{4c$F^|T&Vp?~nMfBu*9qlZT>
zB$2>Fu&7lj#28|8uL!jq1}calrl(|NVdZFaCv}`{uX5{^rw9pWof@@87kz^LDrAZpOw;G*i=xOL+#{
z-c;Mr(Z=TkiTw5aXVNoa@#k4QGdhj#09|@SED_Noa_>zt7~-+VT3wywydX#x
z6Z3wVhDD5=Ppjcw8>d=O(K6ivu
z)eYt%Vdp0hBm6hKz2$t;?yi^G?A+amJODwPtZK+{s#W}7jrjnb8AP@|-c`U}*sEg<
z{IA^1Y6NYr;3<1ySPOES2CSBt@QTX;H0W}~I$YG3UvRo8lGpfK#jLXsXR0bwBhGQg
zIaQ$Ra41oVZAqUvMk^lQxI-UAIMXLdCQvaNW2-nUy&`)o&mWf90+aM(RQ*qCHA
zs;a=qTw^mqT~z4p2iZn;U`_@=%8k(L0mL@(-?Z2cP~}VQ8etDILafIehB_yvb~C71
z&Xw<<`_oS!Kl%8<)$L5Edc4q>!vLrA8`R=tvg(YFLIo>&IMXXLlimCve1kDvxDfqZ
zn)}uEz&!NTPRX9kk@1oM0xPK`3DAETm&(%Au7}kF5yVJLc&;wJLYx`GXn$Q${KgSn
zeL7(rz%X+KqjzyB@NrjZv=y0Et#CI-N^!sM$b5djcg+B|hln7qzXkBvsmnYGu4vr&
z*RxGF>fUR`gyxez$MmX3&!UAD3URDma}bnWO>nIMy`g%hHR=bD$t}#x5WYJEKwiPR
zJ2(XvftOX|Gw}4dFBls$SfaUUv4<#A!dWjo$O~HJ$l?stgI&!S_O-oCkWhQa=D2>|
zJwYaU-_>1QsBTQ;V(neEBOXBRD$LNGu-p_BMZ`!IU`n3torB)H
zR8BAs;giqL_vy)%C&d7Ojk{zU?mMFBrglisi54$GV4U=#wzt-TsyG5~RlgyMvM>Zj
z#@uBRu9E9gsIZCzR%S3uOLTz=enVI1l~
zkEGghm@gynF{uqK1_5=3DJi`%cypaHbutw+IcMrf1_SIk?j0(jq~L3Z#%Rx#GjuYkJ@LZs)ZMD*SEg%_AmXl?|$$5pMUbDk06+7nAtB@ILTG&qp^tJ@TpIv+lq0y?0M5
z{?1?Xjlbi6^WXmme%G)6=YHzX{VRXuPye;Q@||!0*tb9W_)A}W{@MNhjtI;i40A~v
zrLHoVUDbz0q)WtWM&RCM=4Fs=h(tvfPsgUo?8MPZK~FS}kgiAU%4&p!h6d
zIA8`Ctp%vDD?M!_I&
zJbuh_EaC0}up(yIjij1~5!Ke{SaoLD;*N;CvWQ6NDu)(U$t;NBRZZU*mbvs$KuI}Mgv+xWO#3<48Md^
zdVbiboFwg8sr}QhDV^u-;HVK-{_x>|6Q|OEN-_C*HISuFAyE9MS7V8C4%i`pGE
zz;1_eJ|(VU-}%=)d1V!&WLzZG>tE#h%#(?&|O6!nFw_Den>dvEf38355$`qBpl93S9ekkvIKMbGdo
z3cHLSuVzDIBF6+%S+)Q_BP&o5d`!TrBhb^y?4HQXWknz5wcLY1#7(DsokfqxnPdTr1r&3VV2Dw8JU{KSn7v!G{wec;>c0AB&?)IuKR!v_OCJG73}m#;>4onju!#u+nZIRF6p@phMFZvn3h
z(xa9$khsC@J@EQz`UV2IvbK?WJs-7mATwD#S_8|Ib)*QY-9DkjOh<-X-*oWhPaD*x
zL=j89OIF^Anz3|aQvHx0jg}J&1)8B?=6$bRk;9OXUK7#r+)R1zQdi%fHDB%8lSx2_
z-(uaD=UQ%SldS3%BufCOk|`oGZ(|met(>}?H^gb5p4yukM3h{|J<*K_Z*7_I>Rlt^
zz?5zPd+M~K$P@{n-Irou14*dv7Mc)2-Mi{m#n+le8V;i~fTr=gFef=G1jRAc8`ixe
zm|81ZJ9ClTdxIl@4Mf>S$pVyJvdB*shaF(;+In!)+89}9v{uzK%!r=e&jXgS=eu`z
zX>ZE2qfii-Gl2v!Lk&N>yLYL7mY-ZAt7JQW>WSm+UR4wgd#hT~CRmNI7|5x~lxsBC
z%G%}Y++*T=jTW~k)OTaboZ+=nA7E_zIkFlapt?xh@0BY^Z&-y>1@`W>(ohJW$fuVWM3taAh|l!BwUqJcS49j+Y;D`HGQ{i#sp%<{2n?#3;aeUao`I4r;ey
z$WIuQ;)7?Ecl&UFo|1`J{r>akPhLNM>CNNM|HAiguV1YdHT>SY`_F&x{`T<^3D!jN
zma(^jjOlM(Qy76P1hB<7H=x_kQ`>mQ4;t_HyuQub6|Y~d`|$hE{lyQSKe@$k`z^oX
z*ZuAP)8F%t{Knt+FaD{Y{j>j{$J_0jzwCz}9@ZD{KA$nW+?uSmn=VhM0>A|}2BTG6
z)95%Qlt~mk1&=#h9CeRV%z5X-Qw*N{FsgqBst>e-eRMo^tVfzJ;4scGHhBko5I9!D
z8HYn)Z61Ppol4~w=?*-$qr}(+<5bFp4r3xSV&lKCI*q#tqwl%oR0zb;3X=%Fl)p}h
zQx;0X;B^{509^cq;bDb1
zfnq<>*q@@g@ev0uSv|`~?))5#N&^?l$JXB(&;g|OR`J7u7qku;Q&;lg@yQZf4$QbO%#hBWRm&ENZ^moNG`e@{k^TS1_TQdm39Fs8(^VOl`^t*%gj-ou@6;
z+di2=cni-fr=!66S{g~P(L{z=x@YR{F{ylWgbYFBAYJCB7Zv%+=-f4M3}RtkKU;-)
z9Dql%T$~Oz41LV;j_Sg$(xyaj?|?yvGzB|
zdA~Z*78ydl#LH+j&b}|9T&IZ5%-W5>RL?Z+0n>DkDr*;w=T8JvojoNZY(Q@Ctg4ka
zWeyQ0hjm3pxRaK2L4{!F?RMo7U#%%dYD-P1A49KOR&{Uf5R-{{M6B-C+{S}DK>D{x
z2AAAQMeV=|vR1^5*6}F`y`U(%p#D;a5T)URJWd1*`6XhlNS9nm(KVTjv;#qqE7pD2
zE%~c{`6nO0iM@A*H6^~eK2WEkIp()|nW_#lJ;rqCQIIW><;cERjHv=a&-$DfDV9x
zV}*{MSR8Fq9ju3#p6N1-!K1D`k_0AsJZ5@k?=DURGgGW!m6R5Q&yWR1mZ
zhKx*WRVPuMl}Z4NKy$x=;_Rxyh>I%~2j+0gR@d0riM>l}n`Tf`VaYdW+*jR&2gQl0hKEW5U`5V7bOD_I
zh^m?vgV=Gos;&Ew3N#4&z6s4W>p>VUweedfkq5j>28L?d$8g;-l7$9;O)wGFUArO^
z$=+(6M8OKL?J;>Qh23bvKsgD!nCt5c^+C#lkt_D|hH|%z<&(V?$2wPPy|BRWmO8p8
zS5(i83WkF&jbJ`iPC%e{D>z4D-)B8!*H#^gF|(RYd8#v6_Y&wOKZ9JW?^|&I-W(9M
z3&CJ8vG=SSFxa~&)q@13)#C-dR}P@ho`9tA@-t!d2sv#5OTz)xTG%R3S_W^icMWYE
zpaIWP1$G)ZYYkTLlo*2JT?Ua65nzo-VliWlx(8FG$W3-^7#ZW%Ww1H
zZ9d=UNs6gJ4pfQ`*gy#@G3Rd3Xo=bg3>uRau6;1~!sj_}Z+!C*A3t%|{Nnrl*%$Y(
ze*ExH{C9u+@BQ&#`6vF=Z~fQDZAfBrxG(pNtH%GbYsf8Ouke?AROjks{2D026z!S
z4o^x#P+_cOxb}nv15HZ7T?8L%2n%!~LT=}j079unqnDXsdQ2kD(S%&YY=k?r
zMTpa=tKB+`_f}GjnA3qYsR1lYWaHBgc&bLgLB$j(dgQ<>D_Ku*&XjsA%|@LTPd6yi
zX9!gWEPD_dqq9QK8D{7#Z_gF+1UX*eexA9=MYm_7&$yQc$@U@HradxV4K8RNkz
z2CqvvQv!T$D;V5+nwXkk?%r;br!19t>Ddn;a?1Xirr=Cqsf^QsXkNc8h%vCzja+^N
zJ+Rx00EvW^?Q%GhibHjelVUK&Co-T#f6{=79M=~(4c|;csFgscqp*J&MRF`?)a&CJ
zfbc_Bn0KF?K?l`f)C?*jMsAaHW|=26IG*WLwSK{=@aMdZgW`SI3c{;IE_6W^p#AAV
z&r9RLclL0STLJv#J(+dzyXRa1h>R|@h=Ox-FNvl}|w^FEkx3Cf)
z8}YPwI1|U?-E;~S4j5pnIvJ3JGgmUl?zlEn()S&BAwk}I<%?58mWMVVu*ONH;ilOCvZ;P
z1_paKfVCpTvFQP55nxx>ga$`7SCo};Rj#o2m4eIe9izQ3``(dJJz+;7r4_cVlF&W(
z=Uyv;+FE8q)V*RIm7SXKX?q=qKxkA=46Uha3Hg*KPA@I<-a$(vCk;w>#5xpEB^4!3
z0=VzepVS)??qR`d`A*mF)2_4bb(Zlu#wy_sP&F&bz}_2Vq(p?Sio06##2FW9Ek@#u
z%Y`ZFS|sETtj}BWUgL#^=q`@QM?6o8<+_A3+G3!W-eNJx
z*O!>x#gt*5xpODHXz-@aXRb4?vHKBpKq{y5#-rm|RkjN6yF6FUvN$q>bw;$^l}w19
z9p)WG#J+ENMP@F5gRbseH_SP8)wN}djVfr%8U~^bPmczz{)EPZb61V%8BCEaWfow~
z7%*N5!`c;*`@SPNaj+XHKUaz&;#PvJd&$0|o;M@N(G}=D2+iMO&{GUv_^uW;Pew?7
zPQUA*j*uE!96arVCT*sf+0}uFTsJ_+{S28)r?WNRAr^BmkA`Zt=
zPPP=k234YwyR;mPjMmhe#38)pEh7cpV#um~_ilfo?H6DWx5VpL@#^h*dWgrTdGi<#
zD{d>+4Y!3CBa4~o*-rL6hmsLEjymUmKOr>aHHFb+6oZSXxT{aig7)%h$e#LQKh3FD
zZQ3vw*Hl%3{7X^WJ;^@s_!Wc)M@9hwF=|DuLYY0V3C-9n!Vb&^{@vbg?KJHONYn?Q
zx&|}aiB)y4CUJj%|I*u6k88gB3qOc_cz9exe(#It@BZNS=JC}l;=U(>8JKN6aSp3}
zX7;`02i?=N8zZY|2CzkEx@mJV_i*p|e9zlQzP|CseBSxr{9rHMfB82*{h$BOe)6~f
zeZS@p{o#M}_y2)E^_TwhzxcJUef9N6pFY3;;@$htuY@j0mjGk5o!%oOv29%*IPZfV
z6>-?8Q>Y9qbHhRD=szD!Pz6bA0qh|c=;COiTQ<~%$OjoYGhNkEirL%D^B9=fNU^%6
z8(ivePR+%msGU;|a$skp!!qXJGA7_vx?c`27(1kUT6NqyM3WRH3ILilCF-oP!UMeN
z>*;I{L{bMhrd5*i@}HWuVj7JecnPQa3mWYe>p}VuK;_!YA-1AbOa+`qw7L)SBTG5+
zgKAvvPPO|5(mhtc@8U&Bu$W{8n9K~ay0u2?fc%yfEAd)#9|Mf2|g_z5sMs1}rN`c)a39HL>
zY8A>{K+P49abYx=6XsgGno5APVEjIDi?W#jCFVY)HU~vqVA#px!e79co|LcN48iHH
zp0#e_CV~X2J7dim*U7WOb#)Ns$=?c2&$=Mk)7&E?WK0rq{Gf-BwGSY6onEwVtnMd>
z+lm=hchHAK0wO~bz7X(p&v=m#^EB88O3alei>tOifr8ic$q>rm@&cwogh3PNF5yPw
zzsa%Op$A&iqHpci&JfA;HK7IcX9j*V0-tceARQX<&{W#Z@qF{^Q_0RtV|lP8&jFL8
zWc`9vc;BkYL6`5D-_SLC(=+UAyB@t=%FmVnt@$3D)>qx^Q7c14&2d}Ks>!9D3c|XP
zM=l5qT2sekdcc9X7eXJ@EmN-A=7b1g&lKxc^@a85xa8;3If!r`86t0JkaBLA9|24~
zVyLe;qxjRiUSQxvTYxww@0fu&&>~+MEcx&$1zs0ejFb*$&7?FNF2{6qnzRh{f>8)Y
zx*3>o{gzT;GxQz^Y*{pqJqKlJ5C2rRMS&=L6h{-^nQ!Cqkvrz4#~
zxAA~7)K3}M1-u9%o$5jX!P>PR(llK^D2+eoLV(UX
zlc?G~fOZ-J*E)v52qZ>%ij$
zrPMZlDk9XdYpN%cJ>vaqr0;)*$PRwPMU?8vtu97r`UjD)CUHVx2C~T{Nm&(~ovABrv_3
zHqFKuiq+6G?t33-0+wxXraG1(HD*jB7eNX#2zuc1`1r8zTjTx6bXz3TkwCZXWN{{h
zqvsz+V
zCW0tOZ}kmjoSOI$e4GLCe6N*~EV-h^X)W~pB3Y$vW?UXA*dwR9vBk}%z%T$D2IF3}
zd$(zZsH(?@^`(y=|FggTgU63P;w=G8_0NCr-KTFK)>EQzi<9+vQlt7Vl}OD}UaFqq
zQnd*~b-kNF^eke7eaC&~^Tfvw>-7^JlJ9E%f8T%iF!*o%ZQuAm{%`+>Kl$5!!yowR
zpZ$OQiJ$%X@BF2&ef_I%K6?B9-50&@Aeq@+-C(Q`^G_*~rn7)vC1_=9S5wSvdaGae
zoP?`NNwYXrIL8x6d5o?Wz`tdGsGdOk2+i#7K|pAof!fp32so$fp2%cKmYKq14)%|L
z-S7na#EdDmHp*P~4u#ucmDzAvcTNV?Tg*hPuC3sTF@w5~HyGVl>1b8AN;Fb#o9m@D7l0$o;w|4sMw-!;sWbbI_+Mwk6nxr?+Yk9
z6G-n})5x)dD{^`!>`S5r70^=7qs=lZEN~NUL0WSYjKt0q6|J?O+!9mIKIaIN&v4&~
z&GXWv;Rrn`x6Ph(ovKC%)fulTl4_K9@F?W#|v5p!7xI9OagqNyfx^=
zk~u7(^D>Sfnr_nQQtm-$e}MjMPt$f0A|Cj>b~l(FvY+Rr5HC%dx{TJ+q$3s634#>H
zri?)QL=WCSrlpTMA{W7NHKNpJ5q}HSXDTr2Y@q3$5T$tfKpLU$R8Imu<__T!PPj3G
z?~5NJ)i0`tKK1!bpO$XUjZgv`>!w61a$E0_b)RXBO0~?TZ>zi;5p&=n*fzk;QTux_
zBF`i8SN7!gTwzgFaXPGsG>CPW?u;A=OEWwCWG<1l#QhMe(J#O!++Lp%I3uRL3->aKwOq=5L^HyI;Vue6_WL_m
zewvYaeEGvv^buJ*f+^Jz6#pW~ckk<0|MD;W&{yC1u6xq{A?!J$8gN`LC~vl3fa^kq
zJR$wDy&EK(nLIK-MZ}pj^mNXE#Et&&y$c7G$Q8Y-
zF%jH7BTSvBU9KGIXUp&$4Av!*@aDz=yG|P6L4gR5j7Cdh{Qx6L`>06-k3!a*v`E(W(e0Y&=e;t_X|8+7zlH2)jy+qv+$9%ZSS*
z_pZ4Z9_GOWXQ(rf+93yFu=56s|&8sKAezo4bj#rQI>c&@(al6Is1`&P7P2S8*?P<($VRd>^9(A>;G4-fs|Mkf%Yr=0{RF0`dcqDVGNPkI
z(GnWSvc&KouxnsDE;(Qfh=bs8vLg-9xhas~^Aq
zxxf0|?|=UXw}-VBLH^?B&%gNDe)W(P@l-jjucm)SPLo6rdQVS*lLFe}fa%StieM)D
zc{1Zh)_r#2x#!K|+Xue6#rx-ZxA9;7()*7e)<5tQf7_4$`fvZkzw5{Uxj*=)e&)~q
z+pnJTE8qBP+#c@F@AhoazN~I@q%eZ*U)_z^k*uMvN$`YM@@CbwxUx@Z0$>iw1@-$7
zU!caRT+ze4CNVZu2?+mkt)?G&F$Go486p9gX91`_hQhcCx2ug15l;D16w<@7nowQQLG4QQ%*kccOHrcK-@%aQg*$U2Lg#gT@ODIW6muXKS)*Ka6@CyV
zV1#9a>&$5&51PjhkuDr-0-`;wz=^xLiOByo(XfLW*W*Cbb)
zk$nc>L5tV8_gT{N!F3iRTLrjOQk#LZwA#k_a|F9?tH!3U2kOCjPiSxjdDI00gp~Qh
z|4==1&yh>v!~dAg3lfnjxD6MCLR=|SrSC)tQWXZ$pdDW>KG7J?F{Odx1*(4?9Pr9}
zl$_PY%INM*f=n==0r`0m5km>5#eOPlscEENKg1Wou*bno;<~J)oJYG4X5qP?I_lOp
z(h)uSq!87J;D=qbheF*ME9v7ukfDx8wA0OufcM>3w{`;Qu0kwsB12#d!|Ox(RC^Rd
zK$y_9kESqUpD71JPw1o??{oh$V^@hZJOzeq36?3_)&`s#6E5UvApffu9SCgFHWZm>?%m#6={Rdbzq#@U5!4S1w|QV---kjO
z%7v+{efBA7BY1yb3^M&}tsm(@B2JpQt++q$+Qml^#hZ)R%#6&~yWzGdr+1I;KO+#4
zlVq}X>DZ{f)@b5tsHQq^OFPYaItBe5Xn=i!P0#I?r-Yu7&GPoxOLwNu=8t_heh$3O8Fg#>L<`TRqhT9}A2lb|KRRy&(6!3$9uw(u(w;*0G$<#*fjnDF(HG
zhu~1_l#c8hJ?
z$Egh39Jtg>vbQ=%-qxBy)$Z=Kvb2UILtN?1kh)k`UDHv0$KXl*2jgv9q(C;p?x2I0
zb+pJSAl5D9eWh|X()*LN)96T*sE0qAB$S6Qn90OU?2^EY3`IDZ(djWwtdxmvFf+3D
z-qp9Yaz)j2&sste%_Qf+eIsaCFttiKs{8qU-S4BhI)Gc^>46`=;j71ox3AZmC%%4+
zhg&>8@OI83Y-CqgO$37oV(*R!o|RV{$Y`fUOHGsu?a4FEOs-p0&HY}Z
z?TDTWdQOdlrwbwzScCIXf`LHowiC~(FEK+RBWs$nZX&wsnb|erojR%Xa7u8jc^jc
z^-IyS@An}X-Mh$P-%nGL6yFVspmmBMp}RBfrI?;tU!t>igROd%ZbroR6XUHf4(uE;
z9cK`nX5+FM>$7p~bVHWQ9crjKlP|y2_R!&&33$WK}Cb>N}O-qX2#PS=}w!f-I_e+qen@scq&OPh)`w8
zNH_X|J4LT(bDL}dr3Rl20m1WOLuu&PpHtI|X_NO{XJ&v($*pVkio
zpmMSBGRrl4z}g0lZRfC1^7K*s00Qtcxmt%Kc)36_flV$
zw$g>mRTrLtiE@EEH?^1gA8tFY$`YDQQRgu^S7>u`j6mB(Eh4hIR2fJ+%d6CFFqmif
zbb2IQR0Q}P+g?QGWH2`bmOrqo<%a;z8dc2)y9rE9CwQ?TPQ{N45jA#Z3(6L9z?pvW
zm{mL8O{AbiU2utB(6my((^s`&)=wXV(>Mm4gQhiqVA6DCpbu>3A?8%?jOG4pEM~Zh
z`jM(uH2~w_AKhpaG`_=`k>hgR8~Ns)+U3A*=i1|1UgX|Dr=>m+rcwlmJkSDPwun)S
zKo1cJYN{32dG>q`&niCzdSurbhd~bGwFj&@n97IvZ=?e2RwTq=C
z5UsrtP9(_B4f_Drn_UUD=mnCNJa^klW`n_iQ1K!Jm`gB*DEUddMH9g
z=yvHqsO2UqA`nRR3_itS;(*Se51xcIO(rrGR^(EP2%jBF&=Le9^WL~+{>Tr%dh>{V
z7gC57=fWS92R@J<$Lpk~MoEK6Y=Qs6fQB<8E0^0Xy2OC>NV&Cs<2*@8L{xTbjbyHv
z@=(QP*F4vH
zNFq!-EGd=+Slj3q+Mk3VJ0kD4vyx^DEn7552~teCVV_3QwHv(7d)U<+vr$Ck7I3CX
zGBNF)@)HBwT%S~Yq&Hd|
z(j3-qCP&(FoHQnTuv52bc!hvO6jUXxzEK>pp_E$ERnDNyuTIQd0@rEQw8$4VbFW$Y
z&Q1c;TYYJ%)9c;d7dn%6_nLr23W}(nDU6Z<nO?Vb
zYA=P;o(>^Xb3#GS>|OO<Rvy!kvFla4
zOwnoL(5z1v$LHkef487Eh%u6-KzbZ?0+_9>CWDLtS=wYPHuYdP&fFR*ROVRSRE@gU
z*&U9nhGeEu{$Sj@4mybGgZdHsUQ+vGrgl#tyr>*2gW#?ML-bT3zzE(RQbhV&hDhL;
zWAv#mNTmbWS~|V*0z9pU?>YQ6T8y)%?mg3ytX#Ej3hLC22`9#SXkN=)ofXF6H{YYK!gFKq>4HmaBr@K?D>4-{l?Sg
z>j%7f%vUq-r~l^X_l4(Q@$FCk+28xSe*1st*Zlr}`QQAP{-r)#Ydjfjn{0RynI!#
z8hIUhuSsR@gf3X$AIe_ob7C;AT9{WCf+HTN+6=C>z`!Z-1HrYlS2tYiLOUqblB*hm
z83Ypym=^6QIW+tI^hl-jVSr}Fq$Fb~0FHEED)QQcU}1t_a2#^4nz7K?B{^|r1Xs^B
zOx2TwMUvf9$%N6=IUNbdD}*J(v1^V$mJ%8XHIt*TC%Yzi>gX=fdR3B;B^_WcC2+N80k|=o
z540aViD9gfCeQS>n`A=tT?SDH_;GXA#u`;O@FbL~8oLeiwGN7Fy#O6{v|
zX#Cg*bPxA(Ql$TZ=WpnX|_khSm=Nc1;c)MlML_!V#tY
zq9Q@{icocBNW+s24I!tyz@zm5p)17?XR
zAHpJxZRy?3X-i-{40G8;3q9%%Ca%%m3;~nn4&nQ}lnLz$18t5EMBcg^lGM4BG+IIO
z`1`pY5-z!?BzwvA5R5@dWSr;W&qSD@b{G|rKyZSQ3X5S@qTcijky>FG@!7k2^XB14
zzVQH{4uw(*(z!6X^Tu@rc)jWq`4lo42e48J>T}2|rVD=8yV4EUsknlF*8zWA)SbYo
zL`F_e-St~%4h{a;;RsYjb;n8)b#E|k4`SA-f}x>T{|IA1RTDf$b$;vZ-MmcN&k!WX
zorT`7=2TMi=NzrW3iNJ}>z32Qz
zdEa{^L)$H`ORlJ0RXCy}k)dq$Pjc_=x!;TnQ{M>&oE|i?I3zs+z3&}~wNeeg%BeW|
z1dXbK@YbB^bMwvqYHLQsk8Pq=14M=?Z09)XVA{pHL84qB#B{G)5~(g_W^xX>Mtz-@
z26bnq@G`Nr^MOFz@0)D-;_4p4lRX{P0YvPN>7dyFs47Mftey-8wFXxIjG_`S^o3g8
zY_8n9q$5Q{RcR6Bi0NaBna2m2v{}@N@Br>zi@4p^Zi^}aw#@C52IiZvZePuL-_{bR
zSN%gHday1t;U1FfcB|b+s6CGj0#&WXZ|{8pxGHeZ7V9)fFZETfe%=U8%adlD+1~du
zd(?Kbw1p}pGRjCTH%bzNU8BV#?E*&*$
zPo~3aCiZ5}oXjN$;|aMw*X$Yqw_9jD-azEx0Jo2sR_qG(Q$@bJt?UU~NY?I16M4F%
z{{TiJ6vjiQT@F6T=6>R
z)zf;weE(hlm*0E;hVys*`XByvfBXOF_x$eP^e_IQpZODi;@|xFzxkKH_3dwc^vRds
zfAQJ#yJ_;|Y??d6{fdC8rTpemSv96O&0|iwNv>FWq=x?Nz9~`e1#jzb1E<-Mi2bD(
zIuymZARHb1KG0WwoGH^qY%ox03azj_S+uD5x}E9yG>Op|yz`fDC^I*ICvSR9F{
zdqkQId&T+p4v!5V0LZz@70Xo(t6m{U1;?QU$&@_g;AmGf4o*g_@nY^USJ6&UOpk?L
zifNotE@r$`NDmHvcJi&A5v`z)?Z1ytoN7y(FcJ35)91Gyc20M7$fqw=o{xy02yk+m
z0P1B2(-9k8A3VSwHrj}szR%&0oPJEjm$_GcLOcec^M+F5IJKs#8+~z4Cxkooz@ui<
zO>wGMtE7&*^%tIbW|m%v~<}+ZCAto>Zb|sWmv&|?Yx|N*I)J&8t74|GXrgT)gE^m`pC|#-6gCrJi$Hx$KXfVkL6%aBfGv#roAfzFO15=gDrpR
zh;w14Xr8bD29;ve`)CQ%1Au&2uAYiE0kVn$<0+lOq(h%5aMJ?>qh|z8V`f^sN{jIe
zb6YFGdu=`BcFl{bM$+;Lacrc#WptN1UBMmGIyT5$!>JZ2t}{|l7C-3rgP2pt^QfS-
z`DNv5cTuBt4pM}li{cc+p{|}DodjB#j=Z^u80obqPUA{O=KAahKlqVvz4?)^z5*cY
z*P{dVNi;;kv%+h->O)6RT*a|IO~|)QgLA8y
zuo>X>?EAK4r!k|3VIOdGX5TlqAIzA%G1skBJxYq>M*vkNKB2~&EnLe%8mB3i2BU00
z>X~O%Pk1}i;ABEIj&0X&VLA}70-J@xVkN!zZlz!y(Yt1n35=-GnkttrR@cZbt;ZH8
z=feOv#G4XTv3Jk`H0N@
zysP@*wlL@|NI1IM>vu<|sH^U=Vy*0+B)hw&BcfpdktZWuSrdn;ON%o@wt@`9zXK8W
zkeWvY3mpS$pHKkq697;;`L0pV-#y|y$-KBEFb?#wa@A3(s@rYdF|uEJ|9pRZxb1s0
zn74%Str-c=4r5KgL?o;3d+&#bThH8|H?IPyFb0c!>Itk2kK194H)pV+W2Smih`>eMjV3JIo6JccJM-
zfa~BNCW`*EXWGGm0>TH{j5PyI?DYe&Yg`_4x^X{u6N8DF0wB|7RF!s00bGk+m}onLGGuB>@6yj>9v^0N6{Edbhy>q1SI^v*91|QS#R;>Vf!Nh@%JIFRvaZkA*hj5Y
z<%lpp+Pe;|`!axS5-hnQb`@qKc)!;tuWn!d_|;$g-n+f4S0dux^WE>i|H{XYe87W*
zBy^D?#~_7B*@$QuHG8j>fJhdyhoEX*l7qhQW?&^|_be>{b$9UDyS`_x;=dJm;La=;0O0R
zK>Iqt1}t?_dl-s5iF+Ugte2C)qpZM`(GF){y{oW6QmCyDQk{i2Ulq{Qy%$T{d0^KIj9E4G?O^5QC09jJEAVp=2aal1Q<0Bt2zf7
zy0&1D)@b4|^6h8nA8vApc%&LuKnTeC>Cg}oD38Zw-YX1`m*<=AzQ}=OV9E}Lr{L4C
zkuRk1hzMe|MZNW9!z)i4nh?fBv(@>h(H?ifZMSAPb6>Z4$fO+ed^BIMs6KnKp#T_h
zkY~=hHM`pJNh$!N0*2f5&mHav64ga**V8H?i0P#NlHJ|Ysr{aF5UVSqpTH3jHS(Pg
zSYjvECN;s*YN8q`)2s&rUt*%QULm6b43OP6VUzw_eQd;$NFV4*>5>O==CzbHMRK`%
zr(}lg>>Hs4l~cjn(gRmU<2mm908+~2kYT=DL`KHD`~GD={Lv46?Ul~F5hwDv(7802
zzGm4MD}YSpt`=iLyFm3<s|GlTD+
z_jIon5mdzwOzrZ83K4EclbM;Gi9B|yNKmtakZURqhe#`GZaJfk
zlsP9kIJ0Izrkzr7-8*h60}RE2P@J%73L|3M>u5AlbXc3QQN7N#7}T7MY?FmFdxQj{
zN~gwk!|SDKCb>HnoubH`nfra~ceAWLS)S-$L0TY~Tu1$FD{Io9UV$$@VrK3e)t5J}OGNHS4yigBVMjIWw8j9o@Zm
zXEOW`0DZY>M>qD#;eD?
z-Qt#T=__PrfJTiqhmLGI>=|bupvL1ms(7h#0u5A)?W7Fu{%LU5k^vZ0k4+&Bm%E=n
z6&DHY0_0yX+&vR$CEKu}(ZN+ig5ln%M(;8neqe6eqtzH+F59Z^yZeod=t5-FE}^t>
z=bXD>WcP4FR6@ydCdIE
z+t+{P7k}}Kch8Tv6~P*O|MTb1-uL4zs}bp;3Y!tbBZsf5SP`*$*U9YOIT3F4)59f
zNvS+KTV0Ryd5%PII!@_6=WF$hdcCxuCUAJ02g|H+`9H2AOvzVm5Yy6Uoeqf8GbZ>6&AGUS5(!L
zJxKvZ10WN}G+|UxM8wK9faF5rPj;)e|KQ1LMszM2I5i!jJsa;L&!k+v#KpaG`moL>
zD7Q2wht<1#lj|T*W}ct_oLW}@-J#i)`1lBr*S|X6UjXI*FTKM+T1408@_!8%+J~_3
zuY6i&V=#bx#@KqNGf0t!^mWJ}cgyS+@YcTWe`Oz&OlSDlzfrKh!YoZe#)ZWaBg;Rb
zW~w@xL6vqY7v(nG-Ikc*(p765uZuTw@}jA&UN7i+whpr
zn@a;d^OuPkf!cfIPotX+8empRsH)6mvCQ$=;_PU|it=@_ffD+f5D
zQ6;BYyF63@BcpfiE@*k(0K=M!$nhbcQ*ijz95BOx=M1`v3>AJ1s)CaKQwgs@4P=9a
z)Wz)DK<3Igb9n3Eb1nCPcAcq+__1%l{n97VRq3@sAO}bGaLN$fIs;8t5LDNrh9tpa2vNbenK4#n~7!mfrws5q+`UEVJrQY%HYLX@7@#Q_%px`p}!-TN-b
zi?IX83`TlIP#&R-s-7torQKylz!+2T7L8N0R+jI|b~tAtdp+NBi>jEL+hiOPR1N@(EYeVt)o~5hp&LzjqCNTxCmf+9ZD{G-RE%gEKPuByaans
zF4eO7u`|HlHG|vAt3E)3soy2=8$2|^5n6k2C!2yqOnW3AQ#Et^mhgc;3a%!3Buwt{*r
zp+XT-*fQ*J>!qn7g9t(+&+=*)%+&66^RSEL{oW4`H)144rI6|JV?0-w%5f11@~&mP
zcJeUNHG@nJC?Pzgrs)o?8tB1Hnp~hA>)0NM$LXL{u!relBL>f-WcticPuBrc_v3$}S-TJ=dB1PVQMI)Fpv1iW5CM+nWM69#~;7lo>qT90{s
zYCLLBmG9=R;Za`pMl28q_8oMMSyU7dr|{jb(t7~zE#FeipfDsg7^&U9+C7oXjPX9L
zK%0L7t94X+9Q@H~8dql4N^x<48OqcuS}#~;>ON`U8KWRSa0nK$U_4DPB=-#k7f
zKKtz5M{i!ot_Xf{zkmO;_n*9Zy=!jC03r}=wP%J}qd^Z-2HcLR5p4UA&h#LIXQu&d
zs%(_S`zVSL6mPVre`(KWflnUz=3#xb@NUmv`QG#6>>vBlFaNXu%0B1I?*B_W_QowPGYX&5F>bNt&!_}>R
zNMIuaT1>fB($7ml={8PWOC9})Yhl#Uu#zh7s8{2W_yN#xAV3Iebq3e1JV5zH!B8EF
zqfb_19(8?gph-Cfy9=^*&8y4o+b7PVDRt=H2Ho1_m3BG+nB6J^bnH|fkgO{0igWkT
z9d>t^8QZw19cam_aecz;Ft>_N(Y8balaC`Pil4Dv)fi{7>xZKt{aYTrl3Myc1WZL0
zjbZ29ct;5^fFx_|*?Y~RgrEfKu%Ax#uioPV(;+v(h?i{mLKbmx&SNZJ)iUhG%rA(G#;|alm~^2(D3x92j}l-{YZh`2nlrN5$s4s>i{g9(NO`ITW2O{WyL+_8RB*7&
z5j0IzUpv|xEQ#qs^$$PWBrYuq2>aIvEFT?#`y=
z4=E;OouRi$eKi+VqK37^paj>gQ>Kj|2^7%C_1Gu8T;Q>3D25R*ie#mn!je!DU;7jwhZ5;S(+ts)
z71NIf%*R7#TyCOzK4C|wF@N9#3YgrIGSNk5YEi0_8?dph3yICCG>ZyUO
ztaHrbAp!Cf;y4j-NE*iGIW}?JYeTnJkXn$Df<-06(|MO#DJdV40e5Y#ym6@mzuj){
zpZAyEJpI@&d$Wjp4FL^s4!RLANe0xU2p4+b66po>Q{9kq!1h{&>l+DLji7F1o1U(q
zjzgUDSrR%bQjuQ06xVL1)IJ0N?0b`QyG5PfG8W9rwe^?@=tl8eN=?;f#^xxKnPgOV
zonTaRtT3Vjq2Ez#+
zHf*y-HZ}dzv`7`QhWIhn)5le~jZ)%;P%tmSjY6H|CN0`|2brl&mF^*Yd3%_~@Xn<>
z{1ZhCMUn$>owM>1hV@G?uOmgmIV=&y+J-i*b!NI(v=t`+x6KUhdnbZPf@`f(IJD$h
ztQ=-WH&rZvnr3JQcI7q1QcchvZG7ndq17Ww2ujjcY?zh~D21Pe6Trct^xE^Fdowke
zDTq=9@$?{(5I|rCsDg*!A&DNV0YdWEEgD6>q)x3sN6)SrOlYT~k$wy?4XtUdJzdQV
zjpd>8WDuHa62XvtD={4I?)UF^)l?IEkc^mzhj{xcUcXsyp7Qk*UOn>ZA)g-e@e%3b
z4menK?eo8n>8a|bNNp;D(Lv*q!%)(^iWyxpy*}k|LFJyM7&2|g1i_<+9Kb%=s+_^u
z_Jv~!xM>VfJ=MG|wXZ&dCnLm`$&$GxsP6qN?f@`E2C5~NmDRK6LfvdkDzutS%8+A|
z_ICGd)2?w@02oxMIahB^=sP!KuI^nUe|8U-ba5n)XedZghT?_HK{B19PAvsr*)cU2d+f43-bh;oB$>o-MdZ=XfYef
zT}={+s>&5dgQ>UBI4W)em<~DT?pa_AHo1E~Z@zhmrzbolzPRHr{=(-^z;FDuKm2R{
z5C7!v{vE&hr~crd{o{Y^-}w2T|AlXS^P8_fdi#8TzKf@harM!96yVAjj`)snlACD{
zw?@<|y8)aE@T&Gn@TziOx*h?F*M3x|lh9&S#llPyafv(JVEKC`|neo2VFp?FE4H1;V8)+3Wj%7EADG=UTsUHzU2d6rGw)_)GmEz`y9W>e%=!}TK
zPM;KL>$yKE(EU6>dJExFW|4cEoy05gG|$SjQe%rq3Tx7
zPjCm}6O0p24Vjz~H(CK%nbEWBVE1(Q;)-L6sY+2NCnKdK)#>mNI_HqVU1t{0X)_~u
zMG4mjj3sJK=9+^*yGFrSCf-dugF*G&%w#T_@YaKs8D)(&ddktvA6C-~zHqu#+ePS-
z0vGzK>{PjK)wSz>TaSQNLy%t0XB5^LnDuc3F&M^GwQGxMDFyU>PlpThHT?c3uFm}Y
zq4vj?f~O-+{c5R(;+(z+sj&f0HRIFjf%M4{qU#Phd|5FhA3scM-%T*WwuppAkyj9z
z;nAJy>E&>u+Tf}6rQMW)A$MsvS_0{{tIq5kQJ5NCm1|8`&5W0i$||*MW_FPwm6rhk
zQsm_l+W|fi>KlWx))F3%VJ7R$btRC?%eF84Le-5@cFX!=UQjO?}U&58Z
z&?9Sl9g*&d>RLU3ms?|N*47-1AO8ZXrLDmJ;Rx{i^eZSATtvM4L
z84l}@54GFRWH~?6ncj^Qpa9NsLK1G`!!IdN^i*woIM1O!%v`fmpKo|MDrrwUi%lZX
zU4%T{{X+obdbtwd-i@Q~o>J45MOh|;Qa$zMc>@fU{2+|SfQVuS2Q2Tz_WG`#@upKH
zuu`rJy0g;vvM>gLsY&p*^7($B=`MEJ=cDH=z&aU>N%2Cvhmj2ZR*yTnkmrlH3gU5{
zj+SA9s8Fme;`<2Z;4yD!aMz)qc>Z$DlJz`0a-mV)r(rXQsva8|j3X@_4Cq>Hj>=1!
zH!)~?1kM3R%*EJyA5=x%HoE0#B}<-&V0mB>!L(i*WH@oF24gg_6jdTaysQrQ{Axc!3up8xQW>~Lgz
zbLK^2xT#|8Q?7JRc)<>OW|x?mk--}5I*AE9lTyqaD^+fO8P&4s4j7WqgPOG_hCPFp>>1D!RH>lVqFYHZ(_Zw_202(Y8Wu%j*RcQ`
zX_c>4H_&#XGxJfcHYXNMZ-cD5sH&VY$wb|U=^sdjex8t70p)`Jv>?ztH_Tem&z)oh
zp6|UPUftp=AHVr;KKt(bckf?6Es;pS|L*y-clGA&tqQjz#)?2~z`{yQi;@~+SoNT0
z!NV4r4>l*C$xbu%pt>Uvh(@tk#T61Kv4D5gPtW-1F+O@7Pb)sZ_kZ>aUwpFSANq;E
zLfNW~jFXJvbx1X<7H!$6Fmgr48x0
z#C23~RwY(E=H!vt)mESE8Q{!m$?j{VoT$>asyVA3XFP##V>7DF;`m>=l?&VB3c(E(
zX6iU}_4IjQ5y_AlI6HX!)B^Nj!$8QwX^(uxIqVbEWDwYK4Abc=4m$2+RLfvc|j?z6OC(JCPqFY<&p1rle0pu
z3;EW9?|FG94ZUO0ou+LJ-VL|<9-I#Bp6E7gCan4ijWz;oE%ZaS1u5Rg_x4piqP_trhps*-4{eJVr^$0H@aG&)=tFXp1AMYE
z(bohI=LVkEi>M3BF{#?FMIQ14h=epP<`(NrD~(DMrk|sR<5Sz^!oa}V|f_lRG~Jt&0oFNKh7L$bzRUt-$l1T
z2;>Rtdh!)3Fum)rZ*iuRSA=K40-KmaPghTZkyt|_`4_B-0@o07uz+H{K3{SMvU*)B
zH5^v!D)wMEy0IQI)=fp3WW5C6-{(tTdiAA`AAuguiG>rI60k9pa&iFU=eX20G+y|E
z1)~Skz0wO>{14j{EG-_GVI(lvyRX@f;=`ODG%YN^xII|CCsqtGcX8&YyYrSUKU=v$
zhgppJpf$uyq^M1Ei&K3a!lw=-Nv)72CGfjUM?7k%UBcvo94*Y~i=ZJAmcp){i4x@S
zg$3lMTXW{#)JHUvNa=Ge)m8e9>Xv&S3&D)KH*fUHnGzrS6WQ_6LZ9
z5uSd_R^HmG44VLl3b;866>{Y&)bY~uD?8I|Oxv^lrmf30FNP7r%ST*UHO%2}HQuh7
zz?q3-mVUaJkq4U|#mX#?MDjS^ojszQh^0xzy>?aWU*WWcdbnDZuuB3`pb^O^M<+QV
zXKInAt}|Z_OY;+$kR2s*~dcb4|NfGpFti@skaben8#X0cbRhH;yD$)Da
zsLoEWZR0f_QkM~nD1xXO&XhF*I3oi>0>Uk_Bd3l$*u^h{?A>d{t{{TZBv;^TpS*th
zo8No){{7ys;Xbpbcta_$AHMC{9Dg@||E^Stq{@ao35kNNRKK4<*kU4Qlq@4o)=<3II3{;fap_x;*G
z^2h$&pZY_8<}dvF|Iynoee~(qztZdB{``5js+v=sQWE_TCaeF4LymSt{T~08Zx%;I$H-&w!9G5PfYQgzn1q-w=N@y+
z#)!zs>9bxdqN`)s`^xyWZaOefGkP2Z+TlVp%V{hvg9!9lJl=ii89rynE|V_g<EEFem7Qi8<3R_GvWyA!kM=Ou?WDs8@gGke%^jKw~9CF;=)B%JvQt}an1%sCR6k+2*yEg}MNp8a(YC&XD(KNMIa<{#56
z*>hf9Hu&(&1$QV-;{xZ-Srp0}nLtY6qgWu@kg>GE7Ng^mg#HB)u9RW&tmcrWy$_&E
zKBwt=>1;9GF_uP%+F-K_SwN`V7nj*h5j0=jTLl@l$K!bLXnji`W}v%;mX2jS6*1uF
zbUd(77a|8p5R5wDoW2_E
zh=EwC5H9h(Ay&+EWF`bzoyEd)IN0X6Wysqw7-~O+PW4E<#~H|nW;}pGb)$Q&n?}Tp
z=t1rJ_7A`Q>Q`^wTR%#5#8n=Wm!}sMC$yJuE^-Tbv?XI;ex{_&TT#31m^uc@&hk}^
z`8c+T@EZ?|hT9U4HX1&Myu7l{i5D0W|E83|2W
z4efKzfDfmBwX~NJ%NknEkO?xQx(BnjeoI_$kjGIeGgoHM)ZU~n$k3w((}^Rvi(SRF
zTp;U;A#w!@)xCE|sPtin#$U5mxb%zg9%;#S?v)u{TP0$2rf~6#_SQ47%_{W#BV+1v
zDD*tH2dK`Kn#uQ=U?|fA6AXjXKBYaAf{nJ&K*t#%x(?B=W}3$y1&u@W9af3rZe7Fy
zy}*d6uI`!6wTu}9WJ(+{4I~(G0Vp!!(h7$<&RC#URcjH;wcfm!=1MdcmpP>WZZ4Q7
zk$J9g031=orCX5#4D$Gx>3RRYyCjq*frke^KJf8jJwC*%SA2TF;|-6uc=Z%d54_z@
z#e|XZ>^?4jxSA^-O$rZ)=4q(q3VN>>s(awt@yO(=1%U1;P$6ggymMeXH_eu{mt6i1
z&s*Yj&^lB1d9u!qNX}Gup4F6iVX1Lub|I`2K;D4zV6ZkD2yw9QjSqP5B&!Ujw+DkW
z;v@%qPjvxAb!tLxtdo`pY4Sga1V9gwFz^C9MhZ9>;UkgZA($!w*E+O%xh71yv)R)Rr+_}5bGCM8_HG-8kueH)SS#K?
zgV-1{i8qn@&EdN@wrL@((u?8
z4NNy>6zkm(=hx9))Ogn9^}J)gVNWJ7;Zdz2OF3$cNkuBLRKSG_U`6}3-&;hC2P#)f
z)HSCAnbQ~PWBcNs>7AOlL3oF=Ax1NM$CFvOXmq%%BhOJ*ogreagj!g!$Rcn?&FOUP
zCRtfn=rB%U?H7_j4U{Yb0)R+&>8jE+m_1O#49p&stF?6~JSCRLW^K!%VI1v;ywfj-
zG6zGK{E)Yk&==7ay1n&1*9{-kiq!n!IwkNd38%hqGqEv!h^7p6dio^QQ&ngn4lpn>
z7dnJz0Fc0K{DS;+84O(7U1bwQh!17e)Py_iQS}4r-1FK4r+*Y?y3NoihTeUPG?5I|
zKY*S`QWh1sc+0$|r9wvZgChXxlBTB5JV_r75n@lNOI9x&Ys^W_ZiV|2maE2h<&rov
zGf@=^Q>V9^BSVUF0cIMRvSKp)=tK_+1||n%4;a4G=%(%;IHgc47?AZy2elrs4HhZ!
z>IaY@yY0$z4g>uarGynU7C!mmd}sEy&EH~%(wHTuaD;XgX-z5`{ad#B8^{}qGbWc+
zN%dn^o)fu1vh#+ROobs8$M%xuxv>J_aA;0C-$%yrvWf_0T8(W)5l4|4C>WH%~n@~@E8>hx#
znV=;dV_45~G`~=tb(DO{+!heIHapz{(bR0oDp{RjKiKdM1`i-gGrMQ(mfYHQ
zd!Lh&sf||hjb!_j2$T^6Q06zIp`~W3_sW~db*2G^7$~{qY$<%?cFWU&2`oi0Z)@3N
zM{d=bGu>JbK0`|D5eHYMqa4HkipQ2EcnSZ&04G-*Yq86mNxu1P%-*wZsZn-D+#&^+
zRL?G;vG=aRVAhQ*`1CqnJ>^HQ^YtU29^>hOPY-ds@!^98^`P>&JDz*KA-pim3A!Tx
z%QJWMK9GYX>`AoxO6L%I0&Vo#>7&oKYl7XFI1oip0~bqQfEje*i1IMNeK!It%`#P?
zucBvwy&Ho_Rv)c_O33c2iA;6&E2E}+kjo^BmKq;tT%%e~N>8PMI`xl%hU}TOGKN*n
z8&V~Z$=`x@s=4e#P`2=_r?C`X+;-u
zVP#nFo#1F*AMzMItSWn-%we`pPi>hV@dKJq4<=)^2uHHEnn4oDT`eRy20ci|BHq8B
zJMnJw^#dOs^W!Ic_BsBGUwHRP_K*La-}v>v_8!!5(p<}0HSnzOtl7XDjn8Wq$
zCDQdFlXxNfAzXKu?Xu8Tq$jF(}Q
z2T_=*X{Ogzs96L6#K5a7C2H$a%n`Xc2lX5CO%u#MDB3&>ty24K;PIv&eiBifUI3r;iT2Yahj{^6y%(yRBh(GEb8^$
z?LnCBWwng3`@@}6ikj5ghcQ_{>nyOU@#-Px=ugnC3xLM
zvFQy_C}sqPT~#80c$ouSh);`*5z?Pws>aNcpDF>!)0T27@_1NCd-#a!
zm}MBNVSo_3n}h1g&@{FWTIR*MGkxCTsZK1ZbL_kD-D7rRGm^PNsw!`vacX*&!-hg6
zXrhjWIeB2(V@4)hGd&a9f!t2z#v1*lCb)D2
zhFqX(b>ag#cX!JY-6LXEvC=x|;&NgdSec2?a5puDiyV@-+wFVbfB*K)!?(Zj#LHmp
zOfarO#E6xEit+OfJDQEIeSlc+XUc4T{N$3ZEF=QHHW2U{UE@!45xp`|ge!uVPow*bRN9r@VS?^(ld{Z^r
zolC+wp0#qZgxDY8q^b`P3(7KWw|tm;Bgop<=DOOWsju4g4^$|9qOK#!97y)48Fn!V
zNEdKTedj1y>Aj?aUm9hWS@d+@q4#ox59a!khu@>BbL_#Ta1k~zKg-6}nrW33A(Fg?
z1D*id21KyzTC1ve-6Mjr>Y(q|3UX%m#8tciV0D4o0pYM*>Rt3BMHFo?Qr!?!jyo}6
z?V83cD_RUn2erO>20nGvSg%Cr?GoF6fY1hrn;Sy4ft|7XK&IWJPJqMO3ZXLxgdu}*
zA&=ssp?a3wHCriH&~2NV;Rry0xfW_N0}wQc+C@;-!~kzAOY?Ma$e!8vu6+VUUe|;1#
zxMC}}DP4H3uHBij41{^Q?t*?s|3t(HG^&wW=Vqy}T?}h0hsTUr#{jwxehion2n$JD
zYYpUiq$NyAkrI1ms#&t|gGiDA8U!)l_^6gtYPLuEdt0sQ0+Wn`Kn>42cM&dnWW63M
zP;=Z9?WWde$w$>-#5s=-Y-LppE3F0Yb+4Kfkq2{RT(0bc7C!V`k}gl5v^PL=>7Z9A
zL^OJKD`4(+{zaR#Io-F2ue^P_<@Y}S{EOGGpMo=p&%U^S_Qmrjk5BLK_~?O|$_~vL
zl}$CCr5*&6X8`ZCRb47`M>P^Sm=MPyQXh_3!#sf9!Yv=AZsoe&*l!fB$dY89(;S)7G%+ckPmVT($6?dCWQ|ze8v=IEI*A!D)Nfb^H=>xCz1R>1
zZBz;6xr1u(<0@h06|dgPCZBVJdzkJr+!ZD(F*vQ3OE-IJdS)_jB)V#}>VqC3MYdDk1h{JQ%zI0x*!uIA18W{+YQ$|x=07u-ULJ?A>
z#_gBKNX3v`NA310O90e!`HF9DR8!rZ^oltBb?rg%lrTbP*yTiO!NY-84m)nNa(a$lrF&v6yBeLz
z$@xJpea^dp5%M!&^`X?MXd03j!1Srpo~yn(qtqS*N1UtSnC$E4a42&owQ)uX;DV
    OS23qNh*RX!*rxCy129e=IkN0
z|Ajy4?VSwza@lA)<@hHmo}PbeXn9OXKDQkgt%c_{kr9zuS|Bl?>kMX!Drj%b|4D*{6
z(VhXOp1iRDofS<8*2-MkW1;5HutcVS*!LSh`pq|A`{YSED-_*Q(HjR<^&ti@(Cz?M
zjfW1(cv8!V{aaYcZmn_&URJU0eXzHS+90IJij>cr8O))QTJzho`+{bNp2jQ4h|bs))#2_HKUQSvr`i4j>V0X_noh%6ndVkOd-QX#^AY
zzN2|x8t{j(fdk+=URmaS%(2uxf=EpD_NE_>xw6`7I2Zgpr(M5tf#AJ5lL1eOl|1-D
z<7odH4y?#JgN}ekzBG-&=&8)f;OqsA{|sT2-(yKOMsD^b7(^LiG3taNBenZZgDEX&
z$)G_dU3GRT5r(|1bj-@kPQ_d#jCJaJkB(M1C`+EPETV;lD+92kk(67s;;DKe{ffIL
za&hEd8F4iIjm(uR>t3R?!C0`F<9Z$dDE$~CBC5bxY1Ra?TTsX*(oN82~8G)z+KLc{1@l}E)TS%q9V^m(H
z2GTBlPBAVrbo)rm-jgd-kU&0U5eOU_tU{@!a8j8qWrP3|y=O$Ey0@#cE2t^AntftC
z-O04UM8Gog)Eif#tAQ4$z&EFBzzP5B0ni?VLbUL%$d$cEDk?JkILx{4}_V!%d5R0C5=4p*MnbIy$EdEOhC%%n-?VlWzD_M+W!GpGn+t`;;F
zC5b)Vg#=GS#2*aqcfP&h^#k9&eYo%bh4=G=FW!CglZSu$AO9^s`P+WYzxMz9^FRHE
z|J?ug-~A6>J>I_hjUNJ^p5J}ZQ-fhLqGkMYHge94=6h!OMns>DMl%z>ES8+&#L}P^
zGCMm^fml4?=^>9V7|(IiMA{{)N`G+$R3EB-n)&}z^=H4@uUmEyHpZOKyVm-ez4tk1
zpL1MQ?&1bROl-g%1dNGYE+>wJgVIS!E)bw}H&G%Ha)p#gx#S;+1R-%5SGkE}B4G$F
zz!U^ZiJT}RgwA%#xXQ9s<>S-suUYT&%$bWZ=5Kv<JI@>vNV7PCdWQNk&dO0HmcjSGZkdaBV~4Z$JY(X#mB%M8zK
z2k)bhK55V~Q$jyN=!(;Qsbe2!2sVis@N9XCke)We1L*4s=~PS+az?Y;BxP48@uM{K
z*5m4Iqsigr$sm1x>KuYGT!2e)48by7ws}}pf~Qgq8VUJ#9hg;KcG
zfF7BCa;t2*rT@X}JrCViyJm|W;^<7*U<_y&?+l6LM992%?SpoR)Nz<$?NpqGK1AEp
zDb#q0eVJT|)E-&g88*}%Tp60jWw45UEccp~ocia&L*w3C7z4nn4Rj#U(J=2$oc<|D
z=9;+rH+~>rlZcm*u11rC9JO>`DsJJKp&Q+r-2;~yom(jlai-p7XhJ-*8qeVYFIh%)
zhfDB@2->)%+pbQu8{o<)FU;gNm5US$mv+Y$>Z*-`Kv$grn)n3c@P1eIkbQkF?YdS`
z9f{^>i7%g+TSFZ}04BahM7NY%6K2(ENW`OiF#nc1Ta3{pSLUKu%tz#6Gcp^v@BQn3
z?b~mC>p^zj{-RfN>;JgsYIm>_Wp$4`L^O^9Pq}i@Mazsn-GIex-Re30Y;`XK6z{HE
ztBHi|s@SOG>qvT8Wkv!Ow{?8ZB@I4C|)YNXDb6Yq4tF7(i8M$)bkMUXsf@%|$dz3Tt
z=xyj4?C!mH!~?xt$=C~8&q@zAbnzp2iajEJO1KCzc}^1@EBh4LXCH=U66~(Ck5eED
zr5x`nuFxz?+O9AT2BIVxTA8`Bx@w
    4Hw3W?Cbpo?jdjdlJ&Hx92K~J2YLGfMFU?
zo)4-!bOv1aquW;HK(}nYNNVl%sa6T*E6q6msH>`bmPsgyp1aohx)tg6KzOZ1^6b-U
zf!;E7B(PTa{AvCV->AsPGCgxDW5WsEC}2r`MRgVP7405{@FdSX7T40G|i
z)bF$eQ43vQk^=_2V0Kav;l#tE5^F|p#P-)Z!1Za7ZTBED)Z2W5BFx0FX2`75tdd`c
zO7v8^HJn`4Myw`nRDhvP;vO~EU^{T_4t>z}J<@g=-ILVUf@YaPW`sHi<#(rTwfUwf
z!_}JZ*w8cRg>Mx!>&&2y1{A(2*R{k;eKxVqm@ze`LzUF9vG*aUjeO^vmM>q-TG6>q
zf{jWvDLoQ%x7v`$N>@sN=roNvM3mlr%Z6XsFX8x$_N^*1BKFoCWkiG*3F7QN)riYeq#4mi
zsZ+kM(bfAnmT9;VWS91Ub$ec_+5)0W3iU7VqF_PJX4e-`WN5;Co57a8Lgwlj_6n@+>PzxU4R))M4mWDPFQg2_
zmVr~oxmVs+qWT4&8Kgpm4|uk*#z~NzxUGHVylMue5>_jJ0wtnX
z6G-nTP?aoMLSzUZ=$5O^In`JZ4G+DAy^@~!Rx_5^tzF}o>5$EkYp?4r`un&JmS>>{
zRT@k5oU}tO1~1xqTVh}t&mTCHj3%nk
z3!a0Sl*T!zx(nZ04;hTTwOSy$(Sg&|h2^k}>RKxYX!Q^=Gs@~iJU`2}>SB4Jrujck
zWUknB%;Zbl-JyY)Em4K0F*4Jx&JFTZpThHVnGj2$`{9=7X!iQrmz+T*
zY53PT1+;%sXWNBpW2TZ0zk24^wU8)M)zaz1F_#_P=b!KU{r=&-
zz%8I;l^2;anoj!~&8KUq_ZCbc>6o$I0mogS1=78l)0$daSXcNfYi2RpXOLj%fiC$<
z69+a=AN_N!!a;Setcn&-Lo=QX)R2b!({RDuzAG=a@%(fD|3ZE=Zk8&poXI2lD60;6
z)KxT8cMh0j#vDzg0K_x_+I2t9ub&4w)bZ!IdadWge0=FUkD))H67wq7$?mf|ToC6HO>o3t^Gyu~4Zs8+W#)lg#L4Bdk@+I;S
zx@#zy^)9*PUrdZKc
zZ&=PMsKyXi_AD$p=X7)+%TqEA1Zp{iJ2AFpyS@g-mCHA)8B0mGTDn1ToU{|dIs}eV
z&SK`-MJ99LDd-1=tZF~o*22twnVd7UrM~8lP{SN#vMEAx2+y8U4Ul=5TGCj0Q>U8j
z#2W82jY35#$xon|$*~w9UtP4(ub6IC-@+K5!dp0BQ~RU4M*>_f6f}Fyh_61}-@Ly4
z`X7A^;C}ad2BAE24F)oVLCpav1`5R_NT(WA{fO}92H0?4w#Gf^zcUBWePBUcXqTpk
zYuhBTAbRftOt3CMt~t`zNn~_+LD@1y1(4xfSbm_3H4e|h!pf9CfQ*Pe6U*AFMX2rP
zuJ42#wU=T{!wLEQ0Nl@eEv?i7Q(I5EPv=TNVn<7$&(V4q_Ou2XUFbd?x2V(SzR|tpZvjxiS405kY>2`+wYM@OhZWS#
z1Vvxtk(;+O#5tQr7uwD=8IbX2F!g1-Li@bBv&oQQ!Ay30#1FpoSL6gxRpE#u`czGr
z1|zc|mimPD4yKLJ0O|Qn%@u*R6z-f{7|DUpu=nZ4T12BxpHl=8JV%1Jt__zf(BOJv5$*;|7vY-
zj`@9YX<1eD5%!}Yw9+#oR;H>A5<8xE@B0Cwv^)*S#msnmipR%z`zGH$@%3XoKJnF4
zti;M0%AnD#mWr_YVtzY4+Dc}kkn_{rOQ%zJdBiotr~fUsK5(?7k|4pHNmiFdevK7u^zLReGxkPRubby{yXwQjXAkSm
zTil<|$Bke7!N)gUzwh__`hVzm{*!;`5B}~y`cpsiul>27`_6ZM@!LQ0<HlKH0e
z5%#Ks>f>%=aDZK>m>}BRJtsK-Wjl(upz3l8CnwrB*mmazGS~I03LP22Jo3NksYOT&
z0tyEOs$En~F(s2IwdAmrn?xU@`+fE3q3#F~Y`KrfL*^8(IgkO)%3LtViY9E=K}KVm
z_$!ZbtjSH6Z+C8OG;&Y|U>47gpwJaP#qaCxvfDyiY@%n`!q-a0x61WU1E(7J=*LYm
zy?T!qz{1nE>*IB|cP?UjQw#@M9#6Pf3=l_pdQ!}ZF&yZi57VJu${v{dOY%T7YUO2j
z7L!1xB-O-h(Vmt9rgcscadL36;RVF4H#bJy#dV|<%*NUlMe0;^yDKo>$LK5_M@
zlb3lEI<4lxU(H2p4@v|m33VsKvksqDZJIW(w92;zw#7yV&#tz!5se9ORK4ni4FM{1
z*gOepKy~!!?}DScYrqZ_*t{S~
zGorgnWPVrqSB2zBi+p-TsFp{?P?SZEA8MC>HZ8UU`{LXZr&Or~Of4WZySDvI=WVeJ
zy8DVVz{-eXRkgfi8x5q|$ewH?Onq=Pg(_cYJ%7;)yPLW6QDsX5GLnptCqN`)<-6~H
z__1%i{^n;75aU2B5qjU75kSXMLR<}_`%@n3=#~{}XbtGV!RR#1q?{XvxvRvgFJ7ll
zL6nhw2E+S;EE~OuW>c~ds7b>a%F=kTD{vGLo5Hh=@}!1LKf2
zDwILUV5T;IBA4(xCGLof`@K?pPW0Y&8t1uB*T?50N>(Hy@aiF6e?~2sdG(5~9`osu
z4~vhFxQ3`^u@tWjN|@p0L>>^I>?Xa27*{gmY)lc(*nYSpSy8JXl%-$NhSsPAs=2ic
z7C40}L^@R6cQ<=EU^ZH-oN*MK5`d!36rk!h#RPFnU;?v2!B%^wqS4h5?c6@Ko=8Ea
zFpP-Ijdg_Wq6ZH7^x%%O7-NYC#lKBw(UYxP^z@0p&m{Ws#>2Y_<*~g=ps$NUkrO#>UiBdLiO+{*2Z!tm4bch)rwLt0sI(mB-F$Jared_Jg?Q3tI{`N0@_2GH1#|89heDB@I52qjQ
zeI8{h<_Q4+rtSUJ=;>~2jY5xCpXxv{!*bTT(3!3>A~0B?ZZs{{;IK4rfwJG9T)|IL
z{&38U+rr-X;lYQ(+k?*^^79+&xj)?Ti{E+o`f>eZfB3ik-hbfl`ZK@(cmGR2{crwz
zKllG!*q=S+bh)E`Kd5(CRmsZ3W>EoYRP
zlj(fw&VNqB)tI#bqnhY;Jz%;cU@~3(YXYqGhz6lFB#jGf4gJ&M#2FD*`|Mxd65lp6
zIr}{I1@w7?{`@tdQ)V`Lp93O{QN}cu>Y`oaxw#_I9kKKo5XRRcP-P!udI;H(wtX4s
z&D2K$892>MpwBtzidYOy!TqQFRC=()xlexl0#c#*5NXVTDm#+btHIGi%Lj4LZVxZ*Qmpu$}z7%~?1#^45tvsYRtitmZBNri2y3K(Df|4U7
zplzj(YGkO6j97NnBX3&pLNNIJe16T3z4`VxpJ0j+CxACT(NVk19@5D5&pF+c!yk-f
zAIpH%-A*MmkGe_0_M^$^pp6?M*%`HAJrccpGgpvy`D<`2r8PY^94yDw2+Eu$BF-+6
zI(lnSri`Ft0yogDh_=t352
zp32)o#W}~#uE9MCG_>yu(P2{M;J)pht4BYn>ImbK@3(6?EhTP!ia^^}-3Vny^|^c<
zgf8eXDQcwFj;Y`9?!GA!x;YNUA!9aJ(yaEo4kA;y
zXWsHW*Zt$>V`QexH*=YOyw+-P#||@WCYW
zR6<8krStLnWv<1G<_&clg~-HpKPtf1-YtC{
z{=4_juUQ
zy84>TkUK7C!x4N`F;xK?pv>^9d&FW@r%q%tgQsh6e!TOu8{XX3>xX(?@!gO3?sq?a
z`|a(2^iTZWKk$$ImwxKc{5${BpZp8|$$$7Ce*XEJ&%gEUZtUmhQyVx;LpYf3GNzw2
zKT8}YybyxL#G+DHcpc8PYA$t5G!WSN0?Y{C*3>5iC2@vtjG?TPruYJ5S2zz8fmR~W
z;UBM08maDq!@I1%bALwDr35uz0n>mh1K_FMrrnmMRxJy|QnOU3Q#%;BvXpl!Jy`Ec
zMG5a7BU%e=1foSW`h~UU#>NlL#L=oD$f(%EsS`~1MSX2Uo_cW1&Ny9tqm`mcjw(Ql
z1UMn{B?h@6DC@dtF{fpA@gi<-BS2hVX3yUCLtMPqjX}?1Il+Jg1l=5)@RabdOk(yheA!
znQeBJ#+g~&vIk6N@l>DaFmgq7JBUI7-J@5HNv#JA@Y)^a2MDx%)G-0R3%xjRX+RW5
zhe?LAQnsP8(h$dEsrB#BBHy;RT?6ut1TZGrE6|6n6?2-F6r~4-10V0hw&5>>nu0?^0Wl+`ls!CKGPb_hn25aLMM&Y2%
zdDX*$zxrJj>*t(^$jqp$LBBu2TYZwMtNV}{#u2G!ms&tyg*5sL*Ai^Z+Ep}z$14S=
zJZY%2Qh7NnVh7X+R7DtD>n00bsK~rH35^y2Fd73PgT$C3$ULCVy=SuDnh%2_uRG+S
z$yl*u{5x_+8J8DCy^vRp_guBZH=qGEL?5gYx}18@KF4Nv(DDRzBxXv=+)SoTA&ztn
zDCQSYK!70yQ8xtqXL_d1jQPVsvDE7jEAs}Up31Y)o&^U&CM*$%hzPBoArnY7Sjdp|tgZXq?mMZ0&?7
zHG&N25;j#F?0wE*uBg4c`(b63Z6nXAMrUH0^LzJ49Ap5o~NZ(qgJW4wBmuO9O0RoqPYRIgaoQZsS_pmD5E
z0d;?1U>p<3Y1s79KUIiz%K=jn5q6ID(J+{$>@kja(Vix$zf$Vy0QT;EN^g9ZTh>b@
znZXJcaCWEQg+l~ZqN?wAktuOsA#H&i#~*eF9vn4^)t7C2v&4MpIyDIfjKs+HB)!yX!DpKZ0@J`$9T`Tp>@lIDLrv#^+Cu5Ap8Z^B14j!;Or1-unk%J%9Q3
zVILt@k#Sz6Knz5mT?|I$O6>qtDL48=aAod&&Z&&Z*^WaeC0jd2Knk#M70b2a?6Xms
zQss6ZPaAr-e1z*%Ax4+OchCKN@WaE`D_-5=>yQ2ZJ^uPv_ea#P`;A}wXaDJc^vD0e
z@A%0-@iTw+&-^>T@R$DTH@^Ml=im6o{eFLbejlm;*$tX=E&6J71BKJhvf2ls7f)BM
zF1vc%zd({YOCY8wpFr8#g5z^&=wYT^7+agZVi=2Ptt3$}NDk2k!_#tnGj~(PI=bB*^e~na()$_>USF-dZP)Ti9OBD2Y32%DVd8A>gB4{ZaD87i
zdI$}}+?l3CResO-`;(ql^i@j&>Qt^}2+hn;BYD+!0MrkP3-%(N;Xvu@Gg#6l1VTus
z3$!zDxr`Tn@*+9OrC?l6-=gbWD%oLZg22%Li;Zq?1|nu^R`L&;au-lIsnc%m{Ihxe
zEe^5(i;!O$ai>=ukx;X({!j+Kg9lK_VMW}#s%sZgd%wpLYgdt6nHfvM88O=pr&Gp9;A*9q&$)=BP
z8E}uExIS@auFURJXEsHM7T_=)6(<72UK>s6kR^0cRF)|u&n@4VPl}B|e5X9url{VB
z8oViayns5O=HmsB384`&7@I$gZ?2)Y6u>=_l=RO^EW@%!nfkBbbY+p|J=i
zxPnz5G?EG8)R7x?Rhx)QZ;v$EqY8Btg56<}l8Y*THAJXS(9zrX`_*HoZcmsItZnVBw2lf(VUjr|8+Z
z=is`%FCr`o>Wo;_wm7s;DycjXnP|o>*SdZ9c;3EVzxmfbt-!~R8fyT1K!m@Wrahp?
zub7kQ7Pv#!5>omy(MBdd{JG?!3FVI}vG>t!pQMpysIZn@570H!I099>+iR}E2ABfr
zWZ#6c;Iit}VJAh%luJ!@0c+*`zDZ$Kt}l+4mEXk#r%4MkB~=^_RGFzzFuI
z`+BjFIH$T!t`JOk_5m#{R2|(G)kK{mMRo03TAdP!s(s&iyG_D#Yu7dmw?C&+LT&l-
zHH@dqSJ^Dt8UEDqtV6w2jA&e0hWoySj%hB2>heHV!>Go@CFNLd!%cb&%lxj~y-209Z@3s0}t
z<1HQ^_^|Ni^?G%ShljW=>YIOY(&RO~d$#R)Bf!h@)fY!QACm;27
z$ErtlwsQWLr=$uKmoZ8v1w4N|5wl~BM*m3e(l#CEvg7@Z!i8#YZIogFXSY0tlvbYa
z79`WHh_DXefWcdE?NUKpHYDlycGjp}XhyR4Sgp7mLPS*8**zO8duCwH4jF;f
zbw99P>qPUM`r_64#%Hg7;ctKVxXEj@C{%kcj+o4{D$Ua
zjytpg{f@}QIcIOIrPSYzoSjB4aDnV=ryC5$WlnTsECghzKx&Fu?*
z6{afx-RxN^Y>HaHj1FhDUSGhI33Q$fo-@uSadk?HzntN=Yjqh{8ZA*RO$bqnIWOTB
ziI-oAVw#e?<}IOZaB~8O#h_@;6hWruk!h$9Q#YzAJ1(DUtlPqCO+1@ZYw8-wQB}41
zjGepvSwgjepOQMpQ4~M|SV+r3L-Hs#z#QaXp39Mu07{fn&%+1LC5bU3YG^U{spC$g
z9sHoaMrqt_0)m#$sdP4mDxx9^kh`e!fF`XYRV`I#6E7yc%*0tUa8=NLOL)m2wD+yo
z!*-wcj`tSArrK5Qfcv1a9>}CN^>hneRX6Lx1BlF25o#oqoY$wv^>T9j+yDaSoON44
zmhF0n=X~Mb=%wDOypROe|IA_XWdi_K_hL)|t^6HT$XJ(S)TuGFwB^Pq>4Ew4mm2$Y
zA7JJ9nhy2dw<+j^B*&CoOT*Gh8JvXema;B2rn)z^(*V%9Rxs+E#v!fmo|Y(Z*`9IO
zq@LZu2o9x~g7ga$;+0ROM~bo(70gSk*-8
zoAgM7^fT#1De6JAqX2uf9}VMhUJcThm1C0&gY^Ii=2CCwGnxRT!dh$DElTf~!Zn#I
z^`jZFZtHvRK7RRme(P(?*UQ-6U>z@kxD=fXgLxY@&OszEqS`q}12IKoY0Ma?yD_@q
zjLD)I-BL}r<+WprRNbO6NqKvAS8Ja;?IB!XwDz2zQ>Q8-V&!?>`dbBokFFI4-!MG^
z!G;H4-7U(omWjCi+ec}`Geh;)!E=sgg93XL4I+KDrG09!tSO~JUC(C1eWoWtyKfZf
zVR9*wb+78Wt#!Ze+igjDASxBZ^rVLRUtGL#drxUdm~rmAMF?n~YGItQ)b``_R!FTq
zpYs^?OzN>g4ZK{47|=Ftyx@1{3ex*gV%$LEn7Qqo%?lH&mO`Vt`xL5~T6o()$q1?@
zU>f^CxF-dA1YIOD}WgHrZ2Dv_e;G|=bNS_!aaco|yY2sM!6MZiok
z1pu_%%>sZVzK0PR#BJ?u7WzKLW(JNDOUBvznjEN5rrk13mG3e4cG(6nP&I{#JZi|>
zO<`rqQMIW@ybp9^t$6hqPmg%K#lr)iZhZX|kGFVwm5(=XG?;LXb82scpxsb-p?Kb^
zWA&OG6kPY}YScJj1}A*e8#_&92Tpgm&}>1UO5Js;gGqSF`ZC@@@*E{)g>5Te&e6Kj
z(a{n2)7=oU!q9}z-j*5Qs^RzPQ(u}+;+g5*y1<*u(0ghZJVQmH;^lsjJY0F@0az^TSc;bLu&$iEAHP|dX@3RMq4
zfm0ET;J%-#PC=8UX|=4CbR_a@c`^xd0NF>A6VoYekGC>r>#S*mU46Te=&H_TCcQ{p
z{;P91)W`-I!~rrRBI=Y(woP
z|>=+m~ECZo_|KSRKnNaLrflWZY-OH%WDe|W~b(_cLD
zv$wZC_0_xm^WS;@^{4nFfAGKfd;iOS$DjPOzw;-5@?ZbCfA25e9{A;t{@By)?Zp`$T=Ha^`D+P^SX@cD)qM7-aIe!
zIXQ7Tec07cbt2s}iayyq{w|cD{34%Q@6(M_!w(0*lBJ182y~6pz;tAuPShv3imPak
zdIwO;$nM&w&GUAL+|itq5iJ07;!l#Ngtdu0dFca%rBdy+Xq94TscW4d?gO-Fx~UY*%oH=ljG(?d?HoN$13<*mdr~Zhr|tg95n+lZI6eI*bkw1f>7UQbuH$(_
z*VzJCHEVCokj(vC`@oO0R@$CIRHRPTda{DRFc_w1H7{20n_(9#@3Xa?a+U2JW)>UX
zRyE!BRBP9xlg7Y{J@7*1dI98AZ!%NEJGGFyVFtuP?WW1eD=z*YtF_=Bt-x4ha`zgNo?x
z12J-0=S(fm0kK3G>xgs_5Mh-LOx*RM(NGjk;agK>N*pMDKU$8j-bXU2n*#r4ZKFzf
zq=7FVcDnSfj77+!vSZ)_&8|HPYcPdB*m;{lg1Ka1#*BFX{`uR#;fpW7{t6Qj^92rv
zx+O>Oxitg9xty)idNFHU5zI^-(Tq6vDz*qIRfrWN&Z+WtnN~H^t$IrRmP>5wFmIuO+&L1pMhhak
z{1C`Gm1E}?5h_=!FDZ^TTLgmDvR}X`jG|6=R{=`~C-lfAv|jPx93z66x%bguE3c9>
ziaXuTg=W
zKz*1k86>N1_ZQ?DHQ@|7J-%L{5vZ3HIY(xCCSR@j14uK88han!ZkZ{urP@@r0kIUE
zJ5p{{1+fYj8{fR`*egY(97Py2q}#(hUv}vruPYYDsyOoizf)zBa&qy&W_-a>M=KGbHyy!l
zY6H*|QED}b5eTUIcl{*+PJ|Z!tYn#F=PGS@ji~B6%8WC{A1q+^SlfFyyZFolf=j}p
z-$PVDY~kDTGP0Q
z+)q5Lj1iWDQlYjqI}I~yk~mGGbhDG_KKr6Jn4qMyt?%9qzaFK>8s=JEZU!2fL6!nG
zEg?g87#XOY8IAtd*WbK;_}lN^efa#dR~ZqJAMVdT`0DxVZ*R|cJUn0}bC)V;%5M*$
z_3b&_i~)U>zoOZ;PPk?5MwOfk4RL}?{H#-F&!jTK^VM9Qe^^ebxHUNS?vM@RsR1TV
zRh(pk5%|IT{37_5g*{j@(fBQpy=fj6@efID_`5*k=AOC&7{a^a2pZQ}y{WE|0
zKmO0&eE#-}FMrjIxBL5drropTdxiR5!$R2vCvvPq3E!#
zq!2SK()IE6Bqhxw0ER|h{ABN?Uo!ltrz
zdoz!Hu%6)X*xmW)P|3~dvX;RlLWHG)l&7j0E{^dNLFE-xQwKKNCo412TKnQnbo%S!
zol{H)ksuYRsxCb-@X`;5z5OKl)?2&F!!PvN{8_3>*r*!ggNqC9X^?saPhAMeW>nLW
zKwQV(Is$tU4bi;|q1o0@2Ib7@UGJd;o
zlkCvpCR~#X2Ufv9o(W0gEF8Jdid%PY-_z;f#gQzn#XINNOx#>Ewc`<3b4vKiovK(k)rU>Ne5uY5V+zlUO##-x~0y;DHt_WI#z%fWJh;ZxPkWJcOjg}C2$
zjh}~Jw!3WQ(q!)r-{=N9R-Ah=L#9{f4D8gkPaP3#i8^N1YPse4M6{;~zsPI@lSQ4=
zjeSmZ1VeN=ai=Q;vEr7iO8!F$=q^^SYpq!bY|ES3LlHhx(WR0-hs54~jz
zP0l|aw2l`pd=1dx-l=<}`86of+-nF3mid7@Os%N(e5wR@b*Sx;lgcUIebJ#xw>;$;
z4U#zJQbM-grXOKOD51yhO0LK0s{1MzV3mg05OnKP-NPxfNNzH>r}Hi$G?gDeLvii#5sL?@P4~0CI3D{@tWlgcHLy1brIr*Jxmwb+e)$BI~B2A(&*_paXG
z@YxM-9@ghKeBAvv-<@CH?|;Lu`RsrF&-^!k;>Um2AN%Q_`7?j!XaD+N{`oJy`L(xS
z|Gdt=fBbmL6<(0-jm?JP`c!LSVPwPdchl7dW;C<53w>x83r?wxb@evodBbc@9!yG=q?5AcqO{rYv_As)
zYg*!nE|>Q+6;k+8Ej9H!%-3V60-qt2>QN_rZJBqrR9E3XPhvfSCLj+x5g
zdYpr0Binl|N`kNOB7lBzZpPJ2V=8uqL68+;&2hxYbYHo8Z^`&6_?xmO0^Ynq2t17|qd!1}8+y!;|3^>td&sRhI3bO8rot)FJ|o_?Fh_*K`WsQBjz!15`GhK^)=5%F+t7YJr%zZ0YI~ULOmRpK84+ZUr?n3_$TS};vX2z1ZIsOi1BkF4fW31e
z&^<|@I`UsNX0PMlwGs*@266?x^|h;h}va~Fu}Eoyyo?|!+5
zizI88$w&-v7Rh`vi^eQA!~pqvdrFh^!W)Xd(jI8ISGsJ&uiegcYoW|+@GMh|#LAWD
zeyw7|M4NHy0}U5?ji~9z1M_-3arPDq*38%bnjkmuAsGFRsy*7C=K(&==+8kXAeo{??OV8>%eaxm<+PqtNFRLtS3)
zF6@pKE>xQ>o-q1Uona)NJtY5w2%biJi?vH(hz~VxJ8GWxE>$!yb$uZa!lkZSwNOB>
z;0f;2WWP%O$k$*0;&*=d;lqd5PY-b;bN%4mhxgCt^^JS;F(Z?ZblC!7M8r8`ynHM=^}v#5c=-NP{HMt3QXYJ7$yJCtA@~
zqZz|k(>NexL+uh;gJ}0Fo(C!x`X6&@Z8y>`RsD(DJ+_$lLo=*u8MTn?7|+dl6m57}
zU=_;76E?n@n$}|Ds?*((WF*@jZ2B-SO}jxK2ZW^kjn!b3Ij)l;E|pvmWR->k4zn}@
z*&-Tz!qDv=CN8X_BEZOHf*#Q*iG=m9d#;#Xfl%VerSX;Xkh>_o#%rNHUxE_L3+%Dm18FUOKsn5CPnl64uf|#oX05mI4B;4@wPj3kXnQCa|ad`w7
z=pE3wM~Q5ygX=@1^Qb^T&p$<$1sa#w3cjAzEp?$=JJBs-NYdeOF+il7DMKITV!C=}
zLx{9nwE)D{)ITGRYBZtHyj6glC@9XZW?%%jm4;4)r{oJbyE4^
z#{<<*-He47fpd3tW(dtOIL8K<3>AV+=2}7DY-Lt=r`T-?z@%O0QuXkfx698%|2Ec2
zMz;96RgK^+A0BSs``*Vdzy9jieEXH}ieoe`JXKH>F0ccpfTE4Qm-R6Ouy+}GsK(I0
zbzENRmG;mjGIHS@)NZCmWV1jMnpUGv#cj3buCwn)A)=~r>>qn}ksadAhEN3*x`twE
z?0Lm;v8k<$2*j~d{BU9wr!?w3eY-`2_va0mrhDqZk^r=3o2m9pjjI3^lbMOg%)Pgs
zm!}N?!HlTgdmpq{=2rK$Ukb!pv2yKwG-yYex2E5ljP5$;bVEb{*;8Rij5-h)$G?`S
zcuZML{vNS_u9Cj~%D8l-Qs5j-kCoa-h_TO!4A|*v0ioFuJeQ~YWTg(`ewQzb#%8_u
zfw7TE+?*^WZ{$Ypjufj(1k%VwK=Rtro_PAfkR3?6_83#N7Bx3G23q8=^`X#0<_htx$pJ-u}+J3jfhym
z+l>!5JU;U2fv+C;^uVX5czle92i`b=bH3V{QVZ_keX1_)Rgd_^qiIKofweJslahx(
z`1WE6jPZ|#-h+@?CXIt^K%7xpFJ?P?6%F=MNC
zL+#dC5D&W7RKSj?^xyfUgD14uth+kWqdZ!U^-|6HD9?O2X3C*IA^*!3f)~dA%?7aj
z3R+%DVWhLKzRT#BA?BBUOb^^Fce)V`o?VehGc~#nGL!6W7`fLn%f_?WaSiZZlld;>
zm;izTqyR+>C&9>8HBj4rhhoa8q6N@}T-3IYI$c06QHu|NbNZ9D%5xOkMYLW&oi@1d
zr_r}e$lpQd??CWvdvek(C-Bp;7+wLbhf@)}i%m5ZYDZ<_97IHRfBTC!ZywkCcOUPs
z&svL!56}0nKJ2#-ao_o{pgB>pw@uV%K$D@3-llD|puEOK3jwq{&oz=O6-~hngX`wf
zN8JV1OIa?Eyo{adUs~)#bfXU22CyElpM#9hUa9-3k0;*U>uWcB@%G`(Lw)~!{guD{
z@oNwKBY)_({{G+hcm2sf`1k+xPyL(!)?fI)*DrnVTR-}(+tZtUzt_2IY^-jRflPqe
zv!u{GMG}38naM#C-0(}S7inAL(w%|~`NFsxHs~NLKDiKkCgR)l(sRP}&goj}^0TN5
zKRppv$cx@AQB2HVs2*^wO1jwYU1bpmTdD$qD(dU9OKXmJdGiXSG9?HYrm+oFe2;9#
z6WW*(V^X@i98u@431g0oIwhWN>5o{V=X%T|VRB|Cm@%BbyS)}Lf*LxwaL~CHCQDJt
zWf$R3OAQId{nSVpA%!DSMh^oND4Tb&XYAZ9!K|a6yrjFB8CK+96BH}*0Y=7JDPNc?
znu2C0UymkKU>~6CC?mNhYk5hm*g4bOi1etdNdI5mba*Ay>D
zR6~`MT-7iImx#KFI1Pfe+uVQ|su6q21V#8aaw8hT#v|n;i-vkV1shM04foI89Yr>+bEgqUis$N7!H!`$O
z!sU*FVdDiI_b)u+ba=9N_EF9_y8%SvzKhp&rXy_$8f*~KA3CNr!4yrlhv@F#c5JHT
zM6zuu!>XeSOe+edw>e{T*W(I%f4(>SmdlNVDxvNXq#alPJ-nla81z+*T~&vSkOlli
z3C`L~T@Cev?Q1;ParZUEP=R>rG&;Ikmrd0E==$j`71n6vbl%d-sA6VS)JUvyz5UD-ocUOd&~4L19z(m6>OmO^AEj*@r~
zjZ==MY8_wNTH<(7ojp_4J*rZz9*KL<5etxnLRWaMyE;q+rxX@_P!z;K3!?-{uElQK
zk`btVkr@Mkw-Wj>f~2b;wmM|aG&?f-=;O8hZh9<^8Ulj=Z?@30LXyeaCjzT%6$Db%=X_Sgu5A(1{G%ZJRi|*9r#qy(NfMwR?82WIilRWnItWro=1_(`Tw~qeETcUvP{owtVZ*I@`e)Z5ntYC+U(k4`U^=kxWztnX~9`d|seRDN>
zlA9~DNKah=pXwuz7>3eEPf16ogRrZH5RB=QKn?9hG-UU_7lTzLYJCLjx$k#8Z@k<1
z{2{;iB0oI$_uuWW{?=DtzPo?d!t|oMO?>Oqqu^Eb(9MP?b)U{ig|I`%xU0^|VTwDpp!*#7UUYYz
z)7n8YXo}K$^oUNoOJ)k_K4*(`!+PmsbhFs#Xr;NnUIsu>Fw`LW#_28feEee{&1rT?
zqG}v!Jm@Lg`-F>YQof|^bs|+&k*h<_1>N106G2@gv9i*Q(~N0RKsfOT(wWN$_faMx
z4>L1Vn2BI{?a1j6_t1X~S}x#zc{py4%M;ixI(KWEgJ*l!aM<9Thhe}~(-G#zt1#2y
z_n1fZ6#-;Krr@P;^qC`UTDa4U{-H*KjkKg#xS;))UW62MYL4Kp$YpaAK?v
zNX&NY%fYV>VQk={-~({a(2pTvd(hU$l&ctB#gc3gDPts85~iw=}TY
zy^jlk_GI7vPLTU$@w@&W)vJxAWb5Qg3Lfx=@s^X*@v|khe#wL2Iu&`7F5e__FOB6z
z!1X5J?w2DEBxmo7Bx8D_N)l9IH1AKxF~_!k5aRNyoF6j3!RP=BJ&h~S-AV8=pq18t
z2>bNX+6JY+??!7rOfqvRSd1Ja(l4k;%|Eqs0?^Vc2+2(uWH;F@5)x!NxYWXxw(M}=
zFxXZXv-6zMh=^5ZU+e{?J8{Xv=0irm!~&Hswj28vMqU%mK=x_5`T)c!84-cNuCag+
zaYFNhu87RYbF?ZV+dDiUcT)vT<6MD^*v{{wr|JcE_Yp8(%u`lD6
zEAtky8aQYF7k=&AZ+?3{h_dxbJG22cBV_)DmKhQQr$lmsdizw=RNnyJRyMGo
zPo+we)~~+YApq3rTww>xU=_M6kXNWOGdALATfP2TSXEnBRx2-Ia!cV{Ls^*z6Sh)R
zR28(O$ll$(ZmYCHMJg0g4{Q^|+wFGFIp^5zkchy!BhxpS5wj6Q{eU&GXZH|FgugHu
zYsEe?C+cdg5+TV*DLgfZK8Cm=iC&r2XcVDU%tpF(ACf6j;yIjr>AEc?;dYFk10*dI
z(7T(SLR=XXX#!j>Boh0aKFp(S3=ub3$GvJ=`o&e@%YGB4|w&I4-b5Jh}+9T
znSsAf@1EmyUGwQygY!pU+LDQzm&?WVh5oRBw5yyJM^UrQND9V^
zMWtQE1bd7T5!kz%O`vz6y4AiY7nk&y1PtC~2OG8E2T&98U(}4pSvs+|H^g#w|dqsr9ace*d
z0JmH0J^w1@ZlDP8LIl%@UiVli)JUa#C(*2PEH@3rC0*M^^i%R1Z(slQzxD3^{Cpl`
z-4=>J{OZH~eE#vd_ES9EBK8TyElI{*kp
zfeXu|J&lHbj26a2>~jE#INa1+@1Uy31ic9^qS0rct_Xq=w-q1m{h{zx@v~dMz47ax
zuXpeJZ@jD9hxb47?N|TI|LhO{`0xMw{)PYJpZlqw{+Yk=pZwKt{OVuz>a#DNpPy@g
z6xJ>KsfesTj5Q=S*rAgasdBK67tm{38lTU?bR3}~xirQ%yrWXoN(vvLJ}~d>;uz@R
zG0D0nU|qo!o3y0PGqmcyP&%4qI6JHE62~HB61Hc?ZytpDIQR2g984x`W<&yks;G;j8c>`z{Q&Kyrg6MO|>^aBol>9Y|vPmgXEM(jl
z;t?Ajkoi^!MD6OB0znt8)sZvf+E;nO!!!&zFsooxQIEtg(ush0Ss`~^&05t&cKb_r
zW8@z$astaE10Qq>IUhn&3HrL=-N`mGiSk3tw1gGt$k5roJ*@k^K7aG@TYvML$Au3c
zCo{(g%oX-zqoNq$@o}?37P#6Y_o-7-4ro(9v!SmMiuV&BW&ywr#?9lnw&O4
zQcn3J_i|`1N(3wQq`j0ZT8YYSAGO-m(v_o&ThZd@+)4a-tK1U=4cX0@#u)=b+
zsMbh_bAxq~Xp-T@Epe_n=ggA
zVTGc>3fQXt!il?&MuLcQY9C{W(xA#uRr%nhacmP7bnF$IHBdeK%nN{`nY3iBaH5k~
z{+WP-iG9~hH|CU97~r0t!1fbZ1io5T;UKe5g)E?sYSWi$vebXdaZMQ}qPwJ|O*5(i
ztvQ*)6fvKWu0%n>wA%TFTmo33254p$E_3Fum)B4mT=>Lp!&x}0>fXIpo_#Dzua1m!
zKdLKlD@&S8*^QjpPCq76BGEQlM>?YS*2t*NDfOHeUe;9?7n%Yusu8Wt)#p?}S^(7*
zjdWM++)DJ;wNhMkAcc!hGJS?o-5yi3Ug&^&#Uh>Z+zX+d#?9`C*!u`z2qsvE4KgKo
z*e8P3WY;&pc=PJvyC2?veDn6Hc9Hqv`TXGh{j*&NOgA(F^K7x=FYZRhrCGxq6ea5#Qt!oPh{=Fe
zXuBb5xZ{dYh+k@FtUCO}O!(oVVVqew4Uny9wX_I?56iw3$S$MwlLQ+S)k(LSV$as}
zVX9sR6($#q%j`ayqVZPx?Lqs=?
zv~f&#pwv=rYvPMMT;0f6C33Gn?)4u{(dy-k3&tigLv9_aWayEhdu!j~={jkQNl=ZB
zqT9D+J+(PZ!E(tzvWrRA2`{E&=d*sRGNOm}G#;>Lm4&@Gdpo{u-wWP{Mm_8?1UDr4ScZ
zC!MP+32?Y%bArN)a8+xjDwnE`27|4lKj_I%1R3&eiU?W1@P(x;YcRTq@f_G3Ep1(O
zQr9Odk8;#jTnCz@j*8L!U=^xsg^fP6Gw1V`ic93Oe)vrz}ZAGp}JayII2G#%&cIhQv!r
zeid)iwvAO;o398O&jwE)wa^UI)`F`V;uC=}tt~hSROMRT70I)^H?&HM?5t7upvhg!%AQR{~nnbwC_jPYY6+i7h
za+CHdEpTh)Ol+;+@I!rhkjVu5>|(gufUr9PvVZfpqn8Xhj5efRGlbT%+Km-~ICWxF
z1K0(|Io$_)__Y}b_TvK|9^%y#Uq9s2Q#?NK@qxD+Zx>ri@432bHtSJfv`^-h=>1SX
zxq$kw;TGVfba2n9}|Q`#RZ5-hDdhMIjDK&T8=
z8Bo=`&b5zY&W8Si`;S;Y4seLQfNsvr53SVbLcd$PjyVOZJy9U^Z@>dD#qq2Smr0uo
zT#$+0$3+O{Px>S`>(rsg|y
z+Jq;4FGLdM$PSS%HRD>)or;Wej5rdX6abQOWmL(kqxbfHl+$vIFb^Ll1D6Zsfit8z
zW3Y>Qtu;}R7sP(eW;M|zzIb!{?Dg%JfB5l!Y6aF>_uAk4;m2=%{`h>aS5L7RJJ0i}
zbEbyFg$Oms+pHHldUK!(0rhuvGGAnM+PkI%)ID7-aId!7
zril!oPsy#3WUt7sK6M(oR2vds6`ps0_K44J`NgYvUgw9;^_Rc%;ajiczyII(9slq@
z^mqRA|Kh*)Cw}_R|0n;^U-|6w&%XHPH*etc{aGZVNMTEAa?Ug@J+=>O-W_u$Lrpm8
z>7VQ~RGEp;fP_OW^q@(2ze-GHAsTR+Qj;2OSawaOKv5NkDqDM4*+D4TF|PpW;%Fk0
z(APG7QnfYo)l@tjApxW}?Fm4D#XG7Zn~`w0Hqkij?!!>v^wetV-hmM33S1LQm-}e8
z#cSeox-RX?T#GpSt{od_e)8#cLOsHrj;4(i2rI*d>G`^s-3EM{WR9R8%Lp{JZrZJr
zUI4~-gwv)L2Op8J_!%uyfssndz
zst2{RMO?f_b*6`k0*QcONcs0D1fG^NWvk7X@ETyLWzzSJ-~l)}M96>jQ8A_CB`;ky-_hv$=wxu!RnUtViZ1qqenE4jCSotNdzS*Voj$rfYXXwz#T3n!xOl
z0HZzJ5Uv<2-Ud
zqg)miPEE%Fu%QM-OBX2<;+O2;h`y7n{74^qE4&BULs;vAl^YkUPGJ%88D0p^V$=zWP
zz-Y}V6oVs9ol_l*Zpp^Vndx){&izDE;!BV^Aqs3PhV7YMAVUTUaE3o&%QW<_Ukxis=v)p!J%<<
zX{SiFkzoVyl7-h%9Z^E2$s%I0OD?Po#_1Z%EBSoXIh~m?cH*Rmr6DhUp>X+jbi*h+&+PL+g+SLr-sF_c(P{#Gq<2-
zx~h7J*AHqR9$^Ij7pLUC-RhQX?;P@Vhk3ftz9^Ivhh|fA81#Px5JV7C+z_U}2;oTMgq(_@Fb!c{*BvF|1*eK=r&%vLa)As|Wp}YVGw=JJ8C~@{@r}2SfAhQVK74$B
zy1lA82!8+F$9MO7{Xh}L@q9@kO5K>DqU)J;yj2HKZ``v1n`~4KS$ZlrZ%N)<#
zhx(--zWdc*d;P!pU;elL@K5~i|NT$?tN-%<`QQJAzxs<`e)DT@KKoj;odEAnZdni`ErcM9YrQG49haoF1`Kl%LGlr=}Y*MK`=nOMka!
zfNq~;7t8_z-R4dGIicj`9|o!3rMw`Jo}H+HI2U%TJKjXTl;u*{&%{sB+C2w_eW>Cy7i12$J&T2?X4u|RiUqQ4(A+S*XZi%?JjyCHMtQ-2>PqcGh
zB_JYL2k5OR+Nua)X-56@0^ESk_5|6kI1v+#TK;NRb>YFfb9-oi*F1F0Su#e*X^|ZD
z4V(-Z8RvA)5(FW|!H5hTQwmNQr|`PJ#EkIrI`l=;&51`m1xuPYAfeH$TM#rt>FA(#wDOjJ4FU8S0pXil4kaX_NOsW4qlLJDB72~j$<1ZqZChB=3dsaa(-8J6>9uJrLH$CWdTM>kV=
z0rJL1?tSW<+wDe|gu1U9O-FaJ8B_G8oT_1?nm@(!OlYd<>>{se0t2L
zfvo(Gcjg}TLKm#!*Xzw;67`uO9M@_o7pePR``GP6F+xmQ=`ZY^Z!#2wVfn#R<~pK?
zM0XuFugV7F=aA@wYxByH%Q_-foGlr7o1&r+H;6{22B%#>$kpZ;%5sC9qU#^DPeHpD
zGvWXsf-896wNI^JrgHiGjKff4cHvKez3A57y$|pC%ex8R+_~Wfpbt@qcL%DriE=jf`_D3lF#G
z!&B#D;a$et2fld~kGK5cd;I)&-#@W_&)@s&e%IgoKmLgy{|A5akNsc&!q5K2@BZR1
ze)G$3zIyv~f8KS!cK|DaxIX}>Kv%y%zg!bS9e5qjpV|j>N^BKEB-M?#eOKcpr^qe{
z7hyz)%FkuC(G2{gTI+h_uFbAm-mQgU6Qen!NGTh2RYfMRiOP`w+aXaZSv8*FQlFll
zw*a3ciE}^xJXK^?LoNxbP-$~kMH`r@2jO)nhIcQxRdb6;*ZRu#3h+H;t+}Rm!LLHE
z;huK7ButB?T0E&;)b1_aHU~Z6X{B!3mXhLR7#JYLAn3?U%<>_$dE2z$sO_+*d&Xvv
zhwRx0hI6)8lSU(W&It>m_Kd_xT4SXel~y}pgbZb%wX_Vw!ro+Za
zmYsCfS}gQ|pM@qc3SsCjEu}PVZ|Ze}8=YcwI9%4nP7b=Sx&DkRM6&%?4C{rqkDe-o
z%w2`S9S=Rw7qT{`{E%n$(C31q-9AC@6Eg^s_S|iTPCET*anT1yF4nAb?)T@aldAZf
zN%THodnQIKFJwta3jKzJWe(HZCDZS-}BhBj5F~6<#d_Qkr
zJ^ZF$^RyBlKjJDue?|E`?W-sf^l|Mz-v3@lf5ms|93vG38k#6*@a4m&4@_VWZU->{IJ+Y;EhJ7=tf<*_UfpL`SLaOI)N&uKu(FUzN4L9L#v4^8
z)($QJf|9o$b{`cqx(=7$nnkq&qk-CIoNUl?Vpk!{
zo0*Ue`mxv&AonZny>{3C04WITDRN*o6l6{fI>qWJa&W+XG)e@%3Xo-6B^!J@H}j
z;eof8EnTkBj%#|C*Xl$B5WuUo=VD&DVZy@vUxU#?;bM%nY9ctM6f!Mel4Fl(8m6BC
z9i=I^lQflXdnA+%V7r)jskAZzIJ?^AUw`sZd6_noll4@N(Say}d)L-ZrljD0jge1P
z1Dc}C7*^lgXc)ZKGOQ**Bu??1N_Z7Hyqv?$U)z1n0i1xBwdh=>_m^JUBvU!6rGW|u
zV81;Ko=R93XCo#3cM}P?OeN^@&kTbOuBFwlLG+zm?C$-18m$zN!9J~_y-Rhpgscs;
z{5Vv5gW^((MpvT~_nEPQGe9kg(%6hZoO7o9QqMyrZ-D|TywNTx6-bmKHAd1(j4{ow
zSvCg77$7@A;`%hApn=*c<*pn8t;!b|z+^OH7QO0B4xn(IBgGR1aI>Y{0laL;>Z1*-
z5m8tf&u2$QRDb==!)LD^e(BwZ=l%BS@rLH9`u-0-eEH^fzt__(R}#;a8n#zA5R1LL
ztBSZZ#=>$XyKMn7m`;PfrI~5_FEi`>U3&uQHCnzb<>=_GV<|$T2yMz=YC33Q5(b}A
zNzjVmeeaW@@mgg@2KF7#&-H%u^~uj~_{L|q=co9=SNH$uZ@vG%Z;CfA4So
z6aS~5{o{Y?-~PFu`~R-*;9EcT=>ubM=I)9$u{ffLSjpVS8$&AaGAFBDsfcu?!G^IDLZYcB>|8YXNvSW_i046FL%Id9ZO&V&>LVA2v)j
zb|*SXtzl(ji<8}8k2%GhvuZ>5Wc48??35Py`0uHDHUQvEGk~jh6q_z?T?SH)
zZJY&YKxX_Gku1={wUiuChjuv7>9f5XXs#RM3MIl|PIcQ^uBNY6KoRINgdZ3>!Pyl_
zEh(GxBJE^Xb*`w>qrf%VrEj>_+V>+fWyS3p`Lt)AtvKqW>_60;z}xLjGdKrmB$EP-
zuD1j$jnZ&F0R$o6*YIu$Av%_P_)JCAg?@t(w_IzcMFhvk2yRV-jX_&-w$4T{G9PZY
zzxBNjKl;trzy3#FE0l!Bv3Lod1_7tc`=p)iZl0RMKDdpJaYm4F&Z$k1nR%+u?##$r
zc46<%Y+-HUVZr!?jzQZj0L*JJqPQgABPGcmDrJhb-{-zJdAlt|NR@p;UwbnWb%`0(PufgxDatGDkGn0}4&}1?l+4E;$l!
zecJnd#|lu=omd$W*{5X491(r0+NP%Gw4^h^*mV$>=D8z-tzjuoff}WDRjJVL26AO>
zfqE2ULcK>g?NLHg^5Qfrk9kDX4K=W*n{1gzyad?leNMB&w(W)_41UdTKc{kaL@;r7
z1C=YPOpXf9SR!KYQwMnqVIr!|No0^M`e;PPK4o6na>q+*CT3DhH_kKed!l$F*m2|Q
zCp@*!B$y^M(+ihIxP-NQtUmFT7c<;S!WH1{us>yd5!OGy!fPBK9uV
zg7V%N-nHg$b;TwlS+?9$Z0~{6^!;LC-|L)$!>0ZOt}yN*u<8`ngMp1Y-CgS;UmTuf
zAH7H^kh`_KN?m;g!e$=M#k<&Ooc4rU9bI=9B4a-v0J*$Lq6rMczr|TlA)XQX;tID#
z`H`8Z46j?eNQq<7T?3%V*h5}sa(IG$Mm&2o&D-Jyk7kSv>Or+OF%D95W=mXKec^mV
zFjwrm__QjA5yal(tfrNxtyX(bTrZLVz%FL86xoI&(i2bA)aCLdk*)^1(E>y=vyKfc
zICE5(VPr_f2lxmh!2P+_&Gq0*dtlv@;yq15xUduejTNyYu@3{>{pMkP{j*np;|Je+
zzVCh3?Z#96gRefm->=_)%-2szVl7HP9Z6IO#=UR*(-L)CJXKxVXkBxgih;FmobYwJ
zu}c}XtHaNs#?dr`Jo^CbLabP^s_UFXl$-pq2rkb9)!8+=a%pTJ(jdgKDmD(#2ML%r
zQTs5HEAV{B^QjLDuWxw!kl*;)`uKdl|JC{7FTMMbxA{N)Cw~7={DI%~Q-A8;`qO{<
z-~A8%qrd#cXOCa|@@vezKkr!Gb+oDg=Ljfik~ubd=oc_8h-!(JW+<+grDN18u4GPj
zPI;i^m#810gi8Z+^Mbn$5g61}A&~}TU1s|zM#D$3ObzY^mq?lsJf~wybik|-vDVvj
zSA~2ATQD~nVCV$5%Po)JIZ%`$a*)>z#k8PxJn97Cg~`nkPT=~Z{-*uXiGV5W*m`;I
zEa|J*EfjjVii7yJN%;nQ<|!d&uyLiStL77w7Diusa3EE~5rXXXMU9lYE5Bt{K^yFi
zi$YJ}+T_%pBOs;*H1OK4ZF{=ELWG5d&Khmvgy}K!f6zpmdTB(*&}tBdNWcimN|4OX
z#wg_Hmpa{DoFIfSBke@j$M?pKUE9x)sNV8-Gm&o)q=>Asu!ZMl9!(mi39RciR~?NK
zOM0i$&VV>2?~TB45;Wtg+8Jxo>gD+hf?j!MVf>Ie!Lv`HgAvRcxJPwnw=80)$xrtV
zD3%x}c4v&yKVW+59=XtT8peIxuvnntxZe=dmvgf8=0Q~RwA)TFW&maA)tSk$-jCQB
zei-Uv7{ag=NOYu(S+J|cixwTJ~JWlf3Kx8a2
zbA@pf2Y0haTPuVe2uN|n>WU7o^*t>VbYyty!g1gx(nh|QFhfZwGJ5nvWi5>$8#-*g
zY@zIRO8{%FhWJ-r5MrWC0ABSX;C%dqx=)q;6=CcYOADo<8!FvnVz{HY4GVop+QC{C
zh|vUnr*88-CI}RgD<2r?*TJzKRtcSo#gJDsum8XvQ9(w=yAL0J{jd4fk9_N~r2+6b
z^QzJvfcm8bA9zb$-_eA1z?8x{$WV`ZM!u_Qgp9H@48*iOo`PyN0?`OfdgvyT;og$n
z-E8XE5b~C+X_7l1a_Nl9C2Yikzr_~U0WNu2T!+_QdQgahY~%bo9qL<
zp$Y9~XmsNoL?lzigE%Q6QQ7^R3;mU%yXxdhl)P{vmMm-9zjp+C5N8aHs>qbMP86s!
zbF`@{=U@ccRj2QD;3CtJ*0SYce8pTMB1*ph5nNqWIFRFx$i}%mZo10B9vZOzvv-rs
zMfpJ7Zc)o8xtr(IIsM^zm&%)}OsreHe&kwseBkS+c=f=?$9Q_=t4DFkU9PEHI9mtU
z8A-UTJTayuyUxG*2Sb@Jpu0aQoDteJ#g!LSkf?@}LqtJaSTH^k>Q6>DL2Ubl*>tyX
ztq?~SP9uj$r{0y}2H852Vdv_5)$V1ct4%V5b6XDW`k`(2b-B|W)1uVEP$~1v3UiA%wJl53Ub-0kzAU5eguq@V<051O4p>VLZdSzDCpWVX_vEwU{u|#
z^Fo!>IbcGXP)m$!+t&~4AqxEPyx)B|A0KP)
ze!MZ0+?sEY$Wy2HaU?0Pb_AFa-Dkl69s>$c6O~|}mYWz!tu7CfPE7~~$YouTS(;%=
zp^RjNA}b8=nyU)Q(WW$E#ui&$JTE@)vm*KyG5d##5y92{zVLqIt9!q>_1lO1=GXJX
zd;awwK0my>|GHoI=AZqi|Hyys5B;ux;gA0LfBDb;`~UgR|BWxd`PrM#KfmAiInNqx
z1=&*(0?8Q$Pn(HgMq2HnJ5SVkF>;&uryF(om8#-UN*&zd1&D9gdu|tpPp9^Y)Sg%6
zI<^Id>}jXn5kM3s-7pO!D7!ev4dtDwX06Pau0iw;Fu+3$k&jmeKJy=!{Ze<=Fe2JJ
z*;QAi)UIx4(@qd}c)LCiamndjB*q|{!n=(rUe70_K~-BGuFN&z597`Kf{OAApDzug
zd`rsFClE}+ZG7IOnGB0^t-GB30hO)ml_hoQT%Pr0Y*xSmPG
z3mrg7R$|VuZLbefbq#nvXvq}vHR(JulF`+tj|T$XRcynqSKryEj=Ol>R#AD{^>o^%
zRd|V@c~^x&)bJZDDQUNkDMF)AR)>>#(onZ3P
zOOyfTS@sA~fKD~bf{C-exHy6%Khs=SiQ22Ht6`Im?u?vax7+q$sQ3_pCvvH&IQt-S
zVuhf6>MD*%R3kL|d}W4aCc92Fe&ery`ur^?UCp8SBo1C(>!59YRo;xyNbQ_rTQer4
zVDIXN`#`(D;p}c$&2{cB>@MbcRfQC5)tSs-A8ajnuwJXpv*g%2N2760M{3THWF1YK
z;Itds8kImplk=^_Lz~g{Ac7iu*w|e=V;hj9IC%CEVJTn*R9vG}82$4v4c_mk)!Zpz
z&W&_`Qr+aapA(3Xf;noR$aQv!U{mc=Nl`goIyY9q1N(~866W=a+|P&Ffu0R*9MK?d
zm>_G#^Rp)*&{S#{Mvun}%p3`>Ld{6&n2`+D-aRO|+VgHD;5hSEf>>*Hxl0$oThZN8
znRZvlk`AZr=Cxwqan5iRfCg?6=)T_%gXgqmyyaxz5=~qSbOM^O?P7f7CagL5iSEXR+QJ1Jh
zM-(%)Mnlwgo(uzpb4(N)BF?Ug`GH}kcNbC3g|opzWO(D?h*V*lzHUk)cbSw37_z&Y
zngDTRKx!Rmol@&1Knj6#uh3T2>Qs1eRD$|dcQV0)akT+X)orcrhW6cnjLPKR!YZZ|
zIZpXKN)5f-ND|!p^fA?TJ){OWXP-6mRoYB}@>t4%eZUrnQ>dk>!As4%JA-TG-sfyp
zfvqOZSarEpL1Py4c=)N>6CmuKc(rWE1Vwz%vC!7pjTa<19Gu~w?UFKx14#%w7#Wnp
zKdKS%q|HX$Wr(XF$wMg4w9t8n=+=%gq7DkRmMuFAn$L@s7SK{kkDs*euc3bUAjEeH
z+#>FGxs=Posxw0*$f1RHtnBf4iNN!{(2OK57ospzrU&AeeE0U?N=)mo0i2B)P#ZPS
z#Uath6{KC$FEK?htH1H)@%2N#|L}3|H`*2Qaqq9*@8`DlZ2pY?wW_VsW=oQk
zpU%rD0t|HR>UyrVB9r%B#K}Z2!~E}`>*K~(8*grS`;g!I=Bw}h@cy5D=fmeW{_fxY
zW54^K`^W#lKk_?%@~3|0XMgtp{r$i8OW*kN^QSkT-Jd`1{ZRxC4S&5*Eyiptva9v|
z+o4|OKh7!gh6sWYXZ)Ft_o_*YIuBqPb2)km--(Rb0EcOM+#-!4ra>^gDb4hF`;Dr3
z1Qc7_x?07kcyXMb?$Av}>86M7q4?NSY=DRWVtq%V5qBylPBbX!OXuoVU
z^ZRc`KXR
zUdrmhI0S}n@4V@*`#G+yuXgyNEl)9{RdYi(x=N@sogO&ca+16}ZQ9wgJR)!;6*LoA
zjZ=NlmH`tQl3ACL5sJzR$8~+@zQBd)fXs7(+hO&{%?k;-M4CyVP;r@DNgu7zy?7rM
z0wA^9>GD=0c^cZ}p$&)DnoLI&jmk(B4eC51UXHmp8+T`BzHG0F(e3!1ftNnJBFPTS
zDvRp6W&&C@YdUyWGOO#TW8qXZ?WjA~O?ZsJ5VL&!a!b~~J0ij&!|JkR5d$&K+Fy7|
z#$SO<&wuGbAM2C<4!aEXRbSAmAxaJYqQSdF^Sa^E
z%=l$Q_v}da(4%EdQNbKENKb6SG_lXQJgn)E7-ql$=bWVMi&{~2trZcq8~&O)~I7(2nT2&d@h0!coe74VF)W(Ccl0QZQMZVkVDIv6%&}rV%<+M
zbiy0j7n;IZBG;s2F++}eUOeAbS|V60@#-Ph;_cQ?4}A4_dtCAK7>`eUSe&v63PJaM
zMRC&MVj`?#EeB>MU;g2h#+{g^F@0h7zU20y^E7%N8D(8e3XgHB8G&tXynz5kq=r0i
z-G%Oh@U~@j4b~htQ67Zh1?&D~0}%KU5?Xrp!Stp@
z5m17)RL6G&y;#D_5?slFoSsNS4VPQhBF(a+@8>K;EZT5^XtBMzNUW6^ta;51NO^uV
z;8m;*I$X5223WnNy=;X>B&R@XN!jW2bxxIM7pBAQ=M#&Kx<5C`wXFGfd00|Ln2NOb
ziHb;g&oy2c9L`NafW51ddmCtj9TQn+>PF)}f?uR@m46VQ?-ik8KokA;aeeL0?fbv{
z?tb5Augo}w@4x%_;k^EMukL)f#l1TG;G1NuII_>C!~N;XLuOV@li+OtmH{hhVEO=A
z`&5+(Q4%Nta1YkkL;+JK>xDI1%5k0E
z(@LF?T2^o>uA+&Sr=qopMP%?@A
z16a;oSBX0aeILVflQNV$E=`BXO>WxJS1!;=_SI-noarB8G$a`Y4TBNh7sH7OT94e?
zqUS1J$fH~*RQq9)n!UFX`Lv>q8xGpO41*5A1oDbBJX6S#E(DO;u*9SKv
zQ~&C8X~%(ceWT%7(HZJ{c@?l)rC@NM9n92Yp?wcL79yf0h=xmD(whmpu`;U}nPon^
zHz_Fqq-eb|(E`P%A7q4tWIv#~2N?IzgD4Bly`)1VOE)kE6p@+Yz1W)1bP7M46}e5F
z7B=U1;D;r!L^n?hvCkPuhZjab_qvoaQf$mNN3^d}=%pqSy3}rUa3R)uDATDj6+Jt~
z>q0Y69j05ZQ>RaLR8&x7iObNFY~PI&V9o>44=s
z=h}}Eawv;fp~GwDC@`>o#Hxn8{vbCALs_NABqejrXCqNZ_*_&~gl5_$NvV}+(RD;C
zbw_&Y=$FWoy{)UEMd4>?Kmdd1oV+bFmAlVA7%Fvp4;8Bhc8{z{@eZ{^4e(7h-sV!?
zmvVYqJH&ROJD6-7*)P8Eg>~APDLQSFUi#~aNUShP3@c*Y)>q&8>No#g-~9DI@&;m}
zxre}&Zl@rh$-uGuQBSOug2QLlEC9|))-cek`MM;=3@Pu12iT3yRDcKJMUIO2_g&)p
z2JLbrp`bQ2ij*Y*iBdvvojOgE&7}HUE06KH0I+xI^8~SvEL98hh+tNM<8uTxHJrWk
z0=?A)%zh5TA9}>CHk%|fsw&s2^Rg5ZCIjJg0m!vflr(Wrp-6%jh7Uw6Le!5HwG9!S
z>PRA3_Y%tn#-tFDJR)=8oX%V9`{fAGRo$rDN*q>orgYI8rOkl_QH1DN#c)3mnX+9y
zyTk|@iou9W46}laHKE4k%60rmt@MzWWEB^@sRWNz$lX`~JwfdhD
z7lNqj%~`u9BI%Vu-)IL7crp4-6d`}
z6ILya(v5KRLzm6xL&d;>#NgdiqO}(PYElFO_d=iMsmz$YQ{HYZ&ECi;5G(3bX%l1U
zUbU@48U<|012WE5uf>SIKleH9Ei$Ja`X)_sJ@q4r^XL#ABXW4cV)QBEq%ct
z0T>iev}4Vm*AjEM4PGZ)3yO*s5OY*%Ts`LGAXjWv4WVYIZbCt-s|Q8((NUqHTOcz<
z1XN<$1bGxstc6PXsz-t%!`cpVR1D)HgqS`h{Qm;m42nSFfIg
zaQ*Q8{i_fA!vjzCEtx=QH4zZWx?kJuJ6P=QB9fmF0(JCcG|0X}i3V?aAoDsb1|?nQ
zRYYQHa`v|`}4yQc^()55!X7wiDICVCC+V2-GZGK-Q%Mg<46MrwGeyG#T3>=lBP;;-MXeF!YiV42;
z)AN9m?Onf24?_{SBSIVRyOArMdqipMQX?h69`15UiiC2F8a1rSIwuWGIBVB6=3xUk
z<8t>BB=yPMxCu+~baJ|k9`cBztN!^lCLah1C((_kHM<&K=pp}Ka9bZeo5q)0!XSDSK)C>)O{Jyr4!!g1B%KGl6PRdaSoDaM&K
z2dnn<5c;?_5DE4!33*{mK(l6|nl;7^=b#FbmpgxZith2XN?Z+dmO%HOM=*7vl?CTq
z=6l*=>Uyxck`W=nbswP}XTYoWh@YV%xYP+;2$mnP5HHM*)(O@k@J0j~eiU<<^$KTB
zHZ_m6Mpr>o4Me8IZ0A@9Gr$3^Gd5rbHT(@y1%}&_7Xi&2hznFew1cFQAt90N(3k^0
zg^eSWsARb&9WQ;$3ARSx;$53TBcO)eJbi3`(qh$4Jp}umc!nuyrAM{&XMXvnQ#}rt
z5nx0jSo?qz3sk`a5g~bGXyZ%yVla|Z{|e|;#i6bSntH~p%3v75ocnCNtZ9%0tW)cD
zYo#E5(i<1FCw*|g4hE_zJ$i`{Z|9qSVGx-xZtwdY!DTmy`Vw6q=rcj>H){RYi`(H+0#H+}J~Z>;WL=C??r0XfJ*^llW+u1puxD&nP-bHyp)W70aJ;dZp=1MHUM
zJkHdws;#|ul-{e74OmutMEXaM11I4N8T5Hv=K{Ta<=qtd$
zm1sqVCQ8zz_2CuKb&tIbwOSWNdt!Zo2Q*cN(XI$wOE@(LHn+UHLpWMlKz>~6RysVoZwlm`P5Z$P%(hhx7)2?
z9eff)K;jg{qNjmAoln727joMaP1NQQ{;i&v9Up1PpVlW+Pz53lV((LF0-4bz%j(pE
z9*y)tFr_}-s#hdr5*5EP)n58`3o}2v0$v0anI_H!wg*~JV(-SjpIjE)qumA@W4}_&
zK@R6ASB5sYYysYJ!N1gw>x@X2sW+2t+oPcATv^qpdaVe1N)aVZ2QzrwU3!g~CXGl+
z$fDrdz8OT=Ff(!vT)dRvGjbuCXDEFBe>e?|I3PEbD&^eJ_JwZ)tx;VF6ws$+TyEp|
z<~dho!K;Q2dN80-8_7DQ@pz9lT2wCT@4FZ9?a$x5dHC*!_aDz^Z!0@;eR#hA@cqZd5KS*SMuMHAz=lH}B=k;!w_LKD*4uS(Vv-q~;p-o)1~;@9wdsiQJf9)wge~8=d_U?WCwIAFc@!>c9+AsdM
z|EvG@ANoVT=l}38{$KvwpZmGL_Vd5+&2N0;>Ft}d>wf>B0fn%N$fXR$AnM-2Qsr;S
zm*hVcc$0+X;*`aMI^7Irh9bY!-JJa~ip*CzJ*c0Lte%?606Y1rHB?V%9S2+mV%iGT
z%xrN#wQvO8_K~@cWy#1|mE<4}jw9`lCdkWg_-YI38b*&nutic_-Me3HylH8CNT;7k-v`r
zeX34I!+K>BA@3*-HmBb_V1ef=yk=uAN!X2qYy)S=+xlk5Z(RS>ZB!FjkyOCd?*oF;d<4Yswh%xC4{_NiKEH$HO4X>>{^8b
zcn1L)n#()+8J}{)I)>C5@W5|arJMLkQfSxdAcIlxL1@8CVu#nn1cxhC_YCnir?gcI
zAxI}O1u0H<_=zlDoDbQDQ-hXkKZ>~)@o96|$}iM4o>oe@S{Iv$BVCFo3{x2&H&VL5
zE)C&kO98k}wYH?3&eV#IQ|Js;`AiJ=DYt8R4N*OjuG{
z^T?tY=_=4JA;Ji|(HRRR5j_J>!?Geb!bH`0A>UuS3ZAye)E{W
z>DN9zB%Yryd~AC7>G~%c81vLGs>Zb?TZ`j$2%V&T41`u$`Et2XwgYr~hOxSy)$)w>
zO#^5lqvX_o#NO3orHB%sAdwybHFb0it)YYfo-!$M-wzjMQ+j2{jDT4bwjj#Lvn!V>
zS}Cj=vg9V@ReN>;*xL;M|36oMAG3SArUyaCd0yB3JZrt*@7^t_g%7@xQSGQ2TY=U;O^JFfL=h5
zbT9C~hATo9MAvy$IDMoxl|>f~%;JR@C;UkO`u~UAI{G627ngMbDTZU7q1T^gX#NSs
z@Q9F7DS!xhdjoZ6wxCmOv#t1Hn$7abDU>69G2X
zcCXm%s#rJ2QFAfm73|lc$|rqmH5*@umE9BR=aq@M+TA%pEFvnXu~yQ&MFnK*aeoy?P+b~A-{V2@^XLm?p=NG{~?O?K}Q*_g4p>KIJDL><^yvtFQ4N{_5M;(SOlT|AxQlr~mr@!(Z|{
z|NejQpZ-_=)qm@|-}~M-zWI&kSFgM3-0$T*?HOpSU_oRtnzfLb!f;)P7|4sO$c^i<
zWGorj2v6?mR8vHrz*<`reHEJK0a#gJtVM~5<3OH_#IVX4w8tTpx99@yF~^dL5v;?#ZAmHpLoRu%imzJvj=plJ$e
z4qsE>i|*YSV8&XbjEf6LUWC_bB-zsKg_lICs6r|`I>O5iMjg4RfGZ%8vQCk4G~Key
zL<^yFFd+hzMc8{@qEjS=%->j
zRmtLhv;io(E3kMmOqH!obJhTnEAw35!XB??^pMsW!QNY$i@;^Cuv`SXIB;!4KED2L
zNM|?&EU(sC1GlR#_bXEBh|D?_fkJFe1Vk7fV_~&S!w0aq-<m;ob>`&`JMN`(b!MkmHSk
z2%@i#&p}S6Cz3)_t$HiOKk7s`U#T@_I;D7NlRQDKCCD|%c&nzm>+#8qomwt64w?tkc6(ramLo5s1-(UYIlfazmT$D%DM
zvqK9W0QQzGd6l?GYvnY1MjS~1ar*eispugfrMFuJAF4|t)yx~Ef|0OnIeZ41
zM0wHtW3Y35wal(Y#;MkXUvEX$*$Pt@%@$W=Y*cG?nTlyP5i6B>O`jGgXQg&R9!;!8kEcp<eX%tdey~pwZ=DBn5<$Q?87_Df8mW=vxdABEi{zmfjv`Bh~~erns}s3Evxy
zYWa|BspT$3sTisc#H{}Z}0U|eKaE8(FYmXA@0d6DV*uZ
zT2V(900gl#UW`z46*(e5ml`fnGI06hYY^9ig}G62)M|>z8j*pj5`h@gg{c--YMUq|
zt}CVT%7|ij_0HT&r>L4Oj&_kOSF+9mwSKl_Wmcn
z^VK(Q>#zBJf8Ou;&;Qnc@DKkBf8?L|m;TLv`~TDR-EV&L^H;B4-_QMie+hQ)2H4TM
zmWmKzyCWd_@-Y!Yq8{F&$e~WRI}MI#)-ApMmclEc`^zcU-OI$)=+C*0**IV&S|*xW
zunCu0X|kgslvK|#H}P^afmN(yc<=c+sm)pLMF)b9F=kPlnkydUi@4@W@m_uF>pxvg
zN9?_KR}15wz6#xC`i~*S(a*b4SfPv3F7f=OJd=x3W(q-oH}cT%=zy_%e!oq1QJcOb^lWZ=?JQ)ze#E5e0KcO7`ORw-)ZwV+d#HX@A|g!tf2-IQMG
zN)d1yh3b>9LC5fgjmvXK(H&;W{WjTZAXP(Qt
zy^APW=SJ?ZliL7oeD4Xl&r?7Lt&s!}T@_%&>TWLoR>8CpE(g0?n*&_>4*@CNtac!~
z3t&o+Y$3HixE&^7a9ED>ex4a907Cc0T_jw>54wiwIXHGrG`{A}eCj>@459KcXOs!f
zThAIG13Pzjv05JaY^IFGVCq7|{3^Xk>k3H3zQ{ZTO>rU3Z@Es%G{Klmq_rFk*+GtO
zC>)c+j!^G`Px>kjF?(x-
zVseJkfp4Xl(sH1QyoS~suqDV4e7iEMyK20A3r%g6yaSlU5=9`_#wgn8B?R(B4Rwpv
z3~(dutPs39M0wuk%vd5~t!xjw#eM*^ODdzuG_VviYK+VkNVawf28kkW$dxI%j;v|5
zy#$e8z2mR{k&nOijb{vkaMksS&~xThd+J=W>HV{8D1-T6s6tBn0|P)JN@_RHbihXi
zR(EDHBUs3-sR^%nApFZ_a52T!3TgJrrT_>|!J)B3H*F5zV+n)QR%3;kuFADip1myn
zu66`lhVTQ&`_{DD*HROy@2vT}(y)HAX1QPw!!v-EQIpFX#!79^c(5?ELg`xYAksTn
z+DtQ)1Xt1G9~W{vQ5`vml9)9WF&tn5$n2KX(J@A8gQieU%O(R7#I#s8I>2PzwHH7Z
zO==N5h=^n&NqhFGb&;jW_Sz@p%Cu#Ok|*j#lt%g4a|fTF^7$#Ap4QXGt5^B@DV}a|
zyTxrydx=p(Rg^0ipVAQdT{&(z$p=x3;p|w)W+1L@J0XNIgwlS4e0M^Pr
z<=PrvR6Zcpve(;mmuWoqz_U#Af
zgQr((<$Ck(zKOS!m`xbsq2ri^1I$d?z1-hU?Q5(&$IL#Hr
z%0_0qJA5gAapIF_e)g0<`0?|bm-XH6y?p=MU;WU>ul~lr_Gf(qvr
zT1(2Z>PJyZ+enTd66Q$jt>ju&6;~xk7k&cUG&7{39ER5Btrd~u7#>tiv*l|-YB=XS
zrBpeB2Q^QIBXD1g6>`eU!RTY^$BtZ6GHbTc{%V<7MWEJRf?c}FujdpT)Nq%nUe#_~r010s=;9yM#Z`U;`RxIlI>fXw(c=bR-Wn9UdvZ-QD21$9zq=}EJme0Jwn
z(MLe-j%Vh>(&=s~HvvOvX!26uL4+~5b1>-Sg0cz&&=_Y)uL45A{D~{i0Un&{0Ww>c
zstt~aX$j5beO^gqbak$XL{+Js60=S?lpris4Ci!2G(}1?^4UO9!`%crBPOy-0js`u
zEWY){RAMtJ&0(0~yId1$T+oA;$VGxA)@`%6R(6$HaawQ=v`9Ib8L{^wSVyC3MUX^r
zT5E<(v>PCEFO=ULB68(b?|N%uPS*kiB3GW7>(ZG=v$QZjE;A#wEp{eJ!o}H;O+ufS
z14cyVLXfwOryYCe(+$s0@%lMl-}3o6UcHK^eKn{$cn;edcB!4#5tv+|Wa1JZo-<2`
zNJ}tWxXcf|n82egnOa?+7Lg3M!zc>%$2p#UkFY8H8VDkLDkTmOUs@U&0ice(MCLN(
z;BA8T%99T0YYiVD6@210cN>%#nVq|Kos&&tCG0(e7t4hLD;HCyV
zb-F4NMtL|@ShxC?M)+UtTjmNLr;l##n>;^*K-EQ1k6csK4NpgPcd3GG?NW)gGM8%w
z{Sd{^s)0C#W*K6L23WXOU9!1u$+k{}`m#r~N+h)7Hz~_&AuA7=6OGYmWF$InK1Q&L
zf_c3uT*04e-u6!Y*yZ2v?sskdga9OYSSsem$Aooy?M%$xj!7b?m|G84zyWNL+VV?_
zTv6vb^x-N<84?UcSw0N_duLTQTh4#WGi24@mh(*m=g$y!%an=$YXvo7SORFm7j5$L
z+F8}&C@C9@RT!9+3d#fC&lGFnc#*7}GDEAYGh@YUZCIgm0${BT&qO>%>|!GKM&ApF
zwbrR3xmKLwr>~#B`N{Kt`rVhR>h6`BkzaoO^77&BoF;RxI0fz5bqSh&i8+QBdo2Vr
z2#JA>)RI7-+Dk%{6v;;ihL_w4h?FQm35l~cM2|PeL0~oHnm+`I>?V^rMsP3(lQdkr
zqDuh=itG1#%~6n`4jC4qbfd^jqDXC>)%<@)AAI}tS0_K&_~a>n@SCr`cys=fFYm9u
zzW>Ot|LA}EKl-cw%KyUe`q_W@kN?p>`hWY6|Ku-x`te7feB;x+?{j}?RwU8K6JwSU
zA2?&UXb*N*M7Ca>DV>UGOf5mi`-d$p5$s`s;##cwh(*xU$B!Ba`TAye?OfGdYcB
    b;m(;aTS3(d9Pu4sN&U8kD+CS6>{T#EbT5vErJn2
zocoa%rushZ0)-jZrlh)w^`73;lmeI6?>zUM)T70C+Ta?pd@#h>Qy&8w@;I=0Y|JV0
z*j;4AmTo_D(!>;iVXGXyp_ppKRymWEVDmh2lTGzd5~RwuRN3#B7}o1*IH8*H0&T2f
z`CTXZ#VULl%L7S4D!fp~n3lywZDb~Li!cKpyfhL>x6RWY8N%!9Ghq$}U8*ay
zZD_}FvF<`QSC_>rzJ-=owV1Ez?L=zykzhGQ?c--B2Gn`P|;SY990|2i_X(`dsFS
zSX+)N;oE1k9wDYib6FRagw0%8RoxPB=Rg%vWDKJ0QUR#u-nY4)F*r~=jsw;tQIaK4F$4X%4wtQ}oG+YvlRU`k%!SDmSf)R270TC<4oc*HcVc8ib+b&D8-vY7Qk
zI_hgI-!un~jH+R*hK*!d@-S(c_-I*icx~$v*Tp5}w
zREhWiMIQC*{xduG$}0K<W${`W6Uw*`dCw+^J4;LL%2Xea@)>lt630+bvaxiD_Jh
zDx!{Cr?!f@5HnNu(&_HcStzuG5aDb-AN
zb9;uZU)RjQzAYmW3jx%r`*Cs6;szwv=JSnDw|w;+A3VqNEuNp^={aA$il?nkjXrY(
zi?asK*D#!>NE7*I7Cc!rJ!19`aU$sfyoaqYed*QO359?*f(pn2L9kmz6~e+T8&*V2
z(-I*XZJU!4TBnEfcBLlzaIMThk>yQ?7-*`BHXTCorfR8?R8CU{)itJM#u0#UV9ea1O$oRGG~YI0>Vx(-iudN~=E7`y=l
zst_G(Wdw6a9rjD@r_78xj)5f4DO_r@h&qfFxdM-f;XX;%R4(aL!Dkn9_FS2EE9_XP
zbu!)R%g@;dMlJxOYKH2ki)7R$UaAQWC04^81c+Ry(&BV;fK^qQ548sMLK9vyDMJus
zWTFltb7hk={1;xWe_9REHJxA7KFH*g1iVzpsM15^sO+Dayr1W_zxB!MpZ}Gw&;8!_
z+kQm^zW3$3mv4Uf?xj9>z0^sEX1w=O5XuNERE4dI!a&+%y+s&aRfWK*j_zFR%90vO
zjdUO}9Tu&YG_B19w=|bcOir1x1h8{el{BbgDq257q&qMc3r)zrs2k{v1u^DTXqqWQ
z(6-@S6mp-4ZfT>j5^vt}9sBE7`Pnl*{NU-;2l(R4^B?^3+fQ%&sh|9T|JC322mZ33
z`R#w-ANpthg+KoP`1wEeOW*kXv)3Pe^!DvrN5#?p$x%ouYq?fvsdkFIeGVKHIwu!j0h42&HUrb
z9t6N*6Bg%qdKn=Wv^yisAqo))CL^R=yr!w)Hd2+k8gn&sA)GPH&rg3mTfwxa#E}^c
znB}IRaY3wl*z)=iscmMCoVt3pW{#$g0NrZEcs06yiu9~OjcdjX-XV@;_2hrHYdQDU
z%HD+b6bh8=Yu6e&z=IJy_q{vq!|MLGt1_0(j)c5(Trmd|p+T;y05!AS<0}V1j==`!
zDAYNmS95bdA6sXCa9Ud87oZeVJp)hYJb!5p=rRVo1DfgMhyrAk0$_Fda0G-2h!Wi#
zRGtW`hPOSbj|rRvv^s)a?r@>LP(Au!ozp*tt84unzCUI4qr5~8;f|jTMrX=J-!2ZL
zDUI-J5aAnF0;WV+!mLC)RNFnivZ@`m*$upA1)&h*6^?lD>GffTgT=_D9Mhv9ja(23
zK?8Gi8|ccbXmA$rwZ)3nSzUcWF>0M$A7g-PFD)n_b7h~VkSf{3z_^2k>aC}gzPHGz
zd#{WOC5f1_2yUk3ULr8Zkq6h^vrjSwqbc;wGjYfW!#vEu>~l99qrb~kl>z+L^&>N`u68^SFfG10@X6-T<=Aj)YVTvKV2jYflUnSlvk&U
zf;Hz}EXzjb8ZlY7*CXnB6{l^`nQf$(eM#5((K)J#oj(CVh*OeiXuxh|riDCKoHRKJL5}-5Q!N|RJqT&`i^oAIxcz>Y~
zR1HZ0X68yhJ>~OrzPiP$r+EEAelSGeVIyFWzU~5DI)}*9noG@u`hg=2KuJfKA-p(R
z%!mUDzi{n9LES%CUd})R;b1*(hifd8t37S*vVExk6Z2dHYbSv^V%(!zkGU~l`i2!T?%HQ=fFa{%XXEk}3@K=k_xjA(Qpip{BNG9oxx!>=wc^u{S&
zCrS}WndGh!UuMvKihf;Kl#~iVE2FC9v>nT1t-;v?3n;9exHPD9&5R5gJ?W{V90qlV
zg$qQ;&O#(D5jw(sI_1
zxK{3+FL(Qjj;Ot%?I*z2m!keDs>1KgTye+8;f~7hk{p
zd%yhE=daf9`JKP_7Xj{onuJUw!?>r=NX#d-~wz?bkf_?m(K`7VW8V
zM!>eZ4x##m&Wr9KY)6F4>zMY49_ey|=1q{p+d@YyE1?I|Qi{2c`I5mMd~4y0!ESn$ZG`cMmy8oL_7$?`r!ja18S%`V}+Lx;L)C_8;ewqjiruC
zP_>@j3Pe{4esL0_sojyms18mK?zmEY#X$XoD?fv@Og$6~0-9l&*r#NJsY0Bv85l;Z
z`z>-Z0c1eyv(%}%7rk~1h(=+M)bMAR6hZ<#=d869?lQMn4KYL~_dc%cO5Mo#?9dgm
zPQozx_Vkot?=%1`dsUm{9A+)AtuDOVoNLG79+2I~`u%J{0NOdBP+^BMw1m;L?ucu4
z#m*NtD;ikc<}tdGQ0qDiT}0ysc?nvt=Cgrj%a@0PCx)m+@J`|4^sG)MvVP^2bQL@y
zEqEImEwfcKq<_=hTe6^apL--SzWBcL@X406Z*C!~&rFo*a!Mr^qq^LMBm8Xjyzl^O
zyyuE85~aggnX}`K&AQ4ET;ozri#%TOGZ$Y+J$Nb+=q2k`%VB>sCl|wBoD2m%>mnGD
z-f84tE7zqND0SD`JF+9Pi~Dx#QwS2#jkQ-q)Ls4?wi9qQW8Fn+yTC;z6b=K)jQ}#b
z5E(fRlR~bld+*!IY_C-jr=`fw^(3grbs``pD@-WD%FWEB#Rdc;*V#;^lsR{Kr1}<~MHa3W=(wMM$8b1-2nsLSURiR72}H30%8?Lt?GGA9~`~1hKbx
zs$OY8w`U-TLTL9FP{nID*azNz8Zr&OCSZPCO}@LIz1Lp2`+%TMKi#%)O8sG4W|Oxq
z0SSG`$XILd)x$YC_tpj-%^RVmU9e#1el(2ZZ71(>z`YlMB2SgXRp)drd!4i|=)?*UeMwb*b&45F
z(+5V=n=-n&ZYyklg~9tS0|^mImEGd$IX%BB5OJy{t|Nl%m9ZC|Z@4Wy-SYW4KYX=b
zJ?E=e@%mNV9JvS$9_<2*X*ZplR8xd7kOoD!elH8^|C!XMgAntx6(;(k@+$Z=NR8iT
zER*r5a2`n)Kt|n3aIXYs@aRK=qs8kZ_WaUT)~PaR(eU5zKH&V3WEEVUCr5k+>P5_-K~*~YC(59;nkg)
zkt@+?EtM;WB#K$1$Vravr|M&gJX4U6@Q~@Ulv^l{iHTO!k$#|!Dt$%ZboUV^&`Q>e
zwp=-YnjU-Y!B;#L)*VW@>NJ3r%D)j&NAb>=*r9s|7KjtD_0C@Qkxf3@qa}hN>afdO{~qId*2p|
zgVOMvy6VtwB5V`Q_eMkFGN@J2Y=G>l+AG6N@*|<^QFXO4SDo%5$7@^N%8Wo27b;d%
zosVDNK7Muk&bycU{pIO7bFKRezyI~i=N~@3ec^3oZbUKKb#_MX6}jT&-fPE3G;wc!|4qEy@!6~Ro^t8W&JyMH|>%CYc*>(7sJ0`MydJuDy1!qs+enA9I#9HmGe|rM-bi>OmI|ag^OT*rZFG-iE=?}ceAY>JZc}$1Gx8*
zB-LUr#T8r1P>S(3#Zv=T6gBvCo6u$qInXydnThbIfFRxHw{4A#zHyL7UKu(p}#1$Hp@%80CK0b*RKx@*jza;**!v!9U&{qtbUXJ_SN
z+qy$%#XyyMEvGpx*^c1@#x^c8Q`nN9q-l3XEL5nOLFV7UL5m4!WveILybzs%pd1{#C>Z+v)@?{>Iu%+dh%#YPHIq`M+Ox`(X}}(~S%<
zRD%>En7J`faYSg3t5jB^#$=?hj?8UP)-Ac>`QR>ys)}{n`=)@ED;vnjwU!$GT*D9z
z>|A@@w6Zl#4353`OVz9A{b&Bz>knU{UNCse1cy0LdfDf6B4XPEGlnM|CI|r{%t-Y|
zq>TA>6H|?}_7wOiw1c*k9&xwxiEDcZ%QGoZIcU6Pq8DOU&jZ}w-3~vKE=~5_6^r&C5dqa^LU6V
zNEI|jhU;Ad7lwhW_@DIp0O04~_KC(09qnhgXI`U@hsru~tA8>>O8f2b#mfa-A?s$YI|8
z>Al9<1CYz|T2XhyC|zC&+ekz#MntT&GNMkU)24Yned^MdihqMeHIuo?<~ef;{PszR
zhZNS9vm+x-2E*PWbw{7>M4F5c&}IvvYwXEdku}!QwW68_G$k;df!_fC>AQyE#0-6j~k{Wyqu_oa0P73djwJ
zjdO~DSScpCo}RXI$(i3EcMZ}Sawh3$T_sR?$ll)2jQnYvEoQT=-y#kg2qx!+(
zpQ2VK7nkCZs-vc)RKWm{_j|3(ozd4Y#Npbi6Q@uBjkWTyq9FsRy`uMext|Pt@U%Yr
z==o27_0_4W>b-a7`r@m%@4oTjy=EbSnn(l|jv_w>H*x|+0HdPMYOV#n5ij7KQZRh6
z&_L1~4KhuIw5yi1QRyDIDd#b;iG@rpJLq%nYpu0bb)jvmCDe%zK%u3Z8ogyS$x|1Z
z2o{LS=((E(jdBomn9F5bHBa#tu@;DYQ|QK5xA^1;CeFP3CQ_Cfio65jI36O?o6l
znNwN=)0EO3gXoR{;TNq%31YjO)T+m5$%Dvu-M#j1QcK#z&7R`rvDZzVm!UaVy$WA~
z6!nO#8y0QB<_=4xg-hVBj`Zr_X%V4A*#7G0aB5{d#X%|iwLX`m!;kQ3I5aG+F1Gt
zmk(O_(kQ4}**E#x&AYQox8e!>={fJZ5uLW+cDd@&mS-|p=7?MIAEgFC$H*w_7P}r^{-~oI>i}7`C0774#`}CHiyvH3(TWd6mLUvlSbW;*^asfub3;
z#LOEZyh}O|=Y9vc7c$pr@y}6Jk+&EO;Bv02Ds?!StBzxvi%XsDuG6vBMn~1*zU4&G
z7R4bV#EO+9*Hqicl?198iwo{;R&I2eKhP%KM6R{AFgzjFllwZ?&RKRrQhjW$ln_|~
zDreTs9;
zf0tbu=@uP&4Tx@$7$aAdkpA&B5Z!cA1Hwy9*IK!->Qprs$Z?U=Iw-UFnixk)sWPgp
z0BHRv4Mv(7$>cfBCHYMa_=W0@%(XIX87=rQx>S=R#1vH&67w@Nw8+a#aqQ(#nsF-F
zP2JBKoX3j$yVKxWMlMfxE?u#>YxzvIHZ6@V?E2n^#IK1DyLxNzC|C#ihW!6mu?WHN(7OqVvz;)T3wZE
zho-=o%4`W}7tkuyM(&YLf>3Xe4kY^)09aNvN5opTaQ9|<&WVb+ya^s=1epSH$PNol
zQ~`&IT_6mkOG&7ygrb%nxREr(AZrx6A&}K9c8If0oa(9q;bp2bq=^jNxt^C=hzV_!;OMIA
ztX1S7QvIlGhUcZKgHvjEv6``#Tpkz`6ym|6RCeGIWVsU6RXr^dBCrFWfAnhq;`h(}
zUi}OJkzc)e_qO__c}}ktnUKa){bwXlP{PSU$|9rDxM;B;1`QQCV
zf6wpu*`NJm|MLI!-~6Rt{H1UHz^AW2c>VHnKXoF56|s}`qSwTNhOQ!xMJC1X^F>-<
z0oRcbd?O_XxwK^Q+NvN7*|pXh(KDQgbeZ8QYN;G2Im^;v>M2267K@Uq=FwJOPJX@j4y4CRW2O~A
zN^9Ng;+@eQqmyPxy)u)e^s*?I&6%ms?`NX6)00?tWno%=WUhE`O9e@UEvwX^i8Ctr
z&J}
z5fZJb*Dbq^bM^FxGpPc^<_VyvDYyLm5?xWZ^DVYwiiFpK6K-;XuYpzybMUY2eUeX94`W7>H|N(`6N
z5Q8sS1jty@#7lk2hAoaslf;ku?g*K((+
z1F`o_ZDFMP&eZ71hEn-xZY?
z>gZ^+i?@dUdSsx{r;ANu@1=Y&Z#T>9ue*dA2317PUS89cbyw*w+=H0NU?GTz)FsNy
zbK3qPZ6myW+bJtondSv0K~-Ud$ygz?4b55|VgsRZ9;z=}NufEI=E?|CYo`=KR41P!
z-36FRFkd|OUgs19Fl+9UvDHlg$h@DfLO1T1xn$Q``AYUkxA^dNynf!#uh#RceEk}G
zVioj83-@c#3Hv0aakK}K+f)|aW&@%=WZ@o_t_iOHVsOquq*_5w@kO#m4a1v`5C&(7
zSSn|)JxPFOorciHYX{?%GFsav
zqCC|Y*>-vOIYwv@!zSLsRk;?Bv5axfd>gSm%G1>6oUVH#
zxU`i>#F@nrF2S`x;M(fU0YD>Sf!!@gN$5$W+2)L9Q;Jjd9!6ul`qz=wN6|JOntiE&
zM6N*3l4PwO7j@snQ%`G&t3k3F?Hb1{r4oX{i?)UFU-U>{nb-3xYS>#==UJ6^KL_DG
zaH%Dh%L>!m^D^j=JoggrmJwY8e&*#`B(%ihz|`PzlAwVk&*dd{XkhsEgLmmA3d+&M
zAZ@2ChEbopcanjT;O8H|`uKzO<(scR`sBl|TABB{fA!|w`SAAk1s}X#D{z#7uLd5W
zhl54~LUSUbx}!tGA1lGMilYJW)LG2i?WT`JT`Our4sA)zmBHxhMx)>@=@(T=kx(P1
z+s(d8nY5yzJ%$XhxiX7=SSzBLiP&2mRF_taW>kzZwX#AciTjZf&3b`zXNsXfcJ+#=
z!eQ);K74!l<|$t9`1mr2q@e0p`sZa{fE6u~nx{>7DEc}~{&IPyCrth3hohrge9k9PD``abssI8U#{t#z
zsu?2FGgklDCVNG;*mBxQr4-bU^kFXcj@OWo$fmNj9SAtDkfc{r=2#%8l^WJxPWG2?QKg96!_K4pfK=Sqvt
z1R3l)L@o`)m3}UtWRaQC=#2e9z71M9H#uJF9=Po#4UG?^t#Z_Sn}I1@i{f&*b@hbl
zC4(kGs@SwyoG=vsv2g@YegfYI0R4&HJJb(g{c4K^B4O6}qCvSiG$|hyfSUem&?*#W
zREWk1M)T7ImR8D`z%cHE1h%se*iGAEls%+m`2l%DIzxNLv@dA7>!x=!cQaS6%%xfGO@hznZ~2X{Kl?ajfv6ljy@reX@SXD862onP{^>W0
z1U1S<34Ji@MfHR-`0y)yf|Smi(qCQaU#A$SI#(>|*?e_K)j^?ETVOG_d=O<1W_G&x
zw8DN)iRdmWgtVYOeuCDG-2x(#6E>J|2WzegoW+q808!Avfjas{7FUDl
zGNq34(y*fP
zRuz{8_PT4)$0gbf9`x{JxBw855XbLA*F1GjPb_0b+}GRD#MqI~VGZ(V*7FQ2qj=>v
zA!T|m8gd$s@Uj!0!>8wc?uA0GtW#?*(HU9>cRTt7!78p$GR5R#O$fYd#ptMcZeSyK
zbhGZrh0sq}399W0VoiPTl0PT_V@^kQ}5&uev{eUqmFs(_h?Q&QtDu%G2@vFW$ZT^n-URUyDW0Mle?J?uk})vB&jMHxZt3
zJ-B!(oP;LyK#y#US_)91PdTJWZUDEZm=Y_z1xMwp3ot~?WZFk8=uxO^C&y0R!m5?I
zI)I?@eQ#Y>n@U_khZ1W5t>IHfRx|b@(Op{i-o*;6jN2{Vz2MyozdHE%IX>R`{OQx%
zcm17r`2Mfnf87W1*Z((v_h0^({`Nok_x>OM$v^t9{6|0c^RI6Evu}LX`}yVN9pVJ5
zs&cdM@3|;J5LgVS(nc~G8?`Jy9IHsO>cBd=$@24vXy`!XO^e_jK&YOyShaNb`UtHT
zVYph*b2@D`C>}Vyo_$7G!cY{8L)(KhBiKhy9D{o3Tn)o7cbtEyJHIoRyP9$?r&0^V9X$HoAgY*rW
zcQ#e4n)_fz)Ywl<2d!U7r}6;}eV&4#wvFVlcY)xFJk^NY+hU4B09X;H%xYmOTq7d3
zy(39Vr%sKf<)SqIP-Dl*T5-Xpn7(KZ^2#v7BSkQ-eVHc&0o>LyDl6_1dbrN2M1xcF
znwpxSjmFBh-a*rmdD+Yc{Idnm236$AV>tb!wWp!AAXdIYXvA`BJjjtAx`AJ%fpGmd
zz48Mp@J!zwtkxCkluAS=^db>V!&4FHQzsA^OXCNfP8kQOVPK5)lL}~7cW3I?6>Wby
z{~qA1@{334@xCm5d>Nd|gbB9en1U&A9V~$G;wGs4S$oiFKrCesu~cPNQ@Ys!zN9ON
zW$Y!?)u?oh^xo%Yt~{sa!uK3{UPCS4z%hwHpsO;6=eja7DTzh%S|Kg;y{pzrh
z1t8=^-?QCr#-d2g2WEZC1EYaQm*?<;@I>bb7juAI3mg#XQwWpjbO0OU&mAt2g&}r}
zhuPD8bk5dUm~2CmD-)R{&bg~6mqQ?c+#2~W5_LZsVqD0Q)#YtB5oQ-V)p!vYgJNSV
z9yf}@k3dAGR#X`HOnt{dM3Zah7I>aGg?{ny7r_ngr+9jf=cjmn%8y>>tLJ$AoKH90
z_Vu1gf`!9@u7Z&NR$QRf1F_)a!2H_(#4sC`#(1UCUsG6cAT%{9P29WL*h}e$JuGy=
z%xW|BciY(%1e@*;(e6I`niin_@!^P>18o>|9LbH!DhNHh|2f86R2B#)xgs8`^k0G4a{o5d9GD~+b9
zv)u#XPpuhtj1wVtXwVs!X1IEgQ;bG!?uf29ncY>DPh0+u%nae=9!JQD(5a{gNpS`*
zZ_)z5`-_0=tM3T74Fj}}!VW=}<;&IFZFC5x)CV=18S*F&q(?qYBU40N&R8ZlS^W~Z
zcbxkHxb`|-E2G%C@ErK&$FKjtfBL&$fA!|o^Q$<8jPHH@^3_Yfe!?j}tynwHix>&M
z>-vE6Wjhkf{1CH76WQpC>W@T94cPWn6GS+f0x4+63(VAI8B302xr!h5DKOq&hD2%R
z`cy&g_8mOciPl4#n^!|87M@FWeYasK>43W9E-KIn?#zq>?iJ1468OBsyO;j@hEJa2
z_0zh&iZ^fTKmF=_`|JCU{?OC^;&1u=f8}5PyZ)Y^{iFZfKmTw1!Y_RL;}1Xh=+lp?
zt6p9ZMOLi4S~^P|ra=V)F#4y{08q<=8Tl^x6y^d_0n%
zL?@B!F=_|^4VT!(X-C|!dd;KxmEi$_{~E6grlM_H8l#LRN>>6ngRiK8hXA<2s+rk&>i$imtiF0N7XXy6f=85X_pVkC99y^rC5
zj=;(|)hjb|vAV^B35jcFzKWoQa>uQssNbT>sE47&XI=}ZAm&C^1U_?tHE|Ox@6K7S
zDBaR|tMF5tZIT9-7#APdTc(9UGi1;jEmD4U#YlDi-3QRn1@Sm^ke#>y(MZrqbLBb$
zh4h62NYQ#8$i1$p6z|g}gA!a&RC`ueq^ZsN0pO*`^;OP{K8+;oL^o@+WcD~yf-VX@
z7;tV*Ds$>=QUg`h5or)w-fyZD(*ICbNv+44z6HdvYg(PN%V=pLM1tw+wf2${Ywr?mipbmot9Dw?q@^FVh94Fw`l1%#2Q>fS43+vk&xR>tQXWJw}cB%5T^NS!qa
zkzZHc3mK8oRn@IR_WG(#Qj)xtZfmO}Q*1p=Oj2A>;C5S8UDda>1SPw^oleH`n-mTr
znMYO~hD>4uY37TAJ3)jjVce7C0-_FH-u1mIBcE13zlvAS`N0S4!{>PQDqcOutEX7L
z*@}v+qsrFbE7Dfmj}~s`DpM2mbN!tP6%dLLWe%W3#SIWgPd=@A
zXhwOc6#*;UIW3Leq(}+s8)e7ea+IOcmC-LXMFGegv5B>&4Q?Rh_c=dVOz8=PF*Z&@
z^F87)d*%Tl&kV`&{?Wp!=YWG(AC1ke#V14mMAeAwb|DF8M%^1ia?*SR5h2ViFpq$0
zt3)ms0;e$N@KB0~9Xx|5HZHlB(!3ZAl%1wtqCd9FFN|`liA5mMhXB?No?f?<))yIF
zSWh7XVOBR}u||^JSgOkC@t`{M9y@XGQw-sqe8NIj}QZf(&Zau4#(hZZp+<$
zc)e{dvY;I}D~494(kh{ji%OxNk=dtcFO#b_
zhG@Vp7~HAaQ`h2~2H+a^oI*ezlg_VA1aoDzvLs34t@>Q*1SI0nI9(yUi)%#{d5TXf
zGx{JFya;z%qb9eLVlb@kkWj^Sl!^^OJ;mG8VoOM@k0M=k=UV69;hYB-YoxL&0XDF%
zM2e~=xH7A`GuK-8`w<{g@=!%wwTEWD+J)N@?G>c4GS8vp```TN^#?n?{_5+Ok3Y&-
zvEt3U`FV{P=!)rSOdB6l)2QMzJ3V|hIUAchGFz(q3D(mD!H8jAMLHrZ
z*czZp)>slmFjAJE&I8a}SF65!)H{F?>$O}DuhFj8JK0&CGH&F&YiCKUsde3i!!9b}
znXNmAel(1jGzgl+y04Z?XvOl_nHfuKr+OL%6;@(-s`PJ}p+e#C2>zIHj=#LWxWUz&
z`6}`~!H{i0Ty4N3M%Nb}j0wEmxsYjo2Ms{zRI6AeI#*<5v*yRg0|s$BXE;x2pf)mG
zui`3f#-GBd*}2MoImwtuYu=KQn)k%2W(W?
z{+#}y#9phbGb3as0J=^k28J=0!Vn9*Va(-GSf`YlaE*KNS|V2HmuKtp~o4g
zsM@0;16K{w3mQgrG=l$mtZUq?1Um!c27GDD&d-r+DJW<}cA;)Z{=mjQlvL#24v-u(
z+d;^Aq3kgP9u@8}2_#bE&|vqz?U@z@GNU}X!W2-E+6WyptJkZBA8m$|YHC;Aaj(3d
zLwM@q@EU9HwN@q?9X#iLUS9sJpZNHPzWJnXBCSqRYihuI{!6-+y7*m>yKPR_JZj0T
zz?zArL;H$EcCn;k8%YXR{FyM(ZPD*7cC;
zh^8wy3H$MljLJmyG4dVBXp(7NO%4+c7AirwRW^C**wr9BE>jQ{Ozc?bLKUUiZ}q+E
zwr>)IcXvwb<$BBuJaw$d!8n`Fd^6(F8OUYt;)r13-CfdRu3LZn@%qNc>$4Bz^#|+K
zletf>8QWg+xUf!P#VZHU;D>F3>3wI9YebC1{Tl?wMmUE6$!H>u!Wu1Qnuy?LCY+D^c&O0Vd*Dw!Xt{`*k)`|x0^pQc!q!lL+A)>B(
z>R3((B0b*keY@>_%j#Y?B`G3s&fr0?4~pm8?cqPd>~cp-mcFg4MVm?@_fBH%)IZ4;
z=af<#fI78r8;QOw=!rRVk+Y{H=ZWmSL~M+e+1aDUnQBI!c(GQT>fBK$Sorw$(`O%l
z_`UDEx!>#QX>SA*-~aOM{j=BiSV5Qz1Gv~!8mR4HMpCocEYzp`oVD0
zw~@^N?##GIZH5Zkz~fMU;dCH2uPYz>);V$VqQ@KkyFQ3YR`9(75>xBLTBx4l1czs!
z4I^5#l|xU(CT|N4myz`B6jS)ii3%;xs+=z(nx$<(-%IrBEUcx`u{XVv>c6Ai+&sRO
zVm0UcOcc6sgehkIO!duu{vVIV=`JNFC&|RP!zg;stqe1;Vz1lP5akSwrdYm4ubHc>
z?Ew*!qjd*eq9NjfKhqyiue&3G&1
z6yqV-UuQsCDGt?HnaLUux3>cfaHywwVGj&q%>&V;ijXy*?L*0~vf){nc5gFy{nj;5
z=ZLuMy`;r0Uc#$SGUNm0g!b8;5{9$ig>%mkz!F4C7D=T#IYdyq!t}A}j=R{W?&N7-
z1mTM<0@GB4<{hYNAws!HmPvtTj{+wW>W($EC1!o2k
z_hTfrXJBmdfUg(Z$i+xdknvFLcw7$5^gO17AD)(`@oR4&+47jbEa+mb6{er($_y{c
z@oKMSes@bwdGGr8!~Ch=_`wHHIERVYUW?-c5>x01
zHhEm#0lAN+1c`I>NSu!~?22FpSggZLnEfXBqJ^EomqX7%1gWOYS`&5rNbAg+nD&*2
z3si!sQ6!-fUAB#yFa!csUES5JYNR;K3K}}+33}jDT@i9;p|DH<_fv`z)bdp=$*?Li
zNqLPTBCTK5Yl`TuQ~mOCbS$gomW1xo{*Nj-8nn#MsS)%A3eh1|aar6&nM=uSI#)Df
z_B3TiRL7gQ{ncA`_a`6oKlAJJ&-uw$KmC)>Kk=jco1f?FC!%={&*5p*Bj&hg5DD`t
zC*YXXys|GJ{Fn>fpE~LqANp^$sJT>LWf3*w(bDDw6
z1+<%0WQ3Kv1RGt}yVG<#r7Mx}{TXVuch1#=AjfLnPm`3ypdO=mRP&gzrh3#E2WBBz
zQGQ^gh{67!BT$)6vfGpYuy?fgoghJ?U*b{
zP(jv+$hBqEuM3AO>8P*l7TJ~ETs!GqnxLGJ0?@r6WBFqftdi1Unu`c6mC>)*x2;N9
zG&Eg~tG=ZB#=hUHo2u}7E~CA3PfN~Vh&6_U-*Q`!>bF^)=3a1ZSMi!7=t{@{Ip9U3
znDOcTt|6YgFVfaz;xn%m8Ycpng)D4&+6WQO%tW0AxwdAZRL8Cy8X|#uQ=6Q7Tn((1
zL3UM6HXy|b9v?on84kI0Z7?}AGP?V;dl(>^(OyI7O5J6Eh1aqz*R3i245j<(S=OtV}XLK@nYnlR|<J+re`GrxguuG>2i}@uXg;vCm&_^ySFdrNa-8j|LX0#)7tN{
z7H{c3Q3a#kjwnr&1Y<4P?W$cN*{Ue0z0Inbn#N2uArFA&Idg(SxB6V^eRy5ltJ$LK
zElMsg_kU`>ZhfFI1vFf`tWEEV6EVjalT-cFf23Fy#?`7S
z{1{p%bqIBaQ>PA$2oXLMgvyA_cux@T(;ktchDOk^CFOWbs`}6m*9}vLQq^bRF5iU~
zUKwoVtuQ%%3T?To##J46QIjLSv<-P@S6Do88Rr5NQ7m%
zK{s2w#Uvf;Axe?Dk<7e+arYjgLWX&V3hsVZ9MrGpm61xYi|l5(_YSIxH%&zWh3b&>
zLrjcvo^oD~lE1Mk@PT}+=?=A>3205RkID5@6hY-(@2^9>Ktp^CYP+vI39B#LOAeE3
z{3*oP_LsY)sX_y;@nLWGvb<)D03b_1wQ75B_l9J%#W8SyHO+!Ps*3pt#L8}FLP;oE
z_PI-Y;inpN?4`?7rI(0EBm%5c>JuWM-MhImkYew8=wTFiUQrG-b9H$Hz_m<>_1I8<
zPH2Viv=^KXOmo$Z>-vEp5(>ScfX+vY9as|9=*L>-M~>=TfR
zXAeeX?&qhc?|uF9BR~A%kNvvWgcx7*j4vZw*U;`^{E)=F#bnuwNY?6#U5h6Wk#$^-
z`x&J#(B1*4g6Ukj7EE(icZy4Ms=O*>Q}cKG%J1InHhzAbuAHcQ
zDH-jQV`_Vbw_;@^!;X#ZhFSsh+*{?ESaSwk0|@YV7NiP4yl^Ou&TiKS-rKYs$_52C
zvZAk_&aH5Ib~!RZm+o&T;24NWc&(1K^5BF_&rSS)B=QsqSqAp|rX9acUY!XBeuhM^
zv1CMtK&%bf^R1P(%pMz?M68tvO>SADDi|R250xnHie2<#LY0vSqN>lNqp?Y7wyX#p>_1Fx=l>b1#9PCmmNCJ@{bzFyIF
zy|+U}d(M=|SL$P?fx-6dTOUDn+f{$)RQBAC2+KrW`h;f-ZH9(!CfbwSX?V3tPOLsZjEIFqb}?q}**Nov|I*@2svuT@73rcLiN2eI)?l3i
z%xudQ5sU1qP@HT|)C?0X^;V>LA!F_33s3t|MFiF`x|>T&zo#@mFU@2Xn>_`-rpsD!
zCxL)zlNcN4oDdviw2n-&>RxNDRy}CrYshUV#pWQ@_9F7_yL+H=Wp@AICm(+B>h|^5
zZ$A3uLrpQ?RekaG{qxtiQ+Q_F7E0jG9nN^BRXt$3$XpN!OGCj>2w%BG#y;ZiA-sl&
zfWRqIyWX@s+;)x`E7A=l2KlW~_l*sK&lCyUO~b;zbn5;bMw!@AU-KnNf`(
zGL*@*jfn7OK^Uy>>u*G$5mn8IW`}J?^5y01oq=S=IeaO8x#FW|e)1~$^z`QI`!Bue
z{q>t4{^a>@{~!NVf5q?po&TG^>mU8&|J=X+^FRMf-}v;y+w=2U0Cqr$zw7??oo14B
zTce?$B+503Djs#X4s$!5kS?vIo(NT{-7@bMVbxp-k3!Qw#PF|MBCBMLSIJ4#;kA42
zNU+!nk8yFlm6zpJsY&DgLX
z6Ks$c#dYHtv
zjGL(e-PpcIfL^^omi~6v2;vDtHbxX;ZVE_bTojurvHYgG`*6Bw8qCPR7{p8gt%Ih3
z6J7{6prD&hu}KriX0?hJy1!-pwAgAFTz8(8PZP|
zNMU}0k)fFwYL!a2G@UNtq@##YrRx*|>7VD3z7+;wa$q#gYcj`Khggv^r@;tu1;PmI
zX`s9z4b;YMfn&{MaC3%l!h?t8U|d9`Yr}HJ$tZA5|B=%V<#-(I>E>O#aPJMoy=G|`
zVKHg~fpf+}urwwV_5)(UmHLC|t4tD7E724=e+bY-LzgjYt&Qo`Fi=vaIVW@eBSRtq
zDYDpB8tZ{rrkkl|^;T+KkeO>gt-aURZ|lc?^wS^ufmajCb*6+2_*4TqK(mG(sxhw5
zEu&^g4WemA^NJvBGBegPS4JR=I)rAQmzv<^$Atj2AmKOZ((xsx^L(E}`iOX*>{n?=@69?R;+0I5MkR
z-d%$s>3!;kx*K22VrU!`yiaU%e&4
zAO3;$TYvNOZ~M(pKl07I1?up)C05Nj{~<|xjXX;G2}hI~k7G~dNwPAU{0yBtixPST
zfg(@)@^-Ui`wg7JA&VAucgxKJQj>K*<^mBGjt#W
zb*R0+F8_%Dy-HLw=UMlpiK`xhZf4gw9_u~zU`14Mh6sgWy&BrS)diVNl3mY?VWqxx
z%&TEP5=stONwN-Cn(D7vvCON7TLd;r0e0DCim(DoHKjjv+bB#|BGbN8Fa)6Nn)|kL
zp_@Ic7KYFy-vP7?Z&hM6A-y75GV8vri0G1K73;8$ZQkYg4lq}0nYdun``zzjX^WfK
zo5EP^q@ZH|f?S5rkpaMm4Xl|HvNbbQc|{)0Dhb$t{?hDpcXjnFq>+=B%V%#%PHhje
zm%PT0S3cxL6{a&yLQ~&IMMZ!?8&<{MLi3xltB?z;3%!fpW$#~6ChHWYB;2<(v&0~&
z_wIDt5F>T1sHuQdUjmY+`jdO&Ju7DgfUL}b7~^T#od5{6_`(dmHkQ|%S&j)F?9&%1
zS7-sofRq5q;>vZq-EMn%Z6yNiPd>PP{^9e>o3CG9?kvi1==)#1IqY+*>u
z{*J%lcm2+ve)HwKKm7~euKRgxr||15_+b8(!HBLdmgR$!$FC8ES_vig%w=MHY#V6PxMq`bxR6$GhH?l9
zKhk!?b`3+WwKC-W$zr#nt*I$W8hC$YYfMx!5rSs?n6L%}V#SJCd{xxx%9UH-DN8_x
z9uYIO4#ThhTI~negu-b}x2kFmFpJaOOzkkmqUL)(#sFHz|B)%RcsLXJ`O~xhnW0UH
zW1BeWA00~A;;-de8jwy~feALAmJPhb_glH{8v18*SQx|8SM@9wjeAhPgMf&)1adtp
zGF(TTB}1jo4qo5>3_SjVHu0ZFbt-#T-H
z{{vj;P0phm0M3f`7$io`aLaB4M%R+^NeW2tX(p8^LjlXPMMoBf(Lx{C0cyXe2Lzhf
z$Ua=u1Ym~SbPj2Yl>y1d1JE3`FK~Uu=qsjy(SN=6a75%<_9f~NvC3e-x|D$=rnI}Q(Znbl*K5abPIEG?Evb}vbB5M}Rda1-!YJdhv
zWDeuz({|9^t&L9+GRv^jeU2Ir7Q`CSiOAdhS7s59Oza1fwX~1Y86n%dtRN3qy~*mkRtrs{8LJ$
zDj%uyQuk`J;UYZaZ2+Mr;T+GHv_@j$LB|#GlnDlXc6}UC=9M%MYo|B+?Od_C`n0C{
z+6TSj$=^tyqndl~h&WnK9~R)PwXnn8vcQ_gsU8kuYHGEX<-R(;c?Du!UcH;pFDiF9
zE3ZK5Cyas7+JQnvb0FlZr3>G|9SPvgJ-YbG2l%mH|Maa-L)gucZ$ujRiudOK4n(Tt
z{JZctqwmeT3{NOKMG74vVYv)##4{7EIK(Oi9K)yn@$EMxGgt*JVIn2Sff}xk5hx-8
z)lBg#dv5QQ1|mqloCad8eE-pMX#d?T`|e?sv{XTGnz!v`=ur7HXxh+)WPZXVBJ=5K
zou<5zG|;_141gvz#^gwwaubX$+8BOuS?_9A?OMt95Lgznp~bUdub}(8TDQzwss-IU
zSbm&>DD{<9w#K*$MMfXOG6!~vj-mcjUvh9`x;aqMmSc@*O4qSCQ*=
z)Uq3WPYR*$a!m=qjzEsvb408qvtCz@64A*b@WR<6Vn50Fk(try!ei7jJ_Te;(R%J?
zV5_**vI@08B+$6GF~`zk%&V-KhsrkPUMv-kR#SPaPQk%QPw~1kZn4%%wWMHBgEL&!
zuhoj($VEtKidZ|A&HQ!t1OZPCL{k|EcHy?uGF@l&ppvgv<9bUF();RE$%@M!SNsUK
zfLtr;c;Mi|%x=%=*724u46aASfwq8iuUw(nxVK76DP~Eg2dB1oRZn0Gw>53NAxj;2
zM0Mw0x*&?ZF!R&&NYxVEE#rMvQ1c~Ka)tsFC*3GL0LYySeHu@RAN=&gKlz<6-@JMI
z;qz16kccneyu5wsk3QI4h#U5fyC>eOU6IIzFDMhqYOt^(SGswf>_lpH*;0`i8rh9f
zne@IKQzJSe7FD9s#*ML<6LXSx)t`>7UBe#O1kqO3DlBxZxg#f$L|()kM(*hg?w+c_1P(GfR&*g(oTm6_TtM^7x4579a>vI{_~hf;%e}t;
z#mg7p{`v=Bt^d~V|LMQtXMXzc`g{JFfAk;uKmR*_;y-@M{`?0%dD>Z3=YF5EHgHOG
z0_7|ZehfOB-vKw1U94QG4lR7V?8zi+)vM;yWI63l<^n=RtRAsNH+9xp;$0)Wr>O3|
z_k#b7LzJ$BK394*I_I)zmY_weGvtjaU8p+n${@%<39JH!%G*SDwM}itf>3*54Ot3`
zuv<2YCpo>Sd2o^?NLrU2HKo1->DBK+rj4d&nwP5kjJWD9Q7KZbxQo~ex(Omi1pyam
zVPZcB&3e~ze1@lMIb93@a5-5J=mFBF_cYhX$U8^|yEX0b@)tEQ5D$&G`cceaK53I-
zlOTr6yRNz`QFYu}Pvrnr+Sxsm)w#<<>I{getlMW=1T3lt)l`T-iJa=%|2%xARoNQ`
z4xmc&lbjwn#;`*xgV#(JXFL*thDQ7e?I%@`bZJglo9Qudmm7TtFtz*w;uDz~$r+Sz
zj2+Et1U-}%lH4OMGaBH7cSZ9di36Ts8gym1kFR4;QwRdfC7z^RmEI`EGx4m}Hn1UU-79vTRk}2IJ
zk%1+mt&>z}7fc|R17$8S`|+y6u3V8TZeM$OzifV+xN};*#K>QM#iix4mTtJhj@luS)BJPDF
zjcDUE8&Qld7IDV6$pbwY&vxktKs-{qRMP*|%b3OnH6v4f<~H-hT2sx8Ga{_oz=aLz
zIo)n6BJRi0Td_T6ZPIkPwr*NGx}++newQZmb$GwCj)PTZRJq&NOn6FTl_2!!7~GNs
zN36`X>;W6_EH`bysE?%ayDX-<4`rv~x}<#DX=RZWX=y1M&$(o27ksQQYjQtYj1_U?
zk>cO@y&LMDr|g-n8c~T72y}68T`lHTyJf#D6J_DtIHP7rF<#ZxT$hg*nF|+A+THh;
zRxh1E6-$GlU=`2l>*oprx@N_i@dgxiLG)?u+UB&0v33$s%_Ev?=;1Goy}J77ohGS~
zzMElqX42i$0d)5{qEyFPv9`Ipde|}Ho4PW@+PM(gtTve&a{+OY=0lk|0~wxLYKC`C
z6@VCq)wHRGha8>tk);I%rn)Hf&Coa+go6CQyaa?I(e}uK7#7Ycap+>W(*W3l{4LP%$`MyI)CG1!o`CgowzUx4l*XrwZ)0`-9Md6fq{(GDDV7%w
zjyk?d=hQhocUJei!|%S~FMfsZe9g%GfzMyRdj0eZZ}=yF_1%Zh_rK+D`n~_)KkzsI
zcmCV|#czK0gFpYLzWdep-rR1lZcndsJp)hVT5D%6iYlAx-~2x8=!wWk8B>6faA-1S
zGM&59Mo$F*awL`-8;lov#LS`g$~CW}4D4#wOjBlb`Sg$lELKZz=mFUCg?c_P12H^Pl!F61Sy+2LwF5mcn4J
zT(HBX`vkAqyGlJoW@cn{krmKD8V2Pkpnw=*tH2V3cB>AFe;7l}ZVVW5750NBaIzT<
zwX40*KB*ST=2TfG@7OI|LVSOarC$`_tkHx$5Uz+lJv)rGLGGZL;*o{js|M3F00#|}
zgi&3fN|TI~(Kqxjc4(7FJ~)R4OKd(JF3J4;gAeh%6s=}A4W2%rBdD0t<5zAHI0)eM
zedm)lgEVW!YSH^RBq(dd^ZHb3%Q5U~3l<~h1I8qnsj-X>xQWl)@C-HFz722#zZW=v
z)3e(t)1b`xt3mc
zge;9k4mUJ<)o%Le5gBnc8;QuKpx;NusaL!9YDmVj${Zz3)^qdT-P#;9A6hD6Nh>1|
zxfUrxc>=(~%3amD78%a^nINls@11@CQPq)%STbrd2_X;}Yi&eSo!oof_TINEZ6Vg$
z`Q>-dPyLo}{2AYR23f>bx9dwClUs*{GPRdx@-4#r0><7Z2f&M!{Q#a!5@`i@<9mRp
z7cHi7$ln^R*czu?rR5fC7;8<{zPxokGm1<|jL@n`ySuxD{hy)5AhQ}vVQn;bi08OXM~rU1dfW~-|hy*kr)A@
zFO$VFg;JH}V;ljXij3I;YM<@2iC7qxAL_)6J!eoPsAdQ;G4%zemUcXRxtAzj=8=SD
zKMtZ6r@+iflIIrPr)Ako$PmH^IyIWGZ-LK#@gJT6UE+9qdL
z8GHpt(L@D>O}tW5dAM)U$0?1#T9YjVi~t-*R*q5mT43{Zi_thxb0L#X(Yh^Qcl#u&a
z+4n}h=MkunATA}{uV&hzAg_fVA|Akw_ncL8`Y-#I62h&uWTLCOjkC~Ib-wd>#)x7^
zi8uWfj6H=cPxJ>a;)V-L3;<`^jT3!luF!c$of5M+fdhu7-M2W!BeFE{$p^P@e*F4R
z{_4v)6}+i>{N7h@?mzH~k?Ne+ihDD_wS$$_h)%MmzQt71u28kQA!ptaE_eLD6?H?(
z9pk>K(z?}zJD<8xPb7fT^_FWMTW@D{|?(zVQ)s-&~3ZLtt(2@XBTe()vX&yl8p|g8-Q*`65^WH9dBRw)jd9W<|nWAe$Fqy
zJpak}`-A=VCx7#&fA`<{2mYzw`#b;O|L&jom;c3o{TF`jmp}jfljn~S9@8
z=tf#Mv?G&UegYtiYi&7+sC-gZiwB)R$4`lg7iWITnP@Nvyj5Y8%i6SXGtwnT6_D&X
zhTus5VC+SfpQ^NFJtFL;Gi@kGATz65Iy+~@M0bUgP=uAqk`jzsWKL7!(uaj>5N%?f
z^EOSQ&SoTWea!9xxYm+pciP*){I|?ldv{eyg}b&u0NwZSh^y2(61ma~HDhK-ZbIJg
zSoUvK4|mh9spoVn`sd28sIJ^g!o4f$T+Mca^GahLLJ$3xwHA@H^@LTdZkH)C*D`O5qR8^WYvzTsD?Td&T?10x
zoPoEUCNVLPeE)$1S_L*3n_K-04X1UWsyPNk^p8&ji0TqmsAnJ>b`$aRWI~QX`)Sn;
zoM`M(R6Rs-{kvGzr@L6)da&Y
z>U2$+&Vi!$O)^wn@{U~1VUJ9kuy?W_+#MpSM6_?pmU^m)xsQTa69{^vcxEP9jiwe2
z%DO`rHZya9QB}xTxs`z;L!MZXtGes-Z~n0lKmTM^$(JAo#plF6!3UTU)o=(#ZXqP7
zjwgGbl7*aLNaDPB2J8vUfHm3>*ut$rATI4q7jJu_5HQT9h_E!*;=P4jQAg7m2Rix+
z5_ZA060iC?S}w%(5Stm9Yh_hjKK5%bw{OeGOkY7iR=*L5)u@it22st5%eTIorCkVCiA2+VzNQ3@
z57c_$AZ1VyGaDSZ6M?a3KW-DOY-~$U1J-Z`Xel@h^`See(Jd|=Nu1LJ)PDk@s}+O(
z&|g^tC=Y2he5yt@nkXMTL_}!SN*hTb&2j8&o=iwuFG%7jv^4>od&#!8=l!bkiOf?N
zIc3bRvK14E9Dc!R=8i6!R4;7K{jhy~V|26j10fNp1I&=tD}{o-FMhm6rN%VDUPR}Zp|G`Q4SKz(P;v`129@XI~VIE<{d
z^cAF$Q9?A-T?oYTq5w3Z{%|dmN%XBmkXE}P7(nS;U+{>6nbRQ6W-`^Fx7$s9vVy>v
zi8_g7VD|b);90MKghq49aK
zuE&VXm1NxORF_IbnhNAmuqwJ0cC8hi>VEJ0DT#NgdB30g>HFz-Z|miy?)NJ4s~7&l
z7yS9J`gDBs(SG`HeS!5SzVq^PU%dN$fANp~J)?E={K3UN7chAesa5b>2?yM8Q`KcOX%(z!;QB1EKK(@mVyL=
z%$QyPV;kc^fP%0$fsdy5>O~Mm*lfq0NM5&I_@mzUw2>X~IovXpy#pi>C~6xoY~G1;i|x{&fmdw2^gv5p(9!dLgpgqX(NY$Rf4H
zr&9UkiHGO)6Db%#NaLWek7*Kh%sQ@b9kH%HQ;2}dGE5il2OgK`#l)Y;wf0RwLaW!s
zv6=mb3}i51hZ{YY8dMn2v4S8vbfpS=3Bf9&-wa0rQP<^fNW1i#(^
zTqMp!vvtVo@EnPw9$w0)oNGu7g-^$H?x>DsLxUqfnyqi^#Vu1%AtIOlRT{j{r6SK5
zq-h^|EOOlpu$U{?N`hhErm%q%VH?Flh+L;ph_*gVp$4!@us!6c=oG1PcN}gsk5_1p
z6_Q`Voe7)Rd+DmclYjU}H8WE%1r&dQZd6x!bwoNe>+6L8l*r6?hwl!5^jq=Uej+}+
zv8uJZ*YWTXALb>_hcEC9#af;1X&&0uz;s{92-QG}Oq%($WK_NR=eJ^NWuUxaT
zNawBDGA3(IxRxGOe3RLQqpYTSIsz+0>r8Y?m07jdq&u486sC?YZ6@nMinIf|tJ;W>
zc2Qtyz2r(ta-zoGy+Z)*5W6T*qFBoMc$vwLeG_o4$N}2v)uE#a4nQenEm!I@z~3Gg
z$wh#nH=`e?zaEKwiz-%8+FGalcmyb&G38b%2{UtPlc(KlyHwXjL@pR>c7Qit65{~x
zAbX|5C|xZ=X!LmxOtMwDCC1%)Ku
z_FijgngN+YX?>T6IeFpF@fc>?zRO6=^{6tdc)u5cowoSbaHZt`oY|+tKG>2yJW1Z~dgGmZK#>O8a@rwz1VwihfVGvYpnN2o1(E~zDr$wv
zCiJ9kI)zA+zzH2f#~lzxLx;>1E?V>uFb%VT0CjY9&Ikxq)X!TP%6+28q}q6)fh#a1
z1N94v)N6(IJnf9z!Z$y8{rc5@`{sVZ-!J#`y)R!B2D`CW>>U!I)#ZC*->>%PWC*k1
zaL`EX^d4yrYcS>_g$R@HO>p!L%jJE5T#;)_h)0naFR`BrGGPD#002ouK~xM7
zk{Ec(097?2xT)kQ)?IVjR09Bgcv6}x7)*5KY?8X(f}Xocf3hr@O@_KRk=aDE?_)=%
z=vvk1balPE*UP={_dfTo?l0c(7rvi?EA~}2OsX+bHT~HJ`A%XR;lB=fGsK
z!A4wxxay=E%YnkoLv;U!h*_E8Ax*5Y2oISkxC(Gjr6VY+?C8`~@6rN2+HZBOl?$4g
zM}$?bvGbO(-FpQPeT9E``r@c}b!FX+w32>47+f&>*XvX|t&q~WiXqoPSJm~y-78Hc
zHW3$P;AUO*l6|mpsqY&`n>+KIr8O6=P)};El-`cZI{M`uSmtm~Z9R9%_
zfgGRwMm5BfElQdx6~;}qm^?#bRI4w<%qD5e!KNBcR!g(mb&7qzpAh5;tSthjd{!zl
zR;JoNZ$-4suOs~JBV5qV-0l(Xr?$ofHC(;tpdFZ{dN9G#u(vBX{T;mz+Gbt367aT0
z_Zn;Oy>A0oxJy@sGFXLXAA_+qtL|3(j%^b)fx0SYTqiE~=<5(zPH_I!`pAzNt8=UW
zo3d$l%?E4CGgOg-2$KVJVc?!qD6;W#4zFV#nLQh-y6eIY;p=F6$RkwwYf?PAu5(}p
zPI~MDj3h?wnSWMmtncFPHSVW1%WYwF10T1t_4b@
zmn2m+Q_Z>JJarhf_DZa)*+s!-S2ZFuDe57@R`vZ9Ls~?OZ1wOh8Bee1iAd8#o0<92
z@%GN&^rQJ_{dy^P#=}f8@$nipTLv`?_2^PbVo{?rzBd>L?j+6t;}T*ThXB`je~Z^Xb`GoNNR612(V_30cYAKBu4eZ7`3&{bEaM>!!X)5CsGf9
z%eCF0`7C2p{IsqFaSofUipTunsqW!&1Rl=LoYU0@80%5Wbia2i#bZDIevuJNB#6$H
z7KC3;>AtprRx2G#up|Yfn&gN+rcxUfuEs#!5fKd*fY>Y7C8-Sv`HnFrkvK!xfg+?e
zogNWQYJ;DTC0vgC{+})~4hN~!Mr@2Wp`CY(3Cj0dw^j3gJM`+{wAuc0!7yW)W|jxs
zANJ%=8KWzI$unSPHG0%)DO)`#UB?@ElXvU&Ua_#2pZo(PY~mbij;aP>)+9M-KM4SB
z_w^AjYV0+fVb4yncWO~1fm}IO)h&PKDbJ>;0IS6g8x|tpUsw4sa|%u;spD-d60uNi
zCp}trgbQ8n;>vh>S|h`Du{b%$^a0YY2ePWxUpDO0GZx3=nR5(XTW0czbGo|_npi%>
zJNh*%#Wmt*AM8&)xV^l6drq;qBJNec`u#U=@AY!;Cijk@{Ci~+l~WT=H{&DJ?21&5
zYYG$#ac|`?OxJjU(juBcVdolZ_7t>#H
zyWL`D!X^^}rQ%-KVPwYx7R>5TchLH8q-U-~g=$rAs{#*aR-}U$Xt-t#}_fy~d&bPn#
z&bRk|y4_yEeROKz2C3p9XX((F#W472vI2~`(p?-~&q=X+g_`##lE
z3iytDJ(-&i)OXT_656TJRf{^_T^XFO!*Q002sf@mji>Jwge-B6BOLsnYr^Wv9NOos
zhBU#3i>(cwQVA(ZVP105Cka6XNV_H5P{+REe!qjN#g?h}NaTS@-B2l2lYXzt8lh=fzaFrS=K|N$o9nhsY!rU;A
zrQ-T7h_Ep?$uZGO_dsZNW#-zO-75A4w+QLJWMGk*Fq}d5%1nvOj30Z@G~0tz;-w4P
zi@>i*kygmg&MdNL-MQ#(-KPbKDmCP?8EQVv
zHnEq@0}#-WMk8|HZXz~kuFR#QaNDFQ@(ri4-jCnJeU&BCu3n$^W5z^qDI~0X3V5WEGtgQtKXPX45s*C
zWP=fuR|cxP4rPx4yIZ+!Wz&l!S^y+46G2#{udp)s<&0LY0Nx(h{?
z?w*FXt~qBg0yt|@Rgu_DE<1GXs>V4bOb8bTpS(C)QKc1g!H(rqiLeJ==&y7$)-6X>t{EN3^!jax06$fx8d~kxkRPHBCmaUgNC>Ozvbxc|Z>gcE3Dervb1KYZcbHxK
zDw9b45S7U4YbP3L;b%$u;yxB(UZtPmRc5LF1ESlkD1uUbtB&BfIe=Irxb
    Kt=6a
z9^tvM{*0;_bFizsd+I@CZziz5$Yd88=Ezj5=s%l;?e$<6?Isr?x$3{
zyYN`BI>J*>flz2ssncIW?KiDGy8tO?Tw71AY&xNeE2vn0H4L6%YkKTBJ{eY*rTSEP
zQ0DX-q$x4DRwn2($YxI@h?#!4Jk1$ougHBJ`;3UuW_Kj^Ua5`lCaOUcIq~P5paVJX
zux`9os2S6HiOgKfh2~0o`#4{qyQAHN3A%ga6d
zSK|9$z5C+Ld6|wvpD*LO1zJVRh}gMSq*N{Ab}yEMRx4$!E$U^vR#sW=97(X`XYKK2
zK8*S_tyJkMb=7d{rUvvu!4$+1u|^RPdLw=tGc|=TsUp1<76=A<3_md=?v+N}mB^HR
ztslnx3st3IQ{{*h9$M86p3#_eqZ+5`-AljR>m1(i{neZPl`rd8ziJ>p{_y$3kM=$C
z=f9}$ef91y{~bU6$NusE*477(
zdhfzc`6Pow?;6OpA{GL%m!#lVp%t({m`_#sY7?~kKER0yekCeAR9Cnvz{RV~arE5#
zmZ@pKsy>Y&!z`_-_9l7wIP3e_jYS=--&kC2gsP=^t7;oX3e)FFt)86jtZkI!3fsLO
zB0b&%g|L*gar*RTcF-Ye;&WfTebl-T4T8J||PJ`k2JvbcO(~8I20>iI?JAU4IP#SY5@-
z-`Gb^zrP)M*+schvLz)TACf7ZPC>l#XlZsyh7g=gAjX}fXtVuNwT_T^TGY{9-5Sa@
zA1iyPL8~6k%3PUs?JDj`42zggt1f7AmG8#>|$fOES<7
zDF-3g#0%AZWLDaXLtXEJUJJ
z+;`Q9kp(KGdh($17n*lvH`?lIuLDMa-BlH!!>V8~_1)+E7}`AuFxiFu{eV)0A-
zq@%n-LVT$JaxGGhukFeSW&yciSCnu==kcBZ;FgPmQ9M`PO^pZDu}SMvs$-grT`A>!-vyaUG7y|JPacnTd$U%wD0YAud_Ik7fEIQ)O&?L^*IN$S{{&NS(>>mJ7^FQb*h{cQ}|!`@7Sd(Uox4$@wR
zkY;7c$Y9{@sUQD!`D5S8OEECRk8mwQg+-53jTF0wQ6i?TZ&RGH3$Mg_94K
zk|C#%CdaA}_P=e33+12ye95FO;jZpUMtKl%#8HSYTS~;q_s${ftjz5e3rhBLXp?pju%K0k-
zXfF=brcGQ$3+Z_1b1slnntR78mclNsA-JGi)R}Atpro4!RVl(@2;7fq&emAGU+|qTzRvs0|MGACYyP)?&)@dv{O*Bh?YZ^Ck>h2mmW!)C
zR=N$ggaF1|JU^i^M=?aY#IWO#xU^W1!u+njU6bPRXoqbo^;LC_l=B3E*aH!<*4&X9Kip^T7bc�g
zj{!44gxJV5l+eQc=tjtQSOP$0>=aI@PD8w3LSBPRH>FS@&P6~wCJ+%B_G$_|5(^E7
z>k3H779($%&yX-1J|-T<+FRqS*;`~kQ=JAWz9!?T!1l7!X{Ma{kO|IUpRk@J!aHUZ
ziS`m3kb1m(MFun0UY2;Qh}&)5)_1>n`7J;3>2LgzSM#;}72&Y`_>UwX1Kati64Po~
z!5w?gUP>ZXj0BkWuvy@BDbhIQ@>E!LXuS8>G?N+6HwJ05(-Oeaw#SH>HQi4OegL3_
zEU{wkg_M`69O3kJV#4WF09>J3zs+Sg7ziBs9feCd3d+_0u!!C7QPB9yyHn>#Jtv4^
zt+j4T5KMK;Pet1opn-6J2;!Pq3G}ors)OaqMtptnt#9Oy{ZOzwK%pocWN&g9$S4WI
zW;41pTKbl%qPvBNx9gY@x>#-N=Ogb2F&-J-neGR{eo$xCwZFX7{YWv{*QMsQjPzaw
zO)h3LhizgN$sDpGZQ2Y6L;xm5N0?8gWEYo(f4ES{%ps8h;M%D^U-Sq~36RqNI8%yw
zFfEzrraX6LI*+?A*Cd@fA&;t9q;$jMq3J{BIfRl_``>0n1NWmK!w~@j7whLLLITyS
zQ!xWuc4vBys_@X%F#39OYi7fjFhgdkXTH5d7uI(L1ZxJKlZd6i61CwZ;q
z!3%&oBkM8ZE{?Gmw2J+^R<4^gq|jm*aUxXgsagx?DLUgKwDDIFTkQ@&5A-6!B(hP0
zIF~sWpZk&j+1jeM5CSNbW9|Im^clANaSt)y)4-ixw1^#7EQdymKu@ow6yQGtOgYHR
zyxks~O=`x)xYCLj_6faqvEj;W(sE=pqtS>s_X20;no(Wn-hovAdCs`)goglEY0!j6@3b#gSOR?72#$?J{<H?5kn-o$EKM|;Pnslmz~7Ovdf&XSNX3oSoRV6U~eM8f#&!>7+ae17{*
z*Rhaj@OxjreOEk^*WhrLVo0zK&I$#Qf+%x_g~*xsfYjR3Or#4&8bS#bg|OG8kKL4=Lw4(y
z6cz#40Ko^?QyX{4ROi~wF2+hFm&Ta3Lan30b)59H61fXWFC5(UUVB
zRrDfcChkM5S1EAN-KL)Td^-=6!UbL{xo3v;_;Z&r{Y|VSxx)HMb2|K7e1_!VShA^0
zpVSz{I80cWF7BEIiWX%Zx1*v8)VMU513bblwWrMr^jKIPebF7K>`azy8f4Fa`O3b|
z^V_BaP;54YhB@7jr$JIl#P>V_(932GIk@%0RE7g^10t5`Pdq+&45tE&_C#N37HB!7
zuDp{k1=VSzC*0?_2yyOk$K*#JVJhFH-!|kBkWsd12HoZF8Wk`R)2G_Qgj5UUBRU?u
zVQB4CTbmXmE6Qlv!(w_4oo?4NaOU
zeJX2LDpfnFT~#I~C6dGqG3L@kt7lKfN1VxB<<|2BbScwop
zF(`QJg*OtASe5Kud)Hp4x#k$Xe{XA#7tiy4eeAUsi@D|+v-ki1zW31Db7})ffJQ&q
zG#cyWL;r+Rnd)BxIQ=)}go#uoJHY5P;`xWnjc8Nqkp)5sWg=#}HQRwCn}@p>o)lJU
z8xzzsYW6WMHdGoT5}A=VEW?vgsHU93EVV$V`O$;P)I=JUUrMlUi>5+IFTmXwATv;f
zX!LO+mtn6r0O?pQ{hOjr>SHL&S2M!fVMRRu7l$r}mA+up!n8&(_(BcvWGzIrjR)iQ
zk`z1QLd(T=j(og|t4aGFTdL9HO93rA<{O$MY{2`}YE)?Z=4drrhk{@lnJZ(WHOAYMuRry|*}39Sb0y*7AOym|>)TrpE4I
zhNxoeeY0Dcs%F0>8-H!Qe~#b%tyQ`^P95pB0Z0ei)xio+OuIr7S|y@iJow
zW41AdeYM6Ro|~L-{SHn~$9)A&1H@ycbnDI%l>XKPGLPVwee-xn$Pmy_EYI`?QE6IO
z%VnCqXE@i@3Zn`c3-|b>H7`9b@oYhxDD3uQuLKY?U$`3%u1Q&rN0*U$YRy!1Yvdz;
zhNHXhG$iMO(noR#MgSwQkx}7r09{qv2c0FmL@iln8E(lWZI~XOIj&~8wRe3i4?W4#
zE1A0KWqE~a@MC%mmDduAQ;j94+kEV)jsuv{YZE-l0_v3d@)_%^g$EO%b!gqQuYthlnI#x5>d1JBub$VBzW2WOez~@0N+a?Y-+q4C
z{qm|<0jr#jI!IxMUO$x?3=2(p5YPZmq?l6Z5Yd}~(B9I4mbWBm6y)PNbF|siaRe|3
z#Hs|i_ePj-;~9iOdNu?_D7e9qLLGC8*K-0ff{~bRaMDPVjR~qG6&64^%L*1CXj9)+
zr(QAJA`}9mf;|{wi0j%?DPoYiIyXUmLGEtNah<{ESN_p2=Z`)Cz*iq1>*M3+FZkO(
z{q$?!s6Jj$s&hDg+@
zD$|74PR0#p;S2nCC~UFAI=)ON`B@-1(_tHttDq2dc6_r{Ax&IWrM0r6YP(I=k`RIo;i}Llgz6CEIb|RPIWwCMVbUN#Pju+ss-Mn9l;H7O
z=zvonr850)jc_+4rz<%?04ToJ%p@cmhX2$49WX#Egy}G{z*IOgbBq8&12lAms!7+p
zlA!xYe^RPdOyDTZd=T9o0pJo>jA!)tt`1j^ZWXL_afjZ({f*{GW1u4t_eF4e2R9g}
zbF8zZbdJz$sCq|0g{IcusRPyqtP8>BSWT_$8
zUP%X|f#0CYAVD53wIUEFJj-}TS|T6D%tKX`qBzwO@t9~;s~#EK;XKvi8X^Y{R19aD
znVh^~7ua2ucQ94FeSMKIke$pSKiE5e~7(YFRr#;*k0>4%6r
z&Cm-wJ+O?dRU$6ds>m8nMXgn#DkduF0f*RDpzu$lhn1
zqr~B&?sYjs%vrdU*9N2u8PLY6lU?i!IDqTY{5>l@c(3In^3Ro#xjT^f`~FnDU#>yp
zkS6&C`l83FKrUSp!!bOrFYDK;0^QDA%84S8z4`!u1asqBmhKGzHgiQ(Dtt;V4_Tiw
zW$%}=NTxcB3SEt-YZy$vZF0Pknh^M{4Xud6W2z*bc%`Ksr?djk!X%ifZu1BtyOp_o
zcRrPwl~QS>GNOB;qB7S~$cS<{jY69Id%G9d%}aw`-1w2^?V+jzE2@4f_D=mr8LKM$=4ZSyTfP
zr}rBV3t*(z(bKUo>~1DBbT`Fh$l$Ykx*HJ=IvP%&5-{Gdm}cKU@G#8CgmUJzR&{Jt
z=6OyTN}`!X8I{>R(;c^wA-$Vi9Un|fA?Ff5imLS1
z$>pzJOXCSCe#M$;&^x-aR)z7Jc&vO>{@OPmpC0+?^NWg6M10=+m!Ga{u=nW0=;sSL
zt;|ZPz*H3|LgipLv_DxdJJa(EjvPQ>_LoGDp_2okv_N?=hxcmK{0v=A;p^5S&B!|d
zpZdP~VXmNcIZ)?h3y>yh4mMod%+ad)z3T(%{5omH^l2UkUzs~x6hUT+D%pGA&%wd8
z@mBlK%pT2*1)H>Qx1X0kU${Y(Gy|KR=m
z_dolipRUKVl`<8FDNLc>SrunD;zT(fRRnJPEf3HS7+X|H?v~*QdQM&L9R<_Kab$6R
zKnI?3;*kp715u7P$az4KJ|Z^r2dLU!>xVAYa)1Sq}*lJT01ReH;;B
zx6}2!cid~nXV7^o!fMqr*yF9o@)nMuJ%@;pc}xS@Im0w*&u-t-0!0vHOn1+0@d3S^
z0HG({qaUz|*}KQNucON&?p9Oh2=7%MKx$leq*$7i3@F3n(WUSaH=R-=!%DU>bV^;8
zDq{57%nJ)8az3o^B)xUZ(c#D$Ywf&(^&)hR0Qz=DO#*Mr>ue!^9mx<*$w-Vx+P=X{
z5pcK0vw7zvZ*WwAr@BXNA|0_~gp0$zo5-pxd;jLV=727rfnK)H&Wu&HM2YkE9^D4v
zz%kIb%|L>gMIFUk8kjF_J<>aO{@@zM0&vdukjvCogJa+kbmFqAVYPMWUKdPq8s&&e
zTO8f{+}xu^a+56|cjgSUGOJ*RThbyOIa;Zu9=1hwq=C|Je&W|5D;=}wt&Vs_JSH8H3HJum=b;>48xM?be|G4E(
zTA7~SQgJg1hg;AR2!K7pYpJlsF#tLdh!d%oPT*ko?6!K9UZ%{5l@2>2Vz(SMAmZAL
zh{~EyGP7!$MC^Ufb3Y0()5v_O&qwO0rIkv4>kR<$)&mMIh7!%~k><;LIekPUt4#cC#fuME!ISFfTObWiV@
zMwGnn8eV$m+4`_n>QYr|FptjwxT%&FU@e!G8L?K~hqbQBz6eZu8{1vN_zluggwWx5qyHnGsqiVumy0rsx5M7%`43
zReN`a=Wh3Ei4$!KaFk4tQE5l0hP!;B)X*Xc0<$ewrk>I%3yv_7x%14UaDy%FE&ZQhu}?a;^Y=?-OJLg$n^yIX|;I)gyHr>4RfRba$u8j6;Kyhzc_
zOIhVSq&EVAwIU++_VMTTJHgxdKyWA=2{hL&G`BC=55L^P#^oiu%}mu8c?7+Z<|raq
z&+L|ygwg7mnH~{lGe!+UXR`VYNsj5PkMl-`Ri|Z5^d87cU3td;c*jMhjw8jPA*{9T
zo@0#X5VidFjSuPoJi~R>|EsLkk>wj{H-{M>)uUw*;k6C%T8`%|@y0rai1+eQ4b05-+It2`
zLPMlvQ{uKJ&`Y8m6>u;GaJnVqK4hQ@1|6AU?Lf$}9hyX~^F%9K-eA45+4MDl*n9Tw
zX78=(zthtb*e&|qEV?g7)swB3h&_$N&yz9R-*yJqZW8OUj=IG1sKXtx8{2XoTouO4fAK$l|MA1m|LAA=co!$!flR}a
z0qNkhS5KK|S%Ft9XS%lqcW>)Q|G*5_k_JbQoCa;h)|~2dW)x?wQ!z7RBBBC;8I=}(
zx{S4!r^ey%?%ICMyA~yhK=QZaXI^vESM{{}
zTGy|f?t_rP;JKSmMGvOKBF*2$(P_Dr1eM2P6xBQeDXpN+#5+_662QiZ4vkZjowlPC
zL5lOJ^|^+QFM2Cxs3CgliZYW*gHTAAMhb9TO
zR$ZKNunM}>$AP-_UEKq|c|2XW9(UZF#udJBRj&x_{DLk~>uw{nN*CT`hZ#jiC>1))
z>6tuny)ufk%80dA+V2h%JE9+zfC;nA8S<4`TB#{1S+hk$UvY!sXUCjJ&Kd4Aq&eK}NcDI6e!T)UmO?_8D^Lz(
zXTZ^tNw*vbWY(%$`R1`~XkvDrQ&F@tjgBkFzd7BSIJFF4&arXt?rU$oI2uzVi1mn4
zAXZ{;C)Bz$Cni(RMl7*;_Wg+xr-4;
zMse)!iYrf?K%KESV@?#Mc=eafuRr2X|K!k;w*PudHq}_5bDS
zt-erqOxgfK)A$0PQ56}OjUX!(*AyDEs=l}P9Q^EViHSf|xQ;k@kTCwLAVv*n-Y{Qg
zx0H~XnYvDT6Dgj`7g;EL1K>T#RB1Q61;IK-*bS`&WB?r8u2*kQbww+nC4&n0(VaW?c32)k*HxW5m#A)VF(c#ZD*%*~cv-@Zl-H
z|M7Wuzr1cuTo}gBfA#rSul-6kkOf=w^tw}rqg1u5jP(U-9Een{K)-a)^oGP-s`cIF
z(mGs@Gn0~MHQdR=j;hXJGcwoX4SCmPM?kuVR8M=38ef-c{$04GY60PfTiBFF7*?v-
zIRka4r}y3h2ZtSC6nf_H;y#hIhr9+N%vlCzxUX4j0i$brcT4UDvX-*AVA^nc@4lLw
zyk>s>UH{!r=*W*BS3dHOzT@wId;N3&nZNWe|Be4)R(<;Ar+Pf6)wM_K6($e7N8->b
z5E2@0nP7!Z+(4DDwTKWobTRVmII8APndL#L%1mAtFI
z&=sW%iA6K!&6hCcae1rC1I3HBGEHdi1J%@oA8=Uk#Srk~8~xr%
zQt3%YM`HM_H(+=!&bQ|I$H7s!Umt2JjM~wVvYIs?fAA+i
zthk@&=@Exe*o{kHe=lEBX&x7YhLj5-YrtXB9dyT)4~e2q-|KIA|4U!+ZXv_D@cL_v
z>D-Vc#ZqB0-C@QTq%1MIk7oC1CaRk6;f{>Vdc#W&DDu|*01;TZ+98BKK6rA^#)%_s
z5Y&1?Jy9*np*1`)J$rhltHibHqjK-7yKfW+Mkr`r8Zk;PQ=?y%rOBltX?lz)2pT=l
z^CkeltU&wqp
zZWv9Y>vG8xZ)|8JSC~LMH7;&kgYtFg?(=W6MjU}Cgui>9FK~FaVd&CAIFe1uC_APk
z`!~HqN`&k$;TBAyd~ZzB^C~3pzyT~6(Y>px>Ph>=tP6}N%NAn0)X{ST$TKuJ4A=-U
zIz7fs!5pBd2zfsjI#ok6P=g9^bv}
zAAj@yFa7!V@1L-nr_aXypE=*oU43RChI4IsUU94Px?PXag(lBClNaH@?OIh}H+#1*
ztLd|oTait$Cu5E)rp;!Y9V80Hv?n6E`S$vtK!}k%m9Pvz~15jab6kj;2DB9>lhK;^LokR
z!NFnsUDBCT)nB-DF(&;5wIW4~YStmri)!T00u+mKU44I4ky;ejo&m;a@_W`adf4RE
zbB5qT??UIFV}Wl*R3rn>&Fh2AWurvWTGZ;%1wRAvSf#ep9j0o6O;wrQFs(O9>nRdQVpDz16+YfECtC
zXee<8!9Bd1S)u=YLBs{YX&@4T*GpMOn3)rpgc(m8S6qS)AGJ~$0qu@f%yIzKWE}~o
zwMY8o4%W&5ODs>ueoOn+K^kvaA
z*R_FIOZiwH1Rb`}_ueyPCMw9?1ZsJ9R|MB1J-{M8cK8@*7{N0-_-ycDN&7w0{@_6Q
zDz9AkNe_<$N~z~O7(IblvS5V&QQF^5lD$Wdr4Q(7rW$V8OwkWHs7h-^Pa1Zu;!N)m
zf_+`vEh=oPclCo)zlAO3y4-n&xSH*B7?aGI##Y?6QM?OCR-l##osJ3%0;H+2bSW?2mq
zYo%NXdAIbcihD@RNh+o+XKt
zd};jhrT^}C1n|8Nu_J!^xqtDw|7-t+f8f9WFaLLc_48lti@BbGVpP^L*BU8X^|5}P
z(nV*#L*V(gETyQ&U6#PM`%otX4l`2>w!llBgPzi?r;odc#cuE7dDAMAwr}5PEL{%i
z2G<2afGWdv0_>YPj7YFx+(s+QEdUG+^9-#WQ>1hOtuzGHEjV4m=?qoI^UKqzb+Y-U
zKv2D;2Bql6_N&hfvggdPkHECPhCX4O?#*8>Ga}N1>p8u*%N1%RpO)-Yj^_qb<8Tft
zwG5cKXY+9Ap_q505ZdipZYP)(L@i~AyxnV%bh%go75I>+5)`yW&%aB?c#
z{96A@_fIBRY84{9;NpNIcw50C0e6J1=QvvayXd5DizVg0Ya?9&ICN1W)MEqI8Xc+@
z!;VB9G4>fuu5)kV(87d`GQ!k_&v?<|?dAG54v@6hQ_Klf+9
z_q)ISP8X7&JKoUuvr$BO=#e;$LQBt#eaIf;e+1#*uYeJQi*|d0ml{Wf{x2`0y
zWTjBfVuVuK1T<77iOL%A+Ix>@7#xFW4EbiuFt3hS2_bo@Al5v(vIN-Exm9XfTH2&J|N@J8*%M@
z8emmf+`CCn$dKOKCcw;EdeyO3t`#BsCC@d+2r-|oc=C;cc0H)?LWs}sc1j&-Z;dgv
zy2B#jIrJ@+L
z{x9`3nh46X=?wv&O=d(N15HapNRgSk2?X3ic&~7{2xO+j%)$}$nKqLGXuB%>ma
zRUUAv^IP2Au>l!lZ
zk#%}koh~}V_2w=sTm?dz96;)(KJ-`|l!7OG!3{{%BXJHW<>KhK@0s&bqRI~;Q$VPT
zKecMo)dOQwQuztmx8%JKU!+LP3b6o_gW|HF9Iq3Qh>QNFvLv$8GoH?q}hIL_F5z}0&&b{fCuLdG3RdQ>a=kc^lG2zSo
z4pfR$H3`AU6ve0O4}n?{l}Sq>D0-Cew8-Mg1DS)+
zK^%}6%8e13mCd^l_g~P5=watzg4YK@+dh?X5
zMBq`iYPqd=%e^<0AE&mw1k@1nf(cm*gn;ihhqsU-`x;62q0CD{w
zeEN$I8%Lh01sV5yiPPEQxE=2UFkB9}@F%D%{VYfBnTU|y4GCz($C0w-Tg{)~bYFXK
z$QJCL2=I8S_+o{FoW1wGyzi6hT>I7)_>JLobGMoQyc?}?v$xV7sb|)72-Rj8;pkM4
zTnIQqU~t9^>dEx|K@S$M<6d#+R4oy*0`lMiXS#{GICgJ>mG!h%AWmkfrE&6eb#E16
zg4i8`bt*Jk#UWL&5t~4n^OsuKrmh>xHOAl{6Gji-y3xDYQ$Jz4^}v?o(P2@y;1?Y+
z?uA31LI4%0aFX!$K^#yarN*o@!&eE;po(Cjn@2NZKw?xWf_L|Mz#{=sgD-=+cy^sB
zSw~;@v@jg49<)3>%J$EO-`N;-m`4^gGjH9e|9ourCbYegi-nixp<
zt~eR>R++d1k~1S-OuP49GbJt6}V
z$A+#B$4A?EDUXEUJMAFr>W`?283Z=K#Bcsc2kP6gu5ELJhx7KD+@h-%rD=!L+0t4m
zog{bj;}1XV7PqOI)_t!IYweQExL!wMNZK)L!gfYOUvXcSWJKW{T;j5NfF^cN9if_*
z!n6T~gU0FUQBmSJ5yT&c5FH%sUB5X6nQ?B-BgnA5RqubwGe$)MIDzr?|(Iop-9#d
zHh}7M%8bw?WO^O$aifcg^;kmjW_Z000#UKAL-^0&>^L8@0D>WdC``TfzBy7@B;;C?
zwQ^?IbPqX(edUBasx;h6nVFHiMb9TpqKZkCmI}RDRY!Wktiqu$MBxJHo=EgHs!`eW
zR6`HC6!274Wl!y#l?o^~gq(e~Jn~iPSw5u^XzcCzrJS4W#esxm{V;MV_?8xe3B;NA
zPwVUV&)3WK@~RwV%;4w0eEEFM%PVJCOLr*`$U`MCsrt@{-s3{_+(b7%<>ob=8UUr1
z3?r)|JTYAVh?`ZyXICf_E>7?Pk8bNra*V1{&vE(kdR@D9!AJxGI6Zy{&Sb=+%I(gu
zXWYWIHOd&7)Ov5lsD!HA&@4t$fkHjpGen%J#pBw6RAYuA5Zn1Kn8Dr@ZTGtSb;~({
zmuo(~?9W$!zWUpj{?*I=^xB_Z`*ZW>pZK%SSQQ_i>sPP*`KKoEH~yu+{(JwC|L{-$
z=nv}o>xczZ!~&BP_=`Mq?CzR&zRooVOH^EiA9Z~3
zbw{3*AU*KYC&3<-Wo;_1YOQf^o9A#z2!b`KL(8Ga6t$l-K{hN!tN
zJ#et)pCrgcrgP&}5Bg;{4cFwsT>K%=?>=V^&qtU=SUWo1>4*&7Bet@sso+dyP6D1C
zPO?wIeQ3*=yLBeUAVp&LC5}VyFEjRTkY`qq_i(0ok_hGiZ>JPps%7bv3u0u=IQ8g3
zB~&N}tt1shLjW4cndYVQhI8~E5|&}gb$L2I7nOlC8%IHcNcUF)f5JR4gb@mcbvt_i
zPW4=1tqP>3(-5LmBko!+3p;)o_^}8qi8rCWzI*ELSJlwI1I3k}
z*Qno+i~*vuvU0$P3J?`N%$ws0_a4Y1Ih;i0LlYE5W8$sH$Y`Gt>U4l(;iAy;%s{5F
z-^hF_fqfau5@ghITc@ekZ$I}BzW?zr{5|iV6R)p+P+7j_1wQF{xgw17xuIJOw
z4)av_`jgt3=$^GwgEtg3a$F9A|0^?PNm6yIH_HfAyf(i1I)3;;cqvcS<(e#f(VmNp
zZs!bmC;Wgj_N9Y`Zpxuf6-VVC3{D@mEn>nZPjP-t)XG3yy9X#>BncQ#-ity4eOY)J
z2&B%s$a29D<^Bm^X)*_Iyuhba#@ihYh}P4JyAu$2yk+3{e83H93nno9FL{u1Q_rW0
zb5$N>RNR{P76NLDB|(h4#GUJv>rt`LTllSG1|=7q?GHdV_StQ>A!yf?Ufht0tim3_
zPMVLU?<|NEiRfXj6G3mAK-~V=D)mvwsH*6#qFh@z;mqDsTD?74kdRV9!EbT;@B|9kTaa2qIBSW-5L?WbPFzAAQYmAnYThLU)s2Ye^0-?Mr6z
zO$Mg3-q*JF^&3@#qsvkuR>7IQDTz$pwT;p=eUgIYZV5Ly!}Xlg9Fq?*=W?DIM}0+9
zL12pLVs%74_aM;3#7N$dj7V+_ryh&v-AVKal85;%gzL6s`44}mA9^Fy2A^UMD3WqlXzGAEk4s*FZS
z=omLriJOr%s74ZvvGFc&a|XgCG7!kDh@7iigof%xDZofOGC*$b%vF`cHDKL8QRf-u
zI|%h2DtpQBt*2dm+ovmLx1P$yIkom_8UVbSo~w+R>+z_^s@K^)Sy|tE&S8A|yuW?f
zzwuT5D}Up^^H2TL|IL?Qy*}Q5nAcCeCsv^eIGCDF;1mZTICfNh>F$9uR)ZMtM7X3p
z2e@6?f?$wA&Y5MMV*esFW{&6A0;w%ydwgb{{X@=Zz^@~hPiDU!M(w9l2?eq)G8-q7>ALloX
zaCTK_R7Pwwf;}OoN>AB!l$YX=nMV}`FeMFT256J?oqeuaz07lbdPdtr|
z-8TUe4>%AR)0W;$JLL6%P=|1oP#%c~Ps{4t2J}
zNjj`Qh8oa%a9m9yHRjBF)$lIR5D9hT0$d|k6`K?GYF2nSm6OlUI#sC0TM*BV
zs-@wfB(h3}r+V*lPm4hlDlWr#l_Qs<4BE{tR>#33N_WEB>1WI&D}*6u%FTnUHEcGS
zGp(2Fp@bghbVjbL%I?AA@fdLys+HxkA5?)vj8M>cEXCqSuEil2A{QMLR6qOW%Rl^=
zzW#fD{6rpF>26bxJN7mfo>tXL0nTB^dHRZ5JF3$`nlN)65fi&ded%sy>8Av6xHZ^h
z1yL5M1_M?3$mrv+6!oLBG?5$`cE;EU3E9Xil}i{ad9a7wBel!!&M3}gMqf=}_M~L4
zr#zzI)!XZM~~k^*Kk%5`q{tcR(7
z-unp5C<0l*3^sq`2ayN;@qZimyI&IlyJVAE9gYhG^Py55XiJadw7nkyn|S-4nddSnmIbQ8o8#qHOFj1UBsW#}7*5y_d6tN%ci
zKwEM|yLVF5oXTs#cXWsg307h^XA>C;)YE-r^CCC3C#2tvxd=(Sd
zwGtD383E}nWxlh8I9R1EHo5ZNZu%~f*nN{o-mrtgU<5>SGD@W_AkJ0~DQac!naz9z
z$hK1e05C@*4Zp9)Bgrq4sPBbrPy(JZI9dSkZ_KyY)qAmLQfVVuXXTGCz8Pn3xp+A*
zHZud!qCFFRQF>qk^;o)vbt^}Pvgnj8D|XR+rj7_0)P(bdt(rNI@Zk%9&?K7SVC127
zlnw|F!;Das?8&0csCm{EHqe*!V%Oa*oTcqL$A-s80BY!18V`$yFoU;((
zM%+k7y>+uHUg?0Dpd~-b%SEkJqo}b-!;U~jW<~F#)mKDtD0zEMpOAjS=Yt$Z64M$Y
zsCDbVCgZA-Ws)~l1S#a_JS7eN27d7M`^Tfc
z`}F$Z!wBE~{QCNfUw;14S5Kcl^W8I7Mn!Zo850_=fXLu(9HfY3E03nitMbr2TA75Y
zY>7k0rEq9zxfSsVaM#-u_8tepzX4>D)@ujbX8WvjNZ5p#sWX`e=Tnfq;NSBU1kb<0
zWdLR1+&#%$kJWqkZaH}G4DJd{qtB|Bf(gV7_Ap|6YtNjBCf8$X@b{hr9J*l>f|;3*
z>ZeujpR1oL1JB<)zIu*NSA2f$&rkJN|KZ>MXaB4J?EmtA_OJfN-}@JKT*MWL*;^on
zi;(X7Bo~}FXKJLb8Q+1o0-Gb^Po!SIQl7e0p6Mf$lT2xuWR!YTBAT!r=M+(b>
z)?@E0>yZ)dHnMmR9x&bIGMg5!I;1yBfLu}P)DUCJ{h>^K`rF=QZT`Iwv`XdJX=6L=$!WH
zMmhu#wO+#>0?f2q$6KD0StOPwNgSCPNUqAW{Xs;^#Wold5z*7(T$58)>*_c@DEKR>
zRWN0fDu!TRrH)qFEuZQ^_BU>O&=B?hJ-n81s
zh}6-ANI-Ed2Q`AelXsiWZnFtNavG@2n*h|0gL#)6I5PNF{8Jc`JQ%apfM%5~6>GB5
zoclpVBo1J#hQ`IXN&MphCo9s?7G%_lz|7YFueVE~2pQd;2&JN}9)bhz$S1!2YGSxg
zUkIkrAnmX?@Dw11Jwc+x@jA~ijIRg8e%zd0_}-|s@OEKn>3M+Oi2?I_AG_hT*&0A*
z>FL%|43yP!OK#h(*5N@JW=gx-YaC=TKcr-X&3L_3iv
zW>CwAFx{I+1bPn-6?RrK01e4LzBnT8QF4(HP`viaqNF_;6h9>UVyGtbhfZHFrbi=l
znwi)gk>!$98GT@cA(c1b!`UsnJ4=JqGR(+0k{FRe&BEY3j+
z-byn%(-Lf$CHMHKvsrZ2h7!{oG
zZwIbD0Ux|XL>d_kIM*R;;$>AzLL3=;zfEvK#F0|@@B<*_K?)bY`tbUb}rwTi_71=8$t!rhO-G<6NFbafi_4nVvTm
zSBq1Nf$cdo5dpEHTV+E_wA9`sR9y8DNY%
zQK($#-J~#)pnmVT*&_)~R&_J-^!_TeGwt~FbrdjYK1#AEUrBF3a3JKak=s+9wit}*
z`67H@OG?xk?=4V|qO4UF-JNTB+RB@O&34#s@k=y25h0~g=(whvrMFAp$_NL8=zfdL
z>8_PLRhC)>@rn+1B5nafR-Oj6PAA~f&TNA%h1v}B{r6Abe0=`*e)j3w{rp&Z&42v!
zPrv!&kM9bvSH4^I^vHQ-0~u^%Ruho}2x09Q&Q#QqW&2Our-?2R_k|gCu=%k+$Px^#
z-+3cK4B)gSpy%XI@7TyhHqHs=<~(91VvhWQ@OTE{8_wR=Nldd-q6g&~t96=g#bzXX
z_Vmgu&$EN^3|?Ig^nR-w!*d1TeXL3ftBX$`?ZS
z{HtT=W;^xkhNr{FQ3L>hv4_E(S)e_7j*Bn;#rwbFJVgH^T5<=GG4kd#L?6zlleur9
z`|8%()+ry_&4CPTNypCbG(2}21@&*I0g+!KUB!9>>JOhF4`GEP$)xUe^&PzRJk6<8
zYcO}Q;tl~(SOghd?Wx)5W>#fj*ml81td;h_I2(vKSuk|Zpos6pnEu3PF~WjGgXC)RVW180a~>ZkPt#I>7|4_4*M
zC8@}gRpPr(^BX^Y`pbXj@d#|q;kaKH-yT_Ha0J$#DpQbNVl;0MxCdgX47(j`I%=&N
z4G`#!N<;-4(=%|CrN?QwoDC#qQ&5rDdqV1fs&HK7(o3}T*Gk(61jkNSY
za@Jrl&kkNmrE=O9lniiH%~(5dmdfaW^uM!D;V|6f+r_3phs?&Z}p{
zDhtSmZ*Emxk5vwZQal{nx5D(q$tV%mq)TvM%d1z}~FNthB2+LXDZK%20A~
z({zSJjEPLA+Loy#0WWww3ZN!@N;SrWJW30
zz%vZt@ZlMWGv%P3tS@G3M@Eu9PYz%o3B+#9wEODqer9iGp`Bd>_hgZ^z?r^Sk2-gU
zQ6ZE6oM=~ZH0)w~nSxpX=T`$#-E&$X4@mSNiw^~5U5(R4gV<-v_^F{?AyC$XKx8Q&
z2zqT*nXxSnw}nrgbB{G=uEH|!)McG`l~`+Cd+Ywx%%s@^7ml2Pw#*)Smh9E0q;$3g
zx*2tZ1V}~OYWlj)%)L7R?(wB2rdOYEkGL)+p{Ur*sxbxzfil{!n*SlRE48Y1$7JYm
zt1L;UI3Q>5eJW{(3#eddsqi2%NY=*Yh2T@*haaE+)*t=y<>mGL<57UarbY&h8*8aJ6`5%ysBQurf)d->dhR2rE4xd6QxEjXjFDks{jqiP3*?
zPOIs1EQO&YFxT#?inJD*kS@RpZBn-d#OQJ@XIrSE)`mZDD-XqSNd7tx*1BI+^LV+s
zG8&lOQ{gLi*qi#^*PiBd&-FU5m%I+V&V-&BH0SkoOLWk^uRSdSLh-MP@yS{h>$MQC
z&yV$Z)OVlvcORc#_&zZ|eE;r;kJ#_l%cuF&{GH!?|6l&=|Jncf|MY+Llkffc$ig)d
z#Xc?<0;qtel|n&5@McHEi~}rOxcP9`XA05vkr{Y9<&H>r7z~EQkt(gTk~6ugJ;`1E
z%|MiDrZHl*0QSt?sm3Yf($yQZP|$57rR#yWMh+VFdFJ-HaWlX{V04pZmb((3EyIbC
zP3?xREwLN~DOxKu$IzKHJVp|@!>J06qt4F*RG%Pb*dVVZ0agYbBaGPTFZ?g?Xea3J
z)0NK`)R#&f({}XF^fevu$0Nv%fdO2b$Y=nT8EN7Y4a5cGk%-XF6jklNNe3S4w912D1|k@&qrBE)b=6`e
zjDSgFQaS=M(&|8!MRD+$F}9)mQh)PC84Q>}MKjG@{V@8Zy&B)$aF^VxkZg2TXLMXvkFT(uUCueSa2AT
z$e8KKRQHvZ7o^a7eV9}{tcg~HITEkBw1*+73R%ySTsnh=>_%iNC$w^7P7+p`#=JB%^g!^SJv~_v1Qdj6#O`tBmNDb{#Mh71W|Rne*KW
zLyx)6@;Rp#5a5JBk8q#kMiJs^Nr^6`eX0W@R|H~!wWQ)E5E_^cAlI2HRKQRkQKTK~
zhdOiPbHW%95t32Fip>5?lV5a;is<1+1kd$U&
z5rx1+U2`eZCni?qiiyDR`yX-V1=0v5V5wo;ZVu6!f`>@A+1-Q8lMI*le6ii9Y1j6#
z87xARug+bX=Sbrj!6N*vG=j+Pe4j4
z&I!Y%W@e~{$Z4CHEuFoCf=Qs6h^QE_DpN*K7@0<3-nbwKndd$9I23aemHzNrfr5b*
zn1TpR7fg>S)q)O!wE)K69oncAUn=i?q@9zoyGd%2QiL)iTr&FLHC#BQ&%tx`=u5^q
z(R~vKPc^S1`P@b>9ZCXCRdbIdki=Q8kTX2afDjG^4g0$VAgNBonK=2j6m`?BRfLD-
zN|wekMjL6C5x}@?Vj!w8EyF6pp8Q}?QwI^)mpk?r&3LaXgo6{}6h~fzfjEIZ5Cj>@
z!^&f?g*5PPQBh^$PKQal6N>wCmviXoFAWbV0QM+Dn32A9K_oa6
zkOIGT#b*?q52CZq4x_XO2@yEZ?OTbWv3~7>1kAe~Wn1}uYK?R^CLfh
zewnX6Mt4?h@(+LZ?GL_wetM5jpZeX$$Kw(0jKEkcdjh0r5=B)-)iegd0yjz3=6Ja_5k$PaUV16l%T~r#_q^`Dy01NZvxl#HzwT+ZvU{et
zDk2MrmVT3jz)MX;c72g_rwN1Au^TJ{{+(ab2Swe$=QSC&HfW%peuz*Ok@d
z!J)S@mP29fSqMrXem7d;^3LP&Yj;YjNTg#$!GInQO!rIBw7F4CfW8bepb7U#*>7OU
z5WuicFw8(jX#j!~ATwg}^vt?Wdd5Q#W_ZNar4uu&GL8}|7!9(OkrO@|YdusiA3lnu
zynZk<_wGH!W1>Q|qGmRTM?H8LsqwsUP1d->pS+^uj8e{s>6V#9#o)ocjO4EMfIJtc
zUa2bM^amWcyAeT*dN)VenC1i-Axb8EK9LLrHC?eg5V;=kThtz(s>fK^6l*=i6-Tn7
zdWb?q+QJ9S@ad`4CatH3GbAIREt@eD^|T(Vn2~D%!DcGuJZhoE
zq^*+Bi79MFZ3>}Sfjce|088Vn*n1O^nTi#*FsYnmtJyY42$j#wt%iNUd+
z%ZO0o=?Pyyhr}oMdb~}qP44EZXtxJPhn$*dau~^Bu3`(nhnJ?XRY!&*$iBE%&YmIH
zirz;yCaYV$}lPR+w60?CJ
z%HSLfZrC0c>Gz8x$~w|Ss1GNYKR;Sg!pVcD
z!r{%Ks3n`8-bC3Jl3_t|1cVRfs*IRDLUzoZMhF{=h~85x?$}u0DQTiOGiFb&3}~
    zKa0kW21}*2d!x)Rvc===!p2qdrl^pj3~u*
zGFEYT9HijLW69pFz%yOM$E^_EvyO*TlTo-WwMj(j1Xi|!3kEtk!XHxKaRQMmsuH}#
z$slI~J)Xzbmug6RiRtSGY=(2Kk*79+q{87;LUnPwds<0pb4qQL@mAFZrxOM_&{R^T
z{b`z4vm;Z3oJ_Sgn4?W&x?KDHNU=pZ}
z53?B?1zkt>$c{VXn@Yn=#azxwsnA`l7qK3RJqWDw>!zE2D)~7D8qHM2>ouV?oMCdl
z`S|qx_fLQHtJl4EK4~gX{_Gc@|LA9*-#?jEss%L9~^TSsHfw^r*~4Vm+-#*5gr+iXeXVvj6>`{_5Ahdi>~pJ{5RP
zlfU~rAOG?H*gy7f{mp;to8S7gr+He#*KuUoP#GUVC57
zKqacGb?*rc?5JdSNGQ}XM6Jah#1LR`W!V_xwx@VHgyCt##92vTt2m^}>CVdL^E6{;Izb4trgep;sE;tp5Z(wQkbXDs|07aNt}DBfB8(P?F^r4LK=$@{Uu>IOZU^mH`+N-2*q
zoK=~3A6c0_U1yvp*%@^jcqFJZA`A>4eYqS0DxAH%JWA0OJG>m!WV;`$>>heNn;T27
z^*9o39Hb=7_8A*~Ydvkfrg1>rqNF#xI3nRDG!DFQ!wxBIMKE)inev^XKX%Toh|Du`
zgVvp>o6EyC!1xORoH(_iWWhS
zKux&~PQPTB3ts?*KzhHhqv5@(4xi+-WJr`F7i!EI$5%G4m(va?Aj0FSr!-FFd|D1Y
z?o|SYsI);d#19_tL}f1dtK3z{hL8~}BcX&eT~?;GtKPkP`qk(8$&cRsh2MS(;Od)J
zxI6!|+z9}};C<(wuaL@=%g7~tqaqO1XUN;80da{6Aflkm-L(>lY)7hOO2~?X_{%Fu
zHuMTe*maedZVq#$(8N;EXapj9?;iQh42ndccMD%XHrW`dJ_4}m^w{u7sKz=eDuV5M
zHbF~!Tpz0}7&Yxx85s*TE?I9gyp@^eYJj;~iEpRTs)KGvR@`?}tyC&mK0L`dR&3zw
zcX+>W4i@3GhSYGTW$0MZCKa0~R@}e}mC=VI`J*%+OD~?I|4S35uRUa(@Xyf5;5a17
z-b&KFuP%K{^byW#@3^0KRslJffW~?1yfV@XAfq`2siQ17)Ls^YIYAQpn#ZHW{*~Oe
zw}=5!!v=^b<(r=eb?h;5Fr_av4Z%WWc1ODiEsJrl6yl%#KIsou>QcX0R-}h
zJ9N|pAUOtI*33AtL@)}BNM;&IiJLePFi~PV4%m^UD&h^2(Aw+W?y7mN#WQk65>cEL
zXlCI+c-mSTz0f^tm4H-H8HRuP78uz*t3-$B{t63SfCD$GlY;S}aIcgZ>#-2%t2>}t
zw_8s2sj93})ZJQXC^HU8a-MJAn1YJMawv;60pT7#Gf#9OZjRQ5o#Eq*X&6`1=iZ68
z%Sn$Y61ykGX}F-|-a9kua4UB&t-`iBtAakH-7N(@BZqiuh;eT
z?j7j$_IG~z?bjck)>rGh&)0`{k33Qo?ufwP1omR$0Af|k-;l~tJDEeCEaKbNK|Z@t
zSxODO871P{8$cqZ1)WpyXy`#^F`~;(wjQ}^Nx_qWRhg)s#%RIM
z9x_moQInY*?!AMRSu=|k
z{vZC$na)_u33NE>g{t=1ju*i>GLdAP(i}K)*(fRC+8FG<0+F>0s3qvZd&)pbse=un
zR!lb#E0-E$o;)5-A5AFp=>Mb;>FIMtA;`?)bSe07vmQA;h^Q>25KBfb0Hj7w4MD5_
z?#+m|Epux8Kp^VvLX^BjN2vFs$5q~3X7H@FJZ*)h#7Wb8O83l2ca{mXI&ewz#tlw*
z!C6;DP-5_TyXtgrfp-FE@O*3^%yCC29C%Qcy~ty`_sMXARNVDcp4S>Ut#eANFJ?h&
zm5g;Dd`3oyqW5M_M4#3P?gH!r5&RGiHa}OP+BW)r1np&AnF<%t_vBD8Z65qWBAJ+`
zIfdzn61iEcI3X^XPUzBeJHrG)!kKDrIhYxqkkL|7!8emUimC#2B^|!^KsU%~b$4S>
zgl1WNx_f+C;2xFax>EdQ5_cUFfW`W8${LWG=_1I*U4UCn{|YTXl14G#wEJ@Smf{a-
zB_}mUG?4V{7uA-b#pq={B%-RuqwA8$$N{}ik2Ci)@Q69{>u36uy%8G55D3IfQ_2T9
zl(eL0uw1Q%FL@PwhNPwQx@q=wMyHBkEpeCcy>}p{(xry|ket2{iZYT==qP)&KeG@w
zu;gW`U3r>WrJJDb1yUI_ae@%U!%QOsGZUqwhgBMQ%Uf?d!}2^3PBRO>w-iGASb^wf
zEM0$5T%P+Zu?ezlSpf%fJVceM&c~{s|M7SK;9vaFZ~W-_ell;`paUXl-)TvUJWAP?
zB0z`YX5@_Zm>fjSFhvBmJAIsR1+|WvAA`tHgO!oJeULzY(UmwqjYSDQfIc$|r
zvN+11QT`+qa3X2e1>!;aLZ3;
z0IpVIM1F7tyg~dmhqE3T)XiV-s9;<+GqgFZtJ
zY8}QvcbtHr22`6{wD0gNtU#bQ=?cRgtk8FzO9uQP!G?bb&rx_62@1QSr_jkz!i?-|
zAQ#_>({RjyKv@m3z}@t+ftBE3X4X@IEMOm1h)6#Uhm)22YL*B?^w{t1J*D=rk;^5k
zj!UcC<4_t8HW!x!lzJ|(#zVWO|_t-iehG8%tvMvH9QHlbByzgPbdNNDDRRQ-X?ByWPFur
z1`^9{q4
z5$K+g3~$(I;h1UnyO>Pk;QZDCM0#=&CMuH9Sluv@vMc!8Kl=LL`S*YN`SYg_@1GsVdmud-t9u8N0h@diQR=
z?!9OB=CyfE_u%!Km+N|c-Mi=7y|2EmJ=1&UAn>uOR#v70Q0az4j91|59nrdfuS>Hu
zGW3~8Ac|1`;o?^S!U)pZG_9_Xj`u
z^-sU}#k-FmXI|Mh->Pt@1Hf&_RC=8DvVggBAwW{g!+9$|qaqm6F81C5
zO(1XqZG<7*Zy_zX!hP*40xA|lEsl(Bg13$kv+s?E&c88oojI-SLrMhvA@ZA4%KdoyCHau28%l)#4itIUk#zDD`e`Yp%97NXQ<*soj9F^*A5az{F0H91ge
z(#C)S2pQj$W0ZvfozV)nv<6MGyLaZZ3$h%YLAh$b&RRuA@2x($r&W;pptlwPBoE64
zMDA|(IB(`4gHrFOWhBU|*WLkEq|D1alAXCRl88CRGaOiS;9!^!PwvUiKJt+fxF4qZ
zWbwu4B!qQ+0g!uZ2&&6C^+QAZk7ywJ8xM9Z&EJPCo3>0Po8(^>QIP#lol`^ZpWuD&h9jfgip
ztF0qIMC!4$!b`}CfW4iNTuPn-D_m(l83ng+dDk3P5JZXZ#s*6vtGeD(3loa}h_skf
zZQC$XliULbVjBp(f273@g}qxTxa9fh2mrN`14Z>I5F74trJ&9XD4z)`P|~UR)VZJ8
z^4EwnJV>*(AreD|?E5$g(*9B2Xo22?Wwk?QDr>4%&IS_PqlwCbDsp9|obdO+A&V61
z$b(aY4^?-vrvte!T}nO4-xml5@lSVOIsx_iYcg8T5rb1K!R@Q>
z5!~;>LEPG~;i)!JRnQb}WL8EqD|1y$S0!hD`0??R@4x@sKY!ib>#3$YR}T1xzxd_z
zbNt3P@1;3hPmjomho&wk1AA<4M8qDd`%BA^6J&#CPgGAB;GLDFL#LZJ?W5Wz{S{0B
zs{4?7;>bHio49+SYkk9tb|E^C(CL6A_cSkZUYopLXZH}?&1?5HGd+87UHy9X=c})4
zUiS6!dcAz!J)=J%bWaMes#U8*d-ngJ1vV@sIvvf8}rf@BWRC
z-~VR6z`hOyA`RffS!+@U@-5Kev_v@NDRdPla1;_%M{cb|l?WtCr8@1q@%%6q3n9Ir
zSd;cZEMfOD2k}5;Kp;}Nexj@#qmZkr3ZvXPM#Sz-r$%XcD5)Ea7+qC`ZngdTF!W(^
zwu1pMxE?xXv-gi!BB*&0*l=Tu-Ez*;^njGGiQrAy>!*!zD$-i#b6ej$@4?)8dYQ2-
z3I@L9YCMlDGNd%iJnmz=K#shTBzvX{O_B-)>5L-vkHegVfQ^GPMCjg?
zE`;ZrH|u(TVfwX*RgYSAzv(xW1|rOdwC#`JnDRT-xw|;MT9G`Ed&G01sFiw3DecmX
z5HxOpFX@@)AtLA$e!6tT^NzHjJxy@BBbQ{pgE5roO?z4)$r)5u>nUW!8Il{`AE0l2
zsgY~MjjL|}d+#dQmSo#Fyl5yW$z16}&)g6wW4BMY+i>jLVIsuTJu@!<4nr$tk9
z$YDJ_3H=yTc)I;{klkw`BcigZ9#7AYUw(J}&ToJG`+xfhl9B=##L|`{kCapu$&FI8
zdD5%(|3X4F^`a6EC;_N1GN@6p9CRy+RHpz|89o;hfeMV=h9ERW6CkeUdL+QUW<7Zx
zZe(`*jMHz4uvRe7-WiVGkLpZOX9B_n1p`#_B+j8Sqcq*xjLlR{A(7y9PFH{VJS>v+SxX_f`f+9oFS8t&x?Z@tduJFAUxoW
zF=-i$_Z3BIi6r8jz#Bu6{>#0?Eaf1?oWn_Jf?8_@BHh@S7>_{QgrZvOxkh8
z;TdvAAG@95XOF?eDNj!FEr0}@6UYMlEL}fdW@*yzQDYr{M;}A`-Yt-Nzp|FZBZ-p%
zGedHc=;OejR;8c_fH*mY{#}4vs<_GCAx&NDT`QFkFrTm|R#FRGp$m;XQ;yRUygbTC
zbwmVuGgc~zLGcET;}SD}YO)w{E@yWt@qhzKzuUi{)`WIk7PNMuw6gol!$
zx$AD)tFmQVT`75s6&!*I@?>QlRm*G-T&>Ir=}cG^wT;_?cuxKYe)RRf_jmu`^QX_x
z>jRFx^Se*`Z~x&htMUi$*R|*42R@!289?T1Z*c+Bw)=DD_|aT_T0eP!7}zT~Bri;!
z?x`x<6b&m=28;kgV?O~PW*hIML|A!>8(BHa8%ljeH+Sn!-FmW+OOAsdEHz803F<|__a)Aq$=}i?%feozJyYLLm~XDRu&MiyTy@T
z-Ph}GqOU!BBrQAyuSD0>8lS<-+b@GHy@vW_|^NbpYyACkLQZ_kEmEh
zOrtV($9LcD?|pduQ-AHR{_p=c|J&)#sF^)y0)j4lP7p3$5c=zoFxYL+9C}BB2sL7f
zh?LGwe&~t?C_&S)td`|Y!UH*H2AXWA6Gk#j^6)_t;RH#P21fFzAZgJVhlvctK+)m)
zBj(JiGOILiR_%te{l=i`@lpF^;IVv(350w0Q4^Err~6J+vl9mfbdQ=r_C0Xh!o~Zi
zk`7Uzs_p=SsIv{ug?l!o1(hQuTKG9z^knSw^wt8QDsDrA6poU#Jrxgu2v%=%a@ER;
zV|5p(w|nbm&8UjXNRGknvG+|iQbZQ=$R$o4Zz}HYZJ;M%2k;
ztd$~ndAm+6{e>IHW3Y)Tx7j-AXbRhAKYG~#l%6C6S`!G46eiFn(>OkmC{I@lm6f4h
z90&NHBltIU7J7^MsL)!kk|Ln8G75pH)OoqqQ>{lFKf7=j-~*fB)CN^@E3u
z5Gfuj?vhk*RoCsI?_J(dUuQNInK)JNcpBuM9uM1`L9G~KnGbR2qxFyn6YWi}Fh*5Wfl+3?BrptR*M%x2
zYiR?3WyuFsI2bJg>MWJ0VZ$4Sta8ko#A{V~sx1rZ6nN8(NR>xv+*D}=)}0OdQCj!ljfLvCJ8+Ob*$D@-M{+
z7!5>KDgYwo7xk7DJH#^p>@)biLI&(yiv#}V55M}s$3On*cb`7Ke}0s-
zm_f$RzkB(2|KR8Q*S`Md-Fn^g;Uk`&Rs^zYhI@~kXl)fksyIMTCYl|`+odWuBb+y>
zDws@LsSP^2PsmWWnK&3+5~7W_2!x~@EC#z`6W!eXx_4jA-JE83H@JJ6XkzcauD*J%
ztM{Il*Zun1udm(H*Y4RP39`DH%viZ5TD29x*}buGi%1a`4wUw3Nvojsh*$m!{VAf7p{p)Jg>@k
zg+OHH)B5gp|KO|jPyVC7`{CDq?en)kd-vh1J+D^LsAvIs(i~KT0Lk$bV*NR_2z~U1
zUh(1X=ZnkL>fhW=kf
z;Pmqm8VjUF7(}}NgLOLek)jo5NJnt@Y@tP4B(&=U=lRaqE@?0InPt9r&fsmQ5w
z8;3DB^o!6yhtUMxV{8E5PKK0zQ#AwJUHhHJC>yn3jqbU-(wNn_uUWo1H+hs?N~}ai
ztnL4v2T8rQ5@c*QmOR%4pvBh&Ir6oJ@DGWszCbSZIJ&#aPz~G~(T3SOyyU*4
zbWcZ178_@c`Wa!n#8cu3oID)9-125i<}5MwfvI_J&0PAKaGimXzQx-5lY?ij6>(~g
zsCa+-+FOb?;a>~9^K!iml=
z?k$NR0rb`RSUO@Raz)OdR*o}uDG)yGRo)^lIPhd5&PP{7ip~hEL9TZp20+9Yj}VprYBD_
zE6|wck}taTomuHg&Y@VQ5cOsNRDqIU2#VtI!A958|08ZvU@MIhYV{{1XEDH|1XEd7U#;y)W)O*&-bU!{0cDt^wQOkY#GO+w!?-9@~l>j|bue
zXM%{8ie$uL63k>$Eog)^CQ;hm9AZ5TPE@4M^LmK4BqDYrlNriOv5q<;{OVzcy#M;Z
zQc5V*ovmF$xz^i~(ec>W=oZ1P>>{ic*Tq_PXJqJ{KeMR=bE}sL5?iBs0gh+p&2TM;
z1G5PmUJ!{P*P{Y@o>Hq4a__WmF_|M`tzCea5IZ1u&?oqmlmHFLT!QsG&
zh%?IpytSaIIk9Lq^mELgytP0Yv;$3_h_nwBoD)Un>~V7jbI)JNkW)Y3h8N<*$ZJ1#
zL?ELzGsgYi?5kIuKokv8JeRd{Rz;30CqcW$;YoYi`K~H8Elg`S3Js*%Dq~t^h)_rV=yaGOQ+0Ii3e??V|Tah>5{j9;`EbC{A3k
z!Epd_q77+=fa6n$!>Wjh=&8)!{qcGI>7RV_cmAE<|J8S&zxUxCgEPV49{%A^KV1{o
zkG}f&6yME!e17-z{CH#lTq{ZJ?J@>rt<-b_aa(Iex5*#r9VFT+fE5*MruXg@$XpmD
zIT1o>B0y(JRMp-+r)JyNwTCSw(ctBEUOBJ(+MoN{-NQ}n?mZmh+I+qG^UHPZ*}GrV
zwvw9vY$QThe9G{qsc^$--GZ}Up-hAUIJxvEbB0Y|vuE$!)R*b*p2~P6o>qN))cbeO
zAD`C8chB$Ntq<=WPmzyDtjedAYvsxWxyaSci&x{*-tV6(0*UI~TeIahpB_=b=RGfj
z-~P$dU->Kl!2jd_^nZE(Xa9njgTqKuCd1Qh$qU9zjc>JHz|;rqFUrW77QCfe8OYF&
zDqG%8IZ@N&90vrTAP*3#4^vo232tk}$=am|3d~Z?2Z$r3rY)R=Cw*Y(lWRg`1JM+3
zuS=N$W}=bpS!h1ydZt2C4^B0$f<~$nbw+l#+A=5vQK*_ruRv9)h|+_Yd5d=UiOxeW
z-44Gw0!Qd8Sepom5p
zKh<5`;X!KI0?66j61be-0@qgzNn|6a_CP^=Z8A(8&A|z@>debY7kFZs63g&LFxMH>
z2JF2hmk6Q7QnCA}GEkzWus5ZrQk!12G=i2u93zdOqVB8mk@giNfa_`@rIkf#w*onN
zt}9(_f>N?9IuDAg*D-mEpY<>zosfC|her~|Iq;7{if=|188E?`9qE!c-W*VHDQt_f
zSBXIv)wcRYA+2?|xfGT>T}!i4fS`P*wLG~8;fN*|s)!rRmS^CgBm{M-XGT`63e5Bz
zR^A|USOC1%qi07VquR6Y1VPDYZYoc7qJN`^-9vL8AdKv(l7Iz0Gh}6EE<;3RFxZ?h
zAgu*52vjWfr6)hh>eI?4yv;T1nJBA@1aLk?CK$21S9wYhOb4nsg{%TD5Rq%GA=rn4
zRH96yst$Z6MC_o{2GI7(C$-5>UX@E%O
z*6NlTL`1FZVPC9=00xvu;tRRNd*Ave_tMy`=Kz9Rm9*p~M*405T|h?nJf1QU-NT{u
zs}V5`a=Iyofq;fpiVdn#Uxb4M3p^DE=q0B;b-yOJXrT?5y>Sd_+UJ;%{4YXZWWb>+
zCq(R*$tNWeM`kVwR>dI)G82i%qs|?#A%dDN>l4rAQH1t*t_0%tqZ$DvecUJu>Y*MB
zy;+HRBndVF?5&^0vN%L*Ec#+S0)g31q(6^KTpYH-bv(h_fQzouQRVIe#fNfK(qKvu
zr|pbToo&b_Q;M6+BYepSM&zh|xy{OA{IPG@t*y2i^(@|AXJ1-I*iQ(;?>#{gO%~+
z%Zg**9B@XIK1qhEFNb5FS|3hvKlMulqOn%Zkj-3S>89gYv3sO7(+zfX$H|$Mi3eXV
zJ}R62r+@Oj|IhFL>=(cM_WAL6JZgp=)Kss(^LIae_ql)bCtrQt^XYScc>nbNc|AWK
zl?-H6L0PB~;D`jCnH3_kbOKScU}q0NShh2j84vW#T>J4@P`v0J^y0&oZZgTfrdyf4
zy?c7FdtR^k-23(Fxi~Yg-LK7S_si>kdD++13QroV>$T&fqB0ZI#aGdsEgUw-;|viM
zg~ST#6kds`-JI*Shu3v=&k0QDW5x5Mo}ZuIJ*}@kJbm@<-B<4)Pb(g)-aTqn0Zfm}
zR=}qSKb8C3>?|lJw+BxWw3)<+2FQ3k;@a`))Bft+3-~2Z@sI_Kyge0;&
zLJb!TP`NsxQ{{9glUe7+6+YthD0sa=d*?JK+B@bgREfCmJ=3Q%Q!hF^^f8rV;;GiM
z8=031Q;(74L?owGD4sne*j%|6`PTNG5=h`jL{tSiLQFV#DB#oo#?htObBOW8crSrd
z1yb%*^`KuAIQpKaF7rol@tBg@nw*OzXPM(5h$NQWqU^2~=s0!)Qhv@2-Z*03ibj
z6WU
z#y>rt7KVG{ANsuyKl&znw?QyZeRunT^G@ZtW*e3k|BN$|_queL!Ow&c&)JvCO8MbV
zq?>=Z4i~iUl2jD1K>GPYD-zqqdZwardgj!Nx+TW(GdNtUcz`2wLMTC=PO8R`(^$)3Y@Wk8?F(}A
zHYcH!ls`N;LNjGI5s<6#>*qS3TZ~UK_N#=i>Q)#zoY)t$G7APHpnNE@b&kww>j44S
zRcDmqaS381%dAW&f@^%}+WsK5AsH)s=JnbV4NByBJ7(2QbUPXmR1^-CMq{e{%i;m?Itwarsw2oQMHRYC5QmgZ@c014)4W{*R2=G{}ao$I>K1o}Kr4`uX-9UqGxS#nKO
z5VBhb!gq)6CAc>R89s%A99kig(T!3uJmh^P2YLp;?m@(oPC?BK4m+LdlcB@r49`TJ
zj$Ekibk7lC$!wyf5>7ph5atqCk7BdUJ6i}wjcIkid4E9Lq^b5%!^z5>wzR&2fcI{I
zkEb=;&J6(^>x(=NlI!7t1$Lso)uSSCZWE1qcnQrkw>D+=GdYGZh2zT9lcjoy-WF?U
zolDSx5L{?VB(wX{Etbet5@>7?)ARlJPrv(HKm33GzyH=RzWwg|-~YOYJ>6szugyl*z!s^Jy*hAWShC%e+r@&RAjv-&S
zEXRq&ZthD~eO!C*q5jTm&%XBV>E_k_vf0gR&v&n{udm%b`*P*O^P!#5b!#3?`U1(5@HB^-fpWBG@I
z0kRNCNE{{Qg}(6Y5eOb6Vorn%#}WxTuj4+IIP^&BL#GSa4cD{)9G$}>JzjgtbRU!-(q5SgXH#j2YaZmUehr4Mx-O5wksewXTwr?1wi
z6-@>Tjs0xZJ}Qv)QsG)h|MokjrM&K=KqR0rmGtMg#dTV+zi5yUOR1L?n7t#jB(A2#
zJbo&PLb=$@w5vYv{RSKq$!}isP7J%09+Pei_Q8BJLY8C4D4wk<5R~pT)>^tra7Mg@
z8#{pJ%6Qy-cY_`B-WMbv?OX8f)A$69
ziuW&mJc^2m+HI+MU|(C3r{?H=EJx%KnK(HO(sF0!s%kQsL;bUX2>^X{RM4J*Gd(#Z
z46E6lnUh1#Zd6rjbmu+GI5Ev~og@JgYGt34NF0`RZn|3!{R<>fcva7gmS9HeUe0rH
zE4?P7_t@U=Xh0vq2w?m%R)n&Jx(}L4bi>6p;_=Xe)DdEvcZLRgPtWb3pRM?1roHYW1`6Gv$*tyd3@ZPhP5_0)7;662OUT)r!pHCmx}LG2J7
z3lgoUxmN61zQLWj_uS)lGGMtcV((d=rR?>r<0y}{a>-f)=?nQ229uW~}bqcWlF)^DYl-wh1boZ3H6bqj1
zLDd2d&kGF(uWM3#UX1VKD1a-GWArWDBM^a5$9I#IZxGsEbSoVyVpzIC&sIO-ff(
zkWEztVDG5R9_(z&r7-R;6{az#-A&6nyI5vC3vY
zyW;NBM;ACGTGlOBS+&3yB{KyxYR$~`XMg>xzx4-S|9}6^FW2Mg`Q3xSZU+St@y9=Z
z`S$bm>p%SJ*S`Pm!=BH(-#yk>?;lT(wu>`}JjCJ-an=!Z&t8aS+bR645Zz
z#{Q7Xw5zND<%hooeXo1ZwRiXH>$R^}iGGWGe$>0?r*|LUy?g%n@!j)R@18!se|q=4
z9;+T1s}j+b%O_EgmnvB&kD8<#PdX!SFa06juH2|
z(K|B3KhoLFFk=DiQ5Z7oV6WlH(&uC&B2BNJI#qw0{;@d5^|I8)C7((tHp6--m(4CZ
zYi7GOB#lo^httdO1t_I+DMN>j$8n91XLEU~9nR4Wxe_LLxXl9w#(j2#E{!ub6|^8k
z4BYuc2Z^#x-R-iG9Ylm;N8DJA)(Pm?KOQNi)TTI8TnH1y>Be!Nd-~OW?o{xem$kDK
zeLkk)K7XK7{pP_H?mtWb>jWp^q@_fp!wCE(&xHp7s7!(xxxC1xE0+f)M}TP8(Pj^A
zYCWod6Jk1M$DdN~YI^8C9;TXfG*e?UY{6GHWUD$DT~RdOC}ur1xX^{8Dgv=i
zxWAWsGyhFHT9qOY-e3_iM?^tdna&6VL!){Ky#|@^X9i&>f{t
z@Xftou*)6nS{ady%nX-z?wzaFdOY&){_N!+`n|7y>xWNv%1gjQ*v=YI^s848N(EEmAS|?#uu+1agLI
zrR`yBIjD)AiAv!f-BVFO?5lItTmrWPOs3EJ-CFlLFHn!#J>6Z8M*uTiiD^#8THp!m
zi#TG~8>bPD2~?uTb*h+Wsa-NXPQZxbMl4{9zGk#*?rtiow|jbK2p27c=2a|Booe#l
zu?OiSus1XnOqa`;gLPc?h;b2YEnId30U5uikri$8YlOUifh{#7(U(JpbzgQTfIb3J`K9(m6Y!X_m@xMkLyCCA5k9fZR%oQ`3>aTi{Np)5tj?*t${LHqHT%
z5!-l*wy%G3kf@N-Bnu-y6WG_pBeNh&e3Tdlo=bkf#6-{dpHeH%(RHfln#WNe$L_0>
zws)_Uayi5!9-;NjtVdC8u@I0vp-^LvR9uJ4>O%+zNeNH|)jOL3
zLOX&{f!(4zHANpGO
zv?vR`)kT=IJ*y?uOVlcnc&b+|k;&*sE!lnWOaB$B68(Au7p
z4v>L##IS5Qy4UBV8{))aMk=RZW#;T1m9q!;JZIGpHnZuAP_MgZB3MLa%;9
zgMaoXf9I#){lVY)>97CB46Fox8J?~_=oSme$MB*KEJ%ae_kJ+
zA6NBbRh8qf2V8QSw>{aG*O{csp4r{Id-v?_>zZrO!~NQ?-J5eYub2J0d&ujW*K1$O
zPkOyxU-xxsC+Y0Sqw|Z?8sWSv6m!@!oen1z#bE(+?+cM6_uihldhNM(vy)SqAD$lX
zKfL?u!@IB5pgujGpV#xsRaG)=4v=wOJ$pyS>)xdC8pRF^7Z5@6s9X`bqB0*V1FRQfa)tq!qbgke7C>;LiJnAx%&##v3el?2pg
zO<#YrbtMf6Zpq)cy}N}+D~{x?8isIo^@${7C`b?sjeY@S5zr~vo4lB>;htEM|`
z=jnduPkdmtlxH}C4=sV|ry)j2`QIXu@3#ZUD|2(I8PPLHC&KHF;|V4Vc!JQ3&aZY4
zZ$bg5pFjD5D$NSoN_P(JVG(0v}ODk3!qQ^_cTSk&-a^nMdrY8*3714c%~
zamxufEW^($Q=*UnLMc-#nMgzyjz_`}fE4Qf>rA~rPlAiAjEbntmCw&l;5^VVX>dv=JAGQkJna9^|5ikcn+Qfsa5A*ra$s*hcclv8wURC713!^n8uy^?U=kQjchwR$^LK>tn0`7jl<3ymc>U!NqWq9n#KI(3eg
z1L3Mq%POA+?!?a7a$p`;lOYB0Xcr4r@%1B@QtFLpo(;VDIL0Z3R=7IXA)$zWxZKfc
z=1rHLrV|+_s0Ja_TlCBb$TS#7{K@n1d|=-`3CLy)M1T!xdzJV~mE}iiq8^|QbAC8X
zRTExOdpFXz0B{e1)Nj{e9_ki2%mqVoK#!+FX*b~rNwU-)Lz9-&G>BA(J5nZ2OnUen
zJE#@>OGA?Eh;w}1TR?YnmH2)fP)i3zwC8rN9(J=<;0Wp@TY>@gfaex~wmwEJ5uWGN
z)!FQ@EB~)i8j#jarKFyaT>=q-dWZ{UK5`m}J7f8c?n9Epp!SBkQNMr?&wEbI0Hrw6
zK+#$`!+O+cQervHay>E<-QG$kkijd*_Me2PxwU+Za1&)fhi8m?uGAzkojm#&>hBRd
zfXW=OdonVrG*`Kd-GI$*>O#mfxaf4qx~wCB!l6sjkg@zJUP}@j5hcDpZv;3pAOX|C
z5JVBkqokla4R-uORV<;8705m?&hE6RPQCOSL>$3B7Z63`FZQs3fT*iDlKU)`(fLM-
zc&T{I5AIE8=;UDDcOe91rRp5T`^VAg-988%jH)rz$;%j0Dzgy)HE`I!ohP^$aqO(B
zw=fdY!{bTaThmc7cQLCeWxXdt$}d(`WMmUy&oJ*ZaI)foA~3JJDtGUneEs-KfA5d~
z?f=)`{{27r*^htx{e#5^r)AgboZ^26`H``*W=56|=ba(#H-&$XT(@mR3}
zxoTzBo)ev+Pb;s)Ts?cZhp&6C-PiPPzP!%so*`eaetq4a_r6}bn|og`FMD6TH(P)o
z?Ucz71*D2s6n}I#!$1;RXm)1QSolgwkfwX@YY(~m*x90p$5Vd&?)l^QKYVyv@1N`4
z^V5fSPwyVj
zX~m<$K9%wyXH9L@Q7jSXdQ{ZBUXvfzfBK*Ni|>E!w?6&q=TGmSlACi;=QD%o)Fv@G
zW?DWIlByyRlP<`4ZY#ml1kW_)-n-UA9k^IT9X&J3Y7(J?@YLLtcr$RC6&@bdddso+
zi0%OOJCAn{r*|FU@>!)U80+f-RHKlgh6Tsdo{lvEfT+@`aBfV^LyF7_MdoW~J1qg{
zj29X&&l~6%%e~eEh{+LGoV5(^nZ)`6Br%`=R=AvV*hfc1&>E}LMCn}6p%l8KNATGh
zocdM)g@&2Ytce*i6O&9I0J_gTLp7tMxzO){>ldEKdEWaun$@_*d8?PV3Be(x!TqATz6#Ht6LjL=1T{
zApsb-mT^kXu`Ix-ydN0{HvUPDs@!VORkQ;Ptpqr&`O&tW-u9%tvtaVB4^fX~FP^`q0B~=aed;4#vq&
zB_z%alT~OoB!f-oa3m@e6e0a(occNwjI5QJL}XRw0)mlIYds#3ImFY``sJtnn?L^W
z=YH}?;8jv7xM|YT_1mY%2)DKk$I6X4X
z<%+pD%}B-ARu!&S+oyVuhHZ%TlRa`cGgQ1yxUI+Zh(uBYHoaBLX2#wY>CM>Oi~}QN
z7Mq&T4Mwi)t5Z~1hOm4Py+tw$_%8=J)&?r<(H64Uv}a+`MQ<}22UfclR?Hmy%cRY4rA%m^@LtE
zfF~X^dbpKcY_hi*7+_^!u*o4M*c4@YpJU;V;aXoX`D_qOk1dXn{?l9yBUwwH0E9q$
zzeD6YB#*sJ!IN~r!R}cOwsn8#g5WH5LEv#Na~JwEQ6)`yIj(7po4RmDIiXkB9gjvv
zN1`9ED&M&8Ci=qCBG+qD?k(A_h-Cwt-a5sZmz1>rd)P8F#?={EMd*?%I
z&zQ>++dikx*=OxJ-*=4X(tEpg{j=h5Wxox2kfG7q41Mg$B|{H5#23|9vZFmsjJAJVIbclG8D&8DuG
zM(n7}0B!CS0U{_%1b_=QOwW*+5s}>}iA?mNACy|56=%%v91SpRBy+`2yIEu#JeBKM
zf0X2a(m*K+#lu}x_Xo!*A#oU{n&G-U^DJnaVytZ2^L$)C7l(b?)k{e9qlz>WG)Xo?
zD3q#DrAtrUzwxU-{@tH^`A`3gf7-;)|J)Dc(38%tdS~VU-+zDq)A#*{f0#e~_Vw*I
zZ=YZF=~{2e3|uQBBY{Ohy>>QMp)phaUVV30Vb8qZ_2s_5yx05PKl}dv@_z5T?tR~T
z*9K~QqyQ2~hOIM38oHWFxWe>%3$<=V)-z(|bl>~#nX2CR``&kT^)6JClNqnfPoH0(
z-_|#8Z{NOMpFgk9uj}(`UCAIo+2TaH9reua-Mxg*o-mQuitqsW2q4oKdImBwh$}O|
zNMZYyaVY@W1`$
zzxAhz-_^h>IahY=@)ADD)s?vJD&ve*%}niaLMS2E3W?(gbnQ{-$MvlvMY3P`v|KRC6%)pTXN8pVS+o;qn;OUz*O^Ijtp
zq!)Dl$p~GlSUIxkI
zgTH$^nfl&y+*Y)YSFEWB8IYzPd&-}rHPk_&t@=Dr(l2_3v-b|FK+bRgxh=O0)v;1JhzSqq;`JMeOh(BWI2t4(Hs{=ZlXK
z3kK9h?r3O)pafkp=LmRSf*M=upueuF0Rj^a$RTK;TI9P;R|8}ify`?~M65svnvBe3
z#=0^t{_Lmtt$+EOU;Vi?8qf3b9Pl*qIICe&<@NJ-!C>8W?~2HLVeSDC&^TEb@P<1g
z1R_H-u%Eqe=pg_G87k+s;4!mzsdLid;bCv>xOSJ_5w0Y+hG7hW>$Q4NUHjgLJ#hZ*
zN%3jjmug36u&xE*zW2<8M8&&LEyaUKK9dX|9j?X}sc)Cn^TQoq5D(*J36senV_g{$
zQzebG`dgKfik2X$OjunQ(xUA4$lQU$!www#)#KEzIh~R=^PDrVtO!-PtOFW2ep<^A
zWS&3&p!bQ64U(8}iWN2cx9v-Ci~F3rvV!Au(cWjzu_;3E9ANaE+y{=FsiT`nV$ReV
z^{60$+XN*v;zhqjWEvWZj1t|aD*$3~84Ss8JsRX(E#%S15@a5jDZQDQA7tjS;*m-k5e24U-`6yCp~oQd$|+(^ZpaALuNpn#jmyJC^!G
zcnrN4?m&<0w5KrcARZL~K7*;r4%BX~RbASma~Yi7Ant9VOw_6d&ij6G4uQyrlZQzR
z0wLrP{#ZeHw(UfQy3^WYjz7r*_%PUNMxYdHQoU{)g#kc)4>x&?M7I_gmt&&N+dq=C
zbL$=UyEG76Dh_qIVV%OTVTZ
z7y=3<5!d|o37s&mr)6d_FCYPL_b{QU;u0_@4N2m?%H=(O;-k2;w{&w&u^b!*V~FupYoeepFY3VD|02?
zrlKR5hgsQo&k@@TkFx<--|o5yC^k6*U6qS2M*xwfqR=yAWn>0tGO^ZLwB%5|eQ4@D
z0U$FnspIIJxx?fxyj^&`;{E&i?!ABhbN-M1?%(*|{jdHvGsswz9|A5+^>ochQFwMG
zjHOs6AjUF6z6swFl8<{cBZOQvIINGu^V#|?2y{=tN;R7TBH?=#N0&qQojxy4FZ+R+
zS+^K1o=cNT&h)Iq5dp``uA|7cwBRxN%NpK0^XgA`d0K!|A)lW%GekbUrS5G@KG9)Y
zHpKdZq1#`-*`1LEfNExGFb*GDFnGM*0QAwI02E?$ulw-+7v+llxZ}*u&j3^1dby0~
zE&&P0_(1&wySMJ9e0uuRyw23jtXw*p^c3XJo5bk!Ak2Gg(9kixTRJ60URWI3E
z8Ij#}TJE!xdQOk~p;gt_CP)YO(@h|_aupmo2XYES-K#2vyt!2y;k+6Zc+gJ+Ky)kq
zCEyMpTtVxPsx;mwv@9JnkCKlqJ4{A(X{ZRejcnx-~e0NYnYK6IHWR
zrz&$P;gFVjNHwK*Ar(bqLcIUc0%7IKSgN=rpOK7et@Y{C_5P*4d0W5zXI|gFVc+I`
zthIE%^0C1VIRuEk?&(_yIuu5=?-t@!HIWE%-$$PkGl9KlzZYq$c&eu?NAF{lo&D@I
zAUV~&D_5#O%8b2BIF^>T+VyGlDd=>rXhNM8tvE$tMBO$+PBmz4%)RemGE8e||MgfI
z<|@oI52|{twW|R|-E!{@P*P^0{H7X;7e3!!LJ63AP
zroEb-m&%ffmBu*LX4%j{&p@M}ABh-^6!FeK*PxaqZoMxvFqYld9-Sz9mgSCey3rJ5
zU`-`F9M1j1<*^MakWQ$Y#Y!V}3j15@(KWvL&nn19?=nmi~I$2To4{
z$zb%ode4l;KG2alI^%=2TWzFPV`^$;5IlLxwgOP1SrWUY9e48X8HsGEEr}$Utb6EM
ze5}*fvefLNQ)=XjDO;EOd8#Iar7?-jz+JI0HRU*KtFXqYum^Dqc1^*f-FmBQ(}O{6
zCCW@Ut}E{M?mcQO-Tk*du0MJ0c7WLtVraER&=E~D(+EZ;syxrLYSQ5XzDQMURn4Kq
zHN9YvWV6dLSIQicGD0U)6N(O=nO&{a(h-3<3f7Vnm>*qX=wxu+(jL4tRkLC+K(%K4
z>^j3*R1AoDK3&q3(uM%L%Q_MCfZ2A@(lf!mixD}R<9gyQ$V>LkF!e^0t(ONdUi9g=amS_byqM!<^gUlj92|a;1Le^NLM0
zspo2ut^Q$(Tv82H-43Q4)hLLi7Bn~%WqNMyn3*YMx@yjCP#GLydVD7Gc+O9~U{tF1
zsk-;LM-lfs@;c#L)?fM4zcAJR;2;0qKkxmcpZjL15B{k8ir~tat}plf<@@^&{_v+O
z^IDm~SaIdbh#)49uDq_el&~|SN*=FPGj+tg)hk>c_C5@-mav>oj&!~jfxiyD`^KzPLOzP}bZPUXP
zKXe>!-no5%(>a}`3VJs~vf9d1a3mo!;UE=%89kyIV>&Y*#w*=dnCbC319xqh?qHNh
z*p-30(`0rR;e*T3X*LD=?f6}GlQF1W`@jgmA>wCRm!|og!>i)-%XaHnV{2is1WFz)
zPA;`o@?On6mU>1+-Id9fw9iC6X1WTQd0j6(ZNaN8--{|dwz+p8Btsd%Zl$M`7skK=
z3YDQXB-G!>v2h(daEj`g=sALM3Fri>c=!^@=qbVMA3%i)&j`NKk%U#vhL9su{gPN9NlEwK0A_aNB9VDb)$V%$4i%N$Ew`tz
zUAylH&eBsyt`O#+W-3w%tfXe&=_M<|WafIk<+WyDfG3#i#TW+GD;Xgy^X={Rdw+QU
z%fJ53Z~pR2GDUN1%qT4_
zIkW6DpuDCGM6xGl#`Wc3-!%scC5coG*O5#_6>yR`_PYtvwX%25*eu8NsTnJ0re}Hz
zWCLoc)I*huvcwc;Fh`j^z;!KidqhOs_r1H5nHd^55XpTvFkCrG1%r?1%r(<&hDVZc
z*YpYW6TLS8lhutGrj)v%Fvxsf4kO?)$A#U;X>^P(g*wxr_TZSRQjzq=+x?ifuK}#IXcqB=NT>CJgc~spo!Z+C
z_v5NzK!v`jgQ}iJM2cZiqo!s(Gci+T10jv@sX&2@?s!CHGscz!91RzN4j-M}d-s`Z
z#cMHA6N60oNyhq!58=M$knC1+O%T_c{5G8t4g-a)5M!tMM;`19cQw!0?m3QAox!Bi
z$e409t}_}mh?0gGPILH5%1eMAHYR*>`eS&>QG-im2n>uF&M_3^b5iSe+URJ|xXS35!7$ll20FzbD1a=r4J{_r@Y}!si!1mK|MBns{y+PJAOGABU!Sf6ED~f}ZwPB~_k7v+_uqXVjPZSYxn9O%pPfoFq28C6VfgQn&RLPtv5|OZ3kD$hRpav0mU9s=`XJ6`1
z{mQ4m_SgQ(fAk;z?|<}jzjnoa!^yw{kYf>w4}XrCF&~XHo~7y8OM^IREL86i2zAsr
z@+YXcmLWqT2cK8Il%3vVJ#(hzmt%I$b%^MYNDj86k^RG6(YGhK`t}jzV)WYe7kEkw
zeV4W>K||~T#vGsx6p}c^>3%Ixe(Vy2Gaytf1MZAPmGUV-?C!Jj$ax>nA5rb9CdkX#
zodeEs?jNcEMcZK398(0qjHvEV$+9=W
zyFhSVv9|>6nnzp!Vnt-s);XZC$AQDMTF2+~*sOBa@)Kh*({&~p9{qT#I2ZUKw^o0>
zuA9XMk&#LYJ+-D@rtbnwjRpV*7$>$dIIx}y2gw25CE~P>qsZbiu`zQHXm1`Th(h#?
zHI_tA?_z{BQI8N#PoO_?J{pn}`)h*egCDqpR%l90M8t5a%%|%K%>(k%NqwlIUL&_I2OIm7sw!GC#U*o^rzB
zu9eqY*C6w0BxNk(@?>pg00$FKLU#+Ui(Fu8M2rW7_uy{)<=^`Ji$AjI=wk`GMLJxG
z%n32hAf=*inq&{8r2=N}gD>c8miU&c^+(z}mLFsF$W$|eCdWZ@mS4yzy1@ukJ(f{x
zA9`Hi2S{5nPhZy~S$M+8oF>!QM?ECFy3df$5iuW@E_dr5Qi#KFq6aQzdb&$zqp-BK
z*86?$tpVSf0Sf?it5Axriio{i{X~FWs&j`JmCI^>~>bJwgj1U)dPToKeThsh&j+
zaQC4h$TIfI!*I>V1xbwNQiVu79ryAsdIaSh@Yc;+flz!7P9N^M-~ujb$C{i-?6PB7
zJTqE)EwtbJbn6RZ-#wIcO$i55>H3f~ngP?sM#O{i1OQGwBG~iZXPU&efm7rg
z#$sK`L051Fdn@)9geFCkCy)0rrqF(HVn*XX$HGm|Xjzx$oy#OCp^?U`Ao<~6-M7T&
z82d6J69Ui)$LmH~}Rl+f2>P$nMA)=-p0#Mab
z4`M}9{C0`(&`VNrDb37uOYKr;l01QYrLMJz!#zSZ!bET-095sCW7A#D@F2mn%1~9Z
zE`^d8+e#*zNDmM2==Sl^lIoY~jB#*7KxqY*5Ia`=xPF9liMVr1d{_@1`%iL^hV-5x
zN%}_i@d^Zo^(MpfF{p1f--xa7X8ff)Sg
zg}?Y~zwr6WfAEk0=}-RoKmYurAAI`ev$3ivJ-x5NokWa`pFNP*tEFNYu>_onc_h7#
zbCaWbA-cO~(;j$z3o@3zLw8s8-uJ%WyEe=%gr*Gb_Z$7=geS3X+TW_y?
zyVjEEZiZxLcFlB29Msjj`q%-h+dR!HGD1ZJGPQw}=cs-_7*PP7$rUg0`YN-pT(P)G
z5^FJd>0L|fCz4jYQ3f)}p1e|LeCCps^oT^_A#WMF7aEb%sG7WZExdo3@4v4ff6o8G
z-~Q|WhyV3|fSEv`Z!Ns-amv6<(yhJ>M2AtsBVN+N!{AYEjD;en7HUc7=SaqcIGFjs
z%sd)+Yb{G(y6d(tPYMnQMnhFGq6Ge?$;JcQ;%qtS;?*kk@AAn!B_!8BbRc{7X8OFNz;9uE2-|
z%)RScm*6*qKbU;%-Bbzb;_u1U#AqBmiD1^&@H_;SOZ*jgVYlHJ4tAO8NVfyC%~=&7
zT}bH#nWPV66OZgL!jsZJ{^A*3M?$(W67kWg>VFD8?W-ztfTloII3D&)KhP*?chMIJ
zbdi71ehet5;c0R09HZ_pWEYxF13xQ{{P|8&pe(G>Rk6j<9c;%svi6->jbTpb8+*eik>Y2NfBN
zTo2^jJ!`$RoAX){cz{#A*R?npPJ4t2>6Uqh*tM^GF;YrkX~AlN7hJVn1fEj6=aa=mUD-pjzx2Do7PGBg390k*f0`kB^4CLQ)vDh0nmi
z8Q>#nM!;TJKcw&kfdEYyq=6-m4HQ9LamIfr}RQ7y$JCAdXu@jk!q5fnpn}=!6{zfj<&SBd2+iZ-W{gdxj}&L+Kr{z(
zq00wRNNYE^@1oB=-$b$SRQ9dN)}EmsIf2s`>cVGSp|evj+WvVpf9lpSQ>{qYIOnib
zpiWv^AsCPv!EyxvDIiFhl)OHLT!vFFVcYnLwyvJFLP$rhkiC?7^r$_%u|mQ(MdJ_2
zSh{B>5*UuWYXg+e4WS9*!zDV?3KKq3MDIx$U36F-n?Q7U~-`HB>(?FKAJvhLC`KuIWlcp#ESs4>;b
z<1qo^L;tyt4{7{yiH|3``E(_hzIpHv4hBIyB}>mR0Gu&Y8uHvN_cfC&L+3oJi^H*m
zYXo?O<0~C(rj;VWwir|w0&ubHDnW~xfMa!xNvTeWG1_uUI=D7-j2Q^24+tQJsj7WI
z^2(^p8O$pi`0mS|?zhZ%n?Ls_e)QvS^8fz-`fvWf|NJNW%l-KW-(IiRs9G4wE^2Co
zTy~)~|LyQ>JgUX%0uD3Rfa&a;gx~ti0D!zU9?%QEn+tHZF3zhzA?=I-oNqZKmXD%e);m<>utqK4H?fo;um}zyu_(KgmDLn51{I#!-TmX
zNK5E7H`B?`SvRM>Ikk+pPj{E*-;mI3`g30K)K2!bJu_NFNV*|#61zX_*@mZpa_Wjs
zp>X?(Sbi3yr?aGC3(!v7GQR2&gv
z-2JIqWwtj#JXOW1m2vtTy?XbflC7OCXFh(>*bIpi&kI2|E^O8A-}jvv)umqDA#WP~JBgIGnc1a5v=_>F2!C->XH8ywzHrwdxY(Npl)
z)v+pmPQN;H3JCIihKLK(=5?ug1nfR}ywf~t^3XIqFjD@3Q!=BwDODj%rUsc5L`|rD
zlCwyV!t^MpL-C4pp5Wf4pCfOi?B{#$lfZ<`weJc<;r1$)8&SeA}rBRB;R%mUcli
z?t;eTKX8y?aHgkAN4!sG&99}Qap2M5J!mCS)d4l$dO;KC*3qvZHArm&+n?60lX9s{PmfwU7}31`l>1FCZtU6o@U1=iLOP!_Do;b
zx^FvAv>47Y>#wFgRW))PWah3>f`Qggj})p6uy&EiwKOR~=TpygOas!%PRs
z=;jmmwKrC3X2VD-oH2x+@|b(v$feE`soZr5eJ5fOD|teFy3o@S>Zr!pcdrba<*rm6
z)EpI6ONg3h&@Rw38bGyouZ)1~prI)yJ@D{@LyYsNCON~EoNfuEcQcfT+daM31B0Mv
z!cef4$q&4!x2*Rvqqq_2ljwB`NaWc<-F<%x(}aTfWzp*zhM(kAV`gvUn#|~1$g0aW
z4Q}lj)QO4KqdsZ#>e=)Jc-GR46n&l#oJbtim%_d5=S(WWp?Vl|_(?ovW1n#~ei|r(
zdzW=Pr?PV~LoXzK=iaJMCWBov98)h^15UIbEi#sBfO@?4gpK2=9h!n++qteDO*%=3
zd)0|1cJPn}6onBJp5Sx^c4)WixKJ&mUy4J3T`Tw2EyeTQbrUcc_ueElDSR@noL=$W
z-T<%2c+Ic<(zieN&D;OupZxBB`A>fDC;#mG>jyu)K7Y#00Q)XFP1IptkttK@Yl2wvj^yX+hpm(XimarWUQ6h-H}kUDB?knHv-83CdeyaLI`ukVyFp>;44$U
zQ^kF$_Yy?->9vHd>LMSMP3_Cdj{!&o&|so>bLI3LR~w|mXH4Cm-IWpF
z-~C7L_>DjHqrdVyzw>|okN=Zj`Qv|rxZ_N$kSfsUj6SaWh3V;IVO0%O#(&IeK>rvp
zkX9Z}!)c?B=ySyRzgnj$ltr?IWrGT_l2>hXeNF
z`KqasIo1u2+jHm1;~0i!266J0^th+G5Bw}aZ^#NF9Y=M0Eca0Q?3j$`>QXR7-2*=J
zT5#BznI6X*_4C+4Ru{=}aj$1(EwQmLkbrU_v>2-!5Pak4jUcKkG`17wZuyNPE)};Ujt&9dvBu_HbE!)O0p!$>U
zj{wp+(hgfU0(7v^`CO(m>E8}78ubo?QpKIjk3WE!55!#9_81rO(gvhgHIXPp$D}??
zz#fhA$RQTa{fLD}Y?E+9W@yL#yye}e7kb_`zKF$(x9n?#QfN{^a^!=j1oygTqiYAf#Eul)oy~kv@NN!Vk)AS-34(kHFf6l
zeISSiK#4gf*bs>ty-kw}A<1Ajd*o9JNAlRc(?Wu^x0q3$n-Wsx&%t8u-D6TrAucQj
z-73W)85{?$91$uNzm#?2*X40r*Y$MPPaFKmIU}$ecjI&TXa
zxgeDpxw+8y2oXV$*Uw&Jwf{5ly_G(D5ZYC
zJCmvda6u_AEV&IQSg@;Olj_olOgNcDsOX7846
z5Qlxubh{EOIH^_
zlNwcBMGa{`*95!Ka<%EGB@pNAIwmd-&25s79vS`k#?iv*
zTR3aCMZLbwAN#o|nt28Kex(F=BH;L7ILUds_tTVr(*vSQ#2h9CF)4u9VO>8^y-Tu*znH
zv#dCh#sF5p&1ZM4AQ0s1%Hx$n)vUF&yOUgz`I73yGvGamGme>GTqT=>>vd%s%dAO9c!qh{n5;FAP^qW+G;x{k-SH4jC%uP&+6E%;)4
zj%jm3gXgaD!&Y1*Ts;^s*?XUm45fRw
zHn4Y2qgt7DsP0^l^>pxIuM&`=N=fYc%s~=_efON7)*T>C*5Rzjn1l4k!OJ-#5XQ=p
zemZuFdGM=oZQvziipL{cjzNog@hudd~_%*c-wK=jq7v%?8
zv9k|we^WE+n-#U;*XM)7A=5J_ee1l9(GX|7am-Y25)ld6Y3k%NNa$I{1|EA*03(ud
z2#%(VM6jzQJQn|qv!_FO)R}J1TNyI5t_7PJ3ImPyJ?w$oT;)DpU3ynxjqZEZLY11TgO|-gr3N;nb(Wq(vG*Z(<04R2r;e1iZ?l_3dGXKM_F~Aw2
zU_%u(4CzHlkKv{kbRUDCKI`Mv06oA!1XPv26|21cYIn>qgH{pak?>5-OlzI%LrRHU
zy9UV2s)1)Xt5F%!g*b`c^Ny{f*%0RW%w%-Wb>%eMGj-%r6E`w5+_TA4&D27GcSVLW
zdvl@60WXk$VmOU2tw?czsCnWN{2Fy?>pswM9gL@$pZ_eDSBH-`ePjqbm>wNYeK>Q7
z?>(LtoNID=?!vk6RejiGD4b9ikA~0^oME**2t)HoCl^1N;fX;d-zld@s3sm>!moH+
zFUWy3L6o`1iK!fY;E<02Xl&VoM}!h7agk=dE+y#pen(!(aCbdp_HE$!*`(k`uC(=|
zw}?udW=Sv6-t?)t55y-dCNp}#R!cATOzzEzfXtIBXfzeVwFI#+i_jqih&jjJO
z)8H}eC{B5;=;~b)Pcl=ugz-Qu&nlB_svKmJA4waW(}@AGP#b0iHA{)sW6$o)$cbH2
z51Dj`GvHtbLV;#xS4kzS!%)YmCri0Ju#Y!fIZ%9ps%IjYaCG`uD*R+$b+;5il1TJ+
zzaeHa!^#wO167?@_7<7Uy-RB0F{k=Wz3&0Kb+TdKB_Xsv(!Tfg%ENO?eI}?kYLD3X
zDljOj`LXwROC9YEP-qJW7+TEwUuYn_BYevUm>5h1t9!~BF=7IZGLY3%8s%-OHe*Hu
z9cCIc99(PFblsEW;?Q!zP{8lX{PdQq>eDZN^UFW}^xypccmL0S@_YaE_kQ-%Kl<61
zjE)t#a^=b#%7b9kZ?{p--gUPs#HqcjYPzN?s#fyTwZ8f0`t!MOU369ajiv8k`cKZapjdOrb8V^
zAfDJh5^8-1nOvVv3joI4iQAo-
zjL6d!b#*LVsk1H%g}Sj48Bx>U??L9@_#40d=?6c$-|y?XrtgSUn^CP+y;TLDd(&oV
z!@35b!bVo$*vI^9cmYcM(p%GGg&w(JjM^?lmaT%}01082(m&H8RI~+$NP9UvX
zS*3xf5P6!_u`P2BNM@=AP#6@ZdS)WgM>RZNiWW#SWMvO!uf|Cm3D?YeERZ8zlYZRr
zxWOJMa`~_Z?lw%QVGb5EfYkmx6fpqTe6U#GorJc0J^#Gz<`|rjnSFX5_Yw{;Gg+nA
zrDr%ssBL2u$XhzK=#0STk$K`AvpU18#s$XQ(%FS8NB?v>2w-8#3RY=7)HKl!g%bob
z%MC7EIk*Hn&?63t=dK#=+(@cq5x?5q%l=8>6mF}8|LKXVhpw)SjDu$wED825bi{J(
zSOjYC)KR5LhQc2J-G7eJKcB`O{plJ=9s#{hISHzn5yp2P62>18mdT2GF3p$qADkvJ5=hhuTR{wW7KQo%ZqL@>05PF|VnDr*mP@%j
zt@ij71RTjfM&Ze9KM+`4LGnBwFo?iRuI%n$T1qDQ9Ia5I>|7uXlgucdNQPbNB8614j0_+e9*~PrryoS4PiReAtBDLEa(X7v0F|5s&vJ_3
z4A)wYP9y=S)#=B1a=cjDoHFW6Oik7Ix9@s(A3U{BHxLmvEdT)&oLpzGiPByYRbAa{
zt*K^4%`H8vis`S37sy&pVS_@bC^xK@W_M?#r0MqA4y@q}XKo*`kdMV``NVaG$rMT)juEF
z-+x|$OkiGDLdjTVVxfD25lhKfR)w8C>s7D8d6@^9lHpKW3AA#RAS7hvKx0dFTxsLm
zb{N52aUhPzRe{A|4q1116*a{eE^S@4ch8l~#HdFl5zkFJ!4HH*C6^DfBnrUnnsj8V
zZYKA2v~#b|I|e+KiG;Bp?MkUSF%v8L?$akrRXgQFEqaLQBT1N^rq>^ah{f_KAQF&e
zI_$%ADQ~g
z25B9)5sQx*LCvalT*?^QJ&Krq3ON1Z-X$4JKMdQz8fzDMzBMyLnVD*JT!4l#_Ey{x
zP*Sd|EuWM1FyMG5#9E;;$3hWb+lF(Wiaf|c#}UF=drT``+kG;%ttN<)3f)mdYKD7e
zM16x8FPKQn1lB8OdhdE(3QYRW8JtTTXp!eWQ4{i%Pg^sQa%
zAsEQ#3%Ov>F?h5T+KH<55tN3HnT#N+(RihI&HJt;ggxfIr>b;%ujIx0{KtOqtH1Q^
z@BQI-|MYkN=)d`cpZ&8x`tq~)FW>#Fn&=KDf^=GsA%&hEbfae_SLQbtKYf1t=JV^@
zx9gi%etKPR*UA7fD{y6k1X=~8(oXliYv04RkZ0UIN~{oZX=AK}g1a)ftj$1#9zjM#
zs)`_|d#!7&ToHp<87c6E6Y(ey}=m$oGd2+#qo;er32OMAE
zF54L89B;op+Yd=2H)AN~A%_VVL9_UzFl5xP?9r|yx#K%du5s5xo?H6`zdyAL%^K1^J$gn|>!ipSG$
z4xY$;p_7(lB&jnUPlANJT}?YkCP&#=lfZ?u|9VU-UgMt8LIS6^3#leIJATI>4m`}*Ox`LFz$>zfPj
zxAsm)kT??YgG#7;)_}eUzTb0Z!xBL4sjWgw8vg*0WL#M`I0*=V*o8g=AyBjLSr;Qh
zsj3i;9aN~P0WFuh=)0ytsYYgMHzG2kwtR5n`r)aAgs8lTP`)|9Gx(PZu!v;sy=Si1
zE3<2B(CgIRx$?d%B4QDPdlw_8yBs9mHKi}b2+q{5AnTsUsC)0d*R^=Y8z^&6KxcvRdVdaA6I8{nt!=x=oFvIix!zCHh$u)r*+;9us7
z+Fp+B*f3~=XlvP$r@NQTi*+k27qvAkXMz~n4(sHH_gpJ_1~wG=v50=bse`W-l;JJ_
zpfH*n8Nxp9<|2Cbdvk^DL8HlvXlYP=Of|{!5KB%=GAeRuuk
zfvVYC0!V1qWkjrnd-ovL(gCio$yo7PKx4KHsB;{=I&DzrtIa@>^{V@+%-c2yib3sO
zD;jgA(emKg#}YhhzcsEy`V(ZvGp%%FbZnGoWeXI*x)L*8<<;eTI%Bc#ZXG~!2rCex
zp$M*{XwZ@Uh`D4B9;ViwEXU#oryFb8Yn>~qTKar_i#DP!{%@ur<=cH%ECo$B1^h>t
z0NfLcQAfRVWI(nF=s(M2JVqkOAvN4styFZW^B*H4o;+kP%2U{?X)zE-PfT5xuV6e^
zHpKE3fMzI72aVpdmdN45hbv10A8jqkG2tQM-GNOD4b{Z)Bp&xMQflZf%z_3+L#a94
z8d`~yS)$WV6D_pTeEn%N>+pFr5?^Im<9N?>A}+FWy#WMRrGXpK9amZRprXs$25qkU70apV}~ns`-Jx15*w2r
zta4jxa0U@cy+#*uq75snLKl$nVAN=h8qo2P2!T0x1zkC1w-tT+YF6bgp-g;wa~Q7CHNb-m?%&$?JW8CVy;|E~7N
zkKXcc{;j|MpZ_QS>5u=|FGu9QcgPN{%e1L+d`boq{3$eMfKkLQ$iNeOrme1qunSH*
zGtk!ryP6r8))bt!3gCk_rRJ%^>wTto&5Asfv)rwm4)=S2;O3{A1UzDgq~dAygFO?W
zd*HAl$!b(AInHJ<-C>R1sA$pQF&-#BeFmlgbLO`@_GJzNI!`}v^r(?JW-fJPj^iw+
z4vs(5=GwYPu89Slb1xr2O-S}L95ZI^OObET7T
z*Ty(@0UxnR_NclzL`ZV(@hn>$lQ|i6t<(F1jLJGGYmNSl6R`MuqZG0Ma
zAZgY?PbyBw?KTgxs!WeO%6-~gMpPGw%v7%eA6>A9cI5L6f#Rmt<*0(1&XGbDActqx
zG?K|<>hS&ugPn6~Jc?FQ2EFJ=|7pYjhgW$1I+}U{)Zvv17&>sOj`bN#!U|Fu6QN7v
z;h!yk5)<2?V<@{FDt)#qYnqC+gxH}zAOX*1dF;W5>o5dE9|C&RK3XMK(?CU-a)5jM
zrv*L#hKOjI88CcmSfx9TZBOrA_<|;;&VzQJu#-8Vh~v3ies`FH^!u8M#CVdETr-iR
zV}7i~jTq~DC7L&S?3+;C4sgA$?pd!(2u0=v{o@WxOsO3(nvSS!Xp$b^N*+j0SedAs
zq>0vu%+v#l%*f14M#RduZ{GgN?|%2M|Mm}m{TE-Vt<`g@$UDo)zfA{<4z!+gEF?kh
zyY`-GJ(nO*yZ0Uy`nn9NG&~sb1X*da5hoHH-1p233K3kHCEt+FAxVGh_>di^8O=e0
ziUh#4^>POK{iGEXX54kE3QAI4YZ?gl?jpLnY7?Fte)!1<_#%MRIBW
zYH%sa1)l5&MDiN;In=CT0}v||dAzF)rwAt1H3DfbqkERyj5+V%5K~y3#+ip_!MNkK8FwOVa#LKvOqW+0V?3
zCPs*aS1kx11rL$&Q9KE{ic29NLg!2b0Ca{5ac(?=!(Jz$UkZdq>C!`PrSj<^u@<{L
zZdYP|!|P2Dd$))e-5YBq8kuK`ve;TRLKrl~E$0dsU<6J!OsfTizo*L~Rcva%hO9GL|b4Y>w~u6HaSj)HJ60d3cxIh7MrM^wInU+qYxorN1HeB@F+OYJ+i+>1X@_FkG}_e5Lhc_B)43dwthrR
z_fkAyP}I@G_QzBB(FZSdb%+&C5}d|bvG0z=`#ay>g2d~>moM16^7Hz;fBUcfyZ_Fo
zU3Oonm#8wvAYz?HsJuubl?fCfV^wKfTsygi+RhOnzamdw~Umu30TUjU>=ub-77BwU7c}U77A<(
z&{s>$NHyL7t7fg7>fsYBCstmZGk22TK;-D8pxq)I%Y^j%=TNDBsl$V*BofjqhB|~hE3Uoc%nW?=a7oXa)
zJCq^Utz4I`(XQ0gQ&kxQDAf8f$7**8T88DFqDw`LOlE?t+GyR^jXqZ7<1A`Sj8)tw
z=I1mAiUfAacr@$Pd?K|h#pSuZ4zqZ^Z)TRcl6l_ObnWiQV9#31FmaNHx0dZ;plZD{
zmaZ%u&8M5~(3*~JfW6i=Eqt*Vos2^jvvzAX+RD}Kp(6yLiOMD=aV*4&YY(}VTqsh)
z;85Y2*G1;aRXx|jU-`|?KlcNt>CQ~XLFRphOa5=MceAH3R$}G2nduvljEMOtSaBL(H
z(5`X58pFF%QAyQR?-dLNRZ+>QF_@}iCL6EUs@=P{Tv)*DTcat4#6IKcl_pZP{Z+Px
zF3MKfKnM=dbu*IMIL~aVDzD4Am(x|93ncG%;dxU%k=cqYTXDa?bEQ&Mf}$~*Z}?L9
zuIHPe1Qj*dGii5?d#BU;szi1(tVtv@({^yN?h02e!WsxXqz#6+@4l|6LWVN0yJvo9XB0`-lzftf^XZ@q6UXd
zhD3e?66JUd5xGhO>OGNA#4!Syp_-+3M<7w$n6scI5kv+v3k
z`@PoX??R&YaIyE)-MM0b>JDcMA(Fu}*wcC(bPdz&ZbKq-%zj!vO#7!1sC`NwMN&&Y
zETMsY1ZN=19A#jj?#|;5RYF)-OKc_0?TElIEy0Po@A|5Qh1g@qa2*v7j>N;D!0`QD
zAzzGV!Y~7zwi)w7)t_gwi#*T6$>h0k=J}n6wp8f5;}3)d804>>jIeCyYqrEpi++}x
z4b2hAe2CD9@T~Yq*6rAyc1~4C1fll@x7op|=?6414RxZApU}aEImwfPK!=rm?
zZ?EUq+to9@TOVF+O@EwSU~2ihUqw$RIq7kTmNnN>j^=*Gg!r
zcCve37ga)wz_sa0TL)?OM)a-c%0o#Yl6m1oD|PG(r9l(#n
z8U7&yD2hmxX7iDis-X}jcvPi=6*MitVc4ax|NT*3~{aDXXaQvkq
zW7j}@$X3_V8k&Pcp7GGlREZ?~BQVp7p4Uz@67zH{T4HXrz7F7q1dNz?rk45L&n!=u
zGh?d;ImxCImkr>A1K%^&92`ZL-*ju_uEY9;AR=*WkKNPLy*o2K!6YsEqLDGhDQmd<
zhYpGnwfpfB>Ux0op%TVG1(di*H^StozrA-xMq9L^O-zGl)B`LHusVBhT}$)mD5=X>
z#qp#VMP_y7l_d7w*Y$RgH_*ANp)f;+xK`>_34=FCvh??LoP~PbSj*;8B3EQau6%u3
zzyIC+YrpdL7ysldf%nqUe=wuL5qQr5{%|lheJEp{GXrC6)XEeEI>5S?>`Zzfl!A1W
z#y>c|P(0wA!t~k%EHSa@^EKJeY;A|~BYZg*F=VPjH5v$#+;vLWGw(_{y}i{54u*}1
zW}_n6MMZh9YgG-&_xC#(E0Y;@7ncUOcRCAXGFMlt^W;-idE}DxOFG4!0cI%C
zn#Y?Vo0&yBb1=E|&JyV<-g2t0l#7a^yrJO?|LC4yTnHeE4Gh_X#dE%k)=||U6;la!
zWdyr?V8n`eTl0ib1rVH;A=x`9l6yNh$WC!ue
zn6FYLS_XOq+(dd>rx+T}D9b?lI)F4stN-`xCV~jf(m1W10tB3TWxPCCyYsSNfUbV%
z4`<|h`R_BIPtX*@Rp*|8tkLIR?
zAtK-$$|fppz~({6YK$sh%Q%#%UO+CYIUtLf2G!iT{k8*Cb
z5@)1{Fc1LLiI4!$`vc;K-RZh}tc`;7?E{jz0wN_elH|M)zYfzE)8&l!Ot;gz?IeyG
ze`}|Ct2WnX?r!CZ#}d^8CUj=%y@zxnaLkEN9xCl~u$D>$1?NttA}7=*_~rCS{ayg}
z)>6+?8da#`$Obzj-V4{tjCtSPIVvdvxvu!~zN`BE{e4#n)XvPvykgc`y;9G4@10j>
zE=*L_m-|a?Cy(BD$xAQib&~N)%w+P)rB)=9qC@owGlFOMUx1m(P<|_FdPTgJ8bCZS
z_*3mleK1yuB9~6ZiA?Q;w`*w!UDpL#e%C#zdBw2$5nx^!WCm^Tk&SEmRCF$vXYU3O
z5Lc1zQPCQka4I453NDiElhf7{sk85$*TwL=Q-!%Vu7ymzuKe=e-@W$_Uir8G?SJEc
z_MiRdWRi=~d`cY^KP!8eY5#K?>T>C>nZg*vbkwNRMYV=32qQB7)w+ro3Lim%tz445rofq9T+q+v(8LSwN@^|A%$9;4{n(;9*4HS
z4mHQZdYjV}Dv>pnyrnz_BFUx4ajvBaM%A5hRo`R5stUdilG2JA5WKJc!%SPFIPzql`7x&po6&$Kz>jUldTH0^(c@teS~y*s
zbTX})YRo(kYnxK$G!O`;`UleE^$4gF#bD|T6;N`cj#fR~%!t&DD9;ZWR^bFsKdldC
zsLuFPyA18F>2aKIKY1q}_}FEMX4k~ZAbM9`SI&nJpTJrZx
zkbC4(s2xUM$CdiNYb{3R-j!=nNwdHM*hoWrR*nqkD#K~7oW4~{l7&LV$RR~8S&uJ@w6PkMO!iiW^
zmn%y1{r$#+{@FO^QCNy*l|ZQOX^iHT)ov_mZpZA2#819VeWvZe;N8f;!ue|qIXr`s
zacFua<)CNRI7oI5FQolA@b~INSWzw(5$`P|c$3LNqkQpNCpPNY1kgNj-Oq0>ZLWeoSv0!w?&B^mj
zx`zjPNF_^qQld!Q@lkeebfr)0sBzF(4O5yTE5t@;sd8?}x_bhCKCq3UyEA!L10LdP
zeJs@{h-k58*OEvoXe!VUl0qKlwkJ&40T2w)r+W5ntrA1_Z0)v8R`u*s$jJTPv4RfN
z#4$1`YK^TmauC!tt6M#6l
zL#&+YLSc+l3qX{ZNCRn@ghso|5)$OeO>qc0X4kABG7Fs?u0Tnx!`bs`WoPWn>VCg>
zb$|JC58i#JhUKWisG9fpcMPQZ)k$-aR|JRvmdR8Q69L8Q29eiN{}!T2G2<43HAV1R
z%k?+83)i)-P;oCQEeL9c8A&h_kr&lSUMmIZyC4A~n4a$;on1`N+lm2Bp#p#-cj63e
zWtWX&=zs}j*@C17XDc3Z+A|co&XIjCudb1)TOWhK6N%j=%!RuuCe{_T=X&{ck}mp6
ze%JWfm-_MN*Wdj+f9>D!N=ZI}GR|E%nT2!bS03^_IK!^;P#>Xy$}R(@0E})y);Vdqw2B{Jzg~Ke)bUR3Dl~7nNEu
z2xkXkda(4n8FCUtEWMSLYVsrV^}2TVk3O&8`HfFMctdTu2pDG$%5$2+#gTrc$C)5F
z&s^aTpiIeC);#n%0xYFb<)F*ZI27a=D``zggaaKJOuE#YF~lDc8bPd$7!lPq_|PfA
z32M{9?uh|HvzO2qk77KzwM;Ujb`fOe-urCTKsy^iFl`UIZcs-UHB@6lkVhj}<$)^C
zDIvsdgmMAQtgQ))mWwcw)tSmdlVU9%rKcp^XV>F|9_TL9a^%d6+Pt1TXV*_Rz8`!`
zSPKcZk_>bZ1yr)kN%V=}So5j+K1TsM&O9)VFlv}B!TCV8_3lZhGGYYT>b+C5IwiEp
zi)%d*vQX1q4fGJ2(&X5)8l)0ImR*`!Z+aAh@Q^fgIly2gaRPp{|Mj5!IR~+#dyWAW
zM%zR-*HHHEQkd)Rk><8fFfSi8I}VVX(%C?SKgl
zS3?S-m!qBl)*-iNMtWwrYSPXc12eARPhL8q^L7Rq>~Q^0Gn|K>CL7Zm*Okes_d-yV
zSDgAm1;>3?uFT8IPad0Y*jq6;nNr6VaeBFP&G||rC=xX^&jMDF)kxQe#q<>242@HA#w_@lww?p~Y+NB4)vZaG0(ED6z3MHWMM*p%QeXXKy-8L4G{QlrD-#5&
z8ffvW4oRNpe&h@!Gj_v}Ecf7MuV-xcJ&D>Ld#yDT9T)4&WWP}NtTCj)2$63B;|
zX83i7*l%~sVjAW^;nb0vr~?oji{FSxJI5H2erMGPOs2(XyN2wQYu7~7y^Dr=Bjc*>
zYfW`m^)z-BQFvJAr_Y_J$$ii}#SbExP6+3EBl&5$P}uc)n4MRCLsO2CKpTEeSj8Gw8T!u~ku
zk;_Jfw|-HOlpV3EPec9)d<5WF2CK$m(j--JBf#$$YN4H-_Ep&;A#LE-6k
zIGUF^fv0nPE~in|+M9!SP*plC*u+Gv70Q1(HNrVC18{s9+_wUl1eV;$$udUP1
z{nU{^QRS2f$R0&vKeR1A{u({=WHQjjW}_>a8QEw-LKIlqbylc88VONa@JS^zBQuzT
z=9xe58$27|EOu{$M8yM8?TvwcN?SsikrG`jVyxmCZ
zs*~_}s!Jh*lIM-=C?pks>cYWmOpmgAMw)+t?NExMSIjt}OJoVHDW6ALMthCVA%4D#
zZkhoQq=tuwi@O1(`L*oI$PY0PP?J*Kx~;bYmHpN39kY7`72Ab?MBR1JC!zR?Z2_Hq
z>Vke|&XfqvhjqlHwvn_z0K1h`QNXPA%Amq#BhS<$jVqvRt93L?!mB12UDY!Z2Pv2jIapRI#(WEQ5M#alCZmv{KtYX_6Zc}BjRyK*Me4N^w?)b
zsI!;MNgpTIiX}rSz{tq!_4@z({?C5<*T4DAU%g;~1SIFuGjnk^Qi`2axUt;sj2N}B
zdd@`xh-UQd;*e6Se92_*5j3;60n7Fr-%v1*oAW|ufU|dne^f^(Cd5j%+O@kCkYAp{
zGPV2pEkimm3&VkOk^pSao@I4MX59sPh)dTXnlnm3$+ci)G3u^$<*x3MI7){&wvzg2
zmL}k+y*_t{XH;nWmxDm|y*(kRLCoH+CiY!SzSg?m_Y`8~47yrEYgqP8=2dr(y><9uZG(1A2&zukE`obM~b0VJmGK4aXVrtut+(9)8~Xm6)y
zSB*2=oej&r^&9-v)Ub_xiLASOB3JbE_O92xN%CY7&D3^Kr%DxF6IC7SaWtI+f_h~>
znETM5I-~b49QB01y?AU@YBND>suWe_W}cI9(6MLd`dIPQ8CSKiWK=d($=Y#*3;>=3
z&-H<;E8pB*JPX*LOi1Eb_lMfm-AV{o&aK|5s?VCq4Eu1VAYGYN{^k`wKIfi@$Sb+sA02%An%%nSvgR?SRJ@oel;Bw?M@
z=HqidAsrvvIyF|;LFFge;rw)C4H3IaqPG3M*Oj}5VB|AlX7*iuIAlfj4!AOLL_jmM
z?|QwKez=@OmZCf=o|33ajc9bWIz5DD-ugn*PB$**VlNrfN4Do4L(9_igWpz)Y#&~W
z_Z~%qGQ*S|NhO^QinC&>XYV2-7G|Q?w9`6ue#%;M6ipbbe~0a`Oc3P#z{g_&3jo@N;**PVjTA`Y0yuo#e@&lwR(Pl@Yt2FhT%
zIuJF@E4l|8E1AjH72khf-@n(-e_ns<@BCZ;^S}4+@sIs+PJ*7c*e!dZ2Fp+FO)?_7
z>ZpMpy587QxOl)R`o%puMZyi`BTNU55;(dY9;SgPIDgnzv!@`LQZ|yPts{1QcYWb83JgGLH8>
z12esMV@Ri)eFekn=upaOxbra%G9#cbh|%oqITT+AR^roE3V6~tHDu#G02c{5f1h7r
zth&2>JQ?>gb*NkI_+<=ni98cRH%df04yUv99Sdhc2&mlWkCkF>SpOmwk=h+GD0X4e
zLUqQGQWIDjkf`x<4bIVHKXQw<(uVG_gCY5MpP2!AGP~}8AGuo$9Z3db+F#J?K{v|j
z^B?B}Ll4m9+JV=5CWe_Sz&_4=9JiI8iO5hjz
z9_K6rGgdBuaV&lgJ#oMPhd3*mmfBA>M_#@e;1t8fd$d3j290#YkJW!sn
zo(KKWuDI`(Q?Ba_Uu8_e)#@21(1*3tSZW$)^*tv6(z_8j`tnQmOz+mX#Tm65Seeh~
z)Z6dfda|m`w9k4E9jvTLqNH%zVX;mL*ad$Rzw(W_`684ddkz+o7dC33)002ouK~$M%3c3z9
zU)2%Bl1x`p3m@4LjKss@9*hvv7NaYd6_3SB7i#d}vPWeTK77ZIXr%c!xUF#}rx`iN
z1sT|-*_A=vg@XA`ET@sjqa1<51#p@<>tFOQdlmIAKn8b}q=7o53>ZhmC`jBrPiu;d
zOTZ&>BqF$X&pv@ww_*a_@Z^MJ5DuWgXFg3Pcb^JCNQ5s``&kI9
zqlE`adqz*+ksXo1tc-36hlS~E+lF((r!C_-8Xg*$zx1b~wATkr(s*rRD8Zf00Tgf|B=QQa!)^5}IOKg&coM)(X#t~CYpNrLVc6o{c
ze*Fllb%9Ll5iy_6B7bGi-EmsT^VqeM97_c
z+)*O0%BfCA_cKRBA%mBGWAfl)%Gd33+_V-o&r5`vL=5X0J46zR?3rD&GG`FXU5bj#
zLU^`C>emI<}J2Qw6eEIrALyhR_qN2nyv+`G=y_gQPXEL7Jgb<-iHU6%|%CfVmA
zhBIO?QzUps??lF<{-tB012$YZ)mE}$9m5%ia8qoW8%0fI7_O*xOd19m`1BV0j=d{0
z|HuEszxMC{yZ_7g_b+RGLQn1YIRV|Z8=Sqj_+cFzx|iF5nt0+6&iT$mx#6&N=VT58
zix2(WJrSBAqG+WtB|g@{$mW)7`AFq60!lw?4pJpN1#?!AGW)AbZLl7xU0(siZ%?=8
z-k383Nn>~pBek#LOstS92AC1-f+Z`m`^GtY|0x`;DLaROBVl~jjhhLWl>RE3_z|iw
zb<#cpPaO{KTRtk$BMGv6Z%7Pqt!o^GrL557#BIyg>#;?<`J9lSQEi(Z-PswW`MTtR
zHN|M216-LlJ-w#~!dYTwGLDMYDyfIo^0U%+Sl%k<5p~NTVWE-s3{RKYhwD+)y_-WT
z!rkpjf$m-HUuL{b7>PSWP{HCxe1&a>b&{bAFdUp#)7+FPPKsv+IqcTY;eb{9q{=iT
zA~oaMGLWc4(qs-v6dDgPO5rHo^@s<2f)I3dF5s%cL9kDvw|#Vo_S7R`&Vp?0@m1@m
z*>@Q9)`|Y1+c>pswQZ_6DzZ4rf21&zC<8h
z#UzGZ&a;&QjY2%S4~Epa)*QQtBroU&qt8?%y-I=#bN9tXbd5OPqk_vRJFn^tl^UxM
z{2kS*J@pWRT_uyrgWw`^dSV5gAXIFKk6rQX
zdmv$UjZkeZl4Hhu&Mf_3^lm;Rp6y%4FlJ`owXPgsre!V0d?1C=0~#R9G&ui5Ux2T(s;y#dV1Y;klo~oKCF3NTjQPXw@%|0o
z&MCeJd*47GqNHTChlBrWRil7^C5JMFceGJCk$8{;aJyEwu$xDEp
zQkP_y+!Jycj6oGLBLh`4c9=5)RRd05$uevvenzwI_ub9_AemTeb#>k4W|Smp1A+tb
zP-W7rd)7*`;>lf8d)DI2^ge;5K3f7ObX0w|RT3=$pAiixw{Lt+juL%aC
zHhT5epcW4qk_^VOSe2Cu80(4Py@#B&g6CL0pt+$7#ph}*igHX9D8VXdEmd`+SEdNw
z;B-x1F~dkU%<~Xb$0#Bw)AiF?H(*3>ja{9u{`T~?KBAqjWN=z258SX}-x@%I=`lPk
z&3_tDCb;*Ued+5;n@irGlyLO6U3q(q#Psf11khEox^&s3rz>E}5CEDFEm0e82)gag
zN_ETBr<$JH6DJ(&9OD#dlF76^cp@V*dbj4;##gl~2$3+uQGlM{X4SX4XC8lV&tz)6
za4}*n)9;Z$OzrMD1Fpr63h~m&0b1&Lzuzk(SD;yv^vzTOCx>4UNuNTE$ABl}qK>#3
ztd(pxSDAw_U1l01lD&IOYQe}}PoXgGQzaVLrK4A)D1b=T
zcCtNy+J&KqEs4J*`TtOHW)su-xDozB3X&5nVN|6{rPnQy*6t39jjNt0?9}e0Q2pqj3uj}e9&h&uU
zGZCH+a1zr*NN$zX{Z-lNl#p(MW7+V`X(6620)QRJ8EBoEp=WmR6x?^c-j;`cYY;aK
z0ef1qnjk5XUVKY_Pwsu+m4D?g{PJJ=oxkvZ`Op60FZ}U8#rJofv;He_rE4ga%5WJU
z%9Yi*Yf};ri*?W{Rj(@4Ii9D@uf;%z|3Vyq
z%g2813_N$ZXM%u(NjiL3sVnFC)BkE91!+BmplwQV?3ZvQQ|IzW0KGREI-(+DrrbiF
zn@>+$){sFdAyNpE3or>=&eaxVb)(6Mnd(ERj-6u~NPCm)Y3bB-aaRaEji;@cnVMd{
z^F)h*8jDOng`m?)kEzSgVKcQ-;S^P554XS$%Epa+Kd1j;VMQWg>Q}CUi)fRR*QK
z5S#kZQ^A&@hO!Lx!C?Q4JQ(hbM5LgF*8=K*Y&zy*L5-Q_V!w@D-+-SI_`Qv}-$7^QVQmb?ESOMYs
zS*4^vCXgi+Q&nhiI8e?|8ow}1tl(469t?Z;Y|j^AH5~0@lut*Pk0&kBl?yX>l`%N7
z3am{JqC7I}Mn*Im!MaQ3K7qQ&<^kv<&vnHqO7uST01ZNS#B@hw1B9IMp$|u5cdxu^
z%ag~WhNjlxkw0U=7ND@=;rzNA5gHiEpoQ(sbp?a(?^{L!4gBa`I&&gox&%;+VWh+9
z$S0|DP5<=@jA`xfHh)(5v~Uq$1_cywG|{I+cg)XJ%>W*}?t9elTBWvGh&cN2ZXkM~
zU8Q1JO5hm}>J$`cd!fvb4K7*$zuR~UKcGx!LIN|$73j%CcVi|N_dXg_)&2JN#z_@|
zruWS{#g?hRn8Dr-OxLgM#_J`PWEj|6DWhk8&yiUwzjr(U7P~rvD;;J#M%37C%u?AN
z3C^IV6($55Wyeb3mvrD08CXNt_fw7l&%bMQsOqB}7Ryl+p*b8z&)0I#GV|DXUFGLG
z18?R4$OJU(;lNTj61dD@pziiOSRHgKIF3_YN8dDZak?2yGdY9?KO6+U9L(JS@)-0*
zIQEQ`+tU*xl-ZZLPAofP;s9rtW!oyzCZG}Wao`Y=9w~GyDpy7MgaeR$gh~LkYmb*N
z%{h!a4fT8yb52=I-Q#jf=@`C_s~hj|5bjw8Yhpz{dz`N`FkMT1
z*curWr34bL{*kr
zk*C~xs^`cMW2~D-Vh^F-MD`kQOxgxL-XeIalD*74Pr-visXB|Lwo?um8RO)8Auc#2Va&taNS3Fn&a{I#YBm
zJvuCpfVa?EGv3@IxJHyPdso;8XUU9OpsHqOMh*sUVneuLtdszIrZSfg3my|Y`H=tW
z7JMjKSAn7O_8dn#I7i1r3q(wnx5mhY=fyuC6^Daz)Id7tnUR^(XtX*-?IHyyp664=QEUctQk~$1+1T=+~A0m>Bl*Ys$&#_
z2g*j(-JEl6olHtb4!WynE%^!sOejF*Ec8*#07wk2@cxjjLVe_P)pYdiy`QsC<$?O8
zb5;881K>XsB=DTh-OBqC3?`1zw?(&bh&UCA1otEF{#bORYFna|ItoC`oOBX#*wct%
zk0N%Z9^}0x2uk~f$zwm?n%YWwjw6OQ1V*Co)
z6n=HE*b?XE9RXkv+|~42FvKu3wV?z0zISbhVTk`EIiu;XB&jKp(#crm>l4fCp2NGk
zc1J`he>H%nB9MaN0hr^ek?ex^#KF6~UyAlxyXFO!alpK0F
z-L)Hm?YMC4s_XSSvI*AV*jxGxskUl{R+eacc!&B#EkwYuxRw@zu@b2>V@
z58H-eHxQ#zSYblpq3sy#dvakmRIQzu1+9>|c=D4lNV3}3}F9hc|x5WH^>
zt`tRylHKLVIBP(u+D4^z-Oa^^?$eQlK}K3jT$piy@H~mNgOyQx1aa2(YtlF$3G9<`
zpi*bi!EO7jEB9^nt-9sf-Q9Z+$=adnQ+ESlo>|~RBigak)>
z1JL26GI5R!Xqal+>r_q|6`A7L4&mdcdlGHWaG5+EZnrAl`CHWr}C
zegHF9P*XURCX&Dh$&s2$3T93LkAYON>G|f3*AFG91)&tg*p+nDvvPH6B`X;&_~FH
zN6Rn(CX@HAwBW$hXpu&E{9Z;?!AZ;7iEHoHEsPbw#9GD|Rtz0)+dYz9``6{twdf5w
z9V!C`AwW<;^l^H~&|_9m3)Wh4Mun>8sj#)kJndkZkv6k1!;dtUuEKNrDGV`k8cZnQ
zK&8q|&!)G(Atd46`uWdLTxZkqL|3|7se(<>!_kCD3FT(3gw)_
zVBI^fWV2Ls^~1*Zas0{WIdR3P)d;jqNyL?S2i|x8@a_8BfAg>YPyZ)B`0l5F^!9e`
z4J|w6FOo#lp;IIv7PMWV_trBJu{wS9o~%RS&Vqs2qjYwI8zzft@t!p
zldRGLof*?GrFwFB9)6)m<3N3$XNJ^I{ye(r0pc{(H0md3M5c}@wdtoRX!M+6Z~D&X
zuRf+4o_16fbDst66WP8@iBnErD|U)FoQO-%#>XHTy>?%A1U{mPF~`^-YcQXaCx7|M=H`;nGSwt@^Xa;613zPy<3|
zczlSNnSjoADa5>QiW#h)`f|4)ylA(PuMe$uVgfEZq|XGAr%V|IM@fIubzT?_K|n4+eiW6=rZ9b{ZTWEF(2V)KHr;?vQ`8W)uYkK*aI0fFI6PH@AX4v?tQ4Fd^A)
zcm~XaL5m-VAepVpzZEd%3virNhscC=_L#)oUgt_Fhzcd|iW
zTQWgO0!?4MDl#U9a_dZ!d99S_z&QxnGbbl@lyxi}-{@@5=SzVROV4h}iu@eaM5#lD
zLdaM>v{h-8E*rUmY@MH&4@Em*P($N?$jO5uo#&?2E3#A{t9K1Xb7H%F3YF0x4L7uz
zO924kA5AFTxjp;&SZCeHV9uecf5f)|%(3cB
zveE&kUOm_*)ob&q3&g!XL?f{>R5hK~pu#(PI#p~R@qr%&0l?D0ul}ON$n3GKPe9%&
zVC>u&6o=g%M>P0coR1*iql#%1Rt809&qjE+Lu}P}s2hX}b<1p^;hg8MuG-Iec$}Jk
zw)%oAlR#A&*k})bi2ymJsZID0gJF8_+6wxZ?wNKS)zWsJ_2GJo5jaVGJr1atvBgAR
z_xyS4Z-@V@xj?|lF*w8Gyu=w9OHZQ?;wuAxPj{6%MgPLD#?q?cY)$Hft7kh{P6MD$
zpxX+)sn!*a?y6ExD`SJJb-M`MKa~fqQO`*FDD<=vX1#Bu;$ZLuZ|aZBn5WRf{;=5$
zPP&Zzvi-3eJ?AE(cF*}TrA#nJYLZ7#q5ZC6e77jf+
z?+4S0NEkqqht$}kYSa2R9u0NEvmWI#RgD;6%mgHc$e@gEjJOhvwN_1kUinvl>(dXv
ziP~Co6P&O6Bj9KYbvA0q-W)uyM=VW*MbWjpw>ntYog6ODkvC>kduFg!1i5$bJ)=gD
zp+F`hsxFc1zV{3=V{dy4Ymd;(z567lgf>M)GNSg3Mx%k6c&>-8`H-42-=))AGv<7p
z?|a{S?_J~suy-pnbMLyhW`?5P_kcmuj8&y0eyV4b+dUC6g{rFFgV}e%*p}p@q6;w9
z`*t3{zHgNaBx`TeHS(V8^Ud@wQOdnbUnfO7R^NBq%U#gFqxsVt-!-Udf?#XF#~B`b
zZcU>T(%)J^bCPLo%s;1}_DnhL^MDK8U0o&NGpEIt>cr^*s_bu^vgmtyW)BXQ??wxF
zI*Pr|C6Sc(RsX9A)jqzv84Nju?XSXvd1NvI2FLH323FdZV?Cu|SaR&A!2wvekL@Y}
zN`fm?1k+Vjoy@g3-L;2^
zDc`m#BD&_>xkI40_Zb;;W~dOtzh(xzYL~V*dRJp2V_iYA&L~~X?7MWYe#EnDN%S${
zk2FU-U9s;kKhFpA2Fy}AFRN>xa%TXr9ygbj|2(X3D9lqXA>a%LIv7J3Xza|aYUQaO
zY~xu%Zqj@e5*TMe>FhYVP+ycj3&z{H9a#il=bpqfE*p-72PTB^mEZ-_Q)MVbwq#xU
zTDST-I&OM5PQ14Ewl46Qa}}x@i#$~P32gM}HSF3Pysk@}NKp1XTvu|87e`=a1S2zF
zE3ROW*Ok|b6|sWXiWRt4dj|Tkqc6sqe(Tw|X!W2>>XA!B3;Y*Ab+|z
z3l&x0#_4uWvFPewOyjd_?0q9!+uKjre33yD$zUCap
zZOGFD%$%W*G1ivibVHb-c^Xne#@0Q-$ICQgXgTOQqz+oLBx)252xak%JKrPkJFWwm
zP@5T^EY)#Wp;#ifKVmW*rsu0++%e4Q(tL3YW=bBij|r(7vEl!$tX3d>oj*s?K?vOV
z>rs4Ia4jz3DV^th9>DQhU!866KYgC;(!|-r+0#G(&S68%AoBk(&(Nn+PZ=yZk=ati
zko;iwgj+)^Nof#D^ls^O&uZf_Um2nTK(UbeAsSG2uB1L+NMVKKp|FT^A51$62?uJi
z>_f6dm@1w_a_K38lGWwY2a8Ozk`seqj+r!D!c=d?X+b4P5YI?3nXT9kPUboqZ;3@H
zNv0C)e1U449dsPjPqwiQ@=5>zt9oU2mw-lp(V0>9*NUT7_;>{_ti^@ue+(y$Yjhiq
zb26BcX~}@~{8Quua|{D?2%;xtTT3tWngFn3L8=B0nRH62F{IJS`!z7^JPv&_$}28x
z=KMkFk#w+!q^dAN9Ln{vY$C$ZpN}v|-J2$(1(}&E8OSU1%IjL!b*(F}PuEYs-@oxE
zzx{K+as}{y8kjiB{c&u9g#!TgW0X>ghJdVa859{AO87v^wWN7GX^Scy!ekSXK5{s~
z1EJ{@$~@^~Zt1Dk+`pKUHo29Eqf}g;I*br7d1@^6*K}c84#RAT%>;rR77PPK06_xD}9EsHoN!|oB?!DJ{M!F!O1nCaRN
zM0xHw%NWrT#GI71tx48hnOQZ1&MSKmi5>_DzZ-v8_)%g3SKxhE(4giIgiu|mY8qVw
zPl)QAp$px!u4L=%a1v7l?z{KK2T>-8X6iIIl6PRE4-@`fE=$&0WVp|l$4?Djdy=FO
z7mRcYJXyqJk!pKqO2Z61wp*M5U~re10hRcgSkp6sfsLjL4_BFF$P89ekRMsEV_XUQ;}!AN`IWZD5w0R-QKIGVZ$3gFKONsh&3A>zJIh~a=4
zaO~e1Q8&Y2AgYZ8-IjL(!yc?N=Bw^Dmwtw|1IOjmQuH`~c_8EyjAIaUpt7F-44wc+
zK)JslJ>@+H!y{E{4)5b@0aabiOx3}LOf&=5_-`=R%$Y`GPF13$nsbAnTh-DA%X;aT
zf~wXT!$8Saz47=?)m@W3N+P{$cm6&JtwOijXnJBrrnG{X1MP{ZY)^<$MHMq5`DcJ!
zWJlSU=R0)H|0iU0avY<|DLri&Rj6tLr@jy7N%ef{mhPGET$&^~&=t?4GcwrEC-pbn
zDyWY;C0GE4lw6Tuz!=I06ruE~v72`o-0g!g%=jbbF~s_iw`^F8>$I|xJ_*&GQLm!q
z>kzf<0Bnz^;*Ol5o5v-bw
zXqyXq21(|XCl|+vi6Uj<5zqrF6m@F7z2dtsUFeATJOBOP`S<@9*WTajw9!~&p0XD<
z>zbQ_iK0jGF;$hh@);GYM-^S-*iUPra`IG&q;Hf4IWg(Jy@QcYyy(GSdHlHTP~SL}
z(C`$}yBZREdo)AiDgFn-LuZa~+B5A(z*cCyuO@?J;*5TE^LUyzYax7vsmEzXxYayj
zX&s4b!1d7j5z>aYUMTmA&}}vINc|ip6^GC~CAa=XKp~yJTEH17L>60jkzcj@L)*1x
zWV<~F<4j}N=lURkj4WT`otbrpu04%g*x^jS8pAnW25x=MQafMh=*0hp_T-c;&)Rre
z_x@-aap23NM(qM-j&S^$(*-*mM>7DcJ3uJpM#$XZ>I6yp20g-bHf9<&hls@RQ6eD1
zRI3hmjDQnCu$Tt=yltbT0{LKKghnA5IGNTa%XOE|0bs_r;F0zk#pFcSX?;(*B-7v6
za!4?$d)FS}$wM&8jEFygv@O6HepAl{IMcn4mQID*%HZ+Z5@>~EH0V-K$8ow`o;IgF
zTKng#$%;%(-2_Z<4d7d9T8z;_NgE`)$`DfbOi4v1HorcMl@B*->!u>SXU5u8Rl_}o
zo*6(?%PiCpE7yWFpYYvk^3|Gq`Hy9GJ=B2~UmH)tK@hdAXJ+pnaN0={hw;|LFr#i`
z3D~n6RIda;3|Hh5)VcyhWM<^v{pbJm+b?{Zhu|8hLqDL;+3$GTrWvU1q?s{TbRkfq
zM&x$g(~y^7_U?U8_mqja8Aua&(hCA&f%>3PL5jIL#NC>K*_-iatBt1@(h3(D+cT=v
zyIa4}cr7zxiD{n(Bd2_fRrR22*9_OXGIDyVN}q75YENWNPw!It_ZHPk`;il=@($
zuiDVtR1+d;318PzDLi8%eD4Ryiy1W-^eNr5cj@IST0_U12+U)v#3>Y%@odUPw~)me
z;?26DOz)ZAlR=^QrJvunkj=@tfpddZtYglUTIrW-yTh2>W7HO18elpYXkUP=ntf{?
z2Kx4)YbbQ(zA2fuoew;lnlLIj52EE=2HReSf|ttLMsh8An(V5lSZ*{^Wfq6o51!
zGoy6M-YO;L;JTRUhp?SSZ_ShJ?v7JPsMzgpJ>)vF4)IVv4dPsC?fh!V2P~z~h@{Xp
zX4Z6Mog|Asnv>@c^Ye8%JEu%@jW;H8Rr>iVoSAjywU*L7YuEJTQf`2g2uj&z1WB3d
z!>1#zl`BYaWoY1G9=i2f8D#3RnTg2P>$)^fN@C717EeN?EA0g`13~h-7M>g?C2>i7
z7okHqA~Z>OM(Hbg*eC>J(X)KRg4iBGc=Tt8GqT9l@LA}|&|CETnt?}ZQxkw@rfTc&
z^h}%v(EZ84$rNJ_aV<~p8Tl<|s>-|EW57MK`=QDsDaWi%HIj3LB${aOT0yYx2Jo-`
zl|S_-|J1MjC;vy(sSWvid%mCxfHk~{Db-(h5o(RMq}ecW!I_@88qRR)qe8at~JaBt-ZVdsL5
z2)&&+?GrF((!hLmzs?~QNAd~l9J*R1qq>s@tRS`9`DqB@4}J<$hf^#VLiZ
z|6$}}po-Bm3xy7J_c;q@408y_SyZyp`L*yv1;lSE_T$-IP7BT#E4uBo`KABU`iPG%~1U#E86MZXC9;Q
zS&rden-JM57Q#1F;X;I1@9cIrX(q
zN<29ONMv#3!Xo5A9c$7#=u-mDpg^w0j05wiK?($zA68+43{F?omXeBR*U%Bq6B)U}
zDDv?Y1fRqG3?CKj%fXXT5dtK7rq-1r;>>uOAX4JCpRyu$1(!?jSGD^LG=dJjs;cdM
zpl2?;%AbJX$mQ>EeWD@H|1OA(J(DYm2snZBENJprsdaT#*U0S3gOESmC~ZFz3lbT@
z!~}z7`Vf&+QHW!~HnR+j&oF^{o-L0j;Hu?5>z3=+@AHDvYrTUs{SzR8pLZCXG&
zid=yKhu4+IY7{oaX2|3WbUdG)N|qidu+)dVw<>I^6nN+_EqSqU7-*v3fRVW}$k(;j
z%3L`!c?E*+@B7~OuB}m(nX#5q;$mEw*fkx7+&VL_wZc{?dmdC`6aPP|{xxRXc3TUB
zj$@4Te%^04=lteei?v`a_G_`&$*z`-rO-5BQ#J*(rlmG%f?8vg)L&wZN&RO{qb6vu
zq-r-m2(8joX+bLTqruQt!BR!RY9uAfTysCa-TS@obDifH{y2_tJ@1+=Fz5HZ@AKUE
zb)B0rj@@9ZF7$P4sjH=WpzzLFfaB4ml-zy8c0Q5-#Z!H8^_LO@vUR*{*n@R1@H{aIq-V^y$EWCWuc4Aoc!G?K*ftvi8Jr@EdaN7Y20y-8Bk|z<+(~^YVY?cbj@!L#{2K`0y7No@BQzE@o%4phPiSF8%+8ua
zx8R6zvI%u-`bgU2aMo96aIFa7@dyuax9-celx)&I`TgH-$p1bFEH@>E)(t2hsj~&|
z{HLW~4Z_*iiWF8#e8AIn4cloGS5>4pohjW`NfLA!du2dQJ2F5Ot=TL=WLqNu{E3S;80OQl^fPAT*t!n#8p?
z>1*1DgC1timmdsPAL9PT`ow3V!rSDqp4WZb-_)f|Rw8mO40a2G?!KO{IyH)2Mlv!o
zBO_L1M69G1cGCZ4ty~!qTq_D7veOfn*wD;E`oVkt{7UA5*)I$F7cjL0BTrC!*`#}_=E+JnO2*UIU;
zjS!CZF&;T#r(
zRFFDIZ?g6N6222QLb`v7epCdRE|jOb07>=tbI=rX=q@2T$98CNNhm_*j4Nq1~`dFr*O`I_d=|C8heE!
z`@c}(y;Z0#_Rsl+{worm`+wG{UA^m8mD~<-MBA`B`_S!*t^}bdN7=l6Y?L`-WJ)xF
zR4K4Yl_c4x_TKMcKd3IL-}FQo6gzWDc@MJ#mw|tM?u_W_p!$cZ+eRiDuw*RjvyV3F
zIfsD6{Smlb0BR%RCUtLYkSz0i)BbW0S1lU}lu9L;u}tl{t>T&~O}KuJ?#ns@U{|9A
zrZ5=i6qvAah;-U}ppCH!Zf39=rw*k1oguMc_7Ij0N+>AnQ4_h6kxeo(UoAu+b3NAQ
zZ~E8#viE-R*Oyuh^+)k?s=ger^H6X@E`2nV2nJc?_iGF-5G@ZI*q|+}0^mH=lii+j
z3F2%_GUWL2VE7W(>NoIhH7cae5IiX1mC{7stW9z&ed@#y3AAiAl;fMUEh4?
z(&oY?cCvBK25?z{*47rC!eHb|pXb$b)K7Re
zgtMB~7#V}E2bgyAU2Za7?mK$A4`f-X>Z)xoao6b#yghiWmkVg?J}VNmyB*!sdW}LE
zp%Gjh<6PXjgSk6PoH@vdh}yT3aCRTMp@D&R%`mM37+?rzcNO*#Wr~^%(mHlXR@+A;
zId>$3Gy?;f*wJmS^&Bu68FlI$7gKjOO6z?~9pDHz_4#v_R$H>pki41jCnTF}1%5Vq
zUvpN9^V?3B(d%&a5G10Ggm8jAcuImrksaNoJ-jo=9Gqxc99}U
z!nrCZG+5lD7`d}&t+vVPQtobd7p~`X>WGcJk#u%DhTNn)KKZK+nXA
zXzL~jK&GxbB@npA5P??gFtumf>o(e2s@5y0n|5`XVgMB543CUD=ML_^`JyB1{=COr
zsS8onmx4lD!`sVWpP-3ifcB=M8cec1T3Pq+c|nA&l%D&9u#*-MVcN=fpFfPhL9n~8
zy{l_ImhO}}8KeX6o=gfI9ZydhWXNG|ZFSaxFK9rg86YR5t6nV+J)cO{@X0V8Xwka)
zSQ%vWK$3NibsUXQfZ{}gYmqPwnCfs`k7Z3nGb7kskCmCJzOb>@QV`>Mp;d#Rn^3@A
zMS2NG#)?>(53{3#v)_ZVy2C#tbPgw7>#D4CVd`GO1F>V^V31vBOv=h$vR*If$2(E3
zB4&e>KEkFRUso^#m%*+gdS&z}O`_6uV~pP#H$~@hUx)UUFs2ne+r#zDCgEj=GFW?@
zcjj7oSHL=T>y}YCeHW)tg{Nel+SiW2@B4lK86@}fGv6_Ai8Yki>TaxVp$gzc&yG}3xccyOqe+lqx^LQU{uPW_tJ`Q_Ep1hfV5}N5zvk|Ff%q~9
zUwocyWwBe!a5%86-Z%#1>uJZ@^`4)q&Pj?_Z>-4fGA-X|DM3WNPq5P5HKkhL5TUmD
zji$I-#<|mc=9n|Ld=8v70Dz^Llkw8%Y5kOWY*Yxqju8g*wf@H(O4^adm
z`?!Kz6%Vb|f{ZL%Xxa!aS?8>kYH|cy>dtf!;hgop0!K4V&lBODIb@U3Jc5^vtV>nY
zzwwh<+XMbd5U_Ctg>?9}K0qa`)ZFw%GS
z=|`@rI@S4DPvAC^%Dw(pZt1x#GR2
z$3Z+j@$dPWS6_Y4nzWlRfnbd}JG8!Z7U}*_Eeq$$l+|(em|+?lDI8R$2M8t{+>)Gv
z*u_u{tzMo13@2m^^@JL{oa{yfBvv2o`e6Jd$Wk~~TB}bfTG?ELrbB2ZAp;FY9F%%0
z{rs9
zyRuHDL!zg$v>UT?YCbOsZR&{A8bc)n7$6jpt(Vw>)4&}TB*WIZYy1fvyU;a
zgSut>Pqn$Je{7$s>b$!{{=L7ji|NBJljSG+ty2p0Qos7nBa5(jN~Ho~iI#U6Rw4|~QbbEQb9D7Ei(s9S{S-~fcA4l%*L9)1=s4#ST~MM-?MUW2Xb&D72%=$0|1h6&g5M8Wp2GU#&=LRgO+%jh@R|rO)w^lHF#XB(c!h
zduzf}f;CX5lefN1^J&UqhpMz)&GJ+?g$_(SZjj{JJ1D48&*;Uq2q?amiW@kWA(Kqk
zz`DeRE2#pJm%FMpGlCiTIm23Cu1g*IO_spH#7ZzI@6F%;+kW~N{?cFkt#5zlt6%$S
zg=v_v|HDG~J@a6z0hgd&<(*)W8mtjhtLnyyZu`q3l6K&`tsZx@dP;j%Y10b`XdED0
z3C+kAdrvI^?z8U}0}X91OW56+x#$JxfD<@yCn6e6IE7wD8QE~8yPBJ_JLFPcv^X}}
zgnYC|LqQLv$35E)75C*Sg~$!Bb)Qz4H0Gf5edSJ$LVn4h5HTTwBB0&NaP*>>(YP?&
z2517PpCwb1QF{(y5D>Cv)I*Q@K9R`YXTLO2o`pu6550j**Pg0WC$EhXQ8;Z4X_2uK
zWT;p;bKnrtpH`z*E;Muws({pJdxZsy&?{rk(8?_NcdMGve36>IQK8{+v?WH{19(d3
zJzxz}Gz_?+S6<#J1{&ne5Zv6yJ`$%_adPT}WtNSUhD_Sg)x6Ci)pgFXgu7drt=(wn
z3V2IMeJ+PCGfEdy2l8%6TSFRNKh6xQ9vtH)^yztuCbHXF(
z?}9m|&kXf8f_lBj*TN95)ricsQqlBlJ>Glu`26$pGr#2V(?7nTc#FGF8NTMeH`=)B
zjg1ZTftKt*q`Lx;?s4;FqEZj4`-a1`3XKJF%x_vaGT?cFC58__o@j!q+Ph{u6fJ;4
zH@uukGS8Mh*r!vM|mv^RY(JLnWB)j-!dMQB`VZ~Hva
z4dXHZl~C=#43lVcAk6JQ+lTh`O$SvLK9IoJg=pqPn-V>02#v|Dc`1E6mXlo$&^o*J
zHYDj&y2{mdp$;_TUU#KWr;O_Et~)P8ANttytdrblMV$^(16q|WQ@b+-f;dK4z1F#m
z+$%|8`fs9fJ#Y2n)u(~p{t;dnoP~j&%Mj>Y
zBk-5|%hvgOHAe99$m+hHw|k`WmJ|%aB>B)`_0ZYqMY
z827>sQe!sMH+Cr~9;$PF;*BU*e~&Y23!I#4ckyNbR8K~%TyNB#^%S)>D
zyZ=HE&5V_?TpVlu0!YpXsMf7#kw0J=4sAB=8Gj-NN&!mYZ+F@*FM1ZXh0S#{xCDSY
zU0uRO1n}Z^)aw3rB0Z(u7!FqowI!fQ{F7RAv?Dy-ue#WemyS(UR#iW3Pg1vks(Z_@t?E{8CZcOB5)qGlbPN5n4|#5d0U~tMU^;uf(}*MybP~4`
z^97J-`-b1gSoHuc>!2j{mYd^69T5g-b);uVw0ZV9`((xvjv=u>TTGr`INGs*u!?j(
zsOu^rX8L$cMG2x;3_
z1i%c#JHgxO9&7Tnx+INwK?hakcFPFT-Led{Po8*TFYf<oe|VhNa*)IQObBN1s;
ztz5#X?Un{b}0W3;CIN?S<_h)~eji4=LD8M^cP8
zK=`ieWcgq2b5z?-Fl+0yReXzb6f?T9x1@VUb77p0nHnL7Q*~WiZIV`moF^pnkqupA
zUP#`+E)*C+%iRS)63~qv$R){uZ!hQ8cI!cj3l;&37Yzivdv76mTr1tsC#$;(kH?xZ
zfWFe)csH6VwcElfUmoagPp@bIczxlEMgU8r!+_n`xL;65KvQr$$GGA&-$DNU>iE(z3vImmjL19fzkyj5gpj5bC$1z)5M=)SGj
zdd{sg!~clVZXmdK)hPr7=|ouE;^!QrHi4%f?|uKCP!4toR@NaHf^Y1K9ORnmZwkIM
z{zqDqx!PQ10#xxG$q4poZ`}I?ai`+A+qpOC3&$n0gtfZg;SCt`XY_jpdLC!f%i%{N
zm+q5$cZVz>uDXaC+3;FAp`m;blF~}#Vx7J-hlR4)r!Dp74bYMiGJo1GsP)g=bP^G%
zA5BTz+5LD*PELNL1|;-ae5`zA`kV7s8wh&sjC*NSR|Pd=w)8nP-4p{AMFuk(WZ>Gz
z!U~O4Da(UoQAsOTv@CQ`ljf=P#v7OzWMZGwc02ph_7@rZw7Pie@Dh84_-k<=hTfh>dSVYsygRHj?k&yNs7miAlmDM(^Ym8T#=7l
z8KJVsf9H1T&)j$|jLg*CoXStteIA-><5woRuO`{(fe?s@$I}Y3&XGhysY_(9C91X~
zsA0L`T?W#!9cUh#iU7-x8|VPiV|819B`EI&NnFNp6^GZ#bdwZS`01KxBaIMJD+9Ewt|itEz(&F@@Z
zY7O4GI3i^GGQ#Yu#3c|!SKxG2MCKfqn6E7qX<*0sI;uD4iD@f0m5Dv?N_V%H9_Nh=lO;(J4$JN8eOwHt|lo{uoM(x@hzvaB8yNd)vk*cV3c2Dr>9hwKgGr_8%%~P!uk2B7<0Vi4=
zd0V1RAr1QZG=SXq!qnR^b@4)563uh;VJbBDSuw5E>dNdE(D00|t_n|Nu$&yW?RXUk
zj9@pqv~l_r3IRvAp*^OshiDiluK^AjBaGC^tOC2t$
zKotjocqj!NF=fJAm9Bta(&$r36U%oqd!tP(A9|LNAFZ7L<=Iw#oBon!kx!NUN8*Cv
zd^Qi9bX$e!W_4ZHWul)0Z8g%lTnf;)u)z$hyl1i>(=C_;5(EIXxGFTGt%Jut)yE+5
zK9|TeEsU~cKQfYFIXZI8KprS=xUdjI&3
zK7P$F$cGS99T0O?PT%?hx3$R$Eis+S&YGhFkV+XmGLkv4?WWF@z*46*`V|0*XZPuD
zfwQO2Dd|!6?#BH2)685ep(&$4bzNJ-N3FKi_S9&x7Wq)sr-JO((3(0g^L$ZaZ(yZK
zW}^CRi41zAk0uWG^KLei*Yg(PwuNg->!J@?$Nef<9?3HU4D|r3SKi!jhbAr>d3B&(
z)lsERSzJn4(8`Z31%!sAfctdI^l)0!k86f2w$wazJ@4(jV(6Lg;t$_e1Ib?KD(uF-
z$72}`P)9+nRjX&ZVa+pi%bFf+5wJ6%ck*msJRZCDFu7EudE>f{F@m5SkJ8jtV}@x-
zYPJq86kcW|DYjFqz(2gJ
zYu8ProKd*UqhRfpuo;dN>el%aJVJ$sXNzFX+-?0o=9cFQt!<;YX;{*GL?3hBON@$G
z8#S!Q)>pA)B|Jn%o3T{g$@`6wo_2NS0E}HhoU3$@)v4?GoKq>};#8l`gj6tlS1B;r
zSBPW6fps_C>m28|-*X87;GfB~9d!SCfC{6AS0NBo^zDJ2FM_noav39D?
za9wqS<)%wtX5`g5B}`od!?dn+cv6C+?rPNO73^bHK%8wPQ60FwQsKqr|H-bFgg!ti
z#d~0*a?G#May0`z^kX^6R>7ep?7^w422N>Ap2uB~IO^GHG`#g9r-0^TEs{D6a|K#?
z!VN-k=(prVu%N0uy-0=P(Bdjf7|uRw0?qc^I}~U@d1fW)2Sn+65}H`A383tfDyeF3
zjd8T;E+Y0R>qKVSaP2ahRh7cds;fF5$*HaN33Z6IV+(oqsbi($u?WbvCzZx$Y-n><
zw`e1wX;r9QN=bgl)m&M6H>w%kTkvnGG(Iymw(qH!a)7OEe>2beQi#QkE5X`SQfzK9^tjAg6Zk~(Ij@5YkXqtMu8
zO^k-2P?-Ix-A?%$PE%zz>V`u7;y?yYNjDIkO+@3%XTlh<>3jKO4SqE4ty^_YX$A$=qNvjY$%tGEjjYqV(29Q-d&(f0
znCe{st#D0(k%54u*g|~oCpgzhOUxq;j7cSin@uW6a0#5yc4NePtjy(o95;g%nSnGl
z5fQ3q*UHFLKwd;fWW)
z+J-FF^X>Gk6rHFi`FK1?Fl9b8Zv!%vg~Zli)o?Y^N~1k}swy(LV(-0m=Qng{)L0ND
zhL@`9)VZ$bYwtnCUr<>BpSp2Qa!m4_e2S579Qd
zX#yP#W<4Z7_Nf2wrGUsHsb4z%sBNSjDk}%-d6qXx)kMzh%
zH6WNcZNdK-(h?d~2Q^4l$I}HU%wh@CopHeeE%#+fm)4wmOZAPJ^v_32Lx*nA;yTFn
z6qH~R!|+A=fO_ZfM1&|5l5)i98q&ZzZ_Wq-(N4=GIr8bDx*D1t>NQLZU7ye#4u`Cjr4Zoj`CR+J5L-i0vD!`d
zl}dx#4v7VP=Su0-F2Gflo>MfNggIb%|Ac)+kciqHiPPM7q(qyEd4|5r-P$#P*^D|}
zE$8;k;Q{}vO46T(q(gIP=*$-Y^s?n$m-{LSu1BsFUhiW*0{YU~wL(V$&3r;kw3dw~
ze;B7B00kwGZ1{4~lrK;7$S}RE>z1Pz#VDVkbR1fIt;6TtF)aP^6>d!jZm2pPj@q|@
zT$O^C!7TfGIo*mIBR_OEBBouA1J1MIEJTyMc4t%hxIgEH(jQmgA~D2?<*E9F5s@nu
z?5+=~Kc)_L^emQ(L5vvP^$lpuOpa*A|DG>3fOk!GAuuA8dk0I-jhn*C6`65P3%JxQ
zI+Ajm2Zfst9Zck8@+awkPIAa+{iy)&#!|Z`pz+048ZTEuD(ktH#YZ6$$@}FV(lg~^
z1c=NOe;XEf*Ug~ZwUyU=%n?Ki3{kf%+(d_wuWtLHyZhxZ)SJymtd(dFs>v0~s|zW-
z(u4FY=20eyOPQWys^*5W)AIS+nxAJ-Y0@0l$^yT<>PJ4xfB5(O18+b79PuijmTC{V
z9x^ip|Ho>}4765VRe~`|!ln>J+k~Hm%3Wv;MWh}`1R07-@q*Ig)MmsCCGp;t4nmJ{
zHVD`a0rahAl+$CXC{2k9-2cqMhr0xrO(r0(TOlGcXWoBEYtzl{%!Z&lBalI)J8E0C
z1jS$!1@0kyGhv*m=(_-&e@jwAA>oPIQ%61bDIM9wGp@OWL5>>-Y6rL
zwSH`KnlA%W27R{`4zdvWjEvN&5}EZ9uN_n?2N1Ir3?Q{NAU6l>6Sd}ibAJ}Ws1hG2
zNV8*4w7&Ie_
zF2A3)siRAK6#`v!FSZHB7bj17*>pD|@?1x&Tu*?rZkGG`wDDs{y=Z$!(4{>+g-
zo}(mbkzHqt475a87mq~C=QtV%jpIPwxh6{%P@ytdkLZS08Uq$QKRJ{bWwtH#6f{BRG?`>g)b5Ou>VZJH+d4PUArT;Eb
zdoqCr9@26}xBgW`JU#M8X?51u_ALfY2_B?;@1vrw8}5G70K#?ovzcI>!GjtSQ006F
zrK%o}*#Du>7v6+x8ZFIC!_A>6*$|}wUcbgI`GB@OP@3JqJ8?EV<>-Q
zN_IG7sEYeuo}vj=Z~_s$XjK&MO9wQzoO-1QQ+>^v4l3?w#=AN@dI~Wi^8yaNs0=iB
z*SK^24BgDjG2t{z$^b@x>}Jbfsh8H>9$wHBq*-!hVFLL^yI58FSK8`xJoh>N^CHLE
z(irSritC$?=S0RjRaILt!l&ekJzIOhxlJN!s%l>jkFERnp0<*!j9uLfsuaIH;L8i{
z*@iyXatW@-=$l0c~0_KMv8v})7mA>mKP&*pQSOQ;H1_@E8(eK*py0t
zVa#&ps^zV!A~VRDx=D=zbI~}D+A@sx07xwZ2}XpRv`;xv`qc_n5U_X(kPp`WdCUpm
z$gWly>eR!k*03Kk9#4;zDav)yvvtz++2^{dA^lhD%t!Tp-ogGufADw2<7r=&d<^C!
zFCu`5Tx!Z0DcV5|GeMV;6WL86`${k>K{yqh@2;B93*3uAjeK~iTY#-OCA_;dxLs}u
zq#+WiB8i!i+wb_j?*h{&yfBqx#i(Fj_XG`$MkzCuT%g+8_ojcKdPji+t!&HooyDms
z=HT_=+;VCVoDgJj6xE~O6uIQ3p~tS}(7^P)zIKH)=&(BP{G#sJz_;_?&)pB*vT>h0
z^lyYxcHqrdHJaHgkvRXjdh*!J9b-f!`@t2s&x>~S%
zq!0ajsks=`9D9gPt6R
z+ZkL%&-&D#-uE>P!u4o~&v4t4F(Ks)|{U
zhgyPM4@5GT%o=MwG8YI5q1WS~FZft1)>@DJ{7wJNFMah(J`TcG$D5zwAolKLW|s?$
z)v<-(IVx?Cj0l%95y8OT{pRi7&S~%lYCuwh4B>ESpmsN$Dk13sS`RoPqE797_Oou)2*7~4SW`>)JNwE
z>!Wn6`0nvh-MYVLTH`p4(}PuIdBxlcn#S2R
zBQc4a-?N}4CXyFEF>Y!J0THv*T2hYdE!mx&s0&r^&}^jAJ5Tl5Wzf8uNv5xS1|u<<
zzJ_xik621MUy9k5l@SPxsZdLc#wy{*Ba<{MF!nn
z6z&8B-c+a-oY@Sh0@22CEw0Y7d~~Z$=_>p05h&ye2KS{xgZIIp*BL=fH9>t&v?aW_
z%R0ZZ%+%53$u;56@0OTe?Q?%{?tvQwFeKMgM5%aO%f9_wS=FA&!eE4|{xIPJ!meYX
z6@YQ2vppLr!V1#1oCPVGAToYVXCxz0Xy_BjIFbs_rd9NIL-6;|VA)wM1_46GjvBv%qi-psR|a7aVQ$K>l12}iM29E_jZ(-&P*P0AT>CZpOzE}q
zkxK_aL`cHmI`J-mCV^b<9M;xR72{N@J}{H9(i4pD?c#FLceEp^jWvwX&N!mV_mtkm
z+Coip6}xxe>S!zt<03S)+vsfuuGZElc#THz^a
z4p)nrhPWD1I>hMUKtx74Y&_RWeRs)pt-gRCU=PlshGGRWS>0FRxBZ5n{OSMHPrZ5b
z#ai#J$CI6N%0ng@8Tkm0X$WTeA3Ek2vrs7szI$Gn{ZgBtA9XX)f}q8A;GOpe=jI51
zdq?K!LfRLIhN|j4OWaZH?w+Iao{m9|++FAMeatc<={W^qUJWC}0Ep=?^sDuu+<`*A
zxhW^qG~NpU09d9}@A5wgWHT9vFp;V%SwGsxBwyV5z5%Sw)OBNJdkn{qp+{l!t+t4k
zxqovDZa@eci-@(BdA?a!c{d;oJ$99m5$d{_9^Bx^q2j^+BvjY<4iG2-AV9F^*idZ~
zzGUW&10DDABml--z92Uhmp%>v5jX<{-HqZoM;_eaUKBu5F$T8GG#V$wOci4@BF;G+
zTO-M;iLMFKK_oL9AARMsn~wf8{?#|QAX*vSGRJlgp=lG3K971$_nj}eB21|@
zVCA_fTmeFgbx{>w-Ig4;e}NZJjbF%w^6r
zg_^INI<@Om_r7+65i8f?WQak;#gKZAbf2#y4{s#T-f(FqbKt3YdXD-a#pzA$BHTR)
z_Bj}=MPFT1Jev`z)uJM=+T9({RXAs7a%)PaYNG~aRGLTFj)Hu_%jtZt@dGPE_$Xht
zG9ok4?4~BGcXh6ZqzHy)Oy@Eq+02Nw0v#(8U2*Vhe|diO18$X>lZ$jO1h`@bWM(*J
zNCLEn>u}@vkTKHY($Q`HO3qZ>1sy@~7
zvWd(gH5t!7Jv2tJ6|G=5Q_QSgd%w)iI#-Ks7?jsS1?RllXsVS}44zYHW=40NZKsnk
z^?mKZOndfl$ZH{*eQ)ej44(FIQ3m%G;Oi(t)6>SV^g&ORqH&e>uN9G(oQ
zPt#UDTg%w27eEUGRA!#u+f$theE$s&5X1ur@~T#*zo8cWXz^R1Frb8B&S%_-0I$d?kSK*TwX3F~6`
zTkCbGh(6;G7Vun7rM{T~?B|mi*W1dcARt^xC_pgPh$>H8s7H-9qpBjgca?{@`j~mQ
zbI27va7p{*@9v2eeMvWvuE7c*N(m>uLh0Zwfnpv9O=%WFwWCIE*6DDlA{tNtcn?R~
zlNhf{woc1VspTqG*^}A3tIys?5`g<%2wJ*XCRJB<$^_AUJ)bIMMu;0*>5Cv3(9|Mk
z@LXDwrJ~JKz=&d&)H{RJJ>7v^px*^@c7!--uwE;?|=O92Ood@!H<0X
zgKvEN{)ZntGEjA{>nd@E^}_m+JeCkcO`vcJsK6VI4~B11o7bZi5_<{A9NsV`YY&L<
zM0HIO7%9R_A+BXpZlvLmKhh`I)Tu)K^acTTb4`dkgQdAUls@0+s=6_N_fvNTG8OIg
zD*d9m1XwNGmR5v>sd`&spCN!7S)QeGN??V9&7DGHiYz007&D#lCXnGr(SYV(gMnkA
z3V1`wgk5rW0dgk)NdwZ|nXw)#R}kDUrall8Ja+HIXl9(#Jt4y+&v9tW*`*`ooQjOI
zk6XTZ`};bPaSM3P-1Kvo@$4=^pGWRioWh%{K6uK%|9AZ6=g+=itQAk0uNY5N8TnwW
z?qn=RifCn+sHoF2tgOf5wrt3AD>Z|F!;*TgUosJd(=npz_>6RM)m=rh-6QoLOS@_|
zl4{70GZ(7cLw5p@wyPUH{MC1w$n}UsT`Riit99ACA(BLExa;Y!04jwCBkP=&Q1z-G
zY+3T!Q;dnL@0t07yKmG2pJufOpsD)+RkNXie@3vUyK%KT_4)kV*)@KQx~u!<@&HFe
z=--xcx)kUOu1qw~h?Ugu=!^P|u}^KFbrGL)wDpycrw&k1mcBKoZ*yP{C4C}nCF*X>
zjycQ6j2@|fG5t`gf!=4wh`&{5_nrOAV2k~zU_O=?9LMmWpR>RE@Y!|`cRt8%xZB6cO*LJ>?I@Gp%=Q-btFu(Z1QCxk+)HbOaT-B-EBlQgn*I#x
zF~QRfHdM0`L?Eotr@e@fRP6q=EiCDji^z7yY>-Xt@!!H;V#_mhwlb*FuDX@kxT{yL
z2%dAU=|zhA0{7xDD2i4@0*pBE)5+9q2|B@fP0pC1Wz$I
z(<5%nEE&tJ$~}ZLm&t2Iq*5|V)n@^yUmdvFj0m9UMS;^=YuztgN*Q8r>c@frtEd>&
zD&GkluPFq>C4-@fM}@AdZ+njN^Q3Q;j#rnjDH_)qfWWW9uFff6!ydlAnHdIKMOt#|
z2~>AoC2NCVWc@4MJ}MHru+kEk2)3pk_yBZ3i@(xGWBBJ#fl@&4tERt@fLs%#TSRV-
zJbQUop&ReH{^$<_Dpg3pgm#1q_j5`d3mT=|sj6IYcBwAl3x?fVKiV&72!>GirQ$V{
z%JOL6G`@s1@oRLgjT?#ZoM%p*?C0i34Xnkz%lnC5^TOb}A!`a-$#6zY+C4OK#aazg
znJTK1uS}bEIjVZKVkUqrymxi^Fx8I&B(aXw?UM?fh
zAkqe=QG#?=RfV(kuYdm1r~XeKI3fsuicld$yw?TtKvkOrinSDJBTk
zMqvyZn5#ITD6bfdAM?KEQFjA!-39sdwAPZ+fmh*&pPldi?3ds9?&qI<_V#+-1-$nv
ze%_CM^kd)n=*NEEt5=V>p3mp6-(J_1xt8=P_K!`bQSzmL@h#@_#COsVK4JxYkolM%MUXmwB@)McH@W?qybj05h)0Rb9s99um_1TpV-3wByYIeEuV~wUb(LWZuG=9fcZd0StZLLb
zXixW*tv&OOw6u{J1E#E{S*%ts!lThE({s6JW%5QPR1PC}e^xHRIzIysF;`tfRIu{9apBAYbU3JKEX^Cl*bnH=qJ;!qgIUFn}u$Xs2qJpK#
z(0E~WV-DIVWTaJunCnMZrC`@84@2TMUS?vnM@QWZ`Y3+N8OLxTcHkcfFEw|}rr*0sD(%rQc)8-dIRBeDOAJA%xJA_@I
zo?+pB%e{B{K$CpI%m)SW2C5G4MqbIXca)n4gzC`IsKM}Os4i6II(0O}9QUPdfIv+t
z=Dx}9_N1@-Lt;$IzDXLx^Xd27EUUA_0(5;HoU^-*Kn@ODW<>zWrL|X++NMoXwW^wh^>`R`i9GwP#}fvt3uZH_v1WWnWae6pW(HzK
zDHGGYEzBkj?>jF)_`j_k{uP$k==1)LL1}LCqACKgX<+5*iRmTY(U>
zPNDav7u(AQ0I{zVBqR2<$^hw*Wv?R5v$5L&whWScAH8(DP|DsRjlAt?0}7Blqz?E}i@O?N^-=Uax(-MLcr|{o
z`@zTq+F&A7NMEl<
zRC1KE0~^w;cm$Q7XrNSrG??Au^ay(I)!imYBNzMX0M6L}S45$7`yjLiX$JV9*%3GO
zp}JQ!YEQW!MW44A!_&P4^Gy|Q{IIK0YTo7si~z7_0xI*xq~}}dbSy*NKv!V}_BnM*
zMCdtZJ(i}YVoD*BwJR<0J!*HuC%*|&J(;~rp=xJWW|&K&*+yJas$#O=^Xu&JWnBI-4T2wbLHca
z@4XipEbxmj`}5c5JKy^9Ti^NO?|$?1Z+-Xk?|$#Ix6h}mB?xMuaex!uAAjxfi+;gZ
zf75UJ#lPxjzQOJve)8tJDk6pEO9vLg9w?18RICoR=Fi-KRd{qfiZWe&Ij)U;fAc
z*MIuYe)9JE+K+zY>G58Z`+7zr)l)k|8_o_O*+&?w9bPT1!73f%<=psmdOTeB?ur#v
zM+Z!IH>w@7=+40!l_^ZUM0gX4cR}4?#YDkRDJ`wBSDj!746H8eU+p7kwg%Y*;CXyZ
zBD$r!1a1PUVM4A2?kmmMV6jjv@!?vx5u6bf9O!|(iBSu0eXm%xi*6Lk4$J^JQW|o^
zi#qG(Qgr!(mqxv-s34eDMbaq+Kc@o{0b*&_J+jzX`EdKHJjTb@6{_O!G?`%|5x5k69yO-O&7V6s47I!O_-OSs45D-!A`66w&PR+P$
z?xgP-G02TxsTG-3r+atPwt?zKXQYl-!^YtX0>)a3^t40^GhR^s7rm|_2hy)te<+k%
zXHvv1)_lBaPC4+g|BmFQ{tWsBye}Ueqt#B=q-D~5WUg2lj95#Ki}kef@ra1Xe7t(~W}hGV`uerM
zG+!m8R_0K0cV{t;7TCRyCv8AFe(JQ)QZ;x*y*>!&d1p~8J%V6hkyyF6k1?H{eUyS{
z34tFC;cmZl(Q4e0Zb`3C(vDYcct!`qlPe&%hE6D=DKO79C@Am}jOs&lM!rNH!USwr
za|H_Ll&7Kt4Tqyv*Y&ob0zz7V27)cQxXf&Tpi?{er@{*cvjM|<$^~d$r_qD`*?keg
z;5t=jm-v3^Ow_kM@3SH!5*fYCIvR7CSt-;}TQi8VQOzGb_m4jzfECC_0S8z<8+aFZ
zh9_q{RZZlw2nQ)(SU{9*T8gI8&Xz?drirLN;9Be|opJ)cDgJ?w
zjFTjE3PVmAkrsK5S|frT!mYSCw7`cqeZA}oih)OdEK$%
zY)52pU`i`#6GMo-Y}`nk>%>Z+a#3}=>e}!;+n_KJ7evjVWYw`!Im2rC?kYK#BufhY
zZnVaWV=f^nq)IW)EuL^fk3tikZje2E>2~$?eCejGvAR{YCYkT8vA3>#FtS@x@;?I9
zncVglc~%hRE!6w;XTFhLRCP)fvK3;lELq9MSdDYki|Bdw-bL_SUWO)XNH(fpbhbv{
z%5r7F93tY-lJADX!gh6939rT4xBHg_Gf*uLV-J6&Gbd>ARQTt+4htn1!4sr}BsNia
zN6DoDW7V1HZne{#V^)YQhdnSTTy;+0|8PCx>G62)RYouqyYTs&{?_;2e&@Tdzw@0h
zzWc*3zxk~%KKbZ1FJ%91VC7BXk+=xr<`EXOKVRoc0T#GL|BGw9}%kl=iB&W!m640}h
zsLc4_;}K{0s~{0LXRB?~aiJ$)6Z7Hf0Vc6yx#|!bp|u2((dpb=1nB7{fE2H)>L&Kz
zfA<`p12ILv&OS~vbH7TWV=lnBv9;S%Q?=_XPpR<6(Pokq=uS??RCmV6*aXhdLDkZ=
z#o1yVv!{;LP2y3G?zy_FbG&9cWH`E#jMYF@=@xT`4_2S)>YYOBiXFB%MsWNNexLWt
z$5ghYhnI@>Qpd=&{tJORT}ee?=_vd1>h~Y<$N&3(_@DkGzx#jjFaO0q`@i{1-~Hw{
zzxrc8`s)1;N$zu1Z}e#>u`L?aRqL_33(W48W?B$w9(
zte!43%!IlFYzU9_pY0dWu60({ibUfcM(SPUHP>sUY$;4f%mbhlv28r$MYqxOaG@j&
z-b+xJqWSl3fH`VzxWH`NGwymosQmFPQzc;fd?buhq8go2eXA|2?wMgIw6Zlhrn`1~
z9lJ_0YmWiTS4JyvkBG=~)Q6-h^~@o}=yD{;EqC;NS%PHc%DoFA@y`iM1$+=QJ>8-T
z%_7sUuYv<{H0T%+N~=8SAn{-WCTRihdv=AYOZy?18h*hFK+zMMKI*_58Z
zF3H+r@3NW<+^3EB0d=``6AUa9;5mEmv(`hK;+)D{suy!*7tVgJM#i!%N8}irWN+J>
z6+*N32_>pm13Z2r!N~Jm@rZM2y~WwJ9)Uvb<^l_S`eZDyHX`xq8+`dee-sS#VqB*$
z;)#}~_&}hyt?n36h2>yd7XjiqF^)l__(1W#qWWCD7Hy@2OAr9HL5*Fhj>T(xh^~-O
z(z&S-Z9Yn^esyh4Ou0WKO|+`f?SA=SscCpl-Bcf_W-k`buHFuZv;w>^#jbk^Kvg^S
z9es=|&OsEb;L-yn)>L(Oh4B&PErrZ-H<8msWS~@rc30;kG)gCYMmmi-gv$l1Zr#34
zKW$uht$IgVrKAPw`k#~CI#)a~#0kz-d}O4IL2YUegdh<;-mpnBi0j(MXpXE_#)8!{
z+^t^Cja#O^!N%FjcWFf_y8UL)t|z*yU<0ZHjRp8}KUXZ`G=RNJb2Vz8XGo1L;*t+&|1LdY!WJ(VFx|y*#K6I%cdKAT9$;NZoqdT54QC6f$I7Z7J8nBG
zMAUT5#KleE);5e)v(Y=z~*rUHi@3-Q}5!86iY3
zGaiq}$3OaY^w+-ggCG3KfBFCT_x}2y{KNm~Z~EF-`GZg1tW4MHW#qI4_UXnv6&VA9
z#EXATVNIvN=Y|LQM&=bPX9@M~Xr@57IRc*d7i
z`y6mZohw$TG!-Y@vw3N&QFI*$;~s3Z8mC@lgQF9uTb-+>wj3%^H>`Ymi>85fe?4|k
z3|yyj+6RSV3H{@p_cEt9T=1IQ((N<+t-4|Bh;dW8?pk%0wG5n8hb3XUavr+n$uc!c
z!lZ>jrs>gclmRaL?_T}pmNA~*K~bt377-ic9R|r?DKyN%rS47tKR@ez7Ee*7U(3vsSp#v3J>S1Oa_su6{*G>8{IGD9rAq8Z-hJl1DQD
z*i;*7!Saax!qYW%39;EM1Vz~RP*!CUS<|nB8pdtQcz4@<;k1u1J{PhyOa2kYh$6J|
zl*0t&%O^9l2kF6q@}jzhBIBIS=&h;TnbLlMNJhgyn?}kBwsHw0Qx$z=0-+zJTa=1F
zT|qhobv;tKsJSwq^6Ay1>U{8C{JLN9`0$m7PXyn=*ycZXqe3!L#f{qmiDUIU^TB;}
zkG<-=zD7-uB$L+xt`HXp_u+ofg&$yLzfRS7yZ7RaM*ijGnz4AJp|Xb>yfiK
zAOaTM%K7RlEKY0E0aDl;5
ze}H{vGN5GGn8+WXZFD3}59SC_j-RksUJa!~)H|Y;vz3JBF3u54w`R(nS)UqK?9jr9TAsB)L
z(^{5bAs7xl@q#~=+UeW~1^f!0M){r~$mn*eKfw%7%p0~Ub+whl2qMU0BjbMQWYj6J
zugmIpO?6W18=2=QKgpLkN&OQSECSynNL6~)7l;iKTB?#J!e~(`u`F5Dt$hlvB*@eK
z05Xw_8@*Q4>2H7X{7C-tU;N=e_uu
zJUu^uS$JkFW*=B!77_G3c_SCPA#|SWMFS*@^WSumNQ2OIZ-4sGFoN%Xf!znq?u^9U
zj5@DaCszP{G@GG;=u;hhDH1ZGt0Fl37OFckWY6`%(zAHIz{2OYt|*D|N8AnoY3SJ7
zM8#F(@TsN$AuI&ETj;z?WQ}NS^J*9l-6aGKv^M(Gj#jo(ijp1r
zSiej{*BbN(x;O-4>9V`0SlvB5h>Xx)sB=_Gua%<}r^ZiCx8;L1Xhh#~JP89S0rH(z
zfOTgn-N%hc1+S6;L3JN@cSa~?U6^`R4>c@?Hq``*Knvre2<?&(eBQoylm`ZT(YVYAh)zL5;3ek`BLuxT9g^oUzkL7m{c26f$
z75N}ytqEAqHPfPlk&h=23|~*{v$yA0{n8JA>PIv*+19~#U-bPlc@r%RDFB1mmjo1+
ziIy;Jjh$@q3CeNR8LL&&Oh)5WboX_+^+h=#q#Di`FwQD1O7H9Vy!BP5qG~e#292o^
zAz&L@(A3-r_Hl&FwmpVjeYQVeH^jZ@^LN);IY^caNM&t;?#|QbA(qF(tYfv>)Ro{Z
z-5b~S9I2q}(zMlFso&mXgfRM;0sj!TAyu@~u#4n%Iq6IMz+5Ux=5=idtgBvYb$9K`
z30AShV0Sol*9z4W{QT;(sJTKUuEI_{=0?LmUC*`w>p~Sf3Xa}jGJ$n@Sus)S
zD@6QaUt93!IhvmY4qqCi!TKC$c=-rz*&lR#gx9S)RIwjuCETi?)%MhR)yAx)JWMgY
z&48SWI-NqHno7sW*w+z8n915L4dl6Ga7A}Z=iIJ-+IIwP_ZVWwvO^B13J@XloXud;
z5Y&aoBhFP0iP_qgkXhu|yaLo67UknbwULUNy8jrU6YZQj!{N-r)}QTe+v$y8G`gYW
z7d5MHkRnxc+?cC(ZKF;zW2HZj)|)DxI^A8v47<^ieA4vSpy54ukj!t|3-=u>6kGYK
zLB-)%!LCwJ+5*>D3xlzx~;_zx~CVH@gduwQ}XF_ntob@Z+vzIpq2Z{=I&di=ys{`k-S?6>~8|KXqiXa76D=i{%v
z|NZZO`B=$dUz+~qho=Iw20m6fi0*xzwUi=dtsImT9V+X!UyUQEh^kY9##-A@@dQv`
zps9>l%hS&zvG>8$k+U-3qi84*U#qkd!D$8E+HP%h*uG7NCpB=oN4%h3XUVQ?zlIDg
zOz7a3OTxTZu)OmXg^T$&C*cjn>7
zD;z7We;6Zvv*#r<&h8BA|CavyTwRNg#f|vn(`%pp%B%RvAAkB||IBayr~j$n_NV{M
z-}smQmA~*G|Bb)(_+WkT)%PDyPuKP3Id6$*X74MKb&L{CwMe6aZLz0QrvTNN-BNLi
zCS}#6MvW_~>Ud#iFcN2jZq6}TFbMsJed^SK#k$dBf2f(u(j(UGS)=WTUvm}CGH6Pq
z-Q9x=sf+N%%$DJimY}+i@R(m;<@%CSXu4Wz8zHA#>u%TQvutUTjk!f*u+ztB5xBeQ
zyI5#le@9ha!~%Ms6M>jBmsX+bQQK86Y{fUX*B5{>K+V<`!drehM=P^|?xXFv&k>ri
zM=e-Kr_DHwtg>mRcR1?lsCQrPoyOo%<2zTs-7gb6ji*9ovQja1tCED~m?ehyoD*z>
zxNR6qD0_EB@|4K55EH9QgD6I5|3~oDxzX#J6vEINwCYfyTJOMMAQ=i~4|E`VwAKx)
zQ}FUr23mj@3M}5@pu;vLT3;&WfH8-MFKCj1M09nr85xM^(^W_Kv?*rXj-7!a$ug#^
zg;Htxy5h4>qXTKD2rY3A8RzDYXJ}~5cL*!`oRhI8z7IF}1Pm3_oomg-iQ8hN$D8ZXXVgbv1}N|Aps=bl
z8Cj?K$T}6d7y)6J(A^wlif>v^Poi5RBQoV@0ER5%3jG>h
zm*Xw>sU{5%W`awXrL%$VeJUcDJlp0GCcAkYi3G=B!luDn$^w89f~B+obVoAz{Pt?H
z*%6TuP3+n#Lb{cEr~i)tcAXZ|rU6v!ZWbydu4_j)N3^QWG3sd0T2_twY>YU&
z);B!er&KP0RR0WMWom4uv^u$*e;_TKp%Fz)ul_k;W+4KfU%1}GD^fayLmXh#RX&|-
zuGQ9d3sfN%l|GbCV32DOTgvGhgOttA3JAk2PwW;!4R${m2PF=6
z4klMSMjtR8iysNJ6LTpiz1Ji5RTB>`JF(NwRT=BEQ5ampwRJj0$6GGp2XARJi6#(|u^@_-NTI=a)
zJv}iJ&l_*w)^~q+eeZ{#ee;{2eDh~N`}TJ~`}B*qZ{L;%Ha{Ngy;mQ6^`pn*v06bR
z-TTz@^RuQ{p_>ucb!_nnzJ0r^4%uMrb1)@%5DG=lm0KuLhH7y<<3g>+IXi#+$A0|p
z{(t|@KmW)7oqzU^{k~UE>-oA83o5iG@g-;7w$V)tSINEi%3Le=IbE%QfOZqtRb7+c
zp=Tp8fkoFf(y+GD?S|hOsMFU~+AL?+TB%&CyF9#ms-dy{LwqWWQ6kW2Dt^q$b2&{S
zspCr9r>meDNMp6=`zv#bC5r`Q;Pe)DP35JGLHBHqZ3E)cP0~txF*QV^uPxgF+##$*M;3>tA`W`uX6KFY2oO-pa3kod5Oz%5V51
z|J1Ml*Z$0Z{4f5Cf9`MmU;eN8etr0j_g}sD(ev9c(cmI@vb#yyks?f{JDCO{a9suqEee)`_1#X+a3ae>+_RK&9vE*QnA{Fm^nj_y)
zDDOh66JpD~X3|HuE~%;tK{-~PO6n$1U{1U_zz6)(io|qY;X@I_2XVR(-*!F10_n_V
z8+jwK!GbQ#mp)EM|3K3+!N_H$%m~%|tTxh-k;g|C^QKuL
zqfgaVGHBb;Euhm1g%)Ihh}?VY+Xq9y|B}vS*HI)fmArBsH=K62F2QxuN5z!nX+Y~V
zI&K9oSjyfTkCrQa5JVl#+p$>)XlJrz3jWf>yG&HIv~4T1%LG=L-S+5alUjq;wcmP=
z1Wg$Lea?wYkqS&U&_`G6ixd;~A~@tq$0a8Xe1zKK*)dQEFq{uLGW75u>gr-e!@npQ
zaZkL|3DSj5rrLu5;DB`+P$`xsgESL?I)_kDfsjs5+7S#nI%Evpy-JcxO9Z=SFns4RA!u2M{EqcRyCdtdAE5UJ7*#}SV~T3?JtYc`K4(p>B8qZ!$A
z$KjmPAdu_%IoG2d@8RW}VOiR7Z^1sD>v49)T7uysqEF`{kwTQv$fu`nW&|Tnbv}h*
zj-Uo0=gLN}74N^FpT9Xj@ni4*`d_l1h+Q`xabKyH)3i4vy6Q&3w=*i7hd$TR%LA-fb024$BvHYXCrO<+WC0wOX;RAbsl8j&8KpU+Jx
zYvM>O$J0@<`V9qORy7Xr0D=A7uihuX*U$L8@G2#KU<974--{WC)20KcyI*RNt-%R6
z3c<8xCA7RxHOS>jhTa%#wLLn#8o=X8aR9B$T10m+b{*ZRBv%Hi$(DAV)(|5jT1mFe
zuGX>y7!mtAxgs;J=cAQNjIF>uJtyI2TxrMNKXrCaVIi*PBJp^*Em7g9u?lKz!hkp#
ztQk4eHuOddTM}_$E43(nG3ZU=90Zx!wL8|BU5hFL${(yw+20E=R~#j{t*C=c>}~kN
z&bq4S=Z@tt(u|Qq)v&T`;RRKVAz=4)6kZLrua_8ghn$MB2XXdUD@DU*#@U4;Wdp{P
z!q!QGjPBN+5+3J!E2v?DdI4qGtb${@tJb>|5XY>^tB6?2}KweDmh)>MlGY^Rd4A
z(Kpt|88fYSd+#_Kxbf6jG=62|p>%q0?9wAZ!O9PWL(k;&)1RdJoSb0z>n}739{TqMnkNn}^{OxbOMQvuXxVsE;oly`-
zJKCDQXnp*dV68Ue)}!}>V2Jj-RI41T8!)V(f98eM*7qtveoT529poVVeXl&ZQSR%t
z94afI%BBW;+{(>0vX7PkL}t%1Ir=`u6@vhbGBw$%LFQc&uQfcE=Lv
z-e=cZk%2&;>aKkM!B;=>^!m&G^7Z-b%YGf_?XLHq@c#SpNB)Ul`A`01Kl5+=oBy9b
z`M>XM_)9PbuSYZn7
z>oR_70Ia*EcFxQ?o589VL&Vw5NO{_MBQzqn>K^i(d`&IV{Q+Htt
zr6SQgG{{tRLsyhLAa}5?bth*bmb
z@Fp4EfIhX+AVcx4RkgbmRe7q{%}&mTSkfWD#Y~f-{Pe4E87aGe$%iS1xW&Rx
zVcjwxp#8PFo0b93N-*83juk`0Nw3vqn{qPs(B5rs%OO?O
zh0L6FI}UI3?t@aDw=x#VDk;Epqz2>VL6Hob#`JR%8o>$!avEk$uo)VZq(W1&Pn8{t
z*ale|E0Vd-24oQRGN}Tv*VEe9$qa>|M?|qB^PEnC!M%^x66O=O=90~7a}TIb*cB@^
z$W%f>*y&DDmy%5~LjIz)5}I}||7t`t>TG5*nX$->BvVG(R6&zVA&&
z%Iod<4L|+rC%!TcY`&oFwV)L>KFJUzz)qF27iT#y)+@;$VV0QAl>M6h9DAv!w(Q9Y+gV
zk*>x`3bd+EBl)YY}0kJi8Lcp}a@xw3YR!CUlSu+@v)
zvIXJuh=_eom`#f7>{Invk7}H=nWOaAKsMk=e?=l#SGg+HVQd!5scx|1sGD`|;tDQZ
z2F=APMB};f$;Q`{NhEQ3I;-D^fMy|y8OlfP^@zPonW*~IGwh&aJ+i9qaqvCbT8jmW
z5_4oa$u?KEP6L$;Rp?%i75BjUu>GkVwdKx+BiI>Wjx!H-P|V@O8m5X#W)dxTHy~T`
zE`Q%qis}tYY70$no{pVxr&rav9L**2N+7j$__lbFnCxFbv>W{*grjP@X=Bo8bH#O4
zMvOEkjAI5R0SJf?rhuwQvWD;^ReDtes!vCTsLovngUpj7($r@#xPN=ctj6cm`tvk&h%|%I+1*Fad8kSP
zh>@!V*&eBG1)OE7@HGfM@SPctwT@=v1@G!YYfQFxp~CJFN
z^~k5Ee0uuo`|puC$x_vY+Na(=KR>^{8bI?HvceG-)u^{y7xLS;&w_qzTWFuzdb~3a
zrZgN!;{APH2(bH-};~a<-g#^>os51A)
zW#H!DBP5hF3~3|XECqn|hzKg$hf0y0-VehMPn&w1SA*(oud^PD-upLC&Z*5ja56Bx
zMB(h_deOD$RKK^?S3iueeH3rs_NQO$FQ4npbA9>D$I1^sTz~k#@KgWTKl?n1xzcd%-{$?voG=OHwN(AITL3G>hr@jkv-eukr2FW!!`L)!z
zN>Z(fJ{a!#mr{{QKA0(xp3{C`E!MA>a
zq+c#^W6j>{{w18$u1T34(x`oCTxUz0Ng!i!;*eDN8_*&?h4HsYcyhkYAwA
zGwAh(B&Li|V64S_KxXc1ul4Be8~Kxu(J0`tY)=Dh+h6)brldx?tvPAzb{s>usa#Dj
z`u<$m+vy%8_ulL2sb?r_t0C!Hj|Z76p2+ArkxvmzToVzw9+^oXa;?W=Fv$0w9Zhj#psrKh&U~M0PR)E3#AM2tkHS6`Nd~XCJJOFm|LgJ)NF_jb8l2dEPGtpjWC
z6JdpzPW-AybVQ4aJd$P*`+3J&s@Q~ZVWLGvL)F<0Mx-vST-o5+Cm#vmdfxfSb51wc
zBfENE6;Dx(>$ww%2Y&bl&ksCt;A!%?dIc#h!$6;2!-Gk;x_MH*)%`Sf@|z<)#89Q#x`KEP~1D@n`yx6hrz3NP
zmI5Bb-5h#Tc1oo^*O39$mg!XK;O2(*;@S+{T^`Bq{c#|Tn-I^lo5@^3;d@ur6g2Z-
zsR9Cx>vCqVfPW=3I|0ZhRXDknx)v?)Q=Bq^>pJ=%IlkY>2+#kvNX@>eBnszhPIx&T
z!D2V>Ifd;^gzKub^0?I)SCz_a4gBctON_A?AI-)Xf2?9-`nGy*fyk(8sYR;VB60T<
zz_b<;0_gd+*5Qn?ZAB7x)agtTkat(>^QL|L+$i;X<7?w?Fz{`km7K;9xx*o-deB&S5q7s=M0Owdw*hx@*e)Zs2Usu~ezsGyDhk
zyN)q(^5k@(bYNNYU)>bOEzzIEUtPVogZBiAHSqL!2!|TgD^2#QjUVRCUM@mTv2$9Q
z0!U^ov$Q^*+YLwt2v`$JE8&b2rMtTsZ0oo$$l=wEBNWxjyHQ80|D^s)8O0k(DG4&9
zoAU>r^pH^hyaG|Z3o5Gx!=2KXuLf{3!?B%$k}=|%pg1TAH6v2WseEJ)ek{jizcXG~
zt=;Jcv9G-z3*+Y4yB?3#-8~ZutLk~5wSoL;1xf3
zwccL!!_V>h!g-6&-keADS3iv3|9gJPfA)9%(SQ5T{UiVUzwodBwZHtA-~Y-7AOGmb
zk5{ku_1t}OMWgrg4hA1x`$Vp?Tm=0h0jkMy$X4Vs6}F_~t=pqUAbbs~<^AkU$%GvcztBtnn!TJ_@?Ub(N#?VO&9#HhN`d6}xw4
z0(^SBG6DsCqUEPR^l5pN)u}f`tW~hBXo;|_;bq2Yyqf)8_Y=9GP9S!L4-o)Vx=Cbh;@3W4fOIpG&?b4avE!yTqfyxX(Y_H>6nEcgD!gxpzc+JZm_%8dXQ{qEgT?XWj9ZC
zt|WRr9<{fsH#?jKsk$z~uuB|{4$|xqfdS9ko@yFvB|+q4RYUqQi&%hQu6Q6)k5*bx
zHuGt%wU`;n$XriLLkrhqy?XWZ^ug2je%Qa|SAY0Z-&kYGG_>#Cgh62j_|Rgb;&y~u
zgw*Mnwm;O}b@$~OC34A0K=V=56eTh>Z%#qNtv8@EqNf$h71gM#NUTTp>FbA($)ijkB5R)
zy}7#`V5@IxS~0kfBG9Oe%C6q3&JpX$X(e>#!ZZNg)%D2KhW5j*uBu$3>gg>qGE|={
zGsBbP7nRGgL;xg?cwvx5
zoIZ6`M6MMG)E*R=R5`6(seb+icBhyBY)fA==Ts(JkuQ$cvy#}d+sS~bcNVa(iP5aW
zSdCw?lS_pxoQ4$P3O=~=?J@LhkOFywUAR$U&S`L~Pnk2;lH)v{Kz@H8TGXeGx+gmW
z1`naEmQr3O2qMYH)8pwWV{s+-h1YNDJKul){`bE8-giI$?hjsn_Xl5o`q}mNc`JnW
zX{}dJPal5pVNfS3Pxtfle)INO(CKw;zT_CS>f^olb?vSaC|_OI+jF)jl)ioY3}8JT
z`#QUJbtf$xZFF#nyLP0ewK`h=~
zb*|%LvQZ>)zpjfB3YtqF_|2q-_pC=sTdQT}J(JFW^KrgXV?lDIcK$gV_h?OveX2Bg
zPwc&D6Y7kGaw{W3Q@->Uq1K{1HE#+x9nms5X{5HkXpmO(Ni!%FkB-5dirnoza|wa7
zTM_6}C!BYPb96MqD%;Y1MG}!w#NIoX(jw90<5HEOA6Q!%i_pd868-K*U^YyQPH1c)
z`V_|DmHV6(<_Vo<0tN4zKaG?nc%UlkzU#;0(oG>Ci+DcxY$RGcDzS;eQ
z&+5y!czx>2Hzxxhy#M(9zwej*uHXIN`U`*Y5B-n-#Gm;O|GodyhhKaDYd`w+$k_Wj
zbtwZ3kWW=|Edpqlc#ojqQuLw?~|QDOHKVAs+%1K
zYv8^kX1p9!Z9+H2oi*#w@}poZRG~7LSU|H@MlWHP7+rnwmiB&s+&DQEF@I{$2nWBLNO{;p89q6wuFX+ut|%@V&(}-M*BqMX3Rxg3+Z)JjyW~A4=(>(pjggYrst_6lX+3b;IvLSb`|KXZU8s358_K1u$czvRZG^4w=MYDDVGqNDHncZ1DZTNes6xKC$F04yj+9bWINBj>C-%KJ8<*{3rR
z&2w~WB#gv)L83cXu=<=*)iCgPPg;yde~E}Qt_&bEf_=6%Isi1iiE)p`L(s6DieOl;
zWkS#7Mn+wB<15??Ls4q^Y3hcaL08v)2mX=FHLQp4L8i|h?-U7QYe*&mx%#_F?0rNi
zVUA;U%#K=}8
z7aosXk9_r%PY*V53ZH&a-~IO6Z+-i-?|k?3?|$#~C!apQdE;2a^~gxR|NaLben>8&
zh{maNs&>`h=bT+&oj#|o=UsN5cAbiqRfT4WedzASzMerev7b+5vhjQ!pwT?_T&MOq
zk=excd@;%9o9k_^wfEWQ;O()S#A6gfY?TSRWQJ>(JKIY%X`<(Cm{o>TL090Z^l7E0ABJN3je
z5jf}W(|A#>wJ7qJmmrQNljN;cdLdP`#_NW?s|KL#UIUz$X9E=fg3W>%GD
z2qEE8$CyV34HtfEJZd
z#wm0z`O=q~S0AX2Q{HXs+;T{o>Y2{M6vy4@wv9_JU$xd$Tncq4_r{h$
zx=<1U=gVkR-eM@a&7-L1Cko&MFF}(m
z+Z8Sb$k3PSqtQYTqn0<8s)HqBBsXR?>+YE3m1tjNiXL(^y2yyoBris!v|H>D|Ld}c
zp6Msig$v7j;{vDUxV6UAg)c(|Xv1TO;r?$xVl$K4L9M@|KQQlA*7I&d(XLbPBcMIE
zy-g|5fx!Mff%Mk9F^ispK)>0ahY19z;jTd^5X*^E)vUR4#ekLiPx^RbH}CW*v<4MO
z1oF=B0J;5O0)>1#
zW&({!2BT2Jze%(pPp;2UQw@5E)tPY$ILMWlIULnZMRv^x%_LeWaNSiAsr)zLrZJf!
z5ezXmW)>vA4vH$9nZ@eeccrnP2+qSN~W-dI#J`*W9x@8U}#Yw_dBy!3*>NV02T0dzD@*T@#4C
zVPs8z$FsRcPvu|b^}$5-tRE?!$C
zb9gx!M0I}e=-e#9P@9Vh7Mg=iF~SWwKNO)}PZ^k1Hl64|@SOOfP69hXvoI
zJhM!VX3dPdY`j6-jZ#IUu9cyyQ_=S(Q6g~b#P&XnW?N7#JuQ5?qKHx_45c8nlALR+
z*OgpS+CqP3oy>jul$#1pVZV2U3QA}_r2flscIKyW(lg%g=?2+
za9W!~3`|1>@WUTQ^?h(+&td5=Wm6wp;PGfgNRxlg5w?HrgZ4!diN|BT|K57FNaDHq
z#oPYjr~A8q=kxD=@AVIU@Wl^5`SORKK3}`KYDGlEdU|~L(Fz8d9bKpQuIKBjOM9fx
z-t94CLKBYWj_y5!F#y7mQF_I$`pO6U=+AdmGXccDb^wlA?5eUxOtDPQ&u??B=vC;t
z_T%Z%&AqpJl51a&r>FgV(b+?7j_?>#R5QYeIy*D|_TTx=Z~x6db(dF|5NhQwh)fE%
z{q(6KV#Ep^i{JXDR^;!1$8NavE2_lXyOh`{IXZw`x%bY@%-DUj>Oz?q8SQym(5lu7
z*K$4QF17pp1WIGKnZAK*T&f`WDC%aM>_tTzBDP~uCJuOfbx(Kjby(q9<6$#8X
z;r^Ue$UsEY)(3+NC;c6a|LayIe}0kx+-&WSfOfUsB%g63fB1HUp)x+
zo442p&!<=R(_#`Iy@yv%>&xf<;b-;vYkdA(Z+>{apZ)R2k3aBxe(E3ohyJ_&=D+o~
z{=}dBxBkXo{|}!&c=ho&zW(0(AHIG2`kc4qqlwz5+3cvQK+&0S9zw3CaY~rJntQpZ
zq#cy|)#eo5118;GcwyPeX|OdVbDP@9ZH`gJ67@GqTK{`s_&}K4yMBWHf
z-r$?iS!N
znqoy*g~}bSq#nAjBCQ?iI_yhn+QM2@3{R~UiPB{cuojR|H&a<*zoJS?S#&VI2oXEo
z)zy-lqPZf^y|Oi#hEn~{%n6vey)7=W79eG*r?IVEU9GvI{x(7jBDzqlTn~Vi2T=BRMhEHEg8waq|3+I9l?Cyi)U$rxmdEiU)`^SFYuiJ{Lzu_)1mS5?VCgV
z8Gx`+8SUasrb-0{qPyi6y|aHX(cM)N*+4vo&ZJBYXm%LyRCK;LyU~Xes-=^1xbDpL}sNPrWdXCW{>kJA?1dEi)-De!NTYZzi1V?KGoTM0K+)^#yq+*CHg<&{`
zB9TIjrGQw2fZZMgPhg*F#N&zCVRe9bwUXjjb~UR^PE|gIZv&moq}fQcG6jQ-r!?Ey
zPN-665)!bem#)U>X>pIGH8y05wVP&*+7aL4uQDggw;PRJW%QQzbVyvUK5zW+i~XPc?Deg0zy8^8efF*IeD=dnUq8P+f{xe9r>FJm>Aer$
z&ju{H7Y{s#CjL6`{k8aUG!7TKn1^%*f|AZ^N0%$jrKG4;-KYp^OhD5M-DY4Uf
zB!xaUq(mQ4T$Q|99$1htR6q&uq<-tv;TM+oV63Ghuyj
zwT|(T!s?rjt?@V@r;1gAdV7Uqf6lIJ@x2AIud4{Y1>XYCkIuj&v4ZbEB0uK)AK;VE
z_~l!^uHK*2Q}8Qaef;Bp=-2+i-}|fo?Z5E1|HS|N&;Lh%<==n*aMe|h}F?`Z7m`2pyj8c?mSgo^BvtlhNY36ZusY_q(IO6595}qF$jbRRnBft@{Tq-;5TsZBupmR#93ixP-7Y<{bKbwHKEf}Rke+H>Kct4H59;kgmCrLqpH{a
zlZ)zc)yPYzb+4;xx!M(}HN6j51M$?$Ij;4k%0iv9(;P6qUGLw>a^z6Qw39U)vDXS&
zwS#ds5ayWM^Sx1}skxyVRa!Mc3NvT;q-j4x10$5{HRPI}mME`|OqbX$v;8zB{_Tbg
z(3mzMHNvsmNh31ZhqToeMt4`_guhXh47{4^ZeWH$%y^ain5WGKFUqB`m!rDQHcsiq
zLArS%PMy%14%Z|N+im?_L)Pk+>sw=gNeHNoB+%!bah-HAYn+1&C5fNi(D8lq|9+C7
zcB3QBN(ogBC@@27S|TMyGi5A)Oc`u|T%v{&>ey*8HP=IrWbcZF$kl3$fE$Af4=?Ey
zonc>|RD2-QBzz4H88pRi=W2*WW`y#V7|dL91Y~4p#L8T;9=S3z^YQBO>b>>lu3z#K
z@BhZ1TnX%vIqID8)@u>;2J;wTMZ^nGa>_R@)5>j{UDvISp#jxhOh4IUkPr;v@?Pwa
zlgt&Nlu4q6xwsSvTMaWpGog%}daMS6Jo^BhYqbq#T6LlIX2HcaO06Qh@iJypOv+Jy
zHR0Df*CpUV2)nDhpU;upIx|JuM`4z(M~?={jD4N%UMm}@I&y{U)f3`WIwOy=WgReX
zMlo6s(1Fqz^=v?{n`S(G>S%0UfWhat&r08oh(d!sE%dn<)#U3)1K4Xa7AbrqkcN#;n{=tL_+BdbU>?aSqUE8rUw9+(Gd|u
z_pa`lI!0eSi0C^j$h!N+xc6J_R*f80Gb**7_vM6J&H(X&NnNf{H_s3kn2VJZdD{a~
zbvMeiQmA@YSLOS(ntgKx915`O058LMTgR0UYkQtE65WO8xAk}m%bB{nJHjJ>prMXH
zu`}ab6>+B@5un5wt9IRYk5;c?Z$dw&(?Jpw;V!*QK^pmp
zz10fdo+1PE19XVS=c%(IT(a=z+!8c#AiDeH7$($?GDkDD0=wD`tu8rjWw+lEB~80h
zP8pNG=siiavkCX{t*TVE^;l0&>(vSbuY=dG>wDjQ{@xG1{PuUh`0n?=`2P35{PeT8
zZ=MSsE8^)X*W=Y!KFXyT4=rz7SMBGwg82GW?`xl3s->>y%e=P-MCmAQ0JSeo+7Jd!
z#&OD4NXP4zyBlB`_$UTXv97(Aa^Ok?=G^M6R&d?vl1x3SEvJqgwLJg@Vw0ziaJrC{
zmCeL>bSxZY8MOlW*%xoBhg$LcPdGV7caRj<6I227iNUcy#IWKdGTp;qJU+&H1Sqdm
zi{-x?^rb{nV^sUyw6z1dt$DVyYG7;dni0}4
z3ra96q}Xlu!@{&&vgjRFBLf+@L_dH}4}ST&Be9=*rIR8uk*vpJ2EXzO??2+r=4YSP
z>o?fN^Lc&A`r23HpZL%J)PL?D`EUHWf9DVUPyWQ8`D_2dzxS1ozxtIQ{l?=}Kfn3%
z^ai3)I49StIXm=-_t_c`akl0R0e#waZ<8|Y%y#B2^t~7ZlU~jTI1>^c?
zP{T+ynzwZw66l%VrAAk6YfK%7k$iYrYkx}3>sGsq-BnR_FwE-RwL-xRFQ~Sv4tOuX
z@<_j91+Gpk!7*_sibIUQ`j`RN)P&R77(T3FZI#m?A(qqfdqvo*Y3X1bGnqx=m7(y>L#~{OS%iHRLTHk-4ueuAa={Rjj}DS;DS9
zL=2tYbqt;7)txKNuSVutD_1ZhVm+;=r_7AkZ}1QP
ziub?qA+>PuA`zL5-h*bzqZq-!wNGXQnVF$BHA0YiyR_>boH!!LK7-%YaeCIVV6XS?
zSY(^X(t=cIa3rs*h>ql`s+s(O(8LRoy+tL-ft(I19ZjWB16Bf;gkjy+aZcO0
znqj*a>4a5=!rG$A=zFM|qmR`T&7I>>B6P`!y;Wprtfjn#09bW0>Dd^#lPxJ6L=E&T
zQlU|HGt{)Bkc{7u>P(y9RAKsyg_$r3M(qDTSAQC->$atbLC+XtzTaBAIo&BjieiUECWu592_gc15WtWKgn=~3hL9M?iiJaDJ2rN(V-W{S
zF-;_t5P~8a35kG26en?&U9Nji-|W4bZ_Y6uemrBoYnxNeJ@=fw*Z#h@8FP%M8!O$-
zWOP@XsO8}#Pi1LQZiS7cKJ8oAFU#t_R-V#2x72_vthpiBWDIvh&Wgje+)W2-Q=Ky9
zx^uJH`G#<-p0p<$j51U)6L2hf4%>jB_h{dORK%{c7Y5^`l1fW-J9N~xP!m&$+}b=z
zQ&-eIAY~0DLMXnZ!hJmVRKT{jN*W|4&D_m6uPa8#i#DRKKX&Y@*63I;XG&*cUB<6Ts_8MGj5C2u1bBV-TmGj}6
zN{=9F6&-HAa>bLa@X8WTDD+zU5vZNL
zCicABZ;5qWdC#1S+Cb*asxhL8o!t$yXs-TMFwn-is-9>gh!tsOJ~K5{8cxSr
z4|Hr|wlw^-N4xjIh_llF=)Gh1kcLi1Qt~2q<^?($0L3gwf>=BJTm`&k?H&Bvj=26_
zP*0L=E6Oc1C*jR1cdO|xkwqq5e_x7-Y5@8K@K~K+ibjsyJZhy5X4?s2qRo5h8muyj
zt!pss-3nW6N19@^v(M%2EYl59Ja}K_U3qFlZ??Zk8zW^|sVbQuGE4iwT5l*|@ku-)
za{J6W*2m~$x~j~|I%4gVfHrHH3nLnw9f7$pS3Mi??AE^cB6TgY=xIKz3ezx)!+8ul
z+>VPqdoS*;{OT3vA{?*o*5jkSd~y7q-~E%n>v#UQ{=#4S|Nh}W@-P2;|L*_$Ti^ZQ
z`P=Vi&g=D|a#3R%A?{6ITQa~b_!w-*fm^Tk1?keBzHyXL(`5gX9b#|Iko6018k>Y^
zG=c8`l4V+iuG$C-3o~RJ?2Xd2YIw{QZHMd)QnhW*)fTBHJ!PluiKCn1rZXX7a3y-m
zWcSS8vs4FY8@9~BH(cAHOnPj%ck>7zWmd16*P+(3Adoa7%Qj%aCy;0>ZCSP0CLMC0
ztuzD8dQ+x^QW7478Cji!U?zS=uaBcxkt`aI7`4YQ0ZdzZ+kM1-&~1>V1%)S&;C+lq
z`m@slC3UPG6nyXR3O7lXC4K4lQ$-%AQgv?fMKs8!O?9_)XJj0b$HI3+Qcu&^w1e_|
zNm^l{@gFyb1=Xb)L@M@I-4leBqIWd(_X)0S6ZKfVNzzVD=~Hg4nGwASw&xPrR>4)P
zCGuwM2fceWHw$;<6KqB>HVi`=Q9eRLX^TmO(zI=<<$VsYl^z1RyfhzHZS-*4uX}$F
z4ceaP01;5AdBalXD{Blh2yfew#UN8s9Jh`hsjW^?{K3doBciHejI8S2!7S_j#y|s~
zATY)NZLL+*yy~Q=W*2R)_p>EKpoe$CfG|rFZ_1w4m0D-r^@{x<3>JzS(97x`5%BO4
z!V4`T!pDdh5yQq2BgXB`C0XykbNRJD?#}|N_sWPO+VIMGw|8@&MJCN~ovEf!ziQ1k
z2I=8j)wxO@p2>}oX>v4W42dc+*G3$kfQg&H+6JU!I4kw@eVEjYy2e$=Ih(`;ch@UZ
zz4|Lu(G=lOW#&6_uy2tR9TggoHvTOt8p2<$%cDi
z(7Ec!RSpNamW=S7Ix7<$J2~9xXcn|upF=`hf5lpeeOKRLd+&~Q_iyuh6^x=E*45tH
zqm72iPH0RDg~4JuOhv!2*2#6--NFNTYq%J$Kp7U1#@Hx^g&Id|>F>5Ln6*P(()~`v
z9a4?LP9bR64sS5s8O<=wANJ^oTp99Xi;-}{A`@dcPox+U{qz&dsQeNUC&`a6>k$qlT}~Y;!GNm7P_LR3^iH46kOAoptibTY6KP5E*W#HYb<#
z3ypzO%WnwHhvV>E^34hq=<2E=5Y|2p?S#xMGgPX@bU2h0t=s{UO5*9$Jhm~RO(#Gj
zh7v^d@l?ea#sU|^Lz6&XC?JyroTbuSrHoBuvIHTB{a{&GjJQ3t?9|7wO58p2lP|8H
ze)`p?pT7F+^SjT#ynprTdYzus#f;0idF$mfA3h>VnTWdOpd~<$*Q-ve@X%(hYR{FCSZnFEW#Kxf*%L(Bcn)Rs^y_tEQ|@eO
zbnSJ39a`~l|KQ`OOiJuc=mZ3FlbI!@Nmhl+JlxdiTIrHYwSF-{A*X4>41Ao|XU}fy
zsi>>#l;{z;Du$W8DG=y?ek#S>U1%eoY!}>xw5@^MhjgwIm}^f3cOUQ#vTOK<8T9z+
zSa~v4wNXxTnms7GRc4`r9_AS>H0!p|A;1o;g#~*b=C)jCvKYRXiT^}DG@0s)nz`;z@
zgwjF`mdrzn7SlGP&NR|>*i_;9*fx*ZZL^<4gA2qoEhM9*l3BO`KV`VMiEFGX<-dt6
zHH-3og*~iTmTvAUmEm
zyxU3dszGpCHC#@iSNa7Q-fm4DcN&}7QLLrZ45;VkPF@|Y9@8+orbJvtSV(*k2tH^fjH
z0Cs~YRA#urvXWhR^oXaH5j4SWCn?|fqCT4xYwVm}Y%xH4>&NaPgz+>k>JF431~i10
zWb1_@dhGAjwR_fz2p#$1A-K0`Hx}veHoLdKPlpHD300t(_NM4mmaf0#oD@Q)PpOx)
zcFCmF_O(M%SoG+ZCqmu4PF4*zzTscOI;Vk@&P}AK8OMm>9_}&xi&y!xKXdu9x4c-%
zEgjGmRIB?0ap_TKLo8cJuI=zlDqo7dy{+{0!n{^(e{|zJox->{j(~B^bTg(c)Yf^R
zU=51Ve1K*isH&RnAKO<<3-l-wMj+9+jJ2|qgWAw=b68oa$6Q-FNLFRjT&hc3pv;1-
zTQG#Sy)o5lXJ%z}(hc9^MU{8~PXf$y^C0MEJ_mLZ)2RyH4G(7-4bn
zns}9X+Yt?J+AQ9<1+WE{+cRTNYTn$N3FY6At}r%&09eO0HL}{Yp%hKlMYRXU2q@>H
zYEOe?Eqb(~%fiED!64XMD~+C$?iPAfYPXNoEt;ll**i(YlWOD1mD03g>W>iokF{XN
z7$@ClYtedIJ|9k%f==|UtRc6#N|R!K3Ym4iuF)^1My%Ej=q%Tm+JG`pOWNJ7msXg3
zmU#P!I1c-p5MMmGM7n_Q|0X!O7dARt;336kL	(c_qzSbluiIl2wWx*NCgaqiVTk
zjp1X2))!lc{mM_?P-gbhj=$+}sdH9Fn`V3P-ok#6l^GU-v1*k}*Ddm=TFeeV<0>?%
zv$s7z4HsTT(@}%HMbjXWiMQvC8>N!)n5_)&Py7^1QA_ZcrPO3@ZoS&NBU`d28*(g`
zn??A|?TGL(M0D9IJUsH7*XxTP+(9S<`0~s9FTZ-Ye^^xv^JDn9jAt*Ny>MkO
z3t1qD>*Kty2TcoWbkmKpRcqCndAYe1u(F2PFz;HL>0#SS
z4H(x-wI{tkS27UjqLmM?-a;&_P}(dMf!wQE+4O~;!MgIk^(pXtn#{~>L}b;P
zB^9Nt{&r^9kl76OnR?Bx?eb%4@YuK%`>jy_AaA)>D$$|kFg>fNO?MmC3r?Dd)xu{p
z03CoYkE>=3ZJsX@*~b={v$W4%u#Qfg7|yCnj^Qj@D=!xp$fX{?GNqi)Qam!Zm{rLR
z(t9^EHicmUG^?y=RiafD6CUP{Fv}`}5||k9JDM9zyNof%VzR+_{|0PcLm5=XnC#U;+$1!V^}TBMg};B-3+@KcV+?BDoPf97BP^soJmkACb&Zl67$kN0b$
zO8WUD=Q3*3vB6u7DmYx
z1(%x>y@i4OerkrY;?t%8V=J7AGWdz=%4#n8vbweKp_pB_$XrHbEio|$W@+b^MaYV&
zFO%0f&lxa^Mr1d$}NO$nBm+v*7MV;Gm(g&U7++#^|Q2%7~C|@
zUc=Synd)W1?Q~XWS(V}LKB_VyA#uA#o!-G&P$6x;!nU2Plf5&G3?DLI>D!sv7$Y+?
zC$%~if=px|q648PUWA8eN)Hk-!putpn3na)K-KOh;X36J+})=hm9Vi(=jLo%_hkUb
zaX`{+aq9$8ZXJ@QA%v=WILb`vP34dhGENk0hAD9
zkRAX;DNFifFeD0liTM~&t61eD%t&KaDT>AenVhp?*l`*2TA51)*d2hcJvIp=H0w(d
z9yUxe^l^+ib5)A5iQ$!k>S$&(uL6zcjzUuXna#E2j2aQ0y#x&dY)nKazijz^)4M+e
zl!?faPOMs`-&tY`n)>hs=^(5XgV|hbi*@&Mi~iG$X08E%
zfNc|UqT_0+Se3dS+XK~RS`i@X_$3Eeiyke+@^CX`VkjT@#PX|P%D$pWytnqU?l&AX
z+%7p9H`G<)OIrvsx-z?AW^LT0HTmjC!_Bm4$1sLxLIv{lS2xz}I}w_Fl6AaY?Eq~U
za-V#xl_j>vs^Ku}!r6+u_Cd^ky4-DyxZI4(rJ3i4Ykl?2^|Q|&KL7mwt8X4Y`||#a
zFCSmM&TJRJxE*#}j(6XF)*CTpn^-m1VqvaaYbkEGDwCB{QHw+Kbg`)QMck4=bt#)LV*gcDj1k`W(r(z?ALg~z{E46Z
z?wr?CWMaJ##3IZaE@)eQgD>t<`l)K{D)ID(?h>?xyJ$JC8o4eyBtq|GnHs;43f5pjImHrL%U${>w=n4r%
zf_Qp!4_9YGV2ojgQnU`yME!2Dw!KlHl*&AZ5~rAODErv^;P4nv?)U2S3c8#2$(d=c
zD3f*qES8rkGsR3r&)8XmhMoPg2msG+(-BmZPS~Gmh=QsHheuC=r-wS-AzdM|T_Wls0eZK!t6^~}pEo@-4VL3C<|{+CrN
zOM>qcDSA_feNLXuSNPL~11W2UNiNo%&eNS`6Ro|ycNVc~|V%&NVvSCNK$#Inp(TC#>!Y;6E&JNp;5
zd0Ln$&{gzClHtZo5*BWRchIq)oJ>>Y9rX;+<8o;mI^M<=npdSa`6LCkjyfVVb(ndr
zisNGDX|>i0A1zc2N9`d`OLP195uF+O$t=(j5mqP`EJh5X0E;oq?Q%IHGJ<;$0g
zeQ`g3@_WyI=KXMBl@;mRao58G^$Io7s=rafYZaSAfkjvr*P@#lAdue8a;hb@T+|BZ
zR%|*feXXKbgo~{T1@q_++Pr=W0(Oo>0w`A@%WrCj1C&ShzVS5Gn3swG$}7sg2Wz_ux4&T8w5uOS2r6B
zG&_p!vQ$z^N?NV2@bFwZKXt8Ssz*+mM)XainOR5|?ckP=${<5B3lXMid^<}U-E5c^
zPc}t^>88pA2s0)KrGPSe2Pu0nn-#+mwr2HA*j0}1rWI*bJPAF~5gt}48gMUV_70mB
z`qVmAx4do%@xE4-wDE@c+k`s795u5$f!gn=&=l2R*>#e|c6qg3P5{ktmMj#Tb#yZy
zxY8H#rWDf9hUd1O
zTL5HbbDKIh(MSvWXxjsa`h7*D%Kf|F-;K*}Z@ET(YMq2UK}AViv3VGkM0St_*msRp
zoU@k4Z|wtdaQQ97MyFvT?bJ?y@vdKwX)A~=FoDGjqN
zcgwX{F!xMmE(_!2s#VczV_}$cQrjA4LzHta05)*Fvd@aF1Y$&8S6{SnkU7^zwz%dr
z0PuC4k}Y()22fh?S{!3w@2XvMDRx-tgj(y`TQek-a5HeOWpRA`gCBhB-Iw40WgonL
z_4>uL3yZcl6;iwa;J%wK0l#BZk8AC#v$h|rH1$DK#ZrW|Lh>7%KFe3H>{gGQTEElJ
zqgA0KIsh^g+QvuGkYr;eDlBMymN1Ayj8Mc$v3eyHsK3$eU71=@aSE@t+J&S{=!g+m
zZ=_3Z+4B}IHTXqP3(4J~4@vCk0kr&BT|pPl{nk|$9DPL{YgVx$oXJ(`BcdZ7_QwKu
zsHbf0q6YzRMAT{q)ZH>yghv=@Yo@A-5$4zt4_--Dx_fdFSe@5e$_LKw{3HwpPIF49
zQ%I!P=c$|yx$1=R*;m`f@CeIQEFOnv^0d#b#X0cuh5g{;>JM4)VQX^qD1CE55nI*Y|Ma!(%>shF|kjZ~cis{P+Kte(!Jp$N%7;`?vqi
zfBWTI&)<6bRT}-^I$c1qZ<1eP}c*pzIuSd4fkR
z7tc3Zao=5t?2BDT;|+wXn-ZPydy$IoMdh1xh2~XkoGEi@<_Bc%f0Z7VI5S-~AyXxm!3hwa=paa-8RTg`|KY|9_Ng}CfP)6DD`
z2g=yljW9DQrnbV0E}=GnZK>L9f5(luVOT>S^4eQt7Y55NBq}Bv31raf8>AB`^?CKA
zZ`EIUSok2BwVH(y0BPN%p1%e#sX+u>QX`Y~!Zb)@0`{H~5{6JPu0u<-go0oP5K&Go
zcPb8bzlfba--C_hxWmqbt*YS;(`7NTEysO93<_-)%D^+Y#WoZK=sDA6jxpG=5N3f&
zYOS1mh&73Dv)=arAmY%NT?#`pQ`Z~rqTDTv+N>xBS}nO*0V6`vU~Vt6{*{jbBaBL1
zQs`31Pc}TppyOKp>wo(8y%!E;fuKt>`d%~u&@VtWj#VXwTyJ>TeuVUSdI}G#Z2j|^
zWhTRFPYwdyv;uLiowY>>L+`jPHys=3^o7)NOPE=}LKeCc80)bFJ$4qM^nq?ZDiPr^
zLOq&w+_9axM-sAE<#8DiuJwAtP85rut0IOR4DypEPr|CNn7ge-7PJiw(>e1qDMdQ(rf=qwB0NIg{d&HcQ^
z1gdzscppz4;Hrkg2;3!J6<)Yqj1QvXfC8Fu*_^y>NxUTdR%STEUAJGwxQY>d=4AF6
zX?+B
z@S98A+{6gW!rgs+eOI4-arfz`_n&@t_t}@PzxeX*?qL!fK5pU|29tSZlN3_B+%gT&oY_5k-PEbFnz$
zaEDgJ0VxKKAdPB9VbFM7{ixJ2j$F&a<2Y(9rDQ2v+sx?<`s3r{7hiq;+kX3h>e&rB
z(cCG87&i7%mD%uw?*_u8TOd0??u6BJuDF|-E91LM$`%Efoja4-eFqq=Y6G}?79@Ow
z!8*zTfQwH#1;*{&fSGw}iH^667^rhWp_!J4b>B!0mwIDKfFZMkg?
zDOr#AT@HU^T?dIZQ#(X8cquVc*JKu-9d>i$j}LVWL!b&FS3k@3AqX?9g3yMQsKPpU
zLqu4Fy?hpzi@$#0>({(1T&u2+`Rw`lt-tw4{_LsAhcE$MvNbf!X+nrgltQRsmL(8)st6TRPc
z3juVzs@*y14r_;L`}F{AS!&wUs_xvUTR1KGOZ&G;S
ze4~3+ncgLd-8Zh^RlhqY^_*T+$popTr=S5z1Htgn2`r_$cy;+Ebe1d3PUo*0O#MmX
z_I0nD?n1ZMtzF%HL1RLD^pr$-M8K?AwHH9^BpgHuiS%=rwrKYnWh-sQB0QRi0W;lt
zr&b@y5n7BhGu=5NR_@i&>Z~P6g~Z<7V6_ARuA`j$kglX|Lbw~EvM-2K#*p5k
zm))`Z05qPex7Pvep;F9qW?OgUsjW?wP@><>-F63N`ztn9d5$XQ@6lYWM@%1vjdqjh
z4iBx3GdFArvD^MN4VUWI*XAA|vAdbO7uiMJ%;0O4N8k7UqSoP!;yKlWDW#UmyOZRm
zowh9~&FUMEs;u(ZYio&<_SJX9e&9+XI*^5gB+6QRAQ9J!W9a&{d&;<{7jCUDNFhB<
zeT>URpt5_cRbz~Px>{KinHIq1C(}@?Cp!viUXkfGqFk7y?(a(C1>i}vI$ne
zt#q=R_Fg7nD3+C(&6Nb)I=;1G1@pbkt-bPVYT=%Etd>2i<=r=3;oce>rgd(TTVuL9
zcwM%xB*pasmQ2oqnGatpcW2?EbmT$M1p%>E>e*T=)xqdclu-ObD|q0;*A(a
z>~P@TPU%e&q8u(+qe=~Ws?;~_$?9wz2_c;ZFwx`#D6(-Mjp#Dl*H%FL-mFj@9e~v2
zLq~`W+Z%y(=i9B?j*MhQM<%%TthRQ(kAI#fQdica3{+<)++R(j(Kf0LGQbGRCYfBl9@`bZVt3>MCh-Otor=x_1Vwg
z{ovDYe(48afAZ(_G@jp63Uu;UnSzqlF4F(R1AT3I=-#aaYbR;E<04u~{s4NV(%3Qe=HkmWsb@X7)B$>!CpEE(kh_#YSvClA5!fi(l
z>oHz)jS-c#ri}fj$*l^NPkT_u@Q5+5kB^TJB!2O)|KdmA`S#EK>@UB+yL)ka1DVP;
z2ER8V_KJ1kGF4|btlFoZMH`VbvwqhQqZO5k(bJKERUSrA5x$Zw(C9LV>v2ttBe*k%
z$+ErR)L>#DWXRO3T1IpLN?U+LQ81S}0fkFri;%Z12)WLE4G_nxv>tV&JzeN*65y+D
z*BijmD%ss$Hoc>^THuIUteqv6C&Fn>kfP7B2IZfMcV#);MeVd{jG7|mT*q}?Q2rR$Vj=g7ofvopuVD?gudF?JoD}>>)fcR
zzO)E4jPOh@#|UNf;7VMRH*POpjBj3DBLWF0T0-0%hecQ|6u{sP8MIuuH;m+Ez|AgU
z$8&pj;j0I}evO&&dh!zW;;rK!_M6hF74OWy@QxEBB+%ox5h4Se9
z-8Dc$fyzuF8rt_w4FybgQrgBg8tzbBwm4*Wv%RuQ2XSllkKR9Io3WQB+x9Wv(77r=
zr*V*5nqF+(x^qk9HZA}&^9>A%og1B3)`6w^w52sizGG3Fs4y?q&WP$uCrn^VeAOn%
zxvDo=cKQ}<=SvFSwZ^?A**kF&RKRG>Xt*cN(Ux1N@+PG3^xUvegrBX#opL&!Zf1
z`rf8-6@9}SchSW!(BZ8CQiv-WgJIFP$aiaWh5WrCaPOdbb9YvU8CAYXEi@Gaz$2`8
zL9*S7fNeTygHOsC@3E6@gBf_*5ZJdV#_l}bwM}c+a66}e)qtVEPzjX_Fsw>fKy>eb
zh3t#wHjcw>pwUDvT|HP8BYfzwGR2~pyN~b)M2t&}BgReKy~fY|)XleF?lp1kH_^+1
zr&D@&)g&z7h6Fr9LP0xa>F6_NbJ0LiY2F?Rh=KI3FvP`k62KVVIH}Tbs#A9N&NSN+
zUo_fFz4L%$k6S$oY`d2LC__Q{tnIP!HaUpBIqS6byi2meqm!Hzs81;TywUe=Vd2N9
zRUofxX-XSoP)S_g9Zar*GkhyRcG=q?Q;)|4ju`5WMBjz`Tnh$;c8p`JYtDHkImQqG
zIU+RTk~M}E@Wh{WuuYhCl!ckegBYEtZs$YJJ@%%CduA4avER-Xe_B7JDpac2TIWl|a0x|-zDn%ZKvh?UE)>h!p?R*AZYhBtnU=h=
zkw=&**UbaiFi`tctE27AEYE0vW2V5~{VNSw9EY!~LY0-jW}p?Rt+0X{Vl#??BDQtCgpBp=08Rk|UJVT{HP$0k*c?5Sfjnuo_o*qYTy>ZL1
zLEEX7%u>^@hThE*1>>A+jPNj&$`Hm8!aMcuhH?b@7=vZgQrP
z2pNj0#U}1;0DeG$zt+=}toEv<&dH^~h_DF19OL#9mjh|`aK-Ca`GZd%KKcCh4?cbM
z>8G#0d3C*esClJ1j^V@Ot(Ui_K2tuHB6WQQvNO#L?$UjTCo~0HT(j@sM%A_8v_}cq3*8Bu*GEA$)&7G2|BA1NzR>9gXjq|)
z;=p|m4(j_sa)c8sFj{_}X4-p1i%4xiVKu*@f!qyy&9)yguWKB8iDGB#Xyhn3b1j&8
zCvGdGjZ~DQ-Z(ciT<5&Ie;sb0fBxD1y#Kv_*WdBZ^AVQgh<=p?rlYk9-m6yHx2*5(
zX6@@H0fcs+*d|j^MIteLbE@shtODw9?iKY)hiL6ea|`QNER;KK9?>SFt?AGoB7r1L
zuB$Lnj+!g1*Bx_&ojniEgIZst!)XW=N`Se{+u76>0W~xN-e@NS(S^=BG!+
z+ZJbbd88>5o{e0Zp$%*>bdDs*iqZX8L{w!JZMaIMdxH^z8jCb#j_mFq`-l`AFpi;Q
zP1OnyuiY!0Vm>w3x;ElwbgbB>O||~&^ryHR(VltRI`FN$D2r1x(ic#DTTxS!xtlpw
zA_w1oD}MM1SMFf>q@kC$71^@!>ReQZWwK~e-L5M~@Nk6VX4vH=p52VEU-Ry+t^
zt=qtle02Ly{G-3^Kl{6X(?9)3|MFk@U;ppNrQZAKL)6XV@*{!%V4bn%iP^U6iXlBU8MD&rv!dy!Ed@prA%3R`w3CrgSEU9
zW@e$qV4FzLMee`>?oGek{excC#`)1llMXKLW2`%O?`R6mZibL0QiAjdD>#9wG}ror
z*j14h(&SnnZSACes+T0)z4BB7S$ng~i;3p;1qADBs_1~d@^HfjAk4fsLZ^!s-LG@4
zrRh>Qm(JzUsDfD^%?+|{Tt$1>O_YcNcpWTP7H*%s0i}gQPT8lu(j+r6j**#XN>#MW
zu^WDH$Jy$zZ{C8L)8mLSNM_bl$TCn&qhrT}^#3+P3ESFLG>6_)jJ|d?sc0MLZ|R`M
zvds=iC?MZ(|6^fs*|~E(-P^uxMVi`cmm$?+_u$^9)i?pLm#sHl;O>Q%1y#Q}ws+pj
zTa_&XD7w4+W!}2->LOBkKGId&DQ=2j?J-DOw)B~~C3l*29oT;M^{BivjE&WJz(ju;UmZbraBwZI}DTwH?>o6;dLVL9tdAB__`_eHS;7*Ez>=thEHS%!V{zm~o*+GFjMgxp~X
zt?|b3u$X4ESb^9#!W5@eZG#c%?E~wvBvldirz3x-Zkj1NxF2})FebZrs@<-Vg{Ce2
zXyd~efnxT#2R4%{@~wB|xS^H~I-C`0S7X4f$SRCssEz+t%|wK#Gb&4Ob6@QFpHG~v
z0F+Zp(#uPwPcx_X#DIE4n*o67FjA#e$1nVa(l&QOIE-CJ<~2{5hWAb&H3)sFpMs!(
z@SfEod@V@_&EVOJ)`n3iH>~g-Gc$@`)ziqH>S1QNN?zjavTG?_lRx3Yf!wY2EA|E%
zTgAO5r!hZ=p%?S^2Wqzy*v&JbZ%3wtXwmf!7yj8>!P8UYcf2Foby`68g`wJGiPOCf;LH*
z+nTEs-jmEsaSMQf{V-H-U+G4LvS36b`q#N4VjQvNnsd6_xLgcAF30upy0TzgnGwU?
zb0xvpaV!evC8TDo>*EXs_Fiio(V=e9a;J!BC*cT^*XtB~p}_?cCOanR`>0wWskal|Zf0$|}SWK;=q9N0jR`i;L=^7WA#IZ0xWU
zKuT=$2<;qP_X6iOY_}d1z!EK~$aJx1B+9Kr#|TkqohQO}^z;s}t-6=SLyvz4
z3#_MrMwZKWU~)kTNvX03=+q#w7RO;#RAz#%TNWSEo?mPXU)M4ZGxn*gAQFOsOjJ?h
z_AG|OjMs@#@GveeaD*L$277kk@(#Ya_}8y^e~-N3^~-#I?kNB+LQ|M&bY
zf8Y=Oul{fUmw)HmAARuRo%gQuem-6SH%l9xh;CN;F0kIpi{8WuwC^QYxifx=@D@Z-
z2TD(lMTJ76T^nYtOYix#p$|Xp!JA<;JK2$vD^8(Z)<#neH7*rtogEt*c9VsQ*wHRR
zns81!jkq+ox8;F75US_ibLLaOKo~3&a0vpus*L95#T44D0Y{Hkx5#Qj#GNV|Nf}&j
zl{Hr#hqG6X=^gCqp)aq(rI$>Uq{{j!4IuL*nE@C&TibVJk1leu20-_t>Dk5&8cNXt
ze2$u9L>0A(cwdUvKuPQ9=B~-gg6ObZ>m{Gze+v(tz+dZy`56pox_rjc|$u5W+wftE2EYY@%c&Q~x4}
z`b;>m4HAp+)Ey1io#+R~_nH}1HwkN_JraqIAR{2XrG`VGEhXYKOrcOLI-d
zxMEnhO4j7XCJ=-XRvpLjrX2an9uv`zf?<>4J*K+>7`C4h_w6IM{`G2$&H4&tE^p0T
zY!bpw)=PC6t?((XHO2wRnyPM9!UK;OF@~X6b^9?q2HXi7W9X%gI9%_(qF=%+>=h9`ESmK)VWM|+w&^YG-hb^n?uMK%`y8gMTQb4w0TCP>?>+Nbxa?Yi>%T38eMlMxY_7(MZ*iv?67p!8m
ztn`S=f^i&2u8a{z)8D8m45hzDc;qf_rnPbm*3lC
zWEC7)86FYQf@D*6zh$Dz!thx3D)Fvk7>>XyEVBd$_f2sduq3irTS;rgaYX5O8+}Ne
zXNdM7_K)5deJw4?(t*(cCjsCX9y&rmT93{9e1jVh=j{{pqlf#9XX`=&Lk!zT
zpfdkWy-4jtH3g0;jR?cy_I>(%%7g+YyAe`_^`ou1G#asiQGdpFDtnoEUZ#8V0C
z6ZzD|?4nyF_U0kNBCu9gR&0JrPZ6t<%MeT^3Wm$&IBxxNv6~}2a9#N3RsG=OhtI#f
z|Kzh*pMG)o`4{)E?yhT^AtHQS;y5lhH(_Dn!K^}N)+4f3l~%8`aktj$;}uFHn8nx35Ei4
z&D~6!RI#^n9Wf-qa6>k1w5OjpyDAYAl@Z9Sc`ZpH=IVt@5i!Of=3o1T|7g|2Kloq#
zUBBr!{|d|dmoINxZ{$+a0fY~CJ)ryKDgh;Z7E83Xn>okIba&swQh3-<;KJF9H5t;t
zU-kYirCNnM%~q!EvCz*U%FNuKSk_MNGaBApMq+xY-5G3N(T%{$GDoAXIJql-IuZ0<
zusn>lKPtA6PPYljeXY+%(nilA8Z%5{r4m!b%4(^J_G!V#;Z@YL(P+E%m(@pN&x9sr
z8mSC}CP2fzh}@K2DY86yOMQoJPq(03q&us{;yaFZ5VT0(O;72kz6
zV2coIq8oi>WZp7&XI5HKDYDjGC5UiG$r}$A5Vn$Ic!Ly*uYsS2dp4TG5$LoCYEPlt|_WhsxE&s@$
z__P0yKlD%knP2!TfAxDm@ne@4HxG|@xu)4LTUDjlPXma8at|~j0-fgya~~Sxw9N#t
z@F196lCCuD$R1i$kZmV>#~WB|X+^4@Mr$Ta5u#Ec_8)l)8=nT(=*PGTot{z%-Iy~F
zUR!6-KZj03xTIX&S(#edJrfD+!W%lP@F<{A!v0P0Vu{_+(ve1gwZDUlS9A;6h79x=9>Tr%I
zA~TC-UKDV(aVc1|qs$;GMiixQM1Qk3N^IKo!S}$}h`TPX(bYabwdQ7yy~NXcqU6#apXSm+wK
zpNnS*vLJz?KDjP5t1==|JGf<9?nbsmk-3c5eWI&Fl`>N?04(b;lKwT4X+gd35S&Ax
zR(hbbg@wuGj!q{H63~}I@ZvbkOy)zK;Ss|us^G3rimh+}%)HaGNp*ptL~XG>qb0(Z
z5i}gbf5T5--oCM_R5K02dRy$)^)*5wgth%<`oMZB1wFDlI1|>LhB{Fab5<*15)t76
z_7>sZcSo~Y3`db`70gFyv!ZTXA4j!n+xnfZ^`YA~(>*XHm2^4Q_P+qo>T=mFAHW4
zSAhOW6z80XaC5EU$tjM~IuUdODApH*)@xV8+)_Pj2T+T8Vpfe2ErpO3O#peg!73SJ
zP@%`(tAwj6Z$`tHCm9%lDo!WMAZVm51^?vubwm)QVrH&N|1
zak^<*`w7#EFL}Lm@Qb%=2yEMcMR-zGa&sfdl_||2DTS?y4>yA$Nch~LD&9MeAPZTh
zV1w3NctgM@t=&263lye3|p&tei?6$p~x-*95N7sS**W81c`t0*p-`vf4r7Gw#j$_=ueEA|Q9G2n`i!yMP^wF}N#9xh3R9!p)@?4alFy+CZGhRGMZAz;p#sTexx-a!HD
zg<5mX>l~LMs4GUSwUiv0bK@ov2CL$#6g;uk67*b5UZu}Zb@{nEQKM#}Ql
ze)`GBUw!rEPyNhy|L(u%xBbNTK5#xBmoc?-(GS@7C1Y3;Vz@6S13RTe}Rw>a+4*3z8$yLYY
zP`e^z*uyJfRwkE?K1m{3)-fj5JDgvlFaE`U^v^?GMu*r-}P
zl1TX#VK8=ZSAe;1hwT9+NeP6vW?ktC;t02PQ~#kyzpD1?kaUmc7<%iU{63lnHOpa(
zwqZL-3qW?Z@W}`0AG4ni>tWfO_SZ{VuJKe6T+P6BE8Fu$|7NE`PJ7x0x7f|i%x#0@
zjl=@gAEUo$$2tKWv)oOwv5Ko&s;PgJy5K!_(_q;f->cGq(kFEHEbigDX-lFMSuB@U
zFDz()yft(HM++&t?V@`KGVq4eHE=hoZD!&JWFSN*&0>eSSx=qT{TtY9lCGdGlOzh=
zvY@SmeZ_nH=!T$m7!5kG2Ohap8ZPX?S9OObR0HZa{hD^%+l4@
z&{L59d~IYB%()W_M$h49>QW_g>nYT7mNa*gr0
zc}sN6PsU(_6pgQVxPa1R!LU{ymm73rD~QE~HG+s3eUH_iga{>%aLI|yt-$cnb-^%3
zC~6LFAzh=pXfxBoUo-bOE@RvtUp=g!_|co6`L=Hw)qKy}4Tqs&W5vjKPJ#E=c~T*?
zDqjS<9vo%B!on))(f%OvH
zStcpWK8K|<6dsSQLD?1+|R7R+|*|Rq}xdlK#dCt3~U^?CpT%*
zBuya{Ngx7Z!(spo;qH!1>-YyfA=OV>n_AfkMoq#z#faF(IQw9XVOhPBoPfp7K#Ki4
z0FdL57Bm|tZp_3$xFc+5B|yiN0#`J|7PjhA#)@tn_fc9|?k>r_tQtZYhgxAX3j?7P
zm>90K6nCF9kHdSDkcD0%g^6mQG8yf}#Z<3~86*0!kw-MT#fc_f3cK!UFor>PKA0qt
z)*ElPAFQ9%Cc#>ivH!nic37p3yZufm`O{!pec9DmLT)`C%3LsmtT4CF#u&%V#ltZZ
zU%#%u{!7=-KYji2m*4#Glhp0`A%l(m(5)2u(7JqhsCTEs?4gH6=4xkqySbD
zB--^7Mm9VZLo^*jF(mFglL0Fivl+9KJJAbhiVw7IvNrgu(pR=`E1M8&PT0(7+U_Ho
zBE28o1tS#h?#(C?2y;`C(-@jC+?}NaZCoE8m4L#lu4l5k8I#*3Mv%zLhu3!xj}Kpe
z{WUCq{Kr51d;T-O^Vj{_pMLQo)^$C*9hYMqBg||>Z(b0_2hw_3Pyb(cL*0X;>B{pB
z-vjOLm$*reC;x(P(L~FFeAQ#<{5Es+C+VWCn|(Hc`jBN@I#~M{YUd@Ym8B6eA{va@
zCyu<3)kWA~Jst0U$@oS@b9)Nf!)*Hd7~as;c14o}sj7-PLsn?fvaED(G2Ni96*3MQS#3>s{F-M41r?<*9_}9e)$6*y!f4ko^Z5lo
z^V9GAi+}X@{^x(s-|~^5czK<(#KZ-D8TS|=<9cc`_@#9EZrnUkILsYY}pOJ>w!
zx{vBSH};Izhr|$B#|^1fDxNF*i6=MSea7(MjLqC~ciAkxs@$T@6J7kRdC}&Z0U#^o
zHPytzewbLgr43>6eDT^$Uvha9s1o;#)KsPi%atgsA$UV8`(_rIovQYPRfvizwVA8}
z+`N&JPBhjb3O3=;^{Oq7VU}|>D&I^0w4DV|aIOgVE=bY{Z5UyX^{4Pa1DpDrT-`IV
zBsftrCP`=)My9qT`H7#bwWRl`R)xwqR7tJ=!Ns5
z6Ox^HTT-R+bsguf14OA6g=%`aXdY%*YmMU~y4yn=6w5m!F>HrPn0wKpLoz~7T11DA
zd1I##7Er9ahx&CteZ2SFYAY}I__g)s{g)n$+USn>(z6L;r+u=UR82S@R&D)O&WxVT
z;%vG`IJQtG;C%^kM9M<}nx;{xVd-7#p*N0$JjqC;V87F@}+{hAU~KJaO-
z=x#%nKl%6MgfZ34%qa;jxGGyKgksf%8t%*#{mx`oMYsfSWB6JrcZYZh5@e3>T(wrl
zF#uLB?WERwAy+xbbzNGIM54gdE)cZbgDuojX1ozxbGnC`zsyzSL;K&k{K346ZUBXGk4Tt
zc!vU@GZ?!Pw)oUcQ*#Gw??Nm@CL%0QtBbd4zN&$l>G4^!BFx>_Op+ralkEA{&)2^@
zfUbiyvlz(CwM2asTO-g)=7`>~Wu^toeW(ctunv)HcC<0NE~19!8BFb`pxe#HSO(nHK6m3M4?ccqRzg)#BeaE@{S|5tyHjhh?9VrCT
z44Jj6#xY`e09BeLTNi!8)lwgzd-qm(HZI<0fB)sOZ8!H@YUOj42-PZTlv2r*UrDgB
zN1KPMm^%z9lRjMeJ+4mTY0)AYGAdy!LPOzhBmBNt4?Bj|qT=;^
zefdrO@RP4U`ShF5KYRVfSNE^(b56@?V;~|%9M5iUULKOtK)Hyya$)IR7NtEGYo$os
zyk=FeMbEilMYM}p&xR&&Nx5?S@`X{>`x
zW>F|%Uh9y}BUK5};)Sx5vRa=nhUd~`8@VzQJq9Z=HRV6o;GI64tXlG~)+y8^EGuOr
zgc<`Hyvc;BTx-IN#kp!6uA(m5v$=?>$F+*goG26%mTOM^G*~AF>IkY__pe_)JU-0p
zTD*?1m(Op%{hjxI<8S;mzw(#=_)mQQJ8wU~01H+(FD^IX;TCS;evAM)q6q}o8HIHsu8lVEw5c+h`pPA7^v;K)s0r+T#Y7XMMVZBU#^Rn
zx7g@0I~LA1O^U{MSV;>hQs@x?D^nnsNr4>h!)1c5O!dCf)S!h7tlnK$0;e!Bpls7-@=-RFG9w9Ddk=wQ`7nRlCKKWY2o*n`ujwItX1E#dJ3cLBd>+hXP=I
ztE277xeHtxEEJ
zbULd;PxP{MCmDO!K>uL^CH01=u-6Xev&J52O3$%2LvIzjA%=^BWpC60S}q~MNQuMi
z8LV4#G&}`G0D`3ze^sPgxV(@j7z9lg!US=GTG~U_D7Kk2^Nq_B9YfVBXr-Ll$|XEy
z40Df;4sOsBWEw<;iXG%utt*N=$Xd0+gXHL$9VrF2ci61j4Na0gj;PO0O2(!a$=dt0
zEd+|Cv5uhJ8pqw4!5VsGTkji2C0cjEeOdP3Q!RR_gV$*!xsLq8Y=+Q%&oZK0A+Eek
zz?$fDvpr2Vrn(`$9TeOcs??i3dg%rW5CR##H|xpH0<)%KdrobjR^i~()Y1B080dWZ
za_V~B1zmj;f`;p;+F6#As@wIj(+F1eA#b
z7jh$1+hgcIfQI+`h%*4KUV!awUmLk;P(W{Z69}3)wZe;%0b95hQTF0R(0nu!DY`zK
z21WizU?cWYFR~Ps<``p8p@k@cN^xAo$NC6UqP$y-5fS6?*Vp>s-SMlx8$(ExpvE={
z_y3#+RqZmh=h#L@y+F5)Z2;5>RR_g)?DL6Fd7!#Uru4Sq@~7!#qM6wVWWqY8&#VX`
zxLJ$=GaJVsDpzH-0gvLNXf8Fc^-V3-TIB}x?ptA+DADHvLfu#l4;a>3nR+SBhpRlr
zU{z@uL_`#Gzm(1X#Rw$KObL){rI|-WqCoiYrf1Kz-X={E7A|YF!_U;N;cI0?^TWOI
z$0Yr>CvQ@dQl6F9xyEt0mfAPFq78?gURy>f-!>H5Sw}W(WsY&^G+}Qc$6iW~Dgzst
zm&r5DzF7G7fEy1(5@krd@giBf#~pwOc8z4!C51Z_K|NwSon-4k0}W)+gk?h1F+p>)7M!ca
zDVQC@Pc|>L_s_R73_v`U1c)3DH}AAFoXiFQV=k#eOaWT`{JXVrW*CzFOXZYP;1Cf<
zbRAE{Md)L+dr)Z$YPj|5auY#zqMPQ*7a0*7Yg1T5PoZkBV>q*m<$egC&NCRu>NAkB
zm}-Uf1I@QesOeQHRoH8+4c1GZtkJ%G3GLiO(t?ogr^Hzb!*#bK{PuY~dlnd)4PX3nb)gtfZWsnj+a2R2V$1WNgrCkUV!KoSyEt(EQ;
zBi2=$tRrh0Y_7EM;|LU#qBMpROwj2FuuSQc5)1h7nk@uXKc|m6=Q6i3LeI9Ea?)b|
zlm6t^WP7eMXAEuoBZBgMthH1$&`=OOV9|k`#bVl;OAVSV4A^}Ovp~iX0OqXBhgYxe
zA0HpC*DEY9$9U(Rmp}5oZ+-Zk_dopb-S2+%-uv&oeCOR4&!1gx4`<~VHDW|WjG>nE
z7{e6m5^>_2u)be!_CM^V=qym}6c7ZX>LmQMOA`9I#g;kfUGZ)1)d5|_aF5}0t^VZ%
z^bWRHg&58`b>9N=WIq3M$uC_X^z2`r4SoFD3n=DF~!IHGIlLFW*gYBhc*w=%U
z#^ih?&=8g0&16B60+ySd?XECwQ2I#~Z~)Ml(Xnu~uVl7^i`;Fb2};%J)O!}P8n|?~
zVmVzTl{wsEt)5v;P_D%3@=2uEvA8V3Ogyz}ny@h6WZMX0iDhC0Sg-l7p|2f|GX&^QxV>&dT4
zhZ&Msk9E2DF)&~^fy+xgyTRQ99v|^YTi?{p;Ct^q`yc(Izy0t2oxl1Y`vZUO-~8AA
zjSs%}ofmJt^*A5vdQa_tJbVK;M$%)jsA!$dNqLU|I3sukqNxqWwk>qyD3FWY4tKYsf*PcUFyWtVMFLf2n-7)@fwV$-NNaX=Esrb%c_&vf0QzDS_Jy
zWHL+vPmch*y6(hfwL)lMm|Kl$T7XkPa)%Y7%N)ozlHm7z*)R4UVj4>CG%_Q%BciJF
zeiR?K?@eoV#8pZX|CCkR7*NMp?*q3}Qbq9?m{}Gs0h0SznPz3?xynZ`%-nyjOkbxC
zIiypP#FeDM$2bJzRTe3P1BnhlDCwG%ffPfRw0AVglwimzcy!6jzEopGWoA}`KuPWE
zpon*^fe9}v%L0nQI4cDSi-1Jq@Tw-$%-qKqF@z3~fSVpIvp!(}`|2D1reA*Z(M#E(
z)sACV2r9=&(`vI)K(jeSN84+^UouH8Zek0UdvJv|59P)|Q#ZU{gIcWBy2dut)aDQ-
zJzB6t?0N(<<9wWOixCDN!>uZ3QQmjLfSS~H3psFlMTa4$GV2uUEu)}OJ4<@u5SR2G
z9f-QTFK@wIaYEs-W-5%duI0lWwlax~W30KdlMt2arf)0TVXU>djMfEZ&D0{+m8%Ld
zLO@kjX986L0x$(dljAt{9={fH7x`ohsZvguNUb*la+sM6xu%g>a5Dumt;BGHHG(He
zmO+Kin)K(IIn1f3#RU(1^@#f$yf6glz#<-#m$2wB2Qvtm(V=bKj$2PYB&=;z`pf_;
zd!W|NL#<3`eq0DaR~Xj9oBl~OAJ`7+Ru{v@Feocns4A%DPNMM4ZlP?OL;9fYUJLdH
zCwxLUA{^AlQHq^Vsx8LhBrW@?qDYq&*x~C>>h#kV6v@3c{sk
zMIF3qo6tDM8-fTUTdL5^MmxT;0L!dnxJsG1pU$xuorI>@qfKR-j$W&(DzxOF2*bRl
zn~BiwI`Om<6}4}%;j|5_E|S@eekc8^k8so~MCakD+U!$bjvz`RN~M*Ufi{M}d@F8l
zJi?CfEZkr5`B&FZe&O!pkH7i&^VeT|@%Z{~<|N@(cDcD3m)o~qwhy*sB1f%6tyx^M
z#^=hcT2t>+3O5jcMbw0L2nS5n}IF6%nW3(GtB$72=JBt(>tb?gCv(n9a$s|D5T6(aR){_GPU{wmDB}>^m
zt?37@*SXDTG>?wf2av_^Qru{-NJx~=>l_i|@T^=bPyAMFLs-EvA14f%t7>KDHkCLD
zA0vh$;xgB|KHfjvzkYapSeZcG-d^5*`}r^X{*S)@t#`lu(Yqgf>)mgC>*cfC%gtpR
z17mo&g(18gc3j4Y@bJrV7~pR5*NiTPeSl)Kn(V!lU}yb7sumVaSm6#fmxy)EB^e7~
zo4x}arx4fO;aKZ5u<6$8y|;+*w8&I9ad%H<9j^$ZT>XvZD?yztQLPk}Xr?5H4&W8F
zZ91O1QfZ=C;&s_l21D0LXt`IBZO>UV&F$vq$dop+6YS5E-OOS{3xdKFWdd|oNUM{(
z!87b_&oHhfC%?0}R*fNatPE_C^3E&naxdab7jRDqO#pW3D9HhO+9%9SMGQE#T9ST=
z-e^o*4N`5v>zX-^SZifwc=SvINF*w}uUlxfoDKj&080^K`@AE$7Gqd0PQw`eE*0^Z
zc;~rYZvFb0w_~i8LwV-MFmd$;Z~pb)`B(nTf9+rRGr#$t`U8LZul?}nf8?ir+#()df0H6a
zu{?s3ChbJb-3K;|P)uu74|_W08M0SR!s>`?ePvG{8~Twxio1#A9zm>adQaKW))TUA
zh)i#Rrdx-#+`Y$>rY?83MaLJ}K8)B_VMu}E%~G9M0yeZ$khG_ns59vrW-@_hxnpI8
z`^r_6Rch*;YK#@yPN)A?M8|53h}uTr$^_^Z8eiQSQpvT1iC1Qfs7kZgg0t$!!_@l~
zAl+mX3#_5(zN*yxsBvjt90u+dC!B@wHXnB2&<>%kB6?X6NGgiyO*j*RW&y&
zJu)a4;JEX$^qaz6uMn&uAN?{jm~5fyJFQ8z?n12*2)!3wL^or$Z|(_~?*^?OR_`rH
zC!pS#Tpz=lo?1L(W;;!{=URQ$O-8Bnw${u#hY(imqohx9vdpMQvnO;xa%PHO-W$XO
zj;iQqEyM`jl%D;ld9}>oKG+L|ou+b}wsVOVv(Y{lH
zdk8mqY+5STs~vS;P%EWxZ80V3wU-re#6g<+faH(KR3Jh8g?Iz{SUiZX`FIPP0|BKI1S#jfgoba
zGMCVS+iLW_UV38aZt51?l?ZAAECFaqUH7;|uWYIIGQpWsTQ1#z5mBJE5XCCFHKedG
z>xJxwAf&PvpP8DxO^k`_(yekJj-iBXiq8m^cBW5Gjt@zNSZCdl_*ro;pjKb$eSU8G$
zE-Fha@8q*>YD|!swB>+Fb;#t>neididZkGMRO!rAU8Ul(444PyY4SY`#pt}A+d
zt@e?pH{=`#_bCN~g^ytkI0%t3m?0G&V!N9;&xEGmteH31819C(HZrG8(V3`5UfMzl
zlj6s^G+9%j0%LaV(Nk8eF&5X4smQnMG%v
zSEKs_{rnLitQxjx6j~N*f=v352*I+7Sso2Y#fX|BcGT&$E3E4hK$Iep3Vo~sEzQzt
z)$8*1LEyVT+Xnz3#GzknH{Wp<)=e8)_k>I;2F^{6k4B>k>_X;%=2cVa-$ECs>D5=_
zf)=(CV|W~Xxs00|yBtp9VdCp=_%}X&_`%2DeDc|=Pd~Z)`t`iKzpgX`F2^{=<#Igt
zBR2J=$T!nC!K$@ZuBsj4dYzeaPzSUZ$K7IB&O9e?Nfy$+k%%+_4iw4OY1s9HMXT}mbk7C3CKMy}Mo?AFuPe)*2DdpC8})_PZZ__{%=}=!0*6@Yc89d+Yh_
z&E@78ZgJ>XHv>nQn+^A4_;G|AhWl}hBVunS?lTfVjLrl(m4O0p6*g8?(S(~8d-nbw
z-*IKKva3C4_{lqFDKn$bbC8fkQ2$EX&K#!LFhx2cqS(0!rnnnPs06KUzp;M)%2EyM
znz^fxUbj9ybpWuPBb|P)*3Yf7)g`4on+@779ksU2Kwu1yh+J%1QUiQZV$|ZW5+M6O(lF
zm2H_bhYX=H+{~)gH+w0oN4saM+}uXTt?NbDEXgCAbAIviL)z^W<~fMaYeGFfDVY5#?eiFyJzPjP^CsG%7bGU_lp
z!iM9;t=-<*-92C5aV8#S&MV(~artllmw)ze|670MfA=5zv;T*`{I7lMyWf5J-nZ`W
zUR6GJW(uh#_ZE&4ALt&?c6u2htNEv$JVrzB9Fag8qqjX3kp}M+3TaQ+wgojU>Hyt5
z_0u%;Nh2wsd!IvS^0tYxH_jq)85I17Rwe@55`Xp@b>gS`l@2q6hf2eqo@lLAAasn`
z9;^)D!Zup3N-@TX+5&P7L}}-myf>IIKObJ`VsYs(o9PP+IYsQtsNyRbFuA+Ed(Yu
zt5&t-JalAMnuUYyafJsot(BEq0M--%c6Y)uv3`v*_$is_XUw(@109^r&Qdx%)!m1k
zxdMF(bKgh(6Fp$trbD!x}A+}b=25CA$#(N$>YBH
z>z;JsQbiijtab~k2O7t*EfDv$a*P31t+c(zOfiyWXmd_+jA1}!nmhY}B49AjOpjiO
z>U&|7)|%H|&r79UXM=OzNui-<6VP6DNgq4NG{yM_%)K(lI0)pbI1UAhx_hr!H1^8Y
zH&%*`>0v9`lZ8!$1yayj$?dv$6x;apic1xY8*37{jrl4gg
zF&OU7q;;#I7i*70LMNw|6PTh(8;$`hNoGNr?6y`CboVtE%pyEf9OKfpxL#+(i10a+
zq^TVV&$Tv%hI!36Vyy-Cg4wKExpYRZm6B4;x#YNB*NP*0qUi5V?Y8moM9%9pC20Y<
zR>bJLyf;gAH_+7prYUrLtydvN)T)rf69Q`lA8U?Pl4=h^Yo$dfe5i^@#G!7KMXbbH
zhzlq2)#CeM1CZi)5tBT+k)q&&y?UpE0I1EYj@5gAAhmtYidGEv0>E_+_=GHkMK<}I
zo#>m379MVD{A(|@U$cZiIF+up!&LM>s-5bK3Oh~O4UX11fXSJneLNP*
zAn9)n_3IX~!;gC6^)OIG9>xd|=`^#PEg?JM&iw~9Cb+lJHUr$II1=Rzo02&*hUZMR
z$h9}h_Q2a1HCa5y5O%2XzO#tc1QFE{&C;6)rESouul)APMg+`qFTjxdRAodu&>m|Q
zq#*tFs#A%l1w7q?Cspq&S=qbk^$gzLj+-05xfqBfUf<)@tMwoK{M{#Cy#C=QuRi%-OLTZ5svvTb-|=A*RzwiY?H
zBP!?PqmmX&OyWf9J`p!U6H5wx(>zMm15s9G_ik|vR_
z7OP6jn#n?3BC~2SMu>ng&1|i~BdZklvyyAh(g;S1?5#}6BO~H+IjT74!}ZmxhsTHO
z3mA{MP&LzI^+g+uK89X4#VO-Y8{G|5%eJ`R4EZdrF2bpT07|@
zYH3BYXJ=AC&Uu|m-g;sveHTPAb&h*jE_Qs(YATiN&Zkz3m06s*B0R#YFvi$IbbT+E
zVHK@cY{_&c3lg=7G&2CT8awo-wY`=r_x_$D$f}3|6|Rn17Kd$QmEvop3Q59kC^gD#
zggquJ$-(#DIsV2E?lOlPGC9okru24bBHP#7AGL9RG8NcaRfXfyF5J|vZa3|JtTY_`
z(jQ@N_SSRUUhvH;+&y4~t=D-8{F-0+-e34r|CN9KPyhNq_y_(Mzw}rC!;gO1_gOdB
z`#YlCK`dksixD9mijWB%o$Y%9r
zU17JSJrOiMvO{UGdkj||iqadadbX6M+0LWKMcJBJF-3D&C(laorhnP#1Nvn~^{N7H
zDC6D}`%HtiyTQZNhgYT>dNBgZ=t?s%(`F5KL*)WZ{#EIq_mXoaIb7s_xtUT;YP%8?
z=>sBnaIw*fwFn0S7$hSOkWzuxj!M&**CQ`IeDtjEzB0oj#;A>*`?dwf2%rNJ1Pi%2
zt#_rLG8J*5&ELAb1dI`x6@KiyK>-mytm-KdRKHzKle?Bjc|?o`#MoowCP+12dYGZJ
zG~dAc1(lz(OX(466zTjy-SbHov412RS5v=hfDS^v-UcO&J4@nk_S#xO>jGEAbi?{5
zH-E)U)9Igr)=Ma
zZ8p{1Ba~3$W4H$paxi-!xrW`05l3{wa6}x(xLhI}S@`w8e7t;SojSNFRy0zxZz}q!
zfpt8f8JJJ}YxQ1r;id?83={e2ZXUfzO1{BH3LVTH{R)K|DT${ld-2)R=jdOggBa?r
za^x(Tv4|$S
z6ot1|7R8~Vl$~2upv?!ZaWXzjEYb3(->q+Yvist)!c=K>Gx`B&4z%m3rf57(+
zJTnZ#BSByhWiZec{bx4ZT9{>q;y65$eFwD-ODU#dst9(jCU3z)J0@f!l8iP+2(|UY
zMa8XxCVbUfG^**NMGTfoY3POW)_G{1&|nR@X-m_#w(3bBTa+uMnI0;M-U|gH!mt}^
zoz<};HwA~1on&hp@l)5`h#V0^+fX#38(O;F0upoEk%e7yOC)E}jAQhTj*#phdLFdX
zM7@2jZ3bJ6BP3Snd6n96D!yGPDocuk?Mc>)xHs;AB(h!cvO%6jLo_lBm5jr~ysEC(
zRPIsdURcK?(2%|BMf)}^!fq~ca~Zcceheq@`T<{lm4EfGzxw?1*PnfU_xTqOUwwW5
zaOIkMG3|&LaeKMI%(T}Oy;00^t?RtP;D{=1UB)<$hx>^Fz1GTH$+XO6a3so@Rbieh
zrXc1LB$nMTCAR^!oXFASBH3lSOSW5mitag0$_8gDkO
zWVBvQ93#lmgBM3AA1qrPExS2r8m$4^%4}VwpDh91oUm#(N5Q;0-z`^yCG#G7!Ys0m
z=-s8thcrMCL|C?bWi2Rq&YI{&|)XU2DMF`US@7e&%BLAeIFG@1=2@sQV2&3
z34(H!nT^p~>v*o~5Fjs6RZ&=g09L)uDlF3HpN`pFxf^wi=bD2&?Z5
z6k6zHaI>|R*;Aa7FsbHUwdNgVo%dF?^Y)vXcnVR2^1}#L0-(7~DT9Qj`N{K$z=ucc
zs+I3x5)Hb;sA0YgWb-$yIJ%CYW+r&*ifnq_0MZ9(Vy4r8Y46t=p|B$0gDK9
z_^M8U%qEH{F^)E1LDzq+<>58Ax*>vF$G06-N+aupEwer{WUm#1X=OWqfi_y3tb4nP
z@4T?v8_	Zhme$!B#k((6bdOkdCXhW9m;u^^@()k}7#Ecvu87!NPGEiw+xMHv|5*
z-96y$j*kruFS^eqekbU4D4nL&@2oJh-~&%
z42QYM&uWfWELw{lio}`u>_U%h?~z7p14YPlM-iEu+$th+l0=(Mj+?lA|ulGkalt{MT0&9JQ?
z2w;%EOuOloK27lBaum!6*M^FgJ6J>8!*D&*7n)|>i}by^vp-gIuojMNFELd|7TYeEC1^>h@hyMV2wlaj
zr^pJ8qv`H1_Yc7em^}eoaN}5$Ak18J?u7X-Dg5bI1(cPCeBI+^TXRu~vnVNE?
zMd+8wG;DIC5$3*SPQ@~W{K-;YDdnsjxe?)#rAf_$t>92e
z^soq9t6L+vvzT4`xQRjTLdjiAdH`!%CP>y&~y-P92YI0P()d$R}{rrwOKLrP@w>ImNDE?Tu=){tKEosHqg5##U|&ssb7xbX0R
zAAa`u$!A}G_SxO1pFMo``RiAADa$vA;}~%qw>O918uo_XDzb8}0;7%_sd;S|@#8e_0n
zYtiT)OVy`H6C+deF%^=b3bQgJ+!9J&RXp2T%V1+%)@rVAKF-F}S{q?GSC^(IO;oQTEAhq?}H7c<1q6npN{A=nHagli?1k=|fN5qMNOi3Twz!792-ZCicqHaF6h{mZl-2;^ir(
z6o7iPnYr(y`By^sXb(7JPRAVFELAkEurlq>S
z_fAA8g2UtdH6Akk_uI|gDPXfFszgM&3!^5Ggj`F#flWhUJ7@RZc`6x(wnKC+RUM(^
zgfs;EpXqmW;o81e$y%PnnQbIKsvdSfN=uP4XC0PqSHcGuvd2
zQIog)_ULJ$QHyhuHmE-`*lDxoMxpeneD5Obci<#ah=|C_mCM~?4DAxo$3Ec@Yf0OF
zi1y(p$#@AN2v=%bkuipR{Hl5dT8v7DM^R0rjbmJ|>4zIF+!d-JW_80q!tfd*_pmIQ
zX-B9@>uY8nA$?^;D0oScPBHY$f~1e|2#+x$#t0j3GO>;kBgQc<&&F3@<8aU)C)x^~ljx=m;
zD7Y&wl4NaPh&k&7aGwkgCIVEQa+xoM!G3
zdmse0-_=aI9Kg)CQLzy;!+xazQUJe_$p$1_5{x9tMxT2gM#ZUlpS_KHlVUZa_2|HM
z5J3y{RBVdUJy3P&Olf|KblMMC7gyL;Sim>KV7AX=NLP*h8(V?azuq=P&9m;gdw8Up
z#9sQRdeTL5V<*N!sIL-BkPY9PKmpNxD*cTL^8B~8H4o}yeEWW^kHN+~bqKDd=Dbi|
zU<59QKYt$DH&ev@6<>V0e*PD~`SR2IPrrWsgO6W-_0_u01(-7;hFjcTF1Wx<>yC7a
zgN4ePYt>4c6?uKUcJYVe40|`vT5DyJJdR_nByH6a$sZoMl7+RBj*=+XAaOTKG*M8eGh*lhoXZ7@EToxV=Ol6N)iz_qaQC(5TD^-8M9CU!l3`~Fm}VniInwbI7iIwj&D-~?Be+A2uMn*D5?w2yYVv!g~R
z*_Eo1AWjtu4__-|h?Q-LW_XB$t(7`V1^4Lp`UVxZ7$Nph#H?0RGpQZD%>=jvqJYcz
zpo37%A$r^C)ghL}B#y%r?(G9Ku0mK1v*Gsaz~vo(b&vapdQ2;L|}@BirY=Wjneyb@+tR#j4_HE7$If?lNn
zK(v@Be2c#N;HY-*>z@=lT+xR&*r(^ONm(n>PeC07MIt<`38(JL^cy!rwP$5Cc-lBN
zcMsn~Ko3UjKh*kFbIBao{FrHWc$x*w_IIHsxkh&M|J{5KzUj8dY$>F~;sQX+#M~vS
z@3vYdppGHhe`(4yK;gT>mrbcxjua=#v(MSbx>3oaW6!ZP^OY&>d(X}rjne~Vrc5YN
z$*I8x{Z>e&%~KA(F-wy|m1VmLfGMtkzQ51Y^k94vFrbwKA-+Tu-!``WO>K`@yE`4l#G_?5c7fEp;=%OlcivR+;D{ya_|~%{uT>tJTI3
zEZU8ynZzE7UhGG#C_bJdW6ce*f2RJp7M;_=dYht`wJ(>%S~-qE?7(aGXV#h%!M#RB
zk|?u|<|h2lM_|jp^{2nVCwqh|D|if1#CT&+bK%ZIY0~D$F>Vf@*L?S7{KlUew*zxh
zwV){jy*z4rcdakQ7nNl(ml)CB8|H3v%8-myxNAZ4xGM*5v_{wJX|ttLQK9$;?qX1M
zN2Us~fxQO>T8^^BiK!RK_CiEwIKwQntl;itB_wZ*xX#5Y4^tdP0Afk?rcg>h(Sdt`
zEc=kKK;no*<1mu%S(^a60$BT$B5Sc~2-7pqs)$G>
zmeM-DFWG#1tC5|onrX+;)JoRcncKONU4c=>h=_K-kVS{*O2A?SSbKROiJd=d;SqA-
zL2g2}04&hU>okg2u~LkyeRJiyz`?_877NHidB@@QxCLy(Bh1W42P8^P1ov$$-=>JY
zoEH0k*0LB17ikPY&OQZGyMl#x9WT)dy6g&3QS5eYXw`Tw^WzC*7B}6oBLu3au?Qo)
zib#6c$)vI!J;vVBrXO-*0bOb+JOxrDDx5*V8=5rsEZQ0~VCVK}k;Vo$`Nm5LvX~en
z5LJr?nMHb0@R~J_FgUQVSzmOxDBQhT*HHaOSi{e!?y+Zb!)8rQs#kOb=sCpF44o@m
zz#g${)j0eZcHH=gAAa)s<4<0H^2yzoUq8OOpSf7e;s`T8#?9?<
zJ1%Z?veW4Wgy*%nxB}+Gq+3=ISP!#`kS?I4tG8C$K52G%clRis?eTiezp8m(
zkJEj)+sZ_>*hDNxu1N_v$-FKFt;vn-W3YgrB(HM`xtxzv#bnN2)mDqij1lgB
zohyqG1D$Va3O2-G2C;cfRw{2OoX(
z;rD**{rBH_=dI_r#}UT`A+;Ca4!3fcJ0ik71R6zzIb5=$@X95C)g&oYXb{XJ48Ahs
zVrx~H`3R=AyqaWYm9oPD(L#4?$q6f!b%ZL8;d5#?X|#%=Sj7>+qM{I_?&_dm)yV3(
zNV&Bdj&e&dLbKC8;(M78fvgcG97H-{O(U6-Wbb#s+pPXD(u!oIPKU;-&h{=(n4=Sh
z&txP3%*_W9owZvc2Dde?SD5O2f3gZ@>uz=f?_^cSU#qIQj}bRF@$7co-W-BTALhC~
zuKP#AaC02bZg1ba9pSh>T)+J4;nnL$z;13Yd&podbcj*WU0ceE8`
zEbRXLNm*Ga?T{IAwcUN>^7y5SG~~2!!5w?}ua;cA*mb8(0G{MZ`E*L@|6|zg?TA-cx?tC_`d)U_Y%-
zJPGXtI`rq5@E^K6TjFaTzE;5;&PuM%3=HcdKoP_Sx?99?095X~xx>9(nSyTxV|a6|
z!`$6j@Zsjs4YFPUcdhi)2Z$rWT^s5yH}Tayf5Wf1{OH?;j{MPt+h3gxl5NnBR~Xup0|D`&7xb9q4yw!5qQ;Ra9a8!@uBSZPZHUUv7X;aXEVN8e4xE_
z8$bXHSWRAbSGNgIHFo9)YE}$aY#z4L*tbPTO8DIe5I|;);a!w-X_bD<8q=#4V6b9+FuOdsPpRNJ`J-k&SAa-z(
zsT^Y$Qm7D1J*)Xa0|+8K!d6n!A;mCCg>%}^G)9X2mI#qs4AKvCmb=UNtv^Bw40_bW
zu4N6+S(iO;ubq(e^NF3;iV+*qVm}O3d8*UR2)i79bK@_bxw~cI{t>V4`1$AepMHAx
z>1W@3`o-%nzPP`;W|fBxx40bR<~aPufc6}_d9GZmm}zcvW-&oz)mjUrcDJ~BC9ZRo
z;>EP8YOgM=OgFD;V9UZ3q$Hc-%nTbn{R3<~Mc@vHN$Owm~;mjyPz-R+VaS;cHPsZkLsMaj(8
zT1tmdW{gX?fDN>30`pL02n=LqW^uKLwT(z{cewlTzyTm1UyppJ_gRR^Rrv8-;eMws%e!V9#JXvwx33mn7E&OKFzO$vF)BvLU#c{V$73PXu~
zSuxz)YGx*5G~jN#El{DAM#jSA`ssF~D@=pt+=eN5D-()}IoLXUf~1Ef`zVC4<_^AS
zlnTAs6}zP|dqWo3zFeFS5%lv#nbG*B@OsbEfYR%rbXbVGmUh~`lLB;8
z)R*br6GoQ9s+C0DNc-kp-92mdsa6!_PUWb%Z24_+_I^rRZ>-ig!kf6-QY#<&vjg##-#zl~j;rFE2RuAp-~ZOL|MBntU4Prp{fht2fA5d~hyUKc
z|06%~V-fN2@J+|}m|5vM5vZ*w-R5blZnYgof8&MFGpO@rk3yP6lt7QC-Mp@M$NFLJ
zFQjFk%6)FHUylKe(40-Xqpj5HQ5y6CdYw(E*?56v=q|p;n)85W_b{;iX|O}z
zqb-1REzZ~~#oV0N4v(_UYxaGIIttp=z)i~+cN#UH
zK0iB*t7^B9y$isedR3ArOLNn4DR@r>hP8naJB8*DMAmPhlH5rO1-#
zTw0oH+=aU{-O`%P-Qh&$tg#!)9;2Uo>d0k6L!p>tUpF$%e7~D~QmpHSyJ07J>Rbd^
zvs)9jr{=Qt%6gAkeMZNX06iFUH9JLOj~n}iZjj@3o@H~Ma8?qn(
zH^T^IjY^1?y>#;(0jjqr3}=nTbwpG_KDL&A>{USrgX5Frs0p
z@t&J*5b&#d=h$Hzz9T4dKNUL3c(xYW*k|%;0vjr}enA?cQ%%op9dCq4i>LLoput^y
zCeWg2=`}=yo9%oK+2p!S-%ETA65xywR=X@FgBjxnCS
zcs5+>zGPJu(hYO9>(kw@k5fAj0nC*k<-rzlnrlUb$mCS$Ko(bKmd7Bt?jIw3k;P@^
z%w(#t)tYPRG#I=-W(T^g1Z%D|y1CWL+J|OmOTe-!SH^GAXlq
zU=)iL?#P;JDvF?TX&tLaRAJ?HjKf{TX^HWhxv+J?+9t2n#Q#64{x#OpbxRL}o@b2r
zn{(B@YVWGr`&|0ocH0hZ2PX!%NP@w#1yX(>3!z9LjQBxh3^u#uGBUppa#Xzh9Gx=pDUNkpzde_(gYgL=H2uYkjS2Ybj5u
z#D^mHhqbh)d&<^50ah_ZqH?$zJ{@#3)4wIKB73O#B2ns63bvVRkszItU5z3EP{uEa
zoax^71icGjY1?`PF=5?m*5wCw-<_4Ust(D4JFHuG?p+K%RBV_iI7F_=%&8++{Fho@
ziHl_o%!=Dvk^OX|o87-U-n%+(!xQ*;o8P=U{q0|R_rtH=fAQ5fZ{B|V=EM2scE;2V
z4(H~6C6YNZZ?ET@H`jmj7ryxmfAN>E4*1PK``zF1+kWQ9f8^6&`Qf|Uo73^Qfy|jo
zqs$2Tv$Vo93)Oy6qDj#ZRHOvmoMyf_FRUV^UBQCz>|%DnWtuLV*1JIQ8l6@BPIEE9
za_sMWD9=e(j977vV9m@Zx|_Mpb5xZAPBT-qxq?;{tf0XjbJk&_8~3Ov6!83$;}3r2
zL*~%+ETrCGHaMdOXsns(Yv7;x5E`QJr{)X_a1AJ7RzU%?Q6!=k@etUndOU0ZRyoSa
zjeLBcoAJX<-JX&MzIl6oaL@n2-|=gH_SgRR{_sEgFaK};m4D;K%cl>YKEA&B5HU%!
zVVMaH0F&E}4Qin0)-JMs;o7sf%^_%kP>!KlNL`MOwoyLMn2y9kX2_h(o!E*RaG1>Mn=M0(V)ou$*;GA8E`A
zz(l$!@KLJ5AZg}vu0$fN;R*yU!cKW()$`oRGFyRjX@i6dghF-YC0KZAKRTUH67sD)
zC;2JwezALz#9cS9)sKZiF5}hz->;=Zv;GlWZ6&&y)Tivnj)n2Np%lWQdv|?eiT*;<
z+w|SEywpW6FxZG}^s*HBQ{@hl9p>szEbHY|1sXMrx4qm;o5wssf0>b}wR&o;&|cXRX2eE8vN`*^PJKR^EZ&upM}KnFT6
zGz*)~ULEW@dZ-JjP;>{PA}T_&D;f#bO`ymYbH$zaXv#p+
z$cnk-Qc5d{0%^l8VW+BbP%UyQtE`eycCHK*i4v!bq51EppSNRD7Qklkd%V?2gf8RA1aT(pa+HSO~$#-H_RYe5NX&MK3F$hWE
z(TD!!7}Ec%%7QI5jRd+>H1oT?UJN?10Xq=n1P*KEsCKZ9{L$w?1i*fSp)&6RD;c!L
zs#{lTc1V3IQc?tydrJWHuvNRf8f7a!Bml@QruVCGZ#B2)O2Zh2
ztc+@;6`%3s-HptpnY9<&k6*yhm218CxA^jTvI$
zwTjg7p$?{9BzBwVH0*tX+?`&Z^}X#X~VeV;YEU7j(O
z66s?^)XnwndEbx6t2y&@I_Y>;HLXBwK!%ciX!OOL?habbY(xvx0OZP&;6IT95VL@Q
z4_{491IjcqkriW%I-@Gx97K<RLRvN(`Y2t>ti)SxiK7IM(>C>kVAKt&Z
zI*jc&+{#-3DK&bb^0*ODg2J%o&;)Wa3vRX@`i}ATkBu(H(6f$~1XR=(hm=ayN{2Sl
z0LsEqp{AtvF6&9^>|3{3v&}t=p^z9ooU_34;h#(f9LBjzWnA_zWDl!FF$5fXfFc;Gn8xGPmc`iXw4eXNU;5?0^jCiQKlM9*{cr#Ke)_{V
z-@N;<-#Z>9zmd#m)r#xMl3FBL@Zk*187AGgAqz9YshpYRChIwtC4Y@{;OxpwE72}9
zL(DuP6rfOTAx19YX0=bnj{4-W
zjf0<~j#}GUifs0!t<7cq&6MUYx6$cDMkb+dV1?T&TLb`xFXn7T>lu_wOtOW`uZ_MC1t_gXmY%`h1BlaY`^-3xS
zDC2Ern6>nXbQ+N}BAiIIj-lb%7Bl-nw+U4+r(FP8C<4%!A*dMLdr0lf<$u$g$%IN$
zbLH#0xb#F2?gPurtQ(PKMVdKanH*zqg-p<00%NLScH1;97Ukp^ZiG3@rHAY!y7tJx=wQ5BCd@5BpjgbQTCw^6ety?x%QwadOE
z@-j(sCS(CF95zAYImSroP(e4&Ibr5QpTF;^%o0V6WOdAJ^cDj$0*xZ;5^Hj}k1vvD
zF(+w}b3yV|RdiE-iovg04H}K3JG{?{Anf0(`A*RfQrmi
zPzoYD7D%wGUiw=0cWt5;Swxz149=O=v#)9e%FERwe!Bnq{+WhMQJdNpHG4gyveK~5
zY2im0FoHHT6}==ni4-4UBkATSm=qW
zJ?7*X9K+^JqtV*}qrOr6Km%ZRuyk=@xvhU%_8wKq%SN$8T`PA@5;#agvu9Km=s_E}
zI@swx_lYvP
zWD8grHx>@fRAE7%d(tX171P~OrR4ecJhoAV{k+>|=8nv{Cmm+o&%3#sF*0WC3NfzA
z=$VWb8s%NNpBpvU_dToRTo}U(N}#RK%+WpD_+-%#n<8fSF
z4IdtX_wV;#{qp7qzxu-;{P3GsuRgy0`sVs(&wwf2Wccy;;Gw&3;sz>WMpj0|oacEG
zV17QIGo?N(!GG?4@803wy~EAz?Z5h`{>tC{4_^K5f9N;A{B*p2eSN%l)y4@nfR|YU
zkp)pz!p-L1$x)Xp&&XsJQIY1>sftnokuZ$m0xM^zjI<&$Lud$x&s{R@ZnI;LRl*@6
zT!S7KPDHX-T~uY7k8K;L+dZXgEBfa8kjli8F(*^TX(B6U!7ZX}a2V!}Gwb0IPaYoL
zygnV=quIZzs{Is)qi2;Obwss9B$@kO<~op|*s5C9d7EeqkTkOAjxnR)M1n~SAS+gf
z6X$g2Hf%T^-{aM0?>^Mc3ERNycl(pahyVIN{BytM@A>in+8_L9|Gj_r|Ni}-`tfmf
zb-w)w8hv6_vgmwEiLlgpwm=DNRb&A@s1(-5ht8S-sg#FS#In@~mwvUYesyzb#nY-F
z7oVoU)4DTeidlF4$w5`KipvO7tNOUWd#i45wP#Z))>XzTEA)Y~
z2TtTdE7maiT(!LQU}r+bzlk*tb(u)A&pNJAnzdePGilH>PcxTg#SFuIgp^1XV{B5C
z=?j_}vP77eZ8VBJR3j=nNj!vnhuzDd#hh4NX`yJS6=zpn&-L;ZPEOio9GUo`eg`xa
zbIpXZr`-u9szplo`xh;^^xv2Ez6(J@oNqsoUJ|(2lOf3zzO_%>)Tm!9vhJ?>sr~(u
zG&jd8dZ5-?L{-unqtLq+o*;34^rBjtexNi(di{{hSUKN~hL%BSv?8P<3rtNqDah6x
zU9rpb;zD=iTn?S@B*~@m$hZ*51tikSNSP!v?|h!MPB!Ke9JA#I`UWh~%TTAT0X_KU+#l6;Rwc3w@0_AAl=M{TP}07n~&K(U-a-Z4yK`jm~#jF>2(wa|V2>kgPv*(uhXGb5w=rC6b=GEw_J
zA^)TX#G6r39Z^Q^A`{Kfd>1mrA2Ic9#hQR1D*=OEZ6_s&P;
zn3=5FcWA{!?^ppLGDx?fk|gv5`m*c`Tc4k8rs)(u)Fok_)H9S1T?e9hAA@Qy>ymV$
z)7#ogl$mqZ;b1OFQ{$bQwWIplqSC6Y4+ITFB}|DL)WqjnjtcD%(}csBJ`9yPFKBL`
zevk!mSO&6+Su|uMYMtVMM%AG@TRWp8CN6N34k3jmh{BW;n0HoKEhphOnyp%ziMrjh
z<6%2)PRH$z_t$vy>h$*O+poTQ|K-=$uU~(>zL|3`Hzx@9Jsgsu-$-p(JD<<{J{y6o6g`-!VQcF7BTtiN-0Xb2r{!>;
zF~Mdss~t5${zql*a~8^oo0}WuDn!QerT_<5jFR{5DW7P
z=@?_)MfDab6}wuV%@`HB!=o7#)9I%6E-Ux*2@qRegh}iNW9>5wLqtQgKm#q*&q!p(
zzMnH@HAbB6>l;Q8WfgPI{dBs$y}h})J?;CskcWdke01;S=TAQU^zqA=&tATK_WYAi
z9zVQ)@BTO*%-tyjLOB2^Hz9*tRr%oXp%v|S`9`A;bF<1)Sc9QKOdE~Ewv)9h6lUhQ
z46SKeNdiJ~l?vr+j|@mfHV$`fH{XW7Y*kN$5}Jc16<}@#-R31J?;6ZbkQEik?7lZI
zOh~Pr(v@-B7kls2C53oh=x&74QWw7}Eyu3f#}TfSA~4RbARYF+?PNv|Z2KNgR*c
zqld?P$Cv+)zw*l;KHUCS|I0u3?Ag_ucenSh?qvj4X%{hRVp3|MkYQ#sCTZ@zu&1Wt
zGqlvp%?*t9W7!Hh6gJg0apMSe@q)Ja2#Yn>TN|3q;gwMf`D$p}oX~WuodAYA-C_o;
z?R7K>A8qu_IDQsZv&F+u1*>$cm~s>(!tN%5f_djmFJ+wYfd6_t$kgXSsd-KJH)Hf9yZ{
z-GBSf{GmVa-~HGArGMdn_u{*sJ$U-`_WGNeMN`UDwk^9E7!pw14AS63tjeXY`0
zbB)jaw&Y}8^a^JJ$c11PVK5b(1qb7~i3oK=tH-u3qAN2ISwRV#%-B$}t=rtHDl)x?
zMQcW@#8yR`V3#U|HuO))<;~8j5jousa;r$G0#M|BRb@pnooUUeZ2+#UAN|lwfRmO>t=q
zs>RHAEpv7c+3)#IB&uFo!j(k~b&IQxBPDzjW!6&7?r9WRLbBb-IW%wywQOmuDjOs<
z3NOdl*n?QLu+daPli(dImVIEFR-Lv>S_y{FT#q7CO|Nc|S{j6=sLf>=>I$xUnAjM@
zeau->WaSJDkfyQN03yrRDDYKQ2Q}`+%vOxG`at#enndExh;(1HaKXpMVnxC{3q6>G
zs!63mw;44yj|d=1`nFZ2aie)=ifA)8(t9_XgY;oEtD=u_IE=5}@BfM4eE)k78A~}}
zkX1u$cBx2gYyy;RTUWIVr>d)@_+>i`yOo6oq}P%vLE%i7tYZj6w9&BgR|=bpWVhMjADuP$~szrxrUJUv6cvz4Fu4qKnsU0DMMrU1C1RGVF3wC~
z49Es7&3Lt(!DrMkEJPeR5r$Emg{PAK<^t761R7USOp)JiIQCQ(h?^N
zHD|QL0O$p_NENcvy$Yaa;+T<@kr^;EA5sT|D)~OW`l^+Y5K>E1iVU+tb$oG`Ihau}
zE(oUKLXo9Ix7Qx#&efS~5u!hBwPQf?k4zNyy>dl;xbraV>R`vC4QCW?&v^GPe&JWH
zzxd+gtGCy$-`>3cIQQGAFfe_%k8$t*Jr}hmrZzIN=8RJ+a;)}U3SGpU5mO=9*-*BI
zXvkdGJ6E(SGU-jK0G#_iBU^`UPGmAZnVr){SUHf%r3$@l#xcG8p4+Aukr?>l2)W`XR1j>
zWu^`j?A=Y8X9QbVC^k~9i)Ahklh#<4Q1r+^t$4QR0h_W3h=}X)DbbdkoY`~2dWpk_
z8@caMkyxg2m8WWqDfz>4V1kf=MeL7`uVVIaZ<2)A71m1Rrj@kZi{mNTH!kv5wFFAk
zQ*R)CC@W|5WXURbKODz{ZS&2q4nBqj_~ClK`Fj8A)w?fVee>n3_pe@k{P6KSBcXt{
zVdnRqJR0U!AflpXR)ZqSNr{N8j9GIE>B>20HsxP4BleEfbhq<4HCwT6cU3H>Ydm;(
z{P7=q`Pcr&5C7SJ@h|<}|H|L@@Iig}aC>#N6&R6jbobD?&y^a8o^Wes5#eKSUGY$W
zS;U+`ML
zK7u+bTvCg%d9OX=z9$dP!anP2Sc_SR37iw3JR9bAI?b!AZB2c5G9wBz8;n(l2bh3>
z*6bl7;o=SGZE?q?`^YHtlsgnFL;)$?aCRbC5k)2#iL4rqZQ$7>e!TUM*Ku2{bM3Kz
z_Wb@o{m1_EfA`P+)Ia`5|M>0A51xPL^XuCWc@Ckb9nL6^pUKb<1B#0*J`VsZjkdsvDbTAw+#;
zSG*z`8xj|XYqYE^q-JEAH?Eya$+v!HDrYKsnugG*MxY4xq)=Ia^G=1R>O!sJ#ov1=
z8qoxKwYFDWwB&n&{79n>&0;chYcD|`wPQ%MlWxBGR=u&qbP*Zn4A)7&(k<05UF0PV
zgG;Z|)Fr<4t6QE%3uHmHCMuhL(wWu7wcw&l90>1LL3f&1uF)!km_}+kwFJZ8`a}J4
zo20nV@VxwoaZw!_)~z{m%>#pL6worcw~JYETD4fnl$I5Q#@Cm;Yl7y0^v=~<_|00o
z)*ZM!sMQkqDp+&1m=Se>sMnBX0lQeF=-O(Pm4gE-(5&@l1uAkBu4`42N)-~B>E^Vd
zAJve}LO0DjWYw3{DJv_*;psHi_Un?MD#3CaR?QBGfhu%9hd4SKqp>uQmOznJrAcTI
zM=-Xr9U2cFL;dPFjBV?%lWj9FuMYg#pB`5S#@-xF11vwbd2iI$P
zpHYf0<_s9(97UKjbH-j{7@&V`YlKc8nKjI8Ba2pf7V4xQrQ@KAK6*tpQe<^eBbZ@E
z5u6#rhkB&pO{4ibuS>9>NI+Wyu!Ln2t7cYTx%dD*K9yr2FNp7~0ysF(i{sdowY9v0d^a)R|`{BU$UuGq{>YKWuT;tlD|lJ3AEeg0Ubm7y#~u*U>HqA
z3eW@pE^l9>`KmfXqOmp|hs}ioB*ph-LRDPfT@cKV7PIslDro`P!NMs3ZtkKI%UtLc
zz{)5aR%^N`Nf;A7e_gvf;-Yp&0=UHawz?H8Qij+pEcO5>uE9}#NM=nXt&yx61KZ|@
zqaU1OV;0U6A3oxXug-5?zkBud$1h%8zj=H5cr*9R47!bNjBUHRdZ>3^>wd+YftdRq
z+Gmm6_r0U^B8A$_43=_{W<}aI=9DNhy=5jnLn5LSABl*_GHL73n97K)+%ubU6V0y;df@N03v2ZFT?Zgp1Egr
zS~;rRD6KYu%9yd=eEe{_z24_3B7FG6NB6(`{ZC%J_~iK~k3aqN@v|onA3eN(|NeG7
zY@4@=&8$Qr395IJcHn9}Huq)`-Iavb&eU2ZW+h=h+|46Hx@gmcgSC&ELJxp7hGhn&
zRI04HGi#B|<UVAmcU)?RdlD@f9+EGwUSw&j+<;3
zJ%C!LE_4O25nM#Ztcd9A*Lm3d(eZFRHi>#V<;M^ES6_bk>do!z*VkXY{_y(in~xuJ
z?j=X|BL_GzxVd~O~r(5RargpyW=T)d911F
zSTUcr>eT*MGlG#3h{JZ!zU$(kCo{E9Lr=ZdAH>pce@h})(n^fs7lpanB%s&ch3QdI
z9hq)QwE&G8)tCym7qgCrz>pDjg
zeDn4B*^|TX|2_Y}Z~l!x_WS<8Kl4}r`d|ItPkh(S&o|dyhg2q#JuyXs*uKi^LLsi%
zfqLleo@8_dX&_A6)5Qv}7NiAiNl?;0^f>y`B7lN>8ctr_G2m-|tASW~MFlfeGlJq*
z`oF0;xU>K&%|d*xfhGN&N`Usp%N)Q8Je?dfo@OMk9HxJX8dg%EF!D!4mc
z_TVOyOS4&~Uk6}|1^Whc0rSWzg;GS&O#`7jFnQJKE$Npux@jp>
zA7*1PTiJ4?W{h($#ZFYN{_m#-iqa$n$<+1Fn%T)oj*=3R$}H{TKLYzqeQH_w1-MaBzzwLd
zQ2Sm|RL)uEsAzLS&X#BEw`GaVrqs)3yx0izAJ&fTTEKSe*=qGsLJ>*M8E$=LnVSF+
zpmal_7^!rVTuq7Spfv{_J5+vq6
z7mCz@Gs1J2JfF_nVVmda!wS6}Q^Uo()Z`LD0M)Z+*X7fzA|lOP^hAN%rfCql`Ovy9
z(!ve^fjHMV+Q(TpiF<^joScO~Pe||bRaJe1#Dy%GDf;=Zi0Q^SOe&GCKJ;1lJr}|P
zr8RgzUS?@@aOWlZf;nlO8j9+CX(1b23$KIlG~7%F36Qe{F4QtA=h9PDdp?@_*6t{j
z4d$$D&i0~x#W)OAF2G8~STUjMZME7PCu;n-b!C*gL??UoXwZzZO+$LitVDq~{8pNo
z!2-5HA3PqpjdAZFBMUxW-vrw{M<^KH%<=0>+++cpkY2Uo3T
zXm!axXGWA+>^;*Zqof#$nVCo;BXjCqB4*5`BAE)>Jm-%y(MHTH89L~=$!
zgWYj^eJfsjo?6?y3d+-_eRQrBfQ?z6~D)e9m(tR6V8T-E9o^JQs+tc}W-**sK$L;Zxhu`_$XD?np
z`|QQ1&p&0aZg2
zT)*XN%PfWCi7RUlkuHTcy<1M?OdICpjF=I_y*hQNr=Z#Tnsy03$yE+TB4|TtJ>rQf
z75+TCDUF$GzOp(LKm&5R8r1Qt^;%6cHvZ5AdEs2~n0|`{@yBs;0Gb2Nh(nZBm
zpA}pZIW-Kpsx+q6%yV`xwa3|L18s;CW$$M}iNT@-^cO8Iv`3Lu*0Sp>;y%E(sVfY_>D8+*KWuZDr90
zEVm92E+C_3!AW{Wz?WMM)lcY1C@zL9tN&9Y>)WiWY^c3?r*=@A6$*!{tx`v
z|MAcKk>B%&{-yuJ|Mt&5|Ne`s`;ShyA5ekz)h-NIXI?j>t@FI7B$YW+8C9fPb@IN(
zpm6n`b=Pf$(C987^z?Xnn`%B&ha(bbZFvgXF7ybxh;>G5GXvEZzI8GW
za2G5pJ*OEu{G<;Awb@EZQ!}V@wOfFt4Hk#n)k7gt!&;+zX=E;pRp>%?6Q0WpS^5Bx
znp9Fs0~NfLnFX{>LXT9vcC!_mS(p7fPv#?y^WCQlrLbb(!PDmZkz_=1ux_
z;1EkXrc3LSAWc4s%o13D))cL449)a<%lOLORX4kPw%1XoBEd4cL=zTVCB5p3$qj71Y
z`KV$6?yh7scN+>#0eo;f_&D0>Hh$BuyLx(L&VEf?Z(Qqe^{ZSPsa4ofSG&x$j}t0ih(N0(3)&W-JJA>Zt#2#Za;{2|6bhG(Z%_;GD?Fxzhwa+EQ`I
zHN9ZCeP(6anu@@lJS;Ln?4_o=DsO{sYX*Be(?F-yI%~4Bib&8iC#j92FOAIHw!_@d
zI_b8}W4|B?=Eef%gpX0koY|m3H)25JH>mH`xG9!vwrhvpC=FerkMdO=0tP1K9cZH2I=%(0skxUha*d8K
zK@{=b5>Oda&@z-quo2&)u1_(xH;q9
zhx(;oy?OiQ=Iy(iuiu^Dyg6N;V(xt^`!M&z)jfBEx{4~!IWu%63z6*_dhRhL4`juZ
z#$IEAs)#ugsGJ3q)?`*8D)zA9GgAC(RoO)5Fe|h+;f`pBIKLU0a_?#
z1*H+~8?Dl0a?>Px-%jTf_vvo#KKDlVGouQI0aT%)B60
z+~J8JN`PNUVN$X07&WiM5%XLyqY-gzCu$ZBq$J{QqpjKHKVumuh
zBtB%5GLl`i?!(PMhP=3aXi+YBO}H(T0v2SmwbXRUCbBN~{^FDfRNEZIK2hJcmU|a{
z#7Y9vB8IF&&K4ex;m5<+wsCcDyE<4EPm|w#n7{nh%~xN&`QcaZU%kG5_x|+p<9^;V
zvz&Ar=7+1z{HXJ?=pgKTp6Ao7Vr9-bMNC9wyKOSFa?X(S07PfQksawWr51xAvdCF&
zv1=-^7BH-Rq3?n!SYRe_03zOhxPNu^_UrMl|G9tf*Zs`r_a7W?PV?$;=mMlf9){Bi
z(~O2yDnqBG+0r{?nmH8W*iA%oA>kUgzVFf38xc{0VRWc372^t$m26mrS}pOB*#62@
zq=TsHtZXA1Vb_l6jM|o|0z^a%w?aj-#XdS{jahX&`TWz(HoGi5p~iHg1D2M#onlto
zGo^!9**eYpU8s@jud^6^p+l&`RCC#)5EA8snaQ%U62`Qn3OEdI&Zqad5!a`>ovc&L
z89(y9NB^t;`G4u3_}QQMWB=oS;dFieoCaEx22Ao!XKF3?Q_l=`ubb=4>(WBDd?R!5x0ilR
z<{G&K#OSnPxe?48hFBJ_
z#S588Gkv;M*y(kvDGt2Uj{1ALMUxa#
zYLs?|E`3a+v}&gpN3()WSecE;3h+#QxjV;fpVU3-R`YnUuIQ>Pj^S9~YY83gW1|qw
zi)R0Ra?J`SE)Aj4Scq!eB0>=gos>|mugi?;F*yxE$l7Evrz|=;fU44b(?m_I$!01e
zReZz@b2oGSgM6)H8|~32Rk>z%NWZal?JHw_Q@w0vecauV>Iz|EB?1bBQeX^xw4K=8
zeT}LxwTVVjO0OP!BZk2b8^JMnn(@h#!*BS};f`!i*@DQL;VG2?(me^ss+0vcrM`{X
zsRr{b3@L$hw+vKtzk!7%5y*C@pt9y(bVFh|LC#Z(*rS`VN^!gn=vd9pBxBPhjc?5v
zG2xqaJFSD;DiR^WMdqlcSJ35>u0-VruJ97Bwam+u9Me#oixD?nHrGrP%rz4RT+=~h
ziSse`^SLss+=lI^-OK>XIg=0@tTL=nsw7K!dZ^gbMh}@JnU!%4)1lG0OwIE&g+Gg%
zEd|7BkT2<$GYT5v==+Rjcu-D@JurN+69}Zl0f)_JwiG=hJJL=z5OY%|En1bj@6kyT
zMWkcX{{Oj^Cmx$yv2b
z|3;2sIr|+%04R5Hq|Nq|C0e`nu;Nn4hVtb3EcrQ2xx{KZE6Y$YR1_Qp*8*Hof$f#)
z_0%SIc@Si9?S$%{$fwh5;m9hwQO$KjrHSqWCTnSz*a1AfcDqLDg`o~E&1?+2y5e!$
zw$0q(#3}Lq1Agg;=QnR|zI^@h)!UD6Utizc%o#vgfj)-Y7=AolnP!S$DW+z`em>7g
z6e2SMnG>`&4JHZ|Gb1x%!l*c?b?sMz`+0A_nOW>fDx4Vr=6Q;J+9Q+-Hx)Q8!+BNB
z)tg7{dqf6}=A8S?Op)XT?B{92%-GSptU32>8&dI=Qs0L&gyTrlWie+-HB+haFp11a
zVZjkdNhB1j8A&2EeX;U#nw?Mk7$q;Kn7VHXjEcm*2LX3?cUhi{zCr+y8FOmYR;Gd>
zGiFbKCVIwW->Aqr_w)7b&FOqT@B4nv+z*HC(Zl=S`R=plFMr~*=g(feeD>_g!zYjK
z-M@cz96koL#C%BSss2-Uf@z@=P!~&rW=>P%DmKR)O~jj`l29lvz|mG@89NP8sWw2>
zrn9A_L`XNMQ-VWW@I+))xp_3~X_t|knnkI@w#0cVLvbam`>>dI)%UiIo)V!g?AC)u
z$egJp8!qphSzAD5R_uOqDwMHZfvv0=-JNC!u=VAoIC_Dn<{FgM_p%D>T<5TUtadl6
zW_B{)qLMLZtv*n198(|yfXuyDN1N!b4%_kJ)xCRT33{)Jz8_vKd~zI^rZ
z_1oL`@6YGcT0X`xwr$%ETieXo9DQchJnvZ%nR8}FYPG8opL534L`KG%_mZKsIt|4I
zfsD4wf>ohBezZ8wn6V2b+(XS`MNDNz$N?)|TP61WydAcUA+N|P+lh+qwCr;C
zX$8uD0MdbkQj3k)XQ2w455t2i8yh}crz{|+ulJ{qum1ag=y(3Tzwsyj;2-|uf9G%g
z{Ez+Q_r^G%&)4QoSk76M^nu7MMFDsCnVFUPGP4jYkEOd51u242g$k;LGwT@1Z%sVD
z;9G`em{CMxw?ZwaYJ(WFRZec={Upy&9U=jLZ<ErbT&_~(=I4!o+zxZ
zZ|=fG^^|CS`9WC7REef+?Tz4|ib_+GRGTo{I9H3A6{jrpy0v&h24LujgQagOZ>sRzsr7H_M}_R@NhBh3
z8>3nr(EK4y8Z8A~c!iA6xf*i){4(m)=)*ysw!6<6hwU(DDE~l9jn+}4TFR(0AKFe_
zrj!e-8JSX*i!;Ik14vc|eRCUYVuwNDDg32v?n0kF#1_mi2Gx~vZHRO~5qrFp|GT-id)OzWm0
zmeO{AI-;
z33Ei0$`qFMCjnfu%huFEcr&(Rm^-E8A=zS!tc5F!u@qKkjeJY-yX>s07o$?kJF1XH
zGdE7H&L*p^YYl*eFpEfiB(2c(zzEQUhnX=#{i-G>>0Ybml(K}qBA4W(#0-!Q6-nyp
zQC$F4RYc7Y_y>0z!yexAdq<98d*bF6U%s7h-(A0cee>qc&8s&zU%$Kgcs(NtV7LvM
z`*s+vks&(nK}5`XuFRSdb4Es?qBOoMvx}rXs>(NGaPCusxGI9QI8OlPoaY$FLq^V+
znK^eUD!Yxpoab7E-M{rBPtc`Cp8M36(bSAtp&S|=P6cF!m4G2lY%<{~k<&XZB4QEU
zx;JTSxG~o_Vd&&st%(^u_&_j0_k=E
z6m!Ph_YS&fZKr@msNhg`T1MR7o^DRpAFppt``N0t&9Cks9zA*Z;`w);zkKrI`Qy(%
zefsptgZuZdj)!p=)|M!iftrk}%q=H;4E3mPYF5P<&=>ZPbpsDqSaBJf)6GuV=o0{I
zl8R1CmeJVO8xO;;j@$8S91h#qY$k7R>&@HS*MIx%55Ic<
z<*N^`-`sxuc)s0dCRsk*-EH{rBbR%#wMsd2>gE7W=RG=Uy!M%zl%ryg&dhl}@2Pmw
z390|~(+~~5tM0JluGOH)SF5Id5+-s%1NLsCR5@wi*h%)fy
zr^i>XZ$$LzJ6hL6m>F_QX^mB;A3P#GSyqT;&;yKINCX@;qX)m~Z&otCDyun@#9=dZ
zdLV(;o|YA|mU5JzwW30k>C3V|M~y(zx@}!
z_iMg)@6of{>u-qSU{oRkj-{xI29B!;_}H@9h(2l}B1?Iq(q`Av2op-zy_>qcYznkB
z1jX4|C?K2l=|URSo>e#icwK~4U5$4~rL&|%0obpTwJf#W>8%UDGFnOi=n_;2Lth--
z6y~L*?t5u{Dgl(jrzO)sMgLXo;&c5@Dpn=4W=+cRZtY-}Ql(a`FX;M1%QveITOu?fGO}TL_1~E@!s)hRC;PG09icA(Qa%mSjK>yvV@3?aFk4YK
z%*?wBzTKEK8xR1H$m(-Ho4k}aje37spk^>qo2;ces@DsuI>@CUU%5>MNPWKe=he3-
z%0xmD8j8{-9h*cWt=i*hJtRp&ASN%dcqFQpNJDF&B*E2_=E~GU+bM@M5@P90b!1e}
z=8pJw!(8iy>4)3_A5}hl&|{Vv>0UhzX>sw57{wT)N0n4%gpDmL9m7Q6MwySM;>qf}
zT#>VG>w?c}HZ-f4iZW&fG({k@Y}<0JzADfL*9S-68SMXAeHwuS8x6fI`XQ+Y}4uOoC%$M9rDQy%a%l
z3L0bP1OzlzCV^OaF+yu%RtbGbNW@2S+a%L(K8;=(xX1#HEG>g-)vNc+Jue_;dzLP<
zI;&vjDXv4tT3cwGTNP}qJZ+G~RLlfh4_(@$3b?r}vvxUV7hS|YC+H#;GQzj9rYm#~
zYJJPcSO(B4cQa=Ku1^cH$JyVW&dBTrGQ>)0;?A0ZZZvYvOodOPVkU>C8OyEA%cfI|
zc4cZ+?;0RE$p*Y=!>TYgi^yDCMzFU!_%)uViG|ujn6gqmjt8D5-bZ~h=v5nP7AKZ|
zMK=~(#9?R~i)sj8%TKDaRXhMd%mT{jgr@bD4*pugP9;X_da)smkf@8r)7!#mrM$Hj
zIF>mR&LnJz6UdZ~3+Q>%MvdM?23YMeYZx&LZj_<=68>(Tt;No279y*kw-AsXgjNVC
zPjoV4=4AnxTaCf{_x-qy<7Vzm;^QseyxITS7azZTef`zz>#yJ3Twl*UF!!$Dx6O{*
zy)gur88q5E<-W!~Ywii7T1;U&!kCp}q*VMp5-VhG&b>eu_RLDz^LCNLxr4^qr;+FL
zURCa6Mp(I~E2;d^1l_rZ%Fz8Z-HkTpzMI+k_H4t&H&$PhEFx#_8rfw$=lQ&!&774q
z?&qDYRLUNpsiJZ$s<0#-09vjC!rS%Z!*L6|;FrhCK61rub}O4xp&
zkqW3!tdk@&b4cBt)w6Bg-Cbf;pv?Oyn=zN@dG!Wem8qY!Dz1=_?u8|7*k=&v5j>&K
zEUC6vrJ{*rh7a$9=UWBCY%sG>^21dbA{T|Veklt_2c}!^dhPAKv$T`sHte|h;dnf3
zzHJV0pZM@${@_=yfB3~$U%meD`s?d=-<+>M?9nDGbDD4C-r+!7)8KWv%^8t^Rn_^t
zPvvr>YUWgcSX4tdB@5+DaUr{MDUg-(W_Ha`pmRp-&F^vFXQF0I0fe&`GiHSH+Rvxm
zH`A+eDh!P@X1gGYX{g%wog~fA=hHT}y%k&I@BGrMU;W`Xj~^et`EY%YL~(3f%b-16
zCR^KYdRk07lg
z;SwpRa?nW2j7)=%%_Hs-6QpeSA%t2gj657Y0yQKT0#T7T2R?g#{A+&`r}I1<$BY~r
zr8z-UZCnXyi^7x(RV8L^xH5tinzOE@u1b`t!JKzd^Xg$xWN^Ivl5Y+
zdttzUK|Z=?VBOqQRN^+aJ%7Wmd-kvWi~sN+{>Q)f&;N6O^7HR~^5Ds{>yPhX7-^xB
z)n$4xGeiank|Cd{uOSYVYB`0FWg|+;gIj|?bFmAn6z>h%7iZhUz~N7r3leAQ}%`f=-_@P%Eus3g@~R*)h&v)BZUk2`dF(EL(NE_yt{3x!8UWr
zKg_AzIHPAzi(N+&s{(G`GW1NqX9V4J5x6;}M<}_vv+Du^L?#sC-yCg^3MAcE7N8(!
zi%h4~t9@7mC|X<4mh>9ZWT=iOv102(S`^5sC?N;T
z7_!V6+o9Wp391lTo!Qq20F6YCHwMiIF{|6ip_*EW1>}W7LjyD29nmk);YGJMC)$GS~XOfQe{*!
zQ^njHUIynLW83r{I~{;fd~3Rul<;de&K2L^G=9HWh@RcHZO*VU29RX#Ntq`X)M}cw
zh!zUcDrSu1h9=?rq^ktoGHOm(GaDfJ=3L)9-~bFlE`ul}Io2Rwf`bSUc86)}eA7Hn
zrP4N)TD{YyOwpLW{;DL66{?|OE|?N}**cQjAbqJSxqP|Q31GE~;^F8s&7iridI$jK
zUXkVASlZG?>PIcJbd@sRzO9Py&URtDV%V?*QR-)Ag^;_ULe|Iez%eX=(~b`x>&vfh
z-oCkc_4fAdH@9!TzWI2ar`r+`In2zqZS(v0l+hZt(8k--x!3m0sEP=IK`2IVC!Ei-
z03U{|*hBlU0&|~{;lq(^iLCltJxK{-vr6M__BkUPV71Jwj0x79)4fL`b{zn#3Tm0f
z)J=hgCTh;m3D){U0-)Mmb!Pi{>JaWQ2*NlBp7*^&;DDGxw;9307@q4?%Ss7yTg_VUHcr=Pui_TtkgPafa9fB$g*YHViovWr-%Dob6E$sRw3
z>vnc`A8s0JL_=Y7E6qQXOsUd9a|x!Zt=E}lZtLpG3e&{z_A42kreQ=?0teB^=Bj8K+@#RgO!>P1&A`0rbE2dlr1F?0rIM%35_*0QN;{Fg+`
zxr?@n1h^gf=<(J4gCDOPv>AN=G2eWBdj0C{tJfdCdh_wk+ta&mu5VBKoB*9}hcVoa
zhe02v(I(QotOXzHc&dnRNl^*^y~_yHa+sXB;dB
z$o1cswVSegT6VCXNlHyKf$}uYmb-Ux%oXpVqA9a%a0WJ~8O$uAPEk+p*^`Hdci+@@
zRAXT|0~$;xI*OQ)Ze9IILSQYH&_{r9CkYb}pcH;mvu9b`@&MS_q<*(noRI?aE0Nxx#1}o!1GKEwlmF50`k9}4@jv(<{_)f8?ep(`cKzXf
zV!9E5$}q*+E2dX%o%MaZI31lXlAmJr9S}=~mDSv}{N>v(L`pqZ35I4Xu)tN*0wA-}
z&9fk)l342DX0ug>9LSh~u0}(Qv^lH)t9A?gt%8afBy~4HE2en$Ec8P^4^qA~nhEVdSRpumJ=)F?His|M=#f)la
zS7t*pdYNkf5(_b;UWLfg*14i6JBKAM6w}?WE<&Kqr4C%Yme0h
z48a=PBjLNrW)2%chZGW)!8i>YnbJB9hhu66FMNCDFBFP;@SA8y*=7
z`Xg;df@S8yTuYE*ZwA3JAXonM<#fwV3=+O@8FG!bx}_>(eM-rpw4$;E`cjXv17Sc7
zS*7`ECUy3T=xZ~itdhPBonFPFTUnt}q^@s9BaAjS67K%)ef->Sy#M_E8g<+E@g35`
z6|2y_9vG?b#0#UPgjHMqPdyZ&SOE426x|uKxnQ|lNyc0U7G%tmnxHk4l2q^KG^cIK
z3T#PyX7Lh;K*Hq)(?ctgk!h4Y6?9r+?%~5z!EnQMZD$6V<__8z8=%=t$gGS2qx=5p$*d*O*a-qxm3nHTw)seHOO{!##T^2KMtVFk+t}VTpDj_AJnS#0(CdLCi?HJUj_l5fM?Oo9#0|W`sEn#*KjGLfp+f
z1IkXe;gl`khXxKcbl24D5KS71%*tf$@B_X+<2rB{7=X#nS~xmZ`WRO1KdfplqgiH+
z%hZSJ)=`-SShrSQv?b{AWu@o~r9o$EY?4}_TF%%$d^=%FWpN=9QoVvKR@BUZfv9;-
zckj{}oDl$fEO<)V#443^-%5s3&~l1U>ba>TJAj!beM&*Vb15JD{sVvTU>uASxH;p)
zNBqiHr#Ek}U%x%QeRux)-Rb&fo=-Do73g%|e2l}r`|QIPC0)m9pJuFxm~*O-tpsZB
zN%xA{=M)B~NrO`yeRWByyv;(GHN_fsy^u97tT3noToY6Fz1}7+qq&@
zb-i0zvFLOkOU^y_^ZEAX`ugVjd_E`gco_HZ-~0TtN1s0bkr&UOJ^%FSvrisBesurA
z{loEKht1qzD4OON>v{nU4wned+?^QiZmu#7zS)fEn4&aA3{faVelcXy)^YU-j(*(u3Yx8F3_mDlJsR}?Nud|Z$&3SbghvT?^HO6KI-k$6FWBlzOTz~QE{TE+;
z`0CZ|+jpny+kHPzR#j1gsByS|yl14VIzlFp`<$n9R-5iBt11JmdDeh9M8w=@RonYj
z=ov?`PPgaGRH}t^>2ejPFe|If9vCJWP#IRjh)CwU!Y%fsahS--qS^VpyZd$+nr1AW
zJOuQlO6@{VRqd+Gh=T3sX-?aj5!d_q?b{DkGSKR8y#vNWd?j?B_So)=em2*9sj&?~
z5(2Zj;Z%(`6xmh9)c9ElmdaEy+zu49Q%aRyHwHxPAu(LTwa_&R<(RZ7p{gQ~O|QwR
z2MLE&SQgs&S}^0Ra-{|tXVjdt`?-AZ
z&D-;{hvN_Y-v8uJ{Md{C)*tz2e)uat{NDFJ|M>CaemwM9>}+r&>S
zCrTFdE?BLxT{v0yp9YEY?-)(VcY6yjSp)>Wx9YQ!(0FIDCfO*}Y5{Alm<#C$-2z=K
zl&bd1B&xJs7r4JTxL%|B>(C!Xon#+(XrpXH@#5#Tvoc|HSt%9EvRuAsq<+ag)U}DI
zFuRoTtpt&fW~fZY0!v7?S0QI2ksPDh47YK~6B6$T&9ue0cY+B>W=Sxh39}l#B35Ht
zRH
zVGY4IO4ds}B9!*Tgpmp(7-O`Qr$G_{It7$;Vv>w1<}R~9&Bzk_q0d>~u$Z>Fy7H=p
zbP}Ag-wkTd%19rq=o(s-Sb;G^f+7dA5OXfz2>aZ(!*Og|B6C7vcI#Mb_kqjkTY*|q
z$$m|B*hWlASab6c5s{&=(3yekB`w--5g2^{DCpIeb%tx|K%dl!J!%9u;3oK?>Tz*n
z4a3ZuWOS&O#1**1o>5Mub%UsZyVByiF)nj`3B7Ja^@S!Fh|P2A47_L*tEl=tI|HdB
zM*Dbd`v)%zK3P?24l1qn#05xuBe!@JRCcIQAERvrx!es+*QEY>vL*BSmQc`IMaIm-
zm3{un@!)v-0e|b~zxnFb^_O3tU%!d>AL4X-KF^%HuqGew$HReF2I(5Is!Hjdr}J4A
zb3~<*+cW5z1^AG#Og
z9GaRE5i}RfAsiyJf;DU#W1uAvLclFUPpalVg&HfN5Y^!gG{inR23VkFPHo#1j`DoEy}i9X-QJ$hr+x0mx_7lbdHV44?|=64#V4P={N%;+XHOqJcyRyf
zc-#)d%}TU`B(7FL;}|AHRU{KBrGJ?jtU1zcQ_@!#q{F$5k)ENXL8)+Pwlbo$<`vG-
zXP}NCOIHFmAs0&(e7H1nt5R6Ut9M(2`aiTqMaH`s%>WO%o4Ozs|@JqN>wfZ7WGju%C6CH
zcGDi;>eE&V8bM|1AY|Lk{j9N<&2?WL{r>%{!@;*PBJuGiUcJ43_4?hL*B@Vhef`Dj
z>-X>D_GT`*&7j#B+jf5gM0k&V?x19IHD^fE2-KXr3ORAb`<{gWkWq4SMwSv5w9|TY
zlPjSw1dB*i=W-$x1a--R>0%pvta-#~)F^0~)F~-788VIIY%mDhb
z6I#)If+&zZ)#MbS$@4CxO*uuf&UOb;Rj6UE8bjlAR3u4sQ?tEf!dZQcid0Dx5$@)^
zD0Ej^h%Ngb5eaMZ7G~`Yo{5()kN&sxLgn6<#5`%-jI9k>+c`2fcgk0+hSV+sC;*@<
znt*60cGc4Ki6GLoMNl&qMd|7HRVo=>X20&gqQIyk26-H``}jzl_5$qdkMZzc{pbEO
zKl|yY|Lx!N-}tBg_TT)4pZw_`yRn=VNu(Vv-ExT$Gv;KrVnk3lybypaQ=&lm!K-|7G{}{h}{xbakg)F>6)jLR82C6pN?2wUv$5P{E?*
z`{zT0-M~_Xr*I*#B4A^AsY|i3ZiDnHmJZA;RVgB*hL5!!5s`ivdPm#wNVCqXs;a^;
zQ{=|sFkaovpZ)23Kl*euI~i*}CRVd5CB4SqD$y<*)W}rHr2Zc{JDshSk3`H`y2@qx
z?kQ@JWL3J#Mpahe8)fHKg&K{9^n4nFG`M{bHXXx^Y=M(H=>
z;(sm)Z-hrk6FUZhj1bzZ#gv&1q~&ajeU-!twQ}=I@#4BBqmu41!}=Dio}V_W2lOV~
zJsC5m(_(gJgJqea6JLxd2Q681pB*zUUI?j)(Ci~lK^nM(tD$PnpxYQOSTHGrZkoB6
z3a}tGs_M>}nkTDCgUKbPl)!lCdD4e#1di#qmA;N;^rW1coEwy}^Y)C-9Y$Ca(U^sU
z4kaDp&;TfMuqGsb&bS-vttI46K@xKQ*8aNC&DV@1E
zpy#B3V2GGaJB`)u3X
z{_5ZQ_?Q1*Km3&+esgoGN(VP^Gm<O5
zO*Ct!IQ5!y*9A1^ti;$n(U{=*yo(bs=lK*0y`Sfuzv6^F-y@E>{h42ZMg@tvS#}5m{SFmzM7_DB73|x3N5w=
zsL{j*C|uMGg?)xy(u{Q~3u2B-9>$%MtzT1RW$k-!A*ChF*lRt+KB)?0xNU>TeLsKr
z`0@61b9;NU@4F$l%^y9!|M};SUcCI#moGp0?8Vb(j~_gKeDD6fVMF2qCTR);loIk_}XHE
zb^OvzE;KNg?>ei08^@42SErsRre-7i|CFOkK!N#v%4_kv8#UOreNRnJnlWdJEbVHi
z`k+?(stcv>yO|eR{us8OXIatNl{*BY3bLwo
zb~?amRk@%0Y>XLQI6(_P3Tf6_o~k&XaCs(GdoKWxs2S1qbjPTwBxY64U7eUj6`a{2
z3K8kJTp@EPL>42}9Fic+-He`D=&6UeXq)89*4e6>tozl-
z=9Z;48f5l$pi`wfDv$2Q;hBh-Yvr?5R=|vC`&g!i0uUVAsH}`EFA$0@UzH52NwlsT
zRk&uRcsb41sjNtt)&-G)o4uaiv!{;_@4uOT*d$tVmv)Ua(n)THL|M&D)rt@eUx~!w
zICK-bVa0J+ORNfemLc6;$@xaaT!B@hLK{#8BD36}y
z${ey4Pj}a0w`dc_o+EN`ZfO{l{toqPQQ_uQpi%yx1toxs3}|43>`8L$bpN#vfhGqU*ZbB{Qb^?rOCh4aM_}7Zc25wQw1OK`L9(bZjC7SSN;I7Nu31~+vLK3F
zEh$L!#C9sJ3(a-7W94<}Yp^kMlI!-pdz4K?3$bvt?gra7GIQA<`fY0(ASIqy<9B-v
zwd)qr5xBehxc)2L3K%~0<06uDGczBlg;r@c02;lCqaw_*(*1zt{9(_SppUT~4xOn(
zg4hn54Qox9VH+FG$Dya>+AuQ{Fj?ep`Sn*1w^l*e#kJh+{W94qtaW*E#G*+vt}-_|
zxMKCIK!e{zd->|yGh^Br(0rzz+k!$##6^Fh%DackW=79<}s61Q-T7T`fxLI_v(xsr=(V!
z87&}qiOT6#i)F_1E~Ynq_>J_|EoI}S&Dea86;_YKY#Tm%8aL~*QxluJOEt36|AwE<{UYwfh9%8=Z?+D$-G
zf+^h?;z?8@sGBwK2Su0Ap3I9eqLl*Lsy#wZEkUPKrVTILv8G~Xq$5!EY(_XU^}usx
z0#y4{Y_vtPgxK@mk;{O|v*zwv`#xji1Qj>p4sbDE^r2Moj7qTFr6s7U$f`Nxd=~W-8vOxj#Dt_6
z-JMj-aLl=1-`w2Z-k#6bnbW{~_YY5>J^aa^_|cayp1yqk^wUotK7IP=;nmggxE+qR
z4Ym|Vvoyr;P|95+J1R*F!`!zq1Rd(UwM}NYr4SbWtNGehq_Vg;MlMWb!H)pZ-V-%;
zIy%j~aa8dTA}48MtIXEi0%%3xx)fSrz{`z?==y_Mntf&4rdCH$Gzvp*f>*b#nbiB%
zB3soN);zebMO!lq7PMW)j`+TFM{)5;YWK`C(Pn8K3r|@#dUj
zO>@=Cq#kV#+TEv?1jIodw(S~`ToS9YVHJ89y5Cu=p_8AYY5ZbH
z=UGkS?aisG_=j$9bbgG0?2;yR-%rN8x;mcsvrH4IAU+hy_HL(~VUjfoeHIp))m#cY
zxM8Y$WK?ifPAcWfXe{x`tI+Mwr?0DdSCD-+3+N`6^v)rp$(*m-%GMwgQi^c{1+NIQ
zSx_YxiPbXA#_766A>5HgO|1F+`GePQ-X4Z$r7MqH%F1e2u-uWN-<3pV&X~Xw2D5AQ
zRp76XYa?vfvPKqQQZfRa6_QzGk3UeiCXJ=?{6VPX_Ch$B<;Kl1?$M0bw{^RtDl<=i
z*RT2HU-@7Bp5Oo9`ICR@&;I%E|JdgbA3y!@{%doqGDdbrMZXxyaQas(_}U#s6pRI9
zwGe03!un@5*d$=Z3(G1WVLyYmxl2OTrR%D7aiQb&GtlU8*VGUTvMfc#Dqxs-Ct&wO
zTsDe+-la&UjL^~r5dy6XG()8snbv=>%kWhNQGKX9mDWK4-ODU4SpA*gdxh+(Ez?xz
z_0dOatP_wq-TW>BwldQKDHvGR#44HMv_gSJTvAd3T`h(_F3i;(>T#+bTNj0NeY&OY
z{2l-*X8EYPTYSw3_p{*=61QYUZsRO?`E0O~=qYLSYh_P`yh+DPI
zhYFj3y>F{`3$F5iaeT>RrvjET
z5~#LC^*8DsNlaSIYQ22+I***_TBmC`TIUmJNo&th!>u!8CdcM(``(Frf`Np5SN2lL
zDtP})(h^a~4ES&#nCD%1`JAEnO=V+gY6#ng&=q~H6EZdH*4njhW}S~i0}%TJ7)-P`
zp;MqLvw9#kIx=x;$7B`DO80*)y-~^H8%g)dG@1w|-1@=B@FYI}Zn32R>xo
zGYo3VDHE7gTR)OQqg$nXruGH&MEKIKU&R)x$f12zGDKM5K-OrDo>}#*V6j
z_FN~%2w20)LQ@}3GY&!Et%$1Xk~b2*k}nWt2D;pL`gHwkP7qu!Vn#9}=Zwr}k%*vWEEq(YZBnxVr*Pu>z
zFlMSAMF3*?s$ipXhL)~WIGefj_7OpY73Z9lweS1+bc##~YO>^sb%L5RP2Wc*xLWj7oEc#^^D^k5{i?j6`
z1RtpG5%=pWHg7@R+78a8wAba*1%@2m(r&%!ruMn$4JM%i~77dtSZ~DlhTcnJw~fo
zxrY?($TD#5p{i&2HV`3y1O$JD+-|FP1*NnS)6=`PvS-8)n5aQSBCQU?NZdbg
z48DI~*S7^&)akpQJ^ZKt*ni>K(}#cJpZn9_{r>ZZPo8~v_jaaL-YIxRv!fZIjxkcx
zrN6bMB?Tw8*Fm
zGfERj8kWos)L9Y&ZVZ&}j2fRlbNJ>x@g!Lmm1bUS<(2BmJ}}kdWCr>K$cU+!`l?pu
zcag4olB@GjCnc_{IfY@AmZxdlW+))kAz;?2D??ge4by|MegECFUCf(QtRkyi7mMnN
zRZG=fZ4Pma?0JtJI>jDcSXe*5-%6LVY$(x-(!`f7$ZK)XcfYrl@fy~r@=H-UXdKE&
zF}PV-474Xo(3PI_=EHzJ_v))=0VdXALaGS6)j(H`ZL1)MdsRk-xgk-SsAzJv3)T%>
z2p%$#ykmVUWn^!Ia)Tv#c}alqp-zBkTCw+sT3l=XGgJ)}YbJaQ^k^Y8Sk_;q8A*V1
z=GX=r%GEiEtd^$e&68ey8H1MhGvmS2^V9u)QkoqbXtHDS??~S;_Xnw$)
zA_=A8>7*!;ghoUv!w`7~4;L<8j;a}nEE|^L5n)49px|SWh#59Ky8K%<8GBeN>E
zZN$v;zGo_)p-BwA!!$||RXsu5iAwAFv}1SyS?VY`r18`I7%o)Znxn%7&y!KMA(&q}adxhp_OxbReO2F)4D6+1{uASxCj(xlZaU?p~rZL31f8k?Ef
zeh!Bu7sO_Xih#?x21ekUS)U9zYLE$JVJ5}`H?^&dpjDp~zC5eZ%<2HRKu5pgQ88!w
zXb5X1m)4qnik|&b`tWk)DR;VbTStg)wL(>3A+3ErOUHgm%*-~Ex#KKbPFr=L82`QqWHPaiyd_~2?A$9sMl
zemJ;+X0QhGlBS_An>sWz4vnk?j5ISSTEa~NY}FfP8sX673V^
z+i-)eX0-Vu_Qql*YyedeCBL+g<{&RStd8L3p*!U|fuE8wbg3oZbCAOBiu
zRceEJ3X48L3MQ+*Q^<_);hGAgYE6WsLZMd4C?RCevMh}g&LKGQ7A=n
zwQ%7o1_>l35%5VW<5W)
zQRNh}?$$i8AtS9Qzf&`NzI>`{y{S*HK5xE76H+J4>gL;{tC?QiaIELQLd+?kuCKsiA3Y~2nkf#Ka_Y*wW>3UeF&t;VBB`WWgxXus*#9FBuBZqcoA9P7#;pRwkX@myKTW&8nN+$uQJH$d5mO^@imVyzZ2z9wB_F?|_HzghH(C}W5=JCurVWou6uh*YhKi_0
z;-WR2TtIuy0I4>~hvn?qEwkW-dB%3&*L%ego6HY^SqNuTwPX^_h9R)dy|SL~+AeYS
zIjP*v>fr9RH(OO|4)DZ7k>OFUf#bt+}zyWp3drkL;h*2
zjP5MeW}~Ntp&~%59YDEp?sM+RVL;6pm1)Dd44hROWrS3XWj!9VRyK7+RGQH;X12)>
zM9p*1+&4zdZQFLa`(nn7ad2r9=A5P=%?N-o(>LzteH}Q0xl3EX$H+{&<;wMb1FVh6e!le9NCJ-T+^gpa&gS9ae9wnW{x%CRuYw>&vt-nK5T&6lhh$M^$BX
z-|XJ|F0<_utE{;o)hHn56iyy7k(Lm_WyLN5bsw{qzOu1@R$@jt@ZsZi%+pW*#L7DSAjW6B3dPId<_p)IwL9dR=nLZpu%-RlSWP4d15oHc{
z?0e0?hWh-){lEJ9>%(qilVBcI%vl`F%mRkH*0ESkD1c*G
zev;xIihT$`1DbOpt=s=DMixCqz?445iZBA_N;3}U!SU=dKVI9-IZzfK=A(y)fAk;u
zPrrEi=#TzmfBfTz>t~<6`1t;9=5!yKkr8O0&!PfW28!;}$TI4{i7tz>dU-$rRo<;l0cwC7tzp!
zPJz@ZY>lo;Jl>7sLJ!nEXBFip1qnvAn>a-hrkFT3iemIWP60C;W>tuo7qbc$o-K_@
zC19FR(eI&K&s=pZ4P;ggQYx$_cou=gMXS0kvJGWMcULNVljl{l(j^CFR~Tk2D}oYd
zn0AqXX73+PV;1Mk_28GXn5reay#zs+(~Smq-D>XK?o{fg4Xb`=Ca5jYPFeZepc_EYN0g}`kXT{ii7yD<0f%%
zD#9*-D5N#;qn1(YO;4;=lIPTn&9+wPQlLtowYl0*O}1Ulgdefbbd}DDj!JfK5q=*!
zL}fY6)~QoVQEW!n&RD@PY)cl*XiA+m`MpKCt`va;OWqYxROnVK$~SxP`0#K1xnKG>
z|DC_}lRx&^@oKz%_kKT50aRJ3(p!X`Ee%OqR*w3fa?fbX4x2Kz%+dU=?_wQ{_9zXn%AN}mp=TDx$
zeD?h5qi0VZJbHBR!To!O;bXHZA&q4$Y79LMnY3YM+cumwgx7R1uaU6sXA~${*=f2h
zSm>dhFk7$8ht95+t3dA>kTg!n%1F9-R464UakqN@wNgv~|J!~j5SFS{y<8+S98I`d|
z$54U$9-7Opk-Y%s9y)R6IU-|ouf&}DoU?1+PFTsz@-jWWs5ua
zmHXI6_CQwU?;FXAid0S9z;!#grF~vn-$l(~=1fIv7D#GllF@8*|P*8tN#{W3GnT-LEl*#b+IYD5^Y(`5Qr~&CKJ}PRcI@D!8*A_uNXjO)9+o>Mx-ScVZ-4>EzF1A_e5y=
zE^9)=C39vLRc}7HZ|1zdjV#2w{qe)``+x6${Ii$O{>UHxpMCkmFFyOu=O5m`UB@6L
z%c0Q}N|noY4yz(dadGA5(T4`mGgOE*wg8J6RrR61WceW5ho#gH9mO($lnNIXSWYvu
zu`udhMBO@9;oB`uJPxpbW
zgoxI%E|FS%QZ0yLRBC!bCp3_e(fy}v=PVi9B2qp{F3Cos4DxkCK^>Lh!{-b&e)~)x
zgTS0Q+{$b2;RlNJ6K{g=s~&^S+K5wPV)do%RRgN5DBxB{TKkn)Mud!+xmvQz
zsAMV7vm*$aTCwKnQvroo`Q&$!3XMO}8MtWwiwE9xz@w!}z|g$MDw3`}qH7=#=yaLI
z3t=7F62&PH(js#1`JK-Wf8!Uv`LqAdFFbj4|Iy>CuU>z1KFyv)T9pFi+V>23mPrjH
zRMpwFulv~dy)tKpyXVx@C1veSbBoN#AQ4j-Y@BbS-ELEnay2#LC<_^Mmntmev@-%3
z=O`j_(nmxPR;<`l;HjHOOwB}%In8X&u;CG*TR_%34N%?pU51I2>aHqN7ULRYM8t59
zseTBVS<0RjCDk@dU9C`a9y2mel@*l{v#K(tl4^`J=jMZ1nQ`9F=a28MuW$DK9Jy}?
zJh*rK?7L4t{p3epym~9@<(ZY4!j(jX(lr#V?VZ-MH&$MH
zNf55}hdDJ*Rb5tcg_#u4XM$Z)2~h3xbf6-mOC1L${GzfMj92o2V*R+2?1@}|4TKEMYut7ZXp-aBGi
zVhtZW-j~qVX;$#->v;9{_E-P?w_kku@yk~q-@QNG+ynx#u$yt%4hQT6=$0$buo2ojMt#&DbLpjmfBxO)P;p?`Dvk?J_7H)Wn(q
z-OV!QRLdf}ETAo>3^TJ)$k;$h)Cr}w|}cl`Y?oQn&zfB
z%+$50LN)6$C!)b<3Zh>j2+f?yZKR@V4S<~c^xgjG4GBtN+H8vR$d14ZCMF76lXq4E70X?K`cAxZYg
zk`7Wyx;BVq1~vC6CamE_buN;{tE5>knFiAd!xEw51V*<9Ylw@UkQTs-`>F1ZKqK9K
zMh@GQghA3dDwATZ!ER<+>Zk(FvZ8?D8)YoMwCW8`X#@=1hLj|>$P*f)r`q&*8{ukI
zOlZM_u-4mmOWwTh<>Tw=TmMxJ2=qHyzw}u|ap?$>bhQx)xo^a(F52BXh?3m!hi4&!rD2V|}@Xt~tN3l)ZN`4Sw87FG#8G#Z4Z=)+}kELK?mTxbg##cVj-^wdJ@KsT12v74II82XK4
zM2s+4M2u}54u>MHFYF)w!M26%dyA>v&o3Uf#+G1K%PHF>hg&LnhHckFAjqT~MiW`^;ZCEA`H@-Usu>o(Au!UHwGcWbL^0)%!vwNez?VBd
z4s3>DIGL4Wf@9tDXR=3U&KNiz`$&<3v0)TwVW7p5C9((>UI~jf1cddlkl8{H1ra@%
z-Gc@psbh1b{`Tx9U2^4F&klH-}eu<
z@9#gnKc4RI=WgJ|#dz}U@pnIZ_3G8lN3WlK{QBwhXOEvM7WJ^X!%YH25M?GPTa+#g
zh}fj`YLdbmeb3oqg*7a$Re$==3b=R1jOk2
z2%$OhoR@z^B*D7
zPD!3;mchpG%Y%=@#pT7eh12Z*#JjuswC8p+dN
z4w+PsWQwjXw$!}PPR>n3bY;kyS-@};vqBaW>T7j2)yy<4ydo=8rG+ZUCOctSsMDNt
zuj0kU+~RfG@e=6zjMiyt8^{GtEs%DBr{nnA|P
zT_Pg(?;wUTk_n%HxP
zx^;KB;qt=F$KBoBX?d5K^Xd@b_QP%4a1z{i`tW1;YD3RS5I9U#qxP6y`y*78%Q$#1mHwoB3
z*L)3Ji?3GEGtdDttE^YAe4f2)v4pu?Bc%5y=G>+140plFDxlpXYd<%ICEi1l4Ctx{
zIji74NCB=+f?00S5_#)*u~m(E`(ax9B8U)hxNH#{Q)u$B1)zGUXEs)lDx3b)*DcWw
z0?AmdPigc`)y$c{ZK8ZB_nLx&pOqDgPp-51p*I+!gBC;uU5zv;29w3?4oaW21Go&L
zB2`Ywc`u?PLxjj^z4hBoNGWaW?CBNXnu6|0aJImqCI*Anc4HKbDk_*g|5cdi#OhEE
z)j#+GeF@FxBOmL|F{0LQahs
zcvrCAV}vv+(sE9TX-NX5ww5;f405;91XSatuy(pz9NW_6OVn1HNA#AdoDcdI(0Ior
z49&S^$B5}qFu=od2f;wwS19*FA!$XtFk9ZJm_9_20DA}qplW{L83
z&N%@(EX~a;Q$uLZ#gORq7eXsj0YYxMt4e^;tmbsb+>2Q5%8q%;7~|Xv&6&MZ1Ll^q
zthXQMoJ_{p$l6cyY-&PDGrVIqSWHqN7iqP^jZuKR2m`>HTAwA$2kJ%EVn|smXP}Ck
z{>_9RP?LGG?E+uk^LSyKBifhFruxQKsnB5FJwGa;fDxTdT%0gkVPRri%`J$j!7%sC
zRuzirP={vjIjgGE#jH8fhJeED+?vh_EYmMHB8*uAu)7u)a-EVDwWOv%lZsAa6?7A8
zE{>P3fYyD!etG%BU;gT^{(s+m^y0~$b^HF9$*h{YswL!U>M*VDK6pBb__CUr@G)S4
zeNMxYOcST$iL&?9n~-+5huLCmW6s=<6(iA2oqWtFcRvnmdqG!D|Ys98SrEnw!X
zyw775$*gRxW0B!u=3_)`PI8~~xZfY|@9*z#kGFTHDtBIAUp{&I==&di^z!A+M<3n1
zym|Wk#pB0US67$Y7&vTj?JjHS4M210ufkVh=kAg?w5BiwjGRv-8e}4>jVRh#H!?O4
zBO}7tj)~IDhX^rZj4g9AE5@+1zQc^Pp`tL=0=Z^@t4a}WIzX11PW|3uPle;u>PSqD
zHur3}d=*W`rGRHA78YsN_)Dsr)lufd`_He3Fk5NM4K3aU0jGQaa{!CF>zX99)C!7L
z@A?B=<6V}sWTh`f1Jr4>n=djMquVYuRMjKW+FTgn7gyWW<=74$;rj`9C%*mS_RSYx
zy?uN4<@>uYzdU}p-S6)+3v)JmxouZZAB!*tS~V{Qm#a
zAN;TWzWduRNBH&C7UpgU`Ax){{3D|iw%a+sYZc`fsQ{2RhZPaIXOD5F{BnAiRaIaA!m<7vIrA~j`O@2q>hp@!acy~!^CK2Ma;)KlA;+^q2n4KmLpV!(aK~uYT`mzJuG`=c#)Obbua^YurT-)%xJ-
zVck?uxgKgm&}_Gz>YlJ?j!FkKy9ItY1ATGPTqmHG?}WX`g~IDjQ8b@87lO~K3c_!0fG^WW-!
zc8O^%oNfhm|G=g<1&?)q)jtT7uS1zooDKq#I&qy61}Jc@D_RpXwyZATm2HT6eluj%
z0zMY+`%MBcQC7oa0h206TpB;2NpNao=_$Acpc$0(*lZc*n^{)5A%=sVq8
z6f_%bMd58eXL^ic`H1jwX4!3Vt&LnuJrG8bw{8}4+?C0G^!p1N+c4?T4}SmNf5%T<
zJU$qC1|$2wdy${t-5M{1+nhaE541zIyRlQnHGK*nX0x#i4HvP|7bz3~DJ^|bPi{+Y
z(@09Uqo%oG$g0Cv3^!KqVh(l+0zu1^B%aBceLE~KTkG@d@Iwo$^ZNMf0^cf_QX3kX{oS(f`8rvpUS6wkX
zCoMBB2KG{@qoNTG7l(P8IAhE((@gttly2m%diyE&iB6)~$cT`Knu;yCDb86DLs`&S
zrQqPqxqd|FVZdbE;%6bll3qjE)uO&x21T3$@27o5UenwVh9fzlJMv+Jx?u~OBqXfQeEtv{BOo!)FUh)jwToF6!iz5yg^O_=@D!ta(>0Fj=Q#
z1p;|=CZPkTSxJuJ*8Vhoh3R;sHFlgDG%)+?f8)*Dw_pGE-~OGuyL%#KwxlnjC>oOu
zW6lvFt=fg`uShiuKp8r^whh+_SAzFcSEwVBMLIb%*?BhEMAl3b>c7wJViP|BHJQl8
z%rs~#!IYRWwy}0nLv}sMn%Of}$>daBYr1Tu8W1R`XP!JAk68(D?o-vE
zT%vT_#)vRieVV!7-ycu=@p!t+Ig7lwINaP^fAsP5=TE=){MFN!FP^-7{`BdiM~|Oe
z9k#gG0^s5VAm47#^vcX__%^mq@!qx|i8AXX6}7eSu!zt#qr+?QF>7V8dnlZITMQIRDTV{?x+bV$H0&PTTO0OTf%FY{(~P!7eJz?AK@
zR2+R#>y${ns)x&c?Gt^-(pFSOr8&&54;#asGh@W^5zsYXFeX=xAOkQgu3ZbSO>Q1C
zy5}Thz(;Hm7h|)_OEHivu!{Sf`{~ppq=fqN{j|feA18zZf^#p(Q7Xk6SgdT7c$P#H)JO|D
zz)1O@@r|;KQn{M64{CJe14^l4G7HXOK(&ITP3Tov%l}bAp<-K4cU#z0H+oFnu|OR3
z&+1=PXXe+eDl^-bd2HL&^(Cu*M5R{)7MIzxdDp9=Cf2A6;LVSqxL8YU4^+
zT?uF~Ic7w7J#fgPc@1XaUfE-Xn$%E-qEJ@}D!Kl76^)!4WI)fTf+n81Qh1iTyNHw$
zXy88EK?O0qpE%A6)L#6`tpp@Ml@rp)nF2?~kY-a2mO>D*fd&i12(PNU$=A>P+0(=A
zT^>e=?PF0gP(iZMlC>5qX!fXJ;o;I?RommJu$dE~VND%LT~tbFf)UWd^p@aufh_Xp
z{A+F1js1%QEz&TisCRggRz$#IBkbyG+}-Unz4pp4kN@oN`|khxfBA3y;=lgq|JvXD
zyWjoZCp^8M^R!?vNHXfevmpx@Hry{V>D(u9i9?!P?S*3NqSur0GgEgy>lTQ&N++(r
z?OSTS(C+fseGAS%&sI$Zao1H?B?OiQpq=SFNl+WYq3S553c11EX4w`obGIe_LIdpD
zkQotY_aa;Q5#DkbXM4!Bu%){!+R*$H&z;rkq1WGPn46V-WQ@?RP%$k^SGZS`OS);6
zNa)(VSF722jrCrW%L-UmRiAtU#@a8-`Xy?kH^wonkID7W`?0H}*ZI&^
zB0Y&$G(h=O+Kpl|A^0nNQN(Se(~DQPkoqxAcW5ZC$Tj!6=iDwXobsbHi2bRQY%QeT
zA@_YoM1<#@{RfMQSSx`<8Lc1)UqOOg0#Pj-VTC*^E>f^JW1%fPTb<>wLlk(s;w=8BQ96hYG1rlS#Jk2DP1AaW7
zB3$LI1U`ftgP5ZiOC|(ZJ#AgvU|93&Uwa<+`Wp`=Tey>3V_NqhOO9xUUyY0
zWe7yroD+r-fu1lx7Kcm)X4Q(HnT9tzUIjX44mJzBQRy&PohB(@&S}eww+R;A03xK#
z+JKS5l1*>f*_u9;VrBqlW|d|Kr0h4iN%xP`3B&3c_KuWn78p9W)%^Rp>tI$>F5V*H
zndLoRB4Kl*5$-m#3O1{*uj2h3e)(6vLeY%J<4M$ZWB-!ehtH{Ox5(L2+}w8!aOUjh
zQ#`0y%zc_8hBLA6f)&8xtnA7$mzyYBX_<2mkD7aCB7C12uI3?iHI)1(vnnfwv#crs
z?s*R5YLCjf=fvK+yQ-NO+mL!=%`q0i2>CNLh*p*Ro;ha&=&amlYE;`a>L4qihyXc{
z$K&bi9o(9+pw#v%bOQZp5MIu=;NDLFQ2`-d3N*k>dBMKi_Nz~xZ4=fG6R$$
z&voP&!vT*0C=twthqbQ#j3axO3w;|P+}X1mB3=n%MCiN~O}z;eZo1=4L^S-4u8_KI
zqZ*n*fmX{zSNE!sW#JKH=!$MIw0oGcju_D~WR>OSqWqob
zc7mB99B{Cz3UlTxR@MkR9Jb5LaoFPODn@wG?~eTNVgA~0-u~px*T4RgufKSA{QB$D
z@tFImRGp47A`XX(@JsPzE4783^H|Bb=d9fK0*sYeIcFKn!sb5bRB9B%qfSdXQB27>
zG!^d-R?hTTRSf{xzNd$y=T0lOklHIEPN!W!!G7A!4Q6wunWfQ68!kJvX_f`TeNN^~
z2jEUXeyFyBomOeB9hn+8R*JeV}A
zfEmNV2G_#Q_y`3#?Yp#{%t|V^S*4yujJUYmBDT}%^x02-s|C!aq1g{6ZHSG)(lQSZ8z$@)ov$cKhv9c(Uqt38Owzh8x
z3VN8FJ(8owgT+Gj#DpL=3qBO;mU~CPW|lc(jG8s4u1-d{)SknQg|d|itOkqJl!}>t
zyUht37=Z|!CXSPj5B%igM}Om&-qm5a**WxR&hiLflkGF1yw(M{nl3>N-&#kUG=;W)
z4OsNiy@PDi+K_kIS?LO^0#lYYUD)dLXC~S6oVLc8Rkv5sjVZ+zEZi0`{G)&DfAm-X>JNYVw|)2i{{88A>`v4OCe$*U$$!s8Ux8*1NVk-n
z#KRL+Uqc!w#hSQ(1J2^J_V$AaenUN;a*Ux9^&4z8B#6`au>NO|&kRycVApzNv55dy>H&O{VvoG7KXkw$OCzI1CSr
zZG1T84?aD7_ofju-AUdRRXl}re$2KW3n}SEj5Ij8EtPKa_Naw!_Kc)4Uv4MRO_h_Ou0O&rjO42-M&|6q1vS#KC
z^Ee!GFArnFBUGbise!d_q)mx^n3dr=20>cT2xgVXkiJF1ebz%!q|S_?{W^%)9U(|M~KL`#L)Xft%$F9b)xcVDL$2YdJa^!c0nZHr>%
zEXosMrrHTsFPR93#0!0XQmFT2)(Sl_x+@~
zM7IaaWgor?L7)5ac=~X6cRC&S{RCEwc>3h}JD=XXe0B5u`P0|0pT2nZx;wX
z)i%OLzzMNox`|O~W@B^t=x^Il$2qo9GaCzo4Y`-D;zNy%#?l0G8o+9cX;skHY<$FU
zYokkdvlx!-(i&^{u?CQ|GluX8
z_SuEBh-E!O*Q8vQ$@RkN=A{w4)~{8Qjle#q2i!T6Mkw*OYI@H-rU1htJy7M9rN|~N
z21S@>(I8u0$rNGomtLu+f@yTO6?5PBtdzU6rZwDQ=02ndwj?t1{&;`??*4dxvcR`K
ze(_KL)4%6;{mvhJ{OalEdpNExuD0Q!WQdSS-Xg(TzhQ1x1(Lo5uIk@b;e8g|>73(;
z(f_bWq>X^A3SCyg3#&To@Yd6opI`4^J>*s7nziTC7;Ush05UriCdihDjM2TEP->)j
zO-D~ywWW*sf`oufYy$*Fn8EhsOntN-8M_@Z^=ghf9X2~`eT=x!C+FhWSenr5WY
zS5db_D`&dI2=@J`iFAP!(oN7{Ey#D2+^Rt<&=CD1OcSAcPq_^IDP2{-^@~H@8V{Ra
zU)$|HD=Q0c-=6-9|Iq9I;4l1%Klb1FbN`=T`a3`M^FM9)YR(-7RLlNX_n|-c+*}Ip
zQZv~dj`m%Fd`L3Es`{M7S#73L^_!gyLGkODMIyOC1t0@l4w!3
zBa|TsB5mx$)E^RZ+Y+2swb@~NJd#g9AV>`?T
z^_?E}6W8NXg|CLBjq*tBvvh%HmO@xy4>}^r)3Dkz6TL=>ulb-2W*5+sYUNrf6k5Be
z32Wn!&LG92Jc>Olz1%VcJBV6$GJA5hCX3M{n&{?_66z2HTI|h#V5w-R-xsvJI#QzD
ztNZtMFUo#(Xi>3>wur%GvU7wf__^hO6fhPea!zR-MdGzOks!;)GCengt%zE=%c=qf+OllJ6l73a+D
zu=RtNhnRcz1hzMSJKXwt4mYo27Dq&z3=f^Z4Q1%s&^QeVxD{&~q4%=yC-~v=Fh&d$
zq~vx=`-gvad$h@ZS)XAY)>=-DNTA5>-a5=vJr(D|R~o7^3q!|wZOBOyta4eC8vxT|
zQTj;V?AEL*2%QzH=IPy6U^K3eo{*V@nJLp%2$~?AcC-tU(q+X678R;)OJ6XC%i%g0Q_4*=oQiWCA;Dx-_MAzv($bj|BkXSC
zec{@0Fr0`9>_i!c^;Y6}8L%O6khP>vf~wjNsm1>wbxL52KESJ_9YW=zA(o;t+=zDd
zR8_74v=|z&L=58&RvVCNq$+zi2t>0sc0%_jBwA-)a8VFN53iXjO2oHpVRv_@_aE-u
zc{-k?`pcOHB$$&`O$F#~i(xrMyeKJ=9-f(1j1jhmQ>6Y#mWCDPDP<2JWW_p!aKe1<
zDG*5nz5r-9tC^%JF2%*$=hWon>A3r_eJ>wjW^>=&y|S?KNY!|_d3l?JxlV1hAIW*z
zQ;J6MsIFZTa>puQ&eQ$-yVKlHr=#LeF0Z#okFUP-;^UVupMU)N=H-iLuWlYcespnl
zeb|PN;qC~{w^d19Yk&-TBSJ$pwm>CKy?aL=^KcPWq}hn*UT}$Yp!hSGYe>2J*3*%0
z4h62c`!+%_fx0#WDmmOdB4?I;V;!$UO~qnnIkW=hrxg|eT|P#TN3WgX5KUn)`W{g?
z*p@aqGe&gPtZX^Jy11#fRLu(oaV
zI$33w)_fyAY!AZBj2JM?DJLQ3q=s|$N#zE+W832TGA=GJE)KqJk+glsm+$6p{@RD1
z{N(G;KL7f&H@ELUI2CooSEicZO@LGog|!l?x#-vI34F?7PEcP6pK80I2?+V`z~uy4=*OBWZ_LPCqg9=%}ge=G|YWsc^_8xwo=2a+X2m=3-&@!
z5tAV1>Ezq69$=Pqw>)~5$s=Y>wD8y5!-67t+V5pDOLol3DSwe#HKxa5h^w2q@29)t
z@&0(+=RV6Yw(;cg)$5O*e*2S;e(L+*{{DBr_3Fi=t4njQZETkpV;gQJ(W5}Y7T@cX
z)z_&$^wDA`H&#{RO#H@h()N8fcx(~wGPhIBHf7FSoRy7FY6D1tRcvGl&HonxT1VNd
z+HTt$wy^@tBN`W^yZ}YK`zn-;Ze2IJ8IhIJ`xF`HxsJ1oVlfjA3qyp>3Vd02j>^h$*CE>Eg
zaKHw@rWxht;Eg7CkDx258o#U{psbx*eU9aEHEtTAG3
ze?RxET5^4HtwfrJWx6}-sz*j;sD>uLfp2EEq&#Ikv!G)gw3?&nVb4~umv)Zz3ew5r
zMTVJ2tl1f#IlTvA6-v|*q_>1}B*v->D@#r7YC+`zf^lw)M
zxZn);^N=amy{BX23`pxdJj$s)R7Flr)BtFA?=UO3o=_qxIWDY{U6~2n8kX6QL_6q|1=2TfZNRy8
zF~BI3;f~LdJ#0T4Gq~{1oU^6oqD9bdr+txtu!0#Tj57RLc&CA#2@aQq+GlLSryrk8AXG2`7%|L3t+$yKu`AHn9L3@85p(toTexT1
zH}$}*Qo3DZH0P6(NG8+WJVBD1mS}>+o_LphJ#2#=U?*b&6WDCc(wjhJO9Cu6OSJW<
zEnkPF;8^qa5I<>?>1ncmg>`ii(f3d$X{O@K6g<*mW7SCPc6XARKU5Lg`ny1TUTX^a?!$|`f5y`qg~n;K;H7j$n97E+5_L|8;ldF`BQJ_A?@TgIwx%l20$
z+wR%a_d4+On`yR`x4twWePUZ9kKP4}nsc=%zDlz5ck1tDJt1j5d`Nh73sowoR9mk|
zwkCev6s>14*iwo{=sTkWZ`|E-4O5^mgBI%NDNmK=Ho_y~(e-wD8J8Es%x2;C4qtwC
z`uxq8Z{B|R?9GR_U*3Q5<$iyh`<^I*7GsRqt}fgz%#y;gY)s
zR$zpM%VukVP@M`c-gBnr;neK8hT7UMitvyC>p&F0-LKr&xyUR)7^RsEfu#b7wj^5X
zW_2m%oe)sf9qTqWcGx6rnPW&3LHSLxwD{d!_Gxg`tZ0CZ)%3|Cso3VsS~a>r#ZM9#
zVOe%cJi6eg-@5*#AHKV|91*sndE4;9U_MmISO74^DC4~UwJXduKGTZ_J)f`27owVT
zR$~>`KKVVd??$$X)fjF-E=J7Mp6OgD3g&`yC_AUS;%*(pF*Ig_FaF6t_Q(Is4}bYrzyE_D+8C=@4cefBOIL@fF0|WQ0m*8)^#&itfif-BeRccGsy4DBFM?2oA)`h%F$#NN)5GZ
z$UsDlnZ@XyRvoP_JB`a%^Qka53nu6h#!}+2prg%0CRM59UF#e`^MP)wXI6n$WKjei
zdu&6t1gY_tR7hIellEz7=RnIduwbS?R2v%t=T>V+H&!b)Ybur370=t{uM|XPNea-{
z-j>~)+OYn30BI3hS1SGnq*rO<%DKMA2cB5U~t=r_}|@ucQzv{te*i|#>yb7p24M-0sim2lBYlEWiW
zM923LbhBA$klh7qpD>qxNnE|&okn6(Iw&{YOzJSX(37f;ebmp55pb(H#aiZ^g4L=6
zgi^V#5k6USpCd-26ImVKC+&zUs9t??$3g%~dQ#N4FeBVla+$`Z~cK&-IX
zK}b&Q(Vgt76m^q#nycIv)a)waNOEpc`LX>Mi<%IrB_AY8NiF+6g%9j|f;P6HqmZx|
z4ZCz{GfN7sxl2;WnbXYOJSXWaP)75r>d2aM%XE{Qkq878QdD@AJNr1SMnVm&nyH|v
zmdobMF~;E#nYw+WGGUlGIVVt=bDuk`i-|&dgzDpf1E_hryZid~_QUabJnkm~*O%Lq
zr`I2S{NkgJo`3xM`A4sxKYQ}{`tjlNusyoIxY*?Al-_s$WL0d#VG*io<#KK7?p7MA
z%vu1$*g|q7AFhARRk4n6(x&C6Vb}1r#SuMFTI_bz)b3`cd4oPH%MqG6-$npd)$_Mi
zHM53b+Gb;H!6IFsV$~bcn9WR1Zd*g)P2&sg*YJ*1g#BYB;BEMOH6xUl656kR-T1xb
zrQ+#-wTc!q$oIZ8-g~W*riD=~tJO6_Rh0Ijuap{tQJG#`0_If^6*=#x;5wK^_~qp|
zJl@7|9}#Z1M|}0w=~sUI^%q~>y?J~4=F8(3Umov{xgU3>D0_qf|T4o9O!}_w7Q|WXmVFOrM+qPxaK6e17SYW`|alY+8!`&z?NHdGhkr^Ow(`+&p{yM5<6=QVbbT^SIMc2Y&
zF`EFWY=Ak{Kor!@Tppa{?T5^QrGN3&>G%BZkN+3{?w|N$|LULp(J%kK@BiRuzJB+`
ztW&rpcgX0oU3ao`q1ZFbO@MIKZL3r6vRR)KZSSciU%g0FU|?AnNT<;MsY;TCo(j|v
zYRh8`2D!y@MYOb<%bM{bn3nDVee^I&4`2rHEIT(du-5cMU&L%qIMs|`C0${O6IYI_
zmY=%pvm)U^GGIn`A6TPq`slTaQN8{)EHYZZn-(Z7L$*e8mgxc3aiE65WAvD&K>dCT
z4ImJp+r|={xrovh@jgf`-9kEkU1QyU3kF%JYj>Th`+I~$+9xxjki~Ye?HTO8^84af
z@6;i$IMeX(4r=WtXwBnwWJlm2~O@h*~P(DV;D{*)_e0YI*$Z^Ep(HX0W_rJuDjiOeDtI6w)}C4`bZa7=@YHo>O{7VXp2L;WThB
zbI&Q85XpF4=)R6OYuXPBwA4!%y>Aw>pDPbHdd+gwoSoiHQVPu04)xQQZZc`+7Gnh1
zjFP+%2l~I?@3<{o2L{Sv6pxA}WivyY25Qs>X7E7GbJ?y_)&x2jtqN6>%{2E_M294Z
z=F;224Hi+$sX=!a8;P(p&(Z6ao_2QF{Uc9(@c5`$6=yE6(b!-9B1571n%*CkC
z-9`+#myK`_uPTR0A}cXGSz`;Z2Y?r+Vs0Lr*VO!0pX1?P#o-89lJMbGHons{GMdi;
z4CWTY<)k7O5xpp7>I1Na0a})swK@eVG^geQV&m+T`wfcUR|%z$FPl~&thR(())zg#
zapO?1j_Wk*8*3eJY@p_xQL&UtWYbwZL(l6DFzb(|Lbq$1FoT4(UB&3}_D4&tcXC(Z
zg$O%rF|N1E%W-uGbK56A+|_4q?>_(H{b!%QfBVJpv$wZjeZAk_=A01LJ7SDshr{Kz
zjRm_9#J~
zR-N{J=ImVc;Zr_FirFH!ZS>-hT@)*Xb*7j-6VMXj1opY>($0>|p|F7VoLR?REzzvX
zFdZV*4NpWwnCv-)925hKYf04^ZdorXHOqpUtL~a
zZkJbw%WabksD*GWGuy(#Fotax+wgJNd>awo!BK7&zKjLjH0G>=bnd-&0h0}(neZk`
zd=Sg^gIw}#kr`YCo+>!a2!JuhR5ZKV5*cu66;&_4-f9F4F+69H8arR?g&Aa|iN1uHEdtbkMla{Vd
zO6t{;ZzZd$JDcu37x9XMJ-l;an4*TvNBFXBG1Eog%~e;velCS;NqM^l=pNM`z=+ir
zVl`G$O@%!`idl0U0);FmQwEdWKdh#$yWjOH*7`uhr|Xj%NCQ#*Yt|K@o>pX)J~?}r
zce4Z7Q2D6aqDZo=XX{!9Us$d#*7J(0G1n>FQJ;EDZcC{s>yK6p3-4M(n3TJTx*FL7
zu4_gc3oco+CjInp9jy)3a?(>WQar0F98JKkXH|r=!T4whs-}z^`<<$ZCfAhDnWrtX
zKbV?<%GkuHJJ3JU0qMt5|T1rckx!|@o2PeA_HZz=4
z8{JUIf=93**BmHR&BI0Xf##jCN|onl=`~CcxSMU;Wid^#b!gHxd_-3|W-t~I+Xh&S
zIL&-|9lzx}9**2adE)GlB@R7PP0N0KCEW@kqSR+e@TP6M6&{f
zn2NL}=Bz4{w$@>A@#Or&5|`sglAI19y2hx04aqZcEuRd$w*+l#!mQfRGfQ2QLn4_Dyj-3IIF?}4yB%|
zrX116urk%mz3r&lzjH}2NTlWvi^=kE2!Ugtgw}VbyN6V{rDz>v?kNOB&P>wNOY@^u
znU(GlBlf)<=59IFak0o$9#1hdZ5!x8dgjd7wqoVX*c8=U1;iE(wF*@gJ|YG)QE3d4
zcA9uU`O?k70R%9~lwlzlri2aEh0vooA9uB2vR-3`Dr9CRg))d(A|8i5!?A!r{U*>X+~f<|MieEyrqA05htbNl!i(Z689La>_Ht{pE3F4}x7*wK==$Q-
zt4BZlrN1v>pon3Ev*z6UyMeXuZ10+A1)`^AeFPhP)z_Uh%$%NI|cJidN%eR+Ac8T?FY_c>g|s{2L!W`~3aqU)+B7=Jty(j$gk&owDXml*1yn*y38OEUi0K7Vi5jJro~xnrvw$PCL)#EWqiW?b@2Rd4zFRS@lM*
zy|e;!v{uo=m78jYxtDm1oMk2}psMV-5ABY=jnBObJ2acDnUj@fkyFOVC8IK3cY+rs
zshKs0kMIDw&mHmp|SeT<~ri>8#GV9C8G^n3R!x)=7Vuv$8ri7!V
z(UB}d=~}4{Eg~WY9K#39$l6b*yZaCO>9o%itA_dEa(n#b^4X`)U%Y(w>h-hd&z?NF
zzPP&FE-x>(G2C6D-=ePEO>;S69^umVD)o4Tn?ufL3bH|?*xoW=1*(GpvT{}RCOs}?
z$Pc$bb4}KCryc_3UkIJaA#JonZTadnzz%q8X^#*jV;e6m8C}ub+@g|A_v_CsO2*kX
zq1Gg=yUZhc`ocT9Q-gN8shh5mk*MH~le06!b
zdC;ig$J}9Y7#?lB>RTIERLP&!R}vLHtOdZ`R?`D9y0>>Jf!RjE2Eq|dGpwldggd1E
z5TNZQhi^3%x`p)F=^A$wij;`JoOHMTo5;=l>dFxD;X_X1euv%d|CL|(nJ@qBzxLn$
zH~yzT`O&Yx`t;)u?>+;(5J1W{@N7Y`dSwGvlpOkplWdnO(g?)j^ST(6Mi%Uja8;H4
zFRcZhs~&JzcB6YXVeC^?-7HJraw%3C<2D2K({wj7(OIe5wmt1DjLAJ@%j1isw6joL
zqZzI9l!&RNwbcsHhH20es*<*pdISVfBRq=CHF#;Q@$G(u@?+Hg>Nn3Gx>g2Bb&+eX
zpqj2E-M!67r&5L~Ihg@i(Nulh3ig4@HBlN?Ghr5SLG}pM`tt=i7+bot{={xvyZ-+M
zKx?aab2rb_LZOgcU_n9Xh8@i2QI<~w09LNET+`%5=x&zmswdIi-O6b4(j%p*TquP#
zihLG}uhBF#9Id6bK0a2&i)dTAX_DTme-ptj*4+^v`%DUow^((G9;ua4qqh&{UTka{
z{m@KDz-piLH&Q7_^T2hU^VLBRAj7@L@}MN9ZY+8P+$w8aTr{)+!lHe3%+&F~4KRHhK@@
zHdf|3lJqGBehFFX!;9t?n!=s%Fo!9AW|&O@PMV?bBHDCt8?54QCb=I5-2xxSMf&k1Q)oxW4
z!vfuAR}~_{ShHIuA7L0{p7x%RZa`84xT>T;X^R8Gc0|mMZ78+X%nk7HEV{!TnWU3B
z-A50M=!kFXsrK1(2G+yD$kP31752r>Pd5y+&9DQrkib~yN8^rK7~iO>A))UWqRV{|oV%ZvqHh)dSR
zX9brxJ?QX-2EiQLu=~6D`dgPj|Fcj3lmF+uy}fla8nZBWjSvGsjHsgG8JYk*)7>zG
zdC1x;Y3v~+)U3I_j~m^?L_Gn%&*K;XT=UlMM!KNDh%obg?paf}-M;VQQOU|#8XANG
z56of%$>ZsG`fxg)?)THa=iCnC(W9#uubw==dHw3uvyWasd;R+6+2iXcPp_`850{56
z3?upp<;<#+?r-g>*v1y4k8ihg)TD>0oz`X_V`~oC!p&)l3s%&b1Kc81!nCRo%OOxa
zYG`v;J27(kr1xBgH&(Tr5xTr^3;B;5+#!*IIW$N{>uD(fEuLYQp5lH2HnU2IfY~z0
zL2Ei~&6_MTw8ZDY%m-bBm#LdW1LukmQu^mPnE@F%*;_isA-k*N;*S`Avi`&oN+2jV)M>
zXlvLkb5>1~pv1rl^T?bLu^qPkw9CsKhT#L?oJlOtElC+mgqGzbQQL5)
zF;gSrGmETPf^gM-QA|VSOs0Xk?=xpslHI3ycx)p~`9^s>?f1v~4V2$<4E;H#b*Lo?KsFUMg@X+`vSYE%v=g3%Ey^j}hiJTsk=wXA(f!h;UPM
zqf8!b!6gjuxMo?7CU5pSj~9mbxX)@G&^?I(G>@MD6n8D72NFKC
zyjZjt&b^J`bJplPx2v(L`X+N*{UqegZ<}Jvd-jo8dZc
z?=lOg6Svs^&>#GVzIyYo{HZ_n?|=R7-J_?^KYaBjED~W==7Jq9;KI?{qy#u$)I3Mx
zVF|q1L#Ngi?V=p}MC`&5Ep=TOcK?N@odESX#VPlRRo(#tjJ#cH)dx3m0->4eKvdVP
zPb;EBs@#5lrf?b&Z0F8G-^$%YHn(=5C-j7yF-sq>n`PE&jSM3-pNA?kV&j^{6`j|}
ze_QtI`>I28Ve!7=SjZCKQe>%XWauTYR+v$0GOJgB3;wzRGyQ5rS#@vg52Hb%(jH7
zCDSOnanBVEvE=|#BG7ZWo3m<^jEXdJJC=a2>NMfHDlZUXc
zPrSdfr*2^tvL$6Q>i%wg*5bqTdd^Dtb-`-
z^BvKWD%r8CH!X0^wnJo*rKQ50MO0rR#PawQ7LM~gU`|5zOI>%Hyj9J-YVN1~cl@?b
zKYsn}$G`TI@Bj37Zr|T(vF;}cfl;UP>_F4_8sf>Bh3V!#Ji_x_R;Z>B|?7uCBI6SBHy>ao7}xr0P7Yk~<`4@XgE)t{hzw
zhB2aRi7;zHg76yA%-$d-%!gta+qza-ZVM}xqNlsGP`eR^HQ^Z1=&<%tcwkt~gj>6j
zHCDHfW@{G(IXVvMfoB;QBW6yug97qec+wbiUv14En~UVpPm$zN4628P2NrA49j0k4
zwXKi4)2Q`_3KG&e4>L5a*LSxgvlgVQ9rK{ksE*g}DdkEk<;9j=O&6rrxJ*`7uFqyR
zMjS5u`Z5mNfZ0BIe_x-!yZg!8+u!``{hKfD-@QA&f4?7(d!{b8;XcOU>gw7}Qou$R
zi^X}Gr+uF(^{gq@n>q@svgXW^8hI&1bR$@0$^?mmhqLPuv7;;nYxFO3vzg6(Q=W8^
zVmWH|g)>jGASoEbeT)F?{_a@J2+tPSb3d*c%vhN@>*Df&O8K#``q&L>>NB$tmQ@N=
zhfEYm1LiIml$q1Fafrj7`>dU`A6IJa%PetiA<<7Y3PJ^AS4=O2Ic^2PHfj~`!M
zUmY&4wh_aPu6(p4DOv(%V~p5V%pO?o<{pB6!c{?wCUOrern_xplgiP;&H|Pe1G9mb
z)ymQ$RChKr2CR#KhE`x<#R$mC!AI0SyYgqtraVmTMtBGnNkw6wYs*Y?%b6;x!hPF(
zuE>w-RC?XgHD`%9&V9lVBha!%vgaFhd$yIPB$YbVVaTfRfUJqhNxEX5HMks>liRRx
zgj-hK?fBN~i^GNA-tA9f5M^cCFb9vvIbvJr4$>sh(AfZz-prbQME_642)Q#{=Rms|
zb$=@+3YtB(1xMoyvc)iKu*TLI;%n5=*b)tcvB&S0+EHCA3X_Cmgk4`68Smd`0>@)r
z`TQgQ(m(O$?T0`8KlsZLe*Ng#-Pd0_2AxV!LyC9QfQ-0D9l}i$=r8a5OSOJsKqvC)
z#C~W~(0#jNj7}Y)eRiB3J=#zL4OCGkSI4Lv{gx5&KmkUnu7^oc3WtGh@(a+z4KAj!CUyq
z+(8y|#D?YTD8C<#hp|UfJhNm^TA1wS1m@loS!d2cQUy?UB4TL@bn_m4<2PtlL0Up0
zYzcy_TWmDRv_$qDWr;IW%{FmsYP0$C&YnbH_P_%speDTeQpsx-)ngClClqd~uJQc)
z(FCxyyvop1i4E7BgI-sR2VvowIB%oc7M9ooHX9r`vV;eWYcSQ!y+Rx~X|g;2>_zQ*%eQ^+T_P^R8C+?$EGSS8uI4
z)6;gF*;bPZvzaQz%yLr0`YlFvodQ;+4$92nO__J)WQKXF7`|=JB3we`^APERA+4cG
zEi4a1p_VGU2j@FR43Yp?cXm?0V9qkb7{)RLdcLs$gNK`S@}cH4yzgOX=eF&NTFCQK
zfzjI5y|qTbkS&wGJAz0i^mD5{bymB`QtrZtahkJR(1nk&B-7PHNK@ubaSS)JsZjC=
zwk~0LJiy3O6W-^bHi0|HIj0a586dJbQR_*DrHcte>ZEn~HO~xuNPAB{QO74jgEq;rNDsimFuQw&nMEMydAD}q-a(Rv
zP6}9i*%j&_xj`Aa|3ncMLRAC`N>)o7eHBN*XqEcveX`4RRL&E2_G&O|v-{*|d&GiS
zrN%w<=buNayo%dlynA>0sqZ}dz5m$v{#XCI|MbW8h3$*9mc`UnRDj;{=?UI
zpWol#-_1G0?9t=PCr_@v_31}9H;+I1=;rmy=PzGAdvbmG=*h*^#kjm2MvM^I(gtWM
z<{IVRVn|EfLle#_LEO@wjIsPJAq-11!OJkiH61Fk387i=b>|i{B4R|hh3M|l&FaB;
z|16h5Z}Fu%?$1e@wuY+7Ne9M=S}7D+4b_Gglu8?lA)yL#;UsHaovG6Xch!~`Q{=X<
zV~QPI*KIk(`Oj(Y9^Ue_mOp|mrs=~;h#Q%@gWN##g@UyZj&6WiNZ--tq$cM*Jj|+O
zYea%s6w|eBad9~gn_panyU)b?+xqcmw{PFR{p{`CXK(J_y*qyW{`mfGKTV=6JPzA7
z;`;J3BEsZZWk$2P*YS9ihZD);{SLxMoc8^6n#~>%T8at*k{Y>YYTOQOiDZzsoSC`r
zr^!%~Hc)QyT3afPdTR<4~Ol^
z(?{R>9gynPp%$aUtV8bTwWfw;bv(Cn#46rdT`jJ9&`6`5Kqg+
zXbH2`#%&`N@8&k#I8{M7+%}VLwBR%k*X0ghRLHsZ;JGBUGmlhV9U9J*Sjme^lOg7A
zMO3v5oin_#IysX5p0d6*WKE&+&|GmKvGk784T%E|Ofmac%L$X(xcXuQ}
zuZNAy0#S0ZF81-%$iPYiVXY#?JUT^QZ4A$}O!J)9$ehW9-#e4(48A`6qV{jMB@j0F
z*;tp_7k1X;cDt+Fa0L?+TC;9WXx>A(G6{xnW?rkFbq}(_V^$Gatd1^4hK=(s1bQ%1
zmuMBw0)*DB$!KNSw7B>Ah=MyKMzs}akc(k8WTjh}l=o){VUcO8`_;1%0VtiH$X=mJ
z`tvAJX;Ef|Zb~PH+=b6i3g?H7g;D^fc?{K;;)~^jY_Rsgivf29@{&EoW!B;lmrJ;?
z><1yknNOx$8)N9~LL*pZ9@_Rg1?8uh%$yZ5WTSo#m1)71nL0EDM*G<-3|I;!nr{&z
zk=l%*IT>%AjH;S{AU^;Mk3~wF0f^Z58e@~-N19Zux9b*F%C(avfwRO4
zmd63+F~Vh!={~klw#3-t{eAt+r-x6jyE1ImN`v1^MWHpn2BOqE=(DICJOdysY$K|$
zm#`nULZ;SXMKIe@y(T3!QKu?QtO&S`Lx8dlMhC7fJJzl|3o=mDkWx-WSS=K@5kJjO
z3ckw5D4eT#TJLn<8DU0KY=IBc+=V`5vYnQ~Ehn>5U}|_|mWEPtJ{&q@jD63{%8oc+
zp+|96skq=|;Z`1zm5O4PGj&$7eA@Sm
z)rj`eYl%wczE2I~dpMGn>GBMS2B64(n^vT3ON_O1`4%F!Fr#63%*@mM{q5;=y1lzQ
z-rr}|*l@VmUcP*M^Zeu2A3gu*)y=Dy&u^YyT|YToU5u-XF}8>>XPJR4_jF-Nux&Jv
z8s;lds?&GS)tea%@i4UGBTQN`*N8|b+8Z71o}wg%WUMbYoHGC@@ip9Q3@d3~>%Y?i3?A+>P
zuv8Qd0_WSRH<0F+wBD+8N0x@EeHnTIZ5hahiAf1YQ(A+bkSH?sc6!9FL8x#LGv}O>
zgjMa5tcPufF%Et>c!bkz-|fR~{n~Hbz4_w(=WlP{etGxq-SNZSemZ8Bkq(%$jold(cxJzNJ1bfU?w7mR6
zA)9XVZ_3bXKh5K@R9VcKL`ICUZ6n;x=A8R}yt}r6FE)y)!bsblC>250|
z(O2wVM9ltDizji)gilxoNm{8QFp+_>+mSO?c8plkHeIkVS2^5I1tTK6?lM#_3|IIY5s<^@Zw7YwZ$X)ISs|H#nR2AVEjX|Gh
z-x=~h3#iNABoyjtDQ3bubxf@w_X5f9efsS0{JpP^GcSj^VL#OfD`KBHhRcD`hBGM(
z0J1uzI?TWkGWbU`x}?kXYG`0p-P5Ymo!+1{;cy_cSx9$v|9xqi`EW=mCV)@KzwCmw
z9Mr6ybAO7Ed=4U_ME-vnG
zKbU!)EkpRgQak{X7TqWdGjGCSsWQKzAmxL@FZu##$!UKvqhtMZz=%}4XUio>JyEY8
z^Hvr#_N=x*eFUVoXh}<(GwJvDXK?jL#cIl`>5r_bF2Lg~ZdX@DqTEE5J#=%b$0k#(
zst&PHTyp3--y8kgA~Yjp9-3JdgJH8~h+qE(lA^uu5oa)o>&q-1O@bCN%zBP*6NX(
zQ0mPn&%ZU{&<_XhEB+2=M@PXc;RdB4OIfk&M1=ONxsO;_XV_l$bKl(_
zMGL8Uro*A#*bGn8P}X}YC*67G%r$_~Hzw(l%_z@9;ghastNIGV;9&>zDvkbICf7_j
z;l2%Q6{0rp4EqHA8oe9NN5I`FwU74J)y{@42P*(
zXjQH{KiOFuB$#4sqaVHz4FmvWY$EqkNhIqy1ze?qo(Q-Z3t4npCPv`xJx>?BG7Ph6
zsIpw|LzGcT7qU*DX27L*p~Wyw=;=SeBDc`EoTk?0Gu$UbwRF?mzy;W#8JfPbv^FCg
ztXzkt^b}e^>$a=5^lb~Dl7hNODbT7NM6uvVeYVT1?aMFkKYID}U;0D;_@DkW|A$}s
zyMOPKPrv=){rjyfVsq1zl)WboTbOyy>ET1sP}C?_g;`coiVt9))ApT4CNu~KNEB*<
zuEHdkoTuac>2&;Xd$%8tnLDkuqwL-MVHaGw2s!xsu^H*y|MP+y7$#0qf2D9E3KAANj8;9846TE6ppAQ%JY`2
z9cC0$WNkr*7^tkd3y8w82y#2bWup%+na}ZrcVD0W{%?Hv;>+7NU*3QI=Jf9C{qF8`
zI%ZDN5$1>OaCPZp8ydXb_X%L1bvn(}Pnt4LNv3?sKoWDNhtK1_XUc5pcsymL8u*;c
z2U0bcX|x-FRp#w6w-GTyIIsy3U}phLT@vUvQr-+RJ?k8hqo
zd->wo^P8tP&mKK~dj0tN>f*4C%_1zk?`)ua35-Vg*oK)6@jkA}Z*%u(zuYp7qyo~8
zx;f8Y?%Lwk1)hpHcMWd!7^+7sS*EHN4baF?utz$1mKUfJtFA?*NRknvY(7*ZR4)dj
zU`;oqc{p<^kIb53D#};6i;r)X#Bwoo00{Frrw{jVu9*c^MR<~8WUF}E_rtc0F;t;@
zgbWMM0p=ryw+Y{QuV?PuwoOffbs2_-28mXpwhR(i7kNMV-A}I$7k1k7a5)UFy8)!2
zqXt}cw_cgNc3A3p3ao?rg?KmCWk`10-l@&Edt{qzsM
zyN~1Ck17nv&bRKjYPR&AeRRsJKpXx1hET)kRL}
z*hT~!#QRE`ypRF+(OpxE)6gS}I3q+N>kQ~5
zrOXN+1kWOD>%<3YRRo`T?gA!!YN~}^Qoi$L(R9I@VR-_
z8>i8H^#Le$fvw00e|TfxP7Wwjg`-A49l0#v)94Tt1jh1JaTCp54!Tw|ZB
zL}Y2wQP!(Vps#Frx7LZ6IkNd2P-+Xj8aE3Eh?vnpn7t3WydQPUea@uEpSr{tc2F8loIYf_i|$&
zUZ$_y3r?CkKTk)f3eE;`bV*gWAiBNDf(B=(6RHu`g1$y|9V)m--WYaCWs%`)Ca2xAV}FtEvLW7~zqbIc2q7fGbO8#8}u4G7It_2Cd3RE9xc7)rpZwIlj!q7?zV`
zvkyDoC$8KFXySFrNgQ01o56uelSq_HVbxbj@Bhjr#9E%2IuInosB9(VA~1S{&!az?
zM9$5r>Ci1`c8;)yO&@SNshZ7oUXi_+h_?K_r{qEoS
z=^y!5{;7ZGfA$}P_3D#Xx9@M=_QQ5?_iY;^V&RO~t`1zLsTz66eV>|{Q$!|^EZO0W
zF+$jwv~QWWcei)&!QEY>lCsPQ~?amc=g(^bwFvMWacL
z?Fw4}O(=lCW`lb`)JV7s66%-=Ljx0vxjR=KENwb7lPn(;37~n6hJZmtv?|`ZsOq9d
zBRuS1?4o_#tcOCavjV$qUNoa`6
zoRFAHIi((+vwhq5nOp+PnRB0WjL{K6{Uf+gMQ}+fj1+5XYGA;*qzaXld2+X$^K?3m
z*hFXPl-3KXnG>McFxgod=DtTn*38NdmC?bQnar^bGiGMvX@G7M56eB*KdGkNl?Xb*
zJTl7-CaX5Nk+I;C^d~DTvvMyoOXA;(h%sV#$N;D+_x<$#yTq?njV*>k)tY0dO1kIpuyErUf-(cbJ!0tCG;j>De2dN>oZy3yfat~?F_KnhWb?m(*bjVdh!4y}$-y_pqZM9w68j7#2i9${Ur
zDJ4Wtsz;%;{{5Ua1>{V3Uw3!sy5;0KBEB4BShS4{?v8cyI9|WH{`KEDUgrTWlFVX+
znaMN1l4@q~fl7!ShWhULz0DsowZI5E{cyEMQ8CA4uOFlWjr
zj!Tx5q-T>&R%CXm-W5oZK*B5#hDuB$44d2arIWn7H#>|Ex2KOkdh|c}Gk@d{|B*NU
z`Ct26-}(M`K74gwjXR66G;^zmKe`O&9%g}sm5A%YDgv}BR1Gv<2;oeIo(y3d+EK-3
zB{i?EzG}HUS(gFm0TA_`Z055I{me{Xo!I)XzAw6ZmMpYAM}>cOEsXw0PL{XO(ufIp
z3%8a`$gl7hKoqz2ouWo;_!8iE*Q06$2#=Xf4Co7EQI1rdBUdrAR{wPsXu^83)KaU1
zYxYPIUxUFN%TtcTa9^^bunytq%ase@5J9M<AgCw?F@IfOhi8h)1^{y}c5t@P6panaw{?twa&){=|Gp8-++!ODz)I?l2#+xH
zI1Dqhuo&A24-XmFZ`*jk=TCp)-+m-)xGQ*X^>4!tXL@RZSTLNYrceo<(+c|tPy;Ds
zqiwajt4yvf!{+hgye9?YNC1qk(uCP0sxS@!FlQ&N##-AoLIsSy`zq&
zOF4Xkr9a9nu<*8XD}po>dQ47h+rvr|;|_3{JXKowu#r~WxnOX`W|RU8h4abqCBk4)
zEA~yq4Al;6w?hhBD>$>f!Cfs^jNwIOR)n?3zPB_#A~JhEmdZvy1GA=5*<`X--JdQl
z)Lj74aM!<5qB_*+1q{}{Tv^48vAKCw<%*_v_{`Y@8{QRs!;+*f3fCO|XyZ!K2-69y
zmspOXhFGwdeOY|9KuvGoU^VBxRs_R}eSr5DGqB7U~cDV*i
zCX0MWnhykv?I$>s=*J6<4eNzQz8cK&7%sQATG-zX*X191afg19&HC?hW
zt}1plHfuTNp6fjo8S2ccAV~&LOKRKjnPpN!`Y|L2=a?s%pE{HlD{^-BuZ3uJXcUgC(i?s!{rJxO*v0#@CPwSZ8;y{t@im
zCm$XnrwD$P=GZpByoig75pFO)p78Gd@$diU*YDoleevb(+jn>GzM99oyx(&sbNcYu
z4hM{JxZq(MLdkMwRqk0V?x(#)m`S;ILGD_zRLUx1&QvtF_8Skk;J%lS
zc9duu!re#@pGv!NXHEhIr7#!_l?C`1?XjPkIOAGoRq5u%(iDlCw}jaBUE2CWOoVk@
zHmmA%++~6>bBbxy@`fYa2RySf_Yd#y<~-dWkC`*VFD?&PkFGxY^|YE18q2mePTMwWC>z04*}Ym<>K!
zn|ioLsYQad!ooEbFR6u90bwktp2$oE0(U#MKBl$)Q*pb=^D)pTJ)|hkqNGVxDPKTW
z?z{&x;mFMM0KP2!W#0wRz3T>crGkg97#uJo#;|!L%Yyjn?>zg_kAIv*G#=2Z4-EzC
z$kDN+lq^H@tEz}3fQi5`#1J&u^^866S<+pasq#l#lK>R&s&r&uV1zIT1xB=eKIH9>
zaHWo+0dz7{TdxH^Q-fnRclxjhTwg}fPkY(MyW6{;``MTO-9Pn5{?%XnGe7y!ufF>B
z#~;4>5*C1VWaFgL|7a<>`xs-1O*G(dkhZX2t6V1Sn-bl%TKc`uLRJw)cABlwEv<=S
zg@tt!p^I-N$SfFA2zG0@Vr0&9v%0G8c5z>VBUAa@!FmQWtL$SZV$>43S%a=xOL
z$_GbpHeez6FvEFSyOO*5v?FNkJ=hnCA>c}W)H3jMp`$ahdiENmJb=5^>mJ5f!Bx6-
z#*#Qf#l4!yXgvjiIt?83EHEKdejVe@&97-w`7sI{AiDQsao-}K^o>4cxW*f8-K=cI
zQffj|*EiOEZ36HRX7C5%PHS|z?6yJ}y8Q-L8g!NzKBqRdEJ?aK1p!Z;>D*1VV`9N8=!pnX={CnlIAR*Pa5|nNDtV
zHX<&R%FJk-6E1B9%~m(k6A4oJB{X-p8qITGhLGientdJZ!Uh@=1OYg^B9>Jl$i#><
zwW8V7YJ4QZ0o5KYJwP{_aJeH=j;{t;fEKH~eUW|H95&}hda_tGWZh9v?kfnBLJWSE
zvLe&nnba((@^Y#2ABxWLB0%&*ZpylUSnJow3QAM!sq~URuXO_Q5*fGwETo
z>=5?FeVsPAV;E-u$v`&0Spp~WK$9pJZtnDKxl9#m5l5huw|zQvx>6S?rM<}_tN;Zd
z^E{=frq9CR7RtMTc_5Q4`cMQkT$K=*Od}AZeTaL$g$qsTZPbNv_fm}kw-&t7dYYRR
zGV5@$-F`Uk@819Ozwp}*hl~Hs|Mvg>OMml+-}=@^PoF&nEa%)g1*1xpbB1_H`iOBj
z3}Rx=eeS2z-TSXk$9>P!oEdJH7vtvHqffr`(aV?5U%tF~_3GKp(?`#qTs^)zTwjjE
zSauYq{IO|TBsxMowoM}Fh7yeQh*;9!u7q?ZEZv7fiE)DK+QL@=s@AYaRHc4gtCY>9tF`k3
z(QsCYO?{}v-E9oJyc%Qp;V{PVB<}9(tFMpme*N8>x3`~t{^9Mr`}enbf6RHJ48`4i
zL~Pr|)m4PK0h3fqc0AqZBn|uNB&jNinrZIjtW>?4I<(g#YKQsbafgRS9@uW-Sw(jj
z>looVbGGRbs**{MaI=|Hg-&ISv8g;srBR2Y3{`uj!D1UCQRbe-%$(t|AJf9zkXcm~
z=2fXvt|?P+o^ouVPX#Q499f@MjWNtD_oWQF2}~
zliCbn4oTlvy{pTeee=4(h>{kQ3c~a#mM!_=>eHKb?=He@Y2^FYP{>6{)Sc)cuBD1M
zBNhAPS!Kou30S&e=xT;^k78+lUPAqqKhAvhUT}E;~)z_AHyOPe1HfH$2PhaI-`#`gMq5zvemBViqINE
z>`Sj19`NA;wAD{kn^3A0pA#BqI8Pu~B8FRlNltcQ8w7C5++g8;ePuR#hE=qI8U)Pc6jX}sB-
zX5l`-x#x7o8mZy3YW42S0fWgYvnsPrR9*)pp9RUXf|c9QqgOwyCEg2}3!fH6|BY)|
zu4f>!N>7C(%WSx7DqUU(4HSTi2vTF|#x}sxyL6z}tE@g#JsZmqE$3{`yqOYHXkin7
zD`c|c4Pc7B{$8
z$t9>mED}X$_#sA^!^2G@uAz)p7Hfo$L->eUdAP9O@*NMC4a_Q}8kXv&0tU_9eA6PB
zT<^yXgiN*+V*p=*TY)bP5J9c7;D{J@eosDHl@WoNs{7H#%ZVaR
z97)&Qx7-Vc?`nN@Ob?rKZZtqKy+ES6v=u~BGNxOEk1bqMQo^p}+Xvg%aJK<6fE6RL
zw8tPR7+R6D4K%qLZi&tMZn3b+vWVzj6J*cgRx!*4>Prqi^lMhIY7I`!q+yn2%&ir6z=PmaYHwy(H%86-azZ)uF7-N4~U4>l%
z2n8c(_Mk57z3x`P)%D^1?fu@Chc<$sFYPhS#2yP_jX;SpTI@Tnan|qqM
zhl^iTv8s8l2;Z{`72&V|W|2(Bh|J1NSwiYm$|5aQ0;LeflIpT*F(i4Kq4e^ZRiwuA
zs6-`*H}o7zjHsLiqRDfCEK2KYjA#(UYf-t{+`pUtf-J4_U;h{-z_P+IMHTjd3t*c%?`C8i`_zz*54W
z*R*8*nOU@mrc%v71=x#@wWcn#JJ1M}8Bk@U@<;8=&JE4%vJ4m=CErf>GuR;$!LCAK
z0F-u6jhGKtm(Y|+YcFF2r_d`kxeM7BEYNv2O{PdOQX*%Itzj`U_KN_zJC(N3m)2v&
zvAPKGW^~ESJj*ULKPCQl3>%uXN1v7ruy*(*7DUzniYjm|+Er#-mNG9<#N6rT7XerF
zK;k(0`e}Up`ug)XJ9tp>4C~IVDFMAty6gsh4a9C6E{1I)-a#6c#NeSTZN_JT7fpsg
zxSzZtE)kqY33Y`%S+qmxX-er`~2ho
z^6&dwfBQ%O-v9hBfBNX=`q9(-+b`k4WL8`Mu^od~)2fT;
z`AS1NJualeK)0W|%M=JDPw&2E#K5urMYvegbNj_=VIOOTZ{2+A^6m$waF+!EtA~>c
z$yX1-78vN=a)BS_b`DF-%nldcAIE1cn+a;)r7JSe1l
zO7QIaztXPcPe6C=6ZT;){mN9eYcd2D!KIvCnnJm^vfKvDNeQ0C!B}yLQ2~TkX>_~mxpgz>V6Cxj;X|jD
zEH_nm5;VX=MI^T2_s4ww^6=fq&G2QhLG^y*t7uwU0^qz-99ZsSt$$u8i*fF2c3Kp)
z%aQdwlx`y+9!!rw^pqP}2<_!X&l}8Kw1at|CcE7e`skWRUHF9c9IVn}tp{1*F3z&G
z5bnt8_FHdi4CJh$jR6N{5@4TM-GV%*3cFR%Cq$$Cf(g-*Jik3
zTqp};i#Zciat{_Ki1h-XLr1U!S($wyYvY=G&J>o(23Cxzi+1XsD5+3b;xtH;m4_ak
zG!#r?AuE|$S4|37NP6I@-B`>j{esG}b!j7@vQJaa2S#{iInzYF>uZ8Wj6ycLQd@F;f2)*a|w+IMF*!QzYW_=8yj2f99X~$AA8>{FT4`*ZLtcJ3ToWfWsYBaWee-n?n_0msJO8#)s%E$mE}*mP0Y%|oS
zWw~H+5^abLj1d=?+qU_(
z`8M3#PCMRzz_0%J_RSX`K6~@w&1bjozCPU__tS~{i3vtTc#Q3EeLcMSAJt2i%=^1z
zCP>V=@B5U7i-yzjcs^~+jD{-aoGR1YtTOc#*inR-Gc#+>eTlA}lNs(K=5e3eCF?WS)AT!4p6kB6vz|7Jl1xP`7
z0F;~w@li<0bLYNmrV(v1%DGRoSON_I;+9PnH6ZO(l08GAcXl|8YUx2M|8vg?GPA1m
z#m@q#h&XJ++^S~PJe~IA@$Pgy5oP4%<#u&__~et<&tE)!dGqwy&7)_}9zTBc=<51#
zv5mta)N=|gB_>fYYQ)tX4s2t%v1b?^(lLa*BF(zqg9H!)rfi{6=))jTWvFs#NoS!m
za{DAVw3pJliTdb7Pvoxd1&tuPD}PHg=b}CUAKr)pVD5p)JbUGVGsV4Et0&lqsasW5
zvJLY|X};V&tCTDWAoncxP`xVFh^S;$5zMMEw?(nKb>?b)^DA_ONe>7ViUm%9l-7w&
z+!}~Nce5=#X+l_tYL2n7+MVB*%^wIe*TYkY7b(LY?>SpT5jmL#gl%E>dz}(Dh97+Q
z`EUN@$2qxOdVAReSs0r)5I=k|L>yt)7j|(#IKx*Bzq&8|O}98u7h)?1pi2dPU{O12
zG+73b$@&*dd!ti^V;oJ7EYIT2x7;Of%ey*DG?-SXuV
z`|tl-|Mg$~yT9>&`j7sTAN=;8s(HM>ztc@nBnYdu~7hZUG-y$L*8qqWb8#id~
z2$*UxL33DBmeynv7Spn7B0-BPR
zra~weS(>Qg`C!*e7wyy4n$RyS3ouy$_3R_sAl}U2=84II47jV#&$kB|75
z>9hVt4l7&OXPAl4K%;5kVmkCf9HW1PTC+~|rT$6Pw7%Y~`vIZ;W|q)wY8ibxnOmUXg>`*GyU%FGn0nRLl(j?uY$YBa0&O9xt!!K5fQ17NSvnup~(-)7AmKkG_Pi8
zd$+nv9V81D(jSETG1Pmb_F4_8>_eaxD!NP~JmHO45U^}5D2Nf3i6s)T7*09dkl|K_
zlF?{Y>KJRl)GDFd(F`!T-h;+UgvWA5qnU-Fa=GWZ71P@Fs_J~&HIRTNxU9{+ly6?S
z)JpDiPi6fPWyKL=-;+#pZ*_yM)6;D3rz%=A{hssuR&d&<)@~QpW>Sszj}8yV%!*C4
zz5;c1N{c?_%smWeIh;xqVMbZ8FCRq&{6a7--H`4OP)yOumI%tNv6WrDlr(oq>Qi
zAjK+rSU?juV)Nhq+rIO2KlQC&|H&6W`nAvh
z{*T{$_W8T7-reoltM2OR@cjAX*RP(we);t20F
zhhgSABf~?JlMxncOniYcos$HknG6&ZmDt|7W)fLFXsEo8wN{U)oft9tYBRdQ8Le%h
zEKkJByRP(blWY$L`KXR?pat-%aosF7^)0p_62xefL3c;QI?B3Q!JL|tP+d`dr1vG=
zCyPez-5KtVAgpHk@CBVp+Q1mYfDU=@Evb9bVqhR9G|ku*fJ?{#gZJzY9L#JZ^ge81
zFvU$N7t{=UR%_IUMcBo~xVVUmEnqf*`+K~5Ki_`&;qBY^pS}6;_KW+kzCPXG&0Pvx
znp=#+*tWyrAcJ9vxhiueF!$L8UM#rJIhg?LG*42rk~3#QTW?N-6SeON>q5YE@>k6)
z79)agne%wuRl&P^De0Fm*zjTQmGl1Y-aXu$s1$+BR`2r+L4YJO=ROIRs6z23($@G=
zZlELlL5gj=H@Z?+_nuJBufIEWy5PG(3ojX
z0;w)-W{OlCn?hG9vB1o^vqxJiQ=pHTiFG6l;PEu?Za#M87<;7<5ZcurXX_!{@;aVhekm~Pk7^Yv!a2wmuS6L;V
z%Q4c7_W!5q-+FahxAZXRd0Kn>H%@boIp$%ly{mS)YF8z;Ln?tt;R1vuOE|v3B7hZv
z6d46sA|&D>7D&J~7g3@J3B*5$EV$qTA#uS42!$ZP0>{|05<3UtD8Z(7?Y-8T=P|yo
zzpXVcp7!=Jvr5{v4s*`&eZ9Yj)}B*?tC}}?L9@(lUFINda}P~jhiVozs8m;G9rR!a
zKqHM(RtimK$8OTymb+RdbeW^Fs8XZ3!ODmPq=jXxwxs)8W%6slY0m*Xzq4Ubs^9V};MvHCCw2lt-a5OaAJ3ay2x
zZpcCSBEA&MBn%y`|0^@AOgD!lW?jdi1+z8pZw9k
z^Y8w>-}_U)yv#q!n1l-?FdG;r@sOmc3+px~iI%K3BZXE5G+NlFN&&@;oa#m!cx2l;
zDoDBwHObU@C!dCPPQyNE^WBmd`WPr^P)*KUE2TRYZM<(Xle!&{{0^YbCHF>B*3an1
zkexOt{-7dajE>6zJ7{CnYC;!0WUKJ$0Z@|49N;PdaLM%hV;y?3(t?%%0qwm};0RYc
zE*wi2MgUZrb}FqUkt|tmCFfJBiu)irBfTdm^|^;EHfQ>r`>$mt?3nVDc7oQ@G(CTw
zT%2fvrU%QFN(5>2g*9Q}02+AFG-LHv=rxUwgys?8=E|S#)2G|&Y~criOwv*|XjMjl
z^_|+P-=irL7MQD^IP@j`%0dW@x~w8N=QOiQDv2_y%!iUCnouW>39f>Vq=-Wk6#xpx
z$|!1|=&qUWTT$187ns>Y9Z`TUSOM(0o!y>WRhhdEbFn>DGQ14Xk{D+0-tDZrnQfZI
z3JT2?AN{BQ#29wqqn$i+oL|))JoYFqd;}184WaYf@Q7+v*z%A^CniuwU+@9V%}n=yP2c1Ax7OS)^}DNn@Pf)5_i|-s$lSjmPLtx$f=cQ
zW3!mLgqk!~{JrK|2Ae3Bn!?CQ&}xBTaCd+aS(Vn8FIvib5GkM;Lma)C=5h6c0oj@F
zMKE>V0Z!{8)~q5y&>1s<9=6dsVUaL3Gs4+9*rur=CdyYyE!>7@l(`Z+QhA9nb$xoo
zoRL*I+-5AG4oJCb)ul?3Qkip_c~&g}CsWU%0CXO*3ea++=0A~SN%*Jo-Q19s!QqtZ
zH)q9$%o@gzXFOivmD8#m+<{Bh&2uyl&<1G*YoVrM?I1L?gEZP1ecV5X&~;g-$ZBnN
zmnyYD);Tq~4tgmN)t_YsCp5ZNvlgrI9mSy)PzN@-yqludhy<`CvsvN={yt(?QAq
z2yRPrp?b3^P?d}{BebI~Mkh_v=|cf#CoIXs)y
zl)}8K3^1n(L7K?Aq}bPNvR7Sx%rxboMFH?(rdde~v1~j!Yh8?bCtYRf$sdybtn67e
z%L*?^sH!bp#SxW?aLa__xO7y3B{i|eidGeF%qnZmRrQcgjYrQla!|8dRx)2@(=(x%^{=1afB5vnhp)f+@#{}Np1*v)d_C`%r+JxW
z?x)jswO!x65O~?P-YRBczwG-AJ*$v&+emOmlu$M&vSPL{Fyx?+jwE!qGQ0e**n`F~
z#^rK}5_bsJe?maWk*e00|h|3nK>(SUiN+Nm&@gRzFaPsK$`LX#qHbg
z?%%w
zRh_e->skNfZf-VbbZ(mtf?RV(dZM}cISl^Xe`Q>9#hpExMcOn+FXmKa-PzKsD?H2YOF(}kt=
z6s6)^tYfj29hC@4TFfo7n3Zn&!^g0g^YNVD-`V%y-Tm;JKmkK}N;Xa&86Q7ioVb6n
zy?N!|zqY$;Zr+uqZp>0IwwlTg(a9c9qCQDzgsKk7+W}hxmKq++rNhr^5cUX~kSj?R
zowfR
z|Fa){^{ZEJ-+lb)j|Ey)p=y8|&6|)@z7M2ytg2Nps!i|d7>i_D6`B@eMrNo?liHk1
zG2XzO#3nQjm@afMXTnyhcAsV%4AB$0y>m%d-2&6{Khk!3P@=fqMGPNWU(3qAZK;NE
zajgc@vT>HqIVuIznN{T|%_V0CO9+BVG!(53c&ugtQQd9S>gKx&dp-;0F0Bf-kY2^D
z`sqGnG9?1B?6fR+&tvR9&5VGycbaHEE>Nd0$0k$R@IgHb+FDb$aA+g4ul`j!2HLNf
z?QL#mQtPAt5`2(I^!OlsnI>$TkU^gkRoRX&ffi~wd#YsfsOzA^B4l;f_mf+3u-(qo
zk?Tm9;%-Yfx3|BYK*?q5@MZSXl$T6*Gx|Dou)bb<%A`j=`r)d^*d(ht?zDc=@+8{O
zH;O8=;SL)f0muo_1H^~9QBwqs3PvixwVI4dtLzHgywO`(Fy#p|_c2I_rzHWWImgDC
z_4&qBc)n-WO
z+CI=>7#VC(q_=2xf!{jkk{(i`3`9&YOd1N73RQ`(&XzMY;)|VBQ?~+iuCO{aK3&mq$$eMwy
zFT|(Bz0(09!LwM0UtI@JF>>VTC0uJP^e+Vd_r5
znwk4P_sh8ooALF_jrUi&P9-Ccz`pM@LBklXsa9k2;f5?59PLt)A)*g|YI(PO0yH?=
zaiH6v9S*kGgMKt}@@sH`MkRry8gCluu6wLiGv*Pw@A3_^{TLe8yhOa_$N*fmBZaZ*
z$92$mBewA2YV6y2$U>*i5=#@H>Qp912})PjK<(~Xi8h0%8@Htc>Z_zLlB(z*t-6g}
z=U7J}CAvjMlM;YHn7u>z637OB0JKEesE)N_O0tv@D5M*%uEw^FZL{sM#Qp&-qLWNgW?R#X#*oM*eOLS3Q
zJ<<=xnX{@iH@8q3X`{U|S!Ko4Y@$k*G9?zv#vb1QxV}-t76l43iZU{rRTx`&7-#C4kDAnPT1D>E`CbIAX?p
zdOV-c=gWRpQG0bgZf|dY_U6_7%NK9nzIyxJ!*_2UUf$l`y}Z7@_OZF*&rO$61g*@<
z%!ZxJU|bWYe8JdV(UPQX13+aqjk8!ptZI->H{}jAHG+<>)6lq+A&gduV~lrJEj|WVlgY3Y3vNx`b}8ak9ab%=GaaHwWKELP2+rCz%$b33@%_ViamA}mkBdE+MoK6&q-RIZQ>Bx?8je6_
z7t|GMT=-4CrWmV*YpdOL%T&|X#c=9o)mg1^cO_|Awc0cViKJ4;Ny1go*8mQx*{xpO
za*x`hY}m&y=fC(*|7ZXDzx5aX=l|MYy?b?kbNlM?@v+6}9zbdtM7AX@z5+tk!ByX+&FS||-{y@2
zO4L1ZJii43E8$k#b@}{TlZ*w|=n%CP;i}+*VoyHQ%S0lNu_`pLidvH7{?pks?}Efs
zsOT~Do9=F_o=v3vbW6Azy!+e40y&iG%*IPais&mF1&O(ZY%^wn2?A{UgjttRgs|`h
z8Cqd=-;#S%Y!WLqUPY`8v)ICkD#2#L+nXvdt3y^*4*`Fhis&AP)q!npS*dOqggN9d)g3Cx
z&-)+k6dija){ZaJN!$AK+#)QrUy5!!G+|fi_U^p%ZgK
zI$+mRD*{0nlM%6pdVn^JEhk~F5hXfpBV?Z_y-ktrAm>bTtEvnvj~=@0mD)2ZQ09y%
zC2wixMWnm2n9+J{7^)Dn=A;>a+UsWnX7H>*ChAhS(s^Fwim_Se8zXz-gb!%qw&*h9
z4-wTyTGij;yBZJ`-cgnE?)C(s2&EGD7FMyPZdna+i%2PTN1^wQRNb&bgr0d33fwXv
zC_tvvsuk)mnXB9va7&gG~r5$I7g=_BnueBw(XjdRFNoX{FMe$
zN!Icg!io()9{9Q%#C5RxGF_+I$Lg+trt&g6J3yu&l+rG8G2JGGKPBcR`}7O#e73_}
zuo0evndJLoS2*9CMT_iZR<;UY;phu)J+5C=Pq(II1!g9cq)NybeON})R|1)C%hDTs
z=2)_NVK9_G4<59$VNtbGj5~mwp$1C|19qDK8uS{atxGB@#a-C~rZ`T90?{f^_PA5ezwLXoECj~*-oN>gD_iYK=F9pzzkvaE$j6qsvRHZu`
z`=1ExRaG$YvFi3~{k3ps`6gzD>_AL;ohyZOieLwNe5-tqi1vbJmBGZ7R263VaB)V8
z)e#g1omtJ>Wfx#=maB+RWg+3NqG(YmbHvdRRb^J}vCAkKnGw4lOONCkJ;&z!c)9HR
z<#OIZS?pCU-fY$eQG@){Ayrg3xT3CVS
zFXg&0qp$vI-6Weuo3%cqXr&_9S97<-X5_x_N39>(U=^&ZRxBP!>HVZ><7Z;qHan)~
zRIe_rrO-)Rr8UMCNuzy~nKoP~c3-JL0dv<)+O?kSY+92r7HZ#fJNcY7oLKq%cA^t*
z+-FAC@BZTM|NZa$7==%tE|(cE@5V2F>+W~IJH351Zf`hHtlH;upWht~7wS>ZsIO?R
zUiw8WvQdeI=!&@;g+d#$nsiDHZ`1LtBS8lECBZ~hB4j;pKaZZ3x&kc#x|fCvlA0+{
zC?aYArwuP}`QdX#)YApmr~QBUSN_7^_?!R!zxi+cwLkTT|JY^5+=Gg{;MNj5tRta^
zNTLPc-LME4>6Wo?l%w&fDkU^_3$HSy1kwn@H~P^$HW`v|AA;`{^3%RkT~Eu89U5=0
zPf#Qg5pEtj^}RXLTqeH0tZ0Q;?+dGCBfn8ZYB?(dYzfgDz8_ullN#+E70lVkL{|hY
z)72M~492?s?UAoq)mdeI;vkEgkC*|I)5F(I38{3vg?Vazw6N6l@i@WaVQX6QTya!7D+SxN?^(YQ{e1y+zHI-u1=}q&
zRY!+eWnVn{h*I&XYX_7Ub#PIQjH&4+k%{86+INe;+LrY(dUY+67hqY?3KI-Qx_E3Y
zcrK!~w^(+C#)ZP$!LKgltqNJ`e$w;Mw={P-4q&xsi2a6jSL|l)F1>)c8!fZwE?}~t
zG~0f|px{Cg(ge#!mz5-ah0-ftWenYo{D*(ruU2Hva)2K%Q{8K6U6I^|SCw$+EE(ji
zGRu@sgw?4b8}I~K21uPe_wo%!#w>RzkhU?Fggb0V9o?mYdowMokVTYgWmIu&Ys|VY
z)P(&JxKLhQm82jUJw|yZ#iVHkE$BmyDxT-Wx-A3&*ak5x65X*HARRgZg&P1gI_w}W
zXoMt6P4F8V&RFB-RXG`u7(S#o%t|LPJhOy!sAv{-Bm5_N`f;u@s;4N)BcWZ^%v2@=e(_n!T$%gti
zFsU`%SC;js5gs}?D7CPu;?KV9&2gFCXITrT
zDio}##dd58U?@lyv3%}m*b+6&z|xECY9o?vX3rfIvbe#)2q+RPB3+yYINar4(IC8L
z2D%d~6wTSGckTY5yGj{A`FErlBg>M*?CJ^%(lfA6`(^!Kw-J1JV>B9HF}xD)%_#v8
z%mok~OJ>^XI(2<`w(6M2hSFX$GasWG%B03=n^X*a>j3C6i6o<>V{efj8rji74KdO&
zv!I}mC57skv_|ebDiKwQL=U-*sAuDtX@@|5GxK)1Nb!>b$Hk+zNM0qOv8Zgk-aE14
z{T7=FESQZD$PF0>vaf&kASKqyO6a4ckdd)xU%pwi9!9dA?6kR?&A^vO{P5xY>BHCe
zAHMwh$FD!V-#>lYAJ6mr6mvi70UN`wZ^m}gEXE?qvVHDPkC!>;jL4{YnT7JrP?!-7
z^v*sgKqN5tSGHRS$6ksk_r$
z)6<7*lpPe%3n>^4!(C^xMshD2k$d?8Pz>
ztyG>9X$`iq>9LXx5h_e{h93^Bbwa8YLMq^>BSB=_z{1&0`fcI!(rl|5?3Sr@c?+aw
z!%|g}&uILmbror50*TDXG%yzqi=G24P%kl?BXJq8>JYt$Lake000T61ip|SrWbR+?k9`jexq=4yi4)rF#J
z>1vT1I|iRRicvVs)$Gbq&1|ycrMrAyRlcH6qb#MA6Jh`Wi{K$7*_72>g7gH8R)~NR
z!*R1QZusSEn)ChV_?@5K|BwF%|IPp4@BD|q`J;dE>iggR`2Htyq^<0K9FN$ubi*C$Z(T5AG@P@7f(R*hQ5&UPRMs$vG*2ddS`5)q)_
z3iarmSg%H5dMYsp%^L(@u({9SUgE+?H}8GC;36zRu`L?5yZqkty&$U}u>OS`y`tRA
zj7vEQ_Ba#N>IqeIrmdD*+mfYdhqVLx0K+1YyTt{yJaxf0)fq3`bh`W2qvp+2r1)@^;|2iAyW_>3$ziLgo${5PC^Kt+85#=F
z+svij6sRWF
zYR=W78Ih%-2nsjS9U;(o0qhI=$hIvm+OOk;p267a3c&
zHvyRU!st>=pGt!K9_pi0wAGmg%c%DB5^ju!I0&v++l8Y79!(##?^L`507X5w
zuadGsumAqeO6ZJ+{rSHuu3SKArRH*Z9@1pMHA(<;Net
zzW;dn^kx70H6FjtJ)|6WH{Y(d>zgaPm0eCr!nN;lx$HACbf!efei~DmwTjxFd5LYD
z%=q+lR;d?L$cSazRpp!Tj9Dy-AFHX&PB)PA5-LyRBvL1@FC0;kJ)&Vw$O<$sn$oP(
zJXc95MNDYzX*t!>n#PPObr8gak3ljksoPVU^9bbtOPouid^(kxhRig&GV`c5J4z!{
zjW+jCq)qMg9`9_b=}5ZeG5;zPdVXC;5$FdW=jPGM755#@M!@
zdDk%I^p;FLqBPju^%9qwQJMnKYzQl%4a-zptK3eYtb@KNS#$y``hq2i0oHU=5lDd9
zXm25!Ycz?I0EyrV36ZYU#is)^)7^4vHX6EYwk{mhdM(%7iuPu!6C+BJV603&C6Z{4
zQS70nuFFK>kD-^+EvpoBSW$LM>sW;&zTP6UrwJ}xyQTdNeM{;LH)b6iX{Y@i&!%QX
z&M}55_`Ouj3hk|9wKTy{J(W5#=M3|PX}sP0PSA$t%1V(3LtEu__s)o_5<+p54s+(%
zIA>J38)g)WrvV@Q`dB}G+Hc>U{^T!T{?2dbAO7<0``0p})SM+zj9#m<1H1Ldw>>5f
z&?cdId#n~Oi9_ysEaqy97UMd1(rAv@)tUDFnHq6m=;6vnBWJ6Vn3;%%4|;;}^GtR9
z83YkgNt&|)Gs_$d;q|<`vCEG0Q=B&Y`1$U&;RrPwSW0v`(M3$lQ%c_=kt@<
zF!lt@TuxB=Sh2L6So*APPt@Y9Hd4KYm>8_Wqnn;ia8W0)uK3k{>;7nNQ-QVS$eDP)
z3YWmPl{h%)x?;?ZVK;g)GSCq@-*m-jQ)?N$YNA`THD?EsZIpL@rxN2)86?MnC~2Rp
zl-J5iYZ8tNF6>YtH5GY`F>ex&T2a|OW|0u0TKEPd`tJ+LUg7G08!-`aq_ea74mZjsOSDJeKqL4qPFiaU;KKYH
z0>}*gS|i$;pao#fH^7WDP?gIm0#hrMNx1otVn+|x-Dqo8WG7i+!S7w}p}W9^<2MVZ
zTLIPK=EzF7ajZnJZ{Pl%Rr+BIMo>}B6<|QXq5Oc-o=3@?F2SHmY-Q@2jj?qHLlTyS
zb(;}XqR#5p6>TCyTaimP+DmXCYqj#4^>BJe
z7g`ilC5#CJ_DC6GyN*Pw9w5I@&lEs*+EcYcwF>l>w#!vu#t1}9=KFj3KtqID%eruT
z#!s_b)h@e+i!|jl8e7a#LMg0ff=IBC?p7%|Kph$d=#c}I5{XK)G|ko#pU#3@oKr)9
z03E`}(vV(-jwLcH0fjKhq|}c^hqrl$L&nTf#tu0%`oriSMQRu2C03R-U|qyFSjdc^
zgBb0kAR==coAB1EQnhbTZJIvXU|;1`i_KAHfj+w7W7N+!IADYs&WUi2uAvq)pjL8$
zqQ{wTWYgw?2vHf}GH^&;GL}R|wT$e>8n>n=gDN+pf-glLb`15xXn~jr>!zrVu4-K#
z3DfjW?O+ujW-12@v-FWbm^%eiIxKn|jZ)Z3@hYY8k2>0|^^FT#>+;R5X3|?=UkW#7
zPqSq!N0@QMt*RN7R=sl1KuFq0K_b%M_JkyDFrriV!O)V^dD!r;8M9cKV>1A=aWCyw
z?E+deEy|;!4E4Fhg!*yT(?PoP>|0g%h&&@1RW;`v+u)KKQP&kU?TH4KLB}BSI6^8T
zpevOE6}nWamL_FHpD=~i@Ebunv8nPgVz%Ixz}Wou%5QJBtCN*+pZI#lPamFsdjIA9
z`>!89KK=01)5nkV%h$`k$37E9A3l7TZ8tYp+i)M2S=wwF^>m(>IaRP$D1;nlyr`?{
z(>muabi*_9a=uK@ZQBamW5?8{;M^0Hi6ktek`qXXEADSymwnb=>uTEHfKpn=y~9rpEF+(*u!H(69)uh!kuY71E1lL8G5~zw}H%O8ARK
zQ=I%HCb^?TjOL6b>g@A4V;yihu)0`M!9!A`bo4XkoLSYgb3zZK`oB7j7^jhune%eq
zFPHuC>8WbZ%1zqr7guk;|L)z}*WbT={qDOrZ{FPB-``!GwyUeLIo+&gz!FvDET$Px
zW80kOHZ&g`9c~1)iXjs)cayjmwz=p8I{@fX&d@SCir(+$Fi~`gcnQsqDQh_@iv{JJ
z+noDxfev>7b52ykT!==lp`g7foJ^%on$B|eU;Ve;y>+gBvDozikfG`7W;A2la*jUaq$Dy%2Z;JYpeqf1
zBoQa>&-YrRRZDSPs2Nj7lS+LS#Sur9TZaa8*`r&Kiw4l45oNS(>(^wKs1jIgr1>#c
zr$@?y>XcGyX}!420vpkbLQIIf9mbjXC;#+IMFFF7Mn(3#BB}7$5}5A3us)e|KdSvA
zAw~R}s`BxYFK*|5|G)R=|Hj|^|NI~R&;O6#`~5%6m`EdKgH`Xe
zLNSkT+wEx=a0{VXE@!QYPNRC(=#eC>5bGK0cjzY+Oxy+f8|oD%$u!zBu{{%aT-Ho9
z1=(aq|J45Xr5=Ah|Hf92mx;z8y5L$&Wv=j+Tq4`jyui`fu|1e7WofUhswi|n(++NB
zrJ4&?1ZWsXH4Gk)(@3TDsM~4%*qVzdaN87!Cl7p9bosg{0b+P#BO;cKYkv@6}6`_1c
zoe8i48VI(fF3Kp5s+2cR97aY4a`mtxvH&X)VR@pSUrTOS*5P7bq7eEnK~{KNT&_g{bW!Xai*fqBXbMAfAWT!sNMko<`YQ;-#AZAulqe>C}8FLP|
zV^)xv`RJ=x!3iYhz5}&i_J}EHTpEPPG#_#RRV6CovOhhZ&rj!l-}n6j6T^ej(ZvYE}U
zVnLH6dRQ<(YkR6H6(RerG7zqZ{sXI+6}cC!hiy>Bv`ZmaRgxQYi^#=Obs9vCoy*ZPscZ`|MY^mt#
z4T_u&BPfwaNQY1NywGCcf
z@hpYywSFaFA3`Dgz2zxyA*|IM#nzx&z8AD>8X;HtOhA=Jv%bTw7poEEyv
zDBv3l?DL{P6VOL_xhfG=NDB@idq)eu$cj`|gy!(oz;u$1_2VsxumN|Im_~$I)YKzEd-`Vk67j(th+_wItmj<=L==rilh%W+Nk7
zkz8D75i%t+M25f@Rjq;xGINs95E<#%m(t1t%ES>CixURdq(YH6JXH~BJ*Y!2s%tCA3Sb+Oz
zL)zk04y8d>>8ODS)jC#fkppyerJsG}95B28}*xC7x8ZM4!C$R}a^?URRD9pfp4{qny&UR!UK$Zw!_)hl`QrgBfTY3*g2~;+vTj
z?xfk=Cn!!FW1tcdkzA2K>*S-8*?(`wO3s{_iIv)_(_8*hci&^*=Nw~L2MhO^MzlIY
zVY*dix)L&ha#PY>lqtej3NJCT3^ZPqsb6WshGz4O;d4h>MWwW6F>~7pZW()3c2Bq%@PL6z
z;0}b>l%o+gc-9I@)bSY7H2_&ERZ5chJQ74yWDItahc+^ff{TE4m;!)i&D8J}md>z;
z%E&1r1lK~!n#MXC!ULt|=i+IT{;d14wJf`C7htj42CW1d)>Ic%_H>^%mX<<^)eSn$
zV#WfPRWrj@oKohx*BaH5Pp)rF5)nBzHQ(Y@QbW9QRagCtSo;)OnwjiD9ViV3U}2A}
z!`53Eo87$FZm!*jfp)pz>tp@!o3HObeEs34#~*%p{LPO~pFYpW$DYbe+P01DYP-EV
znbC#~^SL+Ccb@aIPhlk5lBJ@C*!QWdT{BM2zOGJJJ)ietnR(0wA{r7JS{T%rw#qo4
zjj$djnG)i+$_aC>C?*Bt`?j4j&X>zBx5)~lVPss+m#92#107SemPR3BuI1O9
zYL?8C8j(esWrV_D$F|Wp_o?b8tH%Ws=s9+aXtLIz6-u5CG2x{#<8u#l+OWJ#om8?T
zW<^w0gc>vD4dY@$%*JNO8e&r`jr8HQ
z^wMjIvjGJPMh6MG$J_KMftZZt0_AlX5=M;z2Be>8RHEESjFK8y&9V#{B(uQ~%?8&M
zo-+%%>_%RdZ2h!u5c8fP-0TH-jB!#OCN^8+Wois3EHmhhAG_I6>gz1Xh44{JPMG51
ziPbd*YQTt*rabGc%s8;-T3CjPsp{Hqox7kOep2UBh%Or2(9B!1{-ytz)xnme_uNlF8
z@-pqqQ~a6#!teig{?dQtU;bDA>ci{T+vygNr;o|Lgu9b_Zcx|_c^!Re>sS|y*mrI7
zh*;(Nab4G1J^d}~8E)x6slBLGUF;tpgY4n3prHJsyF=gJ06rZ{~Um?lfpIk_uCy??Diq7lLt{%5y6$;G-(WKJ>WTx&y
zycy1Zm%{D3KM-@&oqB6$xh9k@6^|N~T(xH@Y17OhUbM0SNa-yXEK#JvX>p(kO=uS)
zq74?+a9QJgu*{GzSCb)S^OG&MDs%P}AsxyyCsq#}5$2jNr30#ZL=e!`o{HPfuP7?g
zMk>Lz(6iFV&;d#_(jrq+wiqdtKa?3j7X}`>9|fV&T63-U6qK{>uZ1%e8}F7Smbs+3mMk7Y?+^S
zjVzcQ7E?%=G3|K&D*aV%mJL)bHA6o0kXZ58+vYUXL}X<^Y8>IOb&NP$c$2L}Qw_|h
z0F^EqYc-14X-!~P06Jl8$X}{^q6pBXA}lwAB4>GAa@LsR@?#i~3Pnt0Vr<)tiA-%e
zlD;{jqH`LPDntr4Ovi#rxQ_y8!!s&djopn?Rf{EB01sA=hy>)AO&O4M)~E9N-P$1|
z<#EUDxT#=|Dw@#iK)X5P2%?yKvOxw$7BbB}3&V|R@+G><8CxYtd$@KEIu1!z$>y>2
zqQwg+b+CZBV{@E$e3*FcEevMiA}#GW)ljj2iC_+W5dHg3(Tt$4U)@CO0%d(A
z9@X+8bKyg_Dtys)Rd6%0Zj!vITpHd;vAGKVmc&<69Ibc}%2x`)kf^CgvVo+&ECe_c
zRq)ZHtJ-9UY!(C1V~Yq)*UVXcsH)UuU#ZzCC#11rY4x3oDy_niDYbG+nb8@%eF}--
zfhu#$$_Sb9ywLTnT5jE(nWGJ!nTOS5-zTL%
zGy*wyG3%1O)SMH9yXVX~r|y+1?kQFyotBBr*)@49&6p7pGZz6^6x|fi=&Uh-+BGrQ
zEF!GOCRazgMA`7Fs0b;3s%Jnlmy8@GTB0bYSz+7UsI)DeDA@NsD`w1$s!XsV)KA*5
zak|>HtRmuaxqSZe>HPGx&$&lz!>+GRuixGM-u=(tym|Hd)yp?;Ufkc`y|}x1al75#
zoyO4BRAx#(D>8;V%*^0!+qNzAhB6;k_liVUxghD=Saf5P{bP8y5$g)?rV}M8#A;pO
z%XQHBGF!W=vqFXncR%PjLPnRyfM?8^H8cRP)xWhyF!q%1Dp+xBW6qhG%QZ{LdyIp|
z)Xic-USRa$$chYTt5!vXnQde1YLRWSAdksX%)Yz&pcOIS1StvhAJRNQr6Q5s9Lw9O
zf~vTN%cG92z?!R6wn8q-MM7J+xjt?6nA7&}>W|O@%PeWxDpT^bP8>WcBr<1eW$1)4
z8&X8}2`@xv5mu^m>S%`wY=KxA7+IP`AeKT|%(^mid0teJ?R(Cdr_Jwf?f#Z8u524s
zS##EM3S)KFSjOhYLaQ)!#%AAXP}}(pWr*d1(U0CQ*-DMsb74B7B9MtSjdER1it#%<
zqgb~jJ3z=!s
z+f)7vfBDb+-~Zab{eS&8|DS*2mw!@I_Z9-%hvCts>k?>?F4ThaCYh`O;-iiFdEfZkqV5^7vK=HWDK%
zGdr%Um*HH4V6d`wssgK~YA8+~ibe2K5ImajrS-9dQn3<5~}yO_I@AJhmkd?nH`X5unsa{
znK49_7!5{*z62vOO*08d7>h|%w(2@jl`_X;F&0{pi5BUa!J3Fsc#kR^F%Dd1L?z9!
zWT@?qTiv}nSaXY&P^~9#?!u;8Nmx?8K~rrE#&v?5n|g^chAR=Y1sO=xF!#YR8XFm#
zxzmipZO`}<-;M9@sIr4xrel3JA)V?cvvo5153Tfc#4M5;)!S0WMmM;aX8rm;G$YH*
zV&;A+Gx%Wa-Ce1Aw#6~3IS3q7yP$7-fjki!kw8nJO83g{MNHRctsi
z)5>`$ol@0#s#e~d+dvdQ%-XLwv?q&6n?SA+t*VC%Og5X^XPxfIB#l;m4ht6R=dUND
z_A&v`-4!jvRu!nY>?1O>-J6;9e9-B@TtKa^hK1K@RkS(=>v~h79jWAc3Bnt)Tu+a+
z9H(nSk3<$Kq!K;)i*77n&S|=x8oX7(E1e0uypnW(u@=U5$IqD+i51&adLDfN%jE!b
zn%X=`JoeZxwQa+P#Y`P>Efpis!JnlH0Jch^Dp*f564R-a^IYde2Rg9NpQFOV`ZTJ>
z%xvyO%XKL=&Qua#u;pW&<0A97_<__|rhWu^;1P(3OU*)U!-m`K^|(6u>Er~X@c4uu
zKb_yd|MdRD)B6uk?>}DNzdwKedU<->BN)?c*y*%gUtizdaT~5=vKcvJo-z=N_cHE8VR!imv3CN`R3>fsDwU
zJy4+UzRNT>`k1pHjUa%m8pC47%tmYG#E7TJTbIl$Nh?6er-ow0XbuWtUYL8hXO0l*5)2HI|)!Zc8LOF-!G|PCH480G`J74
zXto&vUM`m}pFW>2PnZ32KA+9%bTw}8?jBx0JiNJo^ZNeX+lPl&FJ8TV@#600?&iv!
zW25P^h?x~+x;qoY?dE!8!O3kKXar9FkQ8lu^d`DG`zl|B-#T+V)~Ky2n#0XAI-*jm
zLc7vsS?Yi^RHkV|f{{Jwdyy%};d4-bM#Zi~02t=(8j!0oJx$vR{pgORN;(=H`x5fV
zDWhnH>`V~ms=Un%MIqA8PEv6*b;1HE0ZJ+&fU*ZYEJp6b@-OGRRzxx;d=HL3eAK(A+?cFP|yobGY*P}zSI@^`dkO!<}pLU9}
z3wGp!mDHFV`&1dZ=
zFUx2e@sxx?#_2+$bJc2DA<-y0vszS)(iG$8@1)AC`Gh9NxU^>dC)Walc>MV)2wE}%
zlip)hb4qRL`lw5#7X4$z-Btz;^B$ITd#NARj#UIh^*PWAG+io>tn+CG2yx
zvOHb~iZ!FdkVwp#qK~VNlyTh?>#hL2MJXvs0yc)m4fIhdG`TXHp+&UL9t$gd?qSg6
zH;v4a-WXNp2+0bZ#-bA%YI2bEeP6W1s1Ge;1;#)q>vXJ`pJ6i!sWG9j&W9-7dWiPx
z7MfO7iJ(hsxQk|xTx*PR$mE5V37OZI$*hQJ!*k|vi-^c_-+-F(Q&+Nj2#{`Ef!11+
z;#x_Kdo3G;66%cWfT)};1b`ScTaQ!Z)!HH5bFk(fJ{pa#B1dCYrIT*e1iDyV#kx)R
zQP~GTWkI8TCTv4Sjls`5&QVuRubyhUR~1_FPu-ri(E67D_u<@coNH-Ib9X>Ts6x$&
zmGxhT?`Zvz>U?or{9GDF9QQfO49bm@*@<0rMlYd!_Rwmh*s>IXCbh@vqq18nbSK^_
zLOt^JG5YuFW;KdplhtYwyy%y>y5v=FNiQd3VWj|$wS{$gYI)18+M)^}Sw@yFT|-1f
z@1`DSFSo@KCfTxv(psQM%ASq(nz~_8tkwFps;Cxk_XbWtFhEB!XBH~yASi*82rAY3
zSsB^GFf{SC1s%s-T($4fxCY8-rz^j^^Q$Y3|KfhZ=P&!O|LF1Kr_1~IPd|RTynp}n
z`OD?;>v_LaL}`4k`|0-XdW_A*z2wX+pq|eAJ|j`{5=sHjNQKPDKD)_+%{ld0VkSHP
zEOU>D8rw*OM3t9)*CoB5FOaaXV5|s4C9=Sghs-K5^FZp$j4KbX<}AItlG(vXU}oeV
z?nAjC5ZgmmA~Lj+wa2Lx0fl%oTPaqnxhd>>fUByJOe{0A&^7v;Gg0v25!DkryL#z!
zNy39{%c~p%G61!xCL;vs&AAs!?&Va#i=d7cT@R8m_sq-F)8o_A)8%}wN*b?EVh0@F2LHl
zj3rfBI1Xb!d!F{H;#YI)h5%5bby(1(wp#PUx^y%SmjN%ihUlu&sKv`jk*9$`y7aPh
zRj7@rd}X$B4d`MLkj+v=tP(s7RSg0PN~Y1=tMcH!sz-2nmj18Ep0%e4E0riZJT;gq
zRsNN!e8B2Px^7y)wtiq{N{OD&NGzdg168%=^z3uWOeawKnSopyVAK-+DE2`{S!vm-
zVdBbicOz$q;q}y3l0aV}jipwKSOdW2uk8=G_z5jQx@Bh0q<5Y$2zN$k?0N4Sf%*+B
z_Mq&lEEtt}gHm;6UB&A5FPzUi3a{?RyBFK-wM=xSb66kBjE)s5S~AD>Es*PfNvo^?
z3KYUF;5QFXa{pFVYY>}yBw1CFW!d4MbtvhwR!0gFv`!`P!3b8=tTL;GeSpwx?IdyB
z6work8no5eX*NV_&{5W_f~dlrH3k6g6GUAZ@2(jWbI%BzFZ-YWvw!+8{j>kn|Kfl7
zzj^iIevA`((o7>v8moY2J6PEw50}idmZ|WtVe2MYg>u7??ap4*jS7p>TqRNas4AFO
z#VR_Wx_RkK)j0QUZpN$?sv$E()dyYCPXfgV9oj0!dUJ3g)U6fmDOU&ghSA_t
z!f0-$LDm#jx3Dl*Yh*M{w>oP5^&p(?JzQ8Y5~1N*-Hq4M##UB`m#-R&2c{wW
zo9BA)y^14#6ZgB2_%6hn2IxaY%%$W2DdyX){li_%3YS{o1xV6-Y2#A4L}+wCkdF6H
zE6R@BdssbQH4fKa$ts|Rn!pw~335;GMj^YqeqJ<9FNx_iGSM#fCMUbK(fKKi1jR-$
zRMBOv`cQERAlu$heekZf$|zQQMHg5#=V4}UIXkC|v`mn`4Oje@`%pW~c328qg8RVY
z6wsuz)}Q_y-9c{Vg_@D5y1H_6nzQIMnlmdk?ZCF7k2p@loZGNp{@ex;K{cpLd9lhOC$Ef%AX(9AlU0i&tw?ijjDG=Q-SJ7G7
zqA+v)0x=MP+pGZK!x3x$_GeL(4%7-~9z<3JIH+M_Yso{~!3LLQh31RR>9^1`T31Wo
zN`?Y5L+&;+qT7`+wh7z}%Vyo7Q8XY;VUR#+W+_>8V^&1;@+$i9ImOMD8)pZ{+40@#
zIY2ecUFyeUSw;m{9-R-5eHLKDV-F}ewGZ1qchm*5C%GrxD!{`x*)y560yTjp*^p`#
z;BGUD=vl!s%A_(O1$e7NDb>*j8I2yXit=A%*-HBQqt>
zzMaO^W^Rn+9{BY6@<+e^{L}l#51;lQe|-Az`TY6Q{`8b{s)VNx8-DfT#W2%tVg=5b
zmwi?;v-WvG<=msd1agl;(y?E5lvV8oHS?@~kW2|LNtqp>#-nP^=ydMHLSE9wh^RvO
z#@r(!;j3>$M$By+Rh1b&hTz}+^=<{u%$hOW3azO=Ummk+jG@+VY(wF{I_sQ_jL00r
z+!S6=#>VwT)2X&IXK6gd5xNTOb0^`$XJp2da%@mj-xLvy18t8EbnS^I9ov%`5y)Nm
zi`=%Xs>~Ug=*G#0yJ^Z=KJ8CWU!L}-$9?YS%RZdfH`~isH!oj4ynFNT=FRJO-#y&F
zxO;fGxxGEzUSFAE4AZ#Nj3``crnzmyjC8xw1TFw>X5LqnL>5T8`)TvJhpuAH%JT8CK5G#SIY7i#VcMq&&IIFmR}n3>SD%BmVRI^(uQSO6F)_r8LZQVqDOCo`*T
zmT5sH+KpZEW#E}Lfh4GwF7IntRsWm3{ZHJ=~3}4Rh9vl_jB&g}wnK4JfSg^q4s%
zDx*I=pHt{ajh62&G;@VMbOF$DBv?5n=)B@pZL>YP?mdS#qfy=tYB7W)GL1&A5e$7$
z%llAVlZ1QGE!Lz~>&51x`_k7Z%+NeuL?VKxf!k|-nA~@m)r&j-%m3|v>i_a@{H?$J
z*Z;cz!9U(tqwWsrq{vQY(uKXQeJp@kJ5JAO34sCKG^My?J%!R^=qp^Lzfu;BxsAQ(Y#E7YsNt>cC&h!XVt2(>p5s}83%PE
zk;jnORE_{8!n8T(HclYtY=>k@{Y#S>71f$Fnb2BHQUn+k$I-$rSJu{B^v}8v)GQi1
zeiSR;1@yN1$U|*5vgK2abv#4uZI;0|v2OTxEqEo9~Nby`!
zRdyy#ik&u+)vDZJ2n(1I<<
zgk90LsFFT50=7w%+VqjNX9DYosG==o$?@fzSGJf?f0+=co^sKrZ6?NWNr0+g!>h>w
z(XAt+bt+gy%zhZT5<2)z#-Nkfly*X;2dkph0%%438pR}MU7PzH
zl@+r{_^`@#VHE(gfr_fx+QLO2v+n?A#H@PH65N!)ci
zR~?&xZKZK0FwdbTLi*o+po*7?hck+i6`3>5Y-X|758XU7W`sIG
zGbWV5s~q5{3jKtLq@;tFsqu+9L*f%3vIAA$yE>l(kQPc(Lz>iUS>UGgSQ6hp7J#Lm
zr9wg7Xt{@%FC@r-q#R9Jtm}7Z?R4H|^7wKrbWFQ0-e{~^ZC%p^QRPsK
zxE9vpTU+ZUd6;xPS=IA$wcSV-dRi=r6?c>oA=|uOlbM&C1G-3Jaqk)xSlQvj2Zb!^GZ=&SoYd*ji#xosyqZQFJ-Ge+|3
zm-*r2`Tb8%A3mLbeE;pDr^q=8Qt8
zcFkQ|sA9&v?A6XRf)$SwWFcb@^)s2FD6AQ?0CnftiD(%!e2lov%bctK=_H<7)m!W!
zY0iBQcgvhv1?1f45r`Ej$+1-BalCVNKB(O16p$p!x+<0Un9bI;Xr?N~j!JaD&q=U=
zxJ+BSN!Et$05Xe=xx>s&l)FsveFM&Y_5`h-G74x6n3~3_MCMFXWagBXW}#)e%Y67Y
zysGA$m;LGKa^BD9eZN$tJ8y1JZ{FVBKfHML>cyLfhc|ET-@dtjad&lhbA7rRr_)$7
zZg;mJiwTlrY&M1}!7;oA84@ojdqE`WFkK_m+~G)6olaxUFcKSARow;gA&df+=wGG6
z0hl&eY;3(-PsvQV-)JaAW@h>V@$K1#E}Blrpbhh^K5*EWXhqc6R$bQfT7-=E$mlM6
zj=Q#Kv@(_MtzchJvMCA-I1Yl*W8tZ)C
z4gA@|>AU-JcVij3&&oryVN$T`6s>-lRoym07P&50Wa<%8);{tq?Mf&U*qH^3F6n0`
zG=;v~O#zWjkw<+ap{vSlfA&$r#Y`4#AVZ34sB!12_^Xx@p<^s*LKBhH(jI
zly3?$ph&D)H3m~2UBhX!n`?globhN)EaXUOZaV$Hg$OK~|Ae7myjB)JGp7$iwK
zfO~ONm10w>I;q@j?IL{(U=43zRnCdgS5%8vb^J@?osTwvQ@D%WqHobv2AW9gxh><
z+qRvyRv$TiNL~ORZU*s+KFpoNZO-|NcjNU*a+;O^h^fSZAF9V_f4nYBIp`Wz)N`|*
zS%WGLLn$>PyS0nRDh@ZIBn8z?Y27)uWYioPP%46A(8uURIQ6)dh*A$A4&?G&KZ=Hzr{pAl@DU?vjC)xJ{&vcX6-%$(xAiBSuuqr6VkxU
zj0LWXBQK*>$EcQc3(co-Ilslbx{vb#^P4$Arxp2<((b~1h@~W&Ja+Lu${P2XwE8IH<;lMdDLAXX&ul|N?pQ`Ho
z;&9A`wG>v(*N2wcV;w|oM{9+Z^_3tvxgn`)Phd7%h9(06eMm9$M~lw2aF&c%YmJ#X
zSA6uh?4>A+qa^OauBm)t7O{H50EpqP0!}A6mn`!DkQ0R{cXPu`HYB9cm*@tz8^SIW
z4(F@<-fPMt8?ZC8b#?Y<(><%)k|UXEA@^NE9Ve~iHsoRV5ILh!;i`i*{f_`*rnyPW
zT1AEy!+T0__Z8F2MqN*Zi#ZKLWTYsU=mt;xpP8AKt
z&ZPsCg3_nAd$SJRg%SY9XjhJ#Nx#7AKEb=?OLyg@3rsAxWuvGvr_K>6RONidV
z_0@jwbs=gCFRl}kT9Fj1&JKxeusyS*n6uR=4U2-@hGn$tjti?6%+bO4s}`_sXV6{L
z^ZeLYd%U}*Zd^=1t~s%Y+{P&5RQ&azMB_B-yq7ISzqxG}owU^R?GDeX>JS}Qqop58
zK3)ZS7W?E@o{5H%=K)VbVttJ@A~VWPwt$hUC^PdyAZteHh!%eiL@UiQ3P^8Utu{&st~8?20}iC2Ke
zv`_&mdfMn4ISWMN@{OV>FVHgemJqUFWGy#b=ME}xTCI3m^e8t|GAq8&RLOB8e`N*4S>ZQ$V=a~RY$&OPc#r=K&w6(`p!MRDp2g{P?2PTv&M)DHKQ$a#v~~$f#nq@=*H(EZP8+CIA~oLi>sfAW?@%
z!r)jmbUv4sy_g^>sWSVTZ@i(Cm!#B0n-+YT?EB)SwMaqignO4_{p~tTz{EYu1xX-_
zhKw*DPLft!{>JJlH8LFbs;lF`1sWf4ni~ve)?t{3PYmWh#t@ZZZs_LDfBVhVwE=~wt}yhLa=nGBoO?9w+yGLq0UbBq%4s0`>dk;TD;nm}RoFm6^<5^e
z%gr)!2EY#EHG{cHYanu8f-U{d1PbMyE(jl%g?*;G(XAv4TyGg|76HlF(~R!jnV1=1
z(e(iv_m-`XKvZigs>Wz>rn_{rz~Ss_bwg?Lxesu4epm&8_IT}U*$2%9>&odYTRT9D
ziq&PnoDoD7%Vu;~xw)stZ8M!AoYhcQbyg~~$J#~ME2J`~WZ
z<&hbduIcldYa)}9xeGY$FD@%SEi1$nR^wLk$F_#80A0o<`ZsDB7fRWeN8(~fjLhKh
zLRtrV6p~(*p`#QPNW*sGmmQxHFAam`34)iZSv*m%rOz4b;gA|MiaCqz=|>YLgH@>L
zj{N}1Gm4gn6mCJl>(nCGc}^XbiIihV3#4>$*fRKH2?qr3n8=G}IYI+(sYrOV1JD}_
zQ?ArH-h2M97ANH`B-W}GzS`x(bC+0MQK`4VQmJX1s2ph(bcbShns*~j3Dc>wN|P*@
zrY@;KZydK8ap~)__n^@-QhR5$^jhRi^;plqYTBU>VDGy(Wwtx|SZDMY3uKh6n^~np
z!kxDH&5dsxhuaM96Q4d^e)=ckx^CJdT7tYj3e(5ndxp3^RiFb(PPd%XPmj6HV|_UK%uzB
z0Li)U07#37eNK?W{c_o7gwvJR3NWU|l3+%#0IPl9^_KU2YLZ#*1;uWxonYjgNrPsS
z&JglzdWL3pxm;-UZRq%_tjKb2fgGunxT!1avY&@-<1`Qr+ZRg*kzDE(fUu*g1=s4a
zguC$8lAtWfmF-k(sFFD+JB2810rBjR^J5y85XnLtH2N#gIc3pRs1>N(ve2y|29`8h&nDDI
z&5HJ`XnLIpE6UDG*#IGjH<82)z;}_!%QpIbryx0wdkX&3K3yLzeZS|mYiJr
zR@JFRB$siqYSCvg6U2a@J
zMPs&R%2o;kph&6%uSL6@)URTRhZ}^gR9bv=0vsYs-B}gJP(T`Tb{mkDl?R#3Oii9o
z%6oL&!p20*$c!|%3IyBzE0QEvpH&)kS0(RwuIHn@+6xg)qA4%a)Mq*pWncuzGOvBs
zHh6Qx&!4eh?CCN7)E~V1=l;^4`&a(e|NY1J@5i=9ru*okt#hXjJzX6DGSt;PbA)=P
zIH0}GDpXS;$~ZQdo0{oi{9)`5-pHJd#hSEr6-Tlcn@Y~X25FIA31DfFKN98tN{wgyTPhX1<({>
zDa32-h-Q|g_SQ!d2qBzRA3@ybLz%7vH&?a#Op};)019O;R`z4vehd({_B)}$?BD}R;IGU)wbgUzu
z^jBILG)1XkeeWU?nK^?#purdKcYHtKg#kD)!M!ln+9heVau!|Jp@i$O0g$z8-F?ea
za7dJ4m|gF5NUqvH62_idP628SOi0IvrHkd*)&V&NX6BeVQm_hdD3az7JV(3#!h$^AsZ97oQx71p^go?VU$>;7td1quWCn%Ne;(i6&5$
zPHrc=eQ|Q<7{eVi@Z}4Bcz^lu@yo|g=imJB_~TDcpFi(kp61h2R1n}WH|MrpUEhpt
z8@Y68IcuNuvhRvKocpfo1?0X@EMMHd&wVOJi~BxF?E5ZA)ZBCGO)?{A?&?|QKIhyk
zYi80K+{vieL&u|PHIPK?b4Jt{o>u!FKw(ryW++fvhQ}V^tC&~1lQn0M=9>jmiB{{9
zM$>`N2^KR-YM{~>k^qIa&LB&A4i)j$96(i8R*r2bLwnCzvt5FsbYjk~FqEp*sY}Qd
zT+~|MkaWB%FEdMIi^@A2?ly*1sd2hIetmp;yj(8(JcArQUfi7?9-W|1rJv}@v$0B4P&DFOW`RKh8Tzm{cHtwT!n=Sn-*l_Zoy
zGOAMGqybCI)|1zt=`>wNivuV^Uq9tfRQ*PMEd{d(8FEqCD)2S2J`1hG>_0Pg#THkM
z&Pv#@sGKp)+~v$!l8x%bxaQybZqxS#(;QXGo6!KRX1CNrN7-;SGg>NbNa)A0s!j8(
zil{Nv)^}XO5`6YIXd#JP%o(*>;`SPV)`6&prJ@QxtWY05pKq`I7w=AQUvAEtv!Qb+
zJ;T>ik0y~77ZuUPWGP!@Z|I!3RRiWOVI*i^K|nDyIlM
zQzpCW@Iva6>jSHM>ssxOc!LrX5_6wz!{|L|J}4hg
zbuHDWj1K#1EgY&qQ&?5EOk`%djXue_V46HwO=wh0X1R~Ds-zE(#PAK&i?ga`8*)a{
zS1%nlHXZ5(bZ(3hRcdhon9J7+danRAu5-_qH~u^CjD!X>X?+VaY)VB*wy2uNSx5E#_+F|$-z?2!KD^r!4m9@8oMu$S|Jv}n9I;O@!*AvEy
zs_##Yu5+bNP}O9N8Peoz${DUTr?Dh-R3m^n(+5em$04)31<(d7i4ICd%e{2Z5$ixv
zAScv>#4JEUvu701B)(Wd>8Og*727UW08UC(C2Rs*Ldsg>m$H1g%0AhiW0#k^3!l(S
zGBdAK?g^FWq+QPp#2#h_=RWrqn;2uJ;3t`*#3dw3=UVJ(!xZ=-+aSrDDg9p8G)k5d
zG@3C^+f+deqh`HEl$o=~3@CbAGN39{RCzLxW(+7@X5Zn)Im>p~hM&&)bY*vrO)YEG
z9=P^ysQTp=Dlmu{HKPKgH~J}AbY}NeZ9T}$CKU;qI5jhqAXdsj5c{6cFvtmaZUcgW
z)udTpFi;Z7^PPb%6r_oAH+|FP>DMtz8v^^A1ki@0bqAskfY2%_R55Lx*jV}Vha7P2
zN~anRZM&8?YfL4-xvzV3>EzTUWmu|(MNsJ8DKkd2qT5_fNX4J3y=~M~vK7_%MRasGu3b=C&ZYSS1KW#=rBWJ!m&W|4-KYV(6|I^ctA209UUp{}j
zJU(9bSsK8*4co59-OV;!S`*LAM9w)cbJq)B(zeYrB4^IZv5hRmoO6b|2lM=NHnVYc0xjmuy$5yBY+iN}kp)y{mgYlc
z#V&-SW(3yNqus4x0gd3B<%~i%U~>i&ZeE=pkr@c(yot#_oM&BCRm7Ap&CM$_6hecV
za~fqMOazCItjL)Fd~5z;Yy-;^SEZ3&m8i(so`wpAf*v|Ts(0MLWX{W%uU{{h%j5ZJ
z&PmqQm0w+-9^Srsc=h7lyNA~guUpf63yp;beh>4GO&ic)vasySn9o2W8hgITQy
ztyyN;u#7CE!Oe$U9EACz+EzFlP#ETbwdPjUWAoJwpEZ+$PO4kX2^I*)XBMGa5YZ4b
z7ib7sjVeKBQO9tvka#A!zk@LQ^Z@Uah3mK4UDnX$v^|dMV3K>**f1nqGXD$NB};RlBK#&8m`2mcv!-k
zjbxb49hi50(mSVdJ^f>L7d_~j;2P1SLIZHN(6=5Ag3^HEl9WbxarSi&^n|*Vf@2LK
zs|veZ^69cayg2>t_t*C~rnp^|2n1B?Wwn!4K@A#roHMJjzcS<8)xIm3HZ
z7Zll;P^gEbznxsTC=7k~in7j3ZcwZvF&6hZXJn>26kUsElEozi4h&_BhD;LHyQo%U
z*99cMkp%$-^oZ8&a;U^Mtr+;KY9&5d0yb(!_yQ~t?+=;1H^#sA!2
z{a^o`^JPDst|DXeQ5B1g|b$E%KFC7Df9WFY=9%3M((fz!DLoS
zBz#C0yrd{H3n=^!nT`LJl6w2Ph6ucaxzvF)XG$QE)qF6xB8EW;AEwd-^lF-z1<=~b
zQQg{RW{v*6lBc$olG?+j9C@`ANm?bAO1~>unzQA;O^zI+S=uoI%o*E4=6UoU3ilzf
zd_mn#=*_H#dyyVhwQ^KTm??FRC}UQwsvNNm-~w3r!!53D;O6K-o>#nRIrYxHz3|NG
zWXb1d4XerXk<1FT#7M`6Fb_pri5bX-3smb#Cnt+MmtC-)r_xI~pp{nOu+g#xWvj4F
z3n-*@RW-(`RxpM>oK6ibKch(_(eQ1eIy<1{k;~)Su?l9Aw`sIP$xtCkwE)sNgsJwJ
z4yk}4L6AghnVQyQG6`5{-ra9+ulu)UmM@R!u}->3
z0(vS-A?lDro6;lo1JrwG)Us2MsqCCW)r_)Xn;QwuQ}vTjK+=0XwNy#qMPeI@kw|46
znt^qs_$I1BnWhMYr!H1hAX63B;w(4X<`orLE_YD1IbATs^Tv=)7^S98_h%oy@&_e^
z>S3A6t4d_{^O%Y?0ABAwEsd@;cQfOhEd}W|ev;+V{8>{RIfg}4=`-UjGFj@`ct*k;M&6RT-g&Eii27KQ6HF4)0
zCzf1QI$u!Qeys
zi$12C`~(5h@=!(66-OI#R=?TFo?Rl4P}Q)82jVFADv>;h@hT0&ZP<=9bPWoy!=L($
z6@S{cN34@!(IXNCi;`QVi271M3HS2VI5PUtHMRv-RPzs28oSC>94lMV+;gUY9u#Jz
zk0z{I0!ShiExrsOz_!`#mET^QyTft0;PH&#{P6VQ!{bjM9^ZdD|M=78)93m1^W}V*
z^HOO<)oB}Uw))1GrG
ziETUi+-I!1pJdETg`5#FD|9W>D(XCUA;;M_31(D2?zEaSkQgV685IGb0%r8#`(?5)
zhF#7v=fyW^bVV@*00C9LZK#Tw8q668OZF&F2dh?uQWxyP-$7)CnkaWxGUn{bAv0_n
zf_zJ=?2K;JX3NB^I%~WN5h3DQ$o1tiv!akWbHB{US+hCPzBxL4p;XbWh_%uo-%DLpCy)_i
z45{eUYxV5Y)uxN0SK1cM#&Gp(s&n+dB#`ca$VHcQu~l6?YfTz>0lc%
zZWhv>emVZaWj)wd*SWqf#R
zC?p)Hp32i@OC2?C>JpCHT^3xU)K1&j_PL`FGi(e{8MRpgrkg+0VN)!?
z#Z)<>f*Bb|DowrGTOpl%3QCK9l1Fe9kB=(R`@TmqH&=JjZC4Sk+iwK21f82nj!Sd|
zH^~GViJ{y1Y2Ro5{QK)a@#gw!lcKZZe20suR{a5GE@pL;nJOAIs#hg*HmxI!Fk-zX
za?V7n_vJCH%&M6M7_4N!%GzhBL{$6*I%kFbX|)d2nPrPev1%1Tx8_uRH}?Y4jB^KB
z7*g9c8<8cbw-f>*O2No9E6p0zi_id#W<{V!<8(F?AaOCLm1Rb9b8H(Q6JNf@-3|Zz
zpa0MN+kf}*Kll%Sb9;OD>GS&y%{N;oLh0S1+Ypq(TvXLo<1cLCZ!HvIK?xvGRPc6c
z!=b9pcWR=VK*Zv)&_7%=?LCR8v47TU2qU1v84C>}}qlYb_q}J4!
zJqSP|(PNVeNtsNlhL|mFF6rP&izeLE$FnMpG_#0s#i`}`8ak#3fuy?=G~L@BAT*N_m};p
z#Nm>i3*QI2Ssf#`AnvYB_R{U@5lc)@G87)6Gr%khbkkKtT3`_$Y(O-N4iTXWbAtH_
zlr~2!sez^tRSh2{K59Ye)ku|U`Lzse*f1n~SO=)tf`#>upm07zXG@Um40hBk{Px>%
zBi+yf4(doW6AaUX&YeA8Sa
zoU}JIXTc>KT2PP?nG4HQLsGToA5|y#q_u3a#l8CcGKV7~qs*O_?AuP~ZZ_;B`bT0S
z_DUufTA(GXOttEpKM6tgxoo$f!GV;>i~vQJVr_oc
zSQ?MQ)Xeu`*^_LMQ&+fk%xk8b&x(o^cB7sF(5y>P(+=D!VrC5Vc)kAey*){=qLMAk
z*N&8=S(L8|nuzc*GI|zEp^S_<3q6iYW?2r;nU#qi`GbsEgrxKpX~R2omsNo>W~9uJ
z>U$$<8;q!tJOdx2-fT3$fdB#(;D%nf3n6SZjt??c52b0zZGb5hWQlY)=~C84*UYV+
zn3XN1;(^h~Kef+B)@zxI)-6}6jm$dytFt-;g?2^Qw%ESqq-LaqCpNYg*XX3Dv*bpz
z_K32pL}9s|Uu{OkbT0%K(rR)nuv*lFdGo*~98s}Bf`oL1txCB$8yI^aDtf{JN*iYp
zuoafZ8t?1K_$==DdUt
z2WsvrBhccV>da?UAl=;~WA2k?1m_Gf9Z*@XFGp0UGw`ge9j(z7W>Xz<+VyIonJ*M7
zV|JZ@24t918c;1}E&o&-!N!Gkp6HB?h)f_VGjq;eu!W|;oA+#znQ__Am#2%OeIw@}
zZf>t0Uf;ZW_4@V0%XjZyJv`jMdHv%4;qK+#&1tyQ#1j8i1rg3L(*O~-u^BjA%%}A$
z%{nZs4Pj>usX76X&#ljr8i>sjz}mEDw5+Itcdb{x2E%4nW^LP0;j~AXwNL_R38>LR
z`D$Dlwu5FpB^Xpg+avBWGkf$`R8a}n-A5i7fdy;*Ycm1OF?9LUceE*ZnbsZ@RjEk*
zHV{z>lq;a5g%*820F_g86*VVW8#NIzLxdQ~TGQQ7<|-AGuPeQ&p0)Rb@m*Od}m5!5I>+v#LkY
z)>2GJE?(7_gLOQXPGwegdco2mi-TRGhEeXW=@eYiGga94@D=-6@(KbfR1$q7=vQJr
zlI(tfSt%*d*T?CsU;g&(Z@saa=Io`DQF8`iRHhvPGW81}d|jGb(hyTdspfV-8EQ~j5wX&(J90XvhRud%)oQ0E
z#4{79W|das7pw2DQX6JKX+pSc`4P!vqqWI{>9E98Yt2>>eT{5%InviIt`#G8397daRk~Z|*8eVzU
z)S;6c4N=gdqWV;nrHC0-IAXqAmk0%;!54sS+9g~%H+5Yqvv%w{=FCQBnCXSeV1_J6
zB+;IV=Qv^Z6}75T{r@Vii9#wvqaCZT9OJ<|Kpo1wj5+EYQW0G_q`@YYZN{7{col)l6K2fl2
zPX}X$ID#tWAQsa
z=2fgh7Gfe#NZ^Mve&@s!;eGUBCd#RiATnN|MNnu|bj7<02~u+@gPjBxrCx>`JP%EF2J3Z2>m69#89_#b5ziGn}{q~#8)qiDbHULRtW|=wx8K)`q
zrxPRlK&oYTkufS%9Tq^OJQ^zf)+c0x#S$XRJy$cUMI{~i*zj#13@bLpEM^AE%u+9`
zKopHJ3zWQ&F{QT#LN2TV%Z+2$^_5+n#_6PqkvL!Q@yq4ohp!($pMUuA>BkS3AAh`j
z`n*3qUM_pgsR>@=v~4$c+qOwfVly%;_t;~{<+4XiTk)g-eOP8*F1yNkGn?nB;H;>*
z?^7pe7WO?VrVb)epuV|sRu#CZH=fC{smR-N7g5j3+RwW#LCBUB85Qd0)v`xb?WqKY
zzSCGUVvH>#vvNC)*fTN}zP0cB*iOU!>2gM93s(EA^Fr-&nv<{@2@NMh0+unw#ckVZ
z_%`<`{78+c=4!ZERcIcA0IY0PcA?8pxKUgyQTi`2XGtHpYZz;@Il5TQNE?-j%>D9o
zzMLPQE_0v7+BUzs-d?@Aef8?qn}?V0-oASG?&0;r{r!vEo14?k%@8!1F~O=v;L2HJ
z8)LYE?qQSx<=Ix(*Os5AN~@~Y85L2;mca|U
z=|neB{+F0jjAWw-6tYk}$UiOBxs6ds5idIQg3IrxC^}MdVx7aPKnlf##%-ufO+E9L
zV{z_b?j$pnu+x4DRA;PWP3~^IYLPBg{Cb{O#y|M2yLYd)jF>(9)abIV*D8nsl~sWv
zDl`zgV9cp2q@*Ae?y2%DqI{?>?Gr_`sF;gfI7n&@WOv4Du9l35$*S4Fo_u@aM5+g^
z72RU0{T2$G>x9WVs99s;+Dqd$R31K%2XG>yHG^c=PA}9lCD&j$R0U^F53(!
z&RNEE^KGj!>T==vQW5!&{v+SNdvo`9{=NV2&%S^4^z;?aFQNc=PfPAtKs5Ti{(E2e
zr3KETfuVtc)F$Z8qZkMjdX~(RB#MK_vF{H23svGsWn~G$z}CmIKAx@XpzWi8B!)E6
zqDHHpDki>RIfga8P>&i1{RI#hg2WPKuw-SX!xxv|^8nl}yNN4w<_C~)A2=Go%BXBB
zbXQLmIlZk8{iS=Xq?En2M)Fjx#*ZYG*wj6Nj?+Fm1!65Z@0wSFO8tF9B30ThYTysz
zPOq;zghK^lEmVS{&sP)sjM*!TsCPh*MU@Q(q`6at4$&%$)oLnfv!mzHbs!a`E8w|*
zYIQrT6BEz6n8I?QuJ|NcbF!uYBiAfwgZ`K)$Ny`!f-5!jB
zyXdkaU=AU|UEk{%QNi8a7MsOd9dfN;{Q@}p2-!9rW2v93nUU5sIh>glVuKyqrmsV~t&SL$&qu7H_NEA*Ew%?M>>1sgmn0*d3Nd+f7;FIu%P
z%d2W?PFgoK$d-IJ7RXlkcKa<~M^?$>t?N9is3_(>N)45BhEaG;8+kKeChE1^Ml)|l
zuyTeuYZ>5$cot}2&aB~8m{Hqc25jT|b3WeUW`i#k*50|n%OBF`c1aO|U>(A-tipa-|Hh=k0r6waOZO0G|4O~uLUV8mV`fNt{6N$lB}Aus2N47y3{s@
z087k03uR7KB6=^@;)^0BSZ)ieKqd4|(t!#p;stqCW<^Q6k<5mEmfu8_Q)MAxF7mv%
z_;96ZDjH-(inR9(O}kO*09}Cs+V?pN(9#*;)yeN}#@Niv%(?G)e4Ic0>g%V^=O5mm
zfB5P0)BDSp$II8x`{kVHb3lf_F~&GO-1gL?IkSj4=i}3q%6;ykyFiXp5r*cj>I-Ki
z+6daWbya4?B{;ZWrn_5O%)NoF2-0H)sw7~J3|k9cbU^HLW@vmx1^3W?Yzo@kJGGS-
zjF{61m{@V_GXziU=UsHlyzF{JbDvrR3IwKM-_KQW^SSR6=0k!KMg*j5mHM~A8Hrr<
zdMqpE+*w1*qN=let;1JB+aarJ21s{V77!Jpl%HqzC|m_4Umv~w$39fn<=oYxUe0sB
zTrL$ktgdcPuiw0Q`}X18+lP1Gy?XQT^40zA!~OM(yQ}M~t&>+XGiSy*i{?HYK87!H
zPYs^LoucySXwpIH`n0y8_(~ix$sa6DN#NmQtl<9cLdI}iXY3glQbFPGl3=b(Ix3*l#8+3>RDP!!lp3<0TchsH{+cv>vcu^2E*uk0u+SPAF(n;#uuC=X
zPj^44k+rl^cd`mvTTV6-vUn)*@zdk};@bYcn_dOB6z1
z>p7q_>Q*R8D~M55kXA)XM`J`e&^yIDi7P_7eat-s`iXDPs*Y@?krmOnb%yRY#Kbh%
z%;CJc;?t!-`}jG2_jg|W=l{v?|6l*s-~IW|A4tzN5CI1PCj@paaqBHz-_Ae5>T~4C
z$&g&5s>-kgi}pG4_R)i{Up{`ATWV)vz(P0JtXBE(4)-C63C2MO>hbJ
z_l6wRfFZNFlzw+aWzb9#O4rOKJ+%cJnmba{48ZR3P^Wih+Ig)kP&**m_iqtb>4{qwC
zsFqCSV0(4$f#f&BJrIo~^$C_{Mz>H(LP`@VE0>tYBrEpaZS#|Fgk0=OcK}M9oWPPQ
zNEm>=%!CL6w9c`1%ao+S0n8b;Icbz$QFr=qjmD(As%O$^=40r6j4?Ept>Xmax9M$YeB%q4Qc22Ax5D?i1h8vV9?he|4|dCtr|x6R#YSmT&vEAM6i8%SfV9P26+
z%LZ4)F88}8N8xBx%s32F(>`eC$l?LuRW*856ox83LQYrRLU2K3vc3vr5p6q&2|DI3
z*I9KHm=gc#P!fwyAjEc&Ci`!KmFaGWoKG^VjG{R#6*OuxD2pdok>|3nR5u$fH4hsW
zdq{#JTvg?u8Rp9FBQc}aaKY|R63Z@%zB7t+jwlJVQ8Q?8AD7Dx#2BNLMU@4o!btS@
zsGJe*ZUu8xqLO8$Id4v@(QC#Gj}z}BA2vA4z`ZcJ2m&4$44X=oppWZXYEOhvx$26lF>G77#+r++X1H`En4{98|3DUNu6kmnrFBShE475J>KC+T
zg=A%5rsBccdB1MVQkI2#4@yu%)uX3$taOH+X57+|Dw0lDvQk%6PS9eXsS(G{xl0Ys
zK2b|yxkRi_T9p~+%Vm#C%&7v1;L3wAx{YlZIb+VbpP$Z`dA?lEDEQ#EjqPMFU*F!p
z{OS|g@C46&i?yy*q>`N27wD*vfRsW_LOHGJD0S2~?02R;-Ft%b#zLhEH@Bi+q~h%;qq+!F
zUm{d_so`=B@tW!8WhGX#{}??bdZBt=N;|bwnNXH7c7SQ?&`P3Otfo=LH&{vEOkBOO
z)MJ}7W-*~8p4Ox&Bt5gsepv?zE>Nr>do8kxxn|eTjLH_mw2Gw9XRMM_1fV{4mhutZ
zj8b7pz0)W_W17|qtg6cL;Th4PQ~mCHHvtt{W0-_OSSB?ZHgn_xJzI@pbEY$WSQcxp
zS#g>yQb!$il3h@FK@O#`CB)yZhdM#`=W4MC_JfNvDCz`YbT>?+?-Ok
zm2PEgh`TAd)$nAghcA%Qs;siVecLc&>F88Ceplc)6n4UYo3vs@#GI@uAM)o{8$g68
zb$BEyii?x4rOT`AK-s3Fv)WQr$uwuL*gijz5rSp<&dR7_i&L@+=)|>3M8QUL%fq=1
zjDflH@u}Xu=AZd5{r>;!^8RfRj`Y@gu&WMQnU4HN6%nxA(jC>qM2Bu
zCR)z57(?MYW=u9pV_AXKO!XPCT4G2Y?V9|oaRUw0WXnQVovtRTJ)x?^mIqfaKj8w@
zrEy!1PQ5J_*cnU9Fo1Vx7dRdp{`FrtM(*KwLZyItf{3Zf!Lk`qn%KWq(vRyGQ`9Dx!b_V*NytORL|!
z*E357Td@X8;#yCVlUjzgCVjIwVhC$CGxwq6Y`p~YF(5E61`W~i6o8}1@US*ZYMq;a
zU2~)CkL%f22O)bEJz5RyCfzE1h)gqg*Faslc^VRd1_ktTj%|eKly#qhl~pm^3|V!Z
ze0R6qhP5@SYjbk3<9+&9aa~d2R@oY`4ln6CSSTr>57T4iTH~=$BptHE^G&y~1l7>%
zhZ+!JECuOx)zo0Ep|VD-qrewTv|e#eA+tSfT~UF3!!7d%tYdN(_{>feTlqJwPtaD;
zVbSd*#^`5by_@N7NoLX|5vnnD&yjFFRLw`KS%;_wnr%qVrzUOwjHIw%qpk<|pQ+R1kn*0?wq_lqW
z%-R#4cAZL5LczYf@)svN$=(G^VlQlgSUs7b*VeTf8y|7j6tm$A6}Cfa(*VX#4i+>V
zfMY$YPXJljC~~!_UxyN{7MiyXKy!F0E>b`$&24Ofk|svZ1(^f7#F1)_?I$vQld77@
z5$zO^xLuY)?U4hHmF-;kOmVsF*!W0yq%x3eky~@lYa|AAn6K_aXcUapAVvl5c5IPj
z3_G9fw4JtLj40yAAMu+Hj~_pN{`C3!?T5?vA1)t0JUu?`PmeVx3f#7_MV!v3m$$Kv
zKKUio-uJv*uKO&5=iFyzrra6GnR@2?oPc^ToBPblsv2Wdai1xXpW3`ijm;w4y9WUC
zI?bHPxzFLl(yrHC2b~a668m*`cUno7oO^npSPIUcGaVdbZ|?4IU*6rGMr=c}zA8+sNjJCf&BC|nS>9bmNYd__n55Iw%~qw-|J557
z5C~qx7-4Xjjfg_yaaxK+P2ujoQQ(oW1+aoSbjYtz1}s4hS@3|`dypatG^9tlzKvXH
zJ6bb)`skUewhidJ220YZc8jc<Y&6T9MTtey`*EMUoMQR!eM8u5oX0E2DE_n5CoiN#E+tXE)T!d6ON7>mj3=(J@^
zvuAlSj~-POb2k27i!4=J+ueo|Kw+?wm^Rs9nXdq*vK6s}J{KB?K@YT5AFTeDN>ng{
z7R7R7x3%o$-%KPSwN5>sp(K@0YrWs9CnQ#f0a$jJun5B*rG<{{YlcI6`5MW0;qdIL3x**&KR-+B??b_YpB6(o2kZc$h=EEa=jCk7TH*e$ISBdU5y{~3p%+@8;
zcbRE=7}-Al2%kFz<8bwj%3r`bU;&FjCMqk2IjoW@d?}-}!H*Ev(OLi!4dg8=wHefM
z_GPR$Z*Beo5aAJ~#L+BB7TpMB`}MlD)&cF|22@oRBTRw=EmbA)m@6?0FmR^<<0Lz7
zx9YJFAOPl?h=55t+hZ_>5mw1$7RulwObjgv4QOq5s(zBD&ddsTMC_Bz_GF5;EvDja
z6I$vpvwa5(VV>)Kx4
zX_P{w`l92CF$<6u(0rzPR{SU(T~i86_!vpFeX>Ajwhyz|aN_1P#`Z1usaZI4)Bwm_{{8rRuV1q&PD*;5kwU{kF&
zRHGBQ3|*~nx6XWOieSNzg3MS4e90wV?Hfy5LocQ(cXqE{MZm(bZLy7UdydoQijRK0
z;=`w>k3T&9=DVj~e|P!rH&35_c>4Imb>B-PXTtsFX578J-Nt4vp*}LX@B5F}y;!W8
zQveSLNA2
zr8L1uS4u~#_-HMl%nNJb<$eMM)lpz;nzJm+MaE)VOOdXuB5oQ?s7F0WG1T{OI;e?
z;|%9Vt!qL3g_1_EP<
zO+gy6FcYW1`Gm(O)Q%q?>$l#I|Kd{@?xK(+{^VZ!gzJolac0;9{pJM5*mm
z-VLQ>fl5hJW5Y#r=z+kUm2wVAz+h`kfa1oQ{3D|mj}3RjQX6RX9^=jWg%YdYH?-eF
z|CucBR-(mK5_CMjHY}v6SqaC&)kzK&yn?qEvu*cp-rDA1u4}Vf|6alkks4&(ky31(jlJyL+c{$fbJKu(16`&FVjFH|
zQxv0ioi8^a2y`T)hm+6r=A63PEjBl^d2M-$=#=VQ3NV+0Tnt4ut=fkjfX0R#`m|=&
zgg3gWk*>o5B3z*L8rK0@m}B)hu1J-JQrKZjMlu^80gGeE1lYI?(E|n|+=geui7~v`
z*3&AtXbs^Qu_IBCg*(Q;%px@EW-=}C6FA5Oic0U4RZ0K|a~YhNDkh9DA7u7^V>bNh
zW8}=786n)%G*3z)A9|{K-;S02uu>Uy+{&UQ35zbRUTrNP>DVgmZynIA^4Q4AxkHFU
zRg56nJGv!OBJ;x-+QTeV=}rY<*I6F64f}E8bKwCvJDv&zrePAwVA4Ub#Oz`$#VZ=P
ztUk}@5c(I^9&ofIiwm;{%mIy}pi%b+no-f(&McMC9W~t8V$1wA2*sP(B?Kmhxtnyt
zuDR+aG8ZJRN765?1KZu#g{-(LnI)7J3AD9VM|bt`8kXK;5sa{+>{V7oCc9rj&)|_P
zy$Y3W-!w47#>vlTrMx*|lej$cHyZQHhO
z=i3_}Bi5u!&Y64eb*-$LnW_>b50h4+)I$Pu&(i0E%{lj(fW`1R%lmdo0JPfo88Nbo
zr3_x1a}RFe-m^hf+4Rhhs+2a*WLquNyd=OXT%NAm@XRU8*R1r2F{1QmKxY)Xs9SnG
zs+N^;vF5bcLYk_YQ~j7MMi!p6H%ih=zoy*g)FLx8D@tamaB_f5<}=M$m3#Bv?iG?t
zgt^|NhDGJ%wTes)ht0y82+;lEaEVAW^KyN%9&Hj
zOpPgCv7#L6`BCmZ#;_HmHsYWq>DoQTB`8+u-4v))ovNf4f^Ns{pFKicr8_D)
zBJ@~f@D~~TeD|$=FL@a|fedEw5tV>bVg725tEz28!j-$BUHhSH69Y`!VSP9QI)6be
ziPlPMsj7@EAQat@nVCuSm|dc^Ic|=yIVX1x2_+Q6Q_3@ogE}r&rxSN&)VC)ZEogng
z>chPm@}8SoC|BXcc3X4~gb+gkL%m_T4TDF6?mCMasuK*?q`3ZPZZ0czxNEZrd$BH+
zn_vl*<|U+o3;AdiA1xI^KNjeO1&iAjxtF^Sx0%%?4f|HAR<73ZM%1XY5imBUYu>FlqO<<3=mQEY`@V|WUYLm9uh@I
zqi=LK4rc+07)`pS4j&j`$pp-jHX_`rIQN9P;(E|_p{~b7*15U4Gs#8MH6UEA3Dv@r
zV>PqFttUqa7@DPxCWV96fyVf<2d`<*TBRn-nusM0hS5F|WzuTqCcI^^XdYYZmsC+~
znINITgmYp9NSrp@p7CXJzv6nWzw%dp{xAK@zxyBkjsNNo-u~|O`q&kZI4!CA%Y;b6
zTrFu6SdIO5x1sX}$7DBeLeb5Ole$~6cx`P%7+2vTys3JN_i8m|yZmI1%PMMWX6rW(
z>ZG|QMGY+6+>J(|T`o!B!QX1Ag|A$@!toS2(W&SDz-{_16C%6_v)PD$5dcp
zw&?b_PvkqVh{ytq(zT;Re{`F7JX*J*znev5Du9bLqJVAgf3YE$L-%
zTTrZT+je<+%E@s$jlq3SfIS+2duMYdtD;UlM+VN@y5ersw*)(U>
zhmaZz>k6YEOin5hypraPwyt|yrSU?0#h$tK1Q)I_QtvX>&8m>B#-qJ`2fjY72?}sj
zDs;fw2rDItKF{9ksgkqO-A<~Ue7Jo2
zeEIRqe!aF_Il|93+pAaSQw-fN1>~&jb=J%A;BCLCm#_tYt9t7;ARNl_Z@B#F>_aL1%`A98b(q++{$WJGHnG$RA$bU
z7?!LsZ)tNlh|1|6F+9e0z3g-DV;kExSj{#WFmvY2Lb59Nsr;BekwZ);XXbvrTz