From 22c54f7307326328f6290551ce482f224c7ee9e4 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Fri, 17 Jul 2026 10:25:18 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-17 10:24:46 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-17 10:24:46 --- .syncro-diag-bo2.ps1 | 28 ++++ .syncro-diag2-bo2.ps1 | 23 +++ .syncro-diag3-bo2.ps1 | 29 ++++ .syncro-diag4-bo2.ps1 | 22 +++ .syncro-install-bo2.ps1 | 23 +++ .syncro-install-final-bo2.ps1 | 46 ++++++ .../docs/REMAINING-WORK-PLAN.md | 138 +++++++++++++++--- ...alis-online-payments-scoping-2026-07-15.md | 61 ++++++++ .../cascades-technology-plan-2026-07-15.html | 1 + .../cascades-technology-plan-2026-07-15.md | 1 + .../cascades-technology-plan-2026-07-15.pdf | Bin 433980 -> 436003 bytes ...7-17-howard-roadmap-finish-line-refresh.md | 117 +++++++++++++++ errorlog.md | 2 + 13 files changed, 474 insertions(+), 17 deletions(-) create mode 100644 .syncro-diag-bo2.ps1 create mode 100644 .syncro-diag2-bo2.ps1 create mode 100644 .syncro-diag3-bo2.ps1 create mode 100644 .syncro-diag4-bo2.ps1 create mode 100644 .syncro-install-bo2.ps1 create mode 100644 .syncro-install-final-bo2.ps1 create mode 100644 clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md create mode 100644 clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md diff --git a/.syncro-diag-bo2.ps1 b/.syncro-diag-bo2.ps1 new file mode 100644 index 00000000..e2f4451d --- /dev/null +++ b/.syncro-diag-bo2.ps1 @@ -0,0 +1,28 @@ +$ErrorActionPreference = 'Continue' +$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' +$hits = Get-ItemProperty $keys -ErrorAction SilentlyContinue | + Where-Object { $_.DisplayName -match 'Syncro|Kabuto|RepairTech' } | + Select-Object DisplayName, DisplayVersion, PSChildName, UninstallString +if ($hits) { $hits | Format-List | Out-String | Write-Output } else { Write-Output 'NO-STALE-UNINSTALL-ENTRIES' } + +$reboot = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or + (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') +Write-Output ('PENDING-REBOOT=' + $reboot) + +$msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi' +if (-not (Test-Path $msi)) { + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 + (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi) +} +$log = 'C:\Windows\Temp\syncro-install.log' +$p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart', '/L*v', $log -Wait -PassThru +Write-Output ('msiexec exit=' + $p.ExitCode) +if (Test-Path $log) { + Write-Output '--- last 60 log lines ---' + Get-Content $log -Tail 60 | Write-Output + Write-Output '--- return-value-3 context ---' + $lines = Get-Content $log + $idx = ($lines | Select-String 'Return value 3' | Select-Object -First 1).LineNumber + if ($idx) { $lines[[math]::Max(0, $idx - 15)..[math]::Min($lines.Count - 1, $idx + 2)] | Write-Output } +} diff --git a/.syncro-diag2-bo2.ps1 b/.syncro-diag2-bo2.ps1 new file mode 100644 index 00000000..f04e78a2 --- /dev/null +++ b/.syncro-diag2-bo2.ps1 @@ -0,0 +1,23 @@ +$ErrorActionPreference = 'Continue' +Write-Output '=== MsiInstaller events today (install/uninstall history) ===' +Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).Date} -ErrorAction SilentlyContinue | + Where-Object { $_.Message -match 'Syncro' } | + Sort-Object TimeCreated | + ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' id=' + $_.Id + ' :: ' + (($_.Message -replace '\s+',' ').Substring(0,[math]::Min(160,$_.Message.Length)))) } + +Write-Output '=== Syncro bootstrapper / agent logs ===' +$logDirs = @('C:\Windows\Temp','C:\ProgramData\Syncro','C:\ProgramData\Syncro\logs') +foreach ($d in $logDirs) { + Get-ChildItem $d -Filter '*ncro*' -ErrorAction SilentlyContinue | ForEach-Object { Write-Output ('FOUND: ' + $_.FullName + ' (' + $_.Length + 'b, ' + $_.LastWriteTime.ToString('HH:mm:ss') + ')') } +} +$bl = Get-ChildItem 'C:\Windows\Temp' -Filter 'Syncro*.log' -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 +if (-not $bl) { $bl = Get-ChildItem 'C:\ProgramData\Syncro' -Filter '*.log' -Recurse -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 1 } +if ($bl) { Write-Output ('--- tail of ' + $bl.FullName + ' ---'); Get-Content $bl.FullName -Tail 40 } + +Write-Output '=== Defender detections (last 24h) ===' +Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.InitialDetectionTime -gt (Get-Date).AddDays(-1) } | + ForEach-Object { Write-Output ($_.InitialDetectionTime.ToString('HH:mm:ss') + ' ' + $_.ThreatID + ' res=' + ($_.Resources -join ';')) } + +Write-Output '=== 3rd-party AV registered ===' +Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | + ForEach-Object { Write-Output ($_.displayName + ' state=' + $_.productState) } diff --git a/.syncro-diag3-bo2.ps1 b/.syncro-diag3-bo2.ps1 new file mode 100644 index 00000000..cc1e556c --- /dev/null +++ b/.syncro-diag3-bo2.ps1 @@ -0,0 +1,29 @@ +$ErrorActionPreference = 'Continue' +foreach ($k in @( + 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion', + 'HKLM:\SOFTWARE\WOW6432Node\RepairTech' +)) { + $exists = Test-Path $k + $line = "KEY $k exists=$exists" + if ($exists) { + try { $acl = Get-Acl $k; $line += ' owner=' + $acl.Owner } + catch { $line += ' acl-read-FAILED: ' + $_.Exception.Message } + } + Write-Output $line +} +Write-Output '=== subkey counts ===' +try { Write-Output ('64-bit Uninstall subkeys: ' + (Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -EA Stop).Count) } catch { Write-Output ('64-bit enum FAILED: ' + $_.Exception.Message) } +try { Write-Output ('32-bit Uninstall subkeys: ' + (Get-ChildItem 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -EA Stop).Count) } catch { Write-Output ('32-bit enum FAILED: ' + $_.Exception.Message) } +Write-Output '=== write test (32-bit view, as the installer would) ===' +try { + $t = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\_acg_writetest' + New-Item $t -Force -EA Stop | Out-Null + Remove-Item $t -Force -EA Stop + Write-Output 'WRITE-TEST-OK' +} catch { Write-Output ('WRITE-TEST-FAILED: ' + $_.Exception.Message) } +Write-Output '=== C:\Program Files\RepairTech leftovers ===' +if (Test-Path 'C:\Program Files\RepairTech') { + Get-ChildItem 'C:\Program Files\RepairTech' -Recurse -EA SilentlyContinue | Select-Object -First 25 | ForEach-Object { Write-Output $_.FullName } +} else { Write-Output 'NOT-PRESENT' } diff --git a/.syncro-diag4-bo2.ps1 b/.syncro-diag4-bo2.ps1 new file mode 100644 index 00000000..507a7c56 --- /dev/null +++ b/.syncro-diag4-bo2.ps1 @@ -0,0 +1,22 @@ +$ErrorActionPreference = 'Continue' +$today = (Get-Date).Date +Write-Output '=== App log: errors/crashes today mentioning Syncro/Kabuto/Squirrel/.NET ===' +Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$today} -ErrorAction SilentlyContinue | + Where-Object { $_.LevelDisplayName -in 'Error','Warning' -and $_.Message -match 'Syncro|Kabuto|Squirrel|Update\.exe|RepairTech' } | + Sort-Object TimeCreated | Select-Object -Last 15 | + ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.ProviderName + '/' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) } + +Write-Output '=== Defender blocks today (ASR 1121/1122, CFA 1123/1124, 5007) ===' +Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121,1122,1123,1124,1126,1127,5007; StartTime=$today} -ErrorAction SilentlyContinue | + Sort-Object TimeCreated | Select-Object -Last 15 | + ForEach-Object { Write-Output ($_.TimeCreated.ToString('HH:mm:ss') + ' [' + $_.Id + '] ' + (($_.Message -replace '\s+',' ').Substring(0, [math]::Min(220, $_.Message.Length)))) } + +Write-Output '=== ASR / CFA / policy state ===' +$mp = Get-MpPreference -ErrorAction SilentlyContinue +Write-Output ('ASR rule count enabled: ' + (@($mp.AttackSurfaceReductionRules_Actions | Where-Object { $_ -eq 1 }).Count)) +Write-Output ('ControlledFolderAccess: ' + $mp.EnableControlledFolderAccess) +Write-Output ('AppLocker policy: ' + ((Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue).RuleCollections | Measure-Object).Count + ' rule collections') +$sac = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue +Write-Output ('SmartAppControl state: ' + $sac.VerifiedAndReputablePolicyState) +Write-Output '=== free space / drives ===' +Get-PSDrive -PSProvider FileSystem | ForEach-Object { Write-Output ($_.Name + ': used=' + [math]::Round($_.Used/1GB,1) + 'GB free=' + [math]::Round($_.Free/1GB,1) + 'GB') } diff --git a/.syncro-install-bo2.ps1 b/.syncro-install-bo2.ps1 new file mode 100644 index 00000000..4956dca9 --- /dev/null +++ b/.syncro-install-bo2.ps1 @@ -0,0 +1,23 @@ +$ErrorActionPreference = 'Continue' +$svc = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue +$path = Test-Path 'C:\Program Files\RepairTech\Syncro' +if ($svc -or $path) { + $names = ($svc | ForEach-Object { $_.Name + '=' + $_.Status }) -join ',' + Write-Output ('SYNCRO-ALREADY-INSTALLED services=[' + $names + '] repairtech-path=' + $path) +} else { + Write-Output 'SYNCRO-NOT-FOUND - installing' + $msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi' + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 + (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi) + Write-Output ('MSI downloaded ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB') + $p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart' -Wait -PassThru + Write-Output ('msiexec exit=' + $p.ExitCode) + Start-Sleep -Seconds 30 + $svc2 = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue + if ($svc2) { + Write-Output ('SYNCRO-INSTALL-VERIFIED ' + (($svc2 | ForEach-Object { $_.Name + '=' + $_.Status }) -join ',')) + } else { + Write-Output 'SYNCRO-SERVICES-NOT-FOUND-AFTER-INSTALL - check manually' + } + Remove-Item $msi -Force -ErrorAction SilentlyContinue +} diff --git a/.syncro-install-final-bo2.ps1 b/.syncro-install-final-bo2.ps1 new file mode 100644 index 00000000..6b3a9dce --- /dev/null +++ b/.syncro-install-final-bo2.ps1 @@ -0,0 +1,46 @@ +$ErrorActionPreference = 'Continue' +$svc = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue +if ($svc) { + $names = ($svc | ForEach-Object { $_.Name + '=' + $_.Status }) -join ',' + Write-Output ('SYNCRO-ALREADY-INSTALLED services=[' + $names + ']') + exit 0 +} +# Clean any leftover from prior failed installs +$repairDir = 'C:\Program Files\RepairTech' +if (Test-Path $repairDir) { + Remove-Item $repairDir -Recurse -Force -ErrorAction SilentlyContinue + Write-Output 'CLEANED prior RepairTech directory' +} +foreach ($k in @('HKLM:\SOFTWARE\WOW6432Node\RepairTech\Syncro','HKLM:\SOFTWARE\WOW6432Node\RepairTech\Kabuto')) { + if (Test-Path $k) { Remove-Item $k -Recurse -Force -ErrorAction SilentlyContinue; Write-Output ("CLEANED registry: $k") } +} +$msi = 'C:\Windows\Temp\SyncroSetup-khalsa.msi' +if (-not (Test-Path $msi)) { + [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072 + (New-Object Net.WebClient).DownloadFile('https://rmm.syncromsp.com/dl/msi/djEtOTQ1NjU1NC0xNTA3NjA4MzYxLTQ4NzUzLTM2ODUwMjI=', $msi) + Write-Output ('MSI downloaded ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB') +} else { + Write-Output ('MSI already present ' + [math]::Round((Get-Item $msi).Length / 1MB, 1) + ' MB') +} +$log = 'C:\Windows\Temp\syncro-install-final.log' +$p = Start-Process msiexec.exe -ArgumentList '/i', $msi, '/qn', '/norestart', '/L*v', $log -Wait -PassThru +Write-Output ('msiexec exit=' + $p.ExitCode) +if ($p.ExitCode -eq 0) { + Start-Sleep -Seconds 30 + $svc2 = Get-Service -Name 'Syncro','SyncroLive','SyncroOvermind' -ErrorAction SilentlyContinue + if ($svc2) { + Write-Output ('SYNCRO-INSTALL-OK ' + (($svc2 | ForEach-Object { $_.Name + '=' + $_.Status }) -join ',')) + } else { + Write-Output 'SYNCRO-SERVICES-NOT-YET-VISIBLE - may need a moment to register' + } +} else { + Write-Output '--- last 30 lines of install log ---' + if (Test-Path $log) { Get-Content $log -Tail 30 } + Write-Output '--- Return value 3 context ---' + if (Test-Path $log) { + $lines = Get-Content $log + $idx = ($lines | Select-String 'Return value 3' | Select-Object -First 1).LineNumber + if ($idx) { $lines[[math]::Max(0, $idx - 10)..[math]::Min($lines.Count - 1, $idx + 2)] | Write-Output } + } +} +Remove-Item $msi -Force -ErrorAction SilentlyContinue diff --git a/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md b/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md index d3d9bc2f..a4915b0d 100644 --- a/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md +++ b/clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md @@ -11,6 +11,23 @@ > CS-SERVER EDR installed, ticket table reconciled against Syncro (0 open as of 7/10). > The "Live snapshot" below is still the 6/24 AD-vs-RMM diff -- domain-join states are > per-machine current in the wiki's "Migration phase status" table. +> +> **REFRESHED 2026-07-15 — FINISH-LINE PASS** (full live verification sweep: Graph/M365, +> Datto EDR, UniFi, MSP360, DNS — all evidence in the 7/15 session log + wiki recompile): +> - **CARF Technology Plan FINALIZED** (`docs/proposals/cascades-technology-plan-2026-07-15.md`) +> — this roadmap is the execution engine behind it; plan targets (30/60/90 day) map to the +> workstreams below. +> - **jodi.ramstack DECOMMISSIONED 7/15** (disabled + sessions revoked + suspended-Standard +> license reclaimed; mailbox was already deprovisioned by the suspended sub — no data in-tenant). +> Suspended Standard now 29 consumed. +> - **EDR verified 35/35** incl. CS-SERVER; email auth (SPF/DKIM/DMARC) verified; ALIS SSO +> verified (secret good to 2028); 77 APs confirmed; voice VLAN exactly 37 devices. +> - **Synology -> CS-SERVER share sync IS live and working** (wiki was stale; corrected). +> - **New workstreams added**: WS8 (SharePoint/Teams HIPAA migration), WS9 (ALIS online +> payments), WS3 step 3b (nurse-station phone-parity shared login). +> - Prepaid block: **21.5 hrs** (live 7/15). +> - Goal restated: **close every workstream out** — the sequence at the bottom is the +> finish order. --- @@ -143,9 +160,11 @@ access matrix; Synology retired as primary. ## Workstream 3 — HIPAA caregiver lockdown — GO-LIVE (highest value, mostly built) -**[UPDATED 2026-07-13]** The 7/1 CA cutover put caregivers in an **interim posture**: all 35 +**[UPDATED 2026-07-15]** The 7/1 cutover put caregivers in an **interim posture**: all 35 `SG-Caregivers` may sign in on desktops AND phones, **on-network only** (`e35614e1` off-network -block + `7d491c7a` 8h sign-in frequency enforced; `SG-Caregivers` excluded from MFA-for-all). +block — policy itself enabled since 2026-04-29 per live CA read 7/15, trusted IPs +72.211.21.217/32 + 184.191.143.62/32 — + `7d491c7a` 8h sign-in frequency enforced; +`SG-Caregivers` excluded from MFA-for-all). The compliance-block policy `ede985e2` was **DISABLED 2026-07-01 — do not re-enable** (superseded by the allow-list). Temp passwords are live for phone sign-in (must-change cleared fleet-wide 7/2; `PSO-Caregivers` never-expire FGPP in place). Roster = **35** after the 7/1 reconcile. @@ -164,6 +183,16 @@ Final lockdown = flip from test scope to real caregivers, one device at a time after Win11 reinstall), NURSESTATION-PC (+ verify NurseAssist/Laptop4). NOTE: the device-lockdown (auto-logoff) GPO only applies once machines are in `OU=Caregiver Devices` — until then desktops caregivers use under the interim posture have NO auto-logoff enforcement. +3b. **[ADDED 2026-07-15, Howard] Nurse-station desktops = phone-parity shared login.** The TWO + nurse-station desktops — **NURSESTATION-PC + ASSISTNURSE-PC** (explicitly NOT the medtech + laptops) — get the same model as the caregiver phones: ANY caregiver signs in with their own + `cascades\` username, lands on ALIS via SSO, and sees the SAME standardized desktop shortcuts + to the SAME sites as the phones. Implementation: allow `SG-Caregivers` interactive logon on + those two machines; deploy the shortcut set via the `CSC - Caregiver Workstation` GPO + (per-machine, all-users desktop) so every profile is identical; no per-user profile + customization; auto-lock/sign-out from the device-lockdown GPO applies (step 6). Define the + canonical shortcut list from the phone home-screen set (ALIS + the same sites — capture the + list from a phone before building). 4. ALIS email-match the 35 caregivers + medtechs (ALIS staff Email = Entra UPN); ALIS records still to create for Munezero/Cota/Robinson; Vallejo email-match; 7 discharged-record decisions; turn off ALIS-native 2FA per user, then move to SSO-only (native login is a CA bypass path). @@ -178,8 +207,12 @@ Final lockdown = flip from test scope to real caregivers, one device at a time ## Workstream 4 — M365 - **Relicense remaining suspended Business Standard users -> Business Premium** (Standard SKU is - SUSPENDED — time-sensitive). SPB now 45 seats enabled (Howard bought 11 on 6/30); 41 consumed as - of 7/1 — count seats before relicensing. + SUSPENDED — time-sensitive). Live 7/15: SPB 45 enabled / 41 consumed (4 free); suspended + Standard **29 consumed** after the jodi.ramstack reclaim — 29 users to move needs ~25 more SPB + seats OR a per-user needs pass (lighter licenses where full Office isn't needed — the CARF plan + Area 2 budgets ~$375–575/mo for the mix). Count seats + decide mix before touching licenses. +- ~~Decommission jodi.ramstack~~ — **DONE 2026-07-15** (disabled, sessions revoked, license + reclaimed; mailbox already gone via the suspended sub — nothing recoverable in-tenant). - **Create break-glass accounts (`breakglass1/2-csc@`) + enroll FIDO2 YubiKeys** — still not created (confirmed 5/27); now a **prerequisite for the WS3 allow-list enforcement flip**. - **Remove the standing Privileged Authentication Administrator role from the @@ -194,15 +227,22 @@ Final lockdown = flip from test scope to real caregivers, one device at a time ## Workstream 5 — Server / infrastructure -- **Cloud backup (MSP360 -> ACG-backup): VERIFIED running 2026-06-24** (last run Success, 0 failed, 575 GB baseline in cloud, incrementals working). Still confirm it is image/bare-metal/system-state (looks file-level) + set retention. [GATE for any drive work] +- **Cloud backup (MSP360 -> ACG-backup): re-verified 2026-07-15** — daily file-level backup + running clean (incrementals current). **[WARN] The image/system-state side was ~10 days stale + at the 7/15 check** — confirm/repair the image plan + set retention BEFORE the SSD swap. + [GATE for any drive work] - **CS-SERVER RAID -- CORRECTED 2026-06-24: HEALTHY, not degraded** (live OMSA: both mirrors Ok, all 5 disks Online, all LEDs green; the 6/15 degraded self-recovered). **NO emergency drive swap.** 1:0:4 = global hot spare (do not remove). **Planned** reliability upgrade: replace the 2 consumer 320 GB drives (esp. flaky WD 0:0:3) with the 2x enterprise SSD **already purchased**, on a scheduled window w/ confirmed image/system-state backup. **[WARN] PSU redundancy lost** -- one PSU not delivering, check onsite. Service Tag 9MQFTK1. Real fix = DC migration off the 16-yr-old R610. - ~~Clean up old-MSP agent sprawl (Datto RMM/CentraStage + Datto EDR/Infocyte) thrashing the spindle~~ — **DONE on CS-SERVER 2026-06-26** (full legacy Datto stack removed). **Current Datto EDR installed on CS-SERVER 2026-07-13** (HUNTAgent=Running, cmd `0a60cac7`) — the DC is back under managed endpoint protection. Fleet stragglers tracked in the wiki (DESKTOP-TRCIEJA BD_ACTIVE, laptop3/laptop1/ cascades-laptop reconcile, Syncro BD-deployment removal, GravityZone portal cleanup). -- Synology -> backup-only (Team Folder migration of the real shares; close the workgroup/Kerberos quirk). +- Synology -> backup-only: **the share syncs Synology -> CS-SERVER ARE set up and working** + (confirmed by Howard 7/15; wiki corrected). Remaining: finish the role flip (server is primary, + Synology becomes the onsite backup target per CARF plan Area 5) + close the workgroup/Kerberos quirk. - Rotate the Synology signin-portal credential (was committed plaintext historically). +- pfSense: **AutoConfigBackup not enabled** (found 7/15) — enable it (config IS backed up via + our repo copy, but ACB gives point-in-time restore). --- @@ -231,7 +271,9 @@ Final lockdown = flip from test scope to real caregivers, one device at a time for offline resident TVs; identify the 17 unknowns + generic phones with John Trozzi. - **#32319** WiFi Room 343 — relocate a floor-2/4 AP for coverage (unifi-wifi skill, site `va6iba3v`). - **#32342** Copy Room switch — install + adopt into UniFi. -- ~25 switch ports linked at 100 Mbps but gig-capable (cabling/NIC sweep). +- Sub-gigabit sweep (live 7/15): **34 switch ports at 100 Mbps + 5 AP uplinks below gig** — + cabling/NIC sweep, prioritize the AP uplinks. (Live UniFi count 7/15: **11 switches**, 77 APs, + voice VLAN exactly 37 devices.) - *(Superseded)* Voice 5 GHz lock — now folded into the CSC ENT consolidation above (single dedicated 5 GHz network for phones + sensors, not just a phone-side band lock). @@ -243,19 +285,81 @@ Final lockdown = flip from test scope to real caregivers, one device at a time --- -## Suggested sequence (fastest path) — re-cut 2026-07-13 +## Workstream 8 — M365 collaboration migration (SharePoint / Teams) — HIPAA lockdown + +> Added 2026-07-15 (Howard): move Cascades onto SharePoint, Teams, and the wider Microsoft 365 +> platform to lock down data access and advance HIPAA compliance. Pairs with the network upgrade +> work (WS6) and the domain migration (WS1/2) — the dept OU/group structure built there becomes +> the SharePoint/Teams permission model. + +- **Scope/plan the migration**: department file shares (CS-SERVER `D:\Shares` + Synology) -> + SharePoint document libraries with role-based permissions mapped from the existing AD dept + groups; Teams for internal comms/collab (replaces ad-hoc channels); OneDrive for per-user files. +- **HIPAA guardrails first-class**: role-scoped access (same SG model as caregiver lockdown), + audit logging (ties into the WS4 audit-retention build), retention policies, DLP evaluation, + sensitivity labels for PHI, external-sharing OFF by default. +- **Licensing already supports it** — Business Premium (45 seats) includes SharePoint/Teams/ + OneDrive/Intune/Purview basics; the WS4 relicensing moves the office staff onto it. +- Sequencing: after (or alongside tail of) the domain migration — don't build SharePoint + permissions on the pre-migration flat-share model. Candidate first movers: the newer + role-based shares (Executive restricted, Company Web Docs, ALDOCS). +- Synology then finishes its transition to backup-only (WS5) once shares live in SharePoint. +- Also on the plan doc: Copilot evaluation under HIPAA guardrails + the KPI dashboard's + SharePoint/Power BI Phase 1 (scheduled exports) land on this same platform. + +--- + +## Workstream 9 — ALIS online payment system + +> Added 2026-07-15 (Howard): get Cascades onto ALIS's online payment system (resident/family +> billing payments through the clinical-record platform, Medtelligent). + +- **Scope with Medtelligent** — **scoping questions DRAFTED 2026-07-15** + (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`, 18 questions: availability/ + pricing/processor/PCI/BAA/ledger-posting/API/rollout). Next action: send to the Medtelligent + rep, loop in Jeff Bristol (accounting@) on replies. Q9 doubles as the BAA chase (Medtelligent + BAA unverified — feeds the area-4 BAA inventory regardless). +- Coordinate with the business office (Jeff Bristol / accounting@) on the AR workflow change + and family communication. +- IT-side items: SSO already live for ALIS (staff side); verify family-facing payment portal + access needs nothing on our network/identity side; add Medtelligent's payment processing to + the BAA/vendor tracker (plan area 4). +- Ties into the KPI dashboard (ALIS billing data is a Phase 1 export source). + +--- + +## Finish sequence — re-cut 2026-07-15 (order of completion) + +Everything below is scoped, built, or blocked on exactly one prerequisite — this is the +close-out order, not a wish list. 1. **2026-07-16 afternoon: offboard Juan Andrade** (disable + SG-Caregivers removal + license reclaim) — coord todo `80716a98`. Do NOT disable before then. -2. **Break-glass accounts + strip the stranded PAA role** (Workstream 4) — prerequisite for the - allow-list enforcement flip; the tenant currently has live block policies and no break-glass. -3. **Caregiver lockdown go-live** (Workstream 3) — highest HIPAA value; the interim posture's real - control (device allow-list) is still report-only/test-scoped. -4. **M365 relicense remaining suspended-Standard users** (Workstream 4) — time-sensitive. -5. **Backup image/system-state confirm -> planned SSD swap** (Workstream 5) — single-DC risk. -6. **Remaining staff domain joins + dept drives** (Workstreams 1+2) + printer-share repoints / - Point-and-Print GPO fleet-wide (see wiki VLAN 20 section). -7. Network tail (CSC ENT device island, 100 Mbps ports) + audit-retention build. +2. **Break-glass accounts (`breakglass1/2-csc@`) + FIDO2 keys + strip the stranded PAA role** + (WS4) — THE blocking prerequisite for the allow-list enforcement flip; the tenant runs live + block policies with no break-glass today. Also the CARF plan's 30-day security item. +3. **Caregiver lockdown go-live** (WS3 steps 1–8, incl. 3b nurse-station phone-parity build) — + highest HIPAA value; the real control (`1b7fd025` allow-list) is still report-only/test-scoped. + Capture the phone shortcut list for 3b while onsite for the OU moves. +4. **M365 relicense the 29 suspended-Standard users** (WS4) — time-sensitive; decide seat mix + first (4 SPB free vs 29 to move). +5. **Repair/confirm the image/system-state backup -> scheduled SSD swap** (WS5) — image side was + ~10 days stale on 7/15; single-DC risk until done. +6. **Remaining staff domain joins + dept drives** (WS1+2: ~10 machines left after readiness + blockers cleared) + printer-share repoints / Point-and-Print GPO fleet-wide (wiki VLAN 20). + Onsite batch: reboots, KFM unlinks, LAPTOP-DRQ5L558 on-LAN. +7. **Network tail** (WS6: CSC ENT device island incl. the ~79-client evacuation, 34-port + + 5-AP-uplink gig sweep) + **audit-retention build** (WS4 — HIPAA 164.312(b) gap, approved + since 4/29). +8. **M365 collaboration migration (WS8)** — SharePoint/Teams scoping once the domain-migration + tail is done; permission model rides the dept OU/SG structure from WS1/2. Synology finishes + its backup-only role flip (WS5) behind it. +9. **ALIS online payments (WS9)** — vendor-driven, runs in parallel with everything above: + scoping questions are DRAFTED (`docs/proposals/alis-online-payments-scoping-2026-07-15.md`) + — send to Medtelligent when ready; business-office coordination (Jeff Bristol) is the long pole. +10. **Ticket-verify pass with Howard** (table below) — confirm the 6 closed-in-Syncro tickets + were actually completed; any that weren't fold back into WS1/2/6/7 and get done in step 6–7 + onsite trips. --- diff --git a/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md b/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md new file mode 100644 index 00000000..fb664a89 --- /dev/null +++ b/clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md @@ -0,0 +1,61 @@ +# ALIS Online Payments — Scoping Questions for Medtelligent + +> Drafted 2026-07-15 (Howard / ACG) for the WS9 roadmap item: getting Cascades of Tucson +> onto ALIS's online payment system (resident/family billing payments). +> Community: cascadestucson.alisonline.com, communityId 622. +> Send to Medtelligent support/account rep; loop in Jeff Bristol (accounting@) on replies. + +## Product & availability + +1. Is the online payments module available on Cascades of Tucson's current ALIS plan, or is + it a separate subscription/add-on? What is it officially called on your side? +2. Does it cover both one-time payments and recurring/autopay (ACH and credit/debit card)? +3. Can family members / responsible parties pay without an ALIS login, or does each payer + need a portal account? How are payer accounts invited and managed? +4. Does it support partial payments, split billing between multiple responsible parties, and + payment plans? + +## Pricing & processing + +5. What are the costs: monthly/module fee, per-transaction fees (card vs ACH), and any + setup fee? Who is the payment processor? +6. Can transaction fees be passed to the payer (surcharge/convenience fee), and is that + configurable per payment method? +7. What is the settlement flow — how and when do funds land in Cascades' bank account, + and what does the remittance/reconciliation report look like? + +## Compliance & security + +8. Is the payment flow fully hosted/tokenized by the processor (i.e., Cascades never touches + card data)? What PCI DSS responsibility, if any, remains on the community? +9. Does the existing Medtelligent BAA cover the payments module, or is an updated + agreement needed? (Note: we are completing a BAA inventory — please send the current + executed BAA on file for Cascades.) +10. Where is payment/payer data stored, and what is the data-retention policy? + +## Billing integration & reconciliation + +11. Do online payments post automatically against ALIS resident ledgers/invoices, or does + the business office apply them manually? +12. How do refunds, chargebacks, and failed ACH payments flow back into the ledger? +13. Is payment data available through the ALIS API/exports (we pull staff data via API today + and are building a leadership KPI dashboard — billing/AR aging would be a Phase 1 source)? +14. Does it interoperate with QuickBooks or Bill.com workflows, or is export/import the path? + +## Rollout & support + +15. What does implementation look like: timeline, setup steps on the community side, bank + verification, and any business-office training you provide? +16. What family-facing materials exist (announcement templates, how-to guides) for the + payer rollout? +17. Is there a sandbox/test mode so accounting can validate posting before go-live? +18. Who is our implementation contact, and what does ongoing support look like for payment + disputes or processor issues? + +## Internal notes (not for the vendor email) + +- IT side is expected to be near-zero: staff SSO is live; the payer portal is vendor-hosted. + Confirm nothing is needed on our identity/network side (Q3, Q8). +- Q9 doubles as the BAA chase — the Medtelligent BAA is unverified (wiki: "BAA required + before PHI leaves"), and the plan's area 4 BAA inventory needs it regardless. +- Answers feed: WS9 rollout decision, area 4 BAA tracker, KPI dashboard Phase 1 source list. diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html index d7181f52..b06696e6 100644 --- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html +++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.html @@ -204,6 +204,7 @@ Complete staff domain migration + department drivesACGlabor60–90 days Final Windows Pro upgrade (1 deferred device)ACG~$99next window Retire the per-PC Synology sync client as machines migrateACGlaborwith migration + Plan the move of department files and team collaboration to SharePoint and Teams (Microsoft 365) — role-based access, audit logging, and retention that strengthen HIPAA complianceACG + Cascadesincluded in Microsoft 365 licensing90 days, then phased diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md index fd9e4acb..551660cd 100644 --- a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md +++ b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md @@ -70,6 +70,7 @@ sign-on, and a sanctioned analytics path for leadership). | Complete staff domain migration + department drives | ACG | labor | 60–90 days | | Final Windows Pro upgrade (1 deferred device) | ACG | ~$99 | next window | | Retire the per-PC Synology sync client as machines migrate | ACG | labor | with migration | +| Plan the move of department files and team collaboration to SharePoint and Teams (Microsoft 365) — role-based access, audit logging, and retention that strengthen HIPAA compliance | ACG + Cascades | included in Microsoft 365 licensing | 90 days, then phased | ## 3. Security (sensitive data / HIPAA) diff --git a/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf b/clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.pdf index 803d9be784d94f9029a6f536fa8f69e936f3361c..cdb06b377e231e9ccac0b26e15dd26a747db3eed 100644 GIT binary patch delta 65032 zcmafb2Urx#60S1~h~zASBqdAOyi3j~l2I@qNkKqGP%$25$%+wNvBiX#vw+GH%qWNv zL>M?J&8&+ zg8!LFS$fAux<({M=^DFQ)2Vbel|y5ZUCtY08b&-TI)iI(ue&U9X;eg<)T+H5A;IT5 zO5>7VU7c$;cEe=OMkT6bg2it!@g_W0zV^fX-G`0oCfkn=Ud@j4*x}anboR^h4SDx$ z@3prU8*F_1ZlW8XU$kW4!_mc`drxKkv2{VgtNJ?bhJ}{M zY94wMX?}B0R^8$E@7E9Z>n!HIjA)x-$Yl-Ys-Iuh8Fc8Xx1lWxvpSN3UM&9@~FUY=_nM1?m;DTS90 zE5$W~6xNNl?3LLud*rTt*SdE;z8)(*o7P)&gp$xK$5Z$v_vkGMSt}ft>}aj<{@AIn z^^8eKAdzvu^YTGxqCj+PB6M%C}~@3B6jb?KT@4muG7?uTaQIq*|pV>{-No&z`kuh5bkC zxppZTyiYANo+SPG)$?NP76JEqN1IOQw^aE@yt&EE4R9H%w_UxmuD^5auC=&~y;J77 z!PURD9Ui`IIA_W4m5b-EI1tZgFR}W^=5^Shad)b$rH72{Btx~(9mNa2s2L@wyWDHvPRS8bo_yQ9#<@KEyLZbHIu)eHm7l_=cFjLCF?@VmL8v%kQXvZ{ z$)B=e$vTJQk_`WXY4eYWJEG8rEC)*4@47bTD7*Xhi`KDasrw9-4-d-U4GxM`4gZ=P zq`1%AJL1wTmK#NJp&)6oqxZ+nHH*%TKRJe4rLeo`c+InzINo!aU~fZ-e5;vmhYhuI zvkIh^y?0zFNIvVj+ zm99^*yBb!FpO3ge&#%4}y!X=7!P5C(XS-^CxbJEC+h>v^?{S&p;1WAUT?tKmalZSRdDAUc_VLO~w02}(3jX!5 ztg3+odWahjMiPY<5e$hNjMOmqWts1gA*;x>DQ$Wskj<2 zCv?R*L|v(y=lXNZ`?g)-8N6}Q3tVqGH!Hnby(4D4`?ScODAnAeJ3+;|P7!ia1arOD#C*t(fjsVGwhA>6C&h1r8Fptck*nHZtFI# zc>eX3dwgL>&r6AB3%f;y9XGZ-(p+S-Y-=5-@#)Ef3oc$Sx$7(5{Ip?A$&nDnMZwP| zd<~>E?%bMtHg&?-^3aW9pPD8-THMfjGH=B#rNj!;)$%WPfBpEh{1&sJtvAj3>1E#3 z=$k2@cJ!>Stl#ycQGt4LZsCVx^QQMEe0YaVe#YFl(ec4qz2}_Fnj>HLesHyZl$nsv z{7G3=9J|MXCh^WLU9~EqB;7=MSJ8EeWwlkcx_w78XrU90wb%Z>!PZSLPS|?jknetn z{JyHq7e^_6rfX6HAI)wlI&+|9+pM$do40)7h3|VI&ODd!e1Yc=yF=;g9*Wsm9YU3{ z&jvPjQDYmHSFQ76pXzPKs+i6lCG?9gBOcERi<;Q2u-q)^-o(2G){mbY*PiG1I{m{x zPtNYS;3oM*>i!nve7OvtinxjRtEeu?Z2c>D*-f^sc2zN);L6f!l&AOQaZSvUvKq^; zX*Uvh8?wi}Olx(FD6N#sw22Hab&<%dxOO99th)LaXZgyImhe((8JU#@>szy`t`V*K zH>hM*l%}+POToJqOcRrNw0KOy>G4V%W>q`47;CXp&bm2^y$SMHvh}*R+-`S|2QvoBv^)$`{+T8~dXDOL<>qq*m^CYRx*nZ-u7Hmp}JbE%Gb< z>Qz zYtQT+&6B3xa7Wok4PApDcwp*R&Q{jdnAs$kZPzLNRs3;Fab%w4gWm<7qpzR0nZGml zuDokn-S0FD`Ne)dtO=_tW@);r-`BX8ZPA4tw4=tS+l>Cc#2`(M{j>1lt6dA{bfxd_ zdSMe-7;&hzX+z7}%g-&oHmT+LRmj*L(|X+)*G@NU<88KZI5%~o(yKoM)T)(?b*Uyh zJ6ew}-jSNNdQR_tv2u@z7vjRo$4~1XlgFi;791|GdZ=C>Xc)CVFf?M!xtzxLx6G*% zZeM)%#qY(+K0RiD+}#!zzgw&HHRJu7)b{k;e)Fj0K4)oFZpP#pwv#6g8YMQJ4yxEK`!lm}-laEv8yMRd2idEUo$8X_I}Vq1N_M&@ zT1y6K%u@D@{&wFtqD0lpp*Z|RrTwjrkGuA2%c?bQ-!y)9vHL(QuaY0AUC7+LYJqxC z-m}O#lP7$e->@jHR}{&9@0t#O=r*N+t5?uPpVy1w>j7R>B9bj7oNjo`kyPf(-&_B{u) zW=&H|yeK2po36iZU(LHIUc7bXFYH`y)x~4j6XZm`D|Qp@I&7@D+ak4lGfq0 z((qf(ir1g~lToBCePAh^;$gE73hL{FPbnSE9u-LI-l#P{@TN-AnuqG^n~t}ekM2{O z%<&GJm~DIia<_$AL)y1QdyQ22qfK47k$CQfMTot9;r-?6r{Y{z&3@$M&eN%iRW7V> zPrNhxN#(>`=ZqaM@@1oDXTIHHviR)WA68M`;R*?r2QKu|ccqSEKW_6)GEni7wpjk` zMaYPp&Ym1L+oJWLwXy0O!#Ur+x8=!t{a#Hu zrCx8XeDJF02A5?)*{%EbgrCwWn7o2_NNIQJ{F<)|gLOUm=Dzo1;x-gWa~HcW>)6hF zRHJL#-+K2>{(0>QZ%~}XEM!nx-XiWcRjIYcdE2DS8#M<~7F1t;mt%Lq{!UC{;x3Dr zFVD7Y;@>?I)4X(!jF#ZW{5j{2`L-{d-?z(=Ync&9zpzRIHGQzPN(E8O@EgFR#RM(Z}4Zi2&B{kEpNjlt~=(9-bV%NS&Kh0;Idf|?{ZQv-CWl%^{X{->xav9t9uh) zHO%f<>-s*R9CPd2irMapk)!@8nDzY2lZorU)R%^d88ZwWQj{^3uIfwaoS)j&e%li^ zOD*zzsUN{(PV5R+f4eZ{Ro$M?X5**jG0pqR%(wL4R)}-EF)3Q+rL2`ldXcnxkl(Xi z@hd|3DEUl+)S|Mk2jP?UO9W3kh3hKGDOIPLw`^mEUH@{q`c&YtZ4JvEQ_$svOH*g2 zk4}2kJ1*{fA46m8>4PDmKTSSf*py|p%zBE^z3gT4FN<&C@w+8l`tB^>kaOs3@#R~$ z4G(O|TGKLn=bWiJjoQ_ho+-Ul?}-gvTE2B(DE{hQ+5&XN-E9BPY>ryz+|4C}w?CvT zyYN$KpS)hntjf!F*}WZo)wbo6E1#`0ntFSyN2S$F>3K%NSS60O^&W4r^G7w^8- zcb;Jpd*$g&C5LgYW4|c|Y0*QfRvcPc`j1XIdu++`p0Xo9OvVL0J(+M)>WkQ?n6tE` zpcyXCrQV8*BgKB_{IHYsl{Wg?cya3}&rJ7;<5eEz+;Xs6Ro%7X>Cs4@zI>~ImY=1s zw8CnOUc_a%+uVdTi-cw4@-&=H}&M@!i#I27xViOv1x_`g7xNYHowfzI}9_*WQO^!TSo%C&kEZ%lqNd;Hji@Nlv2f85XX3HiWt(;DJRN_kF1+)$ z{^dBG>3xZ9+uc|tOC;s)hrQn4R~kJfCPUxX)Ff(lx5tg3Stnx_alhrrXT`Vk5*7C< z-(Yj+Z~bDE`>-RtkXul-=m{;lNTo;DEWbeE?hTH+rt|k3Uj^Eao@{Ng)!h9Sl`cE1 zUaM#680&IGjP{;Zb_KgP&iZhsV_j{;x6C?i7xz2ryUIAHkHzkcG==UuJV z{bher#^C)Ei~-KP=luf${)7FNmnywh&HfnB^BJsF@5c6RTd!VK`trhJbAQ6G(_d+A zv0Zbwj!kR1{%vhz&#uJuV+IZ_wF&9&-~5_Wy~LsqzCEUTu)6PtiGEA};1pPXJaV~$1SuGs0DudFyb^$xFDf95pa&mEn`2iZlhO^>YI`g?=P z@9Bxv6T|fMeO~UKS^xP9lV$JNy=D2WH-`fxN~E?%u5imKHM@CpQQ<|CGRORzXMbj% z-nPB`)o1m64oNQSRSzC3_GbOq8(@7l-u0&XI<576(_QE8pdXe;dp0V(*}3_|z|v_& zUDITLt+_C8fR|SP=|KCMiXXP(lKYH46`YyY{H-?Y@sagDH!bWgEZ^-ZzwdU)nvbr} zkFNK*U~iXr@Zck<7^usbKHJ2y`{vbF?_#v{Thl~uc{^o~H8E{od$h|}>qcuEdOtC{ zO-3V)gbt5e<9q1Uj?&=!#MI>z{A9{66ulDR08F{49Fl(-nMe>zva8 z-6gRerzE|Pv6r%DE0x`q+qWTP#Yfl3Vi%+0EWIO(42v%mJ(ROk{@q@i^*n05kKNgg zB}Mn;E)VQD@4|0bxZ>l{Q@gcx7Y0Tze3$RF$U3N4;^ds$3r;BMPueuKA|zwe+@^Qs z#o%-untg^OBJlVjjn8x#)8nkxr-cIhGV!z&k=LZ}YXtEbyJ)ir|ed==N39U;1 z1#jXnDrM?6ct+B9dao|*y{~EL{Ge=_W7=7D@2S-$F{_MS1P9I+A3t& z!Bcl69X$T>^77>tCffQ2&f42sUaWo3LAKGgVuQeLW2*ITt8-w#O}>t{8ts z@v}lo?p88tT`Q08+AftpGr_Bs@9LdfFpm;<{r-fmj=~o`KO~w`+hC=+@^Q*JDJ3oH zF+c;G;tq85OiL;Gz8sH>ogvl~RB}6U`MOsA{L_hwDrL3r0`#Y#o%5vf6)s|WPD2AbQ{ii zrwyJ{wfB4c;~SvZld5G_GVnY@;#G0&#Zg*EW=%*oElBQG*vh}Ad)3sycp`Ix7Ykea zm9?Vk-lW@0)Q&B988)+7p=qtc+_=gO{FQh3_b;B7J9PR>+RlK&(8r@SL+Z+CQip7) z7U@bU1J_n8-h}Psy?9hAd2y+3u&>|ot;SCR)<%t8f0H$Mq1NEx@>yH=Fg|X)lN~i6 zk^c7ROV06(+1uv5GdMM&eoJoCy?v7ovcdWkEW)%tJhKQ~aPN9*OZ|k8SLfz#+4-1E^dGR?$})0CktW6s)UvauM=hcC^ zXXE{f*cPT$Rc^N$OQ(E(IgMrTfc6Wjffr7**S!OT3%A4G<|w4l19yn^`V}c}m_FV0`t-n~cbXR01$C`E?nV56l-fe^ z@WP-`67b^^g;Qrv8kKfYDW}X=^4fEw!`QivnX*r3Cz;MXb;YMptz%<2@5~*wyffFr z&8>sVC6cethR8Mw+jMawAk}P_C_pMbbMCeaHPzF=Xw9Au+M*99!R-s zSNpJ2N$Z5WMX8^@ZNd+y#I*raTP5-1++-i~E_<^jgV)T)_2f!ACbaMLym8MqG)I5= z9Em-ruS7q7#%eW@J$t0wbsbM^<+kot+MjZVr5i7p?=ajch37k-ymB>G-Tma@x!rlP zsXMfEDrD^xlWrlV(UAi`Ja@+jn%Q{^_>ISw#aJm$E$VDtqEY_kef%6v+x=6tw0&>N zZL^88vfY21D4T2hUeMlVv|xR;@{&!}(X%^yyxz)fd+3^4y>F?xcD(j&-pp;xz$Fp& zaksM5D>t%hW}4FDGDG|q<@#k*xb9HZ;LJT|Tz+!HwYY;`xffrwbi01Ol%LhO+F{=# zuVmkYE0S#$Z5;P+kkR#hYq7#karyK+g4Bk+Ul}pUw$Pjxa*t&-2lmk(XJu=jp|mQ_^QnOP4q z=7lbupq*~AS1RaAL)K5n%~b}9x6*tL3DS)!isYI%&3LI6Tpze7#qC7-feTLy#t+PE z33_MwG0|^k^;yQOBYPb8ZM(JIm$E%C;Iwn=!c7agt<4rcD7zk+s`kCJ)Wa_GOs$Qv zWye)(w&{f=N&78~DSz3w{DwrXTwcufGt(I9FMoSjr`Nxdvpzqc^^jusy`yE);J1O% z8)mGvmW_KbZJlRC<=Ug;qH{vMmLF+zD1JL({m#=lyr!FwQvZbhNIYMeZ*@yY|Kl6kTvJPhh|jwo z{u!U57oj6pwO?cN%EbZq!>c0Ci1*re`F`E~Oy^C_vB10}`O!01ue4?rH%r6{mP=Fx z#J}L1_D6n>F!}M+PwCZ~#V5iSGWYFxvDov?|NYop7F{=?5VxMYmVEPflZeObVrC8pDpU->F*NItseZq-dw)imup z<~7G^_;jDp9F1KKYs?oORWW|JK!znaHtW{mtu{pq&t|-pVC<9nl#sDI+QmR$Ty{%` zL)13E4R4DlpKQ!+E}5P8#fCrW#_N8koVZl^>sRB)@nl}9dA(G7esCA{{F?Zp1@?hE zT($3<6kn^vIg$J{BCh%$u)p6Pw@gz*GWyP+w(qE1tu6@q5b%Ai|F1%}QkYYMSy}(g zrSI~ucx7IDb=l-o?!}Yk)XW|o`Jldcg27|wE^>DjtUf-a(#gMG?T+N_6=p^qGY`Hl zn)55bN@2yBP+ma%ihBq9KCN7T%ClHKZsyIjUgIUS7poK~htjQjPUh>!+9xdfo!xw; zQ2m6%@lD=cb^o9-mHmtEsOYTIjJn~MpJ7}!wNb$}$8?o^E;i_%Ah)}oJNnyh%Sp{% z$#<$JGI+O5sJm(gbffx@J}(acthJAB^k+VfXZtuM-PJLD&6|2=@eBvLy|pg;y;P`pbt4Z75c}eZ70uo9K5~Dl$Yf3Hth~=+m6k@gBGTR1*mo#+|Zb%@;PU+FenSJx}+-5<|5H zmm1Wnb$sTH>ql(DL;1_Cb$9KSBgVr|0l4nJQGBPgs!Kt**4aHK;M69;AR!wAmv@8qISf;h*iJ$iA-M=$OA5T!-`Sr#uRoc^KF~>Ld8R%KXOCCF1 zdot(l+!I?~Z@Hil*caMz$EI?U53f1FuQz*d$;yeO^_%ujIa8YsvNE z-JKaTQmr}`%*r)a;VbVo3W&YdMU|B7HIwY})wuOFJj$`a%h)m@#mU3&k8!8P;Lk2I zJDsI+RymVjE^?7dxBMYJZ$LpW(tkmu@uS~bskw3rm6Rpl(*hszLQ~G9g-8iD^IT@+ zqMJ9vUO%nqQhTq|wbc6fSp3SlQ@TIvCwJcY%zw2s{rr-Pt8IN(J9U4Yv7?~heuueZ z+nE>Uj=$fPf3KBTQY0S3;7rXuw>53?-J~^_2S!;N=$eO_+>M$U!XCWPtAFB+kAGm1 z(q}DJ`1(oZ8!t|4=)dnX%FzABlNaBYo-^i!Ydrb1E!*z6(WG#V^C@}T-B)#%%nDaJ zaTn)r2vJk-Oo77f5Vc*d?es9Cx%qw8{uTEcvP!)vjQU>}HfKFQl9HFDFT4526>mzt zZ8l?b_R$6G?MIt;m!&7nT(&p6=AKIf zjaN}a;ZJG4v^lHf{@st4y(i3k>psrww&&!P3p2MI4To6d?ye0Xp;dW} z$5K4rTEK!OF-;}0;ZO6IYN+?DfyEO8>#r$*f4R6Wvd&WsUIg!5E#U=M#)#uGqP2V#PY&G%L zkjsx!N?U?YS9VC8K+8PFyioC$8v`;eEqi#j<0j`}dp7Q~Mp0*KIxjI6J9| zXKobWR9AH4eDx7;kEY3bmhbwrN>bnRw*~rW8|O_9U~CN>rP8GRpi|x4tykS9avLp0 zcTuukl?hYTaGl?nIjzCDBd!WyC6K%!`U!Cxa;rsuDhR=;%uRHY-Zz7hT!AcFds~~y6V4gvvU`j^v+X;55 z$Fla0=?VSj)V;cH_np~s-8NO)SLd~N+hj7oc+dXs>fLhQsZ)Laj;773l`=7$My<-t z>oh-Zji|c4Wv_DF9$!1fTv^!#)pPSB8V~foJC@pn&~i!>3N6{SuC?0lc4(uaGLp&m z>Yl)pDpuKe`}RS-8*yW2tbe+xd{N*B?b$0o)UBb~%zDf-In{n&}UUymMH zUv=$`YSe#yEKVs#|4Y zWo~>ils@)^eZ(*SGY{S!|6XHTI^&VU-M5Ekf2uDCkI^iOJHJf|yW{M*>03u{-1oCB@nJbt8)O{raN6c87+i*^-+tv-WB@|9mx5Cc>ltfd3xJee=zJ9$?9AE_$DS zP{#cYJ3oEzoiQnk`+7e}wN8DNDC6;CBOno{YGPROrB-CjN-g8%Oe^aN+F2?wwqgRMg`cs~+Vv`qhgvhwVwRG7;UM>eFTKOrK2e_i_1^u6Jx)Pm5_%j?!M8 z!-J3OBFYWQK3uvoq3x*wZ`2y&+<^l}y6Zoy>tc`J2I`a?T_=5Y+E{|%zW{1lm zoS*%p<3DX(SNc2C@S)$!{mL5?PwFqys(g~}aBN4%l@Hzvw|P&bG$k4wu0LtDJ38_0 zfdzdRCedCFOg2$@)3MDMsoGrFFpSss-Yjr^Wob8tvE2M<_ zw;x;FAg{A~jYB`zj@fXo{#9q~Fxxc#Q`Jl4C+2PbKo{>~0AGu-Ey=vGs&rKED6 z-RiULMbqbu(>$C|F^StP*0V1|O56XB{|jzOaUJW!uO#gSOV5rzlT_BVYO>$?{O@VW zyH6iKR@PNJpueVOuY*?C&kB!u-<#2^2Mhl2-fqQFggdT$-fn6#;s?Fa<5O$oFb-ew zu?qj^YdQYK*Sh@dy%Mr?4qcb38z5!rsY~bZ^-h@b6`I`myWddxInPx19&hCM5^w%j z&#sC|{1cB{`Rm^bXT~`kzW+NF{;M~#NXZ8KA0trFa?F&!x89AM88)2Gp%dH-~pXK@pTUW2`LZ% zz&kbmKW}CDOWsk1dp^#W;p@Dcpgx5zW$C9&=hB9E&1DirzTll7#^M*fH{(<9Na9@K zb}%--{R1@A$cY;GquoGJfs?DLR+my+e=hxKqq>#LJr%d!U@|4l{H>9vdw~9X?YAmAJEG z`3Ksk;Z`Pm$Ic{lZ4xFf%NWsxMqE{*OMpC$YVucL1`QQW#4PxWyIh5XC@_d$-la$M zq|j(4eB*9%HsOP_-J%C{6aM%f@`2pHmSH1BXKW^4;j0Xahy;`9x-PE5pbB?Om~JqG zN@{}d^YuBgn=WU5+_yrEhGMv1$Xa36HM#BCDzlZwY`7_-AQa{Ks#QdnAf)NYA29SX`HnanzE+HBqGg>%6*a4HoghHW7 zk{APxmcoQ*3dao~hfa>chGuY(OGuR~ZjJSkUe(MQ681gW*E3gkKg~DGg8q zHiR%4Ocj|)W3uR-3}#9C7<5Y-vk-wTgEI`a432O-vYdz!iweh1L>yUA9)Jakl*Ps( zQ(2fPT@IRv4pFig2{%Rz&ah<$GdLmx=ls{6`PZ`nW$%opFt~88HOg{Uj1d~)3e6HH zAK?I)MsgSlhyR|R^bfiWQXeCbh`~?Us>k>HBtCY;wm=@y8E~mWz(H#i$V);fM-9a* zz?LSfkz2yKY~d|fpa}QIND7&KBe7NHnte#CbYDJG3L9wwc%RwkWv z?o2vqHB1KSq>+vSOq?uGLioZsB7GoLMK2+BCudGhJl*N z5P}ctH^QuiW6^8_nB|l)i53(lgG)@I0*B~hjM-qK8UyVy5v_=edLSzvCXHz3a1sRb z(PuJ*<|@3yOa{qZm`svGFquNM3PH#eHckKulSvn@gFYEzGRWT)WEVA98$m;$38p8U zR_$NYGD$TsnMlzZTmXR>BlZ>y!VCE#F*#5a4yYr=60;!p>17Q2jHLlI5PHLz)q1 z{B?MsFCu&zmaEqW*hr263^C)tRhb77*MAKWMp2W5ddaXOF-RT-M8g_}voD9d2~>-@GGX*2(NP$n77jpzX``J6dn zh{R0D#ujeGB3Hr?A;e)?Aq>O z1n*(;yLK39{(E+ku`tO{39%jE&I&>5uNs1xqDYfz#TJ4TYIG*Ath`VUdwwSs=tDC>6>flL51rt|)!ea(e|tH(5BCCwbj}@m-F1duQj{~kvIhY;Q$d#bLt|t|j$!ey7np$U3kA>e6D5)m5~No+#UT4%67g3t_^swTudqC2R|q797}dH83xBj7~VQbcB%qND`lX0HY^Q z#1A^Xo%SD{)oW&$D?8Ffn zB1<-4G1P)q`op?>VqKtCqcuh@!W8M7q(aC#Km;)(^bpKqkld8TBvUo0IdJGs6Kw_ZqE%?NZ6W{WL$D13hr}s?La#zGH=M&p zhGEzO7*2pqeHg)3SZE*&$kCKJpzpNszbhI<05`G?0ky7*0B%ICIBqU9QbVEZ!nuHO zqPb<~fgB@HIJ$`t-xGZbrFe2Onv>}DAj2^mj5WXvh z!O*a|pvc}>xGjXTWJiqT(g<9nz%>wRt(I7AsV#sV1f~DX2lNpF+sFYV_zJg(vpB+x z4B<*9jXYbD;OMeMX$=;aj73gto(bk^UPlSP8(U*^Q(qJk(mO0IBPv}Qgib_OU`7+JBbz{KZ++giE+vxH2! zQ28Kp$ST-w%R)?E1dVc5BQFooEf3&O#8?6dOk`n7=~yrsNXm~k6@oNrF(UTD5)mnu zh)A(WA{By47mx%BbuR#3Vs%v-XIb%SyL5$1qpu4vRlwRY3qcluHc5?wbPPJ8*bM1l&VmtLjQV%qk#ausmX}f=eP;i&;Xhj!bEw zwTaM~rVkRsn=Lu^-|P?@@<{}%Vv1s>yfv^#I3{`0g~u<41N*g_94Gs)aYC3&UIsUk zloc`x5Rkx?bpCL++7DKPE7(VVUw*}iB=P$wS65XsVS6CXbU7K`U_obq?a)? zmMa{~pOr3+vzbV51>g^ad&DZ>cjDK92J-*GBs3Yrvjww7l!`5)RA^Tc*pB>KSo~WO z=8D3Ik{b^*24}aJhZ&&pYYDsKVQQ*W*a{iNvPJBO4U4t$K-r7e!KmrU;AF27r6b8$ z7Eto!6wH>8s~{b-r?4T=A_U_%t(QSLsenLa9dUVZ->p+%ON6XyB=(c0!y^3xn?*;r zQ?Ti9$+c3!TyLg8R7o%#0!j!vDpc!7A`MoP1`|WRh|seYq`^SDkQo|cx@?y4_=Rd^ z3C|S;rvuaFkORz9;G(Og6E6$MhNKh_ZFSm^Xn#isvsolVWwWdhEfupDYRG`D%Vvo# z7E7cl(g}`WuJF>P(1OBd)5s+tB?dzB^@_;djAsvr6>Rd|(8z$X76s zFCi(pDAxf*V2Eglv?+QHCPdC7A_$`Mg!P2|M{1dEC0Lk=eZ_GOSY#G9PGe|E@|6|j ziAfO|T&94Z1!jm?V=x6p@>J;}qC@A>`Tp-!c<^F==mF^y>Hqh4-9iEB|9)=`Z-B{h zqW947qKe$G=#}z_7g*#v3>v8bhA=inL7T7(dgRs_A~wZfi+XZIJvnrw2uUC_*xAq% z(V9a$7rjLLn+fNjg`2T-9`QawC^eHVO1{v^kxY`8g$%v!W(##jy!eJZvFOCe00%N? zJ_#uUa3 z-5w@#--_w{zY|mtF#jvXG$Mdzpsic6$>YcsSt6ydL`q@NtJO@HU8ddN#2SO{J zl?hl5DVXu%_{bIa{Vc|01c^Jbhl;=jQpQRc zpxEQsZbkCF!3c+noQ{aAA=49>63*cY>`!1?7*OFHSurDI(uBziwx7gKVVXk4gh*LV zj}KfNI}fy`%O*Vxthqq|w8r-UB@q>rVkT(PFH8ZIjl~5hx*RhRQ(19R^zJ;d3zb zs}j1~f5tzei?=XSfnOWG7ek5F@I1R5)5K6f4Q4FRT_&!DA@@7by1x^*$5G^67?pe# zi$dG(!KAX+ur4(H0hDyj@EgdW7CI{2z}i8YI?PD$ii-0wbgmv|dU*@miJ`2=&;ca7 zfT3egV5T)S*gbT=0ZQ?Aur;>LocI*g8^&(AR@Tuv_bWr2}MEhK~W+ML;hc&C!CophC08%qnE+>1DwW2 z+d^FUqO2Z}Qt<^=fT8{0ARwzKq)Zbiyu!3GI7G}sLXEstLs@wHiLorG2+fbE zKs-Z25m6z!3GW$H=s?wnUfD!La++;L3E0=L^P!LAu1p=`KAUc;OW?;KO!n@UCvO7JQ|>m#~FI%63ujlM?!ppegJoz zp};?y3*n1JmB6(I@`6=H%REwEu75(wbQ9F8;8 zgir)E4)i0_?nH&?H*^YISd|P8;R$E}{yTXh&AGWlW#}N>L2S@Jz=%EkgZz7kj9Bd_ zTqB=P*fbnbe!(?@+bu6>Y=awv!^;q-MqE{RMRMeE6BIsxGf`Iu=A;e>CPbuY8Wpxf zzV8rD{Q1|=#2i6 zkY9rk6&h4T#xy>fOY|EOfw-_F`xIWKmAbgd(Magwe;rL3+A;w*A{@;l4DFi;=b|$x zehfo%4WJXi zC8D2`pfpZgA{4zggSo*MgZ1FhsY${Y!?eH4(!xKg?v&Yjh^uh~@I*vF7%lkl)ba3Xr(Dko_ zL(}}>(JNORO!W&C|9U!GIG#1!Xa)B!DUhV9g3FV z+%!B2L$x6w07$7I@Cw8;F=Q7Gb0#QDT*gpCIEc_P6OTvt=E6*yb;0!+`-;m8GH2nZ zF~nGmE1@;h#Ff#EU_2b1-iS-1GsfcM3AnjW;lgWU|2kX?-JOF+z$cJsNhdRFOc6*d zSzcg050}SaE+Jf~;qa;Hkb{;&ZVGUI3F9QhkR#!*9cPM5p@b-09qG1W66nA<2@Q0u z1@cN2^0=G;T)K_~Z|JKfaO514!-E+D5Rmj2%3#GLiH9rkoyOp!6CCy@Cckdhm69A3P>}QpCNoahfK#1 zPhh&CPmYCHNG53D2>=|24BLnbARd{rAu6yRGLVA`lK~({e%VXZU`J$ZM^s=FR`Y;b80DYK;5r9snjfe?gx?vi|0ZE5x7=iA?G>ky^VHyS^bFA1y zL=ME{4D&Do_lJ2H!CHoS7!<(3MC`(e1(hKV1nvRsOZ3E@crxTT+?}8zq+x{P7|Q-| zg_J8^V6_-uG9De<4K}uUEZ9fgMtrXd`4Gs^-`-XzWfN`ycE=T**o2?K(Azx#7)e`j zCEVb@10pWT)J9A|LwZgy;KerF7ekHv0erwC$P2!dh{<6nDj)pDt7jA$9Jv)hF|=H4 z7LL#%Km>qfc{KH^SR8tF1kf|Dm2wV8^~cC3>yY6|m!t|Uk3t%beCokB0MO*_%Ev4`X>LxgPQ4Yler*Q{}cOHrv3-;U;|B0i7D=;8I zfGY_eR*Q#X==61{ACM9If?RJv$?pS25q&xj1nN>HfNRZNaeowW6DGPNCl-bysasHl z(MvEysltr~9ZF)4F?6^Jl+vyuCW)iU+t9(MTa1gLMR%cC*dwM)fgqKjV}x6mL%+X^ zMWDm?;aTl7aUTq2K7eIGMRG{yr&u_m)DqQZ@omVb4i5c!2mqz$1hI$cAyK`&NL&lO zx=N8l<9~}SK-5RX62HZIG2~WH%-AoMj1zC6mo!q0F0K*32S^MbhFL0!JL2$FFGR}5 z=)rxUj5#eJ{J95sAdu2lD4Nyc6EURy8nzr!ewz#Os9Ajos;ZVRC%0s~j6u85Y02H{xkpL99WF!D)4FxW3C>Q}4=8`EccmgoY9cKB! zLb<%5ubQHP406dYh@c^2>8k!=CP1T$a6;T+9t)m_`&m+vas>LJQm~`=CLf;#4wL#!Q8_<7F+^%n8yN&a))^=o0x4x zNX8ZMSRQ~fh&oJU0Y$k(L^c}S0C$+j0`kMxnT+=ujDQ&@LeMu!D9b zD#KCXFcc#H6merR$D{fgZ0T=~$FL1Hn{XRe{ z=S4RzG*=-D4@a>*@Bpm$FYBI;Qocf)Fz*xn4N5}RZPg3L;y|Q**8ISY1-@Y&GtK<$-cL;ONXRFuHbAFnEG@6Mt=}7-vLefjZGx zaf%5#`4zu{W=TMF2z2%ohUz6LMuNG$xH^XZ83VHlvqUpwD6)hND+?JO8kB`91a@pR zC`U07`1cXnsTc){3|c#dB89#rQq<9_mzbkK^Ea-5;gA@IC{K-m5Fu@I949dW?avff zKz;;STc`kJ4JaD?xynp&4Mc4PvQ~Ij?4%(4oY)u)IqHdfq83le7=g?n9z)>`(;~S2 z!>kCd>o6&T8#T;{;LwLD5nT3RMnr(YFe4)Df0z&v_CHLBfV**r2@%*nmqQ(L-eB(B zVMavY#4sZwaAKGd0bSz`Ga>>sh8YpqF?Wa&MT1FlhY1mZCc}gXOp-fHh`=N*xWkNy zAO^#Xh~NSwBl?%e7iJp;x(yWYz>`(supGrH<1qAC6%IT_g5r;(b!u?Ropf*_l4Br+ zNrWAOLt`ixaa5%NoswlJ$r#erq8RTql~6=ha+GScQ3ob6k*9zY{HaUa90mC145{ct zQCW$?qM#E7FlT})B@*2?q{#5c$BidfkW!;8Lz9eP^ieg6CXNo9KtBlBgTR^@Z4rLJ$S8 zT>%jk6s4-~w)cHkBnkp5N>Jfzi3LQ_Si!Cct{uD42-mK$5lgJmRYL&9Sg|K|4XCk; z27CW~&YhjRJNLjp?40+`%$-}#ea>^vJr@{qSw}D{WBQEYddn??GYtve2N{;$F14?> z3_i@5Wn+1FG&1-H^LRTRIeZlJ7<;L+`EKiAy3kQmwh2a=`*)?-6WaunGiJ^IqZn&! z4>MwPFxvdI8#TUpbg-xS-JZN;(6+&s=DNN3HF`|2%2f8@m&Ff3kqTz09T)##xS+O{EJ)CJWY4{C%feU`JMV4`0fd+m7N- zpR5zEl{MQQ&CeKczj6$v1Tfc8H<0u&pg;q4zkf1iW7NIRslgBnkj)FHQH!gi=q$70 znf!S|E?Si_v*z-sO82PEEIfxl^N1N{`g#2Mu%ppp5(Oh@ml=l}>eygSBz3yEQZCk} z9v6HURUO;|WL6y9V}w^6++&1S9Nd!;-hg{_lY@IQjvd^SVeH_Z3}XlPWEeZzvRtLx z9o%EdtT?zQgj}TBirSvgXc9`P24i2BoYS zKM#FB!bIz3F*F3=)qXuVWU(7KpWeCfyx?rvp84FS!3Jjb;o(Tr>vFp9>feTaYge5g zoR%?zuH#8vj|wpumtM!KxBO#}&zP1Qkj}g|T0bzi-oSGXKP&8NzMF-4HvT3qSsuEY zb?0D{y>T;-14Q*Ozn&FtY-TUu5fkPI<3T*P@QB4G*fT?zb227|)Mi{BY=|TuQ|1-^ z#F&^|`{{~c`>^VuE%UYFpe>rT;-IYznHbulHDr`H>Pbe4qnDoxKi>ZuvaRKU3)%+% z#q|sMJC2JtGUm;H1VhclHtwHw8%yD=MLa&bJy@1C>n-M;Z;N%j#+@wQ_j6gh^3GtL zjM-yJuy&0_@&q7msopDM5O>LLYEJ2syT>eF!H&jl`sBc~2V_Gt<=$W&bC*C~i*b`8 z1I-MzZBrk?RRi?o!b2SgSE0%has_%Dh@+pBUK!RgoCO$42i*1aTv0l4sjR~ z#8`0{62w?>5K@*12O(t&#t@PLGOiQ77_(}2qP@8!u)c?5%^{D_Am2Y2ylCbur7du1 z-3fC0C%|mk!k}BmT=*D&#~t3;^jH)eWL7-R<@Jk#=IVT)*SF>n( zwx>B_k7%8ka$bHGzm`ac&+L*v-pU%ZI= zYLaeAlp!7NKoec;FcY2HfK2E}2boyrD-JT{xy3;yOqhy;Ou(#)Lrkpsl}a^nhl<{C zkV*80gG?Z>ii1obFxnzvBY|LCC3GZf3s(tVz#!qu0*2;Uj7(lBp-WqBwZ*vFUxVNf z_^SWXQ3*K+%pCLqJ^S`+LD#H#^8*D*;#W( z22KzHa(ZTd7~<^xGT0z6lXKxEhH8S{1vtQjWDFXqIx!$HDN)|fe+ zLTXs&Cwpayk}~v*wX?_z6KdGGo5# z$qiRL8vT$pd#@KZP!gdMi~4X4O8TGqxgUWpmY{sHQ#eZk$QM5y?F|RPV}MNiWz9|f z`KA~$?LB}eLQlS&F&l4$6twi4tm(TkKR4(V!Zs|Hp8%%{U$_ZRfT>(3FlP@AE!?p@ zml3=tiGp74UegYQ;WzEIEr3x6vrQ2oH3Lj>(FrYV+>V=%BUD5~icf$z%D3 zXM`<%Y1>p*eqNn`T?7TtHhwdXyGd1=TK){VboMD#fPcLWumE2Z(Jo6LBDa8)C2{` zRZj)ovR$3-T_$^yhCA@;mq-g*1sDl@7oU*Wv4nBZI`l>sGll~iVwe3OHWP~Ti7m4W-_ zDya+xI#)?$u+X_mS_TuHtE4hx%InKzQX5RKd}|CHEhK#A;ILRX;H!tC!S1;zBB`3@FyI?Uhr??l zO#}f9jnJRh4kCe96yIL z?;ak4844%!6NBy4j2T|#-LMK6Z2O+dqoZR&*3Ma{^Ap>xm8gR=_zG;dzJVEYR#*|U zZJPOy@O=_QVV0PnbM2CoLQJ%c=Y|biZa=f}*<4;bC%l9u+w$vOI-)M-;FH5g&HCr^ z_}!}F#(V2Lo;2r8Rvp%wF17imhVN(0A(yiL@(o?gJ*S7W%o_8k?&LGV|7A>WK3|9V zc(kN3BZi`%7>b*i%`Zp1)7Czt2b!r@QHJoDF11PL zhUdYbT-DI^1fE#tfrBW_Ya9b7Y@YWe&Jn zRpy|pRb>vmT2La;giZGj# zEBnx7Zix<}N$YVFgsk$3AR-Y>3_%7_xkyLD40dOjut z?F_A69TsA*RnKd~VWxFn__7&r9iwLR`Qg2I0shR`Y`H8Pm@$2CV8j5WJDUS8505av zzmY;eTpm77Ebz_z<)bUZ?Kg772r;KFc7?UcWSL?6yr#FMOVs&Z?% zKRd6@=aZsQ=7GhOSo5|Jcr|rNSda6C$Q~roki_}+3i8ED4NGn?ASdY*R?NIZ57K!K zJV?Vj?0~AxJLn)dChwqw;F!E~_zI56JLDixg)^P&y(&;8Z;?X`GFZFw4mt={$vfyE zSS9bEgP@bVgAM{t@(w!4Jk2{QP{2vvAqRmYd50XB2VB|8bO&UJwU&>egB>}aEpfVi z-Xj3c#5U`iG2@rgKiFoSiOE<>BgeMc^N&(0vCXO()A1O6#eh1A=!LKm(lNsfe~Ld~ zs?9bJJk2eMK{mzw`YaE_AUhsI=s9k|C^^^6c!6ISWc!&%Ug8%9*}u(iUZx-h*~rZN zS5es5W7D!`((4GZ$M8wr{3buG5oS8QO@ZED259uw6`=%#OgB%ygDf_=J*e3qOe!IW228>mJ2(A4BZ9j5(@%G^BRR&=59uWen!IYiPhUB_*W#aVx^mBV zUjKQ;$@~0#Q>O*zthe;URZFjZ{F8^?{C>ysPTT$Z)Fm^XUT*SNegE{_5ex5mZ|0RB z{O6ZGb)HlU{z| zs%OspY0AXXkweam`mKCv-!-F751shflE41v+8^Kg;O&oY`2IgD#=LU&M&_&rH8}stC3_Su+h_CvJFGnDvT0|oI`@p}JAb_MJB3vbygB>2 z)8F0voque#`H9uNdT#jgcYk^3pO4Mk;PmRkzn^%;E@ytd#<^>K`ljhtiq@5#MVncd z&HnwOwb&uhI)6RZmO^WX1S*ZIJ-Y!`e87-0qh8083L^|RJTW|b{y7Yr1uq7tni)F< z1I(O1hQrN+GzvrCmT(8S`-#|E01pki|8orPxCvBW}?kXHVdKqWD`^UgrC%a}9J z>@wyIG`oyB1I;dD&Oo!vSlvLw1hp%dv(N;6=ADHm=rivOG(n$vXP^oC%sT^3&}ZHm zXktg_oq;A;H17;F!J_%ZKqFdJ8s1rGREw(wxCt`NI|EISY2F!Vf=u(yKoew|cLtgu z)4Vg#1exZYfhJaU-Wh0B3sjwjW`U}+&@4`M2AY`FdB^Qroa)GZF{|^A-50Am@1VX| z)p>{Y#j4Ibtl!STid-hBMa=5F1N#=zI4w}F{|?q>|40&z`j`3dB<0aRh@TO zU+n0-!}=W^Rk=*?wV2L%2lg#6c3@wu0Rpv4;yW*teKzR$Ej@+y8BkhKlLd*&I70nr`0hV6qcP)x~rh z8r^3u+me-X<pC*)|7B&Kn;b*lRvCrYSvHWCr!w6W!aS=9nNA!}}e>)zyb|pGLW8UAM zpAT;-cl8)g(Jx0t=dh7Ne%?4T`ZF5js z$`UgxVW8%|G10^350hlIy$|4j&DiKe^O;-g_mcnvPan)Jdrqb?Nf;-7)P3Se zmR)v>dLycHody18U3Tc^?uMAN@ov9BS98i)QE%A-*x7vk6IO`z>P(#*ty!D8M|5;l zCDnI=<{8m!TdrThx^b1*Z-n1-l?*UZSOsUlp^dpp#uxgRt7Nc?iYhqTQ&d#J(Vn8B z3Jt>r&B-5=%7{`bIMYRxQo-3SqLd2Gcp<``t7NpJ0J%ykgT~`3sf;M4f-_!3Clv~A zBLi{vTqahOD5ZikUQmFTM@h?wQYtv(MU+y(884!g3eI>DIZJCXEUC6ysyo~xu~#LOwg3#v@nB)$`w^DQ53E;|&YICW}79H+#3)bi7! zyOX_YcJm3trKefYExWbZ<$$QqdT!+v#(+oJ2DBPs$HNni@Y)ef^hVU^Co`g9vPka{M^4LtX&@gNXbt2e)5Rel0Z;{pd;~xh9P$zTRItd$+WG>S3JvHZQ@H_s zWC%HKS|C%wAs>NE1&4eDG8G*15y(_<$j7Rj2J(@a93vk=b5?ga=wlUvgFaRTB+y5; z>2hN-mFz5c$j8odhkQoKymrXPPO}*Kq^DWC+2Pt~P(2>?yz3c$kj8V_Wqt!4di!2L z-)R>|7|YMxz+h;ijkmrD=BV$y=v#Kd-^MT?YG?hd?0}GsW>CK4&4YI^#E8aOMl8bJ z{EW%no`2(KOzz%yA8&))?H8D_HJa^*C zn;2!h*fL0kj*5XbJ#4|&3!<><@SF6KgKxIa9C{P%T5#x1&}zY( z6Szn!o4SS*xL9!L&FbPt;JpCELIb|Z7yb9_h@m_EBBCm?6lo|ixhLdw4As8?Gn^&>D=6eW$*P;}a zvOuo!UVm;je1ltKDy8-Y20Y<@yPBDAB8+L1gWuw3Oq=}XZ5~ae-@h^@yBujun>?_B zpRvRG5AX0Zc37YB9xt%|R5sR3Gq=9aUkLHrxemn|4(lgA;!`YHa@)t;Vkwd#pYkiA zNDei}eijY8Z#GVcEV&WwekgpnWxL$t3bv(gj2natq>htIX^LmgQTSOccM3Yfz-NAzk_Y!S;FZ%^_d_Lsh){R{>Ch+=VOu? zgkG&5D6&=nK6RYTOp13ND4(ExAD8@K%JoOfDL(%!S#l$K)oF^t$(cwHX zv5F4ov5$r;+f7!}%!qPz+vuEJt{DmKye306-am8cTKptO3Mk=?mfTQsr1ZuN>XfsX z=os^o{9;npG114Jd5*M~^XN>b42RS^OM+9`E>mN>OiQlnkg$wn2ZUwBIrqN|IER9z zryK~jU6Wv7VSz}KUY`j9TZ)cVk_lXNw2}}#*iI)Ei6K+yp#!Td!>EeZT6 z#`ww(z9Wa{dWxOe&k#F`JC)p3r=rm(56G>J=c&Z5EDK1@M!6qIgLkAvc99xm^Ed=Z z0!Rqh9zJHni~ zYXy1zX5JZIBY)^)<3>&YOz>&#tbFdeY}Elps|X!X6ckrKUao4tnCIE7f2o^^w3G?ZEMxh}3-(LNisZ%d zUcy|lNqJJ`%H)@4^-9Uwdh=edS;_4s!K{z9roY|#e1wxe(K3q)BELizY_>aBeQ{e zp56QCJ+C4voqxc)x*{Ng%|^zh3z7oP>uJhaCfX}!OZUZ)F^l}o*Z1X}85v{&j&|NCFvpG_{ z$JmYUX&F2I{GKJtr25Vh0hzqRDyv2>veVAfwFG?T#RuZO#3twUWHxK1C$srhd|6Xv z;zf-(QX9MK6-=giW0sdt^S;VKrZiazSEFC)5L4c5Lf7kq^;1veQD`=Ag`m)u$*lwBh%IWb@0;M#yjO~9ybzA+V z9a%|DELKyY+S4yV8~7839Kr(6)8+VJEvwo+Ctg9jX*Dea2&tCA{ME9OP-EV`MWvuQ zzf0oK(_n!mTMTONW(CWLUAB?GUOBs0DlOwIL)9`R>ql|rZ2ObXSZpFElpiIKhL+jQ zxT$hwmN-@E@@ksDYy);v_m)bPs#qXO{l?te zw1SsNf2_WwEiXiN`Xy~Pyx5c3)7w0mr7}Djc(VC<(*7kfZK;t7LRa&h+_6eVLP|B? z$%d(988Q5Vq1uo*`s1o zl`gZ{!EY^W2-PyE01rSh|2VTneKC(y3aQMJ>NjDT_#rJTi`yn$K@4qw9ARCdg1dVK ziKj82jm>S+8|Sn7qca}8;I9jw<`W|{a&=0s*62G-m4$rSCwni?ZR$#8Rr{w zw_CL#78J6?XfoH0%dNAO?gOT`KUK&opUlUmrxwi@Ji*3pr7Me_q&^BdOnm?cMElwR zu%kPc;iJlxYW{K<%N^|7&+G^lq7?`!TKsyFTU%L|j2->{ibn1n_aIDadO)#%JFa`vJZ(dJH&x!= z!I=jPiE7Aq-BIB_|4iD@2m03X$Zk+Pmo??ou#{Z*g4bW4SW`$Li#!F;Y?2_xDsUi-PP^KfN zN2s;Hyl^IK9aMsK{--;f1VHMuNHn8rLH-`qbYzY3?**PHq|9j&d}%yI8zYj8Ci;Ok zt4*qcoHwBsWPD$0Do{?sGrW84;a0J%8ap3p1sl7aE{Iv<_YWL_n!k|pY7OKF3uhQ6 zb|Et5C>hQf7D}gb%7yAJ4zXx84^N`Ulxf5&ss<~^Tqs;DC{Hy8jIiIUAY0vN#0AIW zvU6ilbFf9(>^B+9Mm>UcNxiCI4`)a>G2R+~PH{?tS~xkcK{qigSskJ@R%{MzQ1%5* zm^8ql3Q&Q%%~;BO%mde>1|$eNf%Nr(%P1yAyqe6M>Y!jNypzJqC?Ex_kTt_rX*IU+ zYaWKVUSd~-{kxk+H=K9K>g!sy?>?qh>EzQppEvD%KvfS%0A$UNyg7V?xV6vf9%`ZVFpCF>9 z4{1Yx`dW;b06i8svqya$hnlFFgO>1D9+K^+)>WxNI|Ia(OSBl8S1S&Ng3@A~EwCDy zTI3@P7QqHa- zO$9YkhaIgPL9Eky+M)WC4yaQ_smkD%Y_#BRHl71YrA>bcOR3+-9j!JqXzJ?#5=wEI z0axUDL?qcLl+E3Hiec(kjkNx1nL(zO8TdJ6M|Pl6Rn78xt)*-0F$_(HDMB?DV3<`0 zk%?U~9k^!H2qH7PVmc)1B{f&2o5{_tR1t}on>r)z3zDuYluqt-1y?Ai7DWjr^5-h) z)Y}xp56`Y9I%(V${z0b5B1XM3oJjPp&>uGSn05$*Ykzs!+1UO`frBHhQh zw^S>LuR^r~bHbOg^d*SYEpuo^r58yquhv{Nmc&1&CpuP~8eCX$4Q)~%z?>N8Rl16Q z&?fEl9%wU%r)7-6q}B=iBtN%IdA=?6mk`dtEgFuP0`N+d-8*bxuJ^V%VOnl&oAD`K3l>s;AVNAQUX(Z|wXBd$ zR@Z_}5&qzWX00Q!<_-aY`y*R?1L|hz8(mJ56(BaHHAsh@MhUx1hu~OHZCun$2dS`i z%W(d0&TTGkhfQ92no(romH}@N%LXNjaw?K zRfvq+{)*E|N^Z5B;#blggM(Xj4Af+5Ow0N~Aed5=WTjSw1FmdEo{D!x^)yzaYH+MZ zRgP6xITpxfo$h|AASAMSV4F5u$YZTSdr5Syloz>{6Xn&wZzQzV%0>d#eH8$)nbOcw zLBefSQ)8j4AF4bxH`}x5cuZp*2l6Yk1-nXXKJc@8F-H`b0S7U*^&AAts$PK4 z)iQf*S-MJepc=;bDF*iQd4(6RAu{6rat((DY*7P%0_g1fe~JJzWr#uet<1rz!&;^eY3u;xF=eHXCs~ z1L}Yfp*;pH^XdxaCFrt zI}T6L$p+g}l zrHrRv1;!#%ycz?UJwkp3g&b0{VygLtQ^b9X!R;5Mwba+)y42B z8+FVo!b$y?fO6G~*&3`~3~ct-Nr*WY-QWf_+D#4MB3nl5Ez?lwU~Z*)*d*%P^b)G# z0~loXAl!5-lx@}|Pi9X^Z<3+Vi)DLaUz1Q|_IRSS3>Rke)ZvdP9OW!WmJF`O)Q0^_ zn`Ck?2-hc@5IT30YeIrA)Tm|;gHnlb7)m9UTJ?vNVDJ+4Tuu}^Jb;?V64U38U|3)B zojf!H)u}9QRIMU*$q`5Fwl}(E@1nnk5_{zv8l;p{VdTi_!L`3>Qk`bSpDZ{elucDw zhZQiy!SjBdaHsgQtAqnDX(`uG1XcON0H+t2Rdi`nog_Y56~t~+9}cnX&q8)4D%}C5 z^)VUYJ54czb^i=uw{{)Pyz*69a=3;eM_yZD4QdmI$Woo}mRRr&)CpQCT)gGWlMDW}XrMuJbx z!+c@7G``q!$Se*83-@IFJEbLI2!8VuU7#w1(@{T=miD^|)>dgy%+_WL+|ECcmEs7H zDHahKJ?iNIXkgzUBw->w#zmgHrse}Zx`HBXs%qO&2<>K94sTPE4R;_>w#qVN{ z6pxh@-`{9{4lq)2tkkQ5*blReyu_33Y>y< zoBLB{1|)<%ltX^IkHhrv2@uMas(#E2LOm71OUe-8&|lwQkJGlOT9DIxm7T{H(>g3@ z!jd3<)yH@|)B?lzsy^n#Sf7ny2eM7Jlx~G~9r(xMtTw+RBW%PQtwL;<%{9l%GOmU^ zY>S$I;88XIh&5399`%q$xbz`xhx&3N)nZs6%R{oZ3cKqM6wGp^$MOG^%VyRIVrl9c z=-3x>dn)n?nIf+Vwug)Kn~MEyT2?2>o97%npE8d)uTB|>aDP5!#YQD&Tx*+7Br}BuvvnfT=x903OC?8z`uDk|9%835jzN zku>oyIslmG>wep+zEWYogCB*@4hZGd2QU$=;dKe{L3I-hNxA9|5YVn0AoZmcL=BbY zKaf;DTBclf!m9bW9ht*<4IMzw`Iwr5?fxnzl$;OXkd^$H1t5ZAIgml#ralB6An73d zX$MsEi3iFl{|8wM6jno)N_rpz6q&MApbW`R^oy9$Ckv@ z*9lNlVN=Lpp6cbC4nT{lX$RHe`|+^W)CM7V7B+49FNQ5smC-xAiJv77mMH6A0P1BemDhsi_i03T&7Xgy)105 zf_2^n#Y&PK|7OsOx*1owdI?ddNq;6&me_GMj_^$=y-;P@P+$Yb!J8&iYAq-(U&d;zbOjKniMguhIm13l z#~CqaffY(+vOUhHv&7|~`WR1+(jS=fYGAfi@h13Rhf$^UJj;+;#en@vV=`lXpDOGC zoAA7`1*c>!RB3;!L6!+=oC6saE9;sxs}Qq*nu^on-8Ob4lEv-%V^*QF?*pO0^bbk!l$NAL3cZ z_cv-yjt=z_R!XNV;*cD0O4(-@kg+Al>th0Kl*tCmpK>-y`xEA?A(w0~QYe#aQtFQ`QV>W zT91e*WgX)YOwD(h?ob471$6k2ZH+#gh%Qqx+Q{1cuY+Y(yNQrdGTrZx>k6n;5h^p9 zFb*hV|7P~cdDD(^DzPInI7|OtTHos?Ftr#kcKvZGSb(x zhF9wn1>yn}m4i%ijL6!Bu(0i)tbhnrAQfB;ZfO6-u&RE4ith0g689?J09o^{ z{22cMd+Z@Ed}w1Vpz~A{!Wa3|3F=DsJMmjSt{`JN^V9#3DlSu1YurYDe~J^u4VoAS z2%OZF0i~oHEQC++W=A9_;_E_gGa)h5#!@#)@|z#;jli3y9zp~|HyWBZ?i z1atZY@#Fce05a1R6z9KxZ%L_TfX#!Z(O=8iMWrH?ktKkkskH!m>cvFf`?HCG z?sLHegVe+J`Tj=p%N{tth8k8AiLMe|LIbJL8)WEe?|G=llunWMhi6qe$0V@Ox9Qp1 zp~nIv$#?iMvLJo@7i07)S*g|LiBC;CSSded9cP;2caZs6NyK14h4?Rqy4A8I47P#) zxVg=b4nU?N&-f0NEex3o_CQwgfeI`f&a>tU(*AUa;&YLqN1F@Ua)iVy8K#pj(_wWq zs*3uz>8kypT!d;vEm2cxXRVAGb}IOxEXb7Ko}MEgfnPx)PwOAz@Sk+C@Al*sTHTVz z%a1aFpVV599AG|ZCA7ug6<6g;#E|oAh>fM1U-lLI<#ehK#-&Q2h>XGD-z!Mg!+!+9 zVrqH?A)x%A5b&dc6qyxd!4Z1GDe+bo1G-i_`mx)1!D)B2w0J*Q{2^v-K;@bx%Z-ZHK*l`wTC0k4N?|w@oLYK` zU{V9AjXL`?g0;@KqEVPw65flkc{TpS;jN}3jFuml2hvlqed0dwZAIJ%D%$|EW-_vl z|1hw0QxhBGHy67de8K`XueK*3WA}yk#e_O3!=zo#neaz2Ot5c8W9O)?VPgBJ=7((Z zNe7HV4c8!`Yz1ZgPv)X{QT#YMb_^?@Fegf&k^HX%i~7@(Xh#KPp*x#_ti0dmX;(-V zgrxKWITF;|mhee`aIw`@L9^9FA+cQXe!uxy!<14%%_}6!knzcC*+YWsh*`(VS${TU#H!XrGwI?{Sm5wF9}XoQxT%d z-0-(IH04b$(1u36=vRVQ*;9vZkskV}_8$ruh-28jlUFhq6w&p4>0T5OnA5Hj= zZL>ak$i&h1I~JCzGy#wb-D12e!U7*f8V%9@I3<-2fcS1jrz69J@xGW3_WeebQ!yaq zFj!4x(7`_cCz*{D3MS4^jbQfpDZ+x|Ak?(O?X2_yq*Ox3H1Ho3uTsH8DC;j4V$W{{ zNK1bjV}Sb<4L}?BS?b;@E;dQ%nG%Yud6BT8sz4XzoPt(zyAhIUj7-J;AXAD9=N_Qd z!+!`#$>diCY^Ey6-1ZhHLf6uBo2e~6Yk!Tfe(a>RI@J|}pmYwE{rH+(Ulz@lEq0wT wm;gnLprGi#W@dNge1G?S&*$D_$Li|ts;8c=S?}F<+pzkaVcuUGXMr=H z&9GxItl&R3N={=EX8T4gj54$Kbzw4?Tn5jXLk+30#tf~5d@h&g?rxU6a6wc=yi&@} zkD(zOhnXj7pFOo z%c=SG=x@)5Pk;Y>``h>PNAr>wHNT$K3;!&fD1Py$`_iF}<8mv-2_uX6hPCHwqu=fA$kJ)BeSD}A1GYLv%`+m1|hqx_}bCbj(8&yVjZ8nO4~?;%P> zF$}vg4`YmW#0FL#$?|Qc{y4DX%yQG_uPfrN|0s8OQGal`srYR`%#Do=TTF`_JiI5a zl$-pgqo}dm(si;?W~B@@> zQNPCRigPdcU_R|gbm@hkmAK)AW~Frrwue1JY#A#<(h}+iT-%}K#?^hW$3Zvc>Er=t zO9m_q!P*Y4?yWe0HxwvUGsn;^nkRdn7(*|(^G+#nvaLq%A-lf&AGQI6 zuAQ9h*Bb2qDmePUqdReTpOo(LYx{m@KuLUH;{)2kBiZiFjkK(XKDxe91xkUHC97r^ zD80MG)y<2Wm^L@S0M=hO&$jSRrLIA}ZT`-+f4I}w@3_;9K32i zT9_b`XH;xAEQ+%{d{a)$Zyz+XwsHD&n~MAo_lvjY8rBY5w7xwzc*-&NR=u5d9?8mo z-l_|)oqb*Gx+vzrr8fy4!>6%s^=A9&Xk2&^XuxhdJrLWv*h21eVOmDgguAQH_XW~d zT`beluzDR?_C0=5Q*711UH)u~?_QaO`sRHhPC`0=-vitABR>T0F*F@odR`%OrCxDc z%==wYFZb=+GwAc2x|vSoZNr$4bMj9b znmod{(BBH}tOo6D?7aHy$ma9HTl6m;PBXH+N5b z5U=_E`7twAhK+vH9=)=(*x>#|`qIdh9sHd+xve>(-^X|*!8dogFKcpofl3*F=XN@F z-FdY8EjPHNhA}y|ymLoa>+ph8TQ{zrt>-@DMBmQ_+k>S6!j|`2msXelskl=6ci2Al zlHzO134FTW-{gmHPUY*hUK{1~O>MONuFQcS7QR8L&qtek?yqy4)q3APVYqjocH-27 zVXk!3;X7soPS*~a=DSNt(X>&wcIebqr~6!D*B_oy{593VXiN9pN|ikmGBxZoPA;s@ z-p^^cxamRq{!=;OniGYY1LktJADXr2vh$dR=a)}}D@GkX&>r!XyL8=|^>^l(7sfD* zIW-CKe~%<+jt;6#**NnPa#)l3F8_fsy>_ohVp-wZzo)xx5}WidDV6Aq9;P#-E#AYj zCUT8I-;}oFky*M+k4+issCRwa_pv4G>ipPGEcZ;AIOu4crm~(+Z{f=u!Zp_{cTY;| zJ29+a;J%_4BfY$8Cz;-we&7)|W~)v{-t}%npU&>(wgYw*3_WxDg}H55UFjH4bT=;! z*F1J7>B7|L*TM3kJL|^iCLh;gCpoSiZ2fk$?VC%}4}{h|SZNp9aofr?{*me@4@-@w zo*^ZI%3Y8C8a6vJ!qemR8D+JVETKV6`A1w{&tS)tML6wEirRo}!ewDT&2Og|#Z+y9 zg5TC~Zo}g71)r@iu}0A_t(WDCY4JS@gE(9F8eDw!kjb9Ro_)IHWM+ih^Ei2hicEv~ z_6KKchzfSq-t8EoHY1l6{B`mAxG6>tt}ZV3Vk|mUp*ke4@Z&6+u3b#k;{kEPXPrGS z{1eJPeyvii42^vp-t1>|fcJQDquZ>*WhKE+9>%7}Baf)Kkd?Q~9FFHiH1E~>aJ)D@ zJ~gDr`s(7A*TX{cHag7txYW3G_mKd5AMsJqkA@P##`z^7-pMs%J;q0FKf2J{c+=z~ zd6sU2?;9&?jDNdo_=@$1J6diwD;THV6E0L59#WN+_`<*vHGVs1d2cf}F)kvSx*cOZ?5w;ZB|nIlhkh}l)GKu*mCK*AM&|!ed3)BP$K5u`Z8ZGm{%-u6)sFAACT+B_o_p`nvaZsC zlj}`J>g-S&pQe{tSGCA|_46}d?k+p=v$W~%K{eAMd!LO~eeHT~m&q%zHm+lK#~ERw zLFZko%pc*WTNzKU$Y)hOPHS;o9DX|8QDsR(T8o-+xvmc4V$FajSGL=x zR%MZra|auAdMBhm$y8HXQj~r%v~6#qzKiu!s9F^*Zi){&tz7YHYEh#8i9?s(Ic&6~xFV?(j zjZC^%IHdXApw%W?b*E>Qm^2^PVPp-6HjVx;swrCcLV{`0$YpmvJv!CsvgYMP^SdRx ze>4v5UGFq}(U^_g<071~d}hHu8++GPXYRQR6QA68Wp#bR>>+W_)d#x_bghbvnCAX_ z&0SxWmcr}l+FK@O239?LX5brhYw7khwa+yH%QT)3j8=Pp$+p|jUheUugt&P#9xDzn zU-D^EUDnp@QRWxleR!KRt%2K|Q6J_0z4{V&@zK-v?~>}W!-CFejQI5DH{;-vhbu0; zx!RpLfj3gvlfH6is|o(>n8wV-SA#d4`I#|h=a*;CHlN_Ew9I$pUSl0ovVHe~v$<(S zvU1MA#U%%;4tKi#)=;{ZJ4|lC*7N}Gm(};U^;-g59Tz?6^S&Jyb!Fes-TO38ZC9+T zJkcALJn_ooXZr_;(ytrOn{Mhk@5Q_Wt}gdYj7q9a6$USx#T8m9E*+&ed+LoNDJSc% zOzFu_@;kLNeRx^8;Kg+J7p8NEP1?Qp{+#tq4~;KOS-tD!@ZIN=^j@tyJZ4AKxM%!j zox&Pn{QBt&d$smIIPu%8rZyj@V?^*G|V~>WpT>W`p)U`;fHEL6L;@s${3VWAqVfjw= zZEyXiW!O7Lg@iOVoIW;yk1bVoRtQ~r#mAt=E?PN~GbiY6wes6S=5fF0r%$i9?~{`& zUXYI>osTl^={{K2#Gm9pK4IET@zk@ny@u)g=bMa9%om&PKYst~0BrQy*Yq(==8=cD zqZ+z*%uAdcn)UhAoAeCNb@%0GC2wilB0N=`8JJV5Y*Y2ZXn|O+Y16fkP(gR{b;Gv8 zmm|IAb`0};TN`2>P}sLAFR5h7q^RWLLG3|Do*wF`I`Ja(TUNjT?V=|Oj#eFL@V`2J zp30dw%cCZxPgrwn>-dR-ElheIO^+UMDfFG|{gB8w?wFlR9`v5gYjujYoH_X2+9`=a z!u;>TXxpMS^Xirh6P0Hj5g$0Wwh{ME{%|_>)~U!pr+)b^`#!xO*xKi3Z(nP$M|67q z?RRkxuQDBL?1s)v+&_EMxv7Vf=;M=^cYkW#ta-O%INN=}JoeeZL+l@;>r)TixVyEv zdZtQ=_+p&fy=S`&GPcSLXirXDd!Wyyi8f+CM(z%eU6j$LBxg2A?0v+q<@Ki9zv%*x$)h zRQ7Zm{_U(t$~_}A5;u3HzuEXvVb6*ek5?NWbn4`NS#dtDRlnq>4 z@9VNh)~mXwq`w<*&D6iXYx!{eiRm1D|5cpGZf&;aDlg#?q%rZlu+I6ih5domP4^CN zZrGuz;mH0fNKaHb*fD6snbGgJ^__D#)n{#7GUncr+Xk17n(Q>2WN@* zm`Bd3iZ55+Uv;C_i00^~dU|p&J;=h|vQ+)_a^W;(`uFEmm!~gUx;E5EZbh^5sACxc zy)QpC&pcG(etv8{{df$L_YgkwiZ8vobDH`7;5jh`bB1eNxhAJ=?y+?6gf}s_j;XUJ zSjTMIuTXXK-n)Ch=C6-5YSwyZ(DbZ&cIM!aTDh8UzhVP6YJa<}ynpR5zVFG81$*?5 z9Y~#Wmp))kH0|fo@rKR7HkyaW-kyVoym;ySU}t(cqjFEhxgV!zJv{mDd-0&p!uTm; zLiRXT?FwccSsJb4aLn%LPe0`Yt~EiW@di(0+vl0|W)8I5TNcJTJ@{VOWV(vh$3@RB z?+Noriug1A__mB|m)kr|BN~e|-fbS-^T;j7)WuK#;IrR2OYT+u$eFs6Cr5;MP2YXv zl*iFgp5{AC2DY-iji0*dptF8a_v6ycK_+J$2%r&(5lf59Dv`Et(YArrADC`Rwa$#|I1@TWe_lscT7& zVM5{0+(im@V{>*d-a0pU@)Y*kQT`TDwcGa2eit?(^o#xpp$F3{@8KFpf^VSJmW_*I}l-`4ic#$gMW+mx5zKlEaILvwfi zEbij0FJto?K99{i+_K9o;*x8GH(Ij#vg#)}MRB#Z#k^Fjz$WNSyy5D6WBPMNEnc;D zMIOv3YuRjd4rnkY-Ey3*dc`~QVcPZ+8lIEpIL+3) z;HLjs@9xn%`cP#9qI7+;d%Q^^=I6CAVC?US%y=ouT^a zvVGi>7lBX9&TrQ^aR`?Eut)2Y+^ zHGHP>C*K8M)IMcY97?qsJ!#p4IxY2!U#iYW?v+m)Z<{cFnQe2z?XkBvH*P3f6@1*k zWeuk#WY`m}j-_kI)U7d;pW8KaQ>6K`tKCf>R^Qu?&aKYQzUm>jXZ?EPmU(H~zJ}2& zcBrpSe=8UEsb-6C1^TQt(pcF?uexADRx%dot9tB_f^Jjf@KoQe-f|O1ymGIq8)p3M zq1lF(H6MB}Ph942ZI)ats4sWOmv3I(9v;FN9H(5F8(+J)%;7G5e!0WPpi__a?E6Oc zC^h5GU++J6yHsiMAv~mPaNH>G4e_<{We$JME*+eplRmY2x_rGbCrjn@)=EZReZj2( z5tSM~8?J0onZ2Nb<+&sDa?!k`gCn1pmOB`@EVcTVgFb zf{Hht&a5nSZP=FKaKMmgXIcH)(I|Y_u()SpR^{7Pm8P%71}7b2%byp+Ao13X*s}@6 z&dOgm9awg`?uv7lFfr6PCO7>@UWv!XxQVL|x^p(4ygit)=fS9>8J!!fycVyG*kjod zH83u&#$ex1m(@()>*@gmUTHbLWi5B2Jua&N>Hs5R+xpQ?vkC1=w&5nTV@sq{+ z26>f_yJ~&Wiuvnu+SI(2)0Xj#eQ$GaB<^-t@1tJ!QKUP*+_TDl6We2nLiYYef9Dll zKi8PbpWj$$XMHI7Z)V%vf~6ii^#b?TryR{4+J1RteD7^tt2>UnFKblP?dV#(7I&#B z>`Ifb)%@}%Xlc6h&BSZlwhGziCiVICJK7eWHn=SxUmo?=I!w zW4X|>xlGbJ@mOw>_6JAd_44^Wg4{)^!S;=C?c}T9b#dggS^DlXW?3~x)s+TBEL%6x zEhabj$Ldfw;oy#@-qdCJtBbZ=Qh2=F`d;2`%U;i!*1k$^*?FI)cGr}@JlYViJ+wIa zc)|rSf80_(+k~_uQ<}U@ai6y%ZDP0amZ@mWxTNmHk6%;2oDuOrH`*4(Fzc>`RNhvR z4=&x->gzPp?_@x#Tq*zM`ZWzl#oyL#E}P z3Tz5@(3)S~Xg{x-Iu`@%!aWmw=9Kb4Wr(Zz2*D$Uz;xOTclT-mmV2h&07jP2$T$x&GuyX;sN^Ka`0 zJ`OLL_IT!Yb74|)R9&oSczo=!Q-5qC9J;@)K2=<-)Hn-{F19H-v$$lrMt=8ol?pS{ z=^!XS?ERPNWs?D%8o&0sHBP_Q*Ly}yVVqL$lS!R5ZiziJzrRk{u))GjlRMGEH}S`W zg+r82B|5a2HCGMT9ox1d->;QkGdt#y@2b_2t)W`6Cf9`{-M6{7Yp&>4+P?9$Q)I#A zgrATmv+z6U| zH?QT^J-w_ksTG4ZI9SeFBQ_AFMb1x=-(Ml(zj5rGbnOMllJ~gwjl66AQ%`k~QOpmI z5sy2Bo6EAVsfKRII&3$3{;JrrvnSjXoBPIT@qX=ToIS7?&n6IpW_clK&jnyy!D|H?$7d((Yp{;7Xil2<&@ zs(kN6uU&d|oI4u|+~~FfN1f-w&>8ziobOof?`gA3ndZAxw>>iGi9*lU84q%XXCt+X z^fJza&`-+`mDL{b@!FyDvDz(c>ykq+G@G`b{AhG-%G-JJ`8CUfxu>&lO?i9i$Q;JI zj0Zb-P=0N5YS$0Zk%xa=dWwIaiJP;#@XpSt;UQhv{otNt!L8N%GDPp@hx{EPtO%wr z+F^ZtzEj+zn|_hTg=c=nC62QF+YScKoXIrZ!TyL)DTdi%E9_CU)Pb zyJ>r1hsNRO{!^PQIuCW$2V~qUaD4G&snC2>@b#k&T~i;_2yPWS41Ig#fu)}QV^F~N zI?IxAL~YYVWfQ{!;aB6LS+nbhYpKWBHpfQo;8{(Xu}QtxzG7QRMa9Y$b4tP&+qelV zM;AXYkl#1%qs7{6gMBOZ%pSS-joa*X=Xk4?7w>62YWDbH{`srbdbPW&fqq>9BeZ<0hFsJ_UGWa@FTkTP{b~tNx@vS$-fman0*#YaFIM z_;@}2^*;J6?c3er19kj51?{56&5ncKuimxKZo%kLDT}PPe;@x!f1GQ_Qqh^07Bl-M zvo@@YFHj8X6vpret+x%UUEkAlPH|;!$k=#~Gh6$WjwI*tIATwTE{qm8}>txuATEYlOo`^hL;sj?e4#jCrl{t|a^B zF3p`&@|`k9MPFDkZd<2Djm?9fkyc|&CkP)F>by#O!CD{CcdAgF=*UTlj)?iSs3T*g zb?H%;@FzLNm1k~_KY39h@J!OH8|y{L8^w(CK{3w_&YrHYS~Tt9GSSDbijs9+a_uud z-4A>cHk`HMdvwc#*w@0aig!5&Ra#qgdR^v~?yE2B4d1n8@tnHNmFk0!UVdP@3lGJ6 zM{U?rSGi&TI~BjugtApi0TFA5-nLygwb2|i{PFA3uqg{>YK~QXd)lZfXX4_aB>`Js zD9=cplX5L~Szg`xlFFE#uG=KtAjapQhCtmDvqu}Ks{j>pY%J^rmgfHv?k%!Y2GY6jOk)tb!G&V*tSDrhD zF80{9x{ptNV|+Hax4HJ_!9Kg(3Fbb$ninrm+{0$2)YkNtf7>4R_)24~ZRW(fqJ7s# zbzTlTQL?1P=BDmT`q;4dT}?F~CkwIsictv@x@yM>UUt+pJ=mS?R+!RmH}dd{?8TzH zy@l|vmFMQWJwT_=UW*ZNN4}j>U-&_%(CfJH^Nzs4Z+20FVMj-`>}gEXbnUd5s#~%5 z`6l(n{Hmk*0gHCM=y+4(HGBHAU9LZJW*^iT>*3w)>^_w_F%Yxd4;j(BL4&4@hJ}@=U60N zy4f~9YTVHs^f`SKXQf4WIN39TgEQ$_N3NVb8au7*C}b(~K3>coRSBWF7=2kQIA~Iq zDR0@6k}WU)J~Vr{p~1!t^~tIq1IA{RR!1{R#@+g|WBWFF?Lp7>Z2y#ZJE*WuaI-*| zB6w)gJg9qM{K7>!PgC>sf&#tSzHfi-hdVqGdv(&@cjesf#!vh-C=hLQNtk=(4@GEZdNm|%lWs@ujD4PR>* zGtL|LNqfDqa7e`Hb)1t{Nj_f!FJ`^kl;Ln?=m?{n0Im5pCehPIeF=P(^(sk^8E2~V z;PJU$vs(YjlhX2oPti9pRh1K?;%&^tv5T?GH+|_YtVq2rp@YtueSKw-^=!Lq@Yf~u z&JibX3Ez!85zl>8xZJ70Zmm&PfEHI}qeVyfGA-WY-5IJMdhO!|nT&YKaFbU$GZok`MT%F!A zewTl@SBqME@9|XLbH`70Nk6|bjx3(ZnR3^lp?b*qkA1?0O-n>s=e$(D^Y`}!^kgha zsdzHCWk_Qzv+2oUHMU!=-<<(%T{FJpElb)?^su&d*Rr)A)fqg>R#@*1K^( zl*(s>8C5F|bJNi&)$4BllVc%1vuUitWfeR#BsX&7ZIgFv{{$gJ;p;;FgimsPS&0)9 zJI+STS=%t)===KUW9o&cOk*O8Hoj8Yn^f><=%Kcu-ZOS9hDOY2@2SsQbo}L*O}mF~ zbkj?{5@7fCL~_)j<^0lF?3V?Xl3D{dS)9w8hyMuEP2?AJ?(RFWJ8${W;~t57v@>4+ zcsOq3*IpmHQ^F@FJ%0s%%dQs2^-fTTJ#Z&-#*87qcl!8GJ8sU7{^ry&*YMJm6}veR zOPNvH+dbOyp1WAM?|m8S<)o$Ei;X+%uiu{WX7|HhrKP2#UVhVP{S&_POV`@_8LQ$l z_+!GG&!YGuwek$HsZW%!@9_N3MS&i-2QO>+m4n^UsJ){Y;IeglXnhdp{v8`(R6+K6 zcK6xkteFLt&Fu9%_N}Z7=?uPBv3T&s`>}t!l(JKP)~Uz0&3ZpAKmEn!QARFX1Z!7* zPTSK|{j~fKyLau{eLrijUFf`_d@|KgaPpSf-Bh)bxGDBmr)>GMBlood!{Cyy!ny-a zkFBdj?r&}`aI4$2K=IZyGrVSqUC{Q@FyXnF&Tm^P{8+Jn8*|^es}2ldi%Qkc$6UPT z$Kte2X|jH@EoJ4~P{EkY6$)#I&b2r_c*pLU&Y{h^%FPDK52mUtR`j_t_3N3UQ?d5` zTN>^(q}?@`^2R`(pZGZ|t9o3Da7663a(|`hs*9Gp&Cap*)s8Y2ZV4|fz}q)33jL%# z`J2O{XIWu)T%W5wXj`#VLoIf4!0?-C+1%*6H;Q{MVH<@8=Z>20UYY;w=iko;O$RFG zjNXhymTj@3{I>O?5pT>zt1heIJf^7jsg7v)8&%PlEC-y)6Pe%B5i#DXiF#g}Ax0V| zuf^ms%@}4Al$=JHF?k%KC~A4*iZMl+@61J(t!Bv60aGAmYF^V38MLa39=v0a<+<&u z7*FJN-wc^e!Q}OsJf2ie2$Lru%4SSHL!{g8Oo|XqY}Xf6wL1`ci9$Z>ipITH6D?_X z63zImBiaFFmG{1)j`yl)iaJJ#wEvGtKB*>%WJyG`C4Z7Shl)PFcMvsPSHSq9+N(M^ zn=cyw-kw-X+8_{Z{p27j{3vhKUr|1(G)UzW(n3Y49i$YTFA%kK>WHj5R7C+F%*eBp zG^KQ?hz`9sCpT^U9}NWzN+W?YCF{`#dvfPArhrLEgEO`6AWoK$JiS0!l=orC{}LnF zpn%+9sL1l2J$tm0QxIH_?55y^NrgdiaxwUmD>)9y$qSfhl^@2%nF8YGX)u>uR=HDI zbmQX?@)GPRahjGLA|H_ZQD%ATxbzt~!HbCk}ybRM9g_n(2XEM0`=ZiL7b;MYr@ol;|M<5#2Zx^I?!@ zO^jtZGf=q&W{WdeqA!JBqJ>`#Fe{(_xO6QDIl+N){lFXT} z1iNVI7=jvXFh$CaZ)vNAu*@VjXvSjjk)AqcFRE^J0COFL^3*X^oX0{MaHo0_{}zxa z0duIkMQutj0c;!RGEtf$rh{6QFjds1jG2)Z&m~L|H7R3iXrB_m5s8#6uFU^fTv8s& zRmQ;JDG7H}FjY~@1`03O5t~#)9U9nBWN9mbO5^`br*OiI#Uqg<6g8+|_QoWH^xFcg zLO}?N=S)HcveLj9a2}$TTiR%}CZ-11?trp2F<;UbRaiWk%dkX6XAKBXlw)$ZHfXJu z#{6NfH zZ2+L~`Ln!Aza8>XS|}EYTC@nQhG7aUDmIdU!J;Av9I)h`Bp}R^#3mM>ib*J62csYa z=kt(>F0A7DlLS(5Vw@!qC9QKpcXYv52$&(p80tyK@CZjoJM=ILMO3LkMPd*fFM&a# z&-Z=MHhpXnIa{Uw00Jp(aVAGJ{;)SXs4dxoa=$I0Y6I*kKsu^5!MxGaLEwxW9#y$( zh?SGFuNYw`FiOT*W6TEUanM_1?5%8;nu%=IH*&%cQ`v+LGirjqxom^ zl`LapA)93~jG8rK7{hs#5Sn=u{L(0^{qW)hY~V>4MOA{l_;gDs|vE?dIA zT*y)bU$31HjV^YWDg^Q`SrTY~(M0$qu7}MeWus_IfCd)2y9|amz;MF(2|6&42t#D6 zkv*n@W>{lRvX(fah3{a%*i2b03SqM-!og-y9DvOt@hKF!*%8i1 zEX9&2Fw+5~blYMKsYb_%hJ&^evBv)uOC1uMC9&dCD=B>R+hz!8NHPvKtN~1ehjQ(R zolpxx)z}_$MGNL(I=C|*-6b`0!W2|lGX2?X21OhMd>d5e0DegvFdI2@;KbAzfQ~8l zpdWa&f=d5cQbdqr3c#Vm9LQsK4#c#Pk~7>2Ta;F74g`R%!tOUqRM=>M3InhSGzP;4 zt@D(vMqH;za90IqvqeeUEmiwZViOoJ4HYsmO*Q9!;KODUrtFBbd5BmSXEM=F7FgW> zv#3`Ifp*^8+`xpc!Dd9^mGbDbJ*HX(3cdpF@ zG?0!O&V*46u{I9eYtuV#IJ=goq@AOWOiT|s@-P*VM)|+-0@lCr5v9a#999f zU+5JJOGK;qmYLdFE|H3F<6!<69|dr*xkL-0<#%X8F)lF9pNoYP z8lg5W=7&OD!5Cb4&;*O3r#t`&00#v=mV!#$plcl;n<N3pO z94dmcso0JDY)IHKK;u?n%5(-m0UL#jfP_efu_)A$oK+|~?goAuB*4@WBM@xTxFA`pifql0$)z_Da`Nyq4*Pej9bcaTLq^z7MGv?C)STN3fud z0-iu21dDBh-uqGrfix2^T@)AqCvfC{PLn}|293qBLEC)+j!0NAMN@tM*E(p^G;A&e zH5-&aky-;62uSTf|6_g>ZBkJFry2)E7-ACeVgYL!>rYtC7!2NJ6jr*8gga~*2`>f! zAOH&4rZ@}xZ2S zCt)s-G9rhou>0Mv2)j+9h=Lu(l1LlmP@Kk$BViOA39sQ$yawJclVmyovJ*O>ol`)G z#9(j%Wun?K1vX_LOhJ@_Re#|u%D_1+a&!HN9)~F^`ZP?x-vNZc7D+tez%oSk1o=;e zDyy0-3AAo1J8553!Mi{Un zGuQov~t%rrw)Q~#HC&x zMEOnkNgBZBP$7=GR*HU^aoCjQa@Z7DbJ$d@;IPSX7>fF)0kmwK38y%1x&$p$*)p2Q z;V@7wA7}%Y0vIG00)EIwBSQ#kM8FW6kAxvoWZ_cYx@`vdumA(J51Ju?2x8o_8M1K_ zDEUncjEf+-O44=+`UIHtTU})K)DF;E;@~RNBskK4qsVL~;K;dIV39j#0$_lmU&7!~ z=NX3is_^?+KPpnhtk9ka*y-gk%nk=#VPG~UK&jz?B3v#t&pHAoZ;ygeDG`J?$=XJ< zFlz#M{AK~~`7j5%ug{`ZBXAeRN5Vt>MKn-|mm9#SPRgTOgov+^)I#K#h}oDg&S#-R zv#I6C#^5M8fva;t`-4%`a-{Yn=U`UEa>;YR=Dr*nA}XsNh;t}67y@rGiS@ztQlXl| zk@ybvwnBo5{Q->)-YvO)>Zt^Eit}96Xit%pphaviLnpn65c>$wK;qWDh2V-oIY0?P;-c? zj}SaSI-r?oxjaugz2Zj>LrwfBVk4y2{YnIa{@|n5->wPahM(s zdD=a3pq^hG;4QrDLx^tRLkdR!5h^)bNtzlt&WFQoxGqoQ@CDQ}^+E#JdT$)~PgxA6 z4kkrBUNH^|PlS<$AL&+{{_-TjgCj{*_p?!8k>(a;uBhKZhHxZNha*Wd6U&kS=@(DN z0XSS;WS;~oY@07ZOoBP-p%p|MGXdHtaHNvj#7S`=87p~RscWzq{ohxR#D&xojU(Vu zdrMsaLRtvH|3e7SsTesngK2|m696m8jhmuX(j`?m|CZ!ZOsZi4Hc^$;5AV35yZMep zup{GU;zCFXwI<3Cv)_D@Pa$GH4v@Yw39c${6~tB`Lhz#3MG1?*i?kO@m{|Xn83er~ z-hzlR8aC4wPvHogL-8-lbR--M_Dw}02?yg+9L$VMQHD@tvj70IW-+Llxd7HOJ4B~( z860$c0cO4}6<9X$G~88ZXp(cj--$Y3QJPX z;e}K;1ak8fKo*-t@L1ZN3R_#Yh+0k!mLpUo)aE*~kmgDvCC;XX^OK|)*>7)X>|!hl z0_ugu*gWzT7rz9S9bpP*aefIr$_Pznr9e~ja#-h73KmYS?t`YK0z5UWfY#zvfG6oH zW0nHdg407wmcqzw@n9Sz)grQ302YQJJg_h-&`6X8O(}jeFSZ{txpU1plB^O(Lb*7S zw4TIcK#l~tsQvV#5RjQ7az$K8)&nW70+<+Y1N+ZgOTGft6evy=idvURjfKfUNvkn! z2w_i`%i4Hkn+oTjCvr)y1dyhnNg*Y9*c4SlcUQ<}3Mgq@BwRs|E=iS#azMCo5b@oJ z`)_^-SHi8hEN665h>b$aR>Kzy7PSpvJ+-SbQ>3>FGyh*xDJI1Qo?NgLa~B1zQ%0Uy zn6d){mY|-tTnT~VN~j!Hl9KAbtuKen39nHHa3anDhfgYPY1DSqfl?A}s?N^+XB5E< zIEaB7|BQ~}7AQZBba`S9x|#upKQRq6*Qa((#S`+>C6wA8 z1?`V#!cH_Y;7NZn0}hstu4iCwav@wu$%JRYD^4K`^98~@nkaj%!CYuu2&ts{y=y?5 zxtSP4Lq^EC9P-4GdNv4c$c7_hQ%A;Rp!h7z)u`V{@@V=W8f0>)Ib3oMk>f&FvoL4l zev?R?={JdkoRg`jN2+u?2f`eOz+zP{r{6R*FtgwF4`!LcCP>8MawHzdk(dL-&+J^R zYqs=@1oZ_45+jr;N%9%M1xV@Oi4+F_hoa;ik>C?k`f+NA1n}XLD!C9#@a#>2re_U2F{C~e>f#XuEOCF>BIIkqz!j|}fBrnX7U8?WAaXZc$*DkKk<=-TxRM7Xm%MTmfiQbZYX1^o1l*C}g5>SN@RJlMN!%Vv zb`*p7hY7!RfbY(f?EcLhqL~ukznM!kQ=9A844+QTSQ5_BznMogQ+H`C{I@22|AY@; zl!5dgE+CpIyXw~rA63AIBvSqfflnsjBL7ziY=vn4zd`_qghV@a$p3^xt`C|eDAvCj zw$GM;S^s9(r!=qFzZv!^O*8guhGYr&h4jRQ(jzCbA+l6L|KT89npx=I48o;}hJVe( zGXo6&|L%u)JwP*s82v}HY&@a;{~jWnxP1vJ|BvkuW=nX4o14?9xwDhaLb&k4uPVT1 z=uzJtm7GTSPFfHZ1%^jjIBLkj2BVQXu?m!vgQ^<*k_<07)Q=DBqu4OgLPM3DCM5*V zpBo8hX~yM|m)~C`Dz}xlLh4=ELRdS^U(R~#1zZD-HNnM1?xE-gZY6d!#qVO!%h*b{ z5xdLFAHooCC-4>fK>A>@#z1*pj2QZ*6Sqb|itx?mINf{J__+FXIzh{MifyD^l060;VY+2e*7 zT3!jQ9!u$iF*N2h6iY8*9ynTm2D3&Q&iHI(br$CDa>hR)xoRk#t;a5*qH364$im-a zXxKSuT<1^MK!cfdCGiFxo`NCndCXSK5a3%e^!ozH%v(i2i6M`RFjTz(yNNO{L23SK zdKc=r0;QQ>f!6Izr+-DMbuju_0KOALo9dx>I)i=$RJ;ns+$_2RhBjV@qV{8qiKEds zA?Fj<1b3`-8?z?FX`sVv=x@=xJ0Q~`NKRec6O4bt(9;I!)|iSXqu#riwfN{%JP|_{ z_n`WiWF2hd-J;hM0P2^{Z zPre0egEIuEB^KAE@thgrXYa5uc_GEgl$@dg9I0Q5K-mk*Bv3)w8_J}sK-m|{q|HLv zAIhY!K-rlC71CLW3J)rzw-6N=CQUg+GvSFK{cIEsi6AbYDI~BS#xY?@3ciR6tV2a+ zqT&Y?sRB$woKypN#Bim*cZde8;8J-Jn8O04sc%M50cyadq8?G%2g=WwNA(ktB@<(%gpdwX)1NumRj};9b%$5GaEE*h5um^Xtgq* zrZ_730}eS-1y9|Y59sqjg+PKe7!-5W@B$32#GyD=1AmGUAB2L8o^A#=?$*KeU=k#jNk@Z^Lgaxa>fsh*_}4qSkV-(n z)xp(+=THvd3|H?gwQMkR9=H+J1IEmAmO2+0GtXJ-Twu&R@F{8-7&A}$6^F289+hc@ zWjJto6agnHK0>HT%?gZ}C(R2GCd-q4Ga;>%V&^ak0Dvd`$w@R}u@tifUz2m!Ev)`HQ{qmIrd z(Zf-;4s@%U$r+=vPk1s)84SI{t?)3UX95SZ~20~Q&fFW}m zX#9`|wsVn#=U|9w3lrD-gV9Q()KU!f*umDF1USNws{<@YMX6PeFchNHE!4(<#tXyo zXBb-K45I5ia5)UEXM$)lb}eB+qlP!`f}vavG_I+W(?C^8bY-;O2cLyT^Po-N7r%xS z1Taw14+l4_cfqat#k;+3&;#*q7l!hO!)jE#+vx$V3rFGGFm&A$itDoI@)&CMf+B=I zXB>_6!L6y#_lYR|3w(OP+|gfIo8A8 zGsEDLYv;(>h*iV!vl#r=n{e|qR2vLh{R^;dQ^33B|Kba2JV?@Cj>JQe;dC$=GSVIn zfw6mT)6`MTB}`R(WHxS%qdB3_NSdQ!G#-gYhe37MFL= zQI#SEv_nXSoQ}D?209-`H$-NSX!0m5jIM+}H_|N8DjH1-KJeit$RiGv(xA~ah~9xj zhX&fS9>&?6l2aoF8*J0Z<V-&DU=!T_5K27|i5^gadLt4QP=R_T5*1KEO63Wnz@vT!3_Y+Sk0SL%MF15E zhzm&&rg%Kj1=>-xou~kW@}w#dfJ||7=mAkY89#%`JQ+cQ$vhcDBXCUcV`*MQkCY)1(LzSj{D~fE9Px)!ph(((;s{B| z640#(Tt(cp5RWoOBWHp8#vKFyg2$CSira*5)8SFP?H^_0GyXlXG{H#)V)xB>2?p*t zK7?+K;JKiN;&bSVV!JJP@BeyX@hOVeUn2R!5^tO-Hx5IyX9Frg$WRxLd_hyg(A_z> zjo4{Bu7;!dXxv(S<`r!^j>6}Hsx#bagHih~d^x(h5Zs<%Q{wfz@iH8FZi4zVXPPmA z=F1_?yy+E0&?BN(C{MAso}Yt4USrhKmZig#cEgShB!*ui`$7) zUdy>+=*2#m@a&CT502sv;5L7bRN{Za1&pOl50W!I$OCe4DG)J#iRCet8hfW0!7<<_-(=pfCLUk$Gzo- zq9<2jn#LFU85DFK26zslPlE7A6wevbhhS*W4Y)%HAlfJ|P%Z+Yn^3)ILf1wak8yA0 zatpUco~HB;H1!V1f#9f)qRi;;Xne?E{%XS0AlcvYmu4+K(2QS#(Ek7@-*ZDy;#eAJ z3n4^&>lv&EJ;4NRufTIDr`7#0wXw8>? zrHTef=2JOt0&fY~QWXG+`LZYu;LHCP#`$LOKPWAE26(|RB9O0K{6DWt_+2+pVWiQ8C8PYte{@}p^Ess7N%BT~ z)G`dW77v$~Ka8O(j{$MWlo4urLd=%Y_n%GRAo2Hrkb^HLqUFutATqj6h^%!Y09cwp zLc>~NIxzN`=ps=fY5Ivaa6d>M0aHEp9*R`*XhjEsa!cvP7^?mVtrSh4(n%~&B#%B3 zB{F%G{Rv7Qz4$p~@fnr}qN^@u{~{7S$Dl6$`5V^<8DF4_;PNy+kBNT&!G(}|W89~C zA*F7R{_Zb610(*n1WESFFq#I`z?s2GVO+~;nl}1G(7laj@=B=Q3^*S!I0FQ` zo{Bh}Mms_m$|w=ovy2ge0m=vw*oce|!8OY05SXuw4S~n;Wo(G>Xc-wIJX%JEfVc5w zWC;9<&vljtZg3^Oj13W26N}j$Pj@KGBO0_ z&XGi@bJXEF)!cbo?TveL` zO#dV5v`=jv_6C`BnB-EL(|Qn4!K-)@jxaGQY@82Vd-xy8VyILmLS=bOXI@R(F%$y zc{F_*I$}$MU8F(qyx{_ya<_+FOmU^nCIjID=yUggbnX{7S|qyQ0M+HgX%CQqL3CV^ zQ%BkEv^aFv873Kd(AHt-1`B%bc+xV_4-Txn%!~E|L%}@g-{C{6!O>P1&~KGLZ2@v} zrIFc9ZKN4Mvp`jDFeWsBHVMO>Iq0+rTvbCL%^L-|gFu%NwCU&@QK}w6`-TpALg~>+ z+E+Bu3rZv}_&W+TO!k2_*N�!EmNC;hgqjh@}CPQ26TTzk(BL~lzKleJBk=!a zItkg*_Y@H|WgMD_nlcVeL`@lohW86!#-WL*DdW&Y)Rb{(02{t6(J6#i3SXA#gjWh* zmgyt{r7Y7)1j>JzPM(?IU#8OwD$*Px1WJL7lR%&p$VdsqNr8-&fKv-7S|TJOAQx)V zSOiBckns{YP=Sn>z<~;6yaWzZAmb%)Py!h*frAprXo(lmBh9r!oD|4tiMKygIA(rS zUd@LAHK_^^8wE060;N!qk~)ulECL}_!FtjrSkRi`VZXk~GLZKCiG#^8+!k`F5TAPO0vp~3% zNJpSsk|RUL$I)x3i=XAv*f{!| zLQ_UHmU718>AUHJ;7OSZ0+!~{(lGQS6=p3>mdi$Q%cP;@#%7v3lFNWGs!QZnL3qrB z8zz%m%0={Q41LXpuFuQm7#Nzf7K$4W(v4{7WG;+?_>qLvH$Z8)2Sk#y>2kAZ0^-+} z#7nBam_8KsZh{%#Hpq>@Q1ND1alIpaH?Um|FU`o^w2>H66hSnAM7!kiLuT8x3khBY ze|?+6ZZ1mmm*9@mY0HpKt{qKl`fF6 zFv4_XG>oto84u%xfVIe&7-1kXDn=NHjEWHkBBNpi^8J5poq3>L)Ah%H_uX@^hz!jj zB7&%d3^ebK@4Xr#q>30KC_)G#p(z<^o~{%%3x1kyh@nMPTQR#;Rg}aKRY@9csky{V zr2P>k{e9Lx_w0MmTFD>Wv)(@EtiAWzYk$|U*9lNev{Qg$0QaugFC`Q2esxXOM_*2I z3+FRp#4|Q$A{`@3JmWOC+YJy2Xq=jHugcHS+vktVwBcqX;Nn9bz1$slu_HgSfQ^u7 z$MqRE>L%I|?RW)%dov^N0gs=i-uJO(N;J5B{e9Wz+uWgdWPvTuV`MLQkZ0U{XLfkK z{h@6Cj3BSpFvxxN?0^hF_YLrFwyUEmQIJKlo)4Ly&33DQ_HcGwt`=}3mQGi|jaWKe z0XO1v>I%3Kv!^TI#tz0f;6`@du7DfadAkB^l#L?5Mp*fBrm_KxTC?2=o?k7vKGjP>BaU*_i%#L1e>!-5^yJsKc??fBERlo1)>^`iX z$GP72+3bgI3K}<#4($0{mgqp|li3mVua{ECwd%_Eq=z~ zw!M}>yk%MT@{Idv3DfF*)~7#>`d_d@7Sy_DAT}dcKUkS1g3mFuc+QX*{L$OEdj_<1 z!=2pM-MuO^p#IuR*`+|E#444MPV^Xa7|;;27Qhhm)Wkxlw}6G%NxK3TD#$H~X8=p2 zD_|k;Q&)gOm?d4EQJC^)R(HTcK&!5Rg@9IF0Sf`Gx&jtLJ$D5xgi+BIV-RJAFpSo_JA#g{$6#bT%*J`=|R>33q=KG8}@# z^56W7!A$l`8US`iwz;dM=_za-_YJ(@GW@E|{cfE{H?#30{+ITk zn@`>2AR6iU#S!W21^3$W+~MxQw>jbXui4p(gx z9qss$01$ zogTk;v{lyCcY_D-;{hj5ai#C^N@9Nh#bHv?IPvOW%=h^vGdT!maE%z&=AN|*sV zag~fr4fMoiGBjA8TqVq4dUBO81GM5QVFr-JRl*ENizS~h1Jn`)&|nRi&Q-z;$cw9l z83F2CCfooWxJsA-E^w7F11{q#VFqBvRl*F&jH`qhusd2IVFm!fRl*Daf~$m?j!I1~ z6K=3yxk{K}cjPKz2F$}%!VI8?tArVV4p#{?ARVp}X4pOp?E#*$e{z*D!v@NvYW9NmxkwI0p5 zEoabb(HRj|+tDZRbj+?o#+^NjpO{^Pvu@it>;srxbKL$vhKMC~sLuc_1eYB~*fH*? zlW4a4`O($bh5Y)?7(!6rx*&SWU2z(WuDc-Gpv|3k27h5U>RsRIqUha>d-g0cO!vAZ zy4ZdDoM?FcKbJ(SGj94^c9)@-^T^RFvRjHxH`JYX9yhMJJo+1lWN3(WHy+S@K0DA} zR{~{LUI3BQ7iOZjfzDNx6{8v?f-v7Rqb-3!BRq#L{_x2u~npe?Fjcun+B zR0~0H5t$GK_c|}Q@4O}ph}CPdfLXmJ3#ip=vVdE?A`8gXtF8cDz3S>DuON03dEFJz ztJhrtzIxpi@T=Ed!I$TCR{*eh(&%U+&0ci{2%F!LFxG3U;M4Qk zDmeALwhB%?ub#qo=@nAgFue*2Tc)TP_N_*D=_yyNti64dNz?_ZyYWX+5a`b23YCEJ zO0LiWXphE~taFyHTzSAf@RF$LGmzb~OMnwE-4OlNeRLTTvT{Lmf5tsQ=(>LIP0>(X z$d|JgK-Rt7Mz?^PmtH}mpWhNaopC!~iEQmS2cN=Kzlct8PhLqwGP`=Yoo(JYxX&JZZhG>L)@Al|Tw`c+D`Ll)5rQ`$N#Im{Vm(i9PxAJBY z)H|aA8F%_E{2cM?XnUg7zu@WT+yz?S;8uQZyeN9#-Nvu_Hg`uipjvK&7XZ_y?%jLP zCy(781FsJE^g>qFJ@-ZjkS_eo$VYS!aM$fid}7x9(Lfy2T@A6P++nK?*56@%^>BZd zlpvcN)T=(`!RRs~zlj8~p)$V7V9Q0aPsqRrXo1uf09F%!`=P|Bn9j3X!noD`GxiNlAH1*t+C!n)!2A3{9wIJ#UNS? z73+;S)08Frj7_%O(=@R%FVYkf4SRCRa)#wKZ=&6?G8#@+#~jjfUy6o{iMHAe z{2Q;nVp$HS#qlr0Pi(CfaLIXV?G7wJ@kx{0@zonq$nC&d+vjaw5nF5b|C2^oYu(%2 zUsplJS{p-}$NT(z;mNiRR^kUVh^@7CAHr$yPG^xopOVwC*7|%53yHOMl)L^@F3Izl z=Sr)&4Qp+IE3Sctwf3Sr_TT*S*4ol9cs|w|fvE4S<*it2bKBgEulX5UYuRsNYYlJe zS?h$u?ztIJ89F71rY}@88%j6J(KDl)nH@c0V7xc^B*XH(% zggPL1a+_P5&oxc4q3)Azxl#4qSGG+gKd5^Sv&&mxoAuynX9oj&`eh zahc?jjCGYhxrPmPc)wgTmt>Wz4&XA_R}5KKtOkj^kz@MpT>sj+J^EgF_Hp;G$wUjb zTfSt-g@Zr;;@5NTfA*s-E_-g_Bfom&<$bR|@%6RGzw_)D?Y%dsf4<_MPrtEf&GtR6 z*z(oWKi}?WXD#^Y$*(N_bk_Tu%rC#XZq{RqK3TqY#q*cFx#QY5Us!Q+&r{b;ynM~F zNALURVFM>$`}K8?omIZ@;Q513T>AMdlNTKM@RXN6Uv^{dkmYB+@9zF)@#>)qA3gcj zH6K3k+Uq-C|77W{RcFsWe975+t?aSpy+z~4{PxBF+<(mO-Inh2%A|L{{_^!PBZj|o z+Msj(J$KWqCY^ZxGY2fa>~H;En0weCFF1CaKW#W_>1EfPf7lx%-`e$%X~pjylI`d- zYSz2gw|B1D{HR$2hP~PS+6Ve~ZoGKLtRG(T*NaBfKD_Au8;@Q1i^DIz_L3jYzx>#R z3s2kdrZaYU{jh1T-B~^K`@22#!kXIIFFtj5{{au&u-}55{SUqR?M=5i zc&kT$@yFtUFAur>*=OFKvu5s~r@wh}v(pd%=*sZdOlFfWj zG+ey1!`&C>WIJ5%iP@p`3Bz-JvTpJ*xo+;}LnC0<+ierv*Q0Wq)`BG_J4`UdM6Cxq z44a`4tT0jW!3Y!89BeSLu?xWl^V?0Z!Tfd;Y%npZ3$YC*kwLMl3&9BUdr>gL{9Y7n zFuxTA8_aJ-!3OhNQLw@MRupV7zZC@=%x^^v8w?ZQ?>@l@6NFg^MwlSXLa@OEVHSc7 zCJ3_-Y%oEXg2sT(vz-S>DVFE@A!3Yy9S_n3nV9`SG#S0cK z1ZTWp(L(UX1KznxfTAGNLcsH4I2Qt*@2JTO1E3enxex%oz}7+l^kO*|0-zVmxex%o zhqM9Edq^9c(PB6k0-hIBxe)MtXD23pApm-@jtc?Md+-|oy%@lS0O-X4E(Aa?25=z& zdNF_t!7J^7alrFp02czD#{eG0WrE4X$SuTx-XopM2IU$U`i;%l4t&B_y3aqn_n|IrS)?ishyP?V1(q}FfRF_+`1l8?%vgMRhbcFGa3IHH|f zF);t)*2*u^LHgEr+$DEr#=TSEA+L|kZA2zaiLI~yZn+CH?)C~B*Bx(XdexVY%Uzvu zhjh@2^Ly8j3E9QZJ@$}ecH?&7=c#+w=-#>a_=YAAd10U2 z1FmhC99#RoIkI)?VeYRJ#$sba8DL{Alig(5a{qp}3O7v)n777Ch%tLiR|K@<&B48Bj2-?>VdA;+DoWMss8 zDaO7}zov)ppRDP=6A`4^bU9~w%7KXBgyVDfN?L}G*vZL~&1U3g4h@^I809?4kCi+r zIS>fVJ+XZ@KJM!>hvY^kXRPY;C*>$BKCW$ZIb8KiOwp2$8`pbx%WuL0KMchA^*x!v zAz^c>+wU-z66kW~{K?!p`MI{u9bW!f?%`?Bn|YcCO-CKQIVbn28-6^C3FG}+uG>ku zAGyqs$RD&iBICyYh`*4*`M%rX1UecYwCXVvRQ&a6xy>?e-&yn-;|+uS1Nj+eaL%30 zlYIu~pgG(XAN8%vPYy|u-TvZ_c`Ct(FWgBd@hdsN`!Dy^$vlJP&R=I-k5l={sof1T zZpCRd`u&CIi%rhRjc_w1C7YwVtK1Q1veIw3ICrq*8~Am7z&SZ$beH7t>K%73fAlA9 z$6uD~Bd4S#lO@7JEvHQQzH!3m{YR3hw{{h$BOja5mUr`x%=LAjuF7?WiUD8=7AppT@@gd@EU!oc!t$yk zL0EEPm&YUv((8%Ul^?H}7ShcRu2}%jWrB z^?BFk_9r~}Q{=71&3yHRNG`tRmkH%w#9cU)iJ8v37=humM32}-{Mp5vv&B6 zU+1uOM=!|rsB>0khNN-~spL1|LG{&luN|9}$(iiYo;Ocy9x3^>s%_2&6B0iTUhJ)(d`Oao99FxL1sORPt4$~C+|ZAHos zNR@;ZPtb~680^^n^UN>!NqnAQYLDCbNf@5v!P6HqE;wOu7yjl>2G9q~@AwsCclOk1 z^F}cI!(Y)Jcgt1;!+*nU-Szv-;D*m-llz(2I3j-4189~Ocgx=%#}g*vE3kleyqynUZnmFNWpV$FlNi z8pS@A5znDf|NLYdS-$g@@^kd!w!T?+-wV7VI9A-=FVfzhpK(){@t3Ak<(1`h*&pim zo|Uc@{MGwYo?J<olRc}^VMzTy>_dp~!PTm28%!dvn$faM$f#7FWC zaqc(h89oxSB6fZ&kw{|HL)}Yn@rrMDjUIOM-lk0)q`v5%{ES^Bqu$|lk4cbPa(X#7 zbFO>oJ#GQ8_NnjsMebL4klv5=bL+{OiE9C^QnwxWg=G6s@;3DwzslW|s|BM$Ht}FH zh_D5dL0qMc4-p}HUJC}3!LNg0GI)g*EC#{IQGR{Y!r^-6@JMC zlfeV8U@~~%6-)-N_JYYE)?%Z)l&C~m6(I!R7hVVfcm*jTfSPygi-Aae{ls`=RW{1q z@EBQ@jS^LIh4OCHypb!$sZq8{u6RnL@Qqxd${VGuxDuq*_|%SE0g)(g#rxs|i>zk8 z>(Y3=7=fjL9tCRg9i9YRv6GYndKAm96wssKu2MjcV#}2RdX%tdDWFHu7o`|I?gcj- zrQtH!HpP}J1@tJkTq&SOvE@nuJ#tKjs}Of|*MFG6w`V?XL0VZFc@!3(k8$sQ#zNtA z48po}HH!koH8A7$T$5vWXq=8Y*8S{XTngCY?ozD6{JHfFzChf!+9?02`{+vqeQ=Nb zS?%#A^v4?z?%O zP4DYIv`E}kU9pF%=a%_Cqy~Ej6?wm%f}3`gth4@g4#~Vs3UC7Yk>^r?*&=x%4j_UT zFt*HCfY^SD5>Xa#QwrGy;%F*0eOfZ@!Ko#lrBV#21y6`GiNZ$>u@h%fDLA&onM85& zC+ge8VsBS^xZ~`j3a_djRJLAR(aM-tM6h`LA4YAYwuZ4I*3552R81 z_W9%4_69+X^F;R^obMF}*ZheOl0%P14mpw~wgd-c{x08j@yPh5E%H6x_9HMOjxFXZ z8EPw1&S-l#3lF68iM!p(*b|Te6$3MsdRHaiBQL2VaX?eFSt+1Dfo7$E{=BLQ=+Enc zfd0_hv`nT){5_=r{yJqS1Nigf6NA41+j>&9>9je=PU|jDsk&u5O!D~-Zm{s?O;jhv<~(f{o-Pl+gylvEWnp|znT z9Emn*rL}jF-L04*gQ+SzSgIWgMD}|{>kzdPXkJceD4SX!$`3S*o?;mE+0d$;k#p`v z)Xnp}UrF6t^rxm2(XU8F^PeeFG+zKf)9fge{Q(Kp&Yw<%=BACw_mUEx>AzRjBLWp8 zwq%NV_l>&OLm5pIOsHtoagJ$j)a3kzHB^u2f7J-}U}*x}R6Ab=LeV<)qK9FBt|i@$ z;*Go`r7_5QYZvdfYUpi$Mf0%(Mf0aH70vI!idGhvVS^TH3|{O%>7p7|lA&rY7V0pX z(V|YB87+#7HDBVj5^Kt5tEJyTX)lQbq=^(yS`SUYTB=d{Xl-m1MLce)T%S$c0Q3` zem0q=K!9P;?SCYn$fkU(_=;6?3~@JkxBS-Im#G+Q?j(tyjZEFb{^VxwmhU&rFvLkj zGgU5gV!mIk#2HQdbc_T2bWZ-5+2P!krTOA!Y0gr+Uo2+jc7JH=yQzj{l7h`lpwTsr z@{*Jox_2D>>u#Z$1#haymIdP|ny>SsXudREnud>Gk93)IoW}ENVS>wSN9H9lWJ*6U zcCjd0MGQqv6AMYvd_95|8j7h*G*8b0i$UB$Ee&Z`^pQP9Yqu}PH))=SVbBB@m)KyLsdIp5F$-0`&f3GR`T9ZMe~7HPusHrA4wA~iyJ^SEZY~OQq0Iu3YF;6 z_hmVlNBHBt>BsUeEs+)ShK-n1)-&K`TIzSO!W*;}aVq-)OzOqHWMrDgZfyF^Cy@+o zJ$n`(ml2Dn<#`7qCVW05O%z(i4lbpW%}ePn38xB3|`=>lU7P zebtA=70rM5Nz;;b*<6-X$+Uw@8Cf$6lGY@=p;s2XW$0K(MZj;1Hn^h*YI0Er75l}m8i^b+MEb1!(k$yJdpQgaHtGJ+$9uWpBv)(jh8pEsQY z!M6dl-M>s#o`V zmvsw`Nv}|f-i&U=mso9SNV^J_lzE^v;Mw<#m!MJwNa=e~d3FDbHp3=`jLq0mMY$oREt7zaW%y*PF%m&RNW(PMD78dTmD=pCe9%X2nwv4W z6csZsrlMKZ9W((YhT1iK??k)mA*HI9VU+@0hE-~|m@%R#lV+a}ZF!}bRt*$BvM=%F z($W(~MHBlHfAm?k^QWs6&3_*xp~?Fhqb~f3y2sSZFuh|lwe89hKbL>al|=OfqYOC^ zu1C7sQS;TsQ#V)HFYHU!qdPeGtzW`NEzHPNIWegPfKNujF0ZBkf$J*9i49d1wTko9^q34xJ*w4W z`_Aj>i9cPRW`>ALE7$TzR2wzt_dhV-kD3R^9+>Yu5G&ZcRou$DXKeFk_;4$0A*%8n z<+5AN3yfLK7e&k}!^b4KTZ-?hL|7EfSDjEaUy&(IV{tdwoYWK%j6%aF9(yx5Wi}oC zVm@JGX4EY^9G?p=b)(EM0;w=Q_8@Sk8A06bW&|rf{V&}GzN2I~;{!^DGj_C2H}?mO zv>8G6Q!|1HyP0TKo?(;EIvFwA!4WE2T!0<_> zb;D;zy8$755y9wj%&!E5H1{x8kX z^rNJV<`TuFABgkC=m2CYhC3~2hxoSbNSQ*1X1%lOjF@8D=yeQm*TG`IlRu`K9{!4T zQvkApnAAd##op0#S1B9aPoa3D9VroSpb`a=jq)KDr#+x<=HxupS>jDf)rume7zl{x_m^D;%lkV#g#EWHi8y2?F zJ-F@6=%bB{RYm!4W6)C{JlXl0GDt&%7XbEVW0B~iW!mCx@R7kJnB;0WasTr`vu)x* zH^wDp$n7W;0O3jo0bHckj-ATj>UDuL+K4v8V>~_3OjLor(0D-zqb6REAV!obPbQ{i zaM`vEpF};<3zD%YqI7kC*xrm>VjSoNPM}Wda27aVF=dO&GN8!0(Ja{QatJTAN^t!d z)kj5hp0z!$RP@F_jR*Pq)(!rnj9sH&;Sk6au$0 zOR|{OJ*ZN%hp_D#^hZjL6;C|+S`Xvo5-CB}T7U=f6XW3{ie#)(ii#WmE}3Fh6xlRw zM|`!{#(Nw2D(sIweWR5b(qD{y+X-qhlfb8PjM%a7CE}D|7B&>CDf_cXO+&YOg3Jt? zqG5hLzDCMSoA3e)CfTW)8U`^n3W2iJhIcxN22?YHab)QqU=Tb-kZm71g{g;=dlPq2 zbJwB1wZQ|d!DR1m_J?z%T94w^w1dHkOEW)smDBekZ=gGaNh$PfY!>kfm{~3QZxN-{ z30@}CW71y?tw@1jZQD>S+U%*6hPFe9Wu5K`9U&!KuL1<#xVI!IoJe!nb*LU~v?Wkj zXRbW&;E$vTXdL?7ViB;(5^uj4^GFpxg9E`He;xvBH8d3zMCu=#KhP zzTZyfPxt|isFMq0hK4VY^7YLb`F=;4KjD@!0!sdgq470POXG{~3XXNT*^-?>$j~?) z$l?Fe=D9ZE>8MjPZ?@3og4hf$TJ0ah%k9mf>my8iAnEK<6 z>D7YTH4-W7S&tnG$8>=#cEuWjD6>kb=;kBQsR`l;xe2vGOJ$l0qtJ}65C69RRBmfW zp!qKnrD=f2W=G-)B1eP>Lb`X*{KuctHxuVn6NFwT&rjbAHc%@Jx0A0{nR;GfJ3{hm zW=NhinUc_mT(~~7NgeTJtkX}SU_rA>ejCShMQbUpu!Xg@& zTQNm(Q2hEOW#E+iyKw4@s-!us_>T#vX;q_nSf&;2TBOnnC`i8yFRAGzA6fMCfowH7 zCF@9uH2bGNu#;v6SZgK@`#^z4%Aokq*QW19^jq7BY~w93wgt2Re*%M`B)#-08KLtJ zc^<={dkoOgI*cD^`#g3xy&Tw78>0ZUY-m)DV*3wI zr(Z%aOs^ZxI2p;~jI}mZ5o8mQhelkzRX!Mhd<-UI8kzwd(ER5rQw&OKlV*_P85)oh ze>EA0B#xE3YInOIUn@zE7IK*uOpZs9Ol-6erv$X|M^2qT`kQ_rpNTWW&m5ak z#lX>efvo*fWlF0sNKb&XDFN{`{QRb!N#h_CQ&7F5B(^Km^8Ln=bf67kB3woDDpENN z@0^9>4C;teQI@1lDL(KkX`F;puVQASOzMH2H4*@{6<5IJuWb-f;PD{0Doe1pjsnxr zf7v26LuImH(^Jl%U;&zraMn<7asu32@Ab;E%n=vU6FxqxreYJG{w zGnRm1kkp%+b{$I=iy1;mW7iKPc~!ffI37vLkeW_1N0WeF(2G2+;V@}YmMma13V7?x z@)xs2%QFEI?byKwXACE3{yRd==@ezjMxdc4G?O<1&42y2d9%OQe;X-HV+b{>lE|2r zg$k%ZM^^AS`0xIuA4rHw%L18V+F!=GQJ$!VU;K1hFfpi-QEe(q+G+D0O=%S)x?CGr zqzI6TtzXR6VwmAWAZhtPSptnr?<69x1&&C&4lR(i;ZJ<0MvMJby@YpAK29@8l)j?< z5E7Lz!o}n41KC>AJ>exN1`P{|r)qB*@Q_r<#%Lve2oCFz#jA!8ucp}$8C0XBI4Piw zSQ2jhA@=mhkV=}oxB*cBtE9B(d6E-yrYATe)XfwD^q+Z6y+q<$THpv_6g2U%0Otqmr#t`=%)t8BS+4UnVx75)N_SX~E)~XvTiP+ZH#FB4m|1&ADaJ+b*m8JruLOI z(=>`7D5=Ck^d&Y`yORH6nIanB3Uw3Bxl^X!fBPbRFK#KNwWJP%?FgBV@$zaS5{Vl( zHASo_pj9-Sk<2PRtk}93e`#5OMkGzsB#hlkWBf5!P5wECvOy3MV$hBVj_n$M0kpFA zUP3dDZ)lwzHMOpAU6cRX${`Hm0@2F~T2Ps5?0h<3BWNMl)CX>ulcj0;Yp8B{1 zE&<~rgI3jA2pT!8npw(8q=r~JV0AV$4p+wa23Q2qe^@ZhZHI|f;h!+h4f+l@ni&+Y zp`l{aI)YEjv$nL}g;v%vKxjls)l1|^m41ozL~S5=HjI0Sj6BXU>mj6YrkU>|6?~Kp z$sxJSg%SkBhBJR!&q}1;pa!S-WlY%+X#Oj?sY#%8pdBAMvY_1GguaZoj;f&M1Pxsz zCZh)u>rW3P{t>-LaT1@TuW+w>VO~B@1#e$gEX6c#JMDcybDM|}G%XQgl~qiKF?;mx z!nBly=8;vhH9<7q2V#e~rvlR+7C91MN4Y7C{R``)%cdIc_2Hlp5l_RNdPifqIylSxo8Z_N}=Y5V!BL; zAYn$vKMa2vRiM{Y8RtrR)$?LGwXYut(y%mhx(Q3!m-9`g#LvH&&q}rM5|UsHGvvVN zp)Rv0HibHt5Bwn-J0Yq}o@TmA^-4V_7!YY!C5jl|huK{?`fNu5Eg@ zxDiZ8n9Y`D7f%x**_w{06Ywyu0B9zBhMF;{3!-`~gSgA|DycLovxxjRdxC+g=ZV|{ zqZgl8Eo5JB#(L{BrRgjAX}2`NRAeYL#{jYFgQdAPSz zFP3+p;dCYpiG-jbeKQ_!t&nhd8#GDEsF`D&J!V6%R{VGCMF%t?3~nK_#5mGy);7m) zwDm{Yi1B4Xvs1zuAtls67$Us}NpQ%+467XI&_hV7hLI0!NTa^R{jNt9u`KEA`64Gt z%y0n$%*e3en`K8d-%K4f#ArpGk*VR>Hw_Z7KGGz zF_x@(AgLOLX}%k-^#__l`%Nei*K!`M;n^YfOaIg;bdvm}Un~{&^d5m1$AAqwr@c5h zr0uAZ>uDUN#OiDTLDDOA>HzT6SH@1s3|0ILLL!x3yQ4@%_D81t_y-jXezrGDQ9Ly= zr0W@=f{mb$da&17GlqoQmSA%O|B>FNvsSVHjIR@#IgZbIHHp^HI?PfO|BRl_uI)fg zrgy}L^cDeVkECSBcsw<7&wVrof;H*Yu%X=uvQl-k`< zw;>|rt!VtqaRsx@2~FpQVIxZBoxDEGAZ`!iPJ)JeQ?~;rASS6rO`H@bx@w54M|;{R zh+$G;*;Y(FKWHXc0j;(0OT4HdqVV*K@#bl+C6z;&E?C9ve)?XUwL?2Qf&~gb>J@}Q z*r_hqGkTn-AQGux%n?1qG->`yNdWO;_$%Wd1fH;$Wd?Ib?T6U>#_KA6039oWW^5}g z0NlMzrv3a=2AieUB#J;mGc_Qgu?OjPc=Plq;JP!+c!!q0w@3jWJv8`NbV477x6!@O zNXgd^v^5Oza+so3&>E&K{SU*B?P8fBAfiFTJp3WJ|_(RBJHl0ac-M28J+J(`$#(zqKx zU*g+r8g*3nMK!3NP>ol|4QaY;YZuU>p(9O!R3-r?hw(&z#mv#ALN20w*Z&NWVl*jToBAeB@qi z@MgPMi=)%Dhm0gPUA>Al1GcD^oBgUsD{1Ey8gKuGivV zd+pIGNr@^m)YxK%8Dh<*9Y(4aY8+KYVROWxX7B|aHiEyWOKCTUHM> z5mW7~=DfbiZ-ZviCh>fmbVO*#zh1MX&>J9)U1o-#lnEUJz#KJ|7Nxp`PQa7;vdMA} zh91OZXKmsdJTyl6;K(t8iGnjjjlan3B^=&VY92$6N(e?VkXmHcw!j)KT-40eK`gpq zim7uDT!prob_~|4G4x0yGA66|a==O+dN1L`x0WsN2cJAJy<`8>f++>?3^V9z+s*_o*wy?;T17<%%*;Ls z()asM3sIy?_n2j;m!cd6(s}{stFiE;zJnR9)=IAp*Bo}6sR0Ge&aq_nXw^!@kA6w# znjH}vS?>|30OKMdG-&*FB!-#;H_(zi)s~l_G4=3ED9JEGHh~^h5q_rAkAIjG_%jj= z7ScXJaHsh$2(&Jv7r+`?;P6!YQ^t+aYT&;v@w@9G#P-z!N3_KbD}GLT z z$t%%&1T>6s%$X+*0RXwR3-eoU#GY8~K5W?c_S?Pt{{zrb B5XArh diff --git a/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md b/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md new file mode 100644 index 00000000..fac29f13 --- /dev/null +++ b/clients/cascades-tucson/session-logs/2026-07/2026-07-17-howard-roadmap-finish-line-refresh.md @@ -0,0 +1,117 @@ +# Cascades of Tucson — Roadmap additions + finish-line refresh + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Continued from the 7/15 technology-plan-final session (see that log's Update sections for +the live verification sweep and jodi.ramstack decommission). This session extended and then +fully refreshed the Cascades execution roadmap (`docs/REMAINING-WORK-PLAN.md`). + +First, per Howard's strategic direction, two new workstreams were added: **WS8 — M365 +collaboration migration (SharePoint / Teams) — HIPAA lockdown** (dept shares on CS-SERVER + +Synology move to SharePoint libraries with role-based permissions from the AD dept groups; +Teams/OneDrive; audit logging, retention, DLP, sensitivity labels, external sharing off; +covered by existing Business Premium licensing; sequenced after the domain-migration tail), +and **WS9 — ALIS online payment system** (Medtelligent vendor conversation, business-office +coordination with Jeff Bristol, BAA tracker tie-in, KPI dashboard tie-in). A matching row +was added to the CARF tech plan Area 2 (SharePoint/Teams move) and the plan PDF re-rendered. +An 18-question Medtelligent scoping doc was drafted at +`docs/proposals/alis-online-payments-scoping-2026-07-15.md`. + +Second, WS3 gained **step 3b**: nurse-station desktops NURSESTATION-PC + ASSISTNURSE-PC +(explicitly NOT the medtech laptops) get phone-parity shared login — any caregiver signs in +with their own `cascades\` username, gets ALIS via SSO and the same standardized desktop +shortcuts as the phones, delivered per-machine/all-users via the `CSC - Caregiver Workstation` +GPO. The canonical shortcut list must be captured from a phone home screen before building. + +Third, on Howard's directive ("update the plan/roadmap … getting them finished"), the whole +REMAINING-WORK-PLAN got a **FINISH-LINE PASS**: a refreshed header block folding in the 7/15 +live-verification results, jodi decommission, CARF plan finalization, Synology-sync correction, +and 21.5-hr block; per-workstream reconciliation (WS3 CA posture dates, WS4 relicensing math, +WS5 backup/image-staleness gate + pfSense ACB, WS6 live port/switch counts, WS9 drafted +status); and the sequence re-cut as a 10-step close-out order ending with a ticket-verify +pass with Howard. + +## Key Decisions + +- Verification discrepancies were folded into the internal ROADMAP but deliberately NOT into + the client-facing tech plan (Howard: "leave the rest alone and do not add"). +- Nurse-station scope limited to the two desktops; medtech laptops explicitly excluded. +- WS8 sequenced AFTER the domain-migration tail — don't build SharePoint permissions on the + pre-migration flat-share model; Synology backup-only flip follows the SharePoint move. +- WS9 marked parallelizable (vendor-driven); scoping questions drafted but NOT sent — Howard + declined an email-ready version for now. +- Relicensing recalculated: 29 suspended-Standard users remain vs only 4 free SPB seats — + seat-mix decision (full vs lighter licenses, ~$375–575/mo per CARF plan) required before + any license moves. +- Image/system-state backup (~10 days stale on 7/15) made an explicit GATE before the SSD swap. +- Tech plan PDF footer still shows stale 37.5 hrs (live 21.5) — left as-is per Howard + ("dont send this as a PDF"). + +## Problems Encountered + +- 3b was initially stamped "ADDED 2026-07-16" (date confusion mid-session); corrected to + 2026-07-15 during the refresh pass. +- (Carried from 7/15 log: `UID` readonly in Git-Bash, jodi mailbox already deprovisioned by + the suspended sub, rebase/push race with Mike's MacBook sync — all resolved there.) + +## Configuration Changes + +- `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` — WS8 + WS9 added; WS3 step 3b added; + FINISH-LINE refresh header; WS3/WS4/WS5/WS6/WS9 reconciled to live 7/15 state; sequence + re-cut to 10 steps. +- `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.md` + `.html` + + `.pdf` — Area 2 row added (SharePoint/Teams move); PDF re-rendered 436,003 bytes / 4 pages. +- `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md` — NEW: + 18 Medtelligent scoping questions in 5 groups + internal notes. + +## Credentials & Secrets + +- None new this session. + +## Infrastructure & Servers + +- Cascades M365 tenant `207fa277-e9d8-4eb7-ada1-1064d2221498`; SPB 45 enabled / 41 consumed; + suspended Business Standard 29 consumed (post-jodi). +- CA policies: off-network block `e35614e1` (enabled 2026-04-29; trusted IPs 72.211.21.217/32, + 184.191.143.62/32), sign-in frequency `7d491c7a`, allow-list `1b7fd025` (report-only, + test-scoped), compliance-block `ede985e2` DISABLED (do not re-enable). +- ALIS: cascadestucson.alisonline.com, communityId 622, SSO appId + `d5108493-cba8-4f08-90b6-1bb0bc09eb2a` (secret to 2028-05-06). +- UniFi live 7/15: 11 switches, 77 APs, voice VLAN 37 devices, 34 ports @100Mb + 5 AP uplinks + sub-gig. Controller 172.16.3.29:11443 site `va6iba3v`. +- MSP360: daily file backup current; image/system-state ~10 days stale (gate for SSD swap). +- pfSense AutoConfigBackup not enabled. + +## Commands & Outputs + +- Roadmap edits via Edit tool only this session; no external commands of note. + +## Pending / Incomplete Tasks + +1. **Juan Andrade offboarding — was due 2026-07-16 afternoon** (coord todo `80716a98`) — + VERIFY it happened; if not, do it now. +2. Break-glass accounts + FIDO2 + strip stranded PAA role (blocks the allow-list flip). +3. Caregiver lockdown go-live (WS3 1–8 incl. 3b; capture phone shortcut list onsite). +4. Relicense 29 suspended-Standard users (seat-mix decision first). +5. Image backup repair/confirm -> SSD swap window. +6. Domain-join tail (~10 machines) + dept drives + printer GPO. +7. Network tail (CSC ENT island, gig sweep) + audit-retention build. +8. WS8 SharePoint/Teams scoping (after WS1/2 tail). +9. WS9: send scoping questions to Medtelligent (drafted, not sent), cc Jeff Bristol. +10. Ticket-verify pass with Howard (#32194/#32230/#32254/#32319/#32342/#32370). +- Tech plan: "we will come back to the tech plan" (Howard); PDF footer hours stale by choice. + +## Reference Information + +- Roadmap: `clients/cascades-tucson/docs/REMAINING-WORK-PLAN.md` +- Tech plan: `clients/cascades-tucson/docs/proposals/cascades-technology-plan-2026-07-15.{md,html,pdf}` +- ALIS scoping: `clients/cascades-tucson/docs/proposals/alis-online-payments-scoping-2026-07-15.md` +- Prior log (verification + jodi decommission evidence): + `clients/cascades-tucson/session-logs/2026-07/2026-07-15-howard-technology-plan-final.md` +- Wiki commit from 7/15 recompile: `7e15257`; coord todo Juan Andrade: `80716a98` +- Syncro customer 20149445; prepaid block 21.5 hrs (live 7/15) diff --git a/errorlog.md b/errorlog.md index 4fa85f14..19a3505c 100644 --- a/errorlog.md +++ b/errorlog.md @@ -25,6 +25,8 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · 2026-07-16 | GURU-BEAST-ROG | syncro/comment | [friction] POST /tickets/{id}/comment response failed jq parse even after tr control-char strip; comment DID post (verified via GET) - check-first rule prevented duplicate [ctx: ticket=32557] +2026-07-16 | Howard-Home | rmm/bash-env | [friction] reused $TOKEN/$RMM from prior Bash call; env does not persist between Bash calls - must re-auth in same command [ctx: ref=CLAUDE.md shell-state rule] + 2026-07-15 | Howard-Home | msp360/backups | [correction] assumed LAB-SVR (Len's Auto) is a live machine needing attention; correct is LAB-SVR was RETIRED and replaced by LAB-SERVER — repeated correction from Howard 2026-07-15 | Howard-Home | cascades-verification | [correction] reported Synology-to-server sync as 'overstated/partial' from stale wiki (6/18 note); correct is: shared-folder syncs to the server ARE set up — Howard confirmed. Wiki Team Folder [PENDING] lines are stale