From 5e42821bc613f611637337cad975f8eec1ace9ab Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 16 Jun 2026 12:06:04 +0300
Subject: [PATCH 01/11] feat(eval): add -embed-url and -chat-url flags to
 answer-eval

Allows answer-eval to run against local inference endpoints (vLLM,
Ollama-compatible) without an OpenAI key. -embed-url overrides the
embedding client URL; -chat-url overrides both the synth and judge
chat client URL.

API-key guard relaxed: only errors when all of embed-url, chat-url,
and OPENAI_API_KEY are absent.
---
 cmd/cosift/main.go | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/cmd/cosift/main.go b/cmd/cosift/main.go
index 0a59a3c..3a2d5da 100644
--- a/cmd/cosift/main.go
+++ b/cmd/cosift/main.go
@@ -5484,6 +5484,8 @@ func runAnswerEval(ctx context.Context, args []string) error {
 	embModel := fs.String("embed-model", "text-embedding-3-small", "embedding model name")
 	embDim := fs.Int("embed-dim", 1536, "embedding dimensionality")
 	embCacheDir := fs.String("embed-cache", "./eval-embed-cache", "embedding cache dir (set empty to disable)")
+	embURL := fs.String("embed-url", "", "embedding endpoint URL (leave empty for OpenAI default)")
+	chatURL := fs.String("chat-url", "", "chat endpoint URL for synth+judge models")
 	answerChunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = default 320)")
 	answerChunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = default 64)")
 	dryRun := fs.Bool("dry-run", false, "build the harness + print the plan, but issue NO LLM calls")
@@ -5498,8 +5500,11 @@ func runAnswerEval(ctx context.Context, args []string) error {
 	if apiKey == "" {
 		apiKey = os.Getenv("OPENAI")
 	}
-	if apiKey == "" && !*dryRun {
-		return errors.New("OPENAI_API_KEY (or OPENAI) not set; pass -dry-run to inspect the plan without spending")
+	if apiKey == "" && *embURL == "" && *chatURL == "" && !*dryRun {
+		return errors.New("OPENAI_API_KEY (or OPENAI) not set; pass -embed-url/-chat-url for a local endpoint, or -dry-run to inspect")
+	}
+	if apiKey == "" {
+		apiKey = "local"
 	}
 
 	corpus, err := eval.LoadCorpus(*corpusPath)
@@ -5532,7 +5537,7 @@ func runAnswerEval(ctx context.Context, args []string) error {
 	}()
 
 	bm := index.NewBM25(st)
-	oai := embed.NewOpenAIClient(apiKey, "", *embModel, *embDim)
+	oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
 	var emb embed.Embedder = oai
 	if *embCacheDir != "" {
 		emb = embed.NewCachedEmbedder(oai, *embCacheDir)
@@ -5572,8 +5577,8 @@ func runAnswerEval(ctx context.Context, args []string) error {
 		}
 	}
 
-	chat := embed.NewOpenAIChat(apiKey, "", *synthModel)
-	judge := embed.NewOpenAIChat(apiKey, "", *judgeModel)
+	chat := embed.NewOpenAIChat(apiKey, *chatURL, *synthModel)
+	judge := embed.NewOpenAIChat(apiKey, *chatURL, *judgeModel)
 
 	srv := server.New(st).
 		WithVector(vi, emb).

From f9d3d0c132209316528116b31dec62cf938509bb Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Wed, 24 Jun 2026 17:08:52 +0300
Subject: [PATCH 02/11] feat: known-item /find, host-partition, observability +
 feedback, harvesters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Search quality:
- per-host inverted-index partition (SearchInHost) + backfill — site= O(site_docs)
- BM25 MaxScore pre-check; zero-overlap site boost; rerank cap for site=
- dynamic runtime allowlist (/admin/allow-domain) for organic HN/Reddit growth

New capabilities:
- /find: live resource federation (HuggingFace + GitHub + PyPI) with LLM planner
  — fixes known-item lookup the indexed corpus is weak at
- query logging (qlog middleware → JSONL, X-Cosift-Query-Id) + /admin/query-log
- feedback loop: POST /feedback {query_id,rating,reason} + /admin/feedback?summary=1
  (reward/penalize signal joined to the query log), per-client rate limited

Ingest:
- WET bulk import skips host-partition writes; crawler bulk-index fast path
- testdata/eval/queries-realworld.json — representative intent-spanning eval set

Tests: host_partition, dynamic_allowlist, querylog/tailLines, inject.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cmd/cosift/assets/chat.html                |  44 +-
 cmd/cosift/assets/landing.html             |   5 +
 cmd/cosift/backfill_host_postings.go       |  66 ++
 cmd/cosift/feedback.go                     | 211 ++++++
 cmd/cosift/find.go                         | 270 ++++++++
 cmd/cosift/main.go                         | 151 +++--
 cmd/cosift/pebble_serve.go                 | 625 ++++++++++++++++--
 cmd/cosift/querylog.go                     | 160 +++++
 cmd/cosift/querylog_test.go                |  49 ++
 docs/DIAGRAMS-contrib-network.md           | 734 +++++++++++++++++++++
 docs/PLAN-contrib-network.md               | 438 ++++++++++++
 docs/cosift-diagrams.pdf                   | Bin 0 -> 593106 bytes
 internal/crawler/crawler.go                |  92 ++-
 internal/crawler/dynamic_allowlist_test.go |  57 ++
 internal/crawler/store_iface.go            |   9 +
 internal/crawler/wet.go                    |  10 +-
 internal/embed/chat.go                     |  19 +-
 internal/index/host_partition_test.go      | 159 +++++
 internal/index/pebble_bm25.go              | 187 +++++-
 internal/store/pebble.go                   | 453 +++++++++++++
 testdata/eval/queries-realworld.json       |  36 +
 21 files changed, 3637 insertions(+), 138 deletions(-)
 create mode 100644 cmd/cosift/backfill_host_postings.go
 create mode 100644 cmd/cosift/feedback.go
 create mode 100644 cmd/cosift/find.go
 create mode 100644 cmd/cosift/querylog.go
 create mode 100644 cmd/cosift/querylog_test.go
 create mode 100644 docs/DIAGRAMS-contrib-network.md
 create mode 100644 docs/PLAN-contrib-network.md
 create mode 100644 docs/cosift-diagrams.pdf
 create mode 100644 internal/crawler/dynamic_allowlist_test.go
 create mode 100644 internal/index/host_partition_test.go
 create mode 100644 testdata/eval/queries-realworld.json

diff --git a/cmd/cosift/assets/chat.html b/cmd/cosift/assets/chat.html
index b8c1a0a..68a536a 100644
--- a/cmd/cosift/assets/chat.html
+++ b/cmd/cosift/assets/chat.html
@@ -213,6 +213,22 @@
   font-family: var(--mono); font-size: 11px;
   padding: 6px 8px; cursor: pointer;
 }
+.site-input-wrap {
+  display: flex; align-items: center; gap: 4px;
+  border: 1px solid var(--line); border-radius: 8px;
+  background: var(--bg-2); padding: 0 8px;
+}
+.site-input-label {
+  font-family: var(--mono); font-size: 10px; color: var(--ink-dim);
+  white-space: nowrap; user-select: none; flex-shrink: 0;
+}
+.site-input {
+  border: none; background: transparent; color: var(--ink);
+  font-family: var(--mono); font-size: 11px;
+  padding: 5px 0; width: 140px; min-width: 0;
+  outline: none;
+}
+.site-input::placeholder { color: var(--ink-dim); opacity: 0.6; }
 .send-btn {
   padding: 14px 22px;
   background: var(--accent); color: var(--accent-ink);
@@ -324,6 +340,10 @@ <h1>Chat with the corpus.</h1>
   <div class="composer-row">
     <textarea id="input" class="composer-input" rows="1" placeholder="Ask anything…" autofocus></textarea>
     <div class="composer-controls">
+      <div class="site-input-wrap" title="Restrict results to a specific domain, e.g. pilotprotocol.network or docs.example.com/api">
+        <span class="site-input-label">site:</span>
+        <input id="site-filter" class="site-input" type="text" placeholder="domain.com" autocomplete="off" spellcheck="false">
+      </div>
       <select id="mode" title="query = LLM-planned hybrid (default) · answer = direct RAG · research = multi-step planner">
         <option value="query" selected>query</option>
         <option value="answer">answer</option>
@@ -332,7 +352,7 @@ <h1>Chat with the corpus.</h1>
       <button id="send" class="send-btn">Send →</button>
     </div>
   </div>
-  <div class="composer-hint">Enter to send · Shift+Enter newline · /clear to reset</div>
+  <div class="composer-hint">Enter to send · Shift+Enter newline · /clear to reset · site:domain.com to scope</div>
 </div>
 
 <script>
@@ -349,9 +369,16 @@ <h1>Chat with the corpus.</h1>
   var inputEl = document.getElementById('input');
   var sendBtn = document.getElementById('send');
   var modeEl = document.getElementById('mode');
+  var siteEl = document.getElementById('site-filter');
   var emptyEl = document.getElementById('empty-state');
   var clearBtn = document.getElementById('clear-btn');
 
+  // Persist site filter across page loads
+  try { var _s = localStorage.getItem('cosift-site'); if (_s) siteEl.value = _s; } catch(e) {}
+  siteEl.addEventListener('change', function () {
+    try { localStorage.setItem('cosift-site', siteEl.value.trim()); } catch(e) {}
+  });
+
   function esc(s) { return String(s).replace(/[&<>"]/g, function(c){ return ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]); }); }
 
   function autoresize() {
@@ -519,7 +546,19 @@ <h1>Chat with the corpus.</h1>
       autoresize();
       return;
     }
-    appendMsg('user', q);
+
+    // Allow inline site:domain.com syntax — strip it from the query and
+    // populate the site filter input. e.g. "pilot tunnels site:pilotprotocol.network"
+    var siteMatch = q.match(/(?:^|\s)site:(\S+)/);
+    var site = siteEl.value.trim();
+    if (siteMatch) {
+      q = q.replace(siteMatch[0], ' ').trim();
+      site = siteMatch[1];
+      siteEl.value = site;
+      try { localStorage.setItem('cosift-site', site); } catch(e) {}
+    }
+
+    appendMsg('user', q + (site ? '  [site: ' + site + ']' : ''));
     inputEl.value = '';
     autoresize();
 
@@ -540,6 +579,7 @@ <h1>Chat with the corpus.</h1>
     // progress (planner sub-queries, per-expansion hit counts, judge
     // drops, synth tokens).
     var url = endpoint + '?q=' + encodeURIComponent(q) + '&k=5&stream=true';
+    if (site) url += '&site=' + encodeURIComponent(site);
 
     try {
       var resp = await fetch(url, { headers: { 'Accept': 'text/event-stream' } });
diff --git a/cmd/cosift/assets/landing.html b/cmd/cosift/assets/landing.html
index 9482b62..f11b1b4 100644
--- a/cmd/cosift/assets/landing.html
+++ b/cmd/cosift/assets/landing.html
@@ -340,6 +340,9 @@ <h2>Search the <em>live</em> <span class="accent">corpus.</span></h2>
         <button class="btn primary" type="submit">Search <span class="arr">→</span></button>
       </form>
       <div class="tryit-knobs">
+        <label>site
+          <input type="text" id="tryit-site" placeholder="domain.com" style="width:140px; font-family:monospace" title="Restrict results to a domain, e.g. pilotprotocol.network" autocomplete="off" spellcheck="false"/>
+        </label>
         <label>retriever
           <select id="tryit-retriever">
             <option value="bm25" selected>bm25</option>
@@ -561,6 +564,8 @@ <h2>Ask <em>anything.</em></h2>
     var p = new URLSearchParams();
     p.set('q', q);
     p.set('k', document.getElementById('tryit-k').value || '5');
+    var site = document.getElementById('tryit-site').value.trim();
+    if (site) p.set('site', site);
     var retr = document.getElementById('tryit-retriever').value;
     if (retr && retr !== 'bm25') p.set('retriever', retr);
     var mmr = document.getElementById('tryit-mmr').value;
diff --git a/cmd/cosift/backfill_host_postings.go b/cmd/cosift/backfill_host_postings.go
new file mode 100644
index 0000000..d168735
--- /dev/null
+++ b/cmd/cosift/backfill_host_postings.go
@@ -0,0 +1,66 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// runBackfillHostPostings rebuilds the 'P' host-partition family from existing
+// 'h' + 'p' data so site= queries can scan a single host's postings
+// (O(site_docs)) via SearchInHost instead of the global lists (O(corpus)).
+//
+// It re-uses the data already on disk — no re-tokenize, no embeddings — so it's
+// a one-time key reshuffle, typically ~1-2h on a multi-million-doc corpus. The
+// store opens read-write because it writes the new family, but it never touches
+// 'p'/'d'/'v', so it is safe to run alongside a live pebble-serve. After it
+// completes, set COSIFT_HOST_PARTITION_READ=1 on the server to route site=
+// queries to the partition (and COSIFT_HOST_PARTITION=1 to keep it fresh on
+// future crawls).
+//
+//	cosift backfill-host-postings -dir /home/ubuntu/cosift-data/pebble
+func runBackfillHostPostings(ctx context.Context, args []string) error {
+	fs := flag.NewFlagSet("backfill-host-postings", flag.ExitOnError)
+	dir := fs.String("dir", "", "PebbleStore directory (required; same dir as pebble-serve -dir)")
+	host := fs.String("host", "", "backfill only this host (fast 'g'-index path); empty = full corpus single-pass")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *dir == "" {
+		return fmt.Errorf("-dir required")
+	}
+
+	ps, err := store.OpenPebble(*dir)
+	if err != nil {
+		return fmt.Errorf("open store: %w", err)
+	}
+	defer ps.Close()
+
+	start := time.Now()
+	if *host != "" {
+		fmt.Fprintf(os.Stderr, "backfill-host-postings: targeted backfill for host %q (fast 'g'-index path)…\n", *host)
+	} else {
+		fmt.Fprintf(os.Stderr, "backfill-host-postings: full-corpus single-pass 'p'→'P'…\n")
+	}
+	last := start
+	written, err := ps.BackfillHostPostings(ctx, *host, func(n int64) {
+		now := time.Now()
+		if now.Sub(last) >= 5*time.Second {
+			rate := float64(n) / time.Since(start).Seconds()
+			fmt.Fprintf(os.Stderr, "  %d host postings written (%.0f/s, %s elapsed)\n",
+				n, rate, time.Since(start).Round(time.Second))
+			last = now
+		}
+	})
+	if err != nil {
+		return fmt.Errorf("backfill: %w (wrote %d before failing)", err, written)
+	}
+	fmt.Fprintf(os.Stderr, "backfill-host-postings: done — %d host postings in %s\n",
+		written, time.Since(start).Round(time.Second))
+	fmt.Fprintf(os.Stderr, "Next: set COSIFT_HOST_PARTITION_READ=1 (read) + COSIFT_HOST_PARTITION=1 (keep fresh) and restart pebble-serve.\n")
+	return nil
+}
diff --git a/cmd/cosift/feedback.go b/cmd/cosift/feedback.go
new file mode 100644
index 0000000..c7e1763
--- /dev/null
+++ b/cmd/cosift/feedback.go
@@ -0,0 +1,211 @@
+package main
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Feedback — the usefulness signal. A caller (human UI or, in the Pilot app, the
+// calling agent) rates an answer by the query_id we returned via the
+// X-Cosift-Query-Id header. Ratings are appended to a JSONL log and joined to
+// the query log by qid to form a labeled dataset: (query, latency, empty?, rating).
+//
+// rating: -1 (penalize / unhelpful), +1 (reward / helpful). 0 accepted as neutral.
+// Feedback is weak, abusable signal (the endpoint is public) — treat it as
+// aggregated evidence, never absolute truth. caller is logged for dedup/abuse.
+
+type feedbackRec struct {
+	TS      string `json:"ts"`
+	Qid     string `json:"qid"`
+	Rating  int    `json:"rating"`
+	Reason  string `json:"reason,omitempty"`
+	Caller  string `json:"caller,omitempty"`
+}
+
+// feedbackLogPath resolves the feedback log location: explicit env, else beside
+// the query log (so one COSIFT_QUERY_LOG setting enables both), else disabled.
+func feedbackLogPath() string {
+	if p := os.Getenv("COSIFT_FEEDBACK_LOG"); p != "" {
+		return p
+	}
+	if q := os.Getenv("COSIFT_QUERY_LOG"); q != "" {
+		return filepath.Join(filepath.Dir(q), "feedback-log.jsonl")
+	}
+	return ""
+}
+
+func (s *pebbleHTTP) writeFeedback(rec feedbackRec) {
+	if s.fbFile == nil {
+		return
+	}
+	b, err := json.Marshal(rec)
+	if err != nil {
+		return
+	}
+	s.fbMu.Lock()
+	defer s.fbMu.Unlock()
+	_, _ = s.fbFile.Write(append(b, '\n'))
+}
+
+// handleFeedback records a rating. Public (no admin token) like the query
+// endpoints — agents call it after using an answer. Body:
+// {"query_id":"...","rating":1,"reason":"..."}.
+func (s *pebbleHTTP) handleFeedback(w http.ResponseWriter, r *http.Request) {
+	if s.fbFile == nil {
+		writeProblem(w, http.StatusNotImplemented, "feedback disabled (COSIFT_QUERY_LOG/COSIFT_FEEDBACK_LOG unset)")
+		return
+	}
+	// Per-client rate limit (feedback is public/unauthed and abusable). Keyed on
+	// the real client via XFF, not the Caddy peer.
+	clientIP := r.Header.Get("X-Forwarded-For")
+	if i := strings.IndexByte(clientIP, ','); i >= 0 {
+		clientIP = clientIP[:i]
+	}
+	clientIP = strings.TrimSpace(clientIP)
+	if clientIP == "" {
+		clientIP = stripPort(r.RemoteAddr)
+	}
+	if s.fbRL != nil && !s.fbRL.allow(clientIP) {
+		w.Header().Set("Retry-After", "60")
+		writeProblem(w, http.StatusTooManyRequests, "feedback rate limit exceeded")
+		return
+	}
+	var req struct {
+		QueryID string `json:"query_id"`
+		Rating  int    `json:"rating"`
+		Reason  string `json:"reason"`
+	}
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 16<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.QueryID == "" {
+		writeProblem(w, http.StatusBadRequest, `expected {"query_id":"...","rating":-1|0|1,"reason":"..."}`)
+		return
+	}
+	if req.Rating < -1 || req.Rating > 1 {
+		writeProblem(w, http.StatusBadRequest, "rating must be -1, 0, or 1")
+		return
+	}
+	if len(req.Reason) > 1000 {
+		req.Reason = req.Reason[:1000]
+	}
+	s.writeFeedback(feedbackRec{
+		TS:     time.Now().UTC().Format(time.RFC3339),
+		Qid:    req.QueryID,
+		Rating: req.Rating,
+		Reason: req.Reason,
+		Caller: clientIP,
+	})
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "query_id": req.QueryID, "rating": req.Rating})
+}
+
+// handleFeedbackList returns recent feedback (?n=N) or, with ?summary=1, an
+// aggregate that's immediately consumable: per-endpoint and overall
+// reward/penalty tallies joined to the query log by qid. This is the "make it
+// useful" surface — the labeled signal without an external pipeline.
+func (s *pebbleHTTP) handleFeedbackList(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		if r.Header.Get("Authorization") != "Bearer "+want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	fp := feedbackLogPath()
+	if fp == "" {
+		writeProblem(w, http.StatusNotImplemented, "feedback disabled")
+		return
+	}
+	if r.URL.Query().Get("summary") == "1" {
+		writeJSON(w, http.StatusOK, s.feedbackSummary(fp))
+		return
+	}
+	n := 100
+	if v := r.URL.Query().Get("n"); v != "" {
+		if k, err := strconv.Atoi(v); err == nil && k >= 1 && k <= 5000 {
+			n = k
+		}
+	}
+	lines := tailLines(fp, n)
+	recs := make([]json.RawMessage, 0, len(lines))
+	for _, ln := range lines {
+		recs = append(recs, json.RawMessage(ln))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"count": len(recs), "entries": recs})
+}
+
+// feedbackSummary joins feedback ⋈ query-log on qid and tallies the signal:
+// total +/- by endpoint, plus the worst-rated recent queries (the penalize
+// targets). This is the consumable form of the reward/penalty signal.
+func (s *pebbleHTTP) feedbackSummary(fbPath string) map[string]any {
+	// qid -> query text (from the query log, recent window).
+	qtext := map[string]string{}
+	qep := map[string]string{}
+	for _, ln := range tailLines(os.Getenv("COSIFT_QUERY_LOG"), 20000) {
+		var qr queryLogRec
+		if json.Unmarshal([]byte(ln), &qr) == nil && qr.Qid != "" {
+			qtext[qr.Qid] = qr.Q
+			qep[qr.Qid] = qr.Ep
+		}
+	}
+	type tally struct{ Up, Down int }
+	byEp := map[string]*tally{}
+	byQuery := map[string]*tally{}
+	var up, down int
+	for _, ln := range tailLines(fbPath, 50000) {
+		var fr feedbackRec
+		if json.Unmarshal([]byte(ln), &fr) != nil {
+			continue
+		}
+		ep := qep[fr.Qid]
+		if ep == "" {
+			ep = "(unknown)"
+		}
+		if byEp[ep] == nil {
+			byEp[ep] = &tally{}
+		}
+		q := qtext[fr.Qid]
+		if q != "" {
+			if byQuery[q] == nil {
+				byQuery[q] = &tally{}
+			}
+		}
+		switch {
+		case fr.Rating > 0:
+			up++
+			byEp[ep].Up++
+			if q != "" {
+				byQuery[q].Up++
+			}
+		case fr.Rating < 0:
+			down++
+			byEp[ep].Down++
+			if q != "" {
+				byQuery[q].Down++
+			}
+		}
+	}
+	// Worst-rated queries = penalize targets (net negative).
+	type qScore struct {
+		Query string `json:"query"`
+		Up    int    `json:"up"`
+		Down  int    `json:"down"`
+		Net   int    `json:"net"`
+	}
+	var worst []qScore
+	for q, t := range byQuery {
+		net := t.Up - t.Down
+		if net < 0 {
+			worst = append(worst, qScore{Query: q, Up: t.Up, Down: t.Down, Net: net})
+		}
+	}
+	return map[string]any{
+		"total_up":     up,
+		"total_down":   down,
+		"by_endpoint":  byEp,
+		"penalize_top": worst, // queries with net-negative feedback
+	}
+}
diff --git a/cmd/cosift/find.go b/cmd/cosift/find.go
new file mode 100644
index 0000000..0e3c05d
--- /dev/null
+++ b/cmd/cosift/find.go
@@ -0,0 +1,270 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/embed"
+)
+
+// /find is the live resource-federation endpoint. Where /search and /research
+// query the INDEXED corpus (great for exploration, weak for known-item lookup),
+// /find federates LIVE queries to the authoritative source APIs — HuggingFace
+// Hub, GitHub, and PyPI — at request time, then synthesizes a cited answer with
+// real identifiers (HF model id, pip package, GitHub repo) and install commands.
+//
+// Rationale: a search engine over a sampled corpus can't beat hitting the source
+// index for "find me the specific installable thing for platform X". This closes
+// that gap by doing what a human does with WebFetch, in one call.
+
+type findHit struct {
+	Source  string `json:"source"` // huggingface | github | pypi
+	Title   string `json:"title"`
+	URL     string `json:"url"`
+	Summary string `json:"summary"`
+	Meta    string `json:"meta"` // "41 likes" | "3249 stars" | "v1.1.0"
+	rank    int    // source-local popularity for ordering
+}
+
+func findHTTPGet(ctx context.Context, u string, hdr map[string]string) ([]byte, int, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, http.NoBody)
+	if err != nil {
+		return nil, 0, err
+	}
+	req.Header.Set("User-Agent", "cosift-find/1.0")
+	for k, v := range hdr {
+		req.Header.Set(k, v)
+	}
+	resp, err := (&http.Client{Timeout: 20 * time.Second}).Do(req)
+	if err != nil {
+		return nil, 0, err
+	}
+	defer resp.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	return b, resp.StatusCode, err
+}
+
+// federateHF queries the HF Hub search API across models, datasets, and spaces.
+func federateHF(ctx context.Context, q string) []findHit {
+	var out []findHit
+	kinds := []struct{ api, prefix string }{
+		{"models", "/"}, {"datasets", "/datasets/"}, {"spaces", "/spaces/"},
+	}
+	for _, k := range kinds {
+		u := fmt.Sprintf("https://huggingface.co/api/%s?search=%s&limit=5&sort=likes&direction=-1",
+			k.api, url.QueryEscape(q))
+		b, code, err := findHTTPGet(ctx, u, nil)
+		if err != nil || code != 200 {
+			continue
+		}
+		var items []struct {
+			ID       string `json:"id"`
+			Likes    int    `json:"likes"`
+			Downloads int   `json:"downloads"`
+		}
+		if json.Unmarshal(b, &items) != nil {
+			continue
+		}
+		for _, it := range items {
+			if it.ID == "" {
+				continue
+			}
+			out = append(out, findHit{
+				Source: "huggingface", Title: it.ID,
+				URL:  "https://huggingface.co" + k.prefix + it.ID,
+				Meta: fmt.Sprintf("%d likes, %d dl (%s)", it.Likes, it.Downloads, k.api),
+				rank: it.Likes,
+			})
+		}
+	}
+	return out
+}
+
+// federateGitHub queries the GitHub repo search API (by relevance/stars).
+func federateGitHub(ctx context.Context, q string) []findHit {
+	u := "https://api.github.com/search/repositories?q=" + url.QueryEscape(q) + "&sort=stars&order=desc&per_page=6"
+	b, code, err := findHTTPGet(ctx, u, map[string]string{"Accept": "application/vnd.github+json"})
+	if err != nil || code != 200 {
+		return nil
+	}
+	var res struct {
+		Items []struct {
+			FullName string `json:"full_name"`
+			HTMLURL  string `json:"html_url"`
+			Desc     string `json:"description"`
+			Stars    int    `json:"stargazers_count"`
+			Lang     string `json:"language"`
+		} `json:"items"`
+	}
+	if json.Unmarshal(b, &res) != nil {
+		return nil
+	}
+	var out []findHit
+	for _, it := range res.Items {
+		out = append(out, findHit{
+			Source: "github", Title: it.FullName, URL: it.HTMLURL,
+			Summary: it.Desc, Meta: fmt.Sprintf("%d stars, %s", it.Stars, it.Lang),
+			rank: it.Stars,
+		})
+	}
+	return out
+}
+
+var pypiNameRe = regexp.MustCompile(`package-snippet__name">([^<]+)<`)
+var pypiDescRe = regexp.MustCompile(`package-snippet__description">([^<]*)<`)
+var pypiVerRe = regexp.MustCompile(`package-snippet__version">([^<]+)<`)
+
+// federatePyPI parses the PyPI search results page (PyPI retired its search API,
+// but the HTML results page is stable and parseable). Best-effort.
+func federatePyPI(ctx context.Context, q string) []findHit {
+	u := "https://pypi.org/search/?q=" + url.QueryEscape(q)
+	b, code, err := findHTTPGet(ctx, u, nil)
+	if err != nil || code != 200 {
+		return nil
+	}
+	html := string(b)
+	names := pypiNameRe.FindAllStringSubmatch(html, 8)
+	descs := pypiDescRe.FindAllStringSubmatch(html, 8)
+	vers := pypiVerRe.FindAllStringSubmatch(html, 8)
+	var out []findHit
+	for i, n := range names {
+		name := strings.TrimSpace(n[1])
+		if name == "" {
+			continue
+		}
+		h := findHit{
+			Source: "pypi", Title: name,
+			URL: "https://pypi.org/project/" + name + "/",
+		}
+		if i < len(descs) {
+			h.Summary = strings.TrimSpace(descs[i][1])
+		}
+		if i < len(vers) {
+			h.Meta = strings.TrimSpace(vers[i][1])
+		}
+		out = append(out, h)
+	}
+	return out
+}
+
+const findSynthPrompt = `You are a technical resource finder for ML/software engineering. The user wants SPECIFIC, installable resources. Using ONLY the candidate resources provided (from HuggingFace, GitHub, and PyPI), recommend the most relevant ones.
+- Give EXACT identifiers: HF model/dataset id, pip package name, GitHub repo (owner/name).
+- Give the install/download command where applicable: ` + "`pip install <pkg>`" + `, ` + "`hf_hub_download(...)`" + `, ` + "`git clone`" + `.
+- If the user named a platform (e.g. Jetson/aarch64/JetPack), note compatibility ONLY if a source states it; otherwise say it must be verified on the resource's page.
+- Cite every recommendation by its numeric id, e.g. [2]. Do not invent resources or claims not in the sources.
+- Be concise and actionable: lead with the top 2-3 picks.`
+
+const findPlanPrompt = `Convert the user's resource request into 1-4 SHORT search phrases (2-4 words each) for searching model/package/repo catalogs (HuggingFace, GitHub, PyPI). These catalogs do AND-style matching, so long natural-language queries return nothing — extract the core nouns. Each phrase should target ONE resource the user needs (e.g. a detector, an OCR backend, a classifier). Drop platform/qualifier words (jetson, aarch64, model, library). Output ONLY a JSON array of strings. Example: ["license plate detection", "license plate OCR", "vehicle classifier"]`
+
+func (s *pebbleHTTP) handleFind(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	start := time.Now()
+
+	// Distill the NL request into short keyword phrases — the source search
+	// APIs AND-match, so a verbose query ("YOLOv8 LPR model for Jetson aarch64")
+	// returns zero, but "license plate detection" returns the right models.
+	phrases := []string{q}
+	if s.chat != nil {
+		if raw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+			{Role: "system", Content: findPlanPrompt},
+			{Role: "user", Content: q},
+		}); err == nil {
+			if p := parseSubQueries(raw, q); len(p) > 0 {
+				phrases = p
+			}
+		}
+	}
+	if len(phrases) > 4 {
+		phrases = phrases[:4]
+	}
+
+	// Federate each phrase across all three sources in parallel; each call
+	// degrades to empty on failure (e.g. GitHub rate-limit) so the others
+	// still answer. Dedup by URL afterward.
+	var mu sync.Mutex
+	var hits []findHit
+	var wg sync.WaitGroup
+	for _, ph := range phrases {
+		for _, fn := range []func(context.Context, string) []findHit{federateHF, federateGitHub, federatePyPI} {
+			ph, fn := ph, fn
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				h := fn(r.Context(), ph)
+				mu.Lock()
+				hits = append(hits, h...)
+				mu.Unlock()
+			}()
+		}
+	}
+	wg.Wait()
+
+	// Order: source-local popularity desc, grouped so the synth sees the
+	// strongest candidates first.
+	sort.SliceStable(hits, func(i, j int) bool { return hits[i].rank > hits[j].rank })
+
+	// Dedup by URL (keeps the highest-ranked occurrence since we sorted first),
+	// then cap the pool fed to synthesis.
+	seen := make(map[string]bool, len(hits))
+	deduped := hits[:0]
+	for _, h := range hits {
+		if h.URL == "" || seen[h.URL] {
+			continue
+		}
+		seen[h.URL] = true
+		deduped = append(deduped, h)
+	}
+	hits = deduped
+	const maxFindHits = 24
+	if len(hits) > maxFindHits {
+		hits = hits[:maxFindHits]
+	}
+
+	if len(hits) == 0 {
+		writeJSON(w, http.StatusOK, map[string]any{
+			"query": q, "sources": []findHit{}, "answer": "",
+			"note": "no resources found via HuggingFace/GitHub/PyPI federation",
+			"took": time.Since(start).String(),
+		})
+		return
+	}
+
+	// Build the cited sources block + synthesize (when chat is configured).
+	var sb strings.Builder
+	for i, h := range hits {
+		fmt.Fprintf(&sb, "[%d] (%s) %s — %s\n    %s%s\n", i+1, h.Source, h.Title, h.URL,
+			h.Summary, func() string {
+				if h.Meta != "" {
+					return " (" + h.Meta + ")"
+				}
+				return ""
+			}())
+	}
+	answer := ""
+	if s.chat != nil {
+		out, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+			{Role: "system", Content: findSynthPrompt},
+			{Role: "user", Content: "Request: " + q + "\n\nCandidate resources:\n" + sb.String()},
+		})
+		if err == nil {
+			answer = out
+		}
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"query": q, "answer": answer, "sources": hits,
+		"count": len(hits), "took": time.Since(start).String(),
+	})
+}
diff --git a/cmd/cosift/main.go b/cmd/cosift/main.go
index 3a2d5da..cf170be 100644
--- a/cmd/cosift/main.go
+++ b/cmd/cosift/main.go
@@ -342,6 +342,10 @@ func run(cfgPath string) error {
 		if err := runPurgeDomain(ctx, flag.Args()[1:]); err != nil {
 			return fmt.Errorf("purge-domain: %w", err)
 		}
+	case "backfill-host-postings":
+		if err := runBackfillHostPostings(ctx, flag.Args()[1:]); err != nil {
+			return fmt.Errorf("backfill-host-postings: %w", err)
+		}
 	case "verify":
 		if err := runVerifyPebble(ctx, cfg, flag.Args()[1:]); err != nil {
 			return fmt.Errorf("verify: %w", err)
@@ -5492,6 +5496,7 @@ func runAnswerEval(ctx context.Context, args []string) error {
 	useRerank := fs.Bool("rerank", false, "wire the LLM listwise reranker into the in-process server; tests whether rerank cuts the grounding=1 cases on single-doc")
 	rerankModel := fs.String("rerank-model", "gpt-4o-mini", "chat model for the reranker (kept default = synth-model so cost stays predictable)")
 	synthK := fs.Int("synth-k", 0, "cap synth-source count via WithDefaults({ResearchSynthK: N}); 0 = preserve built-in default (10). tests whether K=5 trades coverage for grounding on single-doc workloads.")
+	serverURL := fs.String("server", "", "live server base URL (e.g. https://cosift.pilotprotocol.network); skips in-process build, corpus+embed flags ignored")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
@@ -5507,17 +5512,18 @@ func runAnswerEval(ctx context.Context, args []string) error {
 		apiKey = "local"
 	}
 
-	corpus, err := eval.LoadCorpus(*corpusPath)
-	if err != nil {
-		return fmt.Errorf("load corpus: %w", err)
-	}
 	qs, err := eval.LoadQuerySet(*queriesPath)
 	if err != nil {
 		return fmt.Errorf("load queries: %w", err)
 	}
 
+	liveMode := *serverURL != ""
 	fmt.Printf("answer-eval: %d queries × 2 strategies × judge calls\n", len(qs.Queries))
-	fmt.Printf("synth model = %s   judge model = %s   rerank = %v   synth_k = %d   dry-run = %v\n", *synthModel, *judgeModel, *useRerank, *synthK, *dryRun)
+	if liveMode {
+		fmt.Printf("server = %s   judge model = %s   dry-run = %v\n", *serverURL, *judgeModel, *dryRun)
+	} else {
+		fmt.Printf("synth model = %s   judge model = %s   rerank = %v   synth_k = %d   dry-run = %v\n", *synthModel, *judgeModel, *useRerank, *synthK, *dryRun)
+	}
 	if *dryRun {
 		for _, q := range qs.Queries {
 			fmt.Printf("  - %s  (relevant: %d docs)\n", q.Text, len(q.Relevant))
@@ -5525,78 +5531,91 @@ func runAnswerEval(ctx context.Context, args []string) error {
 		return nil
 	}
 
-	// Build an ephemeral store + indexes (in-memory style, but SQLite needs a dir).
-	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-answer-eval-%d", time.Now().UnixNano()))
-	st, err := store.Open(tmpDir)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		st.Close()
-		_ = os.RemoveAll(tmpDir)
-	}()
+	// researchBaseURL is the base for /research calls — either live server or httptest.
+	var researchBaseURL string
+	judge := embed.NewOpenAIChat(apiKey, *chatURL, *judgeModel)
 
-	bm := index.NewBM25(st)
-	oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
-	var emb embed.Embedder = oai
-	if *embCacheDir != "" {
-		emb = embed.NewCachedEmbedder(oai, *embCacheDir)
-	}
-	chunker := chunkerWith(*answerChunkSize, *answerChunkOverlap)
-	var allTexts []string
-	for _, d := range corpus.Docs {
-		id, err := st.UpsertDocument(ctx, &store.Document{
-			URL: d.URL, Title: d.Title, Text: d.Text, Source: "answer-eval", FetchedAt: time.Now(),
-		})
+	if liveMode {
+		researchBaseURL = strings.TrimRight(*serverURL, "/")
+	} else {
+		corpus, err := eval.LoadCorpus(*corpusPath)
 		if err != nil {
-			return err
+			return fmt.Errorf("load corpus: %w", err)
 		}
-		if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
+
+		// Build an ephemeral store + indexes (in-memory style, but SQLite needs a dir).
+		tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-answer-eval-%d", time.Now().UnixNano()))
+		st, err := store.Open(tmpDir)
+		if err != nil {
 			return err
 		}
-		text := d.Title + "\n\n" + d.Text
-		for _, c := range chunker.Chunk(text) {
-			allTexts = append(allTexts, c.Text)
+		defer func() {
+			st.Close()
+			_ = os.RemoveAll(tmpDir)
+		}()
+
+		bm := index.NewBM25(st)
+		oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
+		var emb embed.Embedder = oai
+		if *embCacheDir != "" {
+			emb = embed.NewCachedEmbedder(oai, *embCacheDir)
 		}
-	}
-	fmt.Printf("embedding %d passages across %d docs...\n", len(allTexts), len(corpus.Docs))
-	vecs, err := batchEmbed(ctx, emb, allTexts, 256)
-	if err != nil {
-		return fmt.Errorf("embed: %w", err)
-	}
-	vi := index.NewVectorIndex(*embDim)
-	idx := 0
-	for _, d := range corpus.Docs {
-		text := d.Title + "\n\n" + d.Text
-		for _, c := range chunker.Chunk(text) {
-			if idx >= len(vecs) {
-				break
+		chunker := chunkerWith(*answerChunkSize, *answerChunkOverlap)
+		var allTexts []string
+		for _, d := range corpus.Docs {
+			id, err := st.UpsertDocument(ctx, &store.Document{
+				URL: d.URL, Title: d.Title, Text: d.Text, Source: "answer-eval", FetchedAt: time.Now(),
+			})
+			if err != nil {
+				return err
+			}
+			if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
+				return err
+			}
+			text := d.Title + "\n\n" + d.Text
+			for _, c := range chunker.Chunk(text) {
+				allTexts = append(allTexts, c.Text)
+			}
+		}
+		fmt.Printf("embedding %d passages across %d docs...\n", len(allTexts), len(corpus.Docs))
+		vecs, err := batchEmbed(ctx, emb, allTexts, 256)
+		if err != nil {
+			return fmt.Errorf("embed: %w", err)
+		}
+		vi := index.NewVectorIndex(*embDim)
+		idx := 0
+		for _, d := range corpus.Docs {
+			text := d.Title + "\n\n" + d.Text
+			for _, c := range chunker.Chunk(text) {
+				if idx >= len(vecs) {
+					break
+				}
+				vi.AddPassage(d.URL, d.Title, c.Offset, c.Length, vecs[idx])
+				idx++
 			}
-			vi.AddPassage(d.URL, d.Title, c.Offset, c.Length, vecs[idx])
-			idx++
 		}
-	}
 
-	chat := embed.NewOpenAIChat(apiKey, *chatURL, *synthModel)
-	judge := embed.NewOpenAIChat(apiKey, *chatURL, *judgeModel)
+		chat := embed.NewOpenAIChat(apiKey, *chatURL, *synthModel)
 
-	srv := server.New(st).
-		WithVector(vi, emb).
-		WithChat(chat).
-		WithParaphraser(chat, 2).
-		WithLLMLimiter(0, 0) // disable rate limiter — this is an in-process eval, not a public endpoint. caught this when the 10/min default 429'd after 5 queries.
-	if *useRerank {
-		rerankChat := chat
-		if *rerankModel != *synthModel {
-			rerankChat = embed.NewOpenAIChat(apiKey, "", *rerankModel)
+		srv := server.New(st).
+			WithVector(vi, emb).
+			WithChat(chat).
+			WithParaphraser(chat, 2).
+			WithLLMLimiter(0, 0) // disable rate limiter — this is an in-process eval, not a public endpoint. caught this when the 10/min default 429'd after 5 queries.
+		if *useRerank {
+			rerankChat := chat
+			if *rerankModel != *synthModel {
+				rerankChat = embed.NewOpenAIChat(apiKey, "", *rerankModel)
+			}
+			srv = srv.WithReranker(rerank.NewLLMReranker(rerankChat), 20)
 		}
-		srv = srv.WithReranker(rerank.NewLLMReranker(rerankChat), 20)
-	}
-	if *synthK > 0 {
-		srv = srv.WithDefaults(server.Defaults{ResearchSynthK: *synthK})
+		if *synthK > 0 {
+			srv = srv.WithDefaults(server.Defaults{ResearchSynthK: *synthK})
+		}
+		httpSrv := httptest.NewServer(srv.Handler())
+		defer httpSrv.Close()
+		researchBaseURL = httpSrv.URL
 	}
-	httpSrv := httptest.NewServer(srv.Handler())
-	defer httpSrv.Close()
 
 	type strategyReport struct {
 		Strategy     string   `json:"strategy"`
@@ -5621,7 +5640,7 @@ func runAnswerEval(ctx context.Context, args []string) error {
 
 		for _, strategy := range []string{"planner", "paraphrase"} {
 			// /research call.
-			u := httpSrv.URL + "/research?strategy=" + strategy + "&q=" + url.QueryEscape(q.Text)
+			u := researchBaseURL + "/research?strategy=" + strategy + "&q=" + url.QueryEscape(q.Text)
 			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, http.NoBody)
 			resp, err := httpClient.Do(req)
 			if err != nil {
diff --git a/cmd/cosift/pebble_serve.go b/cmd/cosift/pebble_serve.go
index 6d231bd..01d7156 100644
--- a/cmd/cosift/pebble_serve.go
+++ b/cmd/cosift/pebble_serve.go
@@ -323,6 +323,36 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 		time.Duration(envIntDefault("COSIFT_ANSWER_CACHE_TTL_SEC", 60))*time.Second,
 		envIntDefault("COSIFT_ANSWER_CACHE_CAP", 1024),
 	)
+	srv.researchCache = answercache.New(
+		time.Duration(envIntDefault("COSIFT_RESEARCH_CACHE_TTL_SEC", 600))*time.Second,
+		envIntDefault("COSIFT_RESEARCH_CACHE_CAP", 256),
+	)
+	// Query log (observability). COSIFT_QUERY_LOG=/path enables JSONL append
+	// of every query-endpoint request. Disabled if unset.
+	if qp := os.Getenv("COSIFT_QUERY_LOG"); qp != "" {
+		if f, err := os.OpenFile(qp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
+			srv.qlogFile = f
+			log.Printf("pebble-serve: query log enabled → %s", qp)
+		} else {
+			log.Printf("pebble-serve: query log open failed (%s): %v", qp, err)
+		}
+	}
+	// Feedback rate limiter — always on (stricter than global). Per-client via
+	// XFF. Override COSIFT_FEEDBACK_RPM / _BURST.
+	srv.fbRL = &rateLimiter{
+		rpm:       float64(envIntDefault("COSIFT_FEEDBACK_RPM", 20)),
+		burst:     float64(envIntDefault("COSIFT_FEEDBACK_BURST", 5)),
+		whitelist: map[string]bool{},
+	}
+	// Feedback log. COSIFT_FEEDBACK_LOG=/path, or defaults beside the query log.
+	if fp := feedbackLogPath(); fp != "" {
+		if f, err := os.OpenFile(fp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
+			srv.fbFile = f
+			log.Printf("pebble-serve: feedback log enabled → %s", fp)
+		} else {
+			log.Printf("pebble-serve: feedback log open failed (%s): %v", fp, err)
+		}
+	}
 	// Tries the vLLM /metrics endpoint at the chat origin (works for
 	// self-hosted vLLM, no-op against OpenAI). Threshold default 8 — that
 	// matches the answer-pool cap so when the chat backend is already
@@ -468,6 +498,9 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 		log.Printf("pebble-serve: rate limit active (rpm=%.0f burst=%.0f whitelist=%v)", srv.rl.rpm, srv.rl.burst, srv.rl.whitelistList())
 	}
 	wrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(h)) }
+	// qwrap adds query logging (innermost, so it sees the real status+bytes) for
+	// the user-facing query endpoints — the observability substrate we lacked.
+	qwrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(srv.qlog(h))) }
 	// landing page at / and OpenAPI 3.1 spec at /openapi.json.
 	// Both embedded into the binary at build time — operators get a single
 	// self-contained executable, no separate static-asset deployment.
@@ -482,6 +515,7 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	mux.HandleFunc("GET /docs", wrap(srv.handleSwaggerUI))
 	mux.HandleFunc("GET /docs/{file...}", wrap(srv.handleSwaggerAsset))
 	mux.HandleFunc("GET /healthz", wrap(srv.handleHealthz))
+	mux.HandleFunc("GET /find", qwrap(srv.handleFind))
 	mux.HandleFunc("GET /stats", wrap(srv.handleStats))
 	mux.HandleFunc("GET /domains", wrap(srv.handleDomains))
 	// frontier queue visibility — counts by status + top-N
@@ -491,6 +525,7 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	// this; it's just unused. Authenticated by cfg.Cluster.PeerAuthToken
 	// (Bearer); when token is empty, requests from any source are accepted.
 	mux.HandleFunc("POST /admin/crawl-enqueue", wrap(srv.handleCrawlEnqueue))
+	mux.HandleFunc("POST /admin/allow-domain", wrap(srv.handleAllowDomain))
 	mux.HandleFunc("POST /admin/frontier-purge-host", wrap(srv.handleFrontierPurgeHost))
 	mux.HandleFunc("POST /admin/frontier-clear", wrap(srv.handleFrontierClear))
 	mux.HandleFunc("POST /admin/frontier-demote-host", wrap(srv.handleFrontierDemoteHost))
@@ -502,13 +537,15 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	mux.HandleFunc("POST /admin/site-pack", wrap(srv.handleSitePack))
 	mux.HandleFunc("POST /admin/site-submit", wrap(srv.handleSiteSubmit))
 	mux.HandleFunc("POST /admin/embed-backfill", wrap(srv.handleEmbedBackfill))
+	mux.HandleFunc("POST /admin/host-backfill", wrap(srv.handleHostBackfill))
 	mux.HandleFunc("GET /admin/eval-quick", wrap(srv.handleEvalQuick))
 	mux.HandleFunc("POST /admin/hnsw-compact", wrap(srv.handleHNSWCompact))
-	mux.HandleFunc("GET /query", wrap(srv.handleQuery))
-	mux.HandleFunc("POST /query", wrap(srv.handleQuery))
+	mux.HandleFunc("GET /query", qwrap(srv.handleQuery))
+	mux.HandleFunc("POST /query", qwrap(srv.handleQuery))
 	// import a sitemap.xml (or sitemap-index) and push every
 	// listed URL into the live frontier.
 	mux.HandleFunc("POST /admin/sitemap-import", wrap(srv.handleSitemapImport))
+	mux.HandleFunc("POST /admin/recrawl-sitemap", wrap(srv.handleRecrawlSitemap))
 	// PQ training admin endpoint. Same auth as crawl-enqueue
 	// (Bearer cfg.Cluster.PeerAuthToken). Runs synchronously — for the
 	// 224K-vec corpus we have today it takes ~minutes; operator-only.
@@ -519,20 +556,23 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	// Creates a hard-linked, consistent
 	// snapshot dir that's safe to tar without racing background compactions.
 	mux.HandleFunc("POST /admin/checkpoint", wrap(srv.handleCheckpoint))
-	mux.HandleFunc("GET /search", wrap(srv.handleSearch))
-	mux.HandleFunc("POST /search", wrap(srv.handleSearchPOST))
+	mux.HandleFunc("GET /search", qwrap(srv.handleSearch))
+	mux.HandleFunc("POST /search", qwrap(srv.handleSearchPOST))
 	mux.HandleFunc("GET /contents", wrap(srv.handleContents))
 	mux.HandleFunc("POST /contents", wrap(srv.handleContentsBatch))
 	mux.HandleFunc("GET /verify", wrap(srv.handleVerify))
 	mux.HandleFunc("GET /metrics", wrap(srv.handleMetrics))
+	mux.HandleFunc("GET /admin/query-log", wrap(srv.handleQueryLog))
+	mux.HandleFunc("POST /feedback", wrap(srv.handleFeedback))
+	mux.HandleFunc("GET /admin/feedback", wrap(srv.handleFeedbackList))
 	mux.HandleFunc("GET /sla", wrap(srv.handleSLA))
 	mux.HandleFunc("GET /admin/domains-audit", wrap(srv.handleDomainsAudit))
-	mux.HandleFunc("GET /find_similar", wrap(srv.handleFindSimilar))
-	mux.HandleFunc("POST /find_similar", wrap(srv.handleFindSimilarPOST))
-	mux.HandleFunc("GET /answer", wrap(srv.handleAnswer))
-	mux.HandleFunc("POST /answer", wrap(srv.handleAnswerPOST))
-	mux.HandleFunc("GET /research", wrap(srv.handleResearch))
-	mux.HandleFunc("POST /research", wrap(srv.handleResearchPOST))
+	mux.HandleFunc("GET /find_similar", qwrap(srv.handleFindSimilar))
+	mux.HandleFunc("POST /find_similar", qwrap(srv.handleFindSimilarPOST))
+	mux.HandleFunc("GET /answer", qwrap(srv.handleAnswer))
+	mux.HandleFunc("POST /answer", qwrap(srv.handleAnswerPOST))
+	mux.HandleFunc("GET /research", qwrap(srv.handleResearch))
+	mux.HandleFunc("POST /research", qwrap(srv.handleResearchPOST))
 
 	httpSrv := &http.Server{
 		Addr:              *addr,
@@ -778,9 +818,12 @@ func (s *pebbleHTTP) startInProcessCrawl(ctx context.Context, ps *store.PebbleSt
 	// expose SeedSitemapLane so /admin/site-submit can push a whole site's
 	// URLs into a chosen priority lane (default: submitted/priority).
 	s.crawlSeedSitemapLane = c.SeedSitemapLane
+	// expose Recrawl so /admin/recrawl-sitemap can reset done/errored URLs.
+	s.crawlRecrawl = c.Recrawl
 	s.crawlSeedRSS = c.SeedRSS
 	s.crawlFetchNow = c.FetchAndIndexNow
 	s.crawlSeedWET = c.SeedWET
+	s.crawlAllowDomain = c.AddAllowedDomain
 	for _, u := range seeds {
 		// Only seed locally-owned URLs in cluster mode; the rest get forwarded.
 		if cfg.Cluster.IsClustered() && !cfg.Cluster.OwnsURL(u) {
@@ -867,16 +910,40 @@ func (s *pebbleHTTP) startInProcessCrawl(ctx context.Context, ps *store.PebbleSt
 		}
 	}()
 
-	// Crawler goroutine.
+	// Crawler goroutine — restarts automatically when new items appear in the
+	// frontier after a drain. This ensures that site-submit / recrawl-sitemap
+	// URLs submitted while the crawler is idle are picked up without a service
+	// restart. Poll every 5s after drain; resume as soon as queued > 0.
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		log.Printf("in-serve crawler: starting")
-		if err := c.Run(ctx); err != nil {
-			log.Printf("in-serve crawler: exited with error: %v", err)
-			return
+		for {
+			log.Printf("in-serve crawler: starting")
+			if err := c.Run(ctx); err != nil {
+				log.Printf("in-serve crawler: exited with error: %v", err)
+				return
+			}
+			log.Printf("in-serve crawler: frontier drained, waiting for new work…")
+			// Poll until the parent context is cancelled or new items appear.
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-time.After(5 * time.Second):
+				}
+				fs, err := s.store.GetFrontierStats(ctx)
+				if err != nil {
+					continue
+				}
+				if fs.Queued > 0 {
+					log.Printf("in-serve crawler: %d new frontier items, restarting", fs.Queued)
+					break
+				}
+			}
+			if ctx.Err() != nil {
+				return
+			}
 		}
-		log.Printf("in-serve crawler: frontier drained")
 	}()
 	return nil
 }
@@ -908,6 +975,34 @@ type pebbleHTTP struct {
 	// in-flight call (sub-second). Disabled when ttl=0.
 	answerCache *answercache.Cache
 
+	// /research SSE stream cache. Captures and replays the full SSE byte
+	// stream so repeat research queries skip retrieval + LLM entirely.
+	researchCache *answercache.Cache
+
+	// Query log: appends one JSON line per query-endpoint request so we have
+	// real observability into what users ask, what returns empty, and latency.
+	// nil file = disabled (COSIFT_QUERY_LOG unset). See querylog.go.
+	qlogFile *os.File
+	qlogMu   sync.Mutex
+
+	// Feedback log: appends one JSON line per /feedback rating, correlated to a
+	// query by qid. The real usefulness signal (penalize/reward). See feedback.go.
+	fbFile *os.File
+	fbMu   sync.Mutex
+	// fbRL rate-limits /feedback per real client (XFF) — always on, stricter than
+	// the global limiter, since feedback is public/unauthed and abusable.
+	fbRL *rateLimiter
+
+	// Per-site docID boost map cache. key = canonical site string (e.g.
+	// "pilotprotocol.network"). Populated lazily on first site= query;
+	// subsequent calls are sub-microsecond map lookups.
+	siteBoostCache sync.Map // map[string]map[int64]float64
+
+	// Per-site page-title cache for planner context. key = canonical site
+	// string (same scheme as siteBoostCache). value = []string (<=10 titles).
+	// Populated lazily on first site= research query.
+	siteTitleCache sync.Map // map[string][]string
+
 	// Polls vLLM /metrics. When num_requests_waiting exceeds
 	// COSIFT_LLM_DEGRADE_QUEUE, optional LLM stages (rerank, HyDE,
 	// paraphrase) are silently skipped — graceful degradation rather
@@ -948,6 +1043,10 @@ type pebbleHTTP struct {
 	crawlSeedRSS         func(ctx context.Context, url string) (int, error)
 	crawlFetchNow        func(ctx context.Context, url string) error
 	crawlSeedWET         func(ctx context.Context, url string, dedupeFresh, lexicalOnly bool) (int, error)
+	// crawlAllowDomain promotes a domain into the crawler's runtime dynamic
+	// allowlist (used by /admin/allow-domain for organic HN/Reddit growth).
+	crawlAllowDomain func(domain string) error
+	crawlRecrawl         func(ctx context.Context, url string) error
 
 	// doc count at startup so /stats can report crawl rate
 	// without persistent counter tables. docs_added = current - startup,
@@ -1226,6 +1325,7 @@ type statusCapturingWriter struct {
 	http.ResponseWriter
 	status      int
 	wroteHeader bool
+	bytes       int64 // response body bytes — used by the query logger as an empty-result proxy
 }
 
 func (s *statusCapturingWriter) WriteHeader(code int) {
@@ -1240,7 +1340,9 @@ func (s *statusCapturingWriter) Write(p []byte) (int, error) {
 	if !s.wroteHeader {
 		s.wroteHeader = true
 	}
-	return s.ResponseWriter.Write(p)
+	n, err := s.ResponseWriter.Write(p)
+	s.bytes += int64(n)
+	return n, err
 }
 
 // Flush passes through to support SSE / streaming handlers.
@@ -2001,6 +2103,38 @@ func (s *pebbleHTTP) handleCrawlEnqueue(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, http.StatusOK, map[string]any{"queued": req.URL})
 }
 
+// handleAllowDomain promotes a domain into the crawler's runtime dynamic
+// allowlist so subsequently-crawled URLs from it pass allowedDomain(). Used by
+// the HN/Reddit harvesters to grow the crawlable set organically once a
+// link-target domain recurs above their frequency threshold. Persisted so it
+// survives restart. Body: {"domain":"example.com"}.
+func (s *pebbleHTTP) handleAllowDomain(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+			return
+		}
+	}
+	if s.crawlAllowDomain == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
+		return
+	}
+	var req struct {
+		Domain string `json:"domain"`
+	}
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 8<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Domain == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"domain\": \"example.com\"}")
+		return
+	}
+	if err := s.crawlAllowDomain(req.Domain); err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"allowed": strings.ToLower(strings.TrimSpace(req.Domain))})
+}
+
 // handleFrontierClear wipes the entire frontier in a single Pebble
 // DeleteRange — every queued URL, primary + secondary index. Used when
 // the frontier is so polluted by spam-discovery crawls that
@@ -2096,6 +2230,71 @@ func (s *pebbleHTTP) handleSitemapImport(w http.ResponseWriter, r *http.Request)
 	})
 }
 
+// handleRecrawlSitemap fetches a sitemap.xml and calls Recrawl on every URL,
+// resetting done/errored entries back to queued so the crawler re-visits them.
+// Use this when a domain was previously blocked by include rules and its frontier
+// entries are stuck in errored state — sitemap-import's INSERT OR IGNORE won't
+// re-queue them, but Recrawl will.
+func (s *pebbleHTTP) handleRecrawlSitemap(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlRecrawl == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
+		return
+	}
+	var req sitemapImportReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, `expected {"url": "https://.../sitemap.xml"}`)
+		return
+	}
+	// Fetch and parse the sitemap.
+	hc := &http.Client{Timeout: 20 * time.Second}
+	resp, err := hc.Get(req.URL)
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "fetch sitemap: "+err.Error())
+		return
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 8<<20))
+	// Extract <loc> entries — simple text scan avoids XML namespace headaches.
+	// Handles both pretty-printed (one tag per line) and compact sitemaps
+	// where <url><loc>…</loc></url> all appear on one line.
+	t0 := time.Now()
+	var reset, skipped int
+	src := string(raw)
+	for {
+		start := strings.Index(src, "<loc>")
+		if start < 0 {
+			break
+		}
+		src = src[start+len("<loc>"):]
+		end := strings.Index(src, "</loc>")
+		if end < 0 {
+			break
+		}
+		u := strings.TrimSpace(src[:end])
+		src = src[end+len("</loc>"):]
+		if err := s.crawlRecrawl(r.Context(), u); err != nil {
+			skipped++
+		} else {
+			reset++
+		}
+	}
+	log.Printf("recrawl-sitemap: reset %d, skipped %d from %s in %s", reset, skipped, req.URL, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"sitemap": req.URL,
+		"reset":   reset,
+		"skipped": skipped,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
 // handleCrawlNow runs the fetch-parse-index pipeline synchronously for one
 // or more URLs, bypassing the persistent frontier entirely. Use this when
 // the round-robin cursor in a large frontier (10M+) would take hours to
@@ -2390,6 +2589,51 @@ type embedBackfillReq struct {
 	Workers int `json:"workers,omitempty"`
 }
 
+// handleHostBackfill triggers the 'P' host-partition backfill IN-PROCESS, in a
+// detached background goroutine (Pebble is single-writer, so this can't run as
+// a separate process against a live store). Returns immediately; progress is
+// logged. ?host=<host> runs the fast targeted path; omit for the full corpus.
+//
+// Run this with the COSIFT_HOST_PARTITION write flag OFF so the backfill is the
+// sole writer of the 'T'/'next_host_id' families (no race with crawl indexing).
+// After it logs "done", set COSIFT_HOST_PARTITION_READ=1 (and =1 for the write
+// flag to keep it fresh) and restart.
+func (s *pebbleHTTP) handleHostBackfill(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.store == nil {
+		writeProblem(w, http.StatusNotImplemented, "host-backfill requires a PebbleStore")
+		return
+	}
+	host := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("host")))
+	// Detached context so the long backfill survives the request returning.
+	go func() {
+		t0 := time.Now()
+		scope := "full corpus"
+		if host != "" {
+			scope = "host=" + host
+		}
+		log.Printf("host-backfill: starting (%s)", scope)
+		written, err := s.store.BackfillHostPostings(context.Background(), host, func(n int64) {
+			log.Printf("host-backfill: %d postings written (%s elapsed)", n, time.Since(t0).Round(time.Second))
+		})
+		if err != nil {
+			log.Printf("host-backfill: FAILED after %d postings: %v", written, err)
+			return
+		}
+		log.Printf("host-backfill: DONE — %d postings in %s. Set COSIFT_HOST_PARTITION_READ=1 and restart.",
+			written, time.Since(t0).Round(time.Second))
+	}()
+	writeJSON(w, http.StatusAccepted, map[string]any{
+		"status": "started", "scope": host, "note": "running in background; watch server logs for progress + 'DONE'",
+	})
+}
+
 func (s *pebbleHTTP) handleEmbedBackfill(w http.ResponseWriter, r *http.Request) {
 	if want := s.cluster.PeerAuthToken; want != "" {
 		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
@@ -3943,9 +4187,17 @@ func (s *pebbleHTTP) handleSearch(w http.ResponseWriter, r *http.Request) {
 		if dateFilter {
 			mult = 10
 		}
-		fetchK = keepCap * mult
-		if fetchK > 500 {
-			fetchK = 500
+		if siteFilter {
+			// site= uses a fixed pool regardless of k — fetching proportionally
+			// (k*100) hits the 2000-cap and spends 20s+ on BM25 for common terms.
+			// 300 candidates is enough to include a small site's relevant pages
+			// while keeping latency under ~3s even for high-frequency query terms.
+			fetchK = 300
+		} else {
+			fetchK = keepCap * mult
+			if fetchK > 500 {
+				fetchK = 500
+			}
 		}
 	} else if wantRerank {
 		fetchK = keepCap * 2
@@ -5184,6 +5436,129 @@ func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retriev
 	}
 }
 
+// getSiteBoostIDs returns a docID→50× multiplier map for all docs belonging
+// to the given site scopes. Populated lazily on first call; cached in
+// siteBoostCache thereafter. Using the famHost index so the scan is
+// O(site_docs) not O(corpus).
+func (s *pebbleHTTP) getSiteBoostIDs(ctx context.Context, scopes []siteScope) map[int64]float64 {
+	if len(scopes) == 0 || s.store == nil {
+		return nil
+	}
+	key := func() string {
+		parts := make([]string, len(scopes))
+		for i, sc := range scopes {
+			parts[i] = sc.host
+			if sc.path != "" {
+				parts[i] += sc.path
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, "|")
+	}()
+	if cached, ok := s.siteBoostCache.Load(key); ok {
+		return cached.(map[int64]float64)
+	}
+	boost := make(map[int64]float64)
+	for _, sc := range scopes {
+		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
+			boost[id] = 50.0
+			return true
+		})
+	}
+	if len(boost) > 0 {
+		s.siteBoostCache.Store(key, boost)
+	}
+	return boost
+}
+
+// getSiteTitles returns up to maxSiteTitles real page titles from the given
+// site scopes, for injection into the research planner prompt so the LLM sees
+// the site's actual vocabulary. Bounded and cheap: a single early-stopping
+// famHost scan per scope plus <=10 GetDocMeta side-blob lookups. Cached in
+// siteTitleCache thereafter. Returns nil if nothing usable is found.
+func (s *pebbleHTTP) getSiteTitles(ctx context.Context, scopes []siteScope) []string {
+	if len(scopes) == 0 || s.store == nil {
+		return nil
+	}
+	key := func() string {
+		parts := make([]string, len(scopes))
+		for i, sc := range scopes {
+			parts[i] = sc.host
+			if sc.path != "" {
+				parts[i] += sc.path
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, "|")
+	}()
+	if cached, ok := s.siteTitleCache.Load(key); ok {
+		return cached.([]string)
+	}
+	const maxSiteTitles = 10
+	titles := make([]string, 0, maxSiteTitles)
+	seen := make(map[string]struct{}, maxSiteTitles)
+	for _, sc := range scopes {
+		if len(titles) >= maxSiteTitles {
+			break
+		}
+		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
+			_, title, ok, err := s.store.GetDocMeta(ctx, id)
+			if err != nil {
+				return false // stop this scope on error
+			}
+			if !ok {
+				return true
+			}
+			t := strings.TrimSpace(title)
+			if t == "" {
+				return true
+			}
+			if _, dup := seen[t]; dup {
+				return true
+			}
+			seen[t] = struct{}{}
+			titles = append(titles, t)
+			return len(titles) < maxSiteTitles // stop once we have 10
+		})
+	}
+	if len(titles) > 0 {
+		s.siteTitleCache.Store(key, titles)
+	}
+	return titles
+}
+
+// hostPartitionReadEnabled reports whether site= queries should route to the
+// 'P'-family host partition via SearchInHost. Gated by
+// COSIFT_HOST_PARTITION_READ=1; off → the 50× boost path is used.
+func hostPartitionReadEnabled() bool {
+	return os.Getenv("COSIFT_HOST_PARTITION_READ") == "1"
+}
+
+// retrieveForSites resolves a site-scoped sub-query. When the host partition
+// is enabled and the scope is a single bare host, it scans only that host's
+// posting partition (O(site_docs)) via SearchInHost — the definitive fix for
+// the global-scan latency + recall problem. Otherwise (multi-site, path-scoped,
+// flag off, or partition not yet backfilled for the host) it falls back to the
+// 50× BM25 boost over the global index.
+func (s *pebbleHTTP) retrieveForSites(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string, boostIDs map[int64]float64, scopes []siteScope) ([]index.Hit, string, error) {
+	if hostPartitionReadEnabled() && len(scopes) == 1 && scopes[0].path == "" && scopes[0].host != "" {
+		hits, err := s.idx.SearchInHost(ctx, q, scopes[0].host, fetchK)
+		if err == nil {
+			return hits, q, nil
+		}
+		if !errors.Is(err, index.ErrHostPartitionEmpty) {
+			return nil, "", err
+		}
+		// partition empty for this host → fall through to the boost path.
+	}
+	if len(boostIDs) == 0 {
+		return s.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
+	}
+	tmp := *s
+	tmp.idx = s.idx.WithBoost(boostIDs)
+	return tmp.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
+}
+
 // retrieveWithExpansion dispatches the BM25 call across the three
 // expansion strategies /search and /answer share — bare, HyDE, paraphrase+RRF.
 // Returns (hits, effectiveQuery, err). effectiveQuery == q when no expansion
@@ -5502,9 +5877,16 @@ func (s *pebbleHTTP) handleAnswerInner(w http.ResponseWriter, r *http.Request, s
 		if dateFilter {
 			mult = 10
 		}
+		if siteFilter {
+			mult = 50 // site= over-fetches aggressively: small site in a large corpus
+		}
 		fetchK = keepCap * mult
-		if fetchK > 200 {
-			fetchK = 200 // /answer caps tighter than /search — full doc text per source is expensive
+		cap := 200 // /answer caps tighter than /search — full doc text per source is expensive
+		if siteFilter && cap < 500 {
+			cap = 500
+		}
+		if fetchK > cap {
+			fetchK = cap
 		}
 	} else if wantRerank {
 		fetchK = keepCap * 2
@@ -5793,6 +6175,25 @@ func (s *pebbleHTTP) handleAnswerInner(w http.ResponseWriter, r *http.Request, s
 	writeJSON(w, http.StatusOK, resp)
 }
 
+// recordingWriter wraps an http.ResponseWriter and captures every byte
+// written to it. Used to record SSE streams for the research cache — the
+// captured bytes can later be replayed to a new client directly.
+type recordingWriter struct {
+	http.ResponseWriter
+	buf bytes.Buffer
+}
+
+func (r *recordingWriter) Write(b []byte) (int, error) {
+	r.buf.Write(b)
+	return r.ResponseWriter.Write(b)
+}
+
+func (r *recordingWriter) Flush() {
+	if f, ok := r.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
 // wantsSSE reports whether the request opts into Server-Sent Events,
 // either via ?stream=true or an Accept: text/event-stream header. Both
 // /answer, /query, and /research check the same envelope.
@@ -5957,7 +6358,7 @@ func (a *answerSSE) done() {
 // by URL keeping the best score, top-k feed a cited synthesis. Mirrors the
 // SQLite-side /research planner strategy. No streaming, no rerank, no
 // paraphrase strategy yet — those follow once this surface is exercised.
-const researchPlanPrompt = `Decompose the user's research question into 2-3 focused sub-queries that, taken together, would cover the answer. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["sub-query 1", "sub-query 2"]`
+const researchPlanPrompt = `Decompose the user's research question into 2-3 short keyword search phrases (3-6 words each, NOT full sentences). Each phrase MUST target a DIFFERENT facet so the phrases do not overlap: one conceptual/definitional (what it is), one procedural/how-to (steps, configuration, usage), and one edge-case/troubleshooting (errors, limits, gotchas, comparisons). Skip a facet only if it does not apply. Do NOT output near-duplicate rephrasings of the same idea. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["consensus algorithm overview", "configure validator node", "leader election failure recovery"]`
 
 // queryPlanPrompt is the LLM-orchestrator prompt. The model
 // analyzes the user's natural-language query, classifies intent, and
@@ -6378,6 +6779,12 @@ type researchResponse struct {
 	Took            string         `json:"took"`
 }
 
+// researchSubFanOut bounds how many sub-queries retrieve concurrently within
+// a single /research pass. Shared by the sync (handleResearch) and streaming
+// (streamResearch) paths so their latency profiles stay identical. 3 keeps the
+// site= budget at 3 sub-queries × fan-out-3 = one concurrent batch.
+const researchSubFanOut = 3
+
 func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
 	// Planner runs once on gateway,
 	// each sub-query scatters to peers, single synth here.
@@ -6417,23 +6824,63 @@ func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
 	wantStream := wantsSSE(r)
 	if wantStream {
 		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
-			s.streamResearch(w, r, sc, q, k, filt, start)
+			cacheKey := "research|" + q + "|" + r.URL.Query().Get("site") + "|" + strconv.Itoa(k)
+			if r.Header.Get("Cache-Control") != "no-cache" {
+				if cached, ok := s.researchCache.Get(cacheKey); ok {
+					w.Header().Set("Content-Type", "text/event-stream")
+					w.Header().Set("Cache-Control", "no-cache")
+					w.Header().Set("X-Accel-Buffering", "no")
+					w.WriteHeader(http.StatusOK)
+					_, _ = w.Write(cached)
+					if f, ok2 := w.(http.Flusher); ok2 {
+						f.Flush()
+					}
+					return
+				}
+			}
+			rec := &recordingWriter{ResponseWriter: w}
+			s.streamResearch(rec, r, sc, q, k, filt, start)
+			if rec.buf.Len() > 0 {
+				s.researchCache.Set(cacheKey, rec.buf.Bytes())
+			}
 			return
 		}
 	}
 
-	// Plan
+	// Plan — include site domain so the LLM generates site-specific sub-queries
+	// rather than generic web queries that miss small-site content.
+	planQ := q
+	if len(filt.sites) > 0 {
+		siteHints := make([]string, len(filt.sites))
+		for si, ss := range filt.sites {
+			siteHints[si] = ss.host
+			if ss.path != "" {
+				siteHints[si] += ss.path
+			}
+		}
+		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
+		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
+			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
+		}
+	}
 	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
 		{Role: "system", Content: researchPlanPrompt},
-		{Role: "user", Content: q},
+		{Role: "user", Content: planQ},
 	})
 	if err != nil {
 		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
 		return
 	}
 	subs := parseSubQueries(planRaw, q)
-	if len(subs) > 5 {
-		subs = subs[:5]
+	maxSubs := 5
+	// site= scope limits the search to a small domain. 3 sub-queries with
+	// fan-out 3 complete in one concurrent batch (~21s each), keeping total
+	// retrieval under 25s so LLM synthesis fits within the 60s budget.
+	if len(filt.sites) > 0 && maxSubs > 3 {
+		maxSubs = 3
+	}
+	if len(subs) > maxSubs {
+		subs = subs[:maxSubs]
 	}
 
 	// Retrieve per sub-query, dedupe by URL keeping best score.
@@ -6442,10 +6889,21 @@ func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
 		hit   index.Hit
 	}
 	best := make(map[string]ranked, k*len(subs))
+	// Build the site boost map first: its length equals the site's doc count,
+	// which drives the adaptive perSub below.
+	syncBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
 	perSub := k * 2
 	if perSub > 40 {
 		perSub = 40
 	}
+	if len(filt.sites) > 0 {
+		// Fetch deep enough to cover the whole site (×1.2 headroom) so the 50×
+		// boost can reorder every site doc into top-k. Floor 200 preserves the
+		// MaxScore-firing window for tiny site-key terms (e.g. "pilotctl");
+		// ceiling 1000 bounds per-sub BM25 latency. Issue #2's MaxScore
+		// pre-check is what keeps the larger fetch affordable.
+		perSub = max(200, min(1000, int(math.Ceil(float64(len(syncBoostIDs))*1.2))))
+	}
 	// each sub-query goes through retrieveWithExpansion, so
 	// ?expand=hyde gives per-sub-query HyDE (was's behavior) and
 	// ?expand=paraphrase fans out 3 paraphrases × N sub-queries → RRF per
@@ -6459,20 +6917,38 @@ func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
 		r.URL.Query().Get("retriever"),
 		r.URL.Query().Get("rerank"),
 	)
+	// Sub-queries are independent retrieve calls and the per-call cost dominates
+	// total latency, so fan them out with a bounded concurrency identical to the
+	// streaming path. bestMu guards the shared best map; hits and syncBoostIDs
+	// are goroutine-local / read-only respectively. There is no seenURLs set in
+	// the sync path (single pass), so the merge is a plain keep-best-score dedupe.
+	var bestMu sync.Mutex
+	var wg sync.WaitGroup
+	sem := make(chan struct{}, researchSubFanOut)
 	for _, sq := range subs {
-		hits, _, err := s.retrieve(r.Context(), sq, perSub, retrieverParam, expandMode)
-		if err != nil {
-			// log the specific sub-query so operators can diagnose
-			// 'why was this research thin on sources' — previously silent.
-			log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, err)
-			continue
-		}
-		for _, h := range hits {
-			if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
-				best[h.URL] = ranked{score: h.Score, hit: h}
+		sq := sq
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+			hits, _, err := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, syncBoostIDs, filt.sites)
+			if err != nil {
+				// log the specific sub-query so operators can diagnose
+				// 'why was this research thin on sources' — previously silent.
+				log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, err)
+				return
 			}
-		}
+			bestMu.Lock()
+			for _, h := range hits {
+				if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
+					best[h.URL] = ranked{score: h.Score, hit: h}
+				}
+			}
+			bestMu.Unlock()
+		}()
 	}
+	wg.Wait()
 	pooled := make([]ranked, 0, len(best))
 	for _, v := range best {
 		pooled = append(pooled, v)
@@ -6488,6 +6964,11 @@ func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
 			keepCap = k
 		}
 	}
+	// Truncate the sorted pool to keepCap before materialization. For site=
+	// queries the 50x boost (applied in Search before its descending sort)
+	// guarantees the site's matched docs occupy the front of pooled, so this
+	// cut keeps exactly the boosted docs and bounds the rerank candidate count
+	// (was ~138 for site= queries; now keepCap, default rerankCandK=20).
 	if len(pooled) > keepCap {
 		pooled = pooled[:keepCap]
 	}
@@ -6652,17 +7133,39 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 	sse.warnings(s.warningsFor(r))
 	sse.phase("plan_start", map[string]any{"q": q, "model": sc.Model()})
 
+	// site= hint: LLM generates site-specific sub-queries with domain terminology
+	// rather than generic queries that miss small-site content in BM25 top-200.
+	planQ := q
+	if len(filt.sites) > 0 {
+		siteHints := make([]string, len(filt.sites))
+		for si, ss := range filt.sites {
+			siteHints[si] = ss.host
+			if ss.path != "" {
+				siteHints[si] += ss.path
+			}
+		}
+		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
+		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
+			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
+		}
+	}
 	planRaw, err := s.doChat(r.Context(), sc, []embed.ChatMsg{
 		{Role: "system", Content: researchPlanPrompt},
-		{Role: "user", Content: q},
+		{Role: "user", Content: planQ},
 	})
 	if err != nil {
 		sse.send(map[string]any{"type": "error", "phase": "plan", "error": err.Error()})
 		return
 	}
 	subs := parseSubQueries(planRaw, q)
-	if len(subs) > 5 {
-		subs = subs[:5]
+	{
+		maxSubs := 5
+		if len(filt.sites) > 0 && maxSubs > 3 {
+			maxSubs = 3 // site= budget: 3 sub-queries × fan-out-3 = one concurrent batch (~21s) + LLM fits in 60s
+		}
+		if len(subs) > maxSubs {
+			subs = subs[:maxSubs]
+		}
 	}
 	// per-sub-query expansion via retrieveWithExpansion.
 	// per-sub-query retriever dispatch (bm25 / dense / hybrid).
@@ -6717,12 +7220,29 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 	// refine_queries to drive the next pass. Cap at maxPasses to bound
 	// latency + LLM cost.
 	maxPasses := researchMaxPasses(r)
+	// site= constrains to a small domain: multi-pass BM25 at fetchK=300 costs
+	// 21s × passes beyond the 60s budget. Cap to 1 pass — a small site's corpus
+	// is fully represented in the first retrieval round anyway.
+	if len(filt.sites) > 0 && maxPasses > 1 {
+		maxPasses = 1
+	}
 	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
 	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
+	// Pre-build site boost map once per request (O(site_docs) famHost scan,
+	// cached for repeat queries). Nil when site= is absent or store unavailable.
+	// Built before perSub because its length equals the site doc count.
+	siteBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
 	perSub := k * 2
 	if perSub > 40 {
 		perSub = 40
 	}
+	if len(filt.sites) > 0 {
+		// Fetch deep enough to cover the whole site (×1.2 headroom); floor 200
+		// preserves the MaxScore-firing window for tiny site-key terms, ceiling
+		// 1000 bounds per-sub BM25 latency. Mitigated by Issue #2's MaxScore
+		// pre-check.
+		perSub = max(200, min(1000, int(math.Ceil(float64(len(siteBoostIDs))*1.2))))
+	}
 	keepCap := k
 	if wantRerank {
 		keepCap = s.rerankCandK
@@ -6753,8 +7273,7 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 		best := make(map[string]ranked, k*len(subs))
 		var bestMu sync.Mutex
 		var wg sync.WaitGroup
-		const subFanOut = 3
-		sem := make(chan struct{}, subFanOut)
+		sem := make(chan struct{}, researchSubFanOut)
 		for _, sq := range subs {
 			sq := sq
 			wg.Add(1)
@@ -6763,7 +7282,7 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 				sem <- struct{}{}
 				defer func() { <-sem }()
 				sse.phase("retrieving", map[string]any{"pass": pass, "query": sq})
-				hits, _, rerr := s.retrieve(r.Context(), sq, perSub, retrieverParam, expandMode)
+				hits, _, rerr := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, siteBoostIDs, filt.sites)
 				if rerr != nil {
 					log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, rerr)
 					sse.phase("expand", map[string]any{"pass": pass, "query": sq, "error": rerr.Error()})
@@ -6790,6 +7309,10 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 		}
 		sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
 		sse.phase("fuse", map[string]any{"pass": pass, "unique_urls": len(pooled)})
+		// Truncate the sorted pool to keepCap before materialization. For site=
+		// queries the 50x boost (applied in Search before its descending sort)
+		// puts the site's matched docs at the front of pooled, so this cut keeps
+		// the boosted docs and bounds the LLM rerank candidate count to keepCap.
 		if len(pooled) > keepCap {
 			pooled = pooled[:keepCap]
 		}
@@ -6893,12 +7416,22 @@ func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc e
 
 		// Build the cumulative sources slice + prompt block, stamping IDs
 		// 1..N in the order URLs were promoted.
+		// For site= queries trim excerpts to 600 chars — reduces synthesis
+		// context from ~9.6k to ~4.8k chars, cutting synthesis latency ~40%.
+		synthExcerptLen := 1200
+		if len(filt.sites) > 0 {
+			synthExcerptLen = 600
+		}
 		cumulativeSources := make([]answerSource, 0, len(allCands))
 		var promptSources strings.Builder
 		for i, c := range allCands {
 			c.src.ID = i + 1
 			cumulativeSources = append(cumulativeSources, c.src)
-			fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, c.excerpt)
+			ex := c.excerpt
+			if len(ex) > synthExcerptLen {
+				ex = ex[:synthExcerptLen]
+			}
+			fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, ex)
 		}
 		srcEvt := map[string]any{
 			"type": "sources", "sources": cumulativeSources,
diff --git a/cmd/cosift/querylog.go b/cmd/cosift/querylog.go
new file mode 100644
index 0000000..1493c6f
--- /dev/null
+++ b/cmd/cosift/querylog.go
@@ -0,0 +1,160 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Query logging — the observability substrate cosift lacked. Until now nothing
+// recorded what users ask, what returns empty, or how slow queries are, so
+// "is it useful?" was unanswerable except by eyeballing. qlog appends one JSON
+// line per query-endpoint request; /admin/query-log tails it.
+//
+// Privacy: this records query text for a public search service. Keep retention
+// conservative (rotate/truncate the file); don't hoard raw queries indefinitely.
+
+type queryLogRec struct {
+	Qid    string `json:"qid"`              // stable id; returned to caller via X-Cosift-Query-Id so feedback can reference it
+	TS     string `json:"ts"`
+	Ep     string `json:"ep"`               // path, e.g. /search
+	Q      string `json:"q"`                // the q= param (empty for POST-body queries)
+	Status int    `json:"status"`           // HTTP status
+	MS     int64  `json:"ms"`               // server-side latency
+	Bytes  int64  `json:"bytes"`            // response body bytes (empty-result proxy)
+	Caller string `json:"caller,omitempty"` // X-Forwarded-For or RemoteAddr — separates self/test from organic
+}
+
+// newQueryID returns a short random hex id for correlating a query with later
+// feedback. crypto/rand so concurrent requests don't collide.
+func newQueryID() string {
+	var b [12]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		// Fallback: time-based (collision-tolerant; feedback is weak signal).
+		return "q" + strconv.FormatInt(time.Now().UnixNano(), 36)
+	}
+	return hex.EncodeToString(b[:])
+}
+
+// qlog wraps a query handler to append a structured log line after it runs.
+// No-op when COSIFT_QUERY_LOG is unset (s.qlogFile == nil).
+func (s *pebbleHTTP) qlog(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if s.qlogFile == nil {
+			h(w, r)
+			return
+		}
+		start := time.Now()
+		qid := newQueryID()
+		sw := &statusCapturingWriter{ResponseWriter: w, status: 200}
+		// Set the id header BEFORE the handler writes — the adapter surfaces it
+		// to the caller so feedback can reference this exact answer.
+		sw.Header().Set("X-Cosift-Query-Id", qid)
+		h(sw, r)
+		caller := r.Header.Get("X-Forwarded-For")
+		if caller == "" {
+			caller = r.RemoteAddr
+		}
+		s.writeQueryLog(queryLogRec{
+			Qid:    qid,
+			TS:     time.Now().UTC().Format(time.RFC3339),
+			Ep:     r.URL.Path,
+			Q:      r.URL.Query().Get("q"),
+			Status: sw.status,
+			MS:     time.Since(start).Milliseconds(),
+			Bytes:  sw.bytes,
+			Caller: caller,
+		})
+	}
+}
+
+func (s *pebbleHTTP) writeQueryLog(rec queryLogRec) {
+	b, err := json.Marshal(rec)
+	if err != nil {
+		return
+	}
+	s.qlogMu.Lock()
+	defer s.qlogMu.Unlock()
+	_, _ = s.qlogFile.Write(append(b, '\n'))
+}
+
+// handleQueryLog tails the query log. ?n=N (default 100, max 5000) returns the
+// last N JSON lines as a JSON array; ?raw=1 returns them as raw JSONL.
+func (s *pebbleHTTP) handleQueryLog(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := r.Header.Get("Authorization")
+		if got != "Bearer "+want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	path := os.Getenv("COSIFT_QUERY_LOG")
+	if path == "" {
+		writeProblem(w, http.StatusNotImplemented, "query log disabled (COSIFT_QUERY_LOG unset)")
+		return
+	}
+	n := 100
+	if v := r.URL.Query().Get("n"); v != "" {
+		if k, err := strconv.Atoi(v); err == nil && k > 0 && k <= 5000 {
+			n = k
+		}
+	}
+	lines := tailLines(path, n)
+	if r.URL.Query().Get("raw") == "1" {
+		w.Header().Set("Content-Type", "application/x-ndjson")
+		for _, ln := range lines {
+			_, _ = w.Write(append([]byte(ln), '\n'))
+		}
+		return
+	}
+	recs := make([]json.RawMessage, 0, len(lines))
+	for _, ln := range lines {
+		recs = append(recs, json.RawMessage(ln))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"count": len(recs), "entries": recs})
+}
+
+// tailLines returns the last n newline-delimited lines of a file. Reads at most
+// the trailing window so a large log doesn't blow memory.
+func tailLines(path string, n int) []string {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+	st, err := f.Stat()
+	if err != nil {
+		return nil
+	}
+	const window = 2 << 20 // 2 MB tail window
+	size := st.Size()
+	start := int64(0)
+	if size > window {
+		start = size - window
+	}
+	buf := make([]byte, size-start)
+	if _, err := f.ReadAt(buf, start); err != nil && err.Error() != "EOF" {
+		return nil
+	}
+	parts := strings.Split(string(buf), "\n")
+	// If we started mid-file, the first element is a partial line — drop it.
+	if start > 0 && len(parts) > 0 {
+		parts = parts[1:]
+	}
+	// Drop empty trailing element (file ends in newline) + any blanks.
+	lines := parts[:0]
+	for _, p := range parts {
+		if p != "" {
+			lines = append(lines, p)
+		}
+	}
+	if len(lines) > n {
+		lines = lines[len(lines)-n:]
+	}
+	return lines
+}
diff --git a/cmd/cosift/querylog_test.go b/cmd/cosift/querylog_test.go
new file mode 100644
index 0000000..689b0dd
--- /dev/null
+++ b/cmd/cosift/querylog_test.go
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestTailLines(t *testing.T) {
+	dir := t.TempDir()
+	p := filepath.Join(dir, "q.jsonl")
+	var sb strings.Builder
+	for i := 0; i < 500; i++ {
+		sb.WriteString("line")
+		sb.WriteByte(byte('0' + i%10))
+		sb.WriteByte('\n')
+	}
+	if err := os.WriteFile(p, []byte(sb.String()), 0644); err != nil {
+		t.Fatal(err)
+	}
+	got := tailLines(p, 3)
+	if len(got) != 3 {
+		t.Fatalf("want 3 lines, got %d", len(got))
+	}
+	// Last three lines are i=497,498,499 -> line7,line8,line9
+	want := []string{"line7", "line8", "line9"}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("line %d: got %q want %q", i, got[i], want[i])
+		}
+	}
+	// n larger than file → all lines, no partials/blanks.
+	all := tailLines(p, 10000)
+	if len(all) != 500 {
+		t.Errorf("want 500 lines, got %d", len(all))
+	}
+	for _, l := range all {
+		if l == "" {
+			t.Error("blank line leaked into output")
+		}
+	}
+}
+
+func TestTailLinesMissingFile(t *testing.T) {
+	if got := tailLines("/nonexistent/path/q.jsonl", 5); got != nil {
+		t.Errorf("missing file should return nil, got %v", got)
+	}
+}
diff --git a/docs/DIAGRAMS-contrib-network.md b/docs/DIAGRAMS-contrib-network.md
new file mode 100644
index 0000000..882f929
--- /dev/null
+++ b/docs/DIAGRAMS-contrib-network.md
@@ -0,0 +1,734 @@
+# Cosift Open Contribution Network — Flow Diagrams
+
+Companion to `PLAN-contrib-network.md`. Each diagram answers one question and
+references the workstreams (WS0-WS15) implementing it. Mermaid renders natively
+on GitHub.
+
+Diagram index:
+
+1. [System overview — layers and trust boundaries](#1-system-overview)
+2. [End-to-end story — developer publishes → AI agent retrieves](#2-end-to-end-story)
+3. [Component map of the broker](#3-component-map-of-the-broker)
+4. [Publisher: claim + verify a docs prefix](#4-publisher-claim-and-verify)
+5. [Publisher: heartbeat + lease lifecycle](#5-publisher-heartbeats-and-lease-state)
+6. [Publisher: lease state machine](#6-lease-state-machine)
+7. [Worker: install → register → ready](#7-worker-install-and-register)
+8. [Worker: fetch contribution lifecycle](#8-fetch-contribution-lifecycle)
+9. [Worker: embed contribution lifecycle](#9-embed-contribution-lifecycle)
+10. [Frontier lanes and work distribution](#10-frontier-lanes-and-work-distribution)
+11. [Quarantine → verify → promote pipeline](#11-quarantine-verify-promote-pipeline)
+12. [Retrieval path with gating](#12-retrieval-path-with-gating)
+13. [Transport binding — Pilot tunnel identity check (I9)](#13-transport-binding-i9)
+14. [Principal reputation state machine](#14-principal-reputation)
+15. [Multi-broker federation (forward-compat)](#15-multi-broker-federation-future)
+
+---
+
+## 1. System overview
+
+Three planes — humans/agents at the top, Pilot overlay in the middle, the broker (cosift on GH200) at the bottom. Every contribution byte crosses the middle plane (**I9**).
+
+```mermaid
+flowchart TB
+    subgraph H[Humans and agents]
+        DEV[Developer<br/>publishes docs]
+        AI[Claude Code / AI agent<br/>retrieves answers]
+    end
+
+    subgraph A[Apps on contributor / consumer machines]
+        PUB[cosift-node app<br/>publisher role]
+        WRK[cosift-node app<br/>worker role + bundled embedder]
+        MCP[cosift MCP shim]
+    end
+
+    subgraph P[Pilot overlay - tunnels authenticated by ed25519 pubkey]
+        T1((overlay tunnel))
+        T2((overlay tunnel))
+        T3((overlay tunnel))
+    end
+
+    subgraph B[Broker - cosift on GH200]
+        LIS[Pilot listener<br/>virt port 7700]
+        RT[Router + middleware<br/>envelope verify, peer-pubkey binding]
+        BL[Business logic<br/>collections - leases - principals - verifier]
+        ST[(Pebble store<br/>P, C, A, S, W, docs, frontier, HNSW)]
+        VLM[vLLM<br/>chat]
+        EMB[Ollama replicas x8<br/>nomic-embed-text-v1.5]
+    end
+
+    DEV --> PUB
+    AI --> MCP
+
+    PUB --> T1
+    WRK --> T2
+    MCP --> T3
+
+    T1 --> LIS
+    T2 --> LIS
+    T3 --> LIS
+
+    LIS --> RT --> BL --> ST
+    BL --> VLM
+    BL --> EMB
+
+    style P fill:#eef,stroke:#88a,stroke-width:2px
+    style B fill:#efe,stroke:#8a8,stroke-width:2px
+```
+
+Trust boundaries: every arrow crossing into the broker is overlay-authenticated; the envelope signing key equals the tunnel peer pubkey.
+
+---
+
+## 2. End-to-end story
+
+The full loop from a dev shipping docs to an AI agent retrieving an answer. Time flows top-to-bottom; only happy-path events shown.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor DEV as Developer
+    participant PUB as cosift-node (publisher)
+    participant ORG as docs.foo.dev origin
+    participant BRK as Cosift broker
+    participant WRK as cosift-node (worker, elsewhere)
+    participant MCP as cosift MCP shim
+    actor AI as Claude Code user
+
+    DEV->>PUB: install via pilotctl appstore
+    PUB->>BRK: register principal (overlay, signed)
+    PUB->>BRK: claim_prefix("docs.foo.dev")
+    BRK-->>PUB: challenge token T
+    PUB->>DEV: place T at /.well-known/cosift-verify.txt
+    DEV->>ORG: deploy T
+    BRK->>ORG: GET /.well-known (verification worker)
+    ORG-->>BRK: T matches
+    BRK->>BRK: collection verified, active
+
+    PUB->>BRK: submit URLs (lane 0)
+    BRK->>BRK: push to frontier lane 0
+
+    WRK->>BRK: claim work (kinds: fetch, embed)
+    BRK-->>WRK: leased URLs and chunks
+    WRK->>ORG: fetch pages
+    WRK->>WRK: embed chunks (bundled sidecar)
+    WRK->>BRK: submit signed results
+    BRK->>BRK: quarantine, verify, promote
+
+    Note over PUB,BRK: heartbeat every 6h keeps lease active
+
+    AI->>MCP: cosift_search("how to use foo v2.3")
+    MCP->>BRK: /search (overlay)
+    BRK->>BRK: BM25 + HNSW + rerank + judge<br/>+ gate (collection state, banned principals)
+    BRK-->>MCP: hits with provenance
+    MCP-->>AI: results in Claude Code
+```
+
+The lease is what makes "active only while installed" true: the developer's app stops heartbeating when uninstalled, lease lapses, docs leave the index.
+
+---
+
+## 3. Component map of the broker
+
+Zoom into one cosift instance. Routes split by auth surface; background loops sit on the side.
+
+```mermaid
+flowchart LR
+    subgraph IN[Inbound]
+        OVL[Overlay listener<br/>port 7700]
+        LOOP[Loopback HTTP :7777<br/>admin only, not exposed]
+    end
+
+    subgraph MW[Middleware]
+        ENV[Envelope verify +<br/>peer-pubkey binding]
+        ADM[Bearer admin]
+    end
+
+    subgraph RT[Routes]
+        PR[/pub/* publisher API/]
+        WR[/work/* worker API/]
+        SR[/search /query /answer /research/]
+        PUB[/queue /healthz /stats /metrics/]
+        AR[/admin/* operator/]
+    end
+
+    subgraph BL[Core logic]
+        COL[collections + leases]
+        PRN[principal registry + reputation]
+        WL[work-lease + frontier lanes]
+        VR[verification scheduler]
+        RET[retrieval + filter + judge]
+    end
+
+    subgraph ST[Pebble families]
+        FAM["'P' principals<br/>'C' collections<br/>'A' attribution<br/>'S' staging<br/>'W' work leases<br/>'d/u/i/h' docs<br/>'f' frontier (lane-prefixed)<br/>'v/q' HNSW + PQ"]
+    end
+
+    subgraph BG[Background loops]
+        SWP[lease sweeper]
+        REV[re-verify domain]
+        VWK[verification workers]
+        REC[re-crawl scheduler]
+        SNP[snapshot timer]
+    end
+
+    OVL --> ENV
+    LOOP --> ADM
+    ENV --> PR
+    ENV --> WR
+    ENV --> SR
+    ENV --> PUB
+    ADM --> AR
+
+    PR --> COL
+    WR --> WL
+    SR --> RET
+    AR --> WL
+    AR --> PRN
+
+    COL --> ST
+    PRN --> ST
+    WL --> ST
+    VR --> ST
+    RET --> ST
+
+    SWP --> COL
+    REV --> COL
+    VWK --> VR
+    REC --> WL
+    SNP --> ST
+```
+
+`/admin/*` routes only exist on loopback HTTP behind the operator's admin token — the overlay listener refuses them outright (route allowlist).
+
+---
+
+## 4. Publisher claim and verify
+
+Domain ownership without a central account system. The well-known token is the proof; the broker re-verifies every 30 days.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant DEV as Developer
+    participant APP as cosift-node app
+    participant BRK as Broker
+    participant ORG as docs.foo.dev
+
+    DEV->>APP: node.claim_prefix(prefix="docs.foo.dev")
+    APP->>APP: build envelope (kind=pub_claim,<br/>principal=K_pub, seq=N)
+    APP->>BRK: POST /pub/claim (overlay, envelope)
+    BRK->>BRK: verify envelope, allocate collection_id,<br/>store record state=pending,<br/>generate token T
+    BRK-->>APP: { collection_id, token T, expires }
+    APP-->>DEV: "Place T at https://docs.foo.dev/.well-known/cosift-verify.txt"
+
+    DEV->>ORG: deploy verification file
+    Note over BRK: verification worker tick (every 60s)
+    BRK->>ORG: GET /.well-known/cosift-verify.txt
+    ORG-->>BRK: contents = T (match)
+    BRK->>BRK: state = verified -> active<br/>verified_at = now
+
+    APP->>BRK: GET /pub/verify-status (envelope)
+    BRK-->>APP: { state: "active" }
+    APP-->>DEV: "Verified. You may submit."
+
+    Note over BRK: every 30 days re-verify. failure leads to state=unverified<br/>(serving continues, writes blocked)
+```
+
+Conflicting claims: longest-prefix nesting; first verified wins. A second principal claiming the same exact prefix → 409 immediately.
+
+---
+
+## 5. Publisher heartbeats and lease state
+
+Nonce-chained heartbeats (**D1**) — the response carries the next nonce; replay-proof without inbound delivery. App uninstall = identity destroyed = heartbeats stop = lease lapses.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant APP as cosift-node (publisher)
+    participant BRK as Broker
+
+    Note over APP,BRK: every 6h while installed
+
+    APP->>APP: load nonce_N from local state
+    APP->>APP: sign envelope (kind=heartbeat,<br/>seq=S, body=nonce_N)
+    APP->>BRK: POST /pub/heartbeat (overlay, envelope)
+    BRK->>BRK: verify envelope, assert nonce_N matches<br/>expected pending_nonce, assert seq advances
+    BRK->>BRK: update last_renewal, generate nonce_{N+1}, store as pending
+    BRK-->>APP: { next_nonce: nonce_{N+1}, lease_state: active }
+    APP->>APP: persist nonce_{N+1}
+
+    Note over APP,BRK: no heartbeat for 72h leads to grace.<br/>plus 7d to suspended. plus 60d to purged
+```
+
+Sweeper goroutine ticks once a minute; transitions are flag flips on the `'C'` record + an in-memory suspended-set update consumed by retrieval gating (WS6).
+
+---
+
+## 6. Lease state machine
+
+Two state machines live on a collection: the **lease** (presence-driven, this diagram) and the **verification** state (active vs unverified, which gates writes but never serving).
+
+```mermaid
+stateDiagram-v2
+    [*] --> pending : POST /pub/claim
+    pending --> verified : well-known token matches
+    pending --> [*] : token expires (24h)
+    verified --> active : first heartbeat received
+    active --> grace : 72h no renewal
+    grace --> active : renewal arrives
+    grace --> suspended : 7d total no renewal<br/>(remove from retrieval)
+    suspended --> active : renewal arrives<br/>(instant reactivation, no re-crawl)
+    suspended --> purged : 60d total no renewal<br/>(walk attribution, delete docs)
+    purged --> [*]
+
+    note right of active
+      serving normally
+      writes accepted
+    end note
+    note right of grace
+      score multiplier 0.5
+      writes accepted
+    end note
+    note right of suspended
+      docs hidden in retrieval
+      writes blocked
+      still on disk
+    end note
+```
+
+Generous timings: a laptop on vacation doesn't nuke a publisher's docs.
+
+---
+
+## 7. Worker install and register
+
+Self-contained — no ollama, no python. The bundle ships the embed runtime and model weights.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor OP as Operator
+    participant CLI as pilotctl
+    participant SUP as appstore supervisor
+    participant APP as cosift-node binary
+    participant SIDE as llama.cpp sidecar
+    participant BRK as Broker
+
+    OP->>CLI: pilotctl appstore install io.pilot.cosift-node
+    CLI->>SUP: fetch bundle (~307 MB)
+    SUP->>SUP: verify bundle sha256 vs catalogue<br/>verify each data entry sha256 vs manifest
+    SUP->>APP: spawn cosift-node --identity $APP/identity.json
+    APP->>APP: load or create identity (ed25519)
+    APP->>SIDE: spawn embed-runtime<br/>--model models/nomic-...gguf<br/>--uds $APP/embed.sock
+    SIDE-->>APP: ready
+    APP->>SIDE: embed(fixture_text)
+    SIDE-->>APP: vector v
+    APP->>APP: assert cosine(v, fixture_vector) at least 0.9999
+    APP->>BRK: POST /work/register (overlay, envelope<br/>kind=register, reports model_blob_sha256)
+    BRK->>BRK: store principal record 'P' family<br/>tier=new, sampling=1.0
+    BRK-->>APP: { ok, principal_id }
+    APP-->>SUP: ready signal
+    SUP-->>CLI: state: ready
+    CLI-->>OP: installed and ready
+```
+
+If the fixture check fails, the app stays alive for `node.status` but `node.worker_start` returns `runtime_not_ready` — never enters the loop with a tampered model.
+
+---
+
+## 8. Fetch contribution lifecycle
+
+Claim → fetch → submit → quarantine → sampled verify → promote (or reject). Politeness stays server-controlled.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant WRK as Worker app
+    participant BRK as Broker
+    participant ORG as Target site
+    participant VR as Verifier (background)
+
+    WRK->>BRK: POST /work/claim<br/>{kinds: [fetch], lanes: [1,2,3], n: 10}
+    BRK->>BRK: drain lanes by weighted RR<br/>respect host fairness + politeness deadline
+    BRK->>BRK: write 'W' leases (TTL 10min)
+    BRK-->>WRK: [{claim_id, url, robots_ok, deadline, max_body}, ...]
+
+    loop per claim
+        WRK->>ORG: GET url (own egress)
+        ORG-->>WRK: HTML/PDF
+        WRK->>WRK: extract title/text/lang/published_at
+        WRK->>BRK: POST /work/submit<br/>(envelope, claim_id,<br/>raw_sha256, extracted)
+        BRK->>BRK: schema check, body size check,<br/>content-type allowlist
+        BRK->>BRK: stage in 'S' family
+        BRK-->>WRK: { staged: true }
+    end
+
+    Note over BRK,VR: sampling rate r per principal tier<br/>r=1.0 fresh, 0.05 trusted
+
+    VR->>VR: pick fraction r of staged items
+    VR->>ORG: re-fetch url (same path)
+    VR->>VR: normalize via parse.go pipeline<br/>(drop tags, boilerplate, whitespace)
+    VR->>VR: 64-bit simhash compare<br/>(match at most 6, partial at most 14, else mismatch)
+    VR->>VR: authority check (Score(host) floor)<br/>judge gate (LLM, fail-open)<br/>ContentSHA dedup
+
+    alt all gates pass
+        VR->>VR: UpsertDocument + IndexDocument<br/>write attribution row 'A'<br/>bump principal verified_ok
+    else any gate fails or mismatch pattern
+        VR->>VR: discard from 'S'<br/>bump principal verified_fail<br/>(pattern leads to tier drop or ban)
+    end
+```
+
+Same churn-aware grading prevents single-doc slashing — a contributor goes down only on a *pattern* of mismatches.
+
+---
+
+## 9. Embed contribution lifecycle
+
+Verification is sharper here than for content — same model + same blob = deterministic match, cosine ≥ 0.9999.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant WRK as Worker app
+    participant SIDE as Bundled embed sidecar
+    participant BRK as Broker
+    participant EMB as Broker's local embedder
+    participant VR as Verifier
+
+    WRK->>BRK: POST /work/claim<br/>{kinds: [embed],<br/>model_blob_sha256: 970aa74c...,<br/>n: 100}
+    BRK->>BRK: assert blob sha matches index pin<br/>(if not -> 409, never hand work)
+    BRK->>BRK: scan docs lacking vectors<br/>chunk via internal/index/chunk.go<br/>truncate via truncateForEmbedLite
+    BRK-->>WRK: [{claim_id, doc_id, offset, length, text}, ...]
+
+    loop per chunk
+        WRK->>SIDE: embed(text)
+        SIDE-->>WRK: vector (768 float32)
+    end
+
+    WRK->>BRK: POST /work/submit<br/>(envelope, claim_id, vectors)
+    BRK->>BRK: dim check, finite check,<br/>unit-normalize server-side
+    BRK->>BRK: stage in 'S' family
+
+    VR->>VR: pick fraction r of vectors
+    VR->>EMB: re-embed(same text)
+    EMB-->>VR: vector v_local
+    VR->>VR: cosine(v_submitted, v_local) at least 0.9999?
+    alt all sampled pass
+        VR->>VR: HNSW.AddPassageBatch<br/>write attribution row 'A'<br/>bump verified_ok
+    else any fails
+        VR->>VR: reject whole batch<br/>bump verified_fail<br/>(tier drop on pattern)
+    end
+```
+
+Server defines the text (**I6**) — contributors never get to choose the input, which collapses the verification problem into "did you compute the right vector for this text."
+
+---
+
+## 10. Frontier lanes and work distribution
+
+The frontier is a single keyspace with a lane byte; weighted drain prevents bulk from starving submissions.
+
+```mermaid
+flowchart LR
+    subgraph SRC[Sources]
+        S0[publisher submit<br/>POST /pub/submit]
+        S1[RSS / sitemap refresh<br/>internal/crawler/rss.go]
+        S2[crawler discovery]
+        S3[WET / bulk import]
+    end
+
+    subgraph FR[Frontier 'f' family - lane-prefixed]
+        L0["lane 0 submitted<br/>weight 50"]
+        L1["lane 1 refresh<br/>weight 30"]
+        L2["lane 2 discovered<br/>weight 15"]
+        L3["lane 3 bulk<br/>weight 5"]
+    end
+
+    subgraph CLM[ClaimWork - weighted RR]
+        WRR["pop by lane weights<br/>host fairness within lane<br/>per-lane cursor"]
+    end
+
+    subgraph CONS[Consumers]
+        SC[server-side crawler<br/>internal/crawler]
+        WC[external workers<br/>via /work/claim]
+    end
+
+    subgraph LEA[Work leases 'W' family]
+        WL["claim_id ->{principal, expiry, attempts}<br/>TTL 10min fetch / 5min embed"]
+    end
+
+    S0 --> L0
+    S1 --> L1
+    S2 --> L2
+    S3 --> L3
+
+    L0 --> WRR
+    L1 --> WRR
+    L2 --> WRR
+    L3 --> WRR
+
+    WRR --> SC
+    WRR --> WC
+    WC -.lease.-> WL
+    WL -.expiry -> attempts++.-> WRR
+
+    style L0 fill:#dfd
+    style L3 fill:#fdd
+
+    L0 -. "lane 0 fetch -> trusted-tier only<br/>(or server-side)" .- SC
+```
+
+If lane 0 is empty its share redistributes to other lanes; deterministic weighted RR keeps statistical fairness across many claims.
+
+---
+
+## 11. Quarantine, verify, promote pipeline
+
+The atomic gate: nothing reaches the main index without passing every check for its kind.
+
+```mermaid
+flowchart TB
+    SUB["POST /work/submit<br/>envelope verified"]
+    SCH["schema + size + content-type<br/>fail fast"]
+    STG[("'S' family<br/>quarantine, TTL 14d")]
+    SCD["verification scheduler<br/>picks at rate r per principal tier"]
+
+    subgraph FETCH[Fetch path]
+        REF["re-fetch via crawler stack<br/>+ remote_fetcher CF transport"]
+        NORM["normalize via parse.go<br/>drop tags, boilerplate, collapseWS"]
+        SIM["64-bit simhash compare<br/>match, partial, mismatch"]
+    end
+
+    subgraph EMBED[Embed path]
+        RCMP["recompute via local embedder<br/>same blob sha"]
+        COS{"cosine at least 0.9999?"}
+    end
+
+    subgraph GATES[Promotion gates - both paths]
+        AUTH["authority.Score(host)<br/>lane-0 exempt, else floor 0.2"]
+        JDG["judge LLM relevance<br/>fail-open"]
+        DEDUP["ContentSHA exact-dup check"]
+    end
+
+    PROM["UpsertDocument + IndexDocument<br/>write 'A' attribution row<br/>bump verified_ok"]
+    REJ["discard from 'S'<br/>bump verified_fail<br/>pattern leads to tier drop or ban then purge"]
+
+    SUB --> SCH
+    SCH -- ok --> STG
+    SCH -- bad --> REJ
+    STG --> SCD
+
+    SCD -- fetch kind --> REF --> NORM --> SIM
+    SCD -- embed kind --> RCMP --> COS
+
+    SIM -- match or partial --> AUTH
+    SIM -- mismatch --> REJ
+    COS -- yes --> AUTH
+    COS -- no --> REJ
+
+    AUTH --> JDG --> DEDUP
+    DEDUP -- new --> PROM
+    DEDUP -- exact-dup --> REJ
+
+    style REJ fill:#fee
+    style PROM fill:#efe
+```
+
+`partial` for content is neutral (page churn — ads, timestamps); only a *pattern* of mismatches drops a tier.
+
+---
+
+## 12. Retrieval path with gating
+
+One choke point covers `/search`, `/query`, `/answer`, `/research`: the post-`retrieve()` filter loop. Suspended collections + banned principals filtered there cheaply via the docMeta v2 packed blob.
+
+```mermaid
+flowchart TB
+    Q["/query  /search  /answer  /research"]
+    PARSE["parse params: q, k, filters,<br/>decay, mode, max_passes"]
+
+    subgraph RTV[retrieve and rerank]
+        BM[BM25 lexical]
+        DN[HNSW dense ANN]
+        FUSE[hybrid fuse RRF]
+        RR["rerank Cohere or Voyage<br/>or LLMReranker"]
+    end
+
+    subgraph GATE[post-retrieve gate - the single choke point]
+        DM["lookup docMeta v2<br/>collection_id + principal"]
+        SUS{"collection<br/>suspended?"}
+        BAN{"principal<br/>banned?"}
+        GR{"collection<br/>in grace?"}
+    end
+
+    JDG["judge LLM relevance<br/>drop low-score hits"]
+    MMR[MMR diversify]
+    SYN["synthesize answer<br/>multi-pass research"]
+    OUT["SSE stream:<br/>phase events + answer + sources"]
+
+    Q --> PARSE --> BM --> FUSE
+    PARSE --> DN --> FUSE
+    FUSE --> RR --> DM
+    DM --> SUS
+    SUS -- yes --> DROP1["drop hit"]
+    SUS -- no --> BAN
+    BAN -- yes --> DROP2["drop hit"]
+    BAN -- no --> GR
+    GR -- yes --> DECAY["score x 0.5<br/>reuses decay multiplier"]
+    GR -- no --> KEEP["keep at full score"]
+    KEEP --> JDG
+    DECAY --> JDG
+    JDG --> MMR --> SYN --> OUT
+
+    style GATE fill:#ffe,stroke:#aa6
+```
+
+Same machinery for every retrieval endpoint — invariant **I8** enforced by sharing one function, not four.
+
+---
+
+## 13. Transport binding (I9)
+
+The contribution-path proof: the envelope's signing key must equal the Pilot tunnel's authenticated peer pubkey. Forge either side, broker refuses.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant APP as Worker / publisher app<br/>(principal pubkey K)
+    participant D1 as Pilot daemon<br/>(contributor side)
+    participant D2 as Pilot daemon<br/>(broker side, on GH200)
+    participant LIS as Broker pilot_listener
+    participant MW as Envelope middleware
+    participant H as Handler
+
+    APP->>D1: net.dial(broker_overlay_addr, 7700)
+    D1->>D2: tunnel handshake (Pilot mutual auth)
+    Note over D1,D2: cryptographically proves<br/>peer pubkey is K
+    D2->>LIS: accept stream, remote_pubkey = K
+    LIS->>LIS: stamp ctx[pilotPeerPubKey] = K
+
+    APP->>APP: build envelope (PrincipalPub = K, sig by K)
+    APP->>LIS: POST /work/claim (envelope in header)
+    LIS->>MW: call handler with ctx
+    MW->>MW: verify envelope sig (ed25519)
+    MW->>MW: assert envelope.PrincipalPub == ctx.pilotPeerPubKey
+    alt match
+        MW->>MW: assert seq advances, persist new seq
+        MW->>H: invoke with principal in ctx
+        H-->>APP: 200 OK
+    else mismatch
+        MW->>MW: bump Sybil counter on K<br/>(forger used wrong key, real K caught)
+        MW-->>APP: 401 envelope_peer_mismatch
+    end
+
+    Note over LIS,MW: bypass only via Contrib.AllowHTTPDev=true<br/>and 127.0.0.1 (dev only)
+```
+
+Public HTTPS via Caddy 404s these routes — overlay is the only network-reachable path.
+
+---
+
+## 14. Principal reputation
+
+Sampling rate is the lever — fresh keys verified at 100%, earned trust lowers it; mismatch patterns drop you back or ban you.
+
+```mermaid
+stateDiagram-v2
+    [*] --> new : POST /work/register
+    new --> basic : 200+ verified_ok<br/>AND age 7d+<br/>AND 0 mismatches / 30d
+    basic --> trusted : 2000+ verified_ok<br/>AND age 30d+<br/>AND operator approves
+    basic --> new : mismatch pattern<br/>(3+ in 24h)
+    trusted --> basic : mismatch pattern
+    new --> banned : mismatch pattern<br/>OR operator action
+    basic --> banned : mismatch pattern persists
+    trusted --> banned : mismatch pattern persists
+    banned --> [*] : purge all attributed docs<br/>(WS1.3 PurgePrincipal)
+
+    note right of new
+      sampling 1.0
+      lanes 2, 3
+      200 URL / 5k chunks per day
+    end note
+    note right of basic
+      sampling 0.25
+      lanes 1, 2, 3
+      2k URL / 50k chunks per day
+    end note
+    note right of trusted
+      sampling 0.05 (floor)
+      lanes 0, 1, 2, 3
+      10k URL / 250k chunks per day
+    end note
+```
+
+Expected un-caught bad submissions per burned identity ≈ (1−r)/r → 0 / 3 / 19. Purge (**I4**) reverses survivors.
+
+---
+
+## 15. Multi-broker federation (future)
+
+What v2 looks like if **D10** says go. Phase 1-5 keeps the runway clear (WS11a) but ships single-broker.
+
+```mermaid
+flowchart TB
+    subgraph DIR[Pilot directory - list-agents]
+        D["keyword: cosift-broker<br/>each broker advertises<br/>region, capacity, age"]
+    end
+
+    subgraph B[Broker pool on Pilot overlay]
+        BA[Broker A<br/>GH200 USA]
+        BB[Broker B<br/>Jetson EU]
+        BC[Broker C<br/>operator X JP]
+    end
+
+    subgraph APPS[Worker / publisher apps]
+        W1[node W1]
+        W2[node W2]
+        P1[node P1]
+    end
+
+    APPS -.discover.-> DIR
+    DIR -.candidates.-> APPS
+    W1 -- "pick lowest-latency<br/>broker_overlay_addrs plural" --> BA
+    W2 --> BB
+    P1 --> BC
+
+    subgraph GOSS[Inter-broker gossip - signed]
+        G1[principal records<br/>self-signed by principal<br/>portable across brokers]
+        G2[collection claims<br/>well-known token<br/>re-verifiable per broker]
+        G3[reputation exports<br/>signed counter deltas<br/>opt-in import]
+        G4["attribution<br/>doc carries principal_sig + broker_sig"]
+    end
+
+    BA <-->|signed sync| BB
+    BB <-->|signed sync| BC
+    BA <-->|signed sync| BC
+
+    BA -.uses.-> GOSS
+    BB -.uses.-> GOSS
+    BC -.uses.-> GOSS
+
+    subgraph FRO[Frontier sharding - reuses existing code]
+        SH["URL hash FNV-32 -> shard<br/>internal/config/cluster.go<br/>ForwardFn for cross-broker forward"]
+    end
+
+    BA -.shard.-> SH
+    BB -.shard.-> SH
+    BC -.shard.-> SH
+
+    style GOSS fill:#eef,stroke:#88a,stroke-dasharray:5 5
+    style DIR fill:#fef,stroke:#a8a
+```
+
+The portability invariants from WS11a are what make this additive instead of a rewrite: principals, collections, attribution, and frontier sharding all already work cross-broker; v2 just adds discovery + gossip + import logic.
+
+---
+
+## Reading order if you only have ten minutes
+
+1. **Diagram 1** — see the three planes and where Pilot sits.
+2. **Diagram 2** — see the developer-to-AI-agent loop end to end.
+3. **Diagram 13** — see the I9 transport binding (the security spine).
+4. **Diagram 11** — see the verification pipeline (the trust spine).
+5. **Diagram 6** — see the lease lifecycle (the adoption flywheel).
diff --git a/docs/PLAN-contrib-network.md b/docs/PLAN-contrib-network.md
new file mode 100644
index 0000000..ef24660
--- /dev/null
+++ b/docs/PLAN-contrib-network.md
@@ -0,0 +1,438 @@
+# PLAN — Cosift Open Contribution Network
+
+Status: DRAFT for review · Owner: teodor · Last updated: 2026-06-12
+
+Two coupled initiatives, one shared trust substrate:
+
+1. **Publisher path** — developers index their documentation; the index entry stays
+   active only while their Pilot app holds a live lease (heartbeats), solving the
+   LLM-knowledge-cutoff problem for new dev tools and driving Pilot adoption.
+2. **Open frontier** — third-party peers claim crawl/embed work from the frontier
+   and submit signed results; contributions are quarantined, verified by sampling,
+   attributed, and revocable.
+
+Everything below is grounded in current code. Line numbers verified 2026-06-12
+against branch state; numbers marked `≈` came from exploration agents and should
+be re-confirmed at implementation time (symbol names are authoritative).
+
+---
+
+## 0. Definitions
+
+| Term | Meaning |
+|---|---|
+| **Principal** | An ed25519 pubkey registered with cosift. Roles: `publisher`, `contributor`, or both. The key of an appstore app instance (`$APP/identity.json`) or any Pilot identity. |
+| **Collection** | A claimed domain/path-prefix owned by a publisher principal. Carries lease state. |
+| **Lane** | Frontier priority class. `0=submitted` (publisher docs), `1=refresh`, `2=discovered`, `3=bulk`. |
+| **Claim** | A leased unit of work (fetch one URL, or embed N server-defined chunks) handed to a contributor, with TTL. |
+| **Envelope** | The canonical signed message wrapping every authenticated request (Appendix A). |
+| **Quarantine** | Staging area for contributed results; nothing enters the main index without passing verification. |
+| **Tier** | Per-principal reputation level; determines sampling rate, quotas, and lane access. |
+
+## 0.1 Security invariants (must hold at every phase)
+
+- **I1** — No write reaches even quarantine without a valid envelope signature from a registered, non-banned principal referencing a live claim.
+- **I2** — No contributed content reaches the main index without passing the verification pipeline for its kind.
+- **I3** — Every promoted doc/vector is attributable: `doc → (principal, sig, ts)` is stored and survives restarts.
+- **I4** — Banning a principal makes retroactive purge of all their promoted contributions possible and bounded (one index walk).
+- **I5** — A brand-new principal is sampled at 100%; sampling rate only decreases through verified-good history (Sybil identities gain zero leverage).
+- **I6** — Embed jobs are always server-defined text. We never accept a vector for text the server did not hand out.
+- **I7** — The submission/work auth surface never reuses `Server.AdminToken` or `Cluster.PeerAuthToken`.
+- **I8** — Suspended collections and banned principals are filtered at the single retrieval choke point shared by `/search`, `/query`, `/answer`, `/research`.
+- **I9** — All contribution-path traffic (`/pub/*`, `/work/*`) is transport-bound to Pilot: the only network-reachable surface is an overlay listener. The HTTP server's contribution paths are bound to a loopback/UDS the operator's daemon owns; they are not routed by the public reverse proxy. The envelope's signing key (WS0.1) MUST equal the Pilot peer pubkey that authenticated the overlay tunnel — mismatch = reject. This makes "the data came through Pilot" cryptographically verifiable, not just operationally assumed.
+
+---
+
+## WS0 — Envelope + principal registry (foundation; everything depends on this)
+
+### WS0.1 Canonical signed envelope
+- **Where (new):** `internal/principal/envelope.go` (+ `envelope_test.go`).
+- **Reuse:** `crypto.Verify()` / key codecs from web4 — `pilot-protocol/common/crypto/identity.go` (`Identity.Sign` ≈:32, `Verify` ≈:38, base64 key codecs). Import or vendor; decide module path at implementation (cosift currently has no dependency on `common`).
+- **What:** Define `Envelope{PrincipalPub, Kind, ClaimID, BodySHA256, ModelID, Seq, Sig}` with a deterministic canonical byte serialization (length-prefixed fields, fixed order — not raw JSON). `Kind ∈ {register, pub_claim, pub_submit, heartbeat, work_claim, work_submit, work_renew, retire}`. `Seq` is per-principal strictly monotonic.
+- **Acceptance:**
+  - Round-trip test: sign → verify passes; any single-byte mutation of any field fails verification.
+  - Replay test: same envelope presented twice → second rejected (`seq` not advanced).
+  - Cross-impl fixture: a JSON test vector checked in so the worker app (WS10) can verify its signing against the same bytes.
+  - Fuzz test on the canonical decoder (`go test -fuzz=FuzzEnvelopeDecode -fuzztime=30s` clean).
+
+### WS0.2 Principal registry
+- **Where (new):** `internal/principal/registry.go`; persistence in WS1.1.
+- **What:** `Register(pub, roles)`, `Get(pub)`, `Bump(pub, outcome)` (verified-ok / verified-fail / mismatch counters), `Ban(pub, reason)`, seq tracking, per-role quotas (URLs/day, bytes/day, max in-flight claims).
+- **Acceptance:**
+  - Unit tests for quota windows (day rollover), seq monotonicity, ban idempotency.
+  - Banned principal: every envelope kind rejected with a distinct error code (`403 problem+json, type=principal_banned`).
+
+### WS0.3 HTTP auth middleware
+- **Where:** `cmd/cosift/pebble_serve.go` — new `wrapSigned(handler)` alongside the existing route table (route registration block at `:474-532`). Mounted only on `/pub/*` and `/work/*`.
+- **What:** Parse envelope from `X-Cosift-Envelope` header (base64) covering the request body hash; verify; load principal; enforce quota; stash principal in request context.
+- **Acceptance:**
+  - Table-driven handler tests: no envelope / bad sig / stale seq / banned / over-quota → 401/403/429 respectively with problem+json bodies; happy path passes principal to handler.
+  - `Server.AdminToken` and `Cluster.PeerAuthToken` are never consulted on these routes (assert via test that requests carrying only those tokens are rejected) — invariant **I7**.
+
+---
+
+## WS1 — Store schema (Pebble families, attribution, doc provenance)
+
+Key-family conventions live at `internal/store/pebble.go:12-21` (schema comment
+block) — extend that comment with every new family below.
+
+### WS1.1 New key families
+- **Where:** `internal/store/pebble.go` (+ split into `pebble_contrib.go` if >300 lines).
+- **What:**
+  - `'P' + pubkey` → gob(PrincipalRecord) — registry persistence for WS0.2.
+  - `'C' + collectionID` → gob(CollectionRecord{Owner, Prefix, State, LeaseSeq, LastRenewal, VerifiedAt, Quotas}); secondary `'C' + 'p' + prefix` → collectionID for prefix-claim lookup.
+  - `'S' + ulid` → gob(StagedContribution) — quarantine, TTL'd.
+  - `'A' + pubkey + docID` → empty (principal→docs walk for purge); `'A' + 'd' + docID` → {pubkey, sigSHA, ts} (doc→provenance).
+  - `'W' + claimID` → gob(WorkLease{Kind, Payload, Principal, Expiry, Attempts}).
+- **Acceptance:**
+  - CRUD unit tests per family; `cosift pebble-compact` (cmd/cosift/pebble_compact.go) runs clean over a store containing all new families.
+  - Snapshot/restore: create records → checkpoint (`POST /admin/checkpoint`, route at `:518`) → reopen from checkpoint → records intact.
+
+### WS1.2 Document provenance + docMeta versioning
+- **Where:** `Document` struct `internal/store/store.go:30-66` (add `CollectionID uint32`, `Principal []byte` — empty for operator-crawled); docMeta packed blob written in `UpsertDocument` `internal/store/pebble.go:250-319` (write at ≈:296); all docMeta readers (grep `GetDocMeta`).
+- **What:** Add a leading version byte to the docMeta packed value (`v2 = version, collection_id, url, title`). Reader accepts v1 (no version byte ⇒ collection 0) and v2. No eager migration — lazy upgrade on next write of each doc.
+- **Acceptance:**
+  - Mixed-store test: store with v1 and v2 entries; reads return correct collection for both; search enrichment loop unaffected.
+  - On the GH200 corpus (~9M-host scale): `/stats` doc count identical before/after deploy; zero `docMeta decode` errors in logs over 24h.
+
+### WS1.3 Purge-by-principal / purge-by-collection
+- **Where (new):** `internal/store/purge.go`; deletion paths must cover: doc keys (`'d','u','i','h'` families per pebble.go:12-21), postings (`'p','t','l','g'` — see `IndexDocument` ≈:1033-1100), HNSW passages (delete path near `internal/index/hnsw.go:445`), PQ codes (`'q'` family, `internal/index/pq_persist.go`), attribution rows.
+- **What:** `PurgePrincipal(pub)` and `PurgeCollection(id)` — walk `'A'`/collection index, delete everything, emit count. Rate-limited background job (not request-path).
+- **Acceptance:**
+  - E2E test: index 100 docs from principal X and 100 from Y → purge X → `/search` returns only Y's docs for matching queries; HNSW node count drops accordingly; `/stats` reflects new count; re-running purge is a no-op (idempotent).
+
+---
+
+## WS2 — Frontier lanes + work leases
+
+### WS2.1 Lane byte in frontier keyspace
+- **Where:** `frontierStatusIndexKey` `internal/store/pebble.go:371` (key becomes `'f' + sub + lane + host + 0x00 + url`); `frontierEntry` struct `:415` (add `Lane uint8`); `PushFrontier` `:1187` (new signature or `PushFrontierLane(ctx, url, depth, lane, priority)`); status constants `:404-409` unchanged.
+- **What:** All four lanes; existing callers map to lanes — crawler discovery → lane 2; RSS/sitemap refresh (`internal/crawler/rss.go`, `sitemap.go`) → lane 1; WET/bulk handlers (`pebble_serve.go:2643, :2771`) → lane 3; publisher submissions (WS3) → lane 0.
+- **Migration:** one-time startup scan: re-key existing `'f'+sub+host…` entries to lane 2. Gate behind a meta marker (`'m' + "frontier_lane_migrated"`) so it runs once.
+- **Acceptance:**
+  - `go test ./internal/store/...` green including new lane round-trip tests.
+  - Migration test: build store with old-format keys → open → `/queue` totals (queued/in_flight/done/errored) identical pre/post; all entries report lane 2.
+  - On GH200: migration completes < 10 min for current frontier size; log line reports counts.
+
+### WS2.2 Lane-weighted claiming
+- **Where:** `ClaimFrontier` `internal/store/pebble.go:1230`; per-lane cursor replaces single `frontier_cursor` meta (load ≈:199-201).
+- **What:** Weighted drain (default 50/30/15/5, configurable WS7) via deterministic weighted round-robin over non-empty lanes; host-fairness logic preserved *within* a lane; empty lanes donate their share.
+- **Acceptance:**
+  - Statistical test: seed 4 lanes × 1k URLs, claim 1k → per-lane counts within ±10% of weights; with lane 0 empty, its share redistributes.
+  - Existing crawler e2e (`main_e2e_test.go`, `bench_crawl_test.go`) still green.
+
+### WS2.3 Work leases (external claims)
+- **Where (new):** `internal/store/lease_work.go` using `'W'` family (WS1.1); re-queue uses `frontierEntry.Attempts` (`pebble.go:415`).
+- **What:** `ClaimWork(principal, kinds, lanes, max)` → atomically pop frontier entries (fetch jobs) or embed-pending chunks (WS5) into `'W'` leases with TTL (default 10 min fetch / 5 min embed); `RenewLease`; expiry sweeper returns work to frontier with `Attempts++`; per-principal in-flight cap (default 32).
+- **Lane policy:** lane 0 fetch jobs only to tier ≥ `trusted` principals (or server-fetched) — publisher-owned content has higher poisoning stakes. Lanes 1–3 open per tier table (Appendix C).
+- **Acceptance:**
+  - Lease expiry test (injected clock): claimed-not-submitted work returns to frontier, attempts incremented, claimable by another principal.
+  - Starvation test: principal claiming and dropping repeatedly hits in-flight cap; frontier drains via others.
+  - Double-submit on same claimID → second rejected (409).
+
+---
+
+## WS3 — Publisher path (collections, verification, leases)
+
+### WS3.1 Collection claims + domain verification
+- **Where (new):** `internal/collections/` (records via WS1.1 `'C'`); HTTP in `pebble_serve.go` (`POST /pub/claim`, `GET /pub/verify-status`).
+- **What:** Claim = `{prefix}` where prefix is `host[/path-prefix]` (**OPEN DECISION D2**). Verification worker fetches `https://<host>/.well-known/cosift-verify.txt` expecting the challenge token (DNS TXT `cosift-verify=<token>` fallback). First verified claim on a prefix wins; overlapping claims rejected (longest-prefix rule for nesting). Re-verify every 30 days; failure → collection `unverified` (docs stay, submissions blocked).
+- **Acceptance:**
+  - E2E with `httptest` origin: claim → serve token → verified within one worker tick; wrong/missing token → stays pending with reason; second principal claiming same prefix → 409.
+  - Re-verification failure flips state and blocks `/pub/submit` (403) but does not suspend serving.
+
+### WS3.2 Lease state machine + heartbeats
+- **Where (new):** `internal/collections/lease.go`; sweeper goroutine started where the server wires background loops in `runPebbleServe` (near crawler wiring `pebble_serve.go:758-766`).
+- **What:** `active → grace(72h) → suspended(7d) → purged(60d)`; renewal at any pre-purge state reactivates instantly. Heartbeat = envelope kind `heartbeat`; **nonce-chained**: each heartbeat response carries `next_nonce`; the next heartbeat must sign it (**OPEN DECISION D1** — recommended, no inbound push needed since appstore apps can't receive unsolicited messages).
+- **In-memory gate state:** suspended-collection set rebuilt from `'C'` at startup, mutated by sweeper, consumed by WS6.
+- **Acceptance:**
+  - Clock-injected unit tests for every transition incl. reactivation from grace and suspended.
+  - Heartbeat replay (old nonce) rejected; out-of-order seq rejected.
+  - E2E: submit docs → indexed → stop heartbeats → advance clock 72h → docs rank-decayed (grace); +7d → absent from `/search`; renew → present again without re-crawl; +60d → purged via WS1.3 (verify HNSW/postings shrink).
+
+### WS3.3 Publisher submission
+- **Where:** `pebble_serve.go` new `POST /pub/submit` (urls | sitemap_url | `replace_prefix`); pushes lane 0 via WS2.1; sitemap path reuses `internal/crawler/sitemap.go` streaming seeder.
+- **What:** Per-collection quotas (pages, bytes/day). `replace_prefix` semantics: on successful index of the new set, docs under the prefix not in the new set are purged (supersede; fixes version pollution) (**OPEN DECISION D3** — replace vs coexist; replace recommended).
+- **Acceptance:**
+  - E2E: submit 10 URLs → all crawled from lane 0 ahead of seeded lane-2 noise → docs carry `CollectionID`; over-quota submit → 429.
+  - `replace_prefix` test: v1 set indexed → submit v2 with replace → only v2 retrievable; doc count correct.
+
+---
+
+## WS4 — Open frontier: fetch contributions (quarantine → verify → promote)
+
+### WS4.1 Work + submit API
+- **Where:** `pebble_serve.go` new `POST /work/claim`, `POST /work/submit`, `POST /work/renew` (signed, WS0.3); claims from WS2.3.
+- **What:** Fetch-job payload to contributor: `{claim_id, url, robots_ok: true, politeness_deadline, max_body: 5MB, accepted_content_types}` — mirrors server-side gates (content-type allowlist `internal/crawler/crawler.go` ≈:1131; body cap ≈:1139-1145; robots checked **server-side before handing out**, reusing `internal/crawler/robots.go`). Submission: `{claim_id, final_url, http_status, fetched_at, raw_sha256, extracted: {title, text, lang, published_at, …}}` in an envelope. Lands in `'S'` quarantine only.
+- **Acceptance:**
+  - Submit without claim / expired claim / wrong principal → 4xx, nothing staged.
+  - Robots-disallowed URLs never appear in handed-out claims (test with fixture robots.txt).
+  - Oversized text / disallowed content-type rejected at intake (mirror of crawler gates).
+
+### WS4.2 Content verification pipeline
+- **Where (new):** `internal/verify/` — `content.go`, `scheduler.go`, `simhash.go`.
+- **Reuse:** re-fetch via crawler fetch path incl. `remote_fetcher.go` CF-worker transport (`internal/crawler/remote_fetcher.go:37,68`); extraction/normalization from `internal/crawler/parse.go` (drop-tags ≈:228-242, boilerplate tokens ≈:244-285, `collapseWhitespace` ≈:601-616) so both sides compare like-for-like.
+- **What (new):** 64-bit simhash over word shingles (no near-dup machinery exists today — ContentSHA is exact-only, see `crawler.go` ≈:674-767). Verdicts: `match` (hamming ≤ 6), `partial` (≤ 14), `mismatch`. Sampling per principal tier (Appendix C); `partial` is neutral (page churn, geo-variance); repeated `mismatch` pattern → tier drop / ban via WS0.2.
+- **Promotion gate chain:** schema checks → sampled re-fetch compare → `authority.Score(host)` floor (reject < 0.2 unless lane 0; `internal/authority/authority.go`) → optional judge pass (`internal/judge/judge.go`, fail-open as in `/answer` use at `pebble_serve.go` ≈:5402-5421) → exact-dup check (ContentSHA) → `UpsertDocument` + `IndexDocument` with provenance (WS1.2/WS1.3 fields) → reputation bump.
+- **Acceptance:**
+  - Red-team e2e (new `zz_contrib_redteam_test.go`): honest submissions promote; tampered text (entity swap / injected spam paragraph) at 100% sampling → caught, staged-rejected, principal counters reflect it; after ban, principal's previously-promoted docs purged (I4).
+  - Churn tolerance: same page with rotated ad block / timestamp → `match` or `partial`, never `mismatch` (fixture pair tests for simhash thresholds).
+  - Quarantine TTL: unverified entries older than 14 days dropped; `'S'` family size bounded in soak test.
+  - Throughput: verification worker sustains ≥ 5 re-fetches/s without disturbing crawl politeness (shares hostGate `internal/crawler/gate.go`).
+
+### WS4.3 Reputation, tiers, sampling
+- **Where (new):** `internal/reputation/` (uses WS0.2 counters; tier table Appendix C).
+- **What:** Tier function over verified history; emits sampling rate (1.0 → 0.05 floor), per-tier quotas, lane access. All transitions logged + metric'd.
+- **Acceptance:**
+  - Property test: expected accepted-bad-before-ban ≈ (1−r)/r honored by simulation within tolerance; r=1.0 for fresh principals (I5).
+  - Tier promotion requires ≥ N verified-good (default 200) AND age ≥ 7 days; demotion immediate on mismatch pattern.
+
+---
+
+## WS5 — Embed contributions (server-defined text only — I6)
+
+### WS5.1 Index-level model pin (blob-sha, not name)
+- **Production reality** (verified 2026-06-12 on GH200): embedder is **`nomic-embed-text-v1.5`** (137M params, 768-dim, F16 GGUF, `nomic-bert` family, ~274 MB). Served via 8 ollama replicas (ports 11435-11442); cosift `embeddings.urls` round-robins (`internal/embed/client.go` `RoundRobinEmbedder`). On-disk blob: `sha256-970aa74c0a90ef7482477cf803618e776e173c007bf957f635f1015bfcfef0e6`.
+- **Where:** HNSW persistence meta blob (`internal/index/hnsw_persist.go` meta ≈:28-34, magic `HSW1`) — add `model_family` (string), `model_blob_sha256` (32 bytes), `dim` (already implicit). Surfaced in `/stats` (`buildStatsBody` `pebble_serve.go:3084`) and `/healthz`. The blob sha is the strongest pin — name `nomic-embed-text:latest` can drift; the blob bytes can't.
+- **Server-side blob verification:** at startup, hit each `embeddings.urls` endpoint with a known fixture text, compare returned vector against a checked-in fixture vector (cosine ≥ 0.9999); mismatch → refuse to start with mode `dense_enabled`. Fixture lives at `testdata/embed_fixture.json` (text + expected 768-float vector). Fixes a latent operator-side gap (Pebble path currently stores no model identity at all; only legacy SQLite did).
+- **Acceptance:**
+  - Open index with mismatched configured embedder → startup warning + dense disabled + `/healthz` reports `degraded`.
+  - Matching blob → normal; snapshot round-trip preserves pin.
+  - Fixture cosine check runs against each of the 8 replicas at startup; any replica failing fixture removed from rotation.
+
+### WS5.2 Embed jobs + recompute verification
+- **Where:** job source = the embed-backfill scan (docs lacking vectors — `handleEmbedBackfill` `pebble_serve.go:2383`, chunker `internal/index/chunk.go` 320/64 words, truncation `truncateForEmbedLite` ≈:2485); claims via WS2.3; intake via `/work/submit`; insertion via `AddPassageBatch` `internal/index/hnsw.go:471` (normalization in-place `internal/index/vector.go` ≈:275-287).
+- **What:** Claim payload: `{claim_id, model_family, model_blob_sha256, dim, chunks: [{doc_id, offset, length, text}]}` (server sends the exact text — contributor never chooses it — **I6**). Submission: vectors (dim-checked, finite-checked, then unit-normalized server-side). Verification: recompute a sample with local embedder; **calibrated cosine threshold ≥ 0.9999** (same-blob F16 cross-machine determinism in practice; calibrate on GH200 vs Jetson during WS15.3b — refuse to lower if measurement diverges). Batch fails if any sampled vector fails. Contributors whose reported `model_blob_sha256` ≠ index pin: claim refused at `/work/claim`, never handed work.
+- **Contention framing:** the embed bottleneck is not raw watts (~3 GB GPU, 0-30% util on the H100) — it's **vLLM contention on the same H100 during /answer**. Offloading embeds gives `/answer` latency headroom and unblocks moving to a bigger embedder later (e.g., nomic-embed-text → bge-large) without regressing answer p95.
+- **Acceptance:**
+  - E2E with mock embedder: honest vectors promote into HNSW (searchable via `/search?mode=dense`); perturbed vector (cosine 0.99 vs recompute, below 0.9999 threshold) at sampling=1.0 → batch rejected, reputation hit.
+  - Wrong `model_blob_sha256` / wrong dim / NaN → rejected at `/work/claim` or `/work/submit` (400), never staged.
+  - Dogfood: Jetson node runs worker app (WS10) bundled embedder against staging box; ≥ 10k chunks contributed, sampled-verified, zero false rejects at calibrated threshold.
+  - Contention metric: with contributors active during a synthetic `/answer` load test (10 rps), p95 `/answer` latency drops ≥ 15% vs same load with local embed-backfill running.
+
+### WS5.3 Bundled embed runtime (contributor side, NO ollama dependency)
+- **Where (new, in `pilot-protocol/cosift-node/` — see WS10):** `embed/` package wrapping a llama.cpp sidecar.
+- **What:** The worker app bundle ships:
+  - `bin/embed-runtime` per arch — llama.cpp built in `embedding` mode (server, unix-socket transport), ~5-10 MB per arch. MIT license, redistributable.
+  - `models/nomic-embed-text-v1.5.f16.gguf` — the exact blob (`sha256:970aa74c…`) the GH200 serves. ~274 MB. Apache 2.0 license, redistributable.
+  - `embed_fixture.json` — same fixture used in WS5.1, lets the app self-test on first start.
+- **App lifecycle:** on `node.worker_start`, app spawns embed-runtime with `--model models/…gguf --uds $APP/embed.sock --embedding --pooling mean`; on shutdown kills the child. Health-check by running the fixture text through the sidecar and asserting cosine ≥ 0.9999 vs the fixture vector — refuses to enter the worker loop if it fails (would mean tampered weights or wrong build).
+- **Why a sidecar, not cgo into the Go app:** keeps the Go binary cross-compile-clean (no cgo cross), keeps llama.cpp updates independent of the app, lets the sandbox kill the child without restarting the parent. Standard pattern; well-trodden.
+- **Acceptance:**
+  - Install on linux/arm64 (Jetson) and darwin/arm64 → embed-runtime spawns within 5 s; fixture self-test passes; `node.worker_stats` reports `runtime_ready: true, model_blob_sha256: 970aa74c…`.
+  - Tampered model file (one byte flipped) → fixture cosine fails → worker refuses to start; structured error returned to operator via `node.worker_start`.
+  - Cross-runtime fidelity test: same 200 fixture texts embedded by (a) GH200 ollama and (b) bundled llama.cpp → all pairs cosine ≥ 0.9999. Run in CI to detect any llama.cpp version that drifts from ollama-served output.
+  - No external dependency required: `pilotctl appstore install io.pilot.cosift-node && node.worker_start` works on a freshly-imaged machine with no ollama / no python.
+
+---
+
+## WS6 — Retrieval gating (grace decay, suspension, bans)
+
+- **Where:** single choke point — post-`retrieve()` filter/enrichment loop shared by all retrieval handlers (`pebble_serve.go` ≈:3700-3750, `retrievalFilters` at `:6742`); decay precedent `decayMultiplier`/`applyTimeDecay` ≈:4657-4677.
+- **What:** Check docMeta v2 `collection_id` (WS1.2) against in-memory suspended set (WS3.2) → drop; collection in grace → multiply score by configurable factor (default 0.5), reusing the multiplicative-decay pattern; doc principal banned (rare transient window before purge completes) → drop.
+- **Acceptance:**
+  - Unit: hits from suspended collections absent across `/search`, `/query`, `/answer`, `/research` (one test per handler — they share the loop but assert anyway, I8).
+  - Grace decay changes ordering deterministically in a fixture corpus.
+  - Overhead: enrichment loop p95 unchanged within noise on a 1k-hit benchmark (`bench_compare_test.go` pattern).
+
+---
+
+## WS7 — Config
+
+- **Where:** `internal/config/config.go` — new top-level `Contrib` section beside `Cluster` (≈:57-88) / `Server` (≈:91-103); example file `cosift.json.example`; doc `docs/CLI-FLAGS.md`.
+- **What:**
+  ```jsonc
+  "contrib": {
+    "enabled": false,            // master kill-switch (default OFF)
+    "publishers_enabled": false,
+    "workers_enabled": false,
+    "lane_weights": [50,30,15,5],
+    "lease_ttl_fetch_s": 600, "lease_ttl_embed_s": 300,
+    "grace_h": 72, "suspend_d": 7, "purge_d": 60,
+    "sampling_floor": 0.05, "tier_promote_min_ok": 200,
+    "quotas": { "fetch_per_day": 2000, "embed_chunks_per_day": 50000, "pub_pages_per_day": 1000 },
+    "simhash_match_hamming": 6, "simhash_partial_hamming": 14,
+    "embed_verify_cosine": 0.99,
+    "multi_attestation": false   // OPEN DECISION D4
+  }
+  ```
+- **Acceptance:** defaults compile to a fully inert server (no new routes mounted when `enabled=false` — route-table test); every field has an env override following the existing `COSIFT_*` pattern; `doctor` (zz_doctor_runner_test.go surface) validates ranges.
+
+## WS8 — Observability
+
+- **Where:** `handleMetrics` `pebble_serve.go:3267`, `handleStats` `:3020`, `handleQueue` `:2894`; `assets/openapi.json` + swagger assets.
+- **What:** Prometheus: `cosift_lane_depth{lane}`, `cosift_staging_depth`, `cosift_verify_total{kind,verdict}`, `cosift_principals{tier}`, `cosift_collections{state}`, `cosift_work_claims_active`, `cosift_embed_external_chunks_total`, `cosift_purged_docs_total{cause}`. `/queue` gains per-lane breakdown + open-claim counts (contributor storefront — deliberately public). `/stats` gains `collections` + `contrib` blocks. OpenAPI documents `/pub/*`, `/work/*`, envelope header, problem types.
+- **Acceptance:** metrics appear with zero values when feature off; soak test scrapes parse with `promtool check metrics`; openapi.json passes `swagger-cli validate` (or the repo's existing check); `/queue` p95 unchanged (it's public + hot).
+
+## WS9 — Overlay transport (Pilot-only for contribution traffic — I9)
+
+This is not a "expose it on the overlay too" workstream — it is the only transport for contributions.
+
+- **Where:** new `cmd/cosift/pilot_listener.go`. Web4 primitives: daemon IPC `CmdBind` (`web4/pkg/daemon/ipc.go` ≈:26-75; remember the `/tmp/pilot.sock` cleanup gotcha from cluster memory); gateway `Map` (`gateway/gateway.go` ≈:33-78) is the fallback if the IPC path is blocked.
+- **What — three coupled changes:**
+  1. **Pilot listener with verified peer identity.** Cosift opens an overlay listener via `CmdBind` on virtual port **7700**. Each accepted stream's remote pubkey comes from the Pilot tunnel handshake (cryptographically authenticated by Pilot itself — see `pkg/daemon/ports.go` ≈:357-371 listener `AcceptCh`). The listener wraps each stream as an in-process `http.Handler` invocation with the remote pubkey stamped into request context under a sentinel key `pilotPeerPubKey`.
+  2. **Envelope ↔ tunnel identity binding.** The signed envelope middleware (WS0.3) reads `pilotPeerPubKey` from context and asserts `envelope.PrincipalPub == ctx.PilotPeerPubKey`. Mismatch → 401, principal counter bumped (this is a Sybil-ish indicator). For the HTTP/loopback dev path, this check is bypassed only when the request originates from `127.0.0.1` AND a `Contrib.AllowHTTPDev` config flag is set (default false).
+  3. **Public HTTP surface stripped of contribution routes.** `/pub/*` and `/work/*` are removed from the Caddy reverse-proxy config; they bind on cosift's HTTP server but are 404 to any non-overlay-non-loopback caller. The Caddy site config (`/etc/caddy/Caddyfile` on GH200) gains an explicit `respond /pub/* 404` and `respond /work/* 404` ahead of the `reverse_proxy` directive. (`encode gzip` stays out — known SSE killer from prior memory.)
+- **What overlay consumers see:** `/pub/*`, `/work/*`, `/queue`, `/healthz` (read-only). `/admin/*` is **forbidden via overlay** (route allowlist enforced at the listener wrapper, not just at handler-time).
+- **Acceptance:**
+  - From a second Pilot node with a fresh pubkey K: `net.dial` → `/work/claim` with envelope signed by K → succeeds end-to-end over overlay.
+  - From the same node: `/work/claim` with envelope signed by K' ≠ K → 401 `envelope_peer_mismatch`, counter on K bumps.
+  - From the public internet via Caddy: `/work/claim` → 404 (route stripped); `/pub/submit` → 404.
+  - From loopback with `Contrib.AllowHTTPDev=false`: same → 404. With flag on (dev only): bypasses tunnel-identity check, still requires valid envelope.
+  - `/admin/*` over overlay → 403 (allowlist refuses).
+  - GH200 daemon restart re-binds within 10 s (systemd retry loop, IPC reconnect); listener test covers daemon-death-during-stream cleanup.
+  - `docs/API.md` documents the overlay-required posture and the dev-flag escape hatch.
+
+## WS10 — `io.pilot.cosift-node` appstore app (publisher + worker; self-contained)
+
+- **Where (new repo/dir):** `pilot-protocol/cosift-node/` modeled on `pilot-protocol/wallet` (manifest schema `app-store/pkg/manifest/manifest.go` ≈:23-155; IPC dispatcher `app-store/pkg/ipc/server.go` ≈:22-95; envelope `pkg/ipc/envelope.go` ≈:33-41). Bundles the embed runtime (WS5.3) — **no external ollama / python / model-download steps for the user**.
+- **What:**
+  - Manifest: id `io.pilot.cosift-node`, `exposes`: `node.help`, `node.claim_prefix`, `node.submit_docs`, `node.status`, `node.retire`, `node.worker_start`, `node.worker_stop`, `node.worker_stats`, `node.embed_runtime_status`. Grants: `net.dial` (overlay to cosift broker), fs on `$APP/`, spawn-child for the bundled embed sidecar. Per-app identity `$APP/identity.json` (supervisor passes `--identity`) is **both** the appstore-app key and the cosift principal key — single key throughout. **OPEN DECISION D5**: one app two roles (recommended) vs two apps.
+  - **All broker traffic goes over Pilot (I9).** The app uses `net.dial` to virtual port 7700 on the broker's overlay address; **never** dials the broker's public HTTPS surface. Configuration carries `broker_overlay_addr`, not a URL.
+  - Publisher role: registers principal, claims prefix, drives `/pub/*`, runs heartbeat loop (6h, nonce-chained). Uninstall ⇒ identity destroyed ⇒ heartbeats stop ⇒ lease lapses — the "active only while installed" semantics enforced by key lifecycle.
+  - Worker role: loop = claim → either (a) fetch (own egress; honor handed-out politeness deadline + robots/UA fields) or (b) embed via bundled sidecar (WS5.3) — claim refused server-side if app's reported `model_blob_sha256` doesn't match index pin → sign → submit. Honors `worker_stop`; backs off on 429.
+  - First-run sequence: identity load-or-create → spawn embed sidecar → run fixture self-test (WS5.3 acceptance) → register principal with broker (overlay) → publish `node.help` schema → wait for IPC. If sidecar self-test fails, app stays alive for `node.help` / `node.status` but returns `runtime_ready: false` and refuses worker_start.
+- **Acceptance:**
+  - `node.help` returns full method/param schema; advertises `embed_runtime: { family: nomic-embed-text-v1.5, blob_sha256: 970aa74c…, dim: 768, runtime: llama.cpp }`.
+  - Clean-machine install (no ollama, no python): `pilotctl appstore install io.pilot.cosift-node` → spawn → ready → `node.worker_start` produces signed-and-submitted embed contributions within 60 s.
+  - Publisher path: `node.claim_prefix` + well-known token on a test origin → verified via overlay → docs live; `pilotctl appstore uninstall` → (clock-advanced on broker) suspension. Reinstall → new key ⇒ re-claim required and succeeds via still-present well-known token.
+  - Identity binding (I9): tamper with envelope to use a different pubkey from the overlay tunnel → broker rejects with `envelope_peer_mismatch`; counter incremented on tunnel's pubkey, not on forged envelope.
+  - Worker soak: 24h on Jetson, ≥ 99% of claims either submitted or expired cleanly (no leaks), zero signature failures; embed sidecar memory steady (< 1.5 GB RSS), no leaks.
+  - Signing cross-check uses WS0.1 fixture vectors.
+  - All broker calls visible in pilot tunnel logs; if `net.dial` to overlay fails (daemon down), app surfaces structured error and retries with backoff (does NOT silently fall back to HTTPS).
+
+## WS11 — Packaging & catalogue (chunky bundle, deliberately)
+
+- **Where:** bundles per `pilot-protocol/catalog/README.md` (tar.gz: `manifest.json` + `bin/<binary>` + extra files; sha256 pinned manifest→binary, catalogue→bundle); catalogue entry in `pilot-protocol/web4/catalogue/catalogue.json`.
+- **Bundle contents (per arch):**
+  - `manifest.json` (~2 KB)
+  - `bin/cosift-node` Go binary (~25 MB)
+  - `bin/embed-runtime` llama.cpp embedding server (~8 MB)
+  - `models/nomic-embed-text-v1.5.f16.gguf` (~274 MB; Apache 2.0)
+  - `testdata/embed_fixture.json` (~30 KB)
+  - **Total per arch: ~307 MB compressed (~310 MB uncompressed).**
+- **Why F16 and not quantized:** matches the server blob byte-for-byte, enabling cosine ≥ 0.9999 verification (WS5.2). Q5_K_M would save ~180 MB per bundle but lower the threshold to ~0.998, weakening the rejection signal. Worth offering Q5_K_M as a second variant later (manifest `variants` list) if download size hurts adoption.
+- **Manifest extension:** add a `data` array alongside `binary`, each entry `{path, sha256, size}` — supervisor verifies every entry's sha256 on each spawn (`app-store/INTEGRATION.md` ≈:120-137 already verifies the binary blob; extend to `data` entries). **OPEN DECISION D8:** require appstore manifest schema extension (cross-repo PR) or stash the GGUF inside a `.tar` blob whose sha256 the supervisor checks as a single file. *Recommended: extend manifest, cleaner long term.*
+- **What:** Per-arch builds (linux/amd64, linux/arm64, darwin/arm64); CI job producing bundles + checksums; staged rollout (staging catalogue first if one exists, else version-gate). Bundles published to GitHub Releases or GCS (decide at impl); bundle_url + bundle_sha256 inserted into `catalogue.json`.
+- **Acceptance:**
+  - `pilotctl appstore install io.pilot.cosift-node` on macOS arm64 + Jetson (linux/arm64) downloads + verifies + installs in < 60 s on a 100 Mbps link; spawns; `ready`.
+  - Supervisor sha256 re-verification on restart covers binary + model file; tampered model → refuses to spawn (mirrors WS5.3 fixture check, but earlier).
+  - Bundle size displayed clearly in catalogue + install confirmation.
+  - License manifest: NOTICE file in bundle lists nomic-embed (Apache-2.0) + llama.cpp (MIT) attributions.
+
+## WS11a — Multi-broker forward-compatibility (federation runway)
+
+Stated requirement: "the actual broker needs to live on pilot, or we should have multiple brokers orchestrating the distribution and ingest of things." Single broker now, multi-broker later — but Phase 1-5 must not paint us into a corner.
+
+- **What stays single in v1:** the broker (one cosift instance on GH200) is the only frontier authority, the only `'P'`/`'C'`/`'A'` ledger, the only verifier. This is fine for launch and removes 80% of the federation complexity.
+- **What must be portable from day one (so v2 federation is additive, not a rewrite):**
+  - **Principal records (`'P'` family, WS1.1):** signed by the principal themselves on registration (`register` envelope kind in WS0.1). Other brokers must be able to import a principal's signed registration and verify it standalone — no broker-specific secret in the record.
+  - **Collection claims (WS3.1):** the well-known token contains the broker's pubkey as part of the challenge, but the verified-domain *fact* is portable — a second broker can re-verify against the same well-known endpoint and accept the same claim.
+  - **Attribution rows (`'A'`, WS1.1):** include the broker's pubkey alongside the principal's signature. A doc promoted by broker B1 carries an attribution row signed by B1; broker B2 importing the doc keeps the trail intact.
+  - **Reputation deltas:** counters are local-broker state in v1, but expose a signed-export endpoint (`GET /pub/reputation-export?since=…` envelope-authed) so v2 brokers can opt to import. Don't ship the import side in v1.
+- **Discovery:** v1 advertises a single overlay address. v2: brokers advertise themselves on a Pilot directory (likely `list-agents` keyword `cosift-broker`), workers/publishers discover and pick a broker by latency/affinity. The app's `broker_overlay_addr` config field (WS10) becomes `broker_overlay_addrs` (plural) — design the schema as plural from v1 to avoid migration.
+- **Frontier ownership in multi-broker:** reuse the existing sharding code (`internal/config/cluster.go` `ShardOf` FNV-32 hashing) — each broker owns a hash range; cross-broker forwarding via the existing `ForwardFn` seam (`internal/crawler/crawler.go:316`); claims handed only by the owning broker.
+- **Conflict resolution between brokers:** out of scope for this plan. The portability decisions above keep the door open without committing.
+- **Acceptance (forward-compat sanity checks, not features):**
+  - Principal record round-trip test: register on broker A → export the signed registration → verify in broker B's verification logic against pubkey only (no broker A secret involved).
+  - Collection-claim portability test: well-known token includes broker A's pubkey → second broker B (with different pubkey, mock origin) issues its own challenge token → both verify independently without contradiction.
+  - App config schema: `broker_overlay_addrs: [string]` parses with a single-element list in v1; tests assert behavior identical to a hypothetical scalar `broker_overlay_addr`.
+
+## WS12 — MCP shim (consumer reach; unchanged scope)
+
+- **Where (new):** `pilot-protocol/cosift-mcp/` — stdio MCP server wrapping `pilotctl appstore call io.pilot.cosift cosift.search|cosift.contents` (+ `cosift.answer` optional). Published to npm for copy-paste Claude Code config.
+- **What:** Tools `cosift_search`, `cosift_contents`, `cosift_answer`; missing pilotctl/daemon → actionable error ("install Pilot: …") — transport is overlay-only by design (adoption requirement).
+- **Acceptance:** `claude mcp add` flow works on a machine with Pilot (search returns results inside Claude Code); on a machine without Pilot the tool error explains the install path; README covers both.
+
+## WS13 — Docs
+
+- **Where:** `docs/API.md` (envelope, `/pub/*`, `/work/*`, error catalogue), `docs/CONTRIB-NETWORK.md` (operator guide: tiers, sampling, ban/purge runbook), `README.md` (one paragraph + links), `assets/openapi.json` (WS8), publisher-facing quickstart in cosift-node repo.
+- **Acceptance:** a publisher can go claim→verified→indexed using only the quickstart (validated by a clean-room run); runbook covers: ban a principal, purge, raise quotas, tune sampling, read verification metrics.
+
+## WS14 — Test & eval matrix (cross-cutting)
+
+| Layer | What | Gate |
+|---|---|---|
+| Unit | envelope, registry, lanes, leases (clock-injected), simhash, tier function | `go test ./... -parallel 4` green (repo norm) |
+| E2E | publisher lifecycle; fetch contribution happy/red-team; embed contribution; purge | new `zz_contrib_*_test.go` suites green |
+| Migration | frontier lane re-key; docMeta v1/v2 | counts invariant tests (WS1.2/WS2.1) |
+| Soak (staging box) | 24h worker + verifier; staging/lease sweepers | no leaks: `'S'`/`'W'` bounded, goroutines flat |
+| Red-team | poisoning at each tier; Sybil burst (100 fresh keys); replay; claim-hoarding | all caught; (1−r)/r property holds |
+| Quality eval | existing eval harness (`answer_eval_test.go`, eval-baseline-v2.json) before/after contributions enabled | pass-rate non-regression (±1pt) |
+| Perf | retrieval p95 with gating on; `/queue`; claim path 100 rps | within noise vs baseline |
+
+## WS15 — Rollout (GH200) & migration order
+
+1. Deploy Phase 1 binary, `contrib.enabled=false` → **acceptance:** byte-identical behavior on eval suite + 24h error-log clean; lane migration ran once (log marker).
+2. Enable `publishers_enabled` with allowlist of 1 (your own test principal) → run WS3 acceptance live.
+3. Enable `workers_enabled` allowlisted (Jetson fleet principals) → WS4/WS5 acceptance live; calibrate `embed_verify_cosine` + simhash thresholds with real traffic.
+4. Open registration (no allowlist) + publish app to catalogue + announce.
+5. Each step reversible by config flag; **rollback:** flag off → routes unmount, sweepers stop; data families are inert when disabled. Caddyfile untouched throughout (no `encode gzip` — known SSE killer). Snapshots (`snapshot.sh`, hourly timer) already cover new families since they live in the same Pebble dir — verify restore in step 1.
+
+---
+
+## Phase → work-item map
+
+| Phase | Items | Exit criterion |
+|---|---|---|
+| 1 Foundation | WS0.*, WS1.*, WS2.1–2.2, WS6, WS7, WS8 (metrics only) | deployed flag-off on GH200, WS15.1 green |
+| 2 Publisher | WS2.3 (pub-only), WS3.*, WS13 (API.md), WS15.2 | own docs collection live + lease lifecycle proven on box |
+| 3 Open frontier (fetch) | WS4.*, WS8 (/queue lanes), WS15.3a | Jetson worker contributing crawl, red-team suite green in CI |
+| 4 Embed jobs | WS5.*, WS15.3b | measurable embed offload, calibrated thresholds |
+| 5 Apps + overlay | WS9 (overlay-only enforcement), WS10 (incl. bundled embed runtime), WS11, WS11a (portability hooks only) | install→claim→serve works from a clean Mac via catalogue with no external deps; I9 holds in adversarial tests |
+| 6 Flywheel | WS12, analytics extension of WS8, credits (**D6**), reassess **D10** for federation | MCP in npm; first external publisher onboarded |
+
+## Open decisions (blockers marked ⛔ for their phase)
+
+- **D1** ⛔P2 — Nonce-chained heartbeats (no inbound push). *Recommended: yes.*
+- **D2** ⛔P2 — Claim granularity: `host[/path-prefix]`, longest-prefix nesting. *Recommended: yes.*
+- **D3** ⛔P2 — Publisher docs replace operator-crawled docs under claimed prefix. *Recommended: replace.*
+- **D4** P3 — Multi-attestation (2 independent contributors agree) for low-tier sensitive lanes. *Recommended: config-flag, default off.*
+- **D5** ⛔P5 — One app `io.pilot.cosift-node` with both roles. *Recommended: one.*
+- **D6** P6 — Credits economy (work → lane-0 quota). *Recommended: defer; quotas suffice at launch.*
+- **D7** ⛔P1 — Dependency route for `crypto.Verify`: import `pilot-protocol/common` vs vendor the ~40-line ed25519 wrapper. *Recommended: vendor (keeps cosift module dependency-light).*
+- **D8** ⛔P5 — Appstore manifest extension for multi-file bundles (WS11). Extend `manifest.json` schema with a `data` array (each entry sha256-pinned, supervisor-verified per spawn) vs stash the model + binaries inside one `.tar` blob whose single sha256 is in the existing `binary` field. *Recommended: extend manifest — cleaner long-term, and the model file is the first instance of a class of payloads (PQ codebooks, fixtures) that will recur.*
+- **D9** P5 — Embed model quantization for the worker bundle: F16 (~274 MB, matches server byte-for-byte, cosine ≥ 0.9999) vs Q5_K_M (~95 MB, cosine ≈ 0.998). *Recommended: F16 in v1; offer Q5_K_M as a manifest `variants` option later if download size is a real adoption blocker.*
+- **D10** P6 — Multi-broker federation kickoff: stay single-broker indefinitely vs commit to v2 work (WS11a portability hooks become user-facing). *Recommended: ship v1 single-broker; reassess after 90 days based on broker load and external interest. WS11a deliverables keep the door open regardless.*
+
+## Top risks
+
+| Risk | Mitigation |
+|---|---|
+| docMeta/frontier migration corrupts hot store | version-byte + run-once marker + checkpoint before deploy + count-invariant acceptance (WS1.2/WS2.1) |
+| Content-churn false mismatches punish honest workers | graded verdicts, `partial` neutral, per-principal patterns not single-doc slashing (WS4.2) |
+| Embed cosine threshold wrong → mass false rejects | calibrate on GH200-vs-Jetson real noise before freezing (WS5.2 acceptance) |
+| New auth surface bug = open write path | I1–I8 invariant tests in CI; routes unmounted unless enabled; allowlist phases (WS15) |
+| Verification cost swamps box | sampling floors, verifier shares hostGate politeness, staging TTL bounds queue (WS4.2) |
+| Branch drift during long build (external process switches cosift checkout) | per repo memory: verify `git branch --show-current` before every commit |
+
+---
+
+## Appendix A — Envelope canonical bytes
+
+```
+ver(1) ‖ kind(1) ‖ pub(32) ‖ seq(8,be) ‖ claim_id(16; zero for register/claim kinds)
+       ‖ body_sha256(32) ‖ model_id_len(2,be) ‖ model_id ‖ sig(64) over all preceding bytes
+```
+Transport: base64 in `X-Cosift-Envelope`; body hash binds the HTTP body. Server state per principal: `last_seq`, `pending_nonce` (heartbeats).
+
+## Appendix B — State machines
+
+```
+Collection: claimed → verified → active ⇄ grace(72h) → suspended(7d) → purged(60d)
+                         │ re-verify fail → unverified (serving continues, writes blocked)
+Principal:  registered → tier{new→basic→trusted} ; mismatch-pattern → banned → purged
+WorkLease:  open → claimed(TTL) → submitted → verified|rejected ; TTL expiry → open(attempts++)
+Staged:     received → sampled? → promoted | rejected ; age>14d → dropped
+```
+
+## Appendix C — Tier table (initial values; config-tunable)
+
+| Tier | Entry condition | Sampling | Fetch/day | Embed chunks/day | Lanes |
+|---|---|---|---|---|---|
+| new | registration | 1.00 | 200 | 5,000 | 2,3 |
+| basic | ≥200 ok ∧ ≥7d ∧ 0 mismatches/30d | 0.25 | 2,000 | 50,000 | 1,2,3 |
+| trusted | ≥2,000 ok ∧ ≥30d ∧ operator approve | 0.05 | 10,000 | 250,000 | 0,1,2,3 |
+| banned | mismatch pattern / operator | — | 0 | 0 | — |
+
+Expected un-caught bad submissions per burned identity ≈ (1−r)/r: new=0, basic=3, trusted=19 — and purge (I4) reverses survivors.
diff --git a/docs/cosift-diagrams.pdf b/docs/cosift-diagrams.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..ad844b16fe3d582974ede5905a1b210e14f0d653
GIT binary patch
literal 593106
zcmbTdW0a&zyDeJPWm{eBvTfV8ZQHiGY}>YN+vu`wpIYmFdw+M`v+q88oRJwB5%ZZ3
z;*B3UW=15Dte`Lz9W^5)(frxT4kR5OEuM|OIV2}1jiQ;Or4b&du#m7YEiEGhEiLnR
z&+=E#_T8Aj$BeYJ^t9i$zwqy#nd!R;{R{gS|F8L9JeF_b-+tdc%Qx>Y?C<%v?|=Gy
zbN`C*H~%}}-}(OX<NqrrJuTgT<onLeEbuS;H}CHn{v#gUH~x+No$s%);P;q;8<IxA
z-bl~U#vYGU%EsNy(o&CxiJBHqlT=F2z|7jw#=(>WPt4lU$P(`xz>`tHQ^ljB)uCh3
zVbLVR<FmE3G*U6rmoRgrVPasRW?=qyln_;vlBC45G_x?m6EQNdu=ys68tEBY8aX%!
znA+P|8PU)&vQg9i^}<uoGuE>=`<F8rB#o@SjiHl)(RVcp7G`=h-&=rZ_09ga{9UG*
zjkTbjqY)mdAp7^anQ58n=xJGLnHlLQXlY5l-`_kb8^iye!p#k7WNrA@Rx<p1OAYk!
z=pbqMrSNE^ZS1Y|EdNcSqy0Ba*v!)LyEYnO%kLrtjSOrIjUZ_xjjT-^P4O5Q7+JWv
z@f;k#AEy<hYsQ6^S~ONOf_JvgY_yoKtr}%k4}Xt#9MAxuB~6Tp2^ARxA)B%x9uE)R
zo4(9+vEIeKxuJxAO^TIu{9v1!QiWWw!priBw2P1OV)bmCc!K;n&eo;(svPu~Q?TSq
z>F-@b&tdkT2c1`2-5VbtGMnw2G#tu?nyFP^irvrG&c%|;Utga>EMDGU?k+d}?aN=A
zTAl)%2M2@AEIzFlj!);S4;Pcv&IMLSTE~*wM~l)zR{|<u6Y-TeT|S-dZ;!?<H@{Ph
z3e3c1iX_GQ6WTgdJ|+~ZaH14GFOFPzJYB!e`a{f&874fvy4zi?IpUEWT)xajxQt69
zG7B$1FD~UR93Cp#zn-RIASb5wd0M|p+ZWbe=y~~w@;htqc)vi|P%?^;%MrAM{q4Eo
zhiPF}*6Cvuuem{O4q2++S{w8YMuT2ZCXEQm?Xgy_8GE!X(8h8W$!+zo4uh;;Upm6i
zDGS|xv0M`0i8~H2y8-LZ{B%vGejq5QkUp2P>@ngW-(DCGNm`u!IZnmiAjC_RmR%1d
zs);yOglc;A+NwIJ+j$7;uY3Nphs2a%nQItDZY~Y>YGXJYWzs6B%p8q!$gTUT{VjUb
z!7-mxhoC748U>L0JQKazmfFOlro+CMP)Bapd;?q7Sd)TbIaX=Qs2=`_mUoF#>8II2
zo|7U4DG&U3-0z|xJ2-7-=(Qr<@>trAT_lGZZ=Z6$LEVbSH~csZev+dJZa`HG6KuC_
z0F*RyUG{QETW6vZWj9E=qF^sLq|MDMMSE_ihiOYkWjK+1hr2r&8WO}+KfwY9uNIGW
zAN|v<b5RYYiI$Vl#@n@+ap46rY)*v4;^4T4Tuvt9y5HET1$p^~@=q})3RsO1Rh-SU
z_T)b2^18`m0`_De)G`L4+<{S&SUiVh@Ao9cNobu{xAXKGlrqCi4Kx-S8d<RL2W<R)
zjA^%?fjS{|6xn{`925>ta2!Z)GB&p)gJk#JhdTTV%!~0UDaflOX07_(=Ob)70m-<+
z8aDlel_Q3pG>;j$8dgc*V{lwVRdT7>LA+T>rqj{!JI5A36GO-fW#i`w$@izOWcB=5
z+E3xAk}u*<%E+ip7+I}O4=SllYZxhcc+IW&1djQz9}O$RSA{gsx7%*TLI6E5<dzOp
z>IO@$&9qWE7fPC|dh{e^I%6f5P*Su`jrk8v)F6!P_jSB>qCe-;wI-47be7&3rqvuY
zV0b6fk!qMQr`O9;yM%eE@EMxS&C(Dw#<it_)a6a$7Uj7VToS%QHhG$D4YVp>>cO!V
z-V+`=rl&fI28oS%x|@MG)6{u%z33;WXMI6{Bz1im(Q9y^p{s`d02_vM{b8Y58=hf)
z^4j!x@s<$3EyG?Wq7&H$xR~O?hsDV5gaYlRW5LIZVoVMs67XN<q=GK3Z&1FI#CskP
ztRT2}Yz2E!J0P4h*_!0I_`hfP0fTiUF;-v^1j)8O&KUSlp{)h3Jp8O3CN5NM*LKM#
zkua330TVR!fob4q0kvNm(8m1%K?RRcY7+>hd(RhgH|n)XjPoY}*1=n{oM0Q$t8^_r
z;)FH{wKrsa2j*~Ksxl8TCHZj{Os9ke&9RZc5QjCV&_WlD(J2cyuivaQTpx>f!~uA5
za(Dl=wm-c&U}^v{Obsl2-%!QT@mx7X8bUxqj7Y^<9waXtjvh5mhVzRJ4&Cs;pCH}X
z{aOiDD>B6Ws^Q2j#=R#4at#=%)u}7=P(VHSUaut<i(d(!ryj018Auow0!uSrOc0G(
zw2C5^yj-dp2z@_X)-?>W1WPwNY`;fQma8T+M!(@UNpcWcRgeO>9czP=lou*7m@AQF
z`PzQ(_TCy8m@H2Uk1MKm-#M^!fLldw1Bj8||BxvK@~(<!;@oy`q%#X9;$}1jbQw*2
z*wz;dKQfJith#Zl549*<K$GY*pkU`t#1zJtxIGdu8NKb%@~7xKhWm?^yWLKAUO!Ai
zA07N3#9>*GaTu!5+hw1Q)DeXBsDJ{-#F{`l0yWYfEj-@R6TNDaqmJQ~`O-nAt#F0s
zJOjB23&4yabiVXJnO5(34QC3a8_{u?>Nhths6B)#gQmokLZ%SM3;vrhCq;hJbT}el
z_m;k_Q{m5sj1W{w&-bu{>KUMZ8oXU)8NIVbNGm{xdq0cTx^@Kc9Qku7KoI5zcEG0M
zh19}!yBe*DsFbRhqsEv35xG0<iQ>$cAx^RG(j86<@_+G8r<weblga`JR0x}9(I-pH
z?i~aKDA{k4Z?}&Yu>5|y!z;cR7Ny1_2?4_v=&FHhaF?*`KA~2+gqm238A<{O$1{{O
z#HK>ACPzWf=5$K!*0i%_rY|kHhVGkL2~wjT8bMY+`zRxTI2#a2H+*G$M)<`li#U17
zSw8f2q$zvTRfP!}BmG3iU7fhcSCl&x?7n~>iph3YsUZlW-+pBc{}S0}&EFJ@mZtUl
z<<v0Prh3jqFz5>rZVxC@u^XmuQK+9z9P;?;see|W&%rmDOD(u50pXct4NwOy09``o
z5si4i8}LGKiw!_X4@Ayy4>Nmxu}eHtfd7I2FpqFKAOt6igl{gMe>ZcDbz@2G{X89g
zMNLCfg~R>+x|jZz{Pi~Tv9s9yxx(eKWYnt(=seFLf_m)4=m74JRWkPTOqW<`$ha)P
zue7IF#mH**PAzd#)~B^hvW;5NNLGM%7%*3<qhaO@@l@Ol2g4u2jHcoN!6CCn6{J)U
zOB7XOpj2}onTcp}x&|gct&J-?EsogKxTIT^>EQ(;mlKnCQCmKAz(mY0^Ms(TK_j#^
z))<mia%*IBbzno30fb?}03~Tu1qT~b7SB#yYePYzB1MH6nXKe`#+MVCQ<lOlk*0KN
z?GZumj~+R`{Mx=pf`}ajwQOJ_wmuZz^ds&l>xi8+H~HjZ;sTOwR&^}Nylu;R88LE}
z4A}Ompb{Ajw!>|HnV|X?Qi-_Pv1{<_Qx5q-<Gw6ta~qrghMOI@*Ek`}y^WsG@Jkh?
zCs%<~9~Df52E#-7%#niFT+K7|!xcZ#sKx%^ES4V3s7mI&5{Xq&{Mzoip(1ou{St2F
zDU9i#6Q)GQQ!bm~4g9INV$J4u$a=MtI95!ODxl}{GCiKbptebC%xqhRE0)3>nFS>)
zzDqe35HCfQ%qw&M*x;_C3)>9U^|*+vXa)I<vbb#~o{OyP9CcxMA`Dy9j=3aPX&4@S
zaeB!_k0w+7kMt^v7=xG;rTaBt7k0=|;e$x#PgkjwmdHPJLiX2*m30WVXtMMJg%h_8
zOYucyEmTr;<fr>l<fnI94!UNy`dhGYFnbMiOUFrPwMP|uiN^2+=hV}$5CTrPb}#Bx
zZCMS>k`$pXAK<Z_>->i6eFp&}?BXIqkDd?9lrVYI>pN$Dnrj|&g2P0%{Z*W|_EvU<
zu`Ro<?dv1a#+EDHH~Suvg`tAcS$rdv9B0&>w;ZB#c`hZue`2BS6Q2jD7tf?VNYXkI
zVW#1ae+%`4Nc|bnX3<m)+(!NQZLZJ*ql^W5drIp+8{)7Y(JofA4AZjTFoL*{Glz<y
zWG$f+N!*8H17O>w?vq5!ba;VW7%ME*A6rpR#buJ?i|-tZ3)f`7Gw?J$phD1G4)X>)
z>R%0Foqf4aDlW3WG%@Tr@e+QmmKK%L9N#Y9T3W7{hg_OF9-}FI&Gmez!)GyNJ)+>C
zA1!qLo-L#CD;rS%1fdvegZo}J!>#anU=nA4^lCnB!(lE2`_X8xWtd$RY+(q09Km7o
zs%|f_*+ab=9=~w^aPKr{Gs9kOFECL^4G#K7lb$??bGhTB7A{U1OFrBzu_^C1h>+|g
z(F;yZr)Z!Y6!S#_`7sIO1UY093(W2P5<LDbqPPXp-YB%b>mYI3+w_Hz7weWc5+)v|
z?_AvG_O<0DR;fr8CeK?#o79>6a*z^sAS=fXE!ox@<@WO&arSnL1io};IZ?+7Z8&NK
ziV7K4)!M~;yNp=3ykt!I=?)DFxcxP%z-fL+9S2nl-Va7(r|h=H#y#%*R3jc(>65A8
zm*2=vU*9N)(o$-0+akSn5eRk^YGdv3;B9Ddx)fLzKp(UIBgYJ_dneRJf_tt!B}>f@
z>-b>MH0v~~KSbyw{;DG9#8GXHf=!#b32UEYs*JMl(o-{12;JyE^WxFhDDVJp-G8jG
zqum{eZCY4>sy$XaX);l0Ip!NxSu>H;jO8&SK*ua4Vsf=U3~$u(8qD6=3`KI~u@Nvn
z+#Wj3kj43UjU4BC7~M{l(;Oq=9uHEnbtUO%zy3xAR}~Gf%qxj;zJ*7NgqOHdjo_&C
zY@GrPMsr&)&g7O6$jeHbJ=SOJ@|k_WwZ$8uE-OK-<4O`E5~ywB6Y!rov_X0(757QI
z*i~$*q#aW)ub661HNKv4(VLLk>0b9zS^D5vEYI%vOLhHA9sNsx(b4}~S_$y|CBXh4
z873)!NBga-#Q*+O!K42cb&`0DkTeQ>c#if?-;(RU)M<?WqhQ}j{wKkh{vGVU6Md|#
z%xwP<eO_wOgd+Bb9-ojt+IX4H?QFd8x@fCFToXUyey-rkA{G<Y2&br>e9=to-Ht>a
zv#&_iHcq8pPSr%xcAvlZaZw>HKkE1cpQN=*piQ7yJlsEfzN`nu)D^wh$WDpwhCwb&
z2+ePQJ>2?ys=S^Z*d#wnRVrbQx5xvi;#&FeaO=<xetn+En7v*<b!&FLAr*JOZ;!j+
zeqGRfJv{kHZToy}X5)VD6a$}x;Bvp;+d^0u5w#|oUL=q6Xn)>NedI~{Mov}gT!;(3
zTFa54YK<qRA{Cu%`@AZwAvIOG)7MBI3n>VVE0--AnyQT;7h4<u4yj8`Wb}fKav2yx
zIZ3qqa>L>BH>FmeMJ!8*%p(o!G}QYcDZbhYus)7tH$h$$Fn9lT{B-M<9tf9Bz3n9^
zZF(|KgO&kI_SqZ9&85=?1`as$EC6uJ;QQ<d1MN%uLBZ@*4T=W`AP?9exy{5boqZw#
z@Cx7y>3hTZ6~q1Uc5o!4qk)Brp*pDd%aXw_G&Pp7)`J`v18@;BZ8~CgTz~{1ozrnZ
z8b`a|1qr;YwJkXge!~8jgCu^;=!!W1Lq+I7H9{zX@)auhy(Xt{?HGuR#Sw-CCTM}o
zS6o;2^4DI+WheB4l=H3!0)W@bxZFlH_o&2s*c&EI#1)zv+ew~b;7@&gR+n0)9VCqx
zT9)X$hknAQi!6E;CKnaQvo(Gj{Ife;z@88l$5K&aD=+%Yw*t-wvNhGklb!N%KGl<R
z5KFqXc_9-RA`8GMx|TwDRy2jZK=Jy0nM3PWkGL!@qc}G=kb0>N4Ei=QB7!kr`Nm}D
z8B3uU9imIHiY=-OU<_B13&Oj(8~ooM<4x*4Y8`0_JQI105xQ^QwHf!2H@Ru)Q&vAV
zoAnt?R@V2Osp@TgQrv5g<JNF_XE>KfuieNO>D@piL_cBa-muD*Mq<bel!gR<5&Q@Z
z<8yE#*6}<?PU^rj5XtBYjrf?MDzqG52e#<awo;(Hi1yHU<e)rzK`$=Eo1qkhK$v%M
zDa5EO(BTlD+#z1JAZJ5$?lhK&Uf;w|O*Oy3kqrj}XfuI+GpUfCw%kr$0{tU=L%%)G
zrNR;g+~p-4mGV@lwS0d@tfk#lDx5QsNJ-~<Zy&xsrxT4T_;hCHsnBe0(>bYFuTqsT
z!PLHl4<W$}Y?R53V8ivkPSpR&6SzA8nL?Y~qDH2*E+Sj&=-3{bMnsW;B3NPZVnhW2
z=-GuwDAlcv_p8BY_o{fD25lk~meSXvUlBVrjDLe3FYH$#r9AkmKZG$85m^xg15}!?
z!|Ov_r7x1G*lIaA%DwZG8`Nw_K6Bmy<l$x8H9myiblzgPtE84E#ck>**3;)n%+p;^
zeaKi@wWRsRRH_m@xIn~e&wB&zu$MRc;k#$7rBX!9MT#h~T_Jf`UC^&V`=y9@93E_Y
z?=I6NNYmVIOt?u>#YORg0%-X}84kORonnHaX|(a(yvCWRAfrEh)M52W@;O<~J2lNR
zA(q)RL=L6Ac^s%o6!`@9anOW`YwlQ1J1zAxA)eVZS*10kuYG-cmvNbqD`a9>1s4ra
z!<%00hVP!GdMBNV8#mXQ;1i5uJqVN!4RC*1_A!I;0}uklrt^&jg2Xcz>xD)}O}tny
zFXw;l9YIka@}+r|shPX#ilt$<CWH}y$75_aD1_S;rV*CQ+gUUL7;}#&w;g|;kVc8T
zJ1!)vdQ^fUl&TU3{Irvk1P<p|#@?>C#*Mr_iLn`R0%VkzNlLdevMHA&_g6$kovgxs
z+-Yf-fil>OvOBI2=v7x3Eg@GW-qfvJEWA{u^vcn~jardbUq^3u&gjQeDv+-!h=UnH
zuO;hBDQmlQo#>QZeb^1XGK{@s6Y=n!!jIz&P((|uNJAAAR(BgQqlxl(cN}4Z=0sGX
zOyQKE%Bgh8s8j{qx??>Xl#9+*o?5blg%egR{6R7u|79j!$|^^vu4;P1p39QiV#2{z
zqkF!HHnhR%2uvrOW_}pHD?EwTj+Q*efhs{_$r1(B6z`FRo*YywOzN)&94RF~Ic2?Q
z;BQ|^DHvN~DWLsYGu1BR)nc-KJ_opWB%w_AV_4Lep>+wI(x=m~M7x~y#(IHdllAmw
zp6={uoXG+ni(J=(8=NWRjDjif<I_IsV2x*4vOc|{p6!16{>jx*hQ&%c^VTchd#i9A
zhi8+M=Z3-q^dRHI>P&`ZTIStyx@T&2yXn*M?tMV!3Hts&4TjUa|7nPRf`0x_gXy&I
ze;6nS#+jz&-5sP@uuh^3o(2YPgZqzuww(3O!-RzGIVm@wAtme;7|%Dcb<DICDXAs<
zSid!1EiHR0-Tf$$ZP^dyID@9RUxuognI|^Q&7b(gFJgAh@6rhfjcpfz&aMxH@p=Yg
zd~8ZFGc(&!CEG7txXBf`q%#Z5>WDmK18C1nG9Dx$212HABic(mlDno7gf(M;J=kjD
z#tRE%j~>(Siv_w*ix&dO20fzpPbm3`j`scy9bH^FBF1BVv}Xj6#jzbSg^~W+`UvpK
znW1Lo0*Sm?2K`9}xx*`OVVz`6JGiCTqw4gv6Tm6ksX3YN59a!~FL<0B#=AEI(6P$q
z#0(QxP7oj!w5c916p%XlOrI|*Xans(A+`oQ5CT$Q=wm!iC6~@#DD1?f{qAC_6CV)+
zndlD(iiw$7<(%Anrjp!tYOssMfJgS8-29>0$_H}ZkWX`eZ1*u1Ku$a{@G_w$mk>@%
zkDpzTx4s1kry?5+IU#^t(8qeba6s<pGyT3ep!c-@gfQXcW0p7hAj>fCYvlHh=!%fL
z^AV<Gc|{CXu@zTxLZX`Z;jk<D;5Hv1x$Ya>zcj(P92d$qxd6HDRoop?b~XHPmim#q
zd2Va6iqL!d0dPRCX?;TgIidgP0l)#d{uA1f8YWAi^S)?Vx|9v7GkzSA@wqUaEU5rP
z-7T)@+^m;hFqU4Y17%v}Q96Dk8-6Q(FRE;78noN$i5r}7J+H#6pCH2EdxV66Axo_#
zHkdU3k)bL<oft1xU;>bULvx-rDo!7iq%p(d$LY)0WXlNgn+=Lh2GAp{hDR5CFHVUs
z?a8mtj)S<t*B#Pge2A~o2=GQ>8Bz@e1@j}+BlILtUzb{x6swgH(a*2g!ZT9X!d!=;
zt=K>qs0f{Q(3cEUl1?`qPysqczX$oBP{*OEFr4E30!-O)DU$DuoN`NEzLT$zNanAI
zs5*aC?8*Qt_fxI*hc2y%OgQm&5*W9`<yml8(~NPgc44EgI}KjCwtURBQv|)2E7rE!
zMy{MNKq+WbeO@G>H1wGPUt&;3x_?3zQP%e}f-;*qVOi{az}QAX#O&%|QjQB4X~(1#
zjI*=srg_C%jqUtMAo!rXf6R1*)`f3eYxPsjEq|vltEkd1NM7=VO`-%T?9U7ut*QI1
zMER766NmgkO{cg|?;#XqeGC|>Bk5~x;ME?<({G>hAkEwNSf}_UH<p4=mDQw~uvTY;
zT!p~TpW4iAYDMlg;j^w`m&vRmc$)xH8=P;GPEliDnO1bw8dGeb4Ah4XKjcdb8c2s1
z38)7RZorHFPpHG#MX15PyFE{k=y&@j3dr~*bqK$E^LQ@p_JuvEzYE9D@MkWm8{K39
zxesO+HrEWfTJkTLbgZQ!FkV^!e?WL>UtIuTAUt${UI1{=e?YD<ynmb>-}^3(pM%yf
z=)h^7hVeG8qWN4qc|hfMKG6k(@(tiox+V?a1${AgMKHZxe043{|9^u0JHCUjuaQ(2
zMM!k%&L@U>66*pSd^e3~V<CH?p+mSMN)JN|5&tNBw+#3I28u-oWwG-qUMMBTCLXz(
z?zy83c%3DnD!6zvuvV;JqGC6;Dz91}m~I{`kN&w6Ac$%=IcbjgDqhCK(rphgC^0Rq
zpC1IYq^|A{ASCpZo_|8wtBkr?7KY_DpCvmE1gJZr3xMNIW<8wc_7YDJ#acjz7*Guy
zrPS-775k?%mq_8)0C}=TF%ktM@F1}2#vQSc#yRpX1wXZOUoYio)Kb)4KCiC<<loDD
zks}#9lQfZihP8lF_#{r!alm_d!9n?H;r;#Kp#ydCfPsFY{{#Ai^^11J8Ag;^6H`zZ
zI+f5n7#@&TC3}osy`u{(`w?bAQnImO8;>{D4rnT<;v>P=NDw%@6Nt%Rr|gCxREVKr
z6P!Y{CRRBnhrkN2SNOe%*B{a^o%Qn*ov$#i&>aK5*B2aAkQUD$5CJ+=mlqfaAN~IY
zy?=otqzLI=q9BQMO>%$XX%Q_le*C6l*+6IlzBxrl>SOX&;z5Z<^=UPPNzMwQC_F#i
zQr$q{*w_i3j+-pkHx`~5IG()`)gQIj%d82oEc8R7iFyp39~Zk0kx9Pd#wTgGKS_pS
zPEwI9K~Nr`G!V<qqS*$L^#h;gJ-e^=1eX0Fn|1Ok@OpohoXwMY6G+H<7jDAndORS4
z1F!(F-#;-9fcKnK3R9ay_1+!nm?Odj@yos15wEEusi?5<nQrVFwVO|xd)#i&N0JR_
zSyW>w$atReSlR|LRY3VF3FFvs@X#sIEz@K*jOq8)TADLs!E<vZjj$4Y7)s#%iH<xi
z5`cRO2tUC7u$m}5?>H2{NKEeN4Y3D1kM`j-oJXs+k<1}+UbjU2>%oC-z5JksG4U;n
zI@x4Z$xwV48TteNbu&iAbe*PEvaYVxRB4S-sd$_yWjS)c68sBO)0yvla*RN#QRQlq
z>JfXTM+Urwg$F^1)nq^O4V3<(`NFewg*LqzJJYOS=%L3uR61i^8ii2TwX_<4u%nWs
zAp+O@8`UaT_M-RTW1D<{`VT!)KlKP+Vgm~h`+EGmMU}{>(8cxxVZwaIv$ux>FfOnZ
z;ZA@L)@GC+_jgBu#(BNd4(aR=+V{l|MqMP_{So#Ptqs;G)B>=|wBtAWZR3>@Uvt#Y
zokcXX<Hw(g;(h$BRM}&1Fxw{RRX;Ri=$Blv4dr~uWd|qE$&8LjSMI}iaA{xDlxYfx
zfJr!MW#Z%r4N4EY+}DY%BQ_y1L3PGA8#6Ptp}MIq=hE!#Pi|g~+xu2NGzf5K(*QAp
z&y{5};@q9%@MDFN#)5JMM`@>r<ooYHwZ})~B)IDFQ6!i!6&CZvB&vd#q96>Eg&Cq8
zy435GD+wXkpn%Z!ThK<=#(5{9)h%uck`{s41j+N;#Lw}S#{rOCQH4YHjCAHg+jEhl
zdIs6b+zMU2z#Hj_@+^UG2KIyu9GRl%;tc_#?<w-wemP6Y@kmbU(~}w)S`o>OT5D2y
zze(<yEQ%jvE&{BOx<kaagOH;I9h9I_iRD$P(urZ|YZWG{BTdVa)_5dQ&K+t}s{9CV
z2Ai*;4KprBw$W?p%!Fz<xxtScBm`i7)GTLqOl45lWe~%IN-UvAMc`vHxZvi}Zo67G
zVdrMJT5Du|%KPnp^7CmkGdL%uO>Z(_(ds=q*+|};MQ(H73aL%{j`<-v*_y9O=oHOb
zZNe$6*~q8Ev9AVl1fNkZ#|EW9t)l^{l{JQ2EYE``iz8JF*e(7_>KK<Mlf2@zRv}gG
zH}k<7^5xB3=}tuohmuyJ+uJ*O;>o2=>y|?s4vQPt>E?qe`f~g)9k`>THHruJ#AT`S
zH?wYM^UkW72UD`@;c{;-#F(>KLapeaOLxNTWvO-+zAo$6&9L{z`70&1s&xNqamUVi
z7OQyI>a?^f5q3{5<)^b)qZViLuG?;F_brX|vresD$4&;_@Dq2FQ+2S*-}=9M9=F`J
zqhT%{Mu>HyBcC2trgWk;`yRGj7KA(O80O(GHRD7qM7GY{cTcNCtZ&@+d8&u29^J3v
zt3|5b)-VH4YK2~&Sftjr9W>TEFEO|7eYVF30q%j+MSMCjyiEWf>l@R2CutqeY%e~%
znoTp!S{{vaH2x@|S9zEnL-UcaXA&J3SSF5~X%n(&%#7QZKr2JlnhiEa15|agsag#*
zvVcd#wpfGiv@K6e;@_KZqy|dwsifO(riWZ6UG!#cnv=H;ReMR=UR>}me@)Rk8fZ!N
zJDCu3%-2ln^E7WpR#Vt*rk`dysj4_M51oxwBie1gMM!%ym#%4qD*aGFvfJdS?EI~I
z;6d|P&TMIJzu7w7nX2k&RqYp{ZT;%L$#&COnZo!vps4xwXXiQ#$e82;$NAQl(<GlK
zt0FUO#q!qtm-E>SW~kFF?DCT!IxNwV?1(hst*j@<_>9}oBK^Jk?0V4TwzaXI!-Pxt
zs(%O&)skb$HObP>Ou{{=9+b4QM-77<*kR;+=fOO+aob~Wzn@U$$;@+>>Zw4z_c5UK
z#$c`uo2>v7_A_Os{e}h{ixC3Y<@JOI&g+^$v*&I<+{TBVW=%A9)>aSzjH6x-6p$AB
zaUU-lXdCTJkRLVl{|;Fm^LGcJkq>ysuGEqZMmTA>Zr9-M$IK_Mz|S!UELcg*wlO(u
zDXli~Q*)5pt!}+7J{JA{jSG~9F*D(749dumlL|NqZEDQR@V`Np@BfF~f0yGE^BXtR
zGF1*7&e^-A<0P3ER_!Bt^|khMVtnO=t|rxQ657&OmjNgpV`ZYp7?hde{|gOGMgNy8
z`{!b>MOI(rNUinXE--nbSidto&3^2MxFNUvKJbw6%9dx)@3qC23z6hPYF@ML&TU$S
z;%wgJ@?Xv0HBz)%kd(`zM=+;W%okoz+=7PeH1?QAsCJ=YIO-B!)EpglfG(p*Unc*e
zWcqn@%HyR+Po;s;$+B!y!GOEz+T5nnP`nd;m;F4UBhzO7dw1DqU*1HucE6;|N%j=_
zU8-=3`TP42Z;tkpgKSPMe4^;5X#{#B(Sx+6qmFmQBBaOhY2f6+u==Q=+89-rW??Pj
z<>^T!3XaU!@1`aXpl0MY_mpwbU<TrI3JtFf;6}TQY(dvtmpnK5%0|((s+Dc|@(aE4
z;U!0d(%~l0&ztg59y$T!oeu%DxBQhilinR^pkt;+@o3gg4Zz*xrUDe(4f7;wr~3+x
z`WN>~2zDqv3cjB|OlTmQBvJO6Yn!U#w&hE0YKP$JL-&^S6@O|{HBXZpy@?mjbJ5%f
z+Lc<jB=2ggC&$tRDf4VS?TH>NL6+&XaN-G=(Up<N!xV!ZNd16~{l(UTBm!~S8qCD!
zWF%#pI=Vn+M2S53CO)HyURF?{Dp?X_n!30;w@1`2x5NMYI4B)tQnN!B!CVMii{Lc6
z&97|g_hF(rL`;Ca9AYV8Ed;Nfct*amvk|m92%>o0?~XiX*C>myysl`p$s&YsW{s0X
zHSxOhieU3F+Ik=|;^|{W0Sr21B?~j#cKVod5$j<~C02PUU1}73`$<^*eF!oQBf3Jt
z3<BxpV^(ovBg1MwYSjwa36!6T)j0A|!2`96EdCTd!t>!)#Wo#QzI}M8QDCIxfg<^)
zgQ)?;n$WI&)UgCpbKtq1g<6JGb<w+ZNnu>!5elj<@pJUD1O+|TbP<@c`ARgDv6Qq&
z>WT!bzk>|JmPL{l5rX`c0r2_$q+yi6gW2SWQz^iY@gk}L3C$tU<Hu=rEC|!j^CuPT
z%R^gOVJjTU7dcYZ`PQg1DNu}7(0MJE#v)G?OOA?ZVpftWW;!H@GofaiOHh;wH%^WG
zfg%c)G?mj>rmWA61Cf#)!C!7ng9*Y4Fc<xi1sN1Bd#prlEiC6kuYgkZvtbN1{@s;~
zNo1&e($p6XUvdf~T-9(n)+P>3+FGp?xj84u)fGHqSrfa1xhzLe>tal;p{~hOhdcql
zRK04*RIZw{JV#zP4LoMBVhEki;<>rR3_C)#-<{SNYLXHn*YKhWmj<0)O17dKiim;%
zy!ss<=Ly=9x}j-P7bhHww$y@!fMy<ARgVRSa9VD&>y`a}$!#b_A5_Og45==7D(rqf
z?7Y=C_~FC^M_?-)`O!L7mhn7X=?oQ#=vFHkU8VVQ<#Cz7&l%sp3<DBRoJ3;Bz1FlI
zCvzoNj~MJ;n}3$@6kCF3)Rd?v6w!5>@-Ej}6)zwEwG4afv}7qSevO$3GJzZ~j^9YB
z`NYh|Xu?QoB5uY&$>5b4MEIy;WYM`SO0E+{)g#~cGL?#R*qF11f9X`On1dmJY0jDd
z0vb_yG_gY5q@_mPxp?MlYC!Md{9F%E*+3LvHEqgLIo_APztXP|-j?B1lFrY#*3^h;
z6}fP>HZb=*lEcr0QSYh)ASfcycwNPY4?I<Z5VKR~*T6(#tpo2)jaaz)QL(>rYv#f6
zJBEF_@f8=YxG;64`{gcv0P!S*OBZ9Pw3VMqG3Kh1!)&HQ6v)YjD`(4AK`Oa)e5+l&
zX1M8}Y_0Y<F^bl=joS^ODIs9ej2ULs?;4{!F_{kd^@WPbG>$^}2R9gpSSJk}DnJrT
zs2Ok^Fqd+sjLp@sWWalq01d2?l>|oy3IUzR{VgD2D)F3di{cG|gC$`>NR!-9@us6B
zk5|OhNi)r?;#ndJisCw#)cJ+dj+Yecfb~T-!dypr)qygg5p)uIe^kc97Ydo-qxYg_
zB`I~XUSG>&+sRLfA#j-;$~Ovv{87^*IEHY6)uT39d;||fC*|bh<iY@yjvEEu%%l7;
zq!i!PoHa)ZTdc5Eev;iYRwf2g#B`LmsMxbC!B-zqs?8hMpU0w-BkVJjnnJrnqmgGo
zV`yMp7wgOU#UF@XF6AVVvN^G_c31xaQ-*+%rmIfbsNWar{$nO#u_9!45*cs}%a;jl
z#*kSgt_P5dW~+}41Q`lgH^KyBICe4@UdkY)Ge$jJS5}nZFyjNoZtRErkLOG+%-jMj
z)(VgooUYndzJZZyUv<26)R0mlkg~I&bv%=+GBWZyg9($p8n<2eGIT!Gl|_^O^VwV>
z!1Dg?DLoEV-9prmktTROV?ymD+q~<!(*jF}eLd!<7%WbyU*aHYL;g+>#;5d_8UCqc
z=V1*lX?U{@fg(;>Vx{b0@;^Ex-AN}9Z4=GhYSIdbXz!eU*+J~!duA<Z{#4}=@#q=@
zV-jo=3MwZp-TTQ~C11?0_d&JLpu|f?g-}Z6U%@_Hg{=L3=2CB_k{H2JaVlrN=D(x%
zyTDQJF3*<rA|egwyeJKaX{wpmQ%+A!z*#$CGtDm}z~geFFAiAMg!|C3*N%yCl5;97
zsEU{j`Xs^E)uwGp(a2=KsiLSp#NkunOrM#+FU_IQzueEt*?Ov66is78`>_#tqJv@8
zqG)OTk*e@)qbKRj3D!Uw3A1g3EtxI1AQLz3R(hMGf=uW)bd!s<13PB^Db`NHbDH}V
zeK9h|*>8```V(53bc*0Dwf?PKfqHZ*?eCKmt+Xg6f{?_MJI9LEG{wg-cD@SECfN>&
zMTk1KAoTlIcD<o71RbmIp4zvt^KLWF36eL@{Eoq*Njd?FIdS9GDKZ9jBCYrWl`4-X
zM|Hv4jX?7LCk>PeA9&gz2gvHdxt_aR16w7P8C=;fB#Z1u0yWU`c#z|{#~cc^JBsu`
zu*RVXyo(0F(*5A|U1|q7d(~R_OeQBd6Fz<Z#_`PnQ+;L-35(k(Ma)Cx_I)nXK7b{Y
zs})~vD21)!tC89c!9vFu4|oEn+ATzoSpvjIEl}Jo*h%Dq@tpv48t}n(LhjI=XYz|W
zSHm%Q8i#g9ZqrEh5{bQlBK3%I>S(w+0oEt#SdqhH9o=RPVq8J|VB%2?a$Lh-&^C>S
zw|r0$#B)S<e3W^G7l><hFL)k}q_j1KcO!AXBKfnY!4SfT#kLS%@kFM;8pn?@Yn5Rb
znv3rF3_*(OrcVN>;c1lK3cBRTcIVhYkHNjvx3`;xkhrF)YPX+s$Isg@olCt~>ZqHy
zr38{UTpX5+o;L5DPd==v+TOb~TBv)kl3K>EU2bOzpEIu=*}O?iwBovv#;C`)fm_CJ
zS;Vg9-ZPag-MowWH1f7j)==ZF?(HQWIIy?uKcv^24Sh^7nk>8P@ip4IQ`4z7x7CWM
zwy!EylJ*=QttCQG*IB6!({5>;8SBoOj;<sxlftPUS4*Z}IW)S8J~9`#Z$C3bj^&3Y
zQ!P_{j+~noe2((kHhdgRyqw$FyQmSeH1{L1E7<OKr6k}0D5IJmQ(dnL+AF*qj<vkI
zTR)p5H4<iIeVM}XB)YrKCKp}#Xtm)Z(SY|rdjD^R+s{z`2cnQjCJYgB>9$o<by=dl
z%^9L>`uCqeWNE2bI!-k<Y_0|CwK2|&2He7RSbZKh3n(F1)>c)+3Wv;lH5Ct5)F#Cv
zNz)fyzx(Y8Mx7Znp4`|!3Sy{Kx3kCMT94|mnqQv71*i~<!`hLkE&x)Ti%rKiPZC&v
zOnOBx=XwF?X1Gu4d{&?u$wR7<!HYD%{4Pc*G%QCbZ&WB(Vpw)gIby*I{NNma09HZI
zy$+F@02*SDDhxasxaPEB1N9g<jlgn-H9gw957A+t3~6=exN7H!C&E3fS2}>I_Jqk-
zeA$G;wTlESlNuNFs~+BY+^)N&x!#CsWiXPvN{)~S9N)Lmd;yZa(ssSySh8VA_;6!S
zjV>6oM0Q&Gyu5eNuvwjIIspTCzYd<CX4ODnc^-UeS%RGiUL}b~y?;194>@tjR{}r|
z#gzcK@0`d@mO7;64_MpUa{EK`5e;dZ1&vW~GJpRku|pU33|j%(nCQW0SaTbpS?ud&
z8ZP<j^U3G^A^Yp@>g(Y-`{eDa`|Ylu=RJY;<GMd28>eV>c4R}!qH@tC9yup$y^eA|
zA;}aF(2hf1a~&;ivlh8@9StsGIKs9X5bzF-XR0E_+^PN|0*-;AfA?nBs_~T52T-Wc
zva6nYIKv`fmRXqD2Z82V^Z><cE}mw;UktNeAZi&0nQnaij&8LMU|z5mvxzgqmOY)M
zum6NKy^!INC$omf>yM=&C`rbY`~6{QIf=hr*9?yg*f3o)tIF{p_s27Tw)XaYscW{k
z9Wlm{{L7u#9!b837Szq@i7eV4m<{Z3C5Z)g%>Y92PuFqw&}gmo4Ievv-)cIbH5xfC
zvsPSz($1XOjXFQD;9KiN*E{x%(IJd{g_AdZ^-53UYUzci1?U_~H&Hxistng&c+L#b
zq2%~N7x2&0k4q`AbR5{|h%R9w9O<m%%@}ygGbzVBXB`RLH^8hWyVn8hH5ZEY@yfNZ
z(+kzi(W6%9<an`+b=BR$X(7QId>>e>ZObW{%E!{oFKkW$o0}hhyu|Fb&d;ZjXQus|
z>(MV3)H5LaG=86|y|>OsY9((SmP%u~dT6>+1DM=-F-w?uQIVWEEcKw>#hSomLk*eX
zTubjXN#>CnogrU(!w}7teSz_Ag{J=(*Kk<>ec9!|xrReW&GbLIJ463J{KEttJtIBc
zKQGT{MB}i;9e8|%dv0L!GLDAo#`x;>#L;lTarHF7oZs=TCu56pt!uN?@c1CO{US&i
zEgP#ACn}||%DERZzIGM`m5Jk<6C%CyiO+t&A0neOuq8@}D}KVg`t(Ml=Sb5Jz0<+P
zPDmlXW@}5ByI;?~{5<NG^l5*4!)}2$i?V)c1ojjNii;qOZOuTGdA-8*$$EtIc^ltk
z;px9m{_=R5{0g0K-uAu=art`f-!H!E@_6fSZ|4-k?MnzP#w-1LnR;QXc%_)V#QA(o
zZpZz)zPwELd8_XJxP7zva{co7&0Znb{qb;_o=y09vdps`1d>WS3Pd?yjeFJgz@2ba
zr1N!04UEQ579@DK{KYhinYJB6KwfBDM#BlMJ>VjtIg8?kRMPcpO@35SoVdc~`T~_$
z9HnvOhr7&~guR~xS*%9jNtSNQVSWo^@(I~0I%-mv4!`U0+=8d2O;XE>n;YP@ZBc2(
zFV*l=2d~)o_uXL~5hiRWsd?lXqEVC4_Mg*km3FFi$=IM1at7D)ulO-Ef|a}!S?Ba3
z_Z*fpZp4;O0X!AafRONH&)YDFIYjuju`&GOaNX#HTv4PjkX+uqXAz13=-INTbzP!<
z4%E?NKbxKTai9peQ=GX~_-w$0FqIfTYPds4FCKTypS^Q<EcN$AP*}=>ZzA**8O^tO
zV99qWz59O-UV-&Q`ThiaQ*I<0vdy4}*#$I$l#2IjsE>sbr-jRTGA5%&KnW=<2%KE&
zRff})_uHe4eHvE#q0BY10Ef+@g4C1Xr-TT~vxz3+8vS}%Qyhs{LU(|bQp>raDdRFU
z%;c$6NTAE(RgR%np~qQS?EB=WH2zhKkb;izjLsXsTK7W;z<fg+V!BHYc86AgjH`$^
z(nw?k&cs>jJzeK>+UNaZ-KP8H^W*C4IU26}^W^J;`=go1=lN>hWm}5=^Xl%=n(X&A
zsIwxTgXfB7WG~h(53q;}NbYt>n8U0VU#eqdms6H61%v^v!j5N(aFJ(5F!i6G^U>Yh
z6Dj=H6b60vOIy*CJ=cS7^zeIn%Rf`=^nT>)*@+e@E59DgSx8cfDF3<7;hBiDX2)XS
z#9E|P$S=c0wE-Sh>*t21t!UMw;239_LTc4xU?>Wr<JOE^#QS<a+w9){c-!2*O0sc&
zygPEaC(J%bDfYb!Y5lMre(1OPbPeIn7&q+e{&Gble))>#kr|JEOy%~m{J8J_x{coc
zRP1ih{g{g*J<z~TO{#uyaD$pE2AG{zeH9xBWgFle6pWI;WwjHfHkrB$45ElNRsWny
zZG=-V0x}%s_w}70Zs(=5ngfe1fMvM8C6t|*0@|T$Q`Ijz&<p=HbYN!u!tYJv7ZH)g
zHR52O0zb#dGx%b`#4Ac|n^VJ?8Gk@kAexaR*#MuR8O1hdsBhv7j9fnnWrC)EZ4_2(
zoKbI(J(gigfo;<4DWC%E3fq#~FI4w~t)*dKHOTi|ODuGCfLg|{@L|0I0Bsn`o_y~%
zK@xC1o@xPd28>7vz^MYpG80UTiG8>d-|3{FNom~G=Sd}1FYXVuN2&xlvTkbgY1X6^
z#h=Bds-}nMriXD$m?H><ZqFR*`C<$SQ3A{(lSZCTPAZ->sdO>*KVeuyTw(&kD&RjP
zMF$5d;~OXpG=y`H<)=o{e1{)|AY$xf(DR{!B%(O<aj^7)CB<r!>p*X^ydHClQD?>8
z?!p}^@-1y4NFC$^v_4d)kP-Bu5aXX}faA^g2d-0|hX&o+0b}HiSEO#S6XHEFgLzH>
zP(9^@K_g@Rrbc>VWBvSM{R9YrLjFPk4GjOxjP&IG4HEndT%A#il)QfF83CT2Gy0Xf
zazHkrx>5n0J%DA)h>=|U#y>W1Y|3m#$H*=SBtN{xyX-crRN$~hu9z%uuGJWW307DB
zTg&QP5z}K75C&a~n%j#BNd4MEvyeB+9flG*I91O(b{SztBs|N-Aqr6`2e>`8IAC_V
z8{6pY?ScW#OP`B`DKNGv4=lQ(sCKz^{utd}`WI)$w$;Nd;P=7i0^x~Fz<X2#t0YKs
zOB@_J*}1VVtoi`$FhR=@<*r{J?jP2QEf*RA4tsxg9M@?l#_Oy>+Qr$PH_Ah(%7^Q&
z(AtRBdZyb9mwrFaMC<6G@RvVlx;5|G!9OZDD+;1o)f6+~tbClR(i@kIERwv)J~$C6
zb0+$ErR}ClW+%x+Q)y349d3W{K2Z_K7<`e%pX8Xby-dE+@R-b3D^VD;&p}p;>nH_H
znOCxCmG~-H0X5f#mqTbtjWFh-5y5b?7GWF2zzsVoN>CT{Ku2RhYVTX1nb9u6iG<Nv
zwK$=F?(acXayq=aCf99S@{eh!2PX7y;TK>XMXh-0kL+b~#e}pMWzt(N>AtXG0#&MW
zL`F3@Q)L1!!Z;aQL@$Drd3lgsTY{pZ8#D0odNA<%em4LImh*F8&M2ZO9R{X);2fxi
zu!vV<z@=<VUiLi5LTSa`DhAbWxk>a#@$9wfX3w0wx}mgVpA~_=<qy>U$MC`NyoIGx
zNOpd{A5ma0$&{-mhIia=?Z|o74=XW^Dnu0U_Q8jIjO9C>n7!J^H!InQ1W(rmLMzu)
zIhed{Nfc&<Ac<*hVohRAcAivg--uja-FE0I;lks~pz;^JO@vxCa?2#~@};Osg33%C
z6J89+%vEzmMYpntUgHu}cw+&O+=&;4GWc6dFwtQMzi8-0PSn7<sqzGO6>_pS^Qxrm
z`qsHJ6bfuJAte*uMc*mQN-C`iUxmtt^`YkS*^XD?yF7x-Y3dvqyDufj$$ai<PVz`}
z0i1o8=TVld>JF0{j_x)$ckSEK`RHhtSUc?${WznLb0b)@m(H|Noy#AH>}iOj?FTMi
zE=yb^EMG7-nJgW*8z~(3lAa0m1D0Sdgvam9#sV>M=u?M5wNt+Zw>Fq_UMvetxtQfM
zE{rAD^ay$__4tnPcJw1hT`dTa+p#^DrhbMoll&H(6e5Uqnh`C)W>6HIB<U+y#UfRI
zL}h_e3cldG8}U7i%C(i-LWk^2s_Sh(kYALd2+cPC;2!NiGRLXTb@Rj_$po0{N8>^6
zmd4Gj&sTzW!;aoxhRL6;8@o(L3U0<h*KXB0Cib$l{xh@D6Wi)%Y|WdB$x6>+t84vd
zWuwQh70}=tNiV#QXf^u;`~KA=D7=J?F@-VxNnl+2E?)LPRg(-gzWyEbOd<DLjv57W
zED0#UW4y8~Um1^Q(cL?)eQHrsTY=$)6Ng1-`1pR&i&PtyrFv-RkT8U_#(Qoo`VN|Z
zY5n8ScBisAXt@e?Y@ZPh%pfa)Be2eB(uqHn>!#9oa#SA!F)fR}kZR1>LF06YvpIuY
zVQVbT^rkFD1eole6N~XEKyWNRZ%`H+!%=<mAosAWRk&dz;%I;qas-a{6A1?LfP0p=
zywu!N<569y;r-35bab7|rb_vGdJ&R4;7*d|S*MF3d&K2%A3pZ|H8J&_3OAK8pypZ8
zbx(FDkwwTNYBHIRMf2csCe76$#?*`NokaH`Kjk;Sf_Z1zpfZP!g!0o|Qtwix1|Z^O
z6jD7~jQ-SNj@wT{`6)yyPX~<|GA6i?G@=_nQ#b8`MTsBEXkp6M2ft<k%*D(oHHv<o
zQZ0L{o1Z(Aq?I>yPpy4&deeT8Y#)H$oo?z%!^$3i(DRN)-vK35#Jnw%^;txNS8x1M
z-!_{9Z%ZcY4qEz^9wKno+M-UmL8<&*QTL$oq=1C-dTdg!v7PxR(qtA~eQzB96li%X
z7@_<YES2jW(+mVtb6{HjVb=^jclv!x8=LQqohdviT1c>xgmV8H{R(+bVvmf(=H?}w
z!{Xbr_Eq+1;XztS2d8=$Xf&#Jr<$rqon+NWbB08Q9h;j7k1PSfykZIoVsl*`PDJ`)
zy-jkro%9y>EUGiwrx96^OUi*Oi|?*D^uzVy-C|fv*9bDh1zbJX^A_&Is9gkC_A?9;
znu*xq3u+e*EvA<K)H`X{&!zze`ofQ2*>7oW#eu~~3PVCzY5B3aEhHKS9*$jGGBjoz
z@zrwpd%vt!>V|_KK8GIshiK>Yp<|5|L^%N`%5iV6THUC!;#6WY@pEoSgOS2$__()5
zf&IJ5Zn(c^XsPqbIdz8T;?(xy2MI?3U4v&UD7X;xl5FjgYzeF&_L1EBsJPb|nKY#%
zj!Yc-)QUwDQ()i-MR?=STMRO(nzv!$SQ%8^haUwk9YJJ6RDsWmVw9XhEBaI3VzguR
zY)E?UJ|xy#aV!~mSmP==e+JCR{5i?TN$VQopIo4)z_M36pr+7-<>?A`@lk|V=Em+0
zDV)*slb19c5=TZ?cYl>^kT}Zn?wS=!&L(CU`&@+!Lsq$7<Di(6wfOG7=I=;t@jWWW
zRfRh(^5Qg+OE?I1bz9Kf$^U6JvaT&C?74-gAr6snt0z=;KsnkCkM|h=&|E|JC*MzR
zjpU|0sBrC2yNPM7hula<VI}h#e4bR#meX9bu<B5=2-sUNznE0F2r3ZYo=|FAZ1Pso
z2nsJ`!i(3nupoD+lq=J3Sh5J;_~{N({16hnv*u*@Bn0GfqA#0Q7Qd@hnApfK;|)7p
zuA<ZVdb+6NUF|(PO=4@8x*KDSC~(+D+b#tHAc~5+vta+aw~OPFwG%iNTH!->R&o{`
zm+Dv5t+IxO9`O9q`!3uRmuZ}DfjsIGn~e)5OqV$}foe$&M>V^dl)9H9Z4`Xe$u8lB
zJ{VDF>cPeXo$K3Fv1|3mmz@ABB|kr|u5QVXjTN$%v>Yd;6N=mH43~A3ZkhgaQ4Zf$
z|0p&7r_>J;dxS}FG*&+WT)y8jeuK#Zu!>drsup^Pfh%&?mfP|9eat_94AbKu>rvB!
zoZJr@Mh;9CPyiSwAGl*{$r^^R)dB*?Bm2VGic;(4;20#lVQ{XU_T-26HySU?*7Mh=
zQxzGjYUGXmXx?B_*c6wea;K=M{eVGZl4b;044tcC&X*}iWs+}vRWMjn@3l#S)IQtp
z*j@_@Gc%LbO4Ar;cv(*?AsbyvYL~Z})ZVFofQ8vxi-z9N2$_HA1A7>5^tRD!P?_#_
z|6IK5{>=J{t4L;LQ)^nW+fo!GYm3~a`nYDiu$?`{Sf0Cli1VBZ3@&W#?d?LeA)z>5
zXP<j~YwqT3NuL$sEhXkX0xE2ReT$J93p<ZKY7J31+++LPN%sK2^<w;u7Ak_#P7=GL
zGS8Zb*)<s~o26se0yt_1hfRH*q5Xnk{0yp7K~fbC{kp)y6T&(DK5i+O!o9_(=Ixb2
zRZ)<bGI)V6rRKaox&6q8I!7816MBpeg_J0wRcH^t+S!_3d6!;uNtm*q?vVBTT*LWJ
z>(FCm_Tt^C!~Nn#YoemTJkgvn>P8iVbVT-c3~8LJRtFMGkDBTpmoCS5B)8$K-v{7;
zy64$0ou*~;NXHfFkRZWS6zwvr5>8t0T=$$7IBT@;h9?~*ACpB42l4BcQvpNbR_Iv&
zo|@k{_kU6MmO*tk@46=*9D+k|cXxMpcXta}NO0E>g1ZKHcXxMpcXyXr$-Dox&pz|k
zshX<!FjGZ!Uvxj~=GQlH^~36Zn%L?B=0M(wJ97n=$)&v0Hr!Pe-QJ|iH&-8v^?GC*
zTI&52{gIv*p42+Jj(p@gQ<b!)TG>M)L!vhnTw(g9USfUCD7aWTrp6cmqN3Bje}JO2
zv5NggQtk?=ivESL5XP6uANsfjj1%GY*_a`5oa3}DLVCTmy-g(b*$45U$1&lAH$U#w
zXc~UxB<SSL57Q0J{j39=5EuHFY}aS97)pylu4b!P)#mDWo0iy*<n7{`!TD4FigRjW
z6HjdK$`Mv0m3xJCR729KQB5vCTR^LvbEPS^`cm9w+a?iEx}0VoqO+okz)l<gyfE`!
zFMW5c=cExsTAjQpebnP3=eOy#))0$9@HTILf7*(fPeXKDlv%tH|F4e5TGtIarpygp
zw{V6VH+R={ic?;`mab@zLEjM4(~QR8+ACg;_C5uN!J>?@@FRSB0n^yjomiw@6Sryc
z1D#b7i3ktfs~&IWXM4}$hi&j#w6-L!3_L)BK}2eB=q_;xa>3}55V=x&ayq{FgY}aY
zc)K^O;x}Z{ZP~89WIWp2xbdqQFHuaMw#B19c?Oqfz$q(;U2Yt;lHSn~>H)C`jD3c0
zT+w}Q0dYv_F>g)d#URtgHzN__bf$xWM$y&IGzkxd^P%OHVF^##;m;nDC$BE5@D$Lu
zSo{Dx*fl#?JflajSvq&kqSROJTzj%=+D}0Rva~>!;-VF>*NkTL3q5Mu27JEw*1AIa
zXP2pl@OHi1vzkc`j1V}!mZS{vjqHM_&WoqlE(wQ*t?{k{T~vIe=bq%Wt=@eExVHig
z=C7RHma0)HbYT0ZO+rYoVUHu#1y<{Pio00F@m;jtA!>uupZQCzQwfXa7;AEFG0ZW3
zYNKbvlIW|mjnZP($weW~b^9WMw`rrd!m_;h+Zma6725ePV7W&4A+;@2?`AU&iWyZx
zi<iN|2Be`wg&WSY6H(wnIbj{n6=yLbGZbJ1H)*Uuh~tqTGXB<B3Cv}Z#0d}uhGT`w
zWy+c^u>-S$moyQaEKw6O@x=k()we@c{3GDomdSnlL0F*#|6Z$Pf-F-}4+E^&pgz0T
zQCq_M_Y*n*TZBxIS)qt-ty4GIp!7{Pi!@67y9LK_%8W3&3d_I}b9?@QM}ztgTn-|t
zQ_>{x>(am{{pBsr`h%qEUMB~vfOvmV1aZK(fha&S9B^15N>)Dz8<gZ<lq@FSKiHP=
zf+iq;uLUASd(_E=;sg{jh5i|1785j1z(3qTq(9uiiVX@M$V~~atb|4DucQ;Csu%*p
zEqge}PDBH*tp2ABNKRPQZTR`;GP%RFkzk0Qei`gvqSX>R;b|<=2%$eDQT@KGQ2!*b
zkg4+zi8VYhV}D6NaKJZ#)T|1!DHP;msImKDQa8Q1ZpPEROja35|Bsp_Qz&Bg!*bn-
ztup@qBD43y3jgqircnGNt^dC*jlXpAm;U)tuw!N&jm;Q|vxMj8rriF1<`^e3vA;BV
z^fg2!Ki5L`6Ss@@U6nKyrUn4fiu&jH3;aV_;h1CH*V(k>oBIwB{=mS_nbfrs&D}t#
zrC<5xON%4AB=Tew192jrZEy}Jv%j@{;h3gXD>=8_z8_ZKi!-HZdz=_IC9IX3HP|ej
zX}fqdnQ?ISeAh=CG3Dri@?OsV68K~&Z-oiySUMgPaH8tyGO%v+e%J&oTCTyQQ3UoX
zaI0JegY)#%AI=j*aNUyO7#KLe*QQ^kZcTOf^mX1?AVyx$eGy|5Jt^VIdU|4KUX5Ct
z5)b~C`lTE@G7aQNh3<g<+>&rKn--4r25B$i9&*}E5Rg%AJ9x*`oVFvarT=3BylRJe
z2A43Au$#vGw(N>Ek=x}rNN!QwDKboEC4n))T;Cakz0bFo@Rg2S89eSRVq9KVqqZ~p
zaK*^X#%~gV1!sy0$k`sfbMgmBh8=tGF`pvye7F*8+>t*SCM`@lyw7n;(=YWsb>?qk
z>y8Wk8f#uMd1q|a;Az!ZeF*sm{T-u+aG-<liWL!kj;+<8=jCs4!1;>=!sR)z_O3X7
z1#cg`yx}<1&-P%)tK-*fm<dQPcW^&<{flgrqd;RuvPR2(_xNbg8lb%YAkDd%V$gy6
z;a2p7Z$&L+F!PhEuGRrkK+B!`;X#M{DJVD1Nmi8GJzw}u1%t<U+2Ep|(s>m$Aee5|
zXLapnqA4C4k!!-D2XwFx{s>*6xo+PiVJd(@YJUVPqxM&Mb`x-Yt)GG2yXtD9G76uN
zd)&JC?1duc+h{qhDXtNJgL~Kmlsz8-Y4s$POO)r}G49dL!Na<PiS@JSscCuEleT#%
z{q(Sc`c@Bh=YFSt9HB*D1EW^R5YTdZv${o9{}{iTpBmOB_1}2`WYQ=GG4`($1Kp<z
zXz{aHK$CO?nq4jvVFajAg*s$}5YV+Y{$pO!f8Dc`X>$?iSvK&RCY`{EA+VHb5GUa0
z-!3r|MNi<%ffXwh*`2kTB37lwU$2C`&+ReABY&_?MMi@H03_j1EC1NMZ_YnvDf-_i
zKui9EGKmG8Ism{}g-n7GpvHetK&{{hfdPPaK8>Y#44j+(m_8cNwt*GU^#9CJ^H`Pr
zz>$;yXBHdy>I<MV1FL?*g1<JL%|r=|90;s%0%APs)S|+E;fT|d7yX%M)P#(p0{&rv
z_zw#uJV5mi{7RrCx9q&pADApAkO)x2zcAMDlRy|>9Pn8z!@n@VjP?Czz8MCl9BB5y
z+@1d6G>ia!0d@iNg##}CH&I$9Q6|86z={ou3m6BOFJRLC<|NBCsEZh@PK^@ZDJi!n
z7l;lUknLtX#am^Wp~<R1n?ivxh8n&fCU(>NZ_PgI1YH<lpAwCSp4`R_Rj%5Whf3~R
zgyi)1PWN;a>EYqFR}**Bg1+eWBknZkSCw0p+Tfg|^t*S7nJL)wyVDuEJQD|B-iOU-
zx-~h;wZ`Cc`r3IyEjeb?xb)PiGSrkm29-}_bVzKzMnE5MysRo~J%GO+CCJYN(&|X=
zHM=a0(SO7+%)FZ8<FxPQ%_6I$P(<vBLxCk$3tnE?V>B}UxFLp=XhPG%K#U&TL)n)b
z0T{{p*77PW5p}g9hj&3XkpkSjkvkZ>>S@ENEC{UJcXpK(?#bk@;c5a?(084qK3`H+
zYsl#7tf-un)5^w~8a4aUQ1ad0&n*ND(qFqrFNC-1@7|d$7-H||O$Yj0nN(b44C;G1
zcrQssPZiCrUCkNwg!@@_ChpHIk!23K5#R59=7^3MLfd5{`q33KxyoiV;)nZ;Ul?8V
zII|xT42jBToOz1y9@3!O?EDNU@pzRn+BA3u`%Zy8<$hiH%H7H%ggdI6>qhC75Y~dR
zQDP>5@cecLL&V&y$~!evp`iFpZ}niCAM>H9aYDxa9-=|_D>C5Q$PmpwVE)h;3@q21
zvNatIy~7?gY@O#P(Lu<#8+LW}l@u-sMa@C$>ShLZ(bf}oj#k5sqaVkp5#PaEjR6$V
zOWce-!1RpyOq^_V#y+O*X^fZNi*Cj~s>^SpDbpnYR~J6|#fn36i3~Z$reMvt%_MYI
zp{4FI(`dO&?A|)e!p1{l#vZwA%z$u$@kD*6IrKn`mtouO^F(5r6A8z6%$O}QU$b<7
zaKfW2{LFrCq8OcXm~f^hPKAfITf0)4R4IBw(FzWw*3SG%o&D9|FR}xDxXP_td}Td4
z8a|vI$h^8)_$V6(EA4=h?mI@E_VLGRlF-{ivbU?0=YsTHc&5v^qyw#C=8xy<hlk+C
zG%E^wN30r?nDxh)FP<W%7tp+YRD@6x*^lm271ly^Yl@_wAeaNQB|dele<g1ViPkH9
zFmA&<Y16zIsnUlx(lh*ptScM0*>$AuPJ9)#n}EjDD4Tb+{w0kdgvF!BZSh8T4^A(+
z-AMh$^YcW__|@zqqfSq32>%hgP4e8fW<z0|++!u|3P!w^9V%lnqvT(gq&7tl_J?JG
z6SqT!cE*}FY6LpSu38erKb@BFG5v(`|M}I<|7$ZqJN$D8`PUUkfj)p1AvA@B_UB&u
zkMStG*Qr4pOW0&>wh0@>mzu{`BVzg^Vs^{dNQ268vTwN-XyqL`H$rpk2Bw?G#=vOE
zHdfD+qG0KEZi3a$*v520BG6;Gq^Jo8z~SgdeNRy%4uHefg?34iV{VM<3K|B+8QP42
zrw{wvQrQ*M18lK%FbaUX0g9!~7zBFkzg?yQGW0xS)aU^+OpR#ER_szcD6Rcw(WU$3
zkdfrLsSd3(rOK0yfmz?QNK2M-O}o)i%THNL(Aem^6I2@|dB(`G{~#F^Xpu2C`gTDA
zxye`?v$`OS3YJL!uvG%D7KOrOZbUv~O*M6pf=WaKVoO6M0yQu;$`{?m&F;!SBML&G
z*9CSBLnYce4E-Hr9+s~3qLq3PmhO+Pyi0k<*zAQy(Te|#gq6N3BAbAH$ogI<8fFM)
zEDnj4UU-Fyw=d_4v0Z~_q#kh6)y*v3&n)8oD}E1SiEYS5u39hFc7b$dgr1JVVBaG<
zcBD_hIEIeTE`}~)7e!jQy1LetqrAp8(^(2|ddk_#Z_-%%_Qr09Mm1zS*8};adLv~$
z7p<bDa29J|a9^Cmt(IgA&;&f&7Qmv0eja-Ku@q%3AYt=sH)q$^eq-GoYe_7Gp4(~a
zcQ~R~0^0x@UeG`(7yliGfw;u>JD(U7SMl$u--*|*&)JEK85R<!4icA7uZR@}Ek+TK
zp7E=I%=06-9s5SAU6!?k&&HH0h$Cn?iBvCciAARj@dVc>hcX*J!c<&{02>j>u9jXi
zb8SCpy)3Sy-I^SDs$ow;CBSE?dwdnC>pF;$o4EAVRt|v)dRO0SUV+e$`8SG?=r(iX
z);a;PpG!m(QPzYPu!_xIpN5T0F`3#!uf%>b7{6Bcx;DWu09-%`SQH+6;T%BUn%Bq@
zPJgVwyzXT{JHqjOk;BN?0P}>)#I^tBW>|a;|GZ-p9P%<~V92j3-><)Vvb&JTM^OCT
zh*X+>@GdIT4pST@d#J0!e!HPAD+hZDqAQQqLQA0Mr)Bslu{Y*bOX!B!EC0YxN>>N7
zj<-kON4`7z-Jd5?z5oQ?A{Ho^3HhD$%u4Q#?^_ArF%y~R0PlfQ3%>o7bvp)AAqBgc
z_B_I#nqT9Y$h#*p2{&<I0>i1BGnqPiz6;<^yW7!E8@)H6+|^~<aG9N|7SoLGpS<s^
zY!40?O)<T?&mVDrk#azVoZsRm@J#J6FS(&Tu%xA{?6}v#*Vi?ZAPvN|kqj#|(Yq2X
zh#4?EyH72Iw|gUgh(q^9H`|&G>SwwpS2i+?SsZ}m-KlTsFqkx%F@GBz2wpXpX%i@W
z3icX47`k`k7@I=rD7b^9fX;PfyH&&5=I1s(G(+rd-GZ37u@L_CWf(dBi!}2i7!0eW
zBN4ncN3Kw)QJs(V0C@hXWy*u7cPrdtE`ujAmj||I>(9GRX4%$DBYrNZ#J!lYC@D*#
zw(S`jI}+=qn{~IC2u&{EfZ1~1IBM>m?#S$B$w#qn1{Ck;%S4hb)k(UWCaVl2&%ldL
z)C%E1S^8010?u**5SthS>@~iN6K-;c2@V3!9=H7!PY2_1T>Vq!B)9K$azu}<^!F12
z9S$-1>MxG++on%XzjR0QBndpmSjTFAFFPc~f+uf`QVoMRw8S3p=ZEL&k)9D-VM=*)
z1-+x-j!NKz-82im5GCBt(tMceS*|}raHTr-o7^qzQf6ebNnM_V%YNR|T@ERTySCi7
zlr8h-#UpLkyAeZkR4t$o)-*6AR_sNjMvpV`noVK1jg6$rhqyxBdw^<~IB-mA+*`f7
z5$km!cZWV=x+&R-P)0gE__$gK(RMH1Ac0KW^UM3ap<Hfc9*lnFYtWPIwsVEia#H@J
zg1EKg$!Eg0?lAg3sPYcgQHXhEAaM4@DO_Xzvc(H`;YmcKU;nx%y)yHDMT=Kdc(ak4
zJSb}WG?|pvMq5AO5&elgURQT0j(a0FW@%5i@J5bW_GalJ{j0K(%ORXoyA<2G#id;F
zx3*;l`?>31X|b@bm`sz7oD_47<qGE~u`kcN?fgvw;f~5w@_H04N{I*U@)(Vcz17hu
zIR*lf>Ib<~V7+|s2YziH7KrCq?yIX&uZ|g)E&%~gM`8&?N4y_;e7QxL!#-{6>d3^^
zB@5`b(;;%hXWd|AMzdS{;5^oiV%0#O<zDqXwnJ!;RCkPp{yXJVG)WDeIKVjl?PhKy
z4UnPs7?U#&fcv7Gbf2Qe+z6a25P>cKICSg6YOb*Z6;vXa#~3yCABT=>Ggp5=ul2n#
zgQD9dcNvx&CAWnJeta5MgSYIdMi>E#pX-4UhTY<viuT6UM&SrLh;b#*7&Midpm>xV
zQ^r9UH1NQSM8nawOQVqDN+dC8sx?33{^=6KprHnK$zqh4R!KW$tpcynDdoha)QF~2
zx2-bfS1dQK*E9=P3kKgK*DkH@qfP|hqs9nVtI|a0R<zIVlBO3?G}5S2Sr=`(=?pac
zk^l^k1+PwoRjOX4^4~C62<kViA+TSL1e?PCa0ziLmJ@51b{a!^X6cI6YX0tn-TK>A
zt7*gq?9wV7G#2}dqgJh%=a8k_2gJiD=>?*i{vpIdj7znwG7d-ogJT}924wt$(^srn
zDh&*648#jp+XCN{i{n96)ofA}3exM7Zwea<ren7S#y4gJ9v54w{ig}41jtshNTtD)
zjWEJaOF*gdnO5Df3JjRa>^@jpbwyw*LosM-HHrSF5|}SoAOvYRx>ji@aI8tR>O;oy
zn}68<WN=Tg=?5@v;pj7d08~2lCFA%WKLC17AGJ;?Gca_OX6cW<;?BQ)ea33Te%Ivw
zduN7jJeuo>2@L`NKarMhJlcPFbN0^u%3uGl%HW2Dl|oJXyQpvU?uJ+X?!#)TFN69I
z(uJg6jVL%?Q9+RwnxEE;o7IIX)Fy4vZ?z%ca7(hVhJs#0%@jSCnJFQ;eoD$Six3WI
z;W6HeWd^$+!`|QM+dsH+6r|WWVZ-tE(_OYEp1FNh9a?NgOVyS1!+xBC@ygzt^cAhv
zp~P5(o~s`5@VXS@>x@vf6FLq+Yvx38`DTmcBD4&Cz8xi}NB--qi(b;Jb8;a1nRA*@
z(nGPC6L7k{h=1xo`>APw^&x2=e`eK0+g(;B(&~tbjxRs2C(bj(%BvEtnvW343%4ke
z1i`=d6J9<Vx9mxPUeq(8B7wyD&R_uHozN*`-lCB<!6~qxFMrYm)*CsO-xpuykSXZD
zic_Y(KMGj<Ri{jO_$tT$DQ0F(Qru;W23YTs^6~%qL?x2yAqfy^b<DJfuX6rRF~*nw
zzjL1d<s7KJO-jI@nKnxK53gj#GbeyR0w1CXNjSs`7BBw}IChUoqZH%615zdsJ=~G>
z!nH!q<@?JR3LFIJZIW;#)!*Vi$vBegzY66@s=Gg*-X;B2e~Z7A(tP><jXcbkziRTI
z;x8o-{+#K5L7x7TTF3vScA(ZNsrrJ^Y~#POhL?}~pR5WJNF47-1`wVJg-{J3&O94p
z=JJQm4n)6jUK2`sf&9(ye-(=+KmI6S@mKvVW=*8|@-3OvYS7pHa8Yo*<Pj6u)^rXM
zB8@%jVn>c!X7FvJ_s&g{q4Tx@-75;9{GrDwM(yTF71;YW!B1q7^`R$t7@_M$N9$Mc
zEPQssm$`TtUx}JZZg#H2hdue{;CaUvz&fvGGMZ7s^7k%&26;^~CI_&jNPc*7+elQU
z4fbLj?xee7NQ*X@Zc`?pCL=45hbjl}VK&9cbW&j^nsbPSp8kj&R2ipNNw6E+F4(~`
zv*>(j`LiUx+mzu?VlJ;@egF<pB?q!8Oog3K8;%`jP69>Q@vZ**w9am}x?5UWW{7U`
zooPlx21sRYRKY3P)KZgthS{*bEvUs1;ZTZzV1n%c>$em*lthbZnwwg-y#HDnZ$|_!
zjZaSjm&S*P4B3ZBF->X33-;;5sA6weotRL#DM47GiU+BhV^lC2nxGW^E{wB9{aG02
zFCtO^E{v0An3lO0((Y3nS<BkowRf;o>=g=qOX2wJM&(UQEu{sQ%^c~+?I_gv`?2HL
z7$R=lLdBR%y$)nlOZ_m^ZHy{js)thMlphuz7QnPi>5;y%QM7y|21wt|EtyKp^M2Fq
zD7)WlvL<9JwU?#FUOTr=aDppKUMSN-S8aGjKwT4~cD4DgjnAHy`0JAl!%DH~QL0W^
zympaKTbH3O-}~{EM&yUP$14NN1@{o*Tj~8kX2G7s1fs+`2&lOQh*1cx?xxFx?J7o;
zS-ar95Z@_+gUiDO-#ADQUVl%l89rz8N#3IErWwX}qgplXB9l$Cc6XzCzeKI+nbUf4
z7DtuT!KbV3_C<NKV#u@+ah==-Gi%(HB3Zhcl@V7?8BQNJ4&VV1@J8>Wg$WvIRHowt
zI7gk;`V=Gq%m;pE?YyBT9xShZOD%-oy_1EA9fs-YYQ8uN!lW%eaTRl4L&)zEFB4Ha
zfQ5Kt`!#IQI>6e$Bir|6*axD>VsISj`HKhPqMvWa1o$OX_2kM3ooCUL2kh#t#zWMM
zKxQ$pRrfqCgGV3(A9m8Ajn+*;YN%=?X-?x?rtZ!e?$zF~X_PZ#sUxo*!#N3z-<wY^
zRoBO~_=4y(G&lHLsW|6naLq3X9CtRCBkSUwv~ooQZM&DedK-_VjXLt2?ynIexwG28
zht+H<s6Wc=QmgB|Ck?Ie#J4nF68yBCd(`PXRsBkjA2EVGwSq>db=9{rSEyS_!^ye2
z(~vlC1@cY~lLIrZxEbVj3EVcbQ!Fa(6lPE^5ztdC4uf`INP7aGX}|~1jcgDF-nZ7)
zI6m$Td|vh*Hr}t^ACCTP@$G5xc{A!hYPnc{zqGfa1C-`?!k%e|d)j0fq(akvVmAxf
zhL&FR!QFdmr(Wjas2RbXDriSBMfbg(!(YKvA<eB6Xm`Y%&<1TeIAKyd6_i~dA;vKq
zL}F%@HAI^NcsfAKk4GA=x+N1Ba!{|Vumz!U9{3}Xx83SndHmTqo!0Gg0l2RAY;768
zymCOQ-W^#^Cs7t$_wv3td3uS}{7G{jVquMKHHkT2-cd1Ov?Ko>TT4c{_t}BBcwh)|
ztw+`mA3oU1Qgm^qXUtr)tOtXKy5B9ldZ|$rq`F;Mxj~BvSHd@Hp>HNH>ut)hdn*v8
z5c2{`G6L|W=i3JkYZ_6h03WfQA-6qb{v?#ZwAD}Bfh9z)@)M)P-GN;xj%y=?vVl&5
z+V|yzu9r@p_9`T!<!UL<xV5eDZ>Y0;Kb1LcVaejw)aqG6b)8mJ!%S`;9dLGH8ul?-
zo2Q%>m-`hFJf;gT$`*>w!><Z^$HJL{BdY_K`71E#Y!^^hWd@X2?>pBzsl>gkSuG=I
zhg$sJU2i?m$ZG|xZ%6R(uvWqu3Aqj6Ch*KH;~0^AIn#5Dd>x|@ZOl2T;kov-tUqky
zpLAz$m3nwjkuKhHO}|Q(1_vj4Ya0xjN#L$<ejZ(@^W1p%G2uXv{=YvQ!Ti6RQTl&6
z36zV2i}Qax%#f~Au{s!?wQ-_x=>{q`z(?#S4j$9Y#)E`!*blb<X)v({d??uC?4u);
zRI9I8<Tx$nSAW@(t&TF2l=wO^!xa+?il+9**KU{sjmjojGRs+Qc>@0Qcb9DV%CNAP
zjX}Z)FBDm*@0s3jJ4XT^3%7|g8}eYi^L=9-`<Mo7st^`5R#E3nb|3GNKFRo>-k%R<
zkUofKGCwYkLO#Z3A_d+rTN*x|Zvtl&1lpdS&ZsELdz<=1(cd!Vec#r`HpuRkHY<Gi
z->zF43JBiMDtw;aHhkU&LOL?VW{981US^Ok0LE$SA4j5&Q<HJAS&z5xGe;7l?r$@<
z?;Y}@g0tE+?#FKg`OPM8zx=dp=w3a+_coyzs?n-Vuf!6bJVX3S$muJR#yJ3C?*Nit
z>zrt2HuBTjGBY=LUM=fWg_7IY7mKOh6d*FOq8a0FM(V6cIReAG-$*5z7BXKDK2`k8
z<rkS%LcCjhgLK0RuXpsv{v5_|)j;N5mgc}SXtJ5#`iSd8jB-YH`rMB)#BdRr0{b=f
zhg@zONQuxodvayo5T)KU7Gc+;CLd}Xt6Pa;^Zu}+&S4IYawp@ODTYTSNGi?~iI@Um
zk9mIsTk$4ZvRtP8tkP^qGUpHXB41y4b<f<vhR=s5Zv&Ae`UX+Qv<*SuRHbDC6p^ir
z%@q=-N9KBrj3cx4n?ncozG<$1f^=0ylCkgxo}N!TGHv-;5ql*kzez>l>&4tqP8>eQ
zy3$=*X5z8Ib-kn9CAsm+JfQ@-yXMUI;?e0NzF*7VVl`oxF-apoMK&e%+I94r=}3f-
zz1!c2XYt`ZsV&*Zdf>Y0h?*$}>f7V850K1tX!ImsOkI}X49h{)4@EEL-`pvQT>^TT
zA~^brJ8;<&TogqnZ1h)(TaF3q(SLtMRCUlH4AxN!88eP8wsfETvbZ1Alkh!PVPaCy
ze#|q+Z^EjC?aW6US7M2idS!=rm7Q-y&Q3Q4pNK!Dfp@-shw_|0N<^;FT1qEEA1d5n
zJ@ftT_M)I8-P~j-?~A-8aEGlt>2F1ryjG?Zr{p)69;qZsx8)y?mq(&1Zx;gZW+^_p
z@VWdl9uGe6uaO2Ht{K@w%wjZQW@JUROY+S;&JaHX{kbSA=((U->W@TJwPv8P4{f*)
z!ezAezBnXUCB-_(=Ql2XU5}`J`g-2K;w+gc^o&i^VZbaQI%oDnt{k-YCsQ;LvV}+{
zC(+vEp;q!Ls=7L@!p#TG?~@A|_LtElQ{s*klpWD3+0dq8+0Sz&GbQEKI0|<^LlZ*t
zZgBEu=TH(ZpGgk-AIO^TtLvl&t7aiQ1Q$sIRouyT&$YdT7n@w@zJziN6={L*Y{MR9
z{VoN3Jv)c-h(5l{Yc6KIX~rojzOz$%`<jcxa5j{E=U*XCcFRV0Q<W=o;}mGPl_V)j
z<gYD@vAHZee=pTLVVmhOt)C5RhBv&5p573fm>1Ts+t87`PdVIaPan$`WG#W=I}5IP
zQ88AqSLTe9Mp*V+j#M4q-_#l=rI_x#bc#=lK{>OLwMFy2Rj2skZWVPx?v6t_p3Ch7
zAyg%iTd|AbNL_%!s*Jx1VrMqVx*m4X-}oA$?q?Ry$ybfV@Y|xViAGmbj87XXRs+~c
zGAU$+8Moq+@s9<lCEy2Kn>%4+f{r)vA%el_3@pB6^CL(ULJ%#y^huL}(c_?KY9)yj
z{Aqz_$LP_i8gZM?LC19s%)PJdSwgG5+km&xfg0{6*jih5H4V@-A=WzPJ5JpbOqDEq
z2}?_74L)}^K}T|huQM6B1!_g6p4^}1<0;diUj*(RdX5wdvhTyPB~dqD2^vH(_KTSW
zjh(k)R0E3k9|;s7_WN<{QT-^JjE8TpAn=oZY8%j{P=7M>dFBk3?$O6ZcNCeB)iJ9|
z==RmVp@a-BY$?u^n(#g*a53}Yh9QlK+S8IO8G!7Ki?T8{{C3MLJK&u{a8Kq#O;Vvn
z`4W!|InQd(&EyJ8(WgX>sQg+<^Q7|oE_k=h&I~IGz!GV1Z6wEyh+37o8N%0<DX+hi
zUbji}8Ih8xDArdDqP~apH2>a6<FtU;Jcp=6FU-MGSc@bdteXA&t|~F`t(X6F_{~Xr
z6PXS8_RIVX=+Jl!FV*O>OH$z5F8?X)yOXsbK6XU8DJeuwi=6fbd7e4OC#yw;^Pcim
z1-vD0xMq7Z)=Oh7+E_o=h*Usa@IS9&^<ghP7xMU+71S9MablK?3DqJlu3XUcLRScs
z*<q(j`j-394uZ*bBB!(RZbX0Y_*$8mQ0!szi!H1|2vlcjQVlsbdAfWTpUi_I1gQle
zQvp7-1OOa*m6%qTv8!!sirsqKaUi@5d1*qn*g|Ne%KaqP2Q|${b6kmf4lOv7?oEMe
zm+r|}Y?^cFvidSKN5r;W2&42{!G-7;!C-B4y4;kuh_Ow&FJrYy!kxBhTSQuEjtaCc
z?|8LD3mN80D;PiDSfCH7C8i{RB0)WlSqQHAeip{nHA{DdQ@T(82f=uZ7fF*i<9<GZ
znRL=XCO@SZbI1*Kw{a|Vi&U>k)eVTcf6X4X<});%@fw;fVFYXXi)I>jkzBcGY1n0n
z=V@qq$bptasef5MF+}m<bb&0@5nYLI7Ms$3rCq`TYuX6k0V^-Y%1a&|@Ox@_{8Nhi
zGgv_#^Nv6Uh)#WeKOp`j!1Ofl(a7MoV1}j=R?=4T?G2U^KLEch?(J%iIq~G96-+;P
zsNN~$Df#yN;CzdGoJ+|K&kCR7h`kSq<6`1^TU!t}yd&amYyV9v!vOBm<f@@cV6|0X
zq{ar+h4!8OJ|y+Q!p)sdFtTr>|J~u{omQb7a<J-gWs$&sJ#+7>4ul`W=gUja*h@G{
z#X_~^(HPr?<gNq?$JbHfucV&z{t{HKjnRxUo^`CX6bNx%Is4Pg2}eP7HCmAM?~bYE
zC#GH}6G#f$hwV5cfo9t-H8jw*sRK5P1E>SGLKQ@5B`{uyR-PnB#>Evxm^yE`!VOmj
zrFS<hfG>%KLdCirW@3Y9*Rs&Fr_Y}0n!z`BJjuvy(+pgEsi#Uk-y~BDe}klW7WKVr
zPBJcrbn(OA8&x6&cwwFP7!p9e{Ldx@tkYn&+PUM2!aBaWPuPxfk~;E^>}9)L^+{kw
zKebDO;Ob=TuHCSc&E~O!SevG9w|22MbIauDy|lt(g=TmSs^^LG-MtYX9RORY8fX>z
zRUm9uj=l~ESOoI;U}F|cKeVW<Va&kC0Hb9VIkI;d`brLLyGK1#nu1t~qNC=^Zjf^`
zD_8j)r*m3#MKCX;;E^<UzYd^#glzm^q#On1k}Xb-e9Nl?Q85x88v{uw<Z>;Mg_q?X
zP)OuR4jdj5Y%a@gr>8zzFQI4i=LFMAWqZ=}@8Impf?E)&SW^{Rs-g0+l8g<1_)-14
z*rt;G3@zzb-G%l$sw`9xTI7czL9~sA>c($0|H<dv*7_{$#ON=$zFG>}GL?r>0SJR9
zO>~Wv+?Al1Cwthsw4gc;Rs1!+;dj$0p(af}pqNnpRnW?|>1C1=qCrWYuF>jPl)Yda
z?|#u`=VQufRzBE%?01QwNGb&^Q&8811-$&k(NT+09^X>U|CYJW9>|&#_7lsxu7~$U
z4s8B#MUE!T3BS#yZzCIyqeR>!B2A<z2hJu*^KNNMY-6sG!L~BIiyo>4>(uz)MaCF?
zwe7r(OZ47K%}fYgizJ{jStV^rjM;yjcW0D7#?22($0gdc?$Ef6w<es-aD;x|0>h<B
zAIGoqR>mkb=bJwlSKY4vvkL_G2qQ_{5bDGQ*NQCfbXQ;k2RQbg$0kNMp{9yp@ihzZ
zVO#Qxy>{#xb#>Q?+ymY|HGfN0Ja2<WWgA-labrpuHxI@koJYxfwp!?&bIoK*<tnMV
zg67Lh>J5L4#a5AUJ|l2#cuS_NK3|M~7gxLO$Y6VmgmAFX-*&0QI-lE-Ayv!pmz~xz
zw>RnUBx~FZBtfL^w#t0_(Q_?PbR?_vGl=?7Dud8YSm1Is889W45*wnjyUU5hf^<cG
zz`DUxQQz_eqHRHjjoM?0L8cDUWrqq9sx%3qq5lkL>!5gn#Ol+U7eoVBf)`~%?)!Ja
z8$`)U6jtFWmjXE(c(&~`wc6Ro&W}wu@;YQES;OqgL8PNx6<k)h?dfHXp4u>8x&1mT
zOf$aV>?$$n>9vHotvLJp6ZQNqp*2shSd80-urijJ*V5bxVTOvGlMq({$zqBZ(kwCh
z&)loifodHFFA2$rZB+_o)yh=bFT!ZnpClk-K|-cluSA6CekK|Y>jr!^+pzyMw5~fk
z$0oYJMo4dEWw(UT-8)lW2ucT4i#2I182<0V6-=8|)G(b->E0RLtloG&Kk_^cumn53
zn058K*!npa+mD3q7u`Vw;TS5eiQD%z=;`TlJ*#?h9gUR0!G?1V7?=tJ;@nnm8HALH
zb{5;KdMyShk#N!EQj;Irl0u>|_|9o<;=<-+sfF@=rsaZSf_)j<#2QhQ57|FvsRqAh
z>T#;WO%%>VCliVmGBi2ZcK+B_g8-wZd&$~GGt`Y=4Hu_;c}+{h+OMe%TkNv>HrYhu
z1J1}AAj?!N_KjwSib7KU8iRlCEKZoL1pw8Cb!$8sF2wNfVjIRCc%sg|sMA7hy1rom
zVdk4k#*)}Yo`paHT#KM#&C<f2Fg=)ciQq%nQ>YGYIg5sUm9Bkb-_px|uufX0c4OaD
z3V2fK5t?p`V0H(&`pv_8im(j*46a(Iqs!b;d|5lONDgh{yF2X@6{vU=!b=T|^`l<n
z)~q3+GeZaPd}7I3M>sjKnZi57U<B<WnW84~k{pBFRXcX%Yku08doPl)mM`PW&Zu|_
zr{NprEtA?NpSjWZt?+YaN}i9jO5svsAh;A>{Gl4KR*fCPyXgL1Y!|6vqKsgKoqJZt
z!l6T3g>MYAv@k;G;TqDPc0*2Ud?diNL9eyGBpJ}2vuJn&hxpjH1bz@~030Il#0zaK
zSsOaBY7rIvdA&mLJ2tc-1l?Rz_y(%JgdR;85uv8>ol$^=63k&mzTiEHsB+b-i6^EF
zeX0DnxkG&Vcp*s(7o(qoY$W6wLFV%kZ;0fwHTTi3O%z>86l1|K&W(0%=e5iQZ91ec
z+YP7L`Ecjlpe-m`XIMswiiv4iRZQk(fTehr$v#0$a6Nb@rhgX-bWMeNs0b%tc*hYL
z1k$HRve;-JAY^MY!(~HEPt66i2avjb*XGQ^-S~p`0P@x~eNFp8TC90=HJbDsqsA~z
z#ux_$80O#F=d)?q*_fkhz3Zus2$LL*Lc9y5$a25NN}lnHz$vkwtw=l{!yi%PD~^qw
z(1xQ%iy?Sfs^o&ZL}G1#HWaQg6U~L|z+!1-_C=HU$t0M-&^!=qdpTWrNFwLVWrx%H
z`f^_o2?eW?S6o76*zMzbY;&x357DtYx<e984Qta1lrK$FIKakVQ&iKKDTWKtLDgZ+
z8vnb<Sf!jsB2U-TW+$Z6R9X?kt)*Ruoi)EH4XR2b+(b#ku~eA}+@G(Kz|;S|x0me_
z;ZRRM_qm#_H5e<<Ta0P`1fgFupq#URuL;sr7pz$)_>9HtA#`2xq`;aNRykDSoAo+x
z0}<A7-C3?7#9Tkl?Rp0f`M_&9m7<l3)ml7Ri9|)sdHwXvN-d4`;!RHm!ToFHK?t9~
z>5~!g)LifX*+g;X2KiH44|(zI5wM|{BVpLESp>E4WIqFy->mEEE9Si7w?L17xxEfr
zaq5^&{E6efX-?u*@Mn0~xG^C!!H1F#e#-2tz-M7IEeAu0)dnkQo+v5cZMFwNsMN3p
z`S=&I<E-hz2oz!%wylZ<9q{UDHYKRLi>|JKIeldFo267p35Yv6lo;f=X*_LCNzwa0
zD01})j{{cVw3ob(!-M6KfNK)vRK?{f@$Qlc!7lTab*>q*^o+8?x*;fN5h8-I%zXC6
z7%BtH)p#?^kK*6O_K*r&BSE5)h#X##k>V%3QE-JFoZ*&a0&cb)ZCA#Rdnn6vhCuxa
zlERh~9REqW%*|_p$*Lao--hWhka{3Nqog^XV1x`$D7!FFrZB;0Y0G5s!UE?>0ALS4
zB#9I9pr_g_>Q9BJZ@B%rHG1|n+78}$d{Lcqi=r`tq&^*4G+?9=1_Kv?E3EdkNX!=n
zmG30)JXw(E_|wk-*#y_i))=S<of6#*rrkJ7rUHjE!q(g9DsQG`S|VlXf_3?8d%M31
zg(#rXv7C%2!~R{k{*YJ1V^Uh$FP!Q?d_arzzPp<39VRi;tK}Ao9o7@>fc1a&*Y9X>
z$llP|6n$Iogc0It$yx1$`K-^YtG_AQk0D=6`#nk;RJ6IZy#8@i^{zO^4GDt517{XG
zo4{8H3&MUKyiQ%077V2;msg{ZYgXI;0#r#=y{ukNkvMl=x0>XKwqOh~I(=3i0!_Aq
zYVl?NCfoBkt8h!6=BKah5XQ4<J>Pe~QbF>h{+1K-?AFNvuxQPo(J#bC^uV|D1oH_6
zD8Y*}Vf7iJ{kym#&FPFMGJTlsoJHy`EHOrF%?{ixN~VYRE5KNJs87n?&|?&PTQ`Ii
zTkk;|j${mKPGbtf$wgjP1^)T%B@Jlevb3uX<t{K;7gC-f$UOE8*<?qb_H`1^<aN~2
zS9&LH+wXK%wp_y83%G7TqD&j^9MgVN96=kcioD<5Wpl}ygF%BZ8VN=i2uy*w%i+e$
zo+HZS)3wf&c_0si`8697>h<(R(1<c-woKdFoL0XqM43sJf^l|vXKSWC3zQNn3(MCS
z<j21YS1?6nig>sHVmQAW?2KN7-+f%WJ7Eyt?w%M!q7{WX@A1%OLKzkN_mYt)ioLMm
z8Z<MjgY-%le*0?C)8&zwI=vIh`FUi=fg|&@PM+I!>&T}l4~SvJDeh&1(-l-t<k8)V
z(1Gg6)yp0${=DcK5_JUM0i(f1h)KO2KBO!}5l@4eJw6z4Ps#c$*BkM>r~zM7!p+sr
zb*pqpG&ND>RBFBR69T$IB8)QcGwT+5?(8Uq85n|y(Xf@qxFJ#iAN)PzV$Z(|-ah<5
z`^d;gRloH_NnJz$;g$r2H1tLqC6V)wgR?4R%vT4uar^Pgs7imlw_7-MOC=f%?f^-_
z?0uDzIfODS@FM6y>g!qS6MsN@u963PE4AY=bGY7t7}{}}><NyZYG<{lndc`oV&s&$
zXRr!A3MyWaP{4&&Yk!Gk3uXuy9F<}|Y!f?WKz4~^I24913W}^#efM{Wuh<YJzw6}j
zbq8}0XJrf2?O7=l*=_5VjU|Q&kpl$b!I+?X|6TA(5i%0dP8Bd_9tHS1mvn&r;8O(i
zI14WXi2-<Eui7@Defm0`ZJ_@-<mp}b%YHaO*y^SQ_BT_78uC}d1n1)rsq~#C_jx?k
z+ye05W~#t<TSYAcqWXRZn&vg~iU*QgQeby@jYehEl?PBTD}`!uiipq3*17;U&DKtT
zf*%&$Je1I-^oN@m!DEI_YDSLd-f~jk=UXCZ2(e01=_zGlO;TlZ1~al9JJ#SZ9LZWm
zWzp<0L<nGmpJ)7cp>SSn360~&ZguQdASQ=-z=z<zZnNe44UxzQOrf<^f*7oP-58+>
z3<)?H-#fIseA?HJ%-R#^25fzbjt^TFQu@T|G&{v%2$AS#B5Nphch>eQLt9P^K~ya%
zQszh)n6IirYc*+2*Y_QS@VHcsq-vSkPf#e?>o>Sm*=C^^`rdHO6|aTe;U>A#3LQkZ
z<&vf!w14+qZNSiK#l`SC2sEZhY%YvHw%RbZ8RPH5A=U4x%yKQtP(E0%MwcO71ph9!
ztllS^4f>zU`7UY&bzV8fg$NGtu=jSpArczty$Y6t8Vl0PCHm4_R`S<4gxpOx@gP)E
zwY73%4gbW0ww@B!4(La4)7ljL#ha%j2V%_<lI!n~PM3nC7{YqX27K01StN7bFm@v-
zb_gD{f(tGlZY%|2!Uq3X5Q(+`p*()!uon1lPMeAE3zFe*>12qGZ^vN~EtyNU%TMV5
zgS49}2wmW7!{#6l7^>lloi%mmTSf|_hKK=N@cWEOJ^wCvyKt-Lu3%;{$yC?ozF`$k
zVbb3&p)3S{I?)(ICUtyYOI$Zet*9R`xNWi1TinzbFen7)(3Y=k#P#t*Ot{g)JfTY0
zwMRKXWpY9+u6S#v59`zfV|yNkiBVhRB3;l-j6$L?jxK3<1k@g)5Idm)f)vITmg>^9
zv;5R`gc`X*ueY~RunRMrh>9V>)W0VchH^U(Bsn7nCFBgY(};eV7d3I?8}TunhefjL
zEb}5*r%Dl~d7Q#iEFQlXwPAx9>k~6Cd}`$;`2sOtguO?ivfPRksLg$Aho>v?i+#c^
zXuxFXi#Kt(QQDkfblh`H#OUaC4D5D4ec?<-l#l`xANH;3WbD6*_m6CfxOI@Sqt>(z
zt-Q0I0#rFxAt-mPki_tCw<HyLVQmSU#a=q<dV%y|_(-cKk9yh)k$N<9iEisd7Ggi5
zc&^pTRd#8+4@wusn$s}U>4?zGkkI>FK0DA3H=pM%ydhEkwvU;x=2?w9q`rR^d7?A(
zA3oGn3J;q)kAO=&1XcT1h4rs)90oar)*`B6tfI3GBW(>gUN`h7i4P301Cu$6qqA$?
z%32xm7yafluN-%y29Ubao9Im7^}-Ytp+Bh0=K5My8|UB=RdE!e5|;Y-U{_UNRG249
z3z8FgqWkouW}gZ60o=-n0$Rx0=p#3^o)Ytz3mx;%3B-ma7@H^4flnL7W+ejb3#Fg4
zpRaZHmn*b8X780~!SwU8Yr}%xP-LXo^qnlHs_-#nY<UOX(~^FclAGGEG&-RsjsspY
z$t?0#5*n`fK5LXANS95I)YG-ewcCz~#Lu3{QMG#u*UxU3(6^lKM_ev^*{VnkR44b=
zVs6057>_pK=-&~}(F&8QchB;Z<V}=)(<!?6XkUsmr)4{s2!%dzShIt$BPkr?;?i)o
zZAMMa?Bb9?bf)T;#<GuNO|&oi@iYd&3w^vV+E%}8S||bcXMm}#kLwioc|^#b)Sajf
z+){p>1BiAAZBRrINfjYV(K~D;kc4HfJ>`iw+Q!V3;CKmVspssWJ@t8Q9Eg?c8I*lh
zHT`{kHRBs(bCk--3Y)Y3LzsGDf+mE|ih=q0N_VBCIeqT*EZ?YYt@g0BFl!0*xUaQ-
z-w|n1&BdyftYSNBVI=dJZbLoX`oN_5F<pcb@>VMRmfK<qu)256W_=qtdP7?*zkmH4
zBc`?SOFQ$ksn_@DMwRe;Q?DwNDe>^fHRY1lpHcO<Z{A1Q9v`1aGMf^@E_v6Ee_Y;(
zV?Sq7@XXg3-yLo<)6tNLHQknYb!NQuI6xmGJmNmJ>=|k6YqHkZJf%j=KQA|VgVRMo
zTi#8b%e-(GtE@1M;{<_98kFQ^CN^0YS%4qJm5kHlj#~3wd1*IOoQ%}P8M2J*<UMG6
z@Om{&Etz@y%zbIsgF0+DaeeR%(lslu9tXd-)_AR6)$v$9vt_y8m)#IwXfKs0MH-l%
zG;{A$g4OYc{6U)RT~*FU<TzJn2$5eHnY{#2+esA-+VH&VnW@%9aY7cXRzK!BTW;YP
z=~4Vuu`7_y_xQ4pdrf(`DtFC>qh6kcKfTaX;@TM3hga#6d8Y{f_u#<m#dG&4M|*C?
z(+}tg3<@K>JuOuCnA+^FRSs4`OS#N*l}IluhTnuM8CmAbk2n42qX^EL`})u3C88sT
zR?h69wn<`39&DHg4I9FF&@kFF)fmGv5?;?+3~E$tNfyCv{(46BlpV?9Yj_)CzeBU6
z)hVXAk>XVj#=}IFcI_jUQ6GqLoJ}wctmekrbmXYN6R!0P`a}}{HgO9m(qC9R5xJf&
z&M1@I>#EbBozXQa)i-U}QPX|b%X~JzYvM_$nKq<wPMcHJ4%nwNH5M~;8s?!8eVK0e
zls4U57FgGF8u%Jqk~eS^dmRM6Xii@<uEmW$6|Xer?vkT3;7Hcs>?tsj9LmwNXP?qu
z#ZAu4+42@S*N+?kUx2C9UsK7j&=;r$NnhNkR@W*!q5;xSESlLofNL)BRn<8FpXd1Y
zpwJjRZXhL8hPl3Xw&U|2g>Znj^(HDC5puHz97n*~E7Ols;r6wt=T=R2aI3Q^viP&s
zHRRA5b*ELnU;GL8C_RVx5{)?09Q)Zz;uEfLz52>by4FL#7d{b|n&nx#XByW+-Ix}X
z7AGj)99J;T{OU_DS+4bo8ud2TuPWwVT*FI&m08u911`(u7H7WQ?WMT*yqolJ6hEKy
z(Vu5HjI5F_U6oKyk}xF}lS464=?#{$$-JVQjAT?Ylv~+HxxB?+a2eb=yeRG6vAwO2
zdzst0S{rU1&s2yf+`NjjZ>--Qep%(1CRYiW#CQNWxD?jS!(|(pSdx<(%%t-YIp$c_
zEeYF<wZQ}^Rw~d!TtTi{7%X!z^*D6&G#)EvTp?WEzie<^I2`k|MXz(sBa=_+`n0hR
z8Hu|a<Pc>hx=kTVG3IIKjPD(?7R|xeR6I+!>4@CtwuJ_tg6un6KQ)pxdMYj;KpnHh
zwOY<|WV*RBXVDdImtUB#KI4SyJ7zOJ3>xGh{D}mGSjZ<U_QBhkTr?L<k|ny=QfH*F
z9BvtKhK1c^Ib<%me2;!oopbX^tHo{qK#a#2yZbs7i+0I3r<h_m!a=0@Va4;|)?@!o
zeoy3(rh|x==*IY`!^5vrR>*nxdxs)=B=|Cng^6W9@d?@=ctGD0;ltvrFEvY-@ocf*
zRG!kB2?nftT8K5obKXgZsei%ksLl|e0hl;KHENfs6)Wkdpns=39sc#8ar3J-@f7@-
zqI<&ATNe}0c}2BjZy`q}zJYMigKqp;8TqEQ;bBVCyu?Q@LV(Ee22|3Q*3BB@4!!7J
z7HTfpviQ5kqlwl>Ep{hp_lG#+vF=A;8GE%>OYCHWCWxOmx=mwzb<uucDP5wNSn<X=
zjVa!5scB5lgO%v}X}Ok~Aav}ub<Na|xS_TDA5H2v%Dd?fM0w-&It6=u-(O2~o=}-N
zb{gj96=@ot?(V4NtU)HYE27TMhu+H@F^hZ*WZCs--}5pWN`8)y;XRzZVDs!Bz>l}=
z(tIBAetO?733jd~V&GhAm0RiXK-hrNuYMf4SkLfweOVBA{q}q{K;ZoV+|ZQa^n6sn
zA<)6MM~Wfle-bj5imLN5L7l~(sAPB1?NAK0+GD+()|sX}j@36x6ft~b>`%&VoGMaR
z&oYnEA2rDpY8@_e)qiWLY;^ZTRM*NmJC?BRXt^=IVr^29y@E?#cTpXM%vQ$chu*&$
znOw+5Sa$#OP7t2v0-=thoT0v=Gi*O~CPZcQLfz#AEySAbjT?-3YG0R5Is5CVXr7&u
zGbNOk-LIBh8kFk!<zw=<Dc{C>SA#uPZ8`|LdKaqL!m%>BX?8KpI)sF@3b>|K!|L3Z
zJa+2B_Z_>uE!{i<`8N%;p$&daO|Awj8hYz}FLXQPC>IU16$mJF^~0+S7G+2HWEQ|U
zfDw5|+3=tn28vF^L?^UsQ#IU;Jr7U!=y1-tD53qAsOPe(E@V7-xPD2^C&d(>yRj}z
zJWYaC>JjR%C2EentIpTiJ~k)~?#<?Az>R~lUsZkR((T~1WWKE=(C@X`ImxuyrtE8b
z$bi2y`oMO#w^-bKcZQDy^Le{jC3#&j__%)Q_;`*)@)7tBSMLPZra)^6=DaS0zBKo#
z<9OpmR?j-xWCOa^`&%leg}=rVxdHq3;Zy`?qmk=v|4I(W;by;4@#R5XEI%dEMnZ^O
zZp+?h3m);}4ZVcT2~DjM)Tu_&YPv4@=%rggPa>VHbPC&Z`qx&y2X<`s8aeL`+)(aB
zMJSr*y`Tk|MhBa@O@<SfhZ*-IQXc7PT1jiirYUl$ftPIl(e4(q)s$OjU5?{x&ix))
z0*sCD`2Ogu9AWNXTbJUr9Iau2`l41m&CxHAB^5}pud6PMa<rMlxE(s`B<RT;!!p`?
zV?yM=zV@0qt2DJ2j!$Pq_m!P94(;`~$ce=-92dk7Ag)hxqz*bd?i7wAtsJw<?e(}Z
zV4|3}FvXoUmXJ-=p4kksSA~?>p5-!A8Iv4IdLY((FKv=gq8+IrK;KOFTKJtopq4g9
zqAEA3lxok8!K=Vi@BF<21vhcJ{_e`p#qvqaUD*U_`qq3t0%z$N^Lo)oh#lc;YQ(w1
z+0eanuEoTWm7U7Ez*ncNG*>=793486CEz_HfoC3vj?xHpy*D|38vJZvsop&jZqfJ%
zf<{QhqornZ%iIP}Jl79FAANmftF={k_aBa`I1KE4Zt5McrPD3P0zXu|uROQUVK$7$
z@QRb)0mx5A?HB3vTP<YAmg}YxBkwS%n>+(QcIG`k;O*%z&gsIrZn0JNF;9u1A5Q$s
z3DuSaKafDMD0}{8HyZnYAJzMR+KtA<$jQ$BKenTJ=~a+7MC`vkp*wTc_?Ac=e_@1g
zT#<L7XBOOs+UGu$W7ewWL#+TGoiL~@CgqEf_8NbAzWuhMmn`(6$WRo6FC8aYrCO3y
z`}XyBPy&NGVa^`gH|cL~4{tpJ_?*FWbluf&GSw-h-b`p_ck2uS?|WMU?+e#Gz~0f}
z?fT>U4wo(l%{W)!^*C)vaPKb#8w@5}kv<--cOEsbXCHj6&l}aAPkSW-txpaA7jb_b
zmPgOEkHSR?6qn*I1q#L8wYU{`mr~r_inmB{_u}sE?yeUu#oc`m^uFKU^Ss};_p$%m
z92Yq<nM~$Pva)inS(%I#hI-50-X)tA!MeV@{ZA)7J&!9LLgfX+HJxHd%7;@cq?M<&
z;m$&@=TgF!``uozmiv6gVbST*72c*hElt1JS}%`Pd`#_ieet2QtNTE@;G0X8LD2Jk
zTN7h$bh2&pBj3-b^%|YUJxz&^H)jwD{Yc~o4hhqgSIf~li%AdBJMuq9Vs*?Hydsno
z1*#e2(mJS63jMO?k#vrg#&IrA$u5aolXzR0hoBBU^QsRK;LOGd_1&B9ul7x~DqH5*
z(G#vFjz~`B=Fk>cyn>R}&s;NOcNG@dupcd!6E5uNQ?HhfWKRp7KE72DEnNA~;=z@K
z_T8?7#=Mqliu}T^bC7{;(_uIA7n^+J=EIewCJl(vaw@DS%pBHH&OsH}x~1i~K&@M?
zclmlCn3_vsM7$KdQQn%BJ41S9<|8d?5%*J&kdcAG<mnC;2V~M+J*F}#r=~mKWsm64
zJwD>Qw2*g>Sgt~?+e=Bj>z7}mwvi1gWWOH1Uu0tno@XLoiVqFPzMtJbP#7Lo<gwUR
zoSlp?C%0ai+c2Fa-;$k_CUQay5Z|@TmJWQ>3+o}wK|N>SnB19~!lQOtnG+`*+JEOh
zY{-98_L;m+@7+S`Dh!y_pFEbeCa0dpUeU=5=$hV46ft+$vc$eqc-irG#9VBs;Tvxh
zbkszSgFs@gPuUy45<`=BtCGV0h|}dP#5-Ee{LZgW4xOjCkgi?YCWRGfFc4m&S{oUP
z1>avc9Ck!I2ixjZ?%Xq;VgDKhbFmP@RdyPf1}(-!lQYWBI)O{1ytDo0JA`y9<8ipC
z`~B6s#=@`ROG=X^xmdt<qXHz(m@7l9gltv@S07LI8lRuek#sz7_x7Fm9?wUQSDv=K
zJk_7JO1++Ew+c%!mIT9?Hiws)ms|s;KcM+0%Z}xsv&j^i@{G<r?iR3^qImJlD_X}t
z(C;tob2=ySteA&e-`}}@`mxgDakJ4$NcePG*7)r6KxK(yySE0aD`RtHX?OVY#;s1B
z19eQS_5R5R^Rboh(R2PekKp-F=)=*m*Zp?5*T<3|4o#F|nI%sOW2Xlz3+&R7Zo~d#
zX$3|O2~<q+Ds^13SfVD8B=<RR4Dn=*E3eu=HE*lurF>#Hjc%WO{130T?+-_(e<Keo
zmqidyT%Aj_Gnpl5%oBVn6k|4axh_NJawNCxCXbZnvSR*tgkJaFkouxfMAeWwg!oQt
zxfG{HPC3g`k6o3AVj0e&%Kd#n8>^-NxXq@f04kcZ_;P`Y*~3VqTdMjF@S3aN2bWqn
ze}D0V<?Ers576*(hsq5ZVA8sg2w|JHxK~$}TVd#z3zfz6iP7MhZDgRd9%DSGz8YJ}
zbwna3`&#)?@#ms~ISC<MFa8MJf^PAl<%kK2$YL<Z=lvyKteVypKKk1#Fmy!TY$WCk
z*0WRZ7LTe}&{vjND1>SG%ZvKm_bw?{I5A&|$86&|mcN4oZ>e<dwap|oE0Rg{B?i5>
z#edITpUIjlcF%+!#Rt_+TN@gR5ENBjIlCX({>72`yA~HoI7X6pR;?pqkIQH9T;b0M
z#<Fj*{-{m&Fi;>>V@$U{6yGi7IM+ZN6Fe!9MlA%eP{EqnnqN7asMM&T)Wl)e5A_*|
z&@wT`M;zB^jnsr^>ee3=G=;_V_xQ7x{Ow-cnBg_#M!)KFmgLJqB)koM1@(`+Bc@K=
z=ImGLGYwea*J0sWAAZ1C{(fA;rsy?1K&GTG#FD4WIbwCW7nm^&DlTjpSj*{8G(QXI
z*g#4HI7d&BZ?EM-Nl$)p#4_m|YcHXl2DTu3tS^~+5tO)UZr|xo`6cyV!ib<iNuO9w
z$C(b8X~vXZ`pBsG;Wr|9=jwSg?QI8RjH9l|s<{!d{^@_vO_F1euJUC@ia%u=>S0in
z_kyQ;;a{~fez(YDQQp@{Tf%x?82WZ^=F}EB9mZx{$`46iA^2{lDswr0Ig^lnQpq=o
zMrE3SyfwPn3#J`&pIq;YJiA)^4?%0(feeov4A55ugZnCL`YYl&>E4#ZDvZYWAwu3&
z)@2v!c>$psLZ#ilDM)L=F~oD`TbH9teJUfIoZn&`-f!gw8aLr1@QAGOGMa_&!IY!~
zW@zgb*k!J(<&J=PFos%`suxU_Q^{|erPf{_BGI{7&-)G%JSZQw51L;T<<NbVDp}bU
z=Y_IsIu>s9MX6*gKPo3&dG<)kie2vu70sZ)rMhOsrP|-n<L4O!{^79XvN<94=FJhc
zzQO0kUO_1iz8r>mR%5)xT_FmLvcRV09Xui6AB&5UNIdO47RlEtz=}iY_rHZsd(W7#
zK~=F<;*2femmyVegwlLO_L<L@`|eYa$JSG{1AU-9y=siBR2>MW<Ut5Ebyv1#dowG6
z2sP!}I=p@rp<Zy_Y?_Kup!byoe5R4<KEK=daY~Ry66G)#;|QXtJWai*hc@%E%5&C`
zUt0aR;&F=4>0XUve>G2OMnEwwth1Q43UO#5i__a|Tkp3@{9bgP^Gt%mFVS-~2So}4
zrL2(|?zCf&jMmI*1ymf%jfJ{z+`LrqR#74EH`Y)eX$Y0d)j1nlnnK9!q6iAeUcu#Z
zm#9x<Z1mFlx?$%dLug#iJ?>FXc2fuJL$TA5Mtz9YSIBZg9o(B>X~G1<gXWmhydmYp
zY29;W!^H;8a`K0=@K{6DHc5r+piV4YHi%uD-)4G?6|D@(=99)Wl*|z(NmFIc9S(wU
zY-oPVp%?}A3$fTR9-t~URtGh+cuhE#^dtK8Bg(XH_5riE*80gU%CMpg)nJETq%3Ig
zx~DwX`UShwc>?pi*YZDiW5}`>kSv`4Dq!K}$uC$MRW<K}3+x{ZI1q4kDl^|*X0_26
zHEuB9BP<vwe}9H!$7~}zU$c0#mNX!AmUDP-Z0MWyXGj7%au)Nw?%G^WvI!c<-vBpF
zaE74-&u{N{llEA-Ix;-muTqFSUbtR$QziVE>Pv^4nXq;K()hOIyp#5Wk8&G=U#jJ|
z4V98*G|rh=L*u0D%sY(GJO^3VjB3J?YYwW2VdH9*7!uy!ek`wyc1nED(f13UT>{Uv
zsshKPNLJ|2b^o$`4ch%zl;&Iwqj^S?xq<bR1*4kzxaXrDNZtV#wkhK!<juuZ_xuC`
zhc-5GHV1+kNYwZ;7SQjoTk>5f8Zg6h?`iMkIL4!-DqMO|mKZ3hSSVL%nTGydk%UpJ
zRQqW1jUFr7+N?jjoNg9mpbv{T!!b?_x*eg3kdneEC?^{3ZDnSY77rMbCwL5?9#Dn8
zBD!-U9bJBZ^{ECWDb&w=)<B5lE6oBUohkb_oA0BNe}aXum_Za2VG|5bnz6!ERs9L&
zPy6;meDXOl3|w_u5tqN(c!3!wFPJsGIFS>=b$Y&PzWI=DGG}geLRsG2+K2ih>+nt?
z5CC7R3<3^enC;Rt{oyp*(J|^WzZ)YeJFviMj(?)*4SB{6c8#mA8|pTq<>j+Gop|Sx
ztW2CGTB9PkEGp60Xj6;rpuB6W@LcConlFlGzj-1T)h@*11^rkMDe>K)#yCZ>m5L(Q
zTSI9=)w+eh2ku6Rg$3%NAW;NDp@w|XTStk}uB{ZcF`m?CTTFRCYC30Xpx`t={4<x5
zhN`ssp+vPu_2gG_IL_&GW%$Ca;;&f|w66JonhJ^+Jd}28c+I;@`a$`cEHuAol<k~O
z%2}p=vzF!jo(h{<L_e?@w#}cLs!I8xH@qNFWfmYkEjiqke>cgUVj(`pClytqASzf~
z6c(RY;%iWtv)@MV2mhN>*DTk@T*Z0sQyzV6y*!$uwY<`B+e0DMZ=<yAYm;NG^QXk?
z*`{Zf(R<91iG4P&)<2(`ah=pgCRzq3_$-%=Oc~$c=krXFUCBxBgIUbNqv2t(U}uM<
zM^?)BstsGVqr3~IcQ_I3k;4D;OACT2^UvB;y#ku!9^Rxof!*dM9*2};d~tOJXW_nq
z&C@J~vgDUWc^ZjB=7rSnGA#1wo!^G27QSBn&@S*O`c~+usMMgQF?|{_8F|i6r810}
zUmeqh>i%t*KmV{WfvTF2CHpOxW|R&UGmChRpz5S4@<F1r!n8b^eZd{GhY3^7U7%@&
z^B#X*%rqDThcJB=(NbQRpqNy_MzteOpre1T%y(FW1gf`|$?{5c^!Ekert>C8j~_i|
zi&~8zS@yk}E1$9zt^;lsVj8Y@bB>nk0^u!J1fiVn5ho5PxIxWa(y>T-VMtIRW|rb;
zS|!1hEXZ04%0&8F=NgGStYn@1lz3;xMCOQUtXKx6*c`~=rTtvU^-fiUC+wUfPE?r5
z5L0)nUFp1y99nq@{!u{-6zr9Gk5(gWRLa&E@&f(}Q3c+A{Ib8n$ru#yt}XTic!V<C
z!$J&Ntoaz#D=U{-rox$dSdbpTN>~*%ly8(xQ({dch__dSvH0P$aeV#^$@$yEG{ZuV
z7z><8?H+blh`wacxkStVRI^c?Yc9lG_f5XKQZX+d8U;obVp8&b22Z0Cq08{2*^!Rj
zb1nU~4s()K(2Ul+`@MsgnLM=7CGo=J0^cX^tS{0kTFK-l3uW>4nkUD#8V}cAModc<
z?+7ZAr%o7!+ME}-GwOoKnWIBSKrEbaTgyk%Lm!NJN8CmE?4)u=<HK7MdKvAQ!ZfIs
z5~bdgc7AB32#*(Vwi<KGGhLWTvPs<6pP8Gl+`asiwSGG^e385+UDD5P7EEaIY1>SR
zW1(-%f;EaT$C9<#1^axHhvv@ZE!z6}`eBc0v={LtSp%abT>)pMx(U12=w=ii*3*m+
z1A?p+1ik__o7sW;!SF%b5cu#(611~t``a#~;LZ6q;DwS#7Nu_c;KY3W<+<H}+|_Z>
z4$JB8D$GjJQ74nhBk9T;O9InMbdv^78M8zl*Ot7c7Oi;V56n#W3e_^CX=$6WW}L!;
z+ReOmweX&;X#6u|i5LyIC%ch+;o>XiZMk1%oIIJj@m9#n3wde62timBi-+YmyXkcv
z5M0IISV^|$WGF6=$?qCH=-l^_TReU&n<tu&C}U%+CZ)`PochD1>&lfJ2<rzbo?DN$
z&sO-JEO>>47IU_)L{<{ri;h;{@J5H2@^jOrF)Nbd3`B(;kKrb9K8m2}*2y4!x73QV
zs;%pF5@x2Rft>Ek@|>WUU)b#sJIWjQV0`Tdb}`>dL|>xE1n-q2$x%sI>N#oyr*P|^
zz*0MW;MKgM*?y=tWQ?GXN5>Elqcx`CzK%mFHutPwNFsY%)@^D;Xuk4C+_U}u7MkY%
zez_=@Naw(G&^0*{e*x*-;~HFNr|y!QeIpfQ+*EXs`TN5j*mvOVv&@zzGFP^o7L?;!
zXZv#>v=mtLirSH2_Ped3g5HdoM#f7&^{;$}L2!-JWKkCi6zV(kx4->~)oVt+>4hjC
zw_H<0+a@}l%WRRp<uN=dwByCLik_s9#HqVBW9;Zq&oLH7qV1sSSBPa5XEq<uyG*5Y
z-g*zKtrygw_fx~2tGlkb9bLsBWJw$NoZQLB`Or}_|I82>!deD$D{-rKi9*%!eXKLW
zV}eATLgC`<nI^uH8eO#Iq_;HPGqVKvk3}9{*JDKTU%+=@ld(6!n+PH@I19q$Y}Ar|
z9$-oprE+7NorpFww11`uEf~i6pypIX!Z%(tgJUbobybrP<31)tx#L^pBPG>dy%cju
zUFqh;MBhYJ$BHHVi^X=Uqa^nSOCk5Tc5-zGHFmDfd!fs598G%KJCX6K1!SSA%H9II
z35U;GV2Yf@T|*J5h!s@<WC5D^KkqEH%f1->oS6KUf|QvnLSHvoP*?9gNwf<USe)~$
zn4KFlFTRMqKP5q(@bwZ+J^iYVU_}zDn7X{lEsswrMF?MM`=qJB&O_T&Ly6Nq^DBOX
zMs>;A+l0)^A392$BwE!iy9Ie~rx0-<n|*8c(?HH(7|4EmtHhvA5V?iJX3oqXq44y$
z`g8OMi=Ow%tOpkd*kDU?h*0gNIP=ElN>e$_hBz?=HItU`){xP};PMXaEV5q%v@H=r
z#wQLK6O#}->gZIbcE3;z>2czk+qATk6){!r6vZEkv^un~iKMGT(PO#{=eaH`Cx5eP
zgEs>CT~X1gviG&GXP|!yKndMyQD1)#VFpTE)sOpG{>MZ9c^jV)uaO2Yp(q!Q>>Ij6
z^)i$~rcD~k3J`zHy0||a6UZtnI%R^Ah~{&75aEoMAGir@?ckk`l12sLCuyF~KSS%R
z2R&XfHJdJOT$L@tU${s)?orAHb}+vui!y0aJXwcn_n>^DT34B0Fa3hPDfzwk5X=`8
z!{o20K5c&@eVRbbiT@^2G)<CR?P2plDrJ=2&=M(enE<}FR_0x&sBUber|j*gf}1ab
z?_}aY>9oHoF5fL>K2IZ!Teh0V9mLED!kaze<kFk+#@}?yz1K>pjWN4jv-hz(yklM4
zi)+uVWYB1Ynx5(~T-<}mK4hg!aZz?^He?nv2%YT`j;%_hc^Lj}^&1Pfc2KOwp3mV-
zyjE)HiV}Z+=1sSkdEo_S6DQjDuitMl3)!tmtnwX3Btyt)afPC*4pU_d?m{*`I-JB1
zi{S8_%J9t_cP0wjf5^;?OISqx!cn{ro3BY6L;c&<U$NxZ0J?m=AeD;PmWvS8`bKPr
zRcyR+FiT9DB<#Z>O3bgYAXq!~3>gJ2l4jGgI|dO%oesaY9+lcILs9ZXG5JR<1@0Rx
z-^y?|;RkTbg$r!DKl8^P;?%pvzGu;p-lqK9xAFs)M;o8sog1^=u%S`k-w;%@FCSgo
zfpn}nk0UjTPm7@Yf6u~wSicY7mNmN{dhEx)L-Vq2{5Cayg`S^wC?{wXC+gx7{l5aj
z!7Rgfhx=>2NtV|)(IPsVpoyXRfh)@(cUU^Sm4}KItDX<_^O%jdpRPDo5}aFRYf_Jg
zQ$Sq2vo{xObSD`1+!=bDDLLYF;ko4T=}7Wit7Ik+_>QZ8YHuyQQl4hM*xb9luWfz9
z>ef}9@HuS<^s829*~V^R)UIXj+7BgJ3NhSO8-hG}_*-*UDO;%r;fnAwFVb;c%lddD
zYghK>ex<Yv?qycjOy)9!QHZwhXcbm7wDxmhg3{ejrq(cX^wJe0!>oIm;5z{U>CeEU
z8=kk#oE-&7ze^#hsE!Hej_<7=-Rqqv?9t{?6`IIG=l0=%$9R!$%>|c_zwfx1lx6ns
zLWDvbAZOxB!p&gDg9ygVXU7WNY)pbqt176woc*y%kvGuwn*>8tf=*!>w26DR5g61X
z9IhYK`26aYE*ylh1}&eiiej*4c#8TymLO|CT+N8hqQ7&k5gS7&<#z8F$yP)7jDgbu
zIT|s**eGH^z@9+$Frzy?e7)g(CpJ<u&!>QmDQSvuBxb}BbPbI%ZQaZ_2TM$3fZAs+
z+!_0B<4aF^$nHF>01+veA#0}Ipr2~AUi4Zj4O$2my?$GX2{oiXe-KzUkl=@ftk0hV
zB<Lce>XxA)fCT&uzXW^<aI29LZsU*Zrb5#iRfcIJf^5^Jz^Rdf3}=Kgk^)k?+DM^z
zFU%88f_y~bxv$L=tb=@n;FI^~VSTVvyV`PqqA?iCf_zwbG>DNQe6ixkDvdgbpr9D&
z7b}efks$=&yDrWB`Qfn`R;MbBzN0{hz|UR0B)~AF16jW#LkPkLxz+fNNee}szN4QD
z4k$+U_6hfHmti(f2qG|oABazVNkRIX0)t_MWmIP}=m&t&Uwwhx)kX|Od-*RepfO%?
z1^kO^3y1(<f_!XV0SdsA0eO+T_>mzPUK2#%*@4>Wc6p;f{Q0+;UfNAJ-BT%IJ~-fz
zNb`)+K&}VC{06>;&J;ZX%N1y{pNt`lKm|$OK+(Q|;u<eQ2WJ3UNR~%~9Ds!aVdYvQ
zNCbt*V4VR#6@tgpUj;Bj9--m?`+L6IO&c#m2_2}^y0~0rfh_k-%-0%GIzx2NzVb?@
z%*U*Cx4DAjT9(z?>oyCUq14`>=?R<`L4flZ>7~6VG7HyAhDy75)a|SwXT%Atzn|Os
zU9ms6#pzfdrd47P_aD)1UdOe=nd&;2+nAd0eu7@w(<1{+Nm1Bjm{QuVv;5e3>F&w6
zpkwC*$3(h^uiro}>Cd~zq${bGY{dZ4v~hPOVSLoPqrJFLKd>U-#+r1>*rpTLsdeVN
z#W?0@s0@_l%d)=LfSe@E(YZ)Sty+32_rBdGGFDo8QhuViTiVxoVu{Q3!Z5Ye&*_a(
zXuLje>Anf#JGh7*ttZ9!P2tFO`b2bq0=F;+t0xyA7XUQw&PSbyakNH~N)!YQVl2ap
zu9Cmf&a+j>_?>a$AED{H{wqa9d-I4L<ZW%_uYxQ128tE@r9+HJIHOUbBY-Xiqb~#d
zD_2lPFh+U*%8tdqvUByX>;Q5A2=Zt6qT_#rNPaZ-oi7$vSKAyQf<Zn+P^iFYfzc-l
z@(}~hhyXIJyHW}CJRm*!K=%?u`C<J!oQDO&iigBH5bktDCg=DE0}4Go%70-HegiM{
z2Hr7K4;Z0<ybuBfJHHGyZJ_?_FCsniT0KB;UI2fF|D><`7cdbNIRF@tX94&S0Pw3M
zpZ+7-e!#`Runz(Qz2F5ShI$Va3k>@pF!51G<j6M=;;)0qpPo{PQV0-L5?!KyP&K6t
zuTBb@|6FGKO!2**vaXyKdp{EC-5-*)fQBZ*z3-W5?ec~_4PT3X@{+~>)Wq7eb<BhN
zAp<En9@LCqUQ2pq*|i)t2SRb<(zg;l7!GR2E@vaXGVWRqnM*=(W74-0IWX$d{+}RK
z^uXoi(534&1_Y*EsUrU!Kpk)(%<U(sYiX(4lc@dx4iV=J#)EZfe?VN}K_8Uw2-9Qw
zgSjC>T>X0<{_puSXumSe@>;F=`<er(n&?y2w4VkZs*dDIgUMX^vNC&7NP~YElX~uo
z2=_ZHnC9h;W%jb7?shsW>W7kdI{)J*By&MbaYs*a_Y2LVFPL{zn9w#8iFX`2ZO2#k
zqMhPy70u%$nD<7Q&^;50a~wKl$5-Y;fZ{Iw3!$l^DCam-=z>@l<3!$1<^qz?#Gova
z^}Im#0^%_Bpe)q&JYV(#qA;AB3#Oz`7Ave{lJLa@qhDaxx>1vg>R4=~Tu*<A7X}5(
zx-{RiCC%DHN`Y{xhZD`^l;XdtwC=7y;Zn;|HJ&AwH04m2?hcqW{GX`n5iWJ7jX`!$
zL5X%>_wLhdKM$c&aCM=t2K{j#L_*7e+r4ynt+wi|WDfq&ht$)|-fg!>kHicIw`T&E
z<7a~<WsHaQAhx*WuEWv04{wN@ts|yd<~Nl$nirpmy(b5F4N42%r2REn@{AljSp@u%
z(j-D3X?Ukiwc;cl>J|T2FuE^~op$_Z#yt>H2YI{n*h{G^ei}NgVSk+^_^Dcjii3KQ
zY)O0uzs8W_^Y^8m`z1Pa&5zeA1CLfrTTces9>q?YhE|NXc2*M_m7FrmJb`R#)b}CH
z{XZV&V@6YJoTtt;Z#AhK@dgGnn*KX@P*vfTl;9Nnaok&a>_n->IkE!}Vrg&<zrYV0
zm?~|!z2~S^aXA0nG&xGc19}U6E*qx6kz=4v>Sl$<2Uffrv2yU_8-6u?VDXz#L%YfI
z=a>=FcKWi(54(l^9yQ7h91hb>!_`mGWYK8hwz$)_$^*={Q+?xYYLtkSy%<}p1zSam
zzHlsca(L`;pAl%MRs|WYjV0oKP>H^?na_`{l+TIC5($GE5&YccPqJR2Kx2}Pj0qbw
zC{vy64_guuB_acyyM@ABSzUi@Q_Fvim;(1Rv$jE?9YIWv`DR^?K+B4l>|cREThrb>
z0Ni<URUbz)gpi$j`XvI7knA4`g=uPy!ey;o(C&|`$qwXRhr+b9*2Df6l;`SSn8*mp
z&@rfOk*MhvXn^K@6Zsx2BIWBGBMSZi%mASAg5Svfej^4bHf0!JMn6ViI`1HbB49YF
zd7&Ar$Pk!-wt3ZEGJqaZ?P?=|nt4@XfbIg+qn`jgyuPmai`E4u-(W!fKr#T@>o=e{
zNuffp%3hT&puJvL!V4+ryLy>%^}%11<i-Peun@KY_U=3*3Yaezm@fe9f2Iq_Hh!LD
zDzw*<U&soe9)YP?6ut>ikJhhb<#_&P_DmhY?Gg<ku*zCjZNAGzaJF&<^B}ZngzO9s
zTFA_vB+agmw-F7w5))Oem^joEy7h;w?X^RDu7eiJJ+;2q=Y!IqNA&Vmk}H+2ryp~C
zR$a@tWeta6x}-QVBWrhTPJ#Q<bG(y!QmO_XDaJVWsezGvPq{~g;ib=1+La091=4&V
z_QBMoY}I!wFjI$d94n`Lqoe~jSBKD0rjdsm89f1i;`i7xS8pkJ(+&mqLE9tEA43V5
z&S`#)f~9X_K3dUx&U>P0WwqR+cR_cR#tvU4#<7{f7}kJ(QWo`_$)#k?`j7ZM+Gbc3
zhc+<PRAfI}c1K<eSq~mnTC%u8UOY8fIt-hoxBC(G51w^XjU@Fke7cM4`g$ezJvh=H
z&PI9K1W!EA_xRH--3|iq9nwLQzDH^YEgwJXU)FC?OZYp`#p=M{sSvHfl5soj5f-~e
zrdCo1-pycwIxFed1v@ZZhaP7gh3&||_YMv88qqi7yn4-_^itVvJc^RUhSE+4TMw9*
zB^bR}_TOgmDp*^|)FzV)Ek{7ORwf?Rkr}(L3^5~KmD|!d1um#*3r=;8e_gtobvv<q
zHDI_H43sgmn(w76UKEf?1vpYIPe4r5B#7N$0$n)#<hbR)rfA=moX+Ize+Bi&t`}w}
zp!_OrP^wh({x|_>6Kh(h@TvW@Q;TBepth60xqY$G_1%wq$8{vB@H)?ap`%?<?cAf0
z&B^Apj`_pjV@A`%BBxZ|KW;|jJs%{vZ9|I(yY78qL`zP4lwrWIqxg+UaRAn0Y8b;n
zX#fyE<UX-C38BEiA^wM~{uS_7$_&iL|3ei3t_p_b_YYMdR{Mv!qtMGiXc=V!xxuh@
z+BIX|0r`bb{-L1!FRWJxARpma09~*HB7s=IkgI>?C!gWX_vRV(P#}I{sZPG|5`ZPV
z1I8IJ?2sWk{~d6eFC!3OyD~rmKw!GOrC$?}Az*<77zUy)?>ZAM7zA~6?6fzp;|vVz
z2Ihs%#0KyDV{QN`Z~ms}{$oM_U`U~sUx_|ISzdV4E3Slpaqawz>j;Rvm<d?3F93n@
z|B_b#9#93Zhyge+wR@#jKvsbl60-?3=^LnqPC7<_*5Ugt6Tbb&G-=~cDWgII@&|wY
z2L@zY+uOf1kmyA*y=a|RJK?p8FLuJeDgh5LWZFD3JOBBum#(HTvu3X8Iot+a$g>gZ
z9HlTjR*8()mibLpqPt31PFk_vc-4_ukS9zM1x@BvTo=ykU^lTvnHTNDKIybSQ{Q;K
zeJ)*nMt^Ai{;YEHoWRu2ewbjW%(sk?W|(LaS>I^zEM@87=#`u?-TtNX)4I8QSU7Z+
z$8$^zDRXnCt82Zc%=1|f{{4I}W3+L;+9X6Y(h8^3xk`D?HUk^QrUeZsjc_(T^8D$e
zQ>-k5BjLHdVCxf(FHe&U5AIy>HMAaLsht6}p8&QXHXs8T+wVS$j6(ew5@9y?*ZnnK
z>GMja$uGDw{;KkKf`I)+^h#cV4$lKRJn0QY(!c#Z_ium8iO7inx*TX$sK3pM6-^wS
z0dQ)daf5tnUukC`R^1#h6A-^xI{-KDAb|qx!IqaPK^Fx=@?Y^YaC<R`zGI0U%rg?d
zP-&8X#n0m(d3>=XUyan4=|oreA0st>^B)YtZEeE;jRB0F{vTfdqV3&*g4a+WfN=p#
z5^Km1fc(8y510Y6fRbNr)aqBjfQ|YB_|--Q0ROd7UneR+3W3IJ4+0~FGJnPEhb0FT
z`znQGJRkuvaCkDXS8J~$9X<mdFeHP#ef~jpf&tZ&>pzFlYz5F_yD!!TT8uLv2vLVV
z^CCF7@J+o1cy)GPh{L!lriU0kW<CAX)`1-6`xKbi%zsGp(mzbv@r6nMOPc?SNe>1!
zhs^yG@PyBuzZ{+iy~coGGKeSizXOChJDjp@X5H|Ydw*?9-SFnYNP+p2$*wzU(?;;~
z1twP6HvRvc@BDk7#ETzh5Zw(F(`+?3Vkn6nep$~x6KG@t@Z<WZyUpLcw`JzEm8M0b
zcjdgFxT0u`{`}_U%n#@Nlr%UL%=@3ezl_-~6NzIyFnQ-Mo&HbK{2yF89nE7bn0H5*
z&^{9h=Q2XX;WwJaSY9YI6=`ULSQgbpUNAcqNtkO;7S4K}KRXq17-vux?0TM$EMK5t
z)Uf}&nKy4di`u>I?47!enSL|Bx)@!D?P+Dp^fgReO{r{wM2F*|`MN}g=j>zHEJbfa
z3H%Rg-}Qm?I!4O>h^F3O_VeTu)6RVD@ns3u>Dk!#xj<tZ8H<}hsy+CwQ%0Eq!kdV)
zeNegP64E=IuJv+0KiOM(-VZ$XygN-h_Ec|qIGZM1egLuk)cU*h?n<Un8qHD#_KKT!
z#?A5=Twh(QDs1EALra}{&6nguCKhdv>lLr3wLv-^kH@22uczBbQ0v2}>|pD|<zp+Y
zjz{%Z-1UL5NIMp*)nS{|=Rh_jfhaM3<RSb%Q<xFXfCrdHHu@rlpbvdXeT0MO4OvoG
zr-@;X;RswU^n6#*XNL?8gb3km{X=)i6yTFN1h@DVoE0BcceFffBBDuxqW1$qH8KtK
z7JCNjtzgZh=!OTEMQ{o+1WXgfK4d$*>5^2zt`5Ko-Gv4xliq?bkrc$`*0^@As@u@V
zvAM^k@r<WH>>CBjG=%b8>F@kUilG9n{z_1>Q!?zCYp5Hd>5E*Yy+g8{jMTIuh+v6d
z80dvV)I@`Pv=`h0JSVNM5!!aS(>AOgth46C3wJ(Zg?zgqf|`TRIu48_)b6wn-)$;n
zA9GA$EFB`*`?12uo5&E9UVeXag9Y7YGpwm@A;CMpHc_5|Te-%UM5h4pNVYLE1S`Cl
zEgBclLzEFffGZIGwS!-2a#`9ekp*@(+c;f1E^s%wLxiWe!1#+fIcQS(^HSL(JhII+
zPN@Vt0}d0Dou-7-Sx^E?f=oz$Xc9Fnkxe2Rh>u6-<hgxGcZf|$1~YvgmJKw&*ktB5
z;C^R_c>{0jjJGLPXk#vAN}p6}r4*gYu(R(kRAL=Y&>D~tjEjI6MHohh5yCfgVb_c3
zcsDqe+?tB;J%5rOWIY<NV!t|CG;8DVL#Law#<>^KkmlJ2SN56k^KQY}|L@XOCi?$(
zOIKOh7&!iG<*JrODPC=aXPVA<cq3d8uvK@{o9}P-#m@e;gQ33bvrC^Fp$$u^o`JgB
zru*TsHp`=suxn?3AZAIyj#J_CxYtoYl5_|@d$qC(&Btx`3)r4CTYd0kEpSqnf@;1W
znX;;tm%W4-;Xu;*WA@rcZEovB@5#n)E*cl?L?W(ND0*51qz=9buvA_ABht<Fs1DM0
z0%0p3&vRnn@$>b?17GLKdiS~2(bI|RN#|f(srE|B0J0gPP$c)StLLTuTV>3rZ<Qu5
zmo(r0Il6cVf4(_g8YT3)JvpCXmX>aH^>Tfxfp14TZsi&eLO?J=mi2Ug?%egiw!gM@
zeqNy<5mhupr@4Hx^5u=V5>6H?X35?1G1&myE~jxUx}nfc?VFH{Q2*JrC0?`<wfY@3
zpN-s(?l+4>De<!F$@E;blUn0-hSS;1fhV@=5a;8f1}=20)(mvEX4;dGYp{{i^Vv7o
zRfpK2*$j8NYh^mt0akiPI(@;bZwXQ-%aaI8MeO8E*ynWGw4p`Lvi5LvOV~;WHVGER
z{3G3O;Gq}IgpWNU4$GFCYV8I2Q-~lw$Jr-WC+`NRQY^JGB56vz7yKf5C~gy>|Bk;V
zIK4aKh6=pQg9V{!6ZsL_Ds@XCd2EPxQ|`u9$f`JXa0@nyKo64)Hru`vFQi<iNnNvG
zh$Gc>V8=Z+-U_Q=+K0uTvswps3vWMGI#V)QGT&tH$~~{KvBvdR0xzE8JFT~!ttr^E
zY~&B;vz<4c+RIpK_3A}Z(~YYMSZbV2iE0gGSEzS&`9mAd7iYLus4Uf_;4z=rc@q;D
zXBBU$oJ(`ioesb-g|fa6W4XCZ?4_&YV;#mnkj(2&KMwRB7;JA!Emdmp4nxPvFCYL;
zgg0*0xlJi&*|z;YB}fidqq42){?=->OGKpdds}}v`i<0(r)tbkB^eSW2(Uy@=kDv)
zVR4d;w`aJOy$2B@adl*A7*sGK3SnAywIyLVz>9~K9?5&QT{}M=6~UJN`LNj#5o0=W
zgG4V>#IpG3oJ*2%i1#XyS=mKlkEW;k)VWz9I7z}0)n`-i{g3)leOni+_ZxB;^Xcn(
z6{3B`(}U|fOJob9>{s$;0|C`#2~(8>s#rayMfI>^k#8gGIggC_&`2jsmWoxC6R!fY
zU0B|gOXW^ictd{H3Nx5ko$XYrsn?A6Wz0PlSJllfuH>`x20612CWL!|H77OYPTz$j
z)+!pTJ+U<BK9X3_q0YxI7MPXT2HW;STNN#+cCxBSSyDl%-4D&X4a8yFDM5&SSYBbI
zs<dmPg0dPrCbwZQllnQHbe+qW@&vq|!rW6-DNEaj-1JqI^P4qW97ei!U`ZC#0+D-j
z!Q)yW8p2&GpBGOEpKDOVZI#vY{=E*bXCr$RBS+Oja!<ZOB!hgjlVSS@owN5jNVE~7
z%ad&%*wgaQesQqNv~*!;mkJnSJ=c_%Fx|yx<q}5`da{d0U+rsqag=au$Id9y@{&t)
zq@j%yF>w4aD%uyMBt{~XNu(w##_s*BWj9QPlVRo}Z#UL-Kq*H_Q@R<czI2d@Bp+Cm
zlRqU<teZKIvDJ<0GBoINAS{%oc&6A0Wl3tuu&Amo&O&4`D9I~FK=v(n@mn<U_Ly;F
z^q^iMTUA^qv)c~GIrDw_wrNO0?|i2sqikg$$2R*T4p`DyzfHlUz>v*1?6DCWoX$YB
zu@9p77HeRXxh@vUp(PEwj1!!L)?PoB*@Q`=C%He%r1O+0F_aXBu_y$8(G5z>75+(&
zR+9ZCPQ`9!F#?H`GqJZD&O1*{z&8%2#`rGT9jw9{zdz2$T~l<u1}Aj&nu4;n45F&G
zO!^q>1`evunncQQO*P)u#G=hO0<6tCA_kGQ@4cK+1aCUQtzPUZQf})$RQwTS-8##R
zvcL19GH8?KG}pQBnfN*I!Atz?xda=1*!(nMU%$&xxtz`1|9sfDpY>}-yd2b0490PD
zc%dr1iA_dcOeElZe828e$p5GAcb9snTJjgXm`JolTfG8-U`Y|^qv7|~eM90SY<IS}
z;29b4Ju6WO(%c`Vam0BR_vyA;1T&1j%41g<65(afIdl9*4`tCv;QhP`HLSQx3281Q
zuJ~)t#E^bCl$UI@?MGsMg&L%@GLv0SmrM6@Vlj9cDU9IY)SG1QuDoDAs<ErWk8+>t
zf{0k_`=}g|^h1SGwg|VYcHSlP=Dqj(HqHyPmzneHP5SsR)t^T~-)SW(#v4B>q$=+E
zh3Mv^bVwBbNi^?m*j0On)*PUx7rk*CBF3I3a-hk!pm_Ve@&<<TBg6;7I^X&C>X|v^
zTnC{aeZvL$NsyQ?qEIiRU@zNXR9*D2ccAME!%fzNu&z4F=mm5wyfY=iyl1wuH{deg
zMyvitrWEm96~&Sb#9*&#%Xr)JiRPp*QErp6)(&0+jw+}BK)eNmu){&f6jr97$y)sK
z6K`KZr-W`0^r*n%z?UhxWxt&+{{d|ytKh=h`heUY8H$M(<v6}K8bb}-JVD6{4c$fi
z#A4YW4jk@PdeY~11b;9rP|l<;%OER{gm#zen<;F>Oy8orT`d}4Ifc{PTj}fy!l4-w
zM8fk`5pKv|Tk8C>L1ZX`fXC8)V>H3DTp~r(QnnL$#P6gvp><dyN#F8j;5XNCx>Q5j
zO3XVEtOmy22;UMZ<`Vi|%n8n>Ux^|#7ISt6`KFqua~3!;cF{`C#G&d<hCy^>j@kIe
ze&V?`pXmFkT7E5nN9JAJ2>v*?1&zyCNK0gttiydA`RPodiK9}FqwY>TyyjmOMtdQ@
z6n<DtgGlEH;@RMBI}*5du~)%0Sxh+#lXhC>3iufpu6u3GPa%nfYk!tsB4uZ<hp({{
zGKRYkUwQE(c{&hUYHl0sU?Ddod8vJuaZEr{*a!^wLxI9uztSixcv^1qDrd1r;>*A(
zuNL`d+_&#Js+LAac@pa;`>3Kql?Zh8PwAmaSoMOGkimBlWa!VJ*oWZId`y-S5Spwv
zB~Rvj0^4h$9RvB_{D6W)Xh0Tl&X7zJA^bxryZ}kuuqx=L)sbPP2t_|u!m2By)!O#(
z1szOT%M2_}s~HST4h_7zVFc3EajT$9#sHb5*Z{d%3K|(lqfGk}v<q%<Kz2~MyV(=$
zG_r$5gEv)v&=gPxq2q|^lAb}RR7%(bBb-JxbzpaxLZsv1d8F_b_&-F`v|)Ykt=^o!
z{IEy?ixGkdeEVC-<m!ZellVUHfUx5EcJRpx&0SMXLv-^rh@01FGXhFwn$PxQ9D8bJ
zSI9`Se84B65YJW4=EbxHYQK$@G39Ot#G+u(LTicPhs*2&Z3j6lqe0;Y89@q7n3cI@
zS=@RJ_E`J(k+3ZV9IZIV&82>#%``{!^<JDF8cIPz-$6*`B21S){acMj6R~g#3aa1+
zR9RRi$iamrKW4Yf-M&X9y4s>h;w46lx%>(#E_`kf#F#4|i0xYMQ=vUK(`%fCOiFUx
zmx^LD_hFeI(tLmAWO=DKx~Q2c&D5qzQ^fm~x3yJCgsjK+QGE|A(nO-xh$9}SYbFJQ
zhoCJ}XPB5qmSDO}9Leo_?5>IaXJ)f}vyK9*0}64fl3*?AZ%#7n-_#_@ccqxV@exa5
zFb6-HjZJAsI*u-i%vOE+bXmV*%W5X&ZfDE^3VO(q(#MwWdX8MI1U;51`DbfdmT72W
z^*k3MFg!oqJhDiihD>D+G0J`QiJB@liJHnOt<{JDr5~|UnR6@@8ynEyg!J<MKr7(r
zk)$J7ZYnummNM;1;zqF9<iM!cTdU4DTCV^tdwLr$SsZ{^V)v~H%8U$QhR;j$t7u3<
zp=-Wcg+K%oF0?8g@8RZsMc!SyFkVBby+q*Cc7K+eDJ8_ouCe;Kto`YWgJyOxJ32)N
z!#;ygruiabAC&%wUvv#o+Vk1(ZLxwRtk*rJ&3Wi4fF~yh2a(7o!!1)+kGsdk8)-75
z-=l^O)B;Rs10<Bntr?=_GfRcsXrm?ZX=^TIKTajbnrtLMdsr2GrUvn94>nnqKh8Vd
zZEr2}T<&MMIgy*xBterC*Wpz5ba;@*`CnKN>u-N%mOB1Pok?p#n86<E$Qrr<Z9^<~
zksA1uMyr=&jK4tz=K<@87Gjt9ZOL6^u`zk1A`4TT*q2P>Sky`p6Feh2*T+8SVjXu&
zVi$@`OwsaKDJ672V`aqm7Xu$DB76hJl(H!JX8+&_yRbG!H;sx*LZw9!w9v|6YGK=p
zQ)mCu_TP=?_{N=7Fql6xH}JuN{;R<Fk$QV#rmXn6ApFNGLPD9s+-4E0>{@QeS<x}7
z@XqfM>pS-$IWAZA`xtMDCV(|%80;p$Fjx7KXEt}31v`eP@B|A{wB!$Qun9#l#eVpq
z=g-H;Wl3elyBT7Vx+U~5goUQa)*mulazMuM#3dT>ERE4_;^lHd2+6chNB#09%2$u!
zp2#-<b^*R;aLa+^7|m4SCc14Jj8v0QM_Fi$m!xfgn=w7o($y-5LtWyM74B9stk|<f
zILJQNcj(_%tvV9C*vtHlXa5Wy-^kf5Eh}!HsUpfEClw-G8YU))4d*ysFk%;cxGG8E
zW;1zN!S5gq54>gjC6}XW+!XQAA<@ihaE^0a4;5}&uOVem-AlkY!?m{*4L{;Y(W*+l
z58MzM7JSKP;n8FRlM);~gJb8nLkoetnE}B!Lf#=5V-DFC(g`x-_I$nE#&npkLL5xr
zS3XXV)u0u8DLwn~TjG$D3S!gS|8u&sNv;wS^-Pi|1a||x+uEOLNS|ZOPYurYJ_(B3
zuo}^9$Q`r^aKjkY&6!ql*D<I&iC|ORO~&?|wdlEKcydCOmVzEEbgF%u>8EmVv_DW{
zw(8U~gM4bV3RgeV(G4VuWIWwNlr+p?^RpgrVDSud%FCt1l$|k0Y2!_VC81ELcw95*
z-Y*iYbwN2=m?>FIDwUZ%Yv*IHR6a<8u0i-`^R0B%D~BM$jD==mGs1gNvxcDvVuw3u
za+qPC&KOCrKHzHMR%YA9p3dd6B8uicd1p_v;%XJVVvIQq#|h2216=FlHk`eIBMw2i
zHe8DR;f>~oWVp-qj%$bz-7Jm)p1=m~omDW-23GOeC{+)NL#xoYRfiB#37hWy=FUPa
zQFyhuOuSi!u)aO@a5`OW^ZRm!u;qzk_8x|cC4Vev1xGTDNwpB6Zwu%fJ2dzVVWd4a
zUF>04y(k;(`go!t8$mYQHX)>x)U-B1o<e&Nq<EWAlVu`e;yfw!TH49CSov+W;p`#2
za~B!ZEJ5EBGuV<_%95jGore|<HU^!Rod_-29>-;!0_J(EOh%3^35tc!AOl^OkGM@Q
zx*_{hXM{|YXK8a5JeQo}G$rh-6(=^{bvJhS54Qc@kJ+If!EyhXyywt*WUJ6>aBbi9
z@ZF7yOy*+Npm{PoqmzRtdGdb+xsEb+HrcHd;=2*crhV<=QrYkaS=6iPo)UCM&-=sA
z7fVBQJ?C?Wwh7uPF6wU2VW*bI_dmVR`L~R}Ygb#vOluCM`*CbO9>>w?drBvN2p1qn
z)K)TWC7(9Go8}&n=kC?eCSyclqZ6(>18)nv&L99RVG4H-vu9$g^J*d{<!g<BA<WWW
zyi2zUkH6-&wT8O;g)zlbS2eELB9ce=`mf2_OXrU0r+mRXY*taBAK3!fccR47dcn{o
zk~QCP<muo}agHw1Mx14~6J4%J1ciAN99n*;jxCglw4IK#(>I-u&>YsBikohPyR`dt
z9S8Cp1B>}d^QcYgopS10#^Tzm#-}YN?jn(r@exYZR2Ke3Us4qL1O}Wypp6v984@g<
zXcYyL`@6R+D&!`PW<Kv}8}Rj+y2TCQ@MZ~;9TUBtoI!h)srQh~bRG0d7LzWXJC|?V
zj+jASc>2#Q&^g<d0esh@L_;`#lx**<Jm(Jgk6YF^!OlS*=#vzisb0g@*-iCQ6kH*<
zJzs-KxKG|Fb#Mt?GHGGD_!T7$*w(Gd52L4a9GOkn2fO-d^B?u!26&GZd?eXO%<Bk`
z1XqkfwRG-2RZl+c?_g)R{}_T6Wu=FA>IuIwHM&8I4)Y6=u!4GikTV3$9flTKHi=%Q
zcoWtli@loMLx-g#i@kZbSH#9uvUQtsq|YfXlRf*_xy8y^`IqGEY|<Zg!Zu-)BPiV*
zne3wPw}aO4z9i>{tt;ACuf3y*Bj%+KQkby!kqGI(G|&vVuUmohY(t5BWQbmwc$+($
z23tVKpzDnkc^VP%$dE1Tw0rYZiO>4Ib$KZ_%^U7|Mcxu=0G@jl1)Whp$+@Hp9$C8R
zJeU-Hqc;lJ3Sn=EvDupC!%?o^4vsY+dJ@`4J^UWdCYl;D?x_fP2X%cVa~ZKNPCtjQ
z8s;)x;0~GmDY2^P8mKQ1?KNw=|GfIz=&gRzyz3$&f+Dv1IUMYb1=&S3Rx_6jxH^y_
zA}z{4_`G<}W-ZD&{(20SF*H!U!BpCGrHXz?zvGDocYxV{$xrFs{vfbWE)xM<0)}M`
z1>e(EFqho-Zl8W;?X?uLE}|`<ln7*BKP<8Z4B+i!EMR$11ppS=Hwde%frgcWL?0Q&
zw-2N*`MON#94Hm=aiKuu0GFX4`vTDBft$a$xfEZ(zbqj_eg*&H$p*mxb@WZv%teo-
z_-4!GdAG;E)Ye-7zy`#U&_4XzJa2q|f%!6&Q?XLm{@XkNJYp#En(kQ0mo-aMz%5^0
zFCDLFf`SBwK>BthBv2>}K~(_KS7)G+hPgNq6c_`H1JJxcvk^i0)V^E~tRZ@->8mS5
z7`W`O=l`XqZy*Z(LP1qTo6#%kd?}nh9ULnpSgD-j3&{*|k<iO+AfTdO;Q>tpQHA#I
zP*{*FVoZkY|Es7l6H2kLAT>&;a23k9urM47f^am;dzLE1*88}Xk{ES7(MQG4L^CHw
z8M~J7mnySP21AWSQPlZI+)urVOz8ccm2k595qJ)8j*dJEd9>Y%)f)$wAo$w4RGmFU
zbF^R6h@XCD32O^A*Egu<@!CUQ2}<@N9+X449kdZ}mHkIlwhBUWa`%=Jy@i9<qv?!+
zji*NC$QQmms1u2icXiADJbQa-rF*V5$-&$i2RBvLK{S1eercWVLzTvZ0*vcVugnv*
z<dVbd4d}4`T@0}0HA41CI2_6@>IaB@GYXv2PTU8GsJcA$)hGGN@TL|o)9vfMNt#7R
zPcHp*^^{G=>&+}n(E|j0#HF>d{}u3@9tM>gQ=Hr}wwu|o;f&Fr8BJ}>zB6(bL3Otv
zgqG{<p<pRnEmdbXN$|k2YN_YqdEVgjbiY3D)!}{MZgM_-NNVJ3BA7Ti+bW!O+W3^M
zM@NdSoa+YNKRrr_bo1@hH5w_XpsScP&no;aPpLhPmo3Ck$rz4aT&kg3)>uIfohE*|
z!CTR{KYzZL^p228-SvmILkhP2co~c1Gzo#)oQ5>Q*;0{s7S)PJ_Tva-sd;>!^NBme
z^!V7t_2)U>$^5x=3(Q9C$sbs}Z#27izoc%4IB<m)g1gtJR$!Lw=QBOKc?*u8U<wYm
z;ms_GHSrEC&otHze5w+0W?g+AisJak5GdEuA&-5S%!mg2N(7dAqW%=o;9L7&rncUv
zwLaYd53NgiA07sEj#s?yz4(xxua+KLk?3>~3yf-)R-{*)fTz{bDT=hW6BM*Hi&myp
z6j;8}*i)eHOz+>4I$`}J%V}@XLGHG1V>Q2U=segTSxE8WU+`JM<oBzMxQ<zyD+#@Q
z-V=0-y*<6R@o&EGU1`z6nB}G^v7qKsnV4)oG$}cxWM_$@FcY!qhsM!Y-XPn}_&5xw
zC^QHs&^kfNVWQ$U1vRBft342p3pcAQ|80ipYoaLQH0`05LBARw)bBqdAB|^v0ghys
zZA{Zo8{4NqfJvyKjlxruuSOiLtWsQq(;2^OH_=coty{#^^=Ts<iQ<&|scAMX%#7AR
zU7`LaJ{|jX{3F`?16iie8yOy|iAv5q?x*X(6TZUWZ<ZH_(W~IWe?Am2Ng;3!4<=l|
z(0dovvsmj9i4KB(NxS3Z7bs1L?cbxt7X4O;1Jfwlv`wPE(DDT*Qdl{sG?Rn;+BUya
zsCoFCb*QnRU5wd>m2}GTyCRMw5evM85rVT(9Ekdvf=t>-1@x|4hI_ccb+tO8ChUQ1
zWAq-aqC*o^&DauIweUKGn>`%G#UT~e)*+4g>=_<updX%8LJ=Cz$ch|cU`MLsbE0VL
zrlaH{eLGy@syKeJB)Rj@e7;+r0d4gyUKG!fNodmh^$ClRUm?(*r&1xr(@9O>TTQ1E
zjwgtpmYSRdScb=!jPLC?F6)2l!8_aysM^#^G#}|K>a%5RnSfP+YLc&hb{P>?K-HGu
zmgOiIB{iw6E#pLb)b16?s!<NPMaM1~<Bl1JE)it!da8yPoE0gxlgF^Y*_FkH8kENb
zr@f2fF#9=q-M|=2b{OkCxxX+f-T2wKR5_uA)kfPhG7hw~)0}AEO82!FrifNs!`%E7
z9+&4Jbp6110CaIMAnx6w@)W!~eskNsuF2BYw0S;<Y6HTZd9!_H*rHB1lX#-Ex$D1Z
zCmZ*$#d}8~#Il#SfBy`zk)SI4|HlpWAK&vb&?BN{houvgCZdzEvbE4N=jDC5z)Jrc
zEECiJ@m2{55HY~g0hxhNN{EOa2qj)a6(R;&Mvm7%7FarIDI#WAIt2kDds_#i|C>^o
z|4*s^PusUJGchvJ|ECk|pczy`CTaWOs-=~L@B<k3p`#Nt4EWOU&kG_jrX}xG=xkyZ
zLG%yuc>HN}pP0fIBO=z+l$M|qE!Tc^>17|nz#$>E#wXEe)Rc!jq-iu(gFLt%4kSS7
z40nfvwc%cm=>$nj@$Ana=csnis2LZ#YY<?Pgg;+;)jbaOwtDu7nCF)~DX}f*pZ}tP
zU#K}EsNL`aROYg_|MS%-Ve74E{p0!b<7v`!gq7DhTkCC_*E8SaQt{H$m6g}EQ|t2%
z8!oG*r41?fQyOng>@~p?Ts2+C%cd5s&p=k-x~=DjIKGGb*2h`8=O;O7h0Eioo6{t(
z9X88azNblOrP(nABs`n@joR>5)6l0QD=V)DKHebKOoo890=_3JwukOBx|)Pgh7Lln
zuN61GeI<n;tfh-n%*V$kOa$%^yw4LVUgaw@Itv&#@u6P)pbAqnqpQXTNpl1*<lBf?
z8mn70oE!(qw8v+N@YxmG=QE^2BwY*Mw39&38()v@q{l}>m8_8PtRc(aNgG=t{}%v!
zK!d+OjW%!MbF@kIoNv*?JU$1T{r%@KWDY%iAJ4z^O-VZ++BdsYw-%-^!zMQ2F}nNt
ztLf$xy$?P2bZk9X+mGDv`|BH4Et;R0H)}dVzyD<Y?Lz(!voFZnFyr&*m5oh}jxTMC
zJ67+o?7r2@$?D0=CjH&w2|wGdtAVk6=Y^uxS6E%X_&DqKEW2p+hgDB3AH5o>>yPl$
zoyT<98>^4AoIA%MEV)5nytBBSpYZp8{AjtR{KtR1)j!tzpBz`Fv09mU_|}Gm9apHw
zH;K+1{Ia&c_ShUg7hSoU#gB#c&)(?uhn8RwIlkiJleK@?-+cIx!%&I&em+D(4}Tax
zxjrt}mgNo0)$4uNzQ{@E_7{zV`{Aqp?t3rSJ4NXDfhqN~>)P_|Xz_vmoT>I>yTwl~
z{_EabJz=@y{rzeZt-ix@*Iw?n)UF5kPi_nALAmOUU+lwut{gwS6xt6hg)q{r?@Qo5
zke!8|Ow!d7I6u<s^qS+~H-GrQ{?otw&ENdyw_pDKzy7DMfBet?&%fXPyMOvG|NZT6
z|MrHqy)L%DuaAg#IvBjMNpR~gqv@hSzuV1SZ_;{y9hm1Qnm@kmFR?KDkJ-kyjpl5}
z-v6sHYghZl&l<IVg7NZ8S&%C|KWzm6elcN}YsJrR7T?*AzB|Rvop_jHvDuIwOy6zA
za*6xNEo*t&`}sZVr_V~O<$kpT{bKXzb5u!djrw(q<gnmA^^>$?5B|J)a%`^kA27V1
zW`Q|fw%1xaY!KrxJnT4?j}zo*^&eXWC*2S9$#F_Wd)b{{yZslNYCpR)|NLBDE=WIg
zzJEGS9fz|WChEcnqQ~C%A3pxW$G?7*gEX3NY&UKOAE@>li$nhGCDrM;+C8OD_kQ{I
zK{x#GfBeT={o~Uenw#f8{Fi_JumAR+A3JBvofGQd6Akn7ivC=?7#|6*mF>!3qca`b
z=1!4bT)x%+VUOScosA?#D~)7xqtS27w{ORveIt+C*MmrO!)fbNpuWLUfFQ&h-)wBH
z%k4|v)TxiS1#OmBjE*b1-i&l>j=znTo%jI>rN-f#-M)VOVRpz5__J^Sa@lQm?6t);
z&t3bY7ZF_K;x2OQ?%QzVxP2?}pwNCBt#8_i{r2^P*mdiXvhKmQ%Y=HjTld(+_De4m
zfBpF1^Qr&(u{91e=Wg}IV~pD!|I$v~Z~12*(#Gvl(c7_*1D3`OFEVZ<XpP?R^l>Bn
z7`JN5f5VZg5nC6&5%-NPTGQLN4>jG?w9$>kwjjld{q;kIwia<Cm5qWRl&+gFR$;Qf
zH8_OFO`OngxIJi#fuSoBTZr7K+h#ZX>KSaw86dHZE;nvkBUhxuT5fow_7^{N2c!An
zaU*K7IS1za;J%sk&Nm{pjZ|pdzJByEHXVeXfY^9Yq_}TG8x82tt&vd2IJr>$r;Obz
zJ%9B>*Q{+C(lB^+>n3A37Ta!{OF%5V_2@W4ef@B5TW{3lM%uQ~<mQ7mV*HEDw_$|A
zAM6_sfiQH_@Y|P<aN5*-#Ek~uK7TRM@t3rxYgxzfuilTpdOTe#%@2PSw&O3==WAV#
zf9=N>$q3AYF`n*F5^OQ;*ji<qR~}@FZ}4=djn_MSd%4pZKiy~i`b1NGz0c+JMC<%|
z=jbnYIz8X#LNE8Z#_N6Vrzd*1mpd^I&vyp*r~5)*`zGSGZ(`8tiJe~Gu?xT4*-f7B
zi`QQ5LtgG1bbiMnuWcRv`aQ;Y9>dh=wR5QH>swN@I6ahF=*7+b@uJZ-<rw`&ZP4b_
zTaNS?n~aX#gIe1xZJHQ319fZ|L~SGS;kVv=6I@2R4aNxUWE*$NdueRZy#1x`9@GPW
zcfau%W0Me=J%g}x8Qr8&-v%|T`-IJdo1w|7o8gEGDb#f=B5Yfup6m0g*3W%|wk~b3
z>TMh0-CXH*$3JE0up9nN(TCqIwEWfY8VB3LU|W3qc$gpNn{^D=uOFWV3j01@cN2y~
zx1PiLA?dNvTy`I_F`f(^A$}M-Lj7#$2<u;yp(ENh?t}WXr6ZlT-YjjGgQX*#HyT9#
zZ0SIWhou2@sr%0~bv_mS^^aPTO##HXiEEA8W?R77ev@dAam%A`P5Vt^-@q6nCUOM!
zKF2LaFpMQ_gp*~X+m{c<nTdFegSl{!J<J6T+f*@RRYr|s?y^}7h>Z6~jIs5)%=cYb
zT5Kc6O~W3K6>@m0Zrb@Te*AaEL40(*kz=DL@^Sn2(PM03qWwlb`UXeY*N^UPgV$`_
zD7bCSCCz*un^7*ZK6q>071Arc$K~2YsAH$Y#@HPvt9$;No3q^Vg3-e5cB$&GfAl-z
zL^;56rL{(w0ljUke$(jN2&#2^=oVdX8f}X}M=1+%N;x=nliqJCeG`m+ZCm4>rYi>S
z5P2Hu2iapr;NA$nX=@u3=MYwgFS6wfi>(d1$?%PP<lK}EJ94gooD04C#ys~55BL#o
zVq>eL-Cy$X$AN!q#Dw4!rmHs2_1|L)XNF_Ibz||4R~bExH;22RZ=}Q19n&b_!@_J)
z^Gz*B+@<QzDR8H)JL@Pzg^U8-ybaQj?zj9iq6>Pv*7X028Gx4_H-lXpIB<RYkcbUO
zN8?CfAG%EX*i<naOl+gBjdT14(G4eN8|h<Yo6EDgZ|b!eYuYCb(#J9EAbT9cK4o<b
zJN$ke!w#~?F-$c!>2h<I+Bq-+qT9`5-<q&DScjqSkCTmdY*%!P!*-=ZH-Q~-i`M_*
zcMf9mP1{huF)3~AoX$<{+Za3`g-a2RYj`Z-XKMtLl=|3WD7FKl0oQzoZAq?M>ors_
zR3G;ahlj~bZ?thY?=buC`R^76D-2f*#RV6d{^}==2_9yn&vEkY!<08}l9GKqef=;+
zK!gsX&b)0+;a&e6o#wWUfhqME!WIO3cJ#wIKgb^Q;UJ^u`#$H@LH3w`2ibI%93&5y
z%0c#Uy&Pn@$9?|(bm1Ii4_D7YHXT9-$zyjs$R4|+Va_XdXMvUPwLe;uZ76nNc#93o
zhi$+hi}&0dVTKN;+y+N@*@cg-k+ul>OP}A3+BQ_N1>z;hdrk_NU@e`AYOn___rMW>
ziR^kKW!eS{^S(8PHyC<wwY#fO$zPQp_D0?sMeCT?oAzkdb=)@X-nlF1F^PJU@Y|)P
zzy2wXy)pf`A--9Izv$bC!_H9biJ`WIr4JY<rQpW5FxwDS?Y9VryFLFUn>CzvI`<iR
zi^1DK@4>m$UmbV{*~5W%klE?JhXd~*dn`DR!HL~(gXZD_ku%ntA^XV+vT|w<qr<H|
z@;d+ABOx8-*NeaWFbW)7NVO37%4t(^7?%vcA_2$1!MqJqd`NEGw`PXpD9gswqNK4o
z2107^!6T)wdXJ6;>I~1<9D^8<<yaWp#x4Kct#RD0^!(M&ozEeXYXkPj&#^=ewkF2S
z=a{3$HQZ`g;>&Dy7`oKFVPVPh&F3gT_=1nZhcCDXW5r612VZc<mX~gigD<!vZWdNf
z-iI$(eDkJH&R~oN5j^Ox#u+?<V2zL6nd_9^U{P4>vip6@9vn>AQtaU))|6Tx<jT9t
zHl1!)dY?~MfIK!%hwu>Go(^G+n8z!jP_x^WqQBxvkgb!}Hy-3SG2VjUK7)Hr;O2^c
z6NCBU7&;IF-rDoh5n+*1_}o;>R#7sW!jn?GCH!;VXh4qB85`XFl^z%b6%NxNRX}PD
zI2l~4I?}R-1~HAeiRs29Hm3BfH=oxrGFbQ~7Mq(IJ_L7QMFNWZ)<-K9UAE4!K5*&4
zi6o^kPK_j+mcfE4J*&;f#n>1q*_*)s#a?T8_@)eB7^Gd0GWhiaPDnH5gbN5oE;JBI
zbG);+O|+*g0Sc&R_lyk|PTdc;4`LvYl0~lTS1rhv`PjNQbPxs-;qAYDB#eZG@Hp9e
z>-m`>wb0PKwrgvW(y=))=9|-ITF0*|z4g2Xvx55#NB5?^BR0)ua9P=O19i_i%ZBr<
z@yKh1ddoMl0k;Z37J1rh`H?Qv=Hskw(y)GcY!-cFzpHIZFn3^ScORt}XauV+j%_r~
z6#@#HhDo-}iQ6tcsm-Usac?G;zGo6sphj2>5%!eQrrI*-1gR-NPq<dY>Xo%^GR*NF
zV<R82OV4`qdD6BXIl6<l=q-a}%)YgrvnF(Fqdqmmv%v`~f$vSY28+NF$K!&wPM!zt
zE4BGJ#`ze(1kP^Bk%F_a>L}NGjG<|9z<V8{b!C?*JA`q5A2hOI8i_-CRho|?+PncN
zDS^X~rbij5mk4)Fsj^P<2F?<}k`!aJ?lOhevH^W__WGFAHXVbZHLzSu&LW~sxKpH*
zS%yyOxdquW9Llil-w@Pkm~+^P0>)P7bZDx!k;tpz*mCPi?IP7$SYVbIp&D8|r6;X;
z7!BUEwE?}rdpRacZqOcrYtdr`oP(6TV@!5*ZfG@uH-fE}4I9qch6}a%w9c6I80#It
z56Rg=c>Q4N87R?i*=YoPl;LZ`xoa}_UU(K~Kls*~l1=GZZ$2+%<I!5b$!HsCqwGsZ
z*o?3M4n)l&vdP{zZY}cC?pm9A!15j06Jw*{(o_1XHXrAL9$=iFhir-s9nZrm8M)-h
zK$zUqJO*wn8;y1-U~^jSkj-1rkedwNOf*kWm%8(z2^oX!4GaoSy7f%n1~<Ye81VZx
zgaZu*pg8sexU@uv-U#cD4adGV#?};F{^f&oY;Io9>l=w`nh-`?vp`G)dW{_ZD?>ZU
zoznr|dk?_UfW3{tVh*po5y3LOYHq%U+9p`#IlU50>EQ<8t+O>M=`bAVc@y()anr^a
z>E?wjGOqvu?1waBA=Mt#JTEni+;8Dx>tiU7RN9+!9{e|np*DkaxvP=Fqz#G;I|u=V
z^yRXt`3jQwQ5bI8Z0qJN-vQp>2#ij}LZYF7_sJG9JXOc$DxnFR(ok<`Sl<92&essi
z)RT1B#1_moK}0s@KBDyY)&qfH-CV7?Wg7-k0&i#-nVLcYc04rk%XNG6MG#jehYhAg
zn;}mqy{1^aLV;`I&4yCH5w-%$H3;4)4}#U71}bLDO-bQd!HErCS6F5omg44-y9}-t
z*BG37hml(9HE&pB(1fl4Gok@K2KrmEP-E<Txo&N}25vON;2~IP*wXPD4MP<8Ev12w
zH37)hwl;dtxD{<m4K_Co0MRfKlmQE2!Rel;Z)WaPV#NwlZen0WND#`Z;pnB8gGuvY
z8j5*{ZHl>zWy6|?<&?W>Z@vgFaz!6A=3I|l#^AJy!QwaNj`tXVJO*wAT3oU7YL}iu
z6BFl~3UcjQx>X2hCGjSjV)e3UA@*jP;RYQ2VCq8{JrH2R!@71Eske1D3`_<Pz9&-a
zs=4(V0bBz3ED)nWEW6M5*u~153X9HWd`J9H^7UHx`Jp&5w+a9pq`7#FK2FLP;$6qr
zOU>se0-9wS=hw8|t^KUUd6Uj*T^t{|5I-sL*GGQ6Zb=>aq^v3c1~IUOVb=-a#DpE(
z0LE-B*BMBg7P!!`f28FrWEg#t3Wz<Yz=c*k4o5OXr1WM8!{-w6Eu}&f@LuD<P*($8
zVTQxANusNAOiEK6mlW4xlCacK4=bljs+E{+NVV#CSl^=0@bpC!s%h}#@wg#eK{$D!
zVSvXOp#2gXk6xe(Rv1ktunRHiaPp((xD^^(uGKu?VJ7Chur~^yheXpJks715bP{YK
zeONx(BCYq<w$b63M+8yH(wp+y#5&I^<}@P~AzSSZb)J=GgEB%P1Z)J4{6KjnP6Rk=
z@o2!IsN76_3-7r%L&^#Dfwc8L&%Fd&u375rPGqUmy6ecNJAtJH&+d$s4uKwVN(k>&
zJL`NLn|BS)*r+<y!KpjGzW1BqNbh2HW7wcQ^kyb$p6HF!02MS8&;lCus4j3lQsk9B
zJk2s(8(5Uh7=3Dz8e?#HK7}ZqHZUAHAEN_Cp-QTJZDq9{djyi<%=#vpec#)r&Ct%V
zg(~|EXJW;kcryp&+41nmr5&Tov3W$=6dVCpxl>*_EFtT8sfhIqiCMld=Lv*k<YOp|
z@jiLR60`<tJguMCHkPBn;n#uGeTx>9hb$bTdN6>&v60QAX~3fa!^OO(m#`;-DFr|o
zbpxbHw!t_uAuz=_Tju)+PGXn`(YCJT_kt971<m`FvGYP9ARG0NrY-vjK>}dF(Maz&
zUVO>su+pf|`HptDdZBtz-bmr*Fua^1j*S<E0~MWN2;s-*XaV7sF+1VeFib@Tj72c~
zEYTFIiMMii1`NZY!ye>}2jN<P>?H5^u;F>Xd+$A;(>m6Pe9jmd=tBZR)MvVA=k7Og
z?Pw_`028O%WNc!M(JY4{hX}S0U|+Cm!)26Sa-6R5J_D_cv@QTCgMA|@MYc{JLJ<jU
z%#t^2r?9+VTrrWm!$FC*dwQdKHiiYJ<d>@^R?B-P0f8%PW2Zb=<8%dVh~a=Bu$}VJ
zgpY_gtY-8ZBS7F-aKL;7Jy|Vp(y6DEM$6zFq(u4fJj-CvL&glK5gro`aBf2B3@%hO
zhhjv1$#Wa4<uEWY7QNZVgp=X7k|z4s3E(5o4UpZpgn^Z`Sso2j8UP@rhE}eE3$>5O
zCCbkMpXS!a{<xAdKHr%BCx0(}X!v@m_w+p2+<kn$UP&cau<3O3_tJ-kua|mH&l8~8
zqo3XnFwr~<K54#|J~Vv2)O&g!j%Y$P<v*p?HlA*&PsNwQ$NgU~wVs}4hNa}xnckjn
zc8qAH(`Q>rPi>qJ_<Hr!Q)A%C9MgC9DUF6xbGdpy^<GOK8oplYJv}d1W#QAO#roJp
z^jY(@^r7MFrQXx?umF)+KRxf%gD=1LyS`rPDy!HqwHg5Up?$NK4}p*kc#AN^1uPvQ
zK!d@jkwP8Pbqb}y+l%{iN&9-G6i<VgM&MfO*cWs@3n6hN8VRtH;#2KG+H0vv>8FC;
zA5S}}-Jgc|JaU%$#z8Wl1`nEN1YQEz%+h<1y4pkfsi0QO3$6Ju9IF9sx<&L&T6+9b
z=x{?tmkln8dWn9Ns^lJ$(uV@X)AlYuseL?+u@gq`$W?hfu8$#h3%JXq=UEzxk5ZoB
zvOj4MdOYr=cYj_Fcj)MwHVxjNXWjVL8@^GU9P@bxsq_B4qXuew51;iuo~J;=b|m7C
zjAx_}YtgMIKz;0;c@&24!o%&p57d*+$D>#~6yTWC>G3RrPp`AU%^bVhgOK&nf`bAd
zkEfl~J|0K#Zvyurqqf_U!hGo>>1d<J^FF2R@oq;2^ytWw+Rw*<%%KB_?81)^*T4+f
z;Q~yM&eVLA%47H(HPGX6&uSl!%f+B$F;I=qry+A3;mH`myNW55^KbaO?XyX5gs0y}
z{r%jOuUG9mHX9mXPEtCX4pNsbxR8;Dr(H`Q8oplYJw4BHUa!FHK^n3lG=6&9Yw1J7
z*Gs*p=fPTcOwOn0A*VvvPnxf#4-H>0^`4%W5#7$GaR3++S@dVk*V2cEua|mH&qHWh
zqdoWMXka(s5l@=0rJowUUg~{*9ykFky|+)#0|eU3eRX)=we+Fk>!se)^WcXa;r{$Q
zh8voRpEX}g9~!=1>ODOV{v;Zw$BE#8dg{$f;ePwqE1joD!ON7VyXR+((__xR_q)Dc
z>N=u52yvg{slnFNB}8u-C1<#u-~+)iFMa^{aj6REj{&3U_+P+4UWA1QVE{s)m*CLQ
zNv`}JKazx9BscOWrml9QoiQ2gJpxCjw<g7nD31Icl_RB3Ys8?FY|Y>!wEC?MW}?<q
zK@amFc6rdQ1jev6pNYAM`$h%Uz`!}X5I&Rdcj2X~KfMd#75JsP(0&VArP&kz08$zd
z)*yh~nsNOd|3)u@#sV_@9rrxst$HzOF3_vLn}7G`9wk?pk+7Qy@Ipm!3y>FOBrE<*
zk6x<!(|Z&!#b2yP7rm7K{#}j39B;PwQvJRC4)583InEwzzdwyffYtg4LZA%US^&%e
zJTx#7er`Nosru7<FMh%CsN=JDk_a$n@69ol<ILt*vx972xA$s}!#;J5`R{n{Q3nVv
zfnJmhKrE~`PQn)0dq2~om#Y5s9;Non^(g(e##N3f`JCCu-b#*+K34;MFt&Zp+=i%|
z!=-ubDruW!ocw2I?xm_fqpRo_oVv^In1gU1eD*xB&I{c@bf&|fPp}mTPHUhFI~)6L
zjI^)DkDxBEH2oP96^WjIPG2G1KO9Hpr{SgXyg}sTJoMYo4Y}oaQrd|*e|ON+<}>HF
z$nP}fcjEf{({tnV`{nO(XzOXoB^t<*84Y>G2yO(j?356`XpA%y#QYm<<sY%5u9W@B
zACp_V1^+o86G={*oTtCw1XvB6Hu=4uzG14M&xJnK)5T)0wV>xUzyJJZkKa7E*_ZM5
zon|5Qkfg76>VPzZeE!zi5mzImi*Ak8Zh-A?q6zxQ@geb(<Ksfrf5XuMS3h?;jt&}N
z7ybWey7%p6xEx0#tgFX}jMKEXvh-KO1MPp<y!&<i2Zl?hjV4X~K45gW_Iz4$zyH(7
z8<(R3QDWirX=3AS;PU)F_8yd&-#!pS9LWfY;5S>u4N)zYOcMv3mq1AA8O6@5pUtBO
zz&~F;z#l<*<^haII)c53LlXl61u`#jWGNyCF%(<N<6mDsKL7rC&!?V;>d)tWw&Bai
zv1NN}4==F4Q@bJXdB6C}{Yu0A`eFBrX5Fuvf4_dy`&FmhFFNmj-Ocx_FLJ;5a(8^w
zy#Dc;pMN{N=98BFiTBeZ_ZK}h@99k+FY@`S_ouf$TynVa>23FCd_MaA)bURZeKi00
zPM=@;j!%8{r%NS^CtkJg@;w$Wec3}-eYxoO%a3&RIqOTqo3rPW{W_n2ozK6{=fC#(
z{D(3LzQ5HEO;k~<OxS_ssQNFJ^>-9}Zu)nSA|TUDZg<9daR=Ov2H<%RfE|rs^5?JT
zi@_L$^ic-|5(2RbJh9MbgGY-J0z>8yh6v9KJ6BdHfSWkcOtBl7!UZ|<09U0<14P;a
zK$HL>mqMgvVK4|IBZ_)m3#z3)Zi!pYe2^5n;Rp-hDDqS4NnI0gnF`!NgI;11v3yvB
zgpU*=VAfLWQ0aAl@Mwvb7uf*srn=O7koXN}ZtI<=Pz?=4gpxsknnDXuN0kD#VKK#|
zxn9TyuuFBI0%wr2NW>*%GD5rv?hpZmGcCnJh|vqscg&;O%8rx{91{#cg_Kb@P?vo9
z5Zy>!W~-2BhD0gw1_dDV5H>SK$_OZ42*d?<gvQkhswRp?x9lqfmBCerYh4@|GYCUa
zEe^tH9@JCl(LDjC5C>9yN=yKW;@U2b`W_GhpNiy7q$%`Fhoz3dxnih)h;7Z(atvT9
zG)ze3S5RZA7H}fh1*k3uCKs}X91yMhg|#LmSaP}}w-=bDL=&d4WmpQybImD7CU^xi
zYa<m{&-MdnADpS2n;W?IQm8SIFqrJkvFij(M`rs2pzRW~8j|vmy{A1_6auD=7-QG~
zRG_Gqw$_Ug7X%(i5y5*Q(?)~yVJIzVDGP6-!}040mQ5KDk0VDQV7+AIDK;{vOsj-z
z5?GUa6468mc5eq`dQN}xO#DFjGj-7DNa=#S^#=4Nu4W!BCx?N(iz<zCV`HL7X=ff$
zLlH^B1Bt1Sdv9*l4hG=6r_`habOEWfME^so#Oaq#9YQ#7rkoX%sIDfDUOHMg0`3md
zxs=g-hy6F8AI-Gu@ggLj5)vB^!pDtd$Y&>vI?3FRY6)^Q6K)qyE{A5HTg~`t1hF}(
zNY5Ad%s8dwTgzGrpMCezbu?n+wIcv+t}oaF8HC7-6q1%KFZ&04`F;vOIK)Cab_HbI
zK&7`SoD9t$L+EJ)S>_M1Lkea{*PMYvJ$D-n%1RG=4B*rF?MeW=V5oC|ow+7OvaeuH
zWPP2_`E!~+?jw+T0vGX2yWX5BMrt%|z*v7y-qYMw8Q37eP{JKRF3kPle9B-J<ODue
zj?==y@DwtnAc<)?@ks^PncO!sLjAdJJuO>^rXaXiSR2XO0}%=<BNxKf<FIC)mP{7|
zQ&q06gKEt-2bd^jW6T9}F4?CQn?W(gH!SWFf~0LlHXl-<a~Bwg?c!;-kZs5S&L)v=
z_`KL`IxE$c7~9C%-1n-}R%K)47y~JqJ31CYxDE;&(39Fg`tW0)JZ+OS6e~M+R3XAH
zgWQ3ZJQLV@ku3SSOFwPW4B9S0esVh(0DrOZt0hSt_Wj7^@nIvJOa!HndYc}a{l!Sx
zMAihX5k%kUV4|EXl-7_3nNsZTX&`l%rggW&r~7Fioy;S*mP8zox@a0#U=WQGB}>_-
zQI<9trsfD?2Te+viYm(a$NTA0{08K!KFY`pVaUve)08Dm`~9+g_q5+sW^3FKmAR+=
zX24mO{f3GV_v_w)7)fvWu?Go=ryxU?%E&J3NZIHqy!bW{d(V;yBe`yM<fWZ^Qpp3F
zFFZVjuLI+bA=I0-d_D{o?Cr>*1W#xQIZMCXuZQKm%r~!LWTbu6wKm#(0hn)G!q+)*
zPy20X^|i1kAzV(gjx5=nW(Ks|{dz`1OfCShLyV*X$!i%#Ku+++*zvE|0*Dp3E7XF3
z>Ci{rZj!<Ag6_3m&%aoTQXHP&1vxCJIg!_P_3&ITO}fEqyj}+HFyFdnO^=?Wc-h;i
z{5Eo_&oua+L-2AHhFHw!wlKhS(DPc=5X~K+gRHR>Tx<a;?g|!ynJ5WUGPe~WPpyg!
zxRhONKq>Zsv4XuSB28RuYDl!nZ7EZlM+sl|zk4#UwfwZm6zFix-?7mmTPAW-)d-Ns
z-mkXb6n5p5TJy}yyXWpbYV($kez6i>Z2u`A<eCp7BEf+otqMb`8>KNRgyYx31WCCI
zXlr1v@L(X4QyQi{rAXZZJ;Qxr2bCP$E07BYbDvk^Rnod)+&8KnM<eX;JNY?KkLq|4
z90Sq=o6h}g`PCB)X|XU6sdZ8??bL(C%Ti_X%=^2qjL&@8!FdodplXp8QeDs)DT!&p
z#xUe{-&baEb^8EqTw2ZHb&@P|E@x8Ob1iCFSy<%x2T_>6_=5oK?DKk@uImt>Ag0s!
z99Q?3fz^_tEl&|bjx4DhuWoQO<beZdS~?Ey`+0POg<{G{nXTqWc$cWN6oY9mjx+3j
zo??#g<NJ9E;gFoTW3*AHEJH5xagyK9vs|^gmx|7=S`QR3Z<dNd9fr((aZ;>h$-sJW
z&vmJWgCVoI&l9k;4)THf;;@?XHoF?hRdw*hf{E1by4t#M_v4a#Kd-sg%azfSF(7Jv
zR`1kGMei-A@b#fR<&9gO?go<bbd(Av27y;fLpb_z<GDZYJc6Uf!^<E@vdsOg*mF`C
zy)24L-$m||$b>BCg`!+(&x=*^2$UWXoCo5#|K86VFjD}_bf3F*NM23Nc)Ebxfik&Y
zdvMZRFxOG7Lq)t^Mo9Re>2N~IaM;lbxu4AtHMKE4PHt$AWX7w?ly(OL!+qh&N~=j2
zh~#p6nX9MSHJEt%mxc|+DfZf#mWJC9C4V^Hra1?K54PP$S8LnJk@rs@n}M?&<{;mY
zpinX67h!o07p_CBOxg#*41~Fvv|PEyUHA?!ZjTM_RCH4st4Lx{8n$vhKHdETzm-FE
z_f;CGBG6?50=y~2@qO*9e9@<&%zM8gJsA2zZ4SrLhr;!@()S`wtz9K-YV|>-b(p3d
zm!rVMb?Fjas^v0`APzzrCDf7*o#VwpthjcxzKXv=%r>Y`4RBHCF-pQ(?{nM>H+|!O
zUFq#zX*RbJHVRBK5!0zR8q$8&dSAt<*O3D=rz90&4{ssXTXlI1?2jvV?^><1_gyVx
zw@WW__`Eivo5fn~i}YLhmX#j9Wlv@)*~nENzGYcDmX|ss8NKuNaM&WbhRT>;bZ1Eq
z=+a;PDo(vBPLD;~k#LLkT}9`|)et18F8$amwd`c|7ADx8QZ0+k!J%*z(^~C|G_|5Y
zhEK7=)0}<`_$_PW>H{QbE2sHVYsB7*f_k3WtZp`F3Y#iCk4s<ttN7b=(feExh?@$R
zi@x)WTi~{G+ALi3OT9vKgb?BdRC-C;?)uMCB}=uh;#8}lS~g1$lj)qYuwHgkZ#qQZ
z!~>RUr8+Y8!rPg8T}`K6aMizyGrWjXZ*=7-y^g%Q3O_iwX3HGoaxE>w4@<o$tgx$a
zACzBhNUK@WH#JK-z@^?-@wbe2^kH7@<$ymfy^gRS>snyjyDq~WYrWvJt53v(;s1eN
zi#}D*=sh_!S7DS_aq3MId<If1kR1<OoO^H67FU!_SO-^DYDFt<hdMTzVJF+PrQ;~o
zMn^90o1o2$IQ5z_%~OJd**5j!7(7oO*eRmFiRP^I231HeHfKY|q~wu!<XWD*X^7&!
zi4whtQ!f@BpTQ$@a7pEftFz1#7jjqM1&>yGy;o2T$Frm)wDeVtx|9MXJ>IB&6@RNx
z74=bJsXl7|wQY2Dny1W;1M(tNwbm*&<{20kQ+2`!#6Ig$+|p&d3V@x2-zqBBLFSR?
z<fMV242gjItu7Xaz0U8VV%LhpunlCmO)QT{bu6#`&SQDnOmCuXukvpdg>xmEQMm3V
zUQsy9Efl>EPB4ELgj=faQBy0UNk}Ayk_IlcdY)(!kG+fUy~@8;+;0!?1=4x7qF*tR
zF&~a2z%5<hh5gp5N6ijH;jNz5bcPgriy2aMM@5czA;nkuw~~*Faa($6y#^SZhP|$C
zBjAs`3^guwMxMpf0alQZazn**2r<?`>hHprG{4x7{)U|yIPD&krZ-rf^eWo9(32HW
zDjIdT2+4n)WvmsQ^sIhT+NE&N0kOd|oEqs6Mhu^<)$m)ySYPyEvq*hL0e@TRLv@1e
zeX&Fmto6N!YsB@D0R_<c0Gtvvn31=eK2Su#`AsBusn#l(Y`~jn#nC;nH5o1+aL>I9
z5Wk4O&A2gWMX@vh!Oj)q@6N6jH;!h799YDSS9+OI{2O|mrDg^VK_r%Pt?S4QeG`s;
z5!WIF+b~_)%xzeyr8dfQ4Q68)%9lavwN3_NE0u<l)H2@?LrsS|H&9irbe?3jzLT|j
z&mb~*6myGffDuvh6`SZP7`{*m-hm9I2RlW@vxg6^@P0>U^PBkkS(=+>2iQY0KmpUa
z42K4~gN$S}oXFNu_k~VPG*w0NM;T?9{!)Sbm_VFsl`qn772elYQuX0^yMx0$WA=zt
z>YM2PLZx61rqR{MMD`fv%!kzn>bs@J7inr#U`@E9O$a<CieL~T+K>$eoN9?9Sm+c4
zlk$E^vL)yQeMTY^oZZ(NU!<v#1}DZ8<&_ZYOqkRjXJZx6k1pT}OO>6HPZsA6l0qr9
zfe(~AgFMC>0`VfvlhcrNrs9mGICSKJENH?ijFN<HiH%t3<N$Ig&s{MJ^U%$@W|Y&w
zQ!&;$U!>m(h0#adp9N~_KpF(7Pogjc=f5QiW1&+Un5R;wj>5tjAatdYxXzK+Dqp0j
z5?cplfEYRGIQRFa6-aIaL9G?sW2rC{x!0)>QTx;hPjSLCh}fQ-C)ZAnCtrl5SF<1k
ztj5gKbrSU)X$tDbYhcMzrM4WfiB*9stgtF0CRT-U^jcw6&cf7aq11YX^?Oo)gP^ES
zc!vQF<ZA@WrAnuOhZ`z^lT2?MqNLeIofPvcjW5zv$=a&d92DJAcvQ-QA>iiA5(1Yv
znWaLb3Fq+E$H;F(p_O5}IS@!|=*?M}?$WNkj|4r00g#j4Qj^RsN4Uit%iRi(vrt)B
z@Kgz)bgFbJ$O#NQeFO1%k$x-SkN3j7^iWjCOvg099TWI7s+rfopM}oWl1CgmBX=4&
z(IpBlg7*<$>wJ->PWS|^Ks1`pEV%YTk6aKV^BJ4CfEZn?B&?z`Z^xN2Rdy4ZS9*-4
z%2#1(bP(H5+)`kDN3evXPiz!OiS3MKTIsUEAa<W&F1R-k<zgKCD;Q%kE_8kV{Pvxn
zsAWXd5cfhTiU?HTa0Fh#s807fVkrZa7xLCfauK9xUIVa>xBkd)#i*$s8KQ{_A>gfB
zjjGW-@ewP)){8oEngFh0j8ky}z_`}A0fyyw>RvxjqQX3gCMwLif}u!|<sAoSGS;B5
zrPkiyg-fkj3^LWi#;9vGsf6EP%`S#|LeLatISPZ;5T?o4ts=uB=V>3(>>UPerFS%|
zJ#iG2Cj-S2J75hdr14Jg#R`&;H%W|hQmC=b*me+(T)Ebbo(|Im=547qTFZkFpme0O
zCp%c;=dx<)N?EFXU6vDIXAu)i*VT1K=kd+BHl#+QuK{*TwQS0@|BR@-BLw|p!a<Qr
zqVHgP7du@-4|qtSOpVhpPLu-rJNIM6F5(TCZ>3e8YJE1Q3gH9$02<{)J^)z$M(eBL
zkU$Gb5=4lzWMUyQlF2Xu8O<h`?-Dn-)XF1vFmG$K0{}d*X`F#T=N%mJ!WJu(Vs8b>
zq-N9$Si-%*6i-7^P2b`amwK5C*-I_?yHhWU-B95lIVOB^q4&bXO)yO-DTFoF(}}7?
zS+Ew<xQCJY1{S%}i+wrIMsTlFHO)qF;l2Uhr~Vdh`Fd<96eg183p%bM)ejvk>v@n$
z0tQ;6FxPrV0F;ujq~7{Ocfxd$!mdXxm`lAE$Fagp5ohm!GMfq<Ni0^)Wy$&>OU&n5
zEgTrxlRVl4Z4!*Yd=`ylV}AoBy*T6+!gQef5@FgRS3%T0fN!YI{7o(1Axu|#!Prm-
z`T*v(^frbwHe*=B#oi)UUp)r}XoW))4vyhAv2q>_Q78COEE(M209u!7y?Vh0YNSk<
ztmD{{?iqUvl6`f>6bw)jrW&xU3$<xUo+;%<Lh{u+=<G^uq~VcKu}ttNAR^+$saCo-
zd#Crpzjd#q7QAOAweTnvV+f)anQG-kA}gfsS}m4{bYgaIGy$TGG!O3SNbI$atpLDh
zr(p_*Q2~h65o@daNn0<hF#w%yHg<&zzE<2VZARdYh0B(MBQ*;oCg50FZE0@+#~0q%
z0wOC4Dk7pZkT_VNRYnpjmp{2nCicBSA}@6pg0=v(y|syQM&vuCO_cU-UZR{Y9NrWC
z3{Vw<Skh2za)O^*l;6L1o4D*1_Ia(jkBOj0xgDMD>z0`_8L^gO{X4ko*Qi3tdq^Rx
z;qexmuxCX<Da1xV>e>1=-g>EXM13nZ^TgE5xR_@Dw1Enz{tm-U`xpDc-*Ak=$@&ED
zh8@6!f|}Qm@0BW5bJQhx)`f&Di?^!oXI<|EWSlSqY<r;N-;wT(XTl^aOk;ZwIKR;A
zA~X8v>=QaJlxNp`+F;|oPnK%0!jp5<6~5ifsLz}Nl=|@!qj;o$2j2chxwP3QhRns-
z)#IXy4~xSi{2loGRV=s`5iS5dRuPbQmm(UOX_%4irfJ!{#nr#jue$56nxv)PyX-M}
z0J-{iVEb1A_*!3m!Un{p#lFk*+TjzX(1ZG6^Lc^uuXTgDnr5y5vRUU|(Ez$D<%ow;
zf0rxp0(PiPtc4atAQFgBhQ~mL)x?1??O8w983aq!4aoaatz93<35e<xaHEIF_mUGX
z5GB)A@Jy3PV?n3x2&PIFVDBg?_%3H*shUT2FjQNMF*6^$HJ*T*AvCjyR=TfHJC!Ff
z3eJo?iQs8F!T7X^Un;QFyF`hlZb2=jiB_^{pPM=DaH-atz14h$jY^XjaRi!hFy2Rl
zV50d%jwSj1yVQ)e?mlFPn&EstbyLjr`eBrn=HKYP!l2dBqB2Ud*h1y?;Aj)lWTt~y
z<uI+%LDs6dDf!GaL2=j8jg7fYRs#yk)XF!hCKpJ*l(UUN6NNZr9t^u7%u;|wDgKBz
zDJV<b&BvGs$LKN-^_{Fu)ln9~TJsg2@}8kF=85%8|KONs@+jOe7~P{!=_>7IshiuN
znNefJBW4;TYJL~Gl%@8gHz_q2xYd+%tIfA(fi<cgVI4A)GMYZV<aMgeJKaL_?LogX
z&*zNeK26<#6us4bg$_=ykLu(g0o8J^M4k@Dn^KKB;nLUXJ#RE8A?QpTYN6B1l+fl%
z9I^yFuM>wZ0NCYI<DJX|=QN-BM65Bp8hGUI<P)t_50#ygMMpVqQRSlh1dSVV<=(5l
z!nmj3a(K)<A)LrYy?Ul{&cr6T{9~QNv{ntLu+}GVR2;6aNc@=uVBTHdrAJ-l5mb_O
zQY@t0En$c7O@j)ex(THY<$c!FLN$^w=D0ykX|DhRc$LP?{s4O-zg2yesFD8nRtsL0
zR!MdexauRRJu2PAn!L}{TI%-JS!NcP@$~qkiq0HSy^9*X)qRx@lW`6>;%A<c@)(tr
zKU`v_t_{nCnN@Pw8_kVqPqon^e#&4Ukhn87C|Jk4yt9jxql`+SB>aO1s--1{s^rQ%
z`x<UkdQC@rqth}@{K&7G8EydY>=|x`Vq=#opVQ6Gf<Ns1tc*#7Z0LbPrjB)s63k+x
z{&RH@E>wY?E2|jSe_Q6+Jqdn_ep(J(sqsmVtH1qaIYmd-VMcBwQI{<gp~9ad8bkR+
z&6MAn?uR0xqoy~v8}e_9QzX;<o~}m8Q*a7c+tckpvxbX?b)TbjG_3MMa9Z%B#5zW$
zK?BuvPpnJWH37tp_*P9Iz#B3w4NyXVNvwkt$ETPSrL8bbxyhdEHUf3Sb6Qez7MxH9
zZ2)977spOTE5<BsY7N-enK~v&XXckQF%87Y_bmZo39O5)_O#qR1pXl`p$d2EOHNpK
zs$`dhtAOJHt8fgT3#;N}nWz{dC6bqXDn`Pf&;8$%q#RYOw9jUN(!J8h)CbL6)MM(D
zAu(f$QH)*+f-`kCa*h;rR8<?NoFk+cOPl#VL5O|AaOlmaT?iO#Vvh)3J$lIjV$Lkq
zX^8f^R>WmgMh)J-C7?-B4o+W^at!ncd-hF3rYEe&8G1@!ow_Az3jwc)m+YI6M5pAz
zV`Q)=qbyR3EhYh3q}IWWTYt%00dKI?!PJHz$Wci_lWfeu^pwaxp_m8QBgm4<rU+z!
zk4p04<}<m4*)i5|KB6RZIRQz<f*Z~3jU6YcjmT+cZwOVYh`JQ#!E^qGj`7HSXsqz4
z;pir2Ty6$InJ%t;piVLw%nsOKpg(EnB!DA2sm2V6osFmS1-Y^#`^B>+`zaFvj#Qmq
zGKURIm3M;%?O6d7sMK1AVV>Tn1N<8t7c_l6(lV<eFJ@<!>1T^P+Cw@QGMX>2|4y<<
zkPaR$N@yqYus%hP+jt~c1{4(tZc#naP%1tNDtgn(u9|IrX>v2nNW34lom0yP5{om-
zq6-x$w0iBO(~8ESIL55ir}I`}PPmY;64K$zoj;uE01P&LOag|YycX+gag1qeQjp_0
zdd`D~lC2`$J&fU3TwRR|8r_|h;&bqx#xAPOwTdYLgEcB`F5}vfK-JPWr_E{BG|PN(
z%(<2^1k6v&+6*x{s^98i&OS|9u;BzxB(V6X*&WCo&%1{VZgN;MPAdig6rvTs<RsIq
zWXOth3Mq&&K3A;Mf+au$asgil=VRD`EiG~$&K3BvUY?fAW(<%;0$kzg$i-H$>gQsM
zbL(NPJ}uRlT0W!j0cxg92nN4thU)>Ov%^Ml+9$xBQ1O1&F^WO+6DKF6RQSuePd#l@
zoLpALfTU(H4YBuyW$mAlu(QU8ZSu5B!iP42Bq-jO;6~Lhg@N!P5#z8+pEhYA=Syd@
zALM@C6lO}ETtKRKuo0e21eo0}g=^{PmSQ8Ymf>7j7z8Z+r-^d1P}IB^85Iui#TO>#
zG8wjT)T4uibTW|8$T2}=QN~rv0Aj-PlGgBHm8DUZoOzj)ok+LLAte~}33YqE7Qef9
zn`~wy@szN^TgyuHbw(JIvf`qFX|J~c>>@2V9=(8R;Mt9WZ>iM5{IY-YP(fz1dq*96
zlY%x1Edp11*gROhe4RWi4a%i44Y&%T!-B)n>Q)9^w0Y`#9UD9RtLWBzB;GgAla+u}
zTqQnF;}=6SkKHstvIQ}+RSNutEQX@dvnH9id_6PLBY^%+y`owHBH4J%OL<W5CA*lH
zg@%e=lLOpH=_M49B5Q#X8<@*V!Nsyr3^5AI;56YH$z(k1()+~Ct9kj~E*7P9Z=oPV
zE|WIOax0X3rkNl?KxwkyTr7#{*K3klPnkhI9v~c<&=CsRy>u5Va=H=Kz}cI)jUhbI
zHk5M&t2|;$<%+x55K;^jLG2yhcG98NvMfg?8C%gcUG7II4(mH?ViXqAk~pdoTTtcK
z%gg_|8Kx9wYVNQDP_gM0kAd=l$?61dh=QZM?#1bD2aaok3rw|5LMAKzu1uwq&XbYp
z!XB9PO}!ccu+`4o=9D-U-&#^1^A0mPn<Odj-YS0WE}m@PW$3^jhN06`%1Ll-6{VbI
z+Er}Yx>TD(npSih7`2!^d^E`pzcKvaWgN$gz&kEv<)}JYf%6Hy(<G&Z-9F<$oJD@p
zhV;?6%dz$6SS?=Gr^#uJJZ4zNhb8?O#G`?!=FpAjm}%N}<^L|qv6yijZ<LVDNjc{8
z3td{~`3IdWT}e5{vR_XoGj}+Br{g%V?&p!E%nAF*h#~0k<~Z(Ys}$!Lm&5$>oRTxa
zJXe-XL`$yJoHQ8TeG)A*wK&eOmk=AGwLA}1a7@%3)p>X`gy`%z$M5G!4nLRhPI54;
zmK2cC*&fxx8Tz=;+|MhGBc*#rfmmx*GaEb)!AwQ1wm7h6h=71SnS5hr6J5xpF<CFb
ze#qmv;J$=pvLu#G!ZFX3?<7na%riU^TE5=vgM0bam1#faM+H+P2^Xi68;2V8<JNOO
z?>*puo^lo+wr^fxyA&WrJ#K$5p@YWe(_sTv#GM^fifF7TWja6Y!T0kf>|o`bd^sdV
z*vMcrlj%osMd{q5A@Jf>M{2rO`@)Rpu1}yUm@e^7$u+m|C*6xHigXg)2jyy#E-Bqv
zk_I?_jt0^FY!SgJJSo@)8a=(SAm!YBW!y!MR@saDw^3)=<+bQHj1C&RYfcLMbaLwb
zX{=*sKO%TrOp<yP1q+HEXn4Q$BVM>6V{>xgg_CtmlaDz`3a{OePj~;o@2*v^VzQ3G
zMVXd$#DjGVE8@y;d7+RyKRVWlN+Ba7dJ36^-Z(;E#hL%YlElLIVhHncZz8V5`#@;$
zy{-MDOTFs6>*Y32C9qZYx(}3oho#<EaU~QDCD~&(;D*W^C252A@Q!Nfy>!Q}^}@vF
zJr?A71e<j9r53r0Z`8huXOb3(3ugFAu$E)GGo`7SX&WOMRTj?QwO*eb`y-?5y{M?e
zc}9zNpWM=^{3@<QH6_~_6o-RB8cQ4-&&AVS!r%FtS9(zyVY;h(F<kIw*7x?hWsT~!
z-dAxY06HRIC5DqTRe=3tmKRY}f#^%u_F6BvU+QYO>!MiP;C!#~pde-RH!ky6@t##l
zbMy(>^rT4d^oWdWt7;w#Px?|XJRVbT0xh9;M4Mv=5#h#f^uCHK`L**NwxedPQdNDJ
z%$2{f3dI}O{Zg;;Tz04lO4X%aRDPLy367UHA%Pch>P1gdOghve^+P60r|IhNRIZ&x
ztYEDdW-v{?#uY6Y+G$d+vLe2*4ne$%E2)~K*gs*AIcdfaP_%)k?KZ?C-b5x=dPR96
zTg;7$e@?WHcj*<R@OOG&#YM;F!(xhQc$J7Tu=P#L)VLSD*&-0K(u?HHiEtWi79+4o
z3fFXj3MT1V?W?$0-mJ`LSlxgCW!R-N_$tak2Qv#V!!B#R;JTcVo6%gT!Z|u*59hRZ
zT3^M*RuD6w7T|bn70UpVdnq+b%WxIsS*z_hIhI;suE0Z6p1fqn1BEZ%#ExFXlUAbZ
z6tfDC$#j86)(NaR>bfkWN(;5{qfYoFi)c}WF?yy>V68{V7O|?cv}og;=h?D%uG^I|
zA8i&dfe&FFzgj8nv@?wX3#~<QCk0~3V{Fs@PVcL@C_siLyK`3NNn+s)nXvV!$0^}R
z^fp|!Qr*L?l$bKpR82I`?>cjs-)O#&7rjc709Sy{!)74Obxt+|Q*2CfzD0m;sk(KG
z`dDp*Px2O*5?Usvd%TPMy@*S1mz@#JJDJZoS|gQ-cUSPU$-9W)QnlNTjz=D4k;6pu
z%vVUNcuRJlcfrP2d6D!nXL%0zt_DaZ_bBA#5JN~1wCGns$fZiqP?t(i@}^QbXfluy
zGF_@h)he(_^K1R+Z{3hYHflOfA^MY*`td>Edk!$q*7T`yz>b56XA%!xDmv*|{e)Yp
zvSRXhU;P5Ywjv-yYS_Ez>sea|P6^sFfIPpPq+c0*kD5>YoxT@w4Yx5+#i&v=ge%DE
zJqxo{f<{c@#_K5WTJ3nG8@0Kdd*{hY27c45MY9YZpQV$C$#6u=i3?U!t&p-ttB^7|
zS=Ccpgp^lm(;ZOG%%O9oX_a%HuFOG`*mDu7ei0XkC#*cL05)(M73?O>1V~4%m)>f=
zTnDh1YE`71=2+#6dn!-^07}Do(7UMkSz60`vzUxwL0SDHo&G%oCt%4OQlsE9R=&{5
znT%QahzOMx%N5v(C$U+lwa&A!_IPWE7iN-0OxjwcI<|~rpaR-B+BqkC<XWYI04G&~
zucWXri2GHvBs~*rl`qob#?{_q5{6CC5a6Q45exU(BJ{u1XL+DbIDt=neXoIr0I)7q
zUPy~>IN$|<CEGNr;v-y%lRymlF=GueSg1rDrbJADL8^G7LUF#y$X6GygU+?i7isDQ
zPiwb|vKdmXG8~uW=~)1%<<_zSGhFKgBc9GOY&sehF|^Hmc%~jQ);eFLsZ)@cQ?Lom
zpgBT3eWs@yYQ)$YHnC7CmB$H`8GPXd#ZYkCB@{zd-as*4q^Yy%$oZ3n;JEm#2D0%c
zOTkEU_8OtF)QR+?DkNuKl<h-eGNpkP$Y~Awc##&%)o_$W$<w@OvDO<7(vuN_W{K2m
zD9B1DDyL5Jh(tX?r-aQ~STc(8>ssfFG<6C%!yfz@Rb);O5U<!ca`bHlI$7!rp9R7g
z*z@$fFe;^189jJab*=M7S|t9UW-sy(ET9Qc>A(~07=T&V-~!!pt&$VhQ)nGj&mE=G
zMBC&onZC(uz|4zu7DXsdMFdGep8!8!Z$9A<T4#<Gie{k__HMR4DN5l^9D|GH4bc~|
zwZ<1|6`F9<!nlOF7bF)Z(Bz!yO0tCOEOlxdRV8t<8>FWfj5I~hGa0L{5kN1}D&K+X
zcEuVrs-_6eQ&9*PKybzy6|~T(#4%O!tV@{YY!o~u?8zyA?UO&b&ed}fsvHGiL*VJh
z#y0Us5@Bon(LyK6&`x-d=UI~AFfFE{;fZ}-s(g{A%7$I!0Xf1l(Y9{7b2uT{kj_}A
zwKBMAr!?{$*HG-X+vFlk>gKbu<Iiv3`AG^;FabwUMRkbD;hMidS)FeMw;ZSE3m0cW
zUL<ZV@L9)Of8;kH*u^Y~Q07b=X~;<S*|~0S@LU%P2l0d3%v$A~G|-_>g@wad;=?Y!
z5X9IYQW#BUj*KAFWzypXobPWyV=JwFG9`gyMXIfufQ1^YQ4#;8+Kb_yNi#SK)!1ol
zGBIkB@u!@uQdzwVjM`FfRK>5<OX@SrN0Hl8dNY`?R(r9ER9;fZtkp?9129<ZjK}16
z1jj$E5piq1x(_2jCUr)~#b&imaJY7VhqSv`niGH*!jlWL>t2$}dRA90Hp@M;YyrSq
z=~XZ*6tK_J%Ua>GNjK^)Svp~@_hQ3KXkUob=r^*WiNO9ZQD9V^<>yy;zqMYA$roo}
zLM<fY!0Ep#^rEWrTO8qq88H(Mxo94RLHJz>k;+ola@k3&zrz=<^zJ(oI9g`fsWf2L
zQ*B4Z<acT>jI%^D8c(x_7>NZ1N)gcTrfKPPol|h8O}m9Nv8_q+#>vFCZQHhOOl;e>
zZQHhOo3r!%=ew$py857>ySu8NTHWhfxvbtHCR%4v4h2TaDjV|gT^9PlNYY6zT_WP$
zSY1iP*jyraAyJbl(r(kagi_I?dN;^iZObr|Vt4Un&uM3yN|kg;WJbBR{An1bVV*%b
zm9Nv2&hy=2E;P|b%!I#ha?>fBqW(ms|FY*a-vQ#G)FM+iajtsO!I^{pz24TE>~3Oh
z;t|su5b;oyz~U1Et9=@jq+tNQXuIDkhh2W!$_Z?G^Qe>Q1tXQ*`bkWRUANGXR(q#2
zpZN(ubS}a;V!23-sn_Am!a)zZhmhOLTmf29jS&c!N3J(p?psy7?G1hvzpE>lv5xZ8
zJ_U19VORlTmlr{~h7c^Ar$O!1eMFc2I4>bjr4AV61c=&jN`gY?CI*BDnwsxfrd}yn
zr}QH*+Nq#)P5j7XZ1ytC&0rocLwC+Kt19zArdAcQ!K@_v<26t)$KQcnT!OS19@ekZ
z?krZz2Fu3{*}o)&9=~O-f;jC3LR~@YJRR5Hggowi{Y1-m_bfs0Bpe0FjQ;Q(l&SGg
zG(BWXYowAez4a?=hORz_nSPFO+z`9j1xb4_NDGX!rXDq&_bIdH8z)Uec_okHz?K&8
zk7^a<>2~dr56?=X{rZkwEBZT%Dz=UdjobwxPOEI1M_#_jn&D>Kn=DG7d{_GeFX+?N
z6~cjrlx~aESIbXa7&LaYN6~cX57Qc`PoW^`D*P?_>}?13vc{XsAAh{UfpC|R^Sad{
z2D4k1*GYb=`M!{Fz2k|BDU<GmH&Z^TNi1*{RsNyA!pW~Np<F4e>AAboR;oMa-qqAq
z_>Pt0ljk}bDQN&Lvpl0GK7b#f)Bmjw>5=zBVW-aLb`O=wdIqJpsR-IBkV4nLwoSCR
zQ`$li6mkTn)55;k1SHqH24UW*?1M&FEuJm(ZwSW({Q+gb8ofT{As?b+9@?izg_eE?
zYOhC#PfCSsozkPP<`H1`Pg%-`)cduPEZSN5<S%_(7g>grQ8xD#(vL{d<N+{5$HqWy
z$N(8Et&pnpf2_XZR0qSL3th+4toJ+thpOMm@+{{uG3NM#>y%|(y9igks(^ewq(s+N
zLi)01HehNoEbs!hf2bp0O~}KS8sX}}kV=`*77=3UDM8>NZl_kpQUHZZ7@ejdI3PMn
zY)?FPp*f`*n%y`WTd8mgxazbt$EU~|LTj3_I9?G)vsD@>;!!5@ebCo<uVgf52q*Q-
zs<j8ppa{@ltiY!}Uwy03AE{)9a`JoF;EFD?NK?|HD_{H5;(~d;JGGxI?C?S(dI+4}
ztQwXB$=Rw#3YQ4Kbx}&_Y_<MeaT%9nvpfB<2&bfPP7ju6c7}fa5L!F$9RxJ_kXI@l
z&**&R>7VmfX=jmczvT)=DY+ENj9#qhjH+0Z{HLZG9BBMqb4!(Pf{R*l$9*Rrv8**0
zTy7DC#$uA#Hr{CaRAm0?@Q-BR;h}MkbL=lp>mvlsKf79c>Ni16TWM8T2{Jd4QI&WK
zVeDz$-!$~5MVzf<ySYVZNW|HpmuYE_31NvhO1gc)H(=(+VUMQQxLjo|Rwc@YPHCM}
zU>fJq00jhznR7&V{2U2U!RFbYD(+rBZX%s6<}3H2+pu0<GrpM#LH3CAXp|ijDyFA8
zIX;aGUiW>h1gQ@0{9)17-(}njGxMQ?XmUK_%uAN@tep#;+wdwWvN)jc@k^L=qH^3`
z5Y!TlYpzk&HO87mt<c+6tb7inIyd@QddQhTtzd26Xp|7)*eYx<WWN&E&dNW>sa$BO
zX5hF^vW^EGL%XJ=;1Vzh<T?$J)4aFVSy5;qA%E?{1TU;V`h}3T(-Jeb-mK!C#Hv_k
zbT5Vla)3Ld#NcN1tW-~o<&hxKyd2edSGGaP&hgeE<r>d09`;Y<McGF|xH4bXpCzzz
zUOmGItiA-puS&1;xTY$J<x?+B`l8n{MIrHHp4*l3*W=EN94CxRe!Y!&cR&Km@7&+&
z{;{<YKq^dW<9{>%@${?|RqLjfTS=8OP^L2g9{#z?rF_*p8Rtq)<`c43F5%mLlGoR_
z=H(oKV**I%(1f!Z{R+{;h{TqIVJGXunl~|VPsFhM7<(-7-N4A0)P^3xCo_pSLPg^B
z9@^RSK>;?d;P-*^@K2MTgZM^vgHCkYe?c@sG&8MAp@7m=^eWPT$qBG!%t}w#sVYcp
zZtDnNA^*WZg!2}h;^C(gmCdWm)lqlNL*gB6m5zn~IbGg3-CchDT)C_H;Lh>r_QGkp
zk>zUMZ!mT-dr65o*toQH^SYSHPThJ~Gt}jY{%U=>QVj9+2^txB`!x9J*txs2#@pev
zp;L?g7XX4W5Ro~tdpG`(RQ|DF_cFn<U9)}c^S1p`f!nU@eDt-s^HLGx(DUx`a)IF8
zgN5=^(dXEMYx+__;NFAvlg$d$qdVpQvE<aID^vNg^m9zeEPoi7?9{0Eeb}e9=8V93
zh(MkV>hfG;QskuI4v+J1oD|%gnDT;8I4U9x9NlVoB5dY#?9%IHw_ng1z;k!J{PXtt
zJCMrmRZ_z5_*(dJ(v#Eu&u|q7d}5)MU8{D-jTf$ezz`R~*J3^|&&4Y#6C^~{tMgUS
z6^Fz8ho!~@f&lnB{ayfi|5S^qar4!H%;tGNkz<Q4`Y@-<o0YnUJCM#6-AbxoDyY%)
zcvD&7wp-Io0esB=OUXIAkD%fCccj*aqY^>y#;!*@@;rgsnn|9LaP9%DBeQ%F)};YK
zqY5YM$QY9V85PjJVoN&!ft!XdGPb!y2K+p?_a1U7K1OV@tNDdjS^TwQPKWf*g8u9O
zY2I(I12giPeS!X_Fe0emybNpk1ZV)YxM;P;O}^=~(t5}=$ACZff@_rEA|QrRzsiZm
zM%eh&PsI`0=B$5+eKAzAXL@!`y}u(ZFt}}x{p`+LNr;kwc6)aN1@I$weIDTNxf1DX
zg9)GX7HKOCjGoq|fsd5u34fhpds#G+pJoBo{t4_S^K;CF0sN*Qz(>Opfp1kWI5>*_
z_x^d&d87zq<3q;FbGI6~#=wSzcQqUpvXWNw`nc>V%k_TJFw^bD^>n!1kpuXC1&^V9
zcx(FU@E-W;z~yc3N|iSvQ(3!+Q3K1N?a?jk)aCv1nVbGt`q-?|{qk9oe5ttZ>~VVk
z+Mn2@<=y+bx7?{29{REX+M*3v|8h{;rVYONGLGD-G3o!Z7~iZhUHP&g+@>YH{PM8)
z-`+AWYSoRz71vl~+4wtm@AP%z#%{5tX~)aDM{fi_^@YPQg0aE5=W`x3lIwn6Kf~{M
zx%EY~$=lQavy*t2^*6nIR%Yn!c;Wp^@*FYgLVR&)QeU=Y4{psLy?8#$q&)>2vd12n
z+_3l`rgAzC=EP&BJ9uRWN~(Rl{vP0ac$JU*>Ex{emBss{hm|QfYs72Dw-M*^su?;p
ze$+PCX4)%nOQCH(4Vs|oxZGN)v3shk?zwovZ^fZYF}(1=(Lq?RxclOOqbZp<n$(aQ
zm|*v0?!chzJF4#+k_$!xK}VSzd4B9nlaEcGa@id^eD)FzpVk<MYU0fBX-fS6S~hhN
zFKY1lM-fiaMlpWvYnwuJC0R~F5iDL2PF9#)Bn|tjymE2_4Rp)K!;&r!rc$vq-V+Df
zsqggq^0QtX9@*09s677K1>?0EPqVc2dSwTUSK)yI$Z4$0D?#|79ckRz;exLo=31`{
zKBp4W*rS&r#Cw`+yzR|ss3Al$4Gb8dF5?o)7GX=hrBAkZ40`1wnhNc@tT%PoD*(bQ
z$=mde;<gg56Zkw`e2$8g7k>WlYD50>A*8RKGr={=NQ?v@T&gs@n=al8iwF{>h<$^M
zJw^Vc-{fo;R#9#u?ViQ}1#?(_Q3ieB?r@gX6M`8F1O-Q9sU=j?`h$MyHzN#rZuuA_
zWWzQox8Qu6ZPi0+>2q|MH7odlE$NObxs7;p{ABvI#f+Mlj1_NGSGAiF0fkZ<<U$$`
zB1@@YD4_-V3_B#Oai*jhsTZZc4D6#%qxy<J*F>OQ@sMisBEg&g2Mbv_CV@`<i7FrY
z^)MrQNr$0_{qryt+rLqEeJ7l`$yNJ@;38{$?$#)E6JlVn1xzXV<v;3oL@U7~q@%yc
zWOSdY3`U3&d|vMVK#y;riYQ%83I-z?W<FNFWfc9b$HfgSb>WGqGCNkMCrjynP1FFZ
zyO{hQKaUP2fG0i(Q;tpmWoT8fE}fF(Rh+<&&PHR6r)w_2#5L4F>%?=a^TvNd6fm#!
z7_SV_imGDR1g<1kGog>bp7D>y|Hz^MQpPJ8>`xR`t`-4TGTL(xgK#USFt76qC6>^*
z_&tTO>T7yDvir5%cABRm)p886cM|1aiEj2s^lR0EpmdHw5-rSgJjA4@alOx4hZ!I$
z{p#mcq=S>I$9cSVeBPdtEy!NGKh6XOr|W}|!4(JRIE1iseYAko3PxGM5s!vIWI#uX
zEg~dX#m^a;y|7#77noO=2rHb$F)EcXKOwIm=?@?9!sL=<=_nCxeoJF0;H0LLrnv*#
zXqe-8!sOfwyV|9O$yr}Z_ry2J0tNkk*_PfWi-O^(RkwA5YKspDtn`y?A4MuyW2?k2
zF(&Hu(pW^euI1$zRZ4g%`6DW^s=vfRt${zaD#^icZ&!Dk_n3q6BK&vr+;NVpDy{U>
zP$$vvmw<rGw$O|CZ%nb(H?4-8WGhq#3k4~5X+qa3AZ#)V=_8g|xrJTF3AQWD;BcG-
zU4+1-R^+0^=XuA{y0<p{tY=CQQVsgWup)vWP~pBEf{4nmmp0w(=84->Cuy_vlcedi
z)GSTAzsP5f9Xwad>w#7b?d0Vby`ZIOT;Z>edX!vg(BLLBrPZfMVn6|31o*|&45XKw
z5Q;}eWvLsfswVW}(}~I%kH&Kj5k9Npe;C8$)Z9<@`)8#$EF<Y7I4IQQd9NCnW+3M_
z@li$m@4z3xg_GhLFP+W+=Vqu0`qf`-h`sTG;~&;o4z=0Unr^a^)5p8NtJ4}%ig7CI
z#S4;%rB}W{>}3bq+ZoD$2ypfb!~!|W-3VsA-rVuQi}aSjuA~6!l!*D5lJY?CF)GkB
z!^2%t>=ZJBRAA1&f4{juNT5E6f-s04;0vz!O(C2FaKB@hE`%uq$3lpEF5G|BsZE9v
zaDdO>(p3=`zAIz>Nm_rZ3}oZel~>9fOnVDXqrt>uUhrJT?$ANKraPpH2XIJoh`9Vh
zM@ylX<iHB&+^$(64h0Ka>3a35-8g9q-`9JiL$wNQ^6nxQxTH{_=KJ;VsWa9&8-5Y$
zKDy{phrhEBD@cE3&{_9|7W;a@g5f@)@6-g?v^=OK46?69eCkAf!mKhgPvjmsJ~9EV
z6LSzGaP)*Nlk5wl8bg`Xf(*W>LNqW0(5q|o+QzS7g)&<BI+N5Xc-EnnV9JFbvedCq
zEz~+Nwj7q<Ne8PJ+v#Y6kVhMIJ1vI(o;!D^uP<b_illNPBky7mQ>ZqF_*21FOH@$p
zQog@%Y)G8Z*H1>_ZYvDvA2q&NviCMa-Eg}IxWMMsGz!`APWZK+@$H1P?15BVaO=~m
zOe)HwVDiz~Wa{Fia++Nvt*T<yWqLGvlu_Tp9^Y<}Ve#`$X`!}0<N=}TO=osa9>Lou
z%q&SY4R3TTTKD1moqdnFt}C0UC@z`+DTd;@+*`~SOXcOERf2{o4Hafm5h~n5W(zO^
zVE>;%!SbGV%7L(1mpW@Wl|-O6^yL7wBgYhz(c*cz4jQbh0x;_4k|iuZU)!#mvuweC
zN{`@DoXiL+88S;%!60B6uZ@T4C_ipGQ|VQC@7}cGl$CcWtuga5RMw<2Ow&LSD{m76
zpps^Zso&-U_tvt#IRV3HExKk@_Xb_cU?QHJP8Z)ES9SOHm;nex?AE+q*1wappjcfu
zWTObrS5av}zBEFHnJ7?N3Tpg$rg392;UCdo|7!i%n%Te$YCa2>7Z&#KY}Zd)rF4pt
z%GP~VaOi-~Zp&r|KR2k67&*$1b9$lrWPf2oQWrggR23~LiBns0ZZKfNWQ$22{jv&Y
zy4Suu`z5Ja93&$ui<g;J4l|;XF0%`kolQ?99)qL6>4_dsok4$bNRw%4-ZK>YwqH<y
zWumhcd)9tZEfHPbV0j};aq4y?ZB-p_v%thpFW|_b<A$PZD@$rBQ%b_hht=^!rS5SQ
z!L{`X(!-DNd8^IQ4R{AvUs!NuZ|%C%&PFq_|5c!!H#iCc43|rJ(&Y#JY-xI0@v8YI
zCK}0or?Cfqa!9+O4%?d}W9wB&*)+cR5*`~JkA>+>VEt0!?~}Q6>Wx;i9j)w8&Zk`9
zv~$eE-LMq$q~>9?V)4gX3_VP0*=U2(S=py6uYGfU?t|hx`CIpb<6+Jd=HPJ=y4-t6
z3)q7LDEWIQNe4#;&&L=QC{V|mBdGLP>{H~Xg6*l@SiN0q!VY?>*pJR9nbeu(^<w$@
zI7vrIEL{kWE_Who%S+W#z2Gbg<3l*pLjTu{@dBTBCQlIfI(@cedwq0~qh}rlOHgEp
z&UgSTEVRezRXqG;(ZZ*4rbm(GWTy|(S^U)!KSvk`8&-6HrS7{#O_3(o&|mSC5n=!k
ziB+lB`~Rj9?39xeRjU33LY1t(SJ#)rn_T_Tq+_~s!Q!t>nz0PAKm)2w-Sgk~J<CH(
zQaDATn1C;iTcS18J4XiU*ARkPcFnC9()U9l5Jc+eB=A)H@XP9#kwSkQ1WELiSAD?~
zEg?(bHYwtkpy?5;_F+luhsTsn1@6M6i<<E!N9<|*&b7-QKh}$AM{)Il_@+cgSOL2B
z31VY3JllSJ$}ar<%ssTrh-?pa!{(GQM-c7v|NH=@6JjQB990GTdh5p`b&BSBG-nj&
z_aar7O^Et-kC)qX5e$qIr-90W#~i5-gkQ-7xPyx(p&>tVJzGSnY%pzV39+pJ7iClR
zVu^-5ttjgY1q(!zl`WBI&HiG<U(gxGB$4WEHXrl)*u7U_`2BHbKJy~g)|p~)6jXt+
zkf=jkSp<l3#qOW7$aIB%x2Vq}fo}W;t!?YfdnU|ucqH{{TEwo;k%jYnUF4kC%m~+f
zU~*datHZFTaQO)cs_Yc&LiKcWfK)ybwz=syrtC^}9bz%7a<AD1OJ}!Kga+0^gV6%p
z*BRWQ;7LK-N6K=nf|?CWxThI#3?|gO>35{;+8()-CY*4S@Q84mS7-(&1M7kN{Lh%c
zH=BS;-z8QndC8JRnb40yQ$M!@4w_OP<n21t>y$&!Dui<G7kF;@%(MDRNV~Na?hXqE
zri?v<?vevr2K=v7dl)~3qRwKf)dWLL_y{J$sCW^S=iXIcI(_Ft)Ynko7DT@IKzO$k
zFx<4*HOODXOn|<}@rWr0X70jdQMc@<(C}IIyW=mfoWGHa<(s|y5mJbZ2Zk5-h2T-;
zJ`y@GU0%B`Wp}uR3)`=rxfep3uIaIq82Jk&Nf}jwmwhK(VE+wPg6*VrqbAwrO}~8L
zG8PcXv80OI^=`!vLYgK$m-N7;^v22~SE?PR{YFP1U5G>s4WzP5WpV~8NzbGAJp~^t
zyUc?7Sq>TR<Ybjx&S7F~Q#<nFfscRI*V+z7>dA+_Z<@k3_zA_lA3&gfsx9GBxU~>l
zn|(xV<(J@)4*vo}%SA;3JKoq^-jR26b+%?v2+sEQY^sYXD1ZY_soW&7*N}Uzb!_E?
zCpzb>qRpFnX-}m~qzhLQxzEYdXNbfS>f#ZuT8vNvX)n)jLlx%3nzQcVj@1_C=jIH>
zbU^gS!J(!iQ+Aqmb_zh9C)F%GIL;^0CV|cAuz%AVZ8IIQrmo@@vG6GEy}5&oP-GC%
zQAK2k{PRpqg=U^ky7Fz%`UO_3u{PvavRwVu6M}Qb3KS-jEd|8@1GJiaG}Z~~g@9c1
zyNmbid^N9c#!D&RLm{B45pGNm#++JHqTz{byC3vl1%BP4l{-uc*~2k?T?Rk@hFNSl
z;$+R6h&4f5UaJYC6+VOo-=GkbUz(dPio<v>SNsDU|30^b*v+}P7o^pzyI3%Q_#dnX
zLB8kuAhQXim&iPcg2T(H{^Q3$4#AGY%%EEgGV;>EwRz8~#&<Vi*U?%krq%X6<8vy?
z5}<q}KUGL7A&rKrLHb*Ob9#h)yo%?dp9<}E8w3y=ja%r4c`4As6bqMY$y-VSSh7%%
zBn!@d=3?8VJ|>rtx;01$1M<a2$Cay*u%)nMX&`fyW?SO}x7ZI{1j{neo0hSZL-p9D
zYd)#%6on$UY`)iNoQ|SwRyV6BX&{+J+N9HLP9^eK4{bx3$!Xy)Wiqtn!*G~LW*1gZ
z8nBw85)>UBuV4OyA4`u;)nvoYw2}&<!|<7{P4CCABf~0t&X1QYykj}4_{cfNQNVkN
zA?%*ot|!RP0ntj$**uMotewg972e4*_N+{qA|@#@%X~;a-p{nIm=10VVlz+W`a<IF
zub)xOsWQt<{480}SxUNk4#jRtUwC|e5QOTjo#I=O<7#6cAAW$JS+E|{R8IwfIB(Ph
zo(E4r3r=(p20&;Bi61*cx5ZPo1#k&Nk<&+rG?Tu>m{s=H5qN)~Uz+Z$N_tkVA&4NA
zg7BRqj*1ZnbWLzBK1|%`b|wZNdaO&yBzgDUftzq(z*fA(a7+-#{sht%#bP>*bsU;>
z`8=-F=u38WW}>GMsPoG;t=XG+=G6Uh)c!Rszw*EkjzMXTIN1UDlNY?zFhJvj-^>UY
zjP2A2C*%hSqY<|npbFWJ8+K{kSL<$&TtDv!&TUgx<!py%ZN*sOWVaa6;IW5q=#YZp
z?M9<XL-q_`$7RvP)S@wSm~x@-7W%IHUAEXz)U8cLWTi2X#70o4h@Ul)rOqP<9(cI|
zAhHRGDDhsOkZ3CYz*y%zyJQua6*Y?StYd4CM<Db+d>|x;vO0UAzvu&op3L@Z8A)R5
z9Lbh5A`P<@tMUd+i#)(T?}v$6_*=58Dnj@Y@7PLBNv_jNpnCT2;HG>DMEgwo%tEFF
zbc`$-c*uXSaP>zB`CGw?e~2Yu4&8<R-GqApaPqNk_QRD%p`A6t0pCdZ6v!ewrHaf&
zyn(+EvJ-t2dj6Ig0H(TUng%n$ewbo5H?1pRxVGPz)dJOfOAg_r%kOPzUR!0~7|<!~
zB;JIz)p3ayBuwLCFnI%pPsg|lOYq!eYRaCZ)`$-ST`o?$sR-Siqo;L2D#Ua?5C<9v
zRmW=+lR-v#=A;-?U#n+oX|<L}=gL>eFzthjyc)bB{$-<2`)o1>1+Wx$5NJ|U5ImNU
zlnk2C*_0P>t=&_MSB8cb{^qhvlHM5&R#*gF4h5%BF({+z%{#;)e~$Z*A8X75h9ef;
zh55Gnr-enZ`m2r>&{v?tLSHqPJEyR9F4{u*=Cw?%(~YB8Ocj`xs*cG!V@xihui66u
z#+*<SMWZzpaR)e<sAMkN;E(xag2{R#3&%uN5rs$gZ7xRDR%S)!^Vu3515rShk-}AD
z%S08r>=J(Gs(+q-R#N^#!sPJL;67TPC1R|jm)x+d+S2kXdaMI1*q+TVW#)Zt&x4lg
zB`VFPk`;E(5sf}<z-+s=xvjmKBdx%1qMw0m*jRKEDa3VD?EJL~q;NDFGwW05oBMYb
zI0I|qp<`6?UUzZBqx$x_xRQ%>@U8!Z5a2$#v{Mk*Tp{X=+_Z=Vs;yR>sIf)HwvH42
zQ5cQOycdOwa`A+|l_Us`(``zDhve$IbWYO<ufHamV|vy=ThvC3K7I~d+SbN=<wQhq
znDfMH7iTq!C}+()ZM=u9?zrBP<ry8>#eYpj+}{JKmiY^?cRXp|%{`zQjd#hadyqey
zjk9zDuZ)7%(DPX~qx)6G$8z{AK=aROSz>9KdhvvF*}9jjd<x>y`O{}1CYbQ^Cfc#*
zs4&Mqq6_HQup$j5aD!sLO=^;7Qg>IUiRujj1fk+yLugwK<0mb}+Ccch<MNXIR`azQ
zz3aVKf9^cl{@Sj-4(9x(=C%fF(7k4c<sN~y=t;ktrZuBH&c^1#eT~EM=H=9?Lg@m)
zRsDupKMQ^ECeM4GyzV;}Kcnm^oQ9ImR_$#1r2kk;!24^&uqE*yce^nJE&`Yqbr|r&
z^C4MaBhs>MU(G9mSG;~`%_aI?$(4JgA1DzNnBqxdis-%htR6zOkDP=RbDW3AdhHw@
z6;jj(c`!`5I4K<UFn!HbG1CK#)mk_XBYl%Q=T_~|GRs68lBJ~f#i_hoz5QZx+Kz#)
zyaxj_N_jXPr(_9_kfv&ear>&qrj*hqA7u)O%L$gPq02&}uun=g`&hkbcdj(O)!|#*
zOwe1cRH!IkoNackY)S@FG<SV5HBOwWnskU0C+VlEBSX1uv0!zo`KB%#CNwj1y~okr
zRs(1s^>kt1;nd<NI`+eHk*l7%UtjPr8~q4%lvG<t_x``5Txh9oOC@8C7A$4@JFZKb
zsB%iy0t(H`HQ_ENT#;nTzD`*6q2NnJOAEUY@1X`Gt<vy#pNRR7x`5~<Mvjc1%h0=2
z?&inY_us>6k`9&|TpsLX22tf<Gh3%W0aZy!(YNaDWYVIMmEy3rBV2HtM-H6v4I|A1
z>2Nv;$xTW62%?NgV|UHm&uG?cFcJrPhZW55wY9i~RU&XsgO@Lke417Ohy@+*;mHFR
z<w%*5_pn16%NTFr858%ZxPQdXodt8r4Wd(Q{}QMkFds~w&0?ygJ8=$i4sW<@qz<dX
z;h$W1SDb_cX7<f85ClaDNU}j>v!!?~=8e7^@Z8o7WH0Qc&>oeKuD4_4%ljCP0QXCk
z{LyMdrR2qPRWCY3Ditg4z>=dMSD{Pj8(u?uXzB@<QhxBv8T1>Kx(*@U%nN<-pNplx
z0@(HZKI4`?4j!pXgU+VZR^T2DrbzO-YOK`t)S4&BRTVW`Pz+TA7}*17h>UrSP1XVh
zg%xvx!!KQ8tsu5GPDfzTkWf6igBew9kzWKYR1d_-d3sGGhv)8%EMWsizU&+?r}IC|
z<1fLT)J(|Dk;vDuKxFg4v6mgRFQ6a2xvscxe};gJ<CZS1^^f(+xb*R&1h(^<9=m}(
zt)%}jQH$p_BAM)^97lSV2k*p7tzJJJ%qTzEvlxmH*9OECQKws}mk_axZwO6r5`t!K
zzDIUYlbZ?vf^HR*jXS9G00anGE?J(%?pEaJ6-y;JQqU3n#q-iXdtJ-QF_KWwP~rH?
z+D$F;>;*0S(umYHzwfs9E-)pth}Q9e+CQI4d`cmr6B{?^eXzjiyL`n%&R%C2&LIt^
ztGoLV2KouS6ew+SP=Ot|WL2fT`s`9;yFN<i^6;?25-{Z*n|{F~|C`UBaN=fkCYAn0
z{+(%ipwfEto>yvOkW2MI3NT!BtBrS$c976?R^qM1f3!JrV`&T;3}%c4KM8>qC@N<|
z8W`L;jw4%ikW!wJbG*k(jxmfk1&v~yof%?r?S_N&yQR<}S^@}W6^1=N$5Ib0tH#Uh
zH`L$a(O_r0_y5{dYEBKX!W6Y!uw*h-Ki>vodbAD%Pw-t(g=?ZpD<fwmRwgvpsY(6%
z)dis`?3rP4mdK{b+yh)i=d+PC=zVOKOk9e-EE#qg;uUt!p%RQt=194Pt3_AA(&<QQ
zI4)q+8Rg9fUjT>Ayn{5W!1poRF;ut2s!6VHBqsl{fdh`I8+$#z4wg(QiHm8pjodGX
zju#ke!bIb9gg_Jqd-hv&VMe1+V_OW2E7C@`g}9%ewq$TL8*+ioQ-l(0npn!oQrt8l
zNjU?P^e`DeX-M1`4;xc=E6bBiMWGLC-1S33_?O+X@pLwbUt6-cx1YzEZgjJ8Ois)0
zeAC|B7vtkAB8#=UY*289#5cR6@$9+*($`6-EJUSsQ(-m4D9;;fZnUYgg^kfRkIec9
zI}C9-6<^IWn?K|<XWcw=`eClYm%|Njrt1K-zb-qv*wyEi{KOb|Kd}7y+qrv(8*IUY
zcpSJs(M&uIMP=>jK=Sy^(TB^^IHcU}8oUL09a;ZTkTns2eO~=#dZQ{}#7ap}dTFdm
z6Dhsjkl$cuA?m|r2i|Lk7+N&I3mzS0b?H%|jo{?8&Zd(Z+fN54qlAIj+}#E_{&T}`
z=hS@3L$gtdphQsTa$Y3@S4M8$b_G*AdwDX21jP}AUxlLrH?a^T$~x~P$!aMsu|cDL
zN5yLP0UZhk&e9io`8E}Et?VXM^WEK`lba4Tp>FIt5@;iJvz{kD6?$rVaku<rY2sj9
z98p7jzjhb0BS2v*;cRyxkM`@K)yq@EACAE-aW;E^ExdsF`fVD1+=Pp}d?$O6VOff2
zE>wKG&bO&f#X)-{Q;o=nAt*(tZ}!cgAZn_xPso^w7W^zz+|>7w+}1oiYENg9@@3M@
zNoZz3UGJ0ESe#ZoeqX=6k!c(}#q}#48fyA5iX3-c)M9vYlK%p3dYgcn8Px|YUw-mT
zXZu~8ZZ2Svv@-M*Bkd5PEDGduWh8{|IijF6jL4PiImlLbvp;r-<>qLOzqJKT!NB(V
zupKjel#w=qJves9?rlS_2dLe{o^3-S2+OpLMqCzTJ#2b+sK~FD8c>G0Qj*ZMAKOdr
zLVN=5DClIb?=Ud0C6QZM_x{%s5JM>4k1T4+Q)3&k$rH67ou+oqOAwVoB(H30;iJ8s
zv>8#pObuBS<z+bn%$Bgk_)6BJgMxYd9XT=bsFP3TDCSm8ZXrL}5J5uzvV$^XQmr$l
zsaV%$k*T+uNH~_2JU~SQ8%tbzby~pY9@j)vSqndxMwO6>VHhmxcF(6Gn$pd5OuEca
zo?z_a@I^IhFjXER6EbeUEJhcTO%-XD82i!bgIaeDN(%jkJj>lk<phN)_{R1tZ8+Y+
z<qqE{6|1UDmb4*Nos0o{;~T^%yu4qVE3Cn&g$nyRcQA&mE?1wp^^sPQ0VN^NB@WJr
zezr_`I*wkwNG5Q4idaN&sJzutl^hBtswyhE!Ih#LJ{yYyf?HUXz|rm$H|v3LnER0)
z9n&RII$+sjts3o`UdORMCuKCRuKsO7lcz5;28m{-F9+eBqi~40SdtvfB~-?=-J%!g
z;caxMqq+4j7c=gwR+75b5Ik?+rK$_U$?P4?@9B8jbmAg8^x<=K-(2^@+j(#(t(=a|
zPsRt%2OWU$STj=%+Cw^_h)ZT>;spTsKu$_$Y3sspnSFLC=GPIF_~w(BpKrJBo?Ko{
z*e8o&m9ju|#24`<@s@(ntw%#*OQGpgI9lf1gUpCGkHs>c<(OOd67SB9v(>q!BSc)f
z%Fxzt^-?^!_ouu1ZLe-xHvRN0Zdg5a+IHGh(TYbLyU)AMQ}6B?4+)rI!CQa9cQtX*
z$vA5yvC<^M<)!PiC+YOQV--)0b3z057G-Dvqv$9rryI|o#+vyc+tLH$I{L;CT#h4m
zs}*HXg=KnwoRD})Ql!*O+=g>9bQ!d3X_5m*#{nH@Jl621`!Nn&3v-^%CO02g-)`QJ
z0LB<)jhtizhm_{>;f0Y=(o1LV5Ocwm0%A_Rh&1MjV|%mGs3gP{W|CqW4i)pknL3Y|
zNJx<EpWBVnx>6VIRfBIMpFr;-zJk1lG8fdpqT!#~7%Qm*`aRx@7IO@SCJ=R71=E&Z
zgk8x`-`2>+wn0M2@{1_nhd9C0+m1yXNl3CeL)puo1*xVVy9F(PrCmp;`?rD~FZLq>
zLsbwQHtEzzp21CyKoD2336yOz9xw<qHn-|r)S~gh{7G&TsFtT0$JY#Fd8h5@dNN51
z5t5Mt!@Xv!O(kL0+In0KaYWLKz$O<bM2s{c*4h&~eZ%AY=!tfD)UnoNjji7ahG7}d
zmvHBpA?v@16@zLk@a8S}(0cl~L)gtgwF4~-r-t7VU7&aG4yU+R&o`GmUuvzzoYQvi
z=~0^FsQA<d4DED9ctW5qkVO@11HPh3XbJ)R%u5~j_wY-4>zb`_?!0!U59fV-f+nMI
z*X&Z8exxG=xWz<0bgP6<qqpr{EK8T%*Jg<qMoFCua6@gBl@)8EOxUc-_l|5Qs}9vI
z*|L?$0jVpOkjIGA-5%WoaIoq|Y9OA5=rZs3$ecuYjtHLcC@dN&KDDT~De4ufb?u|+
z1{0o&6+62gvhGyl3!2g3guK+<{MbAP;7>R*+Wb=LPl9ok?T8hC&g42$GqR5EUR-pv
znse5_`uzn#lSXcJ@+Onq*UGOQ;3AA4z2M17zlqJPaTOX@-AcC~30zu-*=g`6)qy|D
zli?^NvgIqSVLahaI;%Wfw)qO;1jX-8V#Y%66uP`_JTC2w3(e5&PR8TQYn+V|{Qpc?
zvmT++xDTaOS+b}z%@7MeR;5!VGOn_!yR<e$<)>F|<I|@HZIR9Vu4PK!+|3>+t643b
zj2Gg7{&TWznE0t48h+Wq;i+Y<bCSop@EL{<eq5o+1nN2B-ExXEZSJxM&Llj>Q3J7v
zv)RZrmKaX4K{}7CB9Sg##w4S}t>(4MXl!b}lED$w(_m~Yt~l6iUxm}%VpgUc1taL+
z?z)k@1do~2y;)3Sf9v#XP9Z<#b6Lbbk@}kbGfPEIyJ7^r9^Nq8sMUU)P=&dZ<*JU_
zMnY0C-m3ZX%YAWpGZ`Gb?`GZR#4Vie@0bS1akxG@^+WkRj>YonNuBNRRh;Rg`V$1#
zjHq+w@uhGzyjstuLC(R>8jutDQEj)C8Vez($Z-DZ=`|&%KnMCRu4cjLU2Kg|QoL~5
z9B$&<u>RkU=Y95XZR?TQa}EvLC9X&3(s(}$YIoUgSHMdsx+orFkV}0`8A<LA8t-g(
z4EdAe*Ybo+0JfASuL1O4xXfLb;=%(mh?k-+wN5mY))@KPcQ>&6&}x@|3yAXQvRe8%
z-qxQZM0`-df@jY~U3Z^8DwpsmKAR5p#_f^1wN>Uzs~=|&iYm8dcB~Tl-X^?k6_xuw
z_}L8WP}y5o07*?+tG7I3R4dk*?h-a^>owM3iQV?_S}vF>$ZsRuw5jBFtt!FpTX$hj
zYA#MSrTS3IXpFYY+P**>sE*VQn@9G{3*t=yQHo&Ui>B}O`04f5j^`wpIp+iqm<xq2
z+o)yH!+PBKYmMr34Xcgq7f&YUFgOlZ_AoLXS=Q4EH|Ifdylt03*4#brnO?JUd4PMX
zkZ=@fbNqQ5D7Ubr>Ii+N-)VeWYN<)_cT!|*XI4$e4ff<*$jJ#>v-8^Ah#_GDWR@d>
zd$`FwlaX2Tqp?zf&vcS@ChoT4?ML~9FI*Ur4ShH}ooIRJ04ie-JGlA9j1~ig%$(A>
zpOQ**#$vcTo!zh7EJ@U-TIw9V0H}>ob#P81Ms>{mqGjxJW$l;Ll2ca(3^kTfZD44;
zwj4g)baUT`BG2=F@CCNl5gh=>*<c{8qC}?oi9+oFm$2fwcF55wPiRfs1!7+<HpCu@
z1FQ2;+^RtSp9~Kp!^h1nu~?Gq2ShU~D|*?vMe=jXk@1k0>_M1Qa#ReEt9k&2VT4(@
z0pkf?>OcKBv>9-6Hl1!$*UWqpG9lVDCPH$7oB^!3DyzQYnU~BMI8tBlWdM3GQbca1
zFE}>*8c}xs&KR|ysG@^pXJIO6g)z(I((ZffUh<}%#5@&ham<jax=K9Y)^6)wnI`|t
zZcYVB#o$gHfv`k^Jen*^hlMzqyU<c1+YO@{K;~&K8!t+hJ>qFFNiH!dN3J3i;?4*Y
zq?cdl09Oq2z*cj{fIWFy1Ov)@FfEZ8AeUVi9rBI)fJ#z4$rg$=`?`BV|A*6O&}le2
zwP7fb8MWu+luXbVW+dWYz*qB48_$20{cDF6@yp0S{1>n~D>)zd`d~6}W8b3wkiB{U
zPA+C9<|HYSH^3#dgbWETy-R%9ZvdCqc0L@ZUchw2A*wl5-|Ktc8gW7XQohzQo*LT2
z>Y7egzF7tx)ZzXCB?`_(aWFh2@ah7)%sl2$KsoBt;m%O;bJklTCz7?aM0Ka7rge@^
zO2>~wxFbw114F2MWoFNwhC$LD_8<YVT^k#Cc>%)r3t6ZM&r^cBJ=p-;E^}&@Tl*ri
z<@lh{Q{!|mv-yA`GXZ4G^L=HgCcaA|`tlxFed<1zsms@mB)D~}uAilKy%Uv|z?yVT
znE9lbx}%7&#i}8~GV^L}XrsP3s(uIhPm}{`);Vgzs@?2!Enor5o%h3ULz|gfQs11)
zC&aVP4qwWCFpy6ok=uIFFh7|svhRxA7F&y{UW{Ny1YLB#Hl3o3%*v>(S(9RG$U`a^
zK(jFbnrJP?#jbGRhss&vJC<$G(&x-x9UpyH9oRb?{)b#C13kw!!1FFs&`r;GGKY~)
zB^I$k^6t~?JeIrQ2HZuxS}M=**2d97?r7_{b_CZ|sxRWvPbs1{IVJ5(Ohhs^JPuYU
zie56+RuF%4k3&ol&wOJ5xpbb9A;srPQYVezrWQl|_n)=e%KOn$(40V&RsZ|Q7K^^C
zvv6#+RSqGFO92uBdwTw=0^}tFmTR@x6QL9?G0cTRjns*8#}06)6Q{6jjfcFH%~5Wv
zj1aRseCl_`BQaB`Z06U@9eWyD7X)I&z8IFJej_*e-$6%W*ADrXX}313shXRq2ebaq
z$3Y#reNtM+tj<50^`DQ)u9Bjts{Vt@(HsT(-*baEtvQ@(WC7yk8BeGoyV;GX^+^ik
ztda8%Jgi~G9EzoYqz{$&5b=Q$o>q}4Fx${#&doJy*7wml4{|1!+vH!C+ZQ35y*h~q
zJeDkFPm2T@?8P%{#EQ5ySNMjqmR$oy$;@`5sE%+A%?4o`PNx9v=X|P!g$=iE-@<c|
zarHc@rP7xmh9wEjb?OM05K4vPzOE-j1)Lb}@5KFiU;b(CmG<}s&a#8GvkNVhf8dk{
zsIZK!9A^MiR|qZ@Wzv)ITci7QtYbm-Ys!{G>T6-NxJFsjcemcX*&4Ra+A8z&1m{xL
zY0dCkcq~PObo@*;v3q(*yUJRF?xGsc`#a$@7WSIWLHP*Sz@+@n_wYx3Gqck~nDgkw
z9}%DA20T4?#XjIKvxC2ded8zYM?Pk@klFQyd<lf&O2lBL41plmeI*I4w`}0HAxyHp
z1^rXp^IiZ*-4jMy_Zs)ud;Upmq^W7rUk@XW{at=q595Zv^Dz<kSzcX1Op{x`9I6EM
z222ZKm{E%q8C(aBlMhbbvr_0fLs4Np@_ht}eRv*!B1Lyp+1#)YA{^eTVq&vPF5r(J
z;7+ccWs+lOyOSdi28EbtCG(l7b!g&XhTou6@+Y%;EAS8g)_QA5i~2_^t-Rwtm$Rp-
zuHnSwP1?kO8A_+XB4}1Dg>5iwzPzr#RvL_`R!V9QOBZ<+?cyNy{O!2}eZZrGQ<$=F
zYg?Sht3KO_fQ2+<qfJ0IHTi<;o_^PXL9x~-84;oVN55K8jU~N$pzFNbRtjzkeX7>X
zbj}~4s0MAMKW|cX#VPU+7tq*ms0W0?RKyIzm>N)?yL^GW4G*h@h<m@cy69unznn+e
zAn-_lvV8J|--o_Qd_JkC39v5}LOAz&FmHFj>w)OWPxd+%V-ad}B+lS)7Grfdr6U<#
zKBZ-!Iq{rt2pSGHO$1ecXxHHrr>u@mUk+R6*F|zmO_*v9#}6V<<uvLpL1%`9Gs$9o
zKyF#BB4u@B21syL8)L-uxpx7ETJyz|*xnxFp#@n;NT_ML)YK(Ku*z>lnVMJOXMzW>
z=}sgQ&C<PE!CMMigSrh0iri%6{vm&$%OyQb41Aa*=b4(Rwq-%D8EouAf_YjQ@f-&a
zYq)oor;oP|bsKyY-G1&e^be;-sTh28{UBxr>^Q?50<0OgtosoAguDzoUa7i|)Se`-
zb8A|YHUmZ1e}1+FP6@`#hL$71*q7Q8twVHea`*0ZRu`CY9ho&K9L@N8(8*;2m{n1i
zaV9}+X$~xn?V)7nQ<>d>Bi8g=P*^oDj|%{}L&Zn(dkx@Td<Cfv5ne;cCQA?$Zp;S(
z^!4d?{EUUC^KeTQ8NYL|FOL*%RBIw(7I9%SFjzQxT2@t!E>Th9*AUo~h~EnkPsohX
zRlOBxoj6q+M|61L2^d`=F-^H?lbZtWZQP5W86{N<UD4?m^s1bU>Wf1-&gawF`N!}d
zT~f^>tS#T@h3E*Q`O9)km8P)^6Gm`9EL#5#?Gw06%8H+fH4zaB7-ON!us$fVj>a|2
z1zx)Y1p7-uaFBVf3wEYWw5M!q7kRZT-mUgK|47{6j^MyRT-}H?H_x&x;+~r<0t|cd
z0R2Yz*c05(ONp@9c&Ea6ghm_{!un+1OH%OF*R5$N9evFP`Ny#7ye6}yD;bPt4Kj=H
z9~P)#aK+IU21D}S(`${JYIPXG4^1z7jh>@O_LKH-d!~s_VKxxO%8xEUS65GhzE)($
zU-Hre>L5tQETtA-=5KW{g*|HCmp4_ypQW*1OXG(56?q$hXDq_+A%9kK;&C6I!D?Wy
zFBLptC4?o}{#IRq7>J}|O#AwJzwmw^U%`AWxtmSso8Z}oCpS!&aTiBpnhlN|ZrYoB
z3;_KQAr#hA@AmG4kV@@0Wp3pJ5U~dhMXp=_Xsd~H(d@DGPCEIWm{7j;u&c8=_(9K?
zVxQHaxA7J2NOW2?{|$?TK})@`guA`fstw7!Z~t!hY3il2<c1XUa~xXd^oVK~z_i3S
z<A`zP!R4wZdpCz8=Ks}*gl`pjFvo1ha|9i6`CR;VW>&vJMb5VnG@o67#O(ps&#%`#
zgU~{&74B@x!vHrTF)taNn2r|Sg7w)gsp;&8*t;9Q80#}$vzgmOz?{XHb&z6%`Jt^c
zZwUWK9aQu}aQj{&kbXts?Mlca>P4V9Pr1FF2?2-*y13@7k@E(;V$&1s)iF9Gv3kC2
zs1kw?fCXMv-!#J0|22WnCbvMT&j`MKVZtKmyT<XncAfb}!G1pS4Ye0Hj`i4DQeDG2
zZqenE)(uR>`a-LN`QC0T<W?=U(>gL}RM;@(ZYJ6CyTBD(K0Cc;!+2zoh3n1Y0CyJn
z>F;t%G6WYSe+0emw+1O6BIg4#%gXOrPS?q!A&NVOQ+`8=9dp*KmI=o!P<t8H+Vc8b
zO<T7H14br<yTIc<Ju{o097^HPm)tc7%d+7p(EQjjsb+6c3TiGE%i?3(A%@|RzA4t9
zrwl@v>+rvWy7-)MH|r9`y#o%II}R6vzn~m6q#jUJPVeZ?@G<7Iu`~9veUZ%BEXxP-
zkl&qVZ$>H;3eqa~&p_qV{sd4ASMHHB7x_$Yo(-N+99$XKd*J#tUmM@-!43V(*|~mP
zSo444cw4Dr9(xJj$2d`o8ZM<AXMA+H>m8a{xcd#uG+-Q_X;d5(F(>_bGVk5t@TVN;
zcUJTy6n#-FN)Z{|=A+X|=N4OTpKyFo(@{<zB!BtPBfR%z$;b0mv-5o_uY$feoX`65
zY~!<^v#6&I%eD#}6{WnErb9yQIh(jzqqTqJ{zCarkkoH8W9p538GCFhcPyh7!;GC+
z{eM(xwv?m_Vc&M!`|IJfS^1{5IipX_=$9=|8gck&hNy`Qor?G}2~nS3THM*_v<NVy
zk@C?N(_4($e76_GBLXWxN8fjq9-d14SZr@Bvvp}+1qjs(XW${%^D_zeSNvtr*kLhF
z&H%5;ye9>bnpCu<oRP-~MGZRNRc`l4In9#?FHn}8F>5EafUiPG+uuLjlGMjuwKQ10
ze(OY#aw6exak=e#l;v84Ir`Ii_YVyf79T`|g||f9E@RQt^Y^|o#XfBL!Sj%jk}(g7
z@zjK{zHO`(VC50M)<$;pGLszJn<2{(fJ59PM~DoP*0DSKio~y&3qc__lLsj?k+5GN
zpeeZMH82bm?|1Ir{)oeFqVi{hZRJD(2?1N27-)?(zJNeaTkfzLl=5E@H$m|!o(@Im
zMJzNmQL@E$DkJNrCGb=<)Qu1kC_{~p5AXd#nDY_hm#{xDfI6s(;Lhrx`Lq;Qu!4jK
zSx8PeYF>9m=IVcyZGWYo-MwWAsmOI@uwp*OU!XyAP4C_CLq~Uq!f(^aGe4wEqGZ1{
z#P-7R={viZjvNB%C?eR$fx0R_U+3H6zx{s^PxbiLq5BxDS-}+pF9I$yvyR^-0Gib`
z=8N`Ss6<x9jBjX`u%oODt?1<GYU5`}_FwpVnAI;{txlqA0XJ93MC`DLCIZJ^Uzi4N
z$98BYmar$lePP$84A|?rE;CPxh<jk$3_1CdkzgjEA?7mv{Nb?7pB1Kb0i$t_kT4ob
zWO28B@FO>wE5K{?0T|*y2af*IgYru}X_NF(YMEkrhp7gN4P%0sH={rd=D&w&`O73`
zRG2=zOMhEA<VDI(SxI1^);^HQ*-5x7pV>7uM)Hst$kxC;8y2E*lQ;()hgU?OkvvWC
zB63(3qg0KuecLRAfFw=NUB2z|%8J%VdL<d6m~hLfkK?!qk)N}O>lbJfPWsBhda15+
zd0F(2=GUH?ruS7HOlX-LenJGr8a5*mp^LEJYnY?X4GaMfNj2nLoHzM}O2&o^Neev+
zBZvs)#kG_trOa<+bU_^~n=)4q<`!nS&fi*4lLvNxJX}4!`S?C%`ywbMAGQ#LmWy@&
zW{j?$X?Z>Q;Jyx#M>`w_^+cjUmct>x1Nq}@)*ySx!7M^Slz?#3B-iA0f2@M?075Id
zWqAW(pBf$`ibv|8pGEDV-^(A@v-lL8Cg})*#^AbwSSka{^v_};nj5EiF+-bkKb%p8
zg*@4V$IW7OuaaPW?Q;he{x(vhkC<!&EWkg<&EYLFeyg74jj6p-8y_e2DZYSQE=C7~
z=u2+Cnd0$n?c?qHR=KnYN5gQNDrZsb1i?D1`&7|OyZ_C|MJ)Niv^Yd8JMAZPZ;O$?
zaCE9T^l=QQPJ`1C*5)W~b+>%6pjoOaM;ZWg2d+H85O~`=OpH>tXl6tT=H7Lpbos!I
z5dfJ87+O(AoJHf67>a;T&AAEc^i5b_ZF317-_aNov`Xt>qH)1!8i<IIJsyz9`a!ab
z+c!;&A54V!9yGmd!wZ7IGJx~t)j6SF@A>f9NF@E?gWbVthQTx(Ldb2)Hp$|A1i!{1
zJ&#-*p6KVPR@DM~C`-VXv)V=zdT9kNYllTZoe0}Vj~XBq)?5~64O;%uZl6}j2%wjB
z>6gdeE2aduVG7mT%6hKtrr@~?gZdzB>ZHDA=QCg|2t8LFQ)>&JM0H`yZ>gwdM>BC@
zfa(LayI#PT5vXg{(nlm#kCoMj)A79#Ji~n&S~pESF#-0tn4AekEV#qytL#_d6Pl}N
zy#6M+>OlMiK^n}KN`luG%O`a9+{2YO*vNJ}qtgE>Nyb1nj=jk}VKlvq5lJ~f!HOFA
zK$6`wXB87u4J8r@(77s{j0r%%B0U_K4+A>N-{4)ENu80W_^u4;yO}9V@K9e#Y{KtO
zZe5p8jVlN6h+}Ja$KX>U$~Rd@z>R;v!F%sqJ~)r|-~{;GTJbiw21CXjL);-@7mjgK
z{ru*kNQB&JiJ+3a?9VvQ)P8`=a}6paDvp4XU(K`1XLx|BlMa;uaw)B6ITd4Fg)L~<
zhan1ewMo${4n$40Mq|&i=)N}k3NL`>2Qp)UYai|l&bP?`$nZ$W3iOa#T*f-FegG`7
zKA7FY?dpL5`>`CLK$_HXn}t$0$z02^B`VP|wRM)=tu)$CH*z&q^m-c3cC%5{<%i|N
z%ns_03|9Y{jCF+rY##gGVZM>szq2-lL>*e4S*xGd=D9WysOPp<oY63(T{a+zWFeLh
z!dkhKVs|<@qMdSz`aOLd_ssrtHp~vzo%FjMQ@PWP-fc6*G`G%;-z#M?OjMfNnFX~@
z5$H6GaEJ6Xs4mR|NTUw0H@Hr1Qj9P|{Wy#ls{W6scaD$jdD@0I*^RleZQIVqwr$(C
z?QCq@w(VqN+t_4+XZHJh@Ar?HQ=ikPd#bLkIy2{*>aLB!f++?`XBuR3W%-IE*!lWc
z9-}|sy<mLJjH*hTX~(-lDM8srvKj@gqX{`R++ymjc8~aV`Bwx-jk-<A;>wjw1B&;4
z$Nu5`%+BVhZov(P_&XFspMs<o!lZrzB$9@%5?0ITjIblA(<n+dCPg*DTT)tedYs<5
zJN<NxZ}TNR5Yc2qTZ$&!hEqFtSihd<jE3{g(9~D?8?I8}Ed+;uE?L@QN0t6{8`&#$
z77xz1Rl4fcMe*xT-ZtrUh!gLqsk8mXNlnBxT@`Q&qVe8|R<eZf+*uoB^J&S;H(^dv
zQ>OdG!_M*8qdl7|zk~|rvPL_BJ$7CE!?{x<59UxQXGAu~)1Y7Kqh!)EG{~7+j5*7~
zGZkR^hDGrM%XxDzdthgIYFgDgnoNEDVd1!q_^iObxZ~`|)`0wy{LF-b;qPxZ2sIuq
zOmVwC_O=uI{mjB0shtWFTCH~~7XOna6@AF#61T3wVP{$B-!5SX17dX2)Z{BgdyEBc
zyk|-rY6P1|VKOV?e1gB3olB%rTQoUqxR$x4r#5~r2zHOf)vh~@ASmG#+A;1JwznBU
zqz@P&rzrA;PmEc?w@O#lZ0xDI&jiez*S*lCLX8JX;-rkBp~3c^)%A)&Ns3;IkJ3|_
zH;`Zxcb>)DKyAHjv8VqWi{>DVl#s?tVu<1EQnU4ZEu~=WxBWdt!pT?8N{fj+SC;n1
zy-NEDS0YRjoo>~{Lw4WR07k+RyKb0MFytISYrT;^AH@7eu}soTD^l$uR=RF5ImMMr
z9%FI{z6O{#v6@-ew}FhZT{x6nzDDK90y<FgmxqTOVJCObmV09Wt?{BvbxX0XH~@3f
z>RQX&hLFCXo%FZvd${?jn1d2TP;_S5$*+@C0*9FP2IR>J?qj?*-0!SZT4~5R!Cq6q
z`-Z*fG}{RS3T@jWZ9dPK)kWl*6C+zXT#ui`&8f$^w+uY2(E*IrB<()sTXq&gW<?1X
z=iA1icV6@C8de#WojAVM6b5kwT-hC#g<qg^@efjg?Jc96f~s7a(gk*G=*mc@8brzx
zcpk~O)x$*EJl5o*vhMn^MS+A8qY1KMmbS^QTb1pg9SOsElAt`AWin2h^Z^-7e|uZs
zNrQG#?fH8tZc#TR$L2^8E85v1VD77=G%Ix?f^7;(N<nK9aHY7&dA-5pC4tG2J>5iX
z26nzc`L>j-=v@Xb$O-RQ0p&=2B0D43anJ2p&(cHGtmwfUE%gbOVt?j4#fB|fxP!w<
z2$y_FhSwMn3kGHxiF~LU21eiwo+tf&^UjYg9oM!l0_tp%CbJf;*f4Z!2gv(=$d>$s
zFiW!dG4LJwT^3p88IJ1#U{x{CYWkhL?4-DEK|K;Taz)j*M-GYC?Xeg*aDZ1=@&H<`
z&12b!r3eQ!q(L`h%CmmdVQP_h|ND3Se(9E`_KgUlr~7*VIz8e2A-u?ZQ-6SLc?>n%
z@*fBVwjsQB<B7WHlAH}zgbUzbkPjPsL~f@|V84s5sH2}MF8Klg?t_20Kt?F88jfi0
zZZADg1qBY2*YR%lUkG_&ZJS)0f8EFbm^wtd6JGSWUN`VkZ__y3d(O&|smVUvpUR!O
zQ8xpo(|WZuxfn4^WgD~QOZ+~H;jG$9ns=?E7)8C-RK#f|;Ah?PP>0_*(4`?h>=`bo
zgJ`$A+wCEBL65l@QCtrNw1i~?Gqba4M+w_oI><@kMDUie*B&;eO1iuh_jgCy5>Lno
zN~HLbv1pfEc{*t=*(XVR<@mTExto<$Iz{fyS{}QjMsY15WlPL0BcQ=W?y9b>o8oJ~
zIo)7u?!dQ9i{G0G)bHuTl-Q8tzsNtf8^Gi!LMGC|{s1GBc+4PHQDa?R72sg{!wlJ)
zHwP&HHGYw&s+Ds=dyaSk{=`H|JX!>px)8t$<4=%IEyEG9Ud2^&faxHhNG{>AB6|Tt
z%PWW3P+lhi8c5PE5)<6wq)1E{t-3Up;w>RA`%2617zERyc+D*!n<cReazkp7UY7gF
zy%v=Xte2ur?NFB?O^rC2ubQ#1KN#iUEHS*fFDsJGjG1#yEq4Q|=Rz{vSWn(P+P#*L
zz}?*C8WG9lj#OdXtQ?rSO}5T~y?=toh8j&iahhl?dwP2awW^*av#}^a@7g}h6vI*~
zQr~oH8d?%dGPz{-lbxMq5!Y5)j*y|u&|Jv9Nu$CjeJEV(?Y!NykD(}oWO+R$G+KjO
zV%UWP88yg8*mA4?Sv1VK0_v4Y9n#25f{bF^O)Qlc-2|g#k(87NWt_1*sNkUt&!O)j
zRH!qE_wcY;Nt+)tqQlf8cD+layUdyNJCZM5IV^Z~Ns)+<5_3rZ>AC0hN_W5ZZpoZy
zI!+>qz9AiFby!OCATQM4Zr8sVv@|kKpvm77Pr}erC2&gMsL}IyS^r|WTVMmJWrcHJ
z`B)8TqNDW9K<<e<5ka={u`q~6f*9`bAw*e9Jy@ykY;3xFcx+_Zm^B;y)MAVdjO&S?
zR1vb3i`+R6BJ<p@v#z(fE*gCHWj-^KRs`s0EVn&`0yp*fZ_>#Yg&dvGjxw>a{qx(t
z!_|B*XiV^p;RrKRB9BBK*j>#;-8!d5_S5a#hBb9evEZ#weX!C=kTPG%M!Q~ktvLMa
zc0J%CJ_>tB<-{Te=eEpjT{l)`f}(H>r6+Rz5=)92$KV$axR-PUcMRl~gGu(29>XX%
zg7hP489R$Jwf5E9l#%7*-_s~T)-UJI0jQTMVN4d+D6+Dd-0IgZ$TAWIO8%DzBpEyN
zK#Dfro&t+EE2?M&z9TBxE%`a0*H^Hx_Z$NM{jD6LS65W$&o0+%ke;2=evV%6sF<Ph
zgelxcR74z}H&kOj1i#hQ`ol}@#;wHVs>ZP%gVCH3(+{2_qv%%l>Zg;)H9rVj!{Xjh
zLWW#cygDMAO9C2Ba*al<Tjmo&e3P8-J&&Ky$D<5_P!stnCY*tt*ko(Mvj)0O(59~f
z-&u;RlRg<`d|6BF1!=}PbLOQ=U^bGw!9C)$Q)}_bAP-#q4dOl!Zw7|6NG*_sn~Tj>
zRHwWysXyVJ8g2(??VqdY|Ekegutxuss@_77*%Y8p7>H%F?653f3KywL9SjCun~B1#
z_oCr+qoieCu-2rz2Gim5l7yvod6{{v%>QcznOmc7NLFo)`;wYVQ#Py)A$yTfSBcIh
zfL3{skhrmE%YF>b8DD`(JrSMD!vCU9i#6Il8ql5uGlPF%s6Zkzs>oqE$zek3I+Uk%
zIn6VH*I7GgfcmRqfUUF&t^W6F)&x8tQfr*IEg2g7n5Btr&Kw+_e<`)c_OBc=gV$mE
zalTmzf^}gk9Qz4zsq)L5+PligA7IvHe;$_{B&;EPJ;MyiO_=TToVbr<bEyP=hb6SK
z4proMGSIYCd-%6CZBp|6UAp5uxl;-iGOO%~h)#)IY;#OqQ2h<DltBRzE*2SYg$@IL
zVdwrK(YBL~P|0kON@#ueDwPJR4ZTuNxg-(p-Ic0i@lB`nZ)4TNgmx|7HGuqL>JqP1
z+UnJvOEgaK3ccx)v?esJUE$|JX)p71+))FXYp$w^+CfPQ@Qwka&1nf8Y2-RO8Wtg`
z>Z}Y6Ov$lo{>Q$1_8!dK4Z&7Qk;O2(7n;+2-TC!AGH)0k*7^iwEv2YRgaMt@!~UWe
zVR#zvsXqzTv`sS$C`M^Sa#UlMji!e3m5*AdmE{;SK>_ocMmzy$xGl!Fkk_Mgb0pYK
z+@vjorr+=4=Y=5>y0MxNn^Vx{BWGN8O+l|L-%gW)R9EmF4f4LyX8cbMI6}bF-*l!T
zYy`2r#i(+g5x(IP#&Oo-gnS-du6ymuV<U?@yA<2x&<ryWvUTPahWhu3b~EOFv@Uhf
z)qQIA*ZY45RDH$malf~+ge%<l`n)%T8gJO6_bDI;Dw!Lt<u2kcf)s<ddb}gL|A<Wx
z%DoEG#E(*g5e3!Tmev|?k7dkh#yQC3di~2ychGJw9@!KTYeBzSS->~-i?%Z<uaV+U
zOBMPpTc0&WAP8Pz*LEpaepQizfqlpKn-Hi|o~6-vO<xL8=e(qc4j#%FHPJo8jNnT2
zoM2u{)IbJgnzlQ{^U9w7xD0G8(Ul8x?y-;`r@O~$bKfl~BTe(FG)w)oFHU_>Tp{Dj
zJ-pQcmWi1^t)0Psz*Q;yb?D*^s0NmrW(_mWXN1_cim&A`Eg!Lt)n}Pv>^{bYq(5`f
z2TcI!_X32g!iZjU(+`<SMsycxiE^fBfa=SqpW%mEY{c{757ZCj31IQ+I!O;g8YN+s
z#&R-d+kl2#B2t1d&E#k52hui=<R)4TI^_X4$og=56QPoK8pizjLIcQ*b_=SE)X(Zm
z1>6HXGO*+6>Yy3>mCBd#VAKpC19xlVR=bnW)R1SVdBAA;I0X<_r2<21n?VJmAC}}t
zjSwux;598r5He9BcDql9m%&#-TU#i74XmC!+(g~mYq5Iz+OYX=fGaj}Z;Rhm#gkcB
zbfv%{wPtJ=H+=Gh$Jk%Ok(9)&@O^j(u{PQuyHKPNOTqRPdO`RDZ}@_#B+SsHZ7~u%
z_0#r?&4W3Xh^<uhe~qp{DwJN*o~<H_P3Q}>?pE7|x~KKv@g2UyVc=fb!y$0kGOABz
zEU|Ow3iDw;AU>SQU`!R7yeVDYwa?@mbXa%=@qq?eo?Ybmuwg%(<;ji0B6J?6u^aGz
z6LfNyDxm~qp39M6e{{L5QKTF^LXR^CFQ(Cg@+9!|I(>NF@as-dhN(hD4*dv+EaPsJ
z*^2}_I)V1=^ske4`J{D67SrvAFXfg3LG3?(cLM9x>6?p_xFLAw^4Ld}#9WuR-2XUx
z_UQD&DnDJ)Tg|Yu7FSsB333$qJKGI#yx6Bxdn4N?3k%0ri&(d4j}kS~v*NABv4epa
zirA>orM&E`!+Ih?mX4<|c`gmPu-Rft&!{CD64H;4GEo1_P6wCyo$K;ovu^z}^=fAx
zV!@eac;56)KH#u<WU=C-#r&Z^mC3lybC%UFqF9HbCF<cU;qG~;E<$0hz-1r^H;!=4
zI>wmVf8_mf$kR(dz@?A91MFBV8HY+L2dA3#Wbxtt${~V<$R(xYDPh*ioQxF4(L=1~
z&Rw&Yw+gk$99+z5V3eyWRq_;ihW&$5&0PZZJeuspUSJyQEG$nyv#9{2y*O9;h*sgQ
zoLQtHRVfmETu#qZzEL2?cOq$ffh5|$q<nwq2PzXI;?#us&*YN3<m_U2%;##Rv+K>>
zRnP=_5`ghwcMp1PS~4SH6=4|xW3Q%kRddSrqQ%)g<j+v)R8&gFGCICq99fuRp%IDq
zi^ZVZI$6Sg65n|m=urD^e6!8A)s9aGjGT4Bq0n!965h4Wa-h@dN@62)HL$_+n<<X+
z(%kU!1;!-Q4OX@@we(WK28djf3--lEBr}LZg&rDmd@203cF@5t=Ny;mzxC-&;$LLq
zm{5F^XCzi%NCtEm=_JA7?Wl+HKvPuxfw|@2^k_eV({4{lNWo>ideB?SEN;WLxR~ND
zo*)g3Yda<|<Fe^~ob+Xn7#7CAJ9gs`;Uorkjo&fsX)!t_8hg8(1AKMqM_^~aDMVke
z`LO-WB2=t#Zfs0(d8PPkjMX~#GAKM4t%CDoG?D}+nDSxs;$)6|kwYdhGL-ql6wRy%
z3}J$Ff2PeBk}3KgPU~_K%Za@Z58+XalC~12b^b{>-5^*0(l`n76YBLCwQREFL;Yl{
zTjB@Ci|H!~ItO_)&;IuB5>zc_^{$ig_6bo8HAmAm+MB2eA!+l4VitLK-P@PX&7xn?
zgPS=HWixE!i%^BdV;RE35*4RPe9w=b16HODLm!W1C>xAki@All{J9}zzDu{}zm4$x
z+9WK_2K0l8E;?ygdM}#>aiQHbaDz%5u(y8yDkE%>3iH??ytZWBtQ>dVt7TNIg|4x)
zMDgD?InGVl(r6)@HY`7O6Y@=i>g-(nY2GNj>%tM7YJ$R&I*yAzK=(x6@2W$;`f_px
zYWHv|&uVFTObhx@WjQb%qI~1jsIm_S#ZF1xn>}9h?PiNH_RM#UX?@Y>bK`9wv+gnd
zEtl)nSWwxETT?s!A?l?0_`#?Cj29jmCEoUYONYd4kui$3`|0HA`oX7vFsnHQW8J=m
ztIl}fqVbTSL!sEF(L)r+r)OY9S?5sLv^>Rf2xoVgm;OEXhWZO5JJv55J4{85k9&j1
zSt)aMz)44VjC@&LWk*#C>=#L7I>GEhAYG=4%{fN6QD*T5P8)_AU$6m#=F_hh;F?OM
zzYiab(KVhav|L5w_Zhfji&CUL*fR39FkImmlC}J*ewn+$gem^sk`Yj}`8ew(6+=_Q
zop^j$c~o@A%swe&pe!jAo$u|GHjG}HYzQVk<hXDaXo`;&>0ruuxlRqUFGW>*>`jH|
zzfFCpIigfq^=eP03~qKv#9XOJC4=yINXjw$yJ?engQGO}RY(`)$CAn<jgcKTu(Z{P
z^!VPfYfmr`e5jX}Gn8h<7NO}dby`y<nepD*2ICYd7QT_qZQ`j0Z2r-qd;~ItAt*-5
zViCy=o0~G>;|><`yZU-WTYGHr)3K>w6F;Qa@^>`V&~cTX+kj*##M+?BryZ^vf*pi`
z<W!{f_jYHsgslUi&a*jACzOVEQYoAMOTw5xk~f_1)1V9-V#{cO!;}bc9@^FDM$&C0
z*D!t9n=K;_wQ?C0{`+yXtAib8bnKnLoZE;=XuFhD2)2SMb_nBgt7Ty@V?EpLe$Of@
zj~79Hp(9sM+{qIA9{V_8&Z}E&Sd$jP!`K$z&_E?ZbOhhJO6yCTRB39yOp}2If!!c}
zgE5+X_O{ye?4BLk;;43UzA1Dww*ZGa(v$Up_()G`PY7?Iq=Z4>1fgEI!5=g?)HkK{
zGRD<1GbB?dz}P^yx(mO2z|6!~iDPg7l?@JhP`DBCu(N)2hdtIi#UuC&4jJ7Wtm=Eb
zM4{j{0|b=6i84AswjU3j8>HHLl#Hr6-NDIXImJA(*>)#@Bdm8l{j}#&K7^IQKfW>F
znFYTH3!gnE0{7Y+;(_!H0}7<)fa*a|mUA1J^*RJM73{@XpLZ9Ef#sA@QbCdP4qzLD
zM}uDn6O7|HY>z*u&}azY4E=pPLHVA|i++10$ya3%h(zhW+SFC-t^Qy$YXURL*%dfk
z+&2kzUz>T!FP+=k9L6ist6{J*FG<^ORjDhhMF}?@GbV80y1KhQAaq*-E1u0wT$z7u
z2)V!B6V?rltd@VKw?8u{qR%WAhEG;~Iw#qCMt)^KtlC`UoG%)po-C@tJc~A5Bjy5)
zy!gBInp6x8BT0~9?NOSOsf}=}sfMksg+e>g)3^+|4xf=zcqBA9)|&2$%dnKeV6YR7
zMjJsb=a2f;Es<*5(7H~pb<`zN7+sr!M<Dl0UJ>hA9|6(RAGA#%Q(N6`K{^wfKo5n-
zdI>iv>FMII=C#>${Jb`70Ltcy0;RJQpU0tJOSV~a;TDUGb(u{u(%yuj(?D-(%vsL}
zeiP*K2Y%C_GUbl~ev}H{^WFxPBxfddT}^io-zahiF@PGKMB6N4fjF|6-l=}mXE|`w
zuwn)3h$0f@Sb9+?e!=VEP3m_`$r3$~sJ)U>e7a~aV0#M;T~I-H{vPBbUpo5n@VhLE
z;tK2o?hMZSrD4!33|!s{l4R|{*a<0jM7@r=!>Xs}Am)tvcl-QU_t@f2<0Yg4V;pyv
z5{E;=od`S(<&=c`Pp+tEK}DS<i*DPyYkj!ENe$&@0;TV5iaDwroFd|DdpQFhT5=eZ
zCSsTsNn&CiMYYN>c7r*q?Jv#daZ!pt9B^B;_GQB>=4q)*M&T|wvno%Z$584=Xs6T=
zajL7WEo<?{eztyG;L>#L6NAl)hVf9VSstnN3Bg%Tz+D2jLEuqiKn#Z8Axe$8v#4X~
zdw^C9b=slX33xWBG@jt`<l9lxQeZN%N8b+0DR@Oe&85s=Hf4Qsft?Hu&pWaL^t{6}
z&FvBwRr8R<i!_ALGa%#qM}D4$h?XbASyx8)2vrvQO+j7~)>3}+8e30>xZ!;%6Q8Ca
z9H7)vyl|@ue9<o{VP5;}yBv%@B#{mnmYBh-e8R5iXC*OTQmine)lmJu|5Mdy0a0vA
z2*~UXQ8BM131PN;OYnq82x*`#H3-TuDq=w{h=*b@t0zHW>h&5@N)89duhIAvO(<gi
zD?WY6N|xa>nZ2g}+%z$6`M!VR!tt2ah=$+Z+%>`@60xorNCP$@01$;ODL=bv8k5_u
zV`)hjOcP<^*VoLPij$`dVG1w<q`o>tIwJ6fE<)HZ6bX6Rz6v8m)FbM735|gxJ3&!8
zlvG9Mw-ERg83G@3mJOmjB9V~WtsFU6@bS!<)SIte1Wl}GdD=r+$o${E^-`6^mKhgP
zr$J@Kfp9%?bJ7VXHtdZUSPo_CyZe)%#}n6%|6q@2PBhpx-6RKDm;lTQ+F^TbPf<=V
zX_^teB?v<?Uu4yX9;w~TA4^?5RR3!459Tpua&98WXR|J0QpE=s>;8{fZo-waC<@S(
zUvR|=4M=K9Qn|C*m_c)lU8u&YV<tJoNL4#lZ)#ryLR%$Ie@B7eg(tSBRca{#n{j<A
z$UOvQF^|M&sV=1eG5Sr1GFLFcPL7jHBmz^&M8OpvMTa!`162}re39|z7IH!jqlKIn
z4}SG*;kN{EUn>gNYOQ}f_-zq2E30^u2-9Stga;|x;j|r339Wjg`mn8#pT?~qY~~Q5
zhp9w`Cy1Bt>qk^tS25v&kSFRm)9rLOkyf`4(wRfwJ}Q0r8Pmlus?^16QtyLj&7kN)
zzUe?to}+N)3Fv~Gmf|X=ZHC6j`(zd0A2b-2SE>5XHnRwwcb?oXb$QkOW+L^QwX@(R
zYaL~n@liN0>+ey}zB<CZYuO{iSa~2vZ~_V^*qc$4*~Y9HiOQABo=>j%M9E>?W<fD8
zsg*4u!$xIQz*?s+yyb=I))McUHd~InGnJ59t8*UGtc>$Q{!f>h?IrNCqBrFZ-0Cb+
z-RVimS`c(=zmEWCmvfg6^s2{(`y$)vxNp^p$~-9rJ_UWpZpvM_HO`hnrSh2KSVc)A
zV=4LMqo3d}`wn7(LYYz}g76T4Tm8@`i$raMh8DBWt-XygJv^vv61Rc?eC;-vh$Xnf
zTcQ|(`8q2)==5_TFkH&HZ=G~Xd3=YlrftG-6_ALoBJ&6dvg9A~rLY=qZRqWo8Zk`2
zCb2ve10W+vkxr#)45&S%tTy)ss2N<QPHUi*<t)tX;quVk!#opi(ZUuS^%x0>G_`TU
zVHCTpgw92taVB`_LMc=y@>n;gj6bWAJNs7#EaW;)Om(eE#914Z+cQsJQ9;wYBwk@J
z<aN6ZtgrREYd52Z5-AqQO$a3wH*mWed9Q~*qmAd%Wuz#$Jyb~y=ke2cs$}!~c!iy#
zupJ?Rd44XNjgEh2c`F-aoCbM#Z#*&a8cXM1LDSmJP1zc2zTpY)JSe=Bb<YqNC99&i
z!8zg?*U&z%wC0^~fu1?FufU!rO&7#O+7D)y<f5=|FzU6IVO%w24cOD4Q<ZQ9KIJ0X
zE#5#jqZeZ$f#YUQm~&~Q70_zl?+MZ<yYjrS{K2ij0LyG_Cmp9=!l-^AS1#KgrS*By
zz9ABB08{IqF-Xb@JHCxHwqG+Z%Dc4a#?}uic#~c<j0p4(XsF3*mk=q$?znA_Pp8>m
zMqc&8IQgq?Fq{OEG8am772@DYmUSJ^t<1g76E)nU=Q_*7+TT}~+VS4<ei$W5d(g5F
z58^y^%Y)4;4ySK`nU&+UagT<TYAq2Vie;!s0^Fq-YOPEY?a4(dqK6_3U8RFY>Mhuy
z97owgjyn0)f~C2$Q1YhE#QrcXP$t^~?`wbIEy~?9bIVAt375~ROUALohV}Wa0zZY=
zs(|p&L8rd4HNHF&!l&x7dh%3r9IJFyZi;*4e@yMMvj5X3C^XoPfooPevfw*b1vBYG
z5W4T}_udWbdCPSDuqWW(;OGJnA{8ePNf(BxFH4g7*m3ym^Eo-bp*jtg0*T;|Pgjid
zT0W!4mE(WGu2sI6YEOOLnTEerm({?XRle1^k1Y*!9}VvGm%fs+PL3F93y7}U3f4xu
z&bHpFP46G>Md5E4{3Y_Fp(n23-VrdbfbpFi?CrN}Bsob9z*HBQA15T|3wB-M{WOW=
zgZO5gOq~H%q-!NJ%GanoOg8g1X>`g0YX2R9@a-46UG<8~>^ozc7q(^VsajWf7K4AE
zLPS(RYXXEt+q!5*9(C{5^kF}qw>cxRDC1iM?WAQ^2mQye{2&-eNcrF+g^|Erk18Cu
zxZEo#WVKMriR+p{7~I1=A*(oJ?4fl314ZPlG3pDD_&iMV$aV6MjmWL`G&RJq$FaRR
z<h?qkejdZvqUexsTDOd`9Ds9<u~nBbvKD2h3s;`<+oRJNeB-?wTd9vtn>;$tD(THQ
zT@#F3i8=;b093$@B&$qVTVWL=+2+-bS+=`bs7CXy<#}9#&y90O3;ZDp`Z5hSj?&?T
zsxMx>#QSk^&<~NkadBB!ixI%tMs#))tEyppDPi>}+*B3EYCEdhGNu$obUy!QY6}i}
zOXT*)X#F4BN7Rc%z)?E|%oN;%@@%1PgJ!u}H0yCXdm)qCTH&#c{hw)}SdEkKTnxVa
z!A`?A(?4hShLJ-fJ&jF@wYbOHtP-{Sn145hpy}i^-I-RZwG%N=sX7vvDkPNwX=Z2#
z)#Mc#>uDlT%U?*vt|8}lZQ0-(AcK>&n^``1qp-j)6%vImmu(@vgeDE`?~|jE{MS}1
z-xf5h&QmNkumK=N+}2i=qNq5LzN`eBru4vFTj808w(J*C(fOhZ2c_hpW%V_@;2WRq
zG2>KF&$i|k@ieQOn&jQ54Xw*&M(g_a<#*v8mxn;4hAH}SJ4`Aq@CYWjLU{j>!1-{S
zxdg#|x8^l%6W>3EO>531#FT1OsUPjZx*RKiyd$PBDeNFfe=h5<f->Uh%(&_p^ws8d
z!UzNRzuF5ULPAS);bwPb6&M^5D;;!)hl`nSP%xrXr3$Rnvh(DYZyAJl_gC9ohQWsO
z?{GpptUE*lSjtmkt2&f{*R-cU<uxwXi&S}3)^s_^GMljHVZd{cOe^v-A61R;2sBRK
zPI5NC^a*!ZS3i?Byg^i<GH|o=6|JN5EPX~>u7geK(P)~IYNA!Y?tHC6rg-S9O~j7f
zz8=}PzK*`^9DZLwfA~JDINItC#{-oDSC%Ej_I9vXSJcz<xmvpF{rdX+*86!?S%{|k
zRmo#in{c8r^3pr9S)rtX4>EWJfk&a&-Sdi%p34TX<ZI&{2F#B~%`_anF0$(>qi{cj
zUfs(nzgy9`lW&Ypy7h=C9{xZ&IGQy=wj8s27Eo12(cp8yvsYW7XN)i3JEG^qlCKCn
zh6BjzZ7|rGsO7$U15OvM0(eO~q~G4l<pjA0n+$^g9<zIhDGg7J4bgp)hszL^W%!12
zUE48>*C|>X$Sgeavw#&B`_Vx5!l9h_`PgZH`#1pD#oWC0e#OPT$MIJRow^7cG4y{?
zpbqp3pOb%aH+^=`n{>STO?^f2$71_ExaBPf5(}jr%zkvQz`ti8aSajf%KhwE{hHRa
z`b3W)jD;t)r%)?541z*!=5HR6F0<pcUA*b-{tvPCk*@B~B&#Wa9$=~Op>(yvFmyqE
z7QOc7V{|wScU?v)6@Z=wU3ObEGx++zzN3sSZm@9mD*R?*G*EDGaKya>8qp6{b>R9Q
zAr!Fa?LS&4LKH6~Rta~Ds1&>^Uvd-$KrpPff$?m3PG=CYd)!aTwZr%EoUUi%bK%#M
z6-FpZy1Vmuh{~!nN2BoR!V$EcEF^~UhTu+3k9G0%E_=LVHS~{wko7XJrYA7_eCy%J
ze+R3S`qB`zr*=}Y$Pl$h#cak=ucq;PuM&5sN3r=a`0=1t86!A+?l-zD>MU3fs&#{Y
zwY;NeTO@drWOZhixAutkclG3(o?j2d=V7ALTU0Jzk2M|It}tJqBj?gH2*}CP)>qpb
z50kZ?z8TT3cB5)Hm(S-jjFH?iVyDMv7UX%$cgbGhuGnh&G_^`9kC<@A+v=ys*Ztwe
zV+^Xlk?Hxr56F&Ha%KbfVK3;Ha{~88QSu_7)%JaU_!yi8S(3K~x5DLDxNHk6vYg$z
zaS9Z6UCQ%g*W(|T!38q}mYB(oCK#WDEtSJEs78QcF%tjg)DV~7bBo<Njk@yH3kC%+
zqY>3kj!oIkwVcP~-=7rs`fKO+{{B+$Z;-;FirS+qrui5J7D-gz+s!9J8|TvWNq=Lt
zcw9TjZztGRGTON0Oxq}SKVnxTxAUkT`r4|y%AavS&F6@!Y+>#Z|HwbT>bsq8XfUP6
z_(jeCmr@Cxy>T<zvEJiN&sKaVh@bzw_q~+=^ZDkp_Uq>B!|xN|2f+XOdxQV=x%1We
z^*H+VI*b2s!2cfR_jba6PxGUN?N&|4swXS@b)NAxp;Yj}DnkGBr*~Q0^Ih)OBm`a5
zlrf_?d~2~7PvG4v={y6=-30>8$X-3W`lsK!Fg;27x>4}a9fF_r=dbtf&)~B_jjaRx
z%;g<(V(<5^uUuEZjywEa&>KQIfjtktx!b^rs~c})FQHG9mk(Dx;iG#i>z?e{3*;Vd
z%$8SB?ko(Kcb^Qw`iIq07eLf?p6h4_*hcmxE)X5rr)w#|4*T7f#M?vKn%>jadv1=b
z<)v?^`y0HRTUkta6bw?tQT&B4=-#V?_}Bf3ZQIuDLp1-!;?Ixz*TH<3GIQIrMRMI#
z{JBcHFBZ>^H2yO?pZz1IoLRA_(POW_8y}*boeq9mm#Q(IW4iBmS2sR1<4yy-*KcMb
zE(dRMVri33Pxlc!om{!KUt86!ANxqNv&K9qU*vh|5|hv-w#H7*jwS{+|0Fv@OK4^e
z0tSMA0uK+psD-t&i6a5MsI`H!$uAQlJ7W`QdTA3|GiP%GMkW>}PCh<@|F5@u)|HP|
z94UM3vDas$`=&;ou>y$;2<&&)^(}4$-o7TdsfWB0`bLVEOZU!zk5?E;!iZ=NM^j_f
zVx1Zz?6X10^Jj@73Pr+p|KiWa*J(SuEF$IrYI(`+?T^2=I|%Vf2eblZem?f<LYs3Z
zyN1z!<orDUwtlsLT<!JZ&k62k>HwCJdZ7F%S0QeEz3n+in$CLt-alM@|1Rp`_51~v
zEPU-n(0i|~^Laf&_j3o#?%4VQ&MWPDd;syS>J+vKi{Of%x%gSN7R!3$&yTmIy*%D8
zVXeR}lYSppfZngiI5$6hjlrBJc77i3yUs4K-jCZ82=lc*GBDE(-@kWzQa5{@wJrFc
zFW>#YQxw<Pf865#?%I0`#dV@29ljel*ay4zAWf?a*vWCSo(+Oo_{j{C_D0m6EJ?{Z
zi=Mw4c?ef}7rI@uO~b6UlJ@Zls*W`0-QOKgW2fHz+R=Si9l<xnzH>S3<q^PPm6gUi
zqVigaK3VcEO*q*y#~x*?@qLAm43nCZCtvNfQ)P#~-w%8!4leS>S3N><u3!K=K5F4K
z5rHVlyHCgX_CmwZF+Ff~+Hx%)MjBS(X|DANjB_Y(isvZWl^_v;(s;R|_T~5(Wo)#N
z!$eGg^VVX`6yg%*0gA)%r{YXV?BKC>uwIj)#t{4%WvNfR2|A2n!6E_i3G(7)ot@(M
zmZ!m(dOztp+ehdU6;Ua5HJy&@3)HHmkO1D4UvX|ffOM4DC=snE?OS&a#;?o+<j}R7
zniY%nNFPy8B8<P&M1D$zhp)#NBSpWI)B1EvDWJ(!tB+eNV3(W-YoS*I6I~*YC_1%u
zJ~f~4#N2Tbn~B6L&ub>sS0xc}XO1+*EG#slgHZvq;YJ!wwh^xl097Q_=TS~!No8FI
z$JBz>>n@i;dZJE6=PvW$(1<`i3L+Zs#u^%4C#8TQp;j11MGH+}Ds)3)y-RcQ7S0^K
z=x<D-$?G+nqLOlsZM-j2iYgLQXnaqEGvg`0m%+hazW0kkKmH~#`JoPsdm1U632go3
zQP-cp3>C^l;$`2iM<Lb@clbYjt@w{MOR=<j0kggD2c`UQRxoZ>QjSSr2nN<tIa1A_
z=z$2F!J5D{9;RXe2N)>a@BL`yZHJUbI>jk{UCq7CCC~j;jPdl??!i~15c(s}0H2R5
z$FZhfFjL29CRV5`A*hTaN^VI1rJQ4uhl9?rH=frYG_yg4;tLeV6f9igeGKN7l!tEp
zs;&T9)V`*SP04ET^#Z96Orc40)utt9Jod$`ftu>nXYe%5Bk*4liXivxs|pTDatlb&
zWM=mY8`GnnV-NB|&>ahhVzw1N1)`RJv>HMssz(lU%Fd$6TRN~h$eoMLde6WOr=4z2
z+z|XymfH>w8q!?c4EkC|_<1UWAW!)suM1CCDBgN1S}XW{2AG;COVZUWC)H~HL#QOP
zLP{lCYjaE6wS1zUV;94nc#Q5>tj`vfd#)b_i15&XH7*Vqn%vqvTo61Z^WVh^JY0FA
zxyin+UV^wWKK#it<T<gWUBPiYs`bI3%RQO(!I1yngD&$Ed6gT&Al3)98p2@K2Y)w&
zv6~>IT!N8$?Uh`H{BA%;Ye2Uh*KMQp5**i+2g(!wWCOzgnu9Jw&@FEP6diE|gA|@3
zaIz7&X!v(U{V!l3ZPIwWw+_Yj2VhUEViPD!f&L%v8MqGM^168bK0=USpa~On*Xys^
z925wb>H-Rp$?tGC!*|0y4T-vxz#3Z)^jY7{CQ6sF!-MdVD<sHiC)8&|Cta)VJX2n!
zKm~Q~{_cnE-wnI9mkBSTuZ4)k=;;m6S-3V$KIqV;SdT3>;zabhTrK*tUlq2OMxSSe
zaa>rMudBJ_L<+H2QLyfILR*F_!zqVbvBKFAR?sqKRwG_dv#Z39<_CjTbcD#WmnX$^
zQfGgdiAkI=e_J-8dUW{^RXa<~J4DxG(%FKTHsd$fb#NU($zoy4H7h+jtkV?b5nfK?
z1$z^xEPE0;w@UxT=Xvyc9|bIwB@G`^*N3din|6|ML?YHTVYz&7;)4IX!ItJ?yJtju
z1gb-G!$x;r5=x!A_(y$Ya{Ule5tZ+{WC#ymIf(~FP;yfh>6i{-bFK=$#R_33*CO3^
zhj%fQvrgE`+!f}VN$W)M0$fN%B*$wbRpQZ`1ggVSt8xMlo~2hU^(c1CetM^nCGhv{
zLe+Pw?2~UQX|-Get1ix|wx|Pao*y1g>ppYd&q2qiCk=>mq(xdz>x$*Nx~DYc?MKPY
zIrM5+A8$XJYE*P(qAJ1pjvqQ1K~iif?O7_9j}BX_u88G*4msf?Iy(xqJAkhWz2bT0
z_jQS1U=@YnRdr)V3C9IsQg{<<GMYcigKMfcW-F>$E)cD=Empq)ZJ+_#V5l&SiB;Cz
zLRA?msG=&aTxq7BP{$VRk|VyC+K@O3DzB;{(lJj~G?$_R&`3!!#T7r}fhg(l4(YAA
zIHlgAN`C)K%Dm|_=6x&-w1IthcYj)aPBVjEO_v(|KohL?xb;cMA!FZ-e*Rc4ZEg;<
z4YOrzUp7InGuYS90YBhoPtVS%R~N$f!k!XR0z&U%PLgz=@KP&GBbq1~X$EdO5V|~J
zO}K~g(cccXc?!{`i`|eG+a)3))3`C_S+v5!d!>JSjCKsWJ<Of>&o?_`+%=VqDgO#e
zdr>{JEz>MjRw2;#da*$EraNu0Fz6GiDbq9XT@9sW%tl7vKVA=Dzd^2r_gdLed=tX?
z>Y_OBO7UlVD-s6h#`Zk0IGq`X=t9ee5$z%fx6y>VC_~MM5j!#V5rvx!!`X)r?V<>`
zk%U<c!-Zi75eM~$7&egx?X_SB;TU0ChZtZPVRc{!X&GVJhZ#1}2JNL_gU|+Vkz%~@
zp?jzEZ=-&lR*UwGp778AeP4bZ6W%@{-su`aKPgn?c8Xi|#IAaxQmhpHh>pjCQkYjJ
zm1VxKAdy??Su<*q`6<IkI?g;vdEe+<h$||RLX<%pv02cdg57MVE%S@5A#!L2$5dW9
zjrE|kP!-7_`^k0*FKC$e8~5+p{aWNQjbv~aRm*)~u3YPi*DS)yj@Ren&8r^CzHhqC
z_1*I<;kK`XZDg>GWn}PddPW;tnTTFDRJSLpTlNCuV2)<2vcGfWCTy|nda^k6_0QFc
zbh5?dn~Xp5-x}4cDNVsjWi#NywT-G&$R(I7Wiu1T#;9tz7H8{9=qyA9#8OO)oL96#
z%N^ndRHs=o$iS&Gx%xAQEw#<S%n+u~{#HM2KM3Ev<a|AP0iWt}@l8v-9^ai}bM&(6
zAr*huLoP6z(p0gDMwNKtN<LA=a)p?NGB&%H`=2BaVPa(yQ70&E5|^pi$dpjNGq>gw
zo7QV)OhL;wGoRzPk4RUpB#Nq5vl2%osAM^l<r+xp%tf2WVoi^oRJHvOJ-}0`*0f@h
zfmC*OHe`)juA70LflsHs)w<|Bfmpct_$+?`&?CXMHZJp`^{h-sv}(r)<z#Z+p|$Z6
z*T`|$g#U>{*f;H~yojOoOj#%8MYKJ#&%aGQ9EEV8{cDEmJGB>yAiv3*sQh^&Spu5g
zs;zye4r=?Y=2u)p^yDz9fAY}lm1OuB#XxqH5n{l1=k^~c5;MbKRl*2kCXc6!sg09a
zg3s@DQitD<NX8orVFevy=o-TICER(F3AXb{4#*{Q#ucD-r@Af?6Es{K4o@Ws>UBtY
zFe!>@#mGq$d8l>?Z8LNp6QXd0$a{@PrAwX@TfTAom1K&5dnh}>X^m*2rO*az@<jwr
z<gY;Aqt&gTw8Az&XB;WmD6BWw!NJ{EvFTQ1NrsWghge8?h{@(arsrEzszi%~mK}Uv
z6Ao|SW*u2v5p5%_`aTr%Sz(n*jCO|on)wche#4!ZH~Fb?@-s^gqke6nFF<bLr9yXG
zkcRQ7`?+UK!k5loVqkS6WAgc$&@@cBVSt!SEQ7HGN-NrNpHN}}S5IP`PRVc%_oqg(
z61>N=8c7(K0vdCn7IBBV;m=%yn~!iu+ep|8PSHb}xcKu`YD)$Yds4uV2wW#*EFt+f
zUOr+Df-zSTu^YuA8tkc&ytr+JnvdmTVX8x&F-`%TKxF`x=ZTa}C=wT4^`8Q?S@n?T
ztwC=MP4>~cX>G>~Q^~@<y5f!LB~9*gG%NN=2m3}i?ap?0jF{q;@ph2rpupxhpDJr^
z_xxu^=rx1X6qBo?@U=JdoA{0C{xHjm%MaB~OeLY^UOUSdPjej}(ShGSBuk7OBU8V9
zro>4aV(5~Ing5&)Xnrul?_3@*+^&RO{ASa3k{^7Vrt8VSp2SDGEg7$^jSZ%wvdb(Z
zh)=9w?^Hf|W9>uiW7qjM$wvA#O;;}R%gak?*gd?>m(w|5#<UDh>u`>t!&CTYd8l-@
z2^R12pCL0#L9hembnyFfEtMB(+$t|eORL2z;p$lsrsOXiG0W6BVOv=WC;OQUGx&X<
z#Kf2yr>2|645SFg6PfXh#sfMd6s-jxqOIbe52{^As|`{2!_8uCvs*9i06w>!lWV}H
zPj2Up(+fSXTW`r11y=?^r0~EV&%p5=Av(`6EW0e6Z~LGhuB?YG>|rN9UKWSg5kI5L
z+fDB0{hIENM5CeNSM~FfV7bjGS32OX5xcE;OC3F^`<~pX1iCw1uhFhm0@~N5?;;RS
z%&s23WY~T=X8>LEE_z>t_BY4j;Hn)H&=tL#i%TNX;&g3OIR~k7jvJo=PnB<kWQ^kD
zBGQDW?h};FtxSOR^X2w4xJv*yyMyEE>y3}s-yS;PB7n=2*PgF7@+;k^9Je8_W(Jg1
zPaXx=OX6{f%=w>&u^!ap4x!0O6^8b|a*TKfH=?owLn0<zsVhen;E~8Se7zxiY5~Ue
ziX4iO4Z0J_NUI|3Vz&fVayRJ=B#Fy%6!YjB!(ca{$0Va<;ZWb>FBYi0YB<c$8*9Uu
zP|+!VW%6(HrnfQ==R{3-B(q=KUiYh3udcEfHd({S_j(~6fR)$zM#Rdmz;L0j<3_fV
zw2)48P@DA?P(#4yC#Oqyc1vZ&JF#3n!9y3n`P`a&I#32i^DaN`hZ{lf>nX^uE?Wqc
zKUjNiU-@h~5)QTD)S7mx;1zCFG_BiG+A3SOXt4{jYO}h1R{2w+rPP^~PNa*>zKyvN
zG^Q##RqQNHAB#&#eFVz2`VJH-!jZ^)LOU%Z_^4M%#@$(Aad>&NEl0z#>UTVv$1kTZ
z9@NFju<GZ#oa@!*5c=8-*YO;7X-rxWqc6sMD6AVarbcMf=^D-gnx!6@xN(g4elzWk
zjF)?-Ek1iLJFJ&%$F1_uo~*j<)U-;`y6w=(1QmmLtRp_}(9mS8S)nS%YvGk#A*<2b
zKkZ)(N10U5-B8Qa|L*SCv3$iX^PBHE5UVOa9+PUAS4SZrH=zq4cdqxmVruvvKbe%-
z{R^XJLyFxAzyntT^;RcM*^xM$ozlGt(eIczY|9v-*sIUDHF0jsxJ6siIqck;t~+T6
z8WE=KCCWzLa8Ew~!<*J0)vCLB9#LEwI^MJ?>$4^2wUu$-l9r9MpOmGQn@ZX2%2ORZ
zRvd=tZX$WK9Obw?q8Srn!o2d~`~h=}aKfy^z0$D^g+VY%9-VXM;AJeRXs;K4xEs!|
z^Q!5a*mD_z&?c)Xc^HPxvZ~edyhB%r8s`n=k<ZVk1$N&EAyDP=2E3cP0f_sv;~J}y
zO(Y<n-u38zN9$L9r6oxn#&9^CFg*Ynf!5wFCOdU4_EwE5u*Y9`xBDBj@fOsubR;)U
zI+_h@#+2jZck4&t<+yXR4S>KSE9Ybr-c>JE??fMRuzOX8j%ayBA8%qSjl54S)|qX8
z7(Am1(($JgCNPvlr5{5UgxIiH--{p(J+{X#9<=3W_t<>U3ENPTtV>~PLLYP6b9xdM
zeK>veWOvdQUydFt!3frF#2}6j8#Y>+xT|t|GmlB|AI4k#zdd2!w*NG@V5ebMqN)B<
z>z3x`hQn|9rL7m|L+3?CN3)UEtl9I|U(8QO&!*}HK(k7omPW`ILujc6njg1C!A;l*
zy*f3o%Mtwe7X~tliBHBkNO%`g5_SbUv*(Jw;WEo75VocmjqiECsL1tN3s4@YdzpVW
z0oP^rilZ5e>F2t1Vd|P&pQ5`UL)|^55#7Gs;>EJad?aQ1Hg#@Wx^wl|neE%UsJ9~v
z@fs@WF>Ao_C#T&YHy>Yx8k;EBUiE5YK-;rV&2(&|-NS<$zzhqR<UYvVGx@Ured)K{
zvWY6?(d=Of2dFrjwO^yxn>!!=GaMDy;Q`GvHqWUJSEtPOYyS4Wu)@<rV|M=a$+LsA
zt}yFR8u@nn6-UU$h1nlDMN2M8hHfG)#t|Z<%<TE;_A{DJU-HUBoG#5WWE{epM9jZi
z@9<OG?qzz4Pfl1frjxOW!i#(&Z%gE;OuxIiaDBnuX7S@{>U!mIE3-#y(aq|uxypiO
zzPZ}Szu>KT$IIHxBZpHbuIzB%_v!k&c>Z)0uYsm?55#Kr*#+6=tWVb#q`gb-3iG(i
z?`@>m(?)sA0g|ypc?s#P1790@dzEe7VNCvBist=dr>931EVa=0Y^VoszN~w#gQH_$
zSgadEhZeAs-Ez;T=U2Ze`V#%&auhL$(&lqQtoIpi6E%xpG}%!#GWxV7)oa~#*qpp`
z-*`7^5cNbhaKrb^l-#CMm8$qr4vNJ&wpZ&I^DX((kaznKWmceF{ebc=TC3e>q_Pei
zP_2S7blGS2m!PsPW8DYURWD>q&EQ34jlK?AY8Xu3^{LJyryY{`lrs%)YYp89f99l@
zEtD_T$i26e1t0_ZWid6*{nVqh9U`hSBS^}0)>jmSe3ECla&}0ToKd5g>ZB-GdQh;a
zGT{gxStt=khMU7dZemXu1XB#WY;0Eu96b;y%<Tq(qaPxl6v5K<?;=e^ILQMKuyi1D
zSxHQ7{{3JJz%%;xAVDyFKw*1#AC4{u*tF0lFyF>9;phr2$#OPVGzjd^LKn|U7t@dx
zG-13DAOS%R)F}prBu1)`=HJ-!yGWD30e}ZMx}X1zUDqG72s~qLZx94C2o#L}sdg9P
zqzI1A(x%Vp01pjEXKpXZ;~+cnPa(o=4hYo$ble@{q+s}`+TS5g%AhFrw!e=1ILYj7
z?m<zb|LM_Vu8n2F$$bQq;jF*V4;)(KV83ysSOJI#7J5Wcg>!ip2SiH2{|`w7cv`w_
zR!}5(nz?<1{XPx~w)WcYfcJh@a(@UcoiebAC<q2q8}dK3^ZLR5sSVUD2xb5%{D)S6
zTo(7!iJqOd&UHz@q8dL=g;kXA$QjeXUguA$(eX1sf9R5Z%ocWb-JcOFK1QzD1>Qbn
zWW>Q3I(MXeM=0?-MZZniN1A_=p}zXkPsAKK#<Lfp4^7w|xwtKCX0y1FPj5*)Xv$(y
ztw&&!a$e=Wz7-4JH|RB?d6$##9`&3(rVue-$b?VM?xxir`p$d{K4s=Rsya3a26VVt
zV#;)P5kGly^L@gLm#}PVC)<YQARa1u>|#TV@e)6>I02+>GNAy~b4u~Kgg)tWi&K}j
z%bV4iohnYPmb(0pDE_!}u!#Na^ei?Etu`ElBrl1=H8nfxcObnPd-wIi>R>LAl?uGU
zDuM6@GLoQ5RJiHRKopaIl$dfsX-+$*G-M?~b7lXiHtmqqm=ToFmn;@eg8vW9`2LW8
z{`KF~|C^})P`&@>18Ms9P)9?YWxxY?nm_rB1g3W1F6i0+P5nO~u(Q7dN1p{YS!i3%
zSr%C(A6+WLNtZjDFYEzFz)Hhv$~<%Aa)75wl7Jw?{Ws+-bgbsAi==%2xfC2-J@6bV
z+&|a6`{zk8*xDRGCmRMwXKP~sHi>|vGqoY+{tFu5T&MnDtPK5Mto+mbf3X7e5YQkP
z3~m4ai~{;0J<$6-{<)?*(0wHj6oXWWbqZ<BN-cr5e@}u3UO(|a{g{Bm7dw;-R%Xzp
z06#$S|AOhifcfWV{|gvk2g85*rT-sl|KjvN)c%?JU%&tj{a?Uv04>JQ4(unrjbQc`
zBBY5vEE^k7>6M0rQF1_Ze6#L-*^IgSLrC-M?rtcVPXN;D*v0L6Gn?1VY<6q?p@Xo>
zU;T#oDuK)$z$AuXcuGfNh<@+<RK>re?fcZoBXN8G^YlW0n%?7f?~UX9=#`@K8}7?D
z9e-_HEaKrCG|Cm)uj-*U-;|!=*0j!p`!lYKDmp#+JJ|eg?aC(|y-5UVwXj(pz_1wX
z$^@$(V1Q-if%h;h-S>$!P41`-D{}YSpB_3NZ8!&4%0uzrytSd>+7vks%qPo;BIGZb
zb~otle*OoRrl!DJ!zQtvTJx4P{fxsMMcxigo~EvPeVgbEFJMzXAP=7N=RJLpumDoY
z<J2_*y~)xl*yXJycR>tn?MNI4m<a7XkF23Lj8Ib|Rrw1Yw1eR~Hr^#};?bxc?l>RH
zBTBOUx7+xmagH>&)eiwMXMqU+L1gG&+X?zv2#p#Zy5IS$tFfzb*4l-Dz3WHK%zLRQ
zAD6Db%&Ot5aVuS2Xr10u=Wm;3r8(v(iroo>c7zZvip!3N{6;#x8}8Wec9P+JjE=Bx
z;%^s)m!6Ah!n++ETJ*2EF2w6rS+vd0!8A8L-Xj_#lU1pWeYFon9dSLEa_VyB#mVQh
z?PA=2Dc(jWJ3x}6ii3T55Cc!5yqfHepD}Aau`gRyyDyX0^c$4DUn|^zh&*kpb-$?G
z_$&i5D|IViX5*8jsQTDcy91P<-@14`*DKNzTID0D<v6>a216us9IT!fK0Ccx?>B<=
zayZ(i&hG<SW;uEv-<bA1y`3~hj=X5RwF=u5i9!)`?K6*<hM5P_CsFTb@v=IaQo<--
z!%-AAZ>R)wr&hC95zf1>>DB2O=tuL~=^3Qp3DK5OSJT`lhx=!r=IP|w`P_BrVrrsZ
zEm6CFIQpoJFhz5ACEy$V6ymfl*XbBRVXJqzh{G}7(S+9ueYA?@1=s5;{D0iN2UL_z
zvo87}S&{?=$p|Qt1tbaxh$vZt<P4H?1_8++lCwmKl5@@i5+zC;a?S{n5jZ^q`1$Ye
zKl|>p)?NGTd)FG~?WwM=eyX~vy80bvhU&SQu1%~M1}{=l%1;`R?B_@##6}B`jv^9F
zj3%BI?>~L~gWxSH<Fb*ujwRLL+$ltfpLNTDwV>Aqj@@@cbpwaz0}Y*Lx0T+(&(t7}
zpVdqaTU`aGyX*D8obnd&yEbHn0%^YG6g9Sa1pO*r#24;&_vaX+o9aOx+x)uC2vHGh
z*rNTqgC4h4QIDc>I>t2pssiEBNw7BI9G}D~L+1J72Zzu0Yc825(X4^i(*EMy%&Q<*
zeU7oMZs%4@2V0?sWSekiPQ)THo=7;R1UGDZ16#2u$QYr}?FIofJ~bg?Ft)>z9*E-z
zkQl&)K=lS}1BdfOO9K>;4UzEQfktgpE0O9GSRQFgu`~o(5HHGL;L}TASY~84hVF&P
zksWE5c}J8GKNefAx&<aYrHLAv*1&~O^&U*PmM2;!pn&ZU3Eu}aU}eG_EaMqiG=Y5<
zk5Cm<3=Yt}5g-zTrdL?9fmR2wGT{d-A%WZsviD_*4u%0)__7<D54PZVeChTpEFcG7
zmJFbr@JfS1CzgAEpX8&>rFcSBZK!xcRe%q=)50o+pD^((mC~R<c#qBqav;otpoS5@
zHXI6QAbN^1S0ca?Junjuptv_7qBCA@B*0=&B`*yZ&)H^wAv}LWcz%GUi|b(^nl7wl
zNw&I9#cYh48*0o4j0Dd3AL`J)P9f@SdlcC>jn@3%C9en8fd{~||3C0yeaB_`VON!G
zQcDMEhsd%JFZWzD=O`uO_FQ<6*hL`H=QY1lxa^ttmA5D|7DSy64jPHLCOu^jXTI}t
z+G0u8saw29oQ&s4<9)NIXhK_0&+g5)-R4Uk9<W9ps!%I)D?ti%=jG`FV^V)n{YR&}
z@lI4JdzK#Dqyw*$ZBkJ`%Wm^T*7VD9JwW76=!Jz{@{>55rZlt%Jqb9%oMDkT`q|G3
z$_0`o=WPkybl0D~wus2>Gw{+P^72Tb@_t5%uJQn9olPJURis?<S)jmof))o|BCoIH
zM(8R0#kL-gk#Zktau;I=>O3Wc?*u#{U*EAI;RTr_JPm|1LT4r&L;CaxG*2j19(a5u
zH$cBZ0;T*F2)6(zPj&txghv6R90J`(2##Qq8;#Lx!FRoQZRijgTD>A*`%;J@s1;K3
zB^lc%4>#8KWAdOE7#a43{DHRsB|3y$I&+6R5J0&H5Pc;d2sOP$2tQ0<!FL62#zJ=;
z!4Ulg_=m!Fc9cLkL-cmCF>ZH4`0oVdFeoU5o*}^|3E-0a2xYc?7`2b!-Pgb7U~)hc
zNd5v4eQg{Bl$)M%cu0ZFCOn}xuWh31Ezo(>^IuFTLy(rn3^O6rOxgg+B{m;`TT!Qx
z5I#txT)+SwG|$0w0|dZiD==)pUf0+(Il(9cbYQX;N(ea{l7P;wU!i%p<GSMG+T!Dy
z;^XS#<ErB0%HrdS;^VKy$K}MwWyHs&#m6N-{5L*+?Q<LO2EYp*WITP}G~~iuu#&w0
zu+k~sLbN~qSyG;xokq(?rpngn_g0Z8R8-5YMh*wa6CAtMrv}@6<2AttTd6K}+Z7!<
zKK(qqJHIv$It1d>my*5b4ut}l5!=>6O7-JUtdFV2(+lwH&yF(Tcp*u@UJ;kRdPcu%
z#_a!;WA03{&x~2VT+)xuBtswpDcHpG2W?<w+4GO01eZj(1SH^#w-iQSP*&@uWkLP=
zEAX(lT-VDw4_#JxE@ksHLoY1|Dr4H<J4txpk-FY+`j-xdhZGN6^n@3$GB4-oBLI;g
zejO0cz*1et0pC>|&|b%Z7i^)Wb>6Llh5k;E{Pi#3VE(|*2t6BNT_6A!uU+m3)CZtp
zV57V4H9`PF!j}>vDgBB-&NDR=fFtty@>JY6_I@;QBdhO*(wR-bGw_ghy$8V$o&(?T
zw;}8^oB{GbKk_5=Y`^v~sQh7q!msbH{hx+pj9Y*Zet_T>@pT}OL1Pktk_NWA3<L+=
zRE;Y5dy6wSBB|`n0xF(8Z+E3q^$6Z_dqG{Ty6}Rcou-YtZ`sLf!Ys}3!V}AisDkr=
z{I=3U`|e!qxvz@j<QbOzMf2o^#UX!f)CGm~7BWHFMq;rreM2{VXzkC_Duq^_*U@eo
z7h4zbC-lQfhZ+r3%e%{G#!{V&;i+yVn7BC2ZSWg+5)~gnkM^z=JA`1Ll6>%BzQ+a}
ztrK=(M{E6_gls~mwB|3glak;-g_yvIp8&Sj5?QW~(8EuxwKO5VIAL@G7$ABzKvLLK
zjIHt+pEYJDbZckS?~yEO^2T8Npx+~KR~78?tKDM{St`MKYz8#gD#0oDxSNXxx{G>Q
zEp5nw&D2w@k##v4ol(=m-DYV6j{tfevsl`=Ja{jIE;hzb2C8<QR$Fp3{b}HY*BkE%
z_VrxLv4>q_S>pGhr$QhJw$%d?R5)8@3sg7&<|)<!6K-NL3l$DKfCFwk7`C@d#1YVn
zNU<kALC_P8Q1uoN%>qUA0_btM)pJ_g-GpL;gQ*DaQq;$TI{+Ar;Eu%(P$UoyFR%+3
zE5SqX8pv?v)8WbuP;*3lMGX6@mkEw%m&Y#{5OD4qj4hG9Jbr<BFOOfad4Z8SLD%K+
z3mE(I_yy*N-LC*Zu8v=@F6PRoT-J7-|BuzeNKDPw@yB2Di);h4jOo>MRtR}UVyeD&
zK7O8GWEtphOf`g(U1aW7CaLvdL6nyO#p<4~)%TfoF7HRT+lYnb7wFF)zU{od-yoc6
zq2WhcU~vzJEVSD!Hbn^Qr<{tVikijE>CUw+-1<|mZNAwWsiU&DUm9B%?IQ0-tuQ}X
zr2V#wGcqlFTQ$0hczv0qSdDx5v~(?nMdpm4@GLAdzg<ah)4cTyUrfyR1w`=-w|dnw
zl`7TG&!nixFv>q9%KF1zfp3ib&UAB~Nuk&zxxMvva5}gDf<?f}VrkP{7;zl+=6xIL
zmW=%OIy6K4PZz9E10R!fP)3aESvD?gu;_ozAQg^&@n+Z_i;Ji8mU4cF@Il~+5b6+v
zu+rC1;=?%_L=80^IpTZowRS^N>D<>?g6a$~xSAv~WOKjLIV(KP817~~X&>U&``ln`
zWwcFKpn4Z)p@k*v!{?JXoZo*{e2}3U*~bVFQdQpFqCn14%SAJ~pH&u*i#QNeUap(H
z2`P@g&(V8B)?2VoOt>#=q|)&Xeu(Ip%pKyQo#Mu>%8ok+x7NR{?=rjRqE7Rs(M)>U
zdVf`|!Ki2%2u)|4;xbcvKgCOxb??;ZMHiY4saS4LTP!DM67#T<5I%yWkFwh5Z=#OK
zMc*3_a$V`cdx(M7?2lpZA5ww$4~z0mksThrACq8sJj_>+rNqYQxfR}Sg=v$YQ`qkq
zN_?kf?S?c7NzoLa##xh&^fNAjcb|f?*qvxhQ~ZQzZ?CZT86Dpv;*;mMAqxATg3uNs
zoA;fd)(V+-2=0@Q;~t}Mr|r-nwP5*;<+^pBm1kVV4}6WBXdebl9pivgD~A8Vz?=Bb
zdK_CUXIo9R`AwV}KgsTDg>LDSdUw7PLdCro`FiCu`TbSb42cSaR2zPgp*Om#Z!s~7
z-7&*#_#!3d{b<gx`Y58c{A`D)@t-_dnG!(l>hLwMCc{p<kY#oWsz3K(fAjSSB|QVO
z$9Yru<`122c`g(yh0M3?$6Eryy&-8+s^wfCgu)I`-x@XgQoW!uY`7D2i_S=IP#aIX
zdBjiEFOP`|o;s0Y*i|g<&TL_qowpcTU9I$ct^2P<({3-Mr<Q$*jg-kYl+(z0G$fa|
zgG8^)fq7I)Dlcsu$x|&%w>;&h9GsK?n%3<D_#MX&v#I*nkH7DEu|7{v{P^`~GP5XZ
zop}B9L#Cdf#0MdVJ>qNxiQWn!8c4*%VmW%z`8w-{*Xc92q?K*lGnbSGsl7x0bH08z
z7TmMLp*E{;w-@L}$lMyr$V3$ScAcAOc5npyD(bXrb~36<w2{g-%^Y)j7SU)6+*FT7
zh0})~@3*uES(RhhI2xl)BUDMH^4%JV4Axf4YS6Y$AeF3bIBkabGMz6roFAM`yPdSv
zG?;6+9=DQBo&T&LGSzU||5jnHVqdB<eLO+pi0eIC^GSm@Ry0Dk7|CXOYtmCuy1trw
z1A_{iN#^Kn34c&XF)^I&=t&GoAyaoI(Z{f^hatgjH|mehFMgd)*Z<lLD40Gw1OF|2
z?#qAH&|rQs-+OT^1yRs29ca-xHa|S|yZCWH!BvI)7;z}40TRGnr#R#^?d6dFI9i^^
zt)8pxWJ~0)#8IZ^vQ7iCjt=1@CAK4-+sd{_jCRX6zNV*(qd!VSJlac9xGnThsqP&_
z-YM^sorm_&-1lui20#DAAKF76w{NXyFl3ibui8>(%416zmZ+laIG8h@UZ}{IzFlxE
zA=0f``o`UHJ}iQ~SZ~O~<Nv6HwkANoCj=*<oUJS9=a(Xr6Z3s-GP3i%=nTE-^AWdS
zhBS&(w{zpsJ`#+-d3L;7w8fjtPn{2EDWth9i(t^}vGG@!K7}q`c$a6+oi98umzkY=
zHo?10hPxjEh-c-J;G(6I7O4_qN1cyfJ}#SpQ@dG~sj5A`a98h`G@q|oPSho8k*DwE
zg&Fu^gO^`uTQ)yMvz9Kz=AtXR#;MNBy4B|JB&_#Vua13+*Hkk6By)f#&rX$D85XaR
z(HZWGP9ISJipepmC?ai5s-Ckd3PD_K@!@f!u-3iadl5mht&)l9RHxx=ox7z7V+~JE
zh3t%bNg)p(QA4C=Ttq5<MI1!sEz69TMDPafB0O3}7u92uGKzx8Mme+Cpr!Fptz|=Q
zzI6Q(BqxFxMu~-y6_jX$v!JW#Lp5YT^7sT^hUcm3e#{eE?~381J|sai{&l{I{)+_J
z;PAvxgi@)RyjxBf`$roL{gjU7O2NlLK~aH0DN!l@6;TyatZI@f(->KkBx+LS)pwR&
ze_whXL9@kRjpk`DClVK<_W0JgRM$H`VYKp2vjpqI+1B&^mOy;Rof}blEkgl%cWoXc
z78te8`>i0BuD*=Q^}`%_>|Jc2fUBw`F(oEz{`jt2Ocm9(1Qoptqapvgs^I8>5mjE2
zF8B;xud=6BR`I*nBU)K9I;HobXw?LarRe1```46q<+TNjb$8{9UmBb3X5RJwjI{P}
zCF|YOUYgPdylolqzp<fW7Q*~x+246AgJo}K%6TW)y6;Lyq+~}w;qIYPRZuC;k*SbN
zB-O`ryzj(Av$3Eg+P5?DDk_r&KY1<qBzL1^XUg0PrH!wkG|5)IKVD5}mAD3TP*2J<
z(|Bw@#Y|!(sd`d&(8#M=^7T`@p*%P;ZuLX)Bs81leXi7fhEf6SlZ}+NFEPH~W9|+P
z5vy1$%j#HkyBXyMIm!eYJx<Nu;a^gxexMUHMcpa6B)a#twBVUd46<4be;=M~B3rBU
z<Tk#Wt!(#*0@`#PJ;%+9Eu*|)B?h#McdT>S7Lvi@Z)cL&ep-ex7+ckTnP;8Wi*7Bc
zySK4$Fu$^j(h`WL;pWGMrzs-#obUeF_d4o)mBPXLp;ym%q-9&G?)u3uA{pJ};gB5&
zP(~S*cfM10tBz^YFag0zp3Hwdm0MvUTVEzH%DYcLQs%KtiIkARPbutg!hBZFua~oA
z9uqHqPb@nYFAov=l-(z2fJ=6i&5AoT?2R$rRqa-$r`RC<nfrydcA$TD;@og?B5rH7
zDmk;B%#e$z)mmA&FN+A?BzkhTRR4oPZAWpw_EjZZVn-TTIT?aZRwdeFgPEu{mhGXe
zoI`OJ8cGd&ioU7lFoW&=LoA=$>w@~Mj@sE|UXa~aQIdvC^&@!3s*GkCFKGgbR84-q
z8aCzII>PuY9p$ilI|b>s9zzV)Q7S!=i}Cw4x`^8uZ{KF|;EBc2srZH$s2D<+j$;G^
zgPXFDWO`+SE0wBA<LXkJ&=2pd_VW=Hw4^krrDx7(Et>pQfLLrFdS{}J?$Gu8sWq+F
z1BvX@XM{$)qvF|Oo8V&=QL+nGMvgV2vjsg~>!{nsmWBCS`*&TGCWq3hOU0M`;c`gZ
zz?i2>c4VddRJ*;s+0&)t8%m3Bl}QsbW{2b|<9*7=<ZCRVQAsUb6Qf#k-bRHV4Dh;?
zJy)0<B%54ru(LLnDtXKB>nI?n|J@tN4bFGBa1wOSo~JW5TR!@3Sw-}kBK&?g&i#Ek
z9A3C|k+y+eOg@t8WOF&}w{|n}$`$z=*##2VyRpN0qFMu?0YgvWakcJ999+P$98XUF
z^HU9M%>T7dHE^<U{P~%NbOneRgc;psL}A78>Frl|!q_x77sfX~!B^iMMYb_^huiGS
zJ-rYp4{x{h<1{7va39^V-TFnR6<qpR$&{1xVs<c>2kxzogW0iK!uE}JB$UlTWM7;x
z;UrJ7hhv*eKj*_;9u**wAQ&~<Uf2dHP<)kpOO_be^{^-}Y1(Y_sB1Gkb~44~#Q05;
zXI*{bBtt`PZUqNNz|eqhmxlpvk+;XWLA<$3jy@{SiPfp@u)P@T>B;iqDdb?f8N$c5
z_X$5R*0dO7iai*K`%UAWr$~?|amL$P*5F(7ks9IrP$D%R^P3h)8&il--HSg!3Vu(K
zYgfeLulwFvOm&Ms6z%3VL#YA7##?Okof(!9)w$=MuUH2?U#-!D_q^^Q<KM#&mWWN`
zuz>40*8Jh3E-kqD9>2dYIy%*ue4FMKb(l2#E3u7__o{46q@4v7=xk|bNQz%Xy}Y?C
zE1AyBC#gAUpo6#e=pI^8-Y5F7Sx!Byda_LBY3dhTINuR$4U^IEP-P+=w-CP(r%1JZ
z2qK}`+M^=#o_|qpJDA?REE_aKld;mwh&1!|mX6?9gz68}Mb5yLC$bCkl75)4Li~cf
z30MnPNN_BAaDrP&x%T2Hc*vQa&BC{!)ci#{FXHFUqO^fMOZ>Q$4n-)oub-4a;k$Xz
zMi{wO`~ZoQkl_;zNusnBKhLyZ*i(wCjpV76`p;B`Uq~Ac`bapvi+AVhbVQc9CC6fW
zQYJmFs>&#qywK9DwKVlfRMR3t^ND<ToYJC<xl%sD{n%m&;~r*tu{WQ*2C@|m<qaUB
z#uV}nwiE|#69lJLi=iEkGgvD@N~+p?T?!2Hckcd_LGrNDdr>Fi74y>A*YCKtP0(Gs
zMoSt&RBv=oyNIgEhE!QrP5ARM%}7{y$32D3rxunay=Bs9h{V5Et4~!LQB$%{+D|><
zYM$T17Y=I~Tr2txpMvo-4cGXd?|ztYt4`yrX5cFiT%<ixMXm|tFk@1u`8U)#O-7ud
zLupN4`x^4sa!%%`54UW&R4H$rR@ff63z1GDw^^<=q3;W??&2!5dA|Q-x0UuY%hfh7
zIP*k4gRIe3XX~4bv+OaJqJ3!jzllJ$|5^k-;(E-%`ezJo)=l<MRfT3aCMsaJ!M6*~
z2ZtgMV!WWvDnhpIW4&>5qcm?yErO5$W9b}!k8ED3+F2ib7bbONr<h=*QcKs-m+k~9
zg4MLsIU%(R$Es-OGb4AE6nc3hh64Vx#lee{g;u83vI|Ihp<nRgZPlHC?D}))zsPMi
z)SdqX-KF)i#uDoy?7biJF3txv_&RdVw%vYp8MB_BkR`dEG0pCiU7QXUT>Q8=2cJ?~
zZ)iAQ1>|YBqXySQs{*(4<>~V+U#ZP-wnc@!f%AbR{<HN=H<x9ejuiRY!CKeMrK%M*
z2k(tL`&I2-r`6B;Yh4@CPa@PI4I|rJ^?eQIJB!p@YwJu&MwW5MI;_#s);$okZ{J#5
zhg4L}3fk{I8Y!(?a0wkr;ww`KPpd=|G9FN;`!u|nE?43<G>5-4cXpuML7f+PhLa%m
zsqQ2G%d%Y2$TeGMhA4vJ5vwT0@)6On;);Aelj%x&btBctO*ub^@mg)IkrIDHzQh-?
z_jJa!8T9$3ef!>0CIyRgPcG~%%k;>%-JCC?HixJTPotdKHp_4h3=S#-Du*V*%c;Tt
zpp4gsv>kjDz5S-PZn(a6{D_lfvvsZ6uJAyoqJH?~i<3b>sZJ^Bk2mK>Sx2?^g_BJR
z$`%~oYVTBMaACPs*Aa^Cp=uO^51y(DGPh>h`PrgW*NyfdW@Oe4OU7y%epol2!cStD
z)id9;QnoH9`S^pDFA-BqsUaQ`XVO;ZO(K<v$k#7P_RBQh;3&#Y^d2FPt@9{nTPWE&
zMtiF5N6L8?8z$noRI<5S<v~Vu$5Kh>Nm6d-r4e`<Vus%pjlv2&G+j;g+*^>5u+T{f
zel>rYam!!)s@zpc+)5jltiJUgr6T*ht)Z4Z6(6JFY(7)tg5pF$sdVV2yoTGapP8Gi
zZqx+?U2{~14)PLW-@^vigWZnzq<XwhdJFi^-IC_Q-uf|E9G=WyoSi&a)*hQ~53_za
zHub{Lg_2%Cub}<l4u7us5p{OPZ0g#SpwU6=5R<{q0hztl1&u8vw4B4$`PWWvO1+z$
z_~|r_4E6EAw4aEmw%n`IzOz8PfvmyvuiJ+l9!Sf0=D(I4C`BJqyYdAs9Nr<MHWo$`
z^H(6N+v8YR3XCzoVWTqccG0$v@Jn4Um-NAz2H#>tkVbwyj$747$kFGzu7$LKmbtI>
zL+TP?qo@!ujPAP$k27oU<)Tkk*KuFil#MJU<sT^boN7EuDOJe9f?y5yB<`2_zv7CV
z&oq8qk;F(7=zR3-boI;hS1J7Z^fMa@LLJsQq}EW1W*4cnGg|WbqqD|OMH+;}yr;sQ
z5dAXGG>DY^>E^(}?4Y@Vv+4Qfz@4Vmik!OfAio)v@)4@CCS|PWYFrm~W%!T|>CmJD
zWgbIX*P3zT%|jud>HLH2t~DIjn(qn0pQ^2X+2t)AKoHXt@Q<GHxc#WG%$QXf=khn$
znAp^srxJ0^<slCqHVv`dgSrAGaD{xMvtu3a4Np&GWGu{c0m~n_QN<L)t&8{Y(@my~
zvk56hze23G>O<;s#<#i#=A}e5WG#<>>KP8y30vWa9(&N99GGuRukl1%7yab1b<GT&
zUhUp49nekmf1&T1iRPLq27A721eQ08KdYXxU;8DQFum$Aee`VJzIwqPP@oT3gZn4Z
zU1Xs_#0Kz?UAEu&7391eEd3SDwJq?z?a`oR8)l~1Tu`Q;;#^Nr=(HuJ`ipj{iT0SA
zM<g6RKFmLOwn`ah>?g9~EzxzLqkRT?(B7sb@E<`q2Y)bZ#y?}T+q!2Kzt|qKkE}az
zA|b_fqVVJ=k#C{x(2?!p#Ghuc=8K}Pv3S+v7?+fj_vGwjRmtgbRc|+|>+(lhVwA`j
zEHBaSO+5Nyk{pGfDk8i$_v|*PqHMjEY&knO7l)4{mxY{*UZv1V68o3!XU^<e1eHan
z{#^4LI7ku2pq{NYWm=-IR--JIt*x7QUhMyKZ#|%Ft7Of&B6I;WK7YwaRy2=kR|w<t
zuN&mF4Y?GNT6bAvZp?VEvfw-_@}Vb1=nHJ?;%xUcYE;EK@fo&wH&igz;m_TWQPlav
z-Iy%c_5`vy^DG(*$$Z+n^|}9-(A}Fcs*ll|3TQeF>r`zQvJ!;Xo-m!{n#iK+JvHWG
zZLNtxFtOzf+9J>9aagkuEUZf4J`&^XI#DS8i9J0bsoK(RO}x5t2Is%do4HJofG#q>
z62xhc*XC1@l|xGP<b^}X53CPfNrmNM#rSfWvBjnyV$mNx?O!&`tj%w#j){ona4^nJ
z_0D+5(Z!z<k<m}r6OYxCc#Xe#C99HLQqbslcC_kNUop|U+2uS@Sl+hp&AW2b<<raU
zo2uhFYE5_Y_Y(UQD)$nZb2nCb;R4<`Nj07juA{0#2Au^piUw;0Rr+ubym{Ar^?275
z2u|LCi^_(f;&7@KqKSBOF)0RJfY?`X5%cfiVqEX9+*QMg-ZxNnLrv3E3jR9(AXQ&w
z{$O3EDpzFwgeQVBYJa8tZTg9=QgDXLtKbZ+mr@G*dX#5_Ct;-LWA%9HZcX*N>B!o~
zDg+i92!pbN_+5K=2YQdi?KIvEVu@*d9>mg6X-hr5nW8}O`sW_*CpSfYt-_DUnRmde
zl3QJlC&xyQes*tlthyvW=ywv;=xJsg3Py9%;D5JOwm%VEu<q=1Hn^UoegS^F#w{H2
z?G!^+AYmfn+uj@XNolo1UpHS*8KIKVnA>i$K~l&#a*r$(w>;~Iqmv3%#<_2=*SkCx
z+g@~;M00$1n<ar*QFQRGr#wgFD~+VVrlFA?o5nIdJ}r%{lJf!ES0Z{Bg+brX^--tK
zF?ceZX-JlN4Llk$GcN=caZa&b_OiQKow%>^OP)3ElNH%XgY&Xo1bC_!P0Kma4m&q=
z8AH7=(?}j@(9&ohfG@hu^r4a|aJ6bx%)klrRGa8c4O7=@TRPM9YFmNYYQKwG|B38~
z@R|4u*>EpG?oLyc_hY^@ww8NIu3wb9pOiUUIXzf;Sz13(@{JEzr25h#lfeat&L?Ms
z+exk$)?0^e;odHpIEPB3hi6^24iSz!LVD^GmPvLK4`%q(X6u>6X0u`?E2Z!&rJ^gP
z6kw0&%I$SKr)3F1<JlT?Kecf`J=Y?kTg5qCy#ae%Ha?stnrd^X0WmXtB$dI)Tc>NG
z`S0;7D~4!(mAH(FUU;}TiUp@Kd1<w{bcpv#XebX_kK)fVLtLsP`59f5r1)KT8eJwV
zr+;gB1~e?=2O7=+4G)qX%?|hW)cXbv5?Tko@!c-4n8r$WZY`ksndo}4cbYkUF>!h}
zt=lxMx^(sd|5u%o@nUJDGM7v8z)d=Hh$uEkK8BSlK}#8~i~LO~tX$32oChZ|`1DCD
zUD^&tR;U<vq&3ShUQ25lVmcv5?Py{MYy9w($Lq-3FuhP4LzCaGJ*u7R+NnTAc-!BD
z+47yj^QePzAv+cA<>rTGIC4zOQf^MmCp=n^CUq`i_M1A5hJ@&xr@l)0z6}9z`WHb2
z7RqdA7OWN@I2lA-S`4c;mI()Yuro>S`Rc5&|Ej)SkD2+G@_}LzA<D8mf0FZOPVmRu
zINR;>SKf)pelY*}eV#k@Bn`XRA^{tzL&JlIN%a?dXKr5g7Zr*~4j&bqqu^Y_Q_Ogg
z8s2NYEC`tcC7|nVy$Uxr6$Ks}p6~fsRqOU~AHPZVA+I#QEEyZvueYl!c<{~W6y3#x
zFM%yC(1CYu-)bPYoLpU?HcaZ{x97DU4%G3`4s0{thp&m6?hUh{mDA4#%s6*@y!ki~
z*B5NgPWe$>B4e=T8*K)z{+G#(?E)2qx6xl214}d?ml=zVL@D)&Z#z9h>FD(s+R!>C
zjUG`d{K#9{Cxm8phmCb_R4|yK1xhLJ(?Qd_lk2!u)Jm$d2L?Nv6t&&4y_5SUm|=f3
zEDmwqXN**3ttg!n?R808l#@wT_YE~B$$i<}whY%hx%VYS;)A(iUCt(B-#qrG7<tPl
zbh<2I0uD#5ViDJsrgi9e%jfi)j1ERcgY#DC6~B?HY!=CLpbZl-AB-9W=Y54C8P~}H
zNYr}wXIl1GFoDH_`sntY229vv1V8)n7`~3vq)_s^Q|xU)q2`DGL-;QOI4uM}Z06^G
z-G$R@SqGN&!%qvHk^DG>WP(tNJ@dSg2+jhbB~)7SqbVK!9HK44D7J;jU!-u3RBJHi
zz0d_H^E(6t9P$^9<ZxaHcwusqA2%}*c08V?oTrVMw4f3CU-CW++ko;$AjsipzHFq1
zi$Ty0Q-xCE5o~Z~UN$~}OGfYtOL_3^4W+uYXf{Agl#CN1`i>SZ2cZzBPt=IZusq2P
z4`n72x!{SzViO&fx??8bK6K!9SZqyT%fV20{L$&DKw7&CWvPt_e^ch`;deWf-;kYX
zr<fLefWI0A+NW=b@GqP|m=KU1hOy&uJs6Nu6QSPIM3*%2vSj?vIe&C!0#9SVLU1)>
zHVpQUPJR1-bXCQ(sl-Ah0lZh-!Y~h=i7ePkQ!@PnGnm$x%g}~IYtI4R;dW!rU+RcI
zXx}L`tpZ~cjJ{J4fMJpUtKi1(-WOcJPPI2@{vd+D045At@PID3Cs)uCXZ*ZF5IlF#
z3TGPpA4A_Mz}4P-bqPiO1q=$94A8EG$^29FQ23h?Y$k`>#n9FH%?JhR4O_~8k^X4~
z<|DN?hhU2XQ{_s!Aj5;eeA!zuX@3>mbGY4<gQ70{gO;1ukiDjjs40i$5{ridcJ2Ea
zc?2j+dOUP}0n=|{%E%QKPZ*YKMyRY-;IBhVRCxNII58e~3sI=|Jj0NEbz}yUm6_Uj
zIo)qb+O!~(c>Xb2Q_g2-%*-JcXxsgxE2azT50|K}fZqYYiGcGIRRfp1qFqVPT}<n@
zjVfu2Ys^7Vr~X0fu7FxADhX`<b%E9)vIS<CYx0czje;<!*EapZJ0rh)g+;~!h6Rj=
zGU7NyHs;`U!mwPuf=wU{!(w&tqzVY)a__loBl*c1Ga-B>UU->}8#?H395eDVSI8gM
z{A1eAMW}CH0=}B?{bfkx$W8uZ+99if6{ouh_@a$;hy{4HGCxF{=xhOSyI_STy4$dz
zNS}%HP`Ii7&;c|=VXg(^x?-=p3O5Yc+Jn)*#bCgI{7DJCvIrYg$3Hj`3)mt7#c?)R
z;oM<0c;wtCz^(QKnj<LHe~3Dw-nzu~Tk^MmNM^W_Tza{Z<rYiQZL4Q*E{?;8-xN5n
zE6^3ZXI5Na>fE1nT9FH~uZdjyG^kmvTWy9os5dC@T%mH@r^jW(MZEn5XHW?gy1euO
zlq$rn^)3~~t*_{Vw5Lg<{=PB<8Nps(UxPVQcmU^k4gc0Q(jfJqEnN&_T>f~?B=?*F
z-Jo3p@pNKT3}Y-Kq-IhyqlB}zwV$B~JkM@Inu~v5JzB9hps)Y9ZbIzo6p8!i{0=s?
zlzv}3=3c;F5BH|-n<?M%-T!G&M-&B~&z>l6XXsff@&^ys7%CC}*&i3xss-)#(F4!_
zNk443)NoDB?YyK1>&qQZ9C@16Ce=pUcI$qWO8lV5(0?^-wYUzFr^_AC?8HG2m`)sv
zrzE=O3SAR(?FWlFbHT{TQhH3-aE5?pXg5X|c>YiNuZK57nf}fA>;7x;g-|9ayes+t
zu^%?QQC*En$4QkkzXHJHv0A*E4PaAZmbvEtJ2i~XRP!$3=UkfAy6jRbC^yuaLojXs
zo7qbCx6HEkf0~><QQ6M8EgmhQusLZ)VyU~nJO-41q{gCF4xCwB-%=5_wkrI+S7=MF
ze8Z&fa_zxzsB3_3EhX^W`@ippDGRz4p-eyjIsUpI=6WVD*SmywCI3J4!=|rQ+}?U!
z?y8=fg#YJS1Zkgvo($>?v5c+*vx=});5CzAZSmKaTd&r(=yDO%uUrc{9O_!28@OKU
ziR1siALbfGFxM*rGusc|Tt}ZNr_9Z@haa_jZ~C#hr`*`2VuVDi#&z;xIkZeQ;rW8;
z@{TW_ZOqPV(@CRdY9#zVB&bj*DOu`)L^+9;FX@gGmtpZH3S=J?sYy^a5~mir*|d)G
z2PPww6HYP<I<ljT&vOm$KpQ*4KX~5=OtJfzikb`Z*T){ZXvM+mR>$ev<*UO1;&B!n
zr>DoGc;#X`(O;E9f+e(S%56+z5uqdzuaIB#?QI!_YLNL|ZnWK^hbDtQq{<d0<YaMQ
z>`b8*?B#&AJDo5-2_k2c{$7u_CO08vyyc%^eC(!cMbsRy!6OHwGVw6U#?GLQ^@z0L
zW#25yN<z%>AH-fx?E#f?(ITme-EaAA*YcyfF6FB@nY8|vp916SJpY9?`1<z*M!zR0
z>-GS~4C0$k<uNe=2IJYg3HAw?Sp|hBUWS{BjDAA?&k9;7M?SJ4RpsRh1UtAB!I>j8
zV&4)GgslM2(?ADz5;%K=8SD^|lq=DFB4Iqx<>A@$!$-kke(@ItoHtb@OoAE~j{nKE
zEO{yDQrq$RQH>>BEg~8{Y9-ZQ;qS!5x?t#b=HENGKY&X@c!zUK6l|X`=&<7UO8#e@
zLeanI;PTR<U{cRS$S$i_Sb@8}2V8>EWW-ZJ{Yu&3zP8KRHIkWNz9b^h^1l7rg}RFU
zY_XwrY3~56(EYnk{?X}cHJ}T@E?@t%3<b3xOaX_*@ZSpmo?iCSK<^b>(0<pg*|0fl
zK!yFc#=kp3oeNX%k9ziP|CQC$kJlt&als3UDwu9q>c`43QYYV!l^rB#nG358Eu5}!
z=8$hewcqH|v4OuVgF(LxY=|B2@A4NE$Llal=P$ot{JqLt|9QcCsr2o?SNV4(3rb#C
zT>e>34_)iv4bCrMC?-^gs{$Na^<GK)U9E$%_tNbO1Z}V5-Q&8f28Ay)1;p|Fu0BC=
zn{eeAKWN`ytpoOn1Jn$5D`<O**FNxfF?<~ZKWLHcFWI0q`BmZRbG6W1Xsw2ywMcL7
zSlu^@dH=;89$H3oks$s{5e-O}>kQfdv!wm4a_b)|1728h{kO`$OWmU1Dr^6t@)cn1
zOO^GKer@dB|6Nd8{a$CP>vi_I{kybHyY{8O>(8*uEUJd3o(>ME*XsZ)gAvrzLB)T$
z4u2Q857(|7W5dzvdL688CRne;KU=2f&g}o!DjSsESNzBYGIrPe9?)_fTK&o}!brgN
z|E|8}eurmP^<`8BJNy=!1p>Mu2&}aF9|h|F4=Q4X4QNGNTX1)$tH^w#@MpCoRpLhJ
zcwC0vS+%;}NT0ew0rAJbTs#u(-th@(eEO77<EmC+H~PsKNhMjN_U<E0_PK9<739yy
z@9x}bQMom*Njc@=fTm4s(xQTGF8skW(1C6)&(E?D+kA7!?6i*^W7AY&{1a;5gB3&M
z71q7mgyXzZrb**khXf)j$x?m#1_lpSunR<LOA&XRTGp|FJoR7)UZ^~xTjo!p^5Ew%
zVDg^UVm}(d^y9cU<wt-_wDY`$2+BR><$w$2MpGANHY$b1(dQ;4*s1h$|MOZ96{*jm
zXFKc<gr@(8Op%Q=<Jd5NNqx@qH0e`8U*8ri0$!yu0DV~5N^!vs^MTL=78IBAsV_l9
zHeODC<8pG;|6Zn>&-*1|hqdQ{SF1QVFAq+1pZo8u;O^Ze97lC(L3@tD4n4_vyh?@M
z+d#Yodh>Z8^w^Adsmw!y$D>zr{*^lJhhHmmscE|AcTG>|v5?^LzfujLXErb;SOYML
zCkFK3sQLY0seev=_d`nFj66~S3lIc%g6`t&V;9Wfsc;uSapx0A0-gx`4>sA|+RjTs
zw4N~VIp~+Dp(6n>&<POzw=vOb;%%a<-~N&P?o}#Da&Mo4fx)2znu9#>fd61^`No_Z
zmq>43BBi}l13D6{0q6uv@_)c|P;R{Uv-dq;B3q1l8|%_Qy$Z8|W8Uel9ODZ=iI2$Q
z$;igLp_$)ZoB7Xi`R@NzkhwGRoNlTEN5R-x{LQcC^QWB=EsOhFHA&9mOPfRoPdj^`
z6w7wa8MQ;A9~LQ{vhuh!@UzPnixQE!98kne@1n+6yG1bZ<uuFkZOho4cJ~}LPu<JT
zIH1xveQoAK$s`kB+EiR-p|Qg(<;WlpDKUB+J=znv<Lw&MBBxHh&K()oxn6KF)#GLg
zA9*(I%6r<TV6l}1x$w%gxTQ3_T=O+7dL=#LEcazK+1dgXp6=;+Y_`4c?D>-#USu<@
zGGhG<h3R~VV!$-9RCu6_sDBba>o%FVGm++$$}<hw)7c9XH^+<M>53y%?)5WSOLOb}
zbN6b*FPkEh&t1jd*Zf@L+l2@@ALj8zAN1bfIjW726EYm(iQ4e+N?o7SgVa#YB!`Lh
zCbZOWEcl$^m?=+$*OHRSmzY!kSe6Qc;7t}UR&eMCo;FJmS7;ovHy+B~Tbxv#Oq8ss
z5?#E%3sJ3;N{w-=)>m1!W%%G_>n^H}-_c%<*%DvN9VDqsq(@X2Vk#*Rx7L?YjW)I>
z*UKJiI_GU-9btMC5`m_qZjSYi7|)kDhP54hl}uo9pn5wyG8c^pl<->Q3FKM1KYsDI
zSLF{)WEpjH=40V|i5=W1AjC_JtjOw2x^d0K2utLZKrpy4BU6CUzFa8X0yOx=L;l?Y
zx|k^qA*Pttw_-g%12I~dIMyK(-X^x-661*n8&0)E9tnoiSSNS8pP-E`F(Y>pe};)^
z?-sBFVmi77-e6kQLdAr{da42xLig{m6ovSEi_`0BQ{amA!$#?9XKe|Vb3-X;v5M_2
zf>5UKRuo<9YLX$IqW5336ovUmis$NT+d2XK3&~;r@=z%4Er0e!T2ZKw{N|*_rHfUp
zgMlH(HMRg?D4>*%>miRL0P>JasW9G-7Q%hOa;|Q;SjF&~kUY#kc)`?Js_n0Rp$M*c
z!NfyX*uPz3|GR^wXz8C&0<NLh{sT%`6q?f1R*4stALZ>D4qAIA%uO4EOoh%#Iuj9Y
zJ99ZRQn-gfUK>-NCwNK5BR{EC$(SXQ?aukuI=H1z)KM_Gwg-&REpA~rDw%7JLWbz{
z)b&SNNuCasEzU*?@HkaF)v)lCcO`aqSPRu~mJSMVIawMgjOKIFiZJ1q)43Yp``V>0
z``QVqcZT?P5betN)_$kJ4d+-$$8^jRx_{riT})3sMd$wWf`@Ki16Z4LeP(;V`Xqhr
z^rVAGf8uyM`hOAcP9z#{{gi;&*&iTO14Y!e(h-8sztD;m8&eBINXGKWQAqtuNHnvq
z_O4H@7X_16d&>fbBdU=4T!?=^8uSv)3F~X2V6ueuy%bU(fI$lLsZE1HqQ-FSr@&2(
z_NiS7!6$)<MB4i5URuJjpf_Vi{DQ|>Nc~?4j_~&Ljgy=qb_YJS=o5kPhWh61UH^u_
z7Gk$I*Eq>$!GV#Mz{_7c_(|<<L~2`YntP2Q`Q}E|CpF^n)nwv2&QhXXmJqvLq^*q0
z9t_93m2pS|JyRjk|DLdbF(CnOKlpTf42*<{2W$542^~a06cBu+58;(Q|BevO0Ym}8
zSNZ_>Fa`fX7;-O7jYis9Yg8iv(p(KPg=$!6M1mdr-D|kPn2A0{;BC@D>crzfkrzC`
zT(&d$m}v<xjJ7~?sD3$D)4*gvExh)09AM1>%>M}oOkV}$0m&&a`M;HM&2ecwfCrfM
z3hC7>|KNaW`3>GsL<)Ip$-TxA%zq3VZ?iL*n0JX9YXWrX_hJAil|)`#Y5g<_R;3hb
ztE-*@R=d+Lp5?a9!w*bOIlG%qyqf(@QcY6vS?HgPLgakeht%2&f6N%*j@?&>HDpIK
zR6#@2xP<BD=s3u%(B9tzP^>h2$eX`-rb_6>IZ(hFT5(p;MqQvjW^F@=)@)P157!ST
z7)e4C)1&5!gt8;(<Bcprv_u|(cJ~hHhUq=)TW8+rXjnn)-2&e)NwAE2MS2fK$T`l8
z3^EabW1b34xnLl%X$<_(B|D3C$mF$zplkN3OZGqW?!!wo7_o}k*J#ME6K|9<qpqSu
zVOiFnnJ)9vIw8=k3xfmQhF}eE(@tpPfc;PQf@}82mDdP=r)7*qsM^j%zX{a1##h?5
zw|u-356!_>i8|xbm;meV%q_ovE#i$m%;Xr>Pk(O_zt#PF&tUkiZqDE8UTp=#KwVYa
z!pGdNsZ8>!IcTfa8pl`rBnu)`Z7oVENkBG+Qd&Q$)yh~6xtGxi)mWu3WP7G2fc$$F
z8J2^YI~jsspwRi`gH|P9(>TbzQzAT@6dtF$2-f2$w98JjE8J9Ly6X|{T%^VQmL|Ak
z&mR)Sx3eRf4p+Ggv2(6Jaqoa`)OU${!Ln<OrZyAHEhV#T^lM?#T1($OSYbxK%{4kq
zv{BqNHcT4RT>|{9X$Ls0EDaIyf~Ja<Cgzt!;x<qhL=-pqn=}(UENNPJasB9a*N4h-
z09!p&)(z`h1W;M-Tqx+yHZh)!#Ls+qIo-MZz%~!%d$vRln-e%3jL)Cz1&ptSn5LOD
z9z0toLtn$QJi_q|Zzc}$4<(2vUV10~p=D-)8Ch4G3Q5FQ`~&p*z?X|0m+}!ObRQ+~
zZ|cy(Y;SpiE{O@2=)Sgv#l6^=_LgVpl0o`JdU1kdGvvtr;^IIEXE}(%2n<m3EWINj
z28lh?-~Vz7XfJe%dzYedFGa`rHGzEqHx^uBQvi`yQ&>S!Vqc>4|9?-EC_1L(J={of
zIc*E8ClDG4UMCVVmo&>OpyJ=F+70)JlUp|>%wO~p4(%n_&zCBsT-i<(JqR=Qv+mz7
zVbK4<n<{jlHufJw{{!zzh`;Fle+-2!(G`X_!0Hj=-MZTMksh>_1QtttGO-Bp6u%GX
zR>Z*bUUecpC<YM(1r^iLB91QEV=?)*#@2>$*1~l|(&cPaFAlidScZE0YyG&=3CMRZ
zc3)6%X6~`KzBJeAA<sDz-0#0%B2gbQ<T~VJPTB6x<(YdB&?6Gp$-Xc6`t<fnU7!eN
z_g&pGji*x(P-?b&=N{yAKr`P0n$jk|=OKG2m)|VljGRryu)ehpy3uN!<64N*Y$$Th
zXt$@H$HGTKISqr^yWN*SOTpxjJr;a%8yJH)0>*?u$K(_^$9*A=fR344oyuTAmS+T0
zzT^cd^RY&|QNyk3vMfw4W_<ute$N1=kWs_ustW9d#&`h$v*$O=<R|00<sJCN;{~s`
zOhM>;0n!5kp@6?bCntpgUImkTH`hsMV}_{$>F*s%wJ>F%Ho&%k=4Kx#Cju1kFckXU
z0TeKF%urpOgcjy|=on6WFh&$QCf&?jHrA663fO=L04`Gp-*Q}K8rZ_6`^h=Ac+P07
zU(##yS$@Rrk)B*N((y$)y;k{x)C4S(<>tuZIl`E-9HAPg^jr;xXtA2vkX^n<<0D$8
zSPn)FS^2}tCy~jUlTAtxmj%1%>3Nl3UK|)ESda48HyN$xpNF{4cU72oMD0dTGUoBp
zjEHqWrgN3~+}yej8@f+9f@<ovXE<sDW;Pib`7BBrA?CKuaYYd4vMQ!076Q?Bh2vpD
zfs)O>SddL##6hg6fP;#(Qo8s2i`Y&V8IIf2i+lCRb#6`*Qzi#zD$l2;oc9mxf-3aK
zH%02)lFiInjv-9x5~EVX?1WjhOlzlV>j!V%ZHLbs9Jp6hKuXoCk46qI4j?w8ZfC*0
zldl!$Tv=!F@VDQcX!`%4(0v<Sn4o6(u)g%6fwNiyno7H^C0`_A!(W9~@i{-g;SZW0
zV3K*>LDjILTZ9nFpPxVVLRyyNzi4y&0wHueQ2l1Bgw@B*HYqirQa&Yo;!aexR1?=a
zWovOfS;MhYdl6W<xMn(XOhadO`dygVd^&yaY;f`1p;nFWZS%aPGyFIt;)PR<_f+YT
zPuo0u&Gz!zd19^oVeC*rmD(}Ml-n7T%rJ#-eM`kMTImD9PHuH0N}qiu|0U|Qay)V$
zpC!8khl(RYNO9Vm$OS=@iu)H87Y8T37js=|uHW5`H-~4x7AU7cq_>BLS*l04vFqzA
z0}D1D!Cj<p`Lz{<KRs<wGxAJURByUHZPsv(`0DLGgGDRWL;iZj4|@K52#(&_V#5bB
zXxqPJ=AEPkmEWRlqH3Pe`B3ALRU}ogC!)1R9@I|e1fRT3tg9W?4|1p|oepI$6c_va
zsa(Xh3}1e{8IGEvYN*eU_b9!TXE1;<OwFhl{#@2rL)BSaJT6~S86uldr&9VHU(~q>
ziAjCj_#sl#yx8tsPIap7=X&0|vb!m3s>AzK)>XW9*}Sq%Wg@>`su?}pgrkv(x+S<*
z!0!@Pt(*5apWBpdC62j_zv8Ab9i+5wDRpEtkl%%HYLnq4b5CmOT=fFUcz)A(Hf|Sk
z=y$;Byy14jrkkdZnpI*$`m(&`Vs+4g^W@Q-J5SJ3R{_IZilmyKyLmaB4Xr6DA{lPf
zoU!<61?Rc8qBc6?=CsbKnU>{8v7ir46-3d|)qJ)$W>2WSlq)QPTiOT0Ac-yk=%VYP
z56#=MmX(#Am&>DrQ||?!W%-0S98HADVw&DY!YWnKW~|~BL2jF1;48gX_#?Td)&E5f
zxkcCzwE~&y+OoFV_eDiz6`mDa|Cc3)TAWqu1G~dfNqe5^_*v@Xsa}?S>-X|Z#=Yu{
zhg!XHTu?W>^>}=mUzzu;OC_DCoW;zuo;+%sUT>>C<2^MyOQuBOSwpEH+aI1{(GjUz
zE+DgcQ%$zNuQ;aFq}7JqV%gTewd7R))Whe9^H=D8aIl8q*@yX@gMwhcTZ`Cld)vo#
z=%tLeL`iY0-*6${Zy*aTYde51BdsI!5gHG&o78M%ZIr|=UCSK&f$t-`eZ<ZwvS|z%
zdxGHibIPi}Mr50rhue3exZxA-L84(>cOftF^wcymiVe$O_-*FT`FqxxBp+Zh+Z6iO
za=R8fgn2roCA)_fPPj6RwLXPlH+|LfEHg={9(rOv%(5-<t5d8Tb@yA$1J`D;XvOjZ
zjwdB4jO*x6qqLChm~8o<bj(biSEZv%F;<gl*Pm@f9kx}tCFzu(nn!L~?Q2K`O-ZIq
z@IRZgbKSK|+&3dWn|+`d?^#P$l;OhC=^cZIO!szHN11AbI(Jz&Pb}%|#0QJl@uGvT
zLiSF@-8z0#GpwFX`f&&r)$zkOZT!rvC+F@?HL}$@)tg;O#MY-M88!1e?!E?f{M)}O
z#OF*i8@9<RGJ7{gT$&$*Ms9Nk3?BS=VH)gW!b6berEqGV(>Kneu3V)x$h|J;o%+tA
zUY>_L3bWv%mX>*duCiLKv<5#<zFkCaPA$h*)dVZkKEPVf#l$q{b~IsKi$Zp_0p@zR
zy0EC~TgFHAGQ+~Q4QHS2i{!J?Yi08D!p64*ZTH7ajaH_I30D>J?$gUaI!`nh_?FiM
zoyvmko0fN#r+fQ(k~E^p_Qeu9)-u(SSkd+TDGXhy@uNSEXC%8Y<{TX^6*Ka$$96m2
zFG=jk)o1y$36Xl^Xd6&@@Yie0>Xm~Z8!m!f_mTOyKSf5@GQN(Gwl_}Vs8lQ4J*Tv5
zm}Gfe;X<b*Xt?aSCGq7zQeDt)sttT-!`-o@qRsL!0H<Nn>*ML>x7!yk7_!Ro(K3%+
z&oM51&s3`9L>cyfg5N1>g(p+=v*-DF+-y(U<dk=cGMrf*sA)X;yfFPd_j%!1H1(Zm
zJ>sS}Nl|vjVNZfIOT@%#hGd9E3dbU;-;8ZR-tLcS@Oo?lRY{x7GACP6UJH2|M4ezf
zFFY$r#NJ@_aCu(Xi*j(ciH~wrAK~<aX2UuP`w}%WeZnZdn41FvgngkRPO!|n9V39n
zY~<avIrq^jyO=7vn^}d$1fy;x_|2emt6eMBmTI!i>8+=4!A(JRoQArHw>3Tsc8?l2
zr!pYeC!4N`VE?PoUxbG+xJE^XG2OSC;=emJt!kf(ZrDIh(XkvnbDG(EcB6pIgy)&M
zHW7;G+4~h?Gv(Tg=fC*k*uJp8*e|#>7&cfhrDN|pkx-d?=rpD48y;zT1LCFhCP;|r
zn?VV;=Y|DaabRI!cX9JeL{k~TxS_kc;MN)_l5C?$By}<GS>I}=XNBFWYcJWb00l~n
zCpl<5v7U*APkIx})$PuVETca*i(*aQ?GEH(TF=D5M*{-qQsX0JNnp-WqSq>M<@wFy
zCOzb=$XqChT%+*<cAUav_X{Or^p?nxDJYTSSlcllh?HZOgKz)m?1UZx45MP3iNQU;
zAwU2pgl>VGCEdi}<beFBx48N8jv>H|+AW}oDfm$jKu+ZP0U!tIV*+R}$hVfB?$YxR
zYhikE-HO%oosWTUBd%oY>K4Epm#Zopix(*8si%b?l%oQ{3yt^-n$}2Tvk~p=U)Wi?
zFdtAN^TA+sYhgxk^>KG$ip0X}VX}3zSjTvRYViqRd4vprL3vrA_JRQh73X&V7#w}N
z1yG=X!QD?j0C)$SkuYlkVC<!*G4L;8J&%y{dy1PayWMp#Rbh6J3HAJTSGR`p@zsJn
zY<I_lq5{R7d!Z!Wu>TkCSBejAu0PXCpvlGcwoUoJNL0FCEUFvYP8dpkkM7wWzg#RO
z(qe91%l7e*bPDIYJa^Z>@L#xSR0NetP%C5=9K7gdPbF_-zxbG8dTv+dNH)c2_N%RC
zW0>gX#o8Q6=**fEgA*BMrd@a?VQKyQ=vG7LC%sIEqI*umK?*5@b22~9BjuxHa@rMC
z{rTL6t*K9{aL!cyUGtyuE2JdR_4h`uEQ{{hSK=g$8{S`EoGXs_p8s+iKV|bgpR5*c
z)=7njY~l;z_&LX^3<Ssc&L;lYFUt;bA(Vjv3B;O#w3m>lyASH@P7es@Pto!#*4w5V
zf}1uU_tqr*nzkA|-E`X6t~%m0t|8e3|2NJyGIH=snC^>gjisF_)<;8ot^(?9>PciX
z54-(W4c}*j(to|hEwx)d->~lcDbY8cS~*pPs(kTTKlkSc+r*+C)?vr5+`Wp+ch{fj
zBy8K`vXOPxpV*PDMidaQMwCv=f6J`=j<XqlW`5WoRGz&XP=2r4C5BwU_y@iUwh;Ix
z@QIltGx_OFm#MRzHqQWR9i@VTX>)&7XHqSC*P8n!uXo~p&TqBbQNIZ%k<1Zrj%#Gs
zii(}@d(JwZ+e6Mn9B4vmLJ0y`Mj$St?~N^RF6iBN?F2nv+*r?c;uhvE;PD{LLFmLc
zLhsqPgBSw$@|PMjp}`G;9O~d-h(Wvqxy{5N%ohP6h|8keJzS}rXHx)m_`dv=+X~RO
zH!YzTH$UuTcQ^e)52F9Y-OK3by7KW?OHX6rC19cb2ssPH!^>^~ZA=*u53nTUc%6jw
zKtmIXYXF*!z%7S@>m)>Wm4w2slMobe8x&VM0Bm)O&Z>~h)5Km|z8uvA7x1<V&|iTH
zHT5#p1#+KbYCp$h*AD^OfW!k$A}rv&1p^oc5aCb^+R!&7puDh*ICzy2KVN6WTQCgz
zm~Rt7o`Jpf0TK=+G&P37dO(B&17Bt!U|<1EL1E~Go06ZeF#wVP41*^z!mz))t+r+Y
zf#L(C|3S?ar3X&K{)x6J`U(GEX~I$^0Q)~9W&W2Ec9efEj<@{1fM>&g^w>%i#ZPrz
z+IK^SC<26redsZi?w*_6u?s+RMa`!8wLn+XO5I=(#^iKs4Ez+HuZz`3u^Nb{?uapY
z!2$Y_q8z_#cu`KTQxwmWE|SDW%w8*B{i^1YiCLwsAN2M|m|Y}nOzI<KXc%oWz9+U~
zB(Aq7il^`(%hh{vI@3&)^)>kYXJ?sHZh{jP&Yy?R5~`*fq7NY)-|E%ccih|f>Jknh
z{O1g0AMGoioPl>PeT^pbb{gs;hmg0nY@HvJLYBK4&W>tMRjel8jFjuWP0~Bqgq-Om
z+<ZBJl3noi;@~;G+lBp+<iOT~T1y4;M`I$D2Wkb_HR&hgqExS@T|0|4m=3<S=HxGm
z>}?(kD_0ng2QY1}rM)mAo0C!0s6W~Wo}4}1O?A!kH0N3EA;M6WQhO_>&~R?Kew3@f
zarU7uspydP!1e1?@961WXMUaS?aHC#g><<Qklv3w^N{97^m|KdHp_^1Ula$|t8J0}
zDq0+mE=M0zSAh6R<1fo*?V#E5O$QH|ad1wX`PY-IO;2*3oCi;vDY!Z(AGt3-8VlL5
zM($-Weef2gnE$B(k5xrn$Fy6nb#|NT3+ZXnywl@PtCN*S=Y@4=qd&1Gwol2{dwwSI
zKURHW1|dtKe~6Eo<f3`DiPxkiRomcwdMZm|@1{ENZ92s2@Oho%JbdQ2USrbTv*VO)
zmvHZLYJ(b2#}bQh#Qs_@P%7?i{*n=_vEM=7F8*K4y>(QSU-v$&qLg$aC>^4-l*EW2
zA>B%M3M1X!(%m3k5+dD5OG$Tk4Bf-Pdk^X-p6B_k_5Jf*i#c;<-}_wWI<fcJ=Po{8
zyl+~V3}f6R{6+?0rFe>TFt2@@=|08|J?M4g`$jgf)A^6=SrQES>+@6fZ}V=my`s*v
zyPUJw<tfvy(yMO!R=fc&(0jX38J)}KpQo^%AHY@+J+1!4JPp0#CdF=0`B7w}HnJ11
z+s*8?eOpC@9?Yfjx;U)cXdStJ1g89nBKOU=iTgvat|L2)b-R0;unJnRdvtYD)V>?b
zwYL=SXnV}c72%iM8qib~)%kRH_8DEb#kzLm?91rATD&ZC(*dU4FlTUj#m$<nnvt`#
z(-l+;&1*fc>WA&qvbh1QFz2{DHM#WVqd6LpD&ZoYU`&@dqE>nJX~vu7lTP;&+<B-d
zOx{TNGQs|!%^pQH_DjEOU&tx5z)k}29-lX<;t@vjEC0wk3moxBmx{GzVAbWFwd7-K
zoj&W3D~C8=_ttm8i1zHXZK|wp5WGvO$Z}lWajzk2-8gTznTV^#6`i>lpT5nzkk~EM
z3bQonYdmQj&@yp%F6x4b9Xe}HYDjD?owlg=TRiTKIZ5UG%CESy&Jiy$TGi9nEt6TJ
z_(MKwm@Q;2GB#Ue@I}a){AthtWG)Fb=W;!cxqfK`%jmRjpAB9gQzQ4W1I2<_Qn$%Y
zgV$3JX4q4mJFEvBc8Lf0murmp&iGT4l}}%?T~>q3=R2(}$wc!Czs|PxGr9PdkZc5=
zK~kk4*B_sTjW@gB?Ap#YZEozJ;(Wc@g>cVlHaj=bEI?Ym)b6nvKkQuglNf?^G}b)n
z537qhO*$?vYwiBMY<H%I7?!_J0fP2NlOhu$hLej~UYt+U`?k>F(J&A+0O9ekAow;U
z0D^{<KS6LfkO3m|UQZeL8V|(2`M{b91mtV4fN;Pc9yIg-0#f*<f$rM}dthDswKOJp
zllpj(0y_rY<ctrv6SP3w9qt`|8zB2fQB5OH!&i9&cxVnp^tZPQYykmF8+^y$3y)KP
z8wuipfIt|&V~_&~1Dt@n4*CGTz>Nv#0N+k__>SS0FA&NAYkVjR(s$ATAVmKakpp`Q
za->E|_|C+xQ^nv{80AfR{+kre?~c%4X*T*5?DTrFA*ljY-rk_#2j>9Xx)2Qr07|S#
z;sA$RGOTb8z%>ycc%R)~B)R1P#8>Nox+)IH+y+>;TM8hMf$xEC1FVNYC$79=_!ZG)
ziTvI#J>UtyWd(#+SpUD;B>37=_6REnKF4`aRVJ+O+jTGEgrY}C+5b7ldy=vj`pkNC
zdK%|PH7DhjbQOdjHm)`;_=~dnCmOD-_V^mY4m*SNOf2*HCxl0GZP%olmX;>k{rL$y
zQ-kyd+P|(ZO;}s*)Nr4wlR7hnx`qYmIR<W<7i8qnysS_Pw6px8<jZvO;3M!zcq2DK
zt0m~m$}-LY-Y%4cV77S3*&TO&ItbN0lB9QrsnW$+Zvpn8x{iBSZDyCWp=WephhYtg
zpsBG5a%i!+nHstGExf$;xL{kgv0zi_n{&m@C)_hra3J*kbDE+di_`j0QZF^HG4tA@
zN{U#s(fWZPGZo&c^7o^aBIPC;7FFHD=7=S;6+B~cBX$Z^u{UJQpfm4>V$1@YaW7x*
z=Bk5=BGq)Ah4Z7sV^6sUmaoOYp`in0$7msG=?CmD-26HQex4IQ0tqb}8DByCJHBo-
zLYW^lCHuAKa%669`?Z^YOJ^?1l1_{jz-S_Kn-fUe*sWwdgRWU1F;}&wRDs*9K`-jn
z)*Q($X6Ndmj|1%OEgGAW2BB&w^O`YEp!tIYe^d?9u<3I50m!F{S(>pTmG-HMmeH$&
zJvYS!7ghPgigM?eioLS96&3p~SS6t%O?!FtMDuD2m`e1fr@<9XI@PVCt-d-Zsz9eZ
zJGms6mRakCE}!cVyRM5!@Ib%;F{=Pohf&*kFi{%z@);3pPJ4UhFw1Hw{T`_`ujxn$
z35ST**c7Kyl|WqEDe>Ig&Jo1_s@`2<7IWt1(ey0k>2>$ZD#D2QMvi?XM2o7)hQ}Ur
z7<;Q04(|3k$EWe`<jvDm=clcH0v}^%1WKz(8#dS*-fX@6meJ365%gro#yMzZdimmX
zI9^~se7lM{WIojZ)a{xx-`F_>a~Uz80?Ra=kp;m{X|B(r9Nfnjr=joMTk%n<%vk3-
zreH4?%!?cMToemGTz%aUoSO6N6NA?JS1vCbmG8DxiL%siDlXO{F+U<GqQKaGQr}i;
z9H{f|>?i7Edj&5e%;BO&t8O>leTdoqNsn~x(RY8&ht(sb+bSh48)?Uq`uw=>2ZYDi
zBToL2<&P7{d#2^k^W3?k8;Pz=_uW|MmTB~2==&;}lo*$@4#=f{UHUfEyYP&#)_vii
z0}L8IgLNV_-DG7$Q9`GEcjqlCcO>YXUJtr@iAJG?Y1e9@9G<>dm-))Q1_Qad8_qpR
zo2I%v%?W|#4!YMFiMsc6k5`>7*Mrt!VeZDued!Gkj=5Yk&tc|M^QkKCpgJ-KoQZin
zwt3gBqFLY{<vATOStx)7I?T8F{L@-9yDr<5_f7H}gW174b>G&x55}H^roJUzpY@WE
zh>`DftXdXoa+-pif7UwwGHutW(OY}55F4p?dHJ3Tnq@QwNw9S`oK1aS^^fe{%k9{$
z^M$X|@41pNFE$QYn?Mng)5~F@{Gw->5z`GX!C*;8cZw<KH=CPP@7|lr0UUSdTzO~3
zscZWmQ#4bLE1D=1s#+JOD`fY`y3go{-5i_^7wlxFp<(yjc>`UAVKr)Vq{9(4==k2p
zsbguG<QyC8yi<@*<=~5rrs=RtKeL><-8<KqomD?7Mkv$Vsj3^cC4N5Q8{=;T-90&_
zLYmh)v2&hXf^qnsnKfB}NshB~txzQbA%nE<ujDTic19bGH9loMR|4G_fl8eqkTBDg
z<E9F*vRQMDHL1YK*OjXW_H4C#9^iSmjqCA|RM1g_;ntMK@mWHx9al`BSZ&{kZyu;H
zp_Uq=-1s$A!8TthQ+}IUh0x4-bkwqpX{`MGR5%LmObU&*ccR<|hi#|D?O8Pl$0>Z;
zO45qI$vEX~r*767)$S$~JO7=9rViWIWZxWdAs1+YRH`6P`*@f&Kf$_7L#T!_ibvEN
zwex$Sg;aA|Ld!?jMP5NP?%k+mP!6LigzPGC$I<ovfm_Z}{0wgqxW;VJy_7ke5QXAl
zXBZgs`7kThI16s%Rj<O$MU6kvX_C^qtz<3OwsBhG44p0##NvN?syGS76l+M+t)0!h
zxW0nTANG%&xi9a=&)bg``94oCPg_EhZg2P&aD+1;)u?U9wI>7Z<6tJX)+OV{05fN}
zx~HrlUA99ywx=JG?d{>-*gbo;2fn+1S~BfQSeJs;Xnt^drOhXObAhz>WVz{P4%gpu
zHmJ6ru(;LRu)HSqq;KW>fawwoVU@AfaGTDv60a<iC6+2WN8S`#jBmAeSUG`0(3z4{
z?sA#SH!`FabhGVk>9OTmiA^nS>3~DCJeMRD!1W(!Tl`1%ESdXxaR}lM!rsSIvd7-m
z{#&OMrrj1=O<ytPz({0ZuthByT4U3|5sZ$r0d`(|##QE~ZIxcce{tyOQ=W#N-F4VY
z$@dL;-kxA_y2J!}^>jDPpER1Gbs2H*%)q@aX~kXp>m(!JT<VI;jiLRS|Dv7XB*grB
zuCa3gX_xro+Hk9C`1-n_K5a!LWRIED4Z8d3%m})!V&hg)^Gd2RKz6w?K(?nbpp;)}
z(dY#skvc|Dq0Y?SH0@Pv@>}Ayd)`5|-CtvMm{`i2mVTVR_#QL>o2qHP7H`@BigN`a
zn=u7J5!pSV>wHHZ1AGhYnCHC+0)J=S#vPkgV?D%cppMP+r-|2EAlP-&&Hm;Ml7E#B
z<bS-qjO+jQ_A*Wm&VRnUEJfMejD!{KdRJ?4!24w+%_M=(>$ypPjHw5g2(^_Teuf%C
zZpiFw){;-k)f1a7jouF(bwz%`5}!^(!n~$bO!H->FCcI~ThUZ+BWkmk!9pdfIX|_w
z-?L~sH#%FIQc{W;Q$IQ>w!)U^kS%*L_LJ)-DP+EB=gF+T(DgxB(ieAuM#wJA=4Fkl
zi-yyFT-?#>caE`0{gO{1RY>-b;@P0qNM}i8*6@xMl(%S4v)w<A#-Dy7ydTKYMxfvk
zT~?CDMRH^LwX?QXwYs}%eqdh99&BHN)HNZP3ZB(xe8NL*LaBOn+OjCnyAd>=u}~#r
zf%=O54pW>Pv<El|O%=V;0(L)t>ankh<$cG@P(aLK@U0a+58LshSCE%TUEgcw1xV)l
zx9uA4<H<%$IBUMUXZ`>uoQ7rtJCNv6SBi*Vyk7d8BQYXPA-@?~0IOkWE=Rdu3QJr@
z8s>1pa&s3As=JLW>RPW84)y@Agm@sEiflT*Y`}M~rzxRnC_l(4Caqj8qV*?>6cicp
zl@(f+$gNu|deI08c+769t0T8Qs%OiSx61b=mUVsflX%+to}2@spPa9hXXM{XtrHV&
zu$lK}<bZ_m0PS#7GIfu=#w0U;GTI+s%pm>=4RJav`-?61AF8AE-2?qrg|6|e`W0+O
zmX+4e#w8Vv>_yp=iUe45wjOMa5G#mx<|@up-nSim_qgR)fC)eJQ)@xf{k;*CJM5{_
zKQlLe1a#OHa4V~sxdonFecuEj1nce~5*^j@MC*D{QX2^8sNQ1_lSZTBRCvUZkK!NP
zH=}w`@$&0?gdPh}L}b8V1cT68uMwB}5kcv?==LL)u!R|v!=0(l)&vd&H){*`yL$>H
zf&XJ#^ZehYH5U)tKc{t(iUb&VEoS4k%0@MM9_6QuC$F$RTarzuBh)^csM(m(ZJjE5
zkGivtSr+rIQmBn7);q#yN%U}8sGN-`DQrZ(2UqC|jX=?d$h+PdhxwkD3N?ECT7JlP
z<7DB-!B+j<eGTWAf&xK=o~URXA0buB2lodNo*L1&<S!)0tseDclit)g;sr@Whq<>c
zWk&R@E)`tb&{n7yjTyxt<Jbf!zdXc=M8JH#DN^G=J2RM;Bx>oV6xhD5HNZ99w>@hY
zhED9P5!C)BT%_kx@RbBcmp*Go#7WdUQ}g4uW1#yU_X1euUn;vtNfdcLLV21&lxgqm
zDI%g>K+uyHPyNanWl|ZZET*BkBjuC$`>oOs6-PanS&O{giE=uyvRqOE9>gHyTpaq2
zSCvuaYYjvBKd^WOd+((M`}{<)IemzuSla2GYuaer-$n9TKahGQxRfH5<6iEJZ1Z|t
zUu;iB0X|~NhMtXAPAikMPddUn$M~C^9m+`UB%&dDV%sSH8L0_B61?zGVMF7-!iA7g
zi+3-SeecW>VjGAMay5a|;(FRQXHQQ~ja+Z+pUv~TxHGFfOK=e~=)$SSC^h9}Y+u2D
zgErS3o)baH$ud{;%^t%=Ou=+vcEY8&^7Hcv?H}K1{1VhZD4WQP$&{7`-IZckmxG3R
zR3Dvs_273RCOu1wP!~S7d(oCd#mc&0{DhrFk~FtDq7%Q_<<M{qgo#mzMTIlygPJ74
zFpPF25pNVIArrXLW1>VU$4!c``C4ywOfyw_)gx&ZQ+;h`_a23LW)+y3mLMRTZ~nyG
z2)pxn?O;9GKuD^>yD#M0W$0unoDV9#h=@{{qCdfq4@m8R%AlrPa;dcEl@brAwZ`Le
z+N93mFbL-u{P-D?BB9Len~h${V`z`d8|VDM$g({0@#lhV$)AsC>7yaS7#MyLbFV^$
zVh~JJpYGp1O{^IwoAKEUX_e39+WLxo|6`S))Vm1EHGGrniB-h0Xlm&?rUXy?<;ICX
zv(Via4jra$5sy*_z?#cPH*(=pY2!<(>Rb|wpysrfYX5Cs9PIx$^I~OZf5Guj1B19~
zgwa$*tUAL!L92N^6oMDH$dNZJ@<SZ=@990<KYFF-XgGMdYs}w#ef6M;Qo8i8pst|K
ziN@YZ1c!<^Li`DvG;5?~0uprU#@?FC9y)th7sW=gpkl`Dd~*>*7JnX4bpa-X36lN@
zQP>v^txCH&++TOEg+YLWPH&1hPI)=Szg#xCpKp3vKyI$jq0{tNSL6OAZhK&N7zk6V
z0T$MDJwD)G;|e=bad$Wxn4g=0B!M;Ep=;^0PupFdQB=^u&i9!yZw`HE2P5=O6y?D<
zk9l}>*OKgak)Muz)Z0t61kcLxbWESygR>hx7cr*K(aYAtj%5qU+U<)R&J)=~9!mAL
zU&y&vC#%<wKEgn)=?&`j1$J5fc0BTEI_jtGzEieACChT6UlI<B#vHJ4kE-8U1*T7T
zQgLI{X!IksC;C}r{4h~RqY2+5w9XkzxBDvm)?n^)*#Hc2Rl9(+)*=Z<M_n@18S@fm
z%4OQF?liB&5r-&5JfO<em+gt&dt`0?ZiG9nX)4jIm2$3Bp@x(GEz2D|t{{ZwKqbpz
zR6$0IIXCp?k=}&w8%-F>mJOpet#{1{%@|iX5$k_K{CUt(XXp5%e;!a|PBF15rS0d?
z*o-`!L@e(~zb`W}VHcrW<TJ~V9_IX(z|)RrtQUXKl(17@{@pak+E5)T)la4{o&s;B
z@7;NvDm$5T<{j$BcanSY>vMYxE?oNU5Ooy{Ds^-9HL30_ARxz{Km5)RTH!~oM%T88
z<KOO?%}F_Y<nC~O=1)czdb*KW9Ss%@S>ZL=8Gi|utqxeG3=QIDT7n-3oxG9MqNv#^
z{1PW`v$FSGT7CR-c@LcVIVfU$9^`VuIaD;)cyr*{VH#>NctJIX8bc*41H9E=22+c7
zeVeOl?`B<yyG(-hJgLt023%E=^02*zDCHqI`JwG~mDcv<yz4y4)$79iHn#{}W%=G=
zf5fpWzN_ctZN%z0epHxeA>39MJ~&4_G;1wS2A4;=jiTcRp0Z+|K2mI;1q)=heTj~b
z!8szPS(1v2TeW`MOBWrGf<rg39vv@3kIjM~nXo@@jDjNaw)!EG!aJsC6roRlqOh{s
zH?bB#C>78jfD_}}NER<3R!1{l=H`S+VMaTOy7nRg5UVefqHP5l$L)+?cnKg=l+?{l
z8g@Lk16o2c6N|=7md4Bs$?Y7x`vPoX`w1-TrH*W%uT*SNUx!(?vB?jxeB{+pbdX9~
zDR3~`Te3J&ul1B=2<6m;EwS4PMe)*fDpoRiyOgw^6vcCg#>nZff48rdw<<{v>gHJo
zI>*S>iphuKY+Guahj5ABpYP^E{aN8>A7TYf;FJ2TP|H|1$;t5Kkpgy{?^m<9>0oK@
zeuyqgzhg2s>*yMtz{KP*6PFX~_MsiC+)1!?nMQ8{&g8{36KJW|&2qgres-x>ZYMdg
zV9CH?cs1bMW&iz$Z7c9j^!}ZDcalA|QJToVd>7`v->k~5{{16&)^}gME?#rQ>^>HL
z#?Pkl0>lS7I_Kb%%DaofoUQu49<!+H<;4BQ?2?)c9%e*%l}O1tKU1EusCssk8j_BE
zULlU=lT)I7IH!<<FF=+<&Z(4R#+~`|qjWlQEVm?grYz~bk3ytOmhVa5nNl6fnH2@S
zWZJ6ETh0g__<Fg77Z(23?W%Fh<>Z7|S$fCkx_&4vt&vUNy~C}sPSa9f=WJMtA49Hg
zVu|is^y%<LH%2{34+J7^f4&COPUGkt8#yxCSs(89IsM_LIf<#%E;S~Fdp_*qhB|hl
ztTreCBZgAkS-3=w{dxa8gO8Wcot5Q*2}}`1qP}MrAtpb&!)Es*d<q~-REK(8d|+p{
zx~qVzsrI!26zBHc=&PyK4&1wdWs+p-dsJxfQZ(7s_y)2lD|UV+AXT*c?wUDKgQ;Xt
z(9CEcy*R9Mts`VmtQ)7VtasLefW>e?a9`;P73q!(7LvpjzJJV=gUd+4W=2R5C)3pV
zcavrIFYy6a*y>BX&vGi?W?U3+7BxE8o=F#IfcMHSi|1WH6>|ozv7@o!v=1nxP+QxL
z>utdbg))sNFD=b6F>_b-k%~0-bRxuqja5j9C%Rwhu=w}bt(9-LSX!+;aIc#}=`J;@
zo0<rkl%BV1V4Wpj;24LFuHj)fcx7O1(A(YPs9pN7*0>ZqfxNFhys`?(vH$)M@gX_3
zcQQ+;;QOxbU=)@FV!?EN_WtkTdXzS7N(_&|0hw~7jqkhXzCkVXfSWwEAH*Rft=T!z
zdrFoG=SHeWRdL%)bq^A=nSXo6bLwG{TPD0cF!m_0-)ZNyFeeA|m9LPmU|*q|H9~^S
z`HOg$pG*mP6L%AaC*IrK5f+(!Ag4HfuPcI2$03?ehkV*=Lr+<q&{loKQm*sO<1~X&
zCCr>}<BHcxTGXrFddCT3hXqs4g{dmOy#8**U#1Fr+}pOcS`#AG(inyr+hZMnl*b>+
z$n-ecvx7$yvXqdB3t75f=qare(SG@X7lkL8qMi69|EPz$aO>FXzHEv{_;ZG+ht^8A
z7ADvE(nTUlZaMk1oZ<z6b>CRm@@Oqm!Z65^T-Lv8D=0?oF=?`8<<ZV-ZPndNk=F4k
z!^Txq*vOK2aHyd0Zs*Hp{!=vC5?WpkU+GJpS5~HVW7nPhTpaBQ35glq5=xAH)+2Q$
z$_xT3-{>lQ6AknE2ZJSd%4oq1+=;9C<fg9~z8BSGzGO+%FF=^Ek{y=xXmE@QEKm>x
z=O`c^%Ia7NJ}T%J5)&FFE==j@F51r{p$}eqp6K;SGn)zlBTs0<qSZMqt=!G=di5f1
z{ic%t=9@tZ`(yQ~lACJ~bqdH*E?R>)C}ZabJHZ=9nZ7<7MI$S@6xxjM&Bl}rq3J7<
zKi;i(w#CZ?Vh?fHCa$vU_U5+bO=i68IYMDw6AyO8))Sx*X-K%#5}@gDc^y23e*$xP
z8+^gait6*@Wuon;E9%S);T-QApEyFsO6=Y8JmOCU+4;dvTzyV$ou*z{oU-gsE65UU
z0w0fEN&1T5^5DPjyAUqr;8*m|HVEHpMmJfDzf90B@Gjx{DSmG=n<a(3PSNOze%u!6
zXy}rSvY5@%Gn=I+pIB=nLJ=L3F_P-g!LDw*7pt3bxmu~$(}%|ciF}QWE^aY3%QEWZ
zzH3V6o_L0@*M|wjbcPHi=xt~{M+8slgEMlNmORX2Gkekc{6<i+0;9M`$vfqZXsGqJ
zu6*01;<pl)@}<*jK5y|cDvb<85B4V)WMSlSDG-i!X0V$*9EDUody6?`LXG1q`cza-
z(Nw-ZqRqxQde>$nnqay#hx?l_ucIkLx~WNj`kd4-?m^9>4<E;>oHLGeH+yn;uAw@^
zr^Mty2eT)+p~18+TgZNI(sktX7&g^^CT%8rCd<ZagyR(8vL<7jaMQ^9io(eGXyw~U
zU~fec)n)yE&VCntp1?HU<Z^QebH6`-^Mz-DtUTb-<smtf_1(5ro`;`fiPsEY=C!KJ
zA_abCxs&J{pqGsj#Fm#hk*8O}6V5GhMU3<sBTt&Y>#pznEg5dv;g_~^&~8sR%g+q?
zNG4mkPKh~g88W78xlSdZ#aECQho0Xvd(-I|TIuJy-dy`27_3CkTxB$K{z$pU!7N+x
z!c!KUQ{#934tVi3qUm*pov^~=uRV$Q`3uIESzdVwvB*^``dih;yE&m+5)euDqH^}n
z44abS&YM1-$I|ht;j{VQu*!IC8%^UZO`maZ-ABzh|CA9ToxObTIu`+$)b?p<C~g<9
z)w8(yn^@TOw;Zc9V2~LTW@KiSlgx6il4*v?`(r!SKd|MtN=ird)4uoS?hn^R-uw_5
z8~`LW0a0kfq^v1Y?36%qM5mJ~R7{ieO<a{W>sz~E2BaxPSWuz?YZqy^U_hkP&yNA=
zRa*4(&o^DqJYwXrJPOnwAb6A`W@e)yFXt;xBG%z<Whl5(71<PkvrY`XDjb>WBgQzt
zlbCFVU~t)y&WSw~xfD??9jWmvP2w6d3)siMS{ZD~I6r(mDRzl^k-$=7BVeYY1AHpH
z4Gq2Tz1u80KHX06dsSgOu`(Jq_HCUh=^x{pd@<qteXxZ0v9mr#1(z+v{@K%$?{#v<
zpy>^z2H6~GJB3`rtb(+=of34<Q#_O!!egc1zkE=rnqHl+;IM_)QK0$GoT;#nMn{SH
z3+MRg+E!^n+C|-zx=NB+GyGU_VPA!|(v547S_o~GD*szm-nW9sksCA$yl)E+gbPnH
zvnm>dpF0U2d*wgQrgnOB{3#zo6YExb>^(UW8hPxUO_nSPp%(|$AGh)<OiO59E@qPn
z#81gZx;bq6Gw0Y{&52!NXOVeI!Iiv@si*<qp)h(_K>x_8e6*YJrYKsDU33<i+$DBU
zJ|vqOCN>n-b}LzGkB-cLOtb0lz-C}%>MWj|(3T`VlhBqXPMX-3`IHc-ZE1vBQ)+39
z+D&R{f;v@-CIMb=fW3lkPGwwMi#T6$Tf4YRa$C1}eX=QQMRt?=dzkitH37)zcVgE)
z5<0Yn6qLr!14mnb?$-Zzq9|$39GLd)oG0k7#G0)llNyEvGTQs^V^Cdy<5hC|!27=v
zp4-M^9$1G0jg9;#P*9rnb2!I;C<Db5e#5Wt{5Smif5X@OfiM0S{LOiDg}LWi@#Ncz
zaZ!aI4bfo6P1h~QCew7`48k|e5=F5Y8>88T#-pa)<JpAu8*c`OBMJF8MZ?F0#4oY4
z$>dZqX*NZHp)ujV9hZo#6V*>cVepZ00>&`%m`Z#*of_6P6!yHxANVB!Dl2~ijOlY2
z{g4x*!KP@08{TcvH<xl*C$f=likqS_aBR73GNoH=4OoChg{DN&>Fk#ifRc=a=5g7E
zQvT@BmT1;!7=c``Dt!b%t4F>to8D;%GuF*GFpKOtO#2pfX<e?KL}Cc@;D~-M1ehJ?
zj(B?=k;g(;e4p%v#DO$T^uXe|IH+wP(}62Ci|l{t`$Yn!KwxJ5*wk1TqdB}B-M2@o
z%x&04{jU>VPD-U{h8J*qb?4*8N;ltT6k?@Y;F<JaCUx+zJp0>}I*xKXwj@SM?Ueds
zcuqQHbnQ_oL#VdZ7GP;!N|qv#LV+`;C-f%f$q_3<5*cxl@XSc&=%w7y6gO3OHlZ+c
z{B1@>xa2mI-#LV7s6b*wU2~iT*wwB2(GVsu+u#UMZs*#j%fZxfsmHB^a4nt_z@SR=
zL)atLorc1~f9VGeg>C%NZ~LQ9Mes`>7_P5>^rL_2<I3a!)9n|20B_Ved!SI1!;4j2
zcul#f4jh4MQRf_idQlFXG5Wt{TuMg2c?hW|w{?mqC%5(F6DaU<9;krc{Wbf639SK4
z=<>^!rFF@F&Cpw$V#oh)ll$dL+6E@!uH<h^yv;SnPif-(Wx2ODi~*Q0eB_fe*((~T
z|7p8R>!g4;q4}q+6M)vEZ#`Ap0MGw`ula9yra$n7>=k-Sw{{N)yg8s~CpOH%SECK{
zt(<ym=@)O(9#i!8VY$uHP<P>5RLjkg{NeG0qPM874GBwV&xSwI)P>?*4ZSzVD9l%V
zXC7MEXUU=T5J)R{igQeLfRr<LRPkxs=vw(yva&)&DUc=&n-&l#CmoquYf6oN2U7F?
z+rs^YeFhv#sE!piUpV7N6&c~_T3KR&@8}vZ4^`lW0oT5LTX_4!Q2<KR`1b&Gh2(S{
z)dTJE2rsRdj+-M&G`^E-*f=@(NR<qXKZgP(=t>x#wgFSRx3EwC^QfVw`PwZsGg)xY
z$>-9kdKVU^aqsV@M~5xd>X@j7eLYCaR{V_5fy3|&{TI&vi>9dLxNR1TZrz!Y;)zPs
zd(MJGH1gLQllV+eEVK5dVo_u_ehge@AB%#H*grf*dg%q`?Hqi}e_^phTB4<Q>aNdz
zenk+2`H3IQTpLRezVf1Uufw8jQpZBvp@bs61oEnGpmJKh`pJPv@xc6&3Cf-#QM$u}
z7U%LnV_caLzwp7F3@Ls&68{pciTjwGEopg02x`r=nNk9BB=>Z&u)W3TOf>=m1clLb
z`F=~@$&7SB(c8!=5WCaz(C@N}1qlA2GZlJ;#-<y-DO~iBn6)cFF!YaPJ5ZGnRaX|v
zdkLt`g9xwf^9pVS1vw%<Yo1NUnC~Yd#kS8Ke<UZu=Jl=j&<YUHgjr050*s>uY2j6{
z<lQF<&>pFM^~9WVstr)qFV8ntkQu3M4!BE&xN{54qT75SY>pgo*Gl&U0DiF2_9^*Y
z1nx5{-8a%-x&lYXaVri|aado$f8g_crKD3{X?t`SIE96U0A%32|CZmDH2VUy{9o#T
zSmCx?Jd)qBr{vk*{SEV{qP~;=fzo~35#hLI*|;2_u)Ft3+V1>a%#2^|Xc_j>;}ynx
zIhsPAY~!7>uRTVI3I)dgJ9&|#q&PU#Jg6N^$tIz;d^K-A^F7bS3oedv5K~|$uG4){
z6#bKlr(7a9F=-`OgT=1fSoJAUotNEYdQObIVBLq0-H3rwY}NYS5}aZmB3rVF)ISO8
zMximaFUX_eB<X*AiWp}aUMkO8t>`VmajWr2y#Ua_imMzx!4(T=W8%>x4Ax*vR7UN<
zur%S-|7=3zUtONUTK=%3|LupJ$gj^thTkF*a#ok#;(qw3<K0F}tUj@@gpQ-E>m9^Z
z?QkooZ)qo?=Ima;L1Stm|0<3cr~MJ-mKyL+e_x2bdrG8^wil^0rNLHBG)L1~UZ?+&
zwO+!{#J+n$*C7sVcsH`8eV>UqXO_CPPXAv58t<S*4K~R-2}DBRP`q6n8k3)WHw%Q8
z7{K|bfQf?XgF_rT0L5<CGC`ARlC8aiMaU^xC+=rIxz9wBGfTs1*FAxsX>tn*9Jq!2
z@EdaS7Sf=#?jHgsVt{qoZ`KCCS@-yvaCHNCbN>+hY6iS+cr)Nt!CC*S?%#s{tn*J5
zQf&1-08bXkAA!be_4-8(Fu*SP>%$HvVyR~j^!%$GTFaC49mYxKPJq4(4AEe-Yd2Pf
z_u=@TO5r8oUDTj61z>KY?>YVEz5SbBG1u>w&;70pQ1~13|Alosa6qL%(~G$P*k4Wk
zUs$(83n*Ab0`!0J+69-diDc|K;#da_p7kPQm+f*%|M5;`7Sv2hpEys18Mj52%2A$t
z@B+#8)J9Z)V4DJ*$QP2pVOmPW2<Z{H9!VQH;6?yh4<c*8?-Jqxf`@db@40Z|&~?KP
z169XD+DxLby(RyWE#JxvyopwvGGcA1ET;hXbp8j0{^D1?`2m92e`I+Fx3V%pG*f;!
z748pf1k0t^EqMmBV(Og4=D#Zu^6*3!fs-z~^|JqNhfbRZ>`%QP1#VHy!*L69|J3mh
zpQ9xMZ<{p9znmFG8oah-&aOa?p+7j}aCi2X+X7mgi~ig3-TJz*=)ZsxH~+LC{4eLo
z0XRo^ZzBHfnIdq_0MGRssL1BFcP7aZ|MropfMb_Ywif$j=5P5fU!NlvFGPdW?n2V~
zEj}dtu~J#$<d+)C9j;Fr+{3+kwrjH#(;<{TjpWbh?w!$$C`uSB$o3(le7HQ+x{t{5
zjJq7gI0_KlHAkH|w!M~Tf30;C^hh`S>$LLivU2+ktRkiG-~agjIxRvUAovE2!EPG$
z&$ma*gaF>%+6EL1^Lta&itMjnku+=X;4*PgaW`v!ApV5)vjaJp6U7|0fcP$}cALj7
zHW91#P9;7Tf(RO)-86DAkwaUvUR9CDU*GrJ$hG0W|M9I`6#`#7gkL|JxexgCh;T%%
zyTI~7oz)`s3N0KL#pEOIufyf{tSBkyaE2CW;r-|Hq8bHQq$nxSE$-=hB#Vi8CwUN&
z1BXB31BLzta|exxCn5rot0i6PRg#aX2(mE(5zDO}@vYo*kTzXPkb?>i8~huV>KAO6
zn78sPY5f&pk>Bh97&trq-|UEgvlDp)XGcZH_M6>*!`!lC`$w(+8|GIZL?9M<BzOIr
zjrKwWE<XVO_ZZ(n2zz1tU`04Ac>|#J&sIG7O)KnIYcfRP^fE-HkAL@)({K84Jb0`B
z*8dw1&hP)N{}UA`#WVQ3o8a~TZ+-Y^@B>u?-S>^TV??Ivpx(!x;h6AL0^P1DR!T6*
zDudH58~MZQJ4rOan+&@XIR`!aaDt~MbPkQ9e$uAowG@w(1O8_Tx8iH74-s`6c?>Sc
zgiazS5FIVT;}k(bv`@Tp-m@8i_ldU2;Jn}VnG!KZW<-142(Yt?<h(bt)x?~mcM&N8
z`1S<O+XyJb;`{R?AI?o-bUXbVbOhj7MIH%5PtIp49snxFWEmTQOnM~4B2*F>w)^%O
zh`cm_J46OdeoLgYJTO3T1t4+qjx#{;Ii0B-7h{gpYczRoIq%28aKE?%FZ${^;7M}<
zwUBtu2dwli83eZMIsl{W<h+*t@8y6qM28ne^h4)CBG1#uvy6My8_6nRl!!gI$IPo+
zP9-oL4BT+&aaEplKv)ACSjQXE6&iO>ZJKkG;ia;vTTe#c$0<4|&3&-q5Iq4BU){)a
z&~Cocx9)9ndG{)BlOERQxpHoNGy3h`82?yq+VZ7#SkgN32eRwH?Y7GowzJSwjZk?F
z=ug3ElHraL|0)EOr6fmL!4z~Sc3#6LANS3#+)37zt}jZ?`qzz8Q$jcQk(18)9qsz*
z)~`H5XR)ow$A&M}tf!Jn&VQuN$ZT6rf-CY5_=&J`y%qMHfA|-^ymwIN_^6cxHX^_M
z!j)Hbp{eeO)nYx_8JbE(nJ1G(3g#iJIUP{z&#k?9({mD$Ge(#y^Dgav*s^M}k!X3N
zyiMpQYsCuR;|?CDRnk7k!IQ*fBx!R|1K3d`fkJ@j4_GE@_VIv;NfgQx;*RAh(57DK
z*J}2(#!LQ~>&N*vnHMLPTiN!rvrupP+SYNmYrMe-p^q~H_Xjz(=udE}8a)5HNKKe%
z=aj4UK|S}={NTBANL~9iYuI)FXD!m1YVN(b6J`7AVdzy=P)PIZ8cWpct^<UZ2Z4>#
z75kcfhrSqE(=D>;u8)|1hUDw;35YF+E}1gjof>ZpmzNK^K*SWaBYj=X-#7@xHmnU{
z|1f)wAz35G=W@c)eyUTGN&6|kGN|T0>Q`5UUHa_DjBhqS?_`uLA32Fy*0>_kJ_c_0
zQGmXfi7@>LnP%9`OC>od$J|4l*W8d3sHUy@;<{=VinB^ZGk$72J?^3*Z7v_1nX-j5
z-6>}J)K|A|#nt)EK`X*2Rj#VgxCF!xvh5_gavhiSLr%e%WC|ido8FKW{T&lCN15@M
z$!Yz7+gy<ANuO7&?skRfx3sA<vL|SipKxB$ePjxMaDIwUMT+s5inN*|k!zP=QH+U)
zj8ECm`)RD5Cf-a3nXg&EH~j6uYvh(X?rGMkHO#of^OcNa&#)bre4eS@!$sGk%({m}
zFCSGys@YzJhepfy>LufunV$BC^q47bd=yaLqrynzwdxg!)kmy_tv;(M9}wD%uk)Us
zzdV(aer#i3-2pCMqAnCI-q9GTc^9@~Mc=24*zklRr?(HRV>O<+NWfkz$e+i#b<DkS
zVw{v}Kwn@s+IoRg?Qr~^t>b5~6Rrh_&p0NOXGW-#G&NUmE|t!FSkPa(D^JMYb|k5R
zoGP>UeDgEa(912?FZ%DaCv@)X%;=O?Osqf5^Prf)crrw0ku<XRHL;-2|A`>8$~u0;
zE~}S9XR+%Ow7U>`qp*eT0GqH;&#g?A2I3*kDckV7{dW>5wX=u2`C23!Mjypz4t+@I
z%kgH}d+^W}(>7i_1ySvo>*MPaNn-YNbN0rqJ-_?W#2!pz^JtIPuL(tok&KNkaSul?
zy?vudi7?;G24HtvT~!DZB2-r3J+FVRFV&hqZMtq!7@zyb%qA0iH1zwEq65Z?x}@;V
zlK}taq7LtS!cXv0342&-GEYl-a1QQ1bHoko!<}Ec6yB~(jN7m%UaQ+#<1b6a8Q+Uq
z<0og@9M=-Uo7i@9d^5m^%aS!z-8@a-+mLFhnNpQSY}~h2<=|-&d!&9)#eGn;bw)c1
zDXklSr1JJ>?E}l*zMePekR;n)NI*N08nrAK)?^NuG<|Jtg+k>Nx|LYP$XSwXF^6w~
zF`2sq0UI5?Of+#V{?-S>RH9@!*#AnSnyrqRwuZTt-%z+54P&ez#4)%!_LCPd?PHyl
z5B4Xaldt>`oB2_KQXEo5zV1kH)t#b7bhy47+muNK-FP?%u}6yA!bNg7qdDzADjKIV
zb#r#gWo9=X+RXWCqGzV!Qr|w*Xrp1J;fYIwlALkl(Y$%Asj_3!F8v=#8k^lxGUog|
zG%DAz?Ibv5iCvG5Npyn(H`{^w8#K~zguT`GiNFdmD@}mcn5N8>otb9ezOEnnEUj4{
z_ONpX)p&h=(c078)@`n=0gRnkq=vzLa}H`l<Qp-rlS{)<ab&urchl^~b_|EmN1AIB
zvfU4R`O=zp<H*aOuS49^&{ZBp$yBzSLw2;r-6!MwkrG)`&PMcJra{NH`sgkpZ8kKy
zR3k(a9X1doNN7V3XWp|2Oa=o|$xJy7UQF_AN9p;=1`ub#Ft2Nk+-&?uIynss6zv(d
zIgmiXu(O8TEdJ<!Bn`5PDr$5#2th+f8MQNGTKtt}D0&Y-ZpX9lz2+o8I<ueo%n4we
z_HQ|BJih57AekCi>B2`l<zC^K5b7QM(QWdWw!?L#Gv3W{kifM1!4FZ*zz+%zT)sB@
zSoe^#J){D)haY6p-t(3!hG!~$l7Dt&hRlx&f7Fg*o3LrgW2B%!L}3*xFJz>kM8swd
zuvEdl%L**+d394b!08h#?*)4fY%GK@qVxJf#uh5XC#?H`t|vASXmanGQj#P35XsJt
z#=Z);OM$p@tLjfw4OgW=#9;kcUMSU~()<~CRD)B9#gy_6V&fe|AR|GKV$L^pt|4{5
zx!I^$8(G90h37MRIy%HuLM%WKSkY%jg<qjj>SApdSNa4H3Ad470=jMF<cJh|rV;?V
zS7`SD-TeShQ8brZT_V<n+TXM$_I}fv`%Oz2XbP$B0u}-x!0!%1u}2G5@D$z@W?9Rx
zuDF9%{hQTYb7XU46}8uhXxs>Jo<Q?}zOe-)uhDRH!>@{IZ_g;j+gH#4oPeF1T?NfA
zTDM&R^bMfvC5pzUy8wgh0%v#DHOx_hiGXuE@Lt10c#TGXs|xfDTvZ4SAO?rkeud9M
z<RzDMZ}DZs#}u(@X=-&koMK#*@j#z#;qSJT|GyVA;abK71PQBCE#Y9R1XRCjJE360
zw6qNf5>h8w8p3KoOF<j=1zmrtD)CzPc71v>hGE*rljYo05y_ZK{EDpqI_zo3#C7$}
zZWe7D)}`A>aFx)pe;Ctnk)gm_sofqawjB(e%1rvlH6!X^2$n&y;>N|a9Nk%MWo9uX
z&y06#D)b-O%kpVC6N}ehwKmP7(`vBs!?@)axyK!c+9j8G#ot+%kbzMfR>C5zYTMm@
zYO5V}xWz80wyZ9NZb7Gf=!=~}>&V`K1t&Z-Xn`JJBd)MLrm)NplVPPlE>}QX&>Vkx
zp-QK<y<(Q)QWRBUdsrdeIM&T<9ey{?suYZb)jMkCIA_XZ*(4RpwWkY;{xEwm2R2qM
zP*meMV{f0T(JNWZtG2Cex#~vFwiKD{`I6VETi~M>ELatsyKjN2Srx3*_29#lr;YA!
z%Psh2xzT@FE-w2o%e^&NxaE=~0ycYVxqwNO0Mi|qfY=Cox8?}gDPS|eHW3>k2bhaK
zL|D47ZdE@9cozP#jCHtWcvnh1hnuP9nOBS7Pd{L8<28SV;1o&))+Hi)2u{-|C#eH7
zf5nIMiTSN5gkyO}0|ILJnbbf){njQ}Z|66_2W~cio$6xU>H>Vy09{~PN`;sT=mHiI
zaJLg~)gD*~1pp6ZR`NEFU#eILaeyj!TQdb>s2vCMbc?S1UC&2cDN263gd48;NuhBN
z?NR?!!lunHY&Imo)cW!&&7DN81HvvY3ema`txxKJ-1R>)f4Xnbh?ZnV<3JKCBv8LD
zzz`AEOtZ4yh|b$Ee!{uqL}J%~UN`5b0d6g>(ixvF-8P@dbs-sBVwG9^si&GJa5j8@
zcVl{B&WP`HH4`NHGwdFtUQZ2}zsd2YlOoSmJd5kQzZLhVGEa!+b_vPq$&AbD80H<u
zeTgp2tM*k`rj@1(72iooUxgMwEz`QuMHP7TasG?2tBKaDMP;qEEiEk2B<ecBqqSsd
zjAQph<?6X@)hn%_8?ys<#_N*yn~L)$f}8QB8-vR4t{<W>ygXC}_~ObcIx7ZhFLu^9
z>Det`Y(G*R8!NG$ossc&c{shW?bFG1THbD5cb2@<Ws<tHA;GQgfqto*Hq_q}%?{0U
zdrSU>ow&)@n(W}{{zpysCeb1K#q5EPk}&TY$WF%y*TZ4PDwR`?S+)c4I+`dd1TRI^
zrPQBWK5v&kS-m`$TVCuWFJ>(QW)-ZL=}DE<JeRtRe0DS8O$s!~kSJ?-cZFK?kmE_}
zG{I2je81~EavQgA&v0rf)Bhuh<LMc!Vn!1pKfX-xlts2ipzPhFb_VXyM0%k^T0-yH
zN5Wq+-|z@Zvl|2RIi9-SAR%DBswqkSf%eR5U{a!LCiK#nBm2tl`=_?-zRi`YQc6p1
z-4HkE5+TicSaLuW*iFvrLVIu7j*oBVCbJc_VKk0JIoQOWKv}rhzc6J=K;X;IBn_Q*
zd}Z~2C-su=uz^S8HY4XBH9BglW6Se&#7a5C%q!Up(I}EA*)2Bm6$PWBoRV7}nSGh3
zD%M*B?M!Q>39RMyR^d$b+^C+9%@v*9a9S91q@22qvWlK8(wj4_35y=&hmwU~WR8sp
z_!0ChDu^w|>0co8qjn3B4Td#@Y)SCa6<dmb&U7XHpgs$R)^jf(xHk5Z3#}*g=O~6H
zOQ;po3A{B$$^~(CaMz9F>#9?9{6~_D#!A`F`E1JMm~p}*^OBxh^g2ODBq^G|IzU*|
zldqT?^V)2%b++{m?gy3VqY{yZl|4#^IyLBeu7B*^(YJeUv*|);2lO<Zr$&S8-g!3x
z3#;zqQmomW(`qiVy1eLg?p=<oH}N_xiR@Se<$5b-L9?bWBhLor9l2{p@$u9JTmB=-
zMMwRPU7f}?<`#oa7M1-oZWdCSxgykm_;Ba_!LgX<wj}tI02y(p!c}%Frt{-g9e)#8
z|57^!PjB&@=_g2ZE-@k6;w;_}A7McuV|vZkDZKKhfTKus{)CQHy6Gi{OW_@2f9o6X
z@4-(bO~Hc(z~4ChaXdf%L=S$q(F1U~=dS?cRu{P3;|S=Az_0uC0J>iAi#tAWUEoZ{
zD4?4MKP6`h=-xs5gn;I!J(44<E}Z1WX`rHZ?=B*vqC5%et!vcz6~pZO#RBlZ0P?R$
z0FHcn-t86{h#Cd~<bc}?QnxICzyi+rHo|~24kprXBlo{$L5|oC=+eVawY<I6Wzdy{
zGX~BV>dN*MbNX)G@do}Vh~VD)?QL9x)0HXpIthro1Tp!)oX`hO4+U?Eg>JDApz+iU
z#$9Nd6w~cD$mbn=Y^hq+>%It3YDzs=A(SvWtDSqU0gf%^k{D0Q-tHSZG2C?eX4CNg
zG8!CvIdCwI^yKwR;H~zYNz2w+6swt!Nr|FBkynSsO`N*?Z!^h;<<=07TwHD3UVOIT
z1ij4KJC0G94o<x&J4zyHxU!q0+5n$kvid^EOo{7H$=2ffLTE(!qV&2e=o<*9%#t)W
z-A_bazuZ@}`?^}crhTY4+5WK_ub?~3U>(+yD(Uo`H!V?tEvIu!1H{Cyymw^K@r-3u
z`cTj8xu_(Co7eF>U<MYeFaG$Cq({HALsC@g&EY%e=EzjyQvH{gmR{Y%6!t6Q{f>!9
zDPc#r31R9Iiy6~9=8z|AEgm%~p#pf*3{~ajecALnqGh7KA4gaWl6}v6jL7_U){yEI
z7N~@oDbzq_z?%<BiCzS#p71v_oVmXuTAze$??;ZkIoslAeCB3Ikjp7}&qd#bzb_<>
zV@U=l`^`~s7yjDG$5LP0`G$`~A~1hf{>zL?=COw%woV4luxk>O*7`Hi?x)i%z0UUc
z3G2~Y>kCDD`=_~kxl~b-rATS3U|rmjyGIW?b@Yn)LtEorxeJaqmzP-@M)CbMEGPaW
z>1oq>T9b(`*uwoB#E$W7SB$@gr|N}K0Qp!6UTYO6QjI81Ne9Ydgl$xAC%;U{7u3Ek
z2B_WZ8Vf&uF1Poce4$iN<_X77z7*TZi}{q8*Ni{PD(XDxH$Wb#Pd%p;oFO>xZaF<3
z0*#Vt#i&xmfO$+Cent{F8;CU}gfnn>nWibSQz%(&cIlA5$fr<xevoI8tXTqNPWF9!
zyP2J)!_e|q1hhViajZ>=i;cQ%^m?YHeX_SIe3n)Fy5K*OIFx)V`ZfPJ{w%LBY1f5X
z;zUL%i=$lP>;Bv&b*+Kwkul}{y~<KY8#&(nS+Y6c6c6ZneE$0QEbV67ziGbl`mzvI
zf3Xe*+d$Wn#^)OoVB6uHo&t7dj`q;R(W~f>K{FyOuP^o!G_;<EqJQIVR3i<Qr(c(?
zSen+1z#OQE%_2BbX1oaZhI;VwfS##`3cA1KMQFFm+H%DRd$K>8c74`#4cRVfayn_9
zzuDHBcfE<bfu2pfLk~dLP~c$-3v^G>0e5!yPf&m5@z<+pT5m%w1%fjQSr4JkM_bZo
zd&jhmsd2cg@}@tL>Rp$j(ylz5`5kymK;M_<Qg->?H{q^d-iN~P<ljHi+LKb~Fi{24
zw~bKUP`k$3Nwfh9B`=Ky@TzYoQr&P0;w9!G)sJnc+k}ACQRhNUB}iz`d+)?Sik(dE
zhw}kO$u634BKuQWdeT-X-PvqJ<K9Ujm{f@R_|mCUZ5@dt^>DuqRy|#i`*Jy|0oLBV
zTgU6#2=$<Qxj8)OwzN~%qj%<iWYONRc%>g5U~azMIgE6UH;}eq=F%h-&lCIjo&J9G
zJxs1tucF#%%vzx?`voHFFHQbB7NWTIgkjL#>n#jfd+<qjSMNN+m1g^u{Km5A!mBnX
z&YP()9JUl`%rrfhrgoSkf}Sc$?t=4LPJQild%Fhmb_|S8ub78$?%R$N+6{AY-ELWT
z18bdxo;_^8+Z}(e22+~wh_HChY`8&m{zlKy9%G)Q=&r@XSL%7@6Z7Lim`jCWP+nJX
z3b#`V21dkwcyiq{81&eBV5vVds&4tgnNeqhK@Z*X*E%YD_Y9q+-ZVVYjCTTCdz03V
zo8C9{AXgJdd-LPdd<X5MDbAUTd(1i3KdRg}w3{LGUe3r%ie325*Azi-hG+I6sGcq-
z*ksq6sg~~Yv%WB<Dwi_ti>UUpBb69?ZqvpE6Zdb|WLdgrmH*>OBaXkHG}6-{XX0RC
zLuGy~Mb0b@wldfGARquQ0@gJ}<>35VQN-kfje!+8v&aV>8v|hjJ+Qt3Dzl`4g^`Uh
zIV%?zJNJJ*l2j8h3p|qK!ub=gTbqUQj$pH-nIXiVqqOku6~d3$DUq1qn2MWuZtPxa
z@NB(?#*t2m2WfuY9zT~OWn}k?C<|pgL&8nfDkC^;=uk;bT)EfA+0FH`DmNq2p)mV$
zzJ|7JitC4}!k#O1`o`fBd}9LL9&X~7V~9y%5_r=hqhG)n!Lku~$~1im7|*aB<~4*_
zrU^<nb$#fb>UNg4eF~kw*-Zo8#DOdvp{-<%H_PjEvu{U>)r=-l@y?GFerP&ekks2R
z%wHcKw}RZ=E@$0g^X{<W`J2<d0e4V!&%*U}ZtgrRPpxlS#@&rUj>o`TxW^T`d9r!N
zLkMd<9lmj5po!5n4DNBe+#_*|@NX);`5rjgn?(lFciI<%E%#@C$e9V%nz$kqM}J-3
zPv(S|pTBe=#kA(HK95-(jQHw>dzVm&7tTwG@&R5I+?mXoZJKkz6PUBU6SXiIs-wd*
zExDb#a~ir9jkU{0Ly&~$9+~3JGW2HA!B|N_sOSJX+I<pX5e7CYP`2*RP6ZjIAEL+D
z4I2u};Eg30@*7JO1{<1%h-;c&96=c?SChvtUuM~i`0zO}T4c3-yIRZ@oqerQ_h9a=
z#A6OKr+NMtPi7H(y%JSTRL4&bme12aa;{xguD+GeXPmD{iY@z?q*?{Si0=xxC~hww
z3CdG-Rzo;r2tln@F&Q~TQ5s>({t+Uvw>Q_89&L(kaymE5kH_*Ti@Ly}ZmxtDCR-$s
z<^JVo<_|LvUxCG?_A38SMQD$+GVPeXqm!GBHRhgb2fqzfq}@3CT%hqhe>2Fz4Ae_e
zu54n@KiX~WFrrM>__0Yo$npFI+5XH6A~xO<sx23$gb&v&PW=viwX*zfLzrfpEeHiC
z$HkzlnJ0E=n9h-+B?Em&(Y@<u9hd0%(~VkNVR2IqBQF}=W#=*Lsw%L<_h-3Jq}|Kr
z<}w-Lkj_d&5#qbklsk*0-DlL$bqLfN)7z*F$ihg;AWe`#h^rg*<={idVJ)U_hn*$k
zT<BlTB<hHD9kFLmyOE4Kq#BrAlt+^M52_Qky$!ERZTpcl`>NwGEBYgkhF-f(tjo@`
zh;OmciidTkoGi|v6_{DSL&~b~OA?3r)%?)gBul&R;$nItCc<Nwd2@KoEOT>;XJ*mO
zuQX?B_`ER5V#rB;k?R@w`IFdD`+i5Qa!jxF@!YaS_nS)@HJA9p4{5OLbI{G<o;#GR
zb0n@~gfRM@iAvc!Gk4jV$buJ4k~*dVCGRB~<VqwaIV2fsfDVt#H_2CyTE$48;bd?u
z9Pz{c41Ei_F1EN^{U$l5yyWQ0WJa4cc7!LcXvMU<+-BOe|7lWzMKo?9!DXcyKaDqk
zmc@ZPeVu!%{We%Jz34be<tf;}J#3?{;h@mOJI3JD(b(GoG&rigFAR#XHZv|iNN~Q2
zZ9-7E+8&>(X41PKP`2ED<*<EaOXBf0XUHnIZ%a9ex?9n>@Ra>g%Xm$wUvts_$JjeZ
zcd~V1gRyPfc7Czhv2EM7Z95&?w$)+Bww(^Tqse{mz3(^comsQyzgm0kUC-G#RnMwZ
zXCI2=ZH}6h_7pXapDL1_ciRZn{@Of%y+7<(LRSZY=^o|P2YZ%mL0_ADKK(p;mWOL-
zM}rzwkA}lIHduV$&U!@LczfyCTg(<YuDIAMz;iX_bVuMb3BCNxP5PEWe{nXC;D(2D
zZrhgrTEgr)d`a)aWd!JH_<Rs34+l!=h{Ond60d_G!$~rsU8qH(VqP~l9LBeW)G1wE
z6+EYPwk~i`^Rd@1%s*02rMO;@qo0{PW?w(YT$r~7fh2dvi#D;Zde}azYmFM?*F9{T
z7v+C=<@;`kK4Cz}Ii&iqx_7O}-Y-w`n-<MqyFiJszWdqhe*vc0nP{Wq)&y4hbTj8V
zU)Dr$Q;I=$K|43<b=c`9t1V~=tY+pozSB4d`7&YEl;9V=e@2J@(s(c5S*Oxu)TVCk
z;a6p-NH}`=xL46cMQ47vQMEc>7_C#)o?N}ZwV#z=0w~%a@R&+(vGJ!zjd4!$2`Elq
zq^h2zE}~+f9&|1ztun-88Mol=cv&@1mFA%?`JD23XXbG;pOwZcBag%|qF<0d-%+=j
zai(V9IhU}|VCp;DH|9F@?C|#A{ZY9e-I!9|mVWZTeNHbE5E$St%5(^)9`j#fQ?Eov
zBt25nW_0}qFM_L<#3)bhc(PvnpoY@2pslv)be`05945<ST_dg7_oo5u)PVvtiQZlH
zD7T7(Eo^bMlWj{H<!yak{TJ8D#}xJR1uFS;D9nYBQF{)GBP}*+luE@(E#f0!<@XfV
z1FhQC=z>)rv1J8^=?{SQxwL9D@4|lIsJ>jLegm{ghf7mxu(IV+JFHq{N;Wf}%D&DX
zqxo>1JRiHQjgmc;*Cbi7ZP74E(p4c$*}5NBiSNjQCf&*?CmJ6%`pCtqQtfo5Ks+n@
zOzOMS<m;c}3K({VPGzdvwBnYcl^w09<tK$uXV<<Qls<k<8eNs@O$UplEbo&VL;Jie
zzQsMAEyl9$Q!1tFR404d@DhY7u@ZPbo0G4#`|!W5!aT9IL>@jSlvv?pZ4Zh=MT3|*
zD|>$8a_v8`ZfF_Re&2cx;`MkU^z?rw+#dOj@6YuUd^WGfytMIA#hU{FTtFhNOy0HU
zTl_SE@5gl{)|IB?WxC~c-<!Ia?{u^*otiuN+M<j<v-IAG>aG=WH)Dm75l)VNtVXsC
zKNx1+gd3$B?o~8|ZQI=<SKZB2B+{rP7G+aEv@BQh61~ICO1t9#N8i3>;W&!Rx4_4G
zc=UZyYlH2`Y+dV@6<vu!1*C*``AElK(Vibjmxl1BZ@njPvX-d$hG`>FhZo-r`1vw5
zu!(6FW6+}2B$Hi=<?o|_Qlsj%MXiBB{t}Dw+{_#hs3GfalwVFx@}wF?-nh`LP8h8!
zmOT$YQY+fm5s$i#l^3kxW;Ci&TnsTJW1me<epOmtU?N_lw)dFkjvwc>GPjqv{91y#
zze0(HVzs=$BvCaPR`EH7YU67bOS`rC2+BUg_TeP={^u7pGthKebULH~v`9V{&g=UM
zbNYine+hS(6z*1`pV-br*XzBw8C6M}@MD9tJ^ROfsn6{MeIReCKkfTe_Wi($J@g;r
zKWz(r-PD9WKHvJ|&vv9g|59qv4tmP?sQJZcKM6^=g);YFrN^`a{(r2CkZ*P@n-@5D
zE^tS^#@bV$COP5sQ60(#(mCM<UM#yUZWt71Fxek$aeu<L8f&I{e4f<kwOPHl;!@t!
zcE0wKgw?N<t$Wjyeq0?@O!o4RKGQVtKh4s7>u{Zpy?M>r5J>lOKGJc1t#frku{6>j
zi>J*t5<=~3D498MJ`wG>QI~S-60-2AZbP@WvOL9)HaMHR!mMteU9Dw*ZaMB<-dxFg
z)pFLizP6tBt?8)yAECQjr?b&0Oa_>Itx<0F!%JMxb)Lh@i&_bp<m0ULE%n{(MHKGN
zGkTjpzuKnbk&feQo$<(3eg$LSF#j{1l#X3*%P=kN#r;L+PgyCLb+kNN65@IN#ueW|
zx0>#{)aRD_UbXF&$yY5;ecBuABj5iK_FWh=fE%voWP4|xm=u4|`}}}?)_LRc`LR}X
z_nxi95;=RZ{srIi1;4!g1@HX@e|43wEw@D2-=6dhCDMM;JIX@qlOjdsd8)Z!Qux4l
z+BT)!gjTyS?4^P3D-a$3KLb%$+mY!sNs`&R|4y5X$orA2e3QgV6RwRrwKtds#g$-T
zEb5yrp-g(rReNLy<qrY%?4r}bC(vL<m&BaYpj8P@>;7q$l)w*{pP%n_{NAXy?xa~3
zHG{f?_Pa5v$&I1HRY%!bYMdBc-C-f?LanN#RD+?d_-hZ<NU|5#L|P@WPY=u6NJED}
z`o&HHx997{*};Bx+2ii_-!k9cPhCsUT-ZVox}J*FjP7-yl^xckDWpdmr0=7>8S$YN
zw4_o-KxWgRl9hCBta&#W{fA<oe(!Y8lM`dK<&aI-bYOP#zMM`ees;JeUd0?Y%IPde
zPH{VGQZif&n|}3ZM@@I#{~w{p826rLlf*9`&KFRF(+CSEyC6fi;aXPQM&Y;@m$18m
z^Y$ku!58^(;K4q4P*EKYIHVUAc%+Y-Wzq8c8jf!O_@mzys3r;7$OaMR9X7daa;8yq
zsV%lWODfz0WCMJzW+^s&rjO%Zs|skxN&ax4U~q7v4llE+sH2R8&rZR1YDgpU=$gpJ
zdC@t*KW<g~(U*R%gVv>4T^R-{kWD0`tn4%~azGVX^-!%lQ>*YiUn%>D+L?c1M_*p0
zoUjP%h(}C8IbsttkPe%Mw8tQ&Bk%u@@TC*^duS-p0x%N@@FpEn;NuTF=6=lUu95ye
zVqrrxo=e1!Aw&OLdx|O3p^pH@pC7wBmHFt0J5-vmZBcUM4Nl_Az`u@cS|8Jt>)<so
z<26smMRp9z1nqhi2sog=ZC#-(QoGJ(e8w9GBbCNggX${Lvyb_7D^7|o2dtP>@|)6O
zyOCgM;6^Q~bR8MyCYUV520Smq&0{bkzNoW`F3Bu{jfQJgSd~l*C|<ih<X5FN=A!Dl
zMNA<$t`Rfv44a0xUm~UB?>CC*{Etw-O=K~x{9H1wUnPAJobej3p^Vl5&ntWv#^*X~
zH=Xb|bQt!aKi~(_hiwM&exqSnf4XJZt^IHXb_^`MjIIQpxI77y2wNJNACo~_(yfM#
zbxARW2Bze)N|a48fE%a+FE78?sZzxWuUdoebeC`dO0jZ}Zk;~{#%R&VO(rLVc6S@)
zRq7e4w*Pme>^qp)1SuUTKuT$3udO74!gQK{h_6K725B68Kn+JP+6W(V{xy6V#{Q1h
z9WTve)H#!g0d?3ks9gpr9eSTdNQWX~3e53;gg#4Pfv8tf_2qT=u%e+4powG5bCOTD
z_r*PwG1L*M5#30p$|E0bBrriwwDjr4b`a$y<oFdN)ggD^HFoN%;6+-?Qp$s8Ba|#9
zHx<0%8bbzaMEA_H**Bv1aKBj@mA<59rRDSpo~U5yAqCW^v#!Y?H3s5RNeXFVuVgu#
zE42k_#BVx>^@T;2knF1)fzA6PU5FjzNz<=!w4^n*WT<oUc4$T0Smk6XVUcQ$9T0ER
zIUCvXU#E}KLocauPSK+uU|{Ae$Pa;|XdWv`AJC&KT?IX!l-*%Z?Y5J!%8;Auq~Gnc
z=;@3`PkA_EGcp{En0B|vVE(UgB^I+Y8?HR17+nfeFW(@8s0{@$$^Wyto&@l{x#B7f
zjA%Ium(j(LmHK+R9+#1+TDB?FzlgerAr0oUX3dM-TB+gyR|YL9#w3L;FkEb-E|fXY
zq7MZl9Pn!%l@c!vs`|oNj6KaJi_O@MSFYgnejb%-=B(EBcMC(`^3h7?n^wC1#l5wz
zU(HnA{|M`9V73^0n16F;`I1oB0_&+2TnqYwi6%12BQN-WtD?qiXhpFmLB2jw$eq)>
z4fvxC{wEhCOL>IOUQx*Udz!t9MnSGMwFd}2h!%;>6yqB|WkvVB{3#L7<Q6Gx7ezJJ
zxv)J~%X%lnFIbm^=^)BEGz0WIx&<|0dd2HT{&?{9wX`oG36L}Uem2kCBF@hCKnOys
z<}DaE*kaDSTB95=x*vg#g`PX;5`GrAe1RAc_w@1wO+lGjd75hf->O<*7FO6&!leO8
zs2H$QtQv*EwivvDr2#=9xYC>;4rwxHtuPsLGp%U6ff&H}_7HWm1ynw<+%+H+F7^Kz
zl7b^j^~8PFl9n?1-Xj8rg}F9No?tXkw-5Oa)M=!QZBH;b_o~?dss(ZYhMu%On1Wo*
zVF{sDLa;RkPap*!$^7E_<Ti>Fr`{Q5bMmy)^Z4L4s#HUZ8<Z~FUF;Jo_xNA7Fctt7
zs-14*>D(5(?S_9HFWBqRc(r^PX<4_+y8*$sY1)NuhU!-)PF4*dPipz#B89T2N^=Id
z(Oc-w72OiM!T<tGNpw(21#XZA3t@-oNZ1&rm(q1WuMZ++(a^q!OaDOaH6%dsHlp=T
zPhdWBNQ426j>AyO3P(q1PrI9xZ>LmSg%>u9HyJkHByK)gthn~|iDkF1*s{H2@d{O&
zaK`7+>4?oMTw;0zNEKUx#Jq_@zJ+;1*;c4qiDbu-cIr^2RP)%>i1`9z?9J=cTnTHR
zYd#0o7@Pian&Atf!LUGUTdZh5`dWu;Dx4p1OC*>@aA;zta2X)=$0loOJ(b{2<=Erg
zBu0yDqDr^u5yn}|t!y6F4O5_RP=L#r%z(3)s0LOCt6WB+X})k8<O}&e_yip?m~g;S
zXpH;yj6R^(sL!dxgCC`vnRSYaD&DS*oUqV+{z0s$7`Ysb`@qJ@pi&cAVpXp)v1fDU
zFyqHwvR)D@lMwR}poEPgpAjy}d!i<Mv%DH6*<5Im-{VLp2E?IE_(1*Wb~=xut|Xy7
zweJ3l{x0EkR<B51dB85|8{6j4sjRG1Y`7V=?BEWxbZFHbLffWJDg<iJ=#o{1!gG2~
z(j&_@(GPa|EL`#{vc@5Mc4+jP(!90(Kc%;Kp;2L0ac!AOv*6kAKsCS0Z7YBaH92;I
zi;8m^PCcD6z^+0!+dS206lQ!lwv$YLJtLT{n&O#=DYR8BQF$1`F<1?F*Il*4#}MjF
z*VWm&AW~SMb17sLnmQ{u-^~E~GPxB=kFaSN!z?@4yN)X-cnZu`Xty{L2BpvA!WS)>
zt7D(^43r}#aBp)#TDM{t&~G9B;Za_(4|bA+AC>FNV&le}BsaDExCOLat}Ow%g%o`C
z&7)y5$&5dOqCDFITL3!Q^mSWKHlRgt2M$Zqu0n7g`nAnIm*Wcqo*YH&i`#Fsh+lQh
z<yU&%9-8*m9jU0>b?NKMK`nrLlNHCG_(l2o`eO8&hk^l?1jZ#brNb27GN;+Ns8o{W
zK<xm5sPnlU>jc0Z_<TRje4K`jMUMI)q=Do!dq8mQg8y7Vtz7Hap%DFy;ZWBANDHxW
zu4DS98s*NJWhI7qS&$C`6qAU^IGia!wOLo9w$zrLv+Q)2_fyG|Vy2+tDJ@udIvdM0
z5PNt>P>f0tH`Te$ZZrJrcaf?_m8M4f$K9<xX+OfS>DN<>?iEY$*dDWpY7_^lC8#>1
zY3MR|yj$(-rL23xwNL#PVq`M=5`(4D>JOhi(|CHcoPDS!u**Zn0Ov}km2@RoC24W<
zQc2)IgFq!1grnxu^x1a(w9Ckv)}S-;(m!HS7O!Z8YwO1X<|Ez?qt0B|I&u){$pc3w
z4*wsQ`mQVi9Ym-x@{$r%o*LSQPgK~D$Q&Bl72`}`4hzdE@8|1X;ovFt4GyU_sX4_1
zMjv0Zuo{sb{VX#_w;f&?2`)5=+<-i?a9Fl1HIWHfL~Nz8sH8~V9eyvNFPp|Ij2M|k
z^}H4aE+rNeqlI4v{W%H_o;6LYltG0XPG)EZb@>?LVzW7YfDAOdu4<eN=aMTmNN!~<
z_W8BrgkY2$YXisK{3hsq&XCx8lO_+mOjvXX5OSnBy|0eBt$KHfMBnaw1nN7*D{6!}
z+&#(VIBJMgXE=BfYwfO4^3+bO@#JNB$OfbA*U#R95)YzwE8ab1-w`gQW{6|wfwcws
zX_$PKk&(X7ggO%J7Hu($(>5Dxx;l*h+DNVvayIPtLjR0(&UsD0eiF?cVpO3H-9knE
z+^D^2Z8NyHzgdHzx=ANPUs-a?RG6=Tn2F7<P?@Z5t?EwO=eGI+G^DiS_RXj6P7s{p
z($^dq!fX2ca++nz?kJt1h9`zkkLw9c=AqrcNi7aPgflB9Hi926`~}!k*?3m&gkB28
z+V<MqWP(_QE^XSl2rL?*Ki8V=7wa`K+N<u`4v>_ZHGwc|9zLk}tfKQ;n=RIFkppDp
z7O%^<2+32U)Ti8h@9T!-Bk%mJiM>Z=w??n?n&t$}>iA`FfO@rFbg>c2P2!FBKo*_@
z{fOHO{3Fs@ec*{MrdLEm^V4+eol*a%L_|CvV4!j$TP!hypF47l=yy>t_1jU7*Z2>M
zBJy^gqt#5&){T95%q~Ic$5ksfHw~bNUfqddPy0L-N}q4MPr~nsh}UWjEw|iHa$*Pf
z%heAJMeDEaW2<QR8;wjWv8DQ^Htm1K&BMAx6uy<=RoCp&C&dG4+)6pV$Cx=byrZ9J
z0tFqHjPYdCSRNlcxIy_)pxmliOP~h}*8)NNqV*=p8^?$;p9<h)cYv?1yQ_Up{F4*O
zbQAfQlo*x1e6pQjgCLwUU@6yk(AK5`5-us-`73_%I7K%Ggz{{ggyKy{OQc4?4)u<<
zZU_?_Mr{FeAoSAX3j0SoZF`r%=AjH-hbs;+XXMYS>7a>cdX1Pofi8cN77v*NVR<@L
z_Oj125@bFz6t4*~FN=+X-4~MGWjfWaK_-6Ptik^EioevAK2{Z!U8otSF%X8_p!<u+
zI3>wRnD&J!r<i<K?f?6g%m%K)n@VAgu1c1~(0NZdKGTB66NvGrvl}j$zbwyCM*oHK
zUn=o7ej~E6;!t(b($*5l@GtA2cfE|M1F5H$bM*y*{acj;Xoz*E8+7$K#MKzNUhqHQ
zvcTAy^XszchEo`7d!e6#ZnY(=(9Ls0)8ih#!x<+=QVn0+${_oT2Z;djnsqs7(m-7|
z=sw)nZVIyK+CKk>Nj=Y)RRK{cEmPM2>(JYA{2xDfOjD2IMX~=nWFTFx`btw!GP9}n
z0lL<aW<)tB91qNdTJwvm!K7>6|8HYi;EXfX3u|!0%JEh>OwNDZ$sj`SKn}pB2l;^s
zjQS5XN|=AWTMuJ`H<_B!{s;QYy19dKiv-9Po<J%(0Q$=2+g~IK$h~^>LImNae}gAu
zZh+$}5z0Vj##}3p2)hrf)zyfefo`oOfAOGz+<cQBP`6KV>Z$<ff4I@Dd;BCxL1D|h
z7bq%MyIBLO#R91>c{ifk9}Zp(jE{dY0vLX9GL-@Ss41_uwFvwVqs#(<DoUy4446o*
zdGr9iGHKf6Ypgd8D-KonT1{WxzJ>Ukr+xW_qEk`|BvVto%~tRa@q;PHXB}`OEg(0v
zyijNr<k?WV1=9j+e?H^Rq++LZJP8x~hl^%`L?ITqUY#&?kaS{O{g+Cz+4p)v)b}Ob
zX^H(e{mx`s;nEp|EexnrxPKGoWPA#t<ZQ~z4@W1~B>FkIzZt8>NpoYINrpE1#D!$*
z-*tiyl3;Y?CY81oB<Wl6iJpYN!1=9_Qzm%pW^+<H9)T-8^<5C5Qu7i_>-1qGQ#!0r
z-Uge-t{|AcFSnxm2nM)*!c{XpMRUu?(ifenFxU1!1b(j0thXaL=|@zHs$iH{2BBbh
zfaYxg#XB_HQh*f0MW@BMqs84HoZ5ejzyWf;dz&)nl;=Cb|EU5X|FuW4AHIk^*>7Kj
zAOGk&ablZ?qhKY}^O~N0-IglYPnc)zKf&uK-Z+o_fby{LBK>FT$pXVMj+tHHzX<95
zJ_e@y7YE+$aj7|hbkht!TJ7)R7XzYO_0)YdiAViv1OuZ{@DJaIU_7GhhOvmmIeNtY
zuQfaJTZS4im+D?)ujxObM-$AVdFZ^JSVSeUNXK4-`KK&*w_{rGjd$v6QM1sw$K(E@
z@d%JG^Q!Naku(?UAsDAbe@#4UAj7zY6;tinX;Rt$GjnbnO<JG6qw`3)>H_Nit?B9(
z8Q&}N`dl$rUFDj8y`gWhYTgza-aO^rrvF<pIv^)&*%hmQGy2r5UArLolFB_^#%-A9
zIeX1ywAWtja6(w1FxTckIXaIx(*PrCPPOYi`=>H74OZii8Z|Pez4jN(uNVX14AMFz
zD4d6`=%R&K)BCW-)J)8?O1{!?6<9GPyv8e2Nss>!bt%)d$mirhs#Luu9lPbI%iW8P
zE!s4P&lK6P!_cYHaxCg=sR&#D^9RfG_yApROIcGQE`=QWm^Hy7EK5e3()0M?XiwI}
zU~D+XhAPjqs9UM#IYH*8L&dIXlz}el**bL1_zc^(EmBDL=YYNvYtDSSBe7s~Y?*Hr
z-X>1!F9CJ3xDUmX!?6FDa<ywRE1ouqu*oD!>%qm*{)6#^z*4t)`pfgI`d=?%Ut3JK
zEHbbrtiW{=b1l<4B@pa>*fuYh<TgWu=N`RlB@Q&FbV^Wg4l1=U-XO%~l`M(&knsGZ
zbB)K_EarUJTA?J3NolPnQ!`<r|0^t8NKXmr&-aoO+#L<~3tpF<o%xG`V`fXD=4ZO+
zDGu>6d<LmI?(e(!H=Qcq)=gZ-WZyMX&%>u;?)o}r3shg;FL}6XA|)WXt$cSx?e_WI
zsSwqB_YmihRgauHV=^UvPTD%hx)7@DdLC5R$p3PAZ>TxFrs%I2r~&yi<R2xzBICf$
zCa|VH2G+>2Dw}}XhKY|auNZPB?7RA55pyNB6^S!KnhM@Oc?%3|)@}b?$qq)^#(5nJ
z6shSr=2<%IepR6!1x$SD`+ee)J102R5rQK4cBrv9^)1(G^<XdAkZ-V9_!Ad&6}&&g
z1<pBUH%M<wM1t}_hj2?N3mqAsWiTTulOh5loi*8vM_q}vKJS~8h7xSm>u=EMt{owU
z2wyhdvF}6Xl3Om8*G=fE@$}?|v+8uz(d~{o$XFNG?1IQW+Jm1{PS)8SuhZ9IDY#CQ
zK+3HI2!>*NU;Q&HO)YkkOqU&QY1%hio>j%6H6sXWvx#|?tLz0>NmAyrkf`FsvW;ud
z9}lv3!vV(`w(WGi0IM~haeLB9LMH=UxD`R;;S3z!^Tvr=z$Gu><`M4QaW18<wceg`
zN#{ML6+12|!sasDbZ8a_6GL$p!<M?q!9z|fbn5j1b#8PoMGQc{v1KKcslAm;w|0A3
z&qLg+Mh^H5OH*8&)x}8xmTH}2?pjxTkw?Cy)AN(eW1=fOt%I-0gEMv$TKZ6eH?tWJ
zYejF7+3I}Xx>B+L_=v0URn48fL~H8-GKF3lp;<i!7%2}{(;)1fd(5i=FRo4O;8!gw
zy@<DPouV*`aq{lcfX)GPYDy+9S}1JI%P%y9&Xy5kWA;{mrW5rCw;RWO0DBiPS?2Ht
zl>&QRkBx^dnz^=TMvpv~6Act#oZghUEpI?xg?Il`R07e3<y&b`4?6E9i2wNt<;X7q
z^&j*N2{gysyMjwNIC5?R!tuTAbgFDaRQX#6BNF+n+X>;aQ0}!;Q1j;Lqtw|OB8|9!
zcPZd2Y}wvDDKqCA2lhZq(6qo9g@SG2b?xN@v5eROxFCR=s78A;$PIoB#agT_N;f;Y
z3BVrvhND!NQO;mZm*3F;x#lTdSql^Mx_A|CCZ)U`wyyF!=#Vg*x(f%v6=XB!bI25U
z=9m_ecNA%qb+*bg0)HXAB|i2DlLE<apg0m|#|RiPWlCP4cyVxWUT0=3;AsjJ3wa!C
zaudWkI^P0&PZ5H>8VPP-Hc)r?knVl#L=#ex=1eOGgYKXz;>;<BbOokgF{B#~HJ;aT
z>B@TPlpNyZ4hA8&VUa5C_;xKJpu6QB-|-7_v8bWLVs}JX5|d{V#0DJ>`E(TZ<t#<;
z{)E~sQCCuVPNg7}c^9J!9dbSF_PgPB116C06G&^70gB*+#B16NexwF-F{(JV<ooTG
zXA`1{V&hO!IK0zSnFxirB}uG}`x;WC8ID42LDwK$(r`TCvLXa@FZf#Jd&Fpv$Od7V
z2vE|rcTstBo$Y=qiCNx+9wOISEZ%uM)k6)_hZ5A^k7XTd$m~$K4@F0uoysW&w00PK
z%HSQhN!yOmO5Eccm$rFR3T=vWYygJV61)gLHh~zC?T}1Z-vOM$2eC3@=FP-$O2|1k
z66;Bw?u^64T*xyLWX%f<B04Vb&56s!_%p(cGer2YvbZxKmpm_N9K)t?)$~-WW&VJ4
zrLhmtJ@BMUzpKf#Ml_QR2gJ(^v>;$yoawq$oHd^r4_$)i;s{>XIN?!_nSmHEBr@*O
zBt}PWGrMsOGAMQ1La<UZhZ@ob(M3MtgBXtC!d6~)q8VSNCmqR2N%MWr9|<~8o;f+j
zHVcWnzK026VtK^a2zt=bIY8#s#PG{#qF4!iHW-YSB7MNt4A94{#s&S<S&98(bNW?b
z-8t3fo8j4vYzSa{d#;|cN~%AC1`=sK6%Y`xucRg4h_Sk~c}tg-m!kOPVUD}z)v|U&
z5Wu`)%_xvroknr*wI+Lyi3UQV_|7%7#g1_g?@s;X9Vy|ZJYiTS_wcJP?~)BpqgKIn
zs#->N-3D>*os{UutCkY6OC)&tG=+0Sw#vUvs&3xkQF%F81O~(rD1+pnd?z1kf#>j+
zxbf5_fY!Md95_AS%GXT%g<v>@yO+yJt0%U|=Q|{x%cSN}Uuq-*tPT*W-QQ!PtY-Wq
zvXr9{CmniGiXze$93GTB#HAICmiHB33?{SmyR|q2D=XtO0Eb1j3!s1G2T7J2*N<bP
z%tzud#%Dd3zkMYRu^NHI^WgC-jcb;A=2g#1rk$QhJwB9nb}HfOSjf?_l&fW<{C|jj
zY*oi&6GsBqDPqRyoQoJZ58(xS_3v`&@0&~ENF(<=lnu$K?CdasM65O1qa`5C_2F~w
z{y?oEc?#h_r^1|EPlw``nv8$YYW(=c{1~1O;-(LVvG&~-vSlcMdOW>)jS`5636VUU
zJcFtY_z$1M<U#}cgA>ipqfrcOL|<xDAi;)To%|1gG#F0_)4q}|e;4q2mua7xx2k+S
zaF`v&xto&X!4|gtxCjpRs$?;dgv1ZDj0R@fa&{9ODzRWt33N6mdM(0fbhub9+Kgxo
zRh(1puLs&?=j~xQI?TooKmQ(&+9-r(j8u;qrbdh^h3_tLF<6_-!bA@dCdHA=JI7o_
zu8z4%ZFabHhM6h8+e^4|qKOD8GBEQHKj1#N>c1Vu;BjtZXG3-XiQw3dToWtM)|0!6
zf#^LJ!dQ$v`HwYWWSk4FWg9fwM6OOZU2@QZDZ9W$2a*4N$V@BjmJid~G7vI8Z?Fjq
zTF49>TwR`mfP=h3VX}ce>18G>*AG|Kuj_T3vU?k9<(fI3)}^*uS5gFHKak^z;-XYG
zy~inxn-;SuUd;v%i@ltg@vJMmU?guK3PQqowp(CwG^(H`o%R}27&&~$6ucf607WH%
zb$Vc-E6`|r%!A>ayhOqUL3M~@^ug2VRY2kVwtqd*X#NKx3SPA?S$JHnNhrp}rl9B=
z%2NTa3dH^#fiecivbV77<-Vj#Tlx|?cS~`Tnl!A$2LCm2k#`N;I9f6xv}nj9U~>kS
zX(*4f-VDGTA{J&W6%V#IKWQ*;oI@92#ZrXxOg7$j9goIE)yZXC6(WJTr3XyzU26;)
zhVcD&QJ*@C3um~l-@wo#CyKTSzGakw{76iVO@B3q(pV+)b1eD>Y3^$nrX(-h!Ea~_
zbvR)U&CWxQ@hDpn8L$I1GqQJc_uyd&GA0|t^jKfYTC+Gxdy>19n@5*-bThDD5nFBQ
zG9vyaBn$gqQnl>cN+UClV@=}tCQrtY{d1O^RT%BGaKGs7$59223xIA)#uUL~a%t(P
zxYa(F*@v+?Dw|MQwTnL?g-nhlK9#&0_~+W18D?NWX6r*nT19P&>J4de!hi!bskC?%
zhLDl@8o504FTgUW0b1F=F;1avC5=5G&xmGLufhPAyPhrV&*08L9aVBbd4kF1KY{vV
z-ci*V#`ynacFzqdDHA+GD+8fyvlebZMZ(s@0-`p7Z9VE;ZT8eHSu6`>E^HSFfDm`7
zoFHYiHtF=rgE780<nUP_8klo^X+qWzZU-e>xoNo<Qjd{8yzXXzUk6A<S)$BWYXU-$
zIU*63L02{7NZk92Lq(9X-sNB!8$s-Ia@|09rW6km02Z`98YU%TeVS>I9DxHY(VM`@
z7!xVQvTD`hhDz&F&o?|He(xJMkferPuzK`7<a=w2q0S(|CKw%{6!eq=`FjTF?E<v2
zUm#LXDE58wa=0gsSH<v@@HJOfAUqTQfxs=HSS1j!SZg|vUw;2*gfv52uS8-5-{l^D
z%m3pEJ*N9wesjzW|7@E*FvJwyUk;CYQo6RP*<_k)pBwx=;*91rsFNnV<{mPe=2_{C
z{uw8<4p4;kIA;gx{PjOTitCrq6igasi97}iFn=U6uYkON=9+112IL-nMG&u9!+EiV
z+<;xJo@CRK@*h2x0$y67;biRdV!prCWVCQ+9C_%ErRu{8n^FG`pHS7QNP@>vL8u{?
zULWKYFkG7EAwouT#=-t@LGUsXEceFBo$m<%<|`!?hKXNoncb8CY}iVk*VU+4bWP*<
zOqOfO=Jd^2084CSiuxuzv9B~)1E^%<v(SGqrj)kA{w>Q@+YP1`!_ey9c9oOH2!M3>
z@{WR@ch^vi&w?1o@bnA$l1?I#XSd+-=Z=BLy5-)?4;l$E`hJ7VzwS5%==@<uZV(p8
ztCIW#<d#<S7qDZrsT*4mc9>><yv={pPCmoS<5-b1c<ww$@Q-n{W@@91R&aj5v^UT{
z)d9UUZMuL$4CSS^2=cGTs&_f=(8P?SZ}*7n|JIh+?9PTw+bxPwE_%zqw#<$Oc<nB8
zEEtg8|Al~chInH~(28JaO4t53B^dz8nI;r0)WsjkZXm&?|Ea9X?Bk98ATfhn`L7XA
z=<Q!UPgp{UpEVin!Jk3qUKgXTO8r&SLa>D7*Wcj#y_*u#q%H#1VCr9R-Vt`&#O#1_
zpE*aiftA?@aJ;I+oJJ-8bQT>DfQUKL-IQFdh})e9V&KDW;qzg6m;#D(i=vwu<w0)h
zq>Y6WV7r1VLo(fC60z3|29Pao2{OjmV{oGG8Oy%t2*g7}$n=&^vZ_J#IWI;Z(~K7%
zHw>pQk~|uiDcwuZ-cbxkF?MSJmzLn&?w=J(M;?^MNuU~(IC>z{o24qMa5f}3c(%9C
z8A)9%IQ}#V%%IRbo~v>~R7u4vnY{rJ1<&re_GKZbww$?uYS*=S&T3-W%?Eymz|W9x
ztRXD1Txm;^%$MavW<$1Nb}>HC5H-dLse|u=JGY&@A<PzR=X%9m`VClk=Hbv~Z3OV}
zM0DOvq663)mWtiZKkmGd3DUO{!{~UYnYFJ0S@YVF&_RAiYBXXKBGP!%%(_Y6k!yFs
z^2o6l$dX3#8p7DRwa7c6&%mL{^zzxd0%@y}wVX1V@vjVF2G%M?aH?HUFj&q?;=H@c
zTnVwjMi)`6WkU$UV4cH8akh$=9PbN?xR&qLYC@hJN)w+TrGIVr5X@MJ<m~!J9`$v!
z(H0YvRgI8v!D<yK_hX#nt3Mx*4_%CrCR63*5O1_ypVHTS6G=er^2|3hF@0{INAVVq
z8x+1M^(nCUPG0@sIUF27{JH_oTGQEb_eCom&)LT$rF4++p&f$~vNQ}hIAB&RI0ajd
z-S$UWf;gB!hnGXNhqLS4^yNH7@?xpzyIHcj-1W7P_kKQcXc#{LQ(4dS{@$JVv8f8J
zEP|(Y28lu&E^!B46J6!e)9w{s1;AU)ZK8RF(8X$NQi;z1j?#XVjmW|E42OkK!&_WK
ze%2V?c>9Z`#7B>VFZQHh5Q{C{5=e~f70cAg%FwQH!W;PywS@^GnZFvj7k|r{^c2Uv
zUc(~&-of0m!0QsQDLA8O+tBf{Z;|ZiUT+>w>UJkm|9TAT9s9OTSxx+7RuulB&v6NA
zCWz5}qL(lja`(gp#0CQMdt8PNP9RK%hnEBHQ@hq|YmvRBNDeW+FE$U~qOeY|ou0Xp
z)8UAFx?3=;uSC+J)?f+zgJLi(@6&L(>y9$O7=Fy_KDgVrZZbyG0}MfQnB{3b#yMop
zU_t9*6<rl)3zDL;2W=;q)z;DF9{Yx%JV2LWmO;OP@E!*kDdxqVsX31{tGdJ4-`R3}
z4U5>;kk`7w&{E4o!d{aUYDoQ}=OxViYzt9Ya2#S3cLzeu9Fsn_fhT-1IfAF21o>nb
z&;)iRid0CBJm(~gyMLR392N1tN3%d$06q`V5^b-0QzigfgPlmeI$-UfOkl{+V(5^b
zl#pUE-gN@+S<gm7w>Si7Ut-x0t{eoS^;`VoG3G6Fsbyvp#d+q*q&+Bv*br;4a{$h_
z$G4xj%LNe!H|05gpyDGBtz9aagnK6msKoYsX%Nw>7LU-BICPA!@l1A{`Sq2^p<|My
z^k_mu{KQs4@U9O*<YEfjuZE9-<=m1NHS=LuwK`ntf&{-mFNqC2JhOO2RE{I)2Qivl
z+W#0T9h-XyO5$O|n@8D<XGb&9drU`qOA;++=RW97M1)MO0welIsj<5;FFjjFcS7J>
zyKSM_!ITbE8I5-$%0vrb$(49`<(^PJ#yH-3A`i#D{su#qDEoo8O)18#45C)SOvE8<
z1ws|FSq~Be_H{&sd<)#w-UM*Gp~Er-GZw55jKNFbTkWYxKn09d<$-Dc`A`w)61#9h
zHF5dtnlVIEAtI`LEECE8@N=6MWRwC~=o9^SQQo;IW_@54-&!I*=mTDuvTk+O#T8L7
z0lPq2Pg>vjakd{40VLHqg)})R^;l>(S&2ND^BE)cM-+ZWoWC&|!;MMO<bE8W7z2he
zO~}VeCIPr!$^vJ-QNRb=tOs!p^-vgd1;3C6PL%0&y+^DIaFTqi-p&oGQ-?Ph3VcNb
ztsVo{Tpx;o`xhlhr>SY>EIgjZRV!DgM&dlp<Mu>ogIugY*SWgBpBMJ!1|VZA6_bdk
z@rVW|;VeVVnrnsK^UlBz9(V2vBCPZtTqaivYNyRDI#c$ewvt(%-voU}Hjp5^94+Lf
z5X#WC41GAwm<(zVp`oErzlRLxs!P(>^p-#{HRvep5-Db6jwA8nUt(z<yIX?-QIRfb
z1HghiPRl~225C^>Y4;F=aHHx`ieZ4rKrba*sa<4q46me}5;+(SD6&R?hO$ax7cL|^
zz)G-^LII(FhdR4CKk6d!k>(3RFPpRgoLjg*-YmI1PRnmw!D(tlipN_zun46Iis~nN
zzmu|bXDRF~Qr2atgDSuL21N}K^-v{tSlx923kPE8iNkV{v4Arm2GjS{;2uI3KhW`L
zrl4D(L8<a6cN_YC@>^wUj-WU991(?pi(F0l_)K9AxXPY^)fVbIW#AMR4TzrYH1id}
zU$UVoq#QYY$q_?dycQT>AFm-1qG>L};p=G~CT@{qWeBW-d$P`%vj<;?j#)JF`f;Mn
zF5+8!evwHmjk5$LE?y3}r?C$sLp^S@O{+BYJ&D%HCkIJJIH6lKj=zH;zU4pSeEDe^
zSphmzrF3}A9*-1)3R$n@K!LtrWIe<S@f)&}(DyJK1HPAhwoJ>5NrFLgA^?pe!+dlY
z&S2Ppq!bVM=`fPG(R{jpuxmU3i~l~`uvu9C*b>j7zr%b|$P3nF=ocOwxZm+|fKl^s
zSqza3Z2=nXsT`kbFrrKtFqR|ytT}gYOb$j=2r(|pbCS3M(hN81;SRG@$=8`Od%#+|
z!<FBSqQVz(!R3N*trXCgqs<v*ii@)adN7jJ$C>R(j+2cv?7tfGfhMR3VrSCv<%U@}
zR?|SQBrfg8rWN|Q@AOT7oy2}YnjP`-+eOk%Cl*)YI({MB4HA8-0_fnjF(^v4Sl`VM
zi@byzCVY^u5bF4H--7gc=$4Ee|2lHUis={-0S9tUBsBo-HEZ5EN>9Zyv|H^hPbPeu
z=JS|B2T&^l#PnG68ouOabRa~OTHL0Bmj?lH$`jQ11t=Z5Ou&z6q{etU!jmEny9Vy4
z>cnn4gF=;=!00JquPIgc6E3mW$9cS-IQ#00YvG`Jz+%+Vj5t9@TF#khvxnEXJ(2Ny
zxK7g&{KN*3d70&IB7Me?ZDj1dL<e9oOqJLrdTms;B<6@~*P>vq;CTk@u2<1(I0|by
zRwFI9FbIgxo;cecaLj$ww<)mfcNcq9)9k8Aw(gfft3B{XCMXa%B8->^QH56XX(HR}
z)w_qeEj)t>fnV2*D<C{eKU<FQ(aPktw<}6W;~D^JnM|m4YO8`<h?wOg3t%d^EpD1)
zHw-w*_q^cL%+B3`)%k(|03}#$sy(5kX+@hX(Oyh4_#oU$)(92%Af5wwPlwQ92CX|8
z`Pjwe0}le)oU9YBtu5e3QysVm1!~Dq149PaD=gNRea)6hNfDR9H<m_)NcoV&Rszeb
z?;D{dWkY<Jp69eV@}!u_`w>}_2<{gm#bjcB912v*%mgdj%w6N>nc4x~Y|0e4mR(kX
zxRQ6>1~}sGIx&H0hZaWc6pV9q*o|O;A=c*ZMgm2C*qMV);`<p&d=kPBI@(LR`q?%m
zousCmI1|0ihOP)$h?Fb9<|Fliq%ct!GmejZt`THxI%_aG84fZUo2Ix2cEs|{3PljK
zMjQ^}qy|Eb1sv_np=6Zv6wCqwMF@#8pis87!x=tW-7e_RWZg<oW1r9xr^cbCSgln3
zvZRI33Wv(JGxOGnth3k;Q<8+?IqI%MktlQP^cQN(yM~&9KN*JKeobKZbsE7jz(=aG
zeb<?8i(~FZ_fSC3kLb-&4wo6&%Uj^UOCt6dd#|bHrxeoPc>}|a>R&vcNT16kzAPM$
ztRmtpHeG{Z5!uxkVqxelLdawS8+eOK7HDUg5s%>YUv@OWk0U1rOFffZN{@VdLO<~R
zYOpB@?`ab?7HgrQDA%DcZa2UH7{)lsL^FxK#~l$FW9r(gMjtlq5?W_{Gu2=LcD~kq
zZVp^v$wG2+XiM87^PI#NHiQ|+g2IN@p3Im+!r;%SNF5JO+R}jrU;^R~3^MnrhxK)a
z)_a<S62hp{IsP*)z#}>}YCZlp$&4!!?a9m>+;E*vMliw2kL@OsIq(J~puN}-?Pok2
ztgyV`R)aF6`oX5Yc$Ii~yD~v$)8QYH7A9WzMfNZhJGj5lLnZ|2t>H1kPLxd#DCS};
zX_@>~k50v*pAxtYu+-276Cw~CnE>PATH;|8@*!vDO(2W4J+E`3*G=%`+?`M!La%&8
zxJ66tSjjSXT1;PCbhdnVAeB^PLro!JTrMQvUVKVzHbLJy>zno|@l$oEwD3j=MU&7p
z)~ov~ur;}=Ajd(`a_TRzzK!uj>mr*FJa|$LI1-wRqjMgvP$W8|azJWm11XO-k6sM$
z{uG=u%NID1!QC-(0M}AJ4}O;0YDat^Wp4xdhEM9@WWq7BTZfAfMUunS4s5Ky0P@fb
zlFhz~X9&z-ryFYevG#4qMmUaSoqN4`;A?dlo4`kWgu@^tRz$(5ZLHgfE_ny&GK32Q
zmC~v=rns66%B5dZ75_Jlj&C#UfDT%zrp=_*5LVEp=7?>(Bt59iQa&tQWlJYCkcFzv
z<USfh#k70{`^}Mo2&6Q632(CXnV;#M3-6Y7F|LewzXARu=bq@a0^zkb(<eq-L#4T@
z@YCAmEV}qll3G7^SQB?R^Z5lcD3hTI>bMHHt9kvfVmG`?*yiP^D7U7H-}mr5ILr8z
z<5ca$><nK&NMmWoa_)*wC~V(4ac^%*4Y_iXrC~R3b#a-TmqZ03WvIQJ0I|A%1BFnI
zXCy(wNKa&FgnGT77BAfaaV{&$nnxg_tmf_SWHe8#tN3k$%8(kBdi(Wpua;L`UWwAr
z(GiuW5pT#9!VJ2AeTW&0D<=Bp50^MpJ5Z@C3nHD73?8|LPxOg<w2rRc_RlTwsKntT
zg*Hdi<0!34Xg!{h21&v{K9%ODJBA`hg_hKQqa03Ln6rG?>Jl*264NVgapL#<1yR66
z3RcXnpjJ!`ofx9qJHRz6lY(P;@ed^HUImA7aJ8DVSVRu?rhQL(`hD?n<pmzRmwW2`
z$V1D)MmIEC60yY1s1&exu7)Z`1P~BHa;)Q1#thD1lp70snCVxv{CW4Z(Kq?x1&byW
zT0}(1pEwJhVsZSGrvRXh4I^mGXw>zDQmK}e0L^iC{=^U+T#(5Cj;I>Z0yP7M$K`K)
zdOA0l+5zJga}Y0S%OiV_zph;UOYY`J*nbFXbz7E*nSG1CiYBP(Y#ygLgd5~oZ;_S(
zmiG|RBMVWyVSvlSV30@Fq(;ky8i7GB_e$A61^wPaOagx*H0nGGV{B63KXq}B1|1#^
z;hc`sV~RCO-6@Vob`1{{`AD<jaYdR=0fi=~@96Y><nklL72bm37OT=C&`$^TDcI6_
z+<LDUGfzazknbaH?pT>+n3L4@ru8FM@PucMG%xd6RD(?0HsRGAOn3$LCAa<T#^3AD
zRy@C)y}<kLiuTt0TlvJRvX!!(lTE)6M6DSBMg$N4r{U|FKi~W9Pd%P#uSxJ;<r1|Y
z&j}VyMEJ!-D1U;NoF|`}F3KGEYYNamkJv++^!jEqsZXA;Us<>wPI6d}Vjd0Y@7Amp
z_T$qh6h|BKoIim5w-;*(t4!9~h<snmQ{hj%vdeH<gWhtg?`>1P#lLRXdfYA5Q@4Ts
z>FJv71Ejl=FK=74+^uH0SRR`t8vEVW&tLySugil3r=@#^e^cKv(*Kj!<5tqb9|W;^
z2mzhAzcjUwWTkLB-sAQLZ43^U`24mJ=jh=%I5>RLw{nO>psUljoX3vTzt@(jPxuL(
z?CL0p%A&Zgy52^DHn30VP4|0fb-zz#J{)8glW>_pqAj2X3s!nvRHDkDSpD9)zqMG>
z1iqDL4*T0H#H2uMHYJ&D-7U7W1Z@VqPfg&1*`MXFeJs(-oJ)h)E3ckZ1iUWQhcU}$
zSB(5w#PJj#p1d13E2V&}%XWkWeaf5W2Hp({#TganQiRulbP+8X<;(TstFq7DcfW4d
zM>Xot57oUsq2Pz2k_ZQv*Kn;I!a7Z?Z5Ru}rC8}a^M@184tKyahkAqVMHQWh{U(!b
zRVZo)<y&~xCiYU@>S2Tg>*+%z;nwuYhU0|y=KK^(Ji*W76N}27ZMfV%Iu;L?O!_PV
z7a_#!w}kht9M9Wr9M5LS!#`qcH*>ZhX*CVykjjIdzY0I%eFo+&UqeQMpBnncuTGx*
z^-FmF^ks#ohvskMOO)^C*r<(sDE=6s@!xRSOSv*{8*?4}l?r(^)JgYlNN9Y(f^cuo
zb&MW_&rQm5Rurrk`!SH8K&T$pdyvlit4?V~sP1(iztT9r*dU(5sg}t5KD>0tT&Hgo
zwd}^JmRq8rac6Y{d7SVwqsFu8#n2!>{rCMg=G!0A#QyByU1tZLN5!@~+dD>@JqQhL
zAp!<}ep$tx;&-v4xfQ5q45EfM82v1+E1{1E5dWL_SfQ^wPx5@GTE6{eGtRB-W1TZl
zx5<q2=Zx}=V+K*CQRt8iUEQhQdfUW~A*xGCV_xfb`}SNh#%RH<U&f0gztnKSOo_jm
z`-r;~-<pToxKsVutPkL$w#_H;)&6<b=lb(^$In=p6XLBE@pJ9rK8KD+)ycIR1NkL<
zd4m_V!Q<;3Tc75G4$9Z*tQk%@w%(eDKuVDndpmLXo;mxq7&{84S1eaJ-M0RPn0h$^
zWf@*)mVBd+Mut=TnId9#7mV%tiCLE+aSETcFy}Q$?FH-&`{k5BYsE)=s7gtvQGJd-
z{w!&K8(2eMt|aV9*sF|VP3CVu<X?ZMWY8u@)b00TUD2;U{@^~#M`$V!SJ}m46~NTP
z;W)RlWj2LxqI%-$ou>2pnvJ+JLgM!Roo%Ce-0F+A4M_Ryl@c|9uaIh+U5X8}X@^e>
ztr`_mcnlqkjqcX{&(24Fbr(FH!_<WYU}N9-sz-k`dD|PacvL_6wtimp0p|_O=vHi!
z*A1F}7!TFn<lS$#{iZf$Qus(Re6C87I5>%M{thKXdhSW(Y9s!~Q;_h2PJY5KcIIA0
z+~!Y~;%=@R1Z2{N<|ZR6$9tM=O@HVbi|=AVoS4C=<Kq}jy%*gqqmDX%agHo}xOeA;
z{ls;25Kw@xZKTCIB1bE0r@pDh_VX?Q?|qN?hAm`0E#6AcO4Yu_v=h%j(|o{&5wE{U
zUt42OGA!z7-FByy8NjI1|JSUx0NUh6nVj|&cHCG0hTGl~u61M|s&~9VrOhhLv9f7f
z8Gt0JaP;X$);#vcteu!c7Q=;w@8=wgkz+i8^_Jlw;ppj1(}raiUvApd^8x22T@pnG
zk$q?5&mPkg$N0vPpr?bjE0*WC?Z);$<xO!LWOrpBr>55KC)aJblJs=k;oxO-$#G4x
z>)f&|ZKm6b3cR0?2xavxY4@u#U7Ah44^p=C$NLT(?uEDVinpkH8Gt(5=ElpZvLk!8
zHXeu8F2axB4?k}{E<Qgl@;^S>{QW;(|8HF@Z2#$6(f)1wZPDoAHY~ejPz~v`MIge%
zBSebDiSP1p=L1U?gt=h2dtG%5Q4=YoZ%8J%jKoo0Kf*}uq;_k(#S1OM5cyhfEn(x4
z>h^bcKj?rM!7Z;6n}9+}AFflyXkgt965m2{_JIXX2ey%EyuO?29z{q%(n0u5c!-|E
zuQNJky&C)Fv%6`&q}%x}KM&v6yZHy7MWD+-X+j$y!eeZ+?&PuCz0$jOE%y?%lPV5x
zeeos<Enh!{2E<SSo6MbG)sKl#IVdh~bKy$xCt!RAgMXfTKoH3{n<?8zdcED_E8jTJ
z8WNVTR7gGe^3(v|JDv%xa%l|TeEUA^aBBEb^7;xb{n|fz7Yg}&3||I@UR%{|YAPT3
zd83zJ?HAl1AfyQ3bU9mQ4D}w0p1zLlE=cb4Y(^~kWWw##cnyPi-=lo2r{}fdLz~5b
z{N3V^;`f<8R_BCo^;lhf^fujH@e(djO==_}p5&fAbYT9n2hrSn(x&CxKJngX(Zjj5
zAgkP+yY1(@U*?*>$Dg&!clklE?ZZag?nAmUagQXxJ>tzf<L6@cv`er&`Ci&FK3yM5
z$KBUi8SlM<IGZEDt?i?MOGtoC$PqgxGFD_o!+Fe7?ef9cL)pgi|I)h!@c*wR3n%mc
z9KyaKhbsi<n_ri4A}wPx>oJ;!q~sj<6eyh{`3|I&KqDk3{n@wvEs3~`q09E69>&{<
z@bx8z9V}|y@9QOPUie2D1wu^q&OQEmtuUoOFJYZhAwqgh0ttr8yzlk6xBEf<dTk_N
z*tYXp8`C3AvMFRxwv~trQ(r(p|M%Y1R<O2?*yrs}dj5njfleKNE#FIY^pV%murZoh
zeusz6%Z+XTN4pn?CnTdgqMdV(Q?$H5o}Ip1-?bh>N5gE-X6HzW2S{I!`>JJduj%4x
zTl_U1(9xiMAJ1?=dFAGt&Fj)9_8!Jwe|04}Ay5Pa(yNY0h`Kk1q3WKC;6k84YFHnh
zakH2-6+96Oc?dm@-qS<@vuun6&>yq<$OJZGbuG;|3u<HO(F+F5kmVnWl=T^d89l{u
z<l#ObhYZ3&IrX1nlqFT^AncILh*Pq$10ivOtt3j2l7b+Dqy>W5g!YNd$lySZYPeuP
zk_YE$5#lGVniPCDXUv=}DbQs0YmQAV7~o6ML42jl5Yvskx>z_B`dE%@xTJ<Cm1_*%
zK-ejna#K`7FyvTR6yQ`jG?pfBC+}p+;~JuDxd{Fm^V{@jSV?Iqaw9Q;0On&-DKCM#
z<yi93O$xe1D2d2eFE2(oa|3G=43pTOi!)@Ls*Rm<nIxK4+COt_Rktal7B7o9eVO%_
zGQ)>kThF?sjH4@y7UB9o6KJl|#h0<xvMhd}kC`IYi&L|${$HGZbBu3Iv+mf~W81cE
z+qTU;*kjwa?fH$(J+`&S#vXg_d|$rg+>?9q=H&kKtm<0Tot2gDq`SJFs+k-@rK<3$
zzdgc8^M-D*i#l-;Vxyy~XUkJA&CJ?$T$xcP!Q#?nsf*OwMSx8!&^rpvJR|mZt)E5;
z?s{m$SQMfcPXSP=iLqi2X~{;^3mp&Q;UO=V5m`K=t8}s-Z*T*={jDEpv>}*m%sBe{
z{QxV<u*-5P$UiAu23!`2jdic3UoCXV{eR;hzC3JOu12<+(=vC8G@hFN-{rv0_`h5Z
zj2uk=Jwef0ELnTP;oAocKVp3HB`hISytG=3=Sf(uRK5UVS;>jG7^t$zr=Q_{jPGC(
zGmVYaQlCvkxXp?cD@9BTu6+*Yr~o{6GosHcW*{FE%X-<$=nj7HBA`Y<sGUTLH8kJe
z{POzi@p<KI?(^<%>*zB%i(7rQf_KB;yM=R5osYNP&k8!f_m8@`oez}O@A~NbKX*Rf
z48E>+zG^<cvwgiCJA5AJ;WP`p?<)9x9w}wZb{ABttND4pPwX4`Mk_9o@#3NvoT*S6
zPX;!G*$sT>eUs}u93(1+a_>{M7n&tnEoTxzDX@>njS40UXnmkSYoZwc6Mj2P`}OoX
zZ}~eYf}Qwqx_BO{y-eG9;X;0()Zpedt(w1^pBr%4o9OlSW*H#h^XvVJ=OA>M|MM^)
z>S~eU{_*d_UvD57AaEchAZQ>bAVVNCAS56+pqB-L_0cbnUvGbVn^-bBv#_mLc54m?
zd8jDZ2jAD}KaiqZV*!1+V?*$u6=CLsL$&6FHs5?-4Avp=qP!9nm($5PPj$TKorQ|)
z-rw{0<FoxmA%K++5n+kD#}A?S=}Eh{a7E;ozgR}UzD}JK_nuQ-UwOu>@n)C+*Ku>$
zzN~_315)nx{*QSYQ^j(^O-<*Byrh3q6bg{t#pP|rSNpSzj2^+HQx5C=`z~L4`M9&c
zga*#&XVu3cfT=DApOfZ`^>}mrrPdX}c?!tn)co`XWa#t>pyW255G|qhH9mfMz8?nQ
zG5Lc#)@3mJr<Zs0mxCr^DxVX}YcBtNlYplqbE?uX6heWr-x28G0t@gsPar<P+&_J?
zp~R{^E6+rsC3f8xo9|&TTVYMJT<z{bdja;WE%9qV_;~$;?;nlLlT<z0-UI_;R3vX}
z__r2!g}GPP#n(r&RTZNV1?7~qAbGxAhY|eMTe*wm?*!TLN|?Kx;6%2kr9^@1T_h)F
z@vl>FVO`jF=i%oEBRyf(9C_MmP@XW>tFx>4>qtkc%L%fLm9U?WV90z8^|{djzvZ~&
zNn<|Skax9L(`0(;;!X}|BO4mRz1F?sks#SlqguLY1^{ggY0(A*S`eJPe}_mqP|~fE
zBH6WW^{{G(ecBInLJNbCg2pCEItzr6IWBEWN8WScR`z;ynSFi!nB$wSmR%$s(v(;s
znm&b)KqX-bEbZH8C(CtEd#=`l*Wa%7EZSZ4zM-!;ygQT0Jam@^FteYV#zV`X6p1?K
zKKD>O4&(Ib-qLlu3zEc``>d+R&P@~(OZGHix?d`X+Bg}okBp$~V>bcEW=!!^!n`uG
zYqE&k4jCr}$TRCU=!st%;&MCD2PI2holJECW0AxLFqBpnP~cagQd3aXKGUP0(j8YK
zGHQxyyT-#M3|Cf=FwakmY^UsL@1@C1oBc`PoNEwEbDbr^`|0BHhb8W*xGnM7?AR9N
z_|{OA3VO4U;nRYX43U^)U9((4_$29v!x}w8HKxSKNP1Y9xq7)E9}k5zCcFXeF3}hT
zde#qjuQ=G2C~tktw-HSm)P8!95pp_jM@?}y#gKF11Mc2i^1<z^hTk`-m-R9j-+x_i
z7z(6>$Q5P^hPKzw_4jX7GXCxd9%Egpcju|shrb0jNFd0L$qd4e&OW&%7Y+io4V%vo
z1q)~7E^J|cL2vbYw<c6_q7<EKS+_Axwf54=ZeaxkSZ<!y1XjLN{`l@%SU^1Tza6g|
z<c>4E-%kqeSbXWeO{lzt<Yi<1e!IxC@$;naz1e30_09Wm`A(g7h~evME_mJKSNm~T
z@m@K!VWAJWKV{)_D(1i~Lx!E8KoC&v$AQ+*<)p<Gs0O`kf*yBMc8P9b>zdtMsI1+n
zvuK|-{zx?3JXZGkYn<yJ6MBrXaD^HpO8qNn7oN2vY>7pii_eT5=@c4n@pq_)n8~%(
z>TgJ9pjCdpU`R%dId9D@{t|^eOo;lIbgI8NeL!b&gF=NRYRP4Rz332vR9oExhec;N
zplwY4{|p3uK$EGSKMPOjmnhNaiH!3>md!9F!YDzNvA+5s%G<Ri?!`0pK&e%sP9#IH
z6%{ECCLd3c2=Ueeu!HV@(2)4edK4r3vrLs&{c$-Bo=zyE0IyLI17(q`hkU81PXCF8
zH6$u?W>)euklrTDdU#n?_0Ueq&6_%N`$0}=&_iVrb6QO9wz6CgRgNFSZ4x#>??6te
z^%pg^yOIr1FBNw9aiP*V+cr9ykIrJ=HXAcNn7o$`tJ<^}OFNEB?i*S_1r51mRs^sQ
zEd-CG<Te-Yp)PKY_w1?Ez)3N%J8`5N%CFiSU7p#Ou^Xh^qlol1x>KnFnjvrcX;O!%
zCdbjJy~mbkwaY+PwN6J~42=D#JtK`_fOCn<U+vi2(zY|R%d^{3kF$-v&@{k?&Th?Y
zJI63+2U#90PnQ*EnX@@Xq~ItA+0ssOGmJ}SnL8!n3@A;9Z5}@U`k;*K{eiv{KxcTB
zj08QZ*s^wR7<9y#<z!mFuR_KhzZ4m?#<)2k3?Hf@|7W<fY8^{TecX*5xm}S>;oo{v
z6d^|+OK~GH=Ngm33ccC!;4zdvo$+Sg7ad{e1T`=2(YluGbARWu4hPz&5$AsfKcES-
zaed43^-#DTe#~wb9hDVu9K%_JX*m;_SE~G~=s?&JN%Wk;d|1#8BA&`kzk^4}My@$@
zQx{^Wi~Ir6C3v$OtIt&P`oU-xwPlL0U7?Uak<eH;q1F;8UnxIAh$OIARqtXbHa!OZ
z84&+KOYB`D@DwttnDwKY&+Ay`tK;P42Q+B!$vOMc3S?SN+!kfTW0VWe>VOex(p&ll
zP%mof^|Gl3Py!Ic-lM61+%QB^<Ff6P55!P!{v-TCs*K<J9*J6@2&Uo%0$b8A5Q4d+
zYzZI0)h^L@f_WDNC7rW3iBRC~>=<na$HHa1#eI(h0@;{q$NBZT+Nb^(9)5GS@1Fs2
zn@^-$xYp_`Fwzy0|B<0wTcN56DHacIzpl8Djt4W<Ak%5RpYfBNGiQo<E)@?B#fUr0
ztZ-dyu4FlgF>i`l>8VMJeBGISLNtBaoU43vFFc}!HZ~plUqS~%Y`W#!UU<fl2HKZ9
zx<r23M!Zw{TwNzONKQeK@MaZ>J=8&{;6DNE%>EY3wWr&V=$5*~Wbv;c`06SWa^V|r
z_V_pX=%CPg5pou!zaV&mf?x0hpwqgLPUCfmh!<=-H+}GkoBs&!vq#XCDF~}S=$3t;
z>kvV%&z66Pa0kZX_jfQ4pN&mAO+aTp8e&@UFx9SP=Nl^|%i2pmAe{42{C3)OZ2YzA
zfT6`N-<k<G;GQ>jYt%ai7UE3|v<MHWn+B?p_;DJbYz*wbf<`fq#aUzjelh~hcx6mE
zXRCX#t4G#|Z&)J}34InD)6pl^3|7fQ`CI+_`hth4&xIw#{fRQ;D6|p>GyUC?Qv5<0
z-n|(agZGan?y>k@2b{$kMI+mi>^e?#4)>_?FY6X3zXVy0eoDug@zA)VD%kKq*XCDO
zq-b(?Sb~EG;`EH>6<(y{C`0pGue5R5b%wx<hy^i56wgj5bMi}!{z=j9YM=kevO_Q5
z_V4P?``?c?127h(*6)7v&PbE8YyawZF2=}W)ea>->V{u}w@-~3EM|CJAd<jW5r(d;
zaa|(@qnX*)cm8tdo=%%wp3jcEgwZQlb47q%t1l#tnvoBOC=x<!z07BJg5?Y;hDp_~
zBvI=DA5mUrQFR5SEh)@5-p7`5@-QGWQN;X*Nm;G!9OTJPn?DIbuPQ{`ct!(1CDhVR
ze7#xs+v}xA#edpv3EzP!no8fO`>6V~QZ3RR9h_Lk4t&WEC)!R3VU@is6y{bhZ&K{z
z<!HBMtT`gdwr`AAZO?eu5%eqCBZXP6E>8Or&8kRB!ko%vCauDq1lvwnaaCNJ<qiQs
z=6u(SBbiHWAF)teFR;hI1b?Q6Bk6HDD?;U5?x5zwe16-P#i<d6Wo;Y1x6-Etg~b!k
zn#HOW<zGq^&+nMtf5}P=HaizXvg?;aqS=>2vc5F$Mil0I_7voM<`m}h#uVn`_TO#m
zf6LWZ@h<cLY98RTqJuMgA6@yfDcnxxSnqs)?*bk5b8wMRA^#3C>yvab$XFw}`YYyf
ztXK*fi?EdF)a^nvPWha~i47}viVC6o7yrXVH8DCZ6QfV9-3gq%a1&Jy$4+}hT)=0^
zx5tan4}$1xVRZDmXE4%seYBU?5$X*X1D(Ktpck@SJk8;2mj82fe<RL&6@69=T&HA4
zkFPz$6$k5a9lO*3wWr(cekn%CeGL=kg@PlL(mxq+=MuDtXDVgCJ&WvxoC-T&Pibuv
z6@P=#{2Q&T&K~J_0zKomK(`n&%si+Y<tX?q1<)U5ET9*Nalam`8YAN$OBF`kDc3RL
zKlnh2d{tfa8eh*IVcKo$BHkA^s@7rD<sz-KW?EMirV~T+2vt_pAva~b=I5o0*HiP_
znrCG>x6eUAT-6%F9|M|@qWhwYJgec0z=Pa(i<d=AtZq1ls1V<9XSSYWT|<UTl(g(E
zibi0zNbE!j(MBtt(^!Yl>Skt0e0y{<fYX6ifjmz6Tc)uF=JI{s1umat1W15S2r!x|
zJMQ1|vHV90F+>EUG2Hn)B!C#+ez+kKO`nATbs)&R*w;j+&5#W|Zk2y#xk33gRqQjA
zc^z$&SPvYJR^W@g<sTBkTou)6w6^|2_`+BHDVfO{Q_hQ>wHVV(kEUk|-uaj8^CEIi
zqe_FQFq7@Wm(zr&`odny^i=)X{Zd~Ca6BWC=CGr-R)El^eZl!D{v6%1R5B9cc|ERP
za-SvF&R<sLR^W76d3wQZy3~EG4y>_`i6GEPzbu6+NW98iXy2yxq0|8dPZRoBPpj)2
zGFk6F#!0!-+Ni6!E`zdI@CW^r%6e#?J8Y4(n01j}kjU_Ip{S7nree(Yl4-l^2oOLz
z0*0t<allGb+1Qw+A-=sON=I#6icmPFE9F9=s(b8$<XY~?5j4Ki=I=?st+t|MA)S({
zFNBZQgQ~~HW|R2?1h^0+1H@hy<|c$N1jc^E6HO+ujn+U455pHCz`ErGtUPu}#jT&!
zJK%0W8cvrrNt#_?39fi)Aiy^G0f8QVbPqhLxe%IS1&?rZcoK6oNa%N$pdlahV$Jm3
z1sHE;Uq@TkE@7p~GJ9${tOd#0^HgMgWiLM;W2c27-<X>bEZR@C)citBB>;>Q#vf_d
zaPP<<y0Efk(fm}=`7tIf9M92AiowDZJ_U#597S==^+6?xLS^-YoMHsUQ%hYBT9+-B
z{bBLW`UW$TOYQe!%T!BE4#uXRQT0lk!vpnBkEZoE;>%3GbHpPDn66M5ERt!#U(lck
zk2uRiGc|ussSBEt6+Z|HFRF8#Bu2q$hpw1)hKRXhkTw0S9RVPV$^=v+S9FkdlwM|P
zKXLykr7S!l1RbW@0=q4=ru1miHU+mXDlb_wAkVSspYfO+WVAE2<P$cmAk_^j)N*fV
zF4<MVw8O-93=r#!rtB-b0=;S>^-+z$M^U1QW=RZ(lv|>CEEkhCJ4Bc-lTg&ya|VWF
zYc>HsW@3W726Pq9XH=YZxa(2cqBF}t7TJdi=#v9vs6%t~JMG_F<XV>@uoF}|R0(_8
zNYTT=Q@V09afLbq3eJ`}Y|Wr}(&OsAFGa1wXUR}YKk-3PZR`-~yx3Ta7>)4w`8+iW
zV1~wxoP|8IT4IpY#fcc>e-6{)T8f@=o-!;Gj^AT@B$bjZ8LAt&`rx5zLN(A-$Q41h
zW0Oh#Wu1+$z*#abw~{1Y8Gt4r@gnH_y$o(l%bXR;<-BE)+sCT~hI*1R#4uuni9m}v
zF+3hxjcyKfp<L7fvbcsBabF&S#GggiFkPrLvTwTA<!$aieWch}R4=ElQqbg0m!3XV
zrH%{}!H#9DdPb7Zb-_mc<gDw|c%hm0n<aKFaSPh8-&0btiLA3#5HKBUg13IAIWkf8
z(==Hduk9_LxFdsGei{a_eCDy1lVn2E5vFr625&uV$~k{AX0}W%Us;tu^9eXXSDt`E
zG|(LqR9+mja~N8iVK{7+Xs;SRd5WO<S-q6wo9N$R)j!zayn0X)TY+wA=iAy?d7=;M
zX$^gm%myrCqhmh>!B-jNW;Iz8QsA;Yj+)&`;+<N`VDk5*<3gLHn)~m`!C}koq8?tO
zI$e4xTDHoe#&Co(**#_xMpobwEo^-({<hm(rz+$qy8&DBGEZ{kqNILuCua%~6<}*L
zK%36PD8U(1%?pcVq63F4pySpDPtW8s4osqb+ltg0+!#HIOlO2vf-cM1;t*5C&cxMZ
z5r)znkHo0~43J#Z*HItYI*v@MPSWP|q&YjV)WxW7duXj&w96>A$pjXLAS+%ak*MPK
zXu9o{;ThFLb)nl&1P{(xZ4QmrW8PckHmuKWOCb`y6)MV!?Fd+ByP1d;rJJ<Q@@d^u
zY{P@zy@G4=@b?s?Rf)|ywk%?3RL7H}FXid%o6R4@a{~pgMN3liebViQt6r);-Q9zc
zA8CL)cMQ#;Ra2~jL}*=`V?mNy-__??ZU*+>J&2IeO(_?X$ioj?xDqV3^apf$-(5Mj
z`IV;|#Ub+BHtkdEN0Bz*{T&*RLNSKnOVze1u@s}1Nha=+JmH$pC(Bma&^NP9BM49c
ztliGbnt<2@OWNz)t@@+VBvxh{TZ!`t({F44%HD4sF<&y3Ii_r73%#pB;c78dXuW#e
z<zKF^Uo@SAcemGhPtU?uQ|u1O>^Q}RKlT(Ysq)HfA@R^#N<X6fsq|b>ufp3E4PR$<
zfW(oOWB`eD3CvzoR72jz&)1@u-5P*J609lm=mwN#uo?7bSDjXfZ`Egx4r8>L7&7Kt
zZ55I&H<cJ*Id7h7D+NZQp`;6kiTJbgh%LUeL1*MO5j4ckU1<clB7p{69^G}UlJdpW
zdgVJwLgTniE;(1mHC<6sQqGQZ?;sH^)*fbh=f0-PSi{BH4U^5X)|A_G5glJi(z&*a
z)+B{Qt9g%EIAUuX`Pktm0%8aG;u3pPr(UDOU5Ssz4qVe+Xj52NDksQWL;V$3jlzXC
zU6qS=-s*yua#=Nh1#D29(@)X|HUqu6=1DFe=Ng?j7@oM~p6NbG<Yg7{JOF8q&`~tM
zO$(W|&tbxxg;hS}8C8+OrM12cZ)`L_z@n5`4$DWoX7%^nmxOrUvWW2SvS|M9BqpkF
zwYn?DfV1@JL_LpA2)BfM-rR6D;c+&9QP@ET>EZ8F79OTpi@0q5QM8)Dm`g67RG9J1
zhKs@GF8CF5+^qRm;>_j343h&4Iz4C3h(SrhWPSRAr`%PHxxS`>d%7kDZ94X1-jYXv
z3nU7$+xTS^B{?Z)MmI5cX*6&>&hNt1Cen=gx7+Gqld;F#ZH$^!{lc8vH{z`NFj;6{
zq^h42iPu>C%P=syM?0mcy}vapFy**>k=oIfUK0*6<aj5frmTDu;B7KprSGFoNK0rX
zN)3htD^@a9K8Pvm<4}xSbp3wd!Rqqy+KUnSo9L})Um`k#m$R3=1!3xrH}kwluv5IF
zyg=cTmrCS2A^(ArCO3*ZG4r95$pFczfxgdvRG4BDQ}CXcPFP-s4LzRpyJXUp-``UH
zs&V-)VbcCp3SCfk;J1)zeM<7SgKAry%~Lq7hBLGFRoc3=>`mHf^~{Lmz1SH8amNBu
z51%u?N0PZMt~KfO#7>OyW48~eWzL2<2<Tk!=^hJwwPpYdoD=SMFo<laxwL?KQ}fUl
z<d1sodSPJ%Lc=CEPEg<|y&>LxpeX3!b)VJ})vAh`d5K$q_F>6$LU|2D*ZX<uY>hj<
zl`x2UT)qXN;a@!EzQ<%adihetVyZjc_c<&GO*{>^jf9z6{8;(1>oYiw-6vU3x9kHJ
zD8}|x641QvzX{a@zTVR3h={!;K;D9m2VXjqinP67l~U#2AiKGOZ4^JQpo9N^#7}`d
z!PTF6(FK^iq1KX!RV+5vy#Niu&Pzw;aE7&g$FYm5r+g^%HdfJ{$NWBmG&}i+w`McY
z*c#l|DGT?YzUC;=<s5}Zd#OY#zws85+Q)`yI^rM)QLMo17WD>(uZ5rcz?Jo)cb?ZN
zK>1(DS=r^<nbt!zhEJ;TeqD0%eQuvS{sJ~Z+(IWBSI!-K_e<2`ONQuWcJkMkicM;K
z>`R)h%$FOvr8P=`2IUnzN7%ZVa#EG8#Go>GdETYBOXX3;7qw8OI(g<{A)MY9k2p2A
zox0xp=^38l<T!TBLBox8z<B*-=KA{nd#*r|b6E1r?l?YB{jt~hv_PWuhGV(<CuIY|
z#8hkMr9orP^Y>Pk#$B#3Tdu4&%Xd_Z|JpWtS#HH_y|MLlmB7M>|K9f|UQR)v$YKcZ
zp*hZB=i75oJHXVeo`T+i{u4c@IyUwdgspD&y?FoA^wDnV%`NC+rU%w>-Xei}D)sZP
z?L$GBDn)bf+KSd0EWbf79-H;?y(bT~{0CT=oY%JRYxP3b2lk;Y9*Wt{$jHeI<qz$Z
zri@gzkd~O~PO0RS61%y<j^4~zNwbArqWPZ+rSF{#a~3Cz?5Fr|+ADG`L0cn<aU6$8
zf*;1(Q-ZqNTz<vsD9cm{Xe=>X&%#@{`(>9mUq-o|Ei0(xg^oqlcaGF_=u7gz%?>wd
z&xz)3#t%!_bvov~r#wf<f_v`%gB&Wj^)Kd{G5Z}+o&rBiHoV|1KE5tSPPtS=rGz-P
zcl4sE1V%Q(ky<QTg1|2#S7z`~d16qCZU|PV3m2&jL#{tXMZAYk&Pj~DIh;L~iDSxs
z-*I_q&iJhoTf7h_sk`7<z<N7bM?7OdEQ2GDj|o@GQJLU|dZxKY+NCz!yPTWnq@<2%
z9TzCBNbmYZ+oMB`FvikX;6RkePGY~Dgq>zxACL0m&MX>bT=Tc;$=~chyr-pF5wJwM
zT|q5HwofKBuW~BXk|*3t;C;D{ogH(=nh}sc1{3j;Ip}~n;&L?*gLi?EK2N>)6>1^%
zejGdCe<4Pv7?AuA*L=+XyK6o+HZIoxcFm`^6?@o{&?BJGe-55mYy1HU3c6sY5FbSw
z{{Zv`w7=Tj?+W6b^kjfamLrlw((X4hW()-2+ftUIMUNULerXV07N7HjL8biZ*5)>X
zjk$ZcuyC5DGN@iM*(+3TY{Fnkez?+`{rM&^z9Zk8&CNz!+%(ZiHm2t?ct$=3FZ20i
z;77SITqls%^8%WZ_w{r?754S=lGpoL(&ha$m52ZNtQT;5+4{7@mz|guiH3T*_Tl<^
zcRIs>R;lLh5+qgL<sx(sFf_GGsO|`$pO@pnfR?I6C7rLFBaQ@82h38!@kgkuEsei-
zk`>WNABVmZy9-Q`sV%_ZZ^FQ86adlTst;oV2*u6Zjl6~0TQz;WxR=yRzf}GlzAE3m
z#g#em6QV8N{w+h1e+&dKk&c%Vq9MqWzXl5Lp(FV6x{VCg+EL{H)Z7LR2a*K+k^Y4Z
zBrv%G1q9Z24V->#fk4PTcjx3sFS7nt{Lt0&)kcvkg0_qr<dmvl`Fo%LPSfMvZw-}2
zz3&J0c79+|i!fM7yIM#-$Ldm)=I70K=&CjKdNJj~z-SG7L0=)J1KJH*wBIV5oLae|
zzV@B9?BQwgG}<Px3`q@b%`bi|j}S-85+;pBb=hWOZ7XCoT;fPBRom3luBA{^CH@@T
zHe#%1;l3rU!3jZ<T5J%``DQhvE_pn~F_Q=KqGfSprg_XN4xJJ+z<BxjQ=wW?0HF$5
zSsi{N%nmu)LRImpsC^>!tDG{KCWTsTO>sv8t7Xn2BRd%TQC4xOQ_7+ni3Vhc)LHm>
z@%AqostG&gPU@;K2PoW2b}Oj5BymNxLd_K#5CAo1pBX9l;<hydsjd1LoktFCOl9j*
z7JN6m(=1v7fO_BUYN}XRr}tESfzU)OI=!=0&3V8*CmVZ*oT4-mXY7IfMg1z;j^-zM
zul%$$&X`_nBJ6;hGf|fuePc!^<_;-hyIgHsM&~w69Wu@sUL`~g3eG0wG`5<y3MTb-
zF>0q&MFJIFF^DPRm1acoFYXK(H<`J)Kx!g%6`8c`VpF84s0a;qNa_=)rQeJT&Z=j%
z$arj>JGU>q-vvTtjw5HO#TJDB(D6iU_ow#e)P_a7aL|VEv9Uc3y)iWUjb;5%1V?Mq
zug7joEmHw4vW{uXx31#y?Yn(h6s!<N)~W<iaxD~d8}Em5f@gh{?>>BcxnI3|KXhFg
z^_j|sQCCber2YAkI9ro)3NAvc6P-)Yd&qfs8mw6Si(g3S#4kVUW&xU}5R}QVg7KsI
zg1G`f`zz$0WL4U%CA4@9tg4)qJtZ&&Go`=c7rz?Y4TNop7bAzrwZrvsJhSa#0vBX?
z=fpsj)3?VVxKz7Ao8Rmc-m|5|Z}Z^8weZY8c+Y}7p|0$wQE+I<k~qv+r?c(Ed)w5@
z=^`Z3h@6IO8@szze~Fr#b!-d8aO_ZAR(75|mtokp1w3ytaqAC2b~BRWqmZ|-E$n;S
z@bhVLN)B0djix0yvopQw@FbzT*lO~lQ_|(a7`2w5iB`ibc5tjD*$2DC`9lNQKudjG
z)~`Hy{VXKd*MWgMyQ=Nxgw_GK#uh!KmSLYw(|6a%Nb7Gp8@_%`KxMKktI)SI&o=6<
zZHxm?4BQTEoFuM15@fDil1xphkPquWT?U5v9G?`FxST<Li&c_j$l(T5RLraKn@i6X
zI-*$}t@{8^{z?sNZ2s6%woQ9>l1Z)hh6X31)z)#3VywVi%P}7Qsc;d4%x`}y*U2tu
zw<l)vRCCasn#E|+6e9LyllAW}U{uG(w8(O+&mPniLlVzg7mroUHW@ZfD5x=AHRb`V
zPp_K&$wr{6&nQU2HDaBb6KDUWj^w2EH@)PCzEs2T&s)jXY!(4Q3Uhk>fWZukI`UAi
zTE4qKdQ>fBzMBWx2>3YQ*ywe*5c4HPm8B5PM-3FisY7uV)7*~J_|<?vK-BtWpJhL#
zk7_bnLPAyvgLR>uCfv{Z5*v<5J&a|$!^n|;NBmNa#C2}n#^}s)nT;GK4z3+<=yyNM
zr5I^pOvQ~fG=m^JOcbGAxlvV&A+)C}(@P^}V9tKHN`h;(?KD_7e0Lq+wE>l&hXS;V
z#tIAMAuEI%S~XKY#A50o3)naLa&M6lLM;&idB2h#aN;3jOv>8ZA2;ZJxoB)`%8gtg
zd~h6W(Qoam<t8ciOfNo(b)-K3rT!S2S%&+ry5n{gr*TT*+hLync2Vcz*Cj3RH;D~&
z&B8C|ZC~v*f}jrThX3t+lb~*1;oWk||8dRW_|qfBcW-4GZv8(mX2iQT7i>#3o-QLz
zI(IpX(>3*-o@?OjNj<vu7@fMZaMqhpk}svEN&r)Xun~97mE*U^+O+`9uSP)h2lOsj
ze@iG^H%Z}ZG~<J(J=z2s_;Dm*H#Z|vb+&`CC}fUe33o{-4Eq3<oA4MKNo;-~9W3LZ
zyreI1c4-#ND$5oEp$Y}<&Ah7%L~4A6crCbNZH6P6bvz@ab0j!WYB-7p2#g$1DK)s@
z?Mb24s9H6Q_W>-aat)j0Z<4>Psi>4fyQ$B^8sIvX#GlfZK3b9iv^a&4YOpR;AX;Oy
z-aLmxfxiKgNs*X%6OzALJ@YYyYKLm#q*|Z#4Wq!w!k4t=`TJ$%0(tC>#COw8*=`+a
zbg~gP_xkAm8Qh&<o7R~rZ(!OTE6j5l`@{8`|42{KuYwb)%fs!1=>8CgA3WgPLr>ln
zUJVEX@5Yp}fD5WtyQO;ZH@$~qzz;M7D;J->r4JVmwe(Cv2!<<QM%G-aNjg@{NN}C@
zB#bR!Ch?4A$CCP&f-`s=?to0yoHR$oOuW$cs3&+ly4a<BQV{pMeOq&r_HE;Vkb)I1
zQ$8t~DQqS_&h>3P{XK*gOiIEZ>(u4BAhRFj0W}@2wqu2AX_PQp-+TMPVi53&r?Te^
z{4GuX98~Yeu^FYt*IxQr=$JO=P})Ldb(J%v^z?vVP??rE5@Lv_ijizJXW6^VdrM3d
zQ&Qqp@i6_t;lGP!f?G5V{L8S{B`G(YrnvaLNH0t`6$hpH)xSv*<awa(+=gZU41B9n
zw0cR$y4^zN67dL<s#V}WZy+m<%Bp<`Yio>0_)u+Ymg*@Z5<IdbH!Cd~A{~7xdB`wk
zoE+jTkxDZOIuH!3V~Syc7OO$dAJVj;H^S$@y^NdIErv**hY}^ze;UgtdcKOsWYIor
zLo7%(#SaiJc@fHC;{#*B)DZGTirbvutdya&s}raDR}HcEG*V&@y>~GBmqU4_L_>}5
zws;L6af43=D+n=$XSS)h8zvg5Sk|<{HJ4LP)<7LVRx(Ysa%k4|d^xGJE+*zRX0m9t
zPsl`+>X#mmzmz;c6oJli0>%6@@Ck~zBy4L>HZTpm=uIt9X<YC%@8kN&4*Brui&eHP
z2Sh?}Q6th<s`ncPvN~>Ch}V!2&qwT~Sgx~4Ow|#^B)EpMithng!5x4ve$O>U6H){u
zHWDp|B!@$O@x|x^E=n`f91?5sy&p;}@oC|i39hl_SP_jGZ^%k4iPK1Ipia@{SYxdN
z2E^YsT!rR@^xxgBBFnL;j=zmLB^INLsS3$Cidc$RtD?(+8*-gL)hA!YHIx_YVT^WE
zAj*%rWL*p>kMX%d+xKN#nI2#c_^u$@y$IZX$=xJ%E;FvQmn!m&f}OO}CA)mxOwaRJ
z#V*V)Bnp|XLqYhLwZ~O0^+b?Ro5jenbjxjn0;!P&jxE8cD}=)~7s(stk_3P120FL)
z)5$}ExDhJ;Gjtj_M;y@~PDn_h=>KgdKW=67eDM@(fsVkGLSTt*AeMI=EmPZz=c)>z
zoNWpBf{0f?08f3b>;o^uy+uM-@E~hMnY`Z454mwY{L|L;F=5rve@O9^#vZ>()h6D<
zdwGvMCe&`*h3`LC?8-%4lta%&;Mfn0f%}ip1w?<M<FYvbjs?>Ij6vDQrkmf6cgCh0
zFNDJ37{J~k2H{+{2v6+L4=(+vHVD4j`Zd+Fy91A*>&*Wr5R{(tA7M2Jwp7pXZZMEn
zj<+<13gC<{ow!5iu`GIZVJNzAm9J6{B(2`_pkf|9e*=4TT00%@qC5eb@&<|U;hK54
z5PE9<T5i-aJ%h!a&bTFhKK3f-JH)s-^gcY~8nv0{qh=W3h>tnRo#zQF6!=BnCdm5q
z!4|=E4$8oJ6Zp@-*X3XBXWA<c_q(Fyo%}NzQ&AEv_H#WN(=jO0^X3wZ(QsU=BgPV#
zMFW6|h>0bI;@nrLW*SI>n<OS6CC<ljcCna0&NX;wiB`66k4wrBb)ZBt|D^0VbfNUB
zp08Y_wZjbz@O7hzb~HpAo5o0KW=Fb^l=lr55?WP&Pk=dEtYL56M78<oLbPMUR!A~>
zRFCOn<d8Y(Q@oC5U-QGCZe_DDEmGdXVG|o?--9RSNIQu`V`eo@ngbTWWgPkk_{GKu
zMxsiFL?=qu%_M0Rz?RljBdKb$8ExP%W$QE!ZG7;Vv45RSwf*BQS;;hm<@;d4x02^f
zz1DIvBg=O!klXX(-)?Nc|LHnFf2sHRpW_i2P&zPa5D}{XHLyRBGpt0yOXkr}Q{QW&
zj$_1~)HpvrpD(9=Y|<`k!DeJncIjf`+4@T4q3Ykf8V8<Y_KjXm<ZSF{T=9MceEdM+
z_NVvS3Z$O8aPx-b#sD_37!9mV@+yw=in-EUh}*PtD!Wk?1r2VeC>TlRMUK|>z+1s%
zjf`oCvewrA9P(%H7QxBomgP{xgL1*w=>|HE6Emu1=fJsO3|J$t0B&}z?k(XK9pyJZ
z9pq{B+s|=f?Wl3QcueVe#62tPXX+B$JFg~n<d)UhaludH8rPW38D9;GoxoEIIKf-2
z8o-0tEca1^5)x{OP_AByOIykTX%n*;&C)Q%;pUIg=dO1!M9nQ8h;`>tW2o__Sb7Ei
zxVkO9?Xjz0Pu<Y`A4b&Y@=Vzz3SE2Z$yB@c>FCgf5y__<@((=7^Z@5DutWKJ)+r|6
ztg723?bW@eKX)%%#>U|4qMV3{#8m$}yi)A995GZh(TUHPEbxS`v`LeS`ZWmTUQU)W
z4KVYc_~@_y5or}D5uL`X5PW$y@r3k;66D6YO#BV}$JdY*hn1IByo)4F{g8j(O!wfG
zaf01D#ui0#q3v+f{MT8M3+_VGi=$`mDa#wZ^1N{=zzOa?TJuT`-X%rEES1LWcVW?c
z?B%WTED{~ZJh^v?5U5&`^NNl;JzPfbR(Y#u4!jPTf+ZqV0<4*+vSjy>V9&L99^@s}
zvkdK9>OvO0_kH<}9C{9Z@{R#*zEApR3DUz{oi1&Ojxrqj3f(c*xnXr+W6OGm1c8)a
zdUcD=hB4rop#i&?mvxry2HuzPTx&Oq_9%3!24jd^Q7>!w4}^gkolf<(EyF4zyr$<s
z3nz1ScY#6e!W_Wcf28{}+j-xcT)=xUMQ8nT+~AKhtu?G%nhR5<=j(C|TV3xLUW}xu
zvlZyu0E;PWivqi-DEP#E>&C2PTMJQ11)}Y%nRxS2lO|GtT0U5*5-1Ho7ep(%JmFaU
z=?4Sl1$q%jmSXNZ<2vG$TGu`IM0LlSsm2!R5xz}x%~gDlUw{?ku`zZ`=^VbfpBcv8
z+vR)i7-&1j+2+>R+k>N_Q|S#q&fq=92{YZ**U^(!Xu<Gci4)y)>rStqIAJ4q3><Ij
z5n-D17%%Zj&qi3a$!F(1s7u{fCp+GKD4VXymTM}zvpu)XKyT}5z9xP#G7*Ozg^8~I
zg2(q9Z-1y?)~`vk-=G(id2(i99CpX*%c+5&S5L3S$^{TtHdu2yuob#Ne#zD<%e_7S
zna{4x9A8tIoHE9Wx~H{OhL|kcpnZ1k4hIl=+6Fo6&riiKUi8^oYLGCepJ|N<AM;)_
z_?ikKnklWkId$FdL6waCDGe`1we846-gY896uXWQEsE~-j&qgk!rXfD^WyZmyLlq`
zQr_-<J5oUOd#^QodE9ur#+Tpba65&a=3BSW){Xfj$r(@se)GztGQN?u#VS1n0C?Zq
z2}YA#h-2TSCuz7S1t(3X!Si*A*qL*!C{t-d>}%0KbZG3B=w>FzNWw_6T}!1UYfBoA
znbRgknd5Y?k>T94B7Dp)ROp*IqIJ`<e#ciOLTiZ(;>#p02Hx%S+EN@%%#^|D!``u@
zyw34raWXYBO9sPWuB>4n0C8dvLn6Uj``SVBqL0)cA#G4rIUiSS&Z7FLDh-Td9x$KH
z*Jl>AXr6D?i<7jf;gK=<t!rj2AFY47X3~4R_MNFUsRk#bsWe$@>Cphwl7Nuw7u9<T
zA~&Y0HB7ohFfU`DtfKD~4@9-lG83hw=+l|dfULL~VudDz-&m;`ptEU5F)v%q-};wN
zPZHIDA5Y*HFs=T6KO4_PPo<eSUn_E5z^iseax<HeDNrx<Q|eolM%Sy!Tqs;pTj*Tu
ztIWu?v9X<%>87XqQZXQ^%(pgs&!ImIeLkN_VtAS9{kjbEdw-o#_~PVAX6H%1G6Wn1
zn6y)<J$vzru?6L>lSbTUxfslTnBiaLM%o>>gWXMoCUir#jGpZRJaxGNInE23_G7^N
z>g_H`*H-q~hs*81U0RbFQ|t9^-|fj!z$1Q_=q?xsYUBdn-UX$rv=w2EG9qqF?|$g&
zwvOa8{1!Zd#9B@!e0%Bt$POrMhuo=r<&M&DS*HpTq)-`wgg%QOROYls;^$p8X{MO7
zN5a?F3Eq0mfP`+<nw8&mAOEIPJ<+jB*69e>G9hD~H(|}N1nR)9s*KRk+1e}MbZn@d
z6?ejIqpEoX$X$iI3Y;3-7hKI~uhzz1{Y>t#@oZDE;elwk5$_}yXs^T70SWsHo4K1?
z{s!+gqx$nsAIl*0$-$gH5`(Y51*_FvNfqI|l})l?pW1BnW0rD3KT5?Thi7eJ!3?2s
zA?ao{ss751%+|A<O7;yUyEE|^ry~$HqPK5c|8hRhs^Cp56~ireKDDF~!!@^4Z`Ho8
zW7Kk|)?n-IUHom+My)gDMtk%%8dCFUsB`^VTVWjx_2RW>m8EQpX*hSRrv=on^gGDh
z+h^pa0!C@)djDcny~@by{R^@?H(dUI@DQ{9mxuU2RjC>O%M<)R*#9p}TQjpV|6k*H
zWKU(v#NoCg`Cos~c*ugJPiXuFrbVBvU6x0H`Qs6g9RnyP)f{Ue27P%EN)U5bdzxJ^
ziHp84np3$jZ_qbz;;hMGcu>GHThz$(ne0C^mKi&H8N6LEcA3x5c6;b`TF1ah;aEGx
zEPB0ne|gJW96c->wmHw2U#VRWG642K0f1)99b+c#eSJN~tiuX)8`$^!J^S!W%@W{o
z^Y*?w+GVIqQTqAwsg5AE+ID=T3Q9_A@ymX$lz;Mbzl&$L>}g^@E9~&7PQds5>aHv=
zPav+HZp!DYdGl9J3d`B)mT{ItbtQI?ngT(pj)`rLio%z6_0n>xGLVD!tI)1wMywzn
zFubC)loK4L0M-qw#%zCDViFF?Zh;LnG@zIX<jIZHDroNB7mt!P{w5-O1z6;aE}s`y
z>9!*VQ%_|i?IDBLXGCF9b}DS~$a&p}dW1yUd^xP{jRb3H5a}UqkYidItS7wi#)FTi
ztRF1BCTdZDe+p*s?*NclP^_iU*c-@LD9q5P5=6gntZ!$0HC;ML{lsapi*x_QIEiHv
zVKqHeo&1hG@aha=0z@GE8WW^{QAXj|AEK{yG^L*J?E6ntL!g;D&0X$4`bIpqrBI*q
zNxV8Q8qdqqj%2*#5Iw@$F=x1g+K^qR*-PpRf%N6f3rqO<={f{yBflifuY+^e5CuMO
z+)Yc$s+$|ka#aXk-I&kJ8kkN~OV|%JT~*o5?Ub8SNvBJxUFf~b8>?B$EwaVmYzdPX
z54;GH4^Sd#n_rlHE16woD-qMQe?=54-b@#YAoRpfmMNQI+5RPUspZdsQzpFUl8b~f
zn_FBelwC7DJ@a&mJyK=xsPU0%kJ~#=mZP+#KaObu)}dI5RIc}Dk9jDdg)|SoQ`fQR
zMms8G#l*-kP(-!E>VavGRBoJe<|wM?RFKx@t&|m=@|0j2robJ3HADJozM056WioQ%
zDlJtxt-tX@>Pge&5!=?gBP)>)n?ZIOxNc0RnD`_=_|CaT_VftX5tvTXM$mb7n2Rhh
zv@sD49B^n1>kc7nl?&xsCyAM<QoKA%pBTSPl?c!#N%Tsmo$q}SM}_uOR9(0Ml=DPJ
zmdi(OYmd!Le3KQ5V7r{e%(lix%#v1q=;<`gZ6EfG;rJAAd#p%3f-cr8zy+_VGI|?V
z?tjX5hKgLSdzN)hZEY{m9dNhBHdA9v_Oa<{=<*n}gb>Ke;mC&>TKjqiBp6x~J8y!i
zEC5uxm8sG*S96?#>kMsxU9G_N>Up$_Y!z%U&T{Eomo)|;G@@ADVIX_wJAzY|$rcB$
zTT|-8+ybPLXj0J2yZ-+21b2OGJZ(c(_}d{GjEj1eiA)0*;8{O}(nsI0$95Z^U+p@@
zW`EfMob_8dVCwp!?})|S&}E6H{so(-zMW3g*8X1F_9_>`?rI3Z?&=C{otF`Boz^{P
zjjlO4!Ix2|Sfn?tOfD~xVzn~6%-DcjVa*&);d04RAM5~6pL#2zt5p4G(;iMt^99aT
z`4J5f51w!fY<?0Vzd_#xRY2KfF1&08Jfg*Hc3c4#Z2k~!uab`vH->gP2jhwCO3L(h
zuw05aXgXo(9k!N#BVMjj+nQ_<6iZW7yb$Fe?$x_Z^MFawr8%~lCW=o~^t;F!{>*l<
zwnblhBy;sBg0Ta4Kpw_U7N|BZ$ta8O=HA+<swYyhvhESY45i5D&1JL1V2<1E2B>ta
zhxppJPI?TXj9p<=*XZm!^obmFMOXK)><Ze<o;<Y!6N!;vIeym<8`4H79c=&Lxgga6
zz7)%?2srPljf#5-971nh2>l!tURP1wNLn&ed{^|f+3Q2Cg|dSe0QGUkYT6h}%h~{o
zHy~pLh$~D(`iY34Vrir6*-O_W;_*4gxd%D7hHJ>eA;x`8zp*U$I{vbx^Tz4Mk!tSv
zPs`(vcAM^@Y~N8Iz-5^W|3l4knD5qXP74le-aP&mRgU0KX*MD*59La$bIv^FO6ctf
z2~wGMbm1Le^`jD9*ix7JMy5k;ZREm=i?N(Y(x2=>n+5yo-GA69IDBz~^D97tQ^-W9
zq+1Wf*W69;faK$GN+fxFkpmmy+m)I(G>aTN8)})6T4#@H4@%Fa?VTvpdeRf1h*S|%
z!`YDCg6ZJp2Tp{Tc5|h9c14W~9iQ^cpx~TRM`Imj3+$lRgtup>77B{8%H$+CChAf)
zd69V9JqOsG?}qfpreyqoPr;TXWl>89W~J#v{#^HC(2jc1{_{B6my?6=r>57?gpaR3
zeg5(5^?4{%q#V&d3r?hcPU-rBp}_YksQ-e|?-gex?Muwq-BLiW3SPs?<YN&=7t=1f
z)&>Xk*d`@7K*X_N8JW?taI*d4RZFo10_J12Qv;?5O4|8XR!rjuFcRmg52(=EBM#I!
z^Xlfc4IQ{{wV-qLOFmrxQrv0(L(s=DS*!yIgGUUltPiSy1CAE!;Se;E^xIWNYFMEi
zLDX{gi3z3HqxTVZvY5^YmEUi*U<1%0L<-7HU(gC>Bu;MVS|8hNn4<o7d60ti1b-@3
z#O6pg<e(5b_@#l9e%IaHao;Nu>mLJaMJeI+iZe(BMcb&OD+sbttgq>kkR2Mu@KaRC
zww4$blIN&YIx$EUe9`D)vt1<8A=#AH)@?ef1mNO}l;Dmv$2M+_9_2~EpS2)|Lr8OV
zmYSz~k9Up@vCgL`N51TiSD53aB6PJ&xm(#HN>%MIS35g?UESTD5AQF>*9N)UpHEG%
zgPne#N?Ti0*`6B__~kNPo|-@S`6*g^ute%Yv!AhktrPmajGl~^filpb?t6*LJ}7J)
zxEd}yonGbz@qm6=XOpiNlcb;Q3dZG9<#pJ+(vN(Eu*ea#t$RZ+U`|1l%H&k!l5M=x
z#he<K)j4E)QW&3;ue({~z$7~_SD2v#ei^+p_(~nmKS!y8UtOG@lZI`lNI^_PdT}q<
zDh>GY4+K;n1cX|)esTsXFixh^0HHc_;Yk=NwckS{d2xP8&o?;m_54a0j%0gbmO?k$
zE>Oz=9cGt%(Yh}@l{$#&#}Jy<Zs_R-cp7Kk{Q~g!TPZ}yW*?(IB~uQ8?r4WZT1h+Y
zl@6RR!sj81^s;b6oWEPC+_)X@?4f;b<1%>YglbeXNf>)Dg|z)O2JB6Z*eXbf@;2bd
z;jRj{3*wYp?YIB3V9ObgWqEZ-bD)9zf@D{()%+j!ZvRUTJPRuq%YW?wJ+d$LHtb0`
z5`AXs{@j5S?&AyP8})5n;a?2$PS*Or_-|XSz!d{u^nZSRa~V>!N@xL#X<9gj8_G;1
zV}piFiP4;BVrqNKUucwy->gbzFq^^U!e76#eRH5HthIcDoW&9;;e?hZ#~u8#K3@qA
z^A_q<dKa`85Hd85%|D(-N1^{64nXa)+iFls@Hupt<|ilc>-ml0>uqCaJc~o%{bkGV
zQ#b$pd4D5sM=rwjEMm5?N@2mEw6{x{3IjD#jmpC1zS|fZzsecFbXWQ3R|6H+FlwZS
z>Zl{#l`@ya8rno`H*GH&Q!ObT)S-*yS2x@oh_kvbY=RA%68(sB&_I2@vKc#^SHEFg
zK0m*F%J{qASx0K?Zclff@3X(|?D$6+w1r52psEg3C;Gkf7iTxHB7`D{BB&yyAdn(>
ze0rVt%a-%jk%l4A3$&nVZPR$8U61?PhT5k|``76G=Vz)sEx^hT6kH?6_DaR+^mwq=
zAge*e!n1d5#i{yoamBZ{X(=Qqr>54xcA<|q3nBv*x(b`Fm~kUuZ4RZWsC$hM7O<|T
zS!Eg1O-QL4;7>`c3C-Horq=8q%7A%Aw1|O&e*t$zHbORW@W$M3gR`~e{q;fd{AhSA
zMN~#zN><IA%Yd!Q%7B<9XiYDEP9|)9u)!wW`{lGw+ORdnC6Gq4vR8wz;>oGNAL`&B
z=spm0aSKoR#p{*ToK6?AkwV&2j~*z+##C&KxkR!FV|6%!IVUrx=~44_uDW|mP$><@
zjb53Vk~5))j#K2wRcQ}12O}H=qh+`9aBRmpwdW*Esf|xg3H3qdmshHQqCNzK-sdv2
z2ofGK4@FJ*(65d}VJh>Z+FE*#%OV9_j<Ahab_q97uxrusn=IV@c!{qZR>a?U41tc+
zVVqD5uRdo^uf#Y?Kz$p{Kf0cW&_F;@3;es>3BpP%ho*{9Q68fqU|5bX){P&JL_l7-
zrUG^iJX|$V(OS7&`<p6EM`v&Oi(Aw;yV)AFdHE4jTdBOllO7LlKG}iVsru#=>e;E0
znrJ<np0FB(=UCZbX{%sMbysm?f#_oYAf+2PLSImGDhxRxN|n%R@pxY{#KcS?tSwGO
z)fs(QlZe>H8=iSDpV+OXC5sxj%9|U^H{1F6_9heqQz@rUHmW#ka^C*TvHI%t2M0zZ
zj5u67lLKZAHZ|*BVan8Ey2I(eUp+ewxOv9+@B^snp2VrNLDzi5!Hk&qt9&<OZ~(+=
zDZJHn;Prp1Ioy069b)%9hRR6voUZ^_mbLvUaN0pHbm9?z+ylI2E`yMA5u6rk@n$89
zG%syvB=XFZkw^`QUOU{&2OB!d&{jPlvuAAmO>Bm3?0HV^n)=tZB|H5!-ST1aVhxYW
zT0q0TsWd{?lDX578lcSL7l=LSm7)5EwA$smmQKMub&?7RO#*#}NK{Hf+ToK`ncT!A
zIZOwo=%d(q2nj9$5__pUKB`s->wtZ0dxT#RPBKv>F$xx@8$`zl;)}(=Y2|mH3mpF<
z3u_ZC{**pRK~^w2hNlfE8itwl`6df9&d*bGBr~3QI|YZa_V{b2)JHkt_Dyfx!ClbQ
zm(m2Pfkn$nSM?iVG4RR)*izxho<#KBID4;|&Tmj#>SQ4M;#Aa_0tKm{QiOG0{Sj3{
z&}$-)4WeH|u_dtcVhae$Iy0wT;Vu2UePFbwYG!n>-xel@)6N-wrli_6(oGog7G3{6
zk=O8<mL4`MbJ8iXiBZtFwBYRpyV<x|>CUTNpYd>qHf-Ik^A^wp<o&%z7IYXic=GMA
z7T6yn^WO~Zz4~xn@*UZi0qTMG+j={#{D_uF19HXr?08yGdm9d4vC*%-Kg+EBaSFXx
zI}GO;a-$2Wz{;sdG#UPLBIt1q=#aB~Ew^R3d)6JHs<M`0#Y?a9fe&kFCiK;C34k_m
zbq7$_1FHWa-r*463Cv!3ilkDTy{Ih|XPvu9%Vau>s5#q^iMFTCFTZMH0#+})XH%7<
z=w{b~f=yur<N^LC4ZurJ56bh?k!XHLz~|44IlG2*uBk7p#-sl)BSf$Ro_a`n{qFwB
zSz12CTf=zBAYROaenLbDPsZOtLilk1O?3n3Sr6NBmvl8M6QI$2-$g(_6e$z$M`T-J
zYJqNPguXft|9gHE8kCuas-$*F4TimHyU@{5EnJw8jT0Iip$>OlD;QU{t)$tAY_N9f
zIvXoIUm9N!JfyqP15qB^Qfz7!UaYWD=L#@aOw9fexTnd2>5*QTmR*#OsVZ!@wITo_
zkCF)uQHd(QI)8&i$<5`IW(F~l99?aQboj%95$gZ&_MKr(HQn0Ml@3a;f`HV3G?6Z%
z2m%u6AXPxRh|+siX^Ir33T%28L+=O)z4s;{ozNk4z9j0SzVCC+b$)$6vSu<f_dTo3
zOxP=%9e-JB!bT%fTz`J*fCgqlT;so+EU2*;vX&f?51#hA!(AG(hNYP^@Y;tL!?*Ls
zjdBGUqeaCb@|;EHXI@R$$M`U2c*HE264<H+{7X8V5t60bkq$+V&oTOl9@bk41^RpV
z@03y0s@7uQb2yT=>W2pS%Tf_m8uj4#^HINO_(XvFn19Ld&!&(iKemOW5~9*v-obA?
z;)^skk;1J$iCoL_K^XDsw<Q*-itfm_sL*!M;PO07=@e>=F|L0g+`V)lXGYD8qh)+a
z|1$OiN6vdUvaF&O^*ctfQ%{eXuH|#RFBL|}6mMKPt;c=1?Z|#%??r^%32*;5I~8FC
zx}|JfM&*SESXOPM=~_iGF&?49Oa8J<ghxg_c>Yq<yA7X6a6S3|ZX)OsP7ux6iJtu^
zHS(mg2hZa5)@`IC!WRKwW#n_2O1aBIScx5T4^DTm$H{`1*lBpb)p1)IiO)V;b-Q!Q
zy27M({_5!7fOP5^GOdy2{dW`9ozs=dkfXuz_gRMig{fY)E);uo^?c!?uW~7aoF@JD
z-_>osWMWr6db=N>v*i8UoHu^0&8vau!yMBa9p()E{P&`V&VmGb!~Qzd9gRkmxF!4_
z0vmV;&5ij9{%)#9{`}#3kDb<8fX=g~+^p&R$MUD^XV+E`BWDj%MaQD|SXL0yUlGJk
zYIP-=Y3H$7=M#JXv)(^V>1Md?v+TMc>mT;X+~jEP>ytrN$@P}%D8>v4L75MaxHJ>9
z4?R{cK>D^p3~w(`V5l&0Z0V}6LTSAc?tC&Ic!T2$#BqNgzPRo3Rp0fB6@S@vd;>`Y
z!q4c^oz6DseVXmJXM9fW!jym@_927!hG^XPG5j8X4ckKw95CMASU^>syp9S}icm@1
zvD$9a<=(t6AL@W)G6^kFzI;ntLH87OoyD#c4SD#W$km2-JzOtl*e=Y0ofkyyRM~Em
zU%wr-C}*PF9x0U^rrv%+cMKR@EPZ-TOw-1&=<xQTM4y|KvPQpTZey4tQP|Q&)d2D1
zn?5?PX@)iF(y^3MG=!Nhn`X<ttNflds&If4<c_`PdV3Cjy4w^iG2MXr6H0vH@m;!r
z8Qq@t)45&T3zuYYWU%^Xa5XM?;$4t9-#r$YzWi}R$)K(#uYY4kU(0)}XyKN0%(3@_
zjSYKCGu;N(GOdOhgUWC8`*kK>X?w;N>UIY4ED$YP3Z22876CeWu9;S6&#*wr2v-r&
z;1%}uX5BvG2hDGD*oL=mnY!ceHkabYM|0Yjly#Zwwirwq8rMchgAh0uq&m!8>$pWP
zxZ*K0T^MkVvDR4>9Ab~wb8hW!VJEmFnx{VZIQX09;+u!-=b6=`l^a%lLw2AI_%!B4
zc#y?-(O_-y414>fFh2rvD~fRQLP7o5Ynly_CY_fJ#*Tz?Jc?($a2<v9ZS@)So(FvB
zPF7r(kk!z=Nm2HOvS$-#qv`5E8NWfFD}@|Ree<*a%_E!I$Ak{W^oN`Iv1|>R5Mz(6
zwNeTD%;Hsv%N6km-f!IO2v^un@Z~$LbqHypFP#dEId@XY3*#nC^XzX_*<(;+j9fU#
zG;<ne!$GubB#*|N;pc3*sxj+a*gS?SWTk3g+%^<NqzL<A#%A^uyG0rp3L?7Y3LKg8
z2hH!O@t<nS5`gl=E@F5M4lv#J4Ed-^#r~L~*9^-|wELv8;i<lzX5J17WaDNpk(jjD
zj#ee3Yv|D$^$Stod~yQs#MLc{h0(pI2Ff?)Y5i;71XBzW+UpYAI!U=4=4}Xyk75jn
zZb`k^A=Q+IxL>BZJo-7hZgNnk=JJ?_b`l4Jj;6Pb=b3xHbNlwR<aGA|(}Th9eHf#N
zJ4_47>o={T;QXr<69t}(VdgQO(*4)AvaIS0g_ZT9lJj5X&TDRI1RWC2x?*5HaByku
z5tpWdrdozxu!SfRy0soT`s_AqzOIOQjBPX-nBIJG8k9?HfBZ0Z+=kfmjc3xn-6!6f
z$nFnxYbO(fBhogE4`L6ik6ubX+kcG6y;?mzvG+24ZO?{t$9db!?|H68S>qFM%GRog
zjD7TgW628BhV`|kx2jW<PK(A`t9Dv!A9LsihpK&s={B4-o<dH)yQ{M%kG5!vNiIKe
zAyq$o+2W18NAbPsWW=uYoW<Rv!V_`RdK6Nn%qKM=R_k~nwI;0ge5Y#p`~o%8r!W6~
zu_yX}e8Q8UsEF8K7ki1*5fdVj(CIy`%|oB;0oBj=7cuh^T^vY`i^_2KNs#yLi$4Ip
zrC&dnzQXoWNphta%7{npqhg*>6?c?#E#}SlOiq05)N^j_B8mEid~Vr?0kNu!%ZS&n
z8``$%lzp^oF5Z&Mhn#E`E+?O>ok^Zb?WwXfRz9iK6LmMT$DZP$$o}qqzK48{&%s>T
za&VpEA>2EYN$Lb)e~y6GwM8Ja$YqH0L&t{ge$@>xFX?n$NQ~~gs^gbO$GZrsTSHM%
zo-gz6+Yan^sm%|HUnJ9!OqkZM*##4Yhy>qty_3(Wz-WcwK}@u5>phxl=?hel&fJZ-
zRNir(*>ZFgG0lDzBT|N|;bMV$*ZXII3&N=Zu<aEGa`}hvzE}ma)8{ML_S{qy3Tk_!
ze}&Cje6KMj=U$ZRdoE04-Ag(tB68d-xL0&95;e#-h8X*^Q>tCG#&;Olw!9(xZDDeP
z>&`_h*Mzg;0eaV}A^NNS*u$Qk(cY?M#U%s9(Ymoz-Bjx5L6P5OeZsy_i<evWKTo=@
zaG|;U1G%<3DB>~>%QI4nTuk$@?X~x!cr)hB+cxibhcZ7$ARqp;jd<;ws<?L@dm^g$
zLz|p8Zwh%jRek7p))dvnDzy@9`<8Q879LGT4xWHh5+^F;rS~g(`FHr=P9mD#1y&?*
z;9eV2)R%z>+*c;U%xxLVp}<tjdBZpF;5XJo1EJV_IDhw4U9u#2cjhTm#bW)+da0E|
zk`OK=OSy*h%Zd6PjdysBG=o(#2gW_}8+EVlP*RaTx}DKj4=&a^FJ^*DC5K0MzrRgn
z-S(0rwSJ`~B`~G3=uy>TGed-GaNA;QJtpVQ*Sk$VQB79u^qg77&xc=|2CLp{T+H^X
z)D@b#uP$RbtBain333<?l(Sb2{=As&`$a}`{J#3ds~nN3K6wo_QsMeHo%Ua3xhK(=
zzotFpn$fBBbu@F}!*~2L`Eq7tvOi_h75~#%H4a>ep4K#9Q|M8}(}_KFhaEe9eVd;~
z87)RMp?^BHLcXT_`r)&+_2q{L61{PZUlubj5UJne#Z~DW%X`J8pF6RZ3E^r`yV6na
z3a_|8mAEITS9n@=&%pzEk!ARKotG=_VRk(Q>ocilV4Yli(%p`UerEZh=v?Jh4G|E9
zn;pdlq$5LdLi2UfFtO)NC&U+gt<j5%!mA_KQ-zoX(?tyFMu)0eR801Kou%koyR>Yn
zoW`$P+{T}csrigcQGu^kw+V^+IId#4)%aqu`Q3WLyCkl~v$y){kei=^a=UaoY2T3=
z3hfq9K^c>YqXio-D?Ln`{nXo2>5K^(4Ej7=js!t7L!M7ww;*Vtr@h{6Z0GHkHjq%E
zVZfGWn@~i@k<`{jq>b->z{OJ&NGXtK!zSZ5z>O#!si_EByQaypvVN2J$>M@5rCn~3
znO1-dMXow82A@IG4z`)-BQbaVcsT>l@&xB(PZzH7oj%`9SIqvlr6@^5qcWJ+>>M^V
zV@k_s@fC49dRLEIF;c1|MwXjvz6f|f>04#P5W@XT``B9j^PLOTLhp+KIq#O~xis;~
zHAkm5g!tYu-=v#I<*3(?wY#sA;hED$W<1=YrjjZPF>jB&tU`8_)c8!s)*&yY%#U?c
z5twej21$+*z&sDfYm)6sllNRe^}hg@X7_4%)ZBKG?5`ZYo;45A*}gkd!632q?L`_t
zw-gW6m<8T-sDIq*VCf4G4_^~k(O!4Hp?g^^cYnF`^#oaLt$?9>t0^CoNRM5*F@ZsB
ztRd#$WLLkNh8BW)shY5;^}tRaE8ZExi5aYTnOranAvudj+z9noa~2<ryF($5!$R-1
z;E#m4W2B_7jo-$9^}%!dD?g)5S06r|g2Mjvc66}N<Mwl@{Hx_>?Oi_ZPAt@UR59Cc
zL2?S|^c00bwF&plzmBZAee?4rz~!SZH~RNVQZo)C=^ZgqpRZQ~Sluu9;g1|eVccjd
zzLimOn>a5&-daTkMuVA3(NRHKAx9z4IZMG$E=u~|@3KkPwTB{EJ9n@(k-x4Ad78`o
zsui>RR@UNT5VnT(RTaW_{W{NCFc;Ub_`cp}!E~2i;T6Dg?hsI6q_oKV;D)8>OBhFV
zy;z-@__M1MhTjK;t0H(Bt7%UQiLX!QP~6cs-|^jb;=?46@3LYxYRp*cTVx@{b%e`t
z=TPR;;}ezhe{1w1z~UqP_e#k#*-Il&T5xdt=#Pt(Fvm>nFv){z$jIuVoG{^KOhqHj
z)I{o%x--=RjY2b+w+Dja9PtB6s`w-H26rA9Dx0W2V31joNS?9EQ>qZfp}bAYoU%wn
zi`_=^yv&j8N*z=`AdBz~`RB>KdK@e&LVf;c4gX$|2qB2Wte_ybW)Amc$E@<NSlGRg
zP0S97=)$3CJl4hO!?famPSz?blkD^f=A&Tj>4xdb3tVANaF+6j16Z_072%hO3UFV(
zqNI~+HZZADo711TTAHqp{J;O|_|o_wzWJ#u#>{G+GX{))2yq1uHp2DkX#TeYJ{kAJ
z`P><Oj4vR68U@#g`rj*y7qI3--C`t-KADqtxL3<W*Kaerk8b0T2gS%2zVN+Hg$q>6
z8skx4*D`tFUUefV(YAq5TyH*5Xf4mx`wj=LxOGp;-W&Q-r=}yyY<~v;B>X(^D}Cc;
zvQU0Q#|7Sm0&&I;WB%X<dR#~9f3H}4Y;vMD7zUkpySvNvB-J5?GDqq?8gTDCtodH~
zx+2S@F2wh`4BM@eENY*-42IVOboj9DM{oC%C#iZq47&T~FyGBAz$#yQ)t5)IH8syj
zziFCMAgkb0-Uz;9{x{_t#B`-=B`>WVjRvHwUazT{#fIUKrCKbEVe?-Ps}Ks3XKJO-
zlCq=HdRlQuo*Vnx?GM@KDRm2)lEJqUCJ_=ic(<{52#fgZ8!r(2du5YeyL<v{6nhDC
zF|1b$C=ysc)5If4vVX~s+YKev1PGK#h3iiiPT!CR2ny^$s0*&ie)tsVG>3cbBBxRE
zgDp)pOo8Eqt`rA(jK$Z~I6N%*T2?Yw2=%Rrr9}c#KwdPylO8yD_u8})Ha7z}uv-E-
zIs~cBlipg(NNLbY7;gqNT*g(U{`ZQ7mZ3J4tj&j#D{i;z;yh9=X<hCV<<=((O=Pzr
ztexn3CVU^>r{&+4pJKjYT=vcww3D&aV0Qm*fmj9BsjA`It<Q59*tn$BGDa7C|Gjd+
z!u)NiOs4*|y|2%sNh}Nt<cq2n2eY7@>Ab3x&VPoN^jW_sAvU%^ruoUTgwf<iJq8vY
zAwB=I`hTx@kP*L{S2`ggzSyisPnzRSPuhZf#o}?>Jg8+ly;q{=KRxU7thO1W4TDH7
zuL#FTz9dp~Kdtz#B}LXP0ndhyx1!ogC@S2(?>i@za<q7zbquKqE6qr?oeM+9JdDmd
zdQK*x%fTd31QJmZbt(gio-pZwHt5bSYibR2jVE<5xea>$(d)20;r%8)4D9Jh&rV9Q
z7nu27VL7*30e7x}X7oedY3ReD<1?GL3-}Rg{z@)<8?PafuSr8eA#bs=MQN^f)PLAy
zjglc%PQC++O^jqs7p1z|c+r(AeDOgBJ^Q%UJ=nVey--qCoWd)WV&R1$Z&}mJD6dXW
z;Fsw)4fn4{Gk1(X|5&8+(YxORvot7oT&%8LBd)Vrgz2gN<=fKw(k>HM+{$BM;m|}d
z_X18kh8y4YuQ(GP1#dW7l<{W7D@#PyWHA@k)$^XSKknR@W~QA_42oebZR0YGOd|%Q
zB3kO0!8aypQfrgb?yhd@l4_9cHPOmDe>qA^&%4g+XSEX~iEUZS54pOX8_a4Z&VI={
z|1OJWXl!$uADGxE_QGa$u297M%u(xH#z0dBj2<(%x%MhcU8bD%gG!-qPb;od>CLib
z>Pv9lGpp$7Cy)Amf}`;)YmZj#quSGi-m;Se6Kkax&vAz>SOl3WYhSms)eB%9gOqw!
z$v4j!W(9@ZXJ1e2+?V-kNSQ=Z@m80e@pa<|LuwJjxL~S#Lz4Nz*SB?ZgruJt&^~m_
zKV&XpzXA$*&6=%s>2)%hZ7Z9Ow~mEQ?1}MN>jr^?vbh%#U5K?*-0G2_v8j(JO@3#N
z<kFMZpGew|>zK_S>eS%ES7bp5yVuqGU);Cj$c7R=Uvks&Kk4zX-6;os!+U4@VOcA9
z)X^_io1k;UdIW#*#ZfhO2q}gpfuWn(1H(RcM$VeMS-dYpO_bOQbU0$(eok*JnWh;%
zKe40W1~4=XMm|fD&XPCpP)yfdIBLP(4xLT6s_+Fna{DREa9j6!kf+u02h%Tkylkc|
z+N~XhbU#`YklRT8GS9MSojBGVPv8P?8#pvcUOgA&#4c=Qm4n5+_)=;hX`DCq@@zDN
zPcIHQtKhX<o#cj6o2n>TE~UT08jf8cc7*BBAyd36L>KFXJw5L3G`6SW3#oBYkipc%
zEKX&f$-9m|M93^_(B`JG&-GpLD2wZ06J^$I-p5^yym>|9Gu3&1bj3S2N60ACzW?2*
z@x|Lk2eV$Rt!CfeR>aY%9}n%GS1+WC2n@;I2xQ*XF=5BF87;5NBD*<ow6dZeC{kuv
zW&SOz+k9i8E=oE;A$e86uKzTyQPk2yd83A|nDB|4m3Q6R#;4as=@Ho*_VEc?_=5c>
zns5B;MB4lsns3LfjuTn62XlMNwYeBP4--)9x{t51?H7^Yn<h`5^E7#6%P+tI*yTE$
zjZIJWd=Gk2FmZOPfFem+@?sM9Txp~C;rQ|LImQG3`LTbw0RBJz@3X*70ntA%fFU1s
zA|_hMpwow(M`HCcE9+b`q@M-@C2sn_aZWI<C_VV3#@u{%Ci^~tCbE4>?wRHo&F2Wi
z)7*#^Q(v~sWIvpCqC5k+OOZFyJS2#waoKUX+d1Mc6yNQA_||Ivc%#YQo7*thzA5V6
zM-j5|@rt3abg?2~#_0WxSQ0a@gELo`E!nokb7Iic`RY#cv^NN3SbMPCIXz9uQ)n<*
z>nSMoLC-eJW=M)innYS!RZ{~TUXsUUkZlL3MT$7oo1LAv2S0aBx)v!C#zSbMd%am!
zq0KTHxTss=p~Jyh?pDE0EjOgkc2k8-s({P&!IJfDi05sYw>Dfjs%Eu>b$p$2YK5J0
zFy>YRZ2yMI%zaM7;K%1Y@Tbk5t}aChEfG`?vV8*70%!stU}LQNR}1<d0qT;mXCfEu
zykQSmvox^c@s%npBRBzY_?s%@C&+)+iHeGz$E)(9O|)H0z-=^{Z}$m&c4U=2w`s}D
zjDJPGl6rygiLsp=_FL`5avv)*a(hxtN7H<}K$$3g0bM*lEyBC`I4l|!;0Ni)lyO0<
zbe+#r?*%04<k@=o>ADSG$A--3NPSw=K6Qaf5n=jXd*a~xgqx2!BVfWUq`5aOcTRi9
z<$)9tev)RiCzhHK(cD1ex2yE(?p(LtK;^bA`HSvscL*adKKrXn4_LA+`zRcETqH1)
zaq);CdDXHvKdE2h#niNJUQ@iOF3xD8Du<K(I<HjrCh(B-zM9O?_iX9#YxE%uBo&!g
zeR8wZ63BWLwJtivd`snzC@lyut(d!dAaw2RaMpdgyE0}k%2I8cFLxFMq1wxE@MSDy
zhlN=iTKRR}_?E|q><ZDhGmtc7`gYC8W*$U+dQF?vJa$`c^}!tqr`W_q-N%t7*FQKA
zC7WRIB{*gzE_w}zm_|TZdGj}T8I-eb7MZelDL<gSS~0W#gvsS5<MZ+I0);NhX5%;c
z<c~ll*`<T#vJV{K51Wc7wg{bce8&@r@}hLOzGwumNQi#DA?N6S)B0Oj5bK(RHOI4&
zHxrm(^5N37>~Ao>JN;j^L`#Z@Ox27l)f~Pivi5mCFA2Vqn!|QMSng%GmFDY!gT|hM
zH>S;VS1WK_Oj=8O@SbXZxu58xRd`+Ru4?nU*{$3A6czbK9oetJm<xLrx=~jAT8n~>
zD~bW|I}^|@0&T2&Ei@9gOtN2lMiu?8S>9B&cDO^NJj&d~;xPxsa56};cqZweZ!3RM
zy|)>1Eg-<+3$EV-wFN8d*lt=rIAclB@dzg$gO4iKhg+s^DQ|x(vZ1R7VHw@cplxqi
z4G(2)o)b6{n(%=H)Zd9)DGLZF-5s>?KRsLh92;M2=M!soBla0J$&%#0-Na~ueDl!L
zT{bvHMAeaCp&bS!Vp@;MdCwxr9%Bl+k&kNaF1@fihZurBKK+=f=d-`%zB*TM*72TK
z=IEei&q2$3VT-cf^JMC%JhzT;cBhIb?FFJsoMoD|z^VhrFmn|PaV1o|@j*56d7f!_
zQFC&gFH3pH3EJC>@z+iu!;t7bt;cu(ySfdXP80S{)Zty`(Y%i2en_*(jGIjL)rRM$
z>LYqQGlw~tdA!S?BK4VhOm0so=|2{rcj&TkvxlC3kCXpAc}e~CY$_?ed7xPRL$>5^
zaI)nsxlQ=w=B(uXt03oO+&KI2EbTy>um_Nd#Gu$$vpXO>7W`DPRE;}=Ht{0r@?V^;
zdmraaoVvR>53`n)Tgh9_#4)eH!P6F+b7l7J^YN5=Qj0TH>7jhC%I&M^dHL-Usp<IF
zAE|TOSxAO8zbY+y(fh>9T=I}_!7Z?~Rw|x*syuF9C|r*z#hrJxdq@XCURblgo+;WC
z;(fBXTIlU@zB9)Zdn~NGKFsc%|JF~h>OyGPup0IFl*#f)_6+-C7DF9%6G2Rscgzs&
zEsJM#fjSx>u_N=gY|?0oLg5$@t$HinWXw0FZ)?|qy5v5rG2iCULiT5EZ%fZbwxcf(
zW%uqhJl{%rd{?7WDQFHXdsFa4t#A(>$rEW}u0>F*0PcHQ<{1&UuCr9JS(>(czP^L=
zU7dA%i_Ekv5&!Z1$s{i?>le7m_o0oBRVm`TcCm!2?{ac!A+fy-H&kg6k**`N@CZ!k
z)O`c!Dm*U-CyEny_};yS9r?#c3Z&z`n^_S+0Y~o+6k1s|p1xQTXC-*E(3(KSVeiM;
zUqO}V%8*z>m6(p}BF<==CX~c_DVL*J9<N4v)#Zq#ua`qrSMr+WnP89Nq@f76mxRGo
zh)B(RT3WXFRrgx6%#)J2`Bjy}_1nWly4^`6r{ONcmK#ZzC(m5h$Bx&cca`nMdms}u
zG^a1K#yz_C<HBoJAyy>)q8?SFTT<mX4_eHQ&g#Fcmb&rTnz1}}k$;zu=;p;dCBe*=
zvi+A2*#GOT;DR><ME?AQh1ZN1Tx)eO_cT;}H;l!<ynyHEEJIpvCvw;wh>N_eW&CvS
zdxy_}4E^${_t#cWPjMFYXpPBcxeazT{%K1_8grV%<~J7wyDc7go^Fsa&TNHn1o4iS
z=xxBanwX?dj`6JbbQpVQkL+J{52Q(hpKdL$M@XNp274dcM|dA^ZZP%ro9Kv^>5P9h
zblFQtg7E0Miy)4^)t&E-Lk}aok4}RP&qO4>&d;Szw$DQ%>W-@n&zj24PlqEm502~3
z7lx<3o<=-{j5H~Ej%=UR9d8n@J~^qfLF_`MPtTg1&o|*nf{62D`|}ef@1t&}GgF)K
zeOvDx6mN#4iHpa16-nuQ3*)MI>Dj?q1k)KGwzc>9!P&V7zkA%?RQv4y>A43_;mOK=
z^ygY|Qu^*xZUoisO4qBNCAQoWkKi?Xhl<Oq+<Q9K8#R!v+l=Bdv093WkJ`2rxogTI
z7rE<hO=a-ilX<lhU0Fk(>>x(HdFF*^oD7e)-=}KaX5{pgIGWg)VqFuoxdhCsUKH@&
zVYOSWinpD-OYT)tSLBiI7JsM=tty*$k3Dj^8Z@5v)P25cV}p1O)>JORBkehwIHeNo
z7-B1(fWXR^ESaaISw%AE1sJqV?3}>Q97<^&Z_YDI%kjE0dK_vEuOB<S@S2l6T@;;)
zNIQ9vo4<Fm4{Prp${U)P_WHU^qr|t6iIpc=lc_GazcL;>eX=fTK+?1A^<aS1+GZ!@
zvo}q5Rh9Q*cWce~__*rcLVuO#;=7$kQg%(X?pM#<rqvZCqrnSW4Sa}YJ1xWT!$H==
zmeVtz(><xH&GNh_b9#y(CZ!V(-HllLcU+OQwebznqzeS|S|j7LP9MWn;~maxj)@(j
z;*pP2yfpo7oW|MyDwEa9E0%RNm!~+--4Rz^%MaBz!rMI(gcM;l<{mCr;*ajXZWgFb
zP?KUzyz`EJqxaeOD6bN&$Wf=V?5d`HsYPc8n6vOCeRuNaW8_aEq)Iz(OgSD0V68l=
zb%*S%ZEpuVh|h^EA`C;v=g#-B>Q19-tHviCs540Oy!==;Ny!E)NH#;lu{|R`k`v4v
zDfKHJUy(Q%R3_e-t0J1Svv=k@T|ZWBfRH=sS8@2pZ$RPM3*jFPaDBy1DlK^M?YQ7+
z$Cca#(x!Yds}tF$l`EGquAUuf+@QJNHpsI4Smj3J4QX=lM9x42t{8~vf&|Cb7w2={
zqlISE!Gh^SKIby%@aof}6|%$U+vQ48pY$NLfwS&xHIG)^8>-`ry$frP&zhvY4xl9G
zXU0{hkNl-gUB5nz5tpct%mYpyK&mSUqGH>J=2RYjR=4(qQF<NB;komiA7@TWiI`4p
z>wu7Zq0aj}+52eN;c@)_>X_O4cH88MCa1Z@!I~0_P~o_I2~x)PqIp^+Zy+J5v!gvt
z*FDB2W>{QP68RHQXOEq=&iS3kBN4$LGoeh<+QnZ+y|v*MA-scdkS33`5|=B3lxajh
zk2jBM2<6=Vux9MWFbUI8-SESv%8HYYq~Y>Bi867Xc4Fy#-QxMe+E9e+SrK)6DOQts
z%kwpYQu?$F_khV)#p?@|6{g9t(i{DxBiqBLyhA;vHtk=8*+Nc(o9&?CjpDA4{S^81
zRMwU7!x3~<#V3;c+N=n%Lk*W!1h!3o>DRm}hv-{2)RrxFuwcK$mV2)*40pTIlOXS2
zG;HT>GZXKojER5edB4wXai?>7sHt`Pcx%^7;&d3=FI`w!Hf2E~JYK#!HT(IHj+Y>J
zT>5msnC4NH=2_n1O!vs`i&yczV<MAzLAT<pJ<RPPYdo|hl*K)6&G4KA5|$;&%%IER
zaM1TBoZr5DT-~~DKd7o+GVwYr<vs71z*WlJnHP`0BvpEW8$@&G2xxP|Ku`174STfb
z4hd+jD^L9RyrsQmW9yP4K5OqB_!aD*;RK3?8`-!ru8j~Kns<1%3}5t};VuiR^_Cru
zS~GkoSa;wT7aao1(y2v*J!Lx!8ug@V=Ljmtj;XFpDKLnH3Ym(2mupa&W4+_Ex+oDI
z+<oN)F}Hl`QYo2KoAGUNASuZ|v*a67YP<v_v>niUJYDGC=a!ZQjc7;Yf7^(C+U|}p
za2<Vbr^4WDUu>8<TJmz$z}1>`Sn=vL#8W0|xl<R50z-!3SHjJt?HmazWsZ+M7U*@i
z`V+^JPp*yd5_jUKlOSIq<~Sr4o%nXKagdYKJe_vKZo}$t4o`=yHsWyXJ+h1E4^N?X
zue3WngFZ9!XZ6q?W$0Mn6=_{*XPqc}Gsv5OlN($cROnuGviBBYYVZEEJ;=>mUvgJ2
zSJUx5S9w=}alByJ4*XEeNOdtd=tB&NlgC-IbC<ic#}rAjbUUYAMYHp*is;8?O7|1H
zG3+(=_oKc{GpMNU=;|sbdkjAJia35hIBB^t?s*%YqRDOe+&mwu0+}LW;}Q$M3|1Uk
z<w)3F-?yq`qf2IkB7aY+8exlXU&wnt5&MSm<ZZ>g=2F3Ph~^vpeB0CTHbnZ6SGq%c
zvh}9Hp|Jj$%TePHC9$twr}Ff-TV@yN7~FgjnO}?yGx4t`Woubi$A8J!838(*O1)=S
zj6<$HPh$+vGQ*3Jt{W5~*`klKH+ftt7F^o!G6R1+;ePY+4px0_7YTtHFVoV&fb_=1
zfmhGT8cAHC>)lYZ+_BE7WKI#Kd#>NE(_R#gb;{vByx%QY#!)vOQc%U6e(WeiEk2Z#
z-pp=xlRaW-<9+N($vtZV^{C9?r0|ut%}z#L{B&pl1J^LwNnm43r_RwCbNR849jMLQ
z@qN~@XQgDqy39AHM_c9F;iFY^o%S2g^l0$n$ls=G8D5<BV!*#2lQe%b{X00Kfl2Cn
zU(Cjdlj|NVU0P0;>mu``b|y*P8_{3ZjLCxFIWuqT<|Eo!zbU5ZpJ|7ev`LM0aX(8Y
z4<#bWZ;^U9R9v@ng<mdi@r~pH{Oe~6Q*p?(5Y<A>uaX}ns}}XkC+8!UJ*@64VR%N2
z@6Fa$wNI-!@Otw=Tg{kkGO5bD^Ngzm>qhXrC`YCbE3ST?FKHIobXDK>BCTP%V^5q~
zc%L(7wj_3!m@D}bS1G+#?URl7V$CF#7bWE<8oW<;-Q#PH$4APTCK)6lvD3#Qp>=l@
zj&!s5*W26}Ma?8Z+wX19S3pN#%H}JtMG^Ad;4J&~w#vfU;k`>AkKOJ=9!rH)eKvq9
z>lDr<@pw3>QjRAgo)lkxu1Z-I8vpqsA(De6TKbBVotBl_##BLZxxK|l(=_XEkiu^3
zVm#{@w;Kk0crBNSbx48%ybRnO3(75n$meS#CqAT2IrE0tSR28u-5dOeahb;!5A<ew
z#~n|dYBZA?(m3?DYYP?(=T=77?PBXZ9MAVpoSbi;Y}vs!nkNdU4ZN?aAxJ7Ww%<vG
zxo-<b*G3n4vLGgE=i2k0pX<*O=dX*tM0701uy0766+Zi3bJl$1<ZZkh=qL`!FqkM4
zn`+Ac8nmzn!bw+^CToE>aW9%l`prKm*FMhPOg7A8B)OMu-*ao)hsE&vF;78aTLD|`
z!+o7E1ZIXgZvARgt7;+ck_DMnOL_3UFG)0)rzdyZC?PD-HA%6Yl(YoyH8wak2I0>Q
zK)M~Pf%4TOFrK7nM0|9q<FL6hpNaMxr_-z>&ujUU@+uE2Lv}lzWA(cwn-_2RUy3+&
zJoO{rMEK9zAAUO68E^n4PfWicLga4SN^T%u-r*h~NZicz2_jtx-NVmHMNH|RpYMLk
zi_s!X!;Yn*5|-{$%d7Hyl*tsnUD0~@^1}w-bV703L1d>wwat8mLHO(hJpLB9R!z}0
zD!Py9McZB_c24VKc}4Ps?HsH3h&J|>6TPanKL(ap7tn0*RV2B$5oC}(a9K-UrMmK>
zj_HbbJ6>~gCYRp#;~JLZMYVUQvz+;5+dSi9wt|Mz*?W8VHiaETx-oPQ--i^o<^@I<
zURg2UI*k`DJ;>pcFJI1Tnfz{jG?ObWDkf}FTLo(!QM=w9`h+Z#tzM%x=B?IV+{+w;
zhmPW9{8k2snkBcK)&}xY6UFPUj2;=JROJl4i2Ep$4(}Ls(aLaMpE|j=a25>R7xVJ+
z-9HxCEPFxd0q3$7)2Y$YuG7*!kFt>5a7x${+1V>eDh%<k5iXO(x5LV@T`aSqtlB<)
z^?Bs5GZE*@4tMRqa7Im+Q*`CBP_v1h?b9|7y*J$x4cTBpAGRup9amXEMb1Q?^q!y9
zn3y+Z$#$ao<myPe4wE>-gEM)rX5T5gVp+)1hj#2^-eGCS>O{lgrH+e@rpLQdb>EIo
z-=D9Ze?O<!=vVSp*Jk3cp<?yCJNN}+v1**H<W?BxRTy{1rO^+Hl#d(kUluIPEc@Kb
zzhaIRVvfaSo>|{%qM>-TO*hl33v-0CP%qGi7V>%3()^Z6agrW=oYZvOthDp<B=)<6
z2Ky`8pfnLD$^MQbHBi>8#P|=*Sso=iWw-XNhRV7Ur}2#>!*xfl1r`Z1Wceq$#@lyZ
z=}t^wY6)eL2=CrjdXqIB5l{zVo#|G;bV|%*2)=Z>ytZX<>68jv$`G+T-RH1xzr3Sz
zHf}p0EW{Z}l=rsTc0ebdt4vJ|`er<<WPzegt;Wt-t!7<REtASFwTq}LK5M6Do_%FP
zbwWPz9gnk`<VIv&t7O6MF1dY2a>G{sv)9gR>h&tY%5zOQ8yEtt-aDNOdJ60_{N|m!
zyyItU{l~`^r&>ok=VDgzsumlFu?57K`N?U&b-eV)CsWq(-Yt;MeHSOgff4KWam<Mm
zthZ*Xg^yKuo0-z#(vXGKjcnWVmOb?>@0r(|CIp6iwAn*@>o&aI=5y8#-CJd%WE)b|
z<5(+ZEmPjlSS0hmmM1t#pCx)|sIJSe$F$kkeFb@QY!vbvo|#nV86Y^iw3Jfzk(b{f
zK0Wu0+5s!bZs^T@gM!c_{D_ismcfnrM+eXsyP0)heH=^9Xb+dYc`=izPHFmuKKgR;
zybRT85zleG;AR`+gVLKGdLFAqajr*4yL)BCxuZe$Bu!<(WyGs~0fMDcrmKhfO;%ka
zN1^#;$hN*(W8AWn`lT7qk=@ZXLhs<ZWDgN{TuYHO37aDuC8B!=76*&(yUoQ<=uXC4
zEg-D3VXs76kPWO;uUyiQW9hcozs5JVTIeY;p=#T$7KZLjXRkyd@4KxmzQ&W;hjS!%
z-mRwDGM7HI5t-$ERThBkq57&vYTt_P!P$y&+SakXR~?T0F;I^&uVAAiRs#fjhBq$O
zHxKhf?zDbV#MQa66e;_Gu<Z#X(L<AN_Q^vIe+io1R_2Gefu9%9L=QPvXTFz=k#hNi
zX@Is*8o0$bvZD8p+{aZZT4Zh%zlA@_#umC1tzM+!kl*d-T0V;Z&(SGb0!OVDC1jvo
zu8e0$O_wwR4CMb2%>yb@xkNQ@dU7xRBR-sdFByGB<wl`|Qh%50b|K3@!o-pzc`)b?
z0wmQ7v}*zlnrZ)=OB?0&|4=a=?f2V-CM5sOwFduQ!uJ5DMzJRs`yX-T1gVhV6taO*
zMGAUbr(e2B8p$y}GyQEEJ>}n{f2to1{-M5XA^9%XPXV?<Psz5V;b-tmw0Uih+I%Ib
zQDjR%xi0#X)}?<$_7`Nd<^CW*QdRs^A58S$TscVf$Np3usdJ~QRD76AidJ^;e{-SY
zyGB^k)|2~N(EqR&*?_bb8JoX4ZGKGfdo;4v`*Q-ZK=cGRcDdvVe~C=g;#|@QGBEo`
z%&(!>TTib3kL5$-7M-H?ODKsSeyQoQI{3{XSNQq(=lU7`v3~v{8~bk^Cr}0;*H5(j
zj{yA1_1vB#xtXsg7qf=zw`f2bAUVg|lWT(70l(YPwITEbe~j+QCI1;=jUN%tktxLA
z{UsECM3`bp!`I-KX#E*st{)NB_@ss7_DiJyi12R$WUc&XgcW~8_!kYDF#AUU{?h+f
zgwuaS_%E(qr)^7Xj;_$*6fNSK=S$IYh4gOoKMa1k6s?E$P}`q<KkWTAvWGj^z;zdO
zoER)cXQKW8g96ndw%hhd9JNLNA{hO-91MPh_xG$l+#s~_KafA?tomtdbr5>-AeH;c
zoT6p$WAFY+VE@yT+l=U_{G}x-vIRZ4_%%7d#ScUCdvdLQME0-FAC~?xx+j<RS7aZd
z9g}mrkZbpsu=){MjU|mhgI}War#?A9Bb%Z{;imCZKz>B_HvzI%`O{h}RAkM2F>@)k
zOY19fDEW$>`=%58*868|?B`0>__30IX@aJ-LfTszW76S5x0@qdNc&UZAkV`6&@$P=
zxF4JGS37!y4mwzWjFv6b{TW*gr5_H$t+DFK{Ux%|XZheKEh4vHg7@cM%!&T77yS){
zmo$C~NFO>Ve-QNKF8p+ml`#5n`$dB$%r8ZTykz9fpe9e5Neu--fwn_)BzJbj?dqOf
zb~CLJ(SMlHb3mq4q-^u|<F=fZG=dFY{uCr$+m^?Dcbk~pkXP`i^K&poi{T$JIfg#|
ze>Wg&KR$ME7rNo2&(B{(XiC)|yNkGHr6>27__dyEP@lYVg|~Kdev8;2$J=jpkTvv&
zufdW=;SZ1gqCpd)KYjnv4y{(rA^LR7y@QT1fxHf98(3}V&1dbX!BifqLAPF-BAjgM
z!N}fv*#-JVdg&^-e~?%nJrVd;+gNY?Y;XNaZ~b;}{ZVf{W?wyipAmemlt}vyt+qU^
z_FY=-d$igLwA%M+Q<Eq6F&yiy`rbB<+R_z$5-Lg+DguOxGK7k<go<*604Jw$Tpk{x
zJRTw*UZOl+A|5`XJU*h)Zo6Y2F{41s>oX|YC$!pTwA$vh+7`6hPieI+X%)q*Y_TZg
zaW&&{W8!g#;&CYxa5WQf5hdeNM#S1LX{~Oe`jc=qlW=2_aEFp`DU)$ElY_>(?8bd?
zvV1ABeA%*mg|mF+vwStOQVvILnfUSY?hr{POqODVsA1)*VYRDat*T)WfU&s2a`qNw
zFPY_c!SW!pUGP0n;4b(+D18^KRM@-=R<=iJ2z)Z&T1f{CtX9&q402Y|^OEAO2kwD&
zK<Rs6Jy7!=_%UdH4{Qj+*#{eg*!IDuAo+c;8OUrOYyk?~2U~*D_rcbn=6$d&Xnr4T
z55hr!9YAadup>ww0e%TGLx7z@fe5fGC>;TI2Q?$Wo}hUI*c*g%0QLp39f18o@(18R
zkl6t^7!-H_eho@L0Ed8@55Qrd`2%nS2<H&|4#ai{eh-pA1V@9+4#BaYz(epyQ2HS_
z9@KmYP6W*#f|EfwN8l6?+YvYoB!2`>2bm$C#V<;^LdU%qmVVTt>uFkCTdX^+U0|O#
zEK0dX$GsoMcH9!@Y1&&`Y&ET2YM(bQO1VzQjR-@2vz|Vz5Fhpd%ThGbi`DXGWH_s(
zSY#5b6-({`ui`kF@Vmg17DX>p&bs25Y3&aCyamyi9lF)SFr3qtH(sXq>xwg`wFm6;
zRzzd==vI%y0#94oyi6_Yic6=pC+zdqMPm?jtH)tDXD#^NrmyRYTc)+Y+vjbI#vIbE
zo`eOSwJ3U<X4e%DO>3{&=k1He9Mi3yhT)vIyzw?|tt(!b*50+xI}(jKrCU7<3p{UW
z^EO?sE8d^hKC#a`6OB2iTRjgWy3j&=!IZ$K7_WW=+h`4wzZ8S|82SC-g%*_yrrbWo
zRP`f-Mr*kIrC8L*7@<TME#VhTm3)dh>PM~^t>N>R;!q!BhK6CZbX_pD_9+&vAE7r|
zBjzu~qdvw8CBkeW#xM=>DZW=fa?NOsoWJxE^)WWjeb$T@CK=C=TcR(NbMix9IOpky
zzPFqVANwNjD?jP?DYmX35iwe$;};>O7RL+C$7-3vFx~MfcCR0iGFoHe7a^q<zZlAk
z-NJ}zdfB%)q<-YC(Hbki2syR*rO<rr76VLELEqx|`VkeQH4c7}E7aonp}aUPNtmXO
ze2a7IM>LJrxcNmWsl^FG^Kn|HFijnOi>vBK42;%5{36uU;)J2RxGjuWrtf`=+v`Wn
zjn)MDMQEwTi9+*nTMV#FOMHvR>qqR2)<pS5=&8ktLwWI9lCVtseT!G?N1Tk-#Q8-S
zsl`b`^YL1yuuOM+i;wF^yo}bQ`9+wi#YsbXFSamZn_l)SCTJK5GFp@47h$0mCkxHL
z*kXWfD(F{C*Dw-pw04hQ<Qla&c_{CtmLzP`M}EcJ4I?o|I!6QPYL9OXrfWQQAN+{5
ztU2uTa{apSI|lribTfvygQ|JR?xt>;SjcD@O@{eo$L^+iQ(5|qOn-*`$J&>->UsLh
zNT%(YFw9q*$}*SrGC&<do)$KqxOW`CYBs&HJv@z_lzk9iYj!lWe4*sQG?^ZRjI@*A
zBsT_y=kMRm?=Mru`yg0)(=<eoIquI=Ns#%2LraXgjU|%ocWGhcihlpQG{eOf>>g<g
z&F}De+VxNA(XxOd6iF^VBz(0H+G%0)5*NE4DO)rxWP~hi9x1I{Ar<%^$~a{2K;$i)
zI~_FRKT0yac-_7XpI4UsWe=urF&M=xi<?+Kl6k7aYxziN49WD{lx#Lz<n7~vrGJ(e
zJCX0K?#E-YEQJ2A<!wjgDD+HXrvGc%lYkr*^M#Yyq-*4VErl{;zWk}ms}HQDQV>8D
zgY0(<oxcuc`k)vyV|I~@8OwT^_Q}NjDDNEo^wJ+C(mO{3ky1as^FNmX3&>IEnH*b0
z{<ktk4B5-O{7B|&Lb3AyRwCWK{I^Q?Y$!86Xn!EzZV@@4I?y`k;oIEk_f~v8_DGB8
zfpIba{P(cLZ-z6|GjeoWcfZn+rH#B2Wtn<K-F&y240!>sAkH!s;BwjI3i`U96xGW*
z6^iObUcrC8E;8Hss*L&W7|j+X@(Lc=TgE))hw2S?VGwu|=EAUb3kAJ3oB!%vDeKf5
z7jBa);`z>oL*sc$qkY9ii&p2xBVIgk*Ae1#+;gY>Ez`rU$-3s{Y2@>WBG@EIQ27VX
z6YUm9#D?(^;u*4^v%86DYu^J|6GPXW_D6I176bBcTP6$O&X#H|IfOfg8<xWd^*@-t
z@*w<bTX-^)&>?o%Xj@1=lh7gtM^>)aC&1{xy3CYHdoIu~Fdqeup8@2K<c@C}ku~)Y
z#}EEdpox7B=7c7Cz-gv*nirbTLH`{&ep+W9IsQ0sT*QbN-|-=G_^s<5vc|-Uwa><J
z(Uq!adU##*HyyuiHQLhgBdg_x<+fN0pKjm@>zC(a;U}vdhW1$uNTnUn40c<gMqiOh
z!=z>F$@0BRCY19@xDLgH5#8ffj_Q+3qotki$qK$JE5wz$=QOim+S%i&0<hn;GWjW5
zzERmp4G~K&JiMG1NFd6z8XPY6(Q!L4K0^2o6m4%O^j0dA{vQAm8tR24lI%4l78b~O
zhO8?03IvON`iJxZys;BH_8*uI6ebLfi9ul!|Hkm3Fm7po&-0@0*-r8Ll0a}AwRJhN
zy1(?HiT>ebR$&1!N(`awA?ib^fqst`A}9>yG7964!Z0rXh1o}89`|{wq_VSHnfw$P
zXdiH(eDEIS1M8??K6t74%LlsYDBXUe-k|L1L{FZMvS+dn?So&WiYR-I{sYs7!Z7rs
z6plt=c>DjtaG@}98Gq079A!@_%AOBaD0^yu*mGG}K<zS845I8wL{p;QqXlvi>=aL-
zG00`GQ@rpu2E7j8{hlfr?B-S`Kg9yt2Qnxhl%Utar(ZsRJpAPYw=9%yzfs{Rdmay<
z?8!vgV>^Jh=NG98${yP6zcF1XOg<VDi^A0Wjp0LKD*prHgtEtL1?2<uItW@p$5c>Q
z;L&BI7)JSkcMzop`aN2RqA(d~40;_D{Eb1NFrI^+Dk<!gRwh414B7`eC?ABN*FpX-
zAM9!V@<CiK%AVh-*C>17sL6`~ls%_|XdnC{y^pfzR^H#3Ruo2Z2!)A4VU&md!f>K6
zWB-A1K-qJ573l+Q^g2*kMf-q2xcK2^q!>WiQ-h{Nzefup6vhsXL9YX+zcITg4AHP>
z_@m2-aZ3YtGTCnl_xc-_A8NPneUMXrL4Z0L92p#MEPh9Aipp@YFvl_E!SM2NgxJr~
z*{@ZUcb8D(oKaqrM0>3|T&x2_xEIy;!YVZrHB0_5(%4@uk1k6dqs|vY6b)zw74Sk+
zVn-R&XtXNnkC8f@qjmV%GH}NkWef2d(*7mnNqDGD;M8GEob_XhN0)0#Q5rTfI{wpw
zw5Ss_;gLt=-jTxYMuJi?n8EP_)<1+B=*ScwCnzfC4SfA28c-N26h;$mekg;ZwwcU7
zBdpM&DMp1eon7;%2t$RFXcQGr^l`{AiVo+mZe<k4?epK5P88-b8iPI#ZU4sbqA;{2
ze`8*vTrh-kfi`*@Osyf8fI@57z=T3?nEIr`D3Ne6_%ipO0(}~up&{s9fD1>jnqOnk
zry=i{r%D>Th?U7tQHtIL04kpG=#!xD*Dioq{@MjcUr?(3MunivNgPAD0DT(fkD*=g
zi&P0^P8{TKOgjn#M`O^Z;pyKPZWQKL>E9SflnavJNEeKtcR|Jvd+3CV)h;6i`ZTm1
zHw{;3RTN7dU{#b&RllZqKXvHZ4ZMM`8D_61)c({ujlFb=4;gRgs_x~1uPVxGKLz6n
za_Y)5)YN6D{Rtlz;BZu_MNWMN|ImLk6SX|C5Xdd^3xI_7q83gdYT@i(L2(9)FYqJh
z{6(6L!chGOW)y{qKx4>Jn0J3;(A$9fKQQa4mE3^}jyn;m+KFD&CYkI`R!FfwhT=&^
zQKH}fXk0)I?3G+lNOwYSggz98b2!G$mUATLjV<S>*Q1iKYiri<^^yezNrYOAE8osZ
zn<JBO*ZURtr}=Sk9RuJau7KnGmVBLActZ9~xxcytp0!rexB`BKzxs1L&Us>RI|J}R
zTtV3RmDhYl#5EAOmjPV9J#iO2zyRckE9f}Ctz2ggoRsCNlCweq-&FalJL7R~5QC=~
zfO>I-Kxf!b;5>sO8o0y&^oc8EJHOT4U~Zn0&8d;IM9*03ukL}zc}NW2VE~rI6$YK3
z)ooAQi=@gvAr{tmwPWQxBL<%`04L%Kr_OINH<>BErId1a+g_9ZCYw|5ALWaejYR^!
zh<rM@gwRhQE{P->c##B5#t2-KP*8Sxo4U!YF_Tip-Te~iyfMa`2EQ=|N+S{+6G-C~
z924Bhu)JGk&VxePCiHgE*e3Q)(by*SuG82ilT8ld(!xLWQqsaxdf92=sl6h!@U-5$
zv~ZwTlNO%dYfcN#=yjrnXZ8ls!n1l~XyM2Q`P0I4dP`~HxxFp4@Vwq3T6li%0xi6t
zcb^ts*o#XCFY2YFgBSO*)4@OYiqOGJdhgP~zw~O-!6Ciobnwz%CpvgpZx9{4yf=mp
zUeTLD2e0fcrGr=Xw$Q<=dxz-YHN6XT@Y>#eI(S_#E<L=ymy#ad(92E_Z|oJJhd1@!
zrH6m*)ue|v_nOngTY8=7m!SfdFo9*5fMu(|a;t!4o4|6LfMvVDa=U<Khrn`&fMut^
za;Jc0m%wtDfMvJ9a<_nGkHB(|fMsuSmS>1PEfpJRtTL-6WUM-CGGwea>og>_sxRME
zO^;gMIo%ivm_h+FC}05vETMok6tIN?_E5k93OGW6mr%eN3b;Z6cPQWq1-zkvFBI^H
z0)bE<7z(_G0wGW!3<^X*fp<{gJrszB0<lowBNT{-0*O!{849F8fix(P4h1ryKsFS}
zg#!6dpb!caLxB<~0D%H!P@n<|R6&6nC{PCl8lXTE6ljJ5P$<v}1=^uNClu(00=-b6
z9|{aYfng{x3I)cYz$6ryh5|ECU=9k*LxDvounYxOp#U5TY(Rl6D6j(s_MiX)3LHX#
zV<>P61<s)W1`NQ00XQ%K4+dO<0R%9B2nLYA05TYG83s_m04f+j0|V$_00RtQf<=mi
zTQ9ocqZWKT6ymNw4uyE@)4?GA`g$;=_rzd;I1G@40n#u)76!<{0C^a24+h+a0ZK4H
z83w4r05ur!2nJ}t04*4x0|WG6z+)I-2m_2^fGG?xg8>#Wz!C;n!vI?tU=ITvV1OeG
zcnJfXVSp<PaEAe&Fu)rI_`(2x7!U{pf?>dG7!U#j!eBrI40s0v-ot=s7!V5sKEi-_
z7?219l3_p!3`m0k=`bJ@24us4To{lK0}5e4F$^ey0T38a1_LT!KotzAfdO?epaBLn
z!GLBM0EGdqFrXa<bi#mc7|;s?`eDEz3>bz1qcC6`228?$X&5jA1Lk1BJPcTb0n0F8
z6$Zdzzy=K1f&n`)U=Ic$V89^^IEDeIu+IgPDIv~FD-4w$(D*&^YoJO$Xgr(5lR~5q
zFSmZ?o0FY9oeYi}3XEFSWh#yH<bC6AJp_4RBQX53*-4NHFHXd>9hpMGF#lNVc~B7Y
z+Lo9f)e|g)Y!3XGu@Rcz?ejEzq!jYr*%A9%hVt|c&(#+`IvE?UZ1wnE9err-+Ki92
zR_UPAHmkevevE}s-mZ~ZRL10wvXAhhc|vhIjb0o^@9%P+MlT8V{*Uq_Mni{S=?znE
zbS~#-`9}&y3M*C2bcaSS5u;%jDT@bbNIQRJSpL04<q&Q`02K@}bPfSkejWOe?-<+V
z?JrZo`(SnyK7!1^AhQx<1Cb)gtb~x~PgDLi)AIi#!}53X=T|c5Uy?wt@_*z#z93U)
z_KC#&?Yj)cdz{S3oXu`Fn<p}jWQk0ijb~z^^HBetY5D(=VfjBNfyl;dowki5-cF6+
zo@1WlGmYV#c^;{9s=2SUp*pAz`c*ayH#as@!dy_dRjAn@(=qmULQPP&R$Mj#7|85z
zS6@P9RW8peqk54yQ`|-MhPnu%k}T%P3=Atg)P(?fQw6dYc|(OPvey84BgJ0{8O^T>
z<7D>o)f7l3$a}qRYl|_vvl;$aI-#m2tJ0Zqn}c<B`V;MG7X&i(So?C*G;yx8EOVwR
z{u#15J6WbWeKurV(|^VM8KwD)VCCe_B#gMuizM+<xwbTC6lZ(iOC;~d`|2jVV-)e+
z=lF!QXM-d8^nUlQ>MPOc_uXFi+>em=fgrz@ny&Ddp6x`AAHzXqkNQyG8rjQMrzd-8
zj*}I#8i3H>s#9!fBERHwLh8FU<hHE?4|1WKwOvMiA6|BKYDiTocaqHhUUf|Z`VNk!
zP(;!4oaxoErn<(uBoB`~g{tH6A8i7oO?6Gkn^`>axT=n!G#keKP^e!~mG|xHRuw5J
z%^=AWGW#43CZ>?e^)s5Sg%{gf#g(fw5iX9>hX>jpULruR%A(#!L{R8Dd*7?JLk-Mj
zJbN{~+6sko<yLviR|_Y4c<{V+J7Ap}Q$-RgPM#tao&P>(`mTSnj&%wJ$xTE;%7&3N
zfr_H%SInz}m6@2hV;IjE&Q6g7i+d-hf3)R>ub(-zxR2~^6&o$h7|s}?7>OrOk%9kz
z%)Mn$oK4pTh=jo40fGdF06_;r&>#U4G!VrdLU4B&Jjeh8f#5a-4eku?E<uA0?l8Cx
zHtghici-LG+CN|I_v5L$>zc09-RHi#$Ig9D_vsyU!?C}fuRLEg#p|sD=p%bRv~B|T
z0~C55U!vKzpB^bR<)Vkr(^7x)a`pW0Sn#*dV`)YYpC_~aCMb{0fh!=N%%3aZ7uk2N
zfC92iu7E<aa;|_PvNo=OVzN;#bOx+tu7FaqBd&n5=SZ%ge>W8Rm*M{<iI4oJ^sfav
z(8e-1uAvxmpk0%=#px(MsO;Y*Dhw>+LjJqq39>NYFUf$ie@g#a2r3gt7XHfsN^sK7
z1SLEfV}cS5bjnE4?{P5tMY=lH0#tC?lm7b8NsdT4k2sCL_kIJZQ6n??kCcp;vpd?%
zg9Atiu%VO>rT7Rz2Gqzl{v)vQGHYj>c}M^W5jOP6Ln&cGkR3I0ng6IC-2+__8bCsV
z4P|&JB}EAGrAA^1905$0S-aZI!vaViVMAFSO34#~qNtHf0!K<F%h~7(Z~zH8HkAFL
zlo}x@gBtlt;0TQF(cNYq9zgOK8_M-iN`nwoN{uuUIO<3DKvzTrkWgVm`5sCc5Q18$
zF)Y3^RSS@c_(lGC+e0TMgqueMv&DEXh+O~)sN2WhO8YH#hYqP@*nDNG6(EKAw9!4?
z#F!DDuaz+&Mmzs^(d!7lY%&SrilzTuTJSwNXnw>Fp2?3JEcR?;ua+bU+njhF9p`UL
zMi-hg7HVb8h`F5KPy7?(j~Dy(SN9X=(WD@a-+$K_Y!Au6s^G%t7jt4S$;Of(yuK>D
z0a|QFI4;jq%pEi(TkN)sH=~QxVQ{He#4KU<=wJmc#x+mib<eB+i_`c&%E4laf0aM~
z%SrDa<>;tG1zP!kf)A4DB?;!lX<|n%ZgAY8072Zvzr3I0qB;G;JE({51$tS--<QqI
zKmX+<-nfs=Sr}Vb=<BA73r<Vw1OE>or}l05U{1r^fx(=X$iID+l!yLD3jXJf`@zY7
zZ-j<_O8-014o2^a+^dM|y(p7J?Z8OxI-$O;@x=D&3$)MeRp%QQI!(EwiJC7LqxiN(
zX|uNC?rWM1xv!3GRASDms8kTTEq8FJ@BK<*Yt1e4?*8V((j8R#b}iKJ{(HvYfT{|I
zy~nrS=T?rh0dW&m$yek1^BHWZ8@=e`!bmk>e%Je^f>Zh`gBd>m*>brVDs4)@{0)gj
zxii*6P#p}M(#;+`(dTh<pLnAW?~yBqvVB*Fj7#@Wk{ufFk%D*y^cGEN#zBHsZNqYN
zZUL9eW7z@(!IIB?3`}q82GFZ}VNtS=4kYV}kU}}*7$!i2WId>AbM1uf-HQv`H9^=S
z?|FT8i-OV5{Fyb-O6py3TEd1OKP$-O0k32gP!fbl;qEuN${}shH!L0@jrD$w*D}H-
z7BY#7bOhpNNSYQqYG*n^+-Yj{On2NvGbA$><h&)CYn$i-uR}ebF(3kACo^1cRJ?C@
z3={2BZ%%UOP!NQ>>V2U7+^~GhZsJ#&sSP{>%J#N==wQt9V&T@+2cO1!$+IW(n;aj<
z&%eQeOZzcSr<dQOfYz{s$K<Oh;(l*K@rGUkH}~)JzK4fdjee)TL%(v5Fz(!-@4bHw
zl94hF_wMU<t*N|^$k#(qJ@CDG!@c3b9IDaeCrc-S8#W8E>0&*4;zY>ncRNvcpJa!9
z|L0oP*GtuL=j@3+Y8chw#A>gdyX?XI$LCXq3UK9<fhh4ASutBG7iBa}2@e6y@CYZ2
zRlQ=S(x9)GID@)JAU5{=8V71<>An<jVaX9zv+4Rc482`fhS{!l2Az7u%cpOi;VQxY
z#AxFn*l?lQ!Cgz|8ei~WwGJWya;_?9q-z01-g$1E!Pl0(dwMVKH(q<rpm+Bw5D(B@
z$O)XAhl@TtygU|`b~h}5zdOBP_0T@CCwIR;UP@1}Z@qVienlO;;x04Ou3K44Zje;y
zO6|Nsy>EDF-GW+#aYXBSHoSah-&uEmdl2<4we|4BOx1d9(JUeB?dB$S>vWH9ZllkN
z2JFBf$#7yMaHsL`0_bOL%RFH#CQ~)mZEOv_3Tz#`;ccCux~UW%J;}DLIiqGwfC|}Z
zdPXD<dq)!p-VgeD-@^UsqcwGJfR~QJTZTNbRT9(QJoIfV#)E$juY33Bu9>dx=MKXx
z8n;?+TXvoL>m<VU?aZZZ3N{S*G^N?18uk3H-}r)l+?XCFG`?J{n(jS`2xOjaT5puf
z1|FVl@6%Y@f_I`u^qitB7to1cBomQ!bK||v^!vtU`<bAN{l&m|^Zjn;a|ObY1Vm-s
zl#_ISq5{hC%Cw(z>bCqkazXAenla%@pl0sW)bsSq)OhE0Rd6MHqhxb%Zs*dq;O4gH
z6KT+Q&8<iu?wJ#h)_U~z$5H*47n*_8F_Kxlf+vC@X-+_pqnJ<4;ur2?Z8@t!ESi(3
zi@n7;r^Sxnvx3@(25bjM#kqOodaFe55cQi=F-fT679O0D(VLT%De50N4bmlDNeMm~
zKViI4zxxu~*Fs57b7@3s1y*|+hwBnyv@eC%zT)B0t*AMxQtR;_&(JNJww%vH8KoS6
ziIO8fl|)r?RP0_{Co>E^NsilR-9pkub&|c5j4}i`_^t|m787=8qg!HNr|G4O?p&Mc
z!nB5mHf%2!U0<vY6M4_L6}bp5F3vxTzAes6<Ry4ie2L-gIp@_egXd^|JR(1`p$#&q
z)!h|5=NAF_*}Ay{-29SJ&$}0YtkX-+FUj1Dl_Cxf)|*gMWu3bSO^vk%sgM+crP~CA
zVXL&Gd*r+!B-jz7CV$JOInC}<t3#hpPj25nri*vlJi{Rj=6OgQ2Bm&=xluB$Ze45e
zSXVP&EUYg9hg)Z8HZgZPV+@|>4+Uo?rryv9KAZ5{Gq9~)2r=-xgYj^09uTI?sStWq
z{B(cdqcHjplzqz_#8>t7&f49fDS_aQ-|QnszK)vdCnY)Qw0!)qeSy05y?J_m5e)Zs
z6nS?og>84hfZ2jd+NF%N=VXg)v^&=>78<+&c;B877h_Pl`*ZWwnmJxYlaJX-z%F$T
zrQ&rdn(E_kX+%N{eXYE1{1LuA?$VrqYaQ3eMUbd8El=RMvemojh*&;uE~y_I7i{jV
zWw1-ZuQI+E<gF3Xx;m5;2D%`LoTGYCkLD7077$0rKT!7i+hB?xqMv2b+}=~;S&APG
zDW7+pab}5jcb?(b;``Vnw*iZhhILlI4)9F^@R0eij`quJqQ+0p(1Ti*<I;;g?)m!0
zR$Gq<2cYzN3$K_L&A}?B`>dBDw5tpjJ=j?kU3|a#tE@~UbG(78KDb8lW$?A=kRD^B
zLSZx`dqS~0zKAw>5JziwjFGdtZqlRF>jVi?ndK}L7csE!-kDe^_V5aE1t4pnW7i!z
zgDGwGlFlj!CAL52=lfLI#c@Y_%$MELdFGKVrG)m~gHDRP)ip01ybjpx{aR;GvT^s7
z_}joen#As|PrztH3Da_e1hZSJqJ*UV3UMu7S21RNTZH-BHVNu2v(P{J`5P4VFBDR{
z*_@%cZJMcGTTAXJpTBUYL$Z-7EvN5WZ=>xaZR5l75_1~Jx@`D*$-aUQrXNJXwe;uh
zV#mbb4ARN$RMKu?>Oqsv^DCN2@6a*B73LcR5#Hqn9?ZSkUgX^BaKP5iPvYbKF{ilX
zg0c<frMY3Lcr))#-Q57)pI;Fz2}r<Yh~a_6b!1(utiH95-vg@~_2}xh-&VYOwJm9h
zTVsAWi4=pCQ|*IJvAT(2&pdtfT1&gq6QJL#HWXMArfyv!`_(Rkv$FDo{WZ4I2Jwlp
z1)G*JK8O(`%R9;JK~=xS?yikI-=1kQQLK?a&4_XS`UV(~@31>>5y<x6tHsObu(CnJ
zl(`i0yJw{2NOfdiIm^v<w>7A-`jM+|&liTVxfEgwB7t>(K<~M%k^t=8v)XESFUp<1
z>@v<zWzL-hWxsTrQEiCcTWNmEKmHL)>BQZ4=!4$dcX9p)LG=du0T<<@G>m92a1ULb
z#yD$2iLPtx#Y{5>G;v*M`B4^i&HLq;MAtV%UuM`{wYE)|?bIg7T|GK-vD>A8w{(2=
z4<OboxknnNb`M<UTFWO*wVkZsPD_P~QM^kNGlMXJdlq>A!R3W(OI>rTXXwOb*SXiH
ziD(0^(}^jCxbtd@sZOiFA66rSp>Yhgx6jRv>f8_@VRn7n1M{~^L#Q`0ZIwxuT+ACl
zAYM|c7dn>k_8++3#lakWvgZoEYRfV7p<&<9(!{ck-cXwSXyssYrJ(1%eeu&=+D_$7
z#Kxy7hU<Dtd{FRKf7udi6ZYth`qtbaaK6;$a(|dW`j}Us%7CHUR#&lALRmW_m#;^M
zuAymWuWS`u!)r}klR$}jdpA4bw2nFs;*~Z^9LUN>JQ+<GJRzOaIWpIua?{sLKM=}o
zL5a-?2Jc0?n(a<D$DfZ-!BIok(?zOxk(N}r%S|m>zG+<vr<R2)vl2-@eCS`aU3#}A
z<I8`5yWQ^MdXJ5_oYppUg5It5>iLYSB#=|DCCt;CIzy^K@i3yuzE!Qa42XLKYj1!d
zdRnGiP%brPWmMg$Fdr}siu5*IeYcp1{9!=iS=f92y|+Q1<VxqFu1O1}oPxC#EU&ba
z-0^Yr>9ibMuz3-$LNf!`=182CjhE!-V#%V=lyff&yPJrz(9JyGgK0T9riY_soTRkr
z?Vj%a7E!Yy!GABGJL{h&BLg*KEob@635=k52F|myp%wBe`5TocO0T=-Qz7l<7GK1^
zQ;R#5ZkeV>Q_JT3LbPo2V*ADJ`TSkz^=?%}Vxmbs$?7>&te)HEYAm`98rNrSi5oNh
zra>dS2GVD3>u3A=U^rv&-5Wsk&B@K2K>cc+x9<g|yE3EbfdNz{*!mNlwD4^=zpu^q
zR@5py#yw!w?s&Ed9*wc){OM2>6}9#c7!vi~?Ra|Hl;0+Jf2ns`<ZMfPEuPXbPUYlf
zi+Bgi?LBcukdGU-Z1{xcO0NQ;cV-C$OQpyg*s<tJ(Tmo*Ty?#&Ut{CPjT=Q`1f{0i
zu2(GAomMC2BUdWEQL9$g((VKBkA5<q2);auR=Sg(ghiUe^y7b^g=NjQHJSFtz~%1Y
zu?a+A8FZa19Z%`)(NjLZt~!fcJGl(5F1vrdvrus7rWyjZQJodKOK|q6uBG!^qicbn
z%A*sO4rb&dw&-$sPTy|M>W+woLrxPIB~nhOpweXTB3ZVyx0=jyGMvBgoyHES*h>n;
zHa+N9`DHJ;^-R$qaGh;NcSJyE-TAk!o!77@LQzt{#2|sqS)lA3mf<|9x5<{Axaeil
z)s!>PRLpvwmYrgj(J$eR5L4jubnK5vgk?}G8HBIro}pWRehPeZ@^M`EUF1`s_DL)P
z&1E1qk;k+DV#+xxcAZVh;G-u39J9`*Y+&Mt*6`tkj14HzeBPyaViHSLgl5$D6v*x=
z@K?Lc3E5NN&!+RPFi&v0r?$ebn0!U!kjir)x;a_|`A4L{J1FtP^RITUQ!?(;%BV?l
z*8T_;gQnK=G}gqXy7lgff5@O&?V`zW#U`?Na{g^zxz46y;Pf9dXjXs8D4oPU1#<pF
z2F<FX1wGVfp5WL-i~oyO#mN*}yUO>bZz!||^u#F|$a*2bk4`Hyr_x|ilg^RF=E>&I
zM;5()e=s#D76ATdE{mW4Eo}X2_&>=jo~*`FmHk!921HNc-?5_UJq6~X$EtV|%Lc4R
zlg~y^T5Mt(dg7mYK3Wu7(I@}^1w<W<G9Ds$hYwd4n3`z6xd$EDkuLrlh3gAy^ZT-m
z0o8CoV|p<h+>o9F2Q;Lo!NK+Ead1F=dL$fNm;Mb7s7nXI!LW1}H~^Mz0|(cpe}MyP
z)Aiusn)J_bKu!8vIJi3fH5^c#E&&HurN4j!s?vGj;L7x;a6n}`9UNSdP5}p0q!Yry
z<>?RLfb#U)IdEC}*&LuOeQyq2n!Y{<C{3TA1DB*v&H+l&hvvY=>0NVx;`F9Da8Y{o
z9H0nNJQr4&o->D62uYg@D}cn!;T1q4=fZwLzRltNf`I12@*ysBc=-^Uxv)IQmpQyV
zh~8XSF68qZUM}SATv!g|^&DOfL}D&18}ecfFB`%$7nTKiI)|49p_>c)389$7`w1bO
z3(JH&n8VA2+|GtUA!oCAP{`hFSO#Q$7B2%bKO2?~nViK-hYZbzr9rx8@zNkovtg-_
z>RG&0Nbzh~3M5AxkP@G!4Ni`a(*`8RM{0wU;=gGFlHx(y;KX<rZ9rnYjW#$T{);vs
zAzn`#93TH#8xSA=RvR1_|5_Um7cZd={t^E|8}K8ZM;ja)|5O_g8&9VVj)|wx2E@b@
zYJ<PWKhOqzkH6IdN5`LO0ixsgw7^mE>so-Q_<1cbBz{s00Er*c0!PMoX#pbRo3y|Y
z@zq*@i1=bHaCm%<79d>hy-T188;7{qSU*@z&BZC}2YGth_WEm%e~YN%J2}B$a=~d@
zeg9_o-*t5T@3_nUUt0cg;`RSe{D%K?x8MIt59)q!%wOkWOxi!Ce<^JA*GSYQY)zfa
z=w#>&%2|7U<&7@h0M|&ACv5#Wsnf~O80@t2)ZmRS+)%2K_?56Vd6J})@o`Yj%2S><
z`qu`aMj|s|YvRO1Cqr$p)6!FzH#%>lzgi+GVQc(EOD98lP|nhmoi{qC2I~_(QSR^Z
zCdX84-sfF(yv>u!;=jkdDn#s@nY!sd4t`jwg9J$UCv1(JAhn@VgPrD{7kZ0z!vPW=
z8K2H7sw5n{A9zmvlIq+H3O4%?EMQ7Ic3AFrN!5xk_Z#)XP=lh>$8z)6`F5^uV^dDN
z9Z#mi8NNgi%A9RIEivN2P_K!?TPysvZ@@v|-pcIU_<L(!o>tOH>D<O;d)Sqoed?>z
zg-W}X39B-aA_l0dr6ICuv$2S`S!C(Imrw3y<Eo?KvDn6SwS=Zci=oj^&<Ym8juwUZ
zAFft^Cm0@Lzp!M`{^$U5x38TDT7S3G)_8Ti24|G1hnGz!4&FtE+{1C)?0+~lGIj5h
zkw~u|PA(iA3|cb{`SwNg7Hej30+&*&Z+(m69r2d#I|lX-mzz*)lkTlIC#LM@7umk9
zoYjqNX9k9f>%QmpiP8Ske&So_@gFY^-9UL1PCH2XmX`NR`#+DaNj|j}lbcFf!N_!x
zaeB?Sh}6r7FG~yvck8bCGA86>jsAlYM(dMvv;Dg6aw8wzxDnZHKii@cSKvrPb#i|t
zXd%(8ptE*#Q7fTr>!NrthOg-4++@T|>8zKL4|daCbOPbMODm(<YIm<NQb7#HYM@w)
z2SjSme20<$z5Y;bsMy{G)SZl}$lrJ1=*s$)euMJvPe<LnoNDKXHW&>qkkFwZ_t)>D
zL>yaNa;N>G&n}uf>%vM$Hab8BtGC;Qlg8!N-jorRo@sZ-*7LfAr~=C0DlZ9mtm@u>
z5c4g*rA8SOo*ws^IWu%>m>mSVCN&Z*iH`j2pP&13APicQ2&vhg|K+?Ed`j(=Sby-`
zowmg>LvA?Ux>Q0>G}?Gf@A0sDKh<yNU-bhiMe}@Vz5Ldtm783>1X}`cQ;Krxm3>zv
zLjNhOba)bGZ*p0cnzT6l)nHj#tS=h<)3Wrfv)M7aE@+d>qBPJDeeb^o**XWQke@20
zvWa^8==0~DpVi~5I@ORYq3_8pF0woCu_6(o?)12D-HH)Ss58eo=r<A7Z`17*?rA;G
ze{P^YrWfyqZuQ1l{e>o*0lMRqp4qVa1;Lis<lh1@x_QzIO(o~}li*W2tJ17Zu39wf
z$dsaA_2GXBsXCjbaG(CuJb81V13d!|ht)^*f<fpJ4gCq9HQkl+T5BNj20j-U=<>Lb
zkcTMkLd53&8p=wWILTDMGkSkL7i)ela-%5Ot4OvMOKopHV!9qnmDuDV;mweZwuEC7
zSItMzj{_9_Dgbm{9NS;3{dCqDZN8(e;knsUYPNor*ruGn+W)cD$3`+tpZ+z9snOd1
zvDGU;7j*wIirvtS{xRB_Gtlcv5ko47p+TvSBLd3LfqhL5=t?ZOs#YVwN`!fzJ#*n(
zRjQF2`G6hPtSWUQz(j<3kKKRaTUqL|D|v$**0kzO13*WF8NqI}@U1A-$d$a%4(pF<
zQUl<l2=gxctA%g*smm_pDRx*Bs#*;IWfA5bcBX}I*{Mb@<l%N$W2)2*09g^{ZFY=>
zZ_w0bXL2t)tP$0jdVshH^A`K^{I}FpBWH3eJFH>Vq<X+}5#~*<Hof4)qGhMYI;B{H
z>RR>qT$;=qT$y^oKZ=Z;9xIn(^{Z3Y<FjZouXFk91xFVxJ3baK#p+d`sl$Jw$-Ks8
zq!%1fWaRjms}!qSJ*f_#Op|$)>y=(`XwkC6<0qw9o$6Y3`1qR4D_l%^!9hhv4v+Cm
zvD($C>+rEOnU}dR^n(40mhB&3mteK3&%p4nHJF#UmUV-@i;V0a@0MUSt0%$mPc)bp
zx!Mp|O?+*-!S4DV)BkFSII?@R$lKBQ#sh|TNV&4W(xm&%{a-B<AvpZHvcS`n8th(m
zWJkF;+|j7*@$VF}uPi+M%k#&P9oeF4N28L52;lHP!f*dZVfK+7#UiAm@q>p5{-ONJ
z!m}pYVE2Eskej8NNfyCeO($E#Tum)&&0I|(%gtO(DvMyMCX_8=s>YMGW~zQ5%gt1c
zA&X$FzLhCrtVYUMGghC;a5GjP$sic2_hgC~s<&mV8LHQ1xEZRKWf1h$^D;&B)iW~I
z^wpCx-1OC>G6=frA(<k&>OL83y6P?&Zo29=83b*0lS~n9b)AegZFRK_H*Iyf4B|<3
z@rtT?5T%fXs+^Q}RE$Jud~f;w9xS>#NhYJc=LcMhbW|U1x>;=ctn_BN%mN%tUCgUW
zeX*r&!W<HpVSMEi4RvoEx*!_&rST3a`I!}Jt`%`21vA{N&b{<a{_j;b1^jd&L|J)m
zZi{SQfrliEr;<q>e-1a2XWFPxy$#kJu@rL#j#GhRjBgt)mUp5B%MVd2aFW(r#{0`9
z)Ri>q3?0tyT{}b_B%-qgqmR2|l}4csTd&Sxy7OjNFPdx^34`pTHwauGr0rUC*Iu8I
z-Ok4^Wh{QuQ6^I3<*HaWv55wV0Qb@d&S$NLRwgym6Mxh3JbrYEN<HG?rRt1+o^OBQ
zGmrpx61zR7vclWZTq{`}$BEN@ojO!@>7!C{d7(5`J)L#+NB@O8?ZDFf7t{p~iHOYn
z-Vb`(O0w%py^B=VyVc-EnhnjeX4k7tt&TP;U0=y9)#*Q1^ztg>sV^2<P8Ys4O74ny
zSHmRINeb^?I>$u9mkl5*UkzJlrJ#54=D2Y^)n|ji@A_{(c(;h3Oq{gCH-6{k((S|*
zpp*ZC#_lf+eKiwaP9`esRVt&WqwYpZnONHP(`}OSOIMUFqfK|DCP@LDHGi3CTpf1>
zzWp_85u|)F6_IDy(wqOl(R(t%){~%W>%=-ysP`S-(FG~^CKa8Jll4-BK667`?(BE4
z<WbFD$ma!y3>Yr$h_tw=@1k{U`=10CtastT1r2u(LEcrLE}@3$hcSsl@1+|wp-vJi
zAm_1PI2M#y$a~Bc`Tp_$kHpuaO#DptCRX?o5<q!N8y7PtCZN2Hv5VPjGgJF7X86Fj
zW_IQ-7EFRKgr5ujKNDZ?HS3r03_7x1wD`S|_9Ao<5R?+cl)><P)9*`-Ey%(@5@f0*
z*fU$nrsD6{Qlat1_41%}*BPkfsi>94>?-c2{#irA_qBYnRs~oMwKdMS@3g?+ON@Z;
zIY$k`M$nn7w^>D66{%46KUDL(-oU@}vhdyCx-;Hy__f@w^-B9}PjwfRqSQqUs&WbO
zTYP+NSXqGRJk`+q%@eNMEk7jk&(ih=BkB-+oCVP7Dxwwn$M1H>@2*It@pi)ywOQtS
zO-&Uu=?EB6QNTu_Os$))R{VZmzCn)MA05N*krTaTDA@feBl>+sT^Y9C4XU~uHu#-3
zqSc+(DK_3797=n+s<j@0X%d%wd~e@a``m79xZn3G9O@oAtM!_--Yfx;gZ66otG5yM
z2hP7E;fyI6w=z{OJ9$XqpRiWsx}noxnsb!ny_{}CgPh%^G;*;tpcQ!syg=LmADU%I
z%gtIP*#v%Yvaf)A()Y?jugA7OwAk)rz6`x}x&B_|cJ<EO{;*a1o#nR4ALuEUIV|l`
zGp(kmWx(FgUHI9C<NNDeIOTSpn8CxX?Usl6sO!b+`4_p8Qezi+9#zQ~Cm(t#KMC<>
zNT=JaZc46R`H-NNRn#wq7Z{}$?57!v;iP^vIJGq{gIfYdaB9hk&C}_A+Z?TkEqhbl
zGdk0`(@f9$mA&@-vI|760*>KHZ@3!m*|fRO8G)|Xh3oG#q+xnf`wo#g<4Vq(R_&_t
zp51mmzm|5C6<9sL;Rf-;?_gTuPCUQaXR4@@;tg%7lrM7Kg5w>^6MJ*8%AQeC7col$
zE%BUuH)3c(v}Sm>e}8Uxe+)#eYPO;-fcMvit@j6qD5zik?K{8wrTfke;QdKp_lE1<
z?dPHgl)3YuT}3gw5X<>g<5o{C84wEDct5TL$}->YId^njG;H1KWURc3z904VqH8Q5
zfnOe1jTr2INlI%unTHXdChe~fT=zGo6Ndl|jfWW3rY9Dq7}cfI&lVFa4#r5Jn4Kqe
zs^W~F)9u8M%Y%_Yw=nlkm9DdOU5TjaQz{AX=-y2)Z_w$)-D-uq&pedbDQmY$g`w8Y
ze&03a-UxPmBBSOi88uoKF*GYuZ3u;QwMx-6ZY>}!f+R|r3^#`p?LDSiw}$W9xvmK|
zmv<MJPzPHx<|%_xH_v5SsddcZ3yA{v7Q*RsHXP1(phR(>jy1h|8ruBfAC&1Opy=$a
z!EldSY$&g3zWouwaH8Su!~Cg();oo5*lDNVHS!(f{n-ceGn)#qVUAeTiZI{!1T<<V
zL~ywC!`)!|l9co{&i$eE{ctYIQ99~0^JMz|juCYZy+3eM9&=R=5U1-mm8T!@Q!2U^
z{-n@jRD|T#>oFZ<QQwjKu5#x`cYNtr1zs5Kv8Ye30eiY%fo{cW89c90Odpfdz3K^g
zghlb09FEzkpt`hPS3Rj&8$&7=!=7*0OR0MpJC9+rGr>(>AJ-y>flJaTH`m?~hkQNM
zarwmUqB)1Agd1X{F((x%d|mEH<MGKkIq_YX>8Bq<gGr{RcBTd`elF>zgNu0|BplZG
z4p=)1x*Eb{K{+=!y?$#!_dBN6WaH{W2xr|W$NCfK>=(V=LsdDx(3Hif2gFlSK+mh&
zq(p<^`epctN^f*O<Ndzh^0Pm+!9#h8d=10YC63iSQpF8DQ#<jEp!>eB@GggX7uwX0
zMvBCtdZj~WJ+A>uh7v>hXjL(?n`)w}TX?TSw`VJ-f%zvMiA3CF_K@2K_d=n1#j_IQ
z_&U%{-<UAb%58;esD9-JdzLES96Uilr}cF$FP-g&rl^rA0fNa|;p?FYE4zgo=)vow
zuV;@obFD9Iy&4?YABg9^l<GTDZ60}|nvvR=tlxnCdh2YpRa)v2p0%df3xe>vLU#{;
ztl%$w{t~8F8<tE@oX&kORszpO9W3rU74MGt3NK$Ioo211n%mR=XvbpUQ4~D744IO5
z7&ZO{sn}_&5!l>x6rjV{WTOqq9Pt#0=gppebr1x#HyEnlgZX-X&o!POzIwKHR)2qS
z0KBZf_BD*)6*F9L-p85{sQ}wP?G^U0&aqioB`YbTJ(iWS-DGPpffdx7YV8oZhuv}7
zGnd+0`wTRlaaJl3cXl05!7KwGy=*oX+M+a(6Aq0y8_%y*oe+~0Z+OMV=Oa8T%koU>
z{hisk*2D_=$c#(Qc|jVt__$z*-fnEB_0@Yg^s4E23^wNViLZPNa@wO>%Sr9VRa@{g
zqTWh0!E>Kpn6pR3?aEGXMxXrDrj4|tu7`3|cbKlG!n1aYQ8)s3*7j37$c7${DZ<#)
z5vpWI`I~n@9k^I7W9;3gHsxSc8IfwAEn};>6r#LFakL^jSt>cc^=tU(oeRUSbzz+s
z&2Qz}ifBYg`7HG3>fS<zzdTTA%Ci&rbn;xTc5JJ%d=e(scsBSJ-gKFQr_gXn{?p#H
zPPkc5gmKffwho<PBPv-S1SU`sKyPs+2*ns1RavW5_Vq>Dz%vnumK5Lnqi=Ttj2il|
zdf+syX4cqQDb>@kL;njs(E;~e&|WR;yjhL4#BIwy4@o7Qc)c){jgVtcy$aVnE!B20
z$JNf#_c&}gdz1Rf+g6@U_ss;*Jhd(!Fid&}J9KxZt8ybZwL4+KXK&&QVVYpWc}4w@
z&`D?~YnB#}BHzBmbG5!*xMSmy?x~p9FckYdTJVhmV|hcp;M?SFdlb1HbX{uv(_`|j
z_tVfDkf*5I8800!p_UFhPl~|v#yNI<9l68&b6)!F!fb4lq2$DsN{9=?%ksMAB!2iz
z<V!paltoasM~LJe@vSRd8p%D1a$V>XVm(svE*9%Fq(pG3`qd4jNa~qAx1T#Wjc7d?
zbaigsmGZtq2)AAl$j|yNcr@`{XV>!UYQEX+RG(d6DeOYkl&W~!=w7d-e%-rE$d)z`
za%~;h3=yGjp2iaTQ#(f!x`&vtiJBE~G+3N&6nHcw+_!3HM*L)o|EB^<NjKT~Y}ocJ
zLJJC~4oc<bQK3>ED^m5GNzwZB=Z=NF@@g+=ynJ|mjpa=9%YG-WSF2XiL9<Y?R4Sf?
zXRMa^>+<Z)rlWA-rvll;E_bs)Dj0Utjqrk1O<(OFu0nxYnwsv90;O~w>uk=W2Qd-t
zR6S-UM!Rhttx0YNy+>-*ylgFWgA89_1vgB(29Uc;pC{6Nc0aCUYV*#5zBDa*LKjJ%
ztDS@{!3um67dUQ%Y*cS>!ObmeJ^+vJ-P0}gKwR{PAPZx5`%);Nm7}bs1fT`bk>JBy
zgxTFrtOYJpFWlZhk%4Wk#O*G^Y1BUmWC`B3*M%8xW7(b3^D@Hs3}k0iRVYn9Tml7;
z6%pBkm9!u|UMr2`y^nl@%vOolH``LTPB}XxJ_6;hrG@HW$Cc3keg%-A+M$g;dF1Sz
zA!y1(IV$pV(BZ_=!KY2@9XPclm4BlC{X9o+(4Mdu!<S>1C0i#6^q^R4Y^zp^oPCEZ
z0vl~@${BI<`zX@F$+nh@Rh>mey4h24N;2N3#nb+-mRlwZ7NK;0D!7T9Nax5NTklx5
zw@q!v+3e?cQI@xj8E@JIFQ17ymRx<EwXoib<9!tUn7p&6U&Zi`RLbn5z`hrRyOar2
z;^{ZMHm|pC!Q0uPJsXODpjU6}fmv14XsrD-^;VnUWU^^~8nKh~%vutvS8J6ppLi$M
zJE$=VZ!i6043k)#P2FfO`H2hbsGjywsf$p!A!pc0hVOAv(UjQEowL-x39fLlOPJet
z6Vf;>yAOzFr)#OcfweB;c8_f=KK6Z_1h=DZy9v6t=`Bmp9D8(U-6Lm0+dPqr$hLh5
zeUKyQpcZOwR;@ZTSLb30AF|1#xS7JX=ItWFEUoVX79N*ow9L{41{K(Jdhw%HXN5=n
zM>Jeic7k4tcTJ@{EmKoH+}Jo)ee-P~l%wVL()17LE0WSK1mS4)hM#EUwZF_*r#?u~
zW*@{pq(DMoU@K^Tk{l54WKqNK|Gb>dcWgLR+$5QI6cW&v!oe8MDJ{PYaU%cG9)RiS
z7J#j8@h+)yVnLv?IpvqwX!cUH>*>$PH#mHuYwuFo?z-riLjpunbgj8uvg&GVA7rN1
zHMm}rw|-Lio$#lll=Wi*Qd@{o$uPyp7mrvjeEH8-sP$6L`DS8i*qX%?L&ZmqU*<ot
z`|qcKeCp(Q+2f<dUN%dI7GAwQ`|z7s+G(l7<s@l){1L@tq{|m)fgKR@jxOU-&8pS3
zSY#Qn;yll`GI&K$hwnJTPO2JLEfqg>?CbCl621CeUq#gG^W>=alB`ONEg9E5fJykB
zO+;as$`RYkK&>;S0voxTUprF*gn5MFsyZsVt6TErj(EyMzZuU<tgGHvm$p|-d<{-c
z#c%3e;=IUdH1M%b_^~MX47^AkC;XtyYpEO9aQr^C0`mP}QVJf2ncewyX>%xQdWbhP
zFUypfVH_zRnd#{sZW^(Yv`YP8mDdJr=yLj#6@3JO?C=a0IgTmaao%R<SRXj|LB;VQ
zV@O-Sg=@t-C7QU0DIF2cDs;EbV8hR+$;qiN8hW3A2$Z|Pxi(}zZT4XS=KWXL0&3bl
zMM93HdDQg}=<~=#3hbV!+!m)qN6x<%%)}8WUVM0)Pg$vL?*iSOT41@7WlnvD!Bf}3
zaYRAE5h$Z(j$mhn2xQ4EfSv^|(6g4%b|@~=InU||!=~a_lLO<oUUu)Y#@i;FKIp}X
z`}Ni}T=&AkaFuES^vn2iN{Wwu<>#39nw)Cw3Q;zmRKLx}Rj_EFGaX{GZ{^k{A=OjP
zXv~II(6W%Ra8vLxfx(lM4BZ@|EvAnP;w{uc8d9ka&pM0`1K-Sq5k2>1Z77H@A|HKS
zMUc2B_Xm_0sfzs5sQN(gp@1m+D;Fm{QTeu^-8Ua}CVyz^<~iiaDgCH`y_c)+qTk(=
zyP4_genh$NzxT^Xzr6Iw))>28VQ6`k(DD=JRQpZdgn#n28a)w#am{;OdLm-=(_~wl
zxhw+NiqvqdrRytWRT07Vj$JJZAO4So6&{R)^Q)xVw9n$s4op82l;FbPatj{MKt54G
zx19spx9k_Cs~+3Q@5yyXjP)p)ggv@FU7@q}4YFW)BNOytcO5i7zfwu)O;tWcT8@;^
z$}en%65HUMzqN@UtGAV*`!+Gz%{O2Dvy+G)x0b)sIf|iRll4*86T9th0ELU73tva%
zgeY&8ZS&Q79+Bf*8p7(Bw1pJJQp1xKJW$npX}SQi7%Fk??dWr;Fr~S>9rd4fFo`Ca
z^*ZFV@p|?)t-f^1ppgI+mi-b`Y>|ar=W;@`c|)5uIZF00W%X3<*o^v!aPI>b9p881
zQ0EY;P@&%}u1H?`!)VGBb>#VbA*dxf1kP^XRywQ{p*1WV(bhwcml?TE=&uFp_=w*N
zitQJv1YF`KsJw7|TeK)SJ{)S&nSzNyNA<PneR83#Wg4b{uu?t^eu1@-dwaLm_AkAy
zhbp$^!K(swm~`mRf$@7z+twu7k9f!o6L`51HKSm21J3w+?dg=%Q}A;bX|DhmzcuL<
z%J)~|2)BY*f?yjL8?J&a%r@i=MWyOP(}3?CqK^z{`GiDn=2_rYsX)+F%%Yb8e2%pE
zHVKOhq=)@B|Gep}D?*q-oynHI9$4q{ZJNT8-13{K>C<@@QF|ZhkAwL&waILGZXMs#
z$u9!lE>*hnc+A{n7uzZF&Zg4PVqYv3yt-C2A1ue&8#k}<NMky)rI#7&YKX4&@$EaZ
z<r=XS6S0}Lpv!5O#F<WcTOj|!=8KlRv0suiP-=W|3(_K#skhQOO9!BVGR9UEh(281
z)-8Sf8L8HGur@v>Zut7h9``w(YQ(_{81dwZrIHZ|s7MaRE(!+u;&m)6eB$$&VJ`}0
zipRqU3bC6T*bWLQ#ZF)^k^R~1my<XW5fxAA`~|s*Pc^j_Dk_mk91-4=<t!!hgh4Al
z)D%Rzi$^3(s39g1VLUG!eRkr>r;Bh%JHyO5S<hn*xf1gfa&stYH^Cg*-fo%-AV<f!
zG(!fO6A}hWrAG(1XufN`4;VpvoL~D-<xdo~@5fIG<?w&N9FaA*Y<>~>I^NP|?u*{m
zO^l8dQ7CojhpBu!ZCt?^Sv4KZ5FMutD!QlS1^)C%u{~B&cH-P7(m`BW|4&66Z@+;%
zV~<_JIO-MJn`(_~1{fru!(?@?fV?zOH9U9K9n**}9FfDiI5=j;C_bOf%?~4FGDm-6
zRdFbO7$RSBGWM|2XEt_t61AReg;v)qE%P&})=up%1BqIsEgg^;Ww~k2qok_1I>I6}
z2bDP^URO<Db@A1L$6aW5A*_YQ*5uu%%e{E7RUD28Qt1zJOH2WorJK#F0}t~iHsH7!
zw8BFkmwWo6RXV+WAMsZ{y0yG5ls{Sd{S@z3y`=HDtZEJ8dcQo`LaO1#lkeqNpk_~T
zIf+^!B4yn7YI~r_`d2nE)ncg!EN%4ykBQ4`g-iy<Ko~^Wd<Vjomu!-Dl{HU$>Kz3L
zJIG-clHyPXIk9UWgxriVCP*6lk;49$8(g(=q?SXwC2{T+y_=cl@+L(FY3Wn^I4-XS
z_(N;vdfA<);$?8*EKV$Mt&a*=*j?PI&W_!8tNtHl&GQpUxYdT3wsk47u!#aYmsv0#
z3-y1z8dnyUs?c~%+P1RO_SnQ!Sws%*+2<cY_*>}Fz~*L~sZ-f5*tA-)lO~sgAuik#
zoP=Gw7gMcUx3=o=E`3(~t3}6Ckqd?K9nG5$?;Fo%#*bE7=&LK|h!2gZGs<+SHF`%#
zs2LW-C9+ItnNI@RUPyCbG5(yjWLMo6-81UnnF5&R_=p@0P{qvfr0YtQa8MU3KaQ0Z
zbi;Tp7Dv+2wq5P@5eJH`BLAbkMcU$-Ax44|*Gc@hsEYMb!2Hhp&_9Gy47qo6WI^{V
z4nh!1wFvFdsE1t;Q!ssdV%s#eWgR7kYJRu;jTgQ|(R<^Csy&mpjCB*3zk3A8hpmL4
zK>r96?1LhLrcQW4cC$PXfl=Gqufc>p1AiV}k|I(IjBx{GGD3O?ny@!2j%7s9kJrqj
zQ#7Hy?HstA0!&fQqA|OiA8hhnWD4j9b5-xOxeKle&y8CXZ33TA;t%z})-I+ZFa}0R
zNhvZPHa=^`?V_?PQ?-!VCkq0!8NAAlVmk{y&Y2#>cKWoGaJKvtHl^3ap{G7~NCfy=
zKkVt(SG4XneMu!r(jcH!QL*TX9U>sUAfqzzU$OCavQ(|Ngv;PstG%YLUp*{~^_BFy
z-oS@0;V)i8r3iMD9jc!dKNmfqeh_B+l)t}Dc$iyp?6UZA1_Q7APSqU#2RywZF`%f_
zg_3(5uAY*A{n`=r#w(I<v&CY-w}2x4Z#K<umfdDtq}+CXjN_}~4fjQuIDO5h9q_TS
z?eeEs<lEUe>vf@~X%bF+go8tjt%c1lqXAl0w+?<v4NvfG?{9AW^0RNnfBSb_B>%=S
zt!(DA-Erz{x|yhQZx_YKTgxXTjK4~Z9@M_%5qX05^qFK*RPwgN^G;@?@fpN-7B^^|
z{PcB_czMc&4AIJlUhjv*UTHkuCaFA3L-@?g8Flt|(h91-GJ|70jP+i4W;x4-2k`8P
zzGhwN=`H>q%yh?Pel+*K%%8}JBOH%|j#}SBoS~q^BiNP(FR+tYZjj`iweBaP=4Yg$
z1sW?Dc1&%Wm|~0Ot`aOC6dOJh@+n2LfyQ+l@q0~PKCH5w6CYtZWyyP_v?mUB4|vOQ
zVXwEtTB(D<;pfhVUuEWc7%(3Ga`eld#q3k!{0?F~CuU|DTn0Gz_!#xt8o@iBp~r)A
z?`zha+wUfMLx4L~i<0a9<#;a$+^Qs(m!qhuK{lL%mmWb$?kl;;pOnLYoE^#BK9POR
zJ#&=fN+PuGzZS!3ToT`zFc@Mg!DKKRXGf=qokz%*ZfD7zX*B!TNUSq6o((kBfJ-BO
zSKtC5TlgsRFetr<d_~>soJsCE`-fFs*al7SKt8oo-@z-42@TMSHiE%WF=)+@L*s`<
zO9z273qKA?!LE(B3p3eGteQ^I3y#e8?Gd?&=lHr#IWSoQt@or7n(REvF7lKvRe;_K
z7D5VfuFn_<N_qc|V3rcSrJ2jd%q7Pc<=4szUfhNJwS;LGJCj28w{Bk%<rsMQ9p)|$
zrt#au$L!<+GG)t{3Hj}%?}`^56N--NKEf$ho?A7EtT#JB6xhbFp2{A&LrelEsz-b)
zLfQs?9Z_qvQFbI?hKnU0X<K)bvByfK8bnI*=Bhm0sWNGP`7>!))1OGK88b3UC{Oap
z@@R1<NzI|Aw!hvZr<P$_SVYut*^g04q1bilYlNe~mr&ugO<ZP{VhjG&M)t=;7NS8F
zwBLcY=RIXQ++W5-gkBdChCK}CARoitJMLr_n&}d1h%uXt2?5UpU)DbvTh^fKFAn#|
zO&Qm0eq4$%@RO+Tk)C>PnFC9BH@kae(E5D$v-Co0Y0<Fi4*~ocg$v)4wuiE&*nFmR
zWAMLurf%cV8%geZnlcIRIbpsZbWqm+;Qy7sRaLwkZ(}b54@+D;*}P(7QhHQZ20v*Z
zPr>LZ6BZL8_0X`*#Q?F2QjrH{+Hnb{Su~EvXy^l?JnE(}<u?>e>x%Yoo;j?OLSOHS
zsQXIWeCP=x$;oz}CS$O@>8>szmx5^lXkHT+i3zlQr!2(R)TupDnOJ-2l|Nu36)A4s
zfmBem84rRy)Fy=xMw1`OOkT|mg}W{v5$cCMj4Gd(qu=@MHk;t`r{iHDIV)eD;#VP_
zU`%huh;n9v$dUUCOiqa_#K4CPY-;yxzFgA>`eb-7iQE7TeC2k=3Bv&~Kk?5VIzkkN
zi+?F~{AToOpBuxbR(_yrV#+jL+)kK9GtejPH9+bfgZYwrg(cNdCaK1Zxtw`F1Y5E+
z?z69j*0?;B!3F>K_#~LQ&zxJ~nXM5=nl3IqL^-~!WPT0USz(TmG=o#_KQf@Qj*7ZX
zi*iW7T9K#XGih?T!5vo!FWwG(qk}1C{E_uh)V8;LkS<O(X(diHvATFKri<F>-SNs-
zYBP)PE=k01B^<u_w$ck%r9=;l(}6ifHP#+LHnD5N?ZYwhF)x4ZRYraO>cZLtiClK6
zLlR{&_E5I?Fp2aF)#ME8?u{{wYP>C^BZ9y9eBD=U{xa6!c$tD~p3omlt#^r-R@?a5
zEATQp>(+N4{<25l@Ps~0{xr6y#<$Lzaz@w*m^@!wf3aWyq~n9_KKWn0I(6*9O~C&+
z_}KA-$JdpNwma1s&~}brf7YX5EE-{Q<mf2N&Ybd=^~<6=`kP0(81|()Z^lNi*c}Cu
z)|=aX-{%l_SUu-q9^=m}FK6<#0O$pe6NOqNh(*!!*MH^yjAN>Yy$P^O{OsG@gQPV8
z^mcN}(|o)QBHDGy^L=Tv$q-XT{5^QX-#h6cL5^e_i8*-E9a%)dt!otIKL$w4{3QIe
zoQ`ldPhM4!Ikqv;Wz^zMZRf%0k4qRB@_r|xcc{CCiQJs2y@g|_2y0*Ihi;;TP*sYw
zaI{17Oxuf;qASH?S{tsWCDDtIQ~pn@X8rqmenwYD?L_L^7@26EGUkYh4l6&|CYz6b
zbshZN2zOVkXM?6POkg%kK!^7$?tW9vy$SgypmJOj4qW69Y&JO=^<b)BI=_1}q7TC!
z%PiNmYgp+%7dR=sQFm%Y+(cyHF8H)<z3RP+ZM##{npOS3|4#+<mJ3@7dU8U195v6l
zX6>(0#TzmL7%xmWgT5N2=+KWRW@z^BmmUJW7+hF)^u(iER95$Wac`-ex8=M^p6>sA
z+*o@Eyk^V*z#!p>yX2!-7w_A&vRJtOlHr-eb_jvDb~u~jSM%MVEX{u3iA!@{l5hc7
z)o^HZ+r;|#5%Lfozhrp8D@`9;9qRRrT%iY#I0a)y`WV29@sz9WVNN0I_b;)ugu|JW
zr1cm(f_h4WL@qgrzeAH>6`VN&c)G;5?=Qj60Hghwo%W%?ciI8wPhH!;<)#|1`bYUw
zIxW~#)Y0v1oN_()1`iFB#@#*rJ=?C}2o8{Q=&lAa4S=y_o~nJ`V0m?Lp~xc{fT0o{
zC@Rfe!g0=v+1&D=#O6pRuGbmgt(^Mkt0(jKNA2%&#8?_NvzstSN9lbvEVdU0LOn8J
zdKnH8CJMyQb<bP)XA{C|ySr8jC%Vr3S!sS38nuKyws?|0=TM6MCPGy|Y>%pD<BX8n
z#MxiYhE^_Y`P;;Eu#8$3qItBhZ9i=J<DTCq_tA4gm7iFnYe%LGzj$F=4+sT<zX{CB
zb8{52Ml%OVC>XV5MGx2xhNQV*>^!0bPIKc~ILyddO$>>LFz%FW1r%fZ2Yj0#;&CTH
z?!WcwU&Pe=%pnp0c<AXCpsQS8ZV^<I6m|=Fj=exydiW{nDkuBTXaF!P-*u7C;lq2j
zHqDOS7j)0Y7{2%s=9ve`2IkP>mhhDE27VR&$R6mlP;YEZAN6~^fEdBb&cH^CsSaMd
z^Vh^vbQUz<)Lf!4-J*5e6u|WC4W89mDNc4KURPTsg&V8Mu2DO<uW@1-ilj`K5Slxu
zv~k?*m&a^O<M=SB6>{ROXutzpsrk}71dRG#O;J?mDSkM8#UQb~xmeQ6hB-`?PlRLn
z<3NoQDZ+)IIQ}5<)hH@5r<l3JNhytkW3S5o43AYer}S)tRgJ)n)|2?PXIbBi5)Rrl
zt?$eg#^u3}-AkwNWJo*`!A9b*`R!s^MoEcUGRSfhL{s58JD#I2|5##RV!w_ZSg7sc
zCNj@7Apb5HbUH&r^qS&Dz#j(vRjf;orzY+N4nLUZ9_mC^KtjG-W3});=3cLXfCD8o
z9)Ja&H~|}u#2`s>67XW<F4A>Oj3rp7TY@{iF^1OkvH<nm04@=%Ckbg6;@qH*hlC=j
z$Vhv?k48k;3-CLR^Dj+@1)J+*qP|rRhri5pUnq(7)+b^FV24xBKcIToO!|;Q@Yfg}
z`HNGyG3({1|G0tb+X*FeaFDJomQzgBn@6mVDs7lE$@o1e8$M}R^Nw>gzKwXJv`UnL
ztJq$tyF(n<ZF1tK<aCB%I`81yVG3fY$9b;W-Q}<cSL8>!O%7N|U@Wf1j@61uT-1ut
zRg%9y7oO>_9BzB`GJu+BS%$MJU~%1qxa+q_o|T01%VxW{haJjIOJ7wMm!8<rNZ@il
z{P<kncZP}AH(`riqtk3m_^U9Vd1Q=)qS%i4!8<?h1tF01<jt7`T|Gt1I&eg8)IYNg
znDQ>CG2}4R3z{L~Xq7m3!jMw|9_>bEBDLz4?(g0srt^uGgTlD)Z&~i<rpBVKkKbCo
zYrW(ENrMhPd2a(W?&s1N{6*?O>L3=|#%@sN`Hpd)i)rP4V!l$Fa?-K-A=qX5=<faD
z#ObnO`GxCxl+f(W&Y|nXC97)mY*?Q>e6rclN$n}UKd;Sz6Jy6cB_Mw}T97>Y1@p_8
z*Ds>)BVKe<8E<golTj8>(!|sbv^R~|KQ$CIo-qtdf#)9b4C74&2ESd?2*X*-?LTXL
z*$J$Am3sd~p6r+Zhc%P_qeIL<QwO!61uBO9*eh~-`(A_j^3JmmKfnpec1GOK_=pMa
zhbX~@GsWq{rF^ZK4U(Nt>(Fnw1DN|haC*@7`O*b^S03s;{n>q1@19CO%<jkTs=Dl#
zt$AOc3``db{|;@#5jl-|7H?jJ_E$tz<T=1kf5bw1oXBg9JRL;Uq~ML5FUja0VK71&
z98zEY?7XLSZQYnCH)5(`JA#bGGzX_q<{D!i&7q&)LK}SV9Uu8^*R>h91Ad6oQQfnf
z1|`Q(hfDie%u5Y33QN?9Z+BW38&{M)xv6p_x<?@FZ;E=Sf5v?2#tcNCk1?C~EWl!A
zto>0<uK3;{V|1jPdh31LD<+%U7|In!)x26S#8j&1q4A+KQip%e+PDD{a*=wydegR6
zb@K#3omQW5GcoacpMK`7|1;Z>$mm+V6fVP&N^O^%zTfC2GTS!XFYU16+U7aYH%^nx
zTbEbN!EM@3CaAzipkKR}hXN33hX=Guw)d?x-TP8rmZeCbuDuOR*;mKU8>Q?JfJ4gZ
zBTg?FY=sc^`<Z)LxP5sq%X<I0=d5$dT^m$$nW1?Q^~#U9t2yA!L*3x}79X#i-TVCJ
z6nZVZr)_O)=@?d=vha{E`G(a=bQagxLtE0Dc41PpTc<&g4$s?Z^m{d#FY=>*y4h1C
zb*|FdLcH4)no%9>TL_v1ey}4A&9N&vZ@G9^f<5VMUBi{-!nDYqq{k5cYu;TK-g@5I
zD0x`tN6oCpk#C3lfbKv(PUJ?cSoGJ*$rUDhm{L@+?EvXW6BE&Uia(sMzKp%(=cv&3
z=XW#s_DZ^Lw8iH^>`%-mAM&<IVhBElX0g%^VkF2UZJPA$yp?-;b5Ul`c-gviSdXYL
zXpuf#46$d7=7sCt9AVwOtRZN!oepZ%i+-UO&FCg+F?IgyYI;qinZb47JoB`)cL5}M
z%`zPXbnh0~IR8HYY(SI0x7WP??cp`QXxX25eR|~nq7Tjc@}{>Jxxec5%UeHO@^Isq
zx80v{fAsZB$A4+)t@)4dbpO&<eCne=9V$6_;!*1k-{a(^4}0jSFHidY@FN|4&ic~u
zV(lbt|307peLnyDeExHv&wpD6;E%WZiCAji$t4NJt^e(1%RLJ2oBp*U_c#4=6|5Fl
z!~&)vdlLd+c1M6-2frRKMQ$e|(TTrxqUVuh*a0mg2TKVXk{F4tYG6^NaL6Q>6p?Nj
zV4$KHwSbVqzo`fN7ede#Qh~#Jqa{=@YL<eC0F(yeF=qp77Vv<I`f?OTkS-6o<~B)q
zIJW__kSze{JAjd-7#UE=)ZaQNK}$i7aAxI$A7HLmNFX<(6qqvU<I0p@u(;q__XK*6
zLRGRe%`GN4jwtjb6CM>*rYNO-I9O69Aar1<g3uhJ2`N*^M5zZUKL2E9`34Apc!_N#
zrX&3a!D<L)_J*`?KpKHEg{&j6s&&5`AY>G`=`4=bwg5Xpbu0XlOqK^|!P%%mz-zNo
z08n=miU+u_kvk5&9jE~z%p8^ZjU<1>=&vLnz_n1&31gYF#NCyQjsQa;`xioYX^J#)
zP!xeA2|{GNwowYq!PrJI@@`4Kxw&ay%_3zX6@;oRVawhK3l?C7iAup-n3}-zgI*DE
zghAnG0OV7c3T`L}QPItMDZn})b!{jEJ`hfwQd(U_k%YaqVPJo{vUEA7H120olTavu
z67IMX0sHl&4$8U?p&;umDMb7_qi)yUL5y?lv5hH?)ej71$a<$RGYF+cf<*`a6r}+$
zQ<etv5UGo8HU**|(&^P&)?DiV*C51><R76_kUkM!I>_Osl!L_scoImn1K)A2DC1a-
z17Bdniy+xTX4YtwEi?va9)bX3R=pO^j7&&@IRj?^*3<@2I)q4ipIn|P_gY>Zqane&
z1?lL*^#k?m8v*c?Vma&U1?m@a3sI-rZx<AA4H$iP$^8yMZZA-ZniBAeq5+Ae3ePuT
z=EuFYFOBs{&KL)9AvjY7^b^Q@f^Zfs*}cb}JIu#aF!-<(8^U+&bDv5^s11yH)9vB2
zJ%2T%lVN=Vf^IZ$S93TJK-B}OK8X^B_o4GNa?}%f6C7p8Xyf3OISh>j0)`{@K6amm
zuE>C6Gb`_x7b2|*neDlO$n?v+d73tumgGg+EDT5`%(`Kiz?gJ40L#D6+NVjIgK1~<
zN4wUQ!CX+R12cfczpoijONJY&4RLGB>12mMS`o$-m!Sc+rTdcgv|`EZMHRGR<-)M(
zoAe;P8}c5UWbU^W^UH$SK-GxV8EdOyj&Q*h(2a5TYvf|TFW67(HLC2PmDu|xP_sf-
zDb$_e9-u&!-1m#8?Lt*Za5+KR1OE?q8!gZ0CX-ng_ucAov!X#D$m!y?sc=F;hDUSP
z1CONW!&dpUQ@Sh5Jdx2r8?{^Sq^oD{LDqY%o%(5`?qibRYXYq*t=={UvhA@8x6Xgv
z423Ut0#hI7s4KCd(I#Q}&f2frU<mkTr#zV{Y9NB8)P>xzC@5;9)s?8Y+aJuNCo8G7
zX=){nApgiV`v45Ij4VJ=cjJt<8A@m>Fi+Bol^i%&ng*BamkYVOfoZnXPq4n$KIlVj
zwPfV1UHhPU+;oL`GBo0{)uyfPHF&1?P8;#CZ?4siV9Q$F*vi64?a0O@%NZy*%j|gl
zG&E5{XlCLo3d-Nn?!h3Sg7ks3=j-vvC>twA4UI_YQ3?V)A2r&LM_ks>!N8>H*rsJ!
zexl1ro5Fl-sE@?vaXp?ER~m8R!D|)#Z^~;$lT3Y>Rt~bI>+!6F*d@V1NZYkJxacv{
zv2xWoR|kRe^>|T$c*roadjV!{la~%q!bVxtDG8;AOVX7*!wMQ<d}Sm739rTZh&*Y?
z<fd(Kydqw?crq6r!)Zo!7fv>rC2LspugA+V#Ykza^9LwWI<F<zk4F+2Jcu1`1y>qy
z>7>WoLK61+l`y-`l6}cM{a&)yjp#}P&YdJaKp0}&Q3&o}&di>IP3d~P4PI%&1^MTK
zti61F0giYow_&_VUrjjJhbcCu7h}(sIc?VCEJf;K(=aSo*ArWSatxC)9842@pp*i*
zNF6O&#|76DgM@OV{L%c$me!=&5jObMo#l#jmmXL}C1++k>fT_=i>|8&&%8M2#zfy;
zzZhh<U*uFG&&^E)2G+@p^Xpf;uYO7_ld-cn+Wx%ES;i<R(!p|kJu^J7Wz6MLV{^Ff
z&j)U^Oiv%y(K**M6Zl#t-58~Rl1zJjvuNgC=5^CB|MDrXuip|EmEo=6wu5(}1_VyI
zwDi?L1OGUvuFs>2XR}hDik+{tsATOF0e(Xy!(UI1CzLl$TJ=cY2n0ttJq)c{#~w@f
z#|d_Qo?)$zY^59hnYF@zp4jS)6^(n!_2iUBd7H4NYtu8N`*W2r@4ildogH{RIVy5V
zLLthv9foJGg$f6RtgBIJCE{_ZyFRaVGKOjGlLqdL(jg#;_Sz|}=a9$s_WE_f1wz?D
z1<AcK;5euyJ5xRDFb;}_{<!8}pBH_=*R`)>zVdv8y<{#&ON)jB#r4E_z&#4=RV5eL
zQoI=MD69PvY2q>-x4tj_3+|JK^ZD-U$Y#4UMtdnn0B`w&j$A1GF)$J964B`OPXlop
zWnhJ!j~2l7*#tm^7^~JLCR)8JI7*gqR>|rUPZB=^=w7PHBPDm2268x-gJ}+5mei3u
zi^D-eSL>%?Rj9!OLjUC^E2`J)iBFA#7-S*4JWbbtAJW&m%t^k8>sNo?-+zFl1}i0;
z5#W-nAn=Q@oQH?r!`_(1kGxk%u7ZLJEqomK51;SF=hucb&1+e$(nsjvB6{F^e7N-o
zzeZPILupQ<RS7@ObXi`?F}*yGhhEATb%uHsOC3%zv_+6RYU|F(I*FY)JzvG26i>G`
zYf!Lo**&wt!BAfw7UdgX=!ssjrpp&N1EecudNtW!!k7kfuJ=_;y|--*cDtY`2<E`Z
zSd)2x($h{|uW$4=+0`093+kq?*^TvWp8Io;#GiEYs;25%S$dRR5375vNSUPZICJx!
z>xBn@&H3(1T1}7z*m8@r2!y|JAHRyJ7j?gv2Rf##!-?SlTMrA5Fn{A!KGUm?6ua_P
zx1ykhyC~P%7ufXljow!=^=5jnH4}%msDrYbu6ICIj{BJx`&{j4tl?3+fcrY7c0+~|
zS9ow|_BY<~SMld^nzy<8%x(9XBk-~N%#DZVGpG5P+Sx{18=uglgnUlZwRVe>6#HE5
ztN62A^q2w5MIS;ISP*5PzGUs)5#ybU{zNa{*Q;q=&B*TxjsV&B{~^V>d#3kQ{8<r!
z;XU_=K(kR1fnkv=A`qCwXAyyOy^1Wm(mQ%qKg@>Q{u1^a<+D49G`xyGD*)lU(F8X+
z{dOG%otE3e9VF@J@rN_D&Y}-gF$Z$xVC1Qxm`~XNa5}xw`zoehun8@P2>2?<Hw!Y7
zw(J6F6AX0c;f^!C+GvVG+#6j)pkBK5IT(!JMNwYGR2yT$2VRzmV3#bLyRCr9?6#sa
zC&86dy*fsHHIyr>Zb&uf`i6w@*+#z6`zog1X<egirhrvQhjwdIX9>N9R*2>>nDa(&
z#@vr8lSHuKfRX0wR5QHWx!xo3XT^>h9Tqr7Vb3iedU_ufQtFc+!Sm?Rsot4mk4mL=
zsi>6gFVRsK*x%@V6;rP^ZTxQFnK!Mll<FL9ohQMJnQvlMr+Nj2ol38><TmuKl_Z$E
z@9#ojFJh`Su<!OdFJoP*082wfjXGP)kQKK%3yhs=?oD%Pwm#}3Avm?V2PN8u_}iG<
ztDL$$yj9>1`O{W0FrOafo|x+471cS5#GPvP(P#BX=gg%R2UBic4Xk8ED^G)bukz0d
z{=xTB!M_~3hDNw+l+;zT_4zjXcd8o&AgDTs-7M9!_vM*s8gOyG4J^LMOEuyN)j$bX
zL@Jk0iLPk+l#)BhOTh6|qajEDxr(BE(~2u5hY{UTsMm28!tCo?{rDFc+9xv0cL^Bh
zo9jbs->D8*y*d0LGKw%F2<GEh!I%3_en_v7D7s|SoQ(vr6W-i&79#vKr217^mvTFH
zN5Ex$U@~E%cbgJ*@<!W>xb(V41%BPKgVU*k*OLv8(V3!m9=1JKOM-Q0(RGxLEVZqg
z3p!$*<DK3YaZOtEBgIodmr;vYf=RhE`FQAB*p7q5XKKOu&6Z8zE^5%YvzjAZ$ZgaV
zKGFIru61#Msf7{gp;cA^-tBG`khTW9^gJMas&zJ&6v8GqW9=}o&FSw36JCoqYG0(a
z>11bpG<ZiR2qL-Zh?BS;#A8Drfg4Xd<e5$cR7+<Bn24xzfU*TjL3{fyqW&zc-F(7t
z!B~W4#niht0L^GOgqWPi*^gDi&a9A2M;$i~_wJ-~gih-SpPk3<pQY3ZI2Oh_oV*6&
z!{S8%OG(*H;8i_|=%4Cr9@QrAlB^B^SOQ92L#H{2uTN0|FVfG#4g`!CxP!pWL)$av
z01+EZ&zxo0A7clORgN~m@=D*dqsS=DWYhXYv%9*T>wJ-Z7D^#m{u3w#7C44Qk0Tj<
zOKDmyKL#nBsML-krF2+z*b`7GRW=m|2Sn=5b-qZc6E#&?>Id0zpu@#M$&@9-z>l{Z
z@<(upGo4cW>Cl-|3xL)K3tmEJN*(ErRlZ0+3wJ?QK;kYESWKyE-t42%11xVRu!~cb
zsiRt%p~~_!EHxn&cD2zX&Y>JH($4~T(4|4|6vlo5JXn!~9t74mIm36Hs07%64#^38
z4G||mE3q;Wis)c*KGpdmrB1c!3rQk#y`}(WLHCm+yd@_{l2e`F6G%FV0Ho{uLfuIA
z%3uUATIV`nr1U{eQ7wO=MHb`&VZp*7xDJ#OIz|SZtAvk*8ZB}G8Uk^p<>li>b%ug@
zky51tf4k5MV?kr4&B4cnr&PBdLt{=<28%{ArZS?s&_ID%vK+`bJJtCjrA|b33TTw6
zy?{FnbZyi$diFKU4nR1kI@7Z5&%m*d?%uKR6r;EP#bJExFaF}z9i(Gh=#$iifrwD4
z7ak~V@`y@)a+sg!ynUFFvlmtZb!+NdqtH};qw_^dor;)1p{Trt&jpoONF|hk>W}d2
zr$EGsPSn7zHreQ-!VsYPD(5Tq%Qre-q>P!&p)fEiB88Qcpu1RoO!9jDieP%9D#4>x
zstA}PnOO8)6$_1iQFZ_E`R)gNpFL67Puc~<-$?uGub8RlyHHf2qwo>#0vD^agS)O@
zZu`+Mob<e2C`8IRGhzasS#N1^j>vjehT`dSbq}k>6~IevzjMs@0I!2DQMj+l<0tNG
z1xMi{96Rt!^DXe}Os%`DuNfM$;^fGjtPx}@tZ=ILU|iET3)=r`Zo~0;#m>_Tb3afi
zBhGPV=X$-fxG&>i0Q{_A@bt?H1ur+{iQ0qZ;#!+Gf(aE_vK3_N5+JFq$kJSy4~M9>
zbG@D1>lI_)qZnPf*96CDex)v)pydu$Va8&xo>%AyDK0CR1N0wd>N?^bhVDcyN+ITo
zbPZjxPzxSd8QRZyulHbcW4KP6u`VM>NV~1rZNLj#8y%}%pJDdi=rv%IC~g@GjEFdV
z^@Ay6A8)XL2POkS71OnLbCnJ{aR?PY`Ldx<7-GDG2%hTgRSgiz3ft9K+_AJ0)pD-%
zzzi!mqDZYcy_?R0g@g#|YG4SOOxJgC#527BDvvT_+uUJ}aF9hAr}0kdfo;2>k8>ps
z4Qwa{eFSj5ppWqNoI@Ya)q?T1jt1sj0(gWVNhpsHK2qL6Di2N!g|y59YC38k6yQlw
zR!|FQi7cLXK+7|=syw|S1~y{pMQTz35!?qd0^aC7IEE1!<=V@Dl7fg5L}iU@5Kz!<
zM{S)TJ5TkpN-NK?tV>?tthSKxAQ`szh|$;MEzw}8nMnf$*s@+g($NHfO6;YoGu|Od
zPt?Y=@}Nu@)w1BJsP{#!bBu-eI#GMzGbsF<V$*_eV@}2mR$2tBIs;uM?|`ds^hUv1
zeWD6tX|Sf{he0W9d5ecV@Wc@E2LwM`CdyPGq62aMGkTY>F!gsZ*)zRTun-gm2gPUM
z3uDe+z9>4n-l#ora23iiI;%~>lUD#}*%Z~W>E27$Ql9TXxo3)-6Wf9^T6CgOXqu&X
z^g`#n0sFps4zCrgVg+DElyWYlt~WTo==zjc%jP)-_)N8TCN3Z)DBTt))dos4P&I;X
zGvC9D4_vbg+Uk{qgoKLjtJwo^C3=^0O8W|%eMQZl>u%)w*pQs*HkWSa6XChGHg-7j
z8Kn8Z{asM!j&cNmIt$Cj7Ti~(GO_}B5vxm1k<O>8wc;4yzU@11n}vxhJ}{=}j>JAi
zQNIQm7P`6%o2{ZoC_sgmMoC4nsEi|Y^|{7~h1Ui#+}^G+S&bBD(xgdvjMwh_$NJ$f
zgzx&CJ|AG*is%r60>{wq1088dQI0P<ya5k&s^a=p$D5zh7iPT6P*gR(uK3khNr@gT
zKm8s`{;E|MKwV}Ou9sT5{!r^gxt<?rJ&HFLa=j4M7+Bc~hgjpguc&D<v-Stb^>h9B
zK64@CX)f=``1D+l9l$WXSAP`S<sTZ%#fogVib=0Y-j{Uv?5odD0rRKoeX^1Z6&VTz
z?|}T^(v1ijN@V>Ikbe|W=N~%Q^eg1w0P7lSZH=i5z&}!&e@Xv%LF%8XH{gL+7BAMR
zz7YR5xHw@&@2Ga5Z`B`x7_OD0;tLOuj=BN$X|<crx_k^9`94A5TzSksm-1F@4pg49
zdVb{CC(~*6!2w=`aujtcdGAA(LDPM<D1;00+Exn8SysZS?q=d+Wjy$9ETLAc?HLbP
z2i|8q9N==wyo-Y6Sae(Y2NMNQO6sPyKAh!2ywNOuZ=a2b>?_A2t&|{H`9~=h2jC~#
zx)a6D%8zApnbk=`t#U_&T8_7w7pJO6D>xeyd1Yl&#E7}_MJBO_Z*?DG%+^6=^zuLf
zt!H)2Fk=v;2nVL9yv_DF)gA5T#`CQFypHI%jPk~bDIiPlbRR+am`j4Kx13}M_pa2t
zKKp`7dbG-gI!iElr#dBlsjkFGo=SoGSh~rr{Z980Vv_O}-j@SSSv-%2W}USS!L7#1
z5a&rPZ*(Iuayk8gvZ&OUSrJl72gtDBCd?cGQ|W?$vv~1kpn>H?a2b_>g-jAw@_m;|
zbE<oQf~4frg9%uOzLkXlX9~+RzEgdK|1I}X#twNlf!n(BPRkEOAoL)(_AGtpt!`~Q
z?%7zgmb!&0+|<%ma^Sh{BbfDa)A^17w_GS_R7YA6a+^8&mxSG~8AI<>Ys+1Au%v8d
z|5)F(XdC`M8|etlPI(7YN!^NdV5K*y?vDxZMa0`YrBmH)#;&E;)>7HXI}=V=z@zm}
z_fgIOziZ6OJVey4%VL{pl5=(P=&JkBJxq>zqdP$Xv~;(Xk<-*7_B=3@dwQF9b(ES>
zF!SElBS&U|<&kZkMe720eQJN7k9Dpa|5>^{cilz5y>eIfmF!ISQT_{8Rb*?gd?oX)
zb3whs_jY4Dn{RT!-slz<!YkdPxsvsbtk|Vn76$xG^--Ep1(dRGWkiX2TTH&PzDt3C
z?$2pwZ&jjB*DaHcRs#_?voFS^36S@J%BQTfFF*fw=Tt?>a|dn4Wr9RY66|)YLS!gA
z`b(H<k5qw$iwT|ezm3UsUj)C19knmE*kAt}F@<)PRCg4f`9=I;*!$P8U%lP2GD%rQ
z%mHlOhxE$p`+9ldcbd+z6NVMt4Nyv{I|&#(xs~Jql3V#YBw=7ZTpMI^qE*<t@AJh-
zJJeacWKV+Jry^_T=xs!`0oEjD?@O$e7W@%J+<_uzF+tpxAiCXVw>=9iNPz`-Ws?>D
zsk1HW5QX*i0=Jb{geAb6uB<FyfYdoyVtMTgI9CbE5zor~c!ZfK%)MCB?hc$7N&$?%
zC&D_8$D&B3)qNAV0bi8oa9J@wVVNq_T!QmzrS@V%h_cG!+F9=S9z*&?tc+Rkz2SBP
zCUEXMMI-;d82IU8%%?me@aT;?d81CC5I}944%_3gIS0zZqoS8&Tba{$yp|#NdrygB
zmOK?i`pw+chQvn{gzqZ_{1KOiqFA~cUvOWA<60z(4qLe|hU_yzsk2bYr{ot0<JIW<
zaic)14trbM$}C43ra-6?wvL8(oS|>1$<}Jk1Tdl=X0RAaE10-2uz-TkxpGnNfJ!p;
zsjWPa43r^8C5?)hf`LMDrT7LuuEjQXhmAUle7CffK9S&zfDmWlT<H@qF)pn8HM94p
z{0Vqoyvgz>AZb-mA^_EO=%%C-BY-2JbY!e+9}vOF9hkAM?jnXY1XAr$&Vh!ae<af1
zT5?oAB^Myyf%OsTvx46g6Cb``_`u84GyxM*N=2)Czkt3W&*GsW{{(BcL%Nzl`iVqQ
zc8S|!*4G>Czv2BI16ADbLev-+8K5t_$!_;)L=fSQigx(E6iShc!M9$oy_)>e;>Nsj
z0>?Y(A=pK5ze)keCk{OKZhPr9lxr(rdmsU~u0{RH<vPa<oe!Vx>z8w^u>g^fYyxqS
zx>f{990*6SdY(QEpQq6?)O#_GB|v&L{IK6mUJ3;8m*M*~dcnld7)tAk*~57<S!#jK
z7NYg<bLVO5n6qRtW|^Q!;+l@iKoh*REO)Wb+^2~vwnK@B#i%QL1PX-~kJ22E3&+#C
z(K^fB(FcH%<Xm^0WTHga%=Cw4>uJ?WH7OvOWjEuMVRJ!TL1-Wki{{gs3DT~WUk$o3
z-mHrKhcRmf3(v!v{j_BFu8V=Ib)WTU_(uxY*hY|V|F&g(*)ep>LH7h%#1b$<*7y@E
zgpZ7Y(D;47dfKk60SiGig?H}kiY+7;oTE8>`}fWAX|Dte;m+%nvnUNG;#hq_B~je?
zzE?kO)c`RRFBXnMMG0sFk1Rxuf>q>hDLfepK!+8+WQ2L$Ev?Ct4FTTnZl`=PQ&2on
z7s3XR_yVmbDqt;Oo|cibtfVI+31)b~Z2?m!oLW#3bpgt3@zt$miMCmiNeI3G*l}1-
zkW4oC>*-QDh9s9VoMX#v)zuf4aDrfJ1?gYfR}u2w3dT9Zd6Fjy=O{$yv=J-Ff6zH}
zu7a;?E*KW6QP8>8QE9b+oJfJW9)Fwiw+|Z&G}^nZ5Jela65@$6C_nDO(13VM63O(c
z3ra7(ZcU;uIIqMY7xLlAgjhnez;g~>MB}xZ!wR-$5yfeAI58jwa=0+LSa5k|z_eoz
z2q9_L<4Fne9MWnI^)`V^y<$?25j8cMs*?`pa80;!`CyjOAP9=DYMY@9av@$c-Ru5?
z6$xTwCKN2hC;f^BUazs>E=Z%RHXW>n6enqQXv0-X9u`y0C<b7$2nG-i*WxRUIE;bf
z^HApHvRtg1F3u3IAk5)bKrwue#5aItvDd>)I+u*x7=JFU2OAN^Q>>sH62mwG9Il&D
zyGeI)ARTXm6obMzi$=^y;frmwhg4`hqlIK?IM|0Fp4}_Y$YKnd%EE%Aqxd`(A%|Hn
zc4P`%X*cMIQFenYe=SUm#w{A*d@P+MJTONn2bT_m(O`HMI#kKBjbh8NayqCRdr1#W
zqLLSo**5`xfUg3Z%Ax}9prl}C`ja*G@Y{hWu?%^<=!)X%$k6#Jz2B>rZ3SyhTkMaJ
zky92gEhxnGvGvcvTJ)WjGte1n9IFv+u()~Iw+#C{cI0!=G&V$Y7k4hwXfoFI8fGh|
z$xJJK{G`vpOD{msicuneJJ<CRP3F!frbTjhd_<sJdakHoTF7j5d8UrVNrqF-(8nQu
zeIDZhGQ5fdwK>Srz>`kzxj4qg?2Nk~pOrW#2Oz)|>B<lykuXz9*~sG-f*j*<u3w)g
zyMU{D5kzZN{LmRD+7E&{Nr!oIYNQ-RL36Q*O;Q(N&4OjNNEd=T{q^MN3VEVnV8xfr
zBld+e$L^MNS%iwm=Vz|cJ?1(qXZDJ-+6FqN6-651&FACde|=v4J3hay6TkGe)Hl~f
zf7N`@%W>jJfIQ81*ERM+b_c3yX)f2Nf<Lc6Zh_b5J<uBM(eitcf0A44?7qA)pp@YY
z9=lVxX_v!=z87h_!nac+mNOW9+G&r*!1dW02o+npk-Xd%`T$H(D`3&m7Zu)-U#UXW
z%n2+vGblPMU>q}c*VbY`Iq_}Lgwo)*pb?cZ7wKIawMY?V?>Qe$v+J{MW-*)Wj@YnX
z(LEjJi&SZj$zZ^<d++xm6?<_hB5BoRR+Q^fl!FUZ{NhkNa7e-zXF>`on67YGB`Ky)
z9Fkvd{~5ov={}m_z>Jk<i5Sn`WjL>#J20OW3Ti{`9#IzdVm#J$>@;Q#)9zg1tGFmr
zqR3^-Q97zkFjd#IosNj^siX8<Z?@fmi;*tnf89fH6S?wll)j29V;K(EHB%<6I3AX6
zF@_N_O;4S&r)nGcJeIS#cPq*VFznC$S%}7+`+8r+E4_TDXoBClPL<Jo4;~@ae#jda
z@VVNdH@&gw@SDe)jo>ZIcY0sN)H|@OtsrI_#WOH{&Xu+iE?A|`9M0!z{r1gbih8LP
z+ar_C`1QFT`&Il&_cp*)i(X8)l;T|EK38zaGU@L;b#R~Qo!a(DX)AUJ<b7pZJB8^W
zwacmAS26X%Q)>H$WxZVYF~?jlA*hRT?omJ2>ps_Oz!%xrl?ei+<)>FK-~EZ&S25Ls
zM5<mGWo*z3IQEJ3wV9)sgP*$Z&((&m5M-w<Nwr{JUuu2Exz;1`C&UT@ixn$?pNu{#
zQ|$|olU_cG(^$c&-aEONH!PFX8@4D}adtI(qxV((S)qvq9vt;gt<c1XWe(yt@i(D~
zGrhg=o;)nW@z29@79tTz^EFS-BOWi}&kBSr(8JiYP5P=42pMziBw)(S`IA7%sovR?
zM-M`#f~$bR6IEv!psQk(=k+AO@+$sh+~sx_n3=0(B5fBA&<N$5u*<1hmlZjgX*No&
z$qL4x2Ecr$_Er2@L7vD(H5?A8JA*uuwe%-wo3N>#2YF8QHc#DyN3;zXJX#<>A3=(m
z^Vrdg__IPv2%)Ty(v<RJBPVl3;(Lx!?{E@SI@K$4^qsN{^(3Uw@~hrXhf!<qf>keK
z>dlz4Xs^cTfN|3MF{+poS=6z!y$NESDfWu5B41;Otk_uQI{FUSlk!IGtN61*W}{+N
zsJf$yQNWN{GHHh;S+vs}ISZMcsvf8-QzvZzLZiZNJuA)(?~a7NReT`-WT*%^55=?A
z01sn)tznm2SnHVCDt>hwqkE$ozVKBmC_xHAB`!Ot97QjXH}fw1_bM;dtgBW8V63^5
zjHY#xgzUI<a_yXl1<!T2avQ)mVbWG)u+fJJ_l>xbTkKuL@kRbw@+uAn9~NllO0%LK
zK{=RE6<{6)B2P7<8q|tywh2z?ifzv2RT7jRP<t2L?CX2|+~1g)U?7=af}s|$>*rB0
z^h8hK05Z9U-tR%ltETIF9_o2gbM_N4!mJ2v3l_nFQ2UC(vVfGoi@`qYa}?5G%0`28
zs`LSPShb;A5bJWT??qgC5sNMAF+qr#odNV;wKKGenVrXaPxb1MDn*r@zBGCp4Lbl6
zKxS>F=P~3Lam@}eInkAi5*=%bH8B2HNeN)$<vg_fMsHZrt-)Cqvz7&ED7nZ5q$!D=
z&O_EO;#!og;XVQuyptD;%V}!SkAd%To(Hl|wbBR2H62BpYUzb@c$L`#kC45Ik3UOm
zmA{dXMbk2$5=@L00kB$~&tm3hDksYl1#;TB!%^uRRpe_RE;Y}UzDTJw5Wpy^uuf)t
z$U12F80vseZ=Q$ePjott>J{=AEuG-mWs!4aS!r2=$2wo6)QKGWDk$c_=JR`?%$0hT
zhH+3|o+1HGbfTug%Eoohcqg|A13CcR_#1G+i<Bxw>BA^akXBG5H2@?kbOpcTDdONn
zWqMYS3c>8MoJ1T1rL=dE%l8Jw@GSi-Y(q$8k9SwNOL>$CV9|Jz0NKJBxZzYMD0vGn
zVf0`UFJYr<YKbr<>l85YBIVg6jazk9<H$NSMabgQaTCIE&TtebIwfX>GA%LDs8d;y
zg7jl;owJX1zDPd{u`y@GR}*#dc=A<845D}n2wXS=Y@DcsbDP)Z(DgYar?piIYN(&9
ze34QmKtmPVZVgF4JobazjN$5*jLn}QLr!&)sJt>DXeApko7`5A0AW@xp<}Sgi<I68
ztkT6JBreMv6W*FFjtwwApF>bibb{-kR06gDjoN0F##4}tjB|}IQfdUgrvMZNB4V~k
zrT1bOu~}S>XHb_DonY2mMfj?=t0LJ4;gO=$_X6J>>wJ+?C*XBvi|C~lfOcR&7FQVZ
zcjOFIbE-3Xt1lc~31Affm%-gjOl*=L@(if+BHg)qi@ppAn~S-a*kqz~yLp_0cTO~#
z_@b@B*|MO&DCJZ4x58ze>3oqEv!+aM3$+rhN|oY}QKT%ht@^SDAfZ!@79<=XACV9G
z%{w5e^^`e4xqAvcdXW}kCF)$<$j3U{6w${j>lhQsiKlp^6P@bX7vLvRc95YeI%F$S
zmBj>ktn)=$y!Ob>s{09LK`bR*78q(a6w7&nGo9-)7P_c}1T8L61*U5upL$ebgC}M8
zpPxVY8L*PIu>|MkN+|DQ6ML_<w{0MyYVtSW^MHfN8CL7@)}Qm6AjkENUa_i<y{A`&
zLj?c4ze9JuC>-K*$DZ|t>@u-ck_4VXk9P_Wz7J7kRY|M{U_p2g;_|s@_PmbHXE3sJ
zy+g^QO7ccVqt^^rOl6n>Z}lFGcgAuTx(t+LE6gn5ciJh*hT1u1?TyyCc#<Y6->l?o
zwe+<H*s2D10);zRM2L_B$abd=Q&~JB$r{H+9Tsly5OQaF9kZ$Q&RA*D4)lIeogu|`
zywiKIG%rA&Re@HJTiDzIdAUmGNJKx!<DIKbK!PuotzoT@hCree+gbplFy7((4)!}@
z6s(ULV~!ex)m&ieYL!MYfUfW0e`k8f7`17Frg?!XOoq2bLW+~>JG}>X1jR^1<6^D8
zBPt@hRySxP=h+*);fdPtK5f-Z8sxYmVpv@kCs}jPcX|(uGr}8F)@SP-?4<=yiIHWb
zG)tC<I)gW!>)l5KGOuE(wdgg_fm@&Q4mEjT@=`n-%^&2%%+)Y*>o2-tDTL`MnDR_*
zP5_(Ax^IP%MCyH!ooOZFoohWfMi6bJ%phX+w^y>S;gn)^xG?bA+dJ&$nO+eP-b3%G
zR95KibYVj8$T8kyLSIj3L|C<GMVKZ-N8y@QG9iOeUDM8yqNi%dlvyNd0@r5sBvv#n
zIDZ!%`VN75aOfqdEIk%|m^p*=!eSF-LM6c`tEZd;Q_u8<d)1DfNTDh;o|t9WWid7Q
zd<%GebtX`ZzAVc2F1|2uDAuJ`-0rQ)Y@Xs^&-4ay$qaKz9}8dGrMyEvkbU+RUi<2y
zA$G8pmlw&O;X9xZ0m(w$A`i#j!ER6VdOEV<AclLc-WZPBq);TPj_Em^_to>YP`&`7
zG0f!**D}uKh_Djn+i?<ohw?pBobIEl5QkN5Q>5l}lK;XZ*k)1Uohm+XDqbtn1@J2a
zT_R=LG14`1IYmKRsBd7!r>X~rZuw@BL)3f$Qw0^bD)neAAoZE%BcE*nnSH4S9-bMj
zl`1v&R4E~5;1tOGPIYp1hl@Si&>bTki}4HweDCiu(g%L=LI`KC+9cV`8GogFzoWbz
zsl!5Q`kiB^&vkpnIIsv;oh(Kl#^_{Iiw>@#_qvbb57&Fv-AcM+Y2aJd-AcOa^8~Ja
zs&chUTUQ3oS5{qG#dKy8D|(Iq@B0V)nZL(!>3(S^l2f|3@DsrJv8n_zz*ZOUHvzTY
zvX?P?uIu`&?41Dl4HXeYBT00z_uUE<wl2DZ;7{@D2YRc<DD+zKt??@tkQ{2~;*or(
z_9%{71DZ340ahe9>%zxRMt~|9n{LD2<Ky4xx8f54{vK!P1)K*<Of3ApwfK?#!=Uk+
z>!G?>#iI3G`lStBm9&uY+us87-|B~Xy+ZO?<?FccbY{V@ewWO)cBOOR|52>I7H?76
zX~hscUuh-4ycgWU!PBL069V37S6NU67NU=(d=%jwiro8%WeJ_88ysLG){d68XvL)E
zvLkY8l~x7;=URWxvk=a8kG`ikG?a5*-BL9=DIVTb-YP$Wp;RW&q}9VzAVEcsGBZY{
zPk{b3+Dhd(OMN)i%{pd_4$Zvp){2k5bW7Vaiq3Q&;e9II!doAUv}}<1hEXtSJF}QG
zXZ~Hf#i{P_;(J2SuH~99I+d)R4BHjp?~U#wSXHHX<l<TzAnCD{;W75Yh#;Gde4F8M
zs@e(_3qBL1OO)#9>qE})A7qXk0M{r-QNG3I@6Ph>47*9O$FLssX#Gt_$s64Q1F&>6
zC7^VJyKzDL3h4PRTjdBJScf|Bcvlw7SouXp%A^HHWUan@o5gaf8?3m6U$mJm>v)Qk
z`kg4OvFy-0-A6D?X3n6p#SRf2TvnI~nPbuauuSRu%$ZZ&(sF%Eu-xxiIo&M!LaG+u
z;<@T0v@4T!P+o484=$?;X%QBCnPIgVZ&G#MC`L9!t}GyB!9w~&#vF?c1gYWuZ5q%K
zptzhsJytRih_d$dppkRYY9U?zeRj~P>Pf%VLQ&6F-mD}Ht)#=rQu9Xl5o((*yqUHm
z$~`U0H;9ty3kvOhEhFa{NoTr&hqFD|X<EI!j6s&?<?-wOR`n4$z8s}{qD07|*qp78
z#fif#Jb#k`^+xf|YK6$&w3Vto4GF$0yXtLb)lu?6(aCxnE8il>*FrzCL|YtaIp<vb
z;%6CGr@A%Ts+FCQ(syQUG6+;Qmw$EDzo<S+@mT);JwXc&|3#kM(!_Tzu@Q?M@;J%s
zjqbcrw~cULkpR>wUoQi^xBJ@!vZF+r%FRd3>6KVE>)?%Cpc#FoiUn9}-zJuw>TVIf
zCnfd8R0*1*J*Oz!T(p~Ks*iG&s&IhKJzHxppWwm6c15z<;vRTOD?8QL0Mp#_;G~)*
z1{C3*!&QlXKTK777TmeY(isN@PglU^0Wd2&k|;cXAy?Uvsy{ASnE^*(s6E%3{e*4h
zk4swS$PQx}shO~O=lF%3WpI8AiCy;u!>~D71YX*uD-r7De`%MmSAYAEfzMAah5EQa
zMoku4UTHLlz9ofHIlW)v)WBVU>wnD=N4!!dQI|W}ofYBO+<@y}Bw+V|d{yq*r(Q#L
zA+DVuBVLo*{i1E_y~&<Ewy#9m7(vOEMb}236W3}s?s`>54GsZqtaaYMF2LFt;M%ji
zlI5wife}$wQd)=tEvYD@f+O|UEk_$dvunD6Usv>^9miqLXy#%G$Q8AdCE34jw2Dl~
z*;e+NssbRb9bB}w+XkT0G6>-aUCYSLz|g*>WRKF@TjC2T^JI5Q$0o3wmE|?YG8}JK
zm4boUW!Y;$#?8DaMkEl4CB&IhAe5NWp9pXjWyxJ^8GN1i5fv^Y%SLw#d?5wNc(3FA
zgBh)$p}`niX*!6RLpF!bMHVTbq=RtCB0+yRJ}5SFFUB{VGz6uwA>^Q6XA%SMNP)r`
z1^0hAGO40Ee9v{h>Vc?+vX*qrb<CTnnL^=cdnx+cSy6#vnsXgDC6oQFyg+p2mY`=K
zv_QD->meE9X}XT<D2L{OYhg+6wByzgJXhq8FAnjWb3hqol$FL{6a1xoTVMv3PXmnc
zL8Xao6@BuJKwjKVRb?IZq}W^}zPj&h@g4jGs^Gz_ZSm1R1i5&X@$xOT!%@SlHFqj{
zkSW8@0cm)uJ^9EW&(@dAOOgD(o`?!Vs}jM4_01mMSF*m|VgHR(DM1mb$BSSMp>DE2
z2yZu%wBb@Y2;J8s`>c8x5@1-K53PP_wB=}vu`EzJm)FW90Sk7h=50N=y6(B>5^=S{
zf5SeC>iis8TIVc3{r&sBe7@#d7<6sGTX6`-Xvj&}3!2Dn{5%aG_gTzju-t3#!Wdlj
zTgII6ICh_hF3Kb`1k@YL<zeUtiHeeynnyg$oTrJ?rz3ZrWM$ogt?q<XS6mE1^M{H1
zW!?(5t6sGhhZ5Zl8H&GE;bLpZ#=5T?Ps>J%&sNnRQSO^}2i$<YSa(#vtXfZtmPIEJ
z3nzSpmvE&9DH0jrWudM6qWQFDcH}G<`qc*Vsv&F2GJAtZ|Jn%Fn*C+T?%-y__Rhr}
zS$x<9lqv8$?(R3Q4dZFQu!296m4aSBY(ilCF7SdY7z}RP)zfa(p=Z^U8^DKRvvcbO
z8MDb!EBC$fX{*f97oG`jtd_VkQlwxh0n)F$@6=BlwR!?~S=Cli7#EvAXh9c-hkl#8
zo$v*l2#dv|5F!Kos5DYg2X-NK(C|ka<;g^Gl-SwPfmohk_aKtGz*)$xxLZh11`<eA
z3Pl2kZ=-nwj!|1RF@<cNH@mFLavI!maM}|Ahoizk5Sj?Mua{n-4yCFKX*d_T4%n!t
zFZklf<N@-ig;y!;tS;s?FAk1LER^rHQ|pj;*gp`XYN-0^N;W_nNa}4NtRi`aKmI&d
zeo4o^%P%=dRf|vFs+1BAyDUC)I5sF9(^d^da6TF@4a{&`LyJ`ljz{JdgBS@zmtq-5
z8WLm(E)=vliURs@R$MuM<{As?J?cv9vG7aUsyg2Bl%#l?@&o{n6AyBj(jf1vGS?ZT
z<UL*xt~BE2T2DX?2OCR?i3QUDZMfdyD>z<{AXaewR*FDiz2mh8rg&eN7hpE7$IBta
z;E*YB3$pLLu0`CpstF3%Yn;M^)tKTr_z97u%z_43%t08@D`~^&vOeAmAVz8IO7K9^
zFk;Zybr67}QWQ={gyncEf*94Kiu+RBSw{i8TNAE~NX%)#m|c%ILWmtW!rC)q7{{wJ
zJ0fNQ4)8M7gqK~ILU_F@_z!~ldfPxeq&9Z!rIW%VBY<*8Y?fqY63TRE+7UujIO1{6
z!1?vW61grT&MHezrPH!6BMxL3wBfqs`V>dz5amevEw(b(?5o=b>Uc;cB^tAbu1}`e
z!*38}s9WUYMOXN|WfG_GZ2zq%sFeZQQHrsz#;2|lR0zCx>-pIF>udAf`m9V^Z*GL2
z(8^;PP4VtxN<H@D^`#>b8jjL3(*|?p`Hk9M2B-rwlkxaTudm;<k%p6IeD?vQSB;A-
zpLf7*+F5b&@OV&z&~%*-vUA8&sw_}nF+yk7@5u>;av0Qgc4`AP$9Of0Ir%!|L{)w|
zIVMrwNB6#J@+gb8VCFh2l@j!nb4}8tqZ;M?|84Kvb|lG>?B44u@&`PZG#YQfV1e$Q
zX+aOG2hILL33^gWfUx?1;T$tYdW6$Fs~aO=1k_?@rh*x6;ZCR1NwagA(yXjBQkg!d
zV5`>MHpg}w!FCbt9kLIuQwFK*X>(OUU3u9PP(C`?vf9*GSwH05D3ne^s~}D2MhPSP
zjJex4bABGvG6Gly!ZOHaZLqst6C`V*q1%4*j`q>b+K3g3G=NLMt7Fok)09c-MA;=s
zAfUZ+tK@|UYK-CaRlp(kLPVoJ*gl8BH>DI$(JQ&peAB|=_~8n|>UNMsVS9R92bea)
zUiKYj+GY8nlk?d&k%MLx9iHQ-sGhAiik7nS=$#^RK`sf)m<gTwB~iw5F4i`qEq9Dr
z25~q0To&3}TD~7}CnrdT)TUOKe$>cMOR?j1Ee3+-!)SSS`z{zs{b4JRm{Wbp<o!8y
zve)EcR=91B=?(|Sduo(GD1DngyavE-s%JN-$R<QfCB1#}@#)|%KVy(<SsgqT-GeRz
z3uw7@z&bX{R&L^n_9gpf+zrITW_;zq@l1uu&r2(Vs`wPovH_rbSWYWh?Op{S+cQjw
z?!%VZR-U$}VjBsaWBpR?!0*ICugxExeyyt+m6U4f*IvBD30A&Jl!3j83#kk5L=eIm
zcFyEtf1@XmqvFKwwfTej-rA?9J4Y&b*zoA5+Pt*c>%@Z_=6j>C$Q3Nt3%t^qMovoo
zPSQap5(8n_ODm%SLFm)h7}-t>zq4jKh3e@|Zh0RSmc6Uwh-%ERee_thV7Q9vya{`4
zX52Z8`k7VOh+8Uq)-`u&2OTcRWXDklIXnIusLVIOOx~03m>)_Qb<_IcS@Y&ahf*M(
z_U4%lcj-WCL+4G_JP3>Bm^*q2kf#hgv8wa1iMhEj?6sM3dzpQ>QW!E3Owl(<URwlO
zeTFIe+o-KRqIM6PXMcqC6ipEK+Wf(a0BTdVUKy$&DqvYMixzh<Q32T^stDY~og+Ke
zqfF2>5ducW4<ozYZVC<8<`1hs=yYe3mW92G`a?2Q9O@4}Spg%cKSXicoDLAGU|jKv
zwY#}2xbWay$6>F{4BJXxYs8X@+7)+NCwRF7TaKG@M-*2IjlnH<3D_bUNA2!=C<PGj
zo4D8J538<VM6K!y_9d*Y_>KzIm7*=KuH3{;+=wvl1b7LJU8dV=4cJ`CP1WYw{9(l$
ztEM9nP+$Veobq&SBqW+^vn+K`%!%UWAr9GV6-Ho;+xpZccQ%rx=!3Y|X2va89Xcqn
zfMU&5dmi28*%E77H?^ZM?pU6oQs{}nxV?SKO@kYMQ<J(hGcKg-WtrhZ8kyw+q<?&a
zS@Wz`MA+7<qOjnMx&qlG5ekjk=L2ZkOI-hYY5ee_n5qA<DCXs_1`erP_`o4k=Uq{3
zAGdgM7ogyYiWUPmmW%jnwE{<XTW!0xe^?c6mNvZ#*AyEMtHMoLRX9NM?}~77=v=aR
z-a!Whd@MIKyfujs5^`7IyS9H=;cw)+e2P^4Ie>A(u-2Af^QX6kzcBWk4uOXmhu0L5
zkaWC!N7k+0hQ792Xn@{bD6HcIEehuK?22RqN%U>4F^rk=SWJToysXzR+wwf0z45gi
z*Dtf*vLF47(br}6b5K;zs&XlOEq4ZS8i0^ho-P=i=!OD79OorW^s&Rm&LzY~n_gt4
zg%l;kaxYf4jEbzU@%SfZ6X`)<@hZQ9brOMXH{mYL7FH{2&Ky{EVuNWpQ8Fx%6NNtB
zxe9)HMuNCim|%z91MC9q8OA%AdD12VpvGO?OY?_Uj$sT+LBU+$K+UJR)A$0F;|bZ8
zo62z%7aM?V^eu&gGDEb&)H~=LjmYbpiu9$~X3wEnT#+oHw#>=147EaaEn093gGzM}
z6n0C-$SZjQc);U(&2HEQ3z!<kd}*_{QLV$yvXiLAfC@7_rsCo5WAo>}CcX^`acW~8
z7U&dNnO!J(O@xO`dsu@q`)jMc<Yz`{i4=+~_KGWl%`EE}Q;|LktMB`m(99iH^2ljw
zw}O6liX~{TxyLatt+sfYO^hd6LA<aszj(O@mGtvM?`560k0{Wl=kf5Kvd1ZpDyE`V
z%gpvD>|<V988ZQ`C`Lk-Y*l#zbIdUZe9;==3HC9uQl69n0Rg$<D72X?BOTQmlD#2D
z;nK>Oy<{x8nZJfH8dv%d=eGJAbVnsdE(9^*v)mjFp$6h=F!=MDUYUlk*vGuIGN$&-
z+7->!r)|v25Y*v}Tu)?MgpmkhPI8Z!ch3gzfccyA^)rYSamY(6LuM4Z)Xn3jbsctj
zX}bLrob3ZJMi>)`IhIa4Gzto1BA;YM+CiQA5a4lX<$iyF-)>@LnJ~Nj-tkvf$kS-I
zu#X^QTh;iKp=ZgMt-=4Db!W;Rg)uL!j0v4RtD6fXig|p2rG^#AB@?_608FBgprcsG
zT<kQF{4jwLP`XD6L%udLVg^*F7?7n6%ju++lEG>eD772`S)z~%ms%bU!EIh+5{zO~
zD=7|6-D6`etxTSQ)MGj<c_d3p!o|k)xLPGjH3H1+BVx;@hLp&bjzdaPrXfX|4lN@L
z`P#^cxVP>q2a$Z95Y%ODTy>-hS^&%mLr!`IF=QH(_+OdQT)&3Um^kF6mHB8)-p$Y`
zBhhDqk%kL5!I@nG1W+8arP3{CM|GH}qMTgsY^I5VRER3Nv@&Lezp0~cXp}t3E$r&>
z9P9)msL?)ROL=4m@*qcQb%Q=k(`7;!wS^&H8yS%X!FG}ZRg*Wu$n*4HnRIq|!6}8Y
z@cy@p<JSp~Dy=&7XcjOmUt^s=ethw9z?D*w`$9pBC8<mShYgtO<xr}06IjVZJJ>#S
z9^S#Qo)7){GcGd~??#rMS^ew7HRHezo*`)K8Xcld!=qIr8I$~0+*5OAvwVy|VAs2I
zu;`SAX%$VZ7A&d`_|e+vF_rol8nzEh*1*FcvsOo(k(ati1Gix}L!HH16sxT{)nNr(
zxDJ`|=I9fnKEk2JVKL>n5?eNA1%q`%r;S;eREptko9Tn7H(?2rMJE|*<?RBeHJkk4
zwcc-FZ&6t7#Wb=8lDBqd*kaj@=rCUzcWAoHoXpm#-QM91!aWADdnn1ZMv>7FVi!e4
zF2th(QsZ@hLj_M7;pq)<Z~K-bo-Y%2WPC*4F}|T?8ca`XB~~Cn^aWv2A{$wU;RGAW
z{s?R6ZdS<DdNu+IUKb984`L+QQU=f}J1?E<MF8pQat9v_q7I!l><i3@?Oc(^=q~G;
zsV8xRO1!Sc4l6sU%`<>1c0-&Dz^ZJ~i2U#kSTT-^>truLn6G)<0vZU7dvdu8x>?^E
zFfzfvfotxZbvneRAr(r5O*14@0E~>|=E<$*cpo#d@QTJ^s9w~!h}nwqmYZDzVVDZj
zKsKjRhT%9hPdMGtUx)5RH!#d7E>c-8J=P)T%eWW}j0-Me8h3Fwo3X=oh{etqMDA|g
z&;~?li26kJQ14KmQQTTw9a><iVsW7#)43-@*+t4Nn)JHKHIOM%>cp5<^=_DOuW^v+
zw7v;Irg7L#`4bZ?M@Elv#ne0DoyjcE4S02vJ0LQyWHkx+2JZ|5e*(d2Ne*~2&O1nJ
z6jlcIWvq}X$@)y53{dWvJSjjk-^AUdWDG$o!>AxqjXy{PZKV@+2TDvAtagu}jp9OF
z$CU6vQxZoWW}2jfT_s89UEEEgi_M@0GMzc4_6695@#kDAxmjbpZV<IX_%a&|xB!9g
z2+VGoQ|MV`M_}$@z^}<e!v;5~C(vC1JSIa<HsCh1B~xdit<?=WcptdTZduX_+j+5m
zgno*hu9hZLQn-U1Z?dv%*G2_F=qbUq(jKkeG#Mf~H2`<?7LFXot^~QTnw7x^Go-U7
z152A+|9$9P=G(B&+3lK#rsO>`6qM9A6KG1s2TKTmjzgPYbDN1}EhCTB?BubTXy1Dm
zc~f36j59V(CJ&ZoUr}HMDJ~C|>N@LJ$aNS~vPq6XpQy?M#;w*raCIg?Du!|Ab-#Y_
zGxBYC=jU@!A*-YJXDs+vKZSv=qm~z}H~`o(MQ>vrufgsbdVg4C3*e@H?p<24GNLfW
zRK5V6U*p0*o!^9p%>(oflAf0*yErlAF7B>S=_q%RxlrzsSA6BWiXeCBi+q7{kHc$i
z!$I`D^z5%0NMY;Zh-x*s@m>5~S@^KR*HCxqO1;;#rhu6i>VC=^vmv@Z4nNd9BTaFP
z=mt(ZWw=rnKwAsK9;5en)p&#TXHAAqC?Z4Wg7wRsrXdCa<$j0izlm*1&c+5Mg6nWP
zDDMdQpelM7{0e>GYitmEY<ghLc^wt$fVt$r76%~W5d?vI&V9Iw8I{XOP)O=X6BM<|
zJwIWCD>)2GBccv@>BV0+r7In|>9F3!AI^xk5XMfky2e$`HF<}Y+SUCQ1w6-k8+!-e
zVLKQ%2G!9D0{L3}6$b`Yp@G01St5*`S(7jxhHbh*!yt*xco@iA-}5jwD5=AcVcFdq
zM^&x9`k%cm5E(dOcLa@_*dWv|lX~sGjJ;)09YNPM8iEA^0fIY(;O;Jg0KwheIlwu%
z2X}WTxWmEW;O_2r(BSTFU!J$VTXlcj_o-XeRkLc(bk$5x@4dVB^sJSUA>yOKU8)iA
zFt`&#Oc0gvd0MMNFo4#)H6qwy-$_vqC<l@vH?kQD5w7@QtxTOcR9ng%Mz`f!<66?$
z>oz3UDig)|1cQf}#vluNIJ$|_`uP*d<evP9%^Y}zFKLr7_~U?XEsa^}fVeSU$L?XJ
zl|XZH-nB(a&(TPvZm}^M<9?Tl>l5UQ8aTb>k5M}BBPt0SPz(Lq$^~708@iNRf6n?U
zQD0<*C&k7o@dxrdgN5rRy<eQazzv}Qw;+#b*BUF8=jIFTSUnomk3p7l45uzdO5{jO
zi%&Ka{NV~%X%n2a1=2X4C0KIaGm77Dzbm181oWG0qe7(+!yt*7KQfecq8HTq+@vtT
z2UJb~dH0#*5la$n+6M~;L%H3ontH!hc2`~<m(G)9dhCX&^jcbQo{feB$W^w8#VMnZ
zQ7avBRO>m<wxN=Cv2}=0)NeO<HXiCHRJw0pxR40V(_UpM27QFYT^k!v)}E!_WzG6M
zQK(34G2KMhbk_@M?nYEl7DUF)p$QTcTmP7%DzX-@k<!a9WGJmk&QwBMG$i$$qQh-2
z^gnfDt#DBN6VYR;FUAo1{r2)lU9O8HM#ML6!=aaFx|NC-rHH%cox#+~PNa4t5-qJV
z^G*}PLic_|5of&}+KShziu#Pycn(IG+J(9`p&WlxBnAAfC+mr2>s~Q{ET;5DKto`7
zp@rut(uxQErx4)+jz*;0n0fqi#jqdbMyU&ULdRX1H)!*OgqUeAs=^IAyYFZtQF6at
z7w-;U5KMK>BQ7lnE{27Ld@{rh@%S41H_It&4k~GCD<#G*EN#rBjD+T!x<@X4EW-U1
zr|&Cw6fQ<)6+tRT^3>=|yz=D2-UMV7_D;d4FC_daEA{n@7Ow28*N&Jxr*Ku&Wku3R
z6B>9X3;8tbrl<0TFUFctS;8X1n))ky)?!8dpux}epG;HL4mffxuf-70Wgj6}$yfPw
z+}EsPD@oe}`>tTFZ)zSTg6^uO+Ctwy7af~2)trk0R@l!Qj?Qbg6>VOdwY{3JjD3wP
z)xwzXW8j3E9SSW4ZW{5gzZku0?8*i*?p$cS^=4_OBe4EuKPTlM4n^ASqx1ldJ!XJ_
zbwApG<+pu&@BnuR-#j76=L^<c;v&KaS(%ft7Ch(+{t;qcFtk-6lmH!~RUKO`_~k5_
zFHUTv%|XKum1<e=tgxwLh6s4txyP}UPi0o4H9<4Fkci^!FR(nidRNX9r|$p`o*_bF
z>cn+GoT3|dK*SuuL2x{qT5$N`yB=u4Vhz0QX-b8aIAPLX2W)C#k+CJ@|6Ioto6+_x
zJr(u$wXv-Y2~Nf$e)g#!q4APx=eAo})(&Cx%2J$`ZtJtNuR*}G--lReq!5(@TwbJ=
zXj%@NreJg4KF0|a!}vbwJ^)#x=8z3>LpK&I6SVGRG_#Xzo#_Sz334yKRKW-~c#&9;
zk;5T6BrMWYYjDh?9MFtA@EtBXBIFLEG?ynwYA)apZ=Qp3<<@Z*98;n(fe3>kGbGBp
zO)7>TJbU!1)itsq=eK8+hx211BeC@eqeE8kNS_9HJk}+qjz5h2DN-J~7pWaZ%)u@q
z(DTjwZUp;a_Hvh8tQH<SXOE*`-ngj3H(+|X|L?1f-&k5RDxg>xeUz&dwN3_9$G<(2
zwVo1!JL7`DjvziL^85|;r@ic_9LI*)ol7=XL(-|`bZcj&#_#M}W|)+MakHzp$m`>d
z+Ca4*-z&Lp0o*)xVBpfUkaLHqRS=i|j$Lh0<e_G_Is4+;T-5r$<H%^=9}9K*DOfQc
zq&2yG0%eMEru;wagv^@LN|uEpo825iHD402dKs|-aG&{)caz|yde6E>l!+CQIfXH8
zdOoBU<L-?<vzct$Zc5<0krPt$-tQKMgg<QqU$1J<v~mXw`SQ@~dY(xG=0v!MiWg>;
zx6BF^e};$E`n@N}4qzPuAVS!@RVw;sO61!XhBSO@7?LH!e32hNY&*u?)Jl{kouM_>
zBh2a27$@N_F%)trSl3bV1_Ovd!&u%2*kUbMu&shVDP7gcI*yT9M=Sj~9cPxzP5QN$
z9^tEfSi}g0Fb_FR3ldVwtE&#?h(Cc(A)XLkEtsDQRF`t!gMIS_GBnsBt|6Wa`Uw%q
z_&)-n0L#uL;&Vf9oiCegT(X;RIo5>Y6r}-v4xn`!K}tkeJxQv%?}}R0d&*DJBX&H5
z>>W(2lgBFE146H5$TUsK4E{wiX+qS$U^SzUpG34p8Pq}&CTk4|;)_khF)_9l-2Qx#
zJ(VbV2~F42CW|TqrvA_kiD*4^1DaF7hHECJS*9H3nGh31E>AHrG?P3JPvsEum1AQ4
zS~9xByMP!a0I;i2Z1;?*dejoqCMUDXaN#jV4N>ytlt=HYK9-{-f{@L8<y!?b#<7V+
zI;4NL{j7J#tZ|nvH(x|Zu1rbLW|HV8msvc{TExvwx>PRz-R}Q=r9G3&?|KW0{qcvl
z(IPIZPVUp#`8Rh^j|B@a&D^?}JF*)|&BD00?`a}=cMJK}>)hk+$qhzTUybA4F-GIP
zmAoksFYCS9OupfXvnf(_2WjD_4PsGt#JAXh1>Vmr`tv-&fE9|{HZp!M378rr>?4KI
z)-P424Z8QE-=+u{o^>v7RGj9#At`4k%H1nW*$QtBiV@aoryZ7zg*!X1^I<{z$dF|D
z)@I8eW5QS>d%)Mo!$$Yi7aH9nW#`Z=+XL&ZuT1y(o|oVfoN}KY^#EI|%8M=2v!s@B
zD!=g_?B@B;)_K4$lEvR|J&bhnJX)i|{eI24@-_d`d2$z<{i<6DUUc#9W1?)-{#;W^
zwY#eB=MdVIhT0hCn3;Vo(_XIX%xU>6wK<uPf$#SyLb`@ex^<-)<3nxJHp)M?_l<FK
zC!{@dRn*k#jpo|EMA9S7M5o%Bc`RoB`G1@r6iWh*{x}TOzl-%`X)uV&Cc?r;yDIg6
zLQglB<r4&;XVf?wG~BeKNEFVJkdwMk3@#|n%<=IdxF-L$Fv{GuG20zcMszQJe`sft
zQ6VoiGDD<c*G#Y78@U3+{$gDPSv#lsr}8qdA5ER=_+KPknLO)87vARX?LPu@5x8-1
zP@jbqFw~MC1DxVZGbgrI^rryMZhVTD^iuGum+q8KQk)8NJISlw;H=bOeQ|?u6%}cI
z@BmZThW6O}0$W=@=G2ij-aX7k+qsJL`Q%}AyEz7H6y+Ab|MB?!45BrD#`nK_mWg`R
zpK5V7362kx5UviFNFPwh&ZNr~Dk>OF0JCY};#TnFJ^rXn8v`KBWxQzM(yvP1;F4yU
zbfC4~TT@?^WZ3PyXe!S9O7dQ6Ee8oo9uM72A4x-mtp2kvUujH|1ZM^h)B{M>OOLCe
zLZ1JzN?{?0%;c<r5Uik6zQ|yMg?qqyK7f*ZmvKp6TiG;xO632qoHx6wyls(#|4}e9
z!hLYGV=YJ|ufi6uF^Q5Vm0HE+6TblNda>dVb+`w>xgV@Po8En3B_Ae{7Bd_@R8P}S
z6dZ&%5KnxK#U3xRz6O@p#tIBOwyu+L2aox{e+%D-$K<U-Ep^xnpIKI#0vSq5V3#qH
z(Y3`1TG4M)NoDDumNMw&W<4-ZA)9|O$ys@~JHi77rd`vNiM02mZ<$L{9f<&-5l8b*
zI6Wnc=9o}|(q;o}Hu=3WKgMfOysiPKK)@3ZNMSZ&r<$;)nqr>PmWm37)cn0_T;h0Q
z{tT5XAxawI>I?p#kUdR82Mw&yzf`63i=4lr@k5AL4F9S-t%V&b)ojh!I6a!K|G9A(
zH1TWDir*voJ++AcSOkX=2&_AdXUxE!qkh5p-JD)NVqS1+D@~YUu0nn=9~ei=r>=$n
z%Ssts#Je!AZ>n?gsYjW`Z^7f!bdKscdTGqgRm(5si44(^hUGru>d1zxAyw{J-%(iu
zdb=EX+Yx#tO=7j=oz(Es2<*VyTDj9B0-_(wdowoS_+X}aHpA=r>*2Z<dQ>aeqI`@*
z$Gj%ThK1#jFlRr8wB%<?d8zZVpDE@EhFjMCTnea=sNw6Y=1EaK`&F!%ye38sTwHo7
zS=N$qK*mQya;eW9rBZt7a=eIdtomi~dufl;<}TN(xxdy13(IJ1U@b?#)ibGsGN$re
zx><kRuP1fs>j+n{a78>Hh(r=Qso=;+Ppsua&>Lr)Sa2kQXA|ioQSEve9sKl5&u24k
z95CIXZ{2sxMJOSh5ICSCm0f(3h?~RSwHz%|_#YLD4{?DpaV@u>5+Ot+LYScl*NtPY
z!1s$Q(n~J}cO*{E#3DAP?x1^`P*d*tP97%!6Kn9T_Vv*Y-dzdo{Cdq=2be)0D%|0o
zH=?vJUVR23Fant?hsh>=m;P-d9c?5l2kL-Z?rk=XF6s{&WW$O)8%bTZU5@b{P*FB@
z_P3b(6f3f5bDZ@oLZb)BznHb4XqdV@2(j1i2_!{opcaM=Zyo0+tj53N<nTTV2QRv%
z4yB%9jwI_eDvWXc*mT~)UL#vCT$Wg^z|t>MH4V}KibymRJr<E1UU4QT#~sPP+L}v+
z|4W0NiFjY?Iu?d9DMS0RaQUw^aqmm1Vh}DfId1qWN5L`QPlLZ-9f%;I+5m!{iQd28
zGHmQ62NK*>(mObO-1-S3xYR4^at;94*0C?L9yanSOslFD+a>99@Z*NThSZ<S^%iR4
zsA!5T8kqw+IaXw|+4Yjiuop1PGu#Yr6Xobo@ZX6R2Le(7sXqx=WM*MVr`GXsRCK3p
zNUvwCTCBlh9&yR&;Iv-+#z?DpQ@J18Xyq3_WV<NphGWcDFupG5soSTZyiW7%70%Z$
zj@b0`)@jMoq0{~8zZrxJdaqt34L(u7sESX3K@UBehQJ>U+y4{k4uO99*fp7Ci8ITO
z&FRR+pw;?(e(DFWBzximPNnRhV=w$rVqzGScoq4td<$IOu;50mL=lQTEXZB4iUjU}
zIQ&_DvTlWB$@!pEn1AVqE7z(+^DnZ+bDSN~oBR-}JeCjs(wlf27@x_yrNj``{Z&bp
zR=qCJKErQu<vXQ+2G<sjP`Eq5Y^-eQQD@xA_x5}RV3lY3Vg3d$8KW;T@RXwNMbCz!
zRMdiUmKv`yX7zt6y#<Zoy}Zo~Jn9i3Wwi+WKW87vl!jKjy*d35>3YzOQsr*w0=(&1
zi*{y?(#;F;IpF5?07U@x;$i(RHW3FnPNZ)xsn|8@Fd^g!M1|>Bm}Dh|5-<iULMW4L
z;Yj8%bXw)5X+J)%UNCSlp<XhyhGMH*7m4KEeUte4l^qX5H<D$uaDHwqo^;LB_x;oj
z(UHS?b?f{GyHVHJ90J8x`=7knxKMzgH4{0?e#3PAv}ucjtnCp`W^xg26U-qyNATVW
zg=l>a{|cf6wo~$GgWFJAmT&j-*riM`MDezZMZ_%t6LwC;(Grd3g7O1QKkHVIN$rmd
zK{oe#Wi5ZnaGe&Z{?mW&LvBR2WO!8i2O&^9s}n6{>th|m`K5&YFXUJ4Ukprvsp;nJ
zNH!KJ=-oFfmNS-yO^li<>?&4ZVipzp-mcIm_%f^kWAKzV%qQ+YoGm}JYCdy9tScsC
zNDY3E#g?Szh!FUXkii|#0u4oY!$p=7YE5p5-?mx59{)aw`OP%HY8AHXkI*LNQL_Mu
z2Q7nR?uNiJ0)XK?<Zn`Q^da-R_)0uB+f?hfZ|I~5(oa{5L}vjU>3nXWA9!~c)jV`r
zQIr-Eljb$wfcM$bSeY?O78$vqw<NKYlmkUHC0|v@z}{UDIUZxEr}D}uWwTXE=td{Z
z#*jCz3%eiQO_WuyL{}L}<2VXfe4&<*F;nzF2g~JY6i}ev7Qa>)F<CnBf)=2^Z<?^0
z9z7?EW+ETt0z+7bmr2pJ6!e2U^RI0dXw|AMSK4Kn)erZS*va-fn*D=l56+C~U|&$1
zM20y@xo_wy*;8Ilv-~0(eI3?kMc?}R631x5#LZ)e?iYy+JUocyVJ{PDgrp~jspvZ0
zz!wCi){ke`=HV5_`*1brVqwyy?&}}ELL!(c;Bn8?t4U6dCUUgqg6YU8Oa@r`d2Hx|
z6Mud!_MBS~aoe-PTAy(}7##OlSeh<uji^h)3$64EX=L0(<au<>8KOB$?H$+Eu?2aS
zh{fA}{e;^AucHq^3gMkJ%yAIr2-)_2lI>#4V}+S^4e5^ji#!umbj_fhnON1Z6jNHO
z?FxI^cGeM^>+h05zN<sRR2e8YRNrpW{e@2AH-deQSI`>kwkWk@m@nsLQys4h<A-<<
zR|8z=kBn7I7(7@6=J{YNTD1WvTOjIYq0*B2W>;Uead<LKtQv@%Ph9RyseDn@&reH|
zOUh+jOAobNv8S{*qA=MV(JU&@<pNn3Sn;%0O6eNVu0CaOgY(T(u8Rn?Yiutb0nK)q
zb7OQ*d~)iK{lG&Q4Bm9Xi2WQ`2kVgWUBL;pCkOPQd9gkjY4`hRCn|3APx(qe=ON<+
z2i-xMH5$6WG`t2G0us(%`jE7a70XCG6CdW%o?a~hAWuYyH6&^FcL4|SSnD9{p#34;
z&<x&#+?O9gw`%s;2)R+m#4~OQL6jZXidgKtB)tq%pMu8`Ui-Ht0bzu24p@BS$(VJ`
zyb38>usJRqnA|cSf}PqWxowr#g3rw2FvO`?mw0s~{YntMe#D~8>MS`DWe7->MR7_o
zdfE(?uw0@+?K|Vh3p`YmS?nBxKq$11;K?mT>jPCCGdKcUm3zfw7ITxVerdM7l*oJ;
z>5B00i8iB60k-?jlinAO@bCuaUcsKYG(bfuCSOm)n!sNf`<hSsxpcgvz>00oC7>7^
zFzRXIcYjZrSm^+rmnMr<`n}z?oNoDCzN~r}q84|*Op>z7!kyZZp1VUg^cKdJ`qHx-
zDtC9%t~L%n5Nvy;5)uypAL;yDur!cgp9&&t+`|#*q(^}MoGA}@q&^B;D~?}n=|zv<
z5sgaXSM?$ywUM^3yGWF9#X)d7PhZ?^E#Nrcwza-M*k=}Oy~E{_s~q5hIdYVR!HK09
zw0nadEa%*W3LTP}UB7ls3|6D3=|uC_c46Nd68UqqMR+2xn*i{*q!<3qBi2|nQ)2wA
zsf!W|@XW!vQk1JW>M?OzX^&{{O~JE=nb`|2i3`b6&oD#J^t~0g_U6QJB#+b^)vRHs
zQ)-lk@%O;!8i#qIy8F^^qHH6=&(mXh*UTg51kcJdTY!3ps`D+Hv0#veEAz|mxHRIu
zKo5nEsI~y<<s(<B^HM+Bo{6f06)Q*ij__jx3AiYhMu&=wGtH5X#$@^Jk9otJe;i0X
z5vA(dWtc(V(JU~}Pj@`2k~@@LgZs0vz7EO{XbG;)QM)ekgVyYQC{xyLAF22^NnITP
z1Q!U-ETzk7H29Ht5LvUzyXdg51Hs>8nPSxFzS@b={w>zKM8Ex~YVw=Xb*y^W<$zk`
zGZSDz63iq8!&~clCxb^g@a>BRvDI(pUp3h5aYd?4P1U+X70X?kXxsYCH+J!Ds*5v<
z&c9sP0u5!Go5KWW?2ceU59Up{S8_8ZLTJv-WcQbIgQE6kYp*p63X)GzBqxTo;6KDp
zI`rNkQCK_1wkXCe_Rq`=eU{U6=*&mg+gci1;N%oDW+}=5@6oh~Mj8DR8)n!}*2EGg
zk;z98-J8&)D}5ra5N}J!Z{n|R#Yo%hMJGxnl;N0EN|tmvj@m20h&!ZmV&&!E)3$KI
z_4}^)uafX?MulNlz-99>Uw*uBe4#ZgKaMYmC=T=6!GfLSA7oK(ON@#s?LP$3%Ch<>
zU#?_9-_9Qhl4qD@5YXs8j3>>s^zxIF7Qk6c+JIY^;Bh47;YRO>W+?g;8xrA$npX$b
zr;UfuWg3{6Qsom@wNL@gj9)Paexc$ULvkH$Wega?@ElQMZofS=Wm?DzLG5COq-K?I
zo^3cfJ}GMXqe>Z!(XS|;;~6WB(XC}q9PX%uQ*a#7xAOHcJf}`p)GY>woGj5)q#hAo
zeLSBteXgrD$xwXPTxK<ORMf9ne!G5Gb+DNm!#_fkioWG`0{H|ahy;_b=)nFK?#@a?
zAi+-*Sdb;evr9XYEOcc2K$-TfqO%QB(a;@$$sbnq@!N*yNYL@VIo0{*css@JFuVnY
zPtEuX0#5Lk*feOX;T-}2DU(mN!*AGHEjG9FU1FV@Cn4W?I9NDGtdTC;8@JObQ^PM*
z`GiNF0FmJ1jJ!zL7#<STO&;$bw5%U#&i6YfeDnr?4?Mn|5_!G;ePj@ttjL;peuiAn
zSI`R>+*&BO-T%H@y0_i;*7bUx+sby`vUe0Z|BvDMp$QW6ytc7Ed;LyJR=z}Mx6bc#
zy%fafpDoz9?{-qTx1@hxbDV3km^5hZL)x0*aPp5ts&je}BumuV?RYY{TtgT?2s$CD
zf_+&MgdaS!=WRq=sPTl0Iqmg;Q@E?ifRDcBuy2bdyoofU>+s=cQ5EX+AfPX{%og@)
zd%H8K7RWvVG-Wbb-*#QD!pFc|&*>FoI36v}zlUu2&ZhFN6&L?-Y$-gxBW1pSXSI<J
z*afU+c2s{6&_~!hv>*|FbCNE`1n<jivD>xu4F(B250)mhokyooU(8L%ocZ93WOE<e
z<Hi(+Z5|f+d<nYN<kLsMl!jq&+?LLgTw~I_nSEwo)1U7^Y;12hU6OgXwVl0-Mu7P6
zt2g%2;RQfpT8W`4l7`O(Hl$^*uuWc?_h>F0Xf_s6!SK|lA7fl$1PG>?dW%IOQI0Rp
zH~3bM`1&a1H+<>^;qANO-Rs^5%K)z#pNklTHDv#{w$b_e8Y87@gcKBr`{VWe7S(u&
zc&_*<_?yC{hzBh75}T~bX17@47f}FCH7V;reLbt=)+7f$7v2xb5!-XY$vJY1Pos-r
z((n^GMd_MZ;$U-SLac*FxQUsJE(~POHrdlXKPzhVa=Z0Sy4;mAV`LWL^Foawx~--}
z1hPuo8?1?nB#Xoj$GuK%s|4{l6j{-pA-^R#(x#^CPNDasklzyB-7%Z{1_If^+4v5j
zG1mir#iN%pzgv#xF=O5yPwLJ$vOFAa&n!az(F1Hx{9XtDGn{R;RPATzF^|%GKtQ1J
zHfByrsUmHS9ei7i8FwdXJ?6bj@jmf5TyoyGKfEz<w1_@s6lipPUW$q^;r5L_Rpf8X
zzgj}s*k&7uSxc}xAxSfNcOq^@yj&8f9(<b?a;fXOWK$u^m{!pS<bM}Nj7%;*_lZt%
zoO4DPJf;;09y@dr4jFswQKu$iZok0eP|&;MwVY^g1@&CI|Kp9_`&}o$y?5Q=9qqR*
z@F^>J0??KD=KkbQ>e?3BTReUJxUH~XFQ4c?HyP7C`{|0_=PX*1T9EJD%^M}V<;fm)
zBH+NjoCI>=mW7lBdN9Fji!4gHH#*YV#9=?F+UV4i*kH1<LvEd2)7PB(3}u4eo!v5>
zfEM05&Jep@x@-m)yot^bPeH#8NCQr{YrSgy2koB6&a%!7sg~pkyPDB09<s=$6mKp)
zJiODof3&I#qv>k8dkXo>RVgtbHN?vaYe@fZZIZsQlaPwxgQVKDE4%ZM*_i81^9SOj
zjT~{7bzc_s@8wy9^1+ey=OB^(N}pG>w}^KhlJ}?c4a3-ljh9Za%fqSzj^%r#2Th`P
zP;$dSbU@xW4~*;=>y7Ma%jKWH0#Ok+r__dlo_ssIV?QQ*<Lw~l=vkVEXM2m){5c{q
zdZ!=CSY+`!1c<xNHQbp2V=od1q$sv=cxumXkBwL}k*W{(2v!_6URj-90v!`RQXUFm
z<y=2%YEgR}0%9T8nSIs*#_t~57ZgKF%9>uDM71J8;<1!LI7|n_Q!)|&z>z04BX`VW
zrQj`T*EW#C>-{15q5b_Sd;Nse!2eTuPgijkk!*$-66R(D?cq7?q3sv?7kJy-#M-|`
z(zGe?tSEWhQ%eOM0DY1E4Pn3VBa+g{(Cp{6_qC4D^sSW4^f`#SAXD^Y|62f_S%E59
z+6}*nTGOzzz{vaC#`@b|VT!lTF6p=NH`EBL*ZEVOx`rwhQwx+jS2+W{hXeG09@^+;
zruOH;_q&)rvuJ5DW_WMD-{1Eis59J=hX#T^l7ibx+bz;p#{{qyDkqF3MPe8+>b$wn
zvFwhqzLC9rQarCvbcxs__M5<B@UY49cNoyk&Z3V0C>kw-n<!#$8M~M+$#F_kLh1ET
zuc8#?mp6S{4?7;m`XF)d7(jA7#624=BGenI#}y;0zc!xAd@XN1RSerF97BGN{p*bL
zG*OuC^yK4fnih5Y`!sFwL!#JVG;>ymcB#s>7-mcsRhBRhQq&6{JlK85>`BQkCzLgY
zicEL?y)!`(r||9}b251D{b!wGkeX^PAMAc29Cy73<ZT*h3vl3i$xoJ6e)<KpD4b;V
zW$t+h3m!|8wf~qjTw26;$@qw0zFZ{dlC6Owr~xRSDeJ%*v7;IgRw7z&Y1lo`IqLb9
zmhHxy>f^RrS)~@7fX!U0OsftIEs7Ab*|=k&*_kC9gdL-7{#-m)l)O;Isp+j5dx~o&
zJ2j%9<8$exkAvtHH6HMAG0|z|zWl)leFwsvr3##SI1^?wNSY<Owb*A04ZYeIqGtBW
z3eaCvNL&ob*?0L^{!WyjN%Bg}tg_`pZNo`Ulpbv8!h=dX21*h(e6NL#$!bC2iv81z
zw0pB*deFw@{iUk&6>7Wjw%hqq_5OJO{;=`B|LoKDy3722W!w3>-`Q~p?R-0~@_8L+
zs_HO<UylAdub}Zr#nD>(87q?W*uDC!8yC~v$&1r?^26tLk?#(#KfuC#h4QnduPI)h
zuk-8jb`ykCE-!3TRo%?bdVx(M^KXx^osaihK)vI`uT~c!6<q6G{^x8XDT_H2O^pY|
zx3+JH<C_B6Oi%X*ruiV`N^J`#AAiT!-nEveJj3P<@14ASm9m8mH`93er8VKV_=glx
zW027MuZQC;(jG;|Cfu!uPd*e!W!H5d_1{3DxW36GlCo$V2=SjCpFd+e3_~Zt#g~^(
z{3C~huiRwSDo|NRpEXLJHM@h%s`FCeoREv%@lRsnoy1uukA7*7FClhhnWQy*LNS(r
zHQP1|kGH2MZ>^MR3z_(%MahDV*9yMXIbnqn2)>KgE7qZ_`^(Sv_4(tWVcG{j9HNVP
zJYCz-H`ppn#^0_!Lf6eNS6Dle>r&d+p1W*!5&MkyIg>r>X#C{A*RPnnn<6F-CB3&^
zUNQPoZXRH9yt5JKEKS96^(r!Go{`*RNVC|m;;$%EW=|Zwv*%xpHv#^ipXaj!I$xj7
zk%$>UNAC9Q`F^VWEXA6(S-8BEkM3AXp$pzF`&GvR-oH_CG7X+{`!$FYbbPOzyr)$N
z+W`xxPt*OXuhtiIpV30igDwj3B%WZ|MP#g(Uk6i&FYzT8Njk}UD0(>iNY9vjqP>Lu
z$ZvgMu7F2Bk<CD+j!q6{M!^3dTVpF^9u_hdvi|@90cHt+jgy%J8MB0qk(1d^GZR}=
zGh}92GmwRoB^eJJw~!Fo|LyCRS*QU85ptt@?Q2{#i<E5X4&isPppS+_L$H3)<&bW2
zAt3XJuim^ztQFSlO2GnD1Q~V&|7JF4rsZPBM`eG)_}e=7TAG<)#vV0UwWTwpo$zyv
zM+gQJKlxWqsx<B8>Ey+;!lm^C4vksj^y&?e@1Zh2+9KOPY)0AYBs)9%@8c*WrP@93
z;YwlYCGzqNbZ!4UY7*$?^M28UN)SgU&7f>Ta?lwFx4m`7yCmrOc=y$X6k>FJykX$;
z{C0PKeV>22Y9oBoyB8o4*!2GODlwf%azNDno#5<4?fT%W0r`GnUE1(P-7BfRNF&oX
zif>YVV^+K$MZSojkR=G#bErz}ej3?Q#bH;=@(aNzK?-*GI{tx&nhmyEP9XMIvcSUF
zC3?(Xltfx(S)Na3E;<*nA1lR>k1)2tAw*h7A4>EUz6eK)NbP<n$POeWit*`UR=*!Q
zdU;Mugbj-p-#P~Pp`o(C4fUm5s{s}YZ3N@RzpL5u+GCB<K4%)i59w*hN-dwZH}-Wf
zQks*%;!({4Jn0Or6;|YI5(}iwGv>!sJUGl?FuP|x77DQOM*v@Vl62KhD?VoCAiK`{
z*tmQOQJx5{<sHk)J>;asN?ygcvYPHo!`_vZ!2Mt&gsn(^i2S&2@6w>K2}9zH*{9VZ
zXdaU@oQ@e67n(`1ata&y?ePVxnE4GMN8f5sijlo2PYox$mrI)rK#qPAT+Zh_dAqs!
zuCMo7C1%H1taqkXqb<;L=7ONm*U=C><OWgS0M=y@IGm^mM*HciV9<PD9Q4hIcILaA
z?*f7}y2ANvqg-;Eyg(JFJm>9m61tHkS24JA#JO)Q`n*IH?dszVwSSn(9Q_+LnLo5X
zJ_Tz&KKa`@pASEKSs*&P3SI<TXQP(=4NV$Z{&Olo{yDn@8gaTJQmV~*RGAYYr|p)E
zDQB-~T&JAMB-7@vi}=KY17qHFqDC4lVmr(?E=}DK^mXVYk0->(t+LoESr}DJz##eB
zzjrNq-f?kT^E^p`DZ2ITLx*^-mu-D+BXq;TQw&51Q0nX7tZ7z{_)+_|xBW%Xnj9J9
z7qdQZ;1%s}g8K^}vq3@O{|^sj`~T;GoSeKIZ2xZ`JZXnkGK@N8xe90HRl!#nlTfh1
z`1}3}^Jo4|?g{JR3yAL(Mf+H=dC%P;T;?%XGNB*woyMB*K+br4nYH|FXlz8xlnA0+
z{N^eHae4;wzY;OpvQP4YIy;2k4)b?vZ=r7+bH~XtgphQJ<*}2yNuT@6jkn%YQsK8l
zv3Iup6aSsXZO+&G#YM@EOP}{apXPppw?|T;x4)fpP~n%Dn9c|2`!nfVw$EED)ZlH`
z;N{%sy7RSIr{#6t;Puw$DFZFG;yG&J<$A;G<#o{K^`YuLoog4US;wIV{Hwt{4{g?)
ze-c<}L{)I9XZHRLv0vS*)&U=ycR&z8-q3d)w@cA!Xfvb1yYT(Q92eK<!e_nV46Rz7
z+uHGXi`J;-+jOYSyT3j-*4xX=W*6sO;W@g~=l;0r{pJ$aC*znAdaB^_9%mxDqqFh*
z0;z7}?dJ9}g*GWo`JDDPUU`z%S)ue*P8tX&IG@;3IQPa^xZuBVXW`cII_O4K{JPxH
z$$xi$C#>>X4$Xdh9`t#e9ZgPZ2QZ%hQ~vX5ud6*T`m@XxQB*FqZFt#fCzQm?eLO&S
zc)DP{($>fa;%)GGJ$ZtyHmTgrd|Gf&I5qEWOt*>DVFX<34zx8iHaio($1^eKzKz#0
zdQH|nk>1)nEDsQY`JRWf->RSnXY4Ur*V#T3ExLF3Y9?HqS&z{3!yJ5f5B<7pxAixa
zqMnKjvq_WHm0u9n-=lSlzpWcyj*ELpeFcj|=}hW49&vadxjc@p)dg)!J#W33+^&6w
zbv2D&J!OMuI=TNGTP*I=KX<;K%0s!S-}Fr=hL^dm!y4>mzXNrAT7^%Gx%asd<;bW;
zHeM#P$*MwVg#eJ+v=kli?Va<}t`1kmwaa@^L)*NzN{5#U6>7$HhVkj$@iQvvBKKZX
z+w_${`}9#;+w@bC<aLX%qlfLoednahQ!53DK-Mws#@WWT)5E>nzG@?1#4FJ`RJgK3
zx^q5raPQSMYisnCkYuC~0xr-8@h&#s3bk%HK+PMsXpgHXW6p8k4ozfI-p6&1Pa4**
z7TnyT?VqDM1Gc<%+BZuhT}J!&l4Yd4&EE&hqW}-LakJo!Gt$H4gtyJkY|?*|0g@?M
z#<+`k%qB_KkO*CrTvlcpcW4HJ-G}Et4C_Gj({(y`!HqVIQ68;6HhX}?xtGSMW$jCW
zn;Yvd^+x@$6AAfdH?ZaP(ARt$u);ML$ldX+p<x3s*>amLb5a%45|wCu_K)Gry$#d=
z$&~I$0;|e!={K6J?M-rCElNUdTx|Qjee1#X)1x+!+T{{6Q=j>8T*f!uZ$4f(;K@X-
zO6tgtU3GJANvEpPaeV_W<F(C6?2E+^Ah2Gj{l&MMQLQR}?Py_5a6Cm$v+>Rm>G^g`
z=Qd6HSeVQvgEJ=c7z`|}*SZl@m(%3Fa}0aFWo`W1a4Ya7w0pKA%D6Dv!CGgm@n2W&
zdq<>~TULmT(C<A`Jd^AAv8Sk4iv=!&Mx(XWNlGTd{^W`|)6+;+?oq*UWm~Uu^EE54
z`Cw;9;gl`|(#Iu|^t<BbhGDH$kQZTdErqBo7^lu-Ya8U8>~5`d-X8*B{>49W8S|?7
z%<NfncDY~1`1@Iikz8|Gonbu9IMk6ae}c5BD!u(+YyWGC`zfu?;kJ3k-2&fDl8h}Q
zt}t1B6(h77bhZy;a|<_?PCR^_$-Uul&gfb3?{^_0;F~YcilTSD5j<hJdRKmS>~gF*
z)7i3ZhZdc><3f+^f+y)K;=p?Nx_7;C5F!5zJKKvgNkfARp^lYfJx;6keWo=NTI5|V
z_A!nRQ{3{VV=235M-*62K@VJ>(d=F(%&OmDJpXqRvGz|aZ?|+Bu*ic@CsUX&@ps~1
z^)I1k#S%9%6j?^wA7I_a>_2GynQCwuUUV#HhZu=lT;d6>R0xwrODx5BGZ=2WeK8dF
z<<I-It}PRc&JR%v8Snl8bX-smzjsWD;Sw0|`bn5&)WFQ>+bPtzUQrO&ylZ226K3lE
zzBEJR*r<OLqu*&cP}ZMqeNYv%(fGxvAgy*igoQg=C|mY!Kf9HoSlAmn;w?Mj#ZS~Z
zyY750#4M1nv`syG*&?-w<D<WhCh(55S+!NQD$IP2nDq)*y?CK<mYs4BTlEfi@c-EL
zpOL2YdkvcZbA8(rW==<Nr^9<&8>!nawTL^a&+ePMyH9rC;CajB%;>qp4+e$MV(yPu
z{uiDoS=txwKR)$s+y&i*;3nP{?s+zx{uR%Tv7TRu5w1LaTCR9cvpN-4W^@CFw$YxC
z1YMuo-u8q&DY9e&25;YgCd6;uJm;G8Op}BM+iI5($aj*C1Y?4QudOMh!Y<?v51R|y
z6N|Y$>$1<6*$0K7+k#M==#1QKA|(3Zkj0wu$R<-xTfnyscQF{YoQB$6_v?k_X!nN4
z;Na86kZW%Fjf~rtBn<zp?1sHwhZS>(I;c6RO|7cM)ofJvkH;xw)oMeU@!!5kRj%?#
z6%Zp3q;{o!Hv7+W|2`T+Wu2wr4F1;ra^aLdHyfK_m+`zwYvG=wa=uZwXa%+}?&MEG
z2@b)O?$%Q4+VPO&o&N&8C1sQ?)})1;zHfAPaDGQy5fi?W<E_U=3wNT3F+dw13b>kz
zAWEDH7w{Hz`i3UmdBt->K6q{m{LhIX0h*aW0q^CcQ3%dXj;2&Gcg5`};ojlXfWY;I
z12Bmjx?vev@LQSKC#3tw>v8@TI<KwJ^&SV{2DtKTm&;*Yn|9V#9h%H9ovw7Hp6T;?
zYm{%(5T<<{eBGbjURn6Kw727s)V>Iu2-Zx_5NMMg<gSBqNs8eO1B=F`PfwHAuFXrO
zyKF&(6BI6^pob8W9g7oNPMP)e+`&=?xagnf@XTAh1NC87g<4ttqiu|F>sHB-^j)yI
zd%4zsgRXN7>iij|bP!OZTveFhLIto-+i71>Azs5K8Egu=^Qs>wh{jnTSjfnS+5BkG
zwAH#eP7DwG1zErNoAPf5vp=On|71KzpmiYLh=mdLgh~7Bw8oQ;XPe0B?b9ut(!9H}
zh>Hiu#qV>=iXYLdl^K9_7y;pQ<Wb=IcxtDfM{QI+QRAhP<OocSRA+>}@Uy~sDvymT
zOFqTqO<^abLYz@OT>WbyB0W)SbEIy?_cKNe$;QB^6dKHbGP_QDJE<4s4hHo|uOUyH
z3_;nI$1bZn3ZLb^?urpT_&uoTT|~L7<7OJXbreCpjb4f0jt9J%awk{(*$3`9*Y0Jk
z-IpVs6FM8<_ZR*o!6Qn%*(=<?uCK_0ErqpfdIV`dJBjneqM7*>XX6d35g#%!Rqm_5
zSoR^`71wSOK2$LBm<UuJnRJ$=kRJKBquz<>*n!R<EnNytXwE-`DNeX=Ic%@Bv=mP*
z{p~bLgy-QmdL94WPV1$YTDJY+$!kc5p=}Vzo_;m^$^U%e&n-N^#9J<Ns*G3ndgv?F
zBg(Ui5z8WS0Q=Cr9)EFDY;uj|z(XlpYLzO&#?;@E*~M!#t^1{<J#u`7uzVX*=K)yy
z9<;P)@p6Nk%j=%MGM$4-y_j38!PXSQ%y@o>8lluZO@`6bvYm!2*nh(|ab<ma>OY%z
ziV9$y_yZJDU;URW(G>!{yH6BSPyMy3{$ZDH8->(cf35%6J-RCtQg{8+Vm2OG^|EPp
z{k5|c70%&KFbB@-+^vT9;VBgrzI6k_NJ0RQxi2e85;I?Z(~o#VXMQcHSYKNXF_jDk
zzs)UJTL|GY9HBMnt<Ot3XF8j=j#O0WB<$CohRnFYygDlf?dth)_>_#h#7=9BKa{pS
zPwz}7DBDSbHp*IaCz)U4-lx)EyB^fZvV?m--WQ*p5k6M5(#x#r=^vf_OEzmelax1F
z?iwj0t+lG_yM<SkZHnvj{|;x;1$ScZ8p;1-|7SRhd{JCqJE}W6qwXrFsz`tSH{8z3
zfem^Xd%}t47QPyCZdS+pU+*d!ty{m^yiKK?qAz<FBbD!YGsR7Mw338_pHx1(47kmQ
zt3?QF4C$u0aCSXTpx@_iXJ08i_f0;JJ<VK0-&BdO7kr9e%R9V}vELZZ2f1b!A_*<&
zhtk%I{Rt%2JSM(7S-M+Cm!;ytD-den^z+q&_sN%eGoFK~iq0_*-G623<@s#H_-soX
zn^{qm71RzF#Rdy_-cM+m)S;D|Ln!B<OK)6_ol&Q@CeQx`zU%KHT0@7#c~N=z<U4hs
zPKiD$9xZ>owS?XsR*w}rB?aH<)w^b^@U;j?662n-TQ7BmKBfhmW}<#;=ze!yCIQ>)
zvCb5D*ZDyEHn=V!axXy4{|0^Dt*fY^PcH_}$6j_mge@DvXOP@y;DPslfx@A5*&ylD
z>_-2S(MRDKE_RH)HO&5(cpJe&+kA^GV!-GEh~j?yv#pM_4uSg<5D##=GA_N<rK<WM
z>s43q?L!QQ8}$kW#(G$hs@q0qXTsJW%NQp&lQJ@DGb9wSyV9W_>k(Ik@x0_3jaiy)
z?})lbD)f2bp${^Bz3^+mhmh75p76yIa9oK=`<T4<@-Bwwxu)%4BUBhQZjl_v0@;B&
z9g!zbh`Z5!5QNNeouv1bX8^q-jWMd_HQzbJ+Z~~EY7SA}!h<!g<%0hbR70XsKJ=9P
z?Z`|1kf$Xonbxm5&;xq1!SxIoe*^v-%Kshu6o0ObX_lLtT9#SaQ|)kbg-VFOADY<=
zQ)vDvcv|OM@REI$t0RA=fnLPdv^;Yudai0zZ!8*%m*HC59NHk}V~s*K9;`_j-2-bE
zIfif`A|8ad8xpS&rFY<*&wqi7uA){sYBHZhi9c&rowx&)*_g(4&O6LNSeZ!dw(vd<
zg6V`|3uhmP0><0#JE9WnO~8iEx>3yy@t&9tgq)Z7D;MBf<=T>b^HRcG97%?cCLAdp
z7=bea5leUJK>8)aMF<!2z$lYU03v_wv>Myiea&sHtLYqgAuX82!@6ZXKoL`y18erL
zo9-q;=UB$_&;5g~E-N9(1a{4Rb5iYnFEtZ9BY_e@%4_R~G9#D8U$Vml^s4rb(I@Lc
z(6#R?9OoHoqfAE(L|v{*8FAhuq08|zv#?WE@-V9w$wHnmgsXIQb|>qkOuRKpWVU6t
zO%929V(?bX*u%*l;nPTxI_g&S<&kM<NARj`Q>BT1aTzDKS<W(C8^1h+ZPyYvnV$?h
zZl|pl^BY`LNF(d2v?CvhxCZ3gyAU89kEvkfB^&d!S}-VoXc_*t`&Ty@w9t}9BG<66
zxxhUNoWKjxtJUsCXl;wiN?ja?#w{|VQ;3e!xws}m_X1_vw2-y!VXX~)0&@BuPo33^
zVnfbC%Ve#~b!w?hY>&M%P+8%vMm>c+HdZB~xa!#i2(~gb63YpYvK^`QjRN!v*Wpso
z$}<Qf2wco$N?E5XfV}6g2kwMs+S7G2USZnY*(P^*p@PHP$lMQwjPrXRL0(6r4K<X<
zoS_t`?ll~A3S%7Q=n~7^4P4U`*b#mg`gvv=s+Zpq&4b@nHXLGhlELH*gev1t3km&t
zdGkOQP@Bk2tt|kIc`^&j<C%7O!VbC+Q#emwaZ}l9{m@yzyOnO!nB;Ur0hC&B&ti1n
znAKk2qhTNX<yO0SA4%`+toZq70u-ItY{Pn<%O#GW;iodmUk#wl`qT@7YwnbtU##{v
z(~#y;Nux?tQ+E}xzu24`@=F_0m}+N}g=Is#jLo%Sq`-x|Zu9<azE(-d@ze55hs9z`
zl6nIc3WIaHaZ&00fds2cN1_^L9-sh`c=l&@Vfh$hspvn^&Y~#rNrp83>MxagNF)xS
zj+{;!SUlTe^fC#j+E~NpcwopS35VF;n&E&wy=ZHxh<hz3M?KqS*YG6o^CxGw=*t>y
zlMY6^0E1-@rpy#N`Q!0EW?=i1el5;x;Xu=-v0~t6SkztRy?c4M_Onn7Zpq)|L31<B
zq!2?ov7)79V4ap0d4b<8T@9MmWX<vzI2ym4HU{i0?_5$U?wo`Ty0AV;sz6uBNGTE%
zP8laGHo6~UqUvXv1M#W&rfyxsiReBW?K=<PKcNt=&g?bR0$P|nx|yQJiw?KiqD*I)
zL{G(y<BEZaL==(jO@!8qm=m_F0XR*6Q*0c2zd`>v>pF84HAX4+xGj4i`@xlI-CF*f
z9BCPS_L7A|o78F4@+#I>4A5F0=o81hI-oR-Ol;KpESkCq{=TRMJ0F*EV-t6E$pkm~
zH3#q0EVp*Ibi0UPZkFbxJ_N+Ht@{U|0lrnM?#5Gbjr}=31<2(}d$_+;kUY&3NpN%t
zZ&Pi3W5R|7q<3_|Y|V?8(o;RQC-plju?sR<uV?hz6wCteuw^0Mh7-Q9rHg357bVu6
zWMaWeJ02Z7?q*zNgH3GMV=&O2Zw_=<f@{1)WhsgFvVQbi^Q<@}M{c|ETd*7xo;e7N
z=g!vuSo|jjAKYQF;UGV~Z3L|kbeO(;uO~tE96<G6g_UKW;z~qjD?}k;qfwnR6DZei
zQdBuQLPS&?>8=9N&g0Al>lqd6+xJgWcNAMj4CDOKb(t?4o6agOS<CZ`)&cFdIqrGK
zhia;Unssm*5{py-@PsE%>Vk*Yb&mUarT&W02q^e@X=I3BVlDhJ)M6B+yQ*vkb3ex9
zGam4ykKU$Q%wM7qp}L`R%ow{Ahj9Y@JO{xEwokBh=pxafQ;}r-lr*a{WNt<@M_>71
zZ^<#D8lWo~T@|9sUuQmQnsvOVOu5HFUbi%Z#TMdBO7K`S&-;?2Zy#VVzly&_qCcdM
z(Anlb7?0Xe%%lWsbzc#eu}Yse>wL_pgYH=O#|0jnz2HDe;vp}_NW8Kpv|*N467dVE
ziZZUM423vmtZ#o*##99_g7LS%Cv)_mi|ubV4M@u#i-+3$>U?umURV>=sn~xAcJ@3t
zv{th}RIe`QNv@0?r}Ez-6Q1xG(oqPHELhp5(*r?5YCsYdC#2D@s({HL)|FU1RDZLu
z0oe0nbXtw3zl*w@<4+<$YX>#39ObS9Zc_aIkz_vULf)vl_1IYO2aOT*hI%IWH+HLw
zGU!EkS7g8&3Wb4q1=w9;x`j{s_uBwA5;b`iuvGgdb<LwXXW5{3F~FlAyR!`Xjozky
zynRSW2gACY+hY-8!)gBe7Pa?fuFi75aHKNQQ~A7UC{c6&^XjIB4gv8-=rm;gvOR=U
zBiwIEh;Q+eUZvIU1^<H_^H=DxYiXz7VVChA=6`N)^nM=69-NriAKioseDCEtrxp4o
zrz35G5a>xH!$~h<82&5TZ}TpY&fIjtwnAqjvNFSvu@O53E^<RMCcn)tjZ9ql+%@JE
zpEN>!Sv<sEBi?@ppPi=xyf;Q{^S}ij64i)P&ZxXFv6;Wu%S&X`_*2nq&lQHG)I?$k
z^@kEU+b;bl+!~LsDh(Q<g`R$;<)jSsV}%IlG@<U)nCa%a*PBL|8GH(lbK}WWE3)24
zRzIn=CtMuKCiLhu99&cNJpTEDde2jmda}KYbw=|cG5*$Xz?^fjL#3*^yVAx@02Znp
z5rB=~utPK!+<?=BWoIafV1$yu6@4FpN%65Et)J^HkWT+spI$uKQUCPz=xG{VQAtx?
zxpf%-#5!CRFI)#l<4UN2UwCEx+1$UGZk=%$c#;5^GF2**LRPOQPk0uIMoY0fD>-3f
z&o>F@;`r+mD^88gEQs^^k!y+ahMU57e@xjG$8?UWpK6Pd^5n0g=RAOIbRpCa!{OUF
zV!2^n@XD##XI=cU*f0wmiCyz5cP%O=;}-tO;3K(jgsSuv&RO8*U_z)V4A<wKEhTr8
zAi@`9gFojnWV$^@77qM&7|V>?MkQIpfRTLnu?6w@p%^N|bAas%W<?V@rh*<nmA#%I
zeUbS?atl`JY~$Rw0`n!VkxhTT=VV<vwslv@AE*`c1#<R51gq#l)(%^ZX{M+Qq51NC
zU+1*MEYu{H&22pzZ5^vjwI!f-(P4fEyam($BKzop)>ORg#*qm6+fxq6GOb-f36V>S
z1^pcb<7=dm;8P|<6}gqB3t-i&+a3PrS)KLyj<+#glg{o~*ElxJIfgClSaDXQri`nA
zfE25ArQBn`5306Nio3L_Zsruk^xBT{2Ohs+@~bLyDS}-x8_UYnci&5I`Sfm{ntB#X
zW|96e)2%)+GRiw6TFuWNt<re^qK()6G$?UjAj0Faz~#?aTA$}uy;BR>__tE9*X!;x
zqBX&bW0Co(E7^-YJrXO5V2qzHLFkgegWPJ>j976T+}4AlZzKMa$7L&T52i0!ZdH=v
zP6AKneI}Yq)+zVI48Jo%r~9ni#d$+UuUV6D28qz;&BxwVi~T7xqv((w?Fln?1{^%7
zlLl&=#-<@Z!!4T-;rvVaAohH_hPnERhELz{YSK&E<pGD%lNp3{y5Nh7UPL(dpZ4T2
zida?u+|js|sXpJ)mEg$<XjAAI5x62VeTU3hxN@(4Q*>RNBSJDPO{R0mdNcVi*hGHL
z4TyYRP8_ML4{njoMhnt=FcgtfHCLx7>R$-0)MShDZ9h`|w@~9>1tbIyK{y1s4uX@V
z@(+iOS{y~k*i)!JS=;Y?j2%@Jwizu9oZbGYenKaS_vI?tPE>U3=2of9erha-fN!KV
zv|$k+JxgGLINi9n1(EYP^p80V;fWK^Md7~sOgGqW>6U@+oA(FD%6mSzEvCni`{on4
znz`ymM#TVp<H?d+b2sU+3vpU_PSjD<qw4B6(T4CZs3=UZc?*Hm`I4hnx0>#sbua0$
z&ZzR6%;@+h30|I(KiLHG6c4`XIu#oJW|Jr-55xJ8ao`67>aeZ+ykw{WSyc+pP|edj
zuG|41c-!K?_mxQM+3}FL`*1u*IxCKFp|nzT4HTf?BB`&k(S1H!|KONC)iySfH5fUG
zs>C$WQjs<lo&|0n@SnisSFZf%A`aL{Y3f!OZEA_NK&o>bPSP~@YU{X7*1j-_0D(Lj
zV_w<KD(J-4dcR_0I{tflwu$`GQcaIDvE9Yb*Y<3$YNBf)!6a6M<G}>1BcUc779foZ
z7QEuPFGtuKFQ1?wsr<1dDlS$W2FOB&*_^1Bj=mHgr3|}Zx<KWGIAOP9HqiRj?GA~n
z$*ASZ=p&Vfj;Cf1KQ4JUTb3}%jO0j(49D8Qf^@>QkCZdvxCcj%8ux2QAFB6~Gv-aa
z9l>lNr-JN9?f=8rHwH)Ad~YY&*tTtMY}>YN+cqY)wXu_pZF`e!Y&)Ax_MJz+|JS!_
zs;26mKHbONch7aYy~Sf(YFR3|*;cF}eE8nn6&!w+fU{T3kJULHL2}4{C$)xwe)hbg
z!y(Dmf})@srzzE`tev1}GP~|~c_?U06VU#o*rP%w*$1jP^3n>Qn7$~bEN{}v9nO=Q
zZd#>TNWx}bSPS-Ew4>I^8YdMA#Cuu^uFh#B@jH#C+kwjuz}7p=U?q%J*b<31t1Aj)
zR`}SF*E6<knAJs3rLot*_|O&3S1*zm3;ww5V(H0gYKcvJB?R$wp5S+J(UYkXg9AKs
zm?@a{wZ%4T(d;A)y9U!XXE0si^HZ0_*)OJymet19v6=j1U$lsp+S_zbyn5m%jU%_|
z@m(}C_rnL<(cME_P1>SRjNb~S*_Nps?t<rAPo}ffjs?bwejRW1uGHkdKqpfz??zm~
zAi#7q&!TR<4%<;<EXg#`=HLrH<tlC<c;OXHVb%`z0$1yq18~8rIl;4wlsSrsdz?RO
zipRE0nHy!x6OweNIBb7zB$t%5)p*PZyd-5>YBdhkl0jwyJjt(SHsV6-zHV+Uz+Rk=
zpXNKy(D?Y2s}&P4?u8@8q}P-}D{2ct$=0xzyQ?`fu<A=TJ&sw=JGlL+F|x8U*#Q6M
zxczNSm*Y@(&hGaLyIa8f6DUsj6g}yQ+RG>kXvNW&c4Xgh*(1aS+Gp~GEm~ZeD4M;!
zd)w{JQwb3&^L<Wdt#Q$9Dcx_;C5`tp5(MpWSaPgakkr(7QCN+$Dq5~mf$YgJ6bGim
zA@e^r^!#@hs`-a$5yc)M_nEgbh$FrsZ(ZP1$fGRKak!f-Xt;}T250fS88i(W`N!V2
z4FVvWI7K{MsG?=f{SF8F+3|GhnkYm{K~B|}+`eY$?E8<Ze;Datuy#h_5#EIm)5pi^
z%VwhDbvL+{?F(P7sA63gcP=E3J~N(`6}`$YDhNp^Sbtd5CKE~;ej(`OeW)l39|(d@
zru$M*>8@75jg4t%ydnt_r(8^CPIg@h{@u8hL-^~%<k=1_#{r*suE6b8Naj4nhYly_
zFA`ml?;@hH^As>5Gv391p?qDM)g7fX=j1Vi*(K2Q!qfS;M;uj;s%16u4#~+zR276Y
z7{qhO*%|TmNx-{-zRA0mIbZBv!#l4|YERx~&KRGMxw@{zbEsiQ0!n5W)^15c^>poE
z>>YsTBU<u>LXzNemON3gr6c_0G7ktEKUw6XOq`cf_b<PCZ~KwSK=1-K&P9zbj6LFg
zKZ6@9L1W(`K07!AX)=`XY`eX63iZWkvy9iXksRvJ7S8}Q+CVjyS-W?rhUx&H)jh#T
z76qrrM8^i(1#G(7tFf_^_zfG42pN1Q7EMr)Jz7pZvC{ckj{EOup9dq0XbhxAZpvoE
zi(?7Fq%pjcEcZtOc2vZbb(4_ugl0vD%m-7po3@p>dbHu|61JarknEU9zgswykht?(
zdx#(i@Em9cuS%mr*2{~$Rnbt35r$c8_w6jCrBt77H?~eA^jK^`P3`#AkNQJ$BY7*-
z$8r-hGjum0vyG%US}`}I=ik?I_HLw@k+-V5$tRWvo5?b`^jUDZ2N9O}Xh0!E7*6L(
zKtp|b#D;XoZYKfF2lei%E0H{DgD~F7XttM7e&S1~@o;2R>1@91)emaR$k}x0E$w=d
zzxk2?x23KYBzaB{ob&LVi&x_L7ef1#9PsN4C-6}`-<&6t%)TL@%~+%ufI*E#u>Gia
zw=KalmE~?sU{;l_{G~#-Wsb!5yE|7-1lgC!Yh4K6K+0L2z*wmu#Fr|0zrhsC+A5y-
zWarQda--=02T^40F3la+b+8Jid6yHE9+Bm8ErJ7sVXxlYwggKGd|I`WH=NnvE=4x9
z7O|dOuXd!yhoKTCxt?c@DvI896{&04jBPZI=0YWY?-JdZNlEuUI5Tl<<r3eu^#XC4
zr9$XfZkiQ!Z9LoTRkvt<XYANgw*-ownUB~p;y`q}>^kPEU1n()Un#SHIc(uBm($T@
zFoAM+bF48TG0b~SL6_x9<8gzJSF)0p_(e?;&V>PWoc7mmO8IcU7)dsi?VMSkdR^Kl
z?3{{Y!Vf8XDak{U9&2kd3zOh0QeIeJ;Yg^@8T^uhcKqKG2Qen6C;o?8Tk36qa>)vc
zw_XtfgWS&0=^HLHVY3>3udHE6Bh>==Z6G%LrQvVSGJ{Nqgo_nwU$;>=+IFf6x`f$4
zGik0KVRvenE&*r3E2hD8-5M*#@=|F6VfI+hPXJ}zTm|XhH#wJJiqQ{AGhfQx$IU6d
zr!XySy?oaUu(?`@XT=b46kTw9|K*UgKSun+!c?XlD{BYzAlI_$W`=H~d0yF1JFHw7
zv7}H4`j&Uxm6Rr%{&KIg*KT4#EEjbC)Yw*@CZi|XyC5!e@Hp;51K}-!AL-ueK$y}f
zhZ0d?&Bg5$=6#@ryeir3{oA{X=&W0OXZM^-HWYj`jK_Tq1CiX^A?sAMUr?$xp*&x6
zoa|LKNg}4jnn7f|-RkjA2Kf8=hliY#n-rv^cii{E<vRsGi}SPZ$yARShb<;Pl!lpv
zCBDW!4!$3v_itzn4F#DA6id13r%dC26HI>1U|(vp_!Xj;E~j`1r>e_FVEc$=rpwlf
zB`2%H%3vP-8I$|>PfKmNJ>v2753tSoQhl<F4>Ar@odKkV*<9)JHP)Re21!#|Yy?c1
zt4$W0t8#`(Qz>WBe#SOy1RUd2@#hp93ijGYhFNVbW}B0!9~j&WS^48w<@Pgb@ht)3
zfx-^9<yRO>ru_k|SJu&=AzQO0z5TtcSLQP<wOPHy85B!sZ-dLLa$~q35F4v<R}iYQ
zvgK|0EcN5o6OUrO%=WhB{@m=B-5lpcDeu`^tMYdBK)zhJ*G>-L?!O%Nj`p%1!KSD*
z(W#P8I>mhqJVLyIbk;W(Wd2H*DY%+MN4OkcdwYuU3))&+*DN2ui*M*Hkn5CNUwHl%
zdH5H7fXQaNS+iau6yuju;(DO+pvL{<KZe~Lte5@rq}Hz^)-J|;g#-SfM{7@~8OtOx
z%WXMc+W7pZS4FwIhlb~6RopCz-r_!DBH|bJ=WrUF)uXPLCqOlfDihi<1vk-kAl)HV
zf?l<6uZvl^E~Dlt)*-<`uUNqT_)%T@R6im<cgzgk^M4}Eyy|UOX_gZlwZEsG!QF$p
z7@7*QJTd4xD9S0@dpK%7V*Sl~FY8EX*`-G#TNd<!lLB8!AL-wtqb>Df(5>lvqMHC>
zPUwF9N1u0U$@KoS((Bf&&(5uW9BR}*+V3c;Ygnb7ZmO4s_F(e<f4b9f2^0MwrsIC<
zo?X!VcPQ~5L&?qnrD<z2z2MnXApPHZLLU?EyB5FVQPEmz((gNjJ9qcw^V-VDEztSO
zvbAy%vBkaS()auV@%EPthFK>0q|a}YEsoscRxe29|0#PJ1K<0I`-sJT#6Z<E>>c%G
zGSLh*J}9C9o+9PNdmGmv`EQSorjcCq+m}YGzaOMKPjE8a7r4u5;x^Dk2_Rt?WXQle
z{EH=j^Yh8#hZd~w$I?C5692Ke-2Sal(C?a%0P7UXjARR|Qqv#?ujZ{wAWC)IR4?)d
z<6o~ysUQ_(KsIT*JOlI;5+c8_-=oP6^7(c-2#D=ndK1n5FSyXXI|LlTp;sgw+S!)=
zu||N&xfy5O8WWE*f$ekHXUN|^hgA+R3St>E_p&72qR<!Ik^R@0Bj4-w9b;5Oo&aKx
zDSx+Al-sEPVC@1tmhhKNG53-ZVZTt^r;*JrT^rQXW61uR{y*~&+B+M^i1(#Y0pmF^
z%#OaXUJedVf+(ZMaUUYzw~HFn;GdikP4fcKxKE>z)Oelz5DF9)5W2R#q$+nY`QA{Y
z#k}PH#Y=pL<eF}aju!`Ms$+IjMj`mu^zDCMK>KCTmFZ6I>GMBXG|OGeaMs}N>|Tvm
z>0aT^L7ffB1RD>RIekr{3v@bnZVdk&whBF5^DUrlsce{<eR+wa8z`hN>D&e4)^VCs
zLuY+w;Ez<eUYTY((TjGQ!e?T@iP;Otn%|lIGO_O4&NrEXZ3-a;svV5?A3pg`<hfpM
z6MtMdZ>db)sdR4nCkbv-V4dqo=k$o=8^uBpjF%UQG9Kw3hpGw>lDQC0YVMG!Y#h=r
zIh>VkKG#!hD2tSn`~|+2lu_N&!G%p<@Xpaa4m723IBikFTGJhLd`AV-^V%Vlo&<3e
zQ2U8|pRX+~pQWJj67819NATe{`1uT41r95}$l)F+=Rk&a&@B(VdixDqoQzEo;hq`^
zD@}nb0nY63H})3QW#}2PrDUgk)33NUrS0U%;^3V_Avbt36t?Ac7lYp#2yutG3~b#$
zE}UQaj0?Iw&KrKX4K-H3Y`;Sb#&0<Q$SFDl3}Y>_+W?Z@dN3P>wph@MYAxo${>&7O
zLR0P1$B7m@9_9Ab@ALTL6XFRYa^*K0VuS{h3+bDiy9ay7u9wtsr=b-qUw?Ja6t##Q
zIW^x4!^Zu<cPVT&tuV)R$J)5`HEh(8c0`KOl$De$Xh14&#tBexr4D_qyWsHt!p0UQ
zg=1~VjGvz7#+CF@+LO(XG7K8^CMT%~Y@5-Mol5SH3f=qTr@gHKJ1Baz=?4hO1KJYA
zJ^cYojLK~YbL`E_H>%yxg1sF0tp1wplUZl<m7h7Te1rMHgsmw<vWMCpuEIZSEVmxY
zMVh91-x(T0tGZKfzfaI4U%qkO>ou|F4@NI*&mjI8;?o_hMYyj-L4o8y+ELv$K90NT
z77={a=;nM10Tc45%iG1}R~%f;MrzxJqZt&lbRlxvSGNbBtUMcdi3xCeau}{U5d*Pk
zU-sy2-i!7EPP3LYSDub8#|Y1vg>(GEf`n1&(h#J%3lE_;Y@d4++0xsCc%8e(xLvzN
z;O^*3(ueMJt{I%put$IxzL=XBKMLUa_ou=8rY)IwaF3z(RHg|A{r0Rk)f+|drRoHP
z=za1~hV^Oa=EZ>R2O~KnQUmwhI3F!_jaR4>=`$!F4X62b>+ilyy{DvTyc+i<UkJp%
zjqk(~eBr6$So%V-A9l?&k5s>}L!qLyq>5pO*z0aK>2*wQ{Yz;_j<oa6cS_pWC{l7S
z=|@w!$)0P)hYe>NPh9rUAdUIj*unfysU+eyvrJmv->$9+5iZcyr_jstZGpI3Z@wC|
zZX)hu(__fV{&kmbKj_rYRon8H5{AzBJZI-#_xSRis44qsud{#jLf)RX1z!jT$6k_N
z^^=V3!?P}~3D3$b6A>$Oy!C<$W_sN4pL($*vU;|8Rr1WJJ<b+|kyfR-sKq$!ObxUn
ziR(a*$#Uh^-674YS<d&}sy*B$+IiDep`H$oZ9+qE`zTR69tyYb5Ei&73^}WCt;UMD
zti48N1OQiDQo27%+CrLFWNfx_vsDJ3N{}>;Xo<TJ9zu6y$nHhCj+0?r;sc!sV=iZ-
zPZ5t$eyQ+@*wkV{CZ49F+uW7M8pnxIeI-so5kC~70MTF$8;SdPqk1%wEjyPn@6YAY
zPSjbCgz=7oNmHdN=jj%)7IfYwG^-{j_!ulU{8ILWuUOxY)D}@VCzu&Ch2KNaoIDmk
zFMp}txRKOGN3ob5rLh0KY03U;xOb4MWPq46-vH47dFuGQCrQGfPvtCd>)av|$9ONH
z`+)BmOf{ILk3g6dH8V`5Cp@T6Oz`!2=YS}iRMXG$LctvURP5pEx+NY^JlD1K!vIp&
z*d|Li*GT6Kg{Dyism)$?B1M6SEY7DL9T^GJVVb+MiMI7i<?<@~r-H*m7ZWzAzs#bw
z?PL}5{U6jnyK?2e(O3rK%s&ukSEXs8dT2^%Z}6ve(z<uMd5Lm$@fh#KQL2GAO#h|3
zoz9P=!*P4_pL{%>_&Jb@2@hiy^Qq#hL;&!xlIhR~Y+6Moe3w$fIl%*{lR6&TunTe*
zkY{|3lvU}^*bp*6a^EtFF@`*ibVPzu?x`-hQJ4XY3`4N0y=8ZZAhs`3ro^~1_+Sca
zc9^J}7d8=x7<ulw1e-rtQ(fzan4{iAv+ZIsLH!E<;x*0(H1mPf>OPsM_LMO_Np79j
zk~5dJWuj|``~JS%$(!2K-j`l-^A0q*s{tc~K;||DdNd(3cw3S)G{aL>XL;+%CxKMS
zQf&NEad;k>1fcAuOgVBz+tx-fL~$65djmnkG^J>ts6FWpHr0#p;)@PRv>TAR^AkmC
z9zF@vwS(4GV;COMflkL!7MCt2a#Ov=s4b}zE9tH=w3enPLZD%JdSswqmv?ljh%r-b
zk_XJ=18(!00a(N*!{y2zI6-l4;Fu@5c64uCi2ihCfN{M?9hu73dB3u)5EdHS&0fX&
z-9+l?)#?aFfGLD$YF^_8wuEXk>RedpR}{dGv=)Pp{P*J+qv?EDWsY4XY8HV3*gq(L
zxbdEca-~&Si|^4uE4UTG#G@v+n_e1xT7!+vNaci>CMz0V7$}xC2aEXhe-;FeBF(DC
zF04S2<<rRJm+m~~mUF=`dWKbQtMzt|XjyGuy+eJY)^!Y4^}8+z3=eeja8Y>JmSSEX
zUB(pQcwa<^$&fZ!Abo<KtH}1L6=rIqBC+baE@nkhXuKSIn0rO}T65M$*2@3g&&h!d
zVJ6cA)~%7C3gvS-L}79#Pmh$d)rbpw`H158z&aX>5O>Ca7IlRSI2>;^ol33!h6K;3
z1FDXl@Cl_y7>V!o9YPH2TZB?ih+uJPGrMHNq*))i@ggCWJZZSmJRuAiXtiq+wB)16
zXh~i^L9E?ws#IA|#2>`Dd~iK;8VDVxHa5cA3-rY@hq(Z_FCsBANIXkMmu_@<T+(~!
z7^@w9{YbOufl7n@HB%C>f}OL)PKfRFELg2`h-zrY-NJLOFL%QX!;*qVuxCY%FYLbu
z+A~DBb81xc&og*U9ZNlf5=?KoUVZBM$4{$d@X_+7$JlfW4|^TUWgkPCKuyEmX{>n5
zn9JQwCee-3TbrKcdU2yJ%ePbKHi-&c_Q$xtMEv0cdo9=vWf@dqbFg5cEy0gtxaTu3
z!;qpl9IaDHqYe{e^7cfAN9ipkpqiWKW!ys=Wg}s@V}jRDr9^4wiG3D2-%izcpqk9h
zont>mS_rE<B7BDmc{gY`izmvZQDBE|nl_6u^5t%#dbHNZ16$~$uO*mJiQmQ&7Q9lC
zsy{7Ad6p1+G1=2@8y4hBRFQR3Dm9N1<R7GSCkMomw|Ag=<SRpBEG#q<<Vr@-4o(o_
zsI0vXbdvSRq);eNsAbpeZc*=0k*7>u?L(S2j)92^reIzG-sN}};<|?4jp}!iMpI>$
z9b^;&N|*EQTI3?abERAQs3^k+z9!1&c0a6$oUNu&*IJi(r?akk0H>A#9AoAzi|QBt
z(LGtWbN2=@DPskdHi9T#glgi`4HW_G)Wc2ft<<&`k3i6X26iUY@l^P61{EF@E@5f8
zg=mI$f5pOL=>$_~X~8R;G^wepW*Y){X$BHF`n%9(qVlF($scBf@rRTvHVIf#rx_0m
z5Y>W33SkPQ5nW5Jbd5*wS<KH2mY{*RSEg27fDSLU_B<w7)@V)9th3Ez40E$Y{usSM
zZW&K8lT;43PlS7oxQ}I>ekem!b23KI)Ux)p!YWkF(W<<M!vt)150HH=B0@JJn&n@w
z6Y6ZzxNHyXB0IYKM7c0MtEHLflu|Puv-uSlx(XC{yx4$4#n|Z5a{poXaJw{s%ui6Z
zXCD>Y*HD)80c>8iKpML){jB`b1q!(AcxvAggj7&E;TN3XN2mO4Pei~FAO1!9>p<2c
zKOhVyE6zswH}$vu^pqy2m5fY(c!H4;0K~TEHZ*~(1SChW7vj+@>~ABUZZZyY^Z1<a
z2N2(FY-DhSWq4gsTL`EYe@0yn5fZt;tG}U4OSuxAV02@b6w!Qf)uKc)C@3L{)5Svt
z(D;otsf@|RAes9p758Po93)N}0S?cL@s?aF0P;DHeB!Mp&u9?*E>ttM>rGO}h<~<n
zONs=lOU)>tOEJ4~v)yAFUdOH1Rn4N0y_+6Ld_{haNopV3gGaa!ZW{_gsW$zVfvdxh
zV!JVf5HFzZH%s9*aVF$N<`f6cpzk%#;a_1kDSX5goMPviLIhuZ?rTN?NV6UzCCNoU
z%a$oEDSYmG*$Qb<vA9o-n>T#Z=_Z)Mm;4oe-~i_-%i;ZCuROS{jp|4g4cK1)eauO)
z>)uiL5tfBmJEQ<NhVP5ophKzAW16>6rr)Gd-K(fWT*=9YCHv<qi$+HD`Yh>HZQ7jY
zee2Fnv(zO?=rRrHAKztPjpEu}^3OpbX9o;0t*2~g@ZUSfL9kLvC5or3vkWHm+wm62
zrIa7(oi>vTjerx$wSI)^B$#8X@2gExLtF*6ZIkg?4I-idfKYN}%X13adWk++LXUaI
zlc}A;kJ%xUlVT2o#&apEk#fR6LrSGoDb_U_pS{NoeOlb7+JCOhlA7JJzoqS`aypRj
zMHTCvA}kq(%ZLb?iJW8h_LVFV`mgqRlhoinW!pn>a$KPZ<W4#}54eoLwHLq(gv)L4
zs|OUl%uup-jPO3J3B%<ADhKbPU-BdGJ4-phMU&g;+!)7j5b9udkmSgWGL3Cy{(g4d
zhE&j<(%uzD7fL81#TK$t#rpMBo0S3<tXwCxS7+#_;))^)1>uTf*$wH(aN>DId!XKm
z)Kz=T{_y(^pD4jf;E-rfM;*<9hL2)$-Q7h=MleM0dacsQtcd+88+#V(SM+EdRejnL
zYoCHaz3g>5HHrPcst&qVMrslx&PC<);_2GHyO&Fsz?Cn6Vq&^N!MZn@nf3a_T!)YE
zR&MAuN2b3GQ1op4EA()M9eq20Bn3%d0ileA8xTqlQgnTcS?}-W9)cNsyVKrMv>gO=
z)szk2u_2_`G~N~tR-cObFIEE?8>@;F9I<|-d?7y<v1=`%7;m3nmXNtL=Uuh`)FV@+
zBupe|>9kC$JPBrszkZ{r^Pke_wz@k(eY*&4*{5;M;Wc)v!$tc+<`4kxvYZjG#rf(A
z@%zd6ko)?TFpoq^^LjbIa<Zek$7DOq+*UB7!H@_)RL}7j5;QHx;Q-Ez3Prq???RZn
zsbEHjA(80lME)2k2}Yvh7tLs82m9EK=O&m7AVxO0Pv92B={HKC(XMvNc=Ia9{bcJ~
z6T)9VId4!)*%~$i@|njAWIGe8d5%^^+qC|vdbwSb6ljYq|FE9)OmK@<%dFlrP&Cfb
zxvl<~7)x7s+u1aDHSiVQbWRAo9NP@sh;>gC)U@CG@gj}8;8#*(HAp7>CHY6c<YU}>
z^+qfqaICDg{HDEQo1AA2>#YuPGT%4QB7gghzp7}Ej9AV2gS4B;xCJyy2QU6AY>`1=
zL5;~LPT)u-vez0It;V=Lr846v&5FgRt{T*M7J*K!OK{1xjO)Q5x94yDudoHx{kzWh
zBKK^v>Wkg^;4ebnMlBh&TJ5i{(bJHLK{@<CBkXpSK}u;iNK>|P4%F#17(V@of52p+
z)udLr&6g5wivkYA^p%7zk+&7&PctO=hDJdlnWYUpjgFQy*)hQl%VHeJ>Y7ri@XRFm
zMe*Ysh(5IXNAK|a13)4%<H6e_;HK5~C#2YF^$5bd=qebA?7iZA(ap5_Z47ll0{!js
z_5q^LPP8&J^Hff0+0DtVS6dfYGg_^$t_UAbcRwP`akiykzu<>ewR}?sJieVUPMszG
zq}D4jb-Dhr_nP-y=lkNlhZB!0n3b?5-_`c|a38SyrU(-FPg#oK?Il%E&wu4AA5=pB
zd%md{^o;vC`SDl#l>(3__TOpmCr2Osbb_Fhwy$(Ab5rl{<N^U}{^<q*8E_`vB78k4
zNmyY&O>dV&=HNt#KiimE1iK4snAm@Qv&Uj8y^s38nwA5~-}^Q`y)b{E^f4at!<QYI
zf#r;9zqvrw<Z=T2sJ^OAAvnS{A*7ULFs#mJ>dGjQ<*J<gDIN4WtFwGC(1Zn7@fWF;
zEIPrcNeFa1rDcM2YNcss&8g0`Cfy|Tury{Gr-ZhV7svZ$fly#jDTQZV0fbi)l*x^u
zbH{A@`zL9-8ZDFKnbsAp23Y}g7SEmGmN0I96b6)bv5@k<fT>Sco~}oEI%Ck|!xB-t
zQ`h+jw_*l^C@q9QL_9f3f{>ukoR7xs6VYw$O44fI4~Y=5p`HTd(+(?@)M=K!gl21-
z{no5th_@0~_dg*CK=-KTeTtzAAZ!H(%i3zkm0w|EWQ(=IbnuYL;+4j(Gw@9@MgsR-
zj1sZu*0a$7q9$%uXbKg#LH0D;H+<(N)ua~}`}^T#V@#iXUe+Lt%~;o|?<`<43V=wI
zl2L0yFozK{3*w`@(tbWMJZ%ZXs4oQGkKXmx<L@PVP4xlG{tJ91F*umI+McOS&Ci+H
zTDfrU)%?j&RFj<m?ri#T{w{hvNVT642T+v`Elwu-dysw1yBZ`1TudJ32Qo&aJ~FJ3
zN#VYj^t(b{xLsR-AHLOXg*=PjMx^)#AUPdWRBi3<I}baBdG5bDB@$E6qz#bIO@T<f
zk>xXRw*|5mD7x553d(i;#;930rjlRggY3`-q;IN)1X~eR=9|jw#u8(+cIkDC<8`st
zLA82E{RK0w&?z9yQtvqnDTf7{o|N+_Z0O0tZ>YqtKpevzdm{CYW*LKC_c(`8$<5A9
ztXBF_nG&duXY4d9^u$wI8=1|ssq@q(9xMZbiYT=ZKEC^12*E-t^RC<(1Lqs8YGH?j
zT0ModZFEx{@=`x_&9#Xp8iwlEN%%@LM#jI9Z`i1aTtVM$*!=t}J*3E}7uA1G9Slu1
zN1x)jb1!n}dcl<ud*CN}o?~cSI(e|lV0a^XT5Y@DP2hGywq{O*nB4CU^3)3WPO~9L
zQNi2LzT0R6(a^Vvus)X1BZ-5ZH45jcS0mEI7Ko3h4^ir7%6i;TykH_H3O$1{1g&Ar
z-;%trkZ|m&Mv4zhrkWdNv0xi_KMD2o<t-?8m|%`tyOf74t%7l<lPF>p7kp(We@S)H
zv}g-I0q<Ky7EfA%UQSIWMF}gG@ji!K004at?{{jO!H@(&cd2YQZETek+j90`AFK_I
z*i{fpk(?)q5;b>am1NB%tmbdvaVk=Tr#+DkQnl^n_L%464B)8FjmqJCGG`00dQ<G9
z_7|9~{F)5|30Co??xuE5wA#foff_6Plm@S@s!K>Y+L*1!>4-L>IH;n^CVS?7PPek5
znYvuwgEboWaMg2!?hBgoN=sZ%hu1Lrt>{*`MIqjgR^TjII-knj+#4(cO<_Uv=95Yl
zGbX5vPN4;0Q>~-W?G+r9zb7%%><ah6@qb5QRP#!V!0D@njc6r44&Mv+>_hgobb3DJ
z&?-uEOBaLKYbyTU8w1CH@=Y{okE&7@*2HkvQ1pw-^9oP%u&R!U(_nI7$CbyR81<nx
zX>HIIjsF#N?z-G@^x>ce<6O3HRn!?MfnXsPt$c~yv<F~x_&TGj1QkvLA<Pstrj~eR
zBzcE1xKoI`v-x*if4Ru4BC2ky;1ZgwM)LGW`U<9erw4Iz2c96{%T-bR%Nv(lg7l=w
zv3(FB0Q^(ISdP0shM+B@JYiP_l@6)e))6m;0vgwxG^$9GGv;s{!lHq6INhb;@MhK>
zoQVkhcZg6=pW2|FaFBQHLQwh;2t<%BgYXQ4i&CA@$n4$JIiVXH%^zOjM*zP1B#A+6
z2wY*rJi@IV2@9B!XbAuIEp(D@KO`qUcGQEL4Nk&1&5CrOF7*p!t9mRZfQtBRM+M!B
zT%8x%U@U)!Pu0ouFSKl;S|@sckR97p7U&P_NqOWBbcvNG1xD~rvdXz_6Oxp)LKLF%
zfax=+CosG%9#mRZY$|0J?_qboFSvEcN_dHIB8W9nw0mF4JbM$)_>wEoZ6=iQeSzRT
zsqY$3@;DgY)}AgSd-`Y-`$OX258&9H`NOhPMk@DcLf^wWyr(v!u_{f<(dRpyxoGHX
zUv?#S`4he>`NmHk>l0R;Y6YLx%7|UjRuA8ObMRVvvj3}JE_&`7Cv(Rb(whzsPaBqG
z9)YKBGPYpy0IV{rc&5!PbXV{`vW|dox&SeI@<pr=Jq)qCrv-I4I9~#_>PcwPDx^Cd
z&3ehjvrTEQ;(H<`+f{d~zmUM`dDRs2%I)8LhaqNX7345>xLZa<<u#IxqU59;f@@$M
zaA9roMk96hAO%TH?&ct}7!bKjBt;0^k+9<YEvscXwM>%inIhmtT(0OI#a5@^QGu8!
z%L3Jp<6c9PGaAc?Ap0r8wP1r6vjDy<Ni+7{4=!bOGGfa!R*lMmcyj*iorsHgQc<57
zUVODV_5>nUioIznXeJ7eQyq-H6!8&h$IE57nvUe!78PE_6~rxc+Kn_bjG?}Vc8w5%
zYczyyp1E|wt?_<xNlkZCG0-z0uxRML(u#Am!m$$D!7_ne?Nn)dh=j;S8g=;ep`iyw
z4pxM}kdV<IIJrgAHrs?X<ceMToJgq$;A%1`Csw7LXgKMiNyLwT*44C@UI%6RB!-%R
z(s_*IFMbuiVM{YwQ-}K+D|2pvfRYyDD_KlmNp3Seed$Y{&BIzkdIrQJs)q<EBPh|d
zDj)@@i4x*+%`Q60gvm&3kj5eV-iT21w;{t9I<M&O#TdeBlb>>Yzn0biMJ0f{Y>hGj
z+B$AgLW%*N7{dd@HZJ^xZtDZIy_vrRam^z5u$#13bQ<9ZtB;th5V@cnmKYPt2BeVu
zQm9V$*dj0lco~PYTQOb=>%w;^uM_Qh=-ZP*3R_ccRsa(Rs59@$6ki-trRabmO^bIp
z9GLP78T5@*Wp}meHf+~W9bRUQqB0&Dg}6qn4Gbi^x>C57p}1B9m<O-&%vk583z09K
zEJtt_-JMsZgzWTf<=z#j#X+p%ojg~lrMEZ#&g|KHslFIa7oykY_C|~&Whm7*cyP-W
z;9J3azEMojTtp-NoOnE0zy$zOB$f%d{(FJ6`WhtT6e@-@>roPh1O<l~lex$uZTy{4
zyV=`X(-id!g<Zqcr0=}gO$iNwyerL^5+FHqqI5TG-I}ih++C8Bnsb~lQU(?DN0p|U
zvnW#>L#PNtr+9csL^ft?MP)qc<$n3AK_X#0ZB@Yw3$obvO6D8hrx4s}+JxUe9rpRM
zuntWbRt756q{UZ7KFRCiDwT&SZ$U<-xgj|>d$m9$s3;wuyD`<t6Lr@%yNQ#Fk<*`e
zpHZbwVoYOvgE{%MS8}PUXRR<5Ai$F-I<+*fs);3YU0J3MCUZC0$t99UYO7T8A^!vh
zq+l~neN92L48n$)EH^&L!U->0c9_9F)g+;s!ytm56T$M+LFX`&dlcHClFaR>ezVnQ
zr%F@rPE<2Dl1Kj69J#1+Nt|OXwVjjKZ1Q=7JL#}K(XbkYYN+&lY{_S6whc7hU#m5E
z;?|u)JeZmhB#5`Iw;46lNwm$#Z*I%?6SWYmu=m6EN@q%>KURQVYTYj0uhM!*Zg?Nj
zl^$kW+;-OJ7A;;Em16YxwKURUxFx+hT=MfC`^^%lSZ;hB$ELMuMs=asEf}jF6h_NL
zXIpHolwLFnK2dTjF&&O=wyKvb(!?QP&lupBxa02E7x>||F<>ICINU_I)&|o)EgPyG
zbYEQ}+)#(D$W_$34fkRS9*68D^8pl(PYapK<)7>ndQoYN?2Ht#MXPG=yf$VO2QK*I
z+>C8}vCkE;F|KjFG_C{R+7_$)bh9yHImCXf16ur~IRSddA)|~tPi0c$s-ps!sqK{C
zGGIB5)(<yER97O(6bTs)R0b{flRd3g^JJjs1qQvtkWPvr7FbD3rF~BIu$!hT8c77+
z`k|#MHWp0|QIOy!*7VdHhX9aa!x4C7dLp*ngBXI>Sbz>SO_7}24;%5L#w=~WZOl(~
z28Wc(&(fRAqD62Lbs9o4b%mNS2#4Dtw<2BoHzytFGz4`gdqRqqEz(j%8(it;kfuEp
zM_3V+Y20NCWo~0&vaZZGpLA!8%y&Pq9=^@7U@d|ykugQWV5&cL&*SGXJiBr0Ob#y_
z{bjfdDR@MeN&2JZ)$i1EX?@DE47x8Ed!sd6iPRJJ#!{TjhWuGh8*bSsof*Q3g=9cF
znWj1!Py|KiSIe$yR?^b+<xy&9=wc&Qoap@essjXrX`^#VS)?X%I1QTFX@*@yZwM8l
zHH=hQeQ_us3M4}ct^KU1S|3<879thnr&yg)g^t5ud<PITj;)**G8#)#fe%B)vIT(!
z)xeEFw@8Pm#y_Q`$ikEKQw?j`*P->%ADqzV7Kkwe-i3MOL#(wn3|eTjZ;P#?#Scs>
zb@u*A5ff<!;>ua>m|@iZCTs20AwnqSJ))hugBUnL68L572<oCe^+ut(gR653!V0L1
zF#QhH=u6p^xleJtYFo4=BPC<oh+%az24u=)ZDv4SS|xwCwr;ehVCaZ3S<|vmstT;7
zOe{Cz|H(os^NrTiqOI_F!OiNgP_;SaD4xVmCN>$<x3bxS2A&2cUZk@yD!f&(wkr|9
z5yJizl^^j6qB^rkU%~7W1k2KVw&gq-z9E_?`z$QdMx({jl?BO@5;+R<9y<z^&Ka1b
zot76iVrYEDCPr|zHMQNzY3Ul<McnW2AthSz)fT5`u_JNPlQ3+YM0u%Q*|TU5<?f!8
z7xr)+m=xkvO0mLE0a8?i44txJVEx*(EXX^yz~~3!(0#Oz<?n^5>A^kp-4U}Z$-rE`
z8G|LcLLo1CR?7)c{6hKc|0_p+lTwiCH;bfhqE#nFMAM{+$}DW@r%!z&M3yor#;nBO
z(BDkRRGVwqFW1t|wNQ_27$v2W;7hd>i;pK!uJWK*uer05|Bl4mII3Pp9@WMmGJ)AJ
zAa9H-1!iVyB|oMxqC3-aL3US8y{qi)?9_a;kt!N!n5G3n<rOsZELi|7?XzHA0jbLi
zV>Bd6!{#H^7kjcpwYEVA7*kziFmys<U%63g7t<-!t%Ul7WAM5VcQSUGh1`}~-OJP%
zXALUh(r@z?9`CM7sj7vZRx<!hiOrCDn2ba79##2+$i_e}m2}bNIhsJjpdnk=)sDvM
zE?ICnQ+g@R!hK5za{peWh8ZH7{1A=^$LuT?i)PZ4pCI2LG=aflJQ9x*@&+MACbB^~
z2?pw4b;DC0_7~HW#}P*#QW8L(kt4vG{Wy*?GqMdjsMu{%iHzzQ?5me~9(*}%Hgxnk
z4((U&bWwX>TJ*|R#rP}{KT}h&DY4h&%Bq~YUOHfc{>Duy!swBkivCBhtZ^-+2uz);
zK*&x$KkiUe%GnU4P$7o}kt}k;AGp{ekF)-k4gJL=f=O;AB}-=&j2PNMf<YP1kjLOU
z%rt6qOrRj2cm%rHdMXaP=(?2}Pk%-)(7lty<hz&-WM!SqF0mKf4Ht48FN;{5qUm2H
zl?1)^hY_xAW2n7I7@En!OVrDR)|AAXa(W5q2SmXeAnWw-*j3Ov&^o|ZPDxssxA#oe
zjIiM(w|Wx+WZrEuINh{R>^DNMHXkp>AS2iiWg0cWl`{mLhu5+D{REiYlaI9TL|bZ?
zPX#TZNdzK&6<+Bjj!Ma0ujez1lYfSTX5~Pw{X{7kMUzjMSIRB@Qq8C)QyK1M)Y2NO
zMx0yp0|e9#V=d9bDfft$0PwcTqm8V=qa`{y^s|;i$RHk>(!?N{U*BlL7Qn!QQYUZ_
zT2}~FZrEx>gpnh7@7B;m8TezG(yH)NdDCi)V<vLFr~tV*@Jz;|5G1S!LJVYf@4z{)
zBCI0!((K(@6&FxE9NEDve6=J&%yw7o`^sc%2pNQYLu-PlKL)G51<8YW=AT5Z1K_BH
zA6h^auS?D+cbis{O-3u-5KV$0p%oKCpqh9`<$P_e#e(@+N#(4MEGXc!0!6aDXE%^|
z7}LeH6oY>zEkwPyCNpCY>-O~5=<;9m)1-&f^16tlIcn>p!$=**YqDsOY(x{{es?D(
zuA^TwPXQ|xl}8Y8I;SM@!>g$}9WlrkM$Z(@f0`J}huN?MN1Z388h~g?`;z(1LZ1Uu
z?)N4HuvTz<hlhreVlV;BYnNnrhmMU?OgTIcSz?g%W)97=KT!fqz_%lG?cwXaCKfA_
zTW<`o-GmH_Qh%oM<p;fb>!B!HW)QFO7Z5_@5(8isS1_`HH9AbE@xcC(tA3t33;)2Z
z_B+Jl>)@Akzi+6G!B35Bz7hxy<h@Dv8y9seAvtcw6dedibP6QSvT1e0t@-S0F^e~c
zApJ~CKGO}d5Tf?cK$xiJ^(L4;R)aO~(<WG}TnN~Jvy<=iE~6}5NV6&KQ;&J(^!Hwu
zl6aMa;GhG4ejjCE$pq(XGOJjfQpdNcJ%WHN@Spo*n~A7glMhO`UF2i+4U%NlDjZ^D
z$6G@;z%o}!(qR!Djx^8baz7}u$|&5gN_W*uZbzSdZieya*p104AH|cl!CQLV@Tov!
zM7B45BdCncj>Ce`+!L$wS)*vZKqeO*>mLxoE{WXIO<mKlOf%g`gogt*)+{}D!T9dL
zF18RN;v=P|{HyM^g&1SP>9UhAXR7zAScks!6dWgB_11S3LvZ;<G=_nr%FJ1>D5;zf
z{iwzkj(}|Vt6L9&i)1{8$`Qs~Kmv`zMCpwzu(|?e0?cdQiqb*ORxX4P&leL6R~B{a
zzVfOXVTWn*q*&xftIW85AtajzhaCU%Eu(UBml19~4h0g-gbR5^<R-?KYL}m6u+^aR
zN0Pkc_VL|lOqC`P%_4h<*R*=9=!YV(MOzqgLA6WI3~_#c0KTwu&)KEH)aW?O!@5C8
zmMg$rv!P!Jh-1>j9K|7}E)-eMSHUAx(o{-^tL1o${XX+1#k>3Fqv6Jnk^wUqb+6_L
zDRCSYuLkgY7omPiWQSoz;ASKPhvN~pK5e?=`Qie^IwqC1Ht5oZz<0n6?(*}vwXY&I
z!YFo!pKfAVxW)=*6E001=h|kh?qUYrQEFdnBhpNPn>Vl<$tW3=O)fD5)2Ru`X{uFQ
zCgsS)3lxm<l!IIEqr*#nRQ!2mz(UsujPK+X=o%?{YR&hwm}y9d`@%vS0fN-8wBNz(
z%i};u#!)szki&I2p3R2nfLmvBv6-OCk+VIX<nn+N%h3<6poJe(uL;fd+IGg$BR)RM
zhA;g7C$JprDCuPNk|_!|RUd_`gW(X>sgV#T2Qfc+F;>|I;Yznk+tXDcW=H!3r06VV
zf+xTCo+uq_SCc@Q)Pf5N<H71?f=?D+hB?#O8PCVbaQ3C!mtJ{KDo1k1ps}Y#K_BL)
z9MM;@oiod25CLo^Om)V;%BR4gQx(d~OF}0I50-JZ1o~)fKo)sywS`j!vPva?sQW>k
zVPhi{ke~f-wKHwe*QS!}j4zG(s>~jC6V;oSa(`$}&na~YuihdMg-g;|#K9%ydT1mD
zsWt88!^xNWWHgFq&*wJ=Dknh-WhIucwot>m2@fT+8sz6-+Co4_JNrVG+{2N}Ti6x?
zU{j-GnWk2dR^aQnc7_RBhJA}7-aG%6Ol0<OP*<Me&(tVZ?&Z)wP>B=|)jOzRTvsh?
z#-8tW-@+<RHZRzF?8>(Cn`K>t1Q3kodCP>7lg#Ny9RQeqATPNz&z4HR%?XO2f-Z?$
zBbB77l_a&`+@0v6(%jXCmr;+4Fy;?E2Ha+&G-k@-dvuH73zD&7Oy1e9Oj_}^$voc<
zw3+Prr#KJcNdNS{3<k`*9DTAm5#dSPYb#JRHN<k1f(2u&)>PMr<$kY7!rw|&74jJz
z!&p2GgBK2+LeG)ehK`T&oKEjcpNTsz5f+=_Zz`@V`AU5KR9b`PF7|vc+~KTvz|oZA
znGE7VjJ1N_l9hN&$FJPx#VSq@qBfjLDyMnv*u&(12JP6FXAy4Ouf#_bu-=z`75A)4
z5z$d1yfsUR2EBsXbV2-!!n4&7a!*6-qK<q=0n7mQMB-BZqQPb5)J(~hOO?ht?jTx-
zgIyTY<-ii6D?49|y+*FqEMZ07s&KoQI41kgmK?ibBSe@nycsAf{E}aV)FN`)PzGND
z`j8cK&{t^>zp1+Jz9mPpl0RZuG7s8NhwDT!B~fzaO13A%C;l$`@;&uRTwW!*a4O4$
zks5bk7>BNOB~R1?+_g{%kKBuT$t_rE^Y%s>YxWo_o@UlouMFx7)K`b?!3Q-ZIU(v}
zoPYpQqpQYlC3y;zLQ>p^0L@MuG*{crsSW_wDuk6)-f!$=S+<flY5?<RLUC;My_WD5
zj;41dxD*r<e!!SLvTfuXap@(#NYb$o4kTSSJ{T%Zt;7V5COj`)-#8$myK*PBQcX`s
z)4*AifLbH;_t*mq@tTChL9!)IR4~9H(+`3tx*ywWm@V09KKpp8-*_m^I|0&N1G8n}
zJZdg(54;&f?ZJsISSCyb>zKTZ@!CbE5uprokh`$c4(BTs_?_W52||0t2o3vP6DfOk
z_FmQmKR!FC_zH1V!uDWK*~x)CwH|r$z-hcHWgk8(frE}TLJ+D9k_?=c%^-;pnFU(i
zGG;&tMv*Xw(#MAm2U~VxMD{T47tfCDVmV~Bx}RSP*oRVyRjR(=N<cJS^G<k7#FnTy
zA6fa1JtNMH8bl%6qhLsej}4gGbd4BO^>q|`S28oS+5BEOOnk827%n;MQ8{wlO-%h*
zcw}@A*d<BfU$k7LUzJx%Yj&&9;DZZKvca!~+k)yVEtA~KPA!pvTK=(%%B0x!9=*@C
zPvDoH%2@yH-fEB2=a<7&_(=&v`vUqS)|i-*RBcB_;)XY$Dxu?cfs?}eGX4DWuTh7e
zG=-j*mXmj@A226z_9@0=FuwDXI|@>BsRy<1XtOYQrir95gzFyQfB2Iy|9OU^>rPtI
zHmINsA(KN@`X8<Q_NEUZ+DcEWGj6cu<UhnY2oN|Yc-dX0zT0yIzp|S8-1>@hgFAcF
z3aHEux$!>29^|-px&-%f8<eqHvnDw?D6H?;KO}UN656j7xhyZ0Y6=RE=Ghe3OoTTK
zy9||Q``4j-xNC9sX-2Ji_)rLMwhELK##PzH&aDIF=*3$Lc=`(Q{}OL@T}=Df1=pso
zvJK1kM{+*RnC=TzuH$8vnVQs3TML)g%^}M#*5dyR-pI0kRGHME%0=?)CBLuq-ww#v
z^3Hq{<WO^0Zf1Ohy}DfkMYu^U)iv5&L`H%6F1}S%Q1u@+?M9~Zlen`!T7)!Gy-orK
zxQbLXS}Wf8U&={IYV$VR|6>Ukc;n;x<#~}QZ_>XEv2mQ}5LP5p!d6<m?;K;M{>>#?
z+i<1x<}XSV7)j$%g7++!Zuh`JZqtLslo`eK(8>a$|JmldwDq>4YpL|s<I*W3_20y7
zZCl>-1r5%!k8V0-aQ~V$9)@|*m>_kDdVh~&)H{Mtb<-Njt8lyER*{cJ_Ujba6_ZPj
z4OO(|fBJ}5WAexr)K5D;K8yXgUo?(c$^d~|s<%sD{=fx@Bd?3kFxOEDyseMN_{OvL
zEX9)V|B0!EILbF8ZxhlMRl5V!eBxiGq`K^I%#9c>ky?Ox`(u8yoosuSY%bp;F#w~7
zyCW1=3MEt)-WtvuSa#(qnKF@9xpa=AC4%GmJBv{3O$hAHDG>XarrtA-m!3h$y%n!6
z#Q*J?g;%St*#IdQ?|C03|7A*ei&myjUIS{%ef1*Pb<9EcY#-{K((-$9e)@As;$4L6
zSo-Ia{RQ%{`B=BT2x9up-?VM811H__x_d|OFPGLGv)=ql*W<&+s=Ymzu+=B;i+e_$
zvp)Pz0S#q#iCz734Xz<@lxfdw&bjhy(e+fTOi*I7$M!U-fbsX^YR{I?GoHJr;a^8a
zG|U*BP{{A|NA9A$nZ1gB{EgR$g>kT)GyXYZacn=f2L{~oUVThHT!N<0@%!-S7x>>l
zd~)Uf?sHq%xXZ2isy&)F`yj!CRiCOiU#kzF+0tQqd@5{pRD=7w+=1(IdH^?9<~3FN
z&)fQnF~gx<)U57fR_XBG(XJu_xu1X0ctW9uC*DmB08gsz%dSH+RID*Xd?Z|c&#NYd
z?2^Z`Tyo#Ph<5iB8q=;}bwu1$XMGC&-)PiX88`K0tb;@D$Um*1{%-j+HGs;#>@U)J
z(d!5l^nG{@?czE}e4+B;lcy=Y`iP3-#qb{in4pk7W_88HRjwK8-;cPo>Xr-?OL_SQ
z)o4?H1rx!WKE4|%mOttnKlT4QDs;AYYy_8Xe#!dr5zL+SFPmQxUfu}`Hyx)96Mqjp
z`v1*mVMqN$R<C@EajoIf?8Lw71L@R~eQ6hZE5~`^_4!9to>268I<zl2(=p#Vcke`a
zvleI6e#&z~H9*$A^Ba)L;k{U2nQfl*5K8sU(*V(Kcyfk13QwPWgmP=%^-zlhdFpEK
z>|^2g7=69=R7(OkPeQ-K5lOUU`XKu%|NMHg7x;(CoX{F~weNzTQrz*$H_bB(|1#7M
z72`HK1B!NE|8{KEr2sU10Jl-#x&sTebaLVy+@<xKz}1sj*HDQvwLu3S9|ZbGuZ~!V
zU$c0Cub<9!McU8Z`iefo(B0LvH(TV=^wEx=DS*G7s*9Jp`l`!5y^L9*Y~=&%Uta<G
zpSfnwPYN&{`?Vsy|FaaSkAWiqI%dx`8|Fade;!!PWuV*1TZnA8t%)i5uTepz0iD;J
zS-Ja@FX5m6NU=?jG!e@1>o`cvi1Xzt{C`eSX<xGC$QoOJ+IM~Wp8<s6n|^mq=!dJe
zD{U_PYblT!ec7XoFC$F0TLk$3xkRyr;R{xLLcQNr{!}3Q-%jlbMcbu#5rCxB71vRp
zkWhZ{mrG@Q3HbftD;#V8@gzh@FL3sha1ZAdZFUuKW$i{yv(5DQpFap$^duTGWp3u$
z_9|vk{pX_VTREIi=vndaJG=j={~EFKp3!@!fDpFD_U0w>!|Y$96r$T~aq^*Oi*MDB
zE;;2r`t1J(t62U0A{oJF)JMghP=51Q#C-p<=+pC=U7UuX_agu2KO+|wueM$z2Jpo9
zE+GEH^|26pKk$rRmnNZNJ<^{MzF+^1+9dbHrzudqdFwjf&HqCFHh*w#ISP0zc2;Bw
zO^@YWU{(NrgOHB%l%@Iku6-9UtSA5R*n=}8e&7IiZp?^?-9o@vNrl>+NF_vcD9;If
zc4N-Bf>QP6v7&;y*efiD+8j_@T^iuws+`NwEAV_Y^VvD{>6&=*23$NO<jVmcDsp!6
zJG%JpEC9~D0YA<t+fU>j=72#1e8{_f_}o45;Vp?&4*b4y1H3;_zMK&7XXSHt7C5*B
z?i>abECu{I@HTz_82xly<L7WEh^sq<oRW+<_oS!ZdTTy>a{c}1V~!&A>7#EPLq0qv
zh6QTrG&H7>`S>?i9<!?URSEDg=aGQiKUKK@zaOOPQFL9*^gK6#Cs_%H0ZiZlix-oW
z9s@e8Tkvp%y(w+bjQAb&#*NSND&B)DFGQpO(CsaeGig-r*Am-;R*qGj>4<Rk6gHvd
zrs^l}4T$;4NQ}IKrrMhZ7f$QXvIT74g3V9(7z3JtWM>RID`SROM$C`nt}-@jTtepK
z3s3r`J_4gF1ZBu|Wa|T&*dyF);*?+)kLY<vEhG<_h>!s30M?%DCJ{``AyL`A>35j5
zPt+fZjCd4F$zpE74fZ)b6CI_ACaphcd4PXj8q~z`&M;$t5;TrzAptpn9Du3ABh_sb
zI{-FSJlt+vHRwsiMUXi@Q(jJPKV}4&x#s99Fn-}1*d#E?S6@S5t*FYTO0}o4q-m;i
zK7*$kuWU+Qi>eLL<!~lnP5zFNfz)wd0hOkKiu>epy<*df&eNDQ;sax0Dn8`-D*3$>
zD@ddGS0pms%#UA)ww~33#U<XUGYof%_idsowOVUsoAN~)rKwVa*^n&SIhm_3NLAM&
z+<Tjbs5BrYrp;NcvBG;E%T>B2K0%G{j=bSfp9@w(j>$WiZhw$iD0B+$LFhcggn1F7
z*Ci2b9nhXjziF&u%mBnoA}UWKk$D=cxm#8tB1}ILj`L&CYPK5<*9Mec>*)zpTGy&e
zaASsBRs?A5av!Bc%QICw-F$dyWj}GY`DUQhxJyWds`J+)yZZk~|HM?dps+P-hBP9u
z{skrZtb-Or*f4#e8P~RAU(n#Ow%j+oUYWn0vaI$MegP#;fu*PdR^$d@6#V0GzcZrJ
zpJcJ<Crj+gB2t3~RUL0RtQ2kq)*JMeLLJ8_^8aJ(t%BkVx~|b63GVI$cL?qTcejDT
zT?V({?(Xh`yAAGc!Cgau;3T+nc>nMH{&R6|PSsp>P4&~gYxVBkz4u!E9Ifdv%H&10
zZn<cosN9I2`x@XkDhG_eM_}|gnAZh|bFnh6ptN3|MwUqyI?Qb#*w*<ucHY=T;<IvN
zzeJf!m0*?Us($Tr#(M@NR*z;wr0|xlmVSL*A33@CQT&HF1jwCS<R>|`3ArWFx&Rkd
z2%mf#E&_ROeiS}8K=M+rhWMdwST7D!h!Odd69y-WjO<PYYG1jIMnR;;Qo(@=|Ng?F
zESW)ygg}&-{WlJG(Xf3<yUB!6$uQn<0B_T@VBUm_9pZ~V!oM}HW}yv`Lo<qHjnYG|
z*TZcHp@T%sYVRPSJ+0oOcs*&F*V^<zNN=1LqPM<NQRlDE1i%}(D*qdJxL-q#noY0M
z`^vwemM<zpxPCP57159(5cJnR$G>?Fm6#C4*7Z4~&8E$V`iXnrH2|6)wuOvwc;WTA
zwFCwg0_KIH+YfdcMqEWnmZ?;sUiX)3k_Z}>DsKc%;%`Y--ex5NcyjM9)Wnc_NgXjU
zVEQIV=e&C4N{=eYZCaMjf{=D@NJ340Y-dRw&y~+Ot7pq;1CJ#sn(27MUcQD1*8p3^
z_Jl`d+Aj^KpK^xV{bYAeJmK^nfvEZLZBs>8IjA#wVR6{DtTn6pf1IyEODB=E40Kqx
z1zr<csEPCI@4mbv%KxRl`f2gm7~n%iBZ=kBFxlvaM9MVB{xAFV?~)#lXswM0-pUbz
z_FKWcbu(_zRO6CdvwG#O=JExqN=&FkvcJp1>#oln*NJ7w<agx)_tF}x2H%nzFQDYq
zLj(C6KFjm~0IX3#CK$~XYAJ11jO^Jd^BuL^J&lKzw6A3dw_DOi=K3+^A!k@y8dSmm
zy1gX;E0&j~0We*$p4)(_eL*q#t3qySs954EvkVC;fQS7|U(FZN^4+>zyh3P2lgK4H
z`pDx3gfl=}-L1LKZG4B}uh7av<tq99@m8I|SCbl7Ja}VlLnB=4&zKgkQFELkWGV;9
z+bdi*530{xOhqX1m2LQVF9L41&>my4oO(5`)i%t!&NVBK7?VYww1Cdjd`_?{RO@2e
z*3$GtyqiL+plJ=?)7$tYHVwH3_i`fy^feT#_SM`E-i1<7iVIJEdtg@h#{J)chle=c
zADbCrZfX5DU!9cYp6Ld9Lglur6(e_ZJVbU3q32UXw@KdJw@r44?|^vMkWh21Oj4{h
zCG3DLa7XnVg}dO}lp2O_#4cR-dTQkbr<w)jN{z`W<77h#XS4_<gGSbNFbhGXolkhG
zK)D`~jr6B$diA3EsAb4He>UG;!+d&=Lcv_o6mzFQlW_4%g1)`SK#PdgpW#}L6-&8g
zv@l~jk5_(Y&GCCO$$m{&ksfnoUVqf)0=806O*u?ut|%npiT=>wK0Y|Q;zwS9xJOm7
z+=z>Yp)nSw;~Vn1@*$PUI?Jg*Wfx9)Ujiy{wqUyUL}K42F$`X3jV6ZK<h0R@?JgUs
zFJweZMC_%%j<T|QiMci0cYn4BzGb~-h=HdhGUIBwKG)8(FHyk=u8&w%F_S&&@kY7+
zBe^fC?P@IB$;2d5<?|Z?S?&UjRpYLq2hDlaxY%C&+}l9l*wNAx*<B|qBE}x7bsMLD
zNd_?2iKcRuuWw>Pg2lXbY9Ll~`eyCfFZzN?w0h5zR-Z*@+R!m%Pd<IGc4tnxs2|AZ
zg@l}gY(1yC`5mF4F9S!l+=uTzz@8+*T9#PmF&?oLwwi66CA)yc2angpds|MKive^>
zS4{OEIrQNBP*P5bP=N~8&9)`=X7ExKTfU4}rhu@g=Y9?3g6v*gy-ZD%UYZX=t-K|H
zH_INKwLsSTm?A!7I)7s<a{Ds!jl;O-2s(sehV@t9&+O0F9s?>R0N)Q;8|yybX6m)n
zXoOo^a9kD}5Y?PTBPEWn+H|U7Gw7;So|3K*l?$cLNKjYD^t-G6jIeSON;>y8k8rg^
z#vNqZPa`_amJvkwuEL$8knbgy%CnEieigfWXRzqKRv^XF69Y;iNdr-6FB3W+E9oGj
z|D56LNQ?v>?S1$ew2ICFKf=aoJ?hhiAvFRfsojwn`$&`3+Ta=-eCAvB)<t{R^(w&e
z{0Doc_EofP;}$a#+f{z1mU%E7=NRX7oI<v;V9!K4tLpV%BPC(58<Rh|Qrp#NWkGUV
zs13sWa(k#-;hue?8W$DvvKY)TdG%JcGkzpJL0c=B&TvD%klJ<<uW$B_dQ!LJw|m*w
zA6A0T)DF0G%pL@Ui>I>72>$uEXlwYIG*EGphTEp%BY>aqm@{@>aH$-SWkiinKprl6
zO5GxCk>zir%S)k*2Az45KL$fy$f+L8&9|b<KDOJ)CDlucXQzR>Ht`&J*c7CLk;YKB
z%$o-mM<#k}N^$C=l`p=Yqf<(4ceIsiTm0*6@{MxL*aZ|EA*YD_^EIy7>Zf<Dy8lQt
z%Y|Go4_g;^KM<p$Pw3iLP0ipl^PQwSl)JQ=IhzuRkyRZ_Dw(uj9$v25XsV^M`WLLN
zNBuz2L8vbculc*|qC2gAhR1-N{<O0*sCiYptR)enV{u!fGFZz|<ky5D5O@wp+Au&U
z&)&l3R?pbCo~})x*b&uXzmHu>HW-$d%>F_lth`Jq+_z3L>CX@@0pt$9leJoh{2Xe4
z|2(x{2U}SXi4bXeJ+WLY`CBd0{iTMhmHQHF<t+kayMy@q`UnxJNPUBmfdw#!lL_pG
zFd*P+EIJ(Mz&aCUMF6sk?`SnVtAZ6UXNZ#hJc^*s*H9Z;s;&MEX@Tt`kI`cIr^8sg
z4aTUxl`1;;2ek-XkrXX~cieE#sS@%e7X}wW4ULi+s;QT5ok*?%t+n=Cr!Hnr-UiDa
zdXJ1DeXE76MY4&D<B>O@VnT&w(l{jJn$MW_#`~MB2wS@J#Y-hJ-p&Fa3w&6Ylq7mt
z<rBg28h1F0pJ`IVt~))OKzyuf^iF6Hxbh*X9rx(3{eJ=k3<6uP6Y9JICbIb^#X5CP
z)gLQ0(m)~td~&VUHsVjuTnB2+>?4q#!3lk--XZDYgMxKIu%$N^k)zDA@#GG7s{0Rg
zyE|qQ`FWHH>T1ts2c0b*fH$L{#KIwCLg-WV-eYxm8b|T!dI4S>WwNH>91&gjbI~AW
zQtK^=de6~Yu6|vTFnOh)waL$_t!;~K9wl~I*t(F0+XF0X24A{1#O&0E4-7aeGVDsc
zG-LPfQ$Q`U5J11IbF)*`#x5b^+fDY-M&9EB)z6O`dw#DQie-Su1=nYR1_<+ar@Kd5
z9|VxYG6VeGjO|!Xj>Tk{!o)7=&T5DH%Bg`?80Ur|HU|&aP(|T-*J`}FSM-t=rC_$o
zWW@5LT6zk%T8S&5-^UK1yFHW~LnX>1scbHcx#mx<u~Y-kkc)Wq2c<y^gtH|XSyKo5
z4@oD#-g&glmf{HEYE1n6JQYWkW<Q!Mi)$RcB=)c(Eap4C?c~uH4T&D??9Wdjw*KIu
z*}tJsjZ;T=qu@YP?&ZXq?-LAu`#oQyD3!{O!Zcjn=m$b#KQ`3KC%P<0c3qvc6qMCF
z>DP!9f3{U_+ZA+79Rrp^%1S*h^Dj};xHLk26C{BtP~mia36ZCV7-b|?Ogb=5!tJMO
zUH1+2!}Z)OA-h!PZq!ps?jO)QuKbC9KofJ&ks)DL!Jgt45{X~0mUAeoa3E|THkPS_
zYD)sVybECT7Z+oVEoN+K%_>YRpyvE$Uh|6qvDzHH<5MwpxR>ZygGDOW?E~aLrnekm
zQM_AgOeLTD1mX*e5Wd#x9MOeCL?zCS-Y66;VEQq(bJk?|0p{n)`O-?U(hz`2WQwDi
z@HYzF^SnP*h&C!w(7%fWJ{M|Hi~xY3rGt-XMs;<NK~P1HKJJlReB)8dl-T-S2EAW1
z2`?mZ+W+TcDtUdixw<f!%6UweFqYt5hNNaj`K*#}iI_9?bY;B0PR`#3H{LB2v4sg@
zj|R;T7j+d*$1b^Z2%63toxP^;|A%1)=W^Rksl`bDlu!_6Nc%}j=NIF*R2$D+qx0AR
z!{uO5pnWIhkWTW}@HU3gIg+O#c~Pbe5-e*=!yRFsJ!;#X^vLIJd0u1NOf~5$%nL-6
zIE`Pe+%>(~Uzd=uN}<^n*@9Csi&mFC0PVq6z7(Cf;6U4D`yPr-9KQ~Xen_8|W<9q<
z%yx|v)PThC7t_Pzoe>W}XA^SP`P2>ORkh^526Rn(dEjh&rIOMLZ_jwH%7Xq}GM~$@
zpRMly@l2SaS*eNx(I*{?<`r$y3k(Un@RP2ZpF#A(zW^at6S#}|O-C31R_sssb|(yt
z8He>yuc{Z8wwSa>tt9oj(jf@T3hhB(5?Nw_@O$l+pJt37w_z%~8+wD(kT+Ggm^7k?
z?Aj=GJ_}FcTSvFpA_Fr!tOWAK`rcCVz8}QgIv0~c0eZ4J+^Xf&UDYxE2-dh}t$i-m
zEdJVjke`@-c*N$s1APgn_gwrX?Biho8Kt@v1tI?Vqr}_P>-{mWmTDcr2oqBCPbUTU
zx_x%h01@N!SSzLusZa5h9q}iJCwaqeIqB^-^><-uB;k#NtvnPHrb;mJ5sftt^;c5Y
z4-~hsf2%pFE#(!Wb<@VKo0u%6t8~Y%ugGnjI1A)ZtnfXOe7FB&P;nU`8R6br3+Qq4
zMTdL=W5wmv`kf!1nQmo&6&F?HYYUO}2~X3J>+2?hw%sSD0y>VTh$)+zDADeEnN%A5
zWeh*qhSK9!R0xJIdQ@6cgo!D*ePypz8PI7OM2(H?#Ca@&;8_&OeW=?gl`(*8EBQ%$
zd9mpN9=-(cwQE*9`NQ9>yn#;!qrzVl7}hYGM57T-VYds;n4z@7i+CaDTD0g#%c~kI
z`+6TIy!#ev*K4CDj8IL@rth?(EQAAWS|=3=Gy1_37z!YfG!R?&25!>tmnY?~+W@%y
zD~f+!w+S*Scw0EH&`2SB)ag^qhuRG(1Dv-kMiXDV{=gdoV_FY>n#$1w)Q=$OC$$wV
z@pPCBN!fC7=Aod_mRY!yu2QvuWgODSBn#FOsW4(+Kz{0?*jK{P)H4tU&Dt6R(G)<3
zn@ZJ(kKCN+&@`it`8?Xf6}N%+8H;N<iHb0!v0itzBf(j{kvvL^OtDn2e5_BRhAK;D
z{!^{Srn7U|qo!9I_EG{5!pse`>zf|PR6J4!kQA-KxuMq>J5+q-MqC=E{FX*9+qJKU
z(2bk)M4d(taTfBDOkG?|l=x-4b@f2E-=9rZ8gL1inNE4B+NQrdYu8oJ5SL%orJDO<
z#ys>Op0Bwr3{sto>s$8zhvOMHUreinY|J)wDx}AzUTP!LUWU_9{G_U}CMradrj@A)
z=Fb_M4qHaAX8$LFYuQ*{L6Au2L8yKvbo*GbH@Wn^N+Jhj8iuw;=lAdSd&N+(|3{By
zW)X1o3}k)vA-thtvd=9OW%gJ5D(uQOP?!(MFk8|Dm??j7RpA)ocI)1a6tO0-mEsJT
zI)zrnn^`D_;nmBEr?K~9(2{C@SWjpg+qf-4SjV2p4S`{vKNj>f6X%#>6#7J((u?dN
z7>`ofeC*)8Kwf2vk^noa*H}C2)_e1Ai&B6N(Csy%ITuF>#>JdsVO1BJ1XyUT%>5)-
zUpNLY`LyDcLn?Aj4s}?L{ah#H_n?j7Eh?LD>3FNzCQGc!c^k<O1W|usH7G^{$xR{a
zSl;z0F7IW1jgg~uac3R+!iMq$+4pW}WUA~nx36AwtZBKs{XzEIHd;-(*qtVef0WBP
z<@rI3+g=cj5;sppbr)^1^xL$kxdUfqUebQfY<ZqIqkeTuTN#=~#bP$W4ZYpIkC=kI
zNVdj)1U2wREgZD(d(wm58~y{uN5z<Qn!cb>TG;3~NFyJ%xA%8%wFu_M`TJ;8!l9N~
z+O6~Q^oT!x|9v0szxSh*3I+^{-&CkLxqShdv#`&mTLN4<4xd;uMEd-^ZLue%F7qo&
z3|a*&@*Xi{%>TG;g|aA0##pxl^tW}5kCDGekvTZjrwjO^d8vG<{N6#jB#I+GyEGey
z8?!s_$YHKnWgt>hvHdB4si9{D>c&~~$QR}0+)@h~$rQ8B;ctHDWOIO`4x`WqALap=
z^7#8pP(ms2588)sY7Q3m7dKq=C9zI5(#M(#({%#mkPPpm7m74{rkg!q5y^Kq5313w
zPU>sk`zlzM)wOJuNEz$=O(kG7yii+7in^4T#-%3H1vvARnLSJ#Tz>cp1}C>tRO-go
z2yXMh<P!|5x8mDZL~IKJcU*OTt!HUG`ZLsHjB3?UE{MnGq+yzZAO%c6gZkU-rrK|M
z9EOHYyJLWC$UFut{O#x}+3T;bA(Cpw&)%agBHW4lbK=xkRrVe_`ThtLp3k&3Pg39L
zwZH_EC7L2F*cKl-0Uo}Bb%JqWyPMhX=Zue|4I{Nd<Ys%h)~Y)gLQQ~94j=q+U%<q!
ziL7w{dM*UZhf{`5YA4>}=`0vvOGmx5HJ})w+${vKRQydSF%jxZoznrVy$bPuoNSs@
znhu)87Y)NOk&_AVQg|*tHeHwb$#N;WU*Mvc1h;*ar*fc34K_vzCfG`0NnqA$Xr@vv
zJ;(51r)a40#kH+kc%kKkCx2pB9)Mc8NP}G1RuL*Nz?`v_X*Fqnks>gt{^pGfDP-r7
z-Cy4n5cGw%HeIwOM*|5+!lwKvN=1$8lw(UDa7()SZg?RYuvgA$lWSJXaoJGbXrdI{
z-1R3A3zB<vHJ?p&8w@G+5GV12?demav>JY8lXTK)Y-h(y&o|Z&4e4OBf=qbRp;<jk
zu%=Y9B2YAge!)#CR=Z--S^a%RDvjhfUR4->-aMq+|NS{>kPAinY|>iJkyeJPPzLgr
zZ{%gE%`_L3q_3jGzevL<%M=)Tx*m@!DPZq1bIO5Y`7LhMUG6yJ%ixEY>%Vtc;h{L%
zQ0O9cDb<<OTD;D^LxnHWgNzfV8tm5&y;4_Upm+seMR9uAbYQD|11PpeCn1WlE^6Rc
z)A5SDU;Aa?{&A-s)j9tOSAvJtGnIif4Lxm?u>cP0JMy*+<AFr1?Rqb}U5SCtXawiI
z3?L%>TlsiL*i`^Td4lXKc9GPTi(~_S*DS)wcLb#fjc<Em*d$!u*{t6X;#d%Wz?<E0
zk8q`VfCQ*_2h!<jhtoUPdqZobtgoy=?IdQ_^EnH#RiX_2=?$Nqd%W^b!8gWwrk+NV
z*2yf-`wyiQa{oR#xRTU;>P1jTB!F|enNYAVy=+*dE;0Ll!m!PdQ-AI%%cpr%jhRZw
z{$p;ga^UX3MjXQiC~vpI`;bT!uq)O*@-NKRUxKoYk?&jS^giQJ-VMBy`j5#_u|N}D
zEysvsH9u4fC-#{Bfx?SK!GiPTKFnc%zDJS;CMr;tC;cE8OYRYAie6a=aumjbhhlO;
zKiU`-+-v+1wVZ;-kozxf4EzIfDlN$QM@-KQDK#IMuh_h<%=&(o&+gD5L(YBCenZ*i
zD<1GIF`%Szy<7ers#V8Ct2)DRHa(CDP(Bn6PahLB)STD~pzC|)7vHc<H2?tG0(%sh
zfkd|-o*5gGSwSEPwo%!VMJl>~RlvE`jAeeS=O~l5de*>a15Owp==xYk)}V)^pbq6c
zYuYkdCy|Qrw?uW~@n(%(eK{`vX&Z7m>ppJ6W*s5nK2mu%j@9nUm=K2FVE7$Z8}n|Y
zI!y!UUF0Q$uNeAT$I<ND(PoJx+}x60pQ^k#t4A&eg_mZkM4_9ocI=q#9k%|RyrfO<
zB7(V0GnU`04*oXv*9;e?pS<pl?40t-g^`j?PXZscwwCFI4G>pG4fn!r1fsqQSI(Qr
zDe-YdsI(MX0hb=MbkX=@ioW63WF-03;qu6)=3_F}*X7q+UXu-a)!x}CJI@NsGLUzv
zpLO54W;cH2zCVKWU~{Z%xjG#7k|aI5GJks)8=vt;Mbux;P!-2fI9a90I<e&hEH~3%
z`YLvuYbU`Zx1Gv~!9=Q-Q;*qn@9=i{uHRKj#T$~JJZ_?j9`I9G|6r?E=o?Cz+{nr+
zBKk%>H}Q2WkrJ7eHpUAZZB$H5aI&f;<##;fi5gnD>?@Rv*gJ$ibJ4Lk5xgct!o`qF
z35z|{NyrM%vA(*I<YQ%~{|XgsOf?gBabF6=MUXI;J=)OCeq7>(Pz!4WS&fOFB?=~-
zH~MIqM>^AlEB(pVn{Q79l^(1d^sAh!?La^lukGPM?wccYjOX&+AFIp8NM`pi=h}ku
z!Sb&HQ9376fdB^bxG4_bcn;(fne>V%r!=|i^G{o*%MWj`hK}a@6HJ_*TqxOZ&5|_r
z8b#hv3G~@;rilmKNfU8-krIysVQtHN9aW`s+35D8>}p$%3(4nnlUonU0<A*&$mys2
z;X{2m^^;7Fl1Tt8MTq}QRvC@Jzf=c|7`mhYl8@B6akd2BK@erH=1B2<1>7ph)juIA
zfxbF4z0F*#h0b}oN5RA2va0O(I;_rZj^kFf4?cYuy}KzP4PAQHn<+o|{9tnc-@<~m
zIqIOp?r3#MD6UAM0$r+Yco!ZN9}E(DmQCTq{fFjBMK06j#c19}ucNV;?9P+v?PQWs
z9C;Hi`sCcQhOwa}kVsg{QQ?NYq6jZkgQ+#+n2gH?Ug1JBtu;>Mi2LdKMhK35P0O!8
zPx-ku4+#pFw|GM!xtO$;j8*!n#l|3F07>J1S{ENTZ#Iw7&GJa5{a8t?oIA`CLb~JI
zme^yGbTUa}Qd_=oC1#idSxkVH>AmB2Y@zifa?dl%qmM})aI{p*il*LgjeqS+d`>=-
z$`gQ#?J+Ea{rX3WVmi?fRjKI|t|4YSl;UHND(r_mfWE#aZt29d+>R8%Q^##)Sx!u;
z_4k%7q^-V4QW@uoyXYaoyL20fe4nK5^fYu{r*(E4OMK}dMYne0y^f!}UAv*44B?%!
z4*$mQ?3nPk{^It`=@Vpdn7dg!IvAWpqEQ0wEMrJf>6)O^pyX6k%yka=3zJgjmpQve
zY%$F(4HC#jRKD^ax-mURE*y-F&RmvWIT&;^%>F}zLzHEV!!cf9lb||sk50DgUOB|k
zYgG<hvqg-u59%q-83lK48{(AS?s?>s-YZ&$5?obVBrM+vx&}bxCzf8kA4=Vm6|OOi
zXryC;p(R;Y=(@%o$;YxFMP!F1=%3K3d05L)``l&LkanVxmw2ClD2hgXH}}n$mNv4Q
zR~Mfts5CU)x66aok4-$h!uk)s#ISmTvNJ`U`m1%dwn$r{y`AJqG=Wm_mpz6^H1&>H
zGD-q0KL#M`QRfIPvJT)<M;~hS5xElZkle)b8eQhT;!%TssIIK^clw?AA=9}eNU;?y
zNMJg@d;XY`B&oWm!Cz`-pMnGX!dj^=Y<KNkleNZsp7^wI-&(~bn`3yP-R>G{Ln*T-
z{T-(6P9;8lRvnK&^iTVbpzr{xE@Srlp4J9zDhPjT-#9szXY2t9P>D}iQHV_~{&(uT
z<&A`astIj6H?=e2;v8PKyfUhA`F_<=-u!Ok=Dqt6L_H-ZS&JQZPyOz+NLMwBojPFt
zDUM!+Y2vBx&_`2>ddblG35n*qyPDT{gFey)00Xuay8)!97u6SJiWkwDYiR<oZEPmH
zrsyvfsS81Niv7DHzGw#|>%!Ep3MsG^$(vRFWrw&u*u)9p8##O?(`HT2Z!4q-U#*PM
zVP6Qw1)BBmX0qfMa79GP#IRt@o#nsj3#m*CiHc1<@jJDadMol}_)))3A<*YG(S9rp
zuz1Fh!{Kq5>}qfFImNNeIQTn86GT~<m|dG4^du&mM6(N@+>Uph<LIguvZBkl<t3hB
z?K$TDNRq}MJ0uQXF#f^hdn)qUv~X4><MG}SYYDT;V!O5F?k9X?g(an~yXO`LnSstl
zQl=w25Eh@74u~%VMB{R4qh|NOjLDlZ0|(=Rk#rG9%2(_J$Tz6<v6^IXN|J{EPM5U@
z=bcPlHKJm<S*#1JFPctPx^TdqjB80Jv0ddnbNPsEQ2Un1`B}H37yhN*-HIf&Q{8n)
zQ$7~sz-Wk$_;$<g!s*ODNnW8#cN-C_9;d7c1q}(+>6UnpsqMqZ!Zn0GH*xNB?vGPa
zW0?e!qALBR1z1{Ca2)?<z!fjieFy^`%Oo87^26*b#*LVVdALyzI-BOv43))EawM`d
zKJr1iAK^q+eaUE7EeZUi<;~^|4fi$GgGW?2wOxPuw$#jqg7grzbaFSr$F^sUhan2-
zn5v%Cb(|ZXO>SMEWb33M3u35Y$ov|Xw?Ujzfe${Xe)w>I$ItP`{h6dda#Y7e37Jn}
z5ls#xqOcuU<}8DeK2!3qlF$`yB8SRm-e6hLuY%5`HLQ&03o?9GUP)9_OII~$!1;SE
zYkC({6MdgAv5BS`Kki}e@;|R<5^9xHc<L~cPgstFSeq6qCdI-W1KpI@^)=w1tyRrx
zaDr9FJz@_6?aCgL&(dbs1au5g8EfL%(=wYbX}Eq^1J!kj2$d4;VQtp+5S^g?UL982
zzkbr!;ZCWgs?-su)4;ZtJ7(L)X$p%_N*@THA4ar&sw><sLHI;WKts#l=S<I(dhNeC
zqDvL4PKoIh|6be+48vD}b3Nx$mhso+{r~xUZ^Biog#8!Y!fXEy8Jl{kd+*_NxOji_
z_t%+skZ9U_C+~XiEaMrv38tfP3gRgFh}O*&v1zc>7)pKsp>!+VR!?{z*lIjoVfKx!
z<6)||`U9$IWKLdBKxwCiZ5c^)I9-WyZ+(!%>VsgFb!2!Lv#RJYJ+FOSfqT|RT}>2Y
zK#BY>40ImUe6+|hIEW0q$!-~H7L_?xa#Iv+@cHt`0sKSgvTYe*?H{wQ_e(KFet}q%
zTo5#{>@D{%<s)}?1k+lYC8;SI8RUY(_CyJ2TJlA0WSmxsl0?!}Eq>32^c7GofUm42
zd%EJ3vT_uywht?UaH?NC6S|7=ZKKvokUM#a(Wq1H_esM*={P(vk!r9<tzwzlRu}j+
z<e3%Iyjq<g?yHIH1ivObH6LcQPy>gl1O?!YA9Z0c9E|*p66a~(;`3)WX>|$79PehX
z>@Ydx24A|dZt{S>G^~;a^M!u>L1n}p(~`U`LJe0+%rmXX*?`qAKpY_^KSGU@o^ehN
z8wtK9?nnN(h2MBff-v~mBj@=sih*@So07YcAz!*aD<S>OFqMyW{}LrRR=I{nKneh9
zOk+0u!FZF3f;pW?;gAVL^29UdZeg{_$$f(Tk^<lCll$dyogc`Q{&)+<l>R3u8ZNY=
zP(lKd6&X<@;}9<zjO;_Fi9mUVTf$G~eNO+`vK@CK*tnrpUt6%J$wieK2OpMFn45$m
zb;v{%Im<HBd^a-ULslY<W($iQ$gr-Wnx#2VTIXV*Qejz(;N*S8R9|8wK+pB<*nnQT
z#Ahu1r&6w#c{Sfb7xjqP`JM&?G8L>Dbs?+^e0Z7xlgP)pmthv3NrSIL%^sZM%`48v
zY;9wmqG4-ydD$z|o6_@ETWW^LXn|)f{A4nFA0*ns>D#>ORl0{u)Ts0on0Lmght@ZA
zMLlKa=D1K2QZgK*z&L$lhQY|n&E0WvUM9v-Rh4cdx8V^J`yebA?<W>K1gm&guZ?3}
z1eQWlN^H3@Z`~(E@NKM^<Y3uvYhl?y?Dle|UPd6L!>k^Eh9TzjHt6EMJb>AtgMA8F
zD^%&nb*ZIUVZN^PCkcOC_p+0>rn+i^VF#iZ23aWl1z$>&J;D&R82l3rYW=v`otmJ*
zpAVoCTQ8K(YT~%0L-^AkI##;B+kPht{ye3;n2r7k!wkq51)?KH>7;4z`MMK+{40G%
ziZU5<x~b9t!&FVJCgXGUo?LZqi65`}v?cadyl7R2+Pd|FIH%^{VfIhXjR&sXFS8HD
z3Y`3OfaRhP2?R4iG^d7!OwAJ?^wDR2lz%Our%7HGIh5{?GXXx|i3KNUmG|lD55_&D
zGWAO;!w>9kTqJB#ZWe)AVc7~|+zuGDt4KCWk9+mi*W#5Pm`JX1X;FEF+%OCtDfYF4
z4(G->gd(ZRl<KfJN#qq;1E(O*Yq;a_IS)3A2>x(0ibrug=WC>o*tq=4tL`gm`P~-|
zg!nE*9yKh{sRHpfP4}uoJ`=qTZ&^m1>NQV-FIwsR*1HAcD`R=}?%}nf#oKac+@3cz
zop6z`;#vg)K;w7|w@UK*(w3Glw<YAa(ggBuo{tDx7wG&USpR~nb@Z1w$d{ZI*IXjv
zn;7fC^=0santaTb?+GlDP?$CH*cMtR{JZP<AFAOn@;ILBuLW6n!A0<LNj4sVTSp{>
zj3-~x5Y2=LDthx`(kin$fMWkixe|VNo?#l(-D(Vy?0zTHFjb9Nf=rPWo;-|E6j;9|
zJqA+=A{786e}z2t3Z-TY?+W}nrxud&Om$w49T-|Vd^tMVKFi8;bB*PGlGcWspS{k^
zUe}gklGmjXE9|7aV=l}PQ8(<q{<^f&&JEsp;E-I@1sNoMO%yD8rN((rit?8o?gj4|
zs{LcFcu3cHk!N`O|1|I1hbST-*_dz`TgzjRCvw}WyNXMkEHkOW;W}FbjMr^}yfs=l
zq~b^dOwd;nOQVQTJ>-66G<ER)#7hI8-M%$I<EvcZ%2e5OOieTc;L=Qw8G(qRG3+(l
zu6?N@d!q>B-bFM%8%*0$gS7O#)vj53dv<gkd^YomIVo=Q>e?~r<uT``mLHFbBhCrQ
z0!%d~%Eo^W;Ue+J^qU4RNKIS1I)-KvVt4_Il2`SOzR=i-<C4oWRqD_=MxjxhzUWqa
z`H8jg{0JH^Yvb0hsQof+xMD$Ychs>=J-@6*5kY-WVvj<hI_G6{));+xjkUZD4wo51
z`bXN>2BfzK7a9?x?3?TIDDFr+p-}0nS9^Z(H&VT4Rui3E%fYIB`RXGIqXbCPgq9!c
z{W?%$br7{@`6EJ>ZV~`U0jahbB+RIrxlT3<ik?TseW!LPh_^cQwL;gjNWod$8KQBI
z?wyO{#m=)!0&m&4{RGmu75<rgihEukaIHa=yo(I4ef?cvGX)M#rXF08CISP-f=sec
zEC#f+tWnQggvOybF_0MK86@GGR7~{Ukn{8LG(`A&AMlzL512$KTnEDDPcaW&K5mrx
z?WszRz7UTq^XUaIh)WJ4D{6q46D6q|#0cJ!m?LkAHZrIJdaIqnCA#CQ5Az&Ms9a5;
zl1Lu5>%RgM&V{1<Fq^T!H;V_YaPRow5hWP6#ja}!{WDX1X<J)bTbe)%P^y8wa`!}F
z(fX(^o4}-I6049ej%3VQ5|NDGK?G4NVs8DDkvCH=n!b%krBx%#DB48IG=0fuzU39`
z4ANII0x6i#fJWWg#6B*tfm|xrRY1l%NRD<sHE5Xy0$qjfIl8@S>U+G&G=Q%YF1|ni
zDW<~pa8_QRwdE>eJ?q|e{cBFn{!8IstCvta`pywv;|g8peA;|{>NhPdyS`(*Zb+N4
zW?2m3sW(ImOn4C)FsnYA4r_R(I!wx{=Ev@*DE5sx3UgGDP`yV&L7oH-<zdjb6`=k7
zu=b)G+7kMYWy|Sa?k~JGUHUZ$>~%X^{_mTIjZ$2Oz0K@p6?53=0HNjf-HDN9F|;hJ
zzqdJ@L-nODcj$hPe3Z}ZzME5N8U64g`E7($exc@#T#51AUgM3K4%s&kCq-f+D0AY{
zbwEjClN;bL8iDM)UheJXUnC<Nf<0rmx211p48<UI8Li*)nDLSde*ti(Im|C@JLpdc
zSjaf5Qp?Oq3i&i;ELvFXAw|fAmZzt@6Dw&Ii)h#`u`&nm<Ghlq%I%U^#ku+zENW<l
zQAqW-Q|!<iAaQeelyS1MGR7N%$)cECFi97#(bej|Yd5VObCSQs<B%`?3^@5Q)a$o{
zY;|*Z%v$sTnQK$km_J?lHTET`dh7o|8=a;=F&S2*7*Y0f<DrFx=VM}X1Ec|x63c7Z
zj8-P8LNA-P=@m@#vKdjC^A#^THxnP5+3_!Ny`ht!r(zw&&vdqGek4-KVRVhPDH<ok
zDBLfC<`{Rsqnpp<@({7~cq-P{Ycg3*r#h(Qxuo^1WmAW0t#u3kT?=VhbQiJ66aPKs
z{b~C`A?WaUo%H!4DYdZi(=a$?Wb>kdMMpa2QZ!aFOyv_t-KpF=^y}Ra7>%Ah{bgsG
z)9%ULh5MFF-H&IBWN0uD@wq3^@BNhj<yPXsF#k**8#78eLN~aBe;+=?ay09CCTV2`
z;r(7@CGGFCe<H?0<q7n@(aonLXzY<3vN9|ScAbmwun5b=WS9O3UA?f|hR~O+f%oZs
z&+@yk)PLVFfBb)&(Ga@Ilk85(NSwO)Ne-!HIppmdM@lP)bfW;)<pS{}K=B1(6`WH!
zPb$e#rM92HFnDvT0dyPb<RpB8%T=M&lT5QUmz)I@lO@N1wn9*-Cc87n75sunuH$)K
zG*zxsfjXdcKtevGxqF<y$y+9+6&r!2ID@gZBRP>oQbPy9=g`h~wA(p_@1aMOVzIHM
zI3;#byD&Ls($jK7EEY$7^iW6pjQAjELS-yHYZzgro!#U;WJc7$`eKpzqY&CIw>PP3
zFx%>OLl_dTS_c9jREg4fIhj-LIMpfaerNqvoXn^o+bvJ^s#SOm%{W)@R03_OOd2|F
z?J-}Mm_4W)=Dqo``$_jDlQL!`ST%Gw2PP(1_Dw`PmTdkY@QeylbC#Y+kj}WlasnYV
zy#&n)bc;R^EqG)7!S{4G+ltaI`^L)`8UmL|^&-h&!b6+6BH+5|8<;j&{JlLEMO!-$
zr~&#!1%`Au_u}^Q6|NIyWw~m)uF4kDZnf8w4h;%4elcnG9oN;(66W@38f73^IVB}%
zDElZ7Z_|FVF~7PcpP5UCss0-<SG-`2b7op*E8{}}9%|^u78w`fEyDR)XHz?Zb&(o2
zUL<m9b~cKm<RCB?#bx!dRS_X0-&>b-<Am7gG1O=>rd!D+pwy=Q(&?V$mU{vBP4-RQ
zv5{VR=Qu>N-ZPxZ80w~BdhrJ=^Vi0^*~7yzk^TvN;9o)Zk|NBh2~rP~p1Cx0z2R^0
zG2IUr|MCY-1J;$G3jwUY=O2Y#i8p2MmGT`mGMXKQ-O0P0=ZwM_RSQ_(VZ;KRa!ncM
zq;(!uv%+y}tkj?L{!_9!?m8qb9c{w8MARW3YYC37UKUdVOv-p;GfrhAL9;riab1Qy
zLup;8$SYc>#iO3;ITMoDMInlsqD7%M{>hfBOmO84hiIPH{H*an{tH-If>j21FZ>BQ
z#^&$SYmv53rO)j1iKoew-4bl%gNpq&I?!$D;WnAW(Ts`PBJyiJpU};1EhA|VFS#~0
zNX1NgrHK1a*zEKK_QnyQ2(QuR1Yds4O!Bs#*zq8q6DU5_3Pe!O9{UpLyNJvVPLt(?
z0B&<mW_z^1IR3WeY{6fL?*+qYc#9`SVC%<ACKt#s0iCdr`sn^XLgTo#{F_pj!Wh>S
zq#`1cyCMYSc^!U~S*Cv^7C|s?vulzm@i@1Q47NX)?ZDb)TvSB$Bd%n&;?NW$JOO!8
zQo`iPh9+Hj^ia!^M=QN1PZj(zeUy}=<#~H4A}cB6(vu0T>BId+eM@fNX(+!;$03Zf
zpZ;+1GZ+%#T<01w_Z4qx5>v#PPQ2k`;Edo&mBrXBxG+IZ#cLT7P8AG`(_j8+!*(hs
zn3Y)LuAf8uQ70ocXZ?@ZDibhVNsVE$;G6|03^{c^qOPGj=368wVugA*FtTc*_HX@9
z6?5XF&4KA`|9Wzh$}BWo`*5KcMzj^T6dC%x^I67ts8vNGTs7euV0vfo<7_-9rZjmR
zu+*V&aA{NEA#vjIy<Uj9ETAP)KOk-gRD<=YkxGJKEyKWtL<Pt7*P6EG=q_$EL*yYL
zLrnoQFP_DTxkCzEAy!|5ElSOZt;}Jt{Ts5cB;8-{kHRW`XN)XT!I<F=Pc8}2rYKG4
z$D_p+H{Y-52O_|3i5OqCE$qS|l&-WI-lpA3?mx^ZuHNiqu}(${GJUCi#ZOK68nWW5
zOe-yunv8*e&f>^Rv`Cc|Joio^i056{D&!O~tUX;g4SdyAbojjmcws}He=oGe%5n77
zT~E!4WNdwWUd!Yz=qIDDa=DzVBG^{x$JE8K#4<kPYJn=I1kJKB$$p2&fkq-1c!m6y
z6Y5!z&8S{tv_p(=CW+XHQ+f{JAk~K;P?M^?s&)x6MSQ&IM~X}zL;J5aN1!v6D1*L+
zo87!9oitTPXy$6{*s{RV*HwOVw#I|T#ovDTrP8d^5^?6X0IEp6UnckoN~Zd;m)P7k
zrpu$dzy*3hWpog=0T#$~)-Rs6$Sj4@C^xT^O)TMb;a4pEhAw7zEw31V!v`agm0fGu
zM)Lyegfn9{0my!<^oY2EibLq_|3d!y)7r$Ih1B%|_omvBRD<0DAp2(q4P>SK8?i#m
zRjBGtSwgWPwp!RF#*-pobo{I0LV7hio3;)x5+##5go{pdt_*o&jE&3mI_dS4R{_mm
zMQyYh7=%biZCPIg%r-w4LhP|3lj?HOFwlmVt4|FBaY43q|2@zT5EHpb-p6JoiOvd9
zQ;oy(_1;Mk`6M10t#X?l@%-c0u%5~vIsTUnGCANj3ZQ5E^v#c(Z%o1TJa&Q^#7FKz
zRv#R%Iw5UNnT@F|%tfafHfjhS-FD>;>GqP>IIfJ>NnLc#7ZzbPo=5+Q3oBA0iX2m8
zjdblsTsAtRt);GQE|$Fq8r79kQr9{u!|y#2`KH<n8_8D6t&?jS94U=<(q@C|3)b@0
zoPO6;3*d$CF{<k4R_bx<u2%$8NPRH02e#{elXLw5AhILh6`uq%&VQ-4Zj2_7d6!M<
z8gMR<c%3B`Z7OU_qgN&^$BrZpo>TVyR~DC(a?buDs_nLdf>ItPb@ZaPi<9U9!PJb3
ztXdCw@H#`f5>`OVcVqcH0CQJDxHOm#bOXt}Vc<T>bu*W^k`>b{;3+~r-U<LElf?Nn
zAYo_97iTR4ovNGNgLwhdj?M&v7a8-jdY^WKEVF+#V;pplUIyRnQoHl~HdV<{e<Bq;
z8O~%?C6YVw(HNh)Cb9eN!hok9jw4&Ib2}m)K118|l(>7`^EU-ng2$*PLfrV&^XR)-
zm&~AXcK--AQIv(bVeGxA*WYsvR>k$$P|t`e378}7MC071<Njak&he_HnqUNVZRYiY
zd4+<uqBLA7#JC&qYmys_vkf3w_mGbav6!9*);$^|2|WcPxuH>6H|CN-D(sDBLYP1-
zL3)DSH{k*C$(Z?MpU>dyWmQ2gJcjis1(J+fT-D0^6`o=hBODv?!QMNjw&kHlU{DS;
zf`VkG`&r{8Dx@(ZHmnxz4W2}vu_?tH;w;VnB;V0ZE&>7IUhc>o#THeyaqO`~VqrvG
z#xzRW_^A+(-jQpMHjP9nb)(s-N`q6Gf51DdEe2X=K*<Fi$fCuYAp>MR9>xG0ek9Vz
zbCg<RL@=?^XpBTAxv|}_o5Y{pu%Fq{5;%)gs+ST>u7a+HI5kPMz(+2j<+cf__$EpN
z{0wNAWizlGnA|eDrJ#zr>Y!NX+Cr!$y6X;#%fYU&{LVwnxryuqGTW1^ZBIkleFUD4
z(k;<OA;TVtQ7An5?6Delzo5J>A5)NfLwd|NI<~``Zx%~y)-h&7DXVuzlUVC$BkCLL
zE{85DghDG+b1_io^0xX+_JGsHyDVk3Z>lP(t3pr?iHi}Z+smR(+2}Skug|)@zYN~4
z<~0}ZTg!vwdW)^nC4cZST>wgiN3h84HXel{h<%vDol&S;&o4-pFP62|!#XNz4PLLy
zYiT*4q%~WrZ4V+1;BP0|hNBx;YV2U^KbI-jr*~qkQ=u1~%Xe@#YRx^!S}#nZnbf9Y
zI_q4YoHu^qM}elp6&L9@xOggZ*N6c*0_;4hJ38V2fw<V^_GwtEhYzkB4gUCV<dyGi
zBMwgnlc0jR(px291_H)QbpkZnM3y_!V*n2D?fShJB=;MJCbnU^;jZee9x5Uz?iE7m
z4h|wCHyk0C3srx1Xb)Sf;xVwx=wMt35*CP#y;IT;Hje$dz@6qV#EpJLEGt+g6+OKI
z8)|+qWXLOgb#N0T?LrBo0<(j&q+{m+UE7H+UNBzxJu@GCZTqoy!GsNgt3j3RM29r8
z{eRyLF2AD<{veO1b@trszw#T*3mYY23Ksy7denFA)R+Bof}8w>ns)mfn7?#y`|?SM
z`M}+G*<p~!k@>Rk9O|Vxg=d#+5bf^|I0LkdGV?AN5yL+B*PjmiG?%yTs%UA?OFAFl
zIlJp4MFW?W2-R;ud3T%M-^ATCH{bRdD4+SgZj*sxzhm8mzBX^x&3iSy7{$Zgd65e-
z{|*$&TczwajlYU>tp|IYWgoyjJF$-b{z<|V@6CsL?<{z6un0f@#OENqJ^F4Td%ttn
zw)5MuS4ZV`X=PeOQ_PnY01A9sDmmL&8*~)0d>il;65Q%Wt6_0iAU>^kRJ#@P()}+d
zo`M-9)jA2?ZhNz#`Cp>EfV*j^kN4`B;L6%M%8~UNZTGh7MPHPVKkL`$(U==qwkLP%
z{QvUexe1o@{@5+L>UuC@8?Gw<msC%hUsLvMO1uue*{l3NMEmRDZnZtRkr^%>PHj97
zD#By4|3jF+Sk*XO)UaQr^SR%sa%<GH>?Y;)0NoKRdit0)ab}sn31Y!b-s{xC{X`MC
z_6FASfKGN6+Dt{5SN_vR;$483y^NB*6-pU~H^1PVd+W8kSuZOwrTGVq``4qHML?`;
z{r~iN_T}~Bd`oBO+_w8y*ZVX7@7un%-;JrjM|UBcpv0Cfzt@E;-~R{#4A$;7w=vt}
zegj7IIsD%V(ctoJpkzsa99ogQ>(7!6F6nrT!1PVeNi0a+Lo|6iy#FgFAQi~2)oZ+C
z@L5Yiqij<JEp1~5Z~ZjT|6VrE1iT?GE2~O!?LPj0t!FpoySc4S*dc9u@a47n|8(rJ
zD;hZ3CUm}sZFPNjjh1#=y#n(mjM--ES$urL`mJLEZt_2LXJ<J3J;t_fIf*`Q*_Y7k
z=Kq=wUoBit5)#U*mEz<5>wiB30TjD*Djw{QTAV+Iz5efCnX#A8kF#x?DBnLI_kZk(
z0<=x{0^-z_+&A8kfrAhDPjCC$O|jHDW8cjQ7^u2pul`5o;9^zf`ewt~B(!Muk$a--
z;Q9Xyar){*##CgL$<kj4=YP#Xx~I{$C4bZ`->ba+zd#^~B=)NnSrNeOcSt56_`g7?
zSEydHU;X>LZe#D)|AJ#G%H^#qJ#m3X>Rrl9w`b-<V!?iuC7bm%Y|E(5;PwBVO9S&(
z8iS}c93nXnxa@z%ZH(8g+)8a15o>z0LHA!X#wi~99XJirOeQ!WT_*o`e#v-p$9FmC
zjJn5nrNm4-|A8P6i2bT*$Zj)LK>PIETKIqTBLwbLvLDa+R6E+6H<pC{t0}=<mC<A0
zsz(3EZ9^lE=^4BtFhP<*G<$sx1ycBTzcn!aKcH+_Q@`2BT0XgW5|~rLhfO$P+Cgf|
z=DHBscW3PpHALgtsT~jYhn@S1kO;bWZ1It(%V*f{<3z;K&Dbp`fT$+CVJxPjjm`D!
z;}cvn*pi$Jv~kENJ3mz?v|ESll_jT(wv>YEyKH%LmB&|{5>|GLRgv&2mFm17iO{iQ
z8BQnIYK<5X4lB`TF!#umYPm?H+tECkpNsZI%xW0@MMg?gjwT<mL}_22I1x0Aifc=3
zALfqd`#o?J-#>C(+L$ct)MovLky*B7OvYssWQ92lUf<+kJjxG)Z>+%f8!|PaAX6P(
z2?UY3;o$=C;!2*6pr9S`niRd#kHaPB<aEi-9zRtDcIj0)5|(WKn5zl*)}>J0uSHkb
z;4}7)KcZ>*6XfQH3t$!44L~dv6TwSP`_CI!SH!;D?2Fhp%IYR%f4`xH{#c4|fr>*l
zTtJP&cXugjAX**>M1Ow?9dK{#^`O~_jc(<QDqT_@UEo1EyJiIrtXgCTXoOUntMCkr
zxb5$U?mbv_&YMP{(v~lcPv^_okn1|$^FfkPJw8JnFb!xV0aJ0CfvX<Moy)s?Q<way
zo8NPfIa<e*JkXlutP(Y~@osl2{WBwcU=NhLC-DfKt#Q`03|K6Ry-JJyFqxt{J;V3u
zk2q!<l1&>l&rRx=n4aJ?dlLdicxuGX88khK%0_!tt`XzHn6D~t$p_`gFqc#1OsX|#
zR2i@)M5^wjreGAlaRQglBBhz-B6?wCb?6_XXC#%!!@q1e`3W+2$<x>vXM==La)H*e
z^5&F1X!A?vd+~DQF*EGrdYv8BN<R|o2M(m%bfk(+o&FtKCgLM3*?p$Q{fM_cEeATp
zL=3D<RrS-6U_L~JDC=DsD2Lk#am;PGR6E5zjFuG?;_=Zwa+)cm-Gm<;P`$N7Xn@xr
zy1af~jlD?gh;Y^f?<~3pRmr2$KMCbpliD~2rq;v}Cb1+{`(mj4PrR-ytNQidmNeGr
za#H9IQiXDsJXLy?Oke1$U=fsUv+9!Pr&7iy;Yj4s<9*udu`o&!xVY1;a9U~6u+9s{
z-R@{ttKeIB#B>|hS+w5DoL6?wU*Q=M)2cWjxHpet=96n69_(tC4nkhYh)VD#!ac)9
z3H5Kva_66J+FC9o#ir)jjqcNSB{!xw@da?!=b@9%8!?|uI*?uiyp}}oe^$W^1Vve_
zIMIeA3sdZ-D{k*GIx7*-F3Vhum1CmqKNdZPXH>)}uU3J&JcQLmfA)rp-=>tqIjcfF
zSDa|O$37JdaID_e=*#vwFr+9ufw=R}5$-xk{UExqfvd)6C(m-3zolWf4A-3SD=)=&
zg!a?Jo^kZClw);fV>#}Mo%>#E@1(E(QJS!ux!KH0t4Le9G8DSPhmI7Zx;RMqtRx1g
z*u<8YUT;=p!_>YyeG96fr^`ij$fFeYK8H$$nr8C*0`rYe*TuPrhvKf0tV^uFF78~V
z*8W=H?^1Q3irKHf6hf>m4s&1BV2ajLezZqtoAH55z{Q27jP|gyDb2`a**49WEO8!Y
zor_NmT){DdTQu2Ev`-;89Ohj#yZw5M2U~m<%%z<~U}p&e;kMK>mK>~RUp1mZB>EJq
ziZ(c@J$HS!YFrPOG=S1^YAWB!nQ7~u#I*R4l?F3MaZde~rUa18sVGOyM+=wKhS5Ya
z;7z><%i`>!uw4Dj96feEj>2XA#*d$q=TbGk%{{_M^=NycxiRUP&f1I68a@m{?-6dK
z6g{J(Bm-}88aS^M%BFTdr&0TS1Ov$xbH<`a#u`>DvALsgOT+RrGTmf0;?hoOXRCAU
z=2A3kCYVqVN!I)lKYNk%n~^I<xJ~M?hnb>(-nUqX*?VV;N)mzAQpwXd?S#gsO`4V@
zf<FVY4Cy=}oxPLoX0F02oPFnYrzGcN1P04_7S4(b-#S|$Hf3jT$vq>tB>xG??@$m^
z^p?h0YKmh~{lmTT*}QNHg=EFf4|#|Zj7#)OrLc~3iZ_mhK`lPx+Oi<N)teHDDT=Q@
zP}d`v*f&!3X3S}=64O_DzlxxVnm@)R=+Tt}Uc<>mi_~&R$$O`!CUbpE*e*`<4kv!5
zgoe$y0Lbeha`;i=BgQM&E2>noP-dIeCigtjsJyqXrBWR2Drr>|K<uW)L!rG+1h0Q|
zq-S%o@zU3$YeP@L6js<}xG3p1S6kzenWK)(!!PE&CjAF>4nr*`*BVE2w`4;BASD-E
z#{tRVt`tv~7LW8ue=<}@@d;BDTDoa(fwul~VQr;Wu0y?L+lo~u8)FC;&-se{Q3HcD
z5f1(~51t#$fkr`*X87)+CL+_>QJ{UCCCvDFWl|YQ^F7x=TuBCT^pKEObmPwpI929d
z)NLm(hsdjkNyDWmks`-It;!=!&#-bGFLOV;$Fa65UTF>ZLJ7%9vdF5ggIz!r;>_OT
zx`7fUBdiVDnifvMorr`kXG8mL+Ye5Oj%O(b70toi*m6A8PU%XqQF?nYNc|@5F=#j_
zP>dkX^jgk|&`E7UFg>+Yr2tC*KeWANa2(6hHfRehX66wyGcz+YGc#DSB#W6Pi<y}j
zEM{hAW|qY}KIgvQejB?RaewSabY$mLWKni?R#neanazA`D5pRSn5DOT8fx4UzIDZf
zDnoI0+cylymB261VKP;87Z}sG_E|sq0KN+|#8EzqI6O56iJ0P3X>Arc_M&0FaemS!
zEX9i!RXFLfx%KExu9C0II*@UP(>*S$mszVQ_twq=72o`v<y=(f59DkW<!Tz3=}#VP
zu{<Txd?@mwH&iHX&WtUKtnuJ)Cv1JYeQeWU9u4{!Dqc>_hGPy_l5|X0cusk^cetg}
zea9oRebjh$qHfPv={_PLZmsKm6s+|kXJd`GScpxlO}PjsTMJ=tFJVSY`wa1Y@=hFt
za+k%ItjMB>fq3?J+LzF4ro@HOMHNgJD?_?$<^@^f*|4`0N+tJ@_RmsXC45N;_5z%y
z=dbT=Cb&XvkU8V3Nt21_{b?@_bI45VyoO5Xk}+g0bV@dK2{)2DE`KaEK;B;wmYv%A
z)AI{8iV;e~cG1GITs4nGG#owww$urW<hp_+<!;lk)5U}A8g{9xdtf#(h@+CWM6Q&5
zUTPXN{;b)YCC#Nj+J14o;idsb5xC`J$}l1vwyd&p<fb1-ZcD7RNGLR3iav7pdJte{
zT2njtX5bg-DeN8W{4Eh3##tX{AYnadAZ$3Jz^H#NPLVW*J%`DMfw3<LaZ=K-!J#O;
z|7pyrq{65M5PKi0y6B3%kM}`u0HKnFtm+6XGo6`Amgfs~W)_~^X71IzqZmeKla?j6
zHTo{H$6QzWW5*xQ5GGz3R&@*#)eF#gg6{eYX+KL;Y*w+@V&e@3EI_Durcl2+^1Hrs
zy^P*w<T$P%31`WQxc0BU%&WJPcbcX(emfg2>--TymP@Crx%spMM+zuJ>l7GfEN=RX
zK&ISMmhTVzMjRI3Qaq`gdx2<Jm;24VLiKHnvxgw*upxEX>Q+I+PR?5}2564N!L!+V
zL}&;23d!?UA{S@&gHy8ZqtXrUPE`{)0i_{)-e3i0CB0Wb+;-|<Yc7VT)l`A4syY2a
z#3m=#&*oF+LnFyumYumJmiZ)iv{zP48eY-Uzi3R!dW#LKjZ~BDz54wkf_^!x6=QNv
zL>^(~jyh=Z2b$Wiwk1%7wDhRa!)}tl@{e(1BITv1icXZADY$$}5xX&vqGJ`&2oYJ8
zZs1I}RLi=uU6Pvru<_R%H0Z49_T1O847sblb)Gc-WU*}fUWCy!seFe5D=mumoJk9X
z%)r+ox8#qXd!d|&g=2y$(dkgi=ScewxfNB4Aevm}w*_rvph;-~kde#}SgT<gf?C0c
zqAO^EWx7MG*ET;&NY_I{qG*|ea@Le4P+bnH8yoaATrEi>FMY(^<io8!NWA#9Zw*%O
zgrR9yo%Co}P&DhG)RUp#89ujS=2l_GeQZHhVTQPz*tXdZd{cx((6s*0Fv;{GAZce;
z&{~sFxU+B@i*{se5vcd>l18?r6?qgrFgD6@2(6J<_fF$rG(?covU%;jYP4k6Tu;<_
z*Hz3&!#__I(Vq_^1gen<!VkHIi5q+u5y}bl>1tR^hgS3~&#t7~faW8e%Z!_?ne?GC
z0Ia}#7l6){2<ZQS#H+nf5q!Z7rX)pWKdUi$sQE5M*L%z|?`oR>$)l#sdq0R>vNB$`
zMC%S5$E4;N4Qr6BfU@ygcSyzZA$%|fUX+<In!J>ZgcP_wxt;n25^`6s`VIWt1C+}e
zfje!A$~G&MiL2D%mV?OXIp~2H#-qaJz<Y!=*2ynBUJ2eVn(%}KwHJvDMDhU!o~%>K
z<{`=>5{DTY#-^RRop(HaHz~|X9NP57?lUzLJNed$R)3MSOGiqDT?S&-Msioetj(eU
z=jm-Xq|AxXOmlMC4T%te`v!lG(Vg{wf;MFU-SsFD^^6yVhj%5Ex49~_a5#lcwz0``
zmilt8$Z%oGLE!PkLuJVgKSGjXz(xyc!Ya~{bGOo<vVx~u`$poGO=1aUU1q=l^uSIn
z?(*>BE^c2Cp-EO1Tp=n_P#GO~7?&vAB;|*GK2RLNde2>B1U|^+N9c)9LH?#8x8ckb
z71@2up}E9t{33v-Id}RZD5AKLO6fMy=)z41SLU5AS&q_)Gz`7;3Dg3r67j?l)?|5J
z8!H92IpKRYGm&Ec^B(<&1X#Zl*>UO<X*Li0D)~>OIi8>77VVMpr(%5+q^T~FF5$Ga
zxirY&RPrcu#v>n@H>tg0m@{0xOo#b%o7MQW2QFwA5WNhE2G%Fyiun}MPDP#cLCA(F
zxeG&S&(A*O8u+N*nj9QUCfPuIE{TDFk{Uyn_BAJ3RdOnL2xm$g8($62fsVn&<%ivk
zDqWH*rub1!%N`IoYFS`TPnv=){V*GQxe(7nsld>*#HRpJRKXq>dT>u9PUFXEO@u5T
zyO%C*@w^X183ocq;SoMYMhL)nQ4`O7!lKqu0!dX`pRO*Ja;E$;*28N0I~QmK1HF<K
z5*4_@#9C1=)RuP6yxQTDH&C~PC&9xchiVAtBMzh`ybU~@_yqTqVVz6Q@Tk-UCw_kl
zfU|oc%gAyMe8#t`#1k=0-rYXyLP_fAi9h|S$a4fDyo(glpuw2kJFtV<B<x#tRAaK)
zlJcC1&jPVT^QW1?N_8Y0WW^ECvN|T0-8>yfq0K~<8k_#iFMl&M8)eMpJ>>aih*+^&
z_jNv(O@FAYBJ!8HxDBUiOg>nsfsXV275{X`ff7ruDw|03Rj3;6Go!zz(gH&caUYf&
z7oWN#%Xz46@q=@i1*y4)jSIKK>c~62uAV=(^c2z|$q967K1Uaf#02y*Xr0k<5TDUn
zsmtQMXYFWY8Hg3;NJsrxYfrLnqb8!FW>s2*VPWdXlzOmXa2mazNImQslD6EA*SHk$
z7$aZfp8%(FFqoZ;ur}gI2(giLF4@ED2x@#Lj^D6f$ahUYqO9#z)XxJ(c03f}q!&x(
zeiup?%EU;;nNhG;-b^?^tE}rof1DVwwBNGv0|Cc5xLD9VCiCI@&fedGa8t<7RJ?;l
zJyc62##6z~Zn04Zt6J;SY{1+S{GI+j<|z3JvOpyzRlGXQ^6&{k1667eB=u5G(xWVq
zN2-;mw4909)|&>)Q*NM5Q{|K>gaThRJqf=yknW>37iw&Li2~FoCF)O(%8|5JkcrRM
zwx%cSh1w(|8c7_X$8xC*f8j;d>R->X<C5?bcwlE;aY4c+jR`RLTpjwQ^t<w^+X>Rx
zc1&wv#x0@#g%045#(L(rP^QsCQbB4B6|;L#rp1O}%ImVmZP-k~_xQyo<^{vcNkOX;
z+COZS(i!iM@1O5)_bfz9uNI_*4|CdRwX63%q)xTZz*8Ct2Fdt8Mm3#pVqklhS4+E-
znAf)eS_KvA;&9wrh7rnE6hqmnZE24JS=~;<0gMt9P$m>Xw^#fQIHXF7DZaZFh*%FN
z0ZF4z4Z-O8^e=H`xD#49z`3YC_h{$?E+w}Ff$w?T%^QLuPUlq}c|AH0flxGK!ckE`
z>Q9qmt!5qhKJc_)JTxUR)IB|#Ho6?pD;IwIvI{#b8aspj0ZkEO@)yB0mc#I!{A#>8
z;D8trakZb97(EZV0MO`$WghVun5{Z#BzlE&kRRnXh9}jB23bcG=hM?J0q3IL{IVQ;
zhH{eM>8Qb;pxHByo9C&0ewObfLiy>M+8x5mI3CerT2jgvP-}9OjyKdpSrl#h@>K8x
z6j^r#YTe0k+m6|*tVkUjgN>ZUt`w#HtrG|a-@)wv%t?DR)~NIo?=G>r@O;Ih-KtHy
zpgIb3Xr<o~p%J70c99vZb|r4$bv~RqX%ssgE|1_}w_#02RQrPHM>Hzp4PLy6htq-d
zzIgt1VRv4Zn{bU-<d+x4{O%=tP~Ipj>jV|D_IpvuN8L$zk68)l1_SQO!l*)EGCUD*
zK30Jh&(#3i+2X0BDaJ!IaXohXVdmZ7D8-b2dZJTCdIuvyMNR1&U)ZsII0{rkyir0!
z3))$Ie5~=r21y!HoOtQT??g=1#bBtySJOi?fx4C>6S?-LC*X^myWACB9UneT6bdj@
zWDL1KKb!7Can8*eK7<TW%oViCMJSeL=q%wC93x-DR_`U`z50Q|r`aNa_v_9q14E`n
zO^4e|iY~no_S->{snu0e=$BOwfhK7t3R$l&OKw_jG>6grreMb~X$1bc4a#-*63fa`
zRnqtp`z5C#`ExF5Z@@MbD5x}imBBh~OF7wv9Zwx=&9_h>>^U0~RpBk=wlgqK6MPPj
z?kcmAn{EkowhUjFqhNJswCM?+_rwhPnWgT)tk_dIZeFC2NUm-+OPf2y6D!Yl_X@P^
z5Pq88L6kUn!ktCTH$|!!+>~-~{LU$7N^nx}*x2!I#LT5GD%LJn!M3~tYve%}mNuv=
zV=cJ}O8lfF%(|hK6z1Hj8%y_CWE;u1*HcTK3&FvV7r3o9cc5B)P{?t{s8Tr6jvk?z
zhr?n!ycRFFhL242<_lG6C<bMkF|Og!RRfO0C=I%^XHEA4%C%|2D0GSPoWsKhz0Py%
z09Ha*wR9wqOO_?e!|eX-Z-tj!o^wNZxfcmCKR3M<UK%P6RW8zIUr8w)iiW?Kb>T5t
z+t<w`#Z$c=N5uVIu!=%&fA5Pla-9&G5he~*Lv_fMq7{HUpqtiF+M*^KS6Q|y+CFZQ
z0r&QAlD@FAVjE3SOAf#*8(<p!IXF3*8tOxTK@#4wqU#4Hft5zZ(WV>*9PBonmE$>{
zuYRe8WlV-vC<X52v4*xgLm(hqGRfj}JV_&h{gU3ALbXETPrSXrPZ~@CN*MI0-VTnG
ztzv!>?-L8f(>j6(8VpBMGrE3X#j1?a33xj)Ie^3cJK`w_c%2jmBfX6JulAo=NmJ^~
zY*NHO_@t}2RRWS`O(sxqd76B-k+k?khr7!WMwPrqfU}{WXb+_tGSp_i9BH5mgc_4g
zzosA#Kx6WB`NZ}Q)Z(QC_*o;wZrM!cx!)kPAL9H?yo;5wJZvKEJ2`1@o6o2nrR3lY
zs!yV=4{-0`d?bN0_?$R`PoapI0@Jf?0xt$x=lKV2T<hHI6Q4?^WJxpve+B%^oG<Pm
z)>}5WkTThyOjd~&9Za)R&QC(TFQ_X;+0RSKEd0`iyfj!Ui%4pfr3AS5&kPUNC8n1!
zI4IDTBr8GO?Oy#gz*)pr5tbpdBU+t1u}M<D0HB_pQGCDPB>er+Z0(EEC3Swx2Q4bO
z&?c|BerTOHE>kL}al%XOBbtuY-+>s2u8G3=<q_Xy+53`p6e;cO=F?`SxfkSDa)69y
z)xPZq!hO9o>c*S<Y>P}Kc>#ae^?!MNc9920v$$LE_aj$}efoZCiVP2G>;*{Z=t(bd
zX?O(<h1F!vHCBJp>>4L|l0|op-pIFTZA|BKc~K2ojONm+=wMW~Dfb#wo%W`2zn}ze
zt5HE?f+{Eq&D5%$_y9e?*jiOF_n(X2{0=Hf?7ebsPNWl@wh_#IQ*mtJ#saWL`Dx`w
zyDFaoA>I-f#hmScH0-#KcL@KvB*}@;Iz9wj$=bz6uA$p!=@*u;W0%_g>DtiG(U<;4
zel+1?(ny~A7A62!;nSKL?ahEU_Ph>~qs;u)SeX#XB7-Wj;%JlsYZBNZXL=r6%c!7)
z66D<ec=1;c10DiZe$bhGr5}X2!aW3j?Tc>-g>S<X80M?EO>)sCnnRN|VX;75vFqt~
zOE%`<wiAp<gVN*0+&64bikd^lvl>(Z=S+q#bR;viN_(Dv{oLpQRu55S;M_Oqpm1|N
znak%5y;<AA#KqB`e%BXjoSc%e<{0-aECGGO39p98lrZ#`R+?fJ{sDBQA;x?Yiqv^=
zRk2FScsmoZ8?nt(u;#?^_D|w2)#zyi8Pt+y%||Rf41*<9+~lmUM(kG!?Lid9i(mJK
z0+jOghG@OK0sT9%lpsoC3{pX3S1^(mq!d~U1chWR6IS+jmq|JD55)@-XHC^6N&~}m
z0sR-;?;u}sQkgnm?dP&+HMAnv2fgU?%e$z`Fb3La>uTZly<*4L?JXY`C8JcV$ITX#
zC?k4Lnz--R-gD*NWKM(zH^TZy2BzW!n%2#NFS%qN*VJR~0^P6nmk;O&qD@suA%vr=
zb-050o0m@vm*nTAuv+TKF0O+Rx;{eTu9bi90lFj<M-m_}`Z74*b+_e<9?4(noX<6o
zD}`e~gH=ZXGDsZEBnGpXD-`V~jO3Qo4g^sV4oT`GWA=QgUA|04Ol%@KFQpTAE!PI-
zR@9o2YuKnyvkCpgmbHBK+Fd2Ut1<bQi61r&eY1%3tWtQFi6atk;<rN(x<!#}%z!%=
zDxv8KFJB{AW?a0_C6&SQYgFhW(kL#I2c7N~QS1-?rh|d{`8oyNR`@Ux=s4vb4a<J7
z9$(P{{NpxUwrDKQ^ywo@;UbEH`Q(5yw?2;!yTV$5l>ekjmjxmM(fuS(dAM*E*+#Gd
zTQ>^z7gs;zmPV2*ExY!YlWx>Swv#X2YS_4JT>1!v8EwqgLH_AI{@Z_{LD?;OrWqAl
z5l&7Ky`ZI(#;jwYY+xbjBpgz?XJ4@OSY?c{GkHIg<?O;f?l}9m_RJ%i)EC+vX!sk#
zbDL*XNVLtBUNux0UA)s$)XtE1jU(|rf4IeeaY991M}{iU(x&|!4pZ2}EjrURF{!QW
zq2ns?O}XclS#==Q`zWlpMnp-c@^^}Z$g;@P=W-)aDXU4%fW$!?lwBg;N8+!)#`@%n
zR<31cg;fOct7eoz$48`1(&~nrcO>M@=a)n~Ugkn&tQ!ys1z$maJeS?W0D9_lluM4@
zwXjsD4?;<U8gSA%IYuIh(U>F6<*Xi6OPYKBdzh-2!msW(6q+8qtzAtOt4HaH+fF6=
znWL=>uaR;tcoF4@s!ZTykq+bU;BQ(<mGE%-;YWtndJb0xW4eO054dv|Umb5l`}e>M
zg${@Q0XEYQB$X#>XpLVlV4Pt*SxI3!gfnvrQFCfQ*JJKU7~kAWunyRG=yQFqA@1ey
zl)~q2z)^8AG$kFm<KV}*&j-L`ztqk{QPLFAs0CE-VY0d@ZFQc6D{wZb2w=J3Mx;Zu
zCa)U=^e+~DIYt1O#aKp7gNIGcYUKZT-sf|1`cb9S7#c@xW=z1Xj<uUgCtN<;%4beG
zGX9`J+(?6i!(z+_1Yh?7O3Y)p8u#4@DqL4am9jLE)>Kw;l2TPlR)ZtB%G<x-RIYel
zGb85&z?2Zt>rzsb68FrM2(M_Q6=_x1ozDItGaR*c65Yqz>8jqN;PuoH8pg=y1(jW!
zJq`=Lb$$L^ZEwOGvD<jz(^ur*4wu;Q3;6Pg`${W+Lm=aT40aH*|4HC4Dz%;{#ml?F
z{4F|w%^-aMozm9Qc7u(cHVU@iz%n#+b-#?o1<C}jypp8VRtSnoIEQ42Otr^Dm@Jd-
z<j`;o<|fO5DuH7i5C6~hfWIucN929JlIullVXl*XVG}-Ed}K1%*wwHW7+s`IK3V68
z>I>GZ%rcxx6ds{*jD~XxRS)%T=2^sPLG(<rsL~w6wjwn;2qla@`Ygw$W^}!S!X?Kq
zsbs)b^|jG(yzKkDoGt&jQjKw?ZZA<7u@puCC=DG0YTw2+9L;1>#C7ajQc&^$U2Zs<
zy1|9_NE+<1ao7P>aMZRK$rLJGMj46HcZ)ywUy~pYbqdArZ3VrwuJWI<wJ9sjmj}BQ
z3VRP}Tp5XyAorofT2yWRkf1W_utRqt5@yPa#ed&vBty{|g5ywP_K7pULUQaZTefkv
z<@Fcpt^(hsHQLITCkT=HML{(yjh0%f=z1xr-XqN1_#8;jyqr#aC<@1A-b+-zWAW7v
z4!I|R)JIA#o{@qqECE_M1lO~bwW5<Sc2V?cno3RH!xW8GL>OkC822`))`Y=EFfIyf
z!6i(8j&wdvri#Ii+L(@;MLB&6nYC83ET2zjr+XmhNxP3}jlqAr5xwyF&!n^l9#RW{
z$O_7Xcf6`scxQRJhNLza^wh`=1Ogywr9zs>!sAX7N^)v>?7Bk;;)IUB18s1;zE*k>
zVwnB|26A~Yv0{TBYmIqT)sQ&QGB}?Dz$*EpAeXYo8d<j~jNf*+{vA&8yFHv)sEiRf
zr8hE8J((Q#draWyb%7{vC}!n*VE>t_M=k(lJ=vJM@qM>9UPFnEby9UEJD8XWnX*v;
zxmqTRO2Xa{nSju>``~9N<@B_*^{DqE_gOi(9J0ioiWfcC=Jys_wno=@Wwg;=bCK3M
z(xp=e_eD{`;-a<E0If=RyYUuQ0kdMRF0=rgc89OqMODGK)5uhy>%o5z1I8l3D<vaE
zCth7<xz7Tg4HIqT8<QCbs#$DqVna%!?@(AUIQs+EoDdSyndLgBr^B-v<vq>487vJ(
zz6O=I@SR$t;Xv%0SqakP=d`MFC_uVvEK5$YV!DO}t0?0=TmWTx3Gwl&WYR^TMZHB2
z;eY**rM2X;#8as#>aE1y27ho36Q;*@DmP8sc(C$j@akScUdhv%X+Z0x4Lu5nnNmw@
z#F{B)ZC1AS+#u7r2}go!jCIO>(DH_>dTcQW+OkZ4aJ8{_*jowr^a?$U(0)J`Ymo~$
ztmi(-e27~&8SX5<A0!BfcxSAlxq*ugF`H7gW;@Ws9z46Qcr1h0A9WmBMGo07JBvRl
zWsSPzEB8v}X61?YY<_XVT<a?2EASaIzfrw|SufpjoNr%(2+>}}M|eW5SmM^ZN##c6
zk<)q_B|$Icc;~9ZJyjkp-(+55`6s&rcu%MO0%<F2US%7zJB3F^!(|d0Bj^eNd^WQd
zMfxVQyOjs-gWUt+Zd-q)-f3SPi}k!f@iX}4{58kv#u>`edB+1;N4zJE?c9$;Ik=eo
z%}&0Q#Y3H?7wpHlLc6pnow>h)r`C1)lBVSdj1Dh+O7srJ!9$8ydis82Gtra54VZ;?
zHNJlT>5suScDn3*LIf#!GThVul0<&$zIaBw=Xub*iQ_yV5U=#I<q$=xzAMs6jPpF!
zOPgAk?%OMIuavK9139W&NWOGp&?)C;Dt_B5ajk|MW2ZY`Ts5%l932Z;v<>$O<1V~Y
zrj0S)&`vkONN-M3w8QURM?O?<QT|&<wS33H?&99^O|*@l-rc`?etM~SjxZdk&N5~%
z$x0>r<gnVX3JCJfYg+ntY#{`#zwtj}BpEZ`D9+ujmx~&cTZDV|3S7%!y%wa-WTJU=
zy#t}#tn|0x!DA8@JDD^Vf@~9JcJ7d!Hy*ND|E;-NdOhD&??Uo0rOS0S)fyXLyi?m7
zn<Sw5NScGrqC{DL>woHTkf5-{;XQY4y$SBY__y8V^1ENgL3aiQD#h&AWIjOtd2*Kz
zBR4H}chGF@warbIe9r%Bo?tgPuwfz{yjG2^lRQh3Kbot#4O$Koduq+uuo$r~_~k!E
zR@;j~Xq+WLnSk!3{-btn+uf0^zDE}{eScP~?76r9sbuFxkblIpsvl=_DeZsqBA`Rj
z+S+s3-E-P_ZD6z%{T-PLOZ~YH+^|Hsiir-w5%7{j`GRsks3&!*3HcWuIhqXZad^Id
z_m!@thsUn#xBgFa)%255MAu&Om}g}QZ9jbe9Vt&Q*N=^DOCis}dyCHhYn<TZ+IxGa
z4Tn4i48ojC5ABtFuT;FfaIsrM*R8v&xXLyevBZ61!%e;Um|xVK*wcAct`9%nz*Ys0
zoJgaI@3Rl`R|sL9%13U(^P-a2t_jk+vn1#&e4C2x;h$5*mK@ffF5$Hi`3)rVVro5W
z@;SNri))fO-@=%;l*J58^q)hL_x{UEy#p7;U#z#Stf$2jj3A&`n<(%VwD~cm_!Gxz
zl=OL1M_CD@3@p83IZzU}72&W-ZDZ?n*gtAEEZ$Rr5T04>{9C>?t8WmYM2LC{gV)%p
z1*Ky)jQEb2$QSH&-7^;-;;^#FS<<7O=x;Dy8shAd^;HB?X(X))_G@TWWEDQ<yOLz#
zFtDEsOP4un<q5+4H2eE&-l`D!k*~0tNCx1tp7jWJWPgOWwLSeUAFq9=husNHwP#7{
z$UEm=E5j{0T@=m@J%6JOk`d@ktT3%_Q5XtV4}V3SzoU_UbDD`HF}pp?oR_<5j)e0^
zjlQOcJw?ps=nh1>lzO2B`2|RW#T?g*_Xi1+FhKpP465lDe5YNx+~Su`dAHx2jKULG
zXCKhKRDBUIpww9wygrbTANKhT1_RzkveN@`pS_o~P!e&jB0!NTn8I2!rNnB*yz^8%
zn8GkLIBJ%5rzOYEN%x0Stb7frQV1gn!BAA4hoWewyG4Ahtd2i6>^TTrNSki?BKkm?
z982J0z1lDFdt(P`($uc|r0#Y?%_^1)@_pqHMbZ|-eNsM)g;9fI`lcFMLdHTaLSqAF
zoyBcgbdG|P%t0i|qV5aPKF-lK<#O~W!9Jzz`7)SPliN7CK2XsxieNIwgB&wVo;GnB
zf&Ohdp7C(LV6ZsRRar-ze7@9nwMsZP7Y`rCt8E6{{p(cjII2n0as51aOKk(T_<=r+
zjl(i9YK*PMJghBw&qlri#6vYv2xapJ*nm9}GV|y5meCS-toU#FXd6PP5o<c4y<`rh
z$KrkodJiG~++cNqp%B_LDdh~0-IC2=aZpD$_<&(sq;!!#-48nr>v0wh3lyf}BJ&Aa
zcep4b5f4&y1$J&m^fa5g*L>8cAkgBBRI;6OQW7s75~&N@vzz^HdQ%|eou@ScB~J`Z
zLD9=)K0~o!_s6oevrD+$yTkL_aN$R=oMn5w<AW%5;(C(~G5K1RbcB42IST_0T2Uqa
zLy(6bWtum%KGGnBE^c^a=Yp_~wPigGe3A4O!^Q;4YSbB<^Ex_2`-Eg9DJ?0I`Nx|e
zwwePFCki5tfxo*NU|ULS@Wh(K5$1$j`cQEQcs%E(To|-_DhPGtbY&mmJr@rA2mJ}<
zeq=1HLyzoJzqt%BJ7^dwC(<;ZVuwzb%tFS~`0oPLL-?omO59$SND5d`C=M2P9TW^X
z*$q*Pt0`nuVv%!0L-dC|^Md?i5sA=DTP<Y{fvXd^9{2C4mx)8kLSYD4DmTMPRCd^v
zhctuoX~Z(`B2wazW~jD`#FyFgau|XB%|b2(lbrG>f5P9qc7KVd7HN9LdYtVp4DE53
z?1RwhhLf3O;H>LjyosO;q}N6G3NBcS?4#Kz{#a8GRbb~HTn?3oiL4Ay9R$=EE#~p=
zTO!t!FPyd&pqi*M$~wmWCL2uYw?=3M6LAjIw^5Q8klM?)4tYW;_a#s&8|>L=l(J>q
z1P1a9fq&o^;m~x6T{cslja1Ri8!=)A!29SbYldb<dQ|V62Hc;`*DF=R5W*G!qscvd
z5_V86zIcpn$ICX`?Lc)$?5aW$pX*3OsFFRPB_hHwGzV3x*<rKfSl9I?&X3VC>->rJ
zT`xO{ylTUf#4x5g4NJj6U#AZdlbR!S0&caAD=K_eb>m0-up~C+Zr(kA_`gHr(kwXE
zxXD6=)scolAQNqi!JR{Q>MD^$eCkx!1q2PqhAjD646C9<WUl7e3h&#m{|qbFi+G_$
ztAz%U-V*VE><hxsG~1rf=kr7RDA_&;ZYH4fD=Za;8Fx*~f!o@avVVa@{?23Onp+-9
zN0c;XMSELGen8ma@XIP~AM4f0rihK;yK;Xi199k2;Fe<xSJd^3$S>O36TeRf6?^u5
zC}cfJ2@Y6%qU6vcjj|RYXi1(iqXk*=7Dy#Rw(mg&H}OB!-aet}9CIKTG4?l-wTN(o
ze`jD*+KMBmDu8{l74iQRZec|%kHfRuKVEcPFJ&zS)d?xY&=}Sd+!gqR$vs0)v<_u?
z#h^MXaSd)4uL4V<Ep;k;9*Vf5u|5TYN*2gvaFf=bOB%$7dTBe~M4V`ssTROk`YaXw
zB*H{3>7(K3JbB$0;vCmzLO3a${Dah?JopJ&s6txxn!UHO?$7syB0HM+AK*O^1LV|b
ze+r1ug|j*YG<tgiAe7omudwRCygAvF)9I187;+86?PV{{ZzH$pC%KSDGJ#%@6+2>Y
z7I3q}10nYK4oZ#pFyg9)_W_Rq86jtgyG6t3%A-oZhA_yJ7FCNmE_0=&Xaz5bqzCP;
z#%eQHeQ5qTtn{VDF_(Ap-4;9%6-ATuv=}OazteQ2#l0YOB$`H&kWL=IVQGI^*9yMD
z+2scW#yXVlN{|j3cgAa}5UHlRNt`g?fzyWuJSH0xH{L)}2V}_Cfe^knv*0sIU9*W|
zH<22k4ccLxfn_*FTw~iw)XG@2@y`cB>3yM#5RX`WaQG!IK@rL>wg~$D57BhQkE3oT
zT!{#bYbwGPC2FocTrJ8<`a11_`A|#+Vs?m@KVWl#+T293Ka*kJ^lLRpGFcp06(VS)
zhMQF9K~WG^YaqZdE)Rh{qk+7vihvX9l%OXhEt#K7?^hG>!3VQM)*I&xf4$7jtbfNl
zD^D>~8bwAaB(8=Z$-r&zzt2g(rgE#&;8BVjsR!sm5Ct1Z=0)x`EsDOh0j}t*Ls1++
ziDt)EiQ6F@G{_D^9i(Y3&%6$cE_Q&i5kID-Y<X|LscDjylzsQVhJIw(CW4J^$}H~y
z(Qt?M_lBxgrmM4w+mFb84+Oj4CW3LqvNdl-LHhou5>k4WJ0}f&fV)eANDr*O8xNOI
zVlG*j*nEyS43uXP6zh`zTXOM&<+Q_R*4oq7Ptz2<H)!|QDC6?OIhCqLF@H9mXxom}
zN#4=6zI6(H+a=B{nA-Bm6wh@m+mze1&h3JSGPo^f#!p9_O^NMbGG|gfWH?mPG`!}b
zvlBWvTAj|8)5aHnFu(3{5#ty-2f@X$8M#Kuxg{$naWNI!fkMHUKjfX?cHyN*^ma43
z$D-mLw7VmI+H|DS1N7Eaw3^jYf-O~irmY{6uy0<BDi)r<$YAnrc%BdkPAL3vbi~YF
zmll+^h2JV#v@+&cc??gET^Pba5x;``s^Ax4&<Q1cTd}SZpi0iIG83DgYr4dJmhbPN
zf|r`VPi8kiq=C<M*(X(nLJP@0pO{|P34`qhhm9yk81v%RS>L5#>fK99!Sr(lY}K#N
z&9r|J3c)fykh@MAvYDs}hQ$G=%NnAS&Con!&(N>Td7Qx5U*tosR(hgUZlZD+zgzcX
zBu&$VcqR6XzVtUJnI04mIktpz$gxXC*{SO9hoM@ydfP@OF|?6VBPHoMqBs<W?^05E
z71QxK@=OW-5hl?A+SaHzY9ty6uDuSxhL1sMhI*232t_xtlW_dmQ<GGd9TviZ){2Cb
zeb7==4$~bNB0SESM}P6x(9x|!Nvd52bOmR4#|lW;d*rg;_mA$gY{t+$r!Z_t^m@K4
zIVo|wi`LNfD@#a`2QjvZM`vBH#9l!dn+I%Kj+)MX@iOA4he5T|l?VvQyq|nwB5n*z
z$?hd?nzF?lN1vx?JQnS+W86+h;5P<S#+4847sa!D>K;tOKyX7QW>Sogov^H7Hq$j#
zp7k0q7XDa~mFEPMfp+w80@@-jL9l++gU`@%cJEb{%#a!cA<%5^zA6*w==jB3Y<ns0
z<tJ>06z=>viMFnw(M-4w3Lp)FhgH+=Pi5RJ01FBH5=^d3KvwqOT)tQ+s?aUb&=L_9
zepJ^%EK*KxU5fq5jo~7T)oW$=tUG}e%{?E#IjHy;55`mOcvzeun@39?2{@#0!#+n>
z?vl6o-^c8S<#g<Rf9|13I{W6O7o5c=mOebb5@dg%8_1*19w9105x$479}*U92@T^4
zeQ+A|p)wf_F8wsXxNT0nZ+?qXVe|c1TD$suKUvz+FT>VXEa!+L!*(sk6`It-I7Rp7
z1j`sK{J8X}-<*1JpDsQ9otK|;QQh#hbtj=BgY@-i=x)+8=c&2We48Y~8?kptDUdYy
z+=LRv$ihfemZ5O0=IZ@h32ss+4mDh<RCey}@|CcZ10p3T5r52%-Ri~9aDlzMz@AN8
zhLE6lNVG384&?8bdfdk^zAKh+NK7}+h#}DDojX4(GlK<A?N1vLsy<^fe<2>AkfGt@
zg%(CnL0-suyQw@}@<qHan@7JJznmvCavFh@Yi|MGKq|^18TS}JyXuXz?%$HU3IPSu
z6)JWG*+{e8?FTu>)$8<$u~3l?3n_*GIojJO2Swq)iv%|~WTzi}_s+8qmy;t$lOy~!
z&L;df-(8eeo&eV3J7YMo$uG1KLtl26QE-E(m@+yF)8*1OH>4Z!y+&$(|4ttLiJ;3%
z_W9J_YwI7J94GeEz20gv6a^|jsJX*IT=mNLp!YcmhW|PVhx=IhH=>M$<94gr!VGoX
zR?|E`^~>2~7#El>%Bfeo$<m$rMckEJVS)eJhl<s@(fK{*p6sXeDoWN454HUTx^Y*}
zrf@d9wBWnF-x6U#cFN~#c6Kb$DIEd&o-Al&Z>cn7%Y&@Y=e>Tm2YO7s2QX-sZa)pa
z`3*}%u_jMbM9RP%4ZOC-Tf$&=)fQF4s;JBkPtaIJ`FNXCd#Gl|_^vB@b-jlr24lpM
zX2-;?Eqe6@k=YGf#FJ*n)NUoPDEMsBH|9bL8AfR3ORD<MEUn{s@&s}mxdak=<1c{d
za-ktir+vyfgA@QLI2P5gfgn7FNjE_F8y3rOjUYU($#ISi(~1c!@;-y$H)tl6*dBja
zjQyX2!LUpgv4#P#xck$B-w>F7#C{EgCEN!H$wI^y7YGKuJU~w}z1q*sUVyWW*BAzS
zIwyAa2cs0V9Jl+#sILrW;hFtOW2w^YD}rN7tjXqpC8eoi*jROb$5%S1Oo*|zuiXiT
zV^>doZ?<HFtu+jV6Sl!L3L#|sFZibK!En6m)mW{Zqb9J7Gl(c~j6b3Rgk@OzMbb6%
zCTM09knyDQa!IiNLxd$=&c+(MQz8k8UswkZ<1JD`mzbO@neFJpIH1=l$`B=LaU?t9
z6kTPVpl?Zs)h*@q{LjJnNHMEtvpT@?F=Ubr+N8X0k!AE4^!=ZyE=Hsoyn39Vew8<n
z)A#IxpOI?(BUp}MlWfrbSI|bUM&JMauV9UrAT<2fo~TzLZp1**)xDv7v)s&kf5PUr
zG~|$+q^7(WbITa>rJQ5KbIX{MLP2=r{n*A?InN#}&YZY_B`NL`aGU*UF?eI@ivo=P
zxBy(voXUm-Jp=Ixc~BqxYam-A?p>u<)c4iC(0pVlp(0%imt>{Kp>X5AP9PrdA2#!z
ztMd8##FQD#ML}}wh1QU4NagRPjz8loUIWfD&3$CtJXH<WEB>->%O)X1Np7<+Y%7Kd
zc=+n8lJvk7SvL<IOY%;Ggmit&H>JIQ*p2>S_%L9Tl1CW1NW?<AlHAS~{QHk%G4Wp1
zfVm_h;lpNf?F%#Sn?|YpPYaDTjd*#b`Lawhy9yF2trPk-q^9Cy$Tf?nb{M%}s~YBN
zw;8#3#6o)hR*s+FXI!zs%lo_AF%8{j@Q|I^hy9;gnYnDl{?on$oQVDFmRURLhI?P9
zWf}OGzv{6e+nkBTrBe444>;1%<}MyFbS`{<w2OP>7XD43V?o|I9yvnDc;J05k6Uah
zXzElVQ`mZRh`}K@=RduVn6^&S3RL_*>HqW%Lxn74bU(J`pG5fAj=vi5%y#D)y64O=
z3z<lAdwl{gUYW>U$#nvDlqtk4Wb_;;{c&C+!L4Ez(huy*S?U0R)|;Z~-$&km9-Fd}
z@lR>`ZpUNrj(?kcZyM5dj@bOSivKMUjhz@Rq%p}Yq{$SW3f_8P#~N6Hf8%bA8gAEL
z^=eSVTa*5B^e>K@bgR=paayRE{_x<kiZDIyfA^mw$n>GyJ27%ckxR>D;kKm1v7Oy7
z7?Dg!D5{$w!^?1SnC+1ashd&8wo_3~dnK)O!FO4)NU)P@<2*Sm&<3(qa&25Erv=tP
zmQJpX<7Br$8puw{adDrV7dQi1Il0x`I6Ume$YR-5!zjGP<-f$E2b;U1w(nm;uVEa*
z>h>?$1Ghe}8HE3rbQnb8E)E<1OVBIg`mj0wB{Tl4P8!4o1BuE7Ck`2e7Y^bum%}^J
zxc?H19z4$VFk8%cNPXqCUhG@=poW}ST<DS9e+fEjyf7i>zhu^5X!dPLeeEW0n9|We
zCmdg+XjU)*mu2KHvGgP3v{1tAJK<Wa5AFb^0*12YaAk0%a0TcxoB~b}PrsaAw|39v
z&dCPa;k!8KOdoe2*Bs{@$F_W#*_oF0wR?1~(N;JTIAS;g93eJ;nXInyiECFYs*7Ke
zxhkSzH*PKUCaqRq_&T~X(wR<e*+<A7K(cAF9OvQ+bEl$G+%E}-#fDWEk1;^jCl@S3
zrZEyhlt4(1QWP0XZ3Cm~KN2WS=AK|l=B(&FO2KN9HljlPU2(!BEuoZ5xnf^bHKA0l
zC`G0z9z#{8h$Gd8X+%m-g)Q~mBz{B$C^%vgpTLM~g5xcY1z*=E$oBujlHj~Yj0Ojs
zJH*05jEHS11_$i_|H;mXedfjQ061|)`UD$h+!J>IT>l@lQf|o<zu`cm>zHC>2OBV%
zmaiQYXJV1?n3iLEf+57Qn3f3x;IJYQFZ1Cp?$;E0;Yn>Mc4p6;$}@d%jFt(5;TUZ=
z91{tH@r;&%pR-ZKvHq`#996_4!RX=xt|aeQxk33GfKmItnEZ-y;{--pwsv5=5JezO
z*Ii~13C@Tx>O<s)jWdLFlk|DZ^1;a(-U)-1H@S<*hZWuj3J}&k4=4uXIJFS=!C`6P
znzj&z;EWpEScGF+;JTuDo+}kmoLndJp<%`U=jZSt36lut=pl)dGxAD?NHBpoklM)+
z2_s;c;hG*3hTt>ZW17&RVz~_)4&@j-M<WHJL7)kT_w+#qgb9cF^~V|p683-HUrp81
zKA<#Tv-#cE0GE1EV&i4mF5Qe&>$--nw-&Ta)?ca4mbzwR6OmM@YFAhHw5Z3HUTTx)
z<d6Z%>a_;2n4UAP!g5WMJ!;Ty1Rh*XWQy6K$~DAt8}F2a9o43R#6l{z#_iz#-9z+}
zbNmo0SDo&7cdfuI9?G+Brtjd2=DwC4QZCubv%UQ*{I_CD$5s~ao=-z+3)rn)>t+fP
z2ApC{zZ9-v%ERwIsdeV6%jYme^EStPk5|gMD5M~~uZni4MQcuC9r0e_nf6b?)#yg-
zUCg57h4xA>SHV$YPtnIaGMSgi9jr<sEs4up$CKU)4|XmN9mO<`JQ&5+H(f73I2EQ8
z)gks7PrparyNHeU?X-669{-r)^^`w5(FEwt1LL8ynoIkg9nFNQ<Ge~4_nzAF5|AKd
z=dyIRua$5|K}?=m8(wgAi1BY4?|Py+3B6=JF0y|eDHUd!e)JNQi3egKyQ=0pp&(zO
zra1O<{OiR<Y94|UCbjhgb?08U0$lXB{KKrU-nMXOi*fL&w@tRk&_Dz}(7SeM4LqSa
z8HBONxlHXoT*p_4_j@W(E;N3M*?)QQa6S;dGlb<kgQ583|EaG>^_va%>*tYQrzGa%
z{o;52FS=05(O(jX-Y~5{_!@ra-3xImtrp{`iwub5P}xC3Mnl%wgS}QAZ)g-VfXeDP
ze+UH1_+6xZL|Y7P`F_u$(--}*T=bS)^wgTwaI_Kr)~RP7)_AwjT)9O#T<6>g&XZ;M
z4dMAb%du-<jQPWII2siZh4&gK4lf|DI`9hgu09Lqcj~1s0W767ND@-uw{N}nBG>h0
z?#7sc>8?E0SYF$#>g?&JA?AHI)EcSPw`kC2lZ^utPkrJWR#r=5+uCjlVN1<loOYJ%
zAyJh7Y`$QV9hT=>RYVg+Zt5W(HW##*^^jcEO455+JJ~-KK-R?y?#8#i+VC;r*~Emy
zHh)du|LM@ToIoCU9)V5pTImM@pXSqVNOLOC+zJEPy!E;F*vzQGJgDfZym@3hrn@nJ
z|D87$s+-TgHZC57w$<`s=t`!w`zt=>*L;#o>-S1+<q_3IW1RM3j-jXarXqcHtDGJd
zTu{C+5wS;-K;uY4BCYZZ*|@0#9IoAhQ}OP>&8sP6{$n}4`zKp)+NG>XgX;y}HED9T
zUph2Pfy-41h#+o1F7Azsi`wki>SN4jx(uP{pQtK5RtKTW-pLM{ZPVP2*eKO$i7=zD
zbP>+)-kB}E^glY>0~zuGc&9kc4d9A6I5Gvk@oNEY)omsVkC(~&Xqijg{wgViEdIsG
zA{}BWw<OOt4yMubNojG9+MDqSb?(2(;sXs<mTn_*5(PzP4F#;Cd5i70dT*x)ujv`C
zq5SebVAlK5g=qAa5F!!~ae`}zchy>!0y~`T17y3D=i8~Ub{SsJybSJKGry(l?BOZG
zzeXvIxJ$YP&8D^nzp>3{xOC#Moap_AV)(O$Gkx<!s69k=4zB<k_;#&%AOs;74vX`P
z-7lXl(02fa9yIk#_i1U%FRHq{BPR|!o{PvrP8KpS>Ps>lmRzjQx$Q7ViRUM0>!#PA
z!4t6Of=!3Fg9oO8Xu2OK5yraU@kVcVi#g#k^zkRhw$756nRh5lIE*JEX>+gS@zoS8
zB@9may&buE91On1qff|A?OnA$)|x(YPQ}ls4s|y=3S)EMIKf_a#suwtAV`egFJbpa
zmM=zg%y01nzZLkN0zQt%WcTxg>n`1+0aYN3eQXzwWp_&Z+~01{GM#bb`nXA{RuGIS
z-0dR!H|?<o6Uz8)QTMX1sSZ=(j-~CU({L#^Jw>BnT96+=qQ{<e_bWXQJw!=*3gfZZ
zgio@R>LNPmn#YFS6zAA^E+psNZB~}1=<2*C32S_sg(C-}4?elFL@|hG@%UT&E=dBH
zMQd108VAFCp^ffDMW4>@ssfLO5-~vKyMCZYSw4rR!f!1eT-vWcA+<YmwqDWj>-*L#
zObwjP1XxKv<;>Jx_*wX5`d-}Q-+A6eb=8&UXTKZA{GQOh?y{4VBjEdO$A7IgY>f>g
zc2<w0Z<FS0?)%<6mHmNGw5LP@ZE9!Y?BZl<X#1D5H?o4}U;!`y{xUo~^kSAaE~ZWZ
zdNCVA7gG^aV|x=*XnGk_J98Hc04FOeA0Oa9c|9^ZHP+;C7!kdJ_#J1`46K+T3@AcD
zkP-xyJdslf1%XO1G|D&M#&o!|Al?aVLV@tQtYv0r9_Jq&i;|ZguvknGO&&5?wuc!B
ztzGu`I75?VC;XBFb$277&BzNjc4-9q<HC2#E_<Bj7w9(GZVB)@;Wo<iZoF(4pHI&9
z?{%%#=toAEA8Zlz`tDQdIL;m|EgC+$SWM#L<mIMwRp=~fY*`bs&TBes$#?li>HY|b
z#u%!v1#)==;$$ONLiLnN%R$ZFm_jmS#Rek7fy)ra!jLof*;Sc;tP0X6e4JiXvtf!k
z_Ivj$OfVu9oGzHE8R%{{<ak0k$(ySBmXwZK{@56MGINl)de+*YZ+-CS@Y-foXX|Yr
z;eRB!)^jNLZGN*oBTjv=?OV$;Oo*I|t<&6M4-s*4GFkkcZo>PzKaaz7mVFpIoc-`k
zZM4jefreYSfs#vp$26k==jm78%O9qST77bpxZ{v5>n~ZXPcVi3j4wQxa-PE5DN1xk
zvU7ybkw28p5zpqSLwW(jU(9oIKpq6c#yErC1q2bG-GtP;L3=@oBYyNH8OT7w^Hv4)
zRlgX<(UiTgg|Xus2tH3vKT<v8c5WSM%Qd6)Td6#Lcc2>*=@<yihm#WgW^A8gf%TI}
zs`IVYI8{z}uEsY%D=}vdzd%Cd6?KJ)J9pM=<xl+Ghn9eLG&G(a#QpZmjeukl`P{FP
zIZNs|xgjp0nsKgQ%m&(v=qyB~c%aQBg{0+4!HMQB)OLIvph^;?V^c)cNL8diusxW<
z)Mn4OE|BU>AA~Iw(L)6RSgMz-Rb!l)yi(Zg4!mP~RRSHmnAgyg4E~)S;w{3mjEaH~
zLy*)h$k5QgP|+bvvc7Zgx$p`niyrDFC$&bFAmTeQFqjC?!s{;8!@#1CLWq>{Y*-|{
zhbaFH_8b8dJ*v}U_QtIt2qe(*>2ENd&Ca<zEu>iInntRDoaXc|!_+T(q<myo$9HL1
z$nO6@1!!yIF2LR!!k4+;&@if5Rn6E|6}bP{PJ(E-12GAnY|Tn~S(@>A_QS;80V5U)
ziu~?LeYqg!G*h^9$&@z`msSZ6ovXOfHMtN=G(XxQeen<lwe&4tO3%OW^nj`3Wns)z
zhK*hk3TX&S_Xd7bC^e?+N5M>ZZ&>SjJ{lxOxs3`JD8U=~9n$$Zl}paB90ZZm;E|#0
z)MUaCv)lvUfQhl1N|^Iy<TZGYd54V1Om82A9`??n;QLpPbXRq*i?O4}i!1(lD>SG7
z2MfUV-&p`gCKk5;-2_~ut=X-!AqHPPpmx~61di=oGl0^-dLX#LuzZcDnLeA3ib9WG
zYk{90qIb~<o3)~GthYPsZPnlyv)~|qCkTmd8eSkUO;oIQxm9<{!Ag<T^`_#(5K#0o
z?NQ4fv@*d##jfKD%(>)8=l3qY44(qGs_9}<|5V}s6Fv=A9q>@dDN87l<kQuz5~9Dk
zg&HBP!tRS6aaE~Bhf%%6Z<DBK4g@H-0ZfH+a{ObUr68(cY|BCtre-gDlAqWI9v|8?
zI-cJz-}~N^%R?5~Sen$^jT{9>u^Zdza^&DkoQ5niSG}oz4Fa-DH|)VVE@D&jRK+fQ
z6s3*V+w{I(5HY_lSH`x~m8n-Wna&EgZ_74rvwD~jEz$nzq@_~-(Y)K_Pa6<LdzH#b
zmJVk5#5G)k$H2T|>3guPtzD}FNZa{^+P<a&BN)=-Z$UL*)NK(t-tTOrFAc><6k}A&
z1I;*!AF<XBQ%l-Ec$e;$emfzKP9-@w73#Z?xXfV;`^>0q0^1$gKb+q3f;6kZR!Cr<
z9O}##XT2WeKOSc$;-p7w<KEcv_UF!)nwl*Mt-4#)TieQ-iXOe;tG-kL9HRj-vx0gw
zi$~w4yFFlDkkdBL-7%%<qKYAD$3401Lr{%ZX2W=dHxiq+r<=EZwHX1NWwXtYRYAOt
zO$+yt$PyyjM!s1q&f>>$=iRLFtB-&!)G{c7Goy@R!tBN6nct3?DmttsSx9X*cTcBk
zq7r~-+C@(@Tge5!fx{|%G4<q%^tJr(>`PqehJro3*WC!a#j44E7)lUsdK4(JSaK)=
zo33r=UF>1nAiG6_xleSz6?E01eFw5pf>Z4VHU7`WnU%e>Y+be<(#XoLp9?eG+Xltf
z^V_Yz5X}R>-Lq5yHc24QRYyX=K*d&hR`Pi?<kPKCeIhCNvMEHo@~#t5NcT|+U9U8e
zgXF~$J-`%K*E<nSrS?QjS53rt<V`$vNf}L*XdxyJ(~Rv{*tB|2D#Gc)ifFI`io9Vs
zz^)Bn7{f#-M7VDKrE;aOk&P3%Xn)JBJe=8Xob|GB!TRv<$Y@NTY10QTLBs`C>EY^K
zqdyynaR)WW#75MOh)z!m9m&hlO_He}ZPt?{bLchgoiA;brGA$QC<&qT{<`|nzvhMr
zF?gA+O}sqi+7JYX)PL-;Y>kCXd!U71CNh$gF*@+m*wXr@C5x92&rqs24>70})84<B
zV7gvE+d0>AF-(|oAVuSZ^G*ff$Hai;eCVJ+;LWzut?Le4*0HM%bj$a~%UY#8YDoJ>
zVp#Cu5Q;%w5p^N?4EQ{QJId9Ur_a3OlPc`5&XlV~_d$8$^50SF8azISLfQ|U9DN?H
z5Be@H_w*4?)6evOtD2ja(JbWhRh%tSS>raE7g%t&#;GWa)Id5bW{J#7MUHj>(3&Ul
zeFtV}2^zlJ-d;Jfy}B%do^~i}T!QhQaftIktkiF(6r5nPO}-|{#6<O6u27iX1=`#{
z+t|E&{jyolfcGQ(bZU^^gaI!ORD~7TmA50Sqdy@bwfq1LoePcJgh|$5{uXbiff)>t
zWoR9Ft!5PK$VWR`J%^d`z1Cs!{L*fVV9>X{^bxn0ybQza3z{}rZ>h*21-II6nuKkQ
z?Qb8^tSaFP$_wp7`+v8RO#i2mRQc{;3ZPdoGzYGZluVuNU7d_godLl0lY*1Iv9hTP
zK$~7cL<~T$V(Q@npqI1-3JU$_F8rUnq%JhQsE3QVvI}sf^*5_HGk_UbgAyMfG`*O;
zoy*@eF&4nz#hDT?g%!a1AC3+1*IfTiV+XMRhvNWn{2$c430zF?_Xl3mBFfgTWm=F#
z%}l$fqzx_7q6MWrZQ2(q6;YIgY^6m)JKD4_T7*)hR4S2#7OmR+@7#N*xij^d;q(3d
zzu*7gYhGrixpVG0=Q-y*=Q;25JOjUyMakk`?E?NWifLL|+L`Zm_C}eA1Amm1mDnyT
zDJv_5l951fmqp9U$^c9#1NX9Wa(6?aan}H354yX0Sh(w$yMlieXB5*jKjwxKJIDwK
zjQbl(2D~dkA5I|AXyA)*0{Q=@W*EiP&=?f(0NGSSOQ3)UC@Vr^1U;d#DB$rgbpb1z
zSQqF&&;?>D{a@$;rz05@@c3uF5Nri4jRGE^HdWEGDB$t$w1rvHaxj#&h50X94h3r=
zcojlF|A7TzU^6AQAnYIL1ZT7VLvQ*63tB4fU?fn$1F|KIBno)^OIw128?oLb{y=Xy
zOaA}1-j=d4I9>x03?qXA9<T;wQJ8=0jo2l<QIfI-vHwMHTq=$OmWRclfCs1pH7qb8
zE}jty@txqO1Ree-F&_(?FR|rG{ej+aw*LP=%fm{cfCpr6SZNgS_;((Qg^iY2Z_<CD
zH=Kq47xYGyQ4#ECQ55?ZIg`Yaz9zGT?D!cO&Y2|s_rA7to*;oi0T0M3B(Nyp@$alc
zVo7h3{R7SXm%Qm8tU^Kx1w8(x%y2SA><Q?lQfN|hz`g(9xdI$Y|BVBHvlQu~0lieF
zOd_%*&UO9^BLCB>;Scg0!n`7hMgb4VD<m-};PLM)L=tqTMe15ARVGyz&Y%8E>cXeW
zBoneE5If<tZpj4~VM6{-reVn?6F~G*nKP-1{!1C)KSYjy??jTIAd9SGsic=w<p0tX
zigT8~vWox20;HClRMAUiuq5h``Y+C^f29sW)<IYUET{-@rvGHtky>)4iC!vkg_jig
z!j07b^->e(8GluCl7h2@MI|OuPXD(_0b$Voy^~8V9oLr1lSzgDFU2*alM}_b1xx)G
z34+wpv2CdonN)1t`~NS_c>jqyq?e9uOXbBR>X7~)#5N);AjB|2Ui2TSV#&CLSt?s5
zRmJ~x-1>)7JkBBhp-{2(;)$RlLM|jNfdU>->L@LV0v`V^b(CH*eqff$v`N+VUyL9B
zpsv5E>nvKA1M}nmk;N?;i!e)N-=r$Uz5g%7qJMBWf;GX4_!og#X35BdSt75N1+N5H
z!8Zu~4<gSWEj|8|=p(aq^jRY3UZjryV)Vf$nM>Klzp;TOi!zucGV4V`|8Enp{}TsT
zI)E;bCod9y$pGqx!%jVLcqpUTK08Y{lnH23C=d?SMWMmlp+JaB7li>A{wNHNk}e9Y
zv;$AzTmWFOFt92MmKYF@hl^K>qR!&`V!>#I0&9x8C<%}%N&*aaD6q_;i;@IK9wiCg
zUlRNRnHw(|?iSw|TyN>3z;y)h1l?E)x`!0R6qvT?qNE}DrNPhs`Np8;|5;+dJ0VR=
zL&Rl3g`s31;xZJ}399#>iDMSV5dyeTGLQykpnE|^ahNbVvbft3k%Q`fDh^hTz*-(9
zrseDe{RJ3clq~FeIyNXc^6W!l5X5jFlOv`MO!NR1P*UI(f(n4`gRJNxdBf?M964g%
zV9!8O#UglHWDR5mg(q1gF`#i2KbgobvS|`x%3#kaAnFoKnMj~y!O=j7iWbLBSO1Z$
zKvUZSd$_xjBc_8KhJ7d#S;*Q!u>hwBnL&;OS{ygr<R}si1zH?5Y2p!<Ch!M+PL3Q2
zgV6nPT_yN#4RK0#yZ@L2PDr%)5+*ByB=lECh8AC9KxL8SD5-wGozrn5#`Xa`g6c<7
zq2x&WH6R+WCjmo<1~q~kJdi^o+oELp3%Xju>e1o|z7{vhkk~!38Q`07kY0pFBk57H
zdV;oK)&OlmQxk%UI3;gfN?TAoL_;hhwFTs3<V_u~Eqo6Tk#vY?h(=SgQ4(z}VX0_D
z1Ve+3Lgc(=L0fp%aM}Xr6NI+F&&X0)Y+ImC0Na9Em58)O$$b{IwS?oKC6IhkvQiRl
zEoG~S5RC@ghser__e3bk0cK@DK+r6ZTv7DrCA0-aQ-}kiFuJ%^h{S*J+QK&@5!n_Z
z!lS`djGT1D+QK*T5Ya<MWbguV^cHLj&l;dDC?7;<3;c{MmBreEb4xVDBGR_N_8YR)
z;24kZ*&&h+8RWr?l^i7!Z7pT1$S9AYXcc(d!n20c7HO0RKO@K05^)P^Ndkz0ED~vp
zlK(8&))JnBK}Pw-Ei@!nN~|q>s}5587-W<OFCZ)Dg0=`z9$H->ZR=k|d8qve=%56P
z0Z46uO*v$Ff^7@m$wMR^GRlMNA99pPw6#Q(#~`CT*ug`N-hwCMSp#efT7)6A1%5`B
z%3@E18kGQIAd5uW`qL<n@5Ld~7Bb3%t2}aik!WivTSZ2Buy2PPJ%YAir^acEG|Gc)
zlclnRw%{labq*o5wYV*Y#DDOfh;O_h(iSqxgN-ZX_#)O8zUPIA9x}><7m%a3pe;OW
zfVS}6GYh#l_!(I$i?szW>(LO4MB1X1B`s)cDbGPhc?n8ZN}{bLqC5r}<-ryjvU1|%
z7QRmir!CSb4}M0L$`aZFlQw|Zq9`x%r%@iNoDeU;u*fJ6wt|r3i&$Gw35J9oGRiM*
zg(0>21#J<cJk*bZh+81r<hWX5P6TxVWTy~|NZSHCRmf6<qde3LLn0kA%7Z;4<S3D7
zYYAJ$BBMN5$|6T^!4vVU0k*Z!xPo5=gP)P5ve>qu?j3;Gq9_m6)yPuAYikM5!6KtP
zSehe8i9}mVM0qSS%7eWn<meH!MTqiHeGp+=U{elRDobb!j`C1<3(~e0w`q{tJFG2y
zCkQesW06sQaR&nlC1P#iTP29-A)`Ea0a-cmo``1+uq~+kiO?4K8CfcewFQ?_(GZJB
zZHZG{RpSa8_{tzy&j9TcsAqu20W8h%g=uhvfeaYT>40bWI;ia&nB3v(pi~5iq40H3
zj0WDr^dP?i`~ap0=>n+gDxpk(T}#?1vHf;#?!d-z;D0R-$75Emc1|`ZF<?Krouj$K
zu3bp!z@jlZU6G97Qqci9lYt#2<mjmba34WkNJ}t517itJA4ClP-PDM0^FR{DBBw^M
zE>4a?5`mX+a0%pO1U6WZqX&3|vy%-@Xf&QVoY9gda$siyIXWbKEfL5hkdqpCFLLxq
z3Y8{k7&t&fEhE6zq(w`Q#XS%t?yhQQ<KYTy%2RT1M+pOa-)vmX9k-B-H&g_})hv)|
z1OW<i>=KJF4Hxl&VJ6T+iVt2ujvk5lXb2%eL=mu4fE)!9jtHKCsLCMe;VvLYZ;@vZ
z=l~c48tPm?x(0~mkfTV#A;Dw_l#!VN*y2Er-XfimW{lD}Zy`tFj|>Fna~}$sc7XUf
zInpG;g8l`V9$+8~^pF!h2w{<<M=C4?;3EbUgs{m`Am#`H%Rr8x!Vy@uL(*G>^OJbj
zA_F1N!5IhysUr;pd9(<$8<K<~35N)D3x+|6Kr%E4^pTTzk<LJ;K*~sI$@C`%LJ*tC
zKq%QBiLjvUk_-nja|2OGa>C+~GPDfAu?VaISQ#2ZFo{Nl(jth2$)zYG6EN`B<d`HG
z5fd~FuA(7W70KITe3q=WK!7Zyzy&Y|8G;vs$t3g^+w%e)oIOKuJQ0VKQZZuf$r2_B
zsNRe7IAp*BFZc`Xp`k1fVb36}Opd}I+4F+fNP7kWSaPIEgatDvlHouGJc@WZiK(C=
z1Q;po-+34W%|aZ(&ITktNP3h~yTt~wKnFAsFgHUO2<GpwXkZ6EFkR`AaELGv%-?~>
z7$kVSz$s!(p$o{3Dc~XaWD(CCV6q?^x&+N(D6UCJY-1@oiEM*XSR%0v6G+oQUkxNO
z@C@28(O6K*cmBvV7SxCc%@`0UCZ|Rs@i7p-Oft-fD2ky7!;;X0nZm6x7WhLff-oQ|
zPL4nP)Uh;cCenaD7uz<aF(P3S5f2uaL@b1$Ta#mQ@tA|N5x^Tr4|oR63OVL~hq7Z3
zC_4n2kfcP=1>|^K6d?$7fCzzs)&@iz{?!zM!NbwOP!lL4BgEe!<roNt22GJb4;djS
zBISe#vA`S<AxN=u44Cwi(;Tt2EGZ`<LSQIj(j@c<E<%tK>B8W_7v%W+2RT8vKtw_i
z_9jP%gfBu$K;R1*3Mlp%Eb<Dt!vG#yU?^ZOfsXb7-Y@bJidgfXL`DMphyoghA{b7r
z4t%;wWZuX~23|l;y(H>@7(h-{6ro}gj^JDf#}ORCh>`{j#rA>4Az^_IE+jxjH)Kel
z2#J$$NC>P14v`^&BKW^ZXQ0I(jG7|o|3?P0AT~0-fVeWb0VNR@^fxG8Ezm>81<(xt
zoE`#kCnyi;e-sh-g{c#NSO<}%m;gtgK%RjdVTzFQ9|(=~GKxSqF+B*KCQ%}CDy9hO
zQxF<BxnvRYjRE!h=OeSEI*~1O81RIOKPQL))Coh4Mmh>b?3#ku!0Zk&h3r(qP{h@V
z2WM%yiChNf1LWi;@n;hZ+`NH-tQ}wyD(qw6HU(&Ca82p(RIvz%$4~^SiG_gL0w4<m
zryJ5liemG^;;6Ym2NyLVC<5tI6ajf+4j~ksghQk;P;5OQ(J}_Y;}KDlV#~pwL`^)O
z0FEP$I|2?Wn`tUTt3;@`AJ}B8tg#1Iz9v!#E<Tbo6B30G>cx1f#1q}$^#lM%gD$LP
z3G|2*jJtpwe=0!RybdtbFk?VgN!k&Bp@?z+fs9DkqS#?TGUz54cy|RXF2LfVbrMB1
zpM*!)&VgwJqDAUD6#EtyxekF2&UF@H`xuJYH!+9!lP`!kM2;-Qeh3mRLJa64T!&(}
z!JoJeBq&aO2w(^EckKrl2-^qa1c4r+XoR5%^^+)%;1&dWM9QP&7Knuio;koZpq)HO
z6;hfdNcbYSKY=f#Yfx;nAQ@B>NYlWq0>i?XMZiCXA}~(EBf&KYk`s*u?gDZlWsz$T
z=-^xf2CflWq}TvJ%pru@L)JnFTS$78FclIlVj%n<Nr6(q;E!BmfjQ(5{~h*@!5`KD
z!~udDk-0cU?0u22U`me^7Po9CH=rcyM>y9)jR|QW6hY|42C_g0G!XC|a+du&_#T5l
z{s5=51<FYGrwHFK(i!L!2%S*`?*GU@U{_l@?ZBJ)QfbHE0p}P5aE_-6L^Gr~xLlQ-
z2`nV#(AGlG`3R(dCJqb)r6WfT+<{MyD6w5FNg3%m6p?BYdhpT}umS?7NY9~&^~1Rl
zo-sgW(0Kqz#o_GhKa>$!A*0xAL1LLE@Yn*Zfzbwd2E_)R7kLpy@S8+`gem~kphKD?
zQN;Zh`8k0O&d;I!q)3Ya(egjnCVqE4ZiL~%CN^t|&^58d`0eRL^pF-q5&U0plO<U*
z!2*YkE`m({4zI^7Nf~KE6wzT4p%HGfphRTd1Ki<DZcr!)Ed>Y-P8mca{daz|q|nHc
zB?xSjW0FMZC2bp-!Gb70If4|V2F{XQ1h!)+g5xAyg1uN!tX&uy<c35HMJ$_`AOx<H
z5=6#WitPXt#0Dzq5K~0e84y7yr%YltmmF>6<~s~USeuw2VjnmmP@s_&NQ#g?CAonT
z<f0AXn7>2wmv(J5kuTybf}A23O%L#HeGC-a0HcJb325Iw@E)8dfM?Jn03o3EQw(G(
zz<V%W0nhOFp#A`)D}#tXIiCI`6@uCjaWf1sGc2mWKz);h3e4gw@N@K1$r6aElVgy?
zSO~EJPnD=fg9Xv=Kc<I;cBg|*N1%sDzMu=p(L*dop)Kz?Jwa^f5^@pjU-m8FNddDR
zfiI$1fKvoHz7`o9)V%<(1{o2=5i$~B!R_tjXcCPD7HTknbO&QZBx6Bop|&Uof$~(?
z(jb0_Iiyq?AmNZOeG(`WjV|s2auSnh5esdIM~*9{x$;jOjKCaXh_N7;PmVbfVG*ve
zFdT>k2}`l3Vv(>U3oGp3H4|VF%>+=wOOm8Q7m$;1v4MaQ5pN)inhCHJH{28J3<0te
zI7AxA--6E&14zfG*go(_2C^VF(m?*MqW}waBtZVUKo4mkf7elf#s5+UE=DcTLnOP<
z1>}a85IYx`17au029XLW6}3nP72)*@d?E4)=w9UbB5?#0EZji=iwv*`dIn;m#ZrXj
ziFw3te8=f-q0oS+(_krfBrJA~1v<bi4e>)1J1N5SBped@G6)<ZU4tU1PC^eZxDiQ=
zv}THJ2?%S!A3*?E3$%$H5t09{c>s$iMZ_1<D=0Q_EV34;wH06uO3Sc|_Sa+oPudCa
z?dwaYWzbrdkd_e{>)$yP0+7X1C7$TP3;x2Pu=t<yz;6S_{$0}o7SXf-<;tWp3&o~|
zMeakOgL9un9Sc~B9R~2$Vl1M!fIt)JI21v4V#mQl^?-pA=ph}4Vp{>iaq!Fmjsrp6
z2*>%mZi1!dL^=+|9tvptEf&J!!8sk$GH?zYBsB0025_Y9QpC*{#(|Iz5%h+fo+#qm
z#Nz+~?%?!Epog4RD0T=S#{p&z7zYU7MvTMX;rLjnRe^*r#JUu^fSh+OH4flp0x$<J
z78Y%_$5I4}@#6q(`6uBIQ69ol+!{|Z4ut8QFb;^`9V`e)lam)Q4tVBp;{evdkmG=}
zJ#utN_=1yeB0oj8>tHFiLo6{6@J>@mD8MnG1^}c(P(;HQ24X3PKvt}<6k%&(iSaNg
zvBbzw2VOx=g~*{GxCH4=e(c}j^H@CGPs|uHW`b9cV{ECRfPDfI8)$|EGbH3tP(+CF
zLxKO*3t|S5!IR?ta+0A~$|=yuXh#wCM+^m?J-{m<=o;Y_e~0#C@uY|)MTSj^oeoP3
z1%$Q&+<{^P&x@xCN}$<(AR;06h{N+4Fy(-D2zVOk&%iVM9+Ko=?dhgiV%_6x;o%7U
zk|eN0+#J{#E^OtrP5&UYO&3nXfg}&E@<ByDU@tqkArN?m_(VfsG=57nusaq09KsiY
z_fR&9hF~(_JtP+z%I<-!aq#s}iU+)hbPMmL12%s_Qvn*<!v(yD=|PoM;5|47z%%3~
z80fG>U{3->2i{r$bYFuK0d2o<F%#-|2Hrz*VBk}!FwjO0;O`Kh7^tHT=r4l!#K7YN
zcSiw#hwlpo51{D+rU%;!20Fq4XmNnQ51-KrgZRMT!T1k6!}o(WTLVZKd_Al$xDX5!
zT_Jff@IjYwISi<;!8Qr+$$-i(xD#&SsT7tU3vE0A{tjOc>jPep0ILUxJ{FcA&Upd*
zTpV_A9OHr+-bC=W01pk!Da<H5KJdYufc-$@K{)df9!F>|39y+Pwu^;x`(V3(yXoO$
z?trrs;OpRVM8o3<A5{i?4vh~QO09vj6=1uCQ#~}4>fsMm0?t-|>A~ZShWpImLveu5
zVS4a*qv7#}4>keLVu0m<#~lriJA60=;3u#g3!Cg=dhjOug{8^D`6DI-mjYQoyl}}v
z7Y}d=-pgR>P-TSRZ4i8d_$p3HaO?;U2oDI11`r$(76?WI@cTsxT;RS3ky`LoScfoB
zK=4@z^CNr}ClLHq_%5)u5Vn;;T*2GQ0Jnw&g?4`7ww*!WgSSa7Y(*m60(U)l3qmA-
zxWg>$*MM|J*slS5B2;ZbL=2D>gbs1vgGes~5tut@=?#1p=5A3RFwDZDeqi|fuyGRl
zf?+yve=tEhd|}#z5U1ey2B*%1OK~J1ZXwe~2(sYFgy;tA1j_psx+@9Pa8?UbgA5pM
zZv+A$iJBJLVt~dpd~AfN!@h!VP+Oo5#y*JpLimKmg4(ixa0!!w+=(E|!f_8Kgvbgj
z4?>I(mo8WzhSd2M+EjpE3i!tGd<OTl0Pz_fDtKPQ_f`;OAXo=Jgu_!FW)c1d%d!ZE
zgQo^kJPtkxdoeBt`^qAG4puje(-BxCSPvAd5xOB*%c746*0L}cK_&phPrzJ6Y61(^
zLYS@~^})yn@D*r~AoM|(zz7()KvN*hWRUZ~HE&=hgGnt^OCkToS4$Vf1=S9bTA1`;
zQVXRsNK^RI8R4rqf#9!#j3O9Zup+|L3918e364SN+wevJxX=U4sxa^H1^~G50Q?=+
zC_EcsA#Vn<Lil=U)reo00nhOD@T>$c5`YX9z8-D`#b>Mp!SGhPfUiPF;On_s0jIYB
zX9fYM=>v5ssDl)R23|oo!T>*63MUr8D@cnHz$?fCC4pCvP2+yr6k-ARVN-bOlL1~q
zmMsgsg2o-lQn2{rW`Mgut_n=vz^|b~w*i7R7N1%IH^OI^z?~oz3wO8&c3~C-UP2=Y
z6!o$A%oDg9JS_slkHtGBa5ubP0(XPvNnk?;@Dh&Ez}@gbIdC^PO$7ox7IIg_LhPS9
zFL27#b#?~Q?0pNVKS9k}z;Dy<v+@BV3a~T)f7l&&JwP6m0I>vG+{B}7?r!ejj5|^Y
z_+fiD6uy;1)7<sAhLg230uqP+0@P)JS5}rN;HTxS0MhVp%;OnEK}j~Fn1P*@mzArI
ztCh7C@JsU+0PO|)So9I2*d9AK7YB16U^Ss<=k8#&KpeTKK+1uSEdb5^R!%nVw!nE$
zKwpG7@cS}$4(?X2C^1zBb9XD?m@4oHdgvP9cOP-x87Mb*S1WTzM(^7{j8{5v*Z9nP
z4rY7#Wp?@vfAI42`c!=M)7J>Gs6?U5zQ&1r_VGJzW!ZRn9nVgN^N+SAsV-N`6`<x{
zw!!7&Ce`LmCw>U1T+da1x5u7-g;|w-ptxd_6#5oh#zi5gHBVe<mS?MsTRRP@|9W$s
zRybZ|hOaF4R)A;U%<o@)zirOaGY8Td#+TQYzusL_#rHvkx<eqacQfCO7`{{YJ|7PB
zTc!B!MaP53dH$2t@2KWw;x*&s+<f|;-#PV5#B63QDkm;ZZl*P6hv;13tcjxU*Rior
zZ)Tk5UAepIsPwe%#KpbYnUp+7PxT~j*N)$Z-j&*KruxAeI6Hb{bo1r__xVuycr;DN
zna9zQFQe{!`$=U$Rr_UAgO<Wnf%b6V*XBUap^jhSqj|p>c&K*8PZz9gc5^;u@op>C
zTI!<J_P2t*m{l3sDk*MUzQ#7XF);Y-+wKW=Bfggv)HnG$v{3g=ekqnt-yfuH>GeHu
zh>3o-b#}Tx#POT6OlBXu-pI??(oXF=zkg2OQJ6XHFPY}2<hO$Rf(WC`2{!E>?34i2
z+8HO41VMuip>_H%d)McO(Vko<Ms>+)=**dZvyIaHr(F~TyMma@CPz*Mu9S@9nc~TL
zshEzz#C$mI`8$q=o?rP=tmG{Tg);2{xkN$f2lPrTGT4rFPu9G?+;b#2WO>DKIWsm;
zu}`u!N~N7glKIJp*L0cXVFK?_m7TVhm28%S_t!?1BngU^uh=%rNz3Nbf8MAee%a|3
zSCsfcy_?28`nH!sR*8KVFOTzKHGU$%AT7j@Wiu=ybLEoia;HN^G(i%H!<E!n$E@W%
zPcC5?b@*0r4xGE@H|)bzTAeA|6}qdp!&zZkS<7zKcenkc9zW7N4Q6D2e0kz*+ts4^
zwIo9!{`b{+!;?Y3xqhEEZxwgQ|5-XXx~goB{%*DF@q%w6vwZxYc&h4la2)%robzSK
zZpYoVYr3wSnBk9(zMnS3`)QD-w$AuBw^F2WY4kNo=|*Mdgx%xglldt+{704-^fn&k
zNpJp?(6#F1Z?WGww*IF#v!V*MPoJ>-zJWVWJi{gLjxOEWleDU~n|8$=EVHumvGsI`
z+7Wk9@eyObyHJW^^wm&yNyp02nq$2`nSNErJ=pLw>!h!%{ekxCIN*=X($y<}3aHjt
ze^%*GU^C+8n3N7{?(N+vOKbc-^4hqYg(>efJ_A4R>*FpKMJ`)Y6k|F!i`jn^v<R(c
z%Um_hPES`e7j;hl$<&Xi>}Srarv-a^Wof7BbPL!dj$i+kw(OK#N}0|#D|d&Huz(Y0
zv(-%F8_uh-m7eN7`&-qa$Y6cAF!viq+O&)J9Mya1RIl5k*hZSe4hgYwPO4SYyD?s9
zJC$Ui96YZcBCz(RX;`_(cFA<F2ePSURi^fBLNUhDA9dT$nu>hrOx86xt$x_Pv~ZtA
zX-&e#u+xR!Q+r=l8V-Imui@eKocCW{*y5MJF}3WO{Pzz+tNo-tnh%|o|6W)aI%h<?
zYoJH5vXW+AC2ex}>S|e*TZ2El<zkxGM6Bt&YJV{>mz6GOzZq2)&6g8&2V2jNUazz=
zEfdx1k?7+WJRhyDq`Kqj>ocB~8$L&Pd~SN`Ds8#{Blo>GH=Xng`5w!Jj$W^^dSPyy
zE_-_A^(tD^vlkA_gs*R9;{0-g8e@%)3{T7Bd|}3BBOb2t!s6!mT+h5~>qWcU<(#!L
z=SOA2WzSl$HRqp`w{$SfIX-dNvg^J-7yB^7H`&$H%LZ%g&YlR%Nmk#~*3R-p;#KzA
zdwN1P==0GsFNgQ1?$kQQ7%g)eo7N}r%7Sjx`%2s1<JNi`zPOwocVDr&Z6*a}afD~a
z|Lr5rmfsS}`%bxB=Fh($u`6=)(g}dK^S>_SCi?rhAJ)z}(0Bdn=nJ|qHEZ5mR-U)Z
zSKQnAZ2mb%746xt>t8$#|Mq=HjeNoJPSJN?>~>1ocdAGYjT=0<Q!gU*JZ(MG(ez2`
zobx3f8aZOAugX<k^sM@paK!IgF}D8t37h(8ncz{T-*0B+8@yGcUW%_2yZ>H|bGrG3
z-{?1asf#rn+Xu$O(>iHeT#t;G3H9l9M2cHGoK-viVy0ie_3a_YPT`ELF^3cm%4AM^
zvc#N-;@?&8(3<pfVp(5n*R-*5sT6ZpwiL5;Iun<MkZpb*!%p-F6?>Eb^A>><?+gOU
zeRxf`T{^FSiQf4Ke}HDgxsmqYsz(H!1x`QS$56gpQ&ma5V=$DL{|PEYX7_zmh<S($
z3;zpLh}xQpX8k!g{kd@cIqB5tcWZ+_w|esUUs&@&iQyB+weB;uPshUcH40Wg_swp7
zb@k`XLvQw)zFM=zV=VgB^{e43qj!sv?_81F9kORvgQ2R8-|B#Y)5k_mYx8_KG3XLH
zKU%F^SnoHw-O%4z_K+5R{+$WFF5VwE3U;}6zt{6}{e2_0utqmn&Gk%n!WF@rNhKW1
zYP&Ao60Z#3%rdodY>%C}xXgjmNA<c*50qs(yz5En9@*}F$)bHuJSdc1Ubp)-6R%&H
z1-HC)c`wG>G;`oi=D^X6fuj!wx~NvK%;Ct&9^}{kcHaI}cJaYP&w|?q>w531t0`=8
zu8VFpaob5Bo}p8t=srGFuq{-KZ*OkE_ty!j9bN)+e5qr++jB1Um|T6;Yq<KtQJ(rB
zi;1zzx5N{(_N2skG=wwOVu~Y$8%KUsPx;z%@p`Fm+@gE$P6B)Wi-E|36Rx8MXZFd@
zzfH9-Jt`n=UQx2qQ*!sw=5y|=lr2^T-&Z_jfMRJq#OO{-D=gf-a;zngM#yh+-SQm0
z4Uem?-o4J!dp2&P>A)GAx`D3j69Ktg8>I~eI}~0UC5oQBRkVVB-INJ!T~LsolG5c@
zuO2Pi%wv7##O1iAaxH~1A?&Jd;XqERNGk8A4+AnD21FgH&>PQeo=NB0eA=u3qs%?j
zMiGW|;WhSd+q(}ljLWijp9y4H?yg+M%fJyDXvC1eiuzsZ^q17>nAB;*httxiH+>y+
zVs4i;O?R)7Gl)2FC)L6FG4IRhkmsIK;|I3>+HU0<`+Drxvd`1~(N{*bBXkGdHVfZ4
zsBCejBdVNbqja+G<eMBC!FM*kzSbGRiY0TrBWvg}9ExW@^suz&9oGq=?#TYZ<t|_#
zwkmMP*&kebjVlMQCmpRU(|E<^CEBo&Ypc#3v#GJ7_J=*`H>bI_u}ij<3*M-zjd-Fo
zm1a<*!Y7i;#4^`2;Yc(0jLK$ImHTU=XI=klwT<ZSxyCymU3rz)pMN8QN25;2i`}3r
zoavl(=0>)x8o$eJgZG8{Uk<Y6b=^Cz*}!$dH(gaweOF4QO*8#E4J?C5UYB5dt)|SS
zYA;sHl~>HR_Z?HxyTr;`yY&K}yVPl~Hi^e=%ZsRVsh(1Qrxs^6V=J?wB2pZOk$v&g
z7}ori`-aPCjUIWuvyZNqbZT<-HB!2nL1T0Ji105?RBV2Tl*e4&`7sX#cL&Y8X385(
z*57`9#`kXTUEKnfk1e(dUo6&5G94G*96HLMDtTpfeZeJ<@dwAN<`lh-1ss+Ckf(5f
zdva|=t;wi=fPX6YgPjEm#rkbgc2~V_zt8#hhPhx{o!!>~#t;6HPu9_|I(Mvn-31p+
zpy~nYybBvWZ>VmyjKUaonPG~v)9CkR-bdx@I(#{HMPl2@ySf%G7dKoro{Dg5n7xht
z<@S18a=@qUb~No;-}_^^Bl4Ky`Zvr3H?BV!VEv8iokh4>=ixh@zJs<~ifta+e0wuk
zRg2cXceFVB)1aXA>!9=F2h>md-=LGAjqts)o?kp!xGB8SSUKg;@w-MDS3T-;9$>__
zinH6A&|b5my%xlE<9YVaYkMD59)9JPeScT&GgCD-t=q$Nb4UC-MzWLC^4Sgfx{usu
zsP}(adE44SShoC_KA*-KdhY)6)vRM|!h!BIiejI8A1%9aw#N8HQv$7ARf00D+$!bJ
zq(*Z(Ir(KgaTx=5QU{Kv4U`(aEoDBu)B5W$v%9EuvI=eP=l73QPWfJA^=8a*y?Eo$
zZe~`xjhnZZXHM6OHKjGS)H3oi45y|!SVS2ssp#pLZpqC{x7c*i*l9~&*n!D3O^>>_
ziIFP3=MSkXYt(NPFe<HE_afxjufR68=cOJOrv|s`s}=@*cs{rDjG$A6httJLhC8n<
zbNMbrDs*hz$y@757xei`P0WvLG|6{uZu|KOvuh8@wH%0Ry}I`<-43tN=r%_UwG*}>
znCl;0PepcE?zs8teXL9D^*ws=hcm8@4>ad5yLsyxN0L2L_>Txz(OQj-U;S3D{8XE~
zPcZMpX1V7Du~cp4n4@+pHjUFZ8>^<<6l~<u9=g`^Ja+K%J#6*99qe-KB@@v@C1WuX
z<#Q^(zI0?5#^h@^p<9M$hCbyusqoN<Z1!X8uOHhTSDehr&-`h4dF&yHO$K^i;#X#s
zrVhy-+Wec5Nr~;8gRz}s!mhJ9I_*>&-(HE+JNWc?fkDLfW<w@*%!bGI56-4)onOs*
zd?aie-!6keBij{fA+|46*}M%+gjpURXJ5us`QW)y-Zve;uV#U3I@2c$9E!RnpZ3a5
z4m8NL9kg}Zk>t}gaI1rcr|{9MZLg2X-{QVEVMz6HGxL+~l8x6Uw)C@|SYa(Ge&egX
z88$hP#lCB&$MG{2>x3k4YJ6O0+Nf;&I7N5B*2rdenyFE1)4{#l)xYlSEJ*TaQnueA
z^Tg52<IFcP-tVhYTnmr;U7b|tGx_~HZ$c!%ikZ#Cq&?W$Evq;uheJZFDpY%H9Po&m
zQ0<BFSdIucp(07XRegD9D~r!4#y4&lyz`zla_Hv3(47xg)xY1gZac}xY58GaZ;r8)
zS87{F`dNpk9Ro(429Mj%dYPxTYcgeJhrDOnFj02)M63A94cjZve$$^D)t{@^pWCWG
zw;?M#ZP00t2G@kC%j5B$BX{Z!(>@PKh$>F7_PBq8+x`X1oBi`WhkWw(AL;W=dKUkT
zTeK?i%$idf^Oeg+ctkw;zA`WOt)31O+~q2Ish#WEgCRzf%AWKBs>!DGp029(ZN)Wt
z?pi|)HO)KTjF+7Xlj+{QBiYSyXFk`gAvQ_>aHqjFPNpoWk1WCOKW?x2>W-;45xg3*
z5v6Vrpe7}f_4ZeNYs+nI<&1$Uv*&Ky+?_jJ_}0)r{kkHmqS3Nn1ARY^<v6<f$?i(V
zluhfOZZh2}sd>UkDO=}wTVc?~D{m!@tY=3b%qH2eJaw_RdfMEtH@ecpN+9z=(orub
z_t1Pfqf*z4mY%#Xts=jx)BY^((b3+HdP>vh9n*JH>TQ5{EH9_J&a-(z&w#4Fy&>FU
zj+}ejlgD%(<m~+T$>;IQ-ZeZyo34vEg@@<no{q5P|K6=)<mv5L)EyQWJU=nhVg7TY
zH~RhU;DLga<PznC-;Q^gxCM4@c-wO0+WUOdm3k7f?Y5rg?V8u_n4%3ebRRq1aJ>Iq
z_rdI7#p|RJQ|GFyIV-pI88p}>&Q!2(G6=XNJbhu0Tf`det)VNPN45{GRe1gOV{&}l
zXWDGetxQuHyMN5^jOc0)F}M0et=k_IcVe@^Goh5Yg!38~HK|4dWXv+=cQD16ejD%#
zqu-%i*WomPRg4yrYt=atqj_<l;C0oji&QlR*AfmqdYF97uWD`ceLl6i1Fn}+N@iay
z=PW#NWxxF7Rhybx<vn@Rn>%U@e_y|qKfY_Sd%!TYde?bAJL`O!#<CDOtMDJphIeO$
zd~WR+p6aENrz)|+9Pr*S6A)2e7SWz&>(DgdqnP<Q;mncaAANX@r_&2MH=SQ0eoH!{
z)7HUETFT<1PoPb!PkLS1Xyb@6O~^}?qD|Ii$9l^9PSFT3Twu2!sjS!_>`7DUB*n3+
zk<*<nH@tB3F=_{?%Cp(G_A@bFf1znC$Eq5;)|ey5An7$jv69Umw?fTz8&F{zYMi8`
zvu+Iq9gc6MWi3Q0I=|WQz;E#4xj-S#a{phCsIw1ojpayKBucCsV=0W!SrJ6_;XeDJ
z+Jemj)Xbq-=HCsD2bUO_L|<#Fy(_IuAFYMC^|D*Di1XzSDGlzxdaDZ6fNiKSrs=R_
z(Jc<tFN$d8u6r;)ezq+5hIHl}mF44SwBGX85&~Un=Q=;c2X?-`n|#n*vNb+f|I4HI
z4&uhE3_M3%w5w>Q<_y4#n$JHijLq1TE=-+xAc#7#eCytI`=ykscFq)B<YS<7+)zE}
zDk<FUDs8uM2Wo{U2a5BgXJPEIyvLtTX$vvbK00@ClT#$U$3yQTP2<A#S+{PBS2(Sb
zjn%rY61~0zr&Y|F^Xk8OzI#mj-bBmZ4h%N;dXr@$^f+4UM{yKGV@qF|sx*&(Kyb;t
z8BSs=&q{_Ebkj%A%7G`10hXPDb~H_P>{2)LE6v|LSQjB-_f^k3Z5P8Z!->oW`qz%5
z0#6Ihy%S>kH0tCaaY8MLiE)p~ttTZ^-H&O_PB&bhpkJ2dr=sA|P#h)S_`2tr>Uu8|
zli+2J=QlZuuUeigF3Mo+n&860T)MMr-pxh(F3o+t*;d<+T1|XK51+XM{0KWlmW5^I
z9FEx2%_w7ODa}4|Q!g+s4%K+Odr0KQ{@{`urqNRCXapiS(#{>q+hc*wuY4uUcq`mn
z(>E}7N0OpjP-&{WJIYAR$*!sTpkmQR+8rM!O7ui%kEU)u^9rY)9j8ytd~`Vac<t8#
zd!6{y6pdSTG@Q=7%$D521t)pS?}~+jTAT@d{aOON>)f1eCVQT=UHHa$4&emaXV>O_
zB(M8qn#B{0yRGW!P~PVjN$34svXoAjcWS<OW!GW$D!=&1@5$rTmFYiRH{+BM8u;J=
zGb$^)&u=m@?}&Wk-5-NAPX$j6C$vwRIUnU)clD4Mv*Y%Uk~fykug|z)GLNfX!(~AD
zS0u2Dx8|ujJGt+%a<g!?b8&Ze1xky+do6QEE0mZL_;0Jam4m01yPbu(mX(Lqw%yJS
zmcT_0<~D9XF%meq+|2@Lj6lgs1HZ|OBZGSbAcVMzsg<Jv00RTpD4V;eTiMyzx&xbK
zfL}z_0E)487D`SwKnWCA%LHz?d$+SU%48eRG$Di9CIM8GfnTDL2C!`jG|<q2y8tM7
zTH(shU=<u$BgK{3agf16-4%B=^c{j!z!yQRgHdd^xtkU43bN82^f>13;{s>^IJ5?L
zG44nkoERE=^qkc+_Gp^Bpu{vR0ZHxLeZW5-^l<~E#g~$Gt!#kb5peZE2`gDTAF~4b
zM6_Kkp`R2G#(xd?<3SG>7vPsyaSFq2o)k00AqXat;Qk-n4qutWC;-g>Fi2?t+yKyZ
z6G>U@VH5xjn&AE*jr$y^?wd$TO8_sVz!v}>0$c*r<^c#1Cou3CfHTUVWPyD#;I{!p
z%mfSkCkbd5hkXEl1TK?710--~RRg~)DK35(Q28E1VBa^g-yOO8l3ei_0Gp7t=fhDA
zVZq{Ss)u~SxZ9OAF6if>b|2sB-Kvn*PTy$hPIG(}dgs(ccy#VcKlScOtCG5!Ra?Kg
zIX+4GUa9$rTHDX@O0dsU*%eQMl{Tzf@$ku*SA|JL`o^@hhL;#Wj^oYRLJeE2?uhrd
z6`pa5upcnn*IIb6`w3@%pRtrl#m!qe3gST{SE3W+8GS3BziTPU5!5-GdpNz!`$tS?
zj>Ei23EN6Nlp6oV+bl0~uXY<_sp@3E6vg}K>+36(-47VjaPcUfb>cCop?xXKUUW#~
zcGScc-HNCt<@lAl*Z5-}1@#4~`OSX*Aa=?<;OyF(#(9?M>i&!C@5(TJq<uEGFJ5^H
z%XsXUuo8NO(sJF)v?DB4-TQ+0*H0eeuayh+INHEpf6L8Gemg6DVT9fW@4-$jPmlC3
z?EE3Ok1Tdv95%FsnJ-u>&O`xU`XlpJaRTrH@CPpN*0@a_@4S}gfUf~255QSCI{^;+
z1*}2OS>MSHhcTeAQ0D@|0YNMU<_r%~04GgJPyi`#t_?Jq5>SfICs(?g8u|?8O%`>1
zc`-BBsE)lE+V_CdZtU8&dfiX0Kb3Po?UC{~F;jDLxP5N-&8BrOjE=V9eoT2+a>I4l
zn{Hk^n=QQ307YHcb0odvTE-^h<TLk@x36>+TcM-a6kFVIW282-s^Dv}SEpZfOWXV3
zvcKnl2mGE1__1>twOK`yj+txwD+lu~zV=e)O952Fxym*TA)ST8Td3-(I@Gjzb`<<<
z-g<{xB6HdE35(5a5l7yS19hK~2I|ju_!Lh5>|x)!`D&ocGM9@y3a;J5_CuefsW43O
zCugUkXl@SKZlZ2l5kEdvhh6>q!+~Zs&h3gLv*&*))9;#$%jBi%U!z#!_p_`rg=O2r
z<$;FOA$&3}KWpdJB1-ASr>Q@Gdhn~+rp13XZD1?s?3-XUt=PPfa4Mf=WyPLl5i7pa
zqB6$I6!pcMQrDDw&-1@h4(-(m3OcM5h>>GK=?wFx&DortVPmIed7HyB`@UiR<jL^^
zFAZg?`@V%1g;F)lPJHqADNP=d6c8z?r_y#lxgnr?N5jr>69vAbOm-!SqSTFbdhv{Y
zVWL4n6*mNq1}&rM-_6M1N;P$GYMt<)QCAMb#w)|g4^cguLpR(a^%Au8PqQei*TvMX
z*P-_2ZJ-fq&1WAzSp7Kc#J+@+EGXqNo!B$mdQI}s59TlIEfRS+bxZET!+w3bUcJc9
zv0t<k`~h0?x8=2C$51=f8=5nloSXQBuY@V+&t7yj$T=`h?V&!m?c$MdP224Z-D#du
zcb@wB<wR%iQ@(GLUjvkX(^iJ`%$?P)y%QjryP?$j`OOl?dD`%%%UMFAz1NQR+-Z;q
z2q|5Yckbwu!JJ(d*!B{Ky!SKTS59cRmkwO_IN2oo@noIH^YIgtbd$~nr9Tqlb~T)6
zSoynMA+uz@W~SD0mv+ZsZ}W`SZ0IRo{>;Qyoq#Xf3~6imdM%67r?wBq+=&%rv^;<8
zM~$i5y(mGg??OY$r@Mv@&roX$YBaYhH@h@TER$eT&=lO;eD1Xbqr^qeo2n}VKAeyB
zkbh~>ygF^}O4m`vFn>;yulx?lG_89BF0h=UHaWj+$IUy2+?7J7s3)85pi~tC(`V;d
za+_AiUu0HKjpAL#!WWv2uIBGJ>lWzSxHr!t>7=ujR}-@!kK$HM3x<G5&8e9jK3%3l
zi|AvF%4v5h+x*&J?;TW8@L}a|TFDa}WoUj+AxQmgW0YY+acArAOjGGsUw<!)Ybo?O
zGIF?RGNVSPvUa}fhu`lMu}!@qm*Vd4mX@6}+U<Yp-rklEhCE8$7<ZlTUGEOiYJ^ta
z>QmhwmFJ<S)U1EW@@^8Nik!T!#%rmk7IJdy{pDw;rg~~BlX`mTnUCt`j?6@S?T@Ol
zdDOG7Rdy$PNyy>msC~-V64lY#7yGr<SofY)s~eHuwVs!$^l<gCXGG7)jqiKaSRan<
znYt_>C0l%Ix+zJpWS_DiwnSa1=xbBV<`l70K2_{DZhXDJyE9%wv|!hHYt5&O9*>e3
z(?hJjj3uj`iaBe|8(=zrv05OeWOk~zq$UZgt1Y3s@zRcm-3`L;rS$6>h3J`71b4Np
zy|@P;T>C;@jrHkR)vK?Xf+gx92NFv)?sC|zdyrssx7wYRZo6)?iIDE-hP4kqGo9DV
z&ryHo&bn;<gYg!DiyxHYFGeJos81cxsEGWqyCT<PU2d0AMTGT=9nJbO`5}j$qe42J
z_f*753z-k4Z~VT`u*YiMgtU<Sr@|2H6$-w=iX+#;<r{@udD-cV_N2X`er|C6v(y>R
zGG^{_bkX|FE>x?J3HF^}T<N{WP3CN`OtAR-6AUXtqSR<RYXv)P*>ApocF&X6oV$!h
zMs!lovY+im5A}=QRctPdYM<hQy)Q);2Z~Ge3NasBW&Wa9DFhvgm3f)X^X$Njp5=Wm
zR5mUly(Mdp(pS4I-|Vu?oV!9^>my5w1+$t97iS1sR5^3h>*nw3Zna_5E7upC{RuVO
zxxYy8_BCMkG7sl*#;Ofd@%3cwuhZZz<LCY|#vO&`Edy9ly4}4q1s$0r6C5g&nfB%W
zi{35rwdmsYp;I$8YpOYYz8}WesL9R?-ZtJ8tb9AD`Dee4c%(R+c%+x>jqH@`ro8qQ
zLKj`b+<eZCmi4c2JOA>;F0F1<C~vPqB}aMi?R#D>gIdxflT<OE`tBKJG#tb_UMOrn
z`Qe*3T7D(QasOjxDa*H_G}Y_<zQtk!?0lHDdRg8zolzaqn199n?!ve>Z^eoi(w_wD
zeyw_kRc$-)swWsT#;-MZVtX-GbKQ=hP}#%#2U32yt^T>Wp>~~2;6Y5MO@Vb0>$<BF
zL*s_#UKTm}myX-B%f?k+kFhFTzf$JqmR)r|95Le)O1D2Md^`TY$MO52JSoqPCsI_>
zfp<7oan;J^GKwoE=qM)Xh+MJHF-|&g{0$e=H|qG)2B`;*=X^IWHb{MKpJQ)3)~!hO
z-6&^w(mg#*kMCB=#t8<;-wsG`;I$iUwXmh@=tQl$_`3B)-hn=oWF7lY`%J!=tc(R#
zxnE_v<YEm{-rC2bCGPj=>SE9jSm`G2=_b9o@A3P<$;@!qp*ZJg4I1I(7^7^B2Rge`
z^|oB~$jISJzMLX$-0yCDF>chc@oSE6tQJlB+VKuG-)rYJDyLfPIlH)u`>cO<b$hsJ
zz3s3tuBkiBRMB`y^!=uiZ8{=X8@IgOd)1)CU9P3FkAp5)%SJpaRFf|FL;SmM@z`J*
zPN{p#_NE&oG>Ysuj@3$OdicaRctSHJ<mrxyLpQ0tYNV9~8J@~@-IVL{t<KY`aW_h7
z{%W-POS^63w+pHhS#7p&HZalgjIp_(zT6slUUgUhru(`sx%82jqv@p<k&UbJ3zayy
z4!jw;x@~0J?qofs%%=NqE?7)7#2Y@Cil*bZ=v#b#)DeAi)uyBatBV`sRa4%5-B{wW
zH(V?8UFx_<?5n$lKJN#EirOd7y$me;(r%4?^Q&c<)O|e>4vsFmUl^`KtEGjkqhFgz
zJq}fQ+-56vW0kn^1~%0Oy`zre!dHEh%RcCBctclg6oCEZJdEkcuE~vvF60VHI3aWK
zq}4wAp%CNbvl{98$1hymm)@sZwJQ9XC5z|<=TsH(mDZ2fZZfH?;J84Sq~s{^P>=5F
z)#4Pi?FG7W7m!$Ic1<=+tWeYAcf8H^!$}5}X|L^`+^bH0J<OsMC~W+~AZkS&zcFp9
z8M^YL!y%67HcKhH7n`m=zwdhUh4tf>`;wgL)zXIz&|TRz#SziBtj6Tdo!aHrslY)k
z_Jm7vdAd^S<3pm>D}N`vbrn2zrgIY`^N#hG+Xu7c91N%vQ?i>xgH*C?X~T^j4R&k`
zLiO*L3vY8OxiKs4y~6AJNP6$53_5e$Wz_rDcTwBs7@so^HV~88-crearP7HtmU$wp
zrss+552>{VeCruXMH5ksa!NX>+wAjDVTm6S*NbX}e}1*6V}9LG>w3ttHDyHK%q8A%
z^z45k*XphsTW+5dX5e{Vjz?O6Ip5SXwf))DL}3SWUbFd`owXBpgdC(^ZyIngxTyMO
zd78nkm#F^qAd@1W_aC~g3N5s~c{WSe_j{~S6Zq&`;vv`SvFTOb%j&7zY~ELS?N)g{
z9p8Hb+k1!exusf_nM%?<Q#&7KjygVWXG;7a;yV~|x3Av6CQcpOJqU>S{(YK9sW6pe
z<F|2_ftS8X!ACtqJIj6Z`A2*XGnYp0<evD|=^xonZMd@ga<=Rbt-|u2MtjHimnwVQ
zxzbfbUpfP3_MzKjv_#oWyIoGp>DudWD6LJg9;+Q_FN<@n8s?x)YWwV3(58@AZyOT2
z;j&rdH)i@9^|mX|p6UtgVsgICsl4J=&F2%Go!etyJqR!8;EilEca^Qss);?HKli!7
zLfe&Rb6)4I0-lfitMw<tJ>zLMC9U<3erq}6Tg)p~x_{HuuRa%{?~|&6`_+F$*@|;9
z`?kH>N{?~a71>}h;WO@=SJL@y{FmtV$M0A@3O{haV=Bt~S|>r%F?cKP6i?Ne#FRmH
z9>ulR(JPc5zZ9MR7SrHhz2PH6k|Y;nmGO;BP3hS#X&cum3e$uLIeds0>wmm_mM-|+
zr7`*-rPo`hcA|$~Hc!xHcJuhP{HXRDv|n@fp6SF}!PV?KXP-GJwSLSx6kKj5UKVgj
zw8L9<ZKTTX^D^sorQ*(QdY{O@hmmRJdItImYJLt0uDNOlaTaEixnqqn!!v{XtA1n-
z^Y}e~8K~HO&*muo32p6o-qqfLjLXAm50r0gt>|%)sR&?LmPmC>eN$qT`{fl6uJ5mD
z`jO3$Xyt+m)Y*4`qfl;$=Dqj_91%~Rv@UCLLGcuAy?isXpU2PlCUyBOk6w>8&K(>N
zW}Z=Ht(7{kr|{)*x7<3zw3pV(J6bi)n@X+S+IPLazmE0bv;87xtEetr%F4;f%guXl
z;mEe{O;a=5ac8ewnfJzFudhkhNKVD)4YlRNZn$~Vv2hNCRr|}#A176=b@9GjXNf8I
z7vf>g`svU6S$C8E7A!wg%+_Cf(RX%RAFQkpYWnfj(?(=V*ohOuH}<CNbR4uyTNha@
zn^8_*e5zp&7UgLeEH1IbYtsO)4CD8Z`mc)Rte(HHKi@{3D9B&CB`GuI`iAco+bz<Z
zv*ZtL`Jz+AK8|JP`4w?8baPC$@xhjtH%xa8X?tVq%JqKYyz=QU?gMTOudEeCJo3&B
zl`5D_mYwMK_wL;8?qgD%AW+Kq?AYsXD(r!~95@EIUvx6tZsA&K+tqL8yrT1<VqVC$
zuB$`OXZETT?zFihdhO}c-8U4`*qikoH_o*mJ?!<ppp^4cVQO)}*}mbP-JN3h0xO68
ziu*@_W|_h2&yz`!U!|&5XSSMDU%xbQ!IAUBBRgf<xyOp7A?Y0^gWKr0c52zAxM_PO
z=Sk}_c(LcYf0&+nw;_Leu+=S}Q%9sz@>rMvgHN14Pnzk;kXX*t-M7-0wTV30%{q`Q
z@}{jmUZ=>IHl$wX=QSrz{Y#q7`ofQQwLIXv9<@U+O__G%Hyy^9HsMTzgmoP2rtP<D
z3mmK3q`Jq|e0;;*L#8`b6`uZF>ua98yOb_0`qQ_&caD4>yUUhf-kbceks-XO`{jGa
z(-&i{1T{iL9v2j8iiRD?7M`D}ZDJ^X`gE`GOv6Ks$;`Q1AA`qeTi2+G<(hB)6|2H~
ze~WH7!|sL?bZ1naBt_=6pHaDxSk|6YkrioZeY@j<2Cq9ynG=;7^=;bWLrnf9bOD!n
z>Ql?_Sg4$CGiO!ko4~9u6RlYnvR<ib%^psr3j*gl89oXJ$%LbLQ_CCPb!)eDYrpGm
z;6GHeuBx5^BPvpKZdpbGD&b86)oMod_&`QR4mE15uo*M0XndfX<kT6i*<(!p1$3oB
zK_Nd?#(KD>2M$elEAg%CSEfD1p~h$37%DqvPJK$oF!<>Ga<P`~nB&7+`-AN~*S4G2
z+_y~^J(kk(@L1T_XO_8PKiX8>&9AS_-gjsZi^zuv#_+7N%62yMwd?!4f2`n-$@5@t
zJjSoi<B7ePYiZlTd-qud)iw`n+b7TV*L^E<ysN$|IX7pDW^L+T$Kxxe1P$JXaBS#T
zpM0jW&m=$!yJo%ZXAiz#-Om+<?(zO~Geom8+zrz*w0X{_&idngw(I@m<MMGFVxfYa
zy{YU@{_!kfrU8MoX3u~n<Z`!9-@L<)=X_)HU1b#T#qy=qmz|G~7gy~$8btf}yWYLi
zr3qJ_99XgW$~mR;m@6D-))gjH9S}ajwpZRD_)cc|owV{h8Rd6^A7!ZREqW30;8h~y
zMfr@>>-@>DTn*ps=bk{F^7nQN=xQBqaeTF>;c-goT&>uAWpK?A*}|S4`Y%c?{zWa}
zrF{}SW)e3BB+#cYJzV=ePGQPv)~^#!Shl{}ykgb<>%l8liuaf@`6tko9tu91QJz`0
zyxD<OpqVFjf6P4@#nz(gB&Cm8sUFI=@3thoo-eV9oa_F6HdMR8>(2Zu!J%ojHJ&Zu
zxzTqj0?Sp_Sf{qGFi2n&F%fTR*<RPwV#zroa$`y)t19gv>(gY@xGRYf_mldCuZ3-V
z<nielyV?<<gqR~-K3|j9uK8~2N7Z1)tLiTLQz9lo9K*7k_2$MElBpdWD#vL(lyBC1
z$%biR-^$RbE3~!k)3c6gZI)GV9-A>82+B`#UA~<5<el$AG&*I0D*hi0qn>|uj8K1|
zC}3&kdimn&;Stv1^yb9r(F<#K8QXoCot3|p&6ifZd!ji;#-PsNvcvXFL6zONQv;+`
z-+$e=m3i7ZUOl5&b;~KX?JOgP`tH`L!d9vMEDv48^n0w+L`x-ev%)Uxs5lfbj$+>N
zU^B{1f&b;j1*x$j;uhT2FUl^+UeBh&zIxluZa*9@IrW)qmhpx7%VTS$Lh_e8R0zn$
z_xxb4yC)oeCjL>KHSk1j^#Gf6A@};#(!K7-?l!(RK6g$o@#px}`cu2!9!XyFy`$xA
zaSm2kIN9@^RLiEvAIi&1m`h8OoLw5*{cW|6cEu@=Ol8!){H$}o$j6oac;wZ}o}aCs
zwy*h4U28rqI(828@=e{%wnLLI%I&P^W9rqa?i;Q3U{P`PKD7QDmtA_3P5X}Evr+mR
z8B%4Vhnj7oDne8HYq$Rl?(xtZTJzA>D5C<U@h0%N_?wOPf%J4jW{R|Q7b*ieImGE{
z*v!fbxMp`V`DfFWng$;|eLAz6ErIciF6*l_iJ-f*he9?m56boGjP~^IfBvl1qd5(|
zRU%5)Qt`E9{QX;fV=UQEuDqW;BbAbBaW~2FF1LQv@2Au41K#h>s#~Ji&rLWsxNA>N
z*S#G!<F|CIqkI3<&8YNombtZyfbRa99})YlL`_<C$DT=jXc*g>HNj<++;A*#4}04@
z)n?T-Y(3E`1JR<<Z13XJ>vykQ{X|_cobd@qC>yr%7_+gcVmLAmE!#Hf&VO$Bg!a2-
z+nn`ZUp~BtOJMoDiJXZ_%_E_l%M$b(O_d+)a$3QA<&xqG)+^!>>#TJuxc44XT=B(z
zc%|gjGp<=zCV$$EyXbc%ge6#sRxICaQzs-|z;0O}mPpU|VQ}qr{`*1V7BN=Kw>DO;
zu(&k8(OTpAyTdl3y!yERk6aerc59PnRN<k`exfSIiQB}Up6bc)%-h_?!_~DrMcvZu
zsp<8$HGJG!o@&0iR(sp)spU5A3ETD=ZDaDmM*qQ;Pl6VVXyXeZ;Ro8|G!Ga01(*Ds
zXlmSr&FPG;kF+w~cB(KeVeoE>?np{o1eH~`w0@&aLLg^5`>$)xmGW-QqB%@I51YjW
zsRa0zta|bjW2SmwHR~6X0wLP0>SWWBZT4H=R|%ikBUD*3I@6UDEtq;#=y0?%&|gvV
zR{L`4k!^$CKkHVk+4Js*;MOsWuJ>MJE3JGP-_4_&_cg`x8(JspvjbKn{4#&-JF~O~
znN&BfsKB+X9B5`iYqKiu3x@*N5~)!&!%icAjrj+QwF0vz%?{We83;dD*RpL>R*mGj
z^DT^{rfbg}4@_GbnW*$^d{{mGyjPTS#(eqN6Adnpa-_eyZhjinquZg9qW-OH;zika
z#rqy+hPfUcDi&j>&%fP#rCiGEq4Z7e{c;Yk)5P+U`@@~D5A>I2D)f&ueQ7It)^a3?
zYg#n1zru^HCuZC2qh@rn{2MF>C1+hKA~|M-D<cm~WpD83KEr3zQ)3}H^^0q^j%)TS
z*R1T+w<DF2F+G_zB`Zvo6Swy)mscOwrd@GC@HD58c<6GrOOUJhLat&yQtQAfmk{<5
zlaw09Xkx<Y$%WQeQ8f!=k7A8%D=_%rx$=>~_Afv0Ugvj+m1$9lv)4SSctBJ}QnNzL
zgIVY2$d(@?U$=$M$RGRCp6ghYS<mzR{gLlCR_GpcYS-D$T$GyAA@bgM-)mdLTb*oM
z51RXW_W$@&UC6gf{!O->p?v9a)Xi7TRV6=?<1)Pu7Dwr9{4pZrClK}F3cb8N)jI?1
z?(oL?rgtmlBaU^=MWxZO=KISCSf9Bk6OY=Oy3zICOxaGOaesa5lYBcRceTxwcg>A`
zh>eMx)%47`f9i+i!@CU?L852tPOE&f9F6WBNV)npvSBOD=QYaAR-eSfxIG0!lWKcJ
zUA@!j6pjWf7zHaF4ps;?J$1y*n^U&Y$ht7Lc0^^X`hjW_%N)P>&*4d7aiTSC!N>a_
z^nO20zf(P)o^{NOd*^kf)qRb@v}4`KDJ(wpxVHBVyWI8WgG`C8sbLrQN7ME6CUUZ{
zMO_wraV3j^W^a*WcYWgW;MqrS9)8)W6?%A^im+A;%Y}DLV;(a_yOhIDz2L3$mXmf8
z_Qh_SDE=H#l91c;^_c&pS$mm|THWD}*U{Je?KnL*KHXieTUftV?2PpO1JRkC&VwQ`
zGcV@#Wb!%(uJedGi}}qRj*i_h__#gqv+>z*elP3Z0ea;#2Dg$V`54&VbN4zF=hg0#
z4iPAM_9F6=NA$9lmKCn3gJ%qHR*Gk2J9}#UWUdSrSJ-u^CzPu4dQYfS<*ZB}GTtg(
z-@@3OC3IW;Q4r?2`Y{%b@2cz6qN<F9MxZS25naGjx&Y?7r)M{gU@pslc;k|JL1p<T
z*WHR{)F%y?yV+lF+Ujl6Y&;Z3r;)9b5q{+6CD)kx{fXPqO;295g~&@K@7yt3KXk$Q
z`gRtt)lZg-6h4n_c6!+HG{<{2y4~Wl`u*0vtUY_PTU>AbXr3H8mFxS-FgL__IwdT&
zndY@F{antZS2Rt+-sim<*Jz?j(z@DT(}+Bq)qD1h|FE=;^j_J*17ZoXsdf__1x4vB
z9_J#CeZBF^$JO88e|)I#3uj*r{V;2UQQ18ci+hh6BrR{`3p2d)m<Tyzb+G#Twwfrn
zSnsbld}Q0Uto7-*cZL2+8^e1o|Er^Y_Lk`IH1Dbt551+<e@$7d7BOq7Unqn5*;>n>
z*e3m?f4%%2sd%Q#SnCn0$G(^51eaS=>+AfK>=RVE6~s~~kRed;NRe-PY#@gwTIjKd
z)A&)1+Z~0|Up}oid>$~9HzvZMdpxsI;htCm(`KVHwJ5`LA8v9nv-O-VJK!6la)0e-
z$DFd_@I<4xhol-C(VKbNGJkaV=KIx%X(q4V@u7IMqvqudYk8BmXaD?>($dM2g!9p#
zLa*-JS^gpEORm#gS<mxdlPP)bXI$I0C%pK&;@T^ON?7Chk_~+>kH?9eJh^P!MIW1y
zdu|1c7oYe`=F@4OnzQddO}D~U=QLe!qZu973#DLMTbB&FQk~$VY2{+?x((x_eqw5i
zg5I4vXF6H;xo}Tg#Fiw+15)m<Q+8#WJ3s5)ckQ{X`RAM)lY{oZA8TthS+@5HDsQl+
zH+B@6&baDo{yX!>+zUSRVe^hvjj7`C`L&Up;-BO)3QtO^zhB<A4a4~4C*y03BdcKY
zw9Qr@E04I_N9NZ2^6>RYmjBgTH?+S+?Oao8qs9X+F1CohZ$rl4-@7)KZhUD#7Be_!
z>5#Mc6{gA(t1N2QYBjyCY3kIL=XWtqB5Flx_T`E7xyd5$ABlea{JzFCIgn%d6@D|8
zWuD4q2N+~lQb)e+{&IYH^YP)7<HKK2Z*sKD>eu9NvlN`V*4h#5bI-C8d&cL8p~@lK
zT%m%Kw^D^wrye><d1s72-MiXv+MskoTcWkFuyCm4bXKXCXZ|TSul<jYcIC_+YIp+-
z7N$9JKXZwn^;voO8+W)IUOMe)IV>yt)-HT}6P=Ck$zbQ-jV-Syc?Vy<`#hg|(pp;V
z=XzHUfwvfQd+QsY&Y9|G4x+Zc&AIzteC0V7S4E))`pmUzRp~Qzl{1r>{)#uF-qw$a
zr0#iqqD^{-!pu{Tr#v%lx4wthFOLqacxLz}u1}id?R&bn4)5AgZ$s28bv4Gg9$mf{
zRI~iOYQ0e2-L>JliRrcXr7zVLkD0WWs!Wzlw*Rhu(3<^o^X%`pR}~VQFC_X=Pjkd{
zR{4fy#Bkkxqh4CI?*0b*uQxr$`rjQ?x;~ru=|l0AqS2`%A{v(_GEbg4a`=}(r?A!X
z%trS9eMRr*4fUVcq^esQX%;ii=(0}aJ&Cxo<{`s&!-SacS9#yXXSQ$MDc>kay;G#o
zg4_3nVx(+;wodq!24vzpcDdL-L-S~+QK`S<^r`uhQ<ar7)3f6<^KS;#Qtt6~#y;$-
zi~8A-aqPr9(*l3KfZrqY^SwiSxEH5S_YTGU7*+CRHEwmuU{uR3u-7{i{G~+yzL39u
zKAnE-QC4{!eri?`9dmAx7m8<O?`Ki5;<Ij<_Sk}DtdTY=CWkL!>|!16cvJ`|Bp7B2
zzu&V(?&A7;%U@xn--fqu-jtg;Uq8>T{i5Lx%I2JJZ(}0^f1%;?yH{_^o%BA^bT-q)
z(It`Q_aT){CMr_(y6Gav_UTu(4((>0x3Z?T7#^JxsK)qfsJXlB4&`tcRt`PTpS3}b
z`wX*9LZyYI%uM@Acxjy7^!TozT+xepmI~2&mDDVapO1RD96Ws5x_e|FGO@ObGygxt
zy>omeUD~jlbUL<e+qP}nw$(w$wr$%^M;+Vl7#-XF?e2Nzotbau%z6JhC;4UX+N)|+
z)vDB5+1cy9t{dCTU;xKP!=S&mkAC3?y7kpK>l5lqny<>v?oZ;yutp-M2Mog$r9CC~
zb%{{jYDZVr;LC*iGoopfmV=1NvAG<c>~(cI_R5L;`Xg_!^U2c&L&E2w9`CW<Zs8^L
z683jVO=}Gn6fvk?>gU9=u8YEkXp<h2x~>s+cMzR1M@ceA9pNszL=K)X;;$T3Va7O)
z69h4wgZ2I#f4`=G{*&2FkV$)IaMs7Led<SBeQ1HOQ2^Dd(MCMv4S+fn*u@N1@re*c
zolVejU+ehQIa{<`rlMFe+q-Ert5m_zwwu4RH7~9_?PG78TU!{bebGgnaql(0n%0+b
zPUGF(-li{G4IcW4qxb&S8=JKE?4Pqb(9*1aO!$IC^@I?4C=~tP^LZO2sXA<?EPKrn
z_Mt=M?CRT8Zq>IK#}!5p?n8s&PiOz~sX^VXs;Wjx-2>gNMQt<X+RqNvrcyf<*n;KB
z2(6gck>2y-@X6PXo5sD9r>mH9+<|L{BZoF0Y0?h%&Uaj&XW>NA_U+|a<Sujm=f|yb
zyV}yW>MVRY51S={5?Vb7jPuc*n4R}`L3Ky(VwQ~SRZ)8)q{)})%x{5y3N4ovf^THg
z!^cZ38+6Y25u~1U(ul*<uf4rDG(O8?#&^13QUg{GiE$Fmv+d)@yn=oT4x*`wpekZ>
zws;-)&K$*lL;<=agwL=PW{_<ag>Rx>Flh1mi!@|x(<)K(1pDscQ~Gw%uXE{Fei?q>
zGvvEKa6Z4|#5?#C)m76A4a)hGWd2WvIbn7Oj(S~`@Ro3F-`Z=yv3ckzMLiUUBs<lq
z_o1oziSV<tvWiAWCC#3-mh}p~sE9&g_k98V0@Otq7<r?dzAg`%u1#6BEr?15#@0<E
z2y4@!0GrXJFv>2f0K0QGy72hBri<{n&HC$1bZlPcdW+rHgRuy8dgf~1WW&y=tc?ny
zUKLTk@rGL}F|5~nTO02l*tPGzyr#G+YqdwXT1)w+xHPDR7JCl`vH%>#p%#wWe0LbM
zoPt~knt$V}5ZBjbAeQlo5tct@AU1R-)J;vQQh1!^p(_ezfKVt9MrVW|2Bsr!XPbK?
z5GIB&Ff=aS!v_X4%iMmV0V_#ll;{RFL&LCB7S}dBSwo2qbL)Fapcb;JYCC~zn45Y1
z3@UpimMCh4`*-5&V;fGcv}@4Y!1!Z>smm~uvjfH<6x;JocHGT{&4PMtnpo)U<Qy4+
zyXLh-A4Y1{X3|7kA!&7<P2A=RR;<L~bNl)V<m8QzAXWU+3ypWhncA0(*}U1+_5K)t
z)t?b$RWihEfX^1Vk5${^&6*En+~WPB^Yn~N)Ydjtw9WYDx@hhf9}OpjQ1M2kJRM+j
zI+Aa$;44Gbe)Mthq<sZ<zA^yD%c>Oo#{kj7%}s3>L#K*3DWsJv$hiP<!=>7(({n)G
zt)inZ9TUN>Ccq}A=uDK@d_Q#u7SPS?bI=VZ<rTcN<>EzPhidFoF5<WG9p;fteWXG*
z2LJ4oiz7a!G|aG>pKWOqiPAo%ImWFyXgpJ3<%N*Hn5aO*z|}NRN8Q)jYE&agdP-V%
zgG#)n_SUo|TqW4&S?!s_a%_0?Qnu2l`?2Kp@)ADe<?<)5%UYLsr)OPvsVd4E7}Eh^
z1Aimqxr8jv$q6R|7WYR>5A4pIg!PxM&SITb1T!yGwxVm$QETpfrli82!q&lu^sTY5
z)zz@qVmBZA)aFEKRg%Ukm(~6rW94|Sc^WR0uVtXuVkS6ow8s9XH|!$csZxlm&~;|7
z!)De}t<*l>d|pnC>ekd(v!4k>KUrMFZx>>-jj$f)J<+gINy!R`m>~wlwiu@Rbm(gA
zhob&OY8uBj`mruhr8Bhmx&(%<=LtSP{?qh9ENyd4&)^n69wtmW=cz_QGiGnah$2zG
z`h(W>yA)zeWP^38p)x1uj2-E|dRgJm9@*mb9W^YhHhY5?m=lvlb@i?{@}U6!_3Z>+
zK3z+E?v-_Kk18Ln8xImeeShfn44+yRP=kfcl;X~AJy(PSW9eO3n&s}Kz|Q23*q9Wq
z@u7fuRijMwQ=o7zI9Xi24J0NH*za+UE??j^b#O@|k&S8Xf^YDOojk6#ASHzxO_C$t
z3>MH=#lq|B6`hQm>%7Y&>@G4WJK8Vm^oEg^*I}|o2tr`SMhs9e&&0sQ<NGvCu*5$8
z`ghjk)GM=Zyx~6fTNunR_GklD7t0M$WbK!*(e-YcAzHSWNYedXmjKa2qXk6Utqw!3
zcDu|f9DVe*OiImck{aCS=tuWX5Z+F2C}ugT?_LQpG8^J07T&)^es)fO;a}Y}LR<Gj
zI^R?jv^kee?Cm5^rn2LXqdecvIvZ&&`W^wC&3h*G&;%9xR%&6&vc@)t36;v$)D)vy
zKr?0FmwVxTN7ZGsJx?u9sw~lHbDK8#IQG%!?StRrn;~4$zqY@SlkIy|HNJXK4Z4)j
z>QT5mlSHc)e$-hyxGyoAd}*<$jHl2l<~@ILv2ltYr#mVO+Pj75h>VDm3G_vUFEO>-
z7*?yIb3*|cuCD32P+9rz$Ms$#HGd(MTHpJQR&CV$_tP~g&gcsK5kvP5n&syE8<|sk
z#pRZ8#n~FU_!Nze9U8PT{OpX3hSzGT=&_3m8x!H0iMiS2+SX7AOm(;b2D`EnJ=QKg
zZL5X5n&HYd?PWnJ-Ijs^>Iy`5Sy|tQ!5enGH@w6x^-Ilne3Li&URgfUXhLWAQm(m@
z@}I6ngaSKxL<vuCUf2d&cxndxmEe<b)K}Q|Vr^S(gV;*C-?}I89i`*m|0+;@O3@6l
zNSLOpQ(Q~cs5XnoS608$Q-hYHXK(1F;#obM<S!30(N0*~DJHWuMpRckqhZ%l8u^xz
zOQwaD(I6sa`<1QK&I&L)=5AHWgBy6go20&y!M!S6ZgpU85?D-(i6SgHeX49Cyq(6H
z<WkEg>RaDEM`f1K{%}IOtR4e_zTRz7<IGx%1KKK-0OCB>wWId)Fr_j$alJ`RE|uiP
zPJ`mrZQ;E=HR9K{Y7gFZkvDPtR#U0(Ha6bcGCu=13LN|-+}$NM6mkYGy+?QOwT&Ck
z<^ADsV{+hL_~28Y)WM7g6Q^&O_;7bqV8pLfv0;*R97J~Uv4+@gLN2=UEghFCElT9~
zmn)CE?|Bk)&3aac9Vy?3yw1vg!N=g<3!&DKs(ngaQ|h8<o|is@L3u4KTs=Il<FxAH
zR3h1+u8l<*Vn?T}!OK%;uZ~4g*Ed!xz$bWA!k$pl4b*9^lvYhUb*@Z2_m`V;!^khj
z$Q=2g^!BQ1v$PMZee<K+(0;fq_6a1%yqH<D-p^DKf#>t-wm?WJRBVY(5SQS?k4u#!
z*msOBu1(N8+!4fs{4jUE!4St|9x;aVq#=m?=T9pGc$TFDaiGakD;;R0b1Gwp1Wh?J
zXm8(b?2Y+5a~35eIkuPWD6Dx3+lE5q_UiUAQ=si-hgxC3gRFiy)X}3igzmA47Ys=P
zLIsn(=V&uK3WCE=!UH;KZ66Q!F8C*GWi)8(zuIUM8ZBGMwD`|o)R(zFgpqTvm?0K!
zUJJQPxHO4u5DHei4|#sYCK2EVMvpwSclA{#%&j%;?Mx|dC!V~n6NQtd?XRAG;7Td7
z_=;Q81a3)Bc|AmlCM_>7E1wCnI^wW#!B`oixH!zmR{!$6)TGUxKch`+;t}wg(Y!qJ
zSO#T>R*ZR&IQ?CFurGnu=)}~gHH&T7#<h3g^!46n1R~Pl$uS1Wda+RXrrT^<dG(-B
zrMZKK6R*Mko*B@c^~LSL3#VY>{7Nd=)f}b2I35b$4ZQZss8+6z=GMHy1o?<&_sFQ)
z>kio-C(fH6hp+D4WxwWh{o=?jtXRanp?vT=FyA+>6yN96&p(Ux96Xpm_TtP@H7gFT
z*eN{TSEI96M(Nbyxrz|~b((H0&*OOW)6eZLb=xNaqO$hOZRX(pd+!sp8=3>{wE0;0
zu*PDw-aV40th7yq7pF#OVY%?fT119w_ljKvg%<UhNsdl6Q$Hy2E<*vdm`w<xx4|GI
z#x+9Jy;U;e(KE0>N}?2olPBu>VC<0e8^b7p;#D<|QQhYP%3e|nw$FE4Wpppmt?zK}
zS6j06Q(>azYZY@II^GnfpZ1POmOheOl%e@IEsXsV(sOB3jSQ8kQr(k@Vp^2IDa(tT
zk@nwC*GJ`bh>7iUpC)5BZc`J6zoDFy<oe^I@{sHqTo6)DH_(o^1Qi=Qz8w4v23~a9
zRFPu%rG)xn^PXpodR<JlyGrFWuKGEp0%D|YK?#*|X<Gu$`I(L~`|yPp*ETNept@5#
z*{F;dXO)Ky$tJu48j3LqGW4?DypSA6-E9k!?SPuJTP~Lw_s*ScLoSyZ|7l}Vx4HOL
z?~A_UU5fd|w)C&?+;;V=jW^7fPt!g^Pa`irn}^6N7GpsgqN%H<jb9*=S1qe)c>1TK
z#-6dcYj?jk*YnT3xt99#C<ws$HQg9y0lDi<>`)&hBT`1pD%GQqwvIlGj+O(y7V)d)
zU&^f>o=&OR$v>LH&GEM!J1-3+v4Oof)sa(+JGEPuzMAT6hq{l9W(S&=N~LR`fSN7w
z-rMVkiC)9;RDFEF!d&g2sL@<q26c(7OCF;+XA<)h=EukXf{fYoV*mG0Z03L0*Zhu{
z{s(RFH~Qdj4295tU?>3V{|%pDW&C>t_HTRw02}-bpWpyc75{5`f)gM$`WrmK3E(6c
z8Q9tW6`uH;_U4~sxBsqW`hS5Z{%*VZM|AmrZr1-qqyPWSO#mndmOpAa2Eb+b15^NT
z3IGWKNG$co%ftpK`(5%o#Qo3nZ)^e}JOo&#{=5Xx6u&q5+c(=E!zeqzGtUl?>H)Bb
zKUf7jU`M~p{<g#4TXF!jOMkWk2%mn}VgLOMkQ4o0{taRPUIFTI{&ik}<-hn10E+P&
z!}yJ4{QdcN@}oao2LR;&z%WdJ;{eo3+N=Q6-k)XG-;~E+$j6^Lfcn1$slVY7fUr{c
zw>{|(Nx}|*KUe`w4PXU;@BpwQza5FcoAwXd17HMY`(p?Fz1{B|(Z8Gi7X!k|`p+iV
zf6nvtUl|aVfAJ6LCXCtz3c!S1-l90$z|GRoNRk8%Dv`kHs$_r@7*Hr-&M<IZJ)pXw
zm4k!%;Qd;<tQS=~EXKq^&vmn+a_GXAu{KPvX#w{A>dPQwxdj*9iI_8~F)d?as#hHu
zSkJOKSP<rX4f<Zk(Rq_vlucJ>ygSfh06u@4>a2F2R#tQS22G4HOd4stB{VGZpf-JZ
z522H1qu*k%@nh+ovoZ&B`zMSJF}2gY3@wfGrhm08JWYbqSem$~A_^nO{70vHf=O!4
zb2)8^H)Cwk0+SdQqGdr8g}@wNLMk$D{FmT;>LLO`E?d<mILXu^i4R0dUK^6+SQU#d
zWvt099o!4NT;6UYPtwt8;AW}q?p=CPZOHT@neBl*cjp|XIIJrtD5VpEBEGW9xP3y_
z)Oa4~mQdN^4o_0|b!_|2D+~kYX0)h*;J$p@JuDa=H>;dO*=8TVAD1=a|2{JPo1^Ua
zxbzz|`U_|JH%R0^cjNyp9|E|^{+$o`BQg8uG3K96>hF9ABO@S@EnpP<FA^&@P9^|;
z^bb5_(+k!^WwH68b9(JH>v@_panw(ODQZ9;0}1I97!l0Z&%mOesUfjok(2}ws{)Lq
z!ixnV^Jl381lN?TXqDD8mFVH}5TEOboJggbK(&kWP_Zd(L0aO@zT~7&aA5U%zw$h`
zPe1Z(bEU6ZSG%A4JZPGqH$QM9GXT*o1S<FpoOK0wZ*k6kt`i4Vnbv2r$K(~@266-b
z_IOy^Mt`(HodKc%4=g2k-e6DHel+z4^eq=G>CAqsxgjO@X$XzLl|N3Sq0Vd+B=vR~
z4aAGeV71<%uM5k!%9P<76;PC3n?oPZIP};#5H{$KieTvrZ-e2z@>QS%kh7l7l&Rdu
z&Ar$zc#2105696i@RV{nZD4;oAWrvb?FJw!nbXgCblP5*KHcy;X#SouUshYuXkORt
z^{9bpegQR|)fHRX>p3Uy3ea5yL4k5<{Qw)pp~e0LgVG{$>CVtP{W3lXWE+kHboD^}
z(+gQtn?JLnPHfg`_1@2>gExPlsDak-$CZy|u-R)UyjWFRLrrKn+c-Orh7oUgYoj<J
zkRpW^PztK$iS7cGoj`r1T7!e=j(+y)#99N^XGRQa)!4f_+BGD%60EcLtw&%zS}vJb
z5p(<=A#e^npg1_(&)6Y^@W_mi%Z6ZPyKXe!h&E!AySstFh_6U(@X&VUkbm;t-VZN(
z(B{19J4X$3Wf=?%42!ryYk$z=^qTjogFSG6r`}6m9J3<5)5o)?u%8jp5+C+J%0=hX
zdZP4|Qi*7;5Y8^DQPZD?sTSfko2A*K-EM?yhHL(aYc<~S^ECAtTt`iAZ6w>8vO74Z
zcovG)+M2?ec+kf@>g9)j^ErR<>wDPjVXLp@edFh_Z(^-IK;4Q7?80?DB%k`ekbSww
z?a57d<wkQdU%Pj15!qzJXfF<KKb*l=MP~OFOm9)~qlf`!dR80t*Fwh9k7!iRT2(KQ
zfnK7+V=XyqvlcG(!yqqjbG0iN#Z@XM?NNKn1K;hFU)Ua83}0R*BC-&qDKj_NZ8Y!q
zzg?X)Qfs01Qp(oc0roIX7Rq>ARo%Z$^`=~@?R-c-VYz_qV~l+dY79cC5h4%Y$JDs1
z9_7=^H0Xsbl*VHKPm{N94;^HHo0F*AV&Ozx2^VC5jThjW#*Pr+<00os{XA~2`b6c7
z<&0Ij#B!K)M3bdHKlZ-krWR~3Xl$wnI9qj^G0P!Y)U720Q?V#r1x?GGO~aUhfjt(r
z-<w}x8#;OfeIM(}5rCN5nRnK*oSBHgrq=pNZr%h&u5RYh&1qWwYOdCFk(;$sT?G^L
zBVv+;ywql~V4;VT90tCRl?EXI57X35)S96XH90yOarDTx+TLcu;!aiU0O7$;wC_q)
zv`!vT$V22NHCW?)f<fi-)+`MwcloG#;z~^p(4e%|5*w$GWo=9#Ar7pMGm}_C6g_o9
zo~o)4ByJ&&utJ4?H$u0hYGZFll<7Qd@p>>nW40Gq>_Aov5QV;OjtDaw*hiZZenZag
zuvW*<rFB^!gAtbWF%7LdrkBJ)uKHQQYjtqo<*=>`VyHBkw0-kusX(U)M$+|K<-!u_
z!Dcwn;*X3xQK8oyIp39Vpr>tMy<vKXZ#81+c*?T|ba-OBIVQT}97L!3xEvrWle5QI
zrD&J-7&7WXwO6oQe(1rO1rA!y=I`%X^2AmHU3^oUCCp)YC*%?dZSyY$hEWi%5WlT&
z9q{!I=^hcIV!mQ)%!gy2t#*OWHiF$4zASaNP!m|xh+-EFJr!&`6mHZSSGzgAGOT&v
zI`Gw-blc53oxRBO%agm_WoQYh#qiKeCp8Ph+=*&M)gIWMjJH=EX6%S!^^l1_)6$be
zo{8e}#myOfa9GrYGN42?WK1cLvkAjl3D1TIgKd&5kMsycrCK(qR2p9@)NBtj){shM
z1Z&11m@53rTk8d6i+aIYnFo$x1{Ox@9;-B+;AUHegv_jo#P(GK>9j8$9BB|~VB4-u
za024i>xmm!TVMk9FuU`EM^xsHnOyB_8i+4KV<FI>&CYd|AvLrPK}oPDs||5K5ByKc
zD#d;*w5lW$()+3cJ4tmCUAjEKi$cGuf@wO|@M#jCmR$V~4N5xJ*<vr>dh5704N3IC
zE^CDMcYDv>%hVHl&pUNVbdvXC|0(a|dD(^MBgz70CG)aY-j(rRJi&aN>co7jB1cxo
z#*%(76vA(kbK;nH`9+QHbC{BT8{(z>63C_W^Wc_uA7n3qMcdL|mnsP!@^j@RT<zh$
zkLx7Y+>*VU2I#%A1@7vz+{Wd`fx0eH#mEU;zT;$DDR(K+YoxfTcV>lzTN6dUWJ-(^
zwpK*MmtThzC2OU*8Y1)(@319nrMS9=DB&czC{Fx~)Je{_4bWeC?-~Nv^w!ANNV@Ng
zl07W(y8(ZYHjdEg)n+3Fd#2^RNzYeB@(;szK_xpg$s;yXPxxCnhHevlb%i^vj@9X`
zT<3eGUy5NKX6Q+H$xn{#)+kR_ap|sYfX^Lfr*jwwr$c6#!QSsq{GU#!ytoAT<C}En
zVo7aZ6*E@Ug!y0c>3oyK_!myV+198|%4y}UlZt5NtUR59EaLC>A=Wl{6m7OdGILhQ
z*(AM;jFUZ#@Oc%d+4)Y<u`4Z%<M`=Lwn=y&%Jg|!V)5>kZ@qdgawN6^?b?2v0pn(^
zevB-^(%QBNyZ5zXvB)kGC*h^Bv<)O&lCokr_D)!mc&SmO>fz4BOHla*RQ)kURj)PY
zt~Ogi^U_kph0aTH;wwo_Lfbn{m_j~tgCKlG(mO5qcz*QQak545E2YSrgf_A1?qb#G
zgsj7R6v6S)MvE!vBEiKRm^P)U%pXm!#QvgCOA?x7Q6j@nJSC0(1nzh@h9-l&Tx;$;
z!7kGpy|ulpBE-%o+AbZi>|s%pO+~8eVG&c5N$NvPEc>O<-!6egdyYnuy`~^N!R~4X
zMsm5)zfEt>_0{49A%l%oRR&vFnY?{yL8YUGMpcK}a*U)kO-cB`w7lR8esb~LzN8(a
zCyXo=>mUicEEHv5UUI6O3_>wjatO-j>Muq!q-10>g9z*RO*cP2heC8vU>MyCQs@4t
zi-3g7KrrevfW@aj!9qh=)+s@f+zXk}kQ@>#r>M!V6fcRaES<-YECj)0)KZ#t!Aj1h
z6O%3Ne{)f!DE~%*3Ys7W#$#l{bx^9T_l@{Q$ufvlGipWr>rOb)k9+|MMtN=>_Q5L=
zEIT=O<Z0YP^!9`h&BP%FepuD-5%~!r5?C~r3ZI@6rGtB;YNQBqi@ria8s(AL%L#a>
zE6Vvdlq#nvQZ<mk#wDf4lQEH+3ZP?JCecyKDpeFE?JLDA$&E?^$LmN*;^~rrjua{r
zxx^n6wklF>B*35{h*6$ELJF}<#6HpW9UwqLCLvsBk6R+sfwvR&ICE9?TN0axf#x2;
zQFBhLU=5rn*esbCCYs2SMapH6B!dP~NqU4O)d$ce_J0z>l!oar01l9&8MMM;tK0bH
z2l1<x{EEK__;87P=nJ?3DpAW3dOwOt7FmeEU}FJ3);ZQr!DryiitlGCizo{mvM^t<
zrYqiOES4eANz3Z2wI<}|WdtMV2N5i;tCrxS-J%^71HguV-8{*Sqt}Abpeff4S{jX@
z(<9Ja3(27V*&8%c)lypaq7~HA@7=NHG(QLz>JsZD83fxk4xQPsDc22I8bR1xS5^OY
zc<iWO2iM5w4{6z(c2Ez$EAi$uKmJuoJYgQQ(V0uO53@9!(BXUIl&?jTbx<TymV|4&
zksDnqW!o+b<L4TWrNzI_4jQuquW{a0d1en#?!{C2*N*ax{S61tU<Od4ejfmF8tbn{
zVvI=2M6HsNWe6DoE(!r-j_g^eSf^MU1tFqdEV<dyby@(q9J26_aC6?jYIyvRmy1~?
zCC?Oc`dx!FNA}{c8khrfb4G5KmL+j$fRmMoG@pOTpRGZplad$+o0v$`H7lVs`3`71
z)86XDU(H}rj7vss93Nu}t^%Bwpc+r+U+oY=6Z7t7<gQ&t>2l1#_+-!X^Zai|>5HuA
z)1R0+Vg}U*9R3^n^vhodxiXxKBV_C(6qYfR0IV^P;NdR%+Z7HXOv8g1Jo^N!3<3CU
zL43Nl$@|+16D%qX3ij*ZT}uQOlU@v8UvQPf)kzwo=>B;3W050?V{$HemqT(ay@5;C
zE@;k<%i^dD_ye-Z``BI|X<R4<(c)Z6{PIzPqO?o!hXBE^yy%1k^q*5w`4cetgrAQ=
zSlf>nO(`*~PrK6(%cy^ds1}6+qBwH689@#y0tGN&g*YMD0~MhAp%9h=CYC`w4xPU|
z9z9j&?p^x-sLG(YB7{H}RH#4*$S}|0_9IbFCW+-9Vwa%AI=~Zl##*YfTxs##`#yOZ
z(de`xjz3n9pKT7#?~#jp`q{YkVM``(&wOYSD~Vh22l9#|rW=JSGIJalcSwJX(F!A~
zn@WF-Xq_?XnFctw7T<90JI?kkr|-V=n|s}W<&;$9R0YFo_P!#^wuSpFMert8&TLBv
ztMvkEcEkSrd_&Q#@xy6)<C*HMdMFagb?FlxMjC#4GQ*>JJ7Jj@#MB-k1aDB#9)#e2
z@Q*R(P5K{98$*YnBAm3}SB<imzn}Q%d`KLcWNcqy8aen!BZ}qk9LbN4o((y9YBzRO
zXLXa1CpVr?+Hm{a_Uq$!5sBBe*6=(nL%XW4Xgdv}I`=e7(b=oW`NtVdq0c&u;HMwU
z-Ynfz)^wF-d7v3o0W0vCVDIgLnQeTT4fKSiw>DUG!d|Digo@qL9vcpWLr@BI1C4b^
z0VR#};E)p+y5vflhDwiBYjMr>({y=rhD5oQ<@b|w5%>x#4@TZU{S8$8Ex_8hPqi0e
z<CHveNS^JmH69RBEYhMB*OJ~mN33SpY+?1J+M&9?diLU-O*upyukO^+Ij@_=@8cF+
zqRqGHa$S!09Jxo6s|L4GjA*Rd=Yowi6J_RL<QAM5sLi_AkW#HoqgrOP4=cYR&1Y%|
zzE0`q8jow)+j+FBd)~i1aFUwptQlCv>{HkC2!l^amu5<kmh)hJCbcCqrO)kll3ATu
zM#@|N?Q6W1Z^zcAra{NPjk>vdsqe?!^OxSpXD5T>D>RZ)l4ygTuMzp3(9mMBJH)ly
zzL7k%@C}eQ-)Prsb6ai?2SVX+YdqYnW@qwkkhQ;Gn9&M{_IS!F;H3`l`;G1OS$~_@
z7HxZWQy^eHR$vRY2ag`4P`$i3!wK(d%zh3J4q+dCy-+Of?i6#;xmdB(6D0aJKIEvu
zxZZV3xN;*@cNA<eFZ}IVVz=%mVc4UP!WJ~J7sQ&k4`%QUQN7*hI`q&Ns|Zn!e#We0
zQ@~we8bTlMnPk14oXwl>K6FiO{1iX_{5F!zs4$`L@Z>ZL42=|zEn}MLYSY5EyJU+N
zER4cY%NA!!dzZ#{cEQr$+BrTEG(kawq03?wH+@O_LlQ4%90uR|qv!-&n|<Wx%57>o
zk$3Hvn~ss6p3cU?1AEh1ocFK%4`&d+yeM+_YwuIOS3@gXi?vJKpj|K5=xnw)9~~{v
z&v=KtdgyYDZs6jW&Bx{JNyyIBajRN8c`qMz@#LLUu(?ZDBo+gB30YT}sU54iCqpmw
zqx_4hfKP=hS?BqUx|@f#%hT9HV)dOXcQOtFzHYv9J?wrz*ldi~lWbdTAI?YDm0F7J
zq}Nj}DvWx*S|yOL!h{tthSZJ>eE|VSjmF}QK~3)~uoB(VG!%4_LQ`I=dA^p%>-ssW
z-@xnr{k`Mk$X@69)!gQMul2mQ*iC=vWndX*OcCl*v&CR_-8)oo`F4hxwY9gwXZtI#
zwR#L5Di)8&QdPk4B-EYMC8l1!mw`ChP2fp695pMcMrMK*(i&5aRNy)<>0*Ax$pOe+
z%~U{u9djPnbjGp?3i?r_VxUo@>0#4GNX-)%99GsoGnC~#F|0K<_A(pKoU_@Ja&xWU
zmkSHo@h}C6QSYPu@)+dHY!$pTRl?Yj-Vy%s0cSIN27MQ1oHO2m_bxcg5$F=`CGN+c
z8o4d}?csN1)|u^f8*pU@Ctl0>#~pK~%bxGM%d}Nx`0ajc@MfcSo)OQOy^iBi<+1AT
zMwdND6}ed&S()QCW_X8&>hRbfV}tehIDWTxZPz9Gr(V+zt*2k{t|R@)yGIW!8=BhI
zR+N+a^Qn|!THm$i=?`IlHRwn6_i&?Yu8-32#23_cTG&yr6cisGx6AA4*NKwx%+1vK
z`UnpYFVx7qm>-3#I<Ih~48pLP#WeLg-*hA6mdc488GjhX2g#s_F*QH$^=by9@CHrn
z5t<wt(yMS7PH#qvG>RNvh?=oPl6xjD)UhWN_)^h0SjWfhE^eCB(En;M`jsFGZXd6{
zFPY-JlRd448_PR)l_hGKQR(}%wm3w;f7oD@GJ-=x@vH8+$6WgoZkyiUybO=T$b(_=
zl<3wyfUI!xIw_ixs)Vz;qI<*myBvp$6j$d&u#MM<xk$k96=tv)N0I0EoS{daCO#Cb
z_PwoK{>rn9^pdl!w|8{kt=qcO6VDE>56gM@BVfH+vTso2CBy1f2pSyx!3NxTJLkj1
zJ&rh`?d>~;ek(f=tuQGL<a5FbvEmgv39TbluECOgYW-WL(jAv(()*SvxKP*HozR(?
zmR(9OjA_sK*k9B=CUM|mnu|1Og;2F3Dxj>PC{s`-g(4&rgN2~v36-R1g$TL)OKmDd
z9h9nNRLKh`^4(qC&_w36B#%~;dWg^{H8KvAqy4awslYE9EX<xWimA|~8xp9LXhp{;
z7}u0)7O2LPQTq)^BT1u`JSrrV=bKf=5wK`NEcPsL@QEXu8B;7-R4Y}eo4G9!^^54{
z)aF2piaV6XtAtdI^828wCx%%DmRG+|eIY1i@YLF>uaUiXS*~~EY%SHH^pTJQ8UXd5
zR-NA&{1Nt;Z5SHzV?nsCCv?Pj7!S-Qe&m)U)>zUEiMdNu?_g4!YMb|Q{#RVD@ns`<
z&wF<17M}n*J}a>$<hRrtE|@|2fI#I<NVOV6fshJP&J3qA+C71cnm&m-o!Tje8u_&N
zbT1#TbotASt<yG3uS&;xT2$}2t<GPkV;2b*Qx|drxNg>?t2GHzpO~M~uqlV0`zW7z
z^!F>DwR%XmGwjD(<t1|Bm<U~k)`IRJF_D?bVbbDM<?p-n7Ao(xx{J58>?>Q@$=OR;
zO4&+TOWDm?%-P^Arf%vh96F@sj2#W%M0v=A1rJWXMwak)xri%1PdIW%l*-b6tWI~`
zlIyhkPw8tf(QRM0>w6y0d;jD+)2!xkF-%{*IXz8)Jg8S4`uS2_0ixeqG39$+A@yRf
zhFZI2NJj<w(`)+5dSH<bw8x-eZC@;Lpvq3oz2C%%JX#)>yuHW8n=e<C*?P82F!0r>
zC;d1nST>e#t!ZagoIUIHY>xbhPPgDuzGvR?RArc(ymhQ~AOFDenGL$mCS^!0&AMH7
zYr=llbq7ZqV<PHcg-sorTLK&m!|pZ7p(MJJ?`5^Ip5<q(uBra!vl4HI-!vZc<j2Y0
zvbFX~a42!}@eVAnxQh1e8Rw1abNE{%4^yb_8MXLf)Y7OXPv$m$O-OLxga)gPw8bb#
znwx<@8=BnLb>5H2E`0vNC!Xou8$T(<{2k+E-i?_$J6+*{0V%IM)4q6T{9e6zCZlOQ
z(&a3{;qpY@=tk;Q46`~DHn*v>LqEMw#*x51A<KQ=VEaT=8<Anw&a4{oW+s-W(OP|X
z6-qU~Ou4z{cnrYYz2)hLPPq_+bJ7fti1Se|+(r`w*d*Ywm>H2}mQS;6sM07A^@b&(
z^q6e~D(9|un@@+OF3adKW~jwrJgl>OZ5=L_Ug+~)Q8CkT1IEPUWkZG(@IblH-G)*V
zbIqy<GwIQ>DJtB!WUEGV(_4}%^VfEBpSh0(vOxCd^{5m=5SxcH7+7|bvYPUYQ%nsu
zkxQ<H)lJVO2Xyqz&SDALUW+9scPWobl&R1f`RF7g+BaR!xS`VyOc6=E#SI%2)B3vk
z+a$y)i-qI<023~^ftJ<EQ#&8SwGP;9`^l~Dr%d{-yB}+jDGm7V>!Zs@d;^iW_>8;X
zSLaKgbxyR^c^jvXtf{Fo^fmdF98LLqUWR{NfDT~!YY)Q5hsF1)q}Gwl*kPRco3>6G
zwNl|!T)27OA(Mu7NW-B9v3qChl7>#`7}E*cCoDfHtuZHQwdiiSt>3WA_qHp$)#+Rd
zd*-#9ueV-$yrmaPxiVvKw?2;kX!S8&Y+YFa4sG8prKIYw?BRAAhJI1=DNwW!*`;ea
z$8ceAIcm6MyI5tuS@q6Y?{iBV-_p4o8>3!#pQz-t-5SU8r{7srs3+h^Qkp2OM=615
zBoqxEQvzyMA;dwbAP9!!Lp9CVLiN1h(!M(IT70}x<#bp!2+pTEp37r|*5p8s&{wR`
z0E|zIU)m}>)069OQV&}B4i-1rXPwnsL_fA;T5qj5(hzAHsf$*s*ocPAS{?hUg&bH#
z8!d=}p(90^kB<BUi@zyaAwy|O3;}lz8MbQD#{X(*upaRyR?_H{g2VJFz8_~^ba51!
zr}e>iEOPo$^Es3AmaH>*y)k|gjN&9|bY7%{bs)uV+6|_kfK3IHB&0%^HP^JQPy>@T
zV$rC2MroI#QKmU%y_D0gMMdLig&MbcjHu!ua?t4Kr&p*0!E676^(FgN5Xcr5(#!_W
zjFA@8b*E$<Mm<b=DVyarD%;3pQKS57IZavWXRD9Arxx30+U5vV%wWukH)B5T+jG9Q
zbMSTei<DGtzwXLpb@%Psq=%;24(j!!wH(?*U0n+ML-=c}wt8BPLm5X-S@Sj2%7Kk=
z3`)DU`=rmfX2!>Ismz2!2Tm!c;c{(NvTK3^t^~6)$XRT#8SA?_r&Q7`_?G>hD7-k1
zLqiv}-M5FsI_2@_V~ZD8^K8rN#}PwyZSy#mQ-U>ukm}gV(d8FXrITOQ)L2EG>vhyj
z?4&1gB?u>R8BIUFAx5{_={W6GEAPXCue#cd3AQ*qkKf=Mn@_AbtrPMUdJ}I3{{n#^
zR|Na_IX`B=?CpP0!~N%I1mV9$BgmTC+1S$pG=;7<hED$zjlld5nIjVi9blfB4PbHn
zAEhHRD;)<jCkH^^_?Orbunh|!IVBtCzeFf7andm`FmnQ;8UCLwkF2a5bbxe*fRt&p
zfJ{VmfP6Iok0CoFI~_aw@4QWn3@nUvtiN~ie}ymn-+6xiWYzi)QoMhS#sE0${v=WQ
zXF1+~z7GF0Px}9T_yQopf{lTRj)9c{pmqGCU;M3v{JXUCPp-ee8v5TRO_>=1$$kGZ
zXQ~@7Yahq}n0S9i<*W&%`Z^aY2~i$Q<hT<0{RPCrNTUd`AP(>85t+@l7&qbA@olZv
zCSG0CRQAX2JbXpSH*MqQP{%e;&^M^;dYXuKHY%E+)>G_Z5k1s<7O-RLbvPPXPIUd5
zbjGLfUYvV}U{qv$y+HPsJ^IuxJx0attk+;Xn;!|Ln9DOv@x81U-6vn6ld7p<+0q!Q
z={?^ko^o)mFgS_Wt!5ZH#J<|wfYT%^jYXB3YNlX<RQ`IulytRSl;1l#;~4dzGDR|#
z;4XkwluRPFB`RQ^1+%1%Pe>~hSv!<?Rd=boTifF1kH%w^MSB|bUJyf~EC_HEJU~wb
z|KhgK%DK5|cqP!sjF~^zIlt@gHMN(v{E*h%;R(<7!_Kki)+9Q3_+|5l+2WTEp!A3A
zrho5Z|FMJpw`ukNe0%+`r`7*Toc1r;#XtJef4(LD$$R?uX>~x{(C_~F-|i4L7S4Z(
z%{bTb)=^n}_;t}e&9l#$_i5}~mZ6CZn8+|Y2289VtgK=aCOstuNg5br&zQ@Z8C6Qg
zGR?VRthVOn4bUO(0^Qcx4mRsedO%ruv8CJMmwLY(=E9R|-`v;bgMs(9kms7_<(G@b
z<yG_PU56<L0ia_D0-(UqA#L=SGJDWCW*{f=B6uelO{NbbgADM`w7A@iwLvS<<UqTh
zW_-?)n672td+`19m;|!lB}UuAGcWx(@veNp6y7=LYMVYA#<d=i$1>UV--*k~>M(%i
zfdEI*Pvml(H?IxA<%QyfEuf+8A6%|~`GPC31az#ap%I6^F)0ot0p|}Fj67Zf>JJ09
zKo8QN4mo6e`xf&O3KRe_V~KoQl3W&AaSB`jPQaJKUQfW&>22=c0emAN>1c@=+sEX8
zm%K-s2qjhU2v-3t#17K)3+P)Os3-!&kpTga<RIwXkoAneP^d=~P>>MeCn^O7ihk~~
z^*3BXf3oru!J-of*ZW0smxv=eAtIoPDCnl^s4zAJ0wF%4fDJafosGcz%C2`)m03|>
z(MtMgxHE4>>>AY#d)%KG#6M+)Mt3VK?W5)esi(aw*9)20VrfF4v=*UM+5LmOS=OV)
zE$Y-neHK3@i#|Q#j^ZVe^_%G!=@h(lP)54Ulf+A9@<`$!OjO+8*a!isA_Yoq;lmoh
zFoB6;2S$DVR1;~l=b8z%OaO&_z>5*J%z~5&<f$YiB(z?!h^0KO_Z?5HvAwY4K5H5<
z^~>%(Q|74Nqd*RKmN`P!b*1E@lZuXRpRN$cZWWP`1V(&-iL5nh4QcOb`w746teNtY
z!bLNt7~zsNw7Y{!n27(f8ZnRn6j?rmXPUp@$ae@710*TMAR`_yMBW)p-5Jzu!yy(J
zrLG~00hgpaAV~K+G)5FqjL^|Ee;yg3etbLWK_84DqNpJfltPptkI$yZclPgon>Vir
zhN9>$g7RS_VuVlxA7to=mK5Jfk|@$bnJ(M135h_FyD-rVaiA1Kl<a$orDBv7{J*%U
z9k!o$FLy8dJueEsUl!lwY$SR+$$t!sK*O{Y!%oZ9lag<4voq$)U+VF8xHr0;BW-ii
zEg{XH^u!z<!<A4JT7*T-gtpqFqhZap$o~96pljgYn_DYST`g9Pgh3kCoXO-QI+{fd
zX{P+^!_jFyiCpTiiyNmsA&p!L)7_bbQ9VE0o!Qp2;BKUs(H5`doGtNqu;&;XoqA2S
zpow^sq+@i1CR8#hN1mNi^rXrNUg>No;yl;R2`k#MzQ6*WS_YjofqJbtiZb}%VdJh%
zLuuz{qL~!+Rd}RmaIAd><s>^Dno?PLQ9uwG;!s}xLl6{HwVzIvu9dx1tMs|di4z!7
zWXsWkv~UB?!<|FnEG9a2d{cc1Ba%$HQl4l&fh?w&QmG`CDMr1-7B&q6wGn#?|Iw16
zOwADec2aKYUYtgbG9K{=QE<jw@eFxP==)k!WOBefj`L+yNTZXtMmz=k`1n!89JXc*
zccB<&_EcTlN}EQwnE8H+xkO9X(aZ3V862`R4pR1>i-buGGo4z}qsSKZ^apC%Sp&H{
zAg-IKI0I^Y_~<ZP>D38RxD=auy|q>K7Obf?@?aG%QBewxo%43?9@SQX&&5lXJ9FjY
zLPEzTm~Mo*9u@ej-oW%PxxycAGW94OHl}dhyp1ALBP;?92U5Eliv0?qk_EHfrWD7~
zH}%~E(G47uIyNOqxd(OVlGSrg<F1em`WN)&1+HZEZ$u;s)?D6)cJevPg)vLIK{jJQ
z_aBrJCAMg_8#Id2Fg(L8=17{mz$K+R#dXe5*jdx1TnaMB=0geL!uL6mcL#QjqQ#zp
z=pEJ>$mo_R+8c0kTEZB2lIw=Fvydi}iLvcP*Wgl#YqaCnH=Sj_x2>>_rAui`TKBvo
zmqA<F(#yn2jQm2TyBcH;O=oHp;}Y@qtZ}zvZoIVe-0ij>?n+tUn(XT@UoO~@376`#
z<ZK;v8rUI+oJ~NeRzq{`(Jq{H^57Afh;wOw=RLk-#QHTLXXmSTQCz0q={cW-MC0Cy
zd}+0voTJY<K9Ta7d2#|zQ}4oAoyNJ${Tr}eGP%@<8^#a|<Nz*GWQs;pru`XhZ}v_C
z?K+`&11>vy{_uhAmMF~Qnq28TW$jek3XHOtou_Ar<OIbu?X<J=GDcz<bF%vU^s)H?
z>BELL^zh^|Ekr6)j<Zz9hEM_my0&1vmLbt?1C@=*R$Y9I6)wTlxSNWS(7cm!_KnC~
zlg)6pxcsvO#~#okSCewJu=k?31$i1G*i|ABKk3gBB44SP@eE)1Z|6QBl~;(A{o-YP
z=KDPTby$lUfs+uTTzW$=G($RNj7XV`_`-}RR7J*=mcz>gc=iE1vS$Jmc>OX}!Vr*q
zrHs(dE6Zt-oLAx~N(`TeJaS<66XOHDcBYSmzk0xs4i4ddA=K~x72&Qh$##o<CF&hD
zq;d9xzvAK69x)WBE9{_*Tw2TL6Ckz*dhv`^rXT8|PT+~d_udRlOlAlU0wW05gt*z@
z$7HX)d;$YgU~&1wZEO1=KX@P>d?5mLUCbT9dzoVL0Qfa7gdk2yU+_WMpjK5dcJ400
zwQ}~6-@(x=Ts?-rrbb}439)qtV<)9%I|^cm+;Jc<#drQIR5wKAXL4G#=khA5%u`6c
zP`2ZU9S?|0L)aeT)Ds!5#3>_vC`=wy;Iu&W{nhX298znE9!zObdD#|>KH0JXX!XYt
zH6!APhkK@9f{6!(mX!Fl#<$S;P-@DFGq5~>78v$WyF&bs{E);%l%#UVyhj-`#Kh;-
zEr_+Ly6Del_XT4W)54Cf3F#6I<}yv<`QwF{0w+l6;|@%~S4HJ!Q8Hxli;px2y|a9%
zilEB-8S+)08c#JBKi!v;iO(O&c4pE!Q~RN5rhQ%Y0H)t{trBFlas&cbh!ra!>LKy}
zj1Z48>TpBinJ_^zo!B};b;GAA>=v(E6rV+gJ|gNA9S~4q$-z2Dfh8*If|M<lI;U<)
zTV33FjOi5|+(2Pw$g81$Xfkx>$d*cL7P(4(RyLzohT1k((NK|6u2!K|&Zpv2!d3e)
z&r==j_IlrHKe)j$7gXXYJDx$6xpY-%5$R?D&kJ)LNwZG~zsCqWeg&ttXT2-lFX4?O
zoG>DgAS#x4z3<2r%_EybNIk+Wb%CD<3uw9cl%j%Pg}T#)jQ5NRR~lSNp#`u{7F~(-
zF;+*ao+;Mh_$N(mw1JoUP)%TJ<M~x4vikEg25Xbl6<4=x$3Afe2*m)+I*9k6*?yB9
z*PS8<rR2i360ZCQMR^teO1DbCxw{1t%MgnO7I<qk%O$JRrgn`;*{9Eby|+BEEOo0B
zQ+$0wYqA#N?sM5;0~Y&@f-IPMl_NYaD4N3DWhLdvmPDQiN1)8QQoTjgC!`r8VDU0c
zFngBj(@P7sLGVC#sBAk`bzjkDvd@rZlwaf1@3Pk5lRr1X3-lQ1euiET39QPo2x51X
zxFXEor}2q}CG6Q(CX_tzkME9%UESNK{33MjKh1jXJSc=mf^R_A5T5+j&w=5CU_BFw
zJCJ)#u^HQ#7UAg;z7M@uhp;&UlQr0R=ei_$pT;G&nPQVKD#U3kyW|gb3DN|AB9K-A
zn?nfSh<fUL2Siq=cGZXYz-|aqU5wu-*zdWhpcEGF0X4nr$cH_z3TFt92`(l^pk?t*
zX~ICQFRVB%SaL*=XNd^r=MOO`>>x>qKwywj4<?-P`cKqXOjLvhSP?T|@H>oWgIKO?
zuEtqZ{wP042yCpeBI4h4X^!@;F!TdB^g`RefNf|5BWnbyn#j#3QV5d3{eZwM8_R31
zfWZ?VKLO^7qU(Hp`b3fuwB!9HHWrwqe5p`pCDc&jaQfPQ2JMj$YMc=a{s#xyu6UM!
zUkl=923`>=Phhe^M+Khd8?PM!AH_a00|xe0j94&FG^jaf_*tJ8PxvRUq}2L=5+a%*
zqWy0n=8TxPjJ;T^XFXKTX@<*SOOUWt$P_<SEW;U88e?b*m}U)}nUz%?w5<)KaF7KN
zYV$@!P?!-b)5EaH^apS!i3IbE<I{$Sc8uaRCW#aWi0UIng<$I>NU0hmP#PtwOyVu#
zh-m^&s6_+miixd5HLGwbK50@+)hjrlL4koli}FAZ8K6bX(x60YP^dL1l%eLFQTB{x
z4+$v_2s!G7uV`2tBmh#YKv(PJl~r6LS4lBX&rf)2SgP^v-yI8T;$`!F6PCW3>2P~&
z<1Y1b8P<q}i)raFIp4G2Ohf7ys*4QvF9-_upP5FKfPnD`Yz`h=3t(zqHa6~4#hqA6
zW|aXlOhVir_{Pqpbb@apd!3(^Bg_DEC+@X`oNr$FDWHm4880tdLl#?67`xAc*tSUg
zL~)`3_9kl{jAS0Hs;k`E0>sJ^WNH?y%o4;l@4hJqFJBx%0-iVrPmGB-YW9vnZL7)p
z*f6UwG(SJ|#PImI^@g)FpdnkP7qobL&OW~|RN$D<3*ze?0R*oE{7v-T&oMops>KMy
z@JFl=i&{ji3)TSPD!Y!-8!2*OR%Yhzu7agT3X**6$cm^7D~HCqu^v${c3w47Eg1VE
zmweYai|jA%flGqoKMCfzVDeo@id`x4T@{E^FGL|Xq0u)Zhg|5l^1KOWyKksEPi8mo
z!d$3DI&gO<CD1$2**egLkM%50YNTe39Ol=goGS=PgD#5n2~og00`1i9++K<cT4(7|
zx`TbcN?;tTy_lL70aNzeN&EYP;=Utsy`b)%pexM!skuV1T_q7{fqVj~7UZcGWUB5n
z&<dPw0*kbOU1$msQ$55EQ2uh_WwZDROe=go!WZ4%(h%FeE`1(M!?pnCFzB_Kjd92K
zr<7xH`r5>JiuUiqVCgD0MX+1uY0clS$j$x~LMs0*bpG(Dluhd6acWv58#BPmvTY6z
zY^=6>dD-T6VY$P4qd-*tbfV&tuWVST%orpWEKoW|uY<V1p;sOi&e(PWm07GD)z=);
z#)h!0u<I4s1{G#a<~T`K(=*5#(MB^^OkN|g+km+2HTQaG<b=4M(V5|6V>sBH+{Q;#
zqqNI}tj^--N<bHX*U(;G?<Bx3x{9irOyqZ5R)6|I0_ZsetVHQpjFDJ<3c}H4-K)D&
z<6_aOMoFO?bV^H#s*IyKZbzT39i{v_ARCX#XbLhF<k<xUcs7G{Iv|@}kTE`;kdbUh
zMVDmO#oP6_XMT}m7mW780u2y_0-K{4oTng}r-&+1OcO11h!GR4E^>~+5>z~sb!<-1
z=wd(VbBeSp$V@^eB4%A9a`DO*UCyPQOZ+Cm#E~FArw0KEjDS-F>xBHPIrZJI{VZ0E
zviex40|Jp@W=OBQ>_#f6PgbvnrIx*@iIkpDiGU%Fk0H?lL&83Z>Kt#z+H@1w>xB?z
zP^%o@&>``glyj9KE@Yf{HLK1nK6};@;H`x<N3p*B3V8>plI4@wWeI)_>%z$qcFSOA
zbJ1K~-x(R;QBI|7@ntI{wgsTjG-KCPv`nL{Yz`^CdxwcVO&0h{&QP&Hi=drnSms%j
z-|O2$sLTJ|fZEl1R7<$QHz~h1bW!-CacM@hcgx^9jqwHWPR7erLAj`*Z>M{sXa=oP
zv&7K?%-YMUDnlb$(RfD0qMy~asZT4LP2gwg{ckmPbzZTS#d@1(;3UyDt4*PrT|vcx
zcRvD(wzz3g&U!(T1tp&ULWb$wgkd>}@)`$Py0OT~97AH}lSy=vN{I>)s5uccx9X|w
zsEhTJLU}5w@*K=_VqrjBuv~eoXu<8q=T$iNod#>UwlCGCSV5mBJ^6H&9w$AwPDC_D
zlJ@KNe-!2MVV?AYwCgp!Q5m|gBF;5T7{Z+dLX?^$!{Y5sBz+L+!&Cs?op^eCu|7+x
z$%(T{6QQ38oAOIbxpOgZngsO+O87REst?dmmlkSaLn<B$E{J(~Q1f(II0+uQ#wE`y
zZdRZcpz66)szJ#UFx3_`1@d+m2!jVBQx&M}B!xt{JGF?d&r=r^qRNFqYoksrA*4>k
zC!j>=*~{04El{J(;duoYke{QDh3QjX>y5pwCq0izM7@p8dUJfhwgP@m<Vp|tlLJ&D
zgH=emh7U*3=bU680(262)wLLk8DyNI5r-n`<t|a#oG;SqgBzx(<FZNuTr8_7b*m&M
zp0gcdaO7Bu)d_}k&dWyXQH#{c){xFix?IdvdkHtaH(8h7){R~9Z@96siR`O7dDMFK
zdXX<kLtjUY?-PbkNn;nMm*g>_$FT5s%Vvlc(^K|lRTq}YIVR(=?OaMij-?WkhB7T+
zGBJDPfHXn%Bb9HMi={qFR7g=$ky435KU3rbJzJHtqp&g0V)VpR-GsQ5s8Eh1K}oOf
z&y7Mfq8EGnN=ZvgkCUaQ$fl5Q1g6aKBSj7wrP=@-mZkzFD9kj<Qd3wbWiu9M3AE~4
zq?9`;)62^jhuFMRQv*!JpI1j$YzxkQQom|7-yr#Uzma>pX1q~4%-*XGqDhV^oSG<^
zn6V`XFgJFm7B3kV-~7y9fRxsxtdE=1UcV}_t^YP3(ly<>Wt!NX;!Zc#wKhNhN&2Lk
zvYqzEMAL3sBYmjg4Y==H7!B2T2-44n70f-@*O4j0(6shK)J?nWKS1ygULxsxf%%`V
zv9Ch;d%psKf*^jg7YG&b1p%baT}F%|@Wri0oTx2?)w=y@5xMk+B{UPFFHEs^V+|p!
z?TdPjFjkw-yLMd(A@1#q>IF)SFjY&0<mC$r1}Z9YMa|Ivt(E|asP_}H$Okmnw-G-<
zmVzgG2I2^PG4Zq~(~VHLHzuyW33_5NL1?ZU>98T6H>6#ZvnUK-$m_Z*>Ei$nUr1fV
zVfy}vsW+ky!W?}OcbA=CLhzv81=PRLz4EaE5C4a`w~UHo>-TkWcXxMpcXxM}5E_@@
z?(Xgc2myj?aCc8|g1dWgxlPvDd#`og_wKvzr*j5_rbczuY^r+B?&^Mi^Zyj_zv22~
zD2O1xvZG<1MCUzQuEZNXTT&Eozu}G?^f7mbLHL2v%Ish#M0Gxc{hUsJ3vpSQ@(&`E
zeWw0El9?|pym;?<BMm1U4=S^}e;E*zDYL!LigNfY07V*{-xmyrBqi*JBtD&=FOCIu
zLCmVrW9kv`7GeA0svaj!^qE15<{pJ;$8xjV#1BddVbhWYP5fT>8CLfh!I>o{zo&0_
z&yq#1=LgQDzX+4m1#v=n_&qXCaQOWl4m|Z6(F4v%mo(^Wf7cNC@Ma0CQjeIxxN;Fp
z(LHU9G?Q?wG-ghKfFB+@Ygm4-InJ1Jfld$F&ULZ}0pv3Ul_`O6q#ERy%5YcT2aL;e
z7Rc=f_l&5^XNa$xs(xTItcm&E=pHfo-N|s1BCNuJB`UqjCR9ZGL#*<m*m4g}<5IZ7
zaV4yoV+)vHFU&opdU!KN@h=&^UP_G*xU5BZdIWKs3FYlbtH$9z(_n4Tu0`x$U<gO;
zvnCS{h>dSa*TU34s4@)Nt_5IUa5!|MJ!f)nFnfe8n3n}Hn;}&Xv5oKk_JF<i05=*G
zFpA&Jm^!Wn+kJ*H>H+hEsNUiQ-q7CjVO^2yL`puxtaY3DK{%MP3delE00Z9Ch7b=L
zUt;^=oSV?TVV!SD`T;*^;tGdodPEZUKEe3~q(6}QMC?AJyoPDtllpww81hIZ?zL_o
zL>BEmenz3Y;1iCJtJr~74duQUt?1Ez1`+D{<s&>#cklk3dLE8{e(_Q|*alod+e}n`
z?`PZn<U=ep0PREkT3~`GwDVMh>c9PTq3qLtx5@4^erJlVb=`4KfVLjZtkToflMd$>
zD))-WRTQ;g3O|3rXFEXMj`XW0ZNZfPb@I3d+}<cWw{*|7RMQcA{*v!x5XvZA@IJ*q
zw)&EGJ(%w~_`HX^bkn;A8~?%nMBPzXXuHh`B>Uc;pnu<o8;SOwv2&x%3CH+ql_#kB
zo@thTF@UihOS(37p%C?#2V)$q2f;5-MkN#I>H+t~5gRA8wtJ-<wF?fn>)d-H?|Y=@
zfa(XN9MubkBj9pGhY$axDe-#THQZ~+iw{532FQ9`zEgt3P!~pfgu?@uL9b~iV!Bg^
zLmx9w@AoaZqX#VmN$~Y38=lecTdhIdjxi3R=yBJK8$3PVSIQ6HLbG1g;j0gYpNBYK
zZir`ZX1dA_OI|;J&3{%@d^-~^JsfgaxRG_AyD|4ynTe<6d|7m`_9{}F!9OoOjFnS#
z(6IK}CgglM0Im%Nu1(2Wn+CIa4E*@*(Dlyxu_J43%i2p`SlOY4^Cf<A=6vqPoAc$)
z=5g;WFbnCSjkkaAxctSzm+;14$p`fQq0#z`L$6}^t$X+Ud}hU}LFW=01?S+``x0!*
zo0Izf!u#S6P#Cx?hxaWZKmn_KpIc@CwLkS<uRQe)Kb8D2E3WiG!@*klvlBQ9(c0Jd
z`_Yg{$jH9@St1qA5<#%}^FYXjEO@^--SHT;Vn7Oueoy2|MW+HlSXs^9+mZAmQP`jS
zx~Eh$5cLd$Q9k#l$=Xq5=cA>vKaYtnA|_`0z9}WBh+bCX`?@43683ucKkLxDYfNST
zG-(Rr?0oXRg!#}D`S6hWXXSJDg+F`iaR0xeB#u9`ivNXK{(D+0@fWQXb+$6KRn+)T
zP79nI{vXmk7EUI%cV_xGPRq*5#LLRT@}B}e9&RQcp#F{Rf160o#l+6S!wF=!|L>TV
ziwnqR-+?3$)3R|eakFr<u#>R8Pp1aXsRq(u;Kbv1R{2g_fyn9I&d2*l81`S3ii3sq
z-?8bx_W7@4Ci&~EsQsPL{_n^Be~ittvvT}Hi^t9RH!{n?!uDSW_}_6iHuis#*#t%F
zeinq#JE71t_UIm^R=SMt1kw#j|5AQvM_Woxjyk6tNqggyFj^PVz%O?jGus`lv{$(I
z-f&vxVI#@%&0&nXA*hzh6;?f-+3{s=Z5hKJ)%IS->`YN#yT3qe5c527mJljwV@nCJ
zzorpTDYNICbqKLneaGo?5*;PcSqSWlynG$#*RChIux_IXPw`!2zB78G6}pR<o^N?5
zuI<^xiyim?kfI7jDFo+5=$mGxxI6c29vtz@?EeDDt0Ek3^0Y61T*NkhI0v=(o|52<
zSP+B(p?p6~8>VAW><1!S;Gq4l-T$3z{!8co??~$Z-VOeT4E3*$_fK`*U(c1=-+SlZ
z${+j(LuKXUVB`7k87dDK`#&6qmEQ1<2HKf>?#f-p-_K9)o@iam+vcWzt*RYc=+5^=
z5q6#Gz($el`@x(nUec=ukfJByWDm$EE~8|#G9Y|#WYicxLs>Rl5@BqkJ;~JL&}Xj)
z|52ksg5Z(9tP7^e4<Y|+f8|$YlR1fg>I~EG!>3&D*SF{Wx3}xJw+<-i?x2#-y-k(;
z*Tuf+mc|gxHXua2j<+s5ms8F5peyJgkI1<^J}0*h4nBy}Ct$OJ;qgpFY_GfV{s_(R
zBHy=%pKGbZjDb^t$L>J-63L<W_trhPvDrbm;XcbT1B8n7pqfDfs>p|wgq==4wbln%
z!*1m9dOdfqERicefRcgSPYvzm@rVjlj)3Ywp?JESE%t;9J&_Wc+{1kCJnz3$FVXG_
zKnqw`eeNF#re1p<oOKO&W(;r_S>OuCHtA+96&2BkAyK&#fkdKngDm$S-1Be;e!YLE
zoeX20=3ipyY49m@VsUA25fka2xUcJR;i*ErYqR}ZzWPQg;+s4B%j?LovHz?4a%#<9
z)FT294hGXkH>*Ij^5zr>%wof+xVXm(1zD)lwzvlr_9d$UC`r{CH2jYMYHrdXM`5yR
zG4PG*%LNc@Yyb2M{Z=kP!&Fe~%<9G_Pp>g836uW9cB;9%%U~=ijvcC0lI_Xg(88bY
z`JSF}y0#c{LfZyk-0QScwFos|)Ly<lGEP)CuKV6eQy)^Swx7+MT%RxQSKlbzdTROi
zU4W9ute(`L6Xm~I^VvTZJcK-S>8zx6ZHhmC^kaXcex@v6;A1WgVTLotNE_h2#NXoQ
z>azQ8_x)6iFb-iM01wOn_v{x+q6Ci6q6rkrun#`hP2p1<y_?G_E7UqvJXkAgV4L7@
z6dRkn0ct|0IT^=B0N$$tVcKxNG`7IDE6$-N62!;RRJpTuC`>PuKy0oIld*Ov&Q_EV
ze6pAtiwis+85wdoZV#>il31MQnmz?+j?aO3W?zvSXh^}&7Epd29k-Tfy{!%Y{yhG>
z;<ah})%2{s)R75+mGLk%`DROKSD&H-MTXgS^qk@lQu*mT6w4DH_Vxu<A>lLwFr!fQ
z`_Ofcn%~bK37w7{ZKumLC?`Cd0N}+`TvpXs@en^vC>lZ_k{UxIibNtNg|c%7Jq$`Q
z?54pR1ZuGYwXAK}4bm}r0ba^RlrNd;fx1H!m}cq)(BK6u`L@ovABmiQ<wN*&>leJu
zG&$QcXL-C0V-ybh%@^77c*Bc4F*5YhW`%r-PsV}JfG?|3d=5Xe{p(TQN-eh#dJ9Sm
zi=aO#8!j&!x4+`*M5p^nEO9$aa=by`WCwhr&0-_Bmz~St`WaD9ChqWj!Po23B?0V@
zWXXxhbnHF}6ON`-{`~skU)|Mrvgm5<&Tl&w^6>7A@d@)UrHc|HZPu5X?v~vLUw&j}
z+7d2vm7wa5e8_X{a0SdP@!ec8@ZTAEkNVrW?DazKV#`WY`|kHbzJ=b$_)rp6eo|qY
z?HMd>r9N6Y;DU-BEb{XrC5n}{eEyMnX-gQkrpSM%6!TQ1IvROtNH*XRE~A)B#(6hy
zYDU)Bu1vPO9xYROF8igoLz3=xo>V1q`Hb=BJuwR4srNvT;yHz3v*e7_^obD7?b#HT
zpP%yNsIqT_;>0hX;>42~?Y5H|_UVk#)Zc+nh;CCvzqjbs<{;%l-5nO=ylps`kgVhk
zj1(`j6fvL`-m6&oGc*g(Ko{j{+wGLoO{Qc98V;O2jVg+aL=p-URa!tSdDHY%9M?Jf
zqnb2`S0KuBS58rs+Z;50i$}>EmD*9IrH+`IH9T2I0z#c9>}4?mCT^R8OsCr_$E=>P
zmy}_H28$(phG%%M)4P*_Yl|dqi-wFRV4EilJtiKKpr3XJrN;}>P=B5FHhK%%3C(h8
zoEOKmpNYU!V6wh8C7IWad-s}z$O2;zQz_0A3EDB_@{>xY6Vi1?pC5sRw$dgK(k2Iy
zrA@Im60MCuV6yF3cAoAt;TRYt`UZDedj9@B;o;_DHlA)Co?;c@*zE`t)FG#^k(jtb
zXU}$Xs?1T?rqLN&#FTuP<V7(3A=MMh1JhgXAg7!U0=^NIXBtC~L>5UoM~l1jLatX*
z+U`-O-ZmJyma3bv*7L7T6?_&V3&3z}QAM@(Qm{HtV3BRu{G9no9^_YC_c(!oBA&Ih
zc!vEMg((`#@I^Rfx`XYQCvpX^5`GFd6lIpq(plwNC+el)nJA#QPi*svVJ7BIys&QX
z#fkpJL0=y+G_JFMFLTIAvWdSoLOo{N+!k>rYAvrH_V&Ald~Q?iHqx)fOQv6+C%{eC
zKK$H@laVQgnziO^(5qA`nz8!b%Jn5&2|A1BASPh)Gxq_AIsV*H17D?HiMn_>*P#nv
zX`^-SJP6~s`;3Y@9v-I)U#?L}$=h-Qs8?th>@+??N?2L!5x|_o#X8xjBv`6s-X?as
z*DTH9se=Q-h9l-P#9Y7{0#J4am$?8qaP`X7t1jUf2g<4NI;5)EMWN}dyQ0IOTvDfx
zX-l9wdZxn^Snw82z>#q#s2-z@^(pP}f<+O7vw)GM=_5|44qPvo`8EK6BS5Mo(Sa2Q
zVUQE=qm(!}PDQ|oEf+56F&<)34`3Px6Hkh~0jg5eA&{t$WZjJ!k1F^FfTc=y1&ps8
zibV|%tA0u5da8-SY6dUX8fWg^7N09>!*RjVZO^_YD_#znN}<q@dDz9(AN)EELWNqR
z;~9-xQz`q?mMy#CV=@#~EPyM!fc<b>iay4XPa&b`KnV{Daa^vx;`AHH+BhKN6ogsF
z6J9arS5iX;<Hy{Aia=d+ZheO7Y}b#;Fz5on$uq~F3ueIdim<SvL%&~O!FM&4bHNBS
zqFpeF)I<kiI#yTy9M$*iNL>h6;PEWSgo@7N<~Ipjr(d79*AV<oC0L<VZh{F>Uei>L
zv<Shaa{<Ct(nkfh)~Fd3M1vzCiY$7LDS=8=uDW5kfqJ8V{zcSv&V)-uC9AoqTxn6#
zIugY<VD+@&7l=PTrd^>T$FhW=M90*}dR08Ga%e3HF|f8uaY)eM0T6sUx3-DSrg9>l
zQ`;Ir7@iLMlHgQ5y(E`K0<Ppf`+x})XC49;c&hM&;0S<DdvcglY*_A(8uy=$H9c`C
z8&{qNNF*y#r$}vm_Rc&AHDeqMg-fK5q=o$U=PtGZBND&YVSwsC$GZ8j=ZofyJI4VK
zhv{=y@JmkF)?E9NrBk+UtBBSW`wOJ#F`^*CLn6zP8PM^M-DG+jZf&bX@k6J&GdV2J
zM%IxRQ~@F!J9nUhHsv>-K16H#oW14>9=<{__T>wh!SF3H_%^uAnxaHCi;Nc!K0?ed
z+cx5?A<woo!iXVlg#{p$NDW!c8}RoPpk0tc^2@|9-FukNdG;PEqu%_4_$G~D?ZMKY
zSC>_|$w;|)QXmUQssK2{-+!3!;2=e9CP0eHb73I$oqZ4Wp}kj0ea?-G{l?qKN<>;5
zy1-EaeF<}|l1Mh4sx(*>&_Fc;;K6H>Bp2xQVMUAW#jTMB>wq!&%)EHG2%`Fhi;4s-
zQi8mqu>b*$b-GTr0*s>m@Qi1AL8^$u=lhVkK%oyWRy=URN57b7NR6o>LXG>hBM(U1
zdYt_-+Kn+j9qEiXBdTDZNRz>VBIxllfGkyp(x8k8AFXNgU2>mJjd?Ckko^^{xu|f<
z8N8|n9yrKT<!0u?9#v0@clmGPz>5Q|Nud=gE7{UVEZSR)_}OkRZJEMN;+eAvq|o@k
ze*vD4jo%<=8Tc&*Oxa_*pIRCX2}K)+1vH${r@#A^(t+wP14QX$LIZ$EXJgqQg+ijP
z$Lu2kuFpmw!N&3D%{%Z;dtwS%I(gthIwAb7?eXOg+>A9Bf9VFdYxrq=SRL~8v{Ksa
ze*62bs2t~z-c}6s8aX{c1Ugm)1?CIbfn{ZNmxG=5dEcYxUI7#_7?<r54<CZSij+-X
z<EEaA$8>nsc|p&nDMk5Z&y`z>)gYDFK!+@VQW@G&mDL)%h|Jx7cRy#pAXQ-LJJ{9q
zsnr#uo<C!?{nphEB5=B50Hj_iz(Pgmyo40VpoRn#{#%U+8rDf5WVlJs(%$rb);+x9
zb1~Jc9J)Utmd?ion+x}v4MrW2kE-FM#?V)xWZ3(fO5tOSyUlVfqr1fMSVdd?t@WH`
z3TreuK39D&mi}J%i&J?#PgvcRuWqjBeiO}EHY`#!+IprPP{JXQ-xqg|Us$@qm>Fbx
zg76qJ!XVjeOhB<1dV{VNpViR2miw!@FY#jr`1*H|CS86;d{a}R*e0DkoVK2ll2<h~
zTg~ir-pzhUjwU`6eyZ;q@_X%H%2%;MtQHC(-eU8RLEH<WF>Y6Z4&if=cRjeeatKtL
z-p8*PRD>3#!Fb9^il*k<kFd_bUmM0H^t1Vrc5Bqh5YoXlClxDf7;Oj@4)>b&YsxMV
zj;i4!4aVstpt#qfg;7}uHg1mJKVVFSbj75AiLwywXqsW$P=j7vo5{En0c`*1SHGft
zZ!E&=x41PQ!X+QV4l%;KVm<*4iZR>s%*;ACno1fauto3<lz{q)=KU6`S21+|NFf=(
zR`pD`;+ppcqaIgAB{}^ps(w|l@yDmZZLItG&dZA+X*dDv4OT=V_KjK)qUa5$&PZeH
zE$!_4-&B6!0u1$l?l=<tbVC3MEa5SAsMrr9B31d~gyq8xS%EZiS?LIwVpKKSeHnql
zWa0gWc5YmR+j|B+rPJ}dkIqWJ2WEF{TiEzh<rF8hM(dMl?I)=;>8<ja4a?-3rq3#0
zUi96=v4k4S%WW1)u#kL{{QS`f&cK_M6SPew+IxsHRk(OSHS&)(t`H9Z#T4q{N;DWn
zW;xoFxk<ymTda144uwy6o{c4VjgG{6xSyYPAQtl|E_?_DAE3Nx$fk6p<5i>`Tabbo
z#KG-<P;=BFAYSwaU?7zC1X$s)fWKRw%+Lkb`<Xc}%N29xhwW8tGAqexW;b=d^(8vg
zFuFxF;Q<yVBU(eC%%bokR7d1?QOQybH0t<_c4M>($+OaQ+JsH7EP7jdOun8>+7m~i
z*Ig;D-w&3(>NuYS_O`bCfVp%2oQ6FAMW&3JE+qUb5rJP_c@{H*eU%LVqj=^MvN~);
zxdS?JOC+3Sv6h8q#W&FE-U#g`A4Yr8UwR#B1+)OwV62&GGpKj7lO*8pPfoB`;u2KQ
zjnEG*8<N7Cqlg`RnLfC@7rFi8VTJ`%)FYZvHRdg>D8^P`QFMu@;z>z`q6l1!+5j>v
z)&2)6zp_YUyRC)ndqj-PSzuT4on=FGtf9mWfoe@Of3Yu^F{4c;i1o6W-IFKXasgy2
z4K*?rD^bvs8`z+`s1<&*omTd36!WM+nGAzCBUlg=;-(R7XJzM7Vfe~@BBy;<6`lOa
zz?hR4V?3>ed9wWEkjQF!juA49*oYV&@#GMH*_`wli?*wFCpLakqg*}IwscG>UjYsT
zHbJ`pEM5^Yja1!DG3s2MdBnH!YT`Mc$~ZidwxP9h+Im3sXQyeI%1+LuP@DQUnbc;S
z{Tu`Tm+Wt!>g$R1b;$<5uN!$@${X|b`C9A_&u9oW%^9N-dt%b&*pMKwXLB$dhv9xV
zu|G}3HOfc~!sX0hMP&bIG6*)V6N0;+eP2xF*BEK+u*Gfi(L1H!iM)5{D`u#Yxb0{8
zOD;n(aKY(<=u>3v$ZuazmCV{C43Pz;G?L19JsVm-5Z@iA4n&sZgi6$KlSORWer73b
z8Mfe>luHdS`PtKHw|k?L05Lq9nHmrE5?2+pu6^RR0O!m9^kQ&#Z`*j^4d}(EFh00g
zcSG1P#!Eo?s30o_P7BZxrW_Lw)}L<JDG0>I<0^zg{94e1z@ZZW6+OM-gWfgUU(I!S
ztoRJYp+IC>fOPCknAJ37LLCf&O+i6Y00*0#Py>yIB-*Ph<53maHQf&!+|?YH3#5%o
zP_Pc7X4K+xrREWGzap3h8&m<^;ePXXu!vY+X8epkcO5%2aO<e#rWdbaxyNaYl7CSi
zEi0wuA+&)?+RnI<)=(Q62z{o_4@IW%eRY{0g=SOEpP>qC`oK+y3-2ivXM5`H=(~aq
zb2=iY9~81Ju2$IA?>oGjd*|hB$fWJQwhgr3Rqt?P`I^HkSFc}`gwIn_e=I*FOa#=?
zD+b+FPNkLkQ7wHs0_xW->x@)!1O>5O9-v?}PQXwz)_98a#Ke&cbt9d!_l0f!65$uz
zl545+bqyYVq>eEAz8b6Q>-%Ph3@hrW_CwiM1){CkCZVZ|lONv=|ImYFdiR}arm#e!
z-F^-cr`cqX`^U*qwLX=Hbtr&f`xOAfEjJDi=S(5OITE4I(!?<W!yF^i6M+|#5r)dn
zViqXW5RUqfUh~0dp<w)1H%QEZDF)P)?Jej^uZYbps0V8R29!!4$XC_?Tm+MXvXf|>
z?!S*h1Qx+qCUx!QEcc+JIX;LC05Gcb0kdxyj-$Jh29(L-8yLL#H~qs}o*)^<^lTYE
z1AFQz*KeBP>y7E<YT;yliU^dsKT`CCQzl|wt#tLc6IUCQ>4bcY-F$K>JRgY+@|PM(
zUls@JxX~Mb72@V|W4k)i=P|_(phjIS`S^Wq52c=m=AL!a=y*Mfd#w%kAhV}^nqTk|
z2#uvrFXtppxq9^KE5tb)XzKuNbZq5`73nBy+$Ait2W$kr8+t;alBZ3OId~utC&hyQ
z{tlnZ3-T2oubr|DwN+bdC8)7cTg$^#5>9K@WPqb0BM=k5#tc;}$6+fy>wb>PuOo6j
zAoX-Ei#hQnx`Dx;-C?@=e$8*sA=b`cKH2TT_T&c2b2nxOgL!%xf$(=XVJ-0lpIDB@
zx7!v^O@Xuxk0tyY4-1EcSC0~Ip7v8D2N8w>wYs)`JO6a<VLJxT1!jQ`zmvnhW3RJa
zM6~iZg-*pa5wsyZn4bPLl%zXy2y8JKk`Owv3<(%-lwQ&hM=Vl-g??ke7VsTHJL~=!
zrty|M<U2}XCMIGW1SL-)t(t*sBAnzIlfxqRev3zVjLeOsq3eF{MqIqG4voP5C82rz
z8I6@OhwZvf3-i9q-dQ;W{UOL*U!wH<5EN4GdeiQTPo?Gc4@CUCuY>NE*WT1>w>oK6
z4ndvCBKEx!pGbqZY7iN)KzzT44zeR^nK%q^dJUlc=BUCbN}ab13egf86l}gi`z~X@
zRwZ<Om7JburHVtrZ3+TkRuD4lnm{@1#Dzf(PX(^259Ow+wwK@BYoYZTmtBDVX@t7#
zDn@{Lje@%%=*_SNJy&}Y{*VA&`@r{Rjyy9P)fpY{Xq9u+5RdoBp)!4tdvv)U_RLtT
zb9`Q$D)mV-c|2WsS~hi1&5JTE>609K?68Fp0D^MA%$cHCi%gtuOe@|v8cR|(<s``v
zjgqx0s+=m1nwhy%A@6NyD!I$#_-!I8^64}xZN<RJ`7PNCrS+>YDYum@&i*k>oyo*c
zq<KKqhF+C8bv^{&N>G)>8=pskO_&+q?B_lXmyAFp_-RvAzJK(axFzA-IXU<EDRqbO
z#tv2tyRW$A9Y5VF2n^N6GS+>58p}1WMke|1VrzHSZElKo`Cn`zt|a?cyO)^PHt0{;
zwHfXv5Uge%uCiu9h?@Q8yi&h{TDgJMxXU_EvnyIoKlx;{?S7A3Iax{W7aoo$Hb&Ae
zbRBj`t{$$3Reya54Ig?keq-}$$7zjH7TNJ|a(0=b$KSr|Ut)c|-(<`04+y}W`t<X5
zA}Xg#%3ds<qSHv4ZatHG^b%zvg>&p&`$Wo;lX2u#OQ&$3R}kH7dbrhMe8F@|y?%Fj
z2__`~FNnZ^o=?-XB~)t(_DF73O(}J}Y}s-%+qhh-d@j|&u!T)$-lj2)o+>%av42Mv
zBAl+L^9g>X1^>ahvD>cMaCc?*b-a(&=4%4_%bcx-vH-D8de*nFve0Jjw@d-4wQiQq
zMY#w-9@S7YYC#}dZ$yoHCxbMy#fn%9Wf@yL4S6V=HH|r*#rWqK$duX$wn^?wdBtaI
z^scpjhtJ~_7J6To@@>VOZ}$z-K4rMxD14)(1;p;!2vHi-V?52*)e^|=X)q!>%M;S=
zA(iQE_B3L*{5;zZo*Ck%{4zp26qf7RgQ~O`JP?xIp0V!M+;uU$=W{o`m$$Q5a3<2a
zfq?wMr;EV*0|gHLnkGT3@V-VgQ~J~)67P+aG9TNONY{e)>Y8@WFk~!Mb_xAKJip7l
zV<axiFp)Dl9|gZ)>=t`t)YL3o9lItYZC(+Y>+8<w`uZzYX8S5h@{|C1m;bj%zH8mo
z_2WbkrAwJgqUsyCfzsSZ(%S;R5hcHe+%e1H<SG9U0k>UYzfGq)8T%@p=C{VJZ9liR
z(HGkR=%8WX6}tGzyL965>xY77qfoHl9`(nXpE)gy*?~3RkAW3xP*y5(2OmkdFbJ94
z1%@bpmE>`i?U>mcNy_6?I#zu?B3#dvwa1q~j?LGyX<meeTP=e0Z*I1C`GT@hu~sT*
zsKSl#>ZpLxYoB)~(eE-@yor=L=p~{4CC%8AUx+TFBh8~b4d>vnazLVJ{=}{2MN3iJ
zOVnZdn<ib+!KX!EEjyAWb0|^Q-*$Cz1GZK^=~^2Av>lBkk`^><UHhT6ZbmHy^G8Nu
zcljSj%mG#)>>yYm3|#R`fB)E2K|wurWb~~s*I{~JJ?dq;Tu{DYjpA-bUgM55J(T0(
zJNSq_Wx^LuIOON?Kn|V71x9IOLQfn_VQM+d$S{2yT1SJO&YtkPL`SCn>jDFwB*aVl
zsXX#CXq%CVzR3QIy$_~?(mZImqYp1F1u`11d#_t=t_(AnxcmZ~t{x0OSNqC#n~&^%
zN}fb))<S{F8DJ)Ce*-aqAqfQe24jK-dLjxEj?%3QabbY&Ul0krIx@D}swSU~DhKm`
z2j#7Drl(HK9>Dm~RB7^Xw)oA<5-`wlA*<=tcec{{vVGZqztX*Fd4Jt1M4NS;J<(%u
zLTYbg)p{W7z$d`L!ksDL)vN-)3k}xOW2W=tF{colc_GnsuBAaOshnI9SLYkKxN=l6
zpP9@0j$9=w6AsV@s)@r2OMcrOA<nYJ5c7|V3|+awdE0({hT3FHhdF<%_3s+t@z%lF
zR^oM)h@z7CK@7&<$vl(^9r-C)nFg)kI;rT+==Vf~h$g~4<!eyl_k%t<pOIajjL+T9
z2K6kjfm*ett4oJn1)BKLVBn5Jf-UuM4-HSGu2Uv0J?)LoJv`N~TH!T9U?KvwFs`|j
zjeI<K-apgR^rgczFW0p;C&?Ga;L2}WAm~vK3g`IA!JFz~&)DDkGoP1qbRVV9V)$z8
z-xfDkJ`{TUyj`rthX{ScA3=z92A`K0Uwu0)kiL^SJbVZ&c!(XbtIr#cxN_rn7jA*Y
zzFoz&`pJi@Xn9g8qos017-;eJN+ev(K%H^KcOuEQVy~EQ+>@^fX-thU&1Wolh@OMi
zRa@sb`S3t)8}r$^GBMgOv|H%glRYCn&jfEPW1cN--vss3+=HbdvoEGe6mDsfuZo1h
zo}(hI6Wt`gW#k*=Mz@mhD6>-<$6G1<+tSu51M3{XCf3SNPgbjkho=ft&)gce0#W@2
zm|f|iJvB><Y7A)H)>8>v2b!;$CQ@>k?8=?B@kkBWmXEo0gECbFuvzrQTezoC*I(3J
zE&ZqUS2+{bPpJ&nRm{5YX*EB-%=eE&KMhcWclZXHQ0`v-o+kq>8)EN!aUsi=QJzSn
zd-|$2GV8HE=%{?&O5|;7hCdfgC-SVo+%%?nuXVUuQCg~-aGJ+3vhF;&;@2xe&ZAd8
z+hmif1R!my4`3^YnNb>p)MieD{*o7M=G8i1KUQsa7~p!`-})of!v0H5BXiEEGuH5V
znt%MR6yMFr8~tYsHi@!p=cv~@v?_!B(~8ue8LUKKHn;AWj40Zsa+chl2n!3!*FX|#
zwFVb;MYXPYd0Rg(&FZ<CpN!kn`P$3QVJ}4DGu;|KFC%w8&Ao{%T%Oav^(%JFZwN_Q
zRb0LeIkyEy+qA5Ld|sA18Qv<=*qzqm6&(qK*n9Sgx>g@gn#*NC$>{x2{(yxjWE?K6
zEbrn~EFoRL#+M`SEZijFFjt?X3Em;6yu>f5dww*EPn*uUof;Tj<v5EItv@1}ThEUX
z^=lRzym&;zwft902aO#fN@2?j(n9vIH{zMZe8&|z)7FT48)0pZ!!F`k&rgl&A_95}
zFK?=an;%HnXK&k&GQe+Ulx-T{@>_Kdrw2}mx}u!C(wXcbt`!`TP4_aBZmcL{HPt+I
z11j-;KHW7W?U@u<xP9wn)>P)uiL7wF?N42nHaMtYTYIwFHO>kSt*SDcwnf5fYlRcN
z9_ZhB-P{CEj_ltF+}wOghK&meckVH<ry(F3hX#A-xfp)dAY<heW^;C=%go^$CYw<F
zkR!_+>oAu1RX>trb=0(Qq*^j(e)q0?aNqvP;V2>3k^RZhT`F_3-Js6U`*HXDV$W~j
zwyb-X=GvawubQU57jY0yG@3Ufe&~wyvEvFEJJP|sps5WD2H}K|$@V&NNyLqYprCFH
zIkZoF3FL0>S8|suh4;Dlmlb!%PfUqK>L-CuJhgq1X2BgRVws<sejD@Fdk(aEx_vxe
z0+(1)9+^^DO@;6lk><>c*Gf(cP~CYcUdu?--Dlns*UgU-C_)XQog&`=81%iwEvgn_
z_G!K1s}XsIr+6VuXnQX|SjQ(-t9_}_kS1l0C-~B0BUw8FHzS;1=wAuYI-9{Mtu8WK
zR<bxO$NSbOk!C}CoIaH}9wxZ7wrXA`V$VW=Hw*>g-ko!xovU6V)%11dmsB#wV*9VX
zc)i?_gqQN&$Oc6PWf{YPQt=XYeL=S#dkskSP*>QVWkJ2D-9EQml*q*nt=u2DkkF?`
z{3}RT4x0m$?)jpX^+R(}xhHbFK|s~0)`>zT#P~<b>6*P=vk33VT;<7Tb+pv$u3oW@
zC>l+B!<G7>bix=uZ#${<ma$JE0HM1UU;1@rEFY*suM`wz>~LQVVXbv4zrw_qV$~7R
znBF$eVx;xVbpQ2D=EfUF!ZckKNc4i#YYSGUI%#CgWvfu?e*f=%1`ooshR%lcZ)L!-
zI-9%-6PHF283oWWJ)4}-@O2lm-*@YHE;HX*?0SIuQQ;Gq-KO|PP3LRT8V*?NGI(1O
zej696yXz&YI}c?R?n?Iw0BCjg3$|ZL+OMCwH-~F=g4zGhol^{Xol>O^N+9N2x@KHX
z$urE<FS<~qSLL%KJNy9YTXlszB`h`RbDOQ_-<|2!%vN<sSoFbc_j=_OvrE&3S|cYb
zhxFUg8@P`oY1+T0Q#gQnhkuh#`LCeTU%{on#2%7=g|lQVY~3tetjtZ7EL<%Z#T;xu
z05|#<y9YNgef8dqh5ftT<3F=mtQ^2B*Z)}W!O8*@H2mfF-~hTJSXnv#Ss;T07|#OM
z<NtfW<!`n3-)sMq{0VFQoA}kAqWyo5U;Q^n_kS#j#qyWZ;$5`?lyto7EJ#?nNZwT$
zKrM#;ySD>)`SRCY?-mPgj`#4{ANj@~Q2}r--uLst^2f5l3*7X5nTv~?gd4c)ySM{b
z9N~|m<9$6Z2gm=?a{$d9|Ka@jkH7D#jX%r4hS`9I4PcYNt=^Y_NxMJIzu)`*3)FD{
z6(jFz4|Yzrzw{n#?@EvN6ArX_{5#DCFuMo5^M6w9gB_Se`&+dSwK4l(7L@iUdLLV)
zM8psjijb59GN%La;s+2jEbB6yF&^mGPBU%_HRLAFdj2)tYDv{x`XWK>e0vQ}k2R|q
zzKp?a_3r9vo4%lg?|KjXy@rUf7KNpgzXd#T=w@OW#(03$K8{D)GP?+VUBcm02^qjE
zW#@GnM0xc|_}1TIL$Tz^r|q|g#zk&b)}Bv*04*E(jVA54*SBi3Q!(dDV92P@J5sTX
z3QejTcr)N*UsBlib#>D$Cc7Knwph!mav!Y-K1%aWeL=A3{Cp7sz$T5NC`g&6FXRzz
zDA7qWOMUV^^m>|6h_nK=2#219(qNB>WQb7EBF~Xyk0SM?B4@=V^=u$d+Cd#DLeHdl
zIIAh#U4)hy++2oEq9#)(D;uI{cbD{Km}-uBVkLL|gcLI*9Qa9>st{42GnVkQP;Z`i
zYoXNiUtbsApWy#rskQ%R^!$$lY=4T~0OOS!4x08><_;e$fW7-q9h<+8@4w~g{xiVF
z!TJ9cVB_Rv`$x|?)wi)FSa5y)c-yg(o4eb&Uf;IUxh~E$LOBrL9}eK1*T*`YW}{3(
zv-^?syDoFSW}8Rr%dAAgXE}`_nQSg8$S*M99A|({Dycx6G&~Z91TH`yR46`o<T5d2
z3YeX(>Z-S8n!$+t04+@sjTcjQi+3l#`y}sO&L?7a2=MM0?9aVbx!%{s;?;hVAQ_Y(
z@x;9DQXYHJllUOl3;}0L$<q4{FOSRIpsU=Vu3HC}p-cJB4v``|*a6$;af(yIPt1wy
zx}YAQ0N?$^@!6Xv;fGy_ZUitIVty|6;)g;n6q9F=<+zD_&!&1~PSDaWu+ozuWrEDs
z%kHjxa1E+}hmMCbOXa$*pF1EGASiiRS^1tfW6DPXX~dvM&`NnczI(R|Dqt6&J<54m
zybovJhpNCBkT-l$Ry*V6SxktmYe+C4bV|`x0t2I*9iPe@;*rt8OZ`0f;{rbJf}b9-
zXDtBYV{d#%O#{&1s9v8FiqC~{;*YQ)Jj{Rj3&~WyJ>Ta09)h1*%UowYGT`7~(3%Vh
z2t{jOXo3j1t?Yd^<u$OZgy0LNzC^>i6fgoe>39JduYe-(Ce*4KS6<>S0KEWz1~Cb;
zSwQnsbeTb~1Udp(y>p2O`~lPuIO~=lay5ke*B4l|`i!WtAn1GYK7LaP4rib6LDuR=
z4Z^Nu0lg^c3fKBD?FT&+*2KTO;k}_E!Vl3rkEc5wctc1)RL0LIhUr$iDKF0gPd+u#
z5>AN&n+^((o+wAD-3gD0hO!|_uQ#3b$}|fQ2Vv4Nm9W8E2To6+4cP>f#;=hf1tYd)
zNrch_d=BGe1pQ4-s)(@pTsf-wjLtp~b)tJ)VXebiu~r_*!HB&u%I()y*l2UQyx%xw
z<NxI)(O&g?sdsW3@iFnd|0;{b*f}2VwmtA?=B;G3i>)ijl@TFVvFO@g!4?XMD;PSZ
zJar<V`Z|?fyW0QD>ssINssPoi>DouMU&x{@gDExvM!;&KxLB#2x;h#f*s7-PMFvB(
zZ}l|wL=YK61;uwqRz?s0kH#`5s3Kr&{1iBDgwI@k3`#QNr&Dr$Fb1KZ-^AlBC|Pht
zaWe6Z%!sDsOxV#fG<fJmQ&FYTHBO7Xk))_YqI(A}52Jfa9c`_>WLK4{fh#SUly*WX
zPXu|W8BEuEE`Dx=I8^envjTCOO0wT<Lw+=RZ|OzI&pz~q@M!c0eO=hBaU@e&%wMjK
zcRj_}VZQRgedwKzIykysHVZw)-@|-2BO@yyPP4uQ<pfw{y5hnvYiI=-omrd%xAu__
zM#pBR>sr+DIIN7u_Qfs&7IVZ)!=XWdZHWEmD`5uZt_onmyG51aAV5^U??vy^g$)~z
z>wuO9Hp`OOe@~ih*4*=jF_wzcf}%ksIg5Mb%ZfB>*)Dlzii5qHjTD%&!t(OUmml6Z
zF0rhO{k_b?SbhbOp?2;%i+&F9{CJEf<1&sa@NHZpy=U=erc=^&HQ!r8eQ{xp%uL_1
zLZN--0Sy=M?zkA)_E#doBeJa`2^EfWP$H{P9cq>Z&^4IUjs!D{Vdy-OkU6~saa%Z(
zA|hbY2_XSwUemE;Y&O5u#0_mr??k#W@_HM34^^k3S;I>l!7OV6k~36!!kysMc|sv!
zaQXz0%=sa5x@loD`fzi;c1)OIed3AZRoF!M2v~Q&OCN9>-{6T8??%n(7En^--D3%!
z85ZqM2&y`E&w3@hM^M@%IOT;Vk68>i*BG=~PLpAiJg0J=+@O67v64*kRM>=xQ}z6q
zLR7*MOG_~5G|C%`o-u$cAnr<;qboU-%p>W|7fpWiT7=>#<#{V4S+BeNhLD=JxB-*8
z(QtLc&I1Yx&l6Zb`|%5A?HD_v;D|D>Y$I@Qk}H^5vriiF+dK+Cif*a{Omhm^1Z5lf
zS3j?-&nB5878wwiNG(OUl^ixN=qLJNVJt;h5*pQO79mC`?NrrA`Qch1C~Z^3%@7@}
zczR6{{Ep$*C+cy^(W#HO-DjVjiuh2k(Weggh>-e<)3}xi6+N+`ONU+iXtjKXVdp7T
z+l`?_=bT@ZR|^~_g6G`QrgwS`zdui_U|R{#@Dwb%F=IJq$q6XC;%GnLVkrIW`mJLf
z6D#Q6KbVI+07c3j;I60FP<ozzPEx5=J|hC%VV^5qhp-yJMb5~`7gVnA!Y5LxId(kt
zq|BGW^-~-e>~WnIuQuMtbwn0)kt^^*Ipu7PS4FOuT`*{9B?^NQjJc2XIw&KeD(sL_
z9=tXu6=cZiYyo(6teFIWLiO=gL*7mIea0w+mOlG=#5wIS?U6hJ;zurs5MmNgD~jyA
zR=cSsKi^w=U<%OybvjfWj;a-1&;o!8E(ndVu+`nqbV3%4kt6leiIEbqobIg=-BzR`
zx79NL^g|D(0P-u8AkT_;JeHmU#Db0@mB>P2GWpSKGAxoleAY)ybkYnHuFC5J+CeF=
z3;?UTpe+^qXYRx4y7xxdSCGtFJ|--UXPQC{RbK0<=1XLuNJobrZEi3G^i+gf1rKH`
zVBHHCeEPwF1@8cgyjC|^zfI(I0h|z1b$6lldB6<f`+Gz5U`Fzvet3vUu=oM1pY(FU
z8PYRWY9Kq<lvjjXyf;#b666E?cVT;=^pE-CD?V_|7NuhG_aKV45wct|9$O~drJuk+
zSK=R;7I`hsd*03VNy!Hj0WswEOp&0i_{_<HBhLvE&jx@;>vw?=E>~M17WN$Zi3@1X
zD#9<QSnf;%nE`?c$xpy25BG{=+q@^~EOj511b&}<j9H9lJIHyRNwRVSHyN`tt@fuM
z?MBrL;LPo7u0{~RXGT6ce`7CY3c10{V+s9S_(65lYnp@q5w-`p%RhGkiNisGMnpd1
zC=oFXB)b}O4H3_QEmVc+5x5N$ENO&_V{W>LubRU$HmzwPwKhg?K%Yaf|NAkUYVd(g
zNTNfKGKd6_R9qjFH^!=|WTer|6_KMs8j$h_;d88gh%)<?29xzM)lCc_UE!N6y^iK^
zqemkppTuCK_njg+;QK`EfiK!KlbqR*V?_&~OoJ{{0<LV9uNwbG)AEztOcJ?NEu!To
z5t2>GXCYWW?A@BX9t_zo#m~S@lQ>b!GhcQ7^QG;yb|6;b!J$tL4VV}giTBnEHERA!
zw)jj1S(I5g3~FKXBtBFYH`T1HJU45Uje|D#v=)X+vvSb7<Z6arL&#U%;%t=G>AA*9
zZ;&f!EXA_$G)4*K^P&#@01w`%xF?Ex!-mkD2>k-HHH#5#2)+PV{XQ<6#nBw&7szct
z7tSdnJ;<knN~c?98U3Nt?270PB<!E}Hn5rPA+|<hVd)!2X&aOB-J=QdXX7~>_knBy
zsvyuH<6u0{8@qUZWno=PLa=3<4#}`?&N9JWkQYR}rTHldyOa`I6pr-bc+cQGD<IHr
z&co2)JRaSout<U%EJ#S`8!XUB@EeW=Va8RP+Sd1Tcz%ck<H@DHVIUe-uw0!{JT47H
z`|y(b(p`ECkaI}<LsI0tT=vLyW@Y)OC&RTrV1`~<i*^Mrf#;U<7^jguUv{71Xkh2y
zgY^E64)8PG(h@6g)`zcp1J0JC$BM3L1M?fNxvQ)EchLJrOAGT&=cz4AQ_08sJt+Pr
zLPMRf<b|4#m++{;n<LTV?GRMP#n8$jW!vxrHJqbmTSz}fea@`xDr~;^M*6a=B4uY%
zYt!%G<3o!KQG_we%IuWi%;2|3!@?SgnMekSHWh$!4}a&XLqxpj4xm6d2n5|`F#&@b
z?+FOS^ZH*$%;QP#iU^fKO$p%vdusuE>ywI9ySls#uGaV?obQ2-Z2G5Hh>q6Df#pC_
zvX0hJ8NueHW7k*v`P->RkC_4k2a?sz(X+GYx|1XK_P$?3t>l-L$k<R{p&<A4U-NuE
zOJm4IvJfBPdw&=!Ssr~5I}gs?$~!Z8M3;_)toZIwXLQTQhby0Y7C6$!+X)v>77<>u
zY~uvJ+<L1QMO7e)+<+5~g+6VD^d6~!=X`cX>{9Eip1-h}?iJ9L3|O(WJ1rAau|^B=
z!KBsc{$X6!9&!@}5ty!$QfbtWh;cl{*c(iibW_tB;e^2&NVcca4;Iy|(#O1TLC^VY
zjo1}N*4P@JKHV5Zhft%Qir|BJI{d?n-?-RVKatOai~?Lo-y2Rcy9nb0p&R4x!_ua+
z*;)@vVRd4NTpW6O@EdjqWzvR5lu;<pJ%Je^fjN4iCc%zIHHNQEr}C-DND@oe3fjDD
z*u!ot{v4Hc#b{>L^@cYNp0+e-6$A%I{3ah;!uy|Zlc@Q4RGH#2>w38G9|mKfb%dX&
zG&X9A<dAhDni&O9b%VTgt87x~yTD+x+C#98fZ^b9t!p%wG3Qm_x8ZDYfb<Dcx2RlI
zn-nLO)t~Mf`_$C=#)cnbxgDzfc8`sP$9&9xFGj~MjfKIzmcyZvE>{j~Cx(R0C)bq#
z9Ko|5Bdj(8!<r5Pp|+<@!0^UJgCPO`7!P=SW~4?z7Lq|98I1r&6zJ6vI1(wOW*B5h
zBK-^!Il&R>HuuGNuU?4$MPXftwRzZ*?a+yP0~E{!@%KTfb{YV3<529?hO^!BVfw*|
z>z(fqPjISO!|M4arSij`RrN*rr)Zz(wxE%oTD^BN021ZVcjf&_$*_+}M(q3X-o9l4
zq1PqG0@bm<1yfd?Y;C4j{cSB5$i-Ewg*`~<g)mHTnP>)=<;Rn&Zrg`)Z9eh+y0&-d
zoVe8U^ZwE1dNxpCm!C%%5wDP@?j7RT&Nu)?gfr@v;Eud<nr)lVfdn75IH;hh8WjCa
zb*o&aTjm%xPp=k&S}vj>giQ`d5*AvemqCsv9L=a|Gu`_BnDaRn@0Cl=l|Jo)NX~@1
zd}C8AQi_3jO7Fu;Y%{32?@H`NcLYVuK_Kcjiy4^Icuxc*j?>>?UZk=}Pvp8ZHB2Oe
zgbI>MI<y_ZQ@zeHJyb-|FmFBwIccy2!tGgCwFJO1&0dUgKFc9?>Gf3?h;`7li}iM{
zox@xPf!>!{LEY2UMd4dM(2XB_ab;HyISR>yo2!~V$Qg?IeS;GHE0+m+h=Wg5Jg&wy
zWdQ2?!&gom_mE^JUt=!8`$Hrr6N)xqu{)oWz>|vrn$|WVT)FdKX<lC5;najpjbSrJ
z%1pMFTB~;U^@2Eibq_wp+oW-g0(F&^%1hhy=Z9;LG(&pCM;A!HDON&H%l%c(HiKp3
zxzX$N#51XC<+l=PN;b=3XmN!pp2DD%04Tvw762AFL?n@5U4SDJUb{gb^W4RP%{@Nn
zvmIX5EH{UTGLjdY7S>8Yv5*#)hlwZ})=hVilMV|g{GLe<7{lMkEEGIp`S0QM`oLx~
zW2+OlKKanIy>fthPFw8WWqZ;PzBzaG&L^qJrAL#4LQ&0az5!GB)}R<2I`<YHO%613
z9$q(eB3?K3e5;t%qPDXL!+8RRfnW0DXUGHg_TD4x9CusO^Vso76hZ`T3=d!9U*vE3
z6fQP+VTH09CTwJXNn<8{PA*ai$Df|FD-VX|qbLwZcEJfpLZ3E8;$sjA|NE=d4k5Ab
zh$ybhv{jzw*9WoMvDUrP7)}H3i8g9_e)u>OE0(%P^RMPpy=M}ao0d{WX0LQBZ;mbQ
z@xZqahtxJA|HFdFbfk~n(+(Kx7S-aA#;KiHl&j?)uy}0DtQ4j@@RHe@4RP&*MqQdz
z`LOjU_Uj*3D-f*^$P_zqm@vXMXhe`dI?IGINgSt&vLxfE6~q{^By%NM23Pc1ySEnd
zQcbeT+0PFiHe0(gDM?}}|K4CIW$SyIxir*Q_u9su#iP0!5qmP}!KOn(xW#^s89;9;
zhCBM!gB_*wkPyAS62zJM$vR`{=X^+`<iSYwS`5+^RXi|*603=pnHMov%Gr{`lrK4x
zmNkRlV4XS&_`Pgr6g^L@oY76<_C)n-a2cg%M)UrMnB7*o`6M#+b3{)(+cQomG4#d|
z!!r-G@IQteFH^GlWc=L*w7k?TWS-mMR{1oU!m(bRfDSE2CjVZkv$o5GM1_tSldn<g
za+5H(qX!Qje%?0%-^jMl$7p@L`6C#^l0+76X@k*cvvEbfsbxRzFN;F+OgguaZ?MEo
zP*oa!k_QD2?xsR~#MOM{<urxy!NjuQwc5l_KfT&w5cv}G6ILCYX`!fAbQ$M*AfKJF
z)Aoz_v-DoYvaq9v&G{^#!uS3nEw~HcM`<Dd4F3aNnoj@ROK4{aQbgJ1q1^h-?R}N3
zduzUj_Q@?4*W@w)>KPxl!!v1KT?2-nxgb5Agdus3=JMynNC=wR2h4f~<J{54&KdIG
z{cKC00>%Y)8#9MWcG!t0EKhBmj>1rd_~0o=bSZLsN83Ys<q8)4v_F2*EsCSj4Xemj
zb>TTwDBcmEBAUF{8xM400Wxxio|U$J-E->xtF^O$lJ@GP^>ee#s!pAO`zSiW26nDX
ziSNJFUlo91p-dNVcEKQHg=XrE{MZlXWwj$}`vtWh1b9~(1yhC*C~QL$4g2?Y^f%oB
zMAHTGuUnl$2NiYJ7Aczah6$tP^Mi~!1%TriD4cSDuccGss{idtmHv4>UY(xt`4jhU
z#;BR#&~%$dn+|@RM;s2Jjnsas&)5uNfItgG%3Nbq72fzp*$6DRu|HIL`i!gCl2a05
zQC|9nPTFyzg>!ix6VJC{8cyA+N5@soRQ0s>kQg^DtlWYcR<y>NXg+Cg792ZG=12LW
zkt?Nib9dF1LrdL>%DYSjhI7_tGu?$FW!#=z2lpj%-t!~n3~4!YTyN<wC}R{-k*^j3
zziYX8E@3_2bk|+7QUW+ol_|ID83HH9x>jB7Vjt)#<S_If=m@5JTdR;)p)1Q#P8pcp
zH2V7sIXTyo1vk`HWf}RUp`f(2GhTZqt5n$94C5xUPq6T^ot&AHhUI1UEWqcrL9*SM
z#OB|6FkuH3_38`duz7xuV`<JOsCGKVE<PLVOeqG6>Fcwaut7%I*@XsJv2uBNjHQtm
z)h-?+GU_A658`mmro%%x`xdA;tesEYg*}!Gnbp=FzP@JGdidB%5vlL7S0Ex`l;6~(
z39Qv}g(XZ$@C=Caw&u;voN^Iz^V;zk=CZctQWgz{jyct@19p9i75ZfaPtt#MR%j1&
ze%S<<z1udC*|QWfu{-GT@qIFoRN*CoyK>HHs7RPLN%<f-I9E$X9%=y_+P+ekUU9&O
z*>&`V>xPc2V#?GxcO1<S(Wc2mNi)6EH0%>(W^2#ejzIRB8%g$37w6&B@35fMihTD6
z#ajD0PuDtsOS(oI7Nr2_yYG*^SkeN3r<u4!jdD&-vL;L*Eu8$|^vfe#6;lQa%B;QE
zw+3S*+?LM>#g-^~@&G0{@b>m;oah#Lvu6!?zuC+F6BGTm$g6g#U)WbIpU{)hS_WwR
zOeO|T&xd2ZuMbnGt`S<4(e6J-YG&x%)^r3MyR%Ob`PnL^O3EgDW9Hf)j|%392jPvt
z%e|s3R_zdw0!i~ZYUs4Y)1#aTYyfT*qi++EFC@0n-wMB##xC7eYVR#QtiN%U>%QQz
zyB_;Klyh;77=@!7L0s+*+RAfHGFfahSQ-~Hk7PDkWbW%z$)mvrTI?>J3CK1LHh!?t
z=Br;wKCLrYU`Wnwfk3a7&ud6EF-kL;9Ba1G-Frx<yw}=6pm3Aom&I~+{dt3HQW)n}
z4p{A#Abi3`CccI6$(zqO-2{Ki)W*inT+k*qH4?@^^Z7=NGuM;YUm*U$e#!Ng;bJ{Z
z7PH`Ac>o8?za;|yo)b#_U&smHvB5t$;opjh|F@j*PZjdNbHe}T=>D(agdFUDV4xuh
z2M-Vv@^b#+dfY%x2V{0Y@~8h7r~8ZJ0U_c4M)BTZ;NKY@klV4b0O2DLJHGGvZwVgj
z`%eE8g2%@B4}zC8X5UAGB6;TnIrae+)Q>WeK_0e@lKD|()h7Vld_gT1l?wjN*J4n%
zm`Q{W+<gxTJbA8|t)t|mFZLUh@~^f3hp}$}vNY)08{4*R+qP|c$F^<b4t8wY+_Akg
zJGO0PzQ2-GQmLd;^`5u;wr<_-(_Odw>GK>b$VE>Nm=pNUEhJ>+f3$rnYs+(5gJy0O
z$KyjvS?*+B3e@kRwfWsSr$@!3xOUJ!9yodqJe?gA-m+SLZBLLt2%fVFnwqF=rthx{
zT~;7-;npfPtnGI%kF>|_xVm+aI1pIZA_@4EUuf-rT!oxxxEZYs(#^GznBKNKw9MNy
z{5To(5@54k2yRV?ouJVyg9=>=$e__&icJd+kf>0lD2uVANlK&`rQU_8EykH-qaUBN
z6e(gJSuqFR&X~Qp{N1UZgvsXgyLlK1{X%zu7foHP!`aCp60pQx1$1JJ-wwyq=LP=b
zDJ|&M_{$h#^86Vh&u}>2U77wIGp(pN_y3%%{}<K%pW68!egE-AFJkOs{vRfjABg<_
zK4JgA!Mp$BLHXaoyZ_RO|8>&+7drgkmE?bbcdX1mOe_Cy_6ZiIpIZa}tJW-ad-<v@
zzcPIRT(11Dr#5+gq=;CtMMyvg$wI-zu!xC+B87lb0!@RlplM*Bf^}nTsnqKYb?a9;
zmvqYAuvKUVXbMRN$Th&7td(uim7>I}(n+%3&t0zM`W-H>FW>zHuL-Z=U1mBa*YoZ#
zj=6z=fl`2=fEF#|sCaF~k0F7IVS#4&+q`ua58G<cfVvSuBd-~?_yVBuRhp3lvw<8>
zgK0A)Yf~ugArgTC89J=S2S<FK1%7NXX+el;^|`*I$&o<N1F_a72W9IztunJcsD&Qf
z14}bD81=ekzSp-Hfd<<^%0+xOK47;2Ut@ScjW|FOZEbDS&%TO0z(O;ifdiK@8Fe@<
z?FBGD9+m<(T~7~TkG5}%wl_hA>c9i_V~*=|2Hh7ifuw+e#29k=+UY&LvM>Y5fydU!
zGYlK}Qi85Q6P;fC#~WM8%iyo!L8xSbLM4F$gFw*ah+5&{kT~v*amJJoNdg2wjy_yU
zC8O@sf%{mtjdHe~kbz$ROkn{Xn*O-smRX<D<$KJY&5s1ipYh$Tz?f~XBQo4&B*^Nc
zN4&Spf1j3pitQDhuy~CCDtK%YTKhb3M-oQ9MwtYbYDj5%-+5oEQmT}V-6QAP=kk)z
zL5~tbAwgE<%j8Csl<Fh}dd_39u{?r+nu7uIX9@}eLdJqcHKJh?hSdXI6_?wPpb~+O
zjcD4jvkH2hQGI9J{_-LGGT-W`df@%C7`VKFu%=8%<{V#bPF!hfu!|#t4L}Q^h)YuU
zs%#YDSMA|=Z<EX^mtT5=8+sXgEZ8_U*yWzQmvm`dH+R=2aEM~u@fq*qQ$q3NeMy*G
z|2;eOd_X_$v#T3$eb|$sc-MwbN1(-1?l#vu=t06M#y_8r9u~baa)sk7!A$FKJBCkg
zGA>$TUQ(CG;bHYTC%Lz{p8%&CQ8B~-0)%};G7N?e#1LxRWDa87&ZJwq6YkPv4k2n}
z)=CGsi-Q6s%A}V?0t;NPhx@w&q6G|FfdAKsTP{S~k)e5jr5yxg;Ls6UtN=tIB8dq_
zV}MNy4Aux+4?(m4&=Hv~V$7p?9_Uv+l16_C6JfgF=sVQ);VM!P%hr|E*MXsK9$3Z@
zi`L-cYds%t-XbxG<v@uewO9c##(;=b#Gxa2pKS>3%UWG1M>~?jF`cCw!q4T=fDq!y
z#1<vVghAHzZK>aIwWX4~$lhpIC6c@5zv1#wCWxq02MB({%^*z}H7G%NiC}LMr4C$N
z)M-<NRJ?pv{DL*F4<ZOtF}MN|J_&>$gk=)t`k3{Fu|t|L4rzz7h}<^<#fRNkuS(q6
z?lcN{fqEJ7T_ZApVhyD=4p~EB4V`u*^ue`&LJZc#d!2pj1J8KCX%9WzdGokOowzXN
zBLrs+MV}k!4Q~oXS7I#Qp?gCIkV7$vS_L8KK(d|~4$zj*3D1VWFEIWF&4+#bct@xn
zf-wT+MV&DjGU}WIS#3}pK<Wca5E?Kt3>+{BSMf#*cg!RVBi<7Ra^gLR+8AJr1riMO
zgX$Lu7Cb=Ma{<a)2dah<+JqId1dj9(dVj8Z6zqNyLVW0lScB1RQgrVpSOaYv^t)kQ
zbDTg8jMyRe4<Ocq<m|7h2fjLI{Dw0SeB{QLmPlcGC0|EOvCf1eodrq!yrK4$F(BQh
zY>G-)N_1y|voAs~&XPwGXMt-SG&f`8&hM5pz}O0&++k@XG>E{sBgclQI;lEvfAZ6k
z*BmnUtwyx)2R5(AxBnD`3<mlBIRMdbC-B_${xIzLVyux=$@zQ;A$u)A&-|EVFmX*s
z-`W-j8J`&(oa{oKpX@}PANdz`Qt~6@Kk}b=;gwi(4==L*T5hDlQf_3c8)YG;J7pp4
zPtpI#>%S-~TMv@IKLp!(+qsdYKS}pL;`LK=^QUG9FY>Q51u@*8#$A4d`zQJ0O3YQ`
zr^Z}v<jjSFn58Ra;o^U?e`;C(WUv1;=;uMg)543K`_t&k&-b<bBp>`VR?3T9bEP2G
zC1rkmDAODhd({os6g@MN8F$u=)^s-`%S3zLjnyP}Ofn_m-fGHG=t68!=3x-Jelx={
z74Bvbsom`YY$3|a*niPH^O~9F-fE(;upYdgICIZTdnISg(SFZ2Ws-Z(M0*B^(Qa<S
zZj!P@wFt|N%Y;AU!)yx5bz!1C0mNzhAJa`ixN;b!uX3X{IUd7JiR3Oa!@B2%XcxHP
zSbWViG2gqbm>yjMqO+E{!C9M{5Lgv0=`F5i#xpy3Y?)Y--CI!fmolmBY~;}LHZrLI
z>xonVy<Dp53I#L;K}uz=OMsZM+5TAEcpNJS4CyM;Y>nBc{PWhsn!MunLqyK-<K=U!
z;L3~+CcU=U>MZH`aWZ+F*=MYeB_GHBDRw|6ac#cW_0*_E<0Jet2j5CRg&yyx4$pq}
zify{yP&z;~y_%AAwXN2$F>ine<Xp=6U$Pt8N}OJX9;d1Pc_;ZfnTxbD^e=q{ojM}f
zO6b%=p&K2U#s${hG@{#&!W&Gs&D_YhE>vX?50bN=v5mVDQ@d6WYxxN-6~xkhf}b%e
z`3ZgoH|$C*^=AN^d69qA$?8t$g|f1jP@^#5j&}ajp8PFbHtLEs^~69ws<)PUepQY9
zt+G(;n}~K^lZ^Z?Db0KaIQbijY9XTv`5TCGp^s41pG|gg33;`uC@S_am1&~i7DP4F
zf!V+^TF^B9BUPEvy3A<u%4pKaXqAB~+vFSYkJjdYx=ZOpt8Ep0&VTzq4POdH`rZG!
z{oZvO5o4(r$Q7)j?lCrU@$0nHP{o0;haMb0dXxJ3K-Xh@v|0Kv7Buao(qy$FrXpBm
z9Rq@zLz#PgAnY>!LZ6n#9z$ZC`7c$Wl|$138(P*src-h&`6ik6rN#FZ{rmGRAK@in
zUxxrP@Ze<qalS(J%!YDRO)=Y3!+G$9bu^dRT~7V*BpSI4kx+xD*weAPoav%XE<tux
zO*~yJNEu|v#w10T^pv>9+E}W()}Cu?^hk0+^eF$XfE_=JP+IZpiSty7_M7hRk}>6;
z^fcycBSZRl((F59I5sxKX(&S6#w5vA(T#3F{Ak85T702ReKec&)W9I`&*UJI|9)jW
zyJXQ%DH8VGr!%SSW(k{xlsY>@-9;UKU##^)+Z2<OAD5CtMlq#|(eeush#{`lcH<Z-
zJb5=D^flOBVZnQY_KVf+7GGhf*sM7=mG?#S7GH1_x2+2c#m!S2(R72%Lx`lh;Xm${
zY%`!SoBzbYnqtlf)=^I%aUv47rY~3PZzQ$uoi3UzpDxyZG4c6o$?JM+Rd-V0C#e5)
z$@bhfuyo9b1zqD4tyId2)^(DDU{<~#33`qpFosj~r;$v`YX?j5p|myhF=pJJmj7B>
zC~P=lOsVFqo%0o`qp&|EndETJVl(>o#Z(XU)BtCdi^E%0+n>UAHTIhI0L|8j#VW=~
zIKp&{@SA`U>)-7Z8mQ7u#5I_7R-?ZD8-KOjT0l9ABhRGddAJ36SF`C!C6|V6j@nA4
z&q=_Brb-_o*OHqBIp$vr{4G?$R*mMXDGbPU=`ZtB!&ku9bxx7lm$_=CrvI+kSO%_X
z*jX&PQ?+exv(O}eZ#ZLtPjkh)I;yB<!&hi;xbBLd4z7H_E+(zSkjTHzyEbymA90Rm
z|IKzvGqHGUe!egAWVf`19%28!Jl`DUa_P{DVw?9}iLFY*h$c;06mhcKYj6H>;6i?k
zq3OEUE`>TCv1xg_xHan^RN~M=idLq5Tg>A-Qh!$5`C;X<)bSM%o|=!Jq6N@Uu%48Q
zp&UJUxOa#+@{I%Kp;uYd@S6bYTQ1MUH)?IUCZH78GUHW<8G&K2)W1TfjV}%}A(xM#
zT)vfTkKUESu@K8P`PFcw<wKSWm=ARk)w+MI$w#ls=WdItb5EyOrD=H6w!O8kp6~)o
zYEfNaYNF1K6<^WtlH^vT9HnTh)#v5@G1h8zyZm7Ac?55W#MbR9>Gi)%&ephSrItVP
zSXcaD66AkfIci@2tMJF<y@49DHg4Jm=jWcevxHzn>1px0{5r6@IdW>>nuzgUI+ix8
zi)?ar7JHj@7c`PKYga`I3QvWbiOaoXtuYFbXAtlx8ZO%0g@BT9n_}P}ReZR2Fsz-%
zK48rDOVpjC3P`zkuuP-%?LhE!KfLapmOfy@mkWn}ME`d#Fd`$u2qHyMq~-)sERiRt
zu@Js@LM9-HweLV*s`_tWaHhF0NVw3TCuS_LkPA~KsIVvINTFc?2<6DX0TCpTe+@<9
zqA&V}j3U<qB22LC0^miBB0ten`;p#lslrg+ZMooOF6xY^02Tq@PFOYp&_hJ_KQH6<
zPjbM_BC=!WCuj5MWuGtz%F}iM+{8tnFn8*@VLugBn_vVCmU#eh(eJ@85E|p=PjIyX
zt9Po{Aeo<6n9REi7wDhA`9oY>LtnIj@x@!mQa?0`e$V&1#L(hTO)l7(M!}FMzFaWW
z%h`hLGIpl%tFUpV^{X(QycOY^f3T{aJm_Z^q)LdYmx{Y~nKpz$)=Cb9K`sSbUudO6
z>ra$Sprsr6gL0YH0Wk1$Mgee5o;<h~>x4sindSi?$Aft9rdFXYmqT;IixyVRh(mgL
zGa(l5NC3$D3(>^A(^tnlKPVl~zcAGAL{kwM??ie)HBXZDKn(SWgJF(ApUBMvAn&5>
zP=7BFjfwTl0>Cco=f0qN(4Gu;Osv|zK{EPD-WeUK_3Q$mVs=s9LEB@?GKNZ?AnU;x
zn!Z6~cUj&+AN<w=!fA~vJ}tEnCNBhsVA==2SoNSMFQ1Lc^{o34t9E4G`P*SM{$39(
z^YuW~Hg1R5?%KTTw<FXxY=>PBv^@FT__eS2V`>b!Jps29^jZ=I;(B_MR<|Pd%h&(?
zLfwSpTnh-+-Jy6_oCD_EfHZ=4T?+^$ym6(kZuo{03?*E<?yuqNfnWK1-Ouy#`xBu$
zLie(5*Imo94^%MN?P=r2uzt%Q_bPDXvTbMdhV-5O1zM4_AOA_W9@*cn58C7Ip{#y>
z3(;dh;$8j)`(x=RI;8*P|H7?!9n^LC>BzYGs}J~jVD^%8$G?5lAJiZCdCg}RxP5gC
zvM==g!taJ?)8RVAZ~*klU~PDD`lg@<(;vR?$NE6De%v45AGEL4FeGAk_38WuiqEVM
zAz@JT$@T_|&#n)`+H=VtzV)UVm7vKmZ2QiY)~?|jsBiytf6n?FxOKqcQcwu<W5pl5
zbx5NNGB0rSQgi2d&b$vqanSu8-4iCS-Y^{h#^)z1obr-j4O(%X{|4@&-Z0qG>kW_Z
zS07xL=NliNX&+eEF890mN%-+ah7saLqhTnf=NrjIt6^Y<QNkxk_tYYR=YT)3!R{&H
z4!I9vH%#4{&klQDFG4{5bHBk$$Upe^9d#ehZs5AV|LO@1+PZe-*KDuD+l=Zy`MTlX
zFOGNd*DSBY1qXAU?r$hPC%3>McYgU`cEet;%?|n8#P`5%MF{?#9mwC+f9HM)EDH#F
zzBt|y&GQGl-k2Q}eu?>{!`nMGewp*f5C})SwA?{`8S{q_2n%^q-~x%buq?nt*qH6N
zbX@bt`GUz`Qyfy}GPw?&{k^&cZP;)5gz$p<vAhLrIH>Fc=?gA-S+;BYvgr@=g%Hq`
zA8g9^3F&Js2tMld2Jibz5Snr)^ONl1mJRf~J|7JC%lMlBNaRFZ2_4zF*KH6B_15EV
zkdp*d8I4>ym5e5kN;a7)Dws-I3%y-d9}QgDtZ*z-3f({%NlZDZ9vC9qyAhEFDmbz)
z1=D+49GFZxSxh-S6RMD8Jee*knXF1BfKZ{01l5x;dH6li3l!ue`=LgF>?60k9ufLI
z(fk9NL@K&kDw<5Dv3gvA9~$659tDk}4glWe`zegI7ID*eCYs)WC~k}*m0dVdNjE-G
z;kN@BOvWl~LX$2I2#dZ42G$GrZA6^U%J;n!iJT;%YAhUUtb{=s>qh+QAA2GWp_6T-
z+v77Yz4uP0+Lt0j7IXZT^ec}pq*;rAYpkt|E**=m#E}UgTq~oZ?M4(=Mhi`?zK0OI
zX-Df_9ehv3!=j;N)KeD+QCC(MpJx+>5MN~zS2b5x)n6AtQ>sUlRtA$cW-v&2{yo+R
zhLV|=;#VKA9Z_jrS!f#^>~~UGOH*0uz4RsEh?HCyolMe>rmo(AzC41P*guG<cnZ2*
zNy&I2nkKZ$Ca(^!uO`Iqs=v%GzSyEiNK@X8sE$sq?rO@9O?<ABE6`o`M7+<l`}fJP
zy|NOnv-CXM2CERJQkIiVRFz%y+3M5Js<L#vl47FrWQ9#W#avrezZ)3axAe#k-{O78
zLD66>f+D2$JiN4{9&!3tyK6@6X}JBF0zW*GZ+5kHVYPH=>1k&*Rrc9DK;UB~U?Ji+
zZg_2%elkS%=;6Y@aEo@hsy;+~N*dcvGTY>mbDq8QS|3kP7BJtpae*87fQ<m+qZ1gc
z@X3;M`?lhsE2j?li=kgHaAkQ2Py+h%ZqoDQs;ls#>gf8M$l$_3L{CX2<ig5mpaDM}
zFr?IP-o6>WyX%)}pRnt6%Fsr;8UYNUpf>;0M$DtyFp})57a?)qE#bqid&j?UV{bBi
zxJA=Wxs0p3_Rrcc0lm)25*!9?X0!ZBCdU^2PIDq6G^qT)ki7%j<FE~jCBYk)Pwjf8
z)aOQ8YY`icIiG&*{f8_70X5O5d+$hMgP}QfC1Sw?2@>a@i*oSHvwn9X7p}HO-g1+d
zPu}R5?VstZ`|SFqt8iWbZ+k}{J%WUzC#q~+XzxvegxYh0jO|Nj>w<xPK17msQpg+l
zF9m~0ZUTI|#k*{RK1HVx%ANZh|H)sk)qIN;$G{1v9P<B6X*wn0b4snx!i_sa2-<WZ
z@kw4O4%~IbhM4Gn=7*y?J*cli{&r(9@G_{y7~uniAAw<i#<km-wvm^7oq1-uO{Pt+
zxmQp4q<NO{;schEP;>vA;@i#ZrvWXNntZ(o@Ws#rxG(tj*^sT4!E$}GZ{6y-TZf(j
z>nw}>MG@DYD42&?+)uacULPDn0OjKb2N{iBPr}+7+`vN}gWm;j32|XTb3OX*z<PrE
zx6Rgd`Fa1|CWLC|C+KVIKYr{SfER^?Bx)O?@ZrlN`uV}_mBNSzVfPTB!Qijqgdibz
zup;2b0bGI(j$;*=p+;0lFj+x~yU<t-N>pep^t5PHa9|$<H~pvN#A0w|h?9+jFT7sb
zKuE1b0YbvU2JMcCv{1iK`Uio-UI#veU&%oM-o{XfQ1D|-B3=x%2L#C(oJN7G$J4Or
zVIsn?bU-jw<F9rtjsi@H#!@U)ThsmwoAjbkG|E|t*A#-7R}fh9tE;jS&BbqT-l(L0
z8cQ_sI`hkLZyKs&{en4x0$TF(Cbg)4P>})<;bx@LX@s_dhaBOsm<G?Neh15m6o;xM
z>nuoNB&Uf1ivUwRG#5v92rl1uzkV#3M<w-Q(SDyCIc6~B=|$8Cq-4o6V&sG3SEdYA
zx{|DbR3x8~RWg{6I4ujKHiK5B+LTCG|0V;{2Ht~#{>^DDQn$X5Jh(D?c`Y9ss#ZxZ
z4zk1|8brLr((|zQuglPvkyL<__Fj0K@I5`C{e<I;7&TIQfBWin^B|L_MA}*tOHC?N
zT^L_!=M&eG)~uRMJ)2ga4!Rn}<~K5ih&|d)x+4|^;b;ZvKv#Ndok_EKV|2kP%PDJ@
z$2Y~jfyGlH;%QBDCS3ON=Cj0+)lpXOY*4=xN5q%JCb02|^wzu>R8|q{Q>pY83{oX3
zD^YoLe`vjIayNOcjAl(tT6oo<n=!^y$I44&-LURy$<DN`OP%9l>s<8QH1Qt{8Cr4~
zG*-LxZ1vLm^$V8gOoyys6evg;P<7zn)b-qR=xeB+v_uPW#3Dyhp<$ae?kDNp!PTLu
zC}BZ+;F<Mx<SiSxIHp(57OiY8Y`nXE^c8ta3@(~9hxjf>P?NYgs5pzsdxYc?DBNht
zvNC2J#f^={#Vlwv6;z00X=%hf$4NdCdi<Tn1|NSKeHL8Kb?R~w2|Q+(m<L5#t$g1P
zd;*f}s<P4u*OfLGSU)d%G7h#A&fVBQqAt;X%+0-|L$(GFbjgfplqx0#vhgkur5;s+
z4%5zLi)E}!n&r>Z#S$}%{}o2J^~;~hFHAH2Zfje;U>_wO9NkZ`;QVFG`FK>Ot$5Gn
zg2!NLLKX#4s4*3-Ay(tu8CcAMxS9S+&V9}CcJV7qzW9}6A=1=~?B}Ra3W$%1sDc$U
z$-z~-;Gb3S>n?-I)%C`&Co+jQ841l;8f+D28&@xFrk#u}#sJT`4)}dqT*ldt;;UBh
zq3~Ren!-|cuY26Jy`BTEnzB9!h>>w6YFo>yH46$RY#BUnbSeD)NCT5A$w*3xH=4pA
zpYfrC7t;jbpo~k>11#Y+G)htO>g44{35t5$^CgP3V4ME9WCT>e-=20BU!evPJiHDg
zU)9BzTX}i1I_r;@qodpXoWOonpbO_)Ya>UCMo)C|F)o{+@#=Kt37{F`B}FLnMQS-p
z5M`<`Xw=A#zGoqa(bL=WDg9#dG#PRU3DaT#AVBc(AFV)~9<?>0v0;>ta0HQd3SA?P
zIW^gCGB;SSib}zd_z4c8HhE1FRZ8atW1F{Jg~3^)p!69-n;K&ne8_e{`|@#-7FYW+
zo7e7|MnVLp!1|f<?I7g1gnrp$vIQ2JEk|uALV+uJI0|@!K9org(g4RmKg7WBO8;=F
z5mGBCxE3x<JvmfbyR`L>Kg7%ETWKQ#mmDp}S<(7BGq{0X8FN=UQgj;Su8SgFdDY6%
zU{>%nMdJ5h9>%+RN?+k~bxhU<5Y}7M6>~xb9j&0-BxcmU;j+G=ge)jjKyImB_(8^5
zTuzVEO!6CNVIq}JpWEyy+G{WLq4`*;iTIMG#ANqMIkBio5?Rm?B%<H#?P&fr@t~qT
ze$QF=l%yQ_{#fVK$`p837c1<z+MV2X&#*j>fWPIqp!qNX&|ByW8&y3YHVzFkMNJ|#
zpbCvh4;`Mk(skXC%ncA^LNu4k@Ghn@8buX8O1k^GdjOOnTdAoAXj%~a3k^=fN)tj1
zJLZV^;5ph{JQler_vTItsSq2hV={6wpLU4xO41Zi!S4mA--+5zSZ95H(H7c)19}Q>
z#{{|QGRw2_meXOpNxe<ITUs?IT#x>DCvr8;F(iII#B;mLgT6Nb71t<TImOd7ZpW#a
zWjn<yzYe$mY?0wd#tnCD`R3$bDp+juSB9|Sf&C5RP2&yhMjui5doz$`+65dgBa(Fx
zo9MB*SY?0ec>44GmFMXXDyb?N@Aw@IOQ(riwN$dK1TUUA#k>%_*XdJ&MQx0p;ga9R
z*6h`|UD3Ym=_2HnxAlxRreXa@#|&iO>AN>Al9nBzaYCfe??^d01Vl^}ZY-FEurnFA
zl!*e;c4n#7L|$lp(|^{=HeS$;_%IE?#4VEoQx!6ojeT+}&SY-v;c|Mv6Mv}B4@Opr
z<I{*0pomddS;;sMQg51qApAL)g7e`I^5MmV4B`pl@nS#iDXNG5TK#Hl)&94VlMV(8
zJ0{YaJnueBgIFSuLJf{KSq@hX0u63Z(>C8V*R?>K1Pt2jg?~ojmNTKYJj7L1*ncEW
zH-alMaFTVL(Efop(*voa!f$aMq?T}q&q}h)OW^=^S8<UL+H^4A#TcX2wdd3Xxt#II
zKf@W7L@lMR0WnGXqgxGH;$GObQF_UTx6VvhH?R$b#4);zYeK<&?IUWe0X@b#E@!#9
zhOSfZTZ$}M35=eNpS7}4UYE1}w_lWTwzX#+*JqTZW&8o>lh+EuUzw0ZQhSR9K{0Z2
zox@Bj@m6LX>&i1Lu?+8iGn{Z{u2AZvqqlH+#mG==Iz{tZR@H2wi5i8<qC0R3k&ev?
zL;|q()?xm&gEQcE8LYi{l;AV2{M|dvu=-ET5i&t_Os?zK6jhE+!n=Sb4cjFQ8(MbZ
zdn#|OvQbx+GS1V>HyVAY^Ahj0ysk9i>qZazWx0wxOh+*u5^MyRe6k)Mf#fXPS{6(p
z3WQ~!(b$tqe9I>@ZA}~M$}~u4x&jZqx}gnkr86!z&|9wEMnJ0WA+SiH-Fkd4$5GD5
z{!~#G#2uA(zP8K?qbaX~o-bxk-!&msghPEoz2$HjF<3rDNVKpSd$G!*D40G^1{ktT
z@#I%5Vs=5d@Xig$U^vl33KTlZ6XzL#;en`k{ytG$NvphCjR#HQ*mI+sw%g7=k*R4y
zwEP0vONI}Qj{%AYC1C|J3H66`SBDT#)_xlmJV(7lK0-TXzD1PYWBl=lclOW(s%*=1
z^P=TXY~<+s-tE65;DcL!ZG+hnVFieX?5?R#em$qBG_CSyM>38gadN!AX{-5Nn>Y7u
zN!5&=4-1O9Mdn}A&trj8lx=ev5_89d6Px<4hxzYY2Cb*g3(*tMVe3!C?mvhV1su`%
zDE_WE_ksniwCrN>8%G*b1OOYk9gSU2#ZRal$tILrB&S{^5eu4whK5?5v&x~OTI`ov
zMRa*4dV0Q7eU<*xz=74UggTLiX-U^m&wS5#&oq57Z=}>Iha>PNV85MP))}$`FvIDb
zyt=~^qUspRCLpaKG98%7RZ9!z%uZ}qBKG$ls^>4!CB%3RrBgbEw7?*Bw3wc~95+g!
zL*6b(5-wF_O*=*ppzmjCz`NtF*i1fa`g5^g?QeZuo36%J#YuXWoCwx9q;5rLlGQ(D
zwSE$<ENUYD(EBQ%we4;B`LeDk5WvS8sn-&fC|lQ6!B2YCLzb@H?fIvnZF>r@Y?~4X
z-`~Wu^gT$||Alt=a{Xi!DIWrJiDEL82?SEL!hlR(iF^rKUZksD1}SWrT&8BBoapDz
zmFI8=3KmL6H#fR-!1mSfm?s|&E_|<*I2(~H4mn~UZyMmcsMq@9_Iy^S?Wj;OOR5_G
z*sON88?c`B3g@>r{e=9)kTDRl!`3KxN^=0HnG@=VpSW!!!brr06OkANkGq$t%)nPk
zxyd0N$IvTKH*R#?nFvbdz`=(g4>A(3r{JP|=_-H{Hf*1Z496u@_b5-TfM_ki(R<wc
zn>(Q_dRYEj1}{Yh$3=@Qkax8TcXWW6CL&Zzs*{UF9FoJ{IFy-8_ahUty)_)Xw*GL<
z`U#y8PcbikS-Tk-9TY}DfQOJUS8>orV8+_dpn3;)qGJFJaC5{b!s#ug>nMIhDg1{A
zh7)7qX;3{Z6)rCEcUcm5$Oc3m))bb_%0Cp<>Uwc&Vk}|efEzyAfIPDfGG^O09c>r-
zh&=iV)kIcGaOGc{&x{G(rhl}ym`%A1rALr$2fQT10nJ`!z?ZR+>^80qAzi?IiZCxB
zhj?k@A4_SF1U_fW*V7~u84hNZ*JQtJF*vXOK9sR%Fucx(*@<aePJ;5fe>ArE3?~Q%
zobunzvFGczzCps@2YARHrKB;^_wGNDv#yeEXW0;%_%!*J(Q)e#hf>k}7QrH>$<&KM
zL+aCn2B`?d$prmX4<d#`5ekKYv~1(*u|C?m`y6M#H#08mq404FV)*Movx$oa43~E)
zPVW-wObvwQTJq3Wm|bCjVdh(X#&gLx3dH<`(#e;M<X}35su3A2P+Pl^@$~GN^apR1
zT^_<7|2c5ZB}!6b^~R%^wwJNNl+~1Np4Kv+Q>*k^xF{VBiX~ePEy;d&`%YJ@OsLbP
z*|NRb?_~WNX}XZ0!-h|bXFd^cMHFDwIiN#1&D@qM)rA)nRuB~!bG4gT11uisqmX{L
zc)tCpIGM`!V^-b!Q)7=AoF&^*gG88gfhZKpxbRd_x+e{POP)l+PDca799jVqlq_ek
z-R6mSQ}Z?xzGeJ->#wtS2441OREookWz=`Y20hMx-U}LIBB^>$UZyTu?hzQ-N4M%I
zWei|(GUv!cIkP2Z-ZhEVs9&c4F67-KKXbjHOobds2IbvMQl!M8@paH5!8nIP^YYSD
zy@;02Uwr3wO|J+YDR2&)L};X(z>PH@;fpOF_!YlJQnI?PD3^K#LnLDgmIOq2M|u(=
zM;u)mA8kUK!=QChds(}=H_<VG^p#T6;i~bpc<Y^r8k^%lIpH@s>V0-{KoQ~Dhz{s)
zYadv6ZvJG_PNj;Me=M+X@%H5O=o<{^s>ndWwKIz}yDN%4bH!I6uPc*)JX~z8p3`+V
zT_ln;5Th6US#+SSZ$!J9EDQc@%!#J)&-dLgY$|KMT%Xf7xHXgq=Z+X4r58Qt=x!}0
z;Wz)Rj#yd#r|0%u(gwD5Y6u(6>olm*0BJTimbD?=fJk}lWSw)cm!e_qrjxQ#TeBdh
zQh}mT#ZhUM3gs5Mq#}|X%MJlv$r5EnBA1?Z^ep>m*H}Qcpk!Pv6mtlZ)mSfAUN4rK
z6uD{7KpsyaOD9{ILE6c%JSkh8s70cpJzT9)jjkD;GyH3hSQ)%w@+)~`zHq_3FF)3V
zzMxQIi6>i(rPQ}NH9EK&Dmv0X9@>g;c)!Q=Po`AJ)jitaS*p7^`rBl>Gu3ff+T9Ts
zHnM{>J^vi8WNs|0%ynirvT;*Jl@%bM)vUuo7A8j}suV~aJuIq`+aADYuh%rBT|_rA
zmnNc>dg*ZPbG`6<S`DM~x9ySfpskqXK6%ZhTQ76P172nw9!R959hVO&oaD~&?ruQ(
zK%h_z3na%LqidL-gtQ7Ibj7-=nf-6>UyB;qjiR0s{FQj?Y>e`X<a4v=xuVBABCrHJ
zu_rPY21=K6MTWh4_pD{mN@?S`3z&{Me(H9m_ERV}%nYMiz><sGx`PwNXui>pj|vSF
z;?n^Q{SbUf7SLb{PmO(dFzQ|U{X!&QT?&17icxmK-M_fPNpbWk3>ymRri)~)^?`{K
z!GDAQfJm@U-z^`Gix;<+H&_|ZPmmC+scEa}HaC=aom`8fpgE-si=H<m(urM`N6xmE
zTM0#GyA1|{*pFf?A&VF2{bOMDnVf7NjEm{1?rw|KO{2F`xDq(EJALjZdLDyO>t0VQ
zk*r2akf<3b(@7qNNtdLN5Rb`BOUq)`N#o8x(d_+P&pqb%b~q}U8iuA;NqjvTJcXsr
z_dOV}9KNjG7WAG!>YuaZ<abe;nw&~O=viv(xn{p??OLf5rgseYlWLdo#Rn-SU-zOC
z64HROO@;o<ldfHn79z2O--OQj4f_Pd^J<<Lm#A!_h694N8OtW35;sDgOHRy07f*??
zT13al5NW<cqP004rdaGvs|6hqxZnn3T*YTrl0V0hW@X3FmD%t+uYq8~)s%EytToC0
zj)Gf^j3@$51Py8k$A~KwAq3cUy^ew(AoVGM;xaVt>^l3iwd2BJ8nqsPm2}}*+cjg>
z94viNuYIi41Jx*NR~LM4eeLj=o}J4*(o*&fn<Drabt`I2PgUQlqiX@2>5CRslDF`t
z-J{&Bve2BTZ|fRpU?&$M*ULqwLt84?_#I{?e7`NxW*9zM9W_nmvnHfypuAOi?mJLe
zwpzp!&UW7z3i^d^idrP`EJP)Pp1vyFax3-A(j*UkNQb(tiDw(3D=G2W@-3+@GSnqg
zGnhum$(WP8CpjMgdMCIGXDYIML|*+ORoPa#%qOhZsh<}MtJN)|lFli$LEg8CCT5+R
zJwf^s&!VQN8z;XgwEs+-8D_rEY8Ba*#0=trqGNNcl2nV4u^Ayvmy@csoQ2Z0Wc8RI
zS~z4CxwiUl^kL81aF=lj;}1?GqYo0ELi6X&liaBt{bDiVp{B&lUE{YNIG1D{f*rop
zIf}@_RK&v=acH$YfI}&TS)~#p+H;@V<s2VmB5%eZMG|q2(xZlLgsmL0(WX|WNqRr-
zFFNQidI*t3Zv0Y!<b&a<M=tJ07?j>sz_<c))60jV6!ZwgDONxdD_0%i5m&BgdNq&R
z#RZ`Ro=X;?l(GT566+*w7JK*~_}&?p25x!n3Ajg5Szz!ldAL@!``NnNhwZs5?UqR!
zN}VcEsf!7aR)`f69UhVXJdd-Id-qAs_eqW&@}sKPjvf^O0?7ckbwXKZ3nFVSLg+Iy
z>7-n@NB?89r^~Z^>Dbwj#@=533&<I=Kin=t@vWM^_z;N`2Wub<=Z>sZ3;O5wu8gj*
zj!rjcM7gMBg=mR3WPkp0?>dg)@!1#g98^3gAyOg(3L~nn2@bF}4-b(Y{RxW60pVqn
z0yFgdU*e<+>!iz}A?m_*sJKwhwO9vw%wruUi7q1r89B9hV8S!RA+IpjlvPkg%qjIM
zgwRbi5*5sgaeJ0P&)Vf=v0dn1G#RC5XoNY*5qT%SHu==<vE(w5B*WP3pPGv&rao`C
z0uB}FDWgc2S52?tpR4f84ILH0(+MXgX==2@my$!Z;`RS=*zPAFSoBit<zMUGpmdl@
z9EHSB*=D_uKNdfcI<17rvM5^gPM8_kk;frE{!`+Q`G}n&ZW=G8v;TxS4TtJeFVHz=
za6|NX@5xzGSFc=!l^cckq^lrJKLvoFcf{f0!!rZOF#z(Q`l9uxRR3a-GCQODmu&Tk
zF_W}g0tciX8<9|Cz#v2re8TXaU_RGq9WT(G*JuywHOGwWc4C7udlews>9uXg+{&SY
zNvLStT!m}lo>1=3Rhc-qI2qg~LOi=2@U9eyP%?Ctt2RxppK7+6B5JopJ%}-$KjT*j
z>%>pH@dNc3?I9s}TSKg_<>GgI^~g#{jF*kMP9ZapVw6>2SzLj^sYZ51GkO@0r#_i}
zWH^fjN_(}YC|)?@GYeELawqh)CyW(h(61AGvoEF>k-?$sLKC1Kq63V!XZMoJBQ5!T
z>V{W;sL|2lm(c#{NslD8Cb_2N#M{2Rdw_&SjmG8|sDN#(3a7Gv;k;7V(XUKk!|$B&
zIlZrkqfQzirvp&U2DH#<_r86tT!b$`##^bj<4QY?rC>fCzMMhM45JA!m#na<y&C@6
z#^vmjs0FpywvS-)JuG+C*5Ka8!A<t0+jN@T<DVta?TbU(_61j7<ELbpxtR2QMB-YT
z=|yV`ffAH~Kqsb~;~&%=G~Uf50;+=etq~4LhvDuH#WN5QG<afEp*Z&Rm_vp|U<Lo9
z33;vW8)ieUk)faXLz=?JO?pqHgD;Cp>cm_a1n+YK;q-p%kZAdKNxBER=gu@XUz|_I
zJ$Sz~J&j+Ga>PasiE~xowWNP&5zTv1>%7{LvzhZx-yROcZHJSjWoa`XD=WXbj73Fs
zoa_)LEU!ktN?Bt<szO2rO@tH0xlD-1tWkpUpbHl)(=IZlDwZc?PlKtX1PfHfWC=%2
zhXQxfRfJ6+DHXl3wNRfD*1XVA_>eZUasmBcY^o!#KWf_!xe=|p2u7ut@(|50&DC;`
z%A92ew}iKJZ!P}PO8HPWXs}Y1K^y1_bf{e_>J*d(VFh*JZv{3pay1N@Pz2+mdg(O^
zS6By_h|oS*oI2Erur9K)4_ST9R))Jmo!`n@RMj6D8hix|C1w@%YNeIGrJ@zgBP!&W
zd;||-jz7$?y=hv|*54x2mlh006WQKXtQ2F%af9rr-V4G6ZFiU7dVHkPr%#GvSWrmg
znY9%{69}d+=qBxatRQb^NU2$z7`Ws3olQV|j)v)+-Z_23b`cE!8WAGfOYjHry|rV_
z+$Nd9$>JcBPXx-S)oPH*RAsRQrc@;@hi*+<ix}EXR|-isc`L-5xabak(e>m>y*X70
zF(++PbxzG$h6rdx*ekfzSe%ACbsBSb?v@IzP`t2M!kE2%HcI2?SnBB%#3jNxHVF?&
zBMGahmyW49rWcN0WU+OfwxJk<;9Q)T$#S?#gZYyrp`+~ebBORlS&xE>hXN!S$X8L|
z`ic9=P*NsJq!;L{gIvSN8knfb)r;fVlGKX@FMx~G$#!I?_H7*3(@k2NvjELR%Fg-T
zmQM=V|57nV*?7TsKsRV=jp_?mFMb^vOOX*^I>A;0v<}mmN))%5L%zHs46$yfCHJ0C
zdEU=Fxs{gk#R51ehSDC`wL@o|kXP(cI)%ulbV(2K)>JY+?^dc;o&_*Texi>nU;oCd
zSB}>nw4|JG>B8c0dPB70ltw?-QBDHm>fy<hxEA-Xly@po9Mz%Qy}>pg!jb;)D&J(b
z$A2-rpX>t=3n!k$7ZS{8(Uz}|9Lku~&10)ltp;{YydYm9-bUZ*o?w9$8_EWo21$!m
zrf<2drL(Rrh;gr{(f50}-)qPZS&401#rq@N@i_5M;8=n@rGl5t^2WNeU)dHvy`QhW
zx26Ek!%YvSEO~r@4i*<f3sVbX>6CEPEXmux_<|zVx+A*|;ysswpaiOofqFsd@D~VT
z#1AbhRGXDCZ}y5(7H`?c)(u{~lkWast*Wh}y>gu$ry974*3czF%40-vb9ixc{y4t@
z5?1jNR`%mo@oZE!%|l6ORy6_D9+e)o8S3q}n=YHNQJt$m9&76o`wF+zl`=h_I*lGM
z1O|?&UasoTfA$Z}H9FMeHFWxvY^2R6Pe6AQXRa3F-QDr#X9r*pKKKK$h5J^Yo#z{`
zC(XQ$qE&b*ug#n1j?B6r68r+@rI?wKd|2zEBu9F7!h&wv4hpzmLt7Aueh?bkDRc^R
z*ngqfa>PoyO8Ya!jl2<KS9l~{E|C{AyLG&6MMJq?svVAWa4V@88t5G8jR@vNB2{Q0
zFr!9cruBo&TDw@)j+^Qbz+u$GX5L$9^PJ+C>bd6620wfKi*vV|Mb0J86^|B0r~~w4
z^@Ex*(GR{3#E{KyLT<!#^W1O+IuTi!R8qO<!}=wbksr&y9t49)v;>5+_q(9M7$n(o
zPZQ^AKR;$-Kh=EC)_0G(i@pbL6c^&cWY%#~Jf}m-Yt(>DFLoC^We+&$xp|>o0U+b1
zc1Y5#$W%Cb*E(0#Jq*{(i(51>uT07MaEE=%$4A9vJQ(j^LE7|clPCV-hE=Fd<Rl(P
zyb0Xjv6;Hq4U+-`m||0>P9_MvBb&jI+~P1*l!`-X$oJ<Wp(|iewyvl=qmoBQ`T!3%
z0@i!7<zLL(Xd=UWy}#pg59F1Fk?}=&B5DuK4-r~hKRh<5ZDahW)rXxd7`LBfVq=pF
zQD`mF;29FM{G}<1x5YJw^CtD!PbGa^QF5iGBQz2X^VhUBdmb}R@k35vYOcMVx+q<?
z{(`>x9mkkh)VF?6uIgn!PBpOaoil}YcZcmkubSoQvGq@v)Z{pTcE*@J1N~mZyu0Uu
z_C075A{zNkje%N<R^`h%a&a5a?6bGUyfudfmwbjjpMsUuC%z}YRR~AXC|$s%f@&R8
z9SJ4sHh3n(nX%wbcstJStZY6%NTR_81hJ&nAsvwu*kx8CWHnOIDohK}5IvYZ*gA+F
z7HkpAUW$W>tBGskg>0;DUw9f861v9|kka?BZ-ViqCS{<%9CN&XG-{|hbALc6Wcfnc
zOVm_FTRrR=ti;<R>wS(jdrt*!`|!Ju=jP~WV!{Z6Sw^N&w}{wlED>wl6gFIBJ@NOt
zY9)ufUW5HxkEXqr*UN2R3qbj8avZY;OQ+9wIlPJ`AmF(}TE9%a)`02p{V^@Y!~Nr~
z<}?8TugBM5*=xV*&yqmEaR_8kAf`~e=q3V7wE_Z7l5~a80dFKztZu(Y;u(reAPu0)
zW1WzKo`Jj_H8op%;KogX2~W;BC(%1ehMF_S3VDGb?L4$I1<?C!hDM+=KG5!!xDlWL
z_bX7Ko6@Dzv4@J_TLP`k-i>WsbWnfKy*@H&iWMI|wk$3dsYPdhPj2!RrWt^?l!(8h
z#cn_A+@mTCGUuGrtdsG}MPPu|GzRDD#M5a|rzSy-HyZMp_}k}RcH*pc)a7V(Rl6!C
z0omCPV3XmO4(C!;yP`{{5y`%Xr;PNog-QcCX6&hO$jWNZ@vmIYN(<_Bo?ORho1hnq
z7(mB;;&VMuApD#1`cP+R*^AMZ54CwWcC@iRfV$W9{c<N7T0AK*_(_XG?eQ|=j+8h=
ztOgc@lB6PI1oo_yh`c5n53L4Wv$>kYHrHodsG(7XRE`FvoLa9^$wnQ_rEQW@;YvP7
z8%5L~t+Pot`Y)*v<qB2W0iP)m)14yXB}Ao%39Iez8JG$+5}OxI6GZ~pAWxx8Do?+a
zG`(*0J%z#pz7E|7<8mV%Y?P<}UG=vW+qbgecWM5S#e75HNy5h4mS2XRID^+B<CE`w
zu+piJ#@~^e{Z=|khD7!Wv7qwcO4YFFr8#!xWcDnTHdy((Jc4_mFPCc0*igZ7mv76o
zlp<T|ARY-DbP?HqZddA8>{tBu$luQr8jxmbLK+|ys!+>6tfYCJ0J^gjFQ7&6O>dMa
zJ2jjZEO0IIm8dE)i)s+3G^1(~+Q1ql8|F$tKYXQQh)6|ep#pI{X_xYPXp-QiD|(3;
z40%BfXs1EaDs%x%<-l<wtE$T=;T#P=^qJbk!G_)@f%qj(NvUbE1$JqXc@f0WYOoo+
ziV6cDGtrCaemGQay~+$Kiz_RZ@>cWnA_mpI;TX*L3Hr~QV;oRu*dA)ZP~*YUZye(i
z1`sIJIHtJDPBK>U1#sj{k#ZQ5C@~py6`0~s6dHMqv~e1_l~c3QGlnE=p;PG$0_NxI
zKLI@*rzI-Xd<o0R8=Fykp3;$sng5brohUv@q%CVb^J0mo8O{DAdYrEN>7Fvb(VcE6
zMm*)tTLLvCtgDsRJAgs-j#fy45rJgB`$TqZZ02H7Yl?wJJ6asQod<20Nv=f<l8r@}
zG(O*=T%}S=^p@au-)K9-a02-f6OzM{(vqg8d!O;4wR&~(J9r~_fq{$wCum{U!gGdW
zhHHlN4&n|uw|i!D{E`m@YquuY**X)N`8Of@m;QhNnBa+EhXX4>CytJ(Uo;hjeBPx}
z420x4IY#dqy<>~kIZpAQMXWcC><(uyu_3nJMCfSOx&3m+ENhZ<`Iy8TykNIG7((8O
zlPa&iY)SR7;-1ax>cQ^G)$7S~>kjV;YiHoC7wLKUS`Ohz!0UQR*acFVqujV@p=6FC
ztbb%;8O9u|SHg+Y;#i|^8yYb6YZ7mUn-t-AGlDloAYZXk6OD95C=S9QPr<DYPW!^$
z-96U`d)N^U$f^AWx5pyEiwHg88BodKPdnys?QngS+A(?eRCN&;#7Smw5vmEtzzCbg
z_Ypj5sP&~(U<Kvk8gkbt^S0Zl*w>Z|$H#PaF_c@wDk1pq<#ua*vMzEK-}ilgcH94z
z{k*NlYiAZTa?bm@9{L@@Tw|M~(453;_ItloUJwWd{|VW++!IL-ORCwdT$z&1SE1&s
zRKfN!j%S(u%6S%8#N&z6b6~x6)rDmSdX^mkVvj5H*r}O$luNOQME@KA;aUyM-oXNX
zwk|ggjmE4cYX8K)<WX(k1_E;ft%1SPmx5Gpy5PSaEHzXj(fiRO#c9hR2oL|6#(t57
z5cmU5Dlw1q=qVsPg-{9eGhVdkuegK~y)}%<lQ79Z(f&}ac_fS1cXp2`07r$n<d@>v
zmss_bWj??!qP6yAeY(pZz03Zu@2%(d?cQycCZc8U)I+SX=sQQIYTnEKK4StXh~>KE
z+I6Tj5{cKiFgr;{K9WYZW}4*hp_ciU@e!&q209i^g;U4F!Zt5q4-hg0%Hw+|=vM%Z
zLvDt<C#P4NS65F&H;L!#QDg?K-4>MpHT-^?0rbGhq1o{vubhFsxA)M9PMAg!b8KoB
z4U+|%Q7nWT@gJ8)H!msBt2$MnUfXb7iU@85qXF(D5;ib4`v==@)|!DL$OFAhCqDnc
z{r4cx%IA%)21?VJKjzSovmuAg2ED`tw81c&#xRYeGlZU!m$L)`djrdyOWzM6f))Zq
zWyn0|+D|L=ppreGODVIA?GC`$cksY0-Yj>2yt^{+kr9J&@5Tzun6|Os*);Q*YgWYd
zki|qa?T<IomUparWXC0nd~;(YUgvIkI$s7*H8Vbi888lG4#fE|MrJ!QzX1s2+^J9~
zoKGddn~;B=X~<?C$PoOZBuAwHr_!L&USu@5HgPSbI<f2x?h+x!dTm4r0`MG6umcx=
zBsD^G%23W$GWWL%ALT}+j(_omE4dTLk5Ud(HW%adX?$#SZ9`qXP<L(n?Y|hedOC%n
z(H5c?6?D^uZYbb=VM*zYD;VA^!H!B7ziS>}ttor_Q_Lr+8S1l4K82M!I5{?(;Xb(E
zf3<rkAuMHGjf)~$nr%#g0{>ZCLP$&~c>$S)rAWs5EZVf&<bq^^#C=qKq_WM*WLU5*
z5*@1R)sZDKX?u8eQ~YNtPgD-n5NtndONGktI`gPa7-=@klvDmq4bEtkil@RQk%*{q
zss(HZ*#_Dc#uY-9vFkR`$q+ZAOZ(&(YFTA{Q(kv{!hI7{Ct<xh9U0?5`jFWi_W>Y2
z#nKCGarj71!Ir|1vIz)t>_C7qg*0?rb1l|w4EIo;1(dS1S{bc;lSvJ`N=_ZiWv~pJ
zpr}~y<3z$;HhLDyx_*!woZTwi)UL3C8e~`4l5CumDw)qJI8q*TED%DFFisGYIvRXb
z>fYt!k?{eQXIXGnv1y@wVD1y4q*O<RqK#dpgQ>*e9)1Q%H_=`<Jx{C{jb&=H0)`L2
zwW_b3EloW@3Ly4L91&?wt)a$JJXkGO#esE`LZY2qR3sA)Rf|fAF{At4zlS|^MBnu|
zvf=OleK{N8I`qsE(idPKqF}iqU$&R>OP*d33j_NtB#uM*S~uXcg&%dSFx(~Gkogyf
zvl@_13?wm7-zLKE3*jWB!Czd#&S4q#LTS;GmzkAa@Y<MV<BJd0ZV<pBcRysOPgYZw
zdd^turmoFfkvByw!lAkI<^l2V7b-nJm<n8ruoI`JRmkidUoxVzPJg>9oIV;&&k>i}
zhDw)<zx!T&tCAOy#YnZ5ICtCqX^iP4PDb=~chmk=m*K~9HHH)5yR`Kq=s8zwVr6^v
zew^s4k1yd8Iekb9OHwCg=<F{0?(e<EA+!=oU99R~2@RwP5{n>Bo-#HA^tu?%k&XST
zJ=;BJJTE*2l6V@Ngte&SIR3K!xF$xS)f;-Qe;_lzVg86-;H{RsI4=atA~R-?eDpj|
zAraf&T}^EOR?{dSB1+P6)FHqhLY2Io_Rhe5Rp}{9XJJ>+;Um$&LDF#VYH*-YsLNL}
zZkF4rv{Ks@^-6D-vQp)ipv^8o7xo<<BMT$oo8{jq734}2T!?55oksaX>K76_cIsw;
zXw%c#KV7;5{=C2Gs8sl!L~dM8gDY9I{c*mi_b|M+H#qy(g9v(2t%_ILD<iou8eOcV
zJW@WNCQ8?<kVedn`#FKmNQs3p>y%WOvU^qo8{l^SDCot~=rtUXA@{wL5^-&9-{HQV
ziW%^FAAHXkDJXD}N1xT#x8$EFr~5;I1G|x~pYpn&o588rO?>A#($O0e)%^O|lwQNt
zc39T;l49MsCtQYZ-+efmpoku(%c$o(`gVx96^-Es3FM>82PLp4(+L6?ny?rv2J=vS
zap#iTr$n9ie*O*d-xzxfsJNPKYqW89cMsl3V~qrd;O_1aG`Izq;O_43B)Gdfgy0f9
zIKj#5eCM8X@BjWg-gskl_pV)4t7_F+tEy{knKQI;I-D9f7>9aEllmT*>#IL??Y8<1
zj=hX)ZN0gQ!LH7^y#gUbzE{WyL&%X;hyMr+Q=B?>dD*5|IaH_eIX{q-&Qoi9Uv?e4
znB7=j*ggVIJn7MH)y>yWySz+~f{#;D<BqGotFrs^E98Xn2k}<IjH=e+ZhMB^Pp%dS
z;pd~4q3X@RE}1~si}$(s%<QvPO%C{JFnqVKyUR-6|IcbSzJnxGyw#vVelVP)@cCZ#
z(u&1}Z}!X{aViODB15D#FI}MEDvlPz-8^+I{o6dXF%lwL)D8Z`)E>D@=a6%3%(WPg
z^3bmGx5mSRry|OZvsW3Q2@6~>6HA_L>DVu->FRCWh&UBaw5jCTzHbyNuWNxSgcD6`
zP&jE<S86l|L>OCCcM+MHgQJ-z;{v1dpR}evbSkJ*P>d{Z-A~yf5;-0S>P}MO1PQHC
zVbCbFBBEpMe$_Xz%{1x?WAtU#*aal;vBUZemdq*j<_%y7JIGl`Cb^(b=Lr=4Jmkku
zQ|WA{py7B(&G(ND7vUNFo$U2|*m~v9VO$G8ka^6z?#I}nleint=XKCR_j9&=)%JSe
zH>pCmTXh%oXB$M+9uac)1EZYP)>CQ6cmYm&#s2;8IT$ti1IwHDQvwKvZVbxGL&5n2
z)BBg$HL69$Qnm}4*3sB873>CDrB!s^C5jo-#Wr?77#pOF{G_W@zU&FD2*N1}1tl)k
z#T^z#H=2+^$0ZDu(~R_Eqk8c#AzB161?2~p%EsTIXKdjytt9@qXw@0!>jXlcf!ui?
z3F169`t@D(+?)5t_8Nfp=bcNq=cNP<<Vm;kI-!mpC5tOchS@H%=IXE2R9VyfMjr3N
zuX|O{W|A~Nw%z1Ly7=YExMt!oJ-vJ4Rz$*nWg(z_3LOA7iWZ9f?%bak!^FV)iPbhZ
zLMIv@9%j0z^u8T8qFvz(pK&f33i+c}&?4n&$R7mCKkZ5jEdm~I3s#@vK2kQCj06#7
z+?j{e|H_g)1bQ+|Sd|3!(=yN+j8$4=b4M}6Ri>aIsuccG(Z#Nb=8@u+>L{X?uVSGM
z6}&Bv4=2aN-<ClB6hM_NPo<@Y@_3E!+{kv;=tI`XwqGz5YQ2X(7=h2Uz+^#vvur*s
zyASm}bA2mwQZLENwlSz?%)tF(+0NYI-Ix;h7&Z@c)`B^+d5U&83sn4))3E&~E1pA+
z(n{yt+Y%f@t1GD*(jeW}==I&`b=5|evx$9{>CRSU2T3tFI=B?L=#Vy5VntK>9TUFj
zY)6>@b_{Z4`i=4+1fe%d+fiQPpwP@h9o=ry<Sz8zmO^0&-j^ac?P6~|inZ_gBCpYV
zdOU<3?;Y4$JjN13M8q=ne~8l{NhfB;Pl$X#-B(p4Q&o8BEkHsY3agBOdl7k@ZQ$8s
zSB(-cqd^YK*tLdNwKuD}=Ad5qA=UhmBNnS%oU}|*a*Q=+%h4k#`}^BmhPmay26@Lt
z_k~c;*3J7FoabSh>{@l&&%VPH=flW@nArLf=|S))1?!;*#|QVs&(2{!TFdKs!krC%
z8w+Iu$o^|rlcI0(Pfu_-R*zctyx&IX-(yYi{{B-4bbENb^(FA%!XjwEM2sLZLGTaO
zj2Cw#)V5`qATyNK#J|2=A(AFm>EE*1BP@g}+y25Rl5a)iygtx))6J57RDg=>p0`SS
z;J4FeG$Zh<8l`(v&BKrq@cZ(?R{Hh;G?a|hkI22MtiL`bv2hF&YtY}4UmN;-Lq%10
zdLAY%7tXt~d5gc^@3{3xxzW;8p2gp@<+FkJ*A=>t`>*3+KO`a~2TM|V3oqhfmF-0t
zY!c2(<nS%#G;s5-7wK?v+s!A{(xN?25|sqq#>&fpL~`qrIp2gMOcT4#Fa^e^*;jEs
zL{2JPQ&w9R4_lbeS%4Sl-YH%qASpO6BL@852g0-u^r}46k7Mfg^M<U1zy&|C(flkT
z{6bnury6uh?L-RKzTIGhJ0sdi6Z!%>n5s-WV$pvmQ#qKk`>;V46?!O;L0avJPJGRT
zKRB1N0(j~uv-dH*-IF^b#I;+siL>7vx&ihIJ`4HuE3P^ArSzUr^xR+z@(0bBWo=MR
z;}JAaPJ}N@C_+sggW%$m?B=@{J(Iqv?GdB5w0z|`I<JWF^!cb5T3mp;vZ4P>%Yh;-
zhY~7c7pfT*JOY!uW90n!#~6A>i6by2jUy1W2D1UxEq1KR=NK&_2b3rea(>=Xr(9WR
z*cJ`q&stB04x>cq)Vc(ui22%xXdT&wPHT3S?Olb}x@?n_&x^n2TCE=U;bAlPStN7;
zC{zbcuw2&FzkoTp&@t*hn@)BQzJ2x7iuIDlt6snFXcVaZ7FFEyweIW4nbOSKNFDY;
z>GRE@=%1@CEt)C|55zzC1XxwvpoCxby599EUwMd(m2U%f8dl&L53Kpeb6J<v8lt_K
zQq5cs;i01xIq{)!VC3q#iyb2_ZO)eCedY1>6DO#eP^~`Ajng6zmb8!Ru^nRNeeFl+
z9E{Y9NgZ*~;i|>I(odamvH=cQ5Eg%3AoXUZd_Fp5(7aI5C8CK78E{o(UIypBm){ph
z1lM3%E^BL$mq}(9V)p!Ay6+AOnv*`SeK~geIN%76kmqTgu>nP4fI>$J-HTV1>i;?P
z!RutBkKj+|pxUqLVin=|^b$H((_D7YsdlR8qUYLn*qLpLUI(6XXQ9+pB(X(fxk`Dt
zio}ZU&2c`;8V<Rg04v^`Tw#c%k&`zO9Y}`eWzloIZanh9<9QROAyVFRP%Ms#^Z*-u
zleYOGBJ{4x9Ua3Xue?+8D5~p0<Vnl)@hwduJnH~wms)dhn$~oPt8Q@>Wa%<gk7}s7
zuHV_EZM=0a-U$dXqe7IC;anu}e9M7em+A?0)?=}x%X+O}=vna}^@m3@p>AMsnLZHX
zqL}r<MHADZy43LUIQS$wHibhi*0k#2p7r^FLya?7?FVx5I1}VOmxm7wENpnHp$SBu
zm@)<78X4+WWZi9`Qzv@O?p%XJDYzE1avW!U*V>w|IHrWNs#tjxU8<M+_~>A9U6eLY
z#eqVjt*7-~7+xUL(_XDWp3!WR->1WzHQpNk*H9~*;0=LgmMVkqzX!$<JembP#7zyg
zd`+gzPM`AnSLefM7{4~z{pSCq8sQzys5}7b@0<*>*NOkCCV2r)`WzG|fzz#t5Dlax
z1z)KW2PPgLRPiNhAFvvSot6Y_GmZq(V^bt!e@JNydWn#D-^IhLPjb))NJ|zO4@u5c
zl{fgr|L$Y-$EH|$IT>f-P(rDkoo^|i7=9{zV64_~)u<V0Y%*;)&T*X&wd8jPZ*BWK
z@J(&rmXC<%?$w;_Sqp_y-rBcr^NVWXTaa-UFbC&7_C&@Q@LeHRrcM{utZs^?B%GYR
zs?SnaWvhZvajpv7(nWht_iy#bB+UvJblFyF{yHCZmEyzhyC%^UEVs=D)AH)OYOlWi
z$cS$1zzjnU%iY5TDWo7JjyZi?E{nwF@5QOhxHefKnL0@#5g!`r<2ijZ3#uCRYW$j%
z$DPveswpTuzRzN+N@)~~D}T~2?L+BXa@@K#KfiR^$>Y!Ukzr9X@;9-^`E$0LC2*qE
z^G5AYbeQ;O9=rq75Hx1DzC=h!jbP9(2$0!_b`J~B?pDzlbrNL6VlT5n5zC-&yO{E|
zE$onm!}A|sv@G072+|7S0e)48h%ezZoXYYNxY$eVjJQ&uZ7vU^+D<<m742kN>qn*9
zU}Gb@4k2LZh)@3x)6U|unqqJp-(6(YS?Z7})zw5V?y*x<zvmz5%fL^Jl~%0q#t4Jo
z>8kjoU2W{=N!&5pwApg7N^seW(`N1PsnA#xx&}|ns30ochgt5rxEorHtbE=n6u-ey
zO?ObxU{W;iWV#Ur{r<*C_}>4B2LQ*S#DuDj<=FucOM<GLbGRjXj`l!}7_(2@{4E5p
zC9AxT(C3elbdIIcRbUg#6ntGZD$;*`7jd7+3DZQFwODkLR#{BG%U&E<*%uF83H_PW
zJa?cChJm@+P{Fx6f;rhx(zH{0$y?;OpyP7Ez?_Mfe@tUGi7NTiBFTaRTrBbuD0ME_
zydk}64N;sfgn38<?>E-7b?E0mS8)aT(6T+AjQxLdV<Y9}(OxWGhID4qFGIDbUBBH?
zPP$QCAOiip7~g&gYG4>j<G@CJ1aO@vxk=CU(P~gihW|J)vmYJeIyUgG10F-QDeT%$
zL9_SGaMeC`X1QI{DHejAU-tQ!!1@&`EC&qWBYY9WwTm?Zr9OP0m9ZJhOD!K5)LzYJ
zs}}+NmggP%<C%qvJ)!Sp{WcBRaC5lCtz1vghBX~wQvtwI*nxOA9YolefO8DbQ^FhP
zvgJ?9w#}NQY(LK?X55t8&Y~rrIq@okF)b)1B#jjSoya1};uciXl`vCKEV-{S$PAIz
z&2Zvx-=xT3Rc4+nAXq};X{dt4*2vX}u5jKk*eI}9{^;ZFO+n(^Nz~tIimgQOB&^Cy
zYkiqS`^P*6Z79c_Kdoc&@ym78o4+({28Q08snzu^#s3-aqp+uFeMR{7e6jN<+f$)@
z$gziWI7G-4eADnI@i_&((y-K}vFXZwUNJ(P07l;CmQ%|o19k)Z@?!;wn>=M;+*lC4
zWc3i#yR>8H(D@VP$-uCm68L0T1ZWd&QnN?q9DLOSw)AhG_CrW)PQa0e1{$i#2Dk|7
zY+{jR@5uLCO7rlR(NWbASI}8{ZP~sGJXFmyYL4q-t7v?fPDpC9I)qC~70%Eyl`O=X
zrnUfCJ*j`CO+-#BmW`=rKmIPHlB5?4cH#9{&LySj`)2A3JCGc3t+jhobOi@l&05qg
z%?#1uUsYBU$rvjq50;*#^)@^04JHtje(}|py$vjVzRPE668LRr039k9N4Qc!q6zHQ
z_SiaS6-RSi{IyBy)7r4(I`N$*V<ku4x20G1H#}8(+U;}7u6Z4zJc~TjyQq)4ebqYe
ziqkWYL5Jf_oNQh0=Dx62aE9LWhCY0;RB$EDdDwYzYs`evhx#tDDXdn~@+=*)X@RO+
zEl&eaLJ01HccK&RYnygN8;%}=oXgJb1y?)Y4>sH!xlrv_KO1cf4KeeULw1k4XK}jU
z&L1(le@W5)-|&1~9Gw4+mH6M-lm9!Gru4s{`P7{)Ox?_^EnF4U{x`Bc5FZc>p?!nk
z=>3OskCPL~!NUvYMP^fTwXoNu1oHxUxOq4stbG52eUFm^2&uyZMrM<7HL<fX6Lqk%
zv!H}v1OCMY6ccmwq|{^O;|793yxf$moIIRBPIg`h<sJt+A19C<#KFl8A&uh%^6_%8
zgCWp=e}$xM>?}Abx&A@=`#+%n{u1^5FN|V;W&V5Q5W&B;QT?Cbg#Vib{sUzwE+g@`
zg}+w(%PS}&q3$RxBcWj8M9C&&4xt{jarOEqTg}S_Vg(roOGipUK{izjD;pPAXD><y
zQFBLA3r1u%C1-OBXB!7AN``-nK{D0coSf_|?Ef+tLde6A*|aG2Ah?<!b`BsX511PS
zLBxdc^Ko#4fe=PLh!G*@9F!a&N)Qh(kb@6mF$m?I9ycc!kc$JtV+JXO<UmOA{!_|F
z$;k&n*8Hz>2vr}X?SB{kMbrEXyZP_J|53or2L|#%*buoXxp^S2;ehxU!m`H)<ly4s
z{>#w^0&?>G^$a(N8_4rd-rr`x?3^G7s~<1VzjUYM;pPHDI4AfZO7QXlL7Wh8QgT5`
z|Axrlp4oYTAjmlnB`-S|$i>SEN%26UjDruv4PgxA1p)aWy?`jWxglZ2!3$v{<l*H8
z^8Tyi{{#mYA3G4t{WoH`At`Pi9tb}nBus(-(w>hO$n}p_eB6*|;%0{clX7$OKy+s3
zf!G$(;eQ+NA6sw(K@hINfAz`1$p?lg4CV%M{L}kiJ^q!)&BYBdI6H(U5yS)W%s=(G
zAufYB?61CDka6+x@Nz<I50U+6v>+Zxr(iII4UwCj3)075Gjf6<CgbFQn1>I<4uq)o
zf5>u!AQGIAp#Nw5|JCn*Gyw7OL1xuoSqQr(#3tN-bpi7LA@dUi8RCC5;DR`kmx~9|
z3NIHI#C`vajU8e!UdTj+j12^tz>rLcTeyIbS`gX)5e5HF{u_*y{cnU?I6%VrBQhl3
zAO`!d$p)E_t`^P^j88igR|^S?zqESDZ2tn^gp88of5K`SsQjBw@pn2YHOX~5Wif8h
zU;#$T0nC>!Ww{~kVesWWUWX0!ov|J$H^ZRLLM82M6V|>op<6KIPKSK2O($H8)6gb=
zLa}jmtcOGgxh|WzO4^j5B<aVM80rbYKK*a^NRzOov1l!Qlt*$@_)~9fgGftObC;Vp
z1O!*C<WU#)??^hG-`;A-FlkqLzKRmqXY-~NdNFld#>HbRwvq@DXZu!hG}lTeFqWvJ
z>u6|b0B1A&@Acdb1YS4bRUKVMlVvr!^9^LJjj;F`#6}Vm&vRdm`kS^R%w@)8q_0bn
zXwcVlGuAoA#tr(-hY|_ip*V!3JcG!>_cx(d^mD&P|KR|AMu9RY7A^#{;xwXDY#mAW
zw5HyntoSB&{@-gkBrN`8>Hl8J|1KS-uK%!){>}V9uvY)K<?R12$m&16ss6t}R{tR~
z{h!YNJAePn`Tqu4<>Y~^4*%aEs~kK$Ag=!z4NITBd~qdzKU7tAcUYDBoRh|9pn_dR
z(nBysLK0|cF$b`EX?xQF!?0REc|7+T!YuIC>pJ?|&rfO*Mo;)9@cV1288|)7wcxHK
zbR<RSB7xM<8E^I)Ga>nY_dYN0dxZT!IhC2`Co39tn;I8g@FIYG8UVWS{9>OZ0o$(!
zM1UJ~Z%JC}%Hm8<M+}TpH*zmUy3gGioS6~@D!`ZwK%U|AE3sE$_xl|HTBv0^5{^~t
zV)f=y5Aclv(9>w~dl&K~91+0gmXTG<z+=dEemn~hv;Y`4a_D+FvA8hsJCXtX!2!%a
zEg!6=L7>LRjsezS0IIFMeeSPT9X_N0%hyvc7~ML<#<M2U3wOXd5}<j%^3laAjjYub
z2CxYWn9&#VS%tn9^g{wzz=&*Tu4?i691?(`Mxg;*&V4UKa)~mnaDbS?6#|xzhEALL
z4r~Fg7=U|P0A@TO7=4s05HO^G`cWk0<M!%fAN#8jNGPnj3idm_S7!f90tPguqf#s&
z{yjH+)<p3gs_B+ebj}VGk5v?1OsvY5Na`R^5bPrdUz6v*6IYj><by7EI+O<!FpmP2
zuvO#}fDqA>#|AIrrKvz3q*t%juZ@RTN-<45vZ^$-C;}+NL_B&a*k|DvOGX3;ez#g&
zp5)#(W(Dkv0r+|`1N8YY!bCVwgA<gYG}y7;4Y-yEOSJ;?v)&Cc?u$`{6d=kP(?Woy
zT4CRbvz~&oesc)Fd2GR4!l1rBl-1w+xaD2IKVWxD&>eBQ;&`KW1$u0g(T=x)c~|<j
zQlHNG?wLE^y$4PuZ6<CeQfLBYKl@j_FW9KtaAa;uS?&JhNm|pc&~i-Sckvwa7PD}8
z=DcxE{;O^ICIbRbP$N9k!(pa8Op|d{&A3XmYIN(<>96_c7gz%v4viAj6wJ2I0~3G<
zVh95h0f6BoYWA>xt%6I##^G{m_Rx>)v`Yt1w>wlgofY2zhJbYVsC=S>Ue$Dznpsr2
zeE8D-l3CO!V~)w-M<+Dcd{|%r6+3LIDB5IjTRq~zfN460RxdW<3u3gcbr`-jvR0p+
z_ASi{%o$^xI3SX6-Q;W%gDS1h7lOsA4JJt~9(I9(-8OASt_=b#_6u4EYHCAAt=3s;
zPY(OBat-`+g2GXmSbz;UEIBa}Uy8#*d=D>hL}BkD=_K?XUTN3tlJY%#owMX6ix%wM
z;#ZV5>Q?@x?il7Eo2}rRlO7t0TC(#!!=SPC1plSIo%i0cc?e05Dw-WFd1&W*d9b{B
z7CDEt3QMOuRM+V82jp<{!h`(uo#@~EpC_qrXsg2e%^et<lW?3kT5v1d2=$|T0;9m_
z?_6SLW2=lg->|c@QGa>juhR=c|GE{_ntEzk@cF>AE)5Kd8WTw$<nCA4cbR?I+umlk
z-nX575C^<yj&8REWs#sd0B+a=yprEkj{AB5@!9YqVKA3IfJ=3NA1}k7+|Pdq@-}AS
z44f$Jf)px1YsS21VIA944+_XD%R~Wa^?|S5qz*xA+rU-~@)P?%@S8_I<QSp@@f1Qq
zzx(*kq+#Z60M-<~=y^pebF9|H&IQPek?{Q+t+3qj9D;H1{qI`g(ZtgVwC1YT*PPJw
zgMast%zlY23am%%2|K51>2>ZTtu-<G%=L)C5LDx|@<#}p_MvW>=C$BdRM=JMEzkFj
zqDERh<M(<I!&CVV(ftSddHzUezpV(tx!CON$A}M?nG&>~Zq(SFOjt;7v{*=n8DC%z
z>8SgbC1}4Veu1s~AQ3bLsdX(u%g2j_G%X_$)P$2@tVWG(Cod6{2C1k`jh&tH1=i{v
zbstg0hk7b3q-A>QzII5fHjt9sFR*2hN)?b29xNn9h<FlC!gevFH4aEcTIxPI>;z*-
z_u27ZU`HTwl@het5Di8kGLeuZL|j0{X2h5AdqkL<zIat)Y?Tdn^B$8fp2tgwrX-ox
zJkvZ!oTfOxt_^o<QK%+?tG;NJDA`mq@%K;Qntn1D8#liZQr(;tjx5bkGKFTQBkN)f
zzY&Y(@zXDJA4Nu3bVK<q=b2i};A?`&(3+857Z;eyiefci1%M?QJ+a5l<LBv8Rn@T-
z&Esd~B^pvAxDZ<9cMIby91)tEu@TMJu8Xtd8=sJB^vRZ*o!#a0Q|35wHNB<rYDmda
znj1Z$i&AQef;4p(S<-@TPN>0mZVB0Pr_^Azk2K)DaT+k*&xC9l92zh;<QvE>zAUjK
zZ#aOa6G-Y&u;d}=Iiltv=rOW&v8~ne{`-?UvrT4;F}a}-PEBqg{$jyW5=HjQ;{M^g
zKc6{!yvKvpax=v=SKezstFsch>=lz-?UQ6WXgk5^uw$`m$Anco=yn-%2WlW{793T=
zRk2qSH!`(<ysj+OK+!~c3Oa&bZ-(V&l|mWE!o`OUScoqyiRJLWp&p@dehYYw_yEDT
zh5ZFNq<(?@DnVQRj#`us3u!#!gR-ndkSR4bE_MQC-WS+53EB^kl%hls0~V5$V~Bsk
z2~-cR?-ncE{c6c}77t^qR#K3UI^#naHJnje$+m4G?n?&)+@E(J`hbSW-QzNST3>K|
ziRAjy;&Io}RN2kzMwgg^WF<u^N3ocmT<~6<Bze@$W&OsO+vv)Q<=kbGaAgu<Ba-T2
zRo%+0mo-O9#z3dM)XkMt=ha~+HfAl*Vh2hW=zrLRqecq-maeKR?yjDnxYb9ZN|#3p
zwxrmi?aR>zqe{be?-epsC@ALZsG^w;6v(0~=~o<+jqSu&S*m`Yph!8gu-2p#d>Lqd
z@@%ds@ZH1IzU2DK&58d&z+#z4Cx`F<=cb43^3Qe?Eh=EnWT7$`XIM)kwu*s`#OIUi
z<WZEA0iW~W<-7@9FdHFPJ-e`@2m|lP1&?dEf`+*au4k+<EDW>QUMBR_ODSI(MP((i
zgnzgt!tP_!bGCIP0wlFJ{R;<!tHB}A#Yf5tVOPty&T8?5=-01^+g=7jZfoOwYTPd#
zDdEsL*2Bq9%9MT{UgcDn7nZ+>mk+L2G4vp3grr>TnB|u(sR+B}jLKLP9`>i>k)_w7
zFmqBGj3_DG%)#*eQj)AFDHXx+Vx8>G#xzW%G1@Q$n$hcDL>uQuhGh(g&L;Mf$`-Yf
zt>A*u&PbCvv_BQF06Db-y<8_RZ+eFV*R(d5Dh9Gk>)pMMu2-8*_RQS}@&lP=hQ?EV
zeWD>1W>Y5@zIY0L6NO>U+=CJSiFf5x?mOFi@?#SrpD(X09GbZ&knbb18->vQ<k=z-
zmC_%0>m<bn0)<ap0vlni+V})VFF~UGsd*k!Ce!(WeGk`+cgq)m$+44wqirW~Qr<b{
zwFND~h2xZ;$IM+VyrDs^6-=3`BVTLY9<ITGqA+{<?**=R^$jJ<sWIsv6<iL!&3n7w
zj4OM!h4PML{S1usbanq&i$@ZUT8pSL=@3~|3c2F0cCr^Nj<S0`t6e32m;3}U2=-Dt
zU1hCU+dXgO<C;>~z@yMtQ5?Z5*Ire3K#T83R;buQ9y$n&5r@%HA{bD%&fojuGjXy<
z+hc0+`crGrC9@G2hmcu|xM&5pHy6g2xq(^f=#XE9JHK~GHi|s2Bz^(}*6sRqE#w?e
z4hb?U$2EO`F{t57BOoL=ycRQ)9vTu90%{8%N5+!jl}qcypW_Q(h*Toj=fH$dL?v}L
zGI>YL>P=KO2BC?b-Z+LOrx4@h5u`o!&hNdfa_G!FDur9#mBR3|DbML|S_K>eeyYL9
zi#}g{GL4K{4Bqq2l}Kx1`W&$jx2vCvJK|-bafWLk=}(EC1ant#pe$a_jTxs{Tjo;K
zYI&+B#H}u5Atj{u3s<Q&S!_v7Yrd&qXPFVPnv^1(@$Sl+q29UGrQFS3-&%iRJY`QT
z@Dp>E=JYvN+6)rh?d*8W(h@U)I@jFD^2pqo;tiYdOk`X~6;&<o*TMu`KkJvD%;IXN
z(iR+r+3OS4pY(ZZ-gD>gFhW}p@R$;IaD-^euM$c!mrj>&Rl>k(%2!?VBBpW2*jp10
zvdF`J@e>J7N<_kDu*4Y6&$JRTDM8Nkg6FEwDC>iFzd`-3a}3xJgyAPVuwn0IR|>?*
zKCp2LoDf8FaLOv{g(1Je_0&0rsq;d9*#;?z!kedWiM}(>+!Dn%&)O2@xdrtE`_0Y>
zBE1&$cwswJjtC+_A*Rz)A&TDUjfUoXL5s!P`k}y3n){)6vG)o>J;pow!NA2k<_3r{
zuq*X?DI5F291eIL@M4DDOzp8__8)wL;H*yWIYBWa48R=-AHS`=&`VI7zTrgXkG|03
ziYGjBqlTK^Ff#-e9IUXT%1+i5;D%)w4LA{6k_Tfce<X+OZ$J9M5%hn!VJ3tl$TaGg
ztR_Vx$QUt3jppeIVUU<&+c9nZ{sKMR*oZouX(R$>X3n2H3;V=AeHJFGsVQ2ringZ%
zhN_$_Qbxm>oY}!nHzp4yF6W8smni2E4wrF?cqEb!lQ}qKhbv9b6K7q_%<EUzR1B^-
zC}Srp&CKg7Vc&ScJ=s>hL0oKVggTj|VGm9L74!+BHW`<C5t>$aqFQEz7bK)8V1h9E
z?5w#k`be!gg#+8zM+6}N{-ifJ)?sZ2qOH)GQ^B*)TIqQr%+2X}%5@=+9QsH#2P2m_
z=~jNIT74;yI>dgaey}U`&hPat{9sYGiEqrb5m(YFRE)wOF|<)pru=)cwawpPQu|GB
zD4bYXI50#=^lixlESzc{A(-{{2jNaa%#H!4lNdWvt(z|Zhai$kjBU%-xfe`_K$0m8
zWAM89dAQz=rHk<T@c5cZTN}lBz|Vu{OSRT1UyAb(fyw&<GQW@K;drwS-3Y>FKV`K|
zAjj~$jEjDQ>P`~P%!_`ehqgyxby&xw$2PgPMK?-MfX0EqB}M%YUxf2epUIY;v`ds5
z`v*Mci(sFr78A6Wd0&*}#_N^(;dO-j0pc6h2eg+T>j)UVuLtiRSegA1Fw&p5MLm0c
zama(VG9CLbc03NUE)gDb+7QUY5T?5RLY<z6O7Gks7<!_T^W69HYu1KKPYGS}30j^9
zqSa6P!n`5IWz`MfT(&;K3nGzB@@^~D_xY0L2GLKhP@(&C8imJHp9Pdnu58<AIt0ZW
zZ0*ccucMM3Y?+`4+P{(U@7UZp*5mPH7+ey3w|hf-L(Vza+9vw`@eM6Ev?sl;pXZ@!
z6>g>vWJzEbZZ!q`4z)I^we6+Z4VcNO>sQq5MiiLTGA8IW?nXuO?DK_lA5grp@Qg@d
z8vx$WdBVA8vGr9|p9Q5&rfoY`zX)`io`<b$J03WA=A=0GZcS~}BfL4hGiK|wJP+dC
z;RZoHZ=->r9Q(*!2s+VxCJ7*rsJ7jR7yX8ia|Fi>w*KeKZ*4fg2Luij9{`)&Mj;qG
z1}^lZ0r!&x+Z309kI=q@<8eFUH*kET<4W5BkAkE@aZ`so?96e!qBmX-xagSz+n|TR
zb*Q`nDi;CL(18Q=qcEBS^atqJ^qIc2%Zx`-(%_;4_Xp(msb81ez9tUA{{3kOJbdUQ
zllGTrq@cWDoXeC)7GIP<TzR2M)i3C=Su_2Nnz>;(2OuYS#mpHI4CbWEoJZ7j$d4A_
z5=tbA<!VvQ(Q69{Di^c=#+WSr_c+W9iXbAieFXGnuS+LD^@;jYaO5WB5NW4jZ~<fF
zs+0CIfAsUV3+W|k*E~v|Tp%WFAVNZ48Z4&BHe4XQ!2Bhgp>f<cp|7a%rDQIG1{Q-a
z5Y1?tPZ6`1|EZTi5=tWB8|_>W+i(75Ya>xiK2gf-0J<Ls$Ktf2fSCTnH@OGuP&Sni
z#7J1`FF_1<p=^<bqe#>{u+$4YO44j7(BHWd#CFuQ;oT)+PXiXc04j+R@r+^;@J85l
zNX@sBn3AHnUMl;Z3FWBWy-|fM$i{yz`qF51Wc#!%;u(C~*nFP^4U-9dWfEy4$yD$p
zoxan46RFUEjTDlBKFwEC>Pxdg!i~g~(GY>wNlq~wVfn>8ztJ>^gx#R>03FO0kuUJ3
zcWEJ+AgVBsCYovvM{2b*k;sCQIEjL7m1M3{s%)M`8@LnC=u3r`XP977AKP?^his&F
zoWzA^u1qWWD^%%O^`UVRh0`(3LI<BtCDpzWcDnmg66@&XK9H?+r>YW~ShCelO%zH}
zv$^{cPe(;UXGb!lg*meDOJVsaj}ClVEjzT_fRz^R-?lY0)Ow|MnBCFTmGLxSgkGJL
z)pax^BzGhwXYnL8BxO|1!>NPUj4y}&Aa|Em7?+_`^4TqNs&kPLc3o<u^sB3js>6zF
zXvm6Jo+#s9wk|eZ(jiqd8<Wj4n{s6-z;)!jA2Wf8>2C>UhBVDBsYa)PN2@Wbp|N1D
zqpD$`(JQwTWwm3QNNYo^Ep7DRjz)^w?NG*3^HBgL@3#iGf+{!iR)r02cXdTrWzbB`
ztH<`*nLC<mdw%9QfF$%HAN`QaH|t~5Sf)ZU*PO)yR~E|z&(f^=r5@y2(?-;@NVIAg
zZ^`0~^ZGzV0(B6BZ-?cI&(1=3CY;f-M9Y+A(^#bGLUty+&U*o}lI%j~{6&kFU^kIE
zM3<v5vTVgC+7?k(->h?U<Pag!GxV&1g70LBrfHq%9RmfGl>-Og*7A+Qg0Y+;kpm4r
z1-Q+YG`(-%S?p85I=^f^+U#>^rKEXvayoK1&?0Lu<~Q%DJ#DYFY2P@l7pIi7g0-Vk
zg%Mxi8UUOI7-Ai`wxL~mA0_!ZI0a4YT#IO)6heimc@SqhjAjC@h{6^sR_(&hSKJUS
zNumS(pgaIu){qQ|!Cb!N$VMJsl+UCOic?PGnFZ$H9L2IJOP3R(Fmx{{f}x;PT}h|a
zU+!rr)xm|!PoACcdCeb=lQ>_uq3Ra)!bP5Twy*hw96Bayei(d=UHf(QoeaGNwDvRP
z2Emg7O52GP{gR&)y^i3o9ixS577$i(sdC?RwqbhK^59@p3A(oLynNqp>@ARzv+mzK
z`nH=q2!hEm^p&@Ziki0x;UCZjE}#4O^R-~jEv>9X6#YNC!9GJaC0<QW;-ZkwXKpPl
z3A<6VcA5^Y%*`$N4W?0zYG)7vAaC_Xvm63ppsDwzyIx@STh?KyAM%qk@pfU3AZb9b
zk9Ygr_OP~+l85=12}EKqQJU6lkr`)HnFj*Iqrji({Z+eCdq^)vM4hG9&9YM1;hP7s
zPV``EC~uP3UKz^lQ4|qOd^pumtW-~|M`b7`$&_;RulYQ*Q2qTqVF+f!N6#c?Me*Hi
z-~5fz-U{ywTCH~qwavdUOGK)C!S%mZ^QR|%f&B0iZzOk;ZAjd&2qZ3Cro5o!i+Q<j
zJK<fW1caezK&KvJk*`+flj{a1Bd3Vv%u+iAq(b+o=i7oU<y$s42&1SzZ<T-ENT9-u
z;vSAiAZedTibLCos9XPf`V%AR1w}21;;wV0X@9%3qX8yHlpj6sd0(!Grn1<(LW5eF
znv#>W5&+}V?H&;#g^UwI)Sm(^En9$nk`Fgu1nB53ogSX^puN>Ho7CW(oRx`Ku{rV_
zsWtGI_e;;_xuEPuIV^ZnBk|spCzm@vdPK(5$GAxPr4L`u4yxP{i0~`}NWinWW{woX
ztdke$j`C!SxdkdSH6!VTz;a7O<gYW{c=VH9ll3c^$a{FSY}UjTPEeqyDO7EJI6s<>
zOsWl2d1B!29mT}Gg^h{FVnHGv@&rcGQFIGDB4)br`n{d+^DjE_Ru*Y{aXvE3$0Lx&
z6KO=CMYOD;Dm$!*3b*1wfC$}>4HBqogG}heQLg2}(3yeP-s}B=yYx>+x&rOZ4u02K
z8Xhxbe3zY>iIJs8N?XO46cS}l+<v5p`;wnSi&I!=PLZS~80yQ@#5DlH9SPla9Lthp
zCA3Fgm_mVyLU*{7o=bv}iqw%=o#k}_$%(S6(tOT7Df(<?@!YKj$|lin9v&>5unkb5
z&d1xc*>iVyMbaxPMbS@lMI^*hakU7r5XPX#7Z;K3LhDV=Xa*7uXe=4JzI1@R#P=A?
zcS-E>Vx)=eVH{@h-E}_x9?x()S+_am9QaX^VX)%mga*HT&b;IOW3Sa01!cQ;?gNkw
zo2fHx7bAj{^5rZO9I_}yJJ5FU(3|D8sf?*1zTgGB7U&*v2}f1(bSSevaL2s9Zyo#D
z-~7osskUi&OaUFi*7w_(rCCf|p<88S6`bS(dskB}+7GBbp3Ljr5~n^n6S07P*cfQo
z95I-jprAKgbn}G{sw^>Rqd+n|@A&XU19G9g44E^2`|nn&%`I4BbKUaqJZVMgI1>e?
z%(7e!%1hB~kvX%(PN2U5&1dQ7P+E1rVdZR!xc<m+&6F;L?+UC>z{>euZ1qQ80Ec{7
zyCFec5-hk(w%jogz3MGapS;#S^EgEqFDptG8N~n-=G-8Mfe(%;czi4n!R<>B5AS)q
zU8r-XIoI+))8k=&L`s-rXl80-1k*o?G{Px}2zZlAxT`-Occ1|JLIL}9ei)wHGjphh
z9!IU2W^^WWmL*jSg6$EC;oS39->iA`e`zH|?NWzN=T_mkap~91pWbPH&gd31s)}mQ
z`@JGCRWuifi_)G&ZRqiAE@|UZpsJNqHMDfF+v~>cxd9SvWM4R#vlGM<5$bRqhf*hw
zoi|#%|7F&Cf-W64sEkZEL}#r%Hmh7qiI3XUswp9=1n2!TSE;lbc|9|$)n|sFN6w+I
z2<6J<`NH4gX-I2Y=UQx}sLV&v4jNV~OL{Eng?v=ftSI;e{NeVgvsKa|X=M!dN0)7<
zC!B87C9+vfV8f0?@>h-!&d<(eULh*A>o(+Znw(<wOOLKu3gy4S$C=OBw~cW%opD%M
zN@Y<Od#6uG&3eKy?xzI#8&3@muME_O3yQDsvxl|P#T(jY)u3;LNPDc}0jYM2Vm}Za
z+*n+U_1W^p^2Ks06D=rl`Q&m^runU+nx+`@C*>_HJ319Nsd04NG2fxH$7eu^J3r+R
zX2)in2TV;}u6OltESGp(#JLeoV+EUS&~U=5>BK*Yzu_XeUwn1iYyy!kciet%sQql9
znFo0Rc~DlaYY58B+K)k9RbOI7g5|@Q%G~K)Yn!se+meFIx%j5=dd0*Tn`4#Dm#&W2
z)884qf0!~}T&F=b_eP<&B>p$yFnLQgt+l5Gr+G-(_qzsle(bs9Kh`FT%n|;OK5XBV
zYt6?qJeyYwV3r}LQM2Jel`p&msk|%X3^h&SX5hp!C}fZXUw53Ue*;#g8LEI7B229l
zeiXY$Y#&cs9;(u3>_|#boQr6?K9ItpL!*;;vQ~subtSjhy9?C*o=!fyjb5~Ih_h@;
z-QTywEKB>A<M(3(ykJQ~x^%o#ziA&$NQ!<RGSE@3F-LeRdj&Fk<jV6n6}bCsApffa
z8MSha5c|&90cxO*d{Rg?cI)`jyuVOuOV+#nhppy%G-p!YMuZVjw9$IJZ~pCru=l1;
zv%~w3g~*5lTsQ2iGZ#=~oGPwObouNlX2(*C%D4sXI#Pqw^g(>@7`d~Qf9=RZo-gNL
znPmM58`SBR7>)e%?s|=rG5*w?MXfIf`->5K^F+=;!4bRc1!s74yQ)ve=a|nqpQCaR
zI?~25JERDDrx`Y<wfoO48u{ep<g{Xr;i^oKOugUfN|gxDAGhMW9C?R)$O_N}VRjpe
z*AS1VGqR^*!xA8~t0I0sYc`hv)MjL&d0HB}g$|gs<8MTFlbCUYJvQ&#N8b_B{N_|?
zs`s%ni;mcV{3W1^6F$OXvQ`ck1Qfu`1xpUdh8=`EUx_!JCMgM&y<I=fbpOaci>uWO
zpVi>qn9JP1f1yo=F#e9wZ+S6$A#VlY3LZ`7oA2%j_`eYvP*@^4S>y*{P|v*$QW5aU
zlBLA*BOJDNjjLVsZC|0Z1eb4|7rzs&Q(>2-aH}=ge&QgZdL2nAu@413d)L5=f#O?L
z{RsGaG1`tIj$WWt+6g-YK6K4jZr}OR_hivqXCUk_S!6Vd=~Pu~@uzHzuR*T66&Et(
zM(&uVd>I0CDV-@LuzDZwM)DgtB#cRLtT+%<N@f}6>cl!TNo37v8Z&?W^iA<bUA?5r
z(u{LnYBf5j-YwG+<ZWtoG*uy|Npq5~Y!AaSkpn1<WTZog1rdv(a?)`Rs*IK|$d~@?
zw~8*sqyr)oxn){5rw2(Dq}qkZHZeDyHX>=_4rruM9TbkQx38zJf772%)63M$=y=DQ
z@N8cTXv;ZpFNL+H$=q{7TxzrX*4CEszFO;3#;Sa~l@?XRfIK4Z@y3v(JZcDu843ZO
z2LXr9+K14y+NO`)T8AU;cjpeD9iK*~(<P&B!<^WyQID975_VY8lTpzQum|+)u;|Eh
zJ5eiEx^ISl==giHKgu|tr4x=T=63t4${m9suXF@&eSAL6tJS^$|9Ny1K))gy%jn<H
z^8WU_vv&RSpA$R?Q5g@0%gU8w00Os^0J;z67i?-b>VDqSBX2w}SP9KuU2Tk<dXl4a
zSy+`D8#vvH;lN=Qt|@wT!e}<MK<WWwS5x+3-fUM<)EHn;A1aHtR5?#)i4!5aAstoY
zWZ;i=MBa%HRG`t6kn9V><6eoS<$O156xsZiSrb|Se>D|tAcZENK-_u-QKalqchQ7U
zjJx$KLk+h8cmMaoB*hzBDfmIvpVcN26qemT=lT+_99EU;=CHLU_I@>Ht$I0FuCyU>
z@3X8<Yks&WL`Y(kjNvHaD-rbx_2r}6y$>ZZ>oB$17z0MBhY&hgeNw4VLWJ*~rP3ZW
zP+z`nA<Of7Jli@jx+&Wy81tv)Eqb^AoY?akx0jfeSf)s4^b}_#9N`yUTFA60T7vZR
z@aqc-Wgt$91VVce?u;KvWw=FvsB^WGv9x4WtNfrV(VC<>1NEE&SXw^HIf1AvIx7Qh
z+V7cA+BUj~W6z>$V<M_hHP=*10xQ!LLYAcFmvAryY7SS9kr+<MIXJe)QriRyH!;cN
z)J#DL7nZA8mqt-x5}?UV;=*uikWE(0cU9L*JqYklHzZM?E9}o!tBbW~Hk<4%{q&+!
zOqnD7$CVa`(GLo(k}mQmWgvT-PnKG%>%6ga2o^VbDf=@?Y<UoXrLq>LBeDGvY|1eI
zK}R^eH^Qkavk>MA=@okXFD2CUKk~EL2uh$U)Tt>;=4c?FyFzKxqlEdRgrnt%!sHF{
zD_WJ%(M#GfTqW$Gq^w<;d1btjD`mPHjYL|ri2~zjW4*a1L~F>l?ey6c0@bG8!XZBJ
z1i2j<JZ9JVds2L#UNA4arQq=UJHOM?WUlW6Jy03tT>P9_#}UWS)Fr=VeR8^nru$Mh
zPrE$Z39f>q%P|pcEF?zcS)IOrb<QhV3?z&0JaQ$Q#CB44P_v;xkUl)gcl}Vdf5fF^
zUkEZ4Iyt%}6ARrESeG+V1sJ|l>69<@%#gU^jM#OXf9{e`^~`X+vXm*uV-<%Dca=ak
z7*z_xiT=vy&eRUdz@w%S-Y~NqmB$&|Gcfms-&nIN5H@gz59BcGUp&NI?jSakeCl?(
z$MEX7Vlf%=Zof6y!A;Y{huw2#Usu*w{}>`06xJI$U+s6l$lb%2EExFUFUWO|=X$Zf
zFa2w5C8<ZcrEpy7p&}0W;eFD}yA0npq$T^Kwi;iiC$!Ai(gHWeOrPj^(%szDe0_^7
zu5jfV_e=^24ITW-CA&zWlsVKAzLW?y?ygtO<FM@MM4mz>$%0Dd<_dMtfvR~Wr(~(F
z&CP23hjB15ZUsJ=LaP^Rdp>!xgfZi^#5`7oGp*D-mXm*tx%7_TDkg|qQ9|gJL%-ym
zrpcrW<)_4GFWCXJ;n^-3-g%{4svW19a_u~vzlYKIe9>3YA*opgo>2s$36G2636H%T
zp`wQxA^+i}GN!(MBJi{$9JwFXoosgAKnHk2WfY1Lp;k4dIR|jOD(dY%D<ELp6nuL|
zDa81r{yPrhjoR!M4?k}??gzXNU#{rpF>=T{{JuP`;Y)?#F7)}Fuf<&KwdC?EfM@K<
ze^MN@1ck*)ZZM3`4$Jx^#~`FB)W!W?IP>!<_}rTF!M*1*<d4SC(a7<lIf`q0I9n*#
z4CU@~0+o)63$!R6VTw!?oo|G5QIHIkXecsMJf>mrtS<W3DC^M3**F+j!m_KqFk21c
zQU}UtlnSdRk*dY|`VWiv6^M*XBQkQ57B*Fpx)Q~};ayYe2~V4#eCT<pA7lL2_+WWh
zN_$Q*R?bB8o@l+Fc-OjKUF(b&savUWqx2SS<OSa7eX!9V=)_V;#nfkvvGDTU7grD;
z@EMaS8%FV*eytNbkhO%$IXQj`Z*v5PZtThVcoyyXJJqqev6URj*2dcI{O|(|L0yYQ
z<2$2Bve+h4R%kbWaEadh9M772rw|dUZAXQN9t`>CI8Oah=W!~;@o_F@lu$kb>{ghN
zV{6`W=g?k3UrU9$;}oBdNxeuP9*K27mY28|m8i#KCqA9Q5H>t5a+p9r6HO&BE&sD6
zcXI$uR;9%&`I)f?&-}J*s#939aHNRphbktUF|>BCX&bGvzGAU_scv&J@QJb}s(Uk8
zRcu5xQ>w^0(Xie;WM9#y5TwGpAtuX@hn&cSO~FVRQv4VO`P^QknfQv&`wm1mBx|?}
z+DFr6;8R8?F?jZyqko+*B)4p3bjALHW1jJW`k=bxXue~-bV-<%vLCXqr6Go-rELY^
zV0*A<RRiaH@k7?IK9(FiB2I~E6_8+2u|h*r=f^9vBqOPXw)LBeQu?WX2`ge!k4r5u
zOryV3N9j%VG%3=U?Fo%RA(_=7$sPaG-E({1Xmj_;Pa=2;z*DdAq6#h7ad!@XpfA0{
z9#?)OCe_dvbD`3rF#PBH!2x{UTgaBT6x~)flcJ92Bjg%G0E&#BC`dT!DIF9Hrq+`P
zxkFZAmHw$+>{FgBc@NZ+TQ*K5bpd==h0o3*a!nz}A}~fxM}FV#z}Mx_>aoGD$D3`)
zo4qNvbL(tUS%on7voGa5VH#<gNKw_au3o7Hr@u-O?aa@1V&>bQJqscMpSvCxK?SG=
zdER#63-s`)sA$uo^dAmgL5&=#9~W{|c$ca$(bbyKnmTD*AvXe!8aF5~hI#KhGdqs(
zu~=n*z(H{z!xHzk+hUxam79j3>v(uV^1_R>s}37G0FsJPRM%8&LXMhA_CUffi)ntx
zP}!Ov$+0gi<CCagIU%oLjZ1b1jP#autqGP`$oBhs3-{?sOc7gsKTmCuCt0q)9DbUm
zzq0u%?iiOVoiJgg@rYS_NvUcj?b(hpHQLI#_k>z#h1j@3S$l<eMKsAONs-852p`dc
z+QUU16&1-U$m6$VC_@xP-@kLt9#gKITObNZ)-w)?E`%C_8esi`c;~?AGKMmCI_}q?
zC)wAay;YAZ<Y(!l@mMOoyY{qKB0E#_qABgXJpQU9ly>Fo9MHJ0#jBt4LnaaLg(N=C
zaN~>3?~h#KlT*#0RdWx{#8JFo8Tz>sho$d`1b*@ah<kNk!S4(ojzR9xcz~sk3``CY
z%N${eNzpyf&LdIBelW1dd&t7Xm(z@*sKaK$$ib{XGEr-Uo}zrJLTMXB=4jz+p-bDh
z6tf(168P9cQ%}(R2{G-~@w}&5m~pIP6vFM0Il%bigME;DiF?;D!67y0dMqw?nQ)rc
z&svX`_Ov!|%O@V)4`06^+GV?@!#A)ve55@w;3#vHV4?e-vGs1bOKnTe<C<gm=2mz4
zPaTY-H3REiDPmDR<rZ@G<KWASa_#mfpRV^t<5vRqFPCm+X|<WR+h6a$lC8eX45Oe>
z5P1yE-&CcsbX>IWw@`E{FMAmtU$@~nQ~=3Zx?U4n=wB<g>ghn?GsHr^5<jDCDTH7V
zvjOW}FPfMpUd{f2Uy#AHn^CQSlP8@7DFnu_+NREB3xb5)=`W^P?$u=y%Ms0^{J3cB
z89$5lBe8Jw+LG_<wTCovQbaeBd#9bp3hMnBhI!;zejN2FohcgjZj9fQDc-!4Dx_`-
zO>WFM!ok?gp>E7;Raes>j{QW&X_o!*UTgkZr(icAR>On}R9Zqe4v^&smbzxXOTsy`
zL{>TG!jQ;u?UyY<Nm0A^gJRDc@pq_3W|Z4j|Di3E(5SLXNc9@st$9YEBHR?noa5z-
zWYnj02=?nVNabLEoF_ZAjaOs2d(B9lt~DK)8XaWdVF05tv^m~~b@;WJcwFDGDbXrj
z>dknb`#Qf0?avau1z*Hc6sI?5NQdT3?%FGkMcJwJg&f9DjxnXO$8l@yz^Pzyd|N9A
zFD;c^l!aR)5GihbX-eGj_i%C5rjt^ZR4xf|D(D*Tp6u@LUYlO<HwsXP(j6|~5z)Zz
zkA(hE3=Y`ybR%`qoH4=2ij$~OuUh=U<-lh&#I_gl4fVky`x`1NTw`)ov5F~d%h<X-
z_VD#Q6Ozt(Aiqt{VDMsOno0Dq8SFSyZx!7qJOoa9TRU`{1rS+zS*j(Ay^Z^bDZdLj
zCkY7u+_G_lQ&7#${xR2dmeAIETO6?@T3&rJhbYOH?=g*ItZ+s7J+T0KjMUD``u-`%
zz55iE`hZBx8<0V-Fqx9x0t2;TIZ1<#iSX17EWVickPQ1mCmJ_sklcBvd6JfCM^1;(
z#yJ`!*lgtjwf1daMOTA+`GJ~0H-iS4hf<U(q6gR$lTLvdz?bg7O5Lju7LPytbXoEy
z>z~szv~}QkUw0Mt)=6Aq8H(VQesyAE2&Lq$Hv!!Z|C0s-1=%N^IUt9%%=}{Rh(-vm
zFJiz8R`5pZk_EpHWCcCbEI4z%o6!+v<#G8)gGB8mveCm6HSkS3$_~ANpDbz*@C<6S
z#TzqZ2EW9LjW|iC6m2#vH*C%wfB)sV_Gz#nFnIIgnj>!H_YvUW*-7z8xJdZjtL=(h
z4t8xCraq$qn~5spl1#dH^fyQ6j+%J2A8xL+_O*IYGWaphZTezgX>AI0tC#pe>ec*`
zALb%|e*P9Tk!(n8_T(4kvULWz7W3NR)LK;+;iQP@ZQ^lXo8G<P6l*Pyg*iKjiaXu3
ziw+YR<;x%S(m)xp^V`e$CZYr*GD`NUPcm<-6Yp+K_#}~rOd%;;NbCMM*G3LM+zPeT
z>L%)bvd82u6%XSN4bCS840O__dnf0|jbM_ILX3?bJHvZW@2ms)&*?*qK=jvm?7O83
z#AkZVO2>*;Rf8f^4U^g!E^76OxItn~22q6x?&WYV?((I5vs^TKt-Wfj1`L92_ZQZK
zK%E{&&_l@2`hI=c;Ot0Z`L7J}U)fb+7?(;EcB}&`@F&$#EGtX=LlJWFxH)ab@UIqs
zG|ey5+Dnk(ifGn^sCO_$!1nIie%u}Q8`M5^V`nvo=20r%M2~d3Ji;8GqGz;`tKo*q
z(OPb0J=M~<prLsjvPxU8svh_8dz~H;<6W9OP`b+=C&}^s_2JsH(H0imbNK%Ai_zxV
z%L#*sQ-fFXO9nFx#rT)sb=z|nSk$3J10eS1wdL>2tBCM(Qdxtknp`}QPLcS_$~BbJ
z2}gGLLs<0a9-81!9WFU8QJ@{cv;DrYY-PpL;vA?STgPRebD$-Qk{WW7ysooZDtB)W
z8R=w0#ikFXoN@TXnste#`*~!qqV4U`)#c0pgaKav4|{JJ9LJL<Xp6DM%wVx(F@wb{
zi<z03EQ?tdGcz-@C5xGv(Uw}w%-8>&+nL#$iM{=H@kYEK)XJ!;%&LUW=+0mE^H7(Y
z9K#iYuhm_1v}woowUB}atMZAWfHAKS0rG{#ZI>Y7$(Lo54P05Cd*edoC=9$n&(B1_
zCX{^<_`ALDqbjL)9j(_~nIG4O*XtF2Z?j&bu`}P{6nt_zeJr~3FZf?3B3(!_BCi!b
z3H1*tt!mo2Cl<bv)rrC!liZnWnbg*sS#l(Enj$KaHx>W7X-QfdTI8g~V&RLANh4~y
z-{*{0&aIw*r6FQ^;q`=$Ol?ocbWyOysWN3prAYBj9A&jnBTzLIQ7~M=(S%X}B}OK0
zQatE8_q<JtSb9l|a+=Uj@8;cZ8YT!FKC{qdoZTiV(QAyttz-Q(*q&&4rHe*$Fk&&D
zm9XOHr{XVRDQO%?y=*7;j5v2BLGhWUNjb)vqDK>HZ!@LA#Ca<7irvi(HIyBNcFFZQ
z!bG4T?r>dismSzwW3a||ZH%Fs6b~>l$UnlE)hKNksjEaDO5}>p`v71RJ2Ga{2LVRJ
z&6_qOyp~>2k1%Itu6&(>9&xVBuJn|8-1x1NQ>5vOn&&*jnUX?f)wT7WRZE+6Jay*s
zrnZ5@%8VGpQ5BRDmgwVN@wkkX5~Ipf17q)SFR!YZ&CFk0rn(1nFUQ~IZ@?1C-<wE=
zwynCR+r}KKsclZpt|t^)voPuG#Qa3aUX(t<EsbAR83^T<X}PnnGNzWKr%Mov8j0Gb
z;6yCwtHRa>IezoT3xOMqX<WPUhYhaX6vxj&g~#!Rn@giAT}!8xlPq3CpP6;2m$=ES
z@Hf9FRwKb|>R<X7Fl=C$Ddo^0o|1Nb!7y9;xoWwQBz`2mRtIq5Dm3^ONw5olj%S}W
zH`JVQ+``SVggc+^gC`rN+;PX1E@WHez20`oKsH#`vyuA_S_$1+UDvf73`sNia(J&L
z$AFN(5%`M!E9u;{lbCA^3z~(yi8Qw{n`fTY<*r{tftcH6R*z}>ZGC(D<~McgW)`92
zcyTjbjxq=Q%{2Qm*SoFZ&TDQpOZ@B1v5vzjeh_d`Ubmsm96z}XY-JB60G4<a;R`-b
ziIxbaLl6yJDlgg<Ak~T-KVGeas=_;3vv5h(3XXlEfm{<9AwhJQq}r^SfLF5wf$5i#
z`dj{ly}RHFkgshrOZv4Y`Lr2X_hb$;Y$vb@i@9PN7)qCH?}N#)Zrm}KLt`4wX;4pX
z8XTo4&9c6}n<|OD_<3*J=i53YO6Tj!f`o6<OAN5e7bROuN?mZ_PRq~wh|(f{a|0b0
zqEJ!A)lf~sN5W>P0f3CqS8NoOIjbBjEi~<pfPvWG-><g&>}cbm<sq&KP{EU=Mk}Gh
zkE9D_laQZinP0U~kzCAn{kbY9Vip@ZBep&hZe`co^dr#<&3*HGJW4(mo(<cQg{!$E
z{j1H}$y>H>jUqvfQC^2ZRBe<lN$+H_tSrkcWN}D(7h!j45{tc+oxG}g@NpK$9IsWR
z*izZa!e_dGzH;R)RV<}zt_=ojt1IDS0HTI{Y=b``c{7ffXEtlR_B6D++GSByUENmW
zxU<pOnN`%_z4F00<G~NKg_pS#e)-7$^Iw}Cnw4J5`WaA$ZVgpT8s)`DqU|Cyt)_={
zbKXJKD&-2M;ot>50492q5Oc%)q^^P`VU=-{Z=27R77!<}B(I}Iv0uD?e?yAqV#NQr
z{?t9$Wh?J-)3a?S=lddaLZ-_0P;#Q3fwLLs?Qr%QTHgwtL({(CMv1;e(&jNcCrjY>
z7WUwly>}<bWHFiDy}=)FaQ@S~_g7`At}o8!U^8Ugw@1+(k(RQ_eu}EH7uTq~dH(kF
zGY%U~d9qEDpJmYEZrPC)+$4IgsUq<Q#>b<B6AT)q?Xk0PCj$%F<MM;hzxa*|*#9If
z;FpJ%{J<K4+H=h^kY9IUFpFJvVND&=<h2L=Zv;X4NqOuT#uheA(52lCM)jtR%w@SX
zZ7Y{{l}!i9=zdYHKU{OYXxg}f_tTyu;7@R3L^tgN?{Fzj)^b%}`5o3<UWYAgR|5RH
zZTFLmERe6mJnwb6k9uwdqHS@Y{oOD5grOm~R!@x!78kATw<my3kkYZ~MXf>$f2NXP
zj@Y{+8-fAGE6o|4kO93)wzzUFxb7*L@hP7}lP^c{%l-3u>ul>#jdSIq<y{PttZ+pO
z;ITu;ImInr$f&AzBm$z9W;n!g%2doqDDPZ8&9a;S92dcuzuN8M`5GJ|t>jizK+alJ
z(0QxR9<r^)68s*Ol#4H}F6jE~7J+Bsj6G$NcGY`c9cN?@!u5l+!g2F;Pto|T-jMN{
zb;5>lXt=E0yokyN5<BwqVVS(6Dixz+q^_lj>l+h8#=H@m=OssD46MgF=R$EZkjHEe
z53XK~KIPdf)*L1gI*lD6s>VK1M&wKMpk-|A+LKLQS#b+fXZg8r@OQb2rfod8!5kmg
zdl}i?9vGXM{4Utk)XVmkI>PE-T%R}JYPASQMqkMkjl5hH1C%QaRrA^DWw8R|MNHF*
zWD@rvnpFqIC`FLUk1*y1-aoPEkraBFe|L`Z;-)n-$d!?FQ3+6p*>{*ZtZDB5&F+M*
zj!Km^0V%m1gh6^{GYeYPHF7Yq&E0RpH5&a%+VB|ilV&7j^wDI!CI3ZG>Prmq(7Pbj
z#Xd@Qxu^m4!Cg}cxuGU#4ucA>&MR^sN5Gn=4O_oId}3%9zoNzboGg<)SI|V8ki01m
zrE5~$*eU*o?}M(@B}LufZ8sXFN{*O1#_q#$Y+}X0U<22lMs?Y6i<JSMU0fl;k<fYx
zPy9)IEUC<G5Wcw}VkMG9@OJXyG(xLA%qX?D(=w;WXB{XnUn3FJ{<-u(kN2CX%oM^~
z8|#R0_UvviO*2Cv!;R#GgcL#xjFWI3yC#k<h8)!QGTKRD9^Pz)7%}R^#IMu|qOgaB
ziK9m5Hpn_#ghTf{+2*Z-_dE=5v|;B?FSFr5DUM=tbUgO>aCDYL5e%>Va6raLUO0LP
zm3zi!rt+%jXj$%)4-|s>f{j?e1txA75^`CYQQ*2EvK*C(tCl(IQCsqmA#<KYhETM=
zusyS|y%a5)J3ntSJd=4K0l0y?u)7tfu&;U2bKx!7dw?sh)iye;FSh=J<k<q$1Mh~u
za%S<OrwgVuOA^B@J@4n^uTR_e-)4)Hj}hSg9N=HfgX;*pTzreNj%ei6L}Wf?sUdx-
z7*jb8aPY1*PXDH}o`u$GZr9;7!4XTGf%Q0FHO%>E*s}zM&jrel%gWqmG<~|Qmusu>
zxnK>4&oi{-_F`QZ5BG=I8>8$8uQzhknl79*Kp<r6SCm_H(|hyf2=myj0|`GqVE42+
zq7fmWy4Yx64^dq(8~vwK47Pl=R_&BP{1m|#dpir2F|J?7OVB0$^UrDD^@6QeM;F(S
zp4X}jaa24XbgS2Kc3o31KWQ&Z7KXr#+P0tnR(o2vCvaQMEQ1G8OsA=0xLx81I<LQt
zS_$0Db%=$S9eB=^S?0v@F#0H2-`ee>;h&2RiIGGCTH&&KinpwvNZ-`Q@k->OZ3>6*
zz2-04HA`xQxV(>AO$wG9vRgRoiI#eJS0LcI0V2GExj_qFjB*-~<DL*H8vt7-Slemj
zpLhCzagHl}Y1FT$_VtD8IDPDZbz5o-T{c~fpFgtCx=))~y#o5jZNs$_#$1~kh}9DA
zOX^cKG!6Ald15DY`t&uQgq`(jD=EZ(tGb8v*W@n|(4&q)<H%+#1-17LO8Gn}vVI5l
zP*a^sy!rm5`hMB6y)%(Wli<ztooY4F8$-{Z^!weqpLpf{+?}Pu)NdGPvmJj1RgAlP
z6Lz0Al56=Y)h;#1;s%Lc1o3aYSq-#UlB=09g__t2A}Tq`;K|bkZ?r9#{X)7(6<0<{
z_mIRx+jBVJAHz94e=Gz71_dvn%$L`-?b_sR(O7C63*qrbCK<{WeA|{%;$tf2C6dl;
zS*^uQsRKXzgm4zv1EH10-CIY_vF9rj?@3A;2)awvup8d=d8<9h_TwCh%@C)Ve@fYp
zM;?CtH62f%7h$(v^L*D^1aFY~F?6D<909D_)^6MDGmYC;@l(4typH@csu3C&An;%+
zJ|j@e&z9xcoX|KT*v<-E9E<T}s7*O83&@b+YiLa6Jhi%L&fZUAb~a_9<IAQ-L{Pam
zEQiPj+H<<_sWH%r7iH68@Nx9km@;9vIgwnbm)7Z!(o(1HPc-OE400#73n|wy-m3@3
zjlOERvG#rMLN^FuIy<;#>3mMh9Z$V>q@_hk-JEJr!W{o)hG9w-(`PcrSna~BK!oh$
zqrI#7Z8~z|$xtyjMR@!0I=RG0d!kfIrljj~>s#4&Kt~O|erNT4=(fY!?Mbd)LRQF^
zoQP}GFjV{n{{02g^USqxTyOgqf9Ag1tpZLI#9!!@lE3G?dggcO9H8H~o~|&CaEN@Z
z{4vm^^r<8ozkaz4EnVr8bNTHy6KC<leR|VcON;8Q9DA%%ZecARC0H%<TltRmS9CFP
z*)y+>KJkMJN$W!vL|A3yFm|+O$K^woNt+fsn=?9l^6@^u_Fo6S_Ln5NF4|pI-l6nC
zq=Ye{qER(Pgnr1_XJ7aj0cs)Y!EjLviqe8&?gS${)GfC*Ct)weE>SPDGe>~?p=1<q
zj7s(<37t~AS>*X5x0vrr&atL>fed1eg@}Y@%>Irpz&Sa&fhf7(RBBV67L_jPF0F~*
zc&CQutyt6Hekfkr_fx7SuKBMk5S(jE3c3AIH;>#R@~vkn>BcQgaWJ{iQD>m#Uz&6m
zQ7`GnG6)}3OzYBCQ)O-1fk;5E*O|h@Hoy^S$4M37=Ih$MPdDp5>(*LhvE41WUYWz<
z`t131G+dae?e~43vQR?7nx^YdD#mZNg7}n#*-!6(GQ5aO7Fa=Wvsze`&IxbjS(aPS
zmd^ceyCNjk%kf<jA_-AKap4mX`_9qDQS!=eroX()nTt)&9_FM?;>->6Ugu)VscVaK
zG<$e*Y0E`QifGWx>TMwP3UybE`a3Nv-3qkJ)m<wJnoW!e3YDH~G;`DV*J*-}B74|v
z&Ek~+A$s`<zY~;GCO1yfr<uO*4-vHHzwULgWezJ$blsop<dAoFUGzNe={(#K+8HFZ
z)_gQRfCXkw6z-YWGjs2{HuX%>R8B@G;nzzf#VJ%ItrfYUFEiT3Bg=}-DdVk{&f%^8
zI@*x@{F&^#3cRa9QDd9I*KYzXw8_mr8#3RM^MF5YiZCMOa~pf4d(t_FvM|3OCMoV?
z7~3;O2f8)b@>8$R@$z6(8D(lwtH?~y0?C`*wdyMq;u_Su9cZ!>p}QTGzP0Wnag>dh
zEzod^P(q021TcD^G{Ca9*dd;#VSUhZwOKrmR?=P7&)0r9Pjse!1m+et6{Sm#hUucg
z&16Tctn);v>i67k-}VNd16nm-B&3U!4jmnOHdm>Y9kRSsDlXdf3ag9J6AqPV)L6Lq
z-FhQU(Sg+2U+4cIUODQ9oLsR^Aaa3s!8;K$5XJDKl`y@S3?N-S23s@cS&O()haGmc
zChhxN_k0$sAT<o-$jHD$p5I$NN5i=r{T=nWh$n;HS>6Pw$taW38QP%8ybBz<<G#Z2
z?=d3Y7u<~y5{;eHJB)8y;J;?K)3hwWxi3k)zSr(d7*ki|dA`Vj>zv7~p0Ua?<(4b`
z9PG#7Kt?D}=EBC2t#X0DygluQ@UU$voae|*|LhNUo2%S&2Nf^FmvDM_Z+3ro-+IOm
zm+0X(_vFvGqogP*)`9n!$&-PYPoo|K>2;G-tl9sW^&8^2%cV55a&b~zSF(o{qC_@A
z0_FlOxwP0gGkP74iERD?tsR2HuP;i}E#dq-Aqfqr;fSjY?3|G<H>Ac47w)?v?2j+)
zs6O-dR)UpYbZN^oV7rcVh<zau@s(*dj56mkR1pcSUDxo(8o}2JuZz*!N3=Ubce+uz
zg?>rL;3M$%%w>)T=IqSPonEvrh>N$a%@tO6o}^<71*W11DbQ*Z33<*vvQS2N9##o}
z#4@H5Wjm#HRsCl8L=XP*2vSmf8qN6m#O5uq4M~HY!>#2rM{Yv(g0I|!$a8p_DnbLv
z-h$tsA#dmR9PWukTeuRq@{kUv_U=5u)Ds`_par&XI~5M%vc!>{f_jAwbnDY$b4m)o
zUe(Q)I5!X2<ERF#5V~hptj>AMeGnx#dRJYTcFv_H3kY^{xs9Wo|5!30&)-E>1^a>N
z2uFw3R}6<XO2f_!XjNM+yQ)(AA%)5FLJ^k#wL%eXSJkK5?iW%aHux@tPI2|rlCe$W
zm7&WFH6PUCZ$lF?hu?n~Q>KL)NsWhoM8a?lP5I87_8^Ls4aitGYVyS`zmeDxNJu7-
z@W(QWX-zwH84rd&C7yhEu)W_-$cua=CVfC&12LBW74pCi0(kr#sqhcV!#}V!e?#BM
z8`+tWGD-b^6xj0@HR8Vjd$|5xo&Q$Tf7BcV?D?y0{tK|@-?hNsc^LmMfjyuHWdosb
zxc*`o{SDT``VXYa{~gu?LhAgT$Mesy9z9YvE)c8ce+c7Y{<jdGzi2=IH|h@P{NHIi
zp!ENYvcpXJce>91&(!%lQ|I4PbGSiW@IRpDu(7fJGbcqa;j4WRGiu1gmypy^@`ivo
zDs&O@A}NOF!Z||!7071QD6=eadjl3x^m4?wuHnvfi=l!lg=UU`NCm+P7>J9gMdFgH
zW2{TW+o1*;;96N7YS-cnFV)!d!bS<0s9i_A8Q#HfL{Bzozdw~Cu{fG+SGyb@CSF~<
zsgoJuz~c=jfFWcm!*qLSO!#%R+r=4}Zl0ZrO<iyBI#8E$I^rS|lK7Kkl0-B<)iT{>
z^;v+KvP}9-RYe7zh2dTI1)sAX@7=s-mArF~G~PHNEoDS}0fw?NDWz(<vY9gKFH$=b
z@{D#@!3_(6LZW)P6m~NOHiP&A%8_^pl{iaD_!NFGbQFpbnxUg#c%`H?*bnA3$|G&$
z24cq22c%vi_erPgpV9U=#K+4I32zj#Q$JSHetM#C?jZGko_t}!CQcoRws)VLCQ%Eh
z{PeFgFNl}*_b&Oz#QWdjb^hJt^FPMx{B^hg6R-2vp!hHIBF{e_=|Ay0+}tdj|2<uY
zgN2Ljp9jrg8ltP}e)I6h3qLR!ggd_Wl>^F!rt=t?!+n<<5n>ljllJ!?5MvgGkd|Wh
z7ZUp+BpkGl7Z+Kqh@e_W_nFigj)qzh6${(bN7bfT`>0yIzNNL?j;T#-a^h}62#}$?
zq*t>gU^Dfwvc3Ak*Zp?p;B(*)Hc*JcfKR;$#Iofu&_`mH0E=cj;AsAYaRY7*yOX|J
zFSU}x_N?d6hf+si(Y(!53p^FZiMu97ZGD>RNSWd-@q5D-`ryo)Z)%><`E6xa4xVNJ
z8C6o<T)rPKb0_Za4o+ilV`DeBUnT(d6^yyaZmWROX|d>0<CSB(+0Z<37x9k(*c-mk
zQD+I|Sw`3`J=iO>KXbR0KE2w_CfHH3`%9n~w)ol%LLBv){>qx~koPy7JS)hyC&iq_
zK<F7`#sx#eV6<-#$FYAngCecr&Fe_z5rOn{LP*+9)YyL**^S6F#VF@09&yFs6!$}2
zzy*Akp3NLKM3pijDQP+Btff(qA;8Wf9Q-IC3_U2&pLWK4G|uJUw0^s=q02D!7KOK1
z$i2o|J{epfd7U&aG3hy>STRD*AYTGI^0yV7Vyw$z@upv6^hVwTGpAh)SKXTM_<KIm
zn4oC*)EjDzu-Qg#d_SMb;%o(hh4$BqJhE&QZ3)-H<!vUy?OZ=5%7}q&MO_Q8zL5m0
zyk-l7J<*8pP!%BT<Kn2%o@mTeEN*v&U*H_RhkTJQd}`5OWST)K(Re@vXrH;=T?HL+
zyahsKpa1myW9Vtu-BYw|py5C)S9^j(fe%<-q(&-<1to`v{d8(CaEe|LeXK?LTJJ)A
zh1a@gZc2^z6h!v;;(Pad5yZB@$-C9YF84+xUwLr*Z^->DBz=;71jcgVQ<HzQ6A#D}
z1|kR!Tm49jIrE4I=7p8)(rgvj0z|2~N7DRLY0<wEHD2N(8=>X&s}qJ2lLN`{FzUhy
z<IQG1`NLZdRg5UGKv8N2C0?5Fa^`b2FgZhkFBr1k{{hSCmo>FOb_tKC{zM`Yq*D)9
zSw~VUNhOBd3qToDiq@$|C>`m2=bQ^=kLq(j?X%|(w7A0Y^pBBPBPWVqCcg+0#&1xJ
z)UL`ay#3<!LkD9O>&b-zKraRmN5Zd%jx`oU-bIzipb>MiLbJ=Smh=Da&ofpHRO$Co
zB*RHA8_;Cv;UyGDnc5*~lgnkcs*2Ye$ccU={|Mq%H4?d%)}9SOt{T*~?E}vu#X>4&
zQT<AP7}k`$Wf;nun9d8-H;2DL^Fri{)*I{U-RyU}A$U5gXuB*P2_I=6$&?C#{$@ya
z-p|M%w(N+Oiy=!lMh+WY;G7{pU!LgBDsT&T$Gqs8p>J|Oe{lr)9NcB-Au&zCW^azx
z7{b%TKioMsW!~B#Xzn+y|Jxpj_m1`+IF|3rwLz#);>*EGckR2!RyWfFBRJ-SXr2d;
zI1@v@5&M<<M-X>#B6m=u2g~z|f5S}Vv}3xE`B)xAh7`sTc7|A^C8vPg@DX=*#MHhD
z3;_4DiLr7zLrIF2IgllLB2$h!a}?QZxKU+Q^pxx#`u_7h;yq%_0eZV>O#(q!^aj5@
zY-`Z^_*>Qq(0BCZDf3C^kruQcJ!gAlYR}+cTY0l|t>{?Yr{FnLTU9}kNzq|Isq@FY
z$9+cBjwKv&KG+RQV&FoQ9eXHoK9#Exnzkj8kH{J7C!|v!TS_*<7bk>mQ8sr&=%vQ_
zOQ}6OcR}Bv&uu64CfSd88pwzrpENJQLQM|+x3OIfQF8pFAh{8Hh;j%g`3U?F81azo
zd69EGnft#^&%kd)k?-|Eu=%S$u-zgi`4t{eNa)W8Ssdb0{icfYUlEj&_(Ub{#aerN
zn}^P&XL9(+CHIFr8zKz5RZamhAFFXbkkxvVb*SAesom^xgLUJ4*6Oh6*NU81eb{~A
zpzWG}aTEB76{N2mLC@Xt{VdGwOsKs)2DiLyyzn1Lr>wh{B3GLX#;IrebX7@`mafG6
zUU-=>@Cy~sR`9i1-ZjyVSqORoWZ2LBnm?NUNS*5~4S|k^xvz!EuRSbk3Adx4olG&-
z<&dKg686f-o4VXK-NioXpM-d)=i8sSFs2vUpERzriUvTPSdI5DSulLlR?s?cBK}c+
ze=s&C@WSv-tJQS8sc`)nGE#2A&WA>wp=AUhV3(cRF}apNvZ$~^#RmJc+BZ^81;T0R
zH+trx#nVj2K>`Qnk4DeW7*(P-2KC7GVqx&BtUM4@HYsM2ZbfE+9P8-L(M`d+)Ruy0
z1Bz>_XSfam@_fm|0<4U!rkQfve5~pd-$t4k6#3ORQuvnkN3spw_SD;S+fDRT^c8EB
zxATds85KJg3)ae8%GnmB@f(NA!j}&@c%vl>Q;x#VSu2mBh=lN}Tz7s*6z`gOHgrsk
zW#<LWP6Z9KXNArRB~nOk@l_D&CYbU%E|e{p@?JL4X{(I7UP@J+81{_OaxhjfvyLT)
zXM5nzG2^0y6DO%@X3r_5sGE1K?$yG*H_HCu(0C9`Wp9vLudqHTdQ0&v7b+J6ZFw3y
z*}zQ{kKDBXX4Af|r`C8YCHa!2m9OqqHcM=6*A#|dj6`H-rEJkiN|-ZWLjx7=#>qKt
zt1?!iUcR}7p9EY9>f4Rc3M#XpJx2DrWHt}6ujJ#WpTR#phjR@+{o4EdX>uQtpysN%
zYkRrxS~x11eh8bcD}w+=iHqjgd{86kcct*vBB5o>vvLj_dq>M_jyUTXsz_rclyp_{
z&?axQJbK1)5bGJ1NMleWIP(}!qF1yaJhpXIIAt4^0!%8ks7X@5vZ;_2fmz*wSr3h<
zk3Nh|Qoca!A4TLam5t$E|6$CB%U6-a$vxIpx%~~Qr*XkcYC)1uE*Rb15HJBFe7e}(
zMDQbhn*j^W{A!j7KJeZt3U<t?b%=8^zZ>X355=%qb)TP|h-*1$IlN!8$U=&buyc>b
z?=J9qSjc#1{Gdn^A6qC2XReqaFFsBbmoZHcmsvIoXLiye$AnrSxlOhdvW^%nGq(*K
zx1z&0YDtg$Djp>e#zI+Kg4qzTAKki*^DfHmy?xq%eC>9o=j`~9(pj%?z0O34+)eo9
zL+-KmB0EnB2SsV{0Ow0#MkG7ktNG)%iyB{PtuqTS;MaH9nI2zFQC2LNTf)*Mmt#AA
z*JSPe_^Hm-14*sbL5=G$>Sy~Bv=FL}qlp{7tW5dFTzAT)i#P8tFSKyr{^LNuK*Cd`
z4dn?n$JQH{&o_;!X0-*)QRZdl*3TQa`$yxAIWh<FqVT%v-ao&BevXFbVIv|UUoe$A
zg19u;Lip><*G+mXFv~-uPsT=iDo(}=a5|{}r+5oRNqtR2d&!3N<z}MXmo@#(ynB0(
z>tz;IJZG@@gow%_i$_10Q~I+quLbk5*c`=)Sm3%H`y5u)Adr=gSm~7BdCg^kuKAaT
zSbcR*R#uTZWt>d4@_K^Z9}Ph-Pcx;-7A%2e`Ey*IuCxIKK~3$eg=b(w3V`!{e1n*^
zm8tA{aZ0b=%w+KxgQzw{(C0SXEV&vZ;>IDjktFyP)a@|ckWbtgbushHo;ofTo;U}L
z_Z2NX<uZSkirW(br~9uIxx#Uy#8RwJQ4a)wr}Qqe&b3qrsdXSihABRY)J!r!r$^Hz
zB)KY*wu%9_r|7}hb~OF%JI>1&)_Z&`UW9a-xZj<-NAi~6O9$iss0Lv5)@SVU#y6a*
zqv3(<#oWq~Gr)3j({)yHnQ!J2N`oo+_3UFd`!ei`ki(A%D#|Jdh{h|b)&`td*Z_ac
zA|W{?(uzh}9(Z?|_DjTHnohR!7zzT$?iA)cD%z4v8(W_2dwU&_H?&Wi-D;k6=UsxY
zvD3Oq&wZf{9j#1HMzFK?DQGgB(|S!s-m5wHI5`(uYATlX#OL0WgzBu_G|xlrhyXwu
z_Q)(NZ*%}IFiERenT_uEB7TahHBlpX%t!EIC69W^LaAk@@J+CM$<I&TB4*x6+r^Q^
zJ|uKD9Zj_hd$Fu+>2L4N{Tmwye^!HEcTMLKMuCMQDn<>P1N_AIvz0ys>67c*9zk7(
zOAng_K&zhv_Rr2k3VniV*X8`qIpe?i$achf1eQ9d#vbpm!dt1g(nq2f4w0-6-QcgT
zA}7PcfsatVS!EK&6^x6eiL}&lMs0#$wv36>dz`-PW(^uDr<yVdg~zE_MT);DU*IL(
z-KX4vI)y~P6W`3wc8EU8!m0R^pT}BSF*wVljP}r|xhPaG-KCawe3O-R{K#0iqM0)}
z`%!(BBDo!dnn?9PJK0qRZU?&EC})d@n3EBBYSzGtb7<T11U*FS*{V}jqmkQI&G(66
zpAHAQOZDk5vOuQ3UtxV8CPm-*B+R-yz1K}lAhlC`SUYFZEfEDjlph7By8tj4pDvu;
z-;GTBLVUnKe&HomI9ci*xgFWmr7T%3CgW#Mn%xWzQ`a9XbjfY)%d*zBPmG<S&j+d!
zsZ<ao<Yws5O4Q#zrD`lPXr-i@ce-+5B&i<$$^a8bwn&MKgTT7LL~jsxrb0oBPfq)s
zkbpE$uU`0-LNY=&c<>ZG-&E8!Hg9E4W9ePSS_o1(;Y>btKBwOssXqrYk>w}#upuRN
zF=j(Dbw@O)%X}BAJH9_B@kmOOykFq-A4t~b!PAp;I$RWpc986mbah%^UzYC*hIDuK
z)BE1;-t2PG<eIB&I9Wfvew*fJ{@94gKJgSPi>SGkr^w?}oER=<qjdUo=iBemZ)%RP
zJVB^(l0p!JKZUO;AshM_FSXO;Ig|&EJzyi#q%e?47p)|P;}wmQR2;x+_Hmo}wh$-S
z8IYhBrM-G`3LN;2#z~Tj^HcF#$1>}w?&Y65!RKp}t{ZBTK1qe#6_y+RvphRLfybn4
zvr7JJ0>+^25bmM^FeYfa(wVcha`?OO&kGgVnaq4w`eE)_S6)X%_aQM}y5l#gI90L+
z^i^)v1TBnyUO)4dRq~t$*kS^?b4T}feOA3IrcDfGY+0*$uniJANEK8PXy-FZ6J)L<
z=n!FTT@5Z=e!bJ{__6nO<@Yy0xggj`T~US4bo>#YOXnb0#g2xX8vBvN&!84;WLW{{
zhRuXde+lW{298FIIv9W!GJZr)$Jp6WUtClo_DOI+LzO@9yY1J52NKODyQQDQ54HMF
zhf8|9rJ?fAkCPf7gs$q#I8$(bubz(&<Eixli}MxBRq1O#>l_x=I0!f$zURFuna6hg
zbeWdC;BPA7oX$M40quhEehO;6xER%NZ*z)o<-zFwltBgy(LeW{i>V|^ZSl(P_4(Ef
zZ=J0P3%_}C|N6+)iZeI<z&rh54q#oPnw_0XF~2921>T-cAC`n$QzDINl<OzXpi%HL
z(rjhyR$?(giEiW0Je3tpMh>OYB4x`f#{DPsN8RwcSOe9XSOGvjSoGp2unOHosy_P@
zOU@}zRPBf^4MhnBeOM}CsROAVt2HnNuG)J|%hO|t>EnGlcGS<|spukX`t7(?u6K8H
zTc_D&Q$6G7V(uFOK9>nO3zL9?@nd1OAA*4|?d#stuRU)?PmhCL5_@mLfQ|h2g7G6<
z<LP?%C0ki_a|zE3^gOY~QOlX(qbB_3hy%^g9r#sxeCW|t8YlUem3sYRI|p<Mi+Rx3
zEon>iq6nK|DG?LbG{>_Mp+wTj=b;fHThly03cL{IBu@d65k{$6sIx#h6^H6Z#JM10
zuV18h5+@jicayU}$t-JIS38M?;fkA~p~LY*;#6m6m$0k>o&pOPieKiw3yi^5gZ;+r
zM;~IZemoY7VHx`omt=$zTIA}*Twy|#UxHo!y!2C%dEUJ8!4vfHYhhva#7=+O)+}cw
z&!N86HV)F#Ue)^R{4qsKxxO(zmJU^Gk~NA<`8Z>d&t|7Kq8(vg60W4Uij77HrsW1R
z=aQ|e_E&;oPXV>&z9!yqEj<J3*<<=dMIbjdZl?X|=iXUv$+)I_XD^-QtRX64k*|8+
zBuGC!o0I1Mtl<-gBewGp5U_fPZW#P7Ah0#NH7mn2mf~(u_4?<*<gJ^R2#4q!@E3P&
zX+;SM7;Vn!pCX|`iis%RdfBK#vG%5vJR5WAlCSZe*PbGc(9(Po##zzmCvhIbZB*rr
z_s8sOf%T&tQ}FIK^K1nUQu}ua?s6unPDRV2=oiduAvLmbWwTo^sWx62HMeDiL$Zn$
zGI=k{5n^98PKcD4BRbf<GSRnVW|CV3KC|Z)mQU8?DFGQMrJ>ap-8iMo91uLs+62^C
zn-<-|!Z{bmF||H_vOEgFK8-rk$0If?pG1~fI85HX8@U8De>Vf%z+s`ElqoJn%uu>U
z+Z>_O1-F!7hr5W4XYhL2X!zui=C|0lknXndW@462pVqc4Eyv!Dji{VDD)H&viG(m8
zM1=4tA?n?I_tD4e7f=IHz}z;g-IOhuRS=*~*z7pTD6(s666Imp?C$RL@t)q;u#9uv
zj9nNnM@C4Fla+8Am364y%w+<eYicyd?Gxp{xtY1s@?hJH2Rpb!)wquQz&9i!OXsaD
ztdQ^c%r>@R-nwY9c8pabo>Q?_NiP$6@f;ipi%z^7uS7_xdrgFPzYVt=&n4!uuoEmR
zz$!r-?C|`6*7bznXSPgDh%4pMBq>2E)Aq_o&JUD;gLU}fXzAF8MT|!l;<(=(d%0o*
z7u)e=_X-kT<GX28EPBo*5n7JNr(lP6vc5zZYTdJV7HKl?lkQl@NseHfT7}1!fM9Ab
z(+zA&{(U}j@0V!QnhvtQyC965<9MZ7)ULu@M^cqOp}y>Gu!sx7rzV>?E?ttR+kg=Z
z4^z2Va);NLIIc~&YaoHh7Z=C9&%}6aSbNnUu_G2pLhs$#-;1OFb#;`T^{=48|6Z~F
z$MWbuqBH*-my-TlTuRE!*4@n2%ESnC&eq7ng_H&4O%Qf5`Ac%Z#RWp$vw%SP|E!VV
zVdUXvX8*fJ0>rFm;{Y-2LCT1K@<_07fusW<&i#Mqk>KHAX5{=2eZc2`cme*B7BF%%
z|Hb}iVFB4FKv4})Z02vz{hum{zZP8oc?Fi0<=@r%Z+ZSvchbML&VPwa{c9WiKZ{F&
z%n_VyY#=)TNNE6yMe+QH3j$<6VBr9H8bA#ortu%niT@<}gX9E%@9F=R=+Daa&&$ku
zioMqT%z$4n^scrjgYsTT0lVmzMmFioD2}$2xcIBwQ)GUEr*3$sq~XJ$PuH=sZfbjM
zmtF|!CZV&5vTeZ}TEXDd3ROHoH=NyyXYQQwPUSV8I;>L>Lp^KQ{(isrQnNU@JKLFe
z;;(d^)A+wSdPw=0>ejM+agrD#)m#qfk9T^q{~eZ&=8>G8Bs%uRp)_p4kHA1jj9X*l
zwXME)7d?8=)KX*#flLh6Zu`M!IBrAmy%>MU=U2O{VrbPL@`~eBCfKpU4!(|(;3OOT
zMWw6X@DDx4Kg89J3GShs!v6J50cy&>x70u06aQVv;9p0@|1@CmA0zSq2pIfFPyLtS
z`cI00{|p$gvV+VVpb`7uxEVlh3NDb-ffVE^F*CA5@W@*9{_d?RzI0gr^X1pCjdd^1
zxoplzPPlATh#xa?!BEDU5E){Y7(HoudH$qrY@kg6I}b-cVq(VIddk>1;{$eReoL@f
zZwPH*VSy)eALg+NJ$LcAb%;8?ZgFjUbw3QBP_-U!>8O<+pSsC&2!RPvgYoz5Sp~@s
zGakJX`n!Vn@EoWva_KprC=>Ubfur6}qzl>zFCM&DgB>!0t#BMP4E9zQJDq?JAcOtf
z34}ho`F8Gos0a2U17@W5QYDMyPl5?%EJ|~B!`N+jw`pPz2}cBuD^UOE^=bUtYtRHN
zpdSojdzSO$^&9oal`U8UAy}xJYty8&{wHEsQa13Nq?o73)L-lS&|tnyVC_a*lrH8-
z9+sB}V5+eGslaLN7XNkm4+J4+a8i$}swcZHSs6XB4Novu=U&QGM)~3$Z7^1ZZ6?iy
zmYoG*fiGZB0$}g4U_Ai<OjptpctTQpb727~MOX;0FSt|h2QnyVC!b+Y6L~{T-uuG9
zq?Su1z(x$xRVK`?Jvog(rWx+Vz((-y241lb%1B5h&6(c0ZCtQZm^vRHD}hN{Z`Ynj
z=3t615~LeJdz`33*uL~h;Bg|Ad&K@W<+3HJ7(5XqTN%UQ3U5t@sK%&(<G!v1xhyhi
z81VB88^yVY?Cpye+*hP-3L!cv`t}h0a07c*->28x2mbpvj*pl-ta}8n!7$K|E)%}g
zcU@mxR&G?qsC5t3er+DKbLtrDihTCbSkvGoc4;~O^7c9P_s=z-U(~;ku3f)}d6GQX
z-E%<)29PwMuR^bmW{vU)w9DS`UhCsAJM?sd^TC{sFqzV~lvzL$yMy%{p+XT8q6R~7
zV}%Ogfs6pm_(Q@R3qnM40Y{F=?4pPhA>$zM3vXE_)ioTZ5IjJxRS;uH7|TWwzNC14
zIxv#;Y?A4H^Md#hNB;3b5Irlh@;4S3H%X1mGCb7It7~>3<dpO>4^1H15$|?wG}!8n
z?6Uafn@UV+Ke=VlY8@0%2)3!$xXhx`CP>_ob|OS}#~4n8Ckt8B5RM_pGY!$j5KR{%
zwU5#foFR0FDQXtXZU$M_ka!|cy!-OYNZu=WpyJpN(NNCo$w;yzJVPM#DK8>+=|Rvf
zA>xf8F;qS{P=wF5$G9zNv$?m}_B>UXAPc3GZLx(vNQ{?DZwslpJJ{3{E@!yg_rb3y
zY{%CVPXCYWu2vT&XgjVq?Zkyf?t7z?{>j5RLKo)w=|_%%(dG^8j=XQ68V;~8DRFJX
zr64vA@*BcIKjwP_#&p|*5yA&to923H&(`uq3&vgI5Isk1oimNxZfXz0xg_p5QvmN5
zWRoKl=9B{?gl!0V%W4i3{QxXistwvN0QyTFgW<K>o-ewL8>89qChY;t=?(#v?G8Ou
zgfP?!y+b}IE$qk<ti^RGLMsqjeb|?mLA{WM=djEuze%jgcE$Y{T*2(Q{p&FN<snhs
z{hwt|9=o4U{p}A!`HVi<$_cI_@EO8xK%fZ0Y%gK>5AU$J`+d<xTJHVqNX<W^(G9zG
z4sy<u^-KBl%enV^;FCg*B7&K6c|&f;wT?8K@;W72&k4iyRX1g^yO=-)0D_|(S@0yL
zKGnuAKR$p=2x+IGt@$B@RFFn^K8YJcdWhpk&TVOvckv4s`Is#|pFbX?;&!_WC4oV=
zJt%X3K1L5d&;*Q+Zx4vc>Lmdek6|4@svFrqdKrI5y8#aj5~4yG<t0RK5@%;RP1#+Q
zSn+={;~`Ccl@KKwwJa0BL(+?j3SCQ>op~Cyw3KJX&&ZAnHK#1hUovH10Og&Ml@Pr$
zWoKst<&lyQJ)kPg2ZGKdMTO#nO5_=}JUj)R1r_rZbRiO`2y0LgpnO!+h56E;8+^e-
z%1(|7JqF!i0CXW49?~MHhzw8?bVdzyQ3a?paXMb6cu_r5&4WSBq;FHh#+C>C3}d`Z
zeFaT7A`AuDF7>!`s{w;MQ|=7%7oA{{!r6A3fKz^wNT~xt2Kke$=)v;r#yXlK+rfgi
zM(D_bshc{Q(<l=snFBe7zHGKSnnQk^NJR@a?A|FVhHE~8dfb`s$k^YrEllFqd59vj
zrmQqgzi}GIFY;hT3LRiFyk;lXU%JWn^{s2ghLqkgFl=PIX}0lF8ymUG_lR6n4fd^S
z1%(v4@MGUkSu@zOG|C`P+C>4mI3#YSt)hSmc0YizwGluK4e=Xlg$Up>=nr-oS&Kl2
z&+N0HDW%hv$kK-62a>|p<pz?&25Hq%Tlb$)<Qlj0z;@S3Km$;>Auqlv-T5Plx|E-5
zKbp2Lqx?a^$C<9RWcNLknxKtE<7-!he0#&)7_^2nB2_%J%}5+awGDRFE(pcHNYUci
zYmHDDRuxm7)9};nE^x7+i?qeRg^{W{H33=;N=62($84k?;UI0<XW;4Ob$ecj75|!|
zkW7*lzk#}tOotVJE@3t<BPuk>l$`=}fEEuaeAH43)cxM9_`efoQ9*-;0uO1hCeW|p
zILDvxdE`@=JKx?6pF2;}I8~Utwez8!8uG8=k$f&Qp4(80FnyeT#a7ZV{XhFNm05(I
zA!GU7=sZo3dx|ScdWMzA<%`1YyarXoJsJnI$GT-xDUb~c_als2sYDH5)j<eVGyM|Q
z5jVYrRmIe}(h18op^;-?a3%6_N$fgAa2nSZ{*&OVE^o}<BBgT)2j%&MO^s}lyp4>|
z77R(0O${QIOlb(lH+g|pS{9009+8Rzc>>Af5_Y>dBVCt$xysuk5Qx95tSpB>uIIKy
ztg5-)x*r7M$9yK%LWDqMG|L@~WO{o#_;Bs}2%7#42R0D;wHEPfmZA<@*Ut*)jg^(O
zS&JB6lf56iSRiw0?iWi#X{BA--N0A>;hAjr|4rgY$JHbv-o}^1Y^HiFaI`xk?L?VI
zpo%cR^P0(kn?j%(%H5zsvo)Ixq;8FxM4)1P)EZA)WL;WLIP6toww~!RbmLAttU-Y7
z7-?6@?CTw<R@(&{7KAOHXk{}QbKO@sy3nv&8Zv7V9hM<bN!ir#vb;CMs4Z5j1;HdB
zWoYBo*s8!H1tV3c<JBy{AO(v_d-TF6vu4yGd@d($4+ylCtb?zq^IUogr&Y<UsB{*|
zH@^qat!l#8vy#=<2f8>-Il4IZ_t;h1AI%xL+YGq-KE7(PWuk9X0fiwooE9t9tEF(`
z2g-LV2Ff)~kpTFbn<==sH5Kw=eV`{;;<yDTh0j++fz@~egP+4c=kd5s)H<Rz&VPqA
z#7bQWD}hQ+E*BN4ko(crr3iQ6?4kiMN5RLHVaQ!G-GnuAm!}?pk<7qo!rHbS@4U*1
zc1W?<x^;6v3X4-+tUmHfb%R15w}6F3lDiZ?H82WfszTO)#n4qcIprbJoU+!zs;OwW
z3`JMMs*)ctFJ9LEWi+yL?08qT1Z9;SX_>Z`giEL&cNsjag>+oP2^|mPQp!=!cw`T+
zU<RRmP~=4kqoJ|e8Ms)fU0DVHTXVPkt4`j;Mx&7>^FcW)F2W>tY;bJ@Z7-Hutu^mQ
zpqQ`C)Kj?O33P8smLmC57HMNf|5v+7sp7gEZZ`#aIKjyyeQ%??X>AMqKV!urJS$=@
zZRSPlflPoHh0Bm#r$Th){2bJ3oub1wrCzE8$aM2?m4_l7!?Pl%$37?xO|8gU?o(~8
zOblyet=x~vB<DF7bOa3N?)uwcM`L;HtPf{vb(^f2^4{Z?3SSI<D@8Ja-doFVeuaoO
zDM)#^5Y~i7&YK8&0M(-ik1!&=&FZHjW70H#+TIdJoi?5gG`WEi_T4qq<)|*V`93$5
zX*=Tu`SCrFH<Zf`>kAS}E3vTSVlb4Poy<UAuUfyJXm#nI{y#bz)%YaHF$Rl2t<_W8
zz1_LX!Zhs4Ds`Ikeq!}<QjSzH-W+ARp#O2Ol0U2_GNp(i$#HzIxNIs>;)$Xyy@j_4
zRF`*<QLyyL5MGT$!W^=LOH5Yb8W<U~I^eXM1rMYz<#JONq1PGa;6gDbrUDNnsp~~s
zg~C&9#KD}I_><RA3B!5Az0zY(49Ukm@n^?SgZdEYG}Fr*8vq{q9aDFQH8y}?1ITje
zKg^Gyf0-fKJ6z*?nJ!5N=6ge9DxC6!G7@TgLlOts4iqHCxt{P7BHl}vGz0@M#|nMf
z%akMq0r=s9Nlo9Opix=<f|)VX1bb;wIsF1fxCdX+{$lBaN92#ZqRHf~yrRj2fcmi9
zNb($h{%~35#GwJGEGYe?xTeIR^Q&&mS@!Ql4}XB$WC%((7m5hQ!0mj1%;bd;O;Y-{
zFb{yEJIqMY-WLUndE%8gw4eC~HOe0W^b(A4!^aINk+I!N!`=T%kTqIUxGM)b9xw~s
zCWT?SabU(C%GmDXcCQY00=6m+)+{Po-S>FlI@}8(bu5WQuR>z1xREbpz~&=UWo-9o
zG0*bD-6>iS2TLnj_(CS`GThjtK_pH(7}CjcbO*p#GIs}Bo$?Zuq#N|EGEctZPX#ni
z*5;v2fuQ#o9h{<t-@&HLmhon6&%@H0`!`UW+yzj~GhXsT^mNGV&x5pPjL(BsXRLkU
zT?|{=QKrIHfvGbvE)%~T!JE>(@`)IkyMvJ}xw;2vLY|;?;fR1Zj%X7c-TvPl^V@NN
z{o=p_N0ttKh?|LNBXC_?UvR`-;~SSKpEQsTpl;?BfZb1i!=?$53ep3Z)vatm%I>nd
zpfCiDPblm<Yg+pvXw;n~JGMX3>OzBn|2>P2#ZU0MkQ(W^ea()^Pw)(3m6Nf%8jjH*
z1;B94a=-J9NgH@dCP{C!WA+o;1{7BsNiPD3+K;Q=hj1hM$k9;~m<(e3v%Ri?nEpn~
zI!4J);8mfSAfP|ehH)24Yp?YU<RglvT^Gs+yv@YJt~&_lk8<w+!Mq)`U3Zf0*zrVM
z6~Z_1ZI{vg7r|0S$8Kxgk~hwIK*!{!Bh%~B22!`l^2?6C3)cq9L&il9<R#w?kq7EI
z+jhWqzYkE}1MZybTW|lRe>);^0PLjRB@GD4AMAGelbD$0TOY}ek_$CI%n1nn@AMe-
zgv}4`$GjaX*k=M<zohn<@J7rDrk-de1@~j!4n#U#gI54S{#8zYqH(4<^yIF(VYp^E
z^q6~$c|-o(p}lcifgqT)_rT{&ukAO;8wXMR13m*!E*bdkx?ps6nasKPVW-nJ>yUCd
zI(EOWSa%^X)ty9MW<B9|4%9I9-vBG?i1gVF0w_8yyAb$xC~vSH={ve0)+f9BD(m`R
z={tvNHZL`9YA<;^y1;8eB>b-)n;YN`^(X6>q3w|FeFWy{?!B2ncMsSt_QX1ZEzZPC
z##8pzey_TDZ@jHAJ>d8y_$g~^f7oTs6RS7WMLJXO@MYH%x;F$#8dHBM2)~bh8h|p1
zvkM~Zd!v1^SZ3N$xe;F(uQBK&zJXqWHArLX@pTsf^P0rjp<l82f@0903cR^QI%R9^
z6<%@pf+FD9<4xQZ0ts}v<a%85Mn>)xb|LVF6##NR5_fU5_HFMv0M)qxVH4Gtkc6zc
zK_t6;H(HPI@Ah91C0Fi999O)tV;W9a9%sE_V*1f;@D9zEF<<+=VdNgeo^Ze}O)!Py
zp`#vkl)Pj51?5pSx%Ca(!Fu>mg)oJh`fdwoz%EbK4L6}sq4Yt_{2igZ27i(q94IZ!
zl^JV4T>e-;Z$Vsd{LmlF6zbqgeY4`7XF+5L<d7!4sNyi9=ukTWuwSv!V75s@X|zqW
zm@kpV;syW!>GL46dVBI8kGtaWknv-hIH++95rELIXaQ>P56l$7WQ_<T5y6o>@Szma
z=u9$%Ke7Vdz%}xVj8-_{C1sfKSt#HV7IhkCV!x3FFc>M9ql8lA`jZ7vgeQQMOepB3
zEVu=v(h(Ho#JyJ+y>Y_vcmO;hB~uvDBUsTCQ>{2qD#Z+sh0-cvz>xcl^;1T(<v<+G
z7%PEn3#dqJ0KkzBtRjLLvx=@N6TsSsYL*V0-uMX+-y26c@agb_7yzvb-NX*~Djb{*
zB^r+<o`eN%y2VHz5m-p$u4T>)2<vO>76c3)S8IYQtQu@&f;EE+z^YU~R2RObjVPmm
zpa~RJ!W2)S6tAbp259)<MxiDwpoA{KimJRAuBd{E51QTeg1Gw0n9040YHG<8(rTv>
zflUytHLSoB6wzk$GHp=7KD^1$QygHKM3T#O74`OX1qy#r@`bS6)E3#LQ`82_wVC;0
zg2>(;nAsic1~6Cf00io6%<M?RY8+^)voq{S-(}~sD#i>w+|Hl?61Lum>C$6Ad^wxm
zpa5Z?A%jBpghg*x*|p}yX2kU7Z8^o`IleBd?!jKRvk&dO8Ld=paU#NO1t1Y}Izo_k
z5z6ZZ5LK$L^}=vwg7EkmNJee8oWc1k?4t9yfbRACi=MhqfX%?&g)=~CAqk+vyp^7_
z1B!Fhu66Y^qF{xi-@F&j0~bJ_K87o!bh-pMOX1!j;_k7sU?#M}<%Crys>&ofb=M&Q
z#BSQR(pOlww%c;<@r+#Yq+#j|h{{w}^dFzqX<}XUz=sA=TDgMt??cs{Xu37nBRg`R
z$(J5Gj_t(x$cN3BTV>3jJFUbYkTUI<0_@RHXsfN{sZY+DKzW5=Q)7g^nVGd}A-Mrn
z_*I!0SwBUWIZ7FWRNxPP*4S`no?r41ji8`T%;E*<{1B&Gu?<~ZuUmn;=z%5<q6FxH
z5$7WI9KmpD9#L<cwz;Mn%_Bj(QVuigGG=btAA;*iY75hV95wITJ&r-cgNAM3op7QS
z%o}fpZMLDZ;G&aG?YfK|o9A<l07MC+u1x8)5Y3{%{@oVOj?d_Sh&*~P0vOZ-gi>&N
z_Qm7$mnM<yYsXKV+63_1n!RI(Pu#e(i8X50Lz)8T`}Bv>v5n&q<V&Yv4c|mFc8H)z
z*HPN5Ab8q+!4$xRVKli&9$)pl4IZBDcA7)pe7g;}0Nq^MC*s<@N8-Li=}QG@qM>MT
zbz9((10JxeahcFhRS@5wR>8UmM~uD!>`B*iv&|kGPj|jynwgndbZpcx_yugEL~+nC
zP#-vrKi&94!bcc?+0{S)_WBF`F&|<R>q!5a?_J-&_t!50Q%Bj()>dlX0lVO+zBn}P
zDd7ue1lq>~)EUHa+8B-T*b<D8?z$^&lX~rt5&rM7f;}X=Ja{8sj$koh!?J;Jg!u_0
zi^?Kq!sNcna&%HiRupHZwDAFoSGn^+EGD<HI=>5lbn(4ko!h^eopd<P_K9B|qJB%G
z|728iI!*woXL=bO!05}~&g&-7j{k5zU0O1a7=j}lRI$>ti;rgQ55Tbzub9|}GOi7w
zIs~f`sX`+dbdQH^fC{E0pL3l^BmPxNNlg8GuGHaGAWBN?5RSpb;o9B$1OI2Few)t=
zeQrrGPHFL%i?_OOS6l6^%G7wGuJ}B7*F5!T&CZD%WG;$~==R(T5YRB&?kRE-5g3Cm
zgNWiemHzma!R{jy5QOA9yqS_8={tI|8+u<RX4;)|$7hai)>{R0p4mBk&h<SJKT|-K
za6EJ+@+Nt9J@AoU4lg*+NXF$inBZGb&)vC0E}Xc{JamcOZvI-oI|o(%s_r^}P<&rB
zEIIkPlh{dN6$5h03RiE|L;9GjxpfMU`*Pv=`gmz2`eJA8oLbU~=nc|Q5%(t5k?4Q1
zcNf5QENg<G#mr0=Gcz+Y*g}h$r6b8=W+sclVrH_KnHeo+W=7As_q~3w-P1c8v9S{q
zdqbtFEEQ%}RmM5>E5BT0wG$X}Lc`D|=u7zO*CQalxsG-ziIx=F{+K{DJVTWY0al#`
zJ%aij67PZWfVLU0Dt@=+)H;bWIKU|IR045Ov%_;|h9pRVTE{PetX_(XBbso1Uc4?{
zGS<$HP@okSh9ACLmy{oxAQP8PM-sNq4iSK+(Wf#BDo;8u2D4B3B~{*y^b4HvAd0u^
z)Q|w3VysSOm-yG6YqxLG)bgXl?#Q1X-+P^ghgfcj9|LR9*{|Z0YQgeV(B6$|Qw>uJ
z^APCHf~vlKH{FqqcQi_Icgz2RecI1>dzxzI8s==&ZD#!F$<?}!LHEje!dp(Ta`dfk
zbP505Mg5t7vBa`LQPq|+LI6Ld7cS=;4I%3FcJo#r3rU!903tNRCn@kxp#h-WNP9;1
z!vpc%`e(!xdOPQ=$OCZK;jU1J)3rOP{ucV94q*?ba8go^1v(_MDee~eRgun`waGa(
z6b1UqrxIAAz1R(kwNAV)Ti<NPoztL=pj@_=$GJag@5~7q8!P&;s8^Bc=BN&Ml6oiw
zvAF5eLh!T$zXA^4mAHSSrjsZ_##U}3q;<v>i;U>)!SM%weenIgps{&Q{AO>5+h}8U
zBBw}_KYTJjIDa<ZQR>1P&%fy@<PaB9EvN|sagYJsA_T{m>lYP?2)Bnma`-soVp>|K
zxNQ(@Um06P?uyzv+dP&t4?s1sgWI<0nl&XfX!z1P-dBqk0_T~p-?Tcw+Xb(2?z(L)
zq}`UCyIQ?_^Db(f6*h5WvrNwfoM_hbi=R>~Q(s~PwPgY5qJ9qY8rR3OZ*YiPOi`S#
zeU5SAPT`@kMU#Qep%sB_MCdot2reI7II?nOa1JNu)BaH_s#R>G&Mo2KC{IicU<(L2
zgKMU4&Sc{kX_GQI+22ieYudPVXkP_H;}Bfp#&h5llDtcSS(4tJ)xpfXekRXzJ#E`v
zZ)>aMoFQ=t(@=dH4H%rx12nf+G<aDw3)3oEqm3NidOQI{X5JQ8T+uc!?PrtbH>=9+
zV|;7QUoqLLo)u{C7tYLiefVOJG}dol1@yV9+S_0K>9Sz6UTzqwy;(sE0j(|BubRuS
zye0|Dl#vtEj>bi3Y^rJ%)?Z-EbA!nEcU?1dD{gQ0y*PY1HwT%vC1RfNOoJ1tPm>-o
zsx&QCO9FOM%uemo2xxT=I+vLX(t6SJYkPq|i?x%rD<pn>p;6~GBnt#lR!EZSp|LWm
zF$`p6oRsV8187uUXyxL#l)RItpR;sCV476PKWPQ&8IpbC{LUd}VnY&Pht|JAZsEFx
zX@~-ts#y^+2r1=53&$aYlJdZb{<`BJnI84l(C-<I+Lj7nICC$hm<*!f4H73sA@M;a
zk7Q*hVE?vtr+f^oL?pJsUb-ua=D$=~y0%~4yJma_AKpKONprnN{6u4TD6u{N_WUKL
z{kPo-bw_f^x9Mw<(mgS*^*8F-&|{}gH1;boc1}Mh+JQ+p^XU4S5x(l`dro&6H}IW%
z;*~1bT%*e`=lORkRMxJKOqMU>MEYqnPeZPc$H1>oaTzVPYy1b+2od`zhL92rx+I(t
zauOnmE%+th0?E-(K)q9xP~5y!nM5B#Mz3R6UEVD1-mZ&V+?zJiJ$4qgXL{FRi2y0L
z?!>)s4BctEwXl-H73KTs+@p{pSYdmItVQsJj*v~s+C#Pn-`CpKd@iUaWw?=!5QDmM
z)h*CUi1U=h{KEibQO6f{;ip7Hp7dieX1bd{yeaWUVMz81YBB*Sj|Ves9{NT4)0!tu
z$Y@rAsjbLle6C<un7u9lQ4qLc^jbN^aFSDCzf$S*NJ&-LtwEo_q>|lXE7ej;=@#1N
z@2yf=#k`dSatKw_7PJL)%92Vj`h8|WOc+K&E9j4h*U;vSKKu8PEXufa(6&YFX~?;B
zbu8-{9-iwS%%q0!TbX~Ih=D>5t#M7eWH~les&RTrQVZvCP<^FI4jlqLW<_T8l&-;y
zky;+6)(jeomq|%80!Nb*2KJw4M3%rf7nQU<O}>^TCoN&8U}wxIrM3WAGLwNUD9WkL
z=`gSay<{q(E}_xXj-!7n6%Gnubi)6#su{k|_rpjRRNGcWq%r&Cr<V)k+)&F;@q-z$
zqwvHN0n<Wi3u;w(?4<id*7M~6D~DIuxq0*AxFUg<s__Xq2f3RXF>(x6#p7z!@NGKy
zWMo84KuGmCng}nyGvN%Q=kL`vvybDC`IJ%z;~jD?=d-twbIhr?>-fW9hKH`V<AD2(
zIX%tCH$f6Q4zac0R+q^eP4n8mZDtg*q>e+ny^+L$k%>c49!ApXem~fISaXQ^G<Zwv
zTgARo&Paw&W1`W-hwX{*O5<`+v(!(y1-g@*ZA?A&4L$|3PS%`wCnn98v0K9a8f0(z
zfF}Ro6kFL{7Ofyd%ePN)r&o^v3FFIgJsSH~HPbn-xNW1IVH+OJw?wQ{D_pW9sjAJ8
z8=*2*Y+3x6n0zcy7zJW^_}tGE>2_I#?tI{<X(EeG0}~Q6FTzBoDx9Uzp;Ske01SIx
zpC>tO2qxks(%Gnd;VRbS@exLeu~iwtB^Nd=;_##D#hTu_*7Wg1`x<yn)ul?WCf#ll
zN}DVDJ#rr|4V)*C5ID3T3$TjCW{Si{O_Jp$-iz>$SjgjKnLu8XlV$OTQLRW?x$F6T
zl_*Iv4gR`{V+`Rms6?DYu`w5DrMwyG(gWizb}ZybxRNni==#amuT2`|vlG#&K!eJ1
z9V(1G%i}Fya1%*}YQN+GYo$}8bTgb(bpFiD#n!gyCZ?cAV=PRbMg<m6RUpfcSe|^v
z(8|%v3czP7V<w%d1T7V+)=0cYhnr?~sv8o<krh+I^)Nak20Vvn#aiAi{EI#o2axPA
z@TXM5TNbu6r)?BL?1!ON&BJ<<RxcjbW8yIwsXpFq*){TR#6#+z3eGvC!)91IB%pV7
z^%zA<iLiEdqRDMz{0+GF>#|tDE}6uY4W;fblHE!>`DPPbWL`-c_aTf2JlpQi;~TI|
zwe(3bgW<ccgtaV#Q5lhONr@!Y1C?ofPaA&zu4TF>LlyKim@MCWpedcwDA<q{koJ+V
z>cl7#s3X3YKM7SmNm8GE(!6w5n;RC`vtj*FA$PkbFzi&ot1e<QjFG6T_5&8}i)Etj
z0#4i4i=apuu0FIJ0;wA3{8rUMOslq5)%`G845UHpo2ReQ7P8U06+30*ovFoMA+FB|
zmp9(+V{9AyZ0%#_<DlyF$@{Rg&_iJZaTQ+C3I!Ax&ZzR_LFLM@mKv~$)7uTnoGMuj
za&i=K^L>kwsz~75?et$jS3JjY`u2%XYajX-x%7BCEYVdk71T<|PxB=?(BFs9!8Yge
ze>Z>P__>Y8l1DLV0q$Kb7R1&onI<v{v)x#9(B5nejp&n}E{!y|S==e3OKZdP0hzMo
zxqFSBnr%S1XOGe7C;HJK15?9*&Bz|bkpx4!?-!w325eeT&drk%UdzDnm~FE6@fvOE
zFO-;Ug^vcU-_KqI%5PaJM0lH1PInqXx;T>FpNrk=fa?JO4&HZLI0DTG0^AS>H4m1d
zT%`055$8)d!2ma;zB@Nx>H||gK1^&8Hx(6bt-SW&2fL0oM~}HLq}y)dCQkczMVewM
z(py}lTBK+vR2i_kBGS-=S;QukX;M|B1WSx)TjFR~WBsxY>D*H7su(RGG$eg843?y0
z(wk78rOjFx{xU1QSf>HL@Y-0M3FwR1G{1f;UY2HVB%(;NYhxOquTs-*8_2|N%#HU_
zk)xr)d``nLg%ZluSmh1&X<X<-7JMkI*>4_v2Q(m1Tk-cKY`m`;Ur+{4*PjQSPQ(5n
zLzz^wwSBA<c(aZQGD>L)eHJrHc{VoFuy<!L8YJqKl^1D22XC|zR?`dC91{4-QsMWr
z23I_8B_!*d&X0!6U=%S`6#SskuZx_SU$|!kVtvk(@K+F~FvY8PluV>kz>Y&r6FRrV
zHn$m$Lw$6=qp7FjZPcC4_IAglsCkQ1ctY$@1{vxs+LDlrG3RVTX<la}l1ymUHyEvS
zIvBfHI$P>v4Au~CnMBp%EX9tr7s@0rzURXW*Dq|@KK?!uk_l9wQwj;CD;0hwKv;5T
zy`U2&6!(3$H{(ws-Ih@9QP^WJVC#x`c38lJXK9cNI$8LxE>Ttzlx6no%d;QJ54F_L
zUe4f$2IC!r7};ozyn#e8iM{|<Q8rf5SCb%C++1AX@O>uALb*XCP#MD_+PuIz?^Fj{
z<D$eR^L&e2#A&4)wWiVEMvhxVrKEhSs)f=ZZ_!Z(Ftvyt4($EcR1)`v{PpEI?sfKT
zj1zK(1SOm}5{V9;)NV$~1k-UNh6!rU+C!gC^IN4jRxu+(u9&C3nD5?MVx-UVYp^U_
z_(a{(n(VeMHEFeNjvEwhG6kjyUuuja^Zq4u9KniL?&_ro+c2R!!j?>~Z$QsAIvi%B
z#$1~&+1*8$b<mhl078s-E3~Ur=$;MAN*vcnF^UY8GEN0jBV-E1^BjBcLUILD?kBsQ
z<g&tmh=2#MDq{S)@=(5EIA~C*>(5!!H=wrQ$p~Acx8=91Hz|9!Wwr&jdFP_5n4Gy4
zet^DD;tMy>SHVBCD3wCZ(?TC{sCIf!hs{VqGpH2jw&<Cl5$iWTxjsuV*ITEVeY?<`
zb<JfWG_Q-jbo}uB;pXHd5zN$~P0h$y*Zb3_w1irR*h4@tdovrU5!kZQYrUDGoNCi|
z<%b-y&5P$4E(LOIm%)gob7ac8yZcG8l3v9b?@y!W%<!c}wW!U;o$W`;-!%5iJGg!3
zF@%D72m5V=E6@-LJa6Z{SaAmKHo~>yvTmg7ickLI7n_P@5j3E*Y-vZVkAn!5+Mtw*
z9$zzk#>3`1HRDDS#_G1@3*eNMOI62~vf^S1O={2?PddXoW7EvZY=TC`^j`X7=8xa1
zA-0cLM3$RT&#Tw@hlOZuK;sj&bUGp3ZiUBV#>a0HVG=)s1<uIeh(P75nrgaoZ;rOd
zrXqTyec}K_%jX18i6?_QhOd#|_PWL6D-DeK=}Ec~CeNb;<QCfE!$+h+CoHG_7@}P@
zk|5019LmnKG}2{IqIKIjjC_XcjJH2bxgotO4=4SM<w`g=ho;{UH(*_1p)Gt_+j*TV
zVL1}J*FX57UH{x<@Qw{g&wz|_O<?tq(!Qk1jvE`1xbz6RF!tT2L#YROy9bug_G3mr
zPCak)O#@dg11E|#1?_ctG%chdKT~u{HSrr}K}19pT^%k{^KAR{tGT4JFnGB1PV2b9
z5oNe@U9)^a0qSnrm|rqrj2n&=nn1~v=iIvajf`Fj&tcGJM(|yVPQW-9o~QroD3NP{
ztRB_v$lKDfZ3q03?OJKaQyYyDAq$PZogOklGnb10m9X2it1G&9Tc-f8I4!cf>Bsnd
zwGZU@4bk4iO;Q|qu*qT34o-Tc=(jp{{Bke+jPCKM)ytv+fo67T%kcU|8N+(EW3Q!_
z%@K6!JKo?3VTBx)X+ljrO;k<%II!S*t9MzZYgXv#F&7qKw}F1aM~HjcOz^v&X@%xW
z<;phgoDjzhND6q2C@9MpG6o<1-EZLj&(L6}6gB59-5xL!WIVl?tUD{t2ibO!Nxy&}
zHz{4l!4XaNIZNvDMO>gVDJHikznUl9G9G%Er#OY)3LJtKBW5mdo}2SE*w%ho)|=pP
z=xzb0=E^bbSfiMuOzRH5!DQXH+LKJ%L2_M{j17IRU1il?2gglWg3H-0PhCC7IyG6r
zvdd|N(nyx%NC{G1s{CQC&kMpq3N@K(H@$g0({>-b8!zqpn_*c-CNNk)V0HIJF2q_~
z&I27PDws4_J?c8K?sL~9=>k2mmD}4!0O{mxp=lwoSCu^bsuj^2K|<$6|H(y~zAWoE
ztHZm26v;_}{YC|*O_z}*YtCw~qk5a(rVSy$c-4F9eiM=%u9V>Y+DzlclCWX0dz_HM
zGBocVD#wBSJPe|I+04d*MRcQjetHDX3~ShQg*Q{VrawDFy_1n`T$W~!a+GFq%aeyj
zhxmI#YE_Pq3TUcEf{VRR1Ltz0lJ#ajOJI23sJMzGHAV~L?oNMzJi`~toW#<7&;>om
zuam=>;XIj5J@J8T-IJQYZxeo*P-zxO3d!6C8K51|x+&SgTAGQu_G0aEEgZpUc2y|b
zTMHyQ%Kf-m@=xW$<i+ZZHWSYZ=TiOB-mmvsP37hA`kKFI^S8@S&0(cHW3gfsJKTw#
zxfcWi_$nV2y?f_~>^y8SP;jgX_ddoo0<uj8pj6@aL`0jvS8Quxs4p-5T3X?O`~Ims
zQ(*Uf1$8?NOMRvS<-mWL9;+{r647;`^$2c>cgaj+_U9&rU!-Zh&UklA!14xWcOxU}
z%#o4Np;0_Ew$r4pzvxe$O7)hxr}#JVtX&&K9En1gJvYim7b?p*62E6#ECtXFQubAL
zq8e5kuRsmcs=`sfQbffGy4qoK-s|{S+%8{&@W)JoZL9ENaMWuR%bsu~5^p_G;73V)
z1Z-g*NkXr+gv0%HJ*TOnVj?Xc-Szcs-_)1POxdFb?B++iQT&&W`l)vQLw}xvBOFjx
z8~&3)-uh5J>N9X?lXy@T{TPl%56|Sv&Oya95ff2Q%5)3!wc%;{;@truvz-CY%8tq(
zkaTCd2Zw1E*N?UEnhnc+4XNg{a5J(ify0~<Mx3jbwKdVhiCM!nOm$B`fr(VzBf3Ym
z*XFsX_(Ac&-SlRpm=`c<E~2rd7d&q8nX_&w$-vL$C@0E1*60$a+=#a#8CrtUb!4$p
zgW`h?{gvxq_V&U^^Y~_&@|O8zFMD!C4O?&+bN0n@E9UJJag)t@zR5wlzGRyJ_DF<C
zh|Q{Zwmx5Q6_Wc3tqb%$ousd(UH8sp_S*7!)@s~6(M!vvAW%<@Cjz|~^<lM?g~ylS
z=uS5GsB}`q)n&Sp2otiB_2LEN#D7u8A-Siuf9{miV}hr+0j%(P#ktQ@T*hrC*iPeU
z;^jDkei@1?HyyON5yk=-G$-OxjXft=L7|)==Wtk?C)?;6I1%G2gISED-uuhblTDlY
z^cT<?%p|C}uy|v2Q&Yx7BrQvDJNhA{ic?ljj{rK<?PvME=`A^M{}@T1JSsRO_5apb
zKZ`4N6xHkD7TlozmC8YxUKNHzG{5^x={CE20l&&Yvt)~|9<9^&vlJROp>#~8m4U|4
z@sq@Q=U-6rwV6)eCLoFFMJ0{sX+IfXvyrl!CY(VbXGB9wVCWkSI9drr`3js9ic)z@
z-cL7h*wt7P%6;BtaQN{|e=Sd%E9DzX(~p(7njB1pLlXmcyF0ER*M3;oc_K;|GqDp!
z61$0JB!hsBft_@U*$jW>E>IwhRyaMqL%QMf=Jp!Jfjp7T3K-1O)@!+UMc#P0Nm<fO
z;NAb_gvZYN(}fi?%hKBF`M!J0vP;hzZQq}xtF_D%A#Ih}^1ASTP9+~q`O7l2o|_x|
z6N`O-mTmtkvG_h3_I7(8CO>aCO?n@trD%t0^}^CGm}TlQzdD3wM6%c6vc|hwkgw+O
zq#rhd{XZ(l-jH^yjebN+RNKl1o>>59p_&w&BkYFVK=WU05vEJ-j`F8%BkiZeox%!#
zy_s&*pmO%^o7(7$>*H$uYF2*Q3aotGcpc53`x>N@h5yU(hLF26PWx8)aS42SPHtk)
z<tow;CW^GO*8iuLg4QRku{t;E7*%m<TQWJA{Q!?DxlC0wT*A_5b_rh6F;Y6R&k)W8
zjHCgKcw+(Lb&`ss&RZu=EFcc(j9e*}C2KP%StdlhG{y|6m<}v-y&G+lcj$Gjr&SgA
zTDn?qqusjx_x@EN`bPM6`F?!Bpk$ODYN0Kr94&P*G@WeS`!lFLB>GxJ$XjY&g!8lY
zzVnS)ns#~R9H%uwqI?2;u_eUH=2Z=SBn9*_6@5n?!yp<=kTthJ1bN-A-wf2{F_OYv
zQAbVKM%y}^!r6&!_>ilF2kDE;QW)y-m1X2lO9dx~sj95=ip6?w?7^><lF5(zRW<b9
z&B6%SiO8SSRZN(9)t)Glu@b}&+_Y9K`B{W#AK*Fy7ayeTpBL=2V5^AQAM-}Cec$`N
zCm1vs(yvDQy2b?TT}<Y>UpWhWJboGzm1aBL@1NU7R>^z2Em2JDR>2FZ_{6-5l2&c9
zxy*cb`g-y4F4a1TiNwv}d#>PWlTLlrl-afQz!5ps1^M`$?&|jp%7cH#vat)(T+R23
zC7K?bbxN1LqK)V_khP8GnLttPLrL^Qsk}Bd@vMwADlVt`HQfWdL9z-|Hdi~Wn7$1b
zuA3<B#glyxnQOWMIB2*K^SNSsdf%8&EQTMMy~RpY1dVSz!Ou=`-~}d`5|HZxMe!I@
z!Ec!K>b}GWCh^Zu#oB7B#RU&7HbQ(3b5q)4V3M=5n5?Pxl(@K46NenlnPZG)oh^XV
z#XO<R*X7&09@Fw7B)(3K<)yaUs1Z-SBU{5ZYLJ`uD>Ms(?$?Yp`Jb(A<F*;gyj6Rw
zP6w>o#8F?_@_U@qeuveHDQ0fhEHH7v;P4yu8MF=n46MoWwGj$nUD%jsyK8Ki>GA0m
zLi%v%rwqTPwHc51;?x<2IftwYssXL+qKYlr_z9JH+cHKYVI!`(mytBK@oSr=>3$op
zg5S@OF@?_3x(%(oyalagJ1(qhZlxYD8<OQQF*}R=fU`>W;_HYSWcFn&eANo|l0?;V
z+Y_{;zPk{x1P=GQ&lPGGiF4ewS>-8iYdcQe=F2;K<B{1jDejv5yJ&ifuklj8Szht8
zBPnEyiUCbB38k{sLv&zQZa(^FK>VpIj%{rLZF4<^M<fji^;o=hFG_W1rc!&vUP$KM
zpI;n2w%88);gdc2X7Ry;OF=z_D%yiT!U#i7k!vt*8JP~8x>0d$L*j`BDg%cV*_g!0
zVhf*Q!M%F=v+i2gqa3quh77Z>{fH!Q&-g06^W)d?so615vzc}I-Dl0Oxb@0BIKjlD
zW+XJqd7~?=9;ofh#Fjyyzy)}Q%pLraI3mQ?BylhF+k5z$Ceyxu6@$9Xh@B8HpES0l
zjdb^-*h{EdzEVbDun05VE7TF)Q<e(D3Z)f|&i$EdBJKAQ;q|?G*W<=iN8X2#k(`L?
zXlP)M?U6n^o-4c7)hA`exYkvW&o3p`vxQ&BqEkno1T{RGk|jP~lU?!zU%@C}#)e&H
zaHfE<-rShCJUaqX(<>0tk-S5X^-Z$2c5@3<B7%lGP+}^L{y3u7<Pson%sL9i!HQsY
zM?)V-LocQnd9uCCPFXO%z#j0iwzC$Y69bWYi)m2W(=D7SNg2{B<~NWF#sb}%E?7J?
z#Id)G=k;7xfoB!7m!O07_*F0P!-0!1v6sPj&z$@$yVR7XC&6wOR0B<9A!X5vN;QW_
zLH#Qt90QR$)2*#8uV;U?W1}9&!H(3!1j2{qL4L+jeup_SpO4>%@l90G&944!V0EkQ
zL>eNK>jRR)YTDzIEHex?d@}>z?j0YE)(NGu{gLI}g;Ach$yrpeREUb1`OEf<0gO4c
zpc1v9q@21;d1oKXC){=JkzWOti{{!s<C(#HHnyv?l9Xc3r;u#yxNUuT@J2s&cJK+H
zKAt4MNn5@;);S-?0`5Y5ds?4ZRt<rD&Zorc>NecBsvLHReLbd#{p~Ruw(I%aQ+^?*
zaQP!+1+nz3KP@FH0`o=7Z<0vt(5zl~7$C$#`K*OitGg#5=)LifAYXOiMyb)nl~BH#
zG_v6RV`SlcWbfo*kkOb=c9mRyqB3wIF6f=uEJp7pPSAhM2CZferknL_>omKjUh%B1
z;m4(D%$DJR3-mDnJ;Jhp6PjzryXsYx>(Jm8K`JmH6xm47j18YVn8yQdPCsJMG*9wO
zlR<7r)~&(?Arh`8zu~vzQ6Up~oSDP?dVH8?iE}bmFXWaPH0ZsuKX<YP(V1Lf%;ocJ
z&?oZC!JnlaOY36wv2hkBee>6<_9veldHv_#9zR6YFGW2nq$l>EZ<4lx2tE_t?z3cV
zWJ`G^Sj}gve$B5^D~&iZJ49y9W#kBS<=BNSapT2f3AQx?N6{`bMCr_$f2A4eZ+n=_
zzA^{>y&JZ)jgDGf=Ns;}&$+^P)}UgQLS6X~7p~Rc#~*yxS>2PBGy-QtG06W^0Ts^8
zJ(J}gh&kRi%iBg-yMcDfU|Nz8o=~Xt>3zJ6-sClXe7iQ7nj~Hn1OAek{QFQu^7HJW
z4ZQg04(HSMw#Op*r_K|?Y-<O|v<@G+ksY?rB!=d5?eiP+O`%_^k+z{8Hj>dPnmS&_
z0Z|(TW{$pxbXs?mTn9h%xYFwhPpk?0x5d18SyjG5^Z9l!tC(ns=}^fL<hj+Tny0h`
zR<8MnNQjB^rm{F}X+6NN7-}J(V-FmoxrXWRrW!-q5+nmyMohHdze$JwXuz!3S}Rf^
zX_(f(sD3ct;qeL45Q;o}nu{mk_%!0cy*vWB0Jpm=5nP%-oGO2GKt8@Z*y?*miFSGH
zon~8y7`2Y$wz#GrAHH6*jH@AdK7jmN<mO?`(S4;*8^6j6ushi1>#c4@`D}zoL(WfP
zqP#kvANWLsC%F7{hre4nSJ1uBS|NmspEJmgWe9sj@q+Y2iFd<UIkaRx^8OQAJgZ`K
zqJvd|V6mi;Vsw9T?7nv!i)~}9`FP_`=WeQ6(LwLY54%K|fYGyJS$vy1>e9x$k1D>;
z9(C^GQub|0Uu!uRaVhWSE@q5>E!wUBn$cYxWr*bW_P(@#?uivTtTU>)<JN~IStg1M
z!qp#n_V=RYc|-b&R)tuN;KV#DIeH7z)JGh`Tq<C1NjNc<`99VcG~IGW-cIzEU}bAk
zY5T*r-nJ_m8h<Je5)!&j+5xF2L3BXzGa7jVgQpDVenExJWZyz-y3VI6)2dI5J^TFe
zPV4gDQ=LqoDPy;>PMbq=sQfUM0@+G<3Om_QnVS0VQ+A=`I87D1PTN$R9++b{d8aJ*
zQFk2BddMyd_r)TW4p}WV>0o*sYmAx=Z1&&l(PDLl@>v_svnYP_VKJ6PFlo8p=V@fU
zh}jqqeZtP-u)5njsKdWVP37jovSlI?*b!ptJSW*p9to4lg>Aori|pthT#hqb1Lb14
zPQc`ySsE2rhY5o#t}!Y5Y>%5yW)V}79b7U_tp&WPLCJ<;m~-0qSZ?>~$I<z?Klewe
z%DhM~Uuz<Ha!m`2D*SMvm41N2wv59kPoWG~?^M5>X^Nd~8hYKgU6CYVl_eUOWy8WB
zkm>)#$V69dP>k?OIxVqZt>?U;{yFi*Kyo!mrX^+F<2+$)-Sr|Z&f{@%BajXYvkL#}
z%vN~I3iuBUkU}^*0DAQ^!_1%aV)GuQdf&tKtKw5ePfdJ++qE{Boaz|7Ki^m!6qszX
zj0Gkq#d#n1sc)JoYIG)BdRQ30u<viDra;2we)ye+ManXEl`jwY)9psJ0KAe>gm=-+
zwh8c&PK~IVbXeg}uIN8?*M9?Hlcj&!J-{P~IGHwKIj{U!Q{g@ScG4>$AfP@!)jcg8
ztYQ{4CK19Pn0bBS{%B^qj_2iLw!`$cwNW2CUY;8o)8Ran+EUH0kS(THmj>OU^!ynm
zm&zNizvoLHEa|{+9zVxswl$k`d{bE8->A>c+P|AKD0HPVxepC9*J#!s_KIp_;L?Vl
zs>Q2Jx6KeZ<kn1R<pmuI<c0}OwIw01t#UN#RUZJe64W1ev1mSFOH7N`A`_I0&ZeJN
zQ<t&)^rhKV3XFJbJK{{Iu^*zi6ABwWcioDZI<E@G8$YMh`X=nfDbM!BUOLa%`}@uD
zQ+ti11Vr-(v`vHKR=RJ|RG7q|mRKH&pRl@W)sdDaqPyi?r&EsR5&vRWL!nUXHNop6
zDMaGyGvp$rjK;TSik?)*OUsycR?OZuWr_LixONBVV#n(t1ACP96RIds0KN_&5O-nc
zN#<GP+i-#*R>W!;DF)@yB__e&wpsE6ATr4iRF|2+0_5BtB8k(GuQ00Ao~%t}lPG*z
zG^^qhZj|bX?TZTJDC%Te$w}o*a4AUdRjhC^_$g^Mhtly23%`SW%dKD}pA~I{!`Ft)
zTn@dj0WtJ4^xBq@0zOIYF~fLKktP`ZF6y`6X3JV|Nl{7UrBf4IWN;l)u5AlT&r3}#
zPc*81WNu_-W@3G>ryo5dpRYTNkDZ=Eb&$K?hmoNW?S6?v6^*pP59n9)c}AAu-nLQ=
zj_27>(W;3n?3k$Rip24VVxsJgz{wA4%119&F)Tn#Fe+jl?R|{_F$Yg7lQpYdtp4h<
z+jEk&E}&REmnQhbFH}}0Ra1^QlkZ;TWSMGja9*Gd8TECwly1a$uV^0g4x_Bljtt(z
z_vjsFDK35Fd>1+p9XWAzLO^NTW{&l&&e{w75D=C=yz&F7&8*&h569QiTQufACAH!X
z+w`*QLBaJog|N1$-h_2cCc+;u!0(SIY5_@-X_JV95wdE1e#F08MnNjmZd^B4qfoU7
zGi3du`*80f`%6MJ@|@#A64<YOsV+zxItib|#CHR-PdJn>7w7c$u`3_VEIZ>pRG$tM
z>ivl$wjEEm5-5K4^k)6md09TPI7z@B#w9-tR=}?CI{Qwe5UVfN#ruKA1@}{5#fs8f
z<q0Cfz^Fp=fD$t-;pVpfN5Wg9%u2A2Qf+8JF*%n;{JyACU|UV@@b<xr;<#%p@Zxp(
zSck{{TCa!Kz0K0?Sj`uM33<^0){SGK+cwh=Deircda+ZdhFxbU9a+k0DM-FvQ~gZ`
zI{epjp%-p9+br1=x||`>=7na0UUP0}6{{DijQTunC(CJLmu<DyXV&H$uDT{__sibs
zj~k9R?NkGb6SqoVPsk_FWH>W0vKkVpx}m9L7^&44+Cjl}3P5!b?P|=bvia{-+B{rH
z%p6V}GTYh+d>udc8(r>;v0%gsE!7{K-Fiw?4*}(i87*<VdYcP#V?v*sm{7qVZr7Pj
zlo#&&9Jk3G=#SBrdYCO2ooxE}tIoULV^jR<9IvwOt;VnY^VsP29ynXRperkK#Q(W@
zI6Eu*f7L$xpKbsglcc@fx4&85vj1mV-mHJLIRCdM=zrke|H+B?TTcI(bD)^;N7?+F
znDAef!2dQgfsI(3jhTg!l@mx*08jM)VtI4@i{;Ht%=$mmx`7)4@$7#<-v3Pfo#6fl
z;|+wmS=fNA1<N11V&h;0w%Gsku$)|+|2Ty|_r(QV_NQy{#~ddcHzUiRbDUgkjNHJ@
z+5U~~W+wh8e!;=b%*esX$^M6D!NJYN$j%J3AO3cJK#7A5c;Npp$!_2|FtanV@%)iX
zRvvan9#$4^ZengWpb5hDXD-+|8QHiwxmbav!O6(U%EHX^XU<qyxp`RrCB??g&B)31
z$F}Ui{c-)lf)KOua5A!Uv$Js%1L=^z?}Z&miEy!V0{6nj&d$if&ddocDQ0Fy9xhG}
zPU3%1-N5o-<KzOCDc2u2@qZ-$OTe4;Uzq;?j#gmf;QUuuLHGMuM4&K=#N#_=hdfqK
z;{v~MkT_X$D)jCic$7M8@3QQw*4`!bX*z^iE?~6PbiM3mmXuEZwBXV5wUwNTsnU`@
z`h8-NeCnHR^wm$BU%w{$FI&r@whJZHH>9L=4H-MajA=TUS{w80U0as9fSvC4zSbbF
zEb8p<BqqykCp8&96~;s*$dZTK9Fex)RpM=w#}o|Jsm;VWRJK(sT0W0Hbt02<)W_PL
zbmlsgSk)!9d=E?dOdIczb?8ny%>KLc71ZQV?){6FA~G5-U7=bphCh2kml+(`G*SbU
zX^ucb2xE}qr3n5s>Nf*8Wnh==#E|EyqKKnuq(_|7m6+7V+D^Y$Lo-rd!Ha3;7qpv4
z)81CBA{v#IU$5dxn%$3@_fZsHVp#xJVO#w8Fr-n`2=M`3)!q=>Wa)vSD<EI9)Y*T`
zI{m(%_{th{8SN@)+s1LnKaxvCxp4OenoQFg@Sm&U|GF0b@05=JswVnhb~^s-+yJPm
zsM@R9SsL4$m;&p%Kl?2Z6#V1d{-_$+S^vcv{|~3*FWCDp*!wTo`!Cr0FWCDp*!wTo
z`!Cr0FWCDp*!wTo`!Cr0FWCDp*!wTo`!Cr0FWCDp*!wTo`!Cr0|8>~=U%I0FCu021
zP|d#vspS4og}wiL;ref3s{aYy{6|3UpLqwqy8W|HMmQ!>LnqTemJu`k=Q8-;7Nq)r
z2z#^r5j6UHXzss@S+M^99`*)?;r>xl|9mF?yO6<uzAOHh0|tMZ^Zy<&`14Br>+Q<+
zFAn{G1PoYNIhp_OU~hId4%UB-KP`Cv0ed%I{T=p}YpoY<oimGv5~B(NA!R2g@lOQ-
zRe=73_TGYn3*f6_j`F)a4rALbVPo84HAcsUi6Nz(jp}XoYo^PGDQO6dq5Iys$>-cg
zQgYehe);O{>$P4`_OemtRHpc&a+1am#7_~#&2MCGlx~pW<Qc{94y=2{e2H^_QL7~t
z8qfhxe3s!kbN0NJUz`al><rTEd9e=<z9hZ71R5p=dh~XC;Hul;`S@-RvRn)TL)U7i
z&q?H!1A>BYbliFsaeHyyBn1+n4H~lf%lkq?j&SAWfd=HG7zCrU&FP`VUjAcO3&ey5
z1mW`HBJ;dmogYfr478hO9h*Vtrs5zAv|9*D*sk^JdrN(`kCQnQh&KXAqb|GWh?gDT
zI~@oOh+p?WJ=4i}OF=JW_XIR?{(-*ZO7AzkDsbZb>-RS~zQb%@@+5HLP3Z35s36>N
z{sBn+?Ec^d6E+rLuy`T{Q)Al|zcr6hjXL)Iyk~`o$FrYNK#m9Rq(Pq1og!Mq^@fNa
zevg|eLHMP*Zb6<;&ghGEj_bWSJQV3vWP5(hq>R&eL+?A!GJy&UAo&BjsG9si>aOr}
z(fly9Ib4Z!q;y#e(}z{wt`_+fz0!*y!BB#Qg|U$e%(oF_SU~{xU0T|7O`yn4BtMA#
z)<8kIF==z~Bztg~35&YFS%kU+Aax*@Aim9+2#gXV^sxz~8{#$e*)$Wc_Prem{k{my
zo<2AfG!=S150ctK<rZ}ufnm+4DA1V0ZV6vZnc6q6xvXAs)qbEm`*^N?s%X$e+R_N8
zZTfxoXt-~9PjT*{{qtOIh<Hd~68etqzUi(hsy^yR71z3k+n~Esd-cKm9>LATBj20r
z{s-w}eS4BS-L2rrE4eQih%_@e%{UzhfKlg%CHhrgOByF6bmk9BCuJ}(Hrq~pBG4OR
zsyQqYXpo}5!f7Ckh&mo@cN7#n4KcT6a})$L3{#;~x(87FXt@zXdX+W76qu0@dJ6%t
zI#4Oy?lmZ2Lg4w3yt(jLJ;BWQjPGfWpdtH)Fv5_5e3=5zG<$f>5RAdk6`6?eY_~j!
zV9ZF2LGUCX49v)_Irvz;re_*dI)ev3Jl}d-0C-<i<m#h@58s!fL}R<_pF(Xr!Kw<R
zwqoyK*5qQl6+6MQ4(NzSHM)^H!4xlrVygX)pO%m(Cw(rf-dG5IaMzxhuFkJx<B)-5
zcQ3}r4f<|#lL6ds;^q%E9IxQ#PvxOK7(S@<yPf_HZ=@D`yUZ~@h`VltMOWuFQJmcv
zi%R~c->`sGH^|r(&*tz8Qy+^CD3Iy~-EHmxQr)4}%~Rc!UXY4e0nx8$Hn@0+Cf3^^
zel@s`!4q5CV?e5#5P}(bm&giz+uiRDNOeQ_)!_e~>K4kK>AG71Z8N}LgT*%xI~c)Q
z2IbpQZ$|dX$gRAGNOb|Bv|Z{(1kkO)K7O+Qjiq-Aq`E2k!n65>A9^89r~*fvKunmt
zpt9pNMx6hkx_M_6p!#ILO8jcB4G@OvgKADipgN5EVM6trQU?J$q2mg#A)$KMKvPto
zq{(5a=W{CtqnVR8^E-5j-vr?Fw*aci)8zx%YtMT(^2N~agsI>8?_p(g+3s=TMC|S8
zghv#OSrNUPk7)J{#Wh#oO~~CGSkc<4abfjRqac{1B?Atr$a>sIq-*$aVO=Q5dTzhR
z8<?}A@pIwAPAW(SIDL=bIx`_(j*o&^O^Dy(8Ifkrih?i)u9!9=4Ul9-vyqbws0FT&
z9tAO_C>ij_l4IbKufQcTk^x_U+a#KhbMxTBasrQ21U$SMaEZKRKmu^b{lM+wq99Iz
zD+QU5Yo<g&SSQ3AFqK}kh$B6G-xk0&R$FjFRqyj)>@TZ31goI+m>i;=WkW8{6<F6y
zdi-YS{B_D*6Y==C-wH6*q8aRYV8l^kj-+1vFg{pTQ4C%_o8?j=>oM6=)=U+%KqF9J
z19v~(UshrcrQVapSpg=%QUT}rwH9yLiBlciW3sm_$DCLFSzxYa^whG4w#l4U{UeJ;
z^Vx&aIB5>3sWcVC(kV@)X|{Oc)jHnG_l_Q=g(Ypw`6bmC6VgddK~$UxIBTxtnN<>G
zF5%Hc{gi~8vWv!0v<=5lEQ!WgT#$sL;*x^PNGA*S=MY;GUy|4AL)KNyZ2G>yweC5$
z%O&76H^v29-gbHJ)1Gmf%H>O_E09o;C2{~<<IBa5o2NwcqIP}>O@aH3(paT^^`^De
z8#j2ahm#SFIT{UT9gg3$c0O!rUFitA>$M&qR!Hioni6^C2i18sR!3z=Wi;iy>J$1D
zC%5^xmP4Ym4!CLhayb<UAUYugl`b*w+DHx`xmU>Z*-;PzBhu5rD}D}~Bu7E~G$Ajc
zBom>)g&iG{R+g0vFk(f+_#RITT(QN3Tsk417<i>;%D06yowN0kI#1&RJwG{KIkyq4
z87Bm`aqv8)(?aX3?QPN35qN2R5A;Rf-(nO&y4c&_lFKCUiXZI(Qr*qqdj`WQ8YboN
zWzL{2Rmv6k!%K)c&XCF}RImF4D`agZx-P?<T1lo_iSB8m#9R-uW^%@&S*&c0S#fH%
zuo`6SibP$wFf8_ZxF7mHjQC1W?36df18A;D7S{5r@{tq<-7f?<n~ONos`Bs@7n!_d
z$vC_@4Du%j3iwKR#r=z8%$=2H$!dp3w?h@xRaF_-(%pBOq`zj=+kB|UeZjnA*PcI~
zQ);JrgHzt0Zo7V5{obl)MgW=Fp2H7JpyZraDk-nT6=LLd8OP06BI0lqzrQNGnF~Q+
zq@xj}P*pv8#A%(YDvh8I2b)p>3p^D?=LHM@9s{9|W@UjB&?Qz69{zpho$wnu7%&A(
z^(X_utJ%~&B9IT9z4e)Av$~HWyp*}?w!i^`dpV34(r0CekRBsZrM1e$wRN2HSkeWW
zZQ(zk(H{Er@U7sXLJ^Q4PTtmk`a>MU%u`V6Y;@#R<+}_U)aiY(7UlSH64z6sw_qj8
z@hh$;jv9VKUukp@WiiLpIe+m>+<6#h59ZQ@AQy|NRYeu25RQ%UR8B~bY#0Y@cn{oo
zA5R|>_$jo#u7h<ok`r%lqm$U-WEQ3zpnf$3L9b__QnQxcFbKUk#0tGwuVqun1fXkf
z1SkQv)<s%C!d+W-Bmk9x8StR4*|C<6i%~wg8c{Mc&k7rOS@KiR*>PZ{7(TPXNBgWG
z+J6rj$ep79AZa)m*VEHKTgr0k3UaXbDBQrmmYnnH$;|p8`jOtNp8fUU=_*DUrKzln
z?Dq1;&e!NTvpcQ_wlnCRPVs8MIk#0ffbKYztqK2h<p-VU&!1T9%A{7{&f!OA<6ln~
zkr}Gt7bY%%=i)9MQd%qSZsF65j%V*|k%<StML3>;Wh}<phnAHN@ojt}N;Yw6VW%C;
znU2@05|*@LdVblgg#EFS2y56k4=qFlf08Wz3%VSD!kNzKFe`=nY*>g3^@y7ZWek}z
z&lZ-ojRE7-rcW2{7$|P<LtoD&;|^diy_dK)vQ_EOCWEu2PyO7sqj=is4ua4pz!Tyn
z!90bXc?sv^_4!6Dc|)?w;Be9@k8JY;B9uuHFu;NM6w#N<f%x3hm~;QkRFs&VmY|#&
z_u4ay-W$%N<@PaGs@35jS`2l<YyGNlMV=#S7JzFZB%~D4FiflnGr($RF7|+_K_GoK
z;240l#9kxS9Qh#(Rs>;`JE^Q)!WS2&7{2{0ZqddUzc?7LcrvVZeR6mYj%S|R7E%x~
zx`t51V4xpDKAIvgw>tv0%5ZTGHW&62ow_^>BxS{sCQI9r4lfnPv>4qY7iU$f{*u3i
zF|Y`hylzsS!(p2mDehwISmCxqDYM#0*%>%_vsv~NcYD)wIOdGgV55hbsXc46dY|q|
z>by=~sI>%bC2i`FP&5Sv7R6vIkAcrJXOMd;1dLBN)aD4~a89~+j-MGJcv2GH^0=`9
zc-u4ha*rV)I5gdloQxr1=)N~l1m^MlEwGel@a7)d4-mquRH+_#y<6(NnptR`1C^`5
zDSo(?IBOqd_c(JO<Y#3AA7n`8?l(fHZjf6(92oG4%N!KAiA&}>BOhoHnDk9iREP<C
zVhD+YCIDQ}xP2~;B1@M)8Z}E-$Y<clpOqS@Tz|=(f5U_7DLq(12@yHaV8-bMjvzu(
z^?NKU=tJkmeRtf~-l)WhjXuz6b9&#XR7HcIDG&l>Z{bS<3=dM63ChNqa`8ek^m}1&
z><Inim2C<ARg`UgK#TjRZ{cwei!*-vv1#%^O)|%JYvLGxfajrb{07}M$b9CBGB-tx
z;t~q|s=g=^ofZJg+#@d{K!=~RA>Sjet{4Dy%go+Oe#^#<PMH>(3yU|=H;oW|V9ty?
z$u1O3!@Tl_P}Hk>%Vyz^b&H-lIC=~ex*;Y5EDwqSoSCLRV3mMIcNn7zn?UtjlyQT7
zc?&k=Uiwr^!XR$CDSxd45esuu=>7?CX8d2k5j5|3tRdq#3vzc0^Uxa(uVGaS(PW^a
zlhC&w_k*EnMBRfSoI+-yfZN>FHyB1g_X8;aNv8cpXyg{ytyptvQc8F5K`1j3Bd1UR
zB%t=0WKeLttIxEi`;Cu2NN%F5kF<IGjZX&&e!{y3hmq^C2d#PS4W!C%-~bvxL026>
zH;%kz)jaD(ROMd|#IwIP1C{Nn!19SlLmD09PUxk+p9h`*a60>-Lf{mgo?|mOV;kyL
zw;9robu-u$Q2$IwA8LBQcLlFr<+l%<$~^@?bFPh!Ce`$M;j8yBO*9#DtXXwJHuccn
z+CFh<ns!3|Mk=3Z+WLd(M!)d$W!ntWuf0)hUiU&@?EZ9s55T7LMYJC8xWd;o?gZ@$
z*3a<VwtI?h!S)#%_1v;^Vp@ZD&8Y741~T2wPXcSkok+fZp5yBPp*8CZf9NeiCuDw@
zF0RLJF+f)f{$icuCw_~IkkD-sCoX<4>xrc;6}M$COv1oWU^4b9>>2M3mXJk1cxapD
zR!zD)dtAd%fX;Kv;TF>^APL`~<C*m>EeSt&$P1UV2mN4d8eS>YH*lh+XAM%RSMt{W
z3j2uTH<VJ388FGtZ+Q{KaE0xJ%@3}W)@DG*Z+j77ZW#HD#y>QAxQ**XWn;V#e^v2}
zW)pfiflUHCmBG}5v~1Q1<7>JfS+foVx*_<+yLuJXF9N#KeS^DdZ%o}r)<CPfH^)C+
z(bDM$rc8XQ!PnzVsDajFY3e(@ibxCUxJpk8;xcGz`Lq$VegJ=kb;hFa*JKzAocHG%
z$KKL)n_Gjr?9o2pbR*i})b~T)vUS2g3v?Yn+`a_b-TYp|qp@4yx9-bRqp^nB&jbX1
zvEzqZ#B|6#KDRti5Dytsy~S6x&-7kU(BqW=9HjIqQ8=Wusoq1tuou(^Xm<KkH!8P{
zT`&`|DR8vy<OKhQ{$Xh6U%eI90@)ctcEEOp=w&E~xY;W-QM}Ek?t`qKrqrjR{sFR?
zs?@{sH0cHRqL~(QIZ@mlbUD!l;)k3M6G1P`iG@r64L0NuKn#4e>o*MMXjzF=FhHJs
zl>W(cvm#-;>7kgYfFN-zzwU0i14Tqn0_bc|riUStaF75uG$a)iTs-(tYF2{p#30E0
z7InZs#UHu@J!($<5V1EFB$*FXBve4qa3m=-X;Li%F{u^?E>eb($csHd`W^5$mpk+y
zF1Ibv<u(B<a~wk;iGVz)e@6ks5`}tG0!TY{1^)}kP4G96`%}+#_4W}oDu%=dERxoD
zQ<3kuNLtCJ1&IYRXnoraV^qzO7@(!$KTxX1VJLp%gqD#a6>jzlOA_SK-x52y5HPY5
z)CGNmc-QaCy&KA<k*-MqP}k*!)sgy*ubN7zphOs@n1=KLsHwKQn<Db4qbL!e!54)j
z%UKBCv#6y7B~URXKqLTL0GVWrfhtXIop%RmG-8drK9Y9=qzt&6%qTH6RkhEmA!2H3
zYTwD#YU$uEFq@t4As*$>YMRQ*SX<c$5K<SBLno?8dR|bGM~X|om%-&kw3b<=laH0{
zs4@@`?)pacO#+r*cBk2c%B@IC@^UTlZjy_5)RMNZPJY1>)FCWtD;R$>$Diz8ec1&p
zD-Pz8JlmvKSdv=gRatUo<PE16S<~Kt?=?4|qfw3-B$%$4)ssNb?;$*Wa1$uv`<Y!z
z@z<=dXDBS%g!KjYVM^3mh7_?72sWMT_sk%Zay!2&0k21!ZtV(1jf`E}gqa2~uehA>
zp__Bap?M&l)=jIp>$qQ73}T3OYwkUbpxf462tuJl|EX$EIb_BesX^}XhxYlS)F`uU
z{dfo9FjD#H0+0MpPTMIHsrbtrd-3{i4cSx=NY`x;hBaPIlOk1bzv!6XB{b?9;iqoH
zJ8c|p=g=x^MO~=koh4`8B^%E5_}y>BLc+xQLL`Qq_&A&y6U+!fe!+--pr_g9H+#(>
znHN6r;C+Q{2pM+NIdsn<+m0(|E@F?Tycd`dx6!_kQbJ){5(F<wfWN!hu77v4oe<%r
z9CBZSf_MnFT(}ABn(#>swuk*5ANsbZ?!lU01RMfaPj5U3>|&wpDyMg^Jw7QG52<ar
zZ0q&p#63co^Ztn2{l@F$=*S!!5sa=Wi~05r*u#DT;eXHC6ONfWy*<{;Mr?14n>xHb
z4%xoN^5|&R0DKL<gfPd0dP3~GdVPlhg(m|StR{*94R#0Nd49)&`ry~stJ)s>891f#
zJtHIK(6P<YTSAa%7S*r!vm;Vdq7XE9Tn>3U+1kW=OqVtok!n60$-08i&?cht#!?FD
z{`qxhr>aTGDh%F$2w8JtU}qu5>=hAl4s!BmeiosOEX678ENDcl{6HxS@e*iOQ5%#}
z)>!ng4p5_MM4g|SOpOt`q{t?yFp=Uqhs(7z0t<w(=-!t{9i_v{VMD9C{c?!whYYzP
z7kP*Fn;$#SmfO#k$H=c6$J))l8?q<l#^H*6RK|jQymcZmBkQctYNXqe!r;mVPqyZx
zCW+iKnIu_EH#!{iVszg`T(GuK9Ps`oS64qYw^=pkI;rt6iWN`UZGKq11m4}bzaCdM
zq#|T4E<Sp^NWZLfGWm5UT`@K#O+g}>N!s3FDYi;LD1y>Hq)X)$yR{qTYZ^574}Pxw
zszYywmXHTRN>$cG-OB(-a7=Jxi&7~3>>*1OEsh*&T{N`l#8r5MzE;&Z^J0-{U_uS+
z5hytfqYfD@%bU_a_gF12By3h$FjXmEO<_wXL-%<<_E=vfhFET2f@4y#0RJ4SgzF^d
za#QlI!+Z5!H$L}bc3Z7aR<0}rvASaT+N0k)DHf5x%~am`l;T*Qqau^f?W$Bk&H2+z
zhQ3tT<M;fActHdL3@L9@9j>Mz?V;;Th(fHXs{+s*eu=w|^K0GfVP#jfX-_8iC<5;{
z2jZGJe)&!^>5QF{>csMclNR-uLpvK~BRI$bD6R-R;ERCbo%md!nXMX>K;|^qZ)6Po
zCFkNalh<BNWnm${Vh3>zzd`^2BpcjdDTdqcyJd6)q-db0<x4_QMiq*f)2_seFa~2N
zUN+`EOHGS|t7n?xAKdr}aq$r1WgRCkOJDW2aTB9T+*4n_E+gXY#qH0K=BuH3liH;X
zv_?wcCa=KiUXaW6@00HL>)n<kD(c!`cupwgr>_ImU7w8T_l>Te^P*+$8j&Tf-8Mu;
zDr>LS9y{}B<owEXNqmU~vwZG4XBK*JS?t|~WP%`g9vE~m7<3yLly5;$ya56JFwk%S
zb_`<jt0Z3Ov=q1a^9UfAO$h|Ew^PGS^v4~fA1HuewnKp|iEOpINnllE^m5G~V77@K
z5X@#Y0)p8pKrkC=>)YA*eR^mf6w;qyw&x#Uwz;BTt$HKbm)xMCFNOk`X1y-_xB;`t
zyvJPV!t(;Ws_Ho)ArU3o$m-2eh7=UJ!in9v;Lu%fdkIV~C?6V4NcyaF?<~b}GbU;t
zVjhYw7vHec#Iw%ZQn;nZsO+bp1JX=h3a$`_YnV^)$<Y*b$W^$t8HHO%X+Nu8aCAjk
zHG{2$h$nbX7^@&+ldfheqWTj35BA<MxUz0-|Bcm2I<{>aold7?+qP}nwrzCOv2EM7
z?VR;IThD&?u5;cxUrzn2PE}TA@?L9=HRl*(USr(9E9_wTTra<3D{UX+m<%PPPu2m|
zMS=A4+%D20I{xNN?4=>!DijtD>&N`n_Ix75GgG^>FQ+aG-{Wv+#2Vx75eI=walmVN
zHFn$8p-EK^x8urCU7S9tVPWecPaE)bt<b|TS$Zbh3+v8+CskkOwmNBM#1!^j%0?yq
zbn>b5aook=hube#4lazvVs{(QmcinZ6Fv4)r^c4nweWSGreDE0ld!*tChFZSoq&}C
zsJ|bZMh^;~(jU1$)_O_=5)15-)D4YLF}0bgl!zpV1*>BT67gH(x*j(~7gxb(XeVei
zzuvmfq#va)y^Ohcx*k{99!{!0c})8A-FemlQ%JCXwY!9F<qzgTS~p=t6Z{xu%L^(C
zi_C=C9szRX7IqofW@}wK+An|N`k?8E*X|3)88%Hsl`E={-%x0hD^$#dfzb$x<ui^e
zzDtA5>$QD{k&aj}8)O>98dMu33kHh9DfrbJG`6KvaW-Z9ipwbxbYrPnTFvO%fRzNa
z9d80BMmue*m3+M?_M@qv=y-zkP7M3FA$Bb_FVYlrS`vgK4eSh_1`!hYQ6e1|%m~dn
zuvb^#z?GvPtcVxS*kD3T!o6)0qdC~J*Ke-jfde^vNCpXBAm!<2Oa*UFu1_u~fcX=o
z3`Y%(I{j)iI3wLuw0^x-tZgCjl|;FMbg#$U>O|^GD?L;peT&J6vvqsyH?d#DRJe8)
zB3!PYw4EMM_n!_xTBupT+;hUzE__Ik;x)1aj2PYQSBxEi2e~hAGjh#ZR*9{9{k1@~
z@+pLVk_K|IikI%M4Z=Y|z1>qbHjw3hTA~V+u4nI}dl}xR<~wX!d{*-}x8HWb^ejxJ
zw6ix-H_|?ESefexJ>X2X{6!oH4i&^Q=O^5Z%j2ClmbM}R5bpP#NP=Z6hg?QZD=DGV
zeCY;?i|jhOWxftFbHk`}UMp(~4N<RQ%Y8ZnyxAC&Z-_~<^|14L<xMImKT}&n#n?rO
zfDxzk-SA@vg&zrxtgB%@n<@vh_Q-JD<63R@NAC2gmG#yRq<}iqmf)qX1Q1<m+=eM-
z4Vd^zG$hWIj=6G`mk4bPLII{sj-f3Y?c$on4`tkQ?DGOA&Shn8r$QodNQodEQdl7p
zB>M!jVqCQ~1^GpBVL0$LvbCqbU4Iu;OVz%f6+W18TVJw93$gAAaWf-0u^2)1Y?yZp
z?*;I7cc&^V5uf}ld5|aBAubF6^&5dwr0CXyie?xZA`K88Dp-_Y_US_sM8p=xFqkn<
zn-&9;{GkaRpnyJyUXNy@pa|zIP^IwmBwQ`LB@7Myx+Cu-?<J2_a5&F8{3pc;Ya^3=
zSfmNzjUJ-9rL1gL^a-4Y7C(?SItxOo@M$)T@=@ss3<@PmHh8j95tYzEQvMo3XUBWM
zGN+aQ4kd5m%%g#~MYuXs5NJ<#j&0aJyC^58)>r9>jFIp2)jEjAdkShjLc#@;ge&{j
zo?eR;eCz2S9K2o@87Kwb9L{#i_wwEzSE{;o@ATeW)|t*z_U75V1baosVUXG<t80&C
zEjR4t$@ydJrg#U|Xl(ufZm;YW^KMk%S6y*ZKM~FxqC_*p*cmmc34z*?F~J!3@yF$F
zIjpNOjQYYh0@aYrM&x4|kj}oToL|dSRFzR`WEV&#1{3XYlGoMgS{v7{+xM3??3Ua2
z5mI|^pgLB3nwF>!Ft_?x!6tP@puF)z-BQ2i?hrxIQ^AmnC!EhM)wJGe0;C)1kbqsd
z#i3YB!16SJ_ty36XRQdyoG=?=OGJ#7#2g}1xQ0j-8O|c<AM{=%>V7N$y;r$S0)>;0
zl9*ToG&GiUuZcPsuL(-x7oABX%$xdDM^0qM7Wmr3N9Ucw_?^lRjAbKMA4v=U>JWcH
zKqqJb9*zVDEd-H?Dpc0=3i-93R{m(S(dFp|{~H<`{%q5)XeE$9$^-uH_-p2KS?4i=
zI~wlo7RMilFah@Ss!@gev=;{I6c1^yDGp)n2kfe!({Y51)R{{mR21NOn@W%-(PptH
zM|jCSOe&!1-@#IwqsFp;>nykQtP0?Cfsu)>5}$>iC^;P0grxz^8!?*?SFA11l9QAI
z5B!4@Q85M1paV~fW0PtX&m_Sl#bhGh#wm@H5+^$6vr8K-4%xZw`#Y>*Z>a_I*joOW
zuXr%P6i%sym+s&RJp2fSDTzZgV6HG*qBHJ;CewrV`B2lkz?k<L=RF{TFuIUldNWxo
z{(=a4#*XHlye&>NxLBKi)K{(Hrwg8f4YDiq(wKDqH;vx|8OwB`GVM|`W}>u-GM9wW
z;_U~k5l0o>ca-)*GO0wNxDvSw?xbpBlrjot6vQml#CJ^*GGu=&u(TSoP-CIsju2A7
z)Ne44unx2K_A7Fp;23jqNKI+5**wuc`Zp6HqXxFvfZ2;`A~RBcryap29+ls=F$|P7
zRmd~;%*htwj?vvr*bn)^5kbS%#^h5k7}<}tmw}6)IBWjugr@11`4g>(o;ttx#R(>T
z{!Y~t-Lv?TI1vRI8(~k&s`&~lAtv*b@?bT;Sxz>~|Ck~;T(VKbZtuF^DjV`Qv-=*S
z4|#t_D8!&NjZ#YBf^)ObNo!A4EZwGvL$Y(?Wf<(ZHa!!-9rsUyFHXr92M9FqCw{DL
ztdWJpX)AVHaYs2>M_FY=<pfAqM`9d<RDYj*2S#a=`K}4ya0olaK*zw$z;GDXdA1R@
zVW*CBv2+>LpG}DHd1is2&pQy(W3%U~JKMZMtfl0Y1>rPg=EG!v$M{wt1a_43R$Yd*
zdJs<|>+{3h(e0F4zTnlv+LFCK(S3d{hBp3IR6aDYP&PFUMa8%h1@vQxrcZ~5ub)$L
zzo1HHbLgEv36_&>x<6-zf3<uwemyq)D#2kroih+9e$htse*QYSc$cNt?r>3Xid9Z-
zq50629{<Ur^VE|{Y!r#fSo;y!ipK*4wi^my`5MLOm^$c`{v7#}<=agm@OEC%kbsoK
z6d$T(?>(ne+n*s-X54q2UcrGI0+GVgEQ2cB^Ro;JJW&kJqZj&FB$FdLaCNs7RQDZ-
zE=y$^h2GOb_=V-eji2MipTJ@X==<2E#E5b#I|$@OqyhmC0^VJFYe<LYCLSi0B6vHK
zx6sSWsqgV^@0wQ!#7%C>*@g<1AgN45k$hdvz~OYLglm(hl~@Z%IA}r=Cw2x38)y6k
zdj@1CkFVY@`I3jlSM_(zkNywC4_2>X?X?0n+D9aM=2I;vyDOtzsIw6391~YnjIPl;
zc6YV#zN;04!bX-Qo*x7R)yR=u^&Nlz6M|+V$><V-BF*RMK?UVfamsYXRnJFtDqb=H
zzexfDjDe|7<&8w4Egw54aSC%_XD}XWPB>0z9l{@`PY6h1a{&BFgt2Q7dBJTtHRB;B
zFhrVtX;1gGQU?q`4o8(o5_*Y2!7+thc*eMwTL^cDa7MV8g4qlv4%PFm8r3Zl4An~l
zSJX6`vF0_9Uf?i@>)yDjGkiQY@D?}qxvM&}W}J^N`+K)F&)-45l7r)-703Z_v}~Z0
zmq~Sy7-7WQdZ%qRVupdzUr`OCn}P-pX{okppi3)CieBm8&sN3_y4>?8dFEyr4WF1R
zv(K_Ru4=C$<gHepdMuMQe!I=yynbd0KSjAiMz7m5v^yBOzPjA_9!5?4?gWAv9qWA~
z*akXc@F|hiE*C24Y}RrY$iH8~iZr8=`#FmALm<C*Ol3iJv37#%)c-X!vgGTdg8j8*
z6<O$u38kh`XCVlKdLpCRrb;o;h_S(m$(&A45tD8_;upcHQLHKxA82et0Fb^KuHrV1
z|2hALeBXWpP59dc5Trh!EeCq0WtzrGqp|JM;NcB~INn1*uo|!p=El+PicqXUVWNT~
z;c#(;LQS*@B0tqb58azfd!T*pG;>MDIG*I=y>)U_ytY4W;6-UEGHtM_zcjf{xuXuA
z(Jpk3+=IAZFO~MV$&BO{2KBW)(7l-SfO`_La?r{A?j;SSoWxB8sNr9+Ue&mT`D^v#
z>x?a1aG|3Nbm7Li$Z*3Zj1EakT?5Ly1(TZ>TG*Q7s{HAIHE6I7^vp(4yFTdn9vnkO
zgwT<>lfQ@_>Cq*RYF8+gI#RKR;P*@Ka84}vk+Yf!M;YsxJIA46zI_K?;zV>Y&o?Dz
ztAN7Y+)+&J&0#Vy3zxqYJG=9*QhnkbxV#M9P0exd)KSOJclU4*vLO-}wq4g&l|4rm
z5R@qts3r<_f6D-FT>Ny}jsHs5o_oEB-x2>2^9PRhu!-Foli{qgINMG4!qZ-K_$%1Z
z6?6$U_Be{O3I`DU5GiOr=kvl^`dM>BksEgnWDNBAGD2jgEirLj24}oiJa7C(qZEx3
zT1eev8orTqfws`3KDpf2S-q?S!@NW<pxEXXJ-plO+mzce0FJhVzLvT64;-y>hJ2!Y
zaxWZ{5N14VRJiRr&iM6i$9}bnxzrb9f>hk6Aro0FlpnZM#?1ruv9k;<^`U~vB-}SH
zE*35p?rS%pz1Q(ak$do$oD&b%9n&;T_;giB0)q8s7z#>H5n{bFG#G8A2U6*;ciPc$
z-*0m38ZAtl0Or^6QG|;p1~(c=95>*c<*6RFEZNvz+aEt)(qe%NUN~+Uw7V9+)1e?T
zw~U3+^mzoFCJw<Iv(FIE#LtA!tj39`gU`^?$0m<D51$(3O5hQyhbElmYq<u$6#)h~
zKK1w#!&A77G-#QH;#FB>jq3m4(FTs+gF@dwPp3IDiZ?8D4rkv{d-3!V9KSCkmvt_B
zB#S0)u1GH|_1>l83mieAVo!fTsLh78AR8Z*>SJ@&6t>}tXU#m1*Yd$GVD?ruhRv<R
zT@V;8V4YD5^_R<4D?wKS&l02c-;=!|N!_i8K_wslmdbRSuUfpvJ9ccWR6G&}^EE@S
zS>wnC`g<PD2%=$kBn1;0;SZYVz27cN7CaPrPe|BF<vY4>r^h!4T*J)00?Z3d{Y9=c
zqLGb*j!slz#{Q_3?~X+XtFl(B=ovZ%98_bEwR|hPrIv%~Un;5zYf+)y0Gugty^@mp
z0<m90n{<Pxgo1Gt;K7MWR}cDwEk;!xpLvx2##(Nt;nd!bud7;5PeJCh#Tw2|;X=i1
z5=A}onKcjEu<)=i{aEo7kCh!CCz|@hZAk}#$*hvXkucvSw}D)?eaE+Ymm;LFJw+M`
zMMebadR&DmQrxys#&zRaaz)K%(y%PREE4+VHAU#LgG^!-EmP}3EbGBzyc%!{GAkF~
zh|+@7&2F~_mJ-mGr*{fyt<q0W)?@BLgdXi5r%DR$rjHu>8;vKA`s6G-#H@#)Fmubq
z4$f!Lg%#`R5H`HrN7tP@pQh@abn6d`Cf<M_an-vjJFFLrL8oWMCwH8#zUTs^XWZ#-
zxaOL*i#5__o`j(C-UO#O!2mnp_AXMk<Urv7?4BAMXBSZyR~4B2s9wQ<X+eF)dYg-q
z0}#ln4xs47#x1)qDM3^ipt(k`)dv;7b(H%0E1=vjxq5|%Zq{1u7WW?xZbsjopBJCq
z-#t<-10q4PASrnH><j~(l<3QfGVn_1MsHDH+UF%~%GF`=!>HKMs$v&M(haNtpzzfK
zTNyS<x~w8Z1Ml8mKgT2-gRE+u^#zJicZ90_dMK+{Two!!wqj0}>GbQK9=A=W)2`;?
zU%Ysm$Wnp#=T))9j7jmLr+v}oy>nS}P77j|oBq0N<?;KT&E>S>_*8&fP_Z{iIT^zu
zyUY{mOS>qMeOm><b&!gR5Ys(ygI{=2pi%3yycpzk<WZa9xmOy$wYc*AM4Y_isp}GE
zA{BXq<0<R@*joGK+xN5sEqg)b!$Rf4&F0g%hHG{(ymGEp&u@r}=h)82d3CGa@4?QF
znbdeLX4`4%7fT$XTh_eJALr%hS?<(AM@ieCeW>t0=}Y;4<Iv7hb`OmTCDoeirDE}n
z{1ZdlE9qR95dU`!ZTo>107HxX2Zq+5ds_BS3~kyTndmiTApk=QvCg#2J(?}AQW06m
z{UlMfOAS~_;VWkNDYl@hFtx6aC3>APsXZ)zAkLv0(Aj^iggQ@II;h!zZ+Q0NYTo3#
z9pL~DcaSbBv|vAajivFik3RQa>oS@Y7i`RPL-YO~hbkY8ze<mDwCee?=Q(-*yG|Yj
z$W>_x0t@46L5N+x@<Pl0RHz}Uyy+~X`3w<CKX%N-rv2biHi={(Hn`HXhQDho77JpQ
zHVD)mTXkJe#gt`%Lq~R5M}aM71j~<6L&Q9PaShuLZ6F3tz=CD%p_GgJE2AN}a=1lQ
zo|U{KVsxr|?7TerbA3wLvQ=#8@{`S{2AFX`nID8{#N51K(89dZrc@Ek>PgVfq{#X7
z^xDa*mkVpJX&Vs^5L|;$a6;KU6{(|Haf`@4g)ApHnfZ-Dp+flrMX{|O@*>Igw~mCv
zDZ%<BzsZ*x9;>G4bNbtAmjTkYjBDa(CYalZ&=``ofW56)hBK1x)q-IK(u7@9U>8&c
zL4z^fCJ$oodb@Byt>b>Jk`#L~G(}MJ<fnktlbI#OQ*Zd?dHnS_c=&zp)8xfzyQ@a&
z#?Vbm+nEePigX)jC}s`T>_DL;kE^FphnOpblvg1;%%D_ReV)#-hDzPlU8+D*DQO3e
zr}J@C-Xm*V-otcQh)lX00H$qZKG7eBPTD21D!R6_d4?iR`(>&}EXxKh>Wic}5kDQi
z)sH4hd?qH|_C7e6)^To2&5iDao#^6q4RNu?<SgdKN_ois&Tx6w9BtsFiUVj|2#+J9
zpoFIVAo49-!2^c6F9>Milpxjp&HaXRfF$Pw3uFfGQAV0ldO$Qp2&JZi!zm3eR0&r%
zehh2`wi}J;UH(YwqVKC)1JW?bT~nY%4CRkc84_`YlH`Jy)SDuKkc>l2n=>y;@g^h0
z;0w17fl``DC+Rg#z=DLslPO5?V^Wbw7>=u=ka*|_Gm{X)lp!9?8L$mBWC%1I!jyfd
z;);Z(v}cX<`IS?j)8a$yb>Q)wAJWH%Q5+kYd$kqKWX*i?U730Ccz9dw#*&sZ@DDO=
zM*?v(&BgCFi1&8Q6sLY-?<ZmP5cehN`F?rw_o0Ak5e!9bq1#Lu-)}6c0KcvJPWeU>
z<Ix>X;$M@ScK1u+_&f~MSH-GdEepQhXR^L65x%_drPh?`XW#5AZ#KL{B%!;#1R0)<
zrF+0(1cbk=CuQ2cWF*iyA)7GW!MZ*&OtaQH4dfB$Q`9lPADJ-t)qNo*N5NkeUl=Os
z_?5@S)M6X=d-!bGcJ)S*t?nby(P9)M^{h&rJ|%Z}1s6>d0UH&4bBE#TrRpe#>0#gC
zbS8W22<|h&@md#lb?c_33Zt>iU=%KY(lygzN*wQ9@ODW5_4x+%v7q>Id^9UaA&K`P
zZhBe||I5^K-qD%`5)|e(u~1#~eo)I#EdW{Aabwa*C(4kS;k6Dkg?AZttQhd>uz)b~
zzO!@6t7p~kF{HKdBf$Yfw5HX0iU=Nq!!wHaF|_h6{3I;)#u{k3?u}#QJhTV<_054(
zq%mDa0^WhEN%R8q;&wg5Ka&}U7N+$hw%5YwOEH76wC;=ebd$wgh~}tnDJS%={Rl%@
zU?<c;7?4j55rW>GlGa|`M}|{6_<*pk@ha4#ZX#Qp>5XqOQuwQnHPGBcKIw}EkDFKO
zX^*&}1)HMy;*W*e<i&_0+II)qLuI^8_@gs*Pu(7H9E8~{g7y#$S>HH(_E;9nH_Pg^
zH1p+9ha=;a>Hut7ac9<30GqZIhBDAI4>VTo4>oNm%QMCBKr8%=b?H-Qh>NEq(T?JC
ze26mt*oI|srCjn))68Ir5mLMZN`nbc+J`lZDoAYEgYLryk-qNGhcj#o9kxie71q$m
zq$Lx|R_<jE)q|C}=!y{#r>bGH67-yafN)uwwqDzK9;JF3$XRZs>I$pTq%Yp>e3m`Q
zzdOfmX)DO=7cA-2UEH`R&Z0C^HnKn7%J0Mln!7z4_l1Wn>3LZ}^4X77*Z7{X(Ap_O
z+$xVE4=ntO+#qfD2zYUqDJuO96EV5NXwU;r4UP#=z9w~@usT;Ka!*y8h=@Qklfk!r
zasJlowwwE&$I-q6A3F+WUy&2pi$q73dRCGReO&F%t%n!BT2B>#_FCrQ*kQplICylT
ze~qI}7ME{C#0d{MDqOCFF-S)xfg3nzB*0ECi}!WmU7vm1rR)+MFtL%rNq<X|Rojux
zsaMZfW4``y^EnH4$@vsDG1=0z`Q#Cs?d=8KxX3s*x+qq!2l+>kgA^}Uz-P<;Ih=F{
zkMA=tkOqLezdP+~rl60A)~Qu=IrUty3kT^KA{M_iM~g^#Iwzu9EW~v&Co)zVn<C$<
zWjyv!Q?c9-1^+~%Hr6z`ycvnaFO&MNU>YuoMmnFwxp@wwoMC}CJ*|%iZvelbN_ID`
zsXyRUwOm{1u51X|Nb<H9>DjqGitjmK*spWU*a6{Z!+-_P*b(>TJy5~!38$WB4nYlX
zM<*dt0ghk|-XG(K{i07l=n;?x)P&jhU(NJfppRZYUp>a**lGtF78-_~rUv{Yji>$c
z1eyz2vSXM+6SzcGeWoVb1YHy2?QS`~E^dW2w`huMaBKLDx)Q}Vgpx4E4-mRUZ=+#1
zC;1FU!%2rT=WrJ8re2`0?7n=lz4NFfwhWSHIPc=|I-Lkf6b=~_ZNiGK0}KU9@74~p
z0>HFP=6WS28sqJC$kA&Yb!1KVjp1%V^iB0_9VXAL$sJF9z0+{(&KceZM~v~SRMsu}
za(Y56Gm5N6d!5=ItM5a!@v(6~VB4;U!rOli?nHiHK6jpF!dERq_KcJ;2=pnjff0|T
zluTlLfgg``tW+=*8s=Iw_!aqG$p?7f5QtftGs#tN5m+oGmP%g;CY2()9s3OLyhw^0
zmBc+fyncu_PCWi6^_Sw}yYu|}^LHy@HON2)E!%;+h<+hkB&Xmqs`4_pwkr=F5KX!J
znR#VvLek?#V<#yKx+af($7uV`4*Si%J8b6%TrDTl>lI(=O$e|m#;^AH*ZW(3_<4nR
z1FGS?KP}_ZNK&8n++1tgln#=I)A#(D$XA#8Q_qHlCr0AOSWv>94h*WMRFWYL+hSvn
z-2z18BBY}J;L;w)oN}WlYJ5{J4F^?Tz_cg)8<$pZ8^@`8uK!}U$pCF`Tb0Yl_!!72
zLFH<2{5J>6eD1K`fckq){@kW~7=05<Vr`xmM37Kfq!_URDbo(--W~fyGq>|-QdeCa
zlK1xL>%_}NkDJ?Gu<|7a_hmo%G4qf(+bzQ*ur@GJ0aLRlq;x1*2+HRr;r^9D(=ZqN
zNZdA-DxQ~h^2Y{UMzZ-{=vlk%O^(E7e5+7vxgpVRCsVU;U^?R*jct4>!*ib?Zf-<W
z4jhY6vJ8J4#1U)2q3$%)jJOG9DOtjmK>N3v*smsRH8siPE*F&ttxx@JKyM&<p+trX
z;=c#c19}U1ItW;ABJ2Q~&FhX!FLeh29_Gpd*_Nb@oM>X0!#p)fHds8K*N^OQFL<zw
z1Kn-?4iJkyex5+Q5wmdtX`Nmo<c_8IcB<OJI8@QXj4tHJMHX2!@advbKZ;T$vRMo`
zO2;KkIA=m#ruv$RnIj9skY+?p;{n4>RRFCP#R_6=lAn0n#_P@sI%EtPYZprSlAxCO
zKxIee&}Ej;heLIW>??>}+IK&;p5-d=Z8fbp4lTuDqAj#*m*9|*w(Me?%pPrW`7)ZD
zVV8AgN^j~fH)LXNibUlF%0#t4lVpfyZ~#xCGi7v2;ModPisF?sdZIur-<8l2Oo7z{
zBP&6qGJ54`zGG-3Xjl6r49XMRFMAd4*wP3e0D4!;@OpgZ?qsI(3lQ7Y2t*`5sn!eP
zny8;A!tNd%YKc7G#qr~TQ499cJ6(>{JqzCgI&AMS-vp{4w>q{*`Tf<|;<{7M*Zp_s
z*><eWmFo^1wG&bWm!%ZSLelz%^9KA0>;tF>hT>6EB5G3HD#g_+pwl!nXr_kYaDXQu
zs1y^=^eVB-+~r@iXs-F3Rg>*|wrvoUb!dHUF78^7@i)lXi@jSPp=vslI>LB<Scz(j
zO6RJ*urYOBo_09f!U5U~;0~OOpG&Y#_M6BYs}ZoRXIPs(oH%)8c232;Rm*3poCBZb
zjsR+{rG(N;c<p1cKC^%q6A>1-JQ;CD0Sc7z2yzK|fD&@gFu;LPH=w;cYND=EiYTs+
zn~WQ7b&o63rmbkxP}{h;K%At0PRrW*xAQXkDtI+FVx9aP4Ky2*uWsJu`ozsc%6T+4
z@gzlKma$wiCL6*}Mg>Dn<C>q`G8r$A{m~JC7Tr54L+U1b)n(&Gm@XB`{Z8#=xW;nL
zWX_B9SoO|z+mpgqbXqReoDM1d%a_}X@o(z(S~ZjMC%Idc)D$uX%}cX8bXJtMP0Z+)
z5wZKNfWa(ezKdhP#1h`4wBm;?Lu0?(Z_4x4GiBQx*!Ay;8#1wr{>gi($B%A)iCSDc
z)1L8KneNvGUoSd$uOSCMJU8NMesVGMp8Bej#eCm&8gzIr<NVE+QFE7-?ml?Vvzvw8
zLwz!Un^OO|5P!Ii!|Ukt%e5w+<2KEbjdHFn1%RwgBSlXrJMr-a)hqzlp#3|tcG_Le
zJ*Jl9o?~KNGjLH&T;;6Y3?pbqKyjg6`4{=%A!<7wdJ7$?F_P(7oU1qfYuB#x+Glq`
z_+bZ^>1O`1YU4$=gO0{}*cIGkMvcA3<@h5F?{4r4r}FSD?kag9Uz)=x=qIEnsJiKY
zvJzRCnf_bm<G(Uu|C$Xf@qZ?=_Rn0(e@m|XgYf$Iyx6~Hd;ZT{;6Kae-;lNctpxr*
z%Le`{vR0D-Fy)4k>7NW!0!9`B^?&kb0ee{q82<;vmhCU3S|&~a{`Oxa)W1M%H3^v6
z0g?VeuGIv<Qwh}nUx8@<f8OjLRM5Ya@;?^;D{uBsSnvNLcbl2%fAVIn{22he*$)`{
zctL|(32MRuFu%UMuZahsA-po;{RF!-Pp@H^2_l+0#~PDQTFhvInhOgqbl=uXu&&ye
zmAF#|Tjjf~r?5x;V$Ad3gqq57GgBx|YE_NC3Rt$r8e$&qd~suTZ@gL;jb>kBzTRfx
z(0A`>MH|lwJ@_Ws$>4LZQOk3P#YGm@=;US%xdpNc{~O{oQX76T&sE8T9{CD^Gl#`&
zjzPK-WN`&gg{&}vbF!?g%nm~7bCpkSu~MF|viF4IFf}1}Oc_S3;3xn^EH93NKTM#2
z<EI!^!JeN34{_m~GYw<+!M%+a1h0N74Mq2t2Qe;6g1Q)ZSS?W=*({WP3WB^ZedtK?
zNYM#&c@>O_F|t@OB0|GtS&bD5R`0f_KKSyo&WBxY9^f3Ijt~PqySWm(^-h(W_&;uo
zfc~?V{1XcBUn-1$-ui#kA`E|p2K={*;(wbU&ip50`+p>e|4GmO3sIK&FB$9qNDyb|
zWM%`@*QOQ@hIRz>LKeCXhCdDeAkxCn|LqV078Z8Szov)xr+jfhUQ8YQ+~i@2qgjr7
z^BQ8VjiDu`^wQM_?d}m_(?O2F4H0Az8Gu;r-a^_1feQs#Rs_kYVg1Np3HY`Ik_#I|
zqEFE$x<#@~rn$nhEE#W=E-6yidSA5qLkdr2B?@eA!j`g_y!iFl<)VG_^W^p7?V^2`
z8w5B+7+(bpodperFXQQW5qJQIpec`fE|R7Kq6FK=UC=tZp5Az273fjiXT7=BT~WFB
zIo}oFJB85bK7SHP&HcDp1I(ZS#3Eha=wxZ5*uDY8@CziOp`CWlEk~#cY-$&1WMy^r
z#|ut3s0^-;=(#2@_T9V#ypB@&v+^%ZM5K+GOo*doppn)e*e$;|Su7x~+<|7&WR$Vz
zZ~cKvcN1F{H`b9&g|WY1n7C`IKXQ&LzW`ezY%P3mUzDf_gm>l#0!5Zk0f)jLIEO%2
zghs0-kb*pzRPceQ*F{~>XZ@i9i6$FfU&=|w0K)RT?a}o;yIvDB^i_%FKt(+2K1_(o
z#~;k6HO<|O1SE$7DYVV`-d(x#z0Kt`Z6BJMuD2qxA$juCsQ&G7bK~ZK+*0{wr=##4
z#m7pbVJ7{Jrdx1DveT$VHA@pH$uq{uAM#1~8Of(spVS?gIu-ijo_?X-c76RS4@#aD
z>Jz9D2J|isY^Bo&kUqkfKLOFDF2hRL*g4zOYD<^q2vf#@{~Jicj4YEtVk$iv6X<<&
zYPWs`+Cg$`E;L;RT@RwGWOiL9I$LIO0QS3|mbbt<OKw#-CQx0sjleonZdEj<&(Hkp
zAh($SH;u75K|FjuU#k#IpM=ibVlonm9Bh3Ef^+MmHwK9}OpfPo1~%XbzC-HY_ms^r
zwNRdYyrGM1l=r-skAZ^b_{cOkL3>@GqPH<vo)Ck!`<Tvpspmoo)xzRk;%jZcymayN
z<7yR(>>a9v;%{NNU4h^Y*kWw`M30jV*4zuR@B`MG%LP{_-s~kw*v01XhoR}Ei}(pI
zDAg4XLDQp))BWX%ayfNZLvL>|_A$5r$DIx}{O)0F%Mhc=mJsSm4T8FD63*E#qH~d6
zhqK<@rD#wWyiUNSYf!*DgWZhaiViyy6DY)@$DCQ<ysW>*P82QtL5&myMNXCv%zxJX
zXp1pu1KSIBGpji#;C`e#FuFFGvDa{2x-DxG6OA>e1HZ7tpV5afu^s)C@J(+<1$nhM
zD>^~wBY<NrkIs$U@<@;#uM2c3keEXfi>hE*K|1}I`;MV~Lc$1*QF2T<6>bdj%<@dm
ziTIVvnVo&;a_`Y}rze@Xn3!I0<2zMF6Y{AIJ>KA#CLi&q2$dNbG)@yP#c3urA<sJu
z=AV!zA*IE-EnPT8n^W$0h@KNy5x$~E8WLaYf;oHIy51trb?}Yw4ZVA{4vcPKy?r`M
zY@w`!)q7TZ`NAcl+pwR(XzHtTK@^+dMiG0|9Q0u>dg*ZbWpR2jGkRUyklx#bRWZ8B
zpAx>KjpXR1N#7o`sePv|_0P(YcL<vh8oXfyg@}k^WG<CJn;oiW(3HTxg_s>Qs*PWE
zJwtlHaF6gz^^AYdc+c2v{z;cwzI~uazSs|E1G>h4A-qQLNbdp87vCAFJ@$CL`kZ+N
z^Ktl=p61Tl%Hp3E&Ek!a@guWZX(=?`1-#eAYb|KY1Su*P!@SzhW6rOgB^_P{>ivkH
znpXs0mOUfZ=s~L?h_X*NqknPA57=VB$%zvF=SL*K+p-_;{*&+JN?HT8;*Gd^#|uU8
zCS?-uZby^{99-B2&xg8=qUF-!O?8jb#A%xHiX~v5&MitxpR9-gUr7b1zBwyDJLlv}
z7IO;Qg#Y1@>eygq3e4fX6pWt=!o7jkJ!~#SW7HRilP|fpVH17=<>I-<B%cRSEZKfS
z$$rgr;E8nLg>>L_ixn())BI;e{w{Iweu9waT|z6q=k=h`Gw?Qx=D{YAK_-I)#rIix
zkwZDI8yr$?yp);}vxA|XG9vaj(ASmqk5ckn5iZFykdag4Gqdsa_>~C9!8TK5W4`ea
zQhUG9{Oj%<pw=CrJROcEjlu54984HmRd~d$I5_-7nuiXKFt42j@vik^d!}-peq{Ab
z=RA2d^u)09<1~CD{AR34n)SO1DY~zq_c`n(Q($3!C(9xb0;1nq9W{^tTD?ZET~YT4
zvxeIH*OD5_{OJSLSS)`{PuY~7b%u(P6|#8cWjMHNSW=s9-k=(}6rG!7hC!rLd@ZV-
z%eY>WV>HLO8o81ByX$PlN87AJ3SO^)o5d8PG>>3(X`{QImDjUYV26`lRNYYS6q)rh
z&f&%zr)$(3*L19QW^ytgx%KsEkJ7f3Zjua56IgK!^-_QYp{V(ETK%<}ztXRHGw{GH
ztO^v?;$tW(!kJiPwa6spqe1^fBImRyp-kcIc{??sFP3pg&*!4|Q*i}TvGHWTi>6|Y
zS*Fv3a`Vacs`9mB<;^t|7#L3yLo=N)W&rGoR6IGBrKB14R3+0?)2fn(_ut|+YxDPu
zw2>7z8!H23&(*91=;etatTvi$-RSxYbsPJ3zZIJ`e#2o)-#Ix~-8C-1^S5@=nmj`8
z<F=oh+G&TA;9j07fr}d1`_odd%rniAIj^pI*cGpn<6dfV`nJg>x}SIKsvLK=A3up%
zr(0JquAVjqd-x*LDxRhd?yq?9F1D0G`ze-oFO)W`rIE*^D>e&`&sQ9nDcS#aQO|3h
zd%bgJQCeTmpYqweEJ-vl&gXI7jw4fr0r!BxO?boYxCg?xj~Le6n)C_uS+0SrqLt}F
zrI<=X+42J^v5W_Kzy)WZMA(q+N<%r?=%y?YuJ5ms*Xh!)DX%W+vtT|<wLGA*O19hQ
zdt%NWS896B&IaQ5ly~+2WUH^nUyS=fss%a-4I#BODxjUue4i!G{WxF(PDM@MuB4En
z!WCbXlyZJxPY=I$fn~&ZAq|W3W&!ug2&LsSde9k;gLAi`G@xkjeC4dVXkb0EA@-GF
zWq5`3*tu{s-b;F6_L#?x!gn-Gx)ECS7{?bK8OaXmzA&_nq^fZr!{QNopVHiZ=N73U
zWS=wM?CgZXi_^}u&%t%iQ(*!lQ<hV&K><ZYj(W(Vv|2$Sg_;J{gpMkseLB6r5F6)U
zjYGT*xrL-#^f+U>z&Vah^^&AXgABQpxdwdPFiDImT}_FLbTNzA1k8PTj!C_Slv8wy
zBt~cos=;8j&2sXqb?QvD^R0{|-6M_q@2m{`&c>RT<8#{mN=%El#5clPhhLSnmTl&@
zS((3Ar5?4Qyx-o7+2-r#6H(WvT`>akhSW76_<V>mZo};1BC{IaP_yozPkGbYn-$6(
zk7qSRg&t<}3gq$&V%F0Q=vdc{S<noVq;>*li1b%Bc(PS<T{plypJ~l88MRk>4j4&U
z`}I>IG_d&hMfO7q^R{M=Ad3*=#e_+b!R3@>QnJ3_W}7?i?U{9Pb=R!?XpgTw%R|PD
zVj;IB;mD;%$QWuc<f7zdXAT?Lmy=C3`sr%9>}O<lkTMgOFqaUwgTWRllO{>puTLN)
zOITEb5NIJL<(DZ(_tCdi;pMa_FO6T#fmCNFzhYFmy67~MJ^IycQRZgVyTn%6d%xof
zpKmySF4<YZ%WyO3@($_T7_-#l5zvV%W8+<ZzX=ym#}=#Dx$ao((RK8e2<?dHg@+KL
zxj#6<XkQS4wO`1ahKdMs;UA3?nqofPeTr7`@2Y_*{3huhxl()w!<xB;Y_^mCMyH*|
z_|nnRU>q^Qp!_p6l@=BC>)Or^Tlxe!3Tm9Hu#q}tVv2a&xzR!Jw%p6|k(AM6$D(%e
zWa@doHr#E!gpsqR>c{%k<D9XD;vOzt_@#fqtkxpVs6UasZi!SIv8^HzyQDb-48sxf
z&hDZ*5;E;IbR4PdcfGQ2zZHJTM6vg}XnVBHGtv6)iWMeT2-V4C)u8RmNk!7KttJak
z<k}e&*v-kwUVRjr*J&VPUmMN3YB-{x7L9KlITnQ$=-Vw@aPT9LeiOHeqm#5j3e7-H
zlbC?EbhA({VYW=mmHN#!IUc%uz(GHqWT8J=l$3~KKP(zSYb>`>Vp#Y1Kn|I8ZoZ*(
z<$`{@ee|Io&U=r0IDF&kvZwMSO?HBnlJ$PV>+a1kSgyZ}AH29vw$elY!SXhFs15G_
z9NWmr{Rzet8!WI9_RC17Y$11C+*<4t0xt*B@kgYR^=Mt<z#w@IJ#=BJhn8tv?6`4*
zL2~+H(Mc-ii>P4fGwTFJ(sY=+88({*l?bzDM+5R)C4-$MsD$mFktj6f)K#<Gj|M;z
z6**^YV#+y*BRj%i7+HEe4yCJ<3azVDNh{$?M9$KT^5O@YnGmyF+<CKW^8?NSJ;NC%
zLwb>#MN)ZnT)dpvQW~>A*=t2*H0+5no%)(<9PIX|7wOwX#kfM_ey;o12b|SUgwMWW
zb#zoZ=uhLPkxaZp$jeR)ugtI#{~amWQ{zsriw{<MIG%?s1d(?^AL^~w7#|^PO#I}D
zgh5GW1&l*XbjI*zv;$Rs@967->$X@!2ZM<0ATTLood`7@%eDrMM}@ZL0hB-oKs6()
ziB+PIosF6VV@5}1QDgu|Tr$bkN?K!4R+&J3rESsDtKYs)x*5ER-+V*3`MAEk9p76F
zsnjL_TL0)B^$o5oosV-fHTg8fV6sM3uYr}CnV6TBm6VfmT8|AA&ekncY3d4R6k*NF
z-BBja-k&MiJezqizu}xvbOJ8Y7R->6WO#n}bx4k3MG|Xs7CUY)QTymP^8QZiQk2XT
z!pLPUZj)~K*YjE24{<cMWzuItz~ua4;^~(+6Hn)QtGi`Tw)8<-(T{qkY!Z2yo6-69
z^Y@RO$=xEtUoWe^gOwd7?uf+@NsQd}&y(cfV@mE%`>?H(^u?>5vXPEY0+n{}J!GBq
zvqoP4Z#2e*m39W4KDeG6h0G0G`LKW+hEB`>8%=G6q%PNI3~XM-C^^IIakw;{uIRnc
zwenz-Qz!vb*s-LtQ|$r5c`TIG-;BE6K59^Nm4enXF4fYPEVV%sH-KwEO538TW;UF7
ziE^0BJ+ZyLlNlq<fQ1Fl$b~tN91Zhc(*Jnl&ZKu2Pps9sg?3^W?`G^~Om6hJq2678
z|FQ$`_EV38Zsl^#dY9*7CFm4LWZWQ|+TFjlo+z!4jycNienu(k19d-@Z60LL_LZAN
zm0jJ)&Y$Tt#&vKlW^K{M663sMY0EFOgJ084=x$F5HO8^d|Gmf*kA1kU*C6?YUZ5z)
zbMJANH@6%wveyCAOfmE5)LgJ=>bILUN<<pn_(s))^{-E})vN>jU8vuyiYzB7`y|ax
z4IRT|;=VDH`Ca=}iaF)hTvGMaIWh+6AlZ&kT-Bq=t|(3Og$vv9lt;2#w$wJ#4X!9_
zJ4t1R3$m3}sHNH`*{dt`isI+FN~!igM}x@R)xC4R$4xKI5e_%C50klrrY@FS`gXBI
z`+=~+qesr-$CMRLlp}KGBffxw=i`9~UZ~yAscqI*i(cFsj%aBU%o@eN-Pm}>^PG*=
zgM;9K3oZ&%^=q-~>(e<=Q>2~A${>Z$ERj4Kj%<AQ_O38&9PWL8PkleZ3;&JUgO0mV
z4i7#JRMGoOM%z>2q;8cdf6UTJonRJCCRNIIkxffo7DmikqRE10yVMHYP_}1Z8)-W%
zosj3e2ueCT<qEdZ@0e;^{nIwUIEq-qRljGWCcwBE)g?cmyo02t&N`_2vIy#xoJ`|f
zX-gS;@og7s5-@f7A`*HMTfAwZQb#MnW<B|*%f~oE2OuJSN{UUpdN)YoRgX8$c93lV
zwzb65LrnmBGwK>1Y1@-Hk;mXTf>jG;k8db6y)89VNx)^B)KWU7KFxLqJy3sgl*cj0
z-Z;BZhXu{ez7_ar-jKgG(#_O3fps(G9yOWJ#)(q(55bLx&k&D&jJ;1tx11WT|J0dS
znE&E3^)F@mzpL?*|EID!|CFx&O^^SJJJP?t_1{Jw{`K7n{#H8wrpNzh8T?a{6A=CR
zho1jOJSG@=z?y=!u;@=oT^j;=Q3FFO2U7>vKR3&}+B+Cpidq?26Y%iR%NZJ*+B?{}
z5>W61oSO_OVd$mp3=Hi|t&9mM{&5;$qr9VyjfJ5lAPfNmK$N3bCQ$!(HYXDU0l)-`
zm6eT-kriOP1`zXpD*t)tKOCU|c4hw@gZRHw?3kE1{wmmM%5<CcGQhUKQaf0D?U!oQ
zXGlo!`D#Ac=H;VL-CaF2U<?2Js{3nH2U3(LE6c^LO<q~>8>qK*x7iqjn;mp=HCZ^r
z)?O&9vCYN-dD;2|8Pi5-`9@MiT^?g~1Nas`$1`a$96UNY1P_y!G<<w9G<>uaKIWo%
zgf<7UA%cXM4F}Ukd#VdFGsv&ncsr5h!}GhNyUl?^G{gy1c0MZ$o2H-ojF@RLzkfgx
z=AOTHB*PBB?`D_jt}Ui3LmO(GxR{omB-2BV<hOFS76l}jW6jH6??69x>4gX?o?t(K
z*#`gTT>%)J_-9f5_44@VPyNTne^X!o^RoC~Yp;J?igN!$d;Jp$`&aGtFCXY1+A9+a
zE8G7QoRgJ<<=^3)Z2&mu{4&Q!hW(?vakKLSNz9nRm>)81JOT)YuF4M(MjBuVkO*iU
ziE6rvpq3r1FqntmsFsy0E#K!C2!A6~>`cgzIsyZuCs2V<)tHsak=S>7PGtJ#cy4NY
zUtZq6?>hJL9**%IW*uf6@~paM*#m<BaRF}u7md@<VmIc!5(CYE0-<X#)N~w&adWu>
zEiwXaclC@O&>tk$d3^=&IbHO&6G#0Q#dg_2LVg1|T=$2s(y#tL&20yIfCti*e0?(v
z@BRt{R705XAnxsPz4^^`1qkXK6oa{BH*Zwwp|j%-(WlD_DDcuG-Fte&v@;#<yAp6$
zNK{nA^TcVN7ZB4|pox<vi{}wue3uQNt!zkwa{6|??YHO4NiL}G*}y*M$>ZA1DdIDH
zpfUVF2yGr8hL#=FBN{+!<3I*?JJd<E(uG@YKyrci;mHlOcue(^kOYrFSDm0h@CG?K
zpp24RK(=*2C;Wa~2urteDeu2hy+kY2;Fl6#;9uX^(Sc*E#3Dgr_*je6srMr*27MPn
z9)1EfJ)Yt?hu59p#}L<rZH{lo1wMz<^M0gpwtrT)$+o}&&B^m3TrBQMA$&*kB1`~{
z0iiy`3pgzmFH%6}3`4h$+`UueW5x);0P}CLp<w+gEE31>0|^nalGY68;(~Au&%gDl
z2;Za105+0~B-HE5fOn$HHRgw=0?QXvzTJ{zl@_AN@g*z=j7kS319CS9uc%wX#P_)x
zr7Fn0Ch__D^UWE^%cuDBg6i9@_16!?9|JMzOPk1htacF)oaE?-8;8gqKT@a;!f5rv
z6-YG4KD^A{hYzXkKi9KcBs7cQrZ;-{Ru>;mykFTDzb)EU)~!94epFv~n76!wIFHz;
zFJ88f7Qc9Y(E6U%85xd`tYp3CpLHI-Imk@ttZt3k-)rzb&a8>se`Xx&+{Wm@>t!kf
zZ4ot*X_6uMgwGhlz&8<S9^@bd6^_37uz?u((`%x2Lju+5P}X;Yr~rS-1zpkMoa>cn
z0$S0br12L7a7p3$OML8gFkt-?Wxj^%5Yhxv>tJdCqxafDeWZWG%7I(a1=ko+x(~kR
zhuCjK2w+;cgnHNu=9TuL21GDA_E5>fo8&|Yu(hGofZ;ds5uAd@t;R{J(YCCPh<q0_
z@ekj^A!|@F4DqGoisyJ@Qt=EcG0#czf~Mc{EPGGB;(j6J`Q90j>4C{Jn#><T?~m(&
znK7E&ZFv06YHw5rZR2=TzWN;qLpc+;4$`IL%f-jnWAuPc-{5`pZikPN*-P8YE{6|9
zoA=`PE5ifZq_4rpZ!kwYe_%XeN_GJl&kxXnYaWS1^_=j99)}lpn`;<{X;+)ZCkBUY
z`;MsJmwMHZ-Ro<v3{lj+rXF83Mm^!#wlO$dVc0Irs|#(FQ-+_JnzT8<2rL3=bg5mQ
z<TB!2F}ird*u^lnNqy#MfUHP-s=xS5fFU^fykt*Y@^v_Ur@!l2ze3?j^s0q(>Vj{=
z#S73bx;Ezpc7esy@1*xL-xg}Zy$FJoPV|PhhVzgLjzuK-jz{LMg9I0YbVCHR44U10
zxF>1Hn<}_gkmeAB)a0)eV`No95QF3bLq|?L6lg%cJbdXtx@}hrx#5Rq7m?5<_5#ry
z--@R+t!TrEeM(%q`5n_DaP_m3m_O*V_<l&E3D0HQ?M=J+gT7K&BJ+NYnB*a3JM+%w
zYmH;_{(DQXi~hQ+t1?M`?r8k<l;N<+(ToAhUA_T}gD4Z0T0%q+SKPFWI}=t52PWKa
z()`@;xap}L1D1LMOt^7rA%V(alM+%)IL(xZpq*h86D=mJwDgFe13<U~1C}|!=~#fM
z;D9|&fIW#3K}KZxxj}%(0%A-!Nx<o|fM|0DEDG5XK@)&gN5Fw%fCDokg3RKlWh4QM
zfDmPX5Pg7X0#vQPVgz^%em?G}C^~2dEni)TGg4oEAQ~C2C+nb{YXvM<U%-!vwXQO9
z7r*L_1vxe9D$RHz8pU1&rev<S1Jx0(-!f8PSoK$ww1U_5Tzp}qK8n(JQhMYW>shyF
z9KFo)S1oD9tkZEuHga8$OxbtR_F3M#SWbaE$qH1JdXyNeZN+97J<0M_&2i^4`nWJn
zd2T7zJ2<Zz9Gmt0W^{4EHKwsH&%oS5u3zN5sCRHy)jc-N3(f5A%xct-!YK<+YZh_9
z$|`hAXA*HRZW3}JnT9c5o`o@<&c>Ri%*UFBuEA&FY4Lt{|5iQU=gO_>d<)9X=Xz_;
z-sx3WUA5~QMb6!{AQ+B5?Px#T!f9YjtjhlGdn_&GZS`_G8|cW4mvX%aYo*x>3Mb8G
zqyH<_2`<yi@pL}?*8!R|Y4~ES?y1@$t=3?-8i={5#re)}lm&QoY;|r=%hQ#9b3spA
z3r0&#DYfL-eq?AAbWoqs82!YF8t-ewL+cwa0nlNSq4<a(9KgS<h#-q$6A^JC0W&5n
zxwz>Vz%N!{z(PWnPe_OfcRg$p0@%fZ2^VX?g3=1{Ay@_pVt3>jjkB^FBVfI{KV_AU
zvr;&m+o-^KS40%N5wkya8i(@|P7&+|&RHLyEbz<L?nsd;_(NiE3O+_aSJ<(mlB+-o
za{q*<hAa6Oo<un$zheVVjAyN|({RgKjAbp=Xf4GpQzC!WY3x`~O8}3j)hyYM1vYXG
zM;UhWHzk6;w*9D~&l@$iEZ8dXy)g^1HQuIXI$5?lN??EXXB`iFO$J#u=8PuyfsCTQ
z>h5twxptES7diHJ(|Fk3bn>w}yX+2^v7(WY6Txn<F*C6~wRCbTEQs(=p9kTEovt0j
zGqnzn<;P#2=RTj>8l%Jjcs64>9gCrz<#@qKDDpsbcqFd9)_ilmaAXCJtgPF_RNPLF
zUtQ0$D{yo!_jy{`P#nb-4ylYBZq^)@1WE(hQ;&`1xy&1G7QO_^1pZYHD`Ez|galWe
zB+=4H8u+9IW;(uv##?(5W4Ym(f_NTed5)QhXf+p(#GMo@r29|?rsTHHPE_djflgj@
z;;CvXy#e1Da_@NV)Kr{KHP;j)V+uiK_eoy?HTQx-qZE$X4>r@2fU5vDM-ylZx!=&+
z&?{3&A}GP=)<pgKP}Ea9C)4Q^Lr!4nTQFsZ+6gJ&@=M+Hq$uXbvbw<*lz(Kz#HeU@
z3vw7W(KeOtJ+n4G9#!YC>a|jMOuxBGLR)#=PQ|fm+^4Z>LKDYfAZ4Xs*v)r$O~suw
z{1kQ3b0k8_;;1jE+C~A2Lx8!nu^Hzh;8*MQ6rS{8;(Px|GxZ6q(np!~L*8#}GJ%j#
zQY3_<QwD0#PF)%n4VD&~RB7C#)(cXXUy8j?jCdS+C5&~_*sQIt#z?W~VD7YX8-Y&I
z(fnmI5!bh`47@v+6uKkkom%7ye17{x$B)`Vv$`7e_Sw?B2bo;WMIb5#qe80hp!iU&
z-BiWYvB}NL+^?SQ2g{g=SV9mwInVaBl79=PB)^8gAanW>_3<K77BsYpW{MZJtQs%k
zAZmryEY~y^!2@d6bUo_GIB0qhr2U5sd~Yu1VC<EoiI`2`ym=a33rFl?n!PO1lACQc
zC3!*!EBVmdfsMR6bCsNmG%RNfa!)zuJDRr4d;3D_0Ed0)cX+mGoGMIZ>TYx}a?&Ti
ztEaL6g&gvqr{q;fPh~pD!@d%AeKDZNXewO!_#Fh@s1hapRPfrFGU>=>@T!ZS3<Vi?
zDFJ=~JUR5dgc*48;D?>KY4cc+EF>!HY_?rMlSc|7Um4a{JMqZ{0mkm+0U(&kb!_te
zs9?w*z8N{-$Y#sL8vWlHfM@+Bw;OEin}}0FB&~az39FW07RF&0$5Uqel(@&^&G&59
z$5@|OcxK$dx>@6q8S*I+zd$ZVIKVY#Nx?{)Y1SFZad4PQo~AwX9+ZJ^=iq78l~!4e
z@0=)sttJrMx{noGkBUmPv~%V*I>k&cdAr;Qn)fiLm)T*+O7ZnqKy&FT$-8|go&_7B
zVw1(_q?AyaTtXo(H=ZzEDFX#lo-{it3Xn3v-CW~IPz4Y@wRHS<YoVD+jQA*WQpx!Z
zOCi{9NtU{-yda%yQpmfz<;af?M5nqLIzd5UZ^4?n480(&Y|=M<A$bm<ulyEyfWIZZ
zbQ@>+06mQ($AGII@DXCyj(h)rhh_SN_SdO?mIid6#&=`BG#}Uw`SaXzfDxMD1tS0u
zo`m>64%iWbJZ{xFzVsY4$^aRsZhj|3N&EC6qG0Lt)uUkgzo@&%D9N67LG;Bg+qRu$
z+tp>;wr$&Hm(^w4W|!^mVwa7{|2uciyl3WIe44fH%KQ+uEB9V|KM@(3J0j!v^aYV9
zntp=MhLfBK5`$Ufj1@wVp0HrUiq4ogBFf6{<KO*lr{erVREo?FhyYNtejy$!n)@RR
z6>Yu4(i*nEu*U|%-q}=yqMWQUqe^5N3{qFH^@T1dTKPl%9<;ops|a?P=^OB(CjkGQ
zWia@U=!syA%=-21AJG#s*5VWb+rb|cO-maAZCW4`B4t{j!pMqYDbtTRt5l_Mg%8$^
zdE^~`HiG6vsUm{sj#@5^=guYb+wYu$0oP1(e?(Tp@E2}2p^z7vY1306*Xa-2WK{No
zqYKhBqfmsx$ebXACYw{Vzz61{$%B<WGsKK^k{v-Zy9j5L?}e?cxdH10)IK9H?~v&O
z)$h<Wq2Z=Q9Z~3+1%o&=EeS(oie~trFM&WOjH^)B3ye4IbizLBA7;UDq5;x7lXi4Q
z7NkM5YqC4C_S{m9{?Zf4f3!})a0<tc7nD~)APWi5H2%a$A5y-ns|QQZ3J9Y!>hJ>L
z*_XKksR^Z<LE0aixAKS9Xt=k21|p!k;2K#({Vk3yFQB?mtC>WD4~}s!pf$lZGaruN
zx)xUvcv{|QHGrp~nfggzBKsh`nWugA_H|#P&OJ;Q!J2T!JN{=F+0}mQJN|YAf8$=b
zwx)YTpvMVkv(Is-rwP@T^S3{*e#IBdAJ%5ZW3SIJ?*(xS(j)tA&*ECeh3GxE)MH5R
zL_iZsko9ShpS}lcCC6tEtA1w-t}oPQhToCseQ*oB&-nDiv7iHrFz{`<ZD05~?S<nV
z_lk2je7FDOgwYe4klABs=(?~2k1)s}r)yuyb9@UDPqPz+ki}!bVP6U8Y<|O=ZrgKu
zu6?281MOqq4c;9vInlZH@tpQW%MYcR<|F~_<J=AXPJbCrHN&}wMDGX7kySTDq}7Sj
zIkRd6_deiD;Jt@*VgR%{%^nAT)vv$9y~B7<_w}>ZFTca_!71eM8sWW9T!j7J!)e0G
zkFc20_XKUtsvC%*_k+o2^%$I@_k+}DHVC=APJW>!->0}^Ujt>zsT(ZNdZo4H{DQ9=
zK)jo)PbuxWwz!+S#!Bx+tjprvLwJtq0N*h^)w%BM0CyiaH%E0J!aH&I#M@y8+MYXr
zlzJ@ptW6`L3xGk8hhf_bY&Trj%;h!V1-n7e6Hw^{Tts+GXY7M}uKGd>gnG<m?1OY$
z^g;xLAx&rOk)`{?6J;|E2&emlK}}=rBm3I+LPuzMLm*}|4VF93`+^FDC;(+p7cNr)
zB+32y7qI&Qlsm|0u=vcmf!#e|_JU{B`0TkMjd=?JB!eNW6OL!z_nED4V|%hLc<<o7
zYy}|>dvteN&zPU~0&rtmuL@k|0&rBCuLQm(0^n5p?Jw~6O>B@~Yz3fbpH`nRAn$*~
z6-_}i6ZC~VxS{%;as#pIb4)OZq093yP$R)W1ovQCk0FE5AmY&~ruC1!gcHR<x%MF3
zK;S3uK=@Yjg9mh&#heNqBv3&iZs4(h5CfR`LP)fk$%Tc+x(X+LK#KAqhz`T8%``>-
z9Z2kh3TeR**GK2pF9GyYLkCk&{)l82%b^8WoPEKICd)rn1e1bBF5)ngODB6O9e5_G
zkV}hTCl{6&t+7u8lYlCU@va;|USMiMjtd5oOn_@hC5uU;l1E{Y%bPHZ2`8gVi}A_C
ze?f->3MJz{UJ2p<JM9Utl@7{6VFe8jF=3TaYnBE|{X-939EZuUZJf3jN>m(s5{E97
zSxoChJgez2hBSmkHd0cH2qfg~uMsu4ktJ-PFD1OVI=YfNgwn}n<BxiMbY3uUB@X;(
zNKtMC(E+$MhDO-=Z_k!?n6aP=^$dfG=)$THP`%U>$v@UGzKJ>^ga#dvNiTw6FCrPO
z4U~aVTMQ~<sHLH+C87@$Rnb2Fpmm4%mVB_H7Q?svi&?cha2vH6<U8+nG57^;AkSVD
zY*m?MRY_HF$v?m+@kC=4m)bYc2kb8x_{~7VJWTjaA?)lj>+BNiA0^S@WmfH(*(bv=
zK_%X9Gr>imj*al@3>+qH)3p8Oc+f*eylCOyvcI=jHI_v+Ql4d-4?!-n>8T_UvK7cS
zY4(5XFE?7d26LaP0lNVAUK+3hpT7XF>^J{q%c0do0*}>OK^^^_)lr0a^WA<k0A$FB
z2wJr53nW~xX%izyFWD}6(|(}dCVVCs<r-LNpq{4SH6w6qwe_%$T=Gwr%-F5K0M!Cd
zYmFSKx1yqI`$WXBaLvURF=hrIq`L}?u>~AhE0eTB9{E=b;QvscL{e6W<=dyK1oB#L
z;{xSFQ8A~@KKSk>++%xzzl=et0t3mTTRcI#*wsNt0||Tf7C`Ywg=ihm5cO7bJ8QVp
z0)L(tt^=pse!CL$bA@nsisyd|3_LPvT89UQnL{1)3bcVz@L3l`{z>QphjH6%%~iDF
zR3_f2z2CeI&szvMauTZ;e^b!!7(f*M369N}v#)F$o_*-t;mD%roo+NhJ?^4IzxNH<
z$%+6m0uOldA!>nhKAmH><F{b#-}wGR`aE&8@ghvX!Usy9?Bkb%EzSi5kJ=@N;EB2N
z{btwukQeTau;Z|~S1efHUO@T4^Pl^FKfQi*t~$7Q+ZpxkB6S))_ju_u{Y?9tE7B*<
z0}3+145EbI54UDl4?8{~ux$c;+X(8*U0wh|oOn4m3wYOZANor@JvsR;V>9h|?&%FB
z0kp6_T6etmfC&PToI3U;^sU|C=1F=lLWYg9<ZZm}`3*$o?d?s<O18VNkBMj6E;Kec
z5k-4M_=^^n=2-)49;ur8DpMne_9@sCCKudc_{whbYFt07hbIRq)l(y5O9kklm77XN
zDLUh{H!hEokT5Q_4~f73lv(x0g8I2A>s&WkYPSd*)rwI=U8tK9GQW{qmK&d&#_daC
zFvNL#=}W~V<hFk?*gA+2=37Cn&Gyq$V&VM<h4{hx?7}R~EcdKzt_JtW#rQhPnIk6p
zt+Ks*pkO(~`_5Jes1+kMDB@`R<*zsW(`AFx%Vi&gi~v<W!i2WHzI0DM`Fnnb8_(UT
zS9|xd>ia5B*GxrCP1V!8w2Zh4Y<*x+Ra2A2SIkVjWA%3iEZoq`kJZDwmk)u0RWg|!
zX0Mjl+8-PH2@0AG?ou;u8avxBM|y3S{9juK5mb8J2N#vHC)*ys;SzS!M-nEkXz+Wi
z_cK>q=4x~AeOK)QCcLioOJAQtB<Txyo%L<SOmBZmsy`tL#J1NSk0B#}Lg44((WM7n
zgpfJnBghRdD~otVJxilhlCzg2HK)jvf)|09_~<x_-0W!FYoyc1A-Y6#+$z|^++UlF
zx2&DRRchU%?o-Sg8rPVXNQB}NlZ|L6(Z+BEt=Sa8@B~()+YC!I=p6;sfEa~ErcNZT
z4bH2zlr!<bBM1DWuKr~x0jjGRw!5Ea5j6XyS(OQ|yXOY}jtc}!(xa$(60@Pc!nUfl
zTjU<&_^OeicrYzOK?7}hOeqTo=uYvTQR6OYir{hch*?U3qQgdiZ1KS*7YEfB^;iby
zJ75c@=1<`^+XVApnb~a?guQtgh&xzw-gf2vvb>AF=!mbomgZ<A6K@(#a4o17zq^Ak
z<+#ox^~&Aze{4SN{9*Q3h>YGBZ~t>_);<a~SuoyHXe4KLh*4Rvy3<f!Vk+e)?q+k5
z-sWVFl!(?G|B1;(9r+T|foM<BmUPGs6HPyRAk83TMO56p1FZ5c(j&h>K4E#j7jon^
zD?*AfX-vy!cNC3@Wyd)Dxoy>IHX3wvye)ET<`wTQCPD&<wZOp_F0MvHIh9|TEZ@JA
zS6fYIo}93lWC!*)fox$6y7UitH3X-n63489P&u*Vm*V%UitvXj+T(^<g;D`Znce9Z
zp6)OIp7T&S*M0(oM<Ws8!lb!7u2+{n0<ZBw!ZN*5-y-Va*shb78+?nEP(O^5GD$Mz
zmBJZ$i>mWXOWU<ea@R}<eI_eo+>8@mwB(w2hj~~Gn;LeZ3Y@!WFcJAn&ubjtY06VD
z1bim#Ey5Cv<FX~r#enSTv$+YCD`;t+C-!*6M=;V`DDfi<#|5(M1%m4ZtaAeqcBsP;
z@deDgIHK|e#SY=!lqRUa&FnEg4<^0~%4HsYgrz~Hqbr*vE&7l9Oap<^b7KO`8X9U_
z*i%?*HB%DunnJheyk9qv@?)dA30~ypdvN%8IOQg?zORzD(=f~{(J-Z~l$o!j-Ugv4
z&y|TN%AUJ8eK-rnp({n*@KFM}3ftZl(`N8Y^zcw75b^jt?+@h#{w*Qbf_;9&lU|hy
zTw$t7EtTcUaLP}m8x!caB46Oc!ngu{9yfjDvxp$C&DZ$j^?WCSI^?<SB0n61_@HlS
zt0R><#@>0#_Tf$ONWWjPD2%e@M%udYh`;-hr`xr~xHSg5q~}OM6$z2Y%NVA3n(lt|
z{8VCaQqInj{&GM1{ii;WL^T#$Ny|R5PQ@oZGo|V|OySFFDW02Z6g0>Mv|SLcs~;{P
z)(oaorQD5AmOEWJz0+s9Sb;=SeVlLIxan7Cpu|?YyjMHGx40xF$-8!^#N!X$!}2SC
zX9-k&&yERUT-x5dE7GjO(=&$JrE7|eM{(Eo_UXxhANVt$OLsKa>Q&1+WG>1qNJlvZ
zVcnv^!qbJ(`5IOfVob_C`4rta@a?egt3-=yB#j;w+P!?#!Yi27z~L$Ce;co7uvM@j
zGKT)^_v6<=%laXsR{eYFm1OVv*9i@=V-~Qf<<-O8PCT#83lS#y`V-k{@T4KYLh1EB
z2y|v|iT<%ZBn(j=5?8!XgtmA~BfNt?q%9re!>l$Evv#;YZx`{$S}fiTTlSYo^B;xw
zCs_T(#D<93ux^OQfrmeA9-`GW5IIg)zp&SYd?hjHhI1Z=Fp5cLb-^xXNhG$>As_F~
zrNKjEhbqldm?*j2h&oKFQCdB^{KwkEty3%+m{;ynnS)vfU0x{{A59Ity+c^k9a0xv
zceW$HaC_)_tF4b>r~2tK;R*MrQt3^vl2$20I;F)KaiV!b@3z&TH#h2nj}p$+Y0HLK
z#0ZJL)+rql?hxG2e)KIs7p;<-;gDkK#Fwk@x^V^418vvAemQMv*S^LfzVGdQRnMjF
z&5QQoG}wa2--%|S?&a74(RZc&b*u+T|3S`ioUZNfyCL8Vcpp~01vluj7cpldur5J9
zQm42r?fJbs@HsI~D&YmPST6V$v0(x>QZ85)T{JZ%uw2RH{KreZ#FPkX={%#yq#i)h
zqH9B!PIn8RX#YM*UWB52SL^7g-wLXL!pSNRiF@J7ah_*acRfhqi16-ZjaWTd4|q>}
zJk&@RXs7FP>5kaZ#Du!=7OPa6Bo#p3sJEK{DC1<X$>f?GFBJGN^HX4A1>X{v7{>!(
zqdqA5qYTv%P6`5&dVhUQq?YnNm38;%Jyh3`tyj+3m)4~%Y7ok9Yj|DMef*{0c7(JN
zKbA5|_sZO4x&R|+l(uc6;G>yblOr*&sM1_5L!Kq2ioceN-n=l*%c$F{ep&a$>kG!>
zKCnr}P_D66eWcM%TC7k6T6@}>0R!_t?=vHe$r5)k^0DL6;u*)h$G(kWMt~p^O(I7i
zVD%4B?+j=T?wfd%j-@BPbCfmJ1ecOuOWT53Q~o$?Pro^$6=|1Gay3QqPK$G0lUmVD
zYDlH-luk?%nZN2!MFDO9y>UUz>{88%8nvf=Us}7&HRLNn*F5|dr__~Ip|$wrESp;y
z`G*-bN+|SMJdwVtY`+kw<3?ms;LVmJ%{s_@46xr>F!?_&pQtjv+<X&Z?0GziPpv<f
z++Q-w_%8T4yR!u2&98JipCYO<5n<nRsZ?^Q)qaSP56-(ZJoyYl3Z>E@PyC%Zx$ZdU
z8PT7D>AE`l2)9E?!Wcuy9o9vxK1%M^LM{{dF;+Z8nxyCn(JqQXQb%5u%6Bt>?!2$?
zcHS|=8LQLvdN9WwguPi-W-oOq$6xRYMq?Tctb(+%#Ktw~EM!u;&|A<W9DR$|@Uf(t
zBQIspWnf+sLr7>gA?SSs;^>7xe^?S61|H)O560IB<6|cVU~Q9<8qEQKYj$^<^Q^!F
z8w@bmkm7m_RqQD0STXd`N?0-!3ds^7?&dj$P2Iqn4$=`wNw3_K*KL-!N(`v3nPkWI
zlhKMrn5OJbVe%XEW>>0d>*&giNR6oGnbtvx!<!S}zc|2gBq&iCcYG&hEThKWvi`(K
zzTR)kO&u7Jf5#SC049-~mcRl~w?80nj;3ZL{d|ct&0e^6DS^3Fs<IKCG-XSAC}w`C
zn<^s+uwX)YbCB};)fclVF2Ryqn7%!!0D|z29Cz$2UplS@G@LnjyncUg*`Z{DbP(!>
zA>aJY$Y!XJRj=l~oTXm#wyV{gl~a(|V5@M&ZFZ>K9=$cnKc_eO*eGhkE%xV!Wt@6+
zoN+mIB*23;%|2ZWjC4=`5gdZB?o4ugM-g&o>yE16gfh=JyX!ulS6N}p32G6$v!ejj
zTNo@Yw++MePRf??@EY4hi$}RuEoTYQt&}!VCd`ptrZ_k{vyP%99CguD$F5iiL!P_}
zB!yi5!E>0$9+he8VEx@PA5#hg^%xAb=-pUY#MzN+m<Q&xcAR;bho-{HIImgr9!?xA
z4Pu%$47W&Sjo20i5e^ob|AfVy7uGq!ix_jTEfAJg$=V7YCb_Xenf5w)dJ1gg(L~8e
zg4C~A;#BH;ycb~K`WVrxbULUz)UMna)!EA>G*v?TK=$!TToI{WFWp8}-Ad@MiM3Jc
zJ}!F|MXjUG!CIP#DozFIR4(zUnwqkj8tWu+WN15b#3s~WSUbPn2a&#a;A~Cd$cKWT
z+@}z&ave+$)#S_TXEjT_6DNoPjV%-v1aSc$O4mUR_H7a|FlonkPFVgy#2_-dp3s#l
zy5;3F{xgXd$?c*mm4u2hHMIxzgj8#a=(S=uWyT+pw<N{Vu?7_8H&QR~tL}crk7CIh
z4C^0{q&}s2ZBLn0#<-+2v-HHgv`QC)J0@2q7nAvWQ>V1m$S%fpk4-hTTu=}*v(4#(
zqvUW#{D(h~34JK}&1r|e3RvQV72OQyO2*hsj@Q^>+K@;~oE2vZM}_g#)Q0qOD2`LI
z-$&mc-)DVy3JkIgQu+i0v%c(lp@9R#chkc|BJ@ZU&H_1h{{F26XDz;u#O7THRTKb)
ztZ1fRZ<AA*$zvn>+B+Jf^p%)wMXd!phPfMd!*BP!z;7fcV^dDDg?n&GisM{1g%4uz
z243~Xp40`bi?b=r1X-PlmKwcxBm8&%UqWXoOV15X0P2Tr@n0Ks1uxrVOwc-)0k0n;
zcs&+<?fYS(BI?#ZJ)c`XYd;*SJl>7Bt(W)+?<%en>oIJPrZOXjk+t|_31a7i<TJO?
z@oZfn@JHg45arz=@W}{T;wi@@BojmjkzqG?(nmA?`1}}hHa<a*S5*NB>r?)^TeeZ1
z#BeFmq!0%box^kh?_E%}YEf?g@<L>qqEW^*FK<xW`_eE-d`TzOj!KM_Cfij?L{{B&
zcZ(=%xLTIzk!}EJ84l6Ieo8r)M4lgYwj*rmUolgGtyUs0{zTS-p>7t{s@*EKRrO9K
zm=rjUbk<eMhPFC@kt+(VCMgN0f{2QfDT#DVdN2iF7fCi{;+E^Bs2T=-^xla3V)f<k
z_B-sSyz755e=*cGdc5OkDB0d3?X;BdKHQ0y<2&sB9f6rdl}W#rC9hgDRa&7QI@eUy
zfl|_>Z}^nwUP&hoN^Kp^xYr^T`<p;U5jROIZk6gkKbYTAzbc<~`^U#JUWgp^Kq^zy
zxFq+w;9cOsSIc_JWHZu+F)HQ8WgPj+gKEr~DL0qK_QM`a@LmjI^7{0|XdvZLdClaC
zGGu<;ebDVsC?h)b@2b`<)bu(ds$WmW30{Ft-D@WPDK`R|zBJ}sgm5g7+_La%RiF$#
zQI<&u@ukq6hWxgmD5fW#hUOs5)hN2tFh)bYfh?5IG2mq2=(#+A>hiI7XI9KW9w(2>
zfkv0c1E>0piQFHK_)Q4&G=Ze6X_wratQ#(A5l=jDxfrt;@&beo@nTZ4x?jXIB}u(<
zEQ1`YR#;hxMa1EVBEpV7y3=;ZljXlAG!Mv?l=HlK9wg50RBvmKh<u*PPWV4aKT=~!
z6iR-|@n>omSX03)IszVi-Y<gUrFw$eB_{N!yCG=Xqq;F{Pb^pjHyfEXq`Jf^^ck$s
zCd6oq=*9ihyr(^I7PW#VEX_|gfpi_F3p0t{VVWgMsgRQ554lpDEE$Cf)k#y@nQ_%@
zEx;p0M(hElC3Uox_94z?_CfaH0WJP={5oPh8e0aCyO^rC7~M4$FJkl!;bzlKVY!xP
zn8quXc_U4_1r%>lOZH6{fhsT37KfT<hD(KF8<~W*K#9<d!yXM15M?Z$zj~Z7_2`pM
zsZ2$mUVr8ds<X569{>3J5Kxm0W(*#@G*yea6D-o`f;Pfx*FaArxQSwDUKxYHY2a*n
z2Wj62MIrDnfEn_00thfODrVM}K6Of*_Mog%X9S@0=y=Qe6c0IbMAb~`95+Rlpix7s
zLv04r1;4N3?pw!jV*Ww|0?f<G{$~C@0vQDe>&s*WB~!xvN=p-H+DV(~U8EV+<JGe^
zQ#wgw)vXJyG_A6>8tb9AzJqbD$ZAtl$8gsC-}4dYWRU){$ahsJ9Z2<$Mh&qo=6m(D
zQT%)wU0^D}1S{9Ot*|?o9*J?|{t6)Qba6SZG!)@USJZzD5dtHcEnxRL3csOSk@wk~
z?BY$Z{q&LL307?LJ>C|S_j?<VMe`0<{i)4${K^AQ#MkYh&Ev{!epHdIapeUhYTpH7
z`()Q(QEQ@)F{Mi~sTTD@nS==s{*t1_P=nI4=Ko<q8igO#vE`L~VB_^mF)9~rAU>qR
ziYAr8mOUmbR<2C1<DVh&EAR12O849?iu8x3O7IPQ<9!{DU*dj82zET+74|%%0Wl`z
zq%knsfxvI)R0+Bk@|=IVNA>IK<>!&Bg7z}|>|R3P)VzJC_DC!M;Z_uKw_`Mx=>z%B
zFf$5kFigq1zyH`pV}<1YjfTN}g@?x0i89Y8F9HZFg8^Y>_$3Hj@XMfCAq_)6Az1XK
z>WAu{;i>mg{np|;^X~a+VOwGwuPn6nsUuDw9+ag077{53CCf9Zpum2PV6c?e|Lf@^
zTTgNT@ffbil})A#TDV{?c?hZ1K7ECL4)|mtv?R7s458)4HMQv1y1+lJapU0r>tyfx
z$mPNH#GSxpw>SK>?XMjXwx$I=b()>bOO@f=fq-{Rn8h&x!I)H+OcRmg1pDX1Yx1yR
zOGvKpM_oFMD)%9|DIsawCd0}^Bg2-E9l}rgIBQ0jQEelvDf4EIRH@$#PJV(qP9K*7
zJsP`231Z$l-`Z>E9JQEE&o>EI4LAUA%A@#6&{61`ynRiRQ|~-?qby@#`!_y!aNIGX
zlT);(1EmE9ZE5g325z58S1YGv`8Myat2M_{q%O0aE_ZYu`c4m>4An%hHXQppMASH4
zZ;sZ>1f>jz6A}3ZEq2c^ihlqJw-#^_LJ<REaW8o6BH$`E%{{oa3oACNDkx;y-%xOA
z3CczRcpwZ-poVsi{0+!=huPMQy*p}5N`eeO^zL<NL4K)Ol|IC^G!^=0m&*^skJ{3j
zaNravmUPA*L_^{<DUI5uvgp{iWaQ?t@>s|q{<d>G+Jn9}qaV&)6P6E=V~e1a#Sb(~
zEE3^i4GfHNnv6^s&R{lEBMysm21h~ECm4JQ%iW*IynG?W0Th|(%+A^DQc0Y}%+2=6
z>gik`jAjra80ZKZa4iJ<FqAusBdav2+)>(E|L{0ZDe!l=o24aYp5>eTNGbsFPsRZD
z7vps>`_WAj=1PAW>)IUZUC_ySF}Zyt$~RH=BQe$IYid`M)_hx^lFQ;<mpd&pY(i{e
z=uUYqQ2R%WX&5P6b%kyJ!W!yiL|VGCw7PU4hcTKvcYr}!hiTV3w?h>Sy5!b^dIT)R
zqtC6aT#+LH3={F!cF;U+imZSmEYFC$dumw&g#bhA5TK}xQ*K4xSg`Q+DaA)XNq}4>
z{bp9R7>h<AAwThX+bGkAJsSZ_AYvwPH30{;t9CavqafILHrnYU=*{$if+O;08mq&v
z4UzD3wrQ@r@p>Sv<eC@EbeKFf&dr?2LzN2xah$Y+#UP&j(c34zws%ziLYQ2{XY|F&
zVrhJyzWk|U*YvRis<u8pFU;wJ|3orN?`pLnW}R_$s3g<EI>Qn&R@k)cXXebsZ(DOd
z)*>pvMU3q(1E7e?9P63ZcUj=d)})zbWUrm_XGn1`$j_Vv@iSk9+#pN$J+flqN;PP=
zid-|?Up(@neV3Rg7AY4}he-`d4Gd0Gl<~uJ{hU8|8{g2^$KI;%1ze@kRU`L(wOR0i
z?OdY6NE*{MM&0>0z3<~3l@#;KAIQztWqqH&O(kxB+<3BD6CwKEqo?y_dU=wD;@a;G
zN!>0hh>iVny;6yW6$0tUsmyDpZq?adU{=YJ*cX{f#!AY8tg8n_5(g|q4}JBq&rw{X
zB7H(??Yzf{QbM=r4%KEM%REk@vjEyyY?YaWB_Kw8BHbZHsWF$cg)&1i0Hj5W_m?Ri
zm=4%PAZkB9{11V76aW4d-g%SWxprE^S}M8=^IQ5rP|XVrxCSDlInZR@G`UM20-QrP
zg05dUb*Hv@_rmQ$JWUyH639F{M*Le8wHX{z_?kOa5<%t4L+iJeUeVJ|>8zP4rhRf*
zuLJU?Hq<{#-Dqnvjjvp%jzmIaK?b+9$Vc%hS;*x?Ld$HExA%;SZ%n%@HS6Utkctfy
zx+3Oj^0^7KS4I&yW=x!{yD5G)=_&CYf}H-^H3w^ed}%eCuo8(b?%yhSSwQ{k^P=h$
zb(|>KNJ^5hYiukH{~HTK{ZE?Z=1VtWGE<bYrKb{!gP>QV-&JP>V~#$+<Mgs_=cd|V
z_hpibQ$K^}{1pzDji=Zh7bD-w#`;BC`ud`vhBNARuM_X*DS<2|yPRHcjX$Q0Du^{~
zL_Zvo1Ek=q53_TGCth@g?mlU*M@evyjr;;Whcwz*sdsJfibTJJR!OjUiY@lLkaA0D
z$YS#>rr7(sZzQiy!iyR`9@g^7Kv)9}LSylOG~O1+GEFCm38X3l^OIub{i&KIP*P@%
zlP5(nj^YUD;Is{ma}?)pazCvup2E$5{@dGi+54vN=V~6Kc-+y!U~wHnmEm|!c=17x
z#n7|FXAjkfA1;hx6_>VT&Ti&rT04DEM6HZd)ErksoC<dqqI<A(Fg`A2S3<LhqJ^VH
zkVHy-=!lBKwvcJSn9S~dMhrFUk8DrpFmj4$jA}iP4Xx0ERFJ)ZDHqe8iD~rk^X@&g
zX10^c#zb8KvyaD7!O*0Tsvm1pVuO0mKX6g@hlaS7&T+KN<mtfVfo*_(zs>}9TO$cm
zS%tCQj<;7xxA@754PG+?F4PF?ac~x{@GU3bG^pi`@GFc9hyam^lFJ}_E}Gd5?*;S5
z9{*TT)J`)7=E7T>4&Lnc2gA+tm6U<l?$u<w`LCZDv0N9M+iiJiudRP2R`o^$VoJ_`
zHnaJ08NmNO+%FResZ}X8FuvlGHVx0f5Ff0dmOiIzM%3OU>iGyS5JcP3^uCt-CGdI?
z^_HXaQ;X+iIU<1l&md&d48@a!jNhB~7>RP<^#)N}8$%Dz!w$a&TS6bpv)Bmam271D
zO@DhS9iwH(6DM%UTqBW}+~K2EaFb7b&!NxqM(;e`z?Ikgqw_kT8yPVuXU)W&DWyL7
zYL!NKZpz$!uQ-3?#fk1v0uI(K4^J(Z2y1%=k-k04+nJShYTM+>h;0y;#qGDbJf<)2
ziA1*3ly;A9g3%^v7<egg$k^p^sPVTZcHX)RY(YFJVbcY77_bOlVj3$BIm1txgg!^{
zuEuB98k#aPi<@h&rj(cLJ!$&3<COrqg3D+~KBGqxvTmN7)Uf5NA2QW(E4kc;VY{jR
zyvd!=BNWi%JQIsTg#;V%>XFBL*&p-4V2cGQq>rrs4FTTMqA4dz-6P@U-JBz#x??)C
zV;VE^oJE1Tbl@TLE4G1*BX_@k*#j2>p0L4)dEJ<+z9lJ%A>0i*1Orh^lLI>)VYo4T
z8=G;sWx?bsiUq-B9D9g)>k)@%6N$wLay8O6_Fs^4Tb57a(%Wpk6$^Cdwg}p<o1`Em
zidkrlP<Umm+Mn@=)%luUSXm_9y8Q3~5>)vW2P^!~+c}Xq8rFmihM6}*@wJI&0z`CX
zv}+2HQ}s}>-U-g^R820tq@t1Ii35l9?Gi|!3gH5Le->q`De0>IPC(@HPmdb&ME6_`
z9Dbk9`;&D^p6I@Vl-Xv{T0GM*IIxaqI|`pLvybvCV)p<Ztz2Qgd6+?e_084YH7;oa
zCt{d(QbLv4)YJ1el>IBJ@`35=-p*O$?8qt?zwdX$?DAGNRG*K>7ak_mZL}jao2LLr
zvsA4rO{Mzg5(ceg)Fch__mpxPaqUtG?l`pb4)3Xe>7rBHqL8_@Cq6)M!2*91pVugV
zcW!H)0`ue{(0{DFMm3I<3^wAW-=X|oOk0Fs2i;#?NK0yh%QyAHA6@@kM$rq^R&8a4
zMSw|)*;ntm)KNKHyxE#$;G6i$;1&6eP+^+_pJ!dFSDxYQuh4``n^&sLAW0%g2gcI9
zy_PsjoXUX6g)OF`@(1mYQVBcN&1HGDR{0?((%Lps5ub%R7GlbKaZ1Yj77Ery77_u!
zR}+irIWS@RD)}urwC6Q1WWKc25GUauwkXM96jiwl#cm@p2+0y_`_rCNPi;OQn};i2
zfsvckV}5y@o=>e|zf{hpX!?%3#Ifjo=@~3W2HqjY$@m+Rim<gYi?DNch((SRB_lDz
zXhq|S9*Rt*0$(TjlFJW$Z%uRMc8GJO2odKKQYK8yZ3uOC_(mVS_{|GO9=$F!bqTMW
zpbo|Ej$UP=q<}qo6e<m#Pm25lWy22nN)EY+gL1<9*o8Vwmr+uH^sqfek3QgCBFSlO
z4^$ihZR^_|1}jc69c+s9m@#gOUX2QwXyGW0usyS|{kRp1J3U7V43l{<p72-U58<>B
zE>uGaE8=h=Fbb~NScj+x5IA{AV??$AKly|NoACzr=UY`R_9grYst)?ImUgY(-5B8j
z*D$f(w$S!)a8;r1zp+GCPoz<WGEz37zp4fjs`zRNL(`wCG+tZX7_r?%XIpJX^*_gp
zyasmXd|X-mngbpqQzZWgme1H#alPOec+cdW&)RsFb_IB9e_b6?1q!!o_S>Brl<!JQ
zm*)ue6qPS@<uv?ETIj<h#F5DQBnXrYA;~2e;;Tho)5cxVqF%5rCo96Uu-w1T&RYb2
zotnMHZ)$C_I?mB@s}82wixn`}$7+ywx<Nn$7bHL>P}csNU+D%#ithpQC2{_`(B|N{
zekn-U*6O$!r-s%0UHcRx;mh=_A_eMYk^QOM{DEom0#(gjU{JQo7}Ecw{eEoz&n77{
zU{N8q(%;>)Rqse#zz_B@M9%cgloH^^jFz>L7bWMH9wkRGE>?y(`qPxxZc`Or%r1~2
zF?5L7JbwEoQ2=YomA#&tyB=I}4-Y%Padx4RIPEWL{GL&@JJhKoTC{Kq2NdTB|CnD?
zj!XSVMzOF_1g+n6y5%0aIS8GcKMiiiO<BXx&*#{b>-uxe69ywFU54M!eJ*Jw()eZ`
z<OhWId5&R@0)*N$cuGN38lxze+oF|A6W|4z^&#-RW`1XTaeXE0W72F7`e&w9f)5<r
z5khB;egUL59*5qpr6)HO?+}h6h?NO1-&nH+_%ff%Rw{tlvxHuqGR8t&h&n5y5POIR
zy9r69r#&=Fn4NJ)B*QW@w1L9eN2=+2V8m&g>brp_SVG<-MEX}h8dt@{j!}7>a+jD@
zON876DWSP=>C+IxV~rd<JRD1F(}Z<mWC+@27B0PEYSPL&dsGiYLtE+endy7P>CpJ@
zFIw3(e<l}fLl|eN5|H&lUNEc)6E76MQ`Yns(#oCI%S9igGP!5(117(p$7!YmqqQSb
zbKk>4^}c76A(r)WrF+|9Yb*v>$fs_-Y_O6kfggTxjVXXY@!?FVnc&_9LEIbrMa)tW
z_z*0S&^`dmVkNQOX@D~|o>F~^vVWdhZrVY))6~dQ?ZCD8VBt`|g~Awv3jxwU7r*7u
z%TzJ+fS<>u=FwCv92s_EF6!*U^Sn2EOs};*Y__`Hr?)xNktysheZlqK-~851&q&Qb
zq7s5e93wT7h;h~@PLM(D3&D)A8LA$_k8Mqg9thnuLKe;35NLN{CWu8FP(m0T5_DPf
z(iMCzU)dP<-u$+SxoL!l#F2mb`!2yW=?A_@G==gJ`G~N{W}}9wiu~l{37>9l^~CbN
z_UXnxs_yKs21Y(~V$l71A0UT(-X2~^6$q&i!dk&ys?zXBL;K*B&Z&7oTRv}K`H2|m
zi6v)?hsN0J_0S1*Af(L<V<={JAF$6f_1(}<3~iQ(b3f=MYRo>Hm*oDPNy9Zkv(eSq
zcjU|_qxUspcQpU(d7a|7MqJj4uK(R!8TrZZk4p>_iI3G|4}nn3X|~~#c?f;aG%rbG
zlbhkT3&eJ-h62}9F$1PUX<=jxc_U%^(jC;8F(qd00)z@VK5bs45_n3IB(u!KVY^L3
zN@~CKLQ~K;5lY6GtadTdNh3FkD_TysjY{HmJlzsu`$XMr)Ag%qvAV@JB(4wptePa+
zo@hu#dO&naB(JWLzS0EZO8zYhmU_4Q4Ev^((b;x~T}nA(=WYCX!O>OETmRA0PS;z4
zI|IX7;@d@@(4O`k^%IK$EaNky`jJuU@+paRk1Er|Fw^RI-tD)nzsYUm5oYqOBuL{p
zc)GLKXqfa~6mN@EAGLn5u@;nz-}_8+$%{K502+i#L{0=AN)yK(82gg?I8FUwAFLVt
z(F4pb?e$2|*D6Zdzm0R~u;%a|ZFP=~50W}8wsb>8l?bxw%P!0QR$m11@b;Qo85A66
zu+DoaS*7Cb!zPi;5&ypGx$dp8+YDx!mVJ+6x-9T}U&MVq_Hg*Lz4)O~P&P-xus&V9
z72%5$IiC^V%j+q_2CCoy%XjRU&^WR&FpkQr+SaE5?9>mP<9G-RIA?unwjZa<8scTL
z#-Hmnf0`j0xqg$~VxyIt@>Tgo13ThMUR(Ozl>%efCP-h_lTbaDoImtn)gbkHsN26G
z9?6=c;b#O@J9xER0M{53Nj9}|I6I#)TGSp%MX%Ct1g<zVgJ280Y{>Ii1hq+J42MK~
zR2lDQ=?}(NNMy%s$uNayKz)*=qo6A}8GFJzC>&;Xy|Kp$^O${%26>t@m;xJNAK!lf
z$l+bsi2ne{h(0JRR$H1~JgRS2ruGtK@k;AXQ*bxCk2zOYyAKkiNx5r&sK{AV%~52!
zaUtWtF?^XZi7|l)kOMa19CwaH7YNiwlv#HI=+&F#;hQQMb&$4Ti(QIw-@tOmo<Rd9
zm8zQSDbFSDe*wstGTy2{09g_UAge2rDif8ai&&}hstqt<NT(?mFVVmVWsIMpk}?=I
z)i-GMpArZYx$N(2RZ$GTPLuRMemH&jjFs2tE%OnmTib_Ai9rK1e;?Z`%Woa~>S$T}
z&}yZ3?zbq6?*WvbXA1c4^FB%amA|-N@pq&iK(;u2X)GPj&6Sh&ceckrjR`(m)!B>n
zk%lw1Q!m9zqbsCy>8<&o0g@G9!F=C?to~qBENryMf1kfNU<;D3K8AMWP^_#nrL@WW
zw)3m}?*MwAV{81J7-<snY=1V`{#NCa%C4V~z4V9kT*mOH`kD1Db_cr~27iooCGW(+
zXTW`5f{WD5A>vKx9{HepeGb%TVDb06`l+8c2)RQf)}$65JQvwB`THjC#xHC{=S-~n
zIOCH$M7=rw$50N#*|QlFQdBfxgBUju*3d<1p^lA8wu;zRbuGm>7S-vI<TvqF@<SZ8
z+GO~3r%!8~8#Go}Fbs{WYj~HJkMdn0?o=Y~(b*#d5*u!^_xzh$rUZvKP9{rUr7L%?
zjx6851yhI9)qqoB+Caepr_$~kSQeI`n37$jXJc}h^gq@xe&rDM#ru2Tn*D?=H88R!
z^pk!Dfi;q;kvb_m0jAcvZOl{oXsuj_^jAoV2rl=WCl*hK<3qR#4i|~w^+O-UR@>mE
ztw!$~u!_>SJl%|wFy6K2`=hWHbqD<U6b6|iTgBT{&%SRRlwh!N)$Tb=n$PL@7?PZq
z%l@&7fbSm*1p&Utx)}9%ip7^oFQi?bD2Ve`Uh@eJrp)JUuj;G5Qj4wGyQ@By#xn1%
zA{r<ML6<ER6VY#P<?cLDtUgsUlwsxWw-C>JsuPgnRXkjrtKzu*%X{B!j$X4w>o&IA
z@K|C*6Ast5F+4NV{9a?EM;sp)64}iQcImwN8G#Gu=cpFf(qcY&9`~sN9_J%e7!96J
zQo$3-PqzIXCyShxZAdwH0(NGd_}jMn&bt3nGPY~yAFl~eJlv$}5PbuCO7XX6--h9l
zi-}v&82{Svl%-=<R43P%?5?SE-x`w7yK=m6!FQ6XZt-c3(@tm=-7F_qAfIQ%#K)4o
z$HdlIeiDcdp;gBHyBk*kiMr&q?@KeC3vz6hwsjW0Sw=vls=~awpuX+txfYAxdH3-8
zs->~II`jovA1sOazb|EHV`KiW*0TRk<lx`AW%>V~a?Ag$j{kSwfsN(Ay5|3#clcLq
z{uA%;Uq#?QR{j5<1|I&MTLxaxKac+amjCq^3p+O>2L~rN2ls#1nEw}Vnd{$P{(tW+
z|BoYcaWitUv2wB#|2w_RMXbZg%+1Kg3E=n#3gO^nW#j^Iv9JQ62~I{17EYFbLeEUh
z#>LFY&CbaT+zu?Ub8xV+{GY^^SvfcuIk>q20AhA#Hbz!%Hg;BG05=;WH-LqUi<pa*
znUR_EUnkAR!N|(R!3lgFD{v103p4k>E`$ZZ#r;o{Vddgt<ly{gA2#4|IJwwaIEY!f
zIT+c1fdK~dKlWw=#)^}T1GqOQ8yh1F8#4#+!kK{~;N)QE0D9G|j4T|$jsG0+e-hXK
zQT&fO{4W`1wtwT%|DTu+RyNlE#B?N2{X4@P;?;~QB2y$q|Eg#u5V!^|PWuhVVqjNe
z`iR6WXrW{JVQb(YhS~jE*SAxebI*%Y^UyGhQ65}SR8SK$bPImN07iqql@(1~kK_En
zsK$=7f&Ng}S6GmKr`Fel?HA6YoG%x+eLeqfUbOj~m`m1g1MC5BMy-4oa00Xu9p1h+
zGRL4+QM>-vfw~Bl1wPu|RUFSqd_`P-9L*E;5F0xr`V{5KTnjZdHEwX5Pd|lmx2t=F
z^Lp)Lz7#+zx3Ua6Nf@ehnp8A3X|za5yGXP_(jwM{*EWA*n|Xq*WK9ZWi*%(`7&<vQ
zCiOQ3@?_x=@?<7zY2UI`lo#V@EJe-ea?8$0W!kes%W=&G;)S?Y4Uxx8j+jaV+#i|a
zIxx}4ZtA%9Z_Ar$?FGfXTu>{AJp)af@^<x(ecE?y4nHqnz!kpL{TDLGf6e9m!?PH>
z0!<KNrvFU_`LBAE|F1U4zxuKN#RmCT`}j|t-M`uL|HB61;$r!Kahcg!IR8`o`Nw5e
zJ#HEMdgD7u%Q7{;^_M%53(w*<GKcn(8y8{|&6Exd92R3129uUz4iplL6cP?O#z~AR
zRfJWor)3~^hNh-cM8?4M_EWWK(LSwJZ)k0+v}0-)o0)!?7J|=KUeWux!*4VDw6?qc
z#@qLC>EQP}5M;O*jUJb3`2@q3-9R6KSpp=E^*4J98QLAFHPl|#dV|zjKI^MqATLrq
zo<++pciqW_FjnF%A#&TxY*+d$Pg%eRrqCBh;jiYFX`KTryGqbZ1Mt|g+Lp@WB$)^C
zKzC4Tdm9_O#p4QoknbSOC3ZVMD4do{o;BXtcUuh2Q}*Ew`9VH#g-*N6C@!-j?&(0@
zAp@EFtn}&B?zTZr)7;;JeK5s0=3x`5HuTpv{6~E~unMif+g}v(mxCeajTx5=4MR~p
zz|Im5IYMHrVa$OhGu#Ostq_8?6BXtmBbyP4rWnOy)ibsjwBm8N3n;(e%Bz{fmZ(w=
zI0X#{t+g}~A{fY3v_k+nn4u>*>dW4wpT?E^ht`1$E2<3BKuJ`qh1`3B<%_{z1fTP!
z6(&6=Br8VndBp3JuA*H9r+Dj%1f03|c)jt@;G8)Z!*#c29KQaqOeP3wUiHR0BTUxu
zJAZ~tS*)E9kno{8k!O~zk{#hX=)&z3=)K$L6d5s)o!DF9^$(&@mG?YhkQZtZZpt69
z$JkhEH0K)gRm;1*QGc=ie1-|g7r(UXFEh;}m1#V|!E0Z-J=}zxvVR0a<Xv@o9~yew
z_4Svm8fZ8W%GI4?k>kRzE>j_tB>;<KV*xsKf3Zs5;ry&c2HPIO{e?IB=I_dljub?W
zc#{T>2Vli^KuP=5Ca;giCEvNRhwexNEF}HX{P-seU^3DU*a(N^@q=Ln$E+eV<1amv
zP6{K+_NjM%*uslaagApNX3(H|5j0(6BO0OP52@pa6Ox{g;Goq<;U}5RlLf+9j#iB;
zus~2~hNN7Z@Ng7yHZnOwfG!yV9uGnChh$AH5M82@sK|&!LUbCStLusCBq_xZ2jGz=
zmEv?7V9Un`J~<Y{*<uIXF9z-Tf-P>ayaVGUHb@DQR!RSc2;(*?#%R|R7T*i_MCzce
zW4ySK!_$euizDDRKqeRqBJLy0qfv{wSfSVz)yf5W1#(Z;o~R7@DUx8NRSav=_w(S3
zBhBs+waXPSTh%1#4d=%_lYWJ8sTzsgOKUF#A=Zp&+YW-}5@R5gv#5Tj`xDWewqqC$
zNXg<k(Km;=L-B#*jnkX#9oQanyTg0AtZKh59giCC7|)RkgY+;Y0eZ=N5vz_U1!%Ig
zlcZ2_Kb*7We^sWq1NiTuADEY2v-M3LfBiiLe+}(5^puz*XSFv+X$s@+=Ns#uoHcK2
z6f_T*(?763!TCh_44y3V=iI{AC-P?p(BAqVvDVM`e-oT^f-^6Kft!yf-Aee*6&b=6
zn!***<jL~-7T7o+Gv}BkWIkC4mMw*LikU6eWXZuVH+IUE7d?Bd@(muF!NgcOi@q$~
z%KU^SZ#qYgDrW-GY^+ITUG#$F5%Q7Y5$+K#{x@oe>Ca@mh`24_#8+F$=F~^-`HBC;
z+e^-i&NGcK74WB8<FiKwzju|l%Qs5S)ct<E=4h)bC^9KJ3@dd<{_=dxj@`3_Ml1rk
zV@U~KinU`4CoH0LHA2z0B=8ftL?%PH@Ux|0#eZ{x-4$hZH-ubi`gJXJWalpEAHvXn
zPG^$$jH7`F_eG|84H9nhCvX?j)etE^FczE(uAd+ue})$?0G1I4!JY>(-<x^p``kRt
zRxIh!AQ)?)`V;FtTxvk^Z*mF!Um+HMuqh8HV*}R&r6kBG#eD#E_xFXUoO&jIo;l?X
zx$?jwFx%u5;EFJsegy-pw*jLaW~m)!&s%`4s|Bk+B|U3$J`E9%!6UXCfu+r$=T_kU
za(Mj@tB(uc?&rhp<<Yq0Ws`&t!JTp+T1#AktL$fA>9SNMiCTM89tU7#B0&GDc(;LW
zEbwfIb}fL>@gqVp3~5F-A4*;6t&9S<M!0W8$ZtF?YYBItUY^e~*5{KV;o}d;$eX&{
zH$No2=%0uAW)<0=yD(-I+n+bB14M%$&aI|~RxIc}v=y|jnh7H-AAe6y^1so0XtkM6
zH5YHbg2%`$+4)hc)3=Vp^V{WRbj@re6D=#OQL;jH*80cDsen1H9H8bbTfEF?|4wE{
zk8JX0K&uhGGiX3;5Q~6W2XKQ?+N7JsxRsa%vu~n0$2EuQQdtUK4l8b~Ut&A(%k!p<
z@dFs!OmpORc>(Iv9^=jQihSx@>AWk)<9UW|N9ygm9VU7z`igbRyG4YxjEY^$KQ<~`
zD_NJNahpafqE`Q~^TbIMr=Lb$0jkd+2!wEIT=ya+O83pY8@r|_^9n;2W<$o<a>Eyd
zQphEDc&qSrlTCRXmnxP_d9IsjwN)luucd0v4f`i)*cq#s0h2(Y*%Nz_85=2zFjY-6
zZ&4{--Mn}Gs1EwGN%oLk<4G`stx;;T%KE(IBi*}Fs8Wpn;bZcA3p+(TX4~Gwrejl2
zt?6D$@-0`ZNZqGmfzaBnIRdv7fxym6*`kRUKmXTHYKSN|4vslnmB}*o%IzK8)RVQ4
z!TorxkO~W$Gen<jX7e!nYF<9NdEARDXxGq-?*p%7GskdvKW|!kcUK2*g=5p`Mlor7
zv+=$uaZ;a|k7$G(R14oM<6FkRD(ADZb+x|divuo^MVhK1q-)Yfw|QFRQM1oN0GAjd
zO(8L$%#++HK5>FDnAWjT6z!A>-!iB~O;UqaO@*xR%<6xe^;3)b>3_3HE#gl&R78wW
z*%})N97BJ)eiuoZIRdQ99dA*-ObK372@;XHp!IQqeG3}r)y3>1fEgd$4q9sAQ?pF=
zgYivQuw%}shg+06XryBpjc2v$ySh9V*K*Ku_`GJ31s5M@<C;j?U*hq!knzoqB+nF|
zTq=oTu9_w-JxdXnF-;biSv8AdcG4n6hgc%IPqP%Vj-IG6w+)`M0<KnR&5HRh9?KuW
zLQz_V-WYTo*S3rGDaz%$d(nt^>vpN<?D&-4-Joy_%r%SHhcECY_gwckuTTjKNonLa
zmOycK3>)pc`LoC0pZ?NXmlhx=-#?+|`~5XV0T|!z@yl0S&g}SH)3lG1X1mvaOKPo;
zXxv6nz1o+dgi&^#PT%q7=Eye{xKphB{qPldqk#qm8q)#6_!kIU%F}9&ZFepVcTE{)
zbw65S%`42UU$^d$Pp6vlWqv1#!sx2|c7D%Gn+0Y(7ZH*FF`F?Cw=&X--*f5jCOsLP
z>!~p)V<SDADB}ZvF`|E1x`U*ozM-MLVgq=)o38W+WPO<T?H+NyEg*~MkCdJhP+H`2
z>xXhkGbr;|FrSGnlAntOZ`!dfV$_VB0B8x7F6f*$T$X5CdOXD%YWs6@OVlY6Wonf-
zlkE;Q1bw{ClxA8n_|xRCuyuMfhZO`hwQrVQPm<H&IX<Vh2mx(O6}QW?dJSeK%V%f=
zbzy>j_fckPwP?|I4h2m_q3^(I|JDco!i82J|7+D-$Hl@M>o?<LRV#O;%;8FDM+*GK
z@jH2eaN-1^6yPQH2@n1ytCysEBf~*z^8_~A6qiV9J`G-{U(+QlttN)1h90}W<jL4}
zBJ0Bo>rDXgh>O7kOaz#C(7k^uZ|PM&l60sVgfY;Nz0Z@>c%hC0RHc)+lw;;kD#cAV
z0pc<q<`POH=|v4}lQzdPY>MDx&#)@WDzI?IYpT`;92l7Jftn>ka!SNiO*Gsv?lK+M
za6Ot%w!hF6_>JAk&AC;yC7HH%yxES9y1?&fUbg$xylJm`1>Y0qbW>jk!yCKWm|l#a
z7VOheWH{#ZnoE4w^B=MD|7xkJST+z|`BLDk1Nx|6M?2u);WIJE7XUnQLD(m$TBXXY
zv<J($>8jQQO<eI`q080W>SasimN~+Aq4H&&WWFM1zNx#VF{OS)v^HJMbxTJH0M@LJ
z&z7OBE!e~L(D!}Q#pH>TVi6Ui#_eG~!pDVbKfJ7&&0WusUc;5AZM+k!&SCpk=TU`0
zLABdTKIi<Y174Cnv3~xQ?%B!b2aKpTs-3LyxTQY`)_>e!Zf;^`qM}ZoAqH|QB#f&V
zm&;RVs1l9Z1qF7D3A6g01om@B43#rX>4l;aRjgvf-<1F2q&_^RKL9I*NWUA`EWmb@
zF4n@Slq|q=BeN8gWkyDObi!N|Vu1Eq%Q~sq$~tL$GD^|RnUw9cp+=F^j$TcqcDRG&
zCL6m8)oy~L)l<yL2s9&ic+EMy{dJlStnG5$siw)uZRe-g^q60l1MRi?oPg{J(_l};
z;Fn2>7q5g_U$^h3i3zxNx*wo>KFbnL@JsnwaIP2r8yeYPXZKGd)4?!5(61hx)G8-S
z-BY(yoBH$>tK~G@ycx5*5#SWo@1<V3onu)*eaAF#cJo)TDuGHBUUEUU4vj>^{Y!?%
zGQC!MhIzLuJ6fvhpPp<GaYT#s#6&QRzv!rq;?9&vC_qe_AvqagxIw-6JGo@EZ0N`Z
zYLThvf1~cNV=D*#wNEh2%*+fY%*@Qp9qvGfnVFfHnVA_n*uf4ncbJ*>{ARVQd-uJ1
zcjljwM)KEXmtD4Xs%-iAsro!F@&92-FMr8e3xfk$(u(PedBZ-4!+GGzEM3%NKPah7
zF`81TyJLY>=J&U@+w(1jM@okH>l%CbM5?|3mY%rB{<=u4oA{8pugCiCrgBdxw7+MV
z-tS@WevgYL-$HHE(fakneU_j3dowQg+)KD3s_sFNqJUF*daRU<(vkepZ`fnl%mQv@
znn3M54L=TV22Wd3F6<>ydbh>vcL6BYh>dKE(nvO4tco<YcPw^FX&|fl_e1vQ-vpta
zz$A?r-L><J<B@$-PU3XzE@k)b71j&=n}bK8w>#6mdur1mDW&{XmV5rof?xguFDZBC
z)%<t(fZ&}_?vf%9CP=#Sxy$uR*vCl5zg4-}%zU?o;chv%-lv35p>f{&Q}^lEHF8Gu
zHLkVzZ2*7ou0mC{0>=@yxFGKQiNihLHJ_?k(;u?7thGE?MoHZyN@_{8i&^DKvUgE*
z@X)p{M%T{0U-WwZ>_dHp!%Yy*a5mDnRFQMt2NDaJ9AxTPu`n}}5h?r(8X?9%t6*HQ
zn9%5Nz}-4PQHfAS15rb#PU-0YJxz_JC1v8|LL*x0{6U_!3MbFR+AY79yT+dD4PXB)
z8|;;bDZah@(fTHE(Okiv0kZSGUY@7Y8v~aXt5#|<*Si|*|E_c3bJ}|re5zQ)cXv6@
zN?r4}lyS~xpWCcCv--RSw_jgRXt{Mb0@>#1{p4As&|t$0o?J|2F&ay^zdqg`TyZzp
zS}^fi{~X<&x>#}MC!Y9Zo-80(m#OFG=2I*l3g>`!X3~eJ;MA4LU>N87OE72^y^ptA
znYfl&j!>f6xG~S<gpiU!sI^Jk@``gGghe!rZHPBft&0~SD29k#cOBQDnMyb2lC$Jp
z@Wj-Q>(fw_QP78{6O`MN7_eF&$HCP4tm}ArEHiz7t;A3G+rO4vhtGbVwaX9gZSCl_
zI&W!abuHz8;^T3dlCdxeD4Dzz=la7L`O$tHzV;saD0_LF>=E1f5Cm=(b{0*Y;+V`f
z!Y<p&X<A5nWuX;_H&6VW8#`^mYmGY54%>xYqsN1sSfg=Nd|z!eEd6DVMq#-K{JSOd
z6Rjl5W=vYt)Fs2=a$Go><j>phaba7t0)GnJP}LMK0nu@QbUnmnki43GZ8Q8ru!wgr
z$)n^sdhz3*`7Y9*_3djtL?SSyt&otBc%cdE^YhD?)(Bn#f6<i%7d!<fp=&|*F^188
zv)8_yiN~=_MkJ&dBZrl^cr#a-5*C(WRlY5EDKjrxR6lzGU%&qTT|56}IBRR3w_0G|
z*lwEu{?ks~T4C{wqOH=<1P@b>sy)RTS+;TtP~yAQqYM9wpdbZDN<z&>D-`4BCNt-<
zt-7uP{+O45M(a=uZ={Za5%v5TeX{Z~H#JVS-38;|JhxOr%afD0-b&7IDiKiy19wRh
z@;3{T!mc_#fdryo9s&YZ&#_ITo&o~f^V{>XJd<f|Ml~M?&!(UKyoA_<?#I2{_2pG%
z#2~bJ7Y8N6#T3&qyp3`(#p0bUX$3YGGGz*hUUy!i&5$yDk|sH^Xy*wYV;xkL%};0S
z>p_hZ95b+PHj8XU_R>d>NpA9{>5e5UVrbXQ>!EdW2^I6(@98$)S#=K;1i$5!t7Hq_
zSE9rfw9W}tn4`Mcy|dAF;^tD@1Q^*1iYx!r6{s9DP|84REV**ZRM^9LnRf_iu(m9@
zhDUNPO=0LTlK(sn#JY$%HN+({ul$1~`}be!-sAWULaV1a!aWQo+IfZYa?~89ORUW)
z8eK?R8CE0^C7#9WZKLIzM^e~k*G96}#+!{%F?&(pw!9MmFgdPv;h@52@F*I}d=eGP
zqXKX6=;>>SJ1n3vxnb<ORqLv1$*cwkanAOOlawO2t}a;-n(f!)qap6=CmW_ozN?8d
z;AVWB_$*Zgr&(2x+SNif@U5;+d&(|Z(cRVDjg|+?W-7$q4WiCvJOb|rA!#OWb#awq
zHzV8RrbYXb<@y<BnM7XIdNsXl*!5dTG&CB~UZM&CrT!fu>eCL)ULu#c$KTx$IRREl
z+7SD<XVkt|ydm=yY62W-j}|FO64{OqJ~IAeNf>DR2#22zLzqOkq@fN+{qZ-eHZbws
zf_t~%uv(sGG4W`5H-xBp9^@hRouos_P}KUDi7YatKIi@M4u3d8Z0eO>+5$tUz0EeU
zDEW{0$b8;oQR=!$haQ8`^Ue}g>QVZN^BqXkhJ=T5cR-@930_-l61en<UmpU;Ej`TS
z<H_tl;u5&FVD66bMFpK54jGAX*)R`lzvIU(5rx0{b3IFA|0l8OKc;d2i*4QiEH)|q
zKb0oV{(rdT{TDhj`+sr9`_K1Zpc5XD1O7kAP5+0b-hVai`(J;9|L=$7|GUMe|4tJJ
z>N-FR!v76Toc+IW<NtRu1uHApf0HTxJ5AghF>nv<#@Hrv1=+!t5(jUMdxq3s=)x8E
zf+TVb_;wvH=c;kYcH<4FX&N@4EY}gjp%Vg1tyIGke9zgheCfuS=vZ0jrN=rG^?P6)
zE5LvMFg=HpyQh<RH}O`_DT80Z!9&{DOuwE*&{1-dM0+K0IMMOdZa+K|)gv`GMQl>g
zzC8S|KfaNkIJeg3M@Qq}9$M_E*-z1BI8t%wUpvpfV+or=U!{1zeS14yl*4Kc$o{Xx
z#DQ+6|HD1;zmp99*H-a=S}^!eOZ@*84E|G7|4lIXFBkOx5e!(lS=s;p!Nj>){=4(%
z-yUxt^-&;9e0sVwzq$M5LI8W*E=}J>WHkguI0O?7O?sFzKqi1gWCY?I5(VOV1+EnA
zX(_0-Z9Q7ls+Lq0RudHy)^MSU#85Xy7ed{nQbK~lyU+Ld!pZ9L{qp@wa7W0GdLom@
z@_3r<ewuCeR~{@12s3N|2(#z<ZWDaEiyw$^7szf=bk$jQonfmw$PEz)%JXcm(@c<~
z9`XlnKo-bNbms~nZj&N@3xos_x&R)aH|KVAwI$>aKd=NrQfHg({09ss5Kb5&WWjCJ
zH678@afB-1A0WVfYs>F6b?U<A!yg*v8bmqt$<rC&YjbDH1~Og?!d%nqyG=0rXF&#p
z^_}<zs>P_&BlA`GiV<YU0>tSAQ)@QY`KB^?2dW?&^v77La~k6hzEe363Stm4tv{Vk
zhBs%dOdxtt!jgcFx2(}q_DwKhN#oZbiF>RZwhAto0$UIiB5)8WIA!L*RZeE%&FMg|
zghHTUoFDV_%b0XLT6qd+|ALWe_KpK8$ZOmK49F3=cT}(Z+JGMaeb(?!1jycLzF+w$
z+nMvYn#Z82bKBvMw-5M!uhF~(cj+|}e`JsrHAa*tH7DeVf(RkBDNyOe<fiaFtTPRo
zB}&O#v>d;jzO!-(vV;)n5e(!qOH*VScZl6WHm}Q=O%Tv4=m61(01yl^2PA~xL<dm$
z0Iv+NSY~+DIWYKLs190_b<TYZS(2G^eVCn~iMfPIHfSs!*NgrSccJ$^Bj$%cTBlqe
z^1<G_3LeRaiFB;#n+je3yxw^982&~@y;QjTIzDOtu<XAl7b>t-zn=STmF<%M)#sS&
z2;#4Q(p}zJ?y0U+UcT7#w`<XB%DecQU}t3}-ao=W;#>8*^y~a{1)2zfGbCjWey`rS
zZpI*Kg~{IZtKnnD@8qHWUw`{9b)pT~inw4*9m4~b+lVAm1hTdUd&f_Wc_|5E%y?)J
zTnn-?NK6nwC_bAfm~jVta`|ppG^;1nC^JPe_Dlu2C;)=Z6E+BhnGkD`zXKv|K>ugB
zX9LceF`hoe{SQ=q@cTXM4mdJp(33$F9I&YZqT^wGZ3wMl4hIf>sA$qV#9!<K{6B*!
z9U$|k{2AjNX!=87Qf}SCZ@IqL@3=egum-{W^1-9oK6#MI97y#+wS*z?eh9XR@G*qh
zye#r}ggt-iW<aM8dFE(rWl=)#e(#{eRtD;NVdM=9`Cv`%dU;_G6-(`rdSMu1PVV9s
zA|#38UZ73x`V=D6VN8-p(FAXVvS#>M=xGaOkGah-pmzzQqz&utQD%@4d`a<wF2fx)
zXyzcRji@xF#f8+CpLPAHeZhHQVKRhM3$Za~^zR2HvbY|=*h9UE68pOSMBhy^gkBMP
z+&hwA|MxH~II~#DETIiHwTA6b*Z^@Bf}t-h6b=swS_Z?|kh465@uqbHN5@d!Y+U;Q
zuN`+C%4_J)(>8c#%-9VAFatMkngio%R2o2u50onS(J(vkqh6F&0B#ibWprNz#F73m
zLT``>;rH!oILHP0OSry-4=9NMVE`gDiaYq6705nd?yGp|Q>fET1o>e=cNHO<&Ax3A
zunPGfK4d`f#x#CFY(t`u5ggaxr2|(@Xt>f5aR9I{pHg^&F@?OJ$kUJq9u@e+J%|~T
z4_JP}$^@es?`@*>f+ExqovujM8jcDDxG|f)L|9_<MD?M@-meb0Ix_D)#Gj;N<HFjK
zM&!>8db^rl^!lUkZ_;m;%20ZHSKrst%Ddm3#B1;;;7mF3-_$GL#jn!Vi}}7G6vT~S
z2mbRCF*8j;`EH5AP0a<nXIJ76Rlt}8MiekMwj%!>0psIJyrq{9_1C$gI1?~VT&auF
z-KdM4yV2+6y3pr&wjzJpxRb3f<VF~7=0=nOv(|v6YOcgxEP&a-EKXpFSYVa}Fk*n&
zUhZVPwZH@ZQxq=;9!L#XVgk6S1bCi4KGaW5cQW0T+z7=BMR95u>Y`TQ@fCn2fSYQs
z6veB7djnM0JX_H&$%c9Bhf0d>W#z-%3<G66Puf{%&wB`x#ZP?X!(7@-Sv#5$lka(%
zhRu{u_~oJ845MUvoB>oPZiYb<Jh{%yw3oJ{B_+*}$@??WEVO6x#;gU-oK%f7IvE&l
zGb0r1YcVn<&9KQqGm`Re?uH>U{WG{3hwh4F6!p${RGqnq8HX;4qZFGwkjcs?X7WL~
z$;_}W%clF+A6Qg<GraOWx#%p7ywpET+?GxDPiqE8ws?rpwJbTPBp2#bi|+B!Ar)dH
zgQD@!A=U8FAP=h1AeS^EgC>&EARmE|=qk2MxuT#$ji4jK@1D%zF6eS{;4bKWLVSg>
z(jxTt%Y)A*xBrKr0b6uUrVJK)5{DX5*4;~rW%-A3RENcxm>O~Z<T5+|-y08beCLBh
z{L>VCU3+Z@a6RTo25qsh8Y_e5ABe$A5Sqz{XOPvjHAGFkonDh?%S-T@a>qf3VC!8O
zErw!P>Zmk~kRbJ?6!Ze7e#8`c`IsLuVcqB|{_bRF!0IsAimaH=jW`1)%efI%zy#P1
zCV|P{+=wV(GM5|CbS0hwtmYCvRE2GrZ<3`?W6C$`ezdJ~%_94*lz&8Gkyp#9|M0WW
zd<`^;>S<*kkekpxdrQQ<#VOya3dD_!WgpC|#Er;gU9f59GrGIxD&nk{P)oantFD;T
zpNp4Xm2;~@QVaIAdZH>jFvaFEBoZ-13gKv64Vt!;R|@4bms%ndmi`cK^HyXFy3wPU
z_*-gx_<I_#r9D)ik7qCcZEQ1gHjr9tDMR|#P77n2eNIMbzGy;dQ$AyRhO<!5qgZvK
zgfDki#{Nt7hwXjGnj#)McFeZAj*fuP0_b8kZ&K|ajqI?2AZq33aUB#x2gH6XroQ9+
z`tM)i-_R@j+#nR;3iZ*7Im&u$eO=a@tMJLDl19vDABp5)T1eG6KHCL>rK1wyCZUkV
z{pMc!U1fAl6mT(UINF5xJ9wuwc9$qorma9K7!N1)f(rjh40bJHB2Qx6t>wyTM9ZCZ
zVzUj^i8wFdy*x{%+~Q7M!9-GWutEf!e5p}dN=buZLBc}uSCj;=rp9O%Ibkoq(d@k_
zi@yVKt#}@|SK^t2w?;{Di)0nwZ=;RArmj}&IpHRmmEWVk|13fwhA3nS0yq_k*-?09
zP2o8c7v@7Oe_B0`D_~$?2VMS<SaJqjX0WzacF{56{W`w>L114khPOg`-$r)dID6AO
zUKY3kL<O1;QPw&hEUcC~TX4BH@capesxw=n*8*HO>=T}hRPoMqegTKW51e@tf}3hA
z5#DMq6$H8>mV+c9HIBzfX!;=$mT)Y4A6{@dv)Y%C-8&C3Al+hQ@s8)%67e275~9U1
z;f?nB)YHSJBjDj&cDPz6-xCDN-SLw0aBpvl=rx*ow^1;I%h~-&%X#bJz#6TrvitL4
zxIuK)@t8DT5J)J>^38aL5>;iol!&Cc={2$GCVw)mhg)6cbQ4BjM5nryn3Ifa^H@e2
zTy47Ktji~T?jt_@w=8b35t8t0Rl8ht>u(v%%;1NW!bkG7CE=GN;T$j5y~fz?8Qq0e
ziI=%e>Y|7(J!h*Geagl=7h>$8fC`dWA@2J;D#6O%!Ki92P6IC;DG{6PQo_XLDKZ7m
z`8YFY=*&d|o2-?XW(+pInYDcE(Q2OiRAu!~rPk(D$3v$?G^--d8eqp<F`B5DYm_Jx
zQz_SR35)PU{{5IZLQE?%&xG1#$C)pA#Od6nIA!2zelMAz4l9i<9ZO^v&pht9&@wGj
zH&%%86f-u9@o!N>&-7nrsp0dvD3*8`F5wdLSF5lr4$9l?Y$`={jDuXEL}TR4tlOf}
zN4daA$U-yXX-ygJF@%v5GE**KWMkXJwMy|Osbx9XM%W1UyDplzs#$X0uFcd;q{`OV
zt;_o0<6rdzjZeZ7GPhQe<3`sIToIo25EA3>bU7WpXq$aZE~h$oUFb1IN=&a#D!97R
zW2?85t(GCNmQVSed3zEbT-#kS>upR(+X`{+Eu=PDDHPvvt0?lcYV-Z;I913*LYzgR
zVOkY8z9_@dVR2PUs>$GNwyK6j(P8PWOh)6abG3E8C#f?=Bk>3X9mB-On7a^E7HL-s
z`hCrd^CZJOVD66yaM++8{Bupje3|?s2)K@={q!Fu`4^tgZgW4B(90z{N<e@wSkMPi
zP=PPl5K5DhFw)_wkqF>$-AIJ!aKlJM@S(Xs$Zu{|5b3k9-<JTcU_cNFHDYy)6i($`
zjwYny6LO?r?h6e{c=`)1>PNsQB!*byCr^rS<0oW_Xyhkk4mjo0i31?V)E~)_dqofm
zoYamuScG|85bEUi{Rj8#7vK89(+(*p?EAGcl=;(6A;ILu><^lh4gX*`9BY55;ew$r
z1Ulo4Ph5m><0lmy&{W_IHuY&|*9XVy8&Pub^~q=t%#RomdsWI9A*SscPDXm&KNNmX
z^j!^S>iXbE%_pt;tv5$Zv$rvSOuKhs*p5x%@2gPQ4?$GxOLAps^h>2(J?42qut#M}
z;y@W?OMkHBJ-w$fW=N`y`~me0Ykx4rxgY)zi!Z*s^36g)xXgdPZ~#HLPf~L**lXd1
zkvl*{xgY}Dt1lM&M)(iT=_X{6s2!%TwI|Y_d(WEEYtY6>EvwLbXg^zpLOLBHeNh0R
zau>+PMANOv1Ln-Lf*`*fGCxUM#Iiq0y=X7`2Y}WV-;jNX_m}+xm=2x3Aax=38^i+|
zAATJA#{MAiyL9hN4JdU@Lc%-YpOzg^SnK{_qYdL<Yz%=m7ed3W4XfM8a(lYoLJYw+
zm(P2=+SdKZEBEh+4!NI#n=mUI*MkZU!JkB%2wdye!;B8az(qK&wf9}lj<s#*_WO52
zhw5JBs}Q|Qp+Wauw|6B6>`kk0*tB8y3tu1xeZxQG`tDs;+xQ!`4|=C{C$#(37qg}X
z$Pl~{csI}nci*@k5NKHU!|p?_zWfiSJoXc56aIPCe%SZM_x;xkXn%dE_hq{=;ihFj
z<n#SIvT<%Nwjad#Mf)!3OJOfIQ3&yx_ukmY7rMvXHazlR@Kg2;^T(<mx*wcS<4#Ea
zpwh+GjkCx2Hh6zP_@%%N%*Wqt@c5zG%dLjI9j*cLC%YF)e(US7*oJLCa6icY7Nc;Z
zVWvy2U6$3K{h<AUu}|kW+#l<HguJ_4Pv;GhJA8YN?;IXMJ6yw5@5ncLe*S2@mqG(r
z9z$Q?E`#V#*T(d=ZQi@I9t&RrA4pvnJHv|&OJ4%~;7V)tL!2+UTi~-pi*Cra;g%Of
z9!PC#^#k`GUts(;{cwCQpAsH3evocM@J~~7h)k>X1AtZIegvl5_o;?OKUl*+gD1Hg
zy8h<@IbiDT_YK}-avij?`}_p($lciq5L)g2!SykC6((?#)r-CzvT|X!3U9x<b%S-$
z=03F1u;GWg9VqY=eFL~?bRQz#V|<r*LGSr>9pHNt*9*QK?0$*8=j*Yu4f?(p{{(+y
z=`rgED!BXHKk)tp?+~yf6!Q6W?||}UB7_|N^2tolkRKku8}LcsgFw7KJ4o#?w~ZvV
zoA62SFl7AB^MZl2F*{_mXZo(g4JUPRdBgRuwSCy~rm`3D3(3E=eUOFQ+CF%8ui}%z
z2h_hgKagqf`iadUXQw~N6qp9>^oKEBl<!dxwC9Hj`Y8=-JuUtK&aOd7LJT1^P)W~|
zsbd1ianRYYpD&Ax3B^@X#8r}L0%(FMf@mU=N^al~#8D(fFfwUasZ=5RF(5@SFl8_r
z_0^Py3xWbdhj5u8pu>Q8ahgfAAa&t1VKhn^O;1QrW9g!iK^TIt!+`_|l@TX{<e4B+
z*dP*f0Cd=h@i^<(UNIP4IO&uwRM^Nn32f2`L?qn{C6fLSK^i`c*h~Llf_X?G4TA83
zaH>d}*^xYswn%~*m9%`SIj-?|5uJ<=0YFR;Q49lgjM@@lxdM(3#EI)@YJdtKGrzzG
zYoUlh>7<$Iq?n7OWX=FDg`v7BL=E~12r{ptsY(hg46Y(U&=3HJ8p1FS9ahGGL{VcE
z9d?SBb1cI&mPR8%N}YxzP=O0CtcohK0t+Y#E(@Tm&N|!2q)-+X!AUBDNgC3BDIGDU
zVNHV0$XjGy?GG=s&Z_!{i_;Y)%(3K*2jwQJs;;66kzQ0q5EeDpuz6QuIjBr2qso>J
z4vucH$gaWRf-1~`5?1!JD=oAzXwtZ%il(v%zdr@F8L$+%Cx9Nt0IoWU%Y4XyV6dV-
zEQ|wSW}j34Gbhj!6vND}v1q1&Zmt3BA{7==Q3=qHK!eDy<T=a?EHt({cKY$7=)9}Y
z3J_A*Iao@rEXKtKEbF4NVy1v@uE5Hn0Ij3KzEsS^{ITp0Hav$Ywz36)6}~4y5M$F1
zbA=0w15f2JNaC1Sa3#c$n0JjYv(hHIIW0G)f&16<x3fbHo0$b6U2bK|4p#U%07y!=
z8y=&lDG0Xv8CLhNtK?r&<vEmMLS1%OnXxB|@i-EKh{}L6#^|^{5`w&b*wil^BBWu6
zcu>IBk(;?O&W~MT%q?LY!w*#nxJH-UVVKugApCse$PGX2G!X;=T^@VrrsK2RxWgq~
zjzho6WLz*Ee7ICEtj^T)MINULP8z;$8ZxJX*|B?zD1D0E9AsD&ctO9MaOf&_!P2K3
zepG~Aj4^4Hpwt`hss{BWZ0K0Ph%JK9&gOQ$Y}5ZR@sgjqeDcBsX(#R>Vm2sSLAZs(
z%R(edA1m$@h&t8`B5H?*oj<tiHUKbOryn?`f!q-pKqIGF0Cv&iBF%LT7Z09kLGnOe
z6dE?uW+(SBU2X!#T(ZlqSTMJW!xR=FwwUGJ=MLOVJt<~GE)=7G;{3o3Gd2hG)x&4J
z^a%EwLxR%<;06_7`w$roq>s_#{Jii`s5j3@v(B*2Gxr>H=wx8C%_3rmKh^`n>GOB4
zTZ2R}2b_Ln^aU_|GvF8w-&KW`9(nc}I&|tAvW>ASFfc{E<WL6mj9o(IZ(Kf^19p=G
zWtdSAUVV9t5eL%Yc|c*j!1sQHXgL%YV%<P}*yS6!zdwNW3xU|hk6r(H_UzU6y9xj?
zb6+!yhYli&r_SgMP=cc3*~{5fW)_+Sfq4l3KneNW>&XG_34#tnL4Xt`WkX@*2PMaX
z3ms^wQ7#}sxiNk9q$CY@K?yS#S#7FuI0lQOk-u}gzjq#j{4@Y5q`^28HDs>$H-xSK
zA%Zj1S-43+pK{P7dbOXEqkr?(!&5k<OcQY=yr=2J(yh^fgEOw2gAj$>L=2BSi4r8M
zPIU-95g!T-3ibT>m^8>(+1Ix{f|8Hf8daqEpb6#Mt|~n&locS@ky<pWPai`?@`Z$x
zlh2?L(1RGh$4w^_0_1^1W`;<^{=a$PiKXJ8qM*MYT1p~1xt8vWUiXJ2B1!vj=)Z6H
z_5jB0ov?bo0D)XXKpzONIwdsHN~AWpS%*5kimM=cWHnY+0ikxOIyr~zuOtvN*a$g_
zk?jnYUJH9UI6dOlb}kkOAkhm0R(T2mGOE(t>-31vz3;<M*T-1*Ex1qUiBXW*AM-JR
zWu)Y`nbatSKm~}*zJv>gi)`3ahR5LcInaZ{rBz6=kWH5Zs}8~Y8NxaK1ePEYhiiK0
zm$QcMV=ePa7p6m14dca_EZFXRQonFrUOp=%d|f6{^4)UW$F(T6IQ#gC2&0eeZ?X|e
zFb6bLD{yCd1;A#&sh>5)Q$fFgtLCQIdzN;gRjTUJ{YvbjM5Umza<AMsa47dGe;~wJ
z+}N;r$|`oC1CGC2%;s$5^S<ZRR=THg#&Bb12@wZZp|_BrFVf`6l~X;<ub2G}nl_Zk
zH%c{B%F;@d9GNsdC03RM+YQ_-nb8;T8#WJg3x_=pBplh?XkWaLLAXstsK(J%)n{?h
z_S9kCO@B)N?)sKMET+e=SNtw;TiOf+pRKH~uv73mQLw!wbqZRZHv$VTGOI{wZ8o<B
zN6$c@M52T%!TRCA#PZx$;-w0#x~QMKq<1z>`?q6(1JzHcPB|oYQAvepniJOA<mjt}
zt=7r1D&(DF3&t_`uJ&{+AvZ{)aE;D~N%IN{#Zp`xi8*ES#o5_X@pfQfvmg!Cqn3e#
zkP}7bDZ5D(pj6FxlC<C%;uZNQlT>OM@(@MJaHhXeob9jswvSFm?OELu($wivanNED
zot$o!Dz8azb@c6J-eKPLHxYRuCZfy=muTcjVaumUw@Q=1rVK*rZW7Fa41d<jDZ#ci
zQ(0Hl^iM}s_s&uvl?~_Pb-*G&-sE`KV(~EZAX|Va@71GuYLtzb0^c=vStiR^`J>5^
zmH}Ee-DF%IWh0cN4HnfF9l;hw-WE~b7VgcIFCpGYOt1~25RHo#F##mW0JRTx+Qbf>
z?Mf%&sWgUkJ-sp}&a6a~(mLJOrP)f>HN!Ei;EvP`u0ky#IH4h6xe{Qp4?R6HSu-V=
z({cm;+xxeCO{BelbZRDyX^udOd=NeV5<Zvrflp)Zy2;?uviCBZQNZ}TJPp$@Bo2Lv
zAe-)SYZw;x7?})MI5N@OMRELBTQrPNhxcmJ+9`6TtYqTS>7P@%1>~}gaq&C-9kCGw
zJV7t_L7|Qv0LWX)3j<99H!iOhnY=EUT8H$6R1Y1ViTY`iklYzJ*r;#`t-;eoNgTKe
zLcG+_$?$}Jx?Gi-IzjV-_&O{k85><NDg3zX)1!w}OUd}|h4h;nnY|1`q^`+mgK_E+
z)+<A=d!c||3iEU2PV6ej{Ya?rt`EplQU^ZR&4yXrPcM00>KncT_sQ!%!27rb#1z{a
zmmUIkE&TaN_`P}n8#((V6|UWKmV!lh=d`}@w*909&Uv=MQ{tg8LH_C3ZRS@(m6e=t
z$->G%n|sDb*xhc#ps!3&jjSU$9000R2>HO$Vv=kus}cM2)zSSbz7m2=;xq}6N!}1u
z*eEIkz&&=r$P@=(I!yHz%<1BF(ldUp+RFc;=nahnl+Iqg&(pI3dOngynOp?#Tz9au
z0|!!{P@gh7@Zly_4+|VX6N3v$eyOEboohf%1)m4GKz8QOVJ?4Sm8PYWY!sqQAyyhZ
z8TVEF1-xrFg`rngvzYB8g!V|slQLn2b8CdXh{9xY=aV)z=7%i3;cC|!K~z5;EWMGE
z)&G|Lgd*8Q3}I|v);X_b)NFrDqZH8-v@(^${q@Xnue?r?s45&7Y+{EiO}Q;=AKN~^
zacppwDs5NCY17$dxK+fe@yI+=Mbn^zDt8;!i_w#(^A#~Qd%M|PPq}3JbS3wwy^R{I
z)=TaLMV>$Tk?3II`EWIXvK;5Jc_A{`(>_+2jFS|kZf@SdZ-U4eH%d1-<)C<&gb<$|
zJQ!dUfr(|b<~5;<_OWJAmi2Xh`S_>Oz1_dfXZeqibh%L1;pr2xfygvI@yps*JieCx
z%KgowlGKdn?UmL}cEAS<v~a?Rr3g4SZnjILu|7{x;+};Rj~-js#b=H^&iFr+YRR+%
zTyB|Q)J6`;;&}@Oj*tY+A{DV+1jPu4rg#zocsr{|zr-N`m~A>+9|JYyjEeyOK?}UW
zlcQxSSibSUrX4w?u?fgf=NY_O6`RF0>!4$mhX%#?^Ab(_g^fq^E|g`t$33qn6{y~+
z?LHm0Qr^5lqEl(JRa&3qhqD)1i@MB7d5}!*>TNy~2m5Q9X6oTCRd^NS^>lO4-eNDp
z?d4$AF&#FPcyz#&Os57B3B@GVuk-9NpMz_;Z>lX}Ke6Q!>?Drp)wbmH?})FKYx<Po
z_6@03=ly1sASK{1G?FGf)yh-SAb^2*Pz2?Ix&I`eg7P+rlLwTe7|OfM2psG?zH1-g
zfh6r8&o~)P3$0x05nM4_&wY<vkF7-lkZ};MyoP?4;(_C#kK#f>R0~f=?b5l`0^pW&
zJiv!+OrCX)0=l#Ih)jDAYmf0w9hpRwZv(5gRT3d??0x?>_gL`oRsh#<c2q<Y>LH77
zx>rD-@*!2b;@N?WvpAG8r|-|ty*;`&#hq|;?A|v`-nr%;ztKMwT%WfF52=F>qp_#Z
z^zoma*SQks^;ESLIm#J!#3t_}TR%hrGJ>ZtOp}qE$uhcGR7-!<V4c(0$idQ!!sM#p
zVK7BonZ+`w8Bi%CgJPp(WtR}oHt6V8@HMK)Xe~mH$_Xxkk4a`8gi006h$Zb)!z;rR
z!|UyRtU*HYA{TsaP`eq&%^b?kV130CT%8FUhupylZc)4)im^fqVfl*{4zSKVls0v;
zOP&xz`vkY(!|5b$xnv6BJ^CndeY+lKGLRjHVMsEq-b7tTfESOyl}su3akFYC<&tIW
z>afn|&^93>Eue_!Q8XunB7v|@)D(3J!a{N?Oap;24s#*=guOKXMzQ<)HU9g_tV^iV
zPJmQv)5X$Tck}a7`)!iGoWTF2_5s!le*RxUa`3{IQ2)7i{QidnqY4f*ZwN`^#Vo&d
zWch;Hfz<;{9-lS10w`QygA4TdZ$d+LY$e*5;%ODj^O!#S1>$D^p^h3NPp50z*rcJy
zLvLHY?jSwg;3Q9ReMOb$>J+@v(j*$%3q`seS~&;`VYzbwh&;Td@C5LAxDV3}CBf0(
z`94twjn*1(E7h8N84xix*xqxF;(%4SC|_=#=vm7oB^1KCC2IxU?lyUJnNnHp*!7B{
zRdj3E%EAzKTzUjJb#t_NaU3SLKiBDJs~#dMCC;IVV2nxhW|Kp#g+pK}l7dHWa;~fk
zzaq_LT%E*MN_jm4G0^11>7p~#qd4|e9eX<@_$jJL+}6fA%BbiJp1#a5`oZX|#cNAt
zN|YzxWh-gMqY5G_Wa33`G2)-&aE#-!w^LkZHDRhX)>F;lz|BdyO73`5?vA-}3G8JU
zH&^h-G-fa9uOo5>jhoZi0#Vc4M<UW<JZxl))#&Ci3aW~L2BlK5Nm8-al2O4PDH6DJ
z=OGen+n&DHMveK3)di)#+25jhB$%gKBYEgYqP{zb|ICfxNz|kG2EmPKDEbu*1xO;{
z<x*h8%oY(%(mUkL%ya_gbbn>GiFO-p6u4S-x3sqouRAI%f-Man>1L8W{mk7Yo+pQP
zES#hQ7-XJfJCTmHPSs4-l0hyt(I3(|YIH$prTdaqk}v4%<8>yOo1oVL-ha*Dzu<px
zs~wsp5!o(r46qF0qNv}o@_*u-K!>!)B#T1WX1c7MGQ@vp+(QS&fay^gwB<64mC4jF
z<|j;k0FmH6k{o~TmX60mOUfD=8)_Y_3Q_247;0$swN?#Y%nKnx_5XSPB(z9^thmRz
zo5#XB4y(|iKRk9;pzTki0XstIoxWgXI$$8A_Ezz<$6e9WRW@Gp)Xfzt-6;3^vu)_C
z^kghGxkvvZ!jIPql~Y-bLa$9!iG#;zrrEG*%<SUvW>RGIK2!cY`}Ifc6nW8ftVG)H
z?Ocw!T|@A5m3%f*&!GSPk2yZriD3U%XRwK)SDMSe)V^BZdYfv$77NJ9Ioc=EJ>FYH
zn1nR5lR^+s9nu;Vst1c?{rcnp@m07EVoqV~3ow_2aT0ve;*kn=2<DC=laLbY=zDEB
zQ8VovMTVIXMkd7w^IZz<&4eK?)m+S)5HaCX>(B;sqNcw}|M*jX+ER7rG&&2A3#6R>
z=55NeCEYq?bc&D`M#2rDK?%bgXn>zWgqkz&PkXqLIO9snz_Uv;c&?fHib)1_{%exw
zC=ScD7}d~h8)SrNio0!<%R5;6)+umu@|2xlICwm6B`9Wr{N?njyqwfD$+rHFHZXVI
zVY>G=?eC1bCi2lJYZUm@H6v3sg3LUOHkJ5P2>kEXudmMduea&z`o1%+Q>8_JMIjko
znSb^Bg#CE=+c|=cWS<NEpEoRb=&Z4SlN1k&I`XcujX)rKO2~NT^2PbX4N73sKp{t)
zhr|SyF7H?~_t^pIGL`aXLUjZ@^l3a&e_ySS+c^D^ZZUt|U@E-oy4{s87u9H(W08x5
zSYWMw|4{MEGKi*b3{#gf>m%#Fs82T6N4*d24E>E~AZLJKfpZ^236*Vys!4{1#~fkt
z7p+RSRn($2v)BB{!X9_b@3(;~uPn<_`-w|l_S($QBm@13P#twkX>sUb<^vyvJ1Z@9
zdhRBV-4(vnV({H)t?rxmX}S^-)@XgZ^`Q@185~NSKbajQp<gNkjGCwoyF!|nQ=~pE
zd=q@t2%QeC3SHv6<$ST(d~uFwJee7THM9U+mo!T02mVO%(2|Fp1>bLu{fXJwU%`Lj
zf?!&!w5w_8TnWOLVXmBbV*}DKs@5u1jzRybbu9e*0P606E`q(^hr<^eMHzYhjo1Gy
z9M6xZSK&r#3x<%B`x2V;3)N9yBTCRBgHj0Nfs>0hKN|6W7D5((@%E8~cgvOkCZE79
zpSz{7gh~oKNG#Ay!&uAIy5>T%n2l2-kGyqMUS4UB_Fcgpp|M05pLdJ47Y0<y$4#F!
z*@cN~mv;Z&`e)}1@8Eg!Mv{w4QG}6DMfrREb!e|j$YWDdV_faDkf=}GA%dtb(<{N$
zp?H#f_l3VB%>gG5@IGQe09ijDA@(G_w6}Xh(iVvb!J~!XREKk@&obU=G8erA%>x&d
zBL;Pkv7nfSDrrh(Tq=lWF^pUKTb(N^U%w8snj+?_fgn{*%{3@qVO+#$49n-Ck_X{;
zOk}Y?yWLYu$t19~Zu=i8F_vRXRn?De;tG|z75EMEU~2o(FjcphV5-QWndrE+TCaCq
z6U+OHj0g$wKVv#wr#wJUE!LO&%i5815JxQ%=_L5^etPnLI?-EguDW|KvEPAYij*Zk
z;;wsPtRSN1DHq6|DB>e?G3>~lRnaY-zLuH(BvLw)Hs`e*^jg-aD4vKe9*H?fTi_7S
zj$7zONvy1nknjDC>4ci80o#$NM-5L}DE@=QtWs-Swca7h3sSLHG|elN;So;f3^T{@
zW*U0}BnZ_Sp%aTkL>WS&G!8JHI%sI(=LmK5`(3hh#sf9JxQL)NA!4ewLc^}{`OR*t
zHF~=%`bwDY>YcHcPbGN4lOCi~VG|Ca?HA<yb{@g>YlpO~#8B0c!}=l_DQ0mAmf1fr
zIOV9VaDcbcvVjB1IpAd#mlX#0B%nA>B>l58SUqAl;I%oF9BQZ+>UA?X;0gg?-+i&e
z*9^r0Ml<3_o6jRH^?m9p|KU`<x!xtW=~eW*5W-D<6OPPB2v<F%LD(JE9zHzuAPA%e
zE(8y^36H?+1fj_ps{HukFUW#UdpMg$h9eFl^R}~(+wJy>bPea?nxP31|CYu*iS;2o
zx>!T;{J^?_OKr#F$jZ3V#}n%9$-XA@_<Tt|1rN(jcXl?I@YtW9vQKQA#_pBg9oe*3
z4c;By%Ug%ryH`%84zQM1W)9Ycom?ywOjb%}C0R+1lN@lLX>P@mI<(}ac(f`o22$gn
zU^;+gOkUERO_Bi*F#@5@3Jx0HeOkuR-cq#U-vtX~YuY8~MW;ap42i9jm%LWVk$#A&
z^~P1Q=`L)lLupM%wgTSKgeGVWrF5jf=v4kT$ZjlQo_(G{waRUk_SF(;##dXTlPZ7(
zMy532iCRO5DuWlW(vnV1WS*_1iw~Piniq;|18UHh;q^l7_89jPZb}Po?M2sqwH$`{
zzb>b~Vy#%k&e62M%6*q&B3HoE>d-KxR9e#{6{)T1IG9dvgZtd&<Rdi8m12=i;cq7C
zuAbxQSQx>%UZU~@J4RX<w%oWgel)AqNl>g=JV;C6Mxu_*(NPbD_siHb$=R=U#CljJ
zV&L*6=L{3^@q`JuJ7sk|o^K72=r>~=#s8bV$m&Syql%ux1q`h#h@M1+cvhFzj47Tq
z8ExexX1%|XrF2~|apvC<Ta=WUq8n39tYu?xR&~bL!wIne6JZQIYCvlH5rSZZv*`?`
z{}%+CV_+2CVG&ZabZ^fXjtD(HqJK*8jlzhY=1x%VjpaJC;BBkN1x!ujcZakjB2KKT
zeciYIxAga;AL%abow`SwM~HeA4-qvZ?R{^IeB`r5^X+!c*GAG^W`c@0`L38iMzx^}
z9IhBYg-F$+QmK)gf6|p-@q4>~eW|6;BmZYa3{}6PQMMm<FJMcOS9*Bj!Tx5Ij4;iQ
zu^JvbnkfKEu*ep2_=_8NAHd(ou}Fn(tvTg|Sy{xYn~l5mY!K&?x5rz5Q2nQ(%dYNi
z8Ny6glvdeHeBA$M+V`B=N4V3MSo24?MR`pBAZ>94DuO7dq|FC;FM2OqZ_SXwW!|2J
z{NG-vj^ViCXue*m3cAO<1=b#PW``M-usQlA{P^^Aog+;i>rQAT=T&*4U(#`>F~qJJ
z2k7E_iI(G|-CwL3+ndkUdqsL?P29c;w1n%=bk-eg3x;oFef>X6B5;KFjQK0+uZFf%
z$tcBsU6tC&ZU!M82;_Z`?2y4|I%7LXqWR|>Vw9~MW^0J1#>8Ph6mh@%l4bpnmNr?w
zLu(#ka$BS3`4b%nHp+&y?LinqVKEBgm&XsCNPoN(22+cKviy(AB`hA;?Un!Jjlkkq
zx@yCu4>lx%XA?JC*oms5AR;a*N5afgr!#mg&3`$HRreVC*2A9QIb)tQm`|gmVI)e&
z9DI^I%_s?$$J__I3438B_WcWxD?X;`e1LX0mAqk7&G}tqs^{M&e%`IHc_uS!*vV9X
zZK5KNJcsqY8%EE{$)!iy2ReGVq=0eomCWO0T*o*4nQN$s7TUz8MROPWu{jo3|A7Tl
zLc>02G896V>iscIbPdx?eMPv37(0O2mNzI6N$QzRv3+PT2||_)5k<C?=$S}~x~HGp
zu)cs;+Oj3(<J79Jt+T2*4(CkT?$wda;EwK)&VUJ1`%kF;JL#*YsG#eI;b0P&2%97x
zdhAr}Ibvf^Lc^Y2(JAC-Xpydea{pHUG}BA%A}QMVlKJlEh@I|qqk=LfhqvnXT!ebq
zypz3om3w$6v@a1Ykx78L=ePeQ&{4wNoLLNql5$j$MnoC_h{Kcx^=HO`GjGc-Q^M)<
zyGU9}Chl^(To_jR>OJ~cFpBB7o#=FpPOt3+d>(l-#hmk&-z|5d+gDZ-^!vUtZRdSt
z`we5w;t6^`+@NwWZGVr8knBRDTw%5cA+%Gyr;nGYlic-+<BYp*c*|(OQVL_vxOZKE
z%S7KZU2PXwgqiy$n(II(>u(er>X)Y2c(tIc5T)9Lt}pUeJU<`->XL#T?@3lJa$cfA
zJ|F8IJcoW2dF<P$Y{q=|KrF9^hY&~V4U$Q+jvZ!kA3RG+M(CD0N>-cKf-p|ybC^M|
zYQ@@Atr{r|LKc`mx3>T`j(vjsV;HUfRX^?rwBiw0I*F4#BYk=wsZ7$uQ#VZ>VB_W{
zKBG1<&-|qmQV8o*)IDHCqaU$$45Nua->i}iyiec$s{_Yux0`>PaWvECG&MUhLf4)^
z0Ht2D)p~pN&Uq#4f49Q4U=*RJ1a;+QJ1lUqD|6dhA4e!G-*rL0>69ehIn2}+6hMH~
zNCuM<k)jF~+<7SiMV`Wdjss|MqNlPdI5H{fQ!YlSz<^OnX;7_Vrw!sZG&!hrVVtvx
zBpFD;6LqMzd_NvSv%7S$ow*!i+ejY$Dp03J5T^F36{dp>g3~jXG)@-QR#1;rg~ny9
zlz?~K99ip>@Qwa1(Zw=nMxB*2d?9{377BW_-(}~Dj{B0l&R%)m_CDmjyKMh3nO$Lm
zO+~UOCDd=vPv0APZIaBSLD5iltx`_J>!OlvqEb6^E8JgQG`$)&l6r3GDMT&zyaFO~
z4;%1g3(^wtLg!T7YrQkQL%q}WM!rLbtpgd*$5lyM;R>^$#D8l)+!hJu+4~s;sZ~XY
zbJE4)ZHf>9mZPS`Ef~NZGk-9U%LOo^S~HVH4qR3_bc<GYm1vU2MOUfl)JGJwESjez
z!KMVX;r+vtFk}p%tAHXF)0~)r3N2Lh#apUOnIK%%&z9^(E-foIvBW7W{w^(`96bp#
z`)j2N$RSAn@_eggIc-{zX2Ipli=nz*`M79Kwrf10Fn*Hx{T47Vb-MNtzAutcNLMME
zDjhxrVfFxN#_29NPG>)sOmx+#uEUsUJ*dD+>KYeeFB7|dA`an1y*hP>d|DrolgC)U
z`LZ;H@0iO`X1QpBWM#V$LPymkD;jWU*^@?05xgl!>sVhZY9msU3d+a|Euh0JP@J>d
z5=GM_shgvS!t;swD(3YhX|*az^5mEehxtS}Fz`%)83`f|;%tx1;-1BaE_N98Qy3K>
zz2lZ`sz6{29pab(En)VYOu2c;Alg@k&wp>_1V-G;bXZ)%*u*YsRaw3)W*l9<ai4aQ
zAVs2#aTAfcm*rsE!Pvvz!`}m72#-E%eZvGr+f`8qy()(@BV^>)pA@}9+a=WiwG+5$
z*BB=QhYCVS5vNAPhK<-1qH@X>JLC)>=MYWwr*xuj8t+GmmSP=>0?CY?+WWncYz~N5
zPmjey4G43-!)G7eD)1P}Q=N5Csx6;z?zapspK6}EZ#!ui13~t?hIb_1d^!ZVioI97
z5NZ}O|HS8{F@XD}3Zq}AU$3lL%ua{#*|5R&{y9_TvrOvEeV*VdYVqRNJA0CRhA|q!
zp<FzeU97f6FBbNeD?mui4zDFFH@SJ@@XF==hsfE8j_8_4Etj7@z{c4AdM2fF_%80}
z1Ox0qgCrW0lbZ!}N_wa~QT9-KBBMWzvi3B=R$)&~5|Q@9#2-DGe&6Cg*N$e_$p%Y&
zp>+Y@TaMdI@GH-|QSZ7w<3DMbLf_5+R9#{`Zj0H%huUhW_87|R_v`HTuWn)EPG8_~
z7k(J32XbB3zZK|sdFsXerHgpJxr(l_d>c&>bA+>0v)uSDUYbz6g~VaWgNWdjiqCM5
z+g_PrKVc0N`%B0i<Y-M<efK()D--596$_*ymsMh`N%d>gO1f&+Qeqr9LY)3HmH4{`
z<YaTP+M5u;vv=G#r9oRbbS`%FK!yIZGf2b@7_OWnko65V@t-{EOn^Ti!~Fz~dV|S8
zp=YqboruZm6`#RfX=1#FZuKYAd|Qm~cdc*h`uB>+M-;oIE+oZ2?_TuN<*jx2)bunD
z^<uNH^*E&b>*cVzIA9<Y_&HzCm>@)2vB|$x+D{gS{ts@Rm~p2~u1#;WN`gU#d0ma_
z{-h+-ZOoNzERo{Oo_FzG$=<dulfjk2_16C76VYAN?vb4elh(f;)S7EVQ-k`DpAUED
zCr5qeOk6L$dt|ku)yp_niAoqaY<LdtX<Z5XuT8F=(%@G$Dj-)(Qd+0Rir^WJMTDVY
z0l)uf#DXv4@p}o+gf)yDymR+nN0)oeZiidRnCt(kRLKlY#t~Jt8ug)P(1gMKr-#%u
z#&qRw{|8)2@NvAhedY5eSg1^h<OGHH((~!b;4`f6etMB<#@7Qt`;`TP%Sq&En!7a>
z7Xdwp$W!9ansM^byPazKccmkOK1lrE<dtV9D;`m;Gi|2tKc=SlIcS2h@@Qy|F6AOK
zw?ZK~!{6?OpE=R5)Qssl%617I#S)W8+xS-*>D-IS+)tE!OaR9+>LV;j`k*Bdw>pl6
zte-5)BkQ<`VUF8D{B|6x0}SHL_(nR2*0r(~dZuxvVaqIp#Xs9_Xz<oT*@=kJi5HWc
z_*rk8pL<cZZrPrC-w1Rtn5q&?LR(B|fNgwkZ~8V~gf8`>r*pQ)B}lxBxcBEq+j_R&
z3xXA)OS25sEM;P`KRFv!Vt?+q>2MwQTw<S<I7Fjgp|AKj_HPj+3^cyZ%}A=BaHz|a
z$*Fhohp~5RcT;!WP2%_xK`JQpDetL>QQB1qS~&#|7u5js^t(0_VN(yQ47$)9Lgy+?
z?m}9AR<*qjb#6*}$Ykp`bUe6XcAJAFTVD^k4!)YO`QWe$WcRh}+gBv_HUIr;x{GP*
z*^9johL|f@TTHeId($c71%I^6mJgSliXU04ITI^c6DJeXW3a59?Y|EpjPGzcO{b1r
z@4PYt(G?bG;MDE7wQwut)p2apnSnl;veJe6A3w;W7BMFhc`+43etpx%u|$<sz=VWn
zCs6G0DcoJEl5rj-Z9)lM#}cR0V43`8+5gD#`~2l6O8sW}W+jQoh10d8Q(2joGVv=>
zom04Q#V46<1WUi25nc&h6%N;e(*&73-aTg$;NqtDs;Kgp*a@qVVH8d-ihf$Q#VZ(8
zh&F|ihqt9f+aZ^Kjnn4OY<&)^!*Wr#k>TS({`UQTc>7Kck;9Y(B5$rPUuKljEYL;e
zYGAx`$G{T(agU>YYn3f*+CHP@CF|{UTm`g(kthV@!-PJBRV0FRWP?Qf2#v`&aE~s`
zkxj!LzX`BB_2}hWD>6{PZ#SI{+x?LuheVEEq;MVsgFK8tb`=A7x9=FHTEg{-UsA@$
za1RdWd_nj_{z_5}8N)k_B3Za#6DQir*qSWof)<Y+-Woay&O&bi)UrB>1N!)zY8(q+
zuDUmfd~S}U%3C9fKip@g&Yy24LT&#H3lKj`DKH6SU!q|Rqu@yBCWG5JX8}1UX-6>1
zX!S8_yzvaADH78@_3V}Gg8YW~_EGI)>7!aBN8ESZ1mXl5?0s6qv$#C8JF&&HQsu`6
z+?zf#g?Cb7wn;YsN@`kmRY#^uVVIr`QOL|BW<GiFow}StF!$bv@rMkI3;*KSDGMvX
zmZnqJDb0DN%F)rXk*Ah+76v&KBr$DHh6R;W$+$wEr#wz#h1M>voa?zjl`f_fS@DY8
zwSVwq4d_5;a_RSO=N)crhH&Jha~}=Ju|v!_pR1A-hmQW~%Z=-HRx*;KYlS9s<?CIW
ztBg4innLn^ez-d9+|Ko8ZlS_A3N1OWcA@aCQI5jYL?G1EvAy-ILYUy+luYZ`KN@*3
zj$xh{r~eD|P$BAlZzJX>Tw{J2Xs7nSxvlqK*mOE5f@S*NAA7|%Li2apRpKn|_bL4(
zsm%9Ybp3UYwUzL7@TtWW-z#u;9u@7Aj&3#l1&__xS#cCD^qy?hRP=R%QPX|iM@=0y
zw3QC%aR0L}cP%Mr#slIl#SbI6FWUu{GdyWAUIOv?rR3BvE)ee}b-o>rhcU@Z9MyrM
z*cBgs{odhm=g2X&Vt#$ZK1A>6cya*n``|ql%etlY>Q#*wX`!S8=fD>zws_<rQlEL`
z(HI|bA##4;Nj-O_gD$a1mB3sQm`POsJ{o!iJL(Dvzi#97@X4z3yeV*%G=DE&M7I2C
z!yR}#eHNvw&y`$TbBu+c&2YVLujOA4d?@W3&1}99e4aL?ssSC}NQf>re7_DqXP;Xg
z=-~qRsjol?89Yv8h%IaT0N(G(J_KA1w)r~C5GMa{_Nh6$F6xu`rz8Jg?A>K>9Lt&@
zY%w!4Gc%LLOcpbP#mr=}EC$PBX0j}1W~LUiEM}H0*!H<IbI+YQ-|YPOB6c_8gj8Lv
zs><xn?5t8}Wybqx+ZXtkNpz#3;A0&ye$9{)F!%cMlR#!GZ5*p%pw`yh<cHFLu-mdv
zl3uSCoPCLo(4tz>s#vCWPYl{cff-&pZJu8Xw#@5kJj~j_=233s*yCfGN=~%HT2iaH
zo12NWoBGcVv-0KwZx|t}a>Zy98=|*oxBh5u!3->?@erd$jo}_a3#QLvA)btyOXUw0
z+$^CvCJ8*E%}-+x1dukj=$Dp9eR247xHEhGTEFVHyZoz7op1+)9||}pxa(fn1t8dZ
z+$^J4h5H1jI{GK{5W_eZ9GYKM2Zt4%<THhoW)qzOt;;so!FrkUlYDIIL7iOUVTL4K
z?t{RYEls<>91?xzsFim29$)cOtBvT1-=5d~YIy0Dl?Q@z`|kI0(W+Dn3Ux9{7-w)O
z@qmGAs^vB0Ze_FBvSjWm-=b-PO*c`@QFdIXIF*8Gh(3%QE>i!vf=pAe36dHzY7a6s
zh7A))`vko3V1DRM+CwwzklN>l9H}q7=d=HYid6Fj&9dXtbLM7_FwTBe(*M@rId$)V
z<E7%ZW2Yx6X0Pt{rPF=L#wTQS=Yw*t54{zxjkXw9meZuYQudhGAcsJOa+&!Q8qMS~
z3)PG_we%_DtxYB>(Y-a7z$tsUrCD!Zh&;nv#R!T=-KCbm&TeA2Q_~i1mVhfSn%kEp
zM%8@U7PwEEpXW(VV&e`BADo`uEvB#@8P1&$#R2vi{FEJG2w082g75h)`0TzK$JEim
zV6!O%L<;#9s6Ve<orOqc>jh=y@>6C84_mD~)Iy#|!BmZQJmD}1<Ua@@6@u{N^!8vl
zHZ%k(Ie;48L+ZQN)Sbe6DjS2YG`~9LLdyCT$(wDYk84L}eyJKM(Mj^MVRKN>_|Dlf
zcD|k&IU+~hw{}5pT=zqpS(mh;pU(_7uriF@{tJH_Zyc+7%1xoEqEXBMe!~xlPgy2=
zSeAQV6OE0B66bhscIcWhVSlFXY3{S5?aNy8M2hr+*Wzn$CW06f;h`$Fsz4%pzkC41
zTXI0ab4b+H3-HqT5FSr>Vm#a#EeW=Y?!0q^S`N}&4KLLZvEegQ#FCMcqbhz0Ly5YM
z_C(Qr)9PSowmYIEw;x+|-~CoW#LL5fov|DzBtv|b!Fsx9{JgNIt$;}_j0LsnIh78N
zXK;FopPta=0KeN!#(;azd%cK$t^8wNDtCj8{cyc6wK^rG3yFwVvgJh(JPu2WM>yG2
zhvc%QJ~N3n@#B=ZXwzh3ZyGN@rAyavb|ugLw>sSIj4Zd3K=`dn0io^wt5So!9=mPf
z?D#cj$@6SRw<&QR9oS70H?ihA+uF6p6DB?V_Op8x>@FFdqlK>L^FpAx1QV?JMj_bY
z;17_Ue|!oB!A)U+a~d+IiIm;MN{HVkHBo@ODk!u|B!NxS>V5d(gi2lKgbEE@`v4bW
z%U!a2;DSU^^Yd#XD{LPLpbzUXOze^Q7hzLANZQAIJq_@<K5+jR@XwY|QamNHUJ>G#
z&XSjhav2%*zhDL!e|gz+&2Z0ow8XWvy#BOTenRadS)|0%qVivgqy%UKG6v)Pua`{I
zq|jU(V1>`0m`N*2^eA!Bq&5iSeueQJ2$E{R2>Dm`M`OuiqrI*NAKi|;60dy!a{Ftt
z^)_ggIJad;hU|6dcEr{2S;3ho=r+aSJ+^Wq_@-7sP#1?L8XS2q;o0mvamkU`tF)tP
z%zcrhO}!i50?PVwRntV8V3XjoAh(p*?DSRkvhOdRW#ZZ*Z7kGd8NZ0cO5#hD*F@QO
zc%`k{x$N%ifGdc7?v@q(dKLR5+N%4cNZ$S_&eCYXwXM++Nh2ew5yp&6sI=y^z0t2m
zP^NlTS#qgQi)`;Ylaq>ofNznwZ`5T!;#Yl^jb1~WMRz2c8Nm7+6JKJnS-<f*Y0)Gc
z+pShVZU@yP=BNvz+%i>Dq}nd&v_8JLs;#ZNN<51^&zT-+hJ6q6d)T8K7OW8v6hJ2o
zf5YS!$Ud#1bUO!!%_!Pu`grKx^|RPsrYiM#)tt<7pdu5q=9>13&gF^@KJD^ciQ5ul
zc%%}<DcQ$2iDAd{GLv?i5`}YegmcA+Cb1G17rv6(z@4i=G9`FSXZTyEwrhyh)FJB)
zz-|?=@o{7H>p)Ix!G%=smZ9K@TYKScAq!HzBMokxla3l(FQl4#_*y-O2EHz;Da$Mg
z<}1vqIjUUdJix(Pc!e2XYy+9w*YbL<j1)$poO77Zw4-)_CnOvV!hQ;yXp)rD3!-3C
zPN0xO^ss%6vL$(hw`F|lQ-{Ka`vuztQ_bOBW-M5DJO?gJ-~Q`YrE*h5)BqgzHz+0X
zhv5>kJOf*qH0EMuXd7NPvJ~jo67Lqp^UOU*f!8vO$X(X?A5nRf2er0FfxA>&Dxj*B
zm%UEN6Guy)LzPZ5XUGgk1dWa=>YqlUGO#*c`k9k5RxjFKbPFVv?3uc5IwJ|$lOh|V
zX2{=8%6<G}@y5;i3zr~3J=1)o5=}3yig)0DSy@Lga7VT%l19mjsHTlJJuG;KGZIM+
z9unj)^7!0ZC?@zf^44+sbKv86^DM`)kLLE#JaKukTBa7I<xVG!2pDipbB{_1GSQ7z
zLor(`<C)bk@wf78&Pb*4Pw~K?msUExgd;Tv?Zm4@_50OET}R1ws(6e_>FHgK#&Fw{
z4;*<|PGqpqzOSe^2~7GoyT6Cr>e~E@WiV8$?|f%}013)CB|l~EHM;Cw96=K<sVwr(
zUl_alAu1{x^FvL$24*aUag;QaR+4JxO`L1zO|AJ2HQbQ4M?U$jWSQnwvrawEep37=
zu}g0dW~uP0;Cayx?mfmUwo8izFy_W7{rh1k)3xp1xVc?nynHtUdp$46^X~^1DXDc*
z=h;`aP)+46ZW5!13hxX*rucq-cT{nx*-fqcEv2LY1KviGPmvvTxm^YGt~N?!XRKfG
z8#``B?`qCZ7Z`T=Z+?4X7M947&|w1>!7mSi;&9?LtPN7uRVDxNeUe5D-~5Yd4-K2}
zt@|hTRi8noX19B(v{p+^g+@&}@t#f9qObfRGq?<OBWjtMugK_fl(or7B@OkFOa=L_
z=+haV(%p`;5;SjySh69cK`7bD0K~FtdVI1#P%ttW_(&!hwNVHdhP?zBcpoV}M@a^&
zPutq4V4t*GcQ_NJ^4I;1eRER%;UENngJfcP2ng3OD`MewdN-Ho-$uert#DasJ(hhk
z8xkWSrXgRt)Dvm4q96``#JLbyh=J{FVxXf;NjeIY(c#kZpL>$N*|ohZgn;%ae}Oh9
zi4w6wC$Ah-!0<={-Zc#VW!D5VYo?Op%M^bjj>ZYYZVz>30lJI8F%e0;RdVZ<%e9sd
z*K~>VIbJn?o@RYCHLBD$uTYLWO0v}~f7lF{5)D!H7$#ZLu8fLr$Q18q(GM8cynIHA
zYf&M%;JBSroM4Q&4Si1y>2P#QM~h1)fJ?b$V@i4kDbbWT&Z9K%RSNvg=q&%-y7|$n
z!BhM#J^6s)%cRog5k2bQgT8dmfN-HV$bBdaj%)LY3>yo3hmYfvoZI8+_$Q6_b0z26
z(&h+Bb(z#OvLmnvIC3>em9)xUvs<|NL%U~H{dxUavjoLzbBJ%CcnkBVMp<*MK39Q?
z7aImI2U=;l-#i7P$Q{E(zA?X++%8@uToe*7`6M@QNN<X8CAQ5j&Vi~aZHi&t`fWT=
z6Nq_p@zWqcArr|vFaOHv-mn0CUo3)096$T&8rdRXpZXRs+Whq^S3ZsJRMvPOMbe0A
zaUQ@!nra|aCq^=z1NNIvF&jXw6h2rjj}Ajl6E%cP)eaTA2<D6qzs@Qtv~6c4ta4lw
zX8kFj%r(I<H_X`ruWH!#e4k}g@0|N#&1LFgd4Ml&=HfVgXfnSi<-M$OE%p`LnVw9D
zl}tnnECr-MClCRA8Wcp*5mG-nWPqBi*y)}ES-`<5T9)aT)htx>!2S!JKRWHWvxvHr
zmM`gK6m9}#eu%?Yo{SNr#Vz$Vi;-sSp<j>nHY_WgDV_euV}U<;42Nw8*vr=UYy2no
zi0|f+Jhn;KR$s4<P2VQ!B76Ct5Auh_FE6kuLPoS(rNN&t;t-cazC+s0$E!^vpJIRQ
zWdOa+FY}=?hk<utm}cP*C*<xH1>eT0i1J}n{GR8Ew~MHRWJ@nHqqk-q9bHZntx{3T
zneJ_L^P<Z@oIJYU)LvDw;@$dsR$4wN#4kNFKj8Cxea(NvmlMz}F!exwFJhPYW`-;i
zXyv4Cbc>|uU}u-?TBGl9>tn87ERMv*$qDn>P|@q9EU>RnuWWEM*rRP)!IX~hNxjPG
zvu>5%SMOHP6U%eu9K7S9wEp%Y%_}z=wv{v->n~(Y4|E)QJb-&ktonkgi8H-ZGk;d7
z7il}TrhA-~?5_m7y|cH|Uaq`ttw~E?EHwERlOoyATz9GL1^v60D=aDE@!Z<79*%I~
zQRFfv+af<Ta5dF8lS-`7BC{s&JBY@qm1F8*!U)DJ36f%rLPd}Imm<TzTD=>abndG2
zNVuD>VB&xZHSz?YjoCTa6I#Qw|5|a%<7#m#&!S8`$)aCAG%&H`Y$FgPPB%asB&4jm
z*VP?+h14peGyJPqRy=<dx96{8St<X&38!%Ujs)~Cp@DvL9u6j--~<HzkPQAmBU$~f
zn}2~*{;CH4kHxb3Gn@jHQGlVX{wbyWljQghkmFCR3h-!764w9Zr~pY6HV!6^-_8e+
z6(Q06Q^G$b1=h$PLd$=3R7f~^d4NjDZ<U0Lm7NLbr?3IDWanh!`eWPg%z0VZ*g1f_
z3KtU_7w_-mI60Wuc)5TQ2^%*L6FcxC&iaqsS%88G2R9I7`QNiFoIGqyz;wXZ`U{?g
zgo}fR=^xw+4>uFXA1}|t2~5BVq*8!(3mfo&e^wRn^>qJP2fqu=31n9OU{8P!%s==P
z4qi?s);~m;-!{xYwsCTB0_%<CH>1J@q-y?PRybK$fmRIrZ$sukKovF~U|LQt;9LE_
zm2%<W=3oMXFF*$7PoMt3KmAL{h4Xi7__uTEzl)H@&i*eDhkoJ&5OP5Xyzq)5SQSe_
z$z7)ineU0`Ih8W?1HnW1!Xb(=3+^Cn{2;XwByDIrWaucalG?x-^hHVd2ny^X=1gFG
zZop>C5+~X`VJB;5TekVQ)=eJ6ZJEI(u(t8F|3|dT6=ZN)Fc7s`Qm|ZNyV~Zz97OVU
zp-X2(pBQKXIxbK^$K?jen<}aa(DB=GF>h-H$CuY~FUj{Z^JPYA7L6U2R3aR&Uf9y*
z2N^3&W;@UZIxdsl?(aL$<$Mp%C3oKl4+N4_M|_J)#iQb+WzkZkujo~uKPM|Q6lvv0
z&=m>}AW`D!`3SD_35&;lqk?DSF{&zLnqjw7Wlup-u|S)#kZ_-8pp{M(H)&ND6>{=!
z!<3~{EoT2Xx;B?aYhFy@q`U|pfBnq8Shguu#JmxV_{iZXaAFi4`s>6gNw)%UflT;X
zj{X-H^*`Y{e~#4mA6Kg18(IDwq3^G*YyabDY`?Fj|0x>VAFblgmt4-@C-%QJlYfuK
z_BY@1H{bF%-|{!#@;Be|H{bF%-|{!#@;Be|H{bF%-|{!#@;Be|H{bF%-|{!#@;Be|
zH{bF%-|{!#^8YvA!uglCNB?@rOXdGnzU7Y_uK#ie_D_KJpKl8PMqK_`b`p+1YUf`D
zz5Z(*{Kt*t|I7In&Obpt|J~rk-+ap-+RtAMiT=kY{a=O*{%foFpAHxR2mb!+fWaSV
z(4Vv+&Od2G|2|;A#rwb0TiAHGIQ|UroTb^>W-Pi51x)?Spi%WjEyIq&dQwid>QF8g
zmo+i7NhFw4G^?oIP1TS;E3DtZA0eX{sO56KVW}6Hx5q(Y_!eYG%+)Ot=(f;lrWArX
z65b;nWitJ_k(ld2u8G7>#|S^YvhP#IZijE_uwA)TAk=9e(p5ZgPR7N1_Kom?(4I>q
zlxIs!=#C|G(d^XgLLD#4L^pOxD!jy1`{T#yH>73(KNo$6H!5N92}FW4`blQXk9GkF
zjpQWf6WD+#j%^4ckj|%~n3jM?nOlz@L6Ambrg4T%?}w`QN9s}sD9ednTjTwnr8wv@
zPebT1EG!H7`z|M6@OsExKVz>~4Sjm4?(5WC%v6nHctmV)VaO|o?tABL4V9P1pP18p
zps$j~UialEp=3O7kd+5t=xt7lG^K;@>+7*KEx+t;z8_r#HAAjJFwB!&=B3DLeMZ>>
zQ*sJDD0(kKZw^IldgSt_P}20mqy~q9Q2ji-F9?B$MdJrkB%E;K_u0zmNuw;Byzv)u
zeq8nHM$=2gg&@~XxsF)yQyMk1zy;xxG`zMy1!7Ikv(gCkyYB^ljX;D@)XGK^5}9MV
z!MDR%@HMT3T5mNyceruqV6uwJRN2dB1Mm0URM91R(O<e}$hDxG+x)o_?!t2~snM%c
zi!LUdnwu#jkvBOK1>N4124hV^u^*TEo6M<Dpc({i>G#(JSGcekeq2#$D6&a&qaFu6
zXLHv&WeV}Z?0yt%kKE$uqnLsH7R-=onaOd+p#f!QIuzA4Br>NI;8n|ODH7+LfAtQK
zs~BDM|9PkELt`JQyHnjv|3+Ak9H3zL+C_sJJ3B=@CpPbYoN0Cx^z2()PcGarrRI7D
z!3v&ufRKq@{H8PaM&e*qRD-jpv)LW_^Xb4FvA(c6$6(yf+VGSUMFzZzA7Eo7b8Okj
zKxoONIB@e^+{w#YSC%t_4acqvK)UmCq7!OMQ##VsOV^oiY8Jp;#hVKE$f$dIxiSE+
z=&z;AoM`u#d{2zLqzwI@rX+aE`JHm=NcU@hXqjbkqy0gz?rw`O57wNLLx-F3r;{o@
zp0866cuO9F3-oPyJ9XsNMi=LtrDeH#=_{>-8+cO=_UY-;{f!$dYX}a5H!0bk<G|@U
z2=h2{L)K#WUAgkRS6W)`{iau1LIh*L!eoxPq!ue4^wxg6Ep!i%)%T%wqej$=nr#)!
zpLao#?SRgoe;7%APJ$AWv3_ML+TCV!r;QnEw0}p-d(jE=;2#tYx?aT`bqE0a86=pj
zIhqNB#ZiG?dDcA9DB>Td^j$HC5-V*VgC1kqC`Dpl+lVkrvG_=|B*!>A*KpmP{_Hl}
z-9pI+Cku@G8>>&4!U@HfHKR~BE*dtQdp%%ywF=wZ8;mi%18Y|eEeXp6Hvq;8feQm2
zGkhg`#rFW*n$(gs^GHh9Vr}EJ{A<$$Z2(W$q|Ds2ldp|z(!I7uOIduJiX3CAwzAM<
zY3&y(Ik{1#Cq_EWZ>)ma#oZk6qdD5>wcQAi)pdp504?KKHv`q$(QICJ$tOF81Oqdj
zi5w}*b-iCdaF;WCbJRC9*eC_H*fk9;A+r!QJXM^iq+|>XR)W>Ei%RqLG+CtsTnCo&
zqf8@DM)_(s+?*@vatxGbs?H)W!c4Bq1huR8t!o_ES~*i5j%gz6jGw9KPo9}HeR$(p
zN3@yKuP7%7Dpky6NY#8&7cwQ(apU4LEh1C&{pkd1D)^GJC(2+n6;9+ve?bmxJQEFC
zv=qH0R@Rg`ReaiO9T5r2KYCD5#|`hXD!LZ(!xpM-TMau}otvb|#MO|uXRhr@zxLD~
zU@-=q(MjAHtjqa43=Rz44-ObE<6qm81$=z(@Wh8lnl^dU>L$Li+4Q|VSaF$=V&6IM
z+e8hxx`e&rikO{}BeuSP6Q<@V(MF*92$ds)TX=!re4bN(71#U-g1xgc!lI}b;y4rf
z#aK^%i!APogr4oz&d(pOipy_0%Wsm)Z%9nX)wuG{2zc%Yc&e-7RwQRN#2dxI983YP
z-+P8%lZ;QJr-xx+C2>qb*rP9bCBK=5WJF&s{CEZa+AqI(FZ;)#9#?18UkOTj#-a8%
z*f~@2t;$b-E*diGZBoE$`()`i8-ztQ|ASE|cqx{^c)G=OI_>xb*-Vl#%~hNOLa=wc
zmIH#EEQx58YZ;&YD35ibU|<z37+lPBrId@uQNDjwfQ;qSn1w)kACrP+C1a#oT^Bjp
z?eVLfpeFS%vGu-MYUYs82Ep?v0ARVpJ$1-Da#?RCNH5>Uxp1uH=%{waw!_gIKe6tt
zZ^eXWL(S%)k)vMR7wO9aAwKc>_+Uq*`^;BIt)Y;KkA|B^zh1-ScW31L2~UZ9ZtJw9
zrmZ~|8V+<^&R{+PtNNYp<?!}W3TkAYOT#1ztYV7fh~4o5r}-n)4BUeXUSuN4D2mD?
z%1;;ZH1bh}eBTD!fCk$x-Nr71#!YgapF*QP;;4%VOROXVT#Szks*Ig>1O)1K;SL#G
zPXzO()B7hUQ-c&iup@?{yDAAWa_(`FJwdTrl(35pH88(+j*X1-slRoyZ3yzFS9Yid
zxHlIu&y;3)-s)RYc;%CCEFM4CRtPrxRyZ6tO*SgL49*N@CkguD25?|n(}_dzXNc+t
zTV1CX+~-}Q{~TN87^zt%3Z}{_cj6}Ass=P?pxC!MvPWmYuI)M1MPwkZwd*x*(ykiP
zuWr(;ZuV4tT03KhImLlcMOz?oCkAIUSI$X{=24J*eg^+4Z=^OB`zg(}pq#CUp6N8!
z)7|*!T3SKw<IRz$Nw-PECnW=1mw5qBR#$y&A!DCMct$irq{jLIegZ@VM9#R4g;>e3
zmy#hLpDA)#{v!09h|4+olIU46X~vT>aoinn(FGc@;{}NbV^Mh&GNlL!QCk#XE57?@
zD<;J>_n<7d1Eauj6*()Fbw$nj&}%vE+l6LMWs=}kb&8Ig!FY)J={-71zSZe`K~8%+
z;=v-_nOUB|4womD$diinm@{Ck+sxurjfZ{N!$N+E2+6wVtEbq+)q#OP0^hrMy`bOy
zS+?a=F;$$0Ab*;Wjm15;M4$!1D1U>uhEpctf}+(?v2CxxmC;-1*z0|+@V6MBV4<ct
zyvnQj%yukPQkgTKsuIze!nty5LzJEIttemj*cAV~pZz(gMVsR#i{oXOtLI@RQfxaC
zA0IF?rgGg%YJ}rs_;+HX2MW@f65=k1mqn<4fxkw*d2JrJ^rA($bNi4R)U>rQ;b5*j
zwks{2ukk({DtJs|&VnO-;c;m23RcYdc*3vg#i42`!W8}*pFMfHU(_E2ULjEH`0lWy
zn^!&PB>jkV!<Lc`*SV<eBK^p@Z%(IZdwo0LQTjMpzEipL%O>lW690D|;-Q)WrYrDs
zB|iw^-1+oWG;I4*wsl0eYO!9Av{W>1xAHKn`(|WV!<~8c6h1dmO>pCygZN9qW0FM-
zW`h({o!5=m5<)GC*qZXk%a8O|cexJl*3ej8UbJP@5pu=+Shp9#X8|FGhU#GIFR_E&
zq}$MR(7l+jvk|(*?fmnO(vR1Ab!FuosJ-N4M_SF+zY}}4A*-ig^?I7i6p`os&Rr+a
zQJq&5qKly<Ps<Z{#8+|=8}&$(0)yfgPu-KZIV1*D5*>Bd6_{aXzJ+CX=|`uhR4H|t
zX&G`vN2W9$ikAWrOZ6i%8R_B|)qn@m?XkYQjdJH`|JdPV!wDjOiWi~Wu5z<sw3MT4
zT;59ZE6^uwHFaEz5FEZ2?u`O<j=z{m#Q7%x^Pj!OfA$yu!G9_m+W|RH)&JC2Ry21r
zXOwX@wzW0|9%gH7=|aNI1;_ls#njy1m4ug*8;<#RM!)}HV`T$Uk*?-;8YI9Of^f`Y
z#*WhF)|OVTB;2gPKmU=*2YX9fa}vhihyL!gii$dTlISw>^0JdKa`3PMr!=wxA6U4#
z^#8FR*x@s01NLYCz#{+Lv-lGX`OhN#Bh5bx22A*eDEa4EQvYoM|D&h$f1ppy$-<&f
z!p#Ppy$BRd|80UMJGVXw4<~TbALZZ#))ET|a1!3XP2yu`<@|G%{Am*Kf7?&y{8#35
zdg4<*2@1$on-c5LdS5<l#yZyL=~l$OY2x&AaGb0{QPci!VjG>MV_4qGkB);+dHEgn
z0Ek>-e+@z?oahCjRIfX@yrCH_)#Th5IPM}{g;`X(6}cux&=LR=dzlT$b7X<`=S`!B
z!ULj*kWQbNjU`lf&6zXUGmQg(M^XGh)X5LKBBh=w=L(8297TjWF<jri6ISQ{`trC!
zAeyGPXFp%*<fNLH>MpLzK8O?EYMma2UjMxLi`Mck`1z}lBr!41d~_CEHpP$f!tzn?
z5kBfHZGfpp+FhobJf}m~(6N);!_54#;7Ytk+F)cb&X)(fw&j6JPk&HD8{fOXI9>ko
zZ29jH)c>|g{f|4;e@t)&HhVP(b$e@52QzbE>-}Ty@}EEBKTUf6_YO51H#-Lpu;p9Z
zx|%x!XF=N<yPAue|IPr8`5(ssX9;us>xaJ3?&Yht0Q68ZT^`IW&a(vZ(?;SYphIL}
zVDXFtLm*7Fz|tXb(7V4G>4SVIrLWFY>*>__4rrZ+jH()xCe<21gk`dBAYo#Z#RN^!
zs#ilDUfcYY$)6;Wda=6s>zD8Q<2uDdrq4yo0q+6tl-E5z35XF22$9jsIO@P|s+%8}
zNGm8%L!~>xt7*02McxvEA~`j59B7wFX~<cJ5J3c4YTrsP%EK>&#Ru)j18F^+m9W!1
z-FQ9p0f}`7F?L&RufYBQf&r3Gp4>PV;CY0}-E|HH(}k?;QvRAquhBo)nE;Bi2A+F)
zR&~SV<*?$w1VKU%YUJwUb0V-9vqKBQh7A(dXjtnC+5fo<WXl62ewC@~Q%^fLvR^%N
z;5kSjq2{=5ZN#dKAvDP{2uiE-24>Y;MbtXT8Xbu9d45H;LArde0!SfP4ztc|>tW@#
zpFc<oe&9PIh$9I&BzS~5D0D=ImohZk{O9iTxIp-KpJJ)V*JN;a3MG@A_Z<?D*{Ts%
zkn010t4(No!ky<cYuq|2$a&{GY}K;*mB(=6a`5K(YI@L5`Wm69V$P2D_;!_NR*+I~
zL6mb;XKol0_y>4O5Q<Hvmhf$=<FB*};;}nDtGhS?#};9tDB;S(C`eQXJ1{azFk5+Z
zl6F&i&_rBdBA_9G(5Rx0Sefv<Mqu)v@tQ%3`xvYOdE)~uv>+CH5J~%fpwuYC^cgWk
zhtmP<>Bd98sGjZjptWV)9lhVy5x>FezQ55tV+*ry+k2+IQpg~siGQ8;y0tzh$iA+D
zVcd~+s=W>LjeM~>KByTLHP7Qyqc;|gJItIs>XLpXn2X~Ta@sh+ixVCcFs-Xy&OBg}
zd980-T}N&vcJydz6Yy!T@N?Q65s@(xyX3~jw(w2#GT+D6zWGrz?6iMMc)b@-?c(BW
z2&(`~h{Qai8~>nF$auXneF^-*2Nn6e9N}dE8Ys8*td=E$!X&dm%d?%YmK6+!lU9CH
z(tt{W{!-Qo;}7x;QZ5&BzmH7|<ZK#FE-$u9nw}x3!kAPKQd1O0cAEePmfRR}zDHCG
zL~e_&8L#@YoH1?4n*{OQG@RXc1SU(H=cy?%gwYxjh=Iz@nbS$(2LaUT&y?RIvJQG?
z=RGHbP@==fww+-<2r`6lS%nula<+X6tyo^F3DRhWm^7}mF;7Q1><v(&D8&18sN#wH
z4z)rYx;b5Ni6RK+a5ZoVW{BX_iQ|4X;7DYMpm{kE--F%9=*v1T`^tGWzyi6Nv%zhM
zaB`?ZV{&J|^@OCweQC>9xhr>SlV@@%<g+imKK0qHmy#u`%i@yv0aX5g7@FJWfq|#r
zquc4Z?UtrJfe!zaRclC_7q0kbEI0TU)*x{8RjJ$a*#l?lh9%1(3`qxk?#Qrbf`0nL
zK`-AG>tXjVUq+kF9wW;>zH?ukDa2rFU-q?bKiF1B1U&)BtY1*B=ZrM@Qh6khT_QX%
zB(}i_#`vC3s9TWVkwCSiE|FWJFX=>_u|PDDNKT=0*+E0}bKi#eUxWqSKQQ0+@&W17
zj~<PEzv<K7zRMd7`!jx!3?uZmP6+!z-7Q5eXk_I10HgqcS0O?f$s`i5=+jUc4(YH2
zO^{)ON3>3gi};LTh8<G%!YqW~HY-}|ok3VIT&Rp~S+;aN`3*9MtBbxAN6KaRfDjAk
zXoO(QTRUfN5A@1H`fXV*z)(_Gh{+O^$6J8ZXN31T??PlfWC2IPw;F=?Q~-JPr1zB*
zTEN<^f_G)cq5eQioGZFvJ3aS9dA8Q$C~%1aF4w>XTCn!g9JusmYc+RJW7(fXhBBW;
zhU)s5Y|D9@Y(oNfy<}^78YnTW&7#9|KlJxv1D8nPCVM3Yff8!0>~-MgyZ+u7!CFT#
zB?ey=;9?BiRRP?!j1IpDJenPt(Gf7CdSI$gN(_37=<tTqz+LzKy&r+QMt~_5fSZ9C
zDIG_KRsc5v-(hn`vYS3-c-zQfHGM73Su5BV75!9GmDxLRhNw2CJ~BW9%9jNFGp*>u
zPklR?)pE5s8w*hb->c=mN4PU~@0?aYX=N^OB7e!R#$teLORuFlY{mKVQVoG6*0yhg
zdXye4VX$b+(5tVY71D}VJAC%3+eCU%LTk@eKSIKNk%8eytA$CzvU;3^<RSvYXZ^Wa
z7*~b9-c3$SctcG>tc_~;@0YF%Cfn!fpF@{9ap4Oppx`w%Ik6_IWwdx&%fC<WY7`L|
zETN3q*+%>{m`54QQXwA8Qo|jqDv$oDn1MG|1zZrTh+Bj@{hz)4_vm(7lPWvT@>a7u
z&jwcC95cQ*zUJMRthRg&{em^y;4-|jY^DOP&HtKrq@)z!^h{g~Z(}LIv3rEOw(=Z)
zoKt-;s4slx&G*{+^#n_Qh%sFjtBR6*v9VIW{%bHN1R(w~UBZT@61Rn_)8aY(E9VzL
z#9;m-*~*XPdOZa!bu=2$pe?SSo@q8~7q9(yV{3-9MoJ8)z?P6DSo^(z8VlfKVq8Uy
zr2$+OQDc1tuF9yfuz;&PYOH<Ws+t<BSg@AmC^B?+u`eL$_$`;<txgl^!fkZhgV5PC
zjw#&3#`!U>oWNfyq0eE=`4Ksh;H`ru+y|2P1&cX+b8qhwUk#~Caqp5Tz7N$>J=*|N
zqe9eKy;_Siq-HcveOWn$7TUb)G-dq<DZjbChPgJDxj`}8aKn0{y5TCVQqJ5X0;x?p
z-+F^GzfCU}Nq_5W_2K(<vp3jC+1Ysd@=^;^Nm*l^r-do?p1^K6tU^QH<W5?`q#L^h
zw|nfkbyQ+`C_8oh%2CYJFiW2Gj$Yd>{+B_aj~W^cEc38+c>KGJ3Mo_3Are#h=Lxkm
z&4-`d8T7sHgo)l)LEpQ0zDk0U2zhJRd5-R-AIqqxpi@W3#o_z-4|pBK(lX=g^X+7A
z_eH^7hf7{N2OG>e@^YvrP^xV4${J~@o2kl`*5wu@F-OeLBMhAkw<}xrw9nbsyN2zD
z0>2b47qidzriV`2;^tr<x8D-$44!?x3i{d)qb@RVX`ELsU0T<~hIUL<XUQQcn&qJ`
znJ${;S7|VG><ilFs3w`-yS?2fnpbY*V_uq6A5zXotv}b<T3+P*$Z{QBtQakCs~(OV
zY^i2vVwTV4i{pwVfh8ywHHfB>C!u~IB=*6bWJwYD9b<zsYtE8GL){{@PvMkE-ptP}
z3Z0)4plL-Ki|bF|ZLuU*adFCJ<S(bzMd3Ws-V&3w)?U2br{SVrq3Pk8J~LTImXc+u
z??b}ltEFyp@Lk$m-I7C<*H_E#6$E6Kb`L*c`nXGs+B))<koRV?eV&kY^O4^OvxFzG
zSdoocKU~q;q$J`7KHP~x_&m1nWxKC8i{6rBWs&q-&I05W>P)fX%4a15S>Y@F2qlf;
z9EA1_G}v8L^@c+K8f#?t>P%uhp~@s?qpqhcUw`#Ny7>{z`f<bQ*q`lyg@jRAe1~Ro
zIx+REE3dK^4MBEiarMGa26EKa+7VXYW|nx#ew5DPrx|gVX3gOAa%%C^C3GZuSIzO)
zqU&H4ZX6S+s7LO?saM&T)k8=4Nmy{$2cy}%vlobJPkrsCvFdeleWvDecZO82z-Ml$
zXK$iBNt{$3E6N+JbhK<QOB%O{;%MaBrUMeyb@!H`S5~qe0|%O~VkfSqnJvl8;ds_q
ziy;*YBM0GBZr4u<u$Wn@oins6sm=N5bfPg7@Us(qQ!6>2f*RPLw{Q4cULrXkBl<L{
z0cN2Yz4uoEII0?-<VF2Ue02;ZOIUcQ@F%+n)7SB!T{TL}8?Ng?vuDcU@r=rw0t6MK
znx#R{F|N(^Cev@pnS|#@4#u)L0!$FwLMw0(+<I@7O$#|^F|3i@21~ei)=(C0{cJ2H
zKUt33n^k13Bvt&BJ{w=~<W{xc{5*X;lEqR`%T5Ga#pDt9<3ce?{*!ixw<-mPwcFUS
z*E(SIDIp$J`&HiV>{vpb5vH*=Y5b%y`<Ii(K_PzzU(8o`XQq4NG~bcq;qk#J2Fc_(
zXf7M-ES?Hh&fIH^pdZjv%HJ;KLn_m+<TESNdE1;aKv8r!D{8->@zt7(ew=eG{%xNI
zA`O|tn<-cMD~r@A28~YQ9Rg^ldyKOnpn0l3ZkbtP;{a$`y6Y7`!xp=Nt!*_beufqR
z$N&*kK2V`cZR+l+NzhAOY7!XG69_YruscCB(PH4kheqIoSnQqPo=B`4L0C7+3D2Hr
zwHtvb%8ytvoL+!OJhbtNZiGno9U($!#2w*YpYn+=O(59Gg)$5zph+1b6wu^|g`pD=
zUboF~a)A<BS7pkAkPl$RLF%hAbwuKi3v{XM$`iDIMKnRFdxIKKwtYpE&0TtilKc>P
z$C=zqbApe9SOnl!hAOCX$R&`}1?r~B+EUwkG<BU}H(PoqHl=|#m0i70rvg}$O|iW^
zI5w}CJ19+WaJ$CscbM`<2azm2&v10hEpSviek`z5+J4Ftlbp(ScRgnA*<hRi)Y4E|
zK&m6Cd~K`<;k=HN5#79wVJ}B>_cK^=AIFK@H&FIU<~*X~swrbC{;AJtfCER;@%qld
zFI%D~E>?kGD*L8~Cl#iR2*Z|71)$R_#aOWSwZchyCb9eUPEa`NT;M4xgISQ%tAbgG
zbt<QfK*yVqfM5MKpAmG7gWN!vLN!i6>U)X+meWXf0L#Oo??Rztx$Dmu{vhyGO54uO
z<9r~R-N=<nTe9w*a7;}?K@yHdceD&)^i@jJ55}*M)nNkwLnB&-+BdMVtxqS+j))8m
z_kGUIgDc4NTX-j?kE9GuLSZ(`PkfJgcdUBIi#o(Th>lrzs6Yf&m$*;CvEvT4G6cWU
z&yju2>MU4y=}AM&`Yd?WsOZkJnb5xW4Z)+^4v>=vZr^m@LwET74MN!DVB!1dGx`gT
zznLG5$B!HR?<>zJfbO^|WMjrPYd;W=KD-mLN7%|*p}_ag4FG6I<Tbkv<cD6R%7^We
z({`lu+Kuo#$C^8$wV_Gj;5&dpGciE-qGxK`5@6s7a^7^`%e?gT!Lxe>2%mxj+JNwB
zuQxVP5OkHtcIstr13pn`c%|Saj)3i1(9kxj4YB}eoKBlDIKM;4P}TY+y=U(VVun%h
zos=h<zj+6ESD2x8K*(k{)k)kXhV74yppxxH0RJ?slJ-S6`{^2_lCDEv-Dx{+cI_KT
zm-zwXwD~J&V{aXRI2S*=!5?|msBQs%ss{@g@s0nm(I0uLj|=z|Ou(`Oa&_B7gSj1M
zO1I+@t=;IZckKJRH@boGf#$Zv3FA`FWKGW)Amcl_LBmEMk>`Rpx_b}O38H6K)@EQ9
z;N+6(^oK!s(^3nzL6brFX59_(mVym-J7QOpdk_EVi_~Lq1H5}5aV60bxPvbLw!Y`;
zaZtylR0Z@#@H#-zlh|FirU&}_kT;@Gh#)`_NS<1DKm~+7R1tnh7W(eqEp?f9hX+JV
zb@+{hUq-w!-@u5qYkH|qUub=8JK&&~p4gWhI>4Z}Kb~On^iPIw2j0Q?B0*QCZo@y0
zd*gP71Owz8A&|70#fS+S4Z>=+zTc6(V0L~t2q|#v_lE5Z6FQ-MgzEg!*tfY=190bo
zlBznp^x*l_0khe=2!OvNe3|eDjjg+Ra2)prRs4P<^9b-JQtWX$@jA3Tpzw7NM8@)U
zctrvMJCsm11DzG}?sWno7=jIk7DDAgf#?=ac-odw0RhHUHpfEP5&`+J1sQ}65sO~R
z00Raizzp*vg3vLSE|`U83jFfXbxY);tvi?|8%eB}9+krN_PU!KK?MaDC%Xs54hQWd
z5LyBA9X5=|lLTQVj5La58&ldDE-d{s>F0F~3|@o6A2d-UFrR5gE5V6eLweqoSSTWU
z;&BnQd+3i4a1tqG+G(8HhiMZjND*X|#S<p_^5lY9Z0q4?w@7o5^+2@2LJC;oc!Ehs
zNRANPz@$lJ@+p9bDm+>VD^5O%OjL**b>NNg=e*%SM_U{?0~t1&lAd@<Z7hm3Agqdu
z@-cCc52gEOy!Lol&-WRo(O~H69}FujX8YU8AJkF9z@mclkW^@Z<@xHRvQGdMXIRW+
zdJn>EP@o<zjA;TLRarP7MKna55POx)Bv8#IP|P<->ETW!oW3K8v*?cs_b5XlhvY@%
zmIXR;w1dU;D1T7sQ%3QNBBP5Uq5J$%1w%YLp9cd!?3XJJny$_f2aa@ARKHOv+#weN
zA!&JT%hL508*O=hd15|XA{mdm`hbDjKo4Jhw`pnjJ;0h}9w_3JqFLbumb2l|9U`^Q
zim<D)sEOwk%a+qgms^#VLnSg)M9DQ6drrJVgjIv~I<ep&L5V@H69nd2mlw;FQ^}TF
zeM*P=!C;gA#f>CrssOP!9`|W@Wh<ynG3mo1E&{bdP+!?9i$FAl*))n@E0s+;jZJ=@
zH6K%aF)m(WE`omuDKMxY27=$E2u>>k5+O<~V&9Qy1d?N+@nP;sdi7X(EX!JJEDMG{
zJ7-J}jOQH?HJ$4*YSt>8G3UWSDDglE6LaCgSSKB6-E&%EAxJMHCo_Y|MhdnAmvBNL
zYOW)M<H-U+g2oAEaV<d<1BE2mas*b6L~1)yI5>v78!+<h;-!~HH!MksQK@u(`7wcj
z<07v*i(a53i|j7M+!>f7ju8Y7Y^fDjGXYcTvFk|r$NRQSrfH6epO<`uNWR%g+hBv?
z@efwfz8s6dVow$YS%dWUKsp8u*?{mUu&^&(TLA&pZ4QJ9^Wk(kSiCUM^lE&?uCb&3
zgFFWC*#xW)mU0yt!O-V0AED#$yE%Ho6TB~<*Fl(&J%8XFyK=a%g{{sbew;z19OGEe
z<tHdc<v_p|Lbl8RI;P0pV%lo65X8MK0$U?O;9<Jl>rwXQ+V)NO1W4hl!z_s4IS1ha
z-H#~OM0z?Ub4R!W@j8Nvm%l*TiC}gxA=rIE?1>-6Y`rqAN}tw*YUXwqGKm-$Pws-|
zeqOiM3EFcD3Hy{H&#G{Z`~(BSsBb;sWeXRdqe(=%ks}C*&CH=e+CL2AjD8)0^uL7m
z4GP?bKV-@wf`tGx`exCcdUE4+^~4(rYUBfN{EaGq9RZ1GnCUZ>nK@W5Zf|{B=9)Z6
z0G1gh+k6^Ih>-;edmn-s&v;-R2{}3X8j*)22{X#&u1oIsM7{B<J!U8*3Yv&tq0r5S
zm&np6foy72h0w#ykI*2Jw+{~qs1uQIZ=FlhakyMJeHNaS(698g6x&^Gf&N-DGbYvB
zLue@e&;*&-%!xtm$p64gEAm3F(O~06RVB-1z^%#0A`wEsqEGA;QA{23A2@d#2INf0
z1yQT_>Q;l-U$mUT@1LEWu{z{EF*!=3k?9vBlo1Q{Dp7%v!_XrNpz!hto7rl0Y*ALl
ziH6xwzD7oLIPE@1ckV;n8`L&2bD^O{?n7Lu%)vaum0C9+nFI0CD<@S?H;e0}H{m;G
z!S9z$$7H(^9||l*J86W9CGC?}&5?jONs1VvveD%oyqR+~k3=S;0oAo0u9_Hl{ReN1
zEet0dDEy%#@}3G{pkvp1YsVu0ChO@`k8@wPCnsk>FZiuux>DG<?QsCN7sr$H`=ZDe
z_ehRv>|-}%np2Dm%8^Dm>~R$o4zxS4$nS~;++4FCd0Ji7j6WQe&QK2c=V-1OUZ0R+
zFT^q0G}ArJrMF=r;Ja(+TdT{x+<Q3LBPXEOe|>}F8IFUFYIe7WY)aVWg@rp?IFLc?
zju0|AwNt#M0#;#>@ut|`;$Hup5_nKkCHWrD2ngaP)81(Fr|O{H7G0ZU$<X|4*NV~}
zo?mC3;<gmV;8A<qTf;B4F)^k?TwICKgSDm^>4UL$5Maz8j+(H{V9*CcH=4?y&9o3R
z`_)~Nok2dr-l2)MSYs5UW)CO#Haqn%tv1!v>}DP!4kFEFN>iAS_o1qaGWmyi6QLQ1
z<HhMpHFv?ceE=8M#++iur(h+)in4arW*VK|CUH&qQi-A&nT+06WtyQMrbX|rYuL{j
z{;?7>xOK7`+4kO(Mgz&73qgaobNQ!93Nsf!LFKhf`-eHJs?uY=0dD-SV$jO11RvF3
zmY5%Fm0*l>a!tdHj2w)NG+7{i1=;%I|EQ&g!Qhigh<j|UD!B4(-_7XbMXcmGAX!Ou
zA;|X&?VWMqRV_y;TIFk9X6e_dT>7ZIgrSOD`bq*$x(%*V!NUV?xP@Rl?xq{QOV!z3
zo8Sc1*x%MQFqjFld)h2f-mRZ<_yx~TMRE(=7_soOlf4>uh8&wUw-6^%C{apKvU$la
zmX0POWCsF?Sm1WzASa;X%cXFK%WYK4$P`bgT0G~-#K_YKbfTRZoL9>`=?=wRPC)Zv
z7w;s{5zV|L8~)Bg#G^}**({&$n2;IcnWElbx@PBxzUT<`BUU=8t?Hu_A~o3wQ)<Lw
z_--0fxE4J<k7Y|jJvyBDPANod|L*<z;tA1QCJFg0`_X3PFJ3M-TezYEsnnEjdl`Eh
z1Asy}{~nhv{5qTa$SaX80g!VyWA4YTrYnRVN8I|amX@(uwERA;Rpc3{3>AeJwhM&y
zT&1YU)gPIv5jIJ13)f0n@nYOfLu*Hyr{beY8o7aoUK#TU_kFoxZwHl7PxX;bE9sfr
z*FN9wabbV#sPl{B8QPvB1e=7h3~VdmO(<nCV81^%KUu<#iII<=r;w8!Ih<8V5Ky5b
zuyetP4DnOnn`jfxsHJjsF__YC>+)u4Nr`35XFhLxpMW1S<O(>d(2vVGeRpR^Y3}9g
zeU)57^fD9m^<+tvehbWLq#a8^go7r0yYp|2T9Z1YyAeuKol}TEQ;sl$O13{?Syh*9
za$_)<h?t*2VQ~xvvo9P9#3zQvQHNTRgu!Xf2F)Xt>bKzK;~IlCt|I_2K%;tLa*g6f
zIdY>__vty<voxg(?)wzO*ew^v=uXbKFT!CL#gNg0nO)Q9Xas5<GP!8B;jh`9|Flmq
zvnY4rOGX^k2>pnGJ*0&RX|Fh(y#9e3vdJcvd+(A>;Ni?h@fOeT7g|TL&v=CR=C^3n
z;S$vVif=1Kem<%p4di&7-YPifXAP_Ul2jxr8vD$!X$5d(3A2eNdgx^=1G|)6n+HG1
zy&yG#w=kq$y4w4c69YPms%fvb<u+Z%Tdqn*_6}}x9J=0}P4wPx4A0;5jTex8h&%6}
zrnPI<p8!%x3Bnd2m-&}uI^<@eYoriP2Qc1I8HDDx3Kxy{?45b!1!9%Q*0CkKWHBQB
z8YhU}8J&6u;Ggnj-LhGEg!+etLT<<T2h3L_*gQ~;x}vX&cxhRRPfRe|3=bP)SKBa_
z;KZ8lRN4u!vCRf~D;A&{6!fdF%jE!{@dT?AezT&B8dko_^s}Q4w?z;-O?R^v3n(_)
zkWz)D3ER1sifdKdjFB$mUoF9<`#0{+S;?QD>7q9<PGlJ*Da{SjA#c@hm)onbi()%0
zN$@Bw`VmqSfuxL-^f%of9bG9m@~zxYYCp0CBmh*{Neyz%XC+K+IYP7Vf}`8ImE>z<
zy<boQnRorQsT0wZOSj3|sSLzlfRL!2-vHDfkf;{qZ%EV$2#I>*b2Kt@2n)@y#Y-q#
zC8drLvPm(!Hnpa<v@HAg;{Ie3rPS<JKiuj53DU)QWmQGYo7Z<#*zm^t1N~w+BFk1I
zY5nE5&e6&rVYlW&fP{24j~#>OxBm@w#wviLb#5tKpp$#xB#lRUEKtZaytXN|%s5+=
z{S-bUIwHo=fV9AYJkz5&(SQ1VIhoR-BlY&qeZHzS!HlY_Ik=Peb7v#%lgM&y*KNRe
zvp)4g$P{$Ax=OJ%A!BZwc$pnt+ieNlnPNJpkLm*}8ljH&?)xxPg{9{xHh#Xeh69Gf
zP1j?d3FL23+N2Vrl0W@I>DBNs%1LO8Lw;%^oB>Z479qScmF>u7<^5B~Y7cuydpEeP
zTXGdXH$4#QT^_~3#7uvxlDgaay@j+%BTZY<7>^xv6?PJ+*ppA$dU7yLdK724AqEvm
z?pbEzsJL?I63E8<Q6U710_<cUQv~avU>`kzlqlmfPJp!{1<wAQY76g-L+o;&*6U6u
z;RGyIKJJ}pGK6@%ZM7&l=^V%;40aq7p*qS)0rHfMywFLu*9E<yZwDoB$crO5Y3in<
zu8-={Yq0cn6n!!A`&P#utT(#K(dEa!B*D0it6l2&M$0^PhISaF(pc=958_DK13Ez*
zqP&KE+}CF>a0XkNSfdNh!O{J6fv0E|Uvj_5Ul*$ncf9hOk{8T4nsIpc78&PIlqbJD
z7trqQ<lHVg>Dm)@Su7M8I)kw`DJg7Z`qDqCUen)3aA`|5$9+Q}0<%o$aFSx$wQb=e
zvzJcqdaC`rW(32=M`d*?Wm0A4z=^s_5Xrp@Rt1yTnE8`8nd^{{k5VY0tZOtN@4d+%
z^d;M<nh1$YpvYE}rsQxbIG=sti?s(FIbvu+7#W)^ovrjoROCqxHR{-46}5DjS~L$9
z6SxBofj-pOKD#e5+M(7qTE=j?=~=}@wWE=bypMd?_96p;pTlD&`y>xguQ-u+>xsBK
zw|Fz0f=76^V{k*NJrXqD+1{022^JIDgi;$1s)vjAPEmM&F*t8e1M<egoC!Vw1j(o~
zJ|xZRO~3jArg<#@1T(G?qN8wZ;HK%&{lvcnV|eCNQ5FUT-(AN9EuxQz*u$<;#4*aS
zPAv<KruP#(>)A#3OJ|<A&Ys(eW)ALBSyZWR&=ya9o<o})GG+EmFR17*$g3)<t(I!H
zrz)5XZ<FMjQ3v!V;_NrywB)8De7gK^On)4;)>P{~6+C-&b&x*|TyxhnADm0D1IRYh
zObB<}OCA-SeCy?55->%dNKBHszhRA#`_*iDslur{lGgXKp;*PE^k#@))b%Xe5pG7E
z;b-=zeGQ(he>BBxTp6yhU{k&1cBMH<Tj^P(fxv*0GWPv2qg22&_>MW~naq#?_H+8U
zk<lKMZ9f8I83wL9nPC~-1K|?Y@vyAu*gV>7r*e=9MJ6BiY%#J9Z}-@Ir-96FA@ztO
z!781n!U;Y;p)k=gvKVx|i#OrW^5kp8J+9BU^Jw82j5bs_DX}y=gw}+!;31fU<uBrV
z`<(IC7OzSPbMZ=vg!qYAyBxT}5%KS>CM#FS8{{VM6C)14JY3pFa0abP?P9LcKLmsH
z?}+iFsvgq0sJG$iwVwd+3=85uGt+FqCHhz3Pt1b$)%TY2%yHel(DQS?4k^j6R+QXl
zTeMUMBexJ=^OE#pt_Ie%?j}v-YU%cIIw!*iF`&?P7b%#{v+_6JtwGt-FZOi|5$<&E
z>fw0hH=({Y;^nF2evUXtg%b~1HP&-*aOqu2J**RiITT{Kx5$oz@=A_ZO*E8kCcZzI
zzIiq*$eH!Lev^V}Ad(S^P}4CZ%+v3+9}e_w7Tj>IQq&0!(Zy_MZf0E~+yf=VOUBwy
z{;77ru}31On^Q+>X``q#>BAfD><ZHizdp83Fww%f1LJ%xs^))0_uzLPb8gRl!NfoY
z!RCO7+OUo(swAKa{I5@w0OIX&epH9OVc;$uFAe-MUVAGKse$HaaO7HV=%s6Lbg^?`
z;N7za&_D5(m3^;Z<v(M2RJd8@JlW7zTjBLO8&|OTWX~M1b<OWfj8q9Z(2UfjeJG*H
z#~Xk@4A_1opt9SQ_nmcakhD_+%6#P_qZqyF^oVeHl)i|h3(4`4ekqDUbeYm>pj0xM
z$9GW;YZL}w2kM?&ywaIdWRu}#L$1F-z;Y+djTH9Jc;;D0HK<C@_3KzC;Gn=k(!pva
z!!GnX8wY<^=b@k>an&9AM#wn44tVp#*#x626)($kS{qD`Nl^_-H8a4Po?=Cc3Ad_u
z7{>vB$aSffZ^moUHz0K(VYbkkJWiHN&o>jV=dJZLG{kUY8>Cq`Ws`)65h~7SeOu1l
z>70N)l_f1lP)jgZjE|0jE6dLx*{?Ka8qcE-bu_kjuz4R!y(nRqvsQWER~o4+<ajEc
z_Q?;aIq5<wI^_fDlwX2nf)OQpa(gMybJ`R7EX^a%wNB#--v$v|d5Nl1P_3+4_E3hu
zVDFat-07_)SY2LTQ?6H@Kw}aIkQGA_Oe9`T>Tk~MuN0<@+g>qNv(QLfqZ>hW#NZnx
zXa^6?2$ObUf!&vu6O?MY6Ebx^Me0129+R!?*I%kI{a@_e1#Dc~nkH;BGsF-xGcz+Y
zGsMhgW@cu_#LUcW$4oKA%n&m(#GX3m{@s0U_tn+>(nzC`j<l;vYwzXSwNcjks@|vU
zJZ(Rq05)%~%}!WGYo?7VWF$|zHC4`eiZSCsLdn!*rf98UmwcH$vdIixB~3qfBVkHe
zot>W@M}?q#+Gf;dLN{*&`eyv5;&$=ye&08pQiOn2TCeF7?X})Q+|9D>?F|d~LfH;$
zV<vvKzNl#)i)-id5iPYj94Es=Qc}+sb9IhF?sn%ND=gcd!WW5XWghjU&4kyXmRz<-
z{2NJRCB0;7JTy5Ynbes$Uk}EjBi*K;4L3L+%fplM$th!G6VCR>WJ{V;`9HEp3_rDS
z`#mlcfA+QLZP+;o7Ljm@^EjG%xBGor=DyMUNwC6XK{&*&pg;L~ort_iN1dFS2vf!k
zjgh-Rr7UG%q#ePEyBo~O3vxdYGvPVqao7M9XTz}#><nKIG&3`1ve<;zsiQjCk<t0=
zs3`0ZvP?MyS6id(9Ghc=>G78luDvsue1}-5BZ%u4^MYmn{Vz^Lnevys_e_uAKs0WB
z!QZ8^&d%A|zI}j0Y1_h4QRpIpIu(+Gv|g!*sN|3oI3Z0+n%<($-=fZrGuieQ%2)38
z`G`>;1n?2K@A-&f9+Cp9SL0}AF-yN0DH|<D`s7G#2~tikw}yU?=7|k$<K^|;6TdaG
zs98^<9()<Tk#v+-{;os6Ru_A?=ZI)g$lO|x=H_o**0XI|_oZ`{4b!4vCvSAH-UcpC
zx6%y)Pi&XQ69HyP#wUPrpL=^=YZo{{*L`QDySDm|>48e?V683Q%IIf@TJRgXsewk>
zlrRqbIq7g~sWH{6VItSL1ly`%pa8#^MkEf0tlUN6dupfKY-;Bb(szvy2dneQ6AXFh
zkq|qgKE++XOynCEtPcVI48iH!K6Nlddf_ZlAuqRtJbZ*nq^A@I(o8q6<>Y~=?z=u_
z2WSJ{jK@NqeQP0#n6OAk0N`v`c>gKdgj5!A)#KWE#ACb`nQR+cP5O2&RlHwLFTw<Q
zqs14*o(e;95D=wSks>Zb%gvo^N6X)gEGTn1=)h6Ru|2!MU?Q<#b)oKHjg=SWJ$sgh
zsAsC3%(dYE!=U~e(2<!m06ucnSA5+^%v7o>_nGC}Zz{XJ@9bxJCT!n#06vrM)w^Uc
zj5KhRvMH^a-AhNnlH0X*B7hH0P)%#^euE@1Kgu*y$}+%~yeT-rP41q|l%YLGPm!xe
zo~$pDj3g}reJFDm?Als+Kd2}oB^h^4N+Tf<Wx&a?k_xQR^b_YA<(uw$S6d{4lZk0p
zsUeOpx&^x%oJrOhTwS2ur!>d9s+l93FQ6o7v2aHUG{okSV~Q6`EsCZ7D;EcnId5{y
zZZdoCe%~Od<XVwnH`ROwQ6Jf|LJW?G^g4x)zybjmG|YAgQ5%c8*{XaNg30k;TJO()
zfhrnC9WLLX(mJ+S4HXy+bvdR+xZb&b5`nG?ug(x0h{(vq?TgU?u<|V8pt3SU1%5N~
zObD9jbG>uZm273|C}AMOV_eiv#;i@|&z+=(8(|I$+kw!db1!+cy=>pK>F%0Iy`*ua
zcfO7kQ)QFMLLZi-o|Jf<`$^?IQ5s|e6(Wj_jU3*$=h_$`$`!9bxfc=rT}u6?eSd9?
zF`3{0?Ah+pd#rt?TSSo3WUMxMiHuO8MzJMPLB*fu8N+WuQj&5@A{Lk1Ebxk^Y@7Io
z<3}~)F6b{?6X6t&NTouVIT~s5RHa)X-1LrWWSlwRKYnbb?VsX?a^;H4AEcWSR0>Af
z0P#QW2)=@Qhcxhu%zKBFq{o!BLWu|aa@j-bobxa75Am-}rSeqfVDWG({8;DV3T}~&
z!pTU+4DGl^{AKE@INZddn^Lf{gcX~Hkxgz6E8zl_A?Hk@F6kR&%yV#!XXkyXWMPEq
zbX}t;`Q!8J*0`=yvRE2LEyK6Mmo2oG@-g^i`<K#pMfD^_7b2<db()=cC815PurI@I
ze4^tME-VBGrg1P9dHa+5xBQ@tw+p-UwXl3+$Z{Oqeoj3DXWWHL{KH4F9V2bvCQNek
zyx%xESWa;gT|LA3Qly{)-;~tL*qi9S=U1cFlvtXe+C8GgtC1h19yA{~dS)hQt6z}e
zD}YT89PoWD7S#!-`#g~POXHyB7sJGX`fokoD8Ed<YKD}3)S7i^HF|fLe8WAvyB2Rv
z56@a|?Db8d7BtvpF2@WC3mbeWT$gTGcO!)PK|4a~;Tbn<ZzWFIy6*UyhW8JitCEri
z7JnIUIyyOS3ozjKYeTf3--U=Un=;tjeFj6!Y)bfDraBJ7Ti>dmyS|N3=y#l*trpWR
z{$_gKkgQcW6R5O32%_fvnI`X5zE}TP%Ad;Wb)0k4ZZa{V*6X&l2OVgnfao7zhe)P{
zL#RTPNRlV@h~kGmPjNw<8kz!<x{`O)g7jU!r8R>z3Ag<G&d!S$KPG(H&xw@wTZmmb
z-+Gx^#f}ZsqvVzm9!hgnu<{-eJSfwQ|FWciH?1d<e<M*27d1>aXJN~BT^tjlEEzdR
zsslKI{<+j7pJJpCH91qzF_kIAMFrb&+AY1@TI6Zj4)$nZr5TtRA8`X-O7y-&CKg5H
zIvI@t_#N)RZCw>^uAHU%J|;_bnX|JwQe_tg<JHTMjvrN489N{K9xRQKnGg8ZFyo>4
z_7aMC5nY2oO)Yo5Df4a3igIPati=aeR(g?}9~-T}yCCkAKg8))pOrOQ29A!%rQP|*
z5$TQSP4Huv$mQ75Gt1}3T_oerM@8&If(_)UPGE`{2D4>ykQFu+L^2g(<@13&Mh><0
z$o`pLOw%sV!w61M9~%?bvp-XW5G5<jM51%pr!lA1r}Y&;Kd_)R!A&6*)4<CUVb#@%
z(0=tOpfyQPUJK@1$$%x^v2^1WS{#VP)`@K2VG>ns-(#BM04AQSCx?ju(F0o~sugsV
ziIH|J?4zH5m~1L&D#=i&f}P+N*qB)%BE!`l*&;n?#rC+M!Tq{H_{NjSl;OE-aYu<p
zCH*Srg0pR^y0)HH25YHM*G%-_grYK#kDKnp_PpL^dc9T@AeSLFoOHBiaFMO5@bwX6
zr%DxX2^nHjYPwhu9VrMR)e({gQilOG;fJ|YyMh4DRnv(6<f>*HF3Dm*a*>LM?O+MF
za{bJ-&=-l7&-=(@myszswAGt;zdvUK^4ZA_=fI$>MAidj6t>4<K$CJCW&|T&waes8
zH9F*Mgvt{8sEb)$=8U{(V}Nx5GzP@IuoB2I?8Kz4WI?h+do)Q0urK(nREE|YaCjaq
zN`Y5G9!w7pXeOogtQ;ydh_9yaZ~If6;PW$a0O+U41juL8$25^&Yh#k?TJzcml~1M|
z-im#q(z=$O5pyJ(vC#t>n(?RnOT<`;L|cbw<3T_B!;EwRo^_;c0#uN<rwbkG0=p*G
z9r2!lzE;68#Zeif`aX2I-$(A4-CEHyv*X*}eM5K355PbJx#J;AhG6BQ(K9|#*0n->
zB0^dIEYjbOw{ruU89m5hY7m9RtM|o@M`aou(cE;YvZ2wy4N_mc#z`}_a@IB9rm%9Y
zdE&n3v`!WptLGB-hfdY^a1y$7@9~5cQ7X<NzruC;d5O$Evzum?1137LS;nh5^V%gO
zsS<pM@cFRFT!y|csRZ$oRjFqDDvI}B?qL$_tq{~Ft^5=%=(z46JR0X(gPpz-we^gs
zu@4;iX?;!-H{-iKJ-M(Z;h7I+tj1WeNtQk5EqFRAcuX0($<OTa4t?pGeJg0SMQt$z
zS~mx=Yf{raQSeCa&2oglzYHFBTF`g%@OU3>=o)msR-7){>)#(4vcPWL{HSyEMk3eT
zWdG&~_Pp%va2iGk8j5rZ<KF^6K^P^r=KE2AikqWT-Ca6sZPzWqo{Do|C1zPB#?s7o
z{ysP7R*e6!crL@&XY0gicvzEc8SrTi=>;D%;5d(({7!eRR^mA&h7Xl9^GYrADg_lz
zyh4`t+cgS$UJ9(@c*tP_4Iwx0>3S8lc24bPW+-W2dVSDZ?xOk62{C8uhVP)uIdGVh
ztg4YJ7couL%^B4B&uFX15r8Wklrh@vNtXi3B+8^l3J!;v7ptlK$jrBsX!r}|rTyLp
z#}V|z&nLfNDPI)#<K=sNxjgAsc*A%*{d1Y0+Xd}BE5Tr5TH^q{2b3ZKrr*QWVE0i)
z+P=lyAi&|r-Nzv!#Rcv6(Hu&h9>uw6KvY_`>|FzV2yXdgR3|pr?N@g;w>M8N90{G^
zx6LomIaNj1iES^DzUa0_Sh_UY9lDXiZA^wZLErvVX_h(o0nQ(K$kk2Yo4*i<G1F2#
zD1KrF0|sf7r|D9TXU-OY$vYoi`&d2+qJ+cLyjlEQ<nkndyD@U)Ysi);lYuAZ!;_|(
zxXM+ZXeyLWOU(cuk;q5IPNa8snAgK~n0J!z;CXSK+Pd(5mMlmvNNj=1bBlTLo7YLg
z_iEs_mfphyl$uLAASN%QtA6ohFAfH}9~Q?{YCYd9zI!_H>ykQe1Zjxak(8tmehe;7
z)<H`8<62YtW59VJpe}>~S|%kW{xSQhcyi>_OmC96S+q%2QrNVlGGpv)N6s99wS<!8
zEPC>kj-`as{8u9kqkD^I4foJ~n?y}+;X6@HcD}gl@B5rcOSfJ6MuT!?7}ts%yOTK`
zg+YX%YB~-|?u6mOy>EM2=q<6I<#PfZ#N1tGKvpPU?6fha7%@pbn_MtbFra@h4_(EB
zzOY>6Kr(ju1%-I!wOPJCWPSE~0JFmJD-<rFC;D1wm<(T<RI6y}SjZ^&BeTm`4yImU
zlV`x<7M&RUCIa)a&i6hRbih^CwArP%N!m-nOY}tv%_>-kX}C_NM{$!1UfikOma@OZ
z!F8f@|IrK|H)tYQZQA54L%DepM&4Z8ssSI_EQRh+p_)L%k|<)XDptAyvA?=MuK-Of
zAL5%p#se2*XSHCXK4#NWvibv)-zTvx#)qiXC*-<AA{>@fxpVBv#63jtPS#}u)@2@?
zl{O)$Mt?*J6ewL|(mCSlbPg%J<@zkBz*3dpD>v;o7@2!#O%Mu6;4Egll8xO4-WiJn
zMGED)`dp?Rb|POv$w7?!@z5-Gg1FEqh($~&#;P70W<BOnwW^j&!qaDKTc>1?FfMHw
z<)!z$^lw*r*=KW@GSW#C-98?1E?L5sV_sW4uZf7s6O2n5Q<+YkMuc4J@jWCPNQ@o&
zHoqrfkI~Xmv5)`IxP9#+Q$#DiDjNXXbUaa8%V~}`VD??kA$RX_Tw)|>e{G(zZ)fJd
zD~Uc~=P5MD#msZCvwfef`>`UZ<A8dw)68kO#T!RgmEUo9(xLr_RY{HqLCDvF2v!bJ
z1+r_$_01_W8_?qfsj9^-?tGF&u^{cLqaUjvR7z(toGZiq8YPXypPDCQbB`h`d`o(9
zXMcL?LBUWl?epHD!pM87-?Uj+$uJ9UMPIPXc8eG)ldl|Tt^37d^-#ig@e|dx_+$hQ
zHNEj7t?%CYZrIR3IHA4&b|7b7#tNO9hl9=3xaZTt7yI+UZbJlNc}DK^wIRmPL?vOJ
z-9c*>T-H@q4bv+nZ2D-GRhcx@@z5CCR<33$9fIme4vDow+HaNLR4_d86iA|IaHD0!
zS*LTe&cCl%6lNbG<=AuVDXo|gv;1VXw${;MqTV%E3E_9oCnPdeANIxh%-X^F6bNug
zG^kM(dd-`g__8!?X|vM6GLG}L;oGE;{SVDy4ts51dp+f$)%E)uD9_5t>Lm_KU3R1>
z^YLd^_Mm+SFYTv^P3Ur7xo$t|=>dk2N<qqDma)1)t?o;_Qi>N99j%3<Ei2xHhdWM6
zH1BV|$|j|}_!&(H6Ck{2YxAwiKVRG~`uo&*ydsNEsT;|C$rNMuQ{!;;HH;cuY2c;G
z%UD#q&WKolNhWpmvn8apP+oLBm(GN9#Bp5(Tjl#)pF(G6)f%!q$By_V`d+^sr5Pg&
zB)?ruJp>oo_ah40+UPs!-zYxn|76=q`%x>)c%vurJ@$2kQQJ-VcE<17VsQH=JSVmD
zJ<hvT4)uwbQQKu^wK#n}GEEBl-GO6=$RmRE;))rG76&vK?XJk)nBg~1+I93|H#9p{
ziYozzBWPOGph`Nw9G_=K*1>Vh0}HNkY)0EHQz>;1{$rgUfp%r`DN|sb(vFZYr56qS
z`r@IM2>tvahCu3!+vMUQM#&5{LPC<pCrq_RY)O@_^y{UYlw&l8PpReZo@(N*JK?$1
zspo_&y^8aT0MNqn4NQ(qdx}h}si{lW_9`1crTe|N^EG%scJKL#yF|=Nix>e{A+F`#
z*DkA9!(#_?4Ga)Z?PXBhjH~`n$R^c!_NT@4wggL#$IQ-F=rAVm$CIU(dvsW-thrtr
zPRRjdq#Sa?x^k2)9P?d6P4o5I<e1|uIB8RA0u@>|4JbJ)cIUCIuqNZ!{ha)9I8cq@
z*o{G_;v5pQKh#CVUY!_|UNVV!<VM!43M0p!j*c^d@d(t2*+m>0>X@Ik)wSJ_Gl|d2
za3j;}$I&s@SHl&1f-@W`59fTsGC|H(p>P&uuTkY7pkW-d;|jD7)ob=lKWU)ih-5rZ
zT+_K$^~?5Ummo8Cl&O9jn`XQ(Q6=n_8~MT#)qNpulNAcxh1CI5B(hXGwdVb`@n`$w
z825>*bC{;P*HB7gu2BZ|WU+(7viHUj>#`(WjNJ5-UQv^W3$<uiI%RLmp<$+8?;ho4
zl6O)ml%vyIkNkwDV<n-$^G;9eIsPc^fbfs);-@Q-X1U@b89Vj#ay)XH(mpo%yb=s+
zGu#6<g{r+1g=h(aSFG7lkV5Yg&l}svD<_#=fy6k`5)n7P=*2I3b1iiq`dJd{BHRY3
z0h+?<Vp87mG5(lMb_!?B8%!p)23Qmie#R@<hvdBZ%RRa4AIdkH`^vaJES~XzD>d+E
ziuSr*{4*`W)R15z(HRaU)y0M=Tinv1)Tb4?Zjm9ra~AeoN&2;|Apl8r<1O)~Xz#EU
z4ys`>D@jkirvwdYkm3PxFD5b*C;Y@E836^Xtvfu0g8A2pL@M1-f<QF&=@jM8-61dO
zMqj?jU;b>5FYYC`75wI~tFApiI?mxsD3_8@-xibM8FlKYhb)Hh{7CkbE<8NB;<CiK
zrc2W0Bk=5z=LZ1VZNyyy>*${fYUtAUak=vKa43_rW6{TkK%oFE?Q(WgW)s;HExz`x
zKP?<y^&SG{7*^Z3xn}j+Yvf4KPUXK;iH(2XEDGEtTg?9Mm27$@f70@ju}NdhNvErX
zR<Ao&mOL4tZArl5DWoxo-8%L~FlGchYQSTTnHR*NL1Bt5Fbh0p-85!BMV0PM%ZI|m
zKn{{qH1KTTtid)8B2xu7hBRTD2~T3R^}8t3bkkKEx;mhD;`H#O@y^S?hNiM4i~O0q
zRlb`#ez(U!4ns^+>W(lCW$B6yl__D&%CKkvk}QgZm>d;KTogpyQ-%*_%D+NqXRF8O
zJtMoZ#Zd5Kd<1zKk)QoBlKw989bPh@N3J)YqqP2R0qZT|^wPlF@3)Qq??RQEM_)gZ
zjF4z({+2gaNWB!gN0c(wSPZYnx@wz}gW6chFl7pV#lgZclxcxcTnrdndU;-2!=^PH
zsiR*wDqPLx;4F`8E*j6wYdP|;TXz*}$Qd9C6DGf0QEf0e4KLZQMcrqqi}x=wRUTbJ
z3RABbi|j#6Tq)959tN*%;99m+9IrczLJjWs<4fYWT>}W~U;6i}-b1ZumCd+Q1yoRH
zkeNozh~i|nGy)TDK$uIRv=F-F_r(QL*KU+~=6q=ItppO{*e<0dvwEc@vmQ%Hr=WM2
zn1B_LsK5inI!v!^l!#+wfQOVX@rWsV9Uik$`Q^4C|GKTe@<`D1`vg~z)rXzJ+yya4
za6z?#eUwGZAq(=M=|g&>fpNa(b0&lG47D7n2KI*v8^gK0Nq%=d1_Z32_veu=@-tOV
z-sSsRJ#y+ll*(8yiIuGmVKQWN{b<SbFD<7Y-+VooGWnW6SmE6gbJmt9k=JjWvpjRY
zC;7|d$vjYQksqQ+8C<_#j%M+<5#W!tzcKldv=K!w4E^SgDM3C!`B<>N=S|h9JXNnC
z>2UmEy$V@Ya$QrxPKJqp89{A}P8hVTBA<NaTErkEy^8D+;U_ut5lVTrTtHd3pU)S#
z5*z0RZI`f0CR5pEDg$-Rf=FYAyu`~g$81;iJ<}{%nGuzel4nk_E=U`^Y4NM{nO$Tz
zeX%CxxuBeH+7q&h8FS;~Tsa`xF<k7{QTIt=kHpiC@tfd%vwEIXMT<l4n+0^zCm+>k
z=U#6soXlQF-PyTYAjs;zcQ6J%RvSmYg*S$H+RIBTap8CSe4}QM@}ik@<>C{8yOe=U
zW{H8*iO@6hoR`caUaU}MlOB=ssa8d&O9p&b{mUOyD!&43f~pnh7urV;%DkDYZ65uC
zXri*1<jN+4baCmQs-LtRnx5n&Vrih0n-f@k=Z|21Y}W7TEIDj#ZtBhrR7VK7+kE_f
zi=Z@gSu;@aipqyE=E8`Vz@{H>@7JT@23OF*D37d)0sv|hWSn7IC&)^eQhiwxgVFny
z4~$MuZ6C}GK)_UOTpA3v3LJhSAM+jYH6Gp~StJb5iA0g99Fd3<i|DeZo2e*_kM4Kr
z#dgkaTo~+Z9(-D_>0iFrm<z7ALF#<WBB)QRMD`5Ux?VI%YhX*zz0q+V@SqRm(Yozh
z@)$N)AM}-@Y`rB@jhui*8&bTAl9j~F8!R4NX~_;4Y8aB*e2PS#I$d`;&57Je_v@*$
zx!WaAjWnyY*SZ;Q?2U4;?|p25rx{kTp=m$gq|R;Jt8baBH+erD?<5pQG{^m-VhKUm
z)!#*W?f66-bq4EYsT|;f{auT3ZwZo!CTAdMP9}HiQ#`3jlOT}>j<-u`PeCJk^RlK}
zjP$pav_b6RE%OvQ(9(eV36f!k#E6FFM&mp<WLNGoBJPuoB7>Ur^(@oV3pw#xCbzr?
z{Hp2(3ECLAPeS!$RKnl#q^zW^aNrjZpCaI8wz}S5&WnhicXAfTR2ysCPfJSM^Q+ec
zxt}*X-bwLgZ#WS=ckGD(!LA{%DTJW*TsVw(EaN&C<kq=rlw)K>niCTTh%8&g4ynjv
zIaQ@BLW)JKLeO)P@yl;A52Z<qJu()tJ*oCyF3vQvcNw`HRH7TkkB*$F>lx3}fxOk9
z+Uos(HAr$`8zW&oP}gUh^|fa@9{kE2%*#}_A12839v=M3i}|yB?2C-Ui)5m2$D{(C
z!Q7I?>w%n$K}sgMd6AmwDC?N#rT&}H@Wc7n^h3AzIKo-~o$HCp<JsiPbzb|O&oi@F
ziD@pUFptcJ2qbsK-*y!8(B%6V1t9XAEDLR$>9MuHP#=Kz+df(;18yhNRqSSLaUB?w
zBV&5Soe-U23R$&wOO%aQjjVH&#3rl|?TTp2h&Dm)pwiHk6gpssKEQ=x1?RB(YQ@;~
ztIiclVT^(TfXw~3ND@p{Sg>eqih<o8=EKG|SAVd^EcED^Q52=9<YI?pI<$-Ho8*^`
zJ6fXchB%n~>!E_=ky!$soL^bt`9m^1_@eTW(y+Z@#@^(qum#so{!U`Tc%u+~mu?x8
zvc(W$AL<H1Y`OjQ;)$wiZtD*sZ)<)Z$T(0Cs`La20i%3hWASz>a>d*@cr>{<dA8i)
zh!oJ9tSrE}C5eo40WYyc>!T)lffcLI;Aik=X(e!+)Nk^1;Y37xlJ5LB?hQl^#YMX0
z4Kf|%B(kQE<Rtg1*6=A%uI)6-$E%2QPSPM9S{hjBR?OL<)8>xmai9dzz)h1nuDeB0
z$%M3ptk2!x!_=_04zgrRHQpvB|E@aF`iat=!aFLNv-cTijG6*+>wQ{Q@Q87r@;<(l
zahFhqALNl<5R9$O1Rf_%XOq9}_mECkizYk0!Q)7#RtmmYaa5Uf4xKe042xtLSP-9l
zpw$s(+2U%`K~@3xcPp@5jX~6H7p3xwB1#*7;U+Bf;n#<U9sgZv@*%N8<D5W#$N|qJ
ze}%lai1oa;=gq?J*CYF`rs(aYp7i)K&HEds${$;=A2H5S(+5a5q<x{0H%K-gja;h>
z1a7=+J$cSN;_~}=45gy;_{Y96ABGkH!q2?R2Hd{1ukX(r3$!115?$9|nJJx8#3(fh
zluGh2^rRulQzXeE?S;dE);R{`sM5Q+^Lix$)iR`bwK$L596VH3=&<xIYP`63c5w$t
zpm+=+XK3u+(Am^W^vn+zrirdGBb1ZOhw<2N5~J_P1X55zR1z}h5G>v{;Ww}EHqRyX
z_4|^w3Aa*<w7LxX&BqnTv5K2gf`ZM#l|mPq5Pkf^@gR^Faq+bC5mlI07#jV)LcAgO
zVB~f}S08|)56KB96sb-j%l02}IGkcca1l8=5e=VECs{5nq|QE2jdVc$Sg<&?Vm-yj
z5Gq)J-~X~RS?lHXdOSaCJ{*_}v>TsBejO;zP}(KEZ+c&_b20d+ZJXe<qxofSj~i>k
z2pr$7g(DOOm5an0Uti#Jw6?b|v9T7)&&njc`s79J5#7*;sXhI;=zVhvpF?23O&hk!
zj6-@Q2+KxE^YCyk4B6^{?8hLxjOA8b2q!B^N}=ok{JtPo;!`bN#_H~En5<9J+t_c_
zO>MwIN<3lr<MGJwZ?l~!N3jkf?#FswibSPzg+sdMj^|X$8N=u8^NqbNo{xUrZ<Uq9
zggH*z)2t)>?0y;wMkh{Kj%Er!U8z}IxfKJD<x|&{$||@;!`h_z+fMn7;@7#Hk1)Mo
z9*ESpf1q=@DN_4|sr2!^78m}QjsJM*BWM)dM)x(~tk8$VLa|zp3iZc%T%Lavc)3oY
z#p+@;`$!&ZcPGej0{HwqIig3-`&fLsSR>T)d><QsUK(r6;VmT-%yk+u`9PlF7k~Iy
zAt`?()clXE(f^9x`9~DbKQe_>|KB7h+5a@r{*u1J@fZK>--Qlw{IPHTDSh`}?ScPm
zSwsJhoCKnh!2G5EhDvh%J5=(otmJ<ngTT#a{};C8AG_sWS&~eDF(m)!1MKymb|i2a
zD^R55Vg()z4o+4EE+9z><QRc$BgdbB;~%~Ml^OZRC-@tS1Tv6BoNR1B(eqCLlZlCe
zo09{WCB??g%D~L=2NL@KABzNfoBw&`|GUs3RyK~mrugb7O#rb-6!FJ*IL2&o(_6Um
zkOVXsv}ggfEMy`krJ^r%dvs5)a9eyu3`{&r&g|~C(N&YO>{<*0QwwUQo}6WiKlt?J
zMc+hz7i1jXx>=sZuCK;4o0HJqT4&P77N1b0k>x})o`kPth4$jD9*caY5Rj8KSK{~Q
zw)hzqc~WuD7+XY_PABgvi;updTfKFf*am2^TS;mN)^9ni^3w2O%xb$_7R@rZwpw%*
zEz#hw7n7k@&BG8^E{aimbr1|YonselcKj(kj!x~HS+h@wAL^|HI*tcPDLFf<OeM@c
z3XK`(wjAx8zP&h+{J1z%1g%NQDi)Ee{jEG*RLo%u{Hr`52wNm3VJ^5W{0WX(#AO+L
z5_f>$jA%H5Kq!P!sKGM)c))w?W$mkSNDHb0`GZ5_m$v)uCFq;BpTDdTs80<NJIC&k
zpvB|EODMZLfO4docZ2Ewyf^=qY5ePL>OXHdf6V+RIr3lKp8j`ptNy$x{x>=D&r{^D
zx#b*x$u0kn+^WCj$iL;tzvalk<;cI~$iL;tzvalk<;cI~$iL;tzvalk<;cI~$iL;t
zzvalk<;cI~$iL;tzvalk<;efjawNxJJi-4O9{tyqE4BZoVF0UIe-apf@D=|bfx*ei
z#K6SN&CdE42!n;2ft!no4QONhgTnyULRi_^**LiW8O7jaVBunC25K6Ar7?g5vwwv#
z*qInO{w#g~c?{s_Jv%28D-kmr8#@CR6B8#Fuv){y%)rjY!o>Q|V8)*VuKzRw`xlDu
zzqa}x>-w*4Ct~|^@BCBk>VNKo{~SpEzo2Aru(C36a&a?p04r78L@dD46gvk4GdmC*
z0qy`XO(Leh*6aQvIsCgy#ouz|zt&X$oq6#;&x-%;g2A7b%RfUG9Dgz`e?4@6@m>C-
zV8Fu8%n7{i{@syeX6NSmC*9;{x2F$=dJC7|MYZqoMa5>LP{+LaEYw$Y5iki$V&XtK
zt$`#6OZ4v<0r1g8jw5DJP?$b@F-I}1CzDh$jmu(CL515v5b14!ZL#B2U^I>k!s2B5
zTkiI*&`Q0RQ{KHZkMV}3ofqd7x}}%=k7tJ%AfO<@AXgx&CCIeg4$t_mAVr@+%%>_U
z9CTdP;0XGBL4=kCKju86pCyRlfX;=7?K|d#$db$+2Ur9qh|9Hj^cv$v<Dq*kI9C=(
z2>bahgCPQ_5=cZ`@0{OQDwgZVLmWHEjx5M7G%rI}lWM0&Ju*=ny3pqGEXU=*Qt6u~
z1&B5*2q`bm>aX@1^mx#Ob`XHXNbv-ZAc{{i=u<9;=?Z!DubByc?<XRV7qIEWInUha
z_R^z95Hc(fk@Ts~rm5bt?}&ZXP(+1Tj2%AOG>}W+2{K(h9#(6+tl<yO*R7yWg5V&~
zEJ{oPTAu&`ZPG&gQcBQZyn+bk?}sviqz~#y%e43O18;#?pb7Rev0w>;4JA6cHxf|S
z3z|W>s31B7jF~ID6>n%xrfxekw=L$zuM6}3KATyq{!*J%8(<(OAP@r^iuTZ;raS2(
z)F9M#x)%a%c^zgl?1_a>yXT%cK0g(aLy3@x+f=wRvZ7hZ_=y9&6*HT=o$x)Rz=W8A
z$_0)HfC3>9jVjm)8}d+ueL)0YE)?enj584^eH};*@b|5B7=tKWpCyVU^Pt(4pjC}t
z`bIqg^=8_HZ@m6ngDd{`H1GYr93BzB&ja}ZK^XHOc7@PKpcjvCTz+`|=>Ew{>F=Eb
z@8~8fdecc;YSt;ZKMUV+KAL3D1o;j92|n=hxkk40C!{{qJ1g`xJ8E32ovT?nGS4rB
zFF3ox9?iFK{UiOu{Ux_^gfs!(8nSN650N?5?H0d!xGWb73WIAWbW<K>j+{Uej5xmJ
zX@YEvv{7tOqJ+TD`@$(?q+U1!m5zDe_Y`I@(_q03tbSw=RwL@Be#kn!U!u@W{VZkS
z$4v06M$~#p@J6V5P{dThjmBIE;R<EpkW7SW10-#DpZdk?5JUt)3PD#3@Y4p#nUK@o
z`|eR*Qw4=!WU$v0&n6#<<HN=4Fg`Wz@oA;y&8(mV-EO0`L5TbSfiJ-4F~ZTC?rH8n
zu)WX}`m6_I!8+T_A`0Tt?=Meu$LfJ5SnBiP+~FI@7&!8b7I8~nm(3XHe8p!7rtJf}
zo^dfF)tamjI+ot2Ug~=Zm1hX)els(m_I~Bxg1)1`$4D1YE>gT<vFGR7FjHd)qxwv%
zkhixPQvL?MJ?(>K2s+}vc%#>0*K}x%Z*mTkG0qsSzOD%%=*2sEg2<8V4Y~CoD7m4p
zi&`8|<4_1xcVSqkekah_@$89<H4J?Ov;!#J8FEGt1F3!B^(K75Ish1dG8SMiJ469>
zhz%ij+Xvx+SbaPYM)>{6GMGD70SgEqHDE%^;6kO~FrC7`FSVcipH>mOf55vBm@nrD
zG~&Ar+P7g|1S9yJv-X*SFkN(fvJcVSQD}20_@MQ;U$}MQ!jTTze>5eOD-dQ0;e!-<
z=%>7b^$gWhG)F-$r@%LbS(liQV&&988AVw}NKZ`M_qhS{4D<(Q2%Z=f@W9j=Rc3+U
zIiA>eyYSMI)*LXitwApGgD0;;wEz7P2Z8h6`FperAb1t}di}9~|6wV(dlG|>obUu*
z;xKU88M&#R<nGUTJ=A$~^9hJdr2p{%vJvTb|8OYaflLLEr~pU;d5TS-DzShL-wN!4
z1?+MQTm%oKBs_tOZT_KG<Zq$FQvzqT11*Xiphe*ZoW1^^dc{>0aF#hxt^jHWdB8X0
z1g>Kq*t;CqI|aDN2}o1`-{7N+@>2~^$)E(T2OYSMRUlPS0{jagXrT$TF4Tdm<D|aS
zAp^=4qcszC)TbR7*{J&IMyji>%pBzU@b!_d^nK<Yn$R4B9jo=+ou?$WVQ$UFtVO3H
zw%_z`>$xjW!EC3`vclyZHEB7-_34)}+;ZdPg*CylSv!7xK?lke@_tLUwgdW8%OM?E
zbz`U2-^~F_bhc2gQ{O3CZJ;=~fmp@Zg>@fAr424ee@*!^L`R9y-ep!yY;7gMXNRTu
zx@(u8#(Ni8A+am$sGkcfKYiBJMC6#R0sh9lqoRIxPa_r2;0N}Ejdjey6!0N$6LBD4
z7ImPmIdoGZ7kBVeG43FA5!sN?P|%fM(1+b|LuPTq=W+^pt84F9y8Wj`*Y&k)0Q6Fa
z(KT3yJ(4zOHl01$X~`z<{Z2V=Ne`R47U%h<6|&;qBK!K<6#$&`A&YwHN4aLJLHCoj
z{k3U>2R=?ujqAp)D_#|OUE2301_N2+^Q-3TX4R#Z8vQN}wofBi^NVIh_f8FMQ9_Q)
zAZ_y81{b)m-}2l1vLAJE&mu#+foeq~<tI1bG4xWTs{$S?Yv2p81w4v$z}6Sw3$W#*
zNH+;=HBo+|03NqD+$Tkq4Z@T`|HttiUj^>BEK#J(p9fb2@<_cE<2#xd+;0tZ;f6{3
zSJB__E-?46;Jfhr@{$K<l)2yN5(hhlktB0|K6|-pRU?i4^!##f)Z>LxJso;t%T4ua
zRtt>cSfM^`pqXf(0-}M!HK%D+VI4($t_t%MB8wc98?H*6ChI`B;^o?I_T%96#?e$s
zpT)vU^=4Xl%5^O1SY8^tX$*NU>r@2TNZikzH|Hb|N4AbjI)R)YN$e<>&o;$g;`6K7
zc!?b{;Ydx_WP~9%mQZEcT-9r~;-d3|u#2r4>K{sPTxu{&_kX<a&As~AZl;3+xlUv~
z8AzsBT$C%T!4<sddRk^a)W~D?QWJk3Z7{Y###hnP0!WYvG9Ixbri-d#YNJ8s6+(om
zNm4Y0C52W?_b{pG@?!K#{t8VBy;b0z%|e)hC#TF2pun*<8x$#xkC}ldXMC9+ZR2MV
zU`oRNDpQ8XL#BogOYU7s^3|TjTSt{FrK_4|4o~Kx-jDzEHuNmI5ZFRO#z%uwhvuyi
zk)Fe?P*7<5W+Lxu^YaI>X>v(ie2jx?I8vZ|1&08O!Dk+bq@l#2Y^iJP0iLEduR993
z25^6lF-*0YP9|<w9aUF#1+MkU>3$C=TIx7O83YYW&}kfdSUcRC?^(K?h;0Sz6^7XD
zfX($1GR|7hqXc%n`z-d#By%=T^CBA0U+U07qTy<-<l$l!70I(wz>naH2rej;Boc@U
zTm6id1Vj<s_wQJ5=PbU1?aB5rFgSw9OS3S}hZnI4Q18AB80SpT1Cw`*juHS)2Tc^O
z-Y^WK$3ahZmd;5nyQ!2cnm(-8<KvU5for;?#_JU)i+8V4aYjxDkYB%wCixJ1W05@v
zok+P-jbXMJF!h43dD_{KsH<~qCXiN${2Y7gy3?uTL?qO}FV9=bBCCc+L7dM@8YGEM
z-W=uf7TRbkLAmG;I+j06yR(zNd?IU_R@_R()6fsSg;TG!s&1f+s3V!rY7s7P_MeYX
znkFq~0?TqFkp6foA=A|AE;$~EPV%hg#-b3d#tO}H8W{6%PMWldV{2yLV-Szo&wO<r
zc(PX58p2ZZw{S6Ms?noK5S3>Ow;A4$xq<u&E8RoHQo}-xi7h?*9>vR3!?GaeM8rzx
z`Rn}-<}4Q~oKeaNa?j=(Exa|Zb_$j={Cvruxj5%8CnTuI2ab-EIwvRjH}A(%`AVUq
zh(%b%T7^R9wv|xm9mM<(KaV^N$He!YA|;|dw?%UXN64>ahD4NB{ZBe>aPG|5G6M@r
zszvm3c*ij0d#c$0y9k?>Ue|e2SKyUXzoBrukISvX>5G^btF~N9)MWkzt%RL?FY!kf
z+#}5ES;%O}BD)QRm<ak}Q%&ZQU3C``8ViXH$IqYD+IkyNf@>*cw;k1z4r9^^ZOz<P
zO>POZFoG=C1MG>%@~PZ0RHaBvHc4^$vnhE>;#oo~q4F5Rc2NmG=Q)PPPL3P1TW~<W
z{$$PSp!&L}JHpP1Z1#x)G>GxXPKIqDLd8#HILk#?r4?oH4IWS)t}2IqP=!+nu9aEH
zFjp`HrfP?Nh<P3)dw}lNA6`Z4He{_Up3in;TyQ=<_;zcYC<@r3<7g1w>F3cfTi{cm
z9`Gqtc#)F{21<LxhzX%3PMBa{dxQvr_!K*Y*wz>E8KtEs2xec`a1aNjz9$TfYw!gQ
z?(2^iw5Wm~FK|&`M_=HkLr6|#x!|XpdP1mj%<w~rQJUihl(4PwLmO8dv2*Nx!~b?T
zHAD%{xM!paL_0N9f+JtVVgi$?p81L(p=H=71+*ywoUpBYK{1);UJxXN+wXB=!kkW>
zxu7L<^F_&XOn#$Jn~g97YJl@YnHL3#ksMF+0R%Y~zHocXj(jnV0--c+Rbkf}gmM9}
z8iWgVCiDwhzD$Yul)}}n5GO`S_pom;6xxyn1SeIbOgJZ1ibim6qc7Mc0~n|18Bp_8
ziUpv!Rq;kVywd^4i;_&}B|zzcF2l+fB9>`_2SNU986kGjIAbc#xnP9{!WpP%!=Rmc
z2uwC33B&WYhz#(++!hS+z+eeg-V;xT!&e0Zi1mzoVeFW;ctEg(vt2<}cSue}j{@9I
zMPp>N2>V2i>I4F!jRWsN^}yh(!2#5Iw%y3-^?M|3-@OPw4Vo=N*Fi8eZjNY$-y^r-
zrD=TxnAI)3K+}a!RQvZ~)=mCFRlwN@x(r}0dIQL->NbNbm#?kc=Dd(=0xPTBcXZlT
zy|8M6ZK@u(z1oJourvmm7kL5TdKTT_oDF;Ob#q?O_F<`uTRS6w!h828*mc|A_!|B3
z)$T^@RSlbA`3-xxT6W!tt$m8st=k%IU5JZX4*fc9LtgNU{nd-v0N$$R&7hBf=EdwQ
zRxJx)<W1lC;^!;pC*)JaCrI8+Sa&UlKCh?td!F^7IQKy>8^SlVMcvxL+HHFq!gcW8
zricF8m1|Bwd^7SzsCU)Uw!l;KJ?=VkZ@oeA)_?=hs^D!~T7~Zof351i0$F!B4~5=w
zUnE%Wi~GC-YJ>a+O3?JsCtBAJR2pFX>kI+~`w6QwcV?~<?rGj22^tIn!*>)HX%j+v
zwQBn)+|Gi+tJ8N--PRGZtJ1e?&)Oh6s?v>U`Mz{RY+Oa$lh_7NX)yA^=~iLwIQ+2d
zhKcXzI2HH6BWN}VIKSeo#B%F10WJrP2dWihwyk;LrOVe=%f{Uxyero@9&=s<ZvFF%
z&Og8vb!P_cm#z4rXBzgL>n6ND<%Mr7HeP}8J^*cu#w!xu9*7y;&K)z4*;T~ay1mM)
zq~^~LeX<(JXQAoU`d7GJw)cGk9zRb4myF|^;Wq>L7g>SiMRQ(Yt5Gem9kx_$v3+?J
z){MRx$XT6x#n5HO4}RINyQr{??4YYSD7dYEYUPoSFBtGxRk{Ph>j(2%UAj%=W5f>`
zzI@GuSC<zQza4N-_6KpHI6w*b;RP1gM|>)M6g;??d_|4d;?^g)V`2mC10`8Sx$S(^
zm>0mft!l&j2LEnl7hZUk*^J*4GE;?rh3R9@k7PL5TQ#zS&Fcp)Sv|7D#p?%es2$%A
z%Vo|F_4_O%$f0Va5BSszDg*+egQ*=LCr7}A^qNBi1GfD+`0POvMGRDI_MHL_q$>aw
zg9GSTbP)l9`T~W_y7YnBcnRX5Y6lokeDQ&j@2^+l${3IdVj!r&9Z$R@MraV>dtAyW
zD~iik;)(s~5TI=8Zv;LeVab>{Y!9g9(h$-Oy<=8S*0?>Reun$viQtLjwk%Ji4OBsK
zSI-|vJ!Hf_+QR{C0YSZ_xln}ASKqz|j#4jU0Un~Lf<)652CyK+!UMno4QRn(gxX1F
zuowqqKGMUc;Gg66$dr>Hq<4jP*`N$D$fOg+0Pnh2nA#eqP=@APJ<x=dL{colj1vtp
z%ZY5#VCkYQtti-8sQ4sELZ+h#S%}KYrb_DGis~V?An=nUNRD+On~jsfliXKsz|A0M
z();-2Bd(75WA2JwFC1)}2Nw8#<53_imkF5S!cS46Y5gwLTfwzdQ9+|h*lbYB;!hps
zm(;<vc_Hz^s6F3c3Sbnv^pnWN9jRE_6hq@7r~>aquh``w^;>sN+v3=K)=42T)Ronx
zm2rI3)zzhw)P}xNZ8NK7LnsEugQKj_1P_~6S#`i6;R^xBL25+7ndYw4mDt5q$<;B1
zFcH;%vPq|@4;9mFvwz?}b(Eaqa^Z7KF+K4FaDx~QLdsN71kq$=l@KFZWyz}dAI>Ta
zNJ1qE4}%6caOl1rbqszDoVOZuKjH8}Uh~BnIj*P~%c2OPz|AT-jUuth`dYp%`80QY
z<*L7gy2A6vC*jTEY0Ke|??6$EOTKcfD>-c_A@$+htf7jk$;^TRt$lasbLYuXz(+_&
z+yX3LbyM!}vW1Jz;-eiUjeI>t5?2PQ6gDV)m;x+iU{QlR0FWLWwl}U^g>-NP@V?Bj
zT3)*+DHAR&!hp-6HOxOritwC(d2?bP;^2w`o?Hb=lC`k{<_LyCm!LJf`Iyg3#>;RJ
zR(-Gv>4OI<xePct4O<5;?QHVS++7OL2;)vGWJoaxj=b#Y69-^EtZ*aoRvGr-T?E<Y
zU2RC{MA7FxVS5Or#+D4CQ0ZuF2!lUdHUKaB3NQ!QObNuoP;<hZ^79Zrtd>vLZTtr4
zZvsY<#J!*U4nRkZI}7)?T6Z{H2i5wNoaE-u7x9tiVQ`^BoTvPudqz%OgSQ;!5e7K<
zK-x?D-A_w&K~<+5J2&jZ2X{Cc<iO!X2(rHi+L3-+JHGbd3vhsn6~220HyDKjdjcVX
zU)mW=VFsSpKKA)b$Jf@|vo~D^`7_5(o*V51oH?#x$WSas3|QaR4jx~Bb7>38y6#fa
zW~AZ=tm6d`f$T#8A&LOj<%>3eULO_=c25A306!WG1X!3Al#izXVU9jVoiv1DN#qez
zaK91C)l|U_B_%H>C;SZ*xGA`h0Y`u!bU}pi%y-9?z%x45goA*9MkZQX-nDZ_3&<OA
zP!KrUvFCM}cb{#cpn*2Sw(wVW|9A*cD#;<n4N<?TEpVo)-rjfw8)=|LF%;%KS*MM{
zF-XgOWGGDx`2h>|VoWYx`!KeE(4pjk%T^YJT>c|M3A{+83bVW+0LVvt$|?YFbE=oH
z#aI(37<EEPi*5s=2d^<bX<|XxuQZSMLt&yMvq?k(*0`XC#O#Qi`fWB#&X>g@rKP2t
zm;RmpD}j)$%2+tE2)O*e(=CQ1e~!yLg-;4+O0~h2LBgFq-V=_QHgQSk&@*6o*5Fwe
zpso_L!ULkX5QC@o7BaV6(?UvZi>v@<e*hAc?&mKiC*2D%kkCifO#ujbo9iDsCyfiq
zzw^NZ1xx*exp%>_Oh?$Kg^RNBD9Si-jPRDFV|;&i#%wMF6lX^pP{l*dNF~zJo_q})
z{g3mZW~{MQH`}Q0qgU5{A>%li`)a$|yp7cEtQyqCC76)Gvr$C=0STv?Fq?gkixQn;
z>8}MxfaJ3NWuPGe+@s`Q24TT*#w4%ygP7&zO@`Un6RS#?O|r5_VywWx;=uvYA^3g$
z?bksHGJpx2faEsZI29x#mahgPRGgs$7z5~;D%iYf*sm{}$GWa=cRD7NR?=i>^*cK-
z)Z~X-iu{joya{=`i>Mc}#>kf2l$CqW=7nTX-$|GocWA|MG`L~(&q;E3trMNTw7R-9
zPN1BAw?Ex$`vr({{i3wA@(7;IPY{(GoQ)Xl8fWL$u64LKg#>-tMd+}=rbAiLp>RDt
zj9CXqr5`Ac>lXs=7XnKh0?Pvi0sb{Gu)v6EAW*OCvlA*BL{v`EvZT+(qQx~B-=8AH
z*&iZ=CIIhSx9ZN3Wn2oi*l~-%nl1Jhe77@lDqGlN_=TQ?(B2R%%iP^<gswnV0Mn8k
zeq6Q(_=x#14j0<YJ0`R<SWNTY(=pUD$t)K8%eNRY=z%w>Lf=wf3)5&k8zC#$Bs;Qv
zuNXk&8lJKiHtY~Ao`A<ubiBZe59f}*<LT&hdpR<9s9I8U`BXW)%45;$7}<^KNB4JW
zTmdf|W|YaqImu9bqQM4_ZMsCju2bXy9XHlBO=W~~``Qah%?_L?ej<gtF6AyRgV>@z
z18Of}oCPo5m)xrDtOJTUVJei!!ZIOG(>`~vjY1tXQ!R7y-<=7hCWC_|N*qq6p5@X#
zQs=r~<jeLC1z%c~J1qzWkzq6>0W)ykebD}~7O-Ix1+IL&PG?dpv-5WND=~r-JejPz
zuF%!+*589)Q^I)%Ic1>AnXF?e3I~taG(NlIB%yx4mS}Y)6M$H<@No1E<18pUfkUQ#
zWb<0(r{&}Gum|aNZ&5@&<nrkd?Ze!GOYqh~i<H^JG1(GmiT9mdzJicuY-oy!q5F(F
zhE@D6u|+OHYFSf0ulM($m5nIp{^NSf;rv!n%N+BN%Ls3;kKZp(ct))UmnHD62mfXq
zstRWV47UI{Bo>AXl%O`!puAs6GuWL+8;gDt@jNUj_Gx)LWZi2#xP)PyYK5F9=Pz)%
z$YtU*KRt)Jd?LQGhIs7e?mF3}O-_M@OkmRte(lRx8RFs415ySnoyakv1#4cM27#UN
zX*pWZ?AC>=H8o0}Kgn%`V+rP^suzn~Epu@R7owWs=x^1*s@J@}G+IZvRt2-pbyN>#
z12r0oi^Z#y@7(4Sji6*-RFl0I>Uw%)3OT3HBFVomr+ZL}>iDMma?IR)V{3c_`=<Ow
zViJHu%`WR364GA0_PWM36Ov#0o@7nrPkgE(JK9ma{(uheFMWCW0Y!cn3%tOjjiDj7
zliLgzBa0v~tlMB}BO4<K>%}^%6<3O2$C<^DPKoScz6i!?5eqvM{*u73_Urm)MtrPn
znXWlnX&N`}(%PQh`6p+9`47%u{~w%zv{f!4_vDVt9M1>dN~DG9cLj#iF?&Cb!v~Ws
z{O`;c+(^*j9w*Tfu>#Hub(T$nxEp3&!3~9+^r9IVW20#Tz|6nebZSe*M4X3Ed5Ibc
zuHLeBLtK_v!21r(i}^=*a$3)o*Z5Lrh2Om^8SnkI;?eEk5i4@>1-0Ny{5xm5y_T4c
zH2tnU6i6)`ZyzZ8HJU&~<w&6xWdcRnw#_p|Pw?eFq@P)$9x3N|1OljOI+HGhz9|}M
z;mgDQWfWq(#9(6LHf(yRZ&I1cO{qI&;_XLaZ{C{Ipr?(d;T<d`iu3FK0%AFqieiy~
zcs2VN&-ZiGhXBx(A~FFLijYybuRbV`A)FaGyN(pOe2U`*xaK0C>7WClV2Qh6#h5?m
zZY<VUbM?$h=itNv%&`MqGth)_Sn-K@e#cg(+>b+<RSqoCKwv!ZMoqJY#c3&JP$*%O
zQ~7o2j-gU3F$hITky=sGMu2ELi_t_81XU%JRCGH+lhR&I&h~$WZ&9BA9Gg`b7Mnl2
z07)XvRv63bC!wmRPh~(p$Kl(qfFAklnl-Bh1V^C)Cf$<Y2LpYi*oQ$0Fz;#DfFk#L
zW|6yoM`Tuts&xvH6Ai>82GDbK`ywklTHzUM8ntp2T`KVI1Mex=Y%Mz8vA>$ltD=o1
zIXc6T>vT4?6uIm#dQ$n$zfQn%;x5>JAY1^zY!CGg>I~5?7Tx0((-NPJqr&<;g!zqV
ze0@r-LmLe?B0%G~v+Z}}`1|-WU>81pC)|7Yd*ONrdc0Hmx|{BaV(Ug&XAEe`ln5iw
z)c(315fIsNPC&imVr8@p)v4qt$G0w}NpK1Uu*($A)l?}x>4;cU5zD_==YpwoC6<B7
zC2;*b#XN0;?V^jexGwb6Axf40M`Ai8Ea&%Qj8n4pYm#}4)1riuNY}Y9%tRQlYG`%T
zSk@t!15n1504XIQ;Kj^R&G?VR^vgdJ(~BL+V8?&Sl=sQ9Fv44=#<FjWHv1Mz;I!pW
zx3lb6A0V}>{t_}6kXy+q(p$wNAN)oiNq%`Jo;aTwdP<PWPG@<?JWOcTAzAO+tW6+H
zEtVQc(=Z8}q^wP?uE9|l6JnVG?`-*m$}o9ubLxMY^xMS?hyG&g4b(Fvr8p1ED?a_^
z{<o&d-IW4JkKQsQFfv`>S=DD2$Fay%m<*33+a9AMbOTJ1$2VlLBKO4lp24+nwfaJ1
zO9{DhL{0r(T~n$VP5f+@$BOBj<PB-LY>WvRc)P;5MVlM8`ieSPt&S4}o_L%S^d)f1
zN7%)(f~|<4qog5rj#@U25C*5Wr;cUaC@)0H;#kRoCWk?VgNf-!;#oE+5LoQtc2HT4
zTU2n6-ZF4PAlS)7C^phC8O48)&E?5TdD_d{n=nYK|GZl;mwqmy=w<HZ_ZJr+9A%uT
z9W%_|O8#)|fq9mjZMVdC+x4VEzg@Auy=?@BrXMsqi+XUkrj7ou_Pzuf>n-fJG#FAT
zNv1NB4DUQ3BJ-FbWF~VmrBH?j2}$OeGGvHE2$2ezrI49W=2S#chP&U+_nj~Q-Tm&p
zYu&Z(x@*-sopsK$_J0r0e)co&_qQdjWh-kZkBC@UvJ)@a+nY6J=UJ!)P~S2UP_Nl6
zfqrAVu*h-=Yj%O(F{X|!ZKS{}U^ZFF_gPyrV}}{55Zj(t6Ka0;jld(izQ-_J{EnS|
z<?@utxpg<^>6*^6LfVMLAK$7E&yL+*UA`i4{cPy7)v>f&RYfU%Up~li9l<L~E_km$
zUeoXF_buP0I&5+OeBd)}PbTjSzM=CCipL^oy9M`LOqR)S57guxa46eBkR^T$AP%GI
zDi<!BX2i}&PPUNVY_Tk9%*Z^<jZsq&$h?y1_{8<N8VB)(l>#|s&y1QMnVm|dyUBmX
zJ)Fr@wtrumTT%ISc8{1d#W&p&s!|*|jg)tLC9`vLhaDH^!fds`yO6G*6sHDx33d-O
z|KhZ(<9UJDkxTjgKdy#vmbiAQ-kP1tW}bQ2syxW_`jq(fsiW3uI&+wJ&zrqBi`}Su
z_8_r$7t7Nn8;9}?K8u*Xj~BI-vmUUXHY?^UJkr`yIP&q4?t#Xv%x)7y?Sl+8T&SHi
zv0o-aoqgsSZ?7#c-MlIKQ+2wdQ(D_d=?LwLPTACLM(sqM`rBD4tG$DM{Li>Lltrdw
z4+pP!$9};z4D(yhaSf41$&;MwuW9#LbvrPhKk1>Ay!Yi<W4>_9ASKfe?2Y3)98~3Q
zxnjTe_k7><-Y(e{XI<&|o!V1NJGZ^1!QCX`#TvERvV8!v<}giRs8R?|#RKQ}d@W1!
zTjNXG@Zx$T!In;~!)`_D)l9VhKit!%OZ<gwMDC0e(jR7YP9Cx7(WIu=&@;J*A3rRb
z*lJ+^SayX+I@N6dD}mctL%h8@N{7oQYxC#6nym`sar!-(nNG?_Jw^*Sy(`rDCc-$Q
zub@^KE!gb7)O(tS?KQl%XXdglZ?tOVhs#2#DiJq7xJ9k8EHr?BwoHaE7kk*GD=K)f
zX*GS4k!);nw-rsC&E`s}Y;gsAY1?rkm!{-V-U$i!)1j<g9;{S`d+iJbgl=uIJB2;|
zW-aV%;}u=er!%!a123<J8GbpjZku@hY+^^d`Ry-4R*~~dlg0o=GuZ!#M;D1Lc~;}#
z{vQwLJK}x01EmTLKa}lKaBn$A6|3`*uB^$V^JT-1*cnTks2%0E$XucayQgKvYx&Bb
zJb0hzD(@)ABl?a{k9w8K*FR{}idx!Iyxbf%Xw-J^%g=Q`SJh&c;@#&a8ZxfA?+sO;
zuV%WW6qY+I_%@5I<!<}_fyVW%XwmR{DD@1r1sBGm*AoN5W=B=_Q=hI^K(Fk>Uo_gw
zS65~C?z>mT7_SB2k4v{q-fWJ(^(5Yv9A_#ha+t_tZK3mlhehw%*&jdFNpU}dY1Ye}
z*S>xT&B^($f6r7I+=}4DAEN6xWRP@Gc+pyD(fEkHclLVS{izT7R{ZfYgbe#nG8yD*
zY3}3EbxF3&=W2&;oeAddvM&#qjpMj^M#+_x(aezFDm_&uB)2w{<KSyuxx|13^r7&a
z!+~lK>h`!W1m%vRr*s77Hdh5sTy8soxsz(;dpW{Oq0u`a!pq8iyvBAx+_~-Q`KsWb
zaq4F2swH;vS6Z6sN@fLZlot2A&(%>P^_j(!#^i9p3N}6TiF=AV=@akqe|K7M8myRV
z8g#eyyI1gF{bBJZ&z%{r-;M+nO?#3p3U@b!-hbi0TW27O<D^Yr4wp@FMZBC<)b%xY
z$>4Ohw@gAJwka4z-82`JOr$`kgPe{7yCsu8-<-VU>KzOFO=QKhgbCVni|DF7woAEh
z<PFudd~0}R%iN;FE<_(gKe$^`95kO{V#uX+*Yq(V%?)!r%X@F~6)mlPor3k(*#ok=
z@;XdHjSAM*UvnB1T<6}37Arcc;w<_T;`QTP=%-pf4x}WkFMJxrEtop&C9C)){@^`d
zUNBorJ#csJ&>c^@l1|;3uwnIjE)G}CNaaa2>Jf2z*@+$g=k#yJ8(i->`}DbzPVE<(
z9X#O0zOx4dlQ<)4L#zXnNj$pfZ2h81h3Nai=MPAUTs>KE@Uf*v)XQUWHQUwfHZih3
z-?|O8Wf#@U7r~s{n0dB4moE11|G0_nq1Y&WdVWxFcVoWBhke)I$5qQnY*Ihx@%X#&
zXS>fQO@}6gT%yZkDwgEZ$gF%KwC@LTQt3YNPQ_xUw-xhBZqJDJqmi`RiP|QY6;W6#
zZ<!&!Xg599DUg$*e`&4n=S7E4>6&kDHyoJH>SW6KsXe1J%d5<)k+F7lclzt_oLKCB
znba@1|G?0{{eJWQO7j=5E&vRD!}j}1Owq5$HH<bnqce(jb*x;75_<3@xn)!KoN{rX
z_Fch(@O=A#{HaYQIttym<K4I->yPwKEb_fl`)CuoJQXVh%55vkF}5Y=G9%w_ZGCVp
zQoW;5l5RpyKK0XPpOKV6zCDlcD^8S)v5JVGRa><?7pXN1GiRj?+vz)|Xxfz|Sg&?r
zX2QOD_@P2fyVqsc+GqG437_{ubG%unnqH1SO!TQ(-x9r#VX*7kfWyd1L0&P(Gz0qs
zZ4vWD$uj$onNwBAi;;_#sWhKAbDMcKouSgCqheGKy<>3qc~4a#K$gA~^@i>IZ8vHK
z3sMP4-aC4};t#*F66C!-oStf1>huW;=(e;fkMY^LI?KKhu7f#-O=4}%Z4>iFToq5M
zmG#K9q?>wQ{9|@Hu~mAb^kejsyJJcvZ|g6<`N8Xx>KiQ@HO`n{4dC;gQD!G*&dy)(
zlz3X%Ei8bay1Xr+b8msyC{F#=<AWzgSSa}U`*ds{Hyuy6&njeo8nIQiX1FA2{h3B(
zd3oi)oo|W3!F02on#Y8MLkbLnq#4XL^mzU1YJ+#ak9nBv_L<2epHw+!CNi;a-M3o4
zx$VADm)Ase&ck;;7rnp7j~$uNd{UL~UCo&5yIvRdjGndJQRC$Rnkn5OrF`ZJfdAdo
z{Eo|U3$0!qHM4R?oIpE=|DkI48jg(nfqU;_-Um6&92>Bze96w>kkLDpOHV=2KOkLx
z_Hdhl&>@y+l@jk+<+Vu(mWPTRpUpc-4RWNL838^EniV>>Ux_r;bI#i=zS?w#?V1TJ
z)9KkRZm+82m7k%lF&tEVgjN1%+P`S@edVRyp49Kuo}sp#i%41bAl55(ouDdV2axk3
z7rMkHl5>+QlBuM6Ti#MleQ2cPEWxDSr<02ynI>`CF}m+tWxhKZyN!El?BdS4mLvX#
zsXD_88VurIPa}n?oxrPRk%l1*M^<iO?lsLD#`kQ$m|nU0eH=$|q&6me?}=_I69LsT
zUMD=|v$h0B-Q%4N+i7FL=yRc`Zc>$(e!S{C%WBZprc1iXr)pdZ?JbMPe1TzWZI$(B
z*kAI3=x6CT?UAEcpQ&QXf8A<eD<(kB?3<fek_+8a0UF!n;WA&&FUAg{PmM@4dv#wj
zfwz#a%N>(FBg)ZtQJSat_Dho%Go3O+?yjqm89GlMPxVD)d)L3>z%mb$=e4KVxbKat
zoH_Voy!=KOE33{qd#<1NTwS-^CtW!ruvN*a&-Rk^CtIn625&-q*VPk8uIMybIbx+d
zjO-U)21L4?I?x!pKhsi9#pk%GN~@0&`!WN=Oq~2OW`=+GdC_$`f9mRMATB*n5n@s}
zqJ64I;Oj)DQ`w8h+!R3ixv(wUtlDC@_g^}4j7PQO)I`UU+~bQBK>AB|@`3G^`VamA
zq(4sqq`&(d0McK>zo;|6<Rb5K(#7Wl-Tuzp#ay4-`uT9Far-4qCPq~<LGZPYFnQ{<
z-WCa?>%x;Aa{@l{BaKV|klu?#RfOMabB3m+i=oGa>Rjr!3pY-X5_pU^n=3V12%Jd?
zj3pUcCMQRI-g?jub)-}#I(g@#Ba=cGPL?^CsOMK0vzZL$59Sk%Z<vUeeeu=2?4_ky
z+h)ENb*X*0_u64%nFR%so<IJ%?6Oe2+kw2S$?H;uy)z{p3@jcCE_ED7E6K@tZ|+ZX
zp0(nqx_EZ#I=k4~>z-2$%k-5<V^U9y462IppW79Qtvdsh$D9T?>+I3D>f$0yPcj}l
z>sR;K+l+Rp@hYbC8k$o-XcH8nJrKU4Hrl$d-Fx|Zl1QwoYSYw}dv}aWZ_!`OnpeD0
zVVD&<@Mh^v3QM!-?N?IozlpRBR83BwH_~7Kbg0+g`Kd=k&(j;)N1WNZFrk$bt6u#9
zcc`wP?Ao&?Ji>VZ6_`DDEM39Q#qHL&CkkhZ7g^uxj*D6|r1n-Fp6MA;7CD{M-zYlx
z$-GQ1uVcXbX@zOpW<xpsHxF|*waBU@s+jd^pvF2PRy+r+xJ|9OP3z23mCm!AJABZR
zI|Z{xGd}Q;@hp$+SjemRsG4QgBr<7BC5uGEr()488U6&FNWNXqV|4Ad`v~l-=H9$T
zV`i@nH<OZG3s3b6+he@X!mv-{?^;$Vy<&g&=;#D<iJySYbjNK!_Zv?h59i#HI22-R
zB&|sr@~bpgn;xslNzWP58aTD;!OD2Z=Th^IXz&^<K-1IrmE5YN=j~E*?2~~1kyrN{
z(h8aihYDZ3&<bPk8DnQrZ4Ym}{wUOjI$(GGL?L)Cw!GS8CNp<{ZNO;o=%?dOn+IA7
z&tt8pc8z#?Fw{ShmrGA9Oiq-i9%y;(LA|3BQ(`!VI*tkgsPvmpcTiC2d%8xrcOKBs
z*d#o9<<%z(g)KdWGuxN8-)U;mjb4rG8*ca3=C^0QRaG;&nrxT$c|owVu~OYS!PT;+
z@$$<TR9C{i1#2cR-?_B3BID7y;?SJFJFl|v)2Hw6G@fd{;&uO_Gr%Uzf*WnEKXl1v
z&F8D~Na@yw23kS3nLMdafi4V5Ve;GSSIOT7W;jk=^tpA7B&*~fs#e?fB0D_wl!oHS
zvnIKb-92-gsLzFRWNWpfm&8Vy3lCJrDx*JtIGJXmvX%Q>L9OF>N#X0@2LF_X0<lMV
zm%)F;nGB14)&E&u)beJWH}ZW#*{;wZ*UFrI^)`<>539))F>1!|RCyqqtuy9$Bc#hU
z0lfP8BzkOwm%824-O=4qwfb9aT9)D}!{8g8G~d<7qQU#4g2KHG2~;YoR0lBTOT=nE
zp62qR3F)<uu6w7wT)Mu^mUIuTlI%G^(3sgGklH3CfE9>ryFKB;BSsEWGm#MTH;`@<
zub!BH&$VMdh{?=)LOX%Ve<r4Zbt<;~czb&Lxpt!nCAMu>$#>t*o6IYm5{x-wRUs&J
z?!M8G$TO~)*9VOEWVlH&)`#4;R<Oh5x`xdT2&7w)o!wf^Ww*$5+RUm&o~3cx`E6@7
z=fzinKg>%PMf*R4e|yxOl({5*%2q7WRwe|;t^2W7Orb#r<B5r{oVI$o&G`V$EAvX5
z0w0W<>oxlEdn_TG^p9&4tfGre`#4?AC)!!JrKs$*ZA>3i#?<#VTK<BipQgUj@J(0F
zXeO$+MCe*pUw~A?G8M!Aa4y&V<j^9|oqG}<DPOo2+gg{{_}H?Z5cV|0_vx&utbmv8
zC3{0Q;$%Yic&D6dwRx2%cVx;G*7P)0;kM<+){V-tDtDi^bPAg9Y<qR((_V?L7E2!h
zN^fJS9P)vgDTZZiQVSG5BE*8UJ>|5xK9gM2d|o|yXCi*SA?aSJlt=%=&(BulcRN>#
zp08UhV#SF+xIo8r@XQ&9<*BgOr=(2)D1Fs=qH%{rjIdo?<;VFSEQ0?5O26XEwzb`w
zd2?<53Ar&h;)pjB-F`XO;PFmA_3YT`k{^c2mo-j32$C?dn?Kyae(_09P}dZfp696I
zz|>&Z!~q_r8Tb7bUD4Zndxz6@9yB>0bg;o-b95GoC0qALhzhQMZ$+Gfz#G9rd850X
z%xE5)jJ&92gN5=pe798nONaV=+m5y!B|VkTUKkpP!A@2&s+OJqzUV7?K;&tsu@mtb
zeZX-(`&+wnS{<6E8>U-EQvnYBz2aNK0#Q3y%AH)@T#LC4+0F)EkdsKyP1oLM%`VCv
z%+K1aD_5kT`Re@W^f`3g9HX(5Xyl3V)0~)Iw56MZ5lUp##?ary;|?3A)%h-yQ*1>~
zik9BKsJO~@ZBVAl;Nk1TcbQeDs(VhN`}C?RliU=tD@hVz%nQ-jIuYlFn@8>&#Fm;4
zaXLqrFZOLen_DL{=U#69L?LWNU98!^$2&}_re#K8RJcL2ETHIgp6}Mpb*$dD;4OmK
z$JJ>H>!K1Zg{9B<!h6_eZ?aYl#Mc%+Fxy^h@ouQfB(J;lj9A?_Os_SsiDvnODV}9Z
z-e-=r4fC>*vpQbKEE^S+tpZ|Aw!KuG-=S=1mU{km-`em4;>u{@>pBZ+(UkeMdcPm)
z=bG`V0#e_9noXqm$+$O%y>nFYS@o`$(UxBCJJR1DW14*NXTE&vdnfwU9LE@2u06z0
z(#})!r$ju~zkLpP!9*{Gbzar<t+I}I{_f()s6>}Y#TUH=IlYl*?mX;Uce~bdNby_n
z@tB{uI#(r<=a`f7_IB!)S(zPl=aZ>V8gC*F*3gYesvY%;i>KhzqggGk#Xb32@cQ5o
z$9K+FPpb!}`Sp)dxvy{Gi<HpCd`qexEzTqO_n!MGQ8cm7rtR>@8&M&J*>}t9c_T(m
z8q8i=*4%h6x}Vm`g#u5nJbk(GTe5hyP9A>Xxm`j<HGfenFZOi#vJZdkxtA~BmhN+W
zXS#HwclS|HATY+B{SdUJ`o-GO3ANsJUB4Y)(>66kR%^U|?oTZBjI&#GH_~*pm?=wW
zZi#O$JH|e4Z7_SfbWuHt&x_oV)BO-d8z*U5WA*5z`y+2>g~xFhTo27;MAGxuJc`ek
zWouZwVDxiTttJk`e^&kW>4X<6T>N>%tl_O%IQO><Z=Ma@$nd>*VaHcgg(D8lap-8t
zc+6>#Y-i5R58e4NU+CF2HO32iyXzko-hUrG@Z@Ke51+byB{%!lohgC4MYNkws@#7|
zIA7jmK{B~=I6+eWaC;NJ$v(-T?d_e2-Q*uz!q+zSo7q^*g{XLv&ng~VcPcPbq5gTh
zH)ZQXRh?`V!TKXq;H|V^5<?Bqm-At1DPN&8r*@kIHpm?#>8ByIJp66;L+t0wwPU`D
z*ZkB5x!5J&C{-zmOnx>m-!nt=pP26*rm4ZBG_hBcmre=qOtWONEKkVU8#U`-sgbdG
zL1^jx!aGf6D!&Bq*W#;!IBiQ-?nl!=Y6H?0>w%yf%90X!mrvbh&wItyq?f9AS1!89
zx|rLuP^SH(LEV%WDUk|u^4h^7;K-XzzMB1-mDv?;vC`$t+>)?<;$rMenHA3lp24|b
z7k0c|oOSCxW7!WbigEj|H`m-6SsY0z*t9t2#oP9L@k3)-T&1zG(m@T><(rMC$4?#X
zACgoU@*32;qdw%7=gzs?r(CA&wPbmfG56kU{OFkQM|%=*o762|^KMs<*ptwCcJZu+
z?U0VE-e!Ry8a>Q3AJ%+-{0+5(VfW%LV@~m=%tfRMhI|k0JA5p1GakFuVHb^XB(1QH
zM$z<}CHK0FmQLL9D+6f*^Tq)0eU8a0CwrJ7Nr6A08sNR>wU#let5fjaS=|=4`=wCu
z-g$oEy-zjtN<1}K2@v&LkTCLeAVlB0tMM~p*HDCDa8>aKiNjP|vLCfup0M+(c+&CA
z=jFC^r-okN)}H2rBoc8UwtTl!>h5oC>|Ud&Rhy=y%twrezSiWI`wW)vY;#|{tuzx)
zT$(fAD|&FD=VBd`i`Jv+<9CN}?URGe2Hh=_ENr*w)79FNt|~@yB}EtB+2;+OOsN>x
zEv~1az1#QkKegTRWGq*0<cC)OS=A%)E&2V-acPZ{9Q#ceX7&-^4ddp*#R1y;V)Inr
zn67_1eq~D^-{pA5$Y!T!^OYsn`<?S7*YWKt%&T)*k&4Nr=ev!*CU%CbZDVm(8mqsy
zT}qopjHY0d31?_sD}Z|s-h>vQ?x~@k<rbTt%Ay%+{jjQGHSbG}0Z$vpSH7zUf7jH8
zJ|A158`qkSM7Nf1ek{A2z1q*NbJv}@FyH*kQ@rL(Tb^T{3`^seZKZEK*S@@Vo!wrC
zrW?F@cTg71_jddPzn9IW{TE3BU$IF$>5iy;$0qkaznAO(F_`OCv)rwo8mhc%CCf!w
zVWH;-8J0{fnvN-Ps*eg*q-(X&{G{C+_~G=NO=ANlZ&>oSoim5pJ&lj+udfbTy}sR@
zwQFGMNP<sDt+sQPM#c}Fhv7xE8KOS#ovmg~2X3FtDPLjml`P}D(OJKG?ST3rR=JhP
zGo24lf@fg$bAl&rmOrUwtF{iCv>H$eZI9cdL*kb@P<Stae`H44=W>Kv<qX4WLh$;{
z!0tDZdmgrbmalY6Warq`Cs?8yrFW?@LwM9WMz-(s85b*SOh``<c865147Y}cyH&n9
z^|`X*R{-waDQHl{`hozXfU5p>AH`f@3t#n2UT0c2rQ%J!)x^ET#xsh|D{;ET*R0?6
zmzueKzY?|0On0^Ev#FkjXiwP#&t7s)K|$73MCX;xEJdBR-4g)|?@}0fN~PBgwkbGk
zpDXv9dw*(ypZKXLotTh&aQaMAZ6jS*a=hS!$fNBq8njxXP(`=SabL>FP4p;=me4A+
z3se%&;n$!a5VLyw%JibjzAU2w5w|JxP>y2PzLuAy$nqakVWD>l%?LO9aYFw4w>D9|
zy`m;5@cav_`CQU5@rd+H9<qk;%b&veeHQFDvQe)4I1*_GlLEZl^E7V_$}#$^wxI<2
zYkO`5X};dtge_#-FY&%9Q+o9q(dzY@(L>><-j{0Les>=7{;ug4m7ppWr$I-fNyE}d
zm|Z%t)*Mhukp9u`@2*Z0+gz~b;$6VnZQ##mw~wu2Cjhd4LIJWj&HEe{7=?Do2+`u%
zc>uo`>%c2zBL019ytq#)T&w@_%w^lrZ6QC5vl6tpX@olN2%UXxt);zK?AOgELN+;?
zmRc{&t|ZaL!cG5r2z|Q03t-v5G3skNuW;yT&U)-hf%GSrezd{GtA}>~gJo~h==DPK
z7nVJH&aJ#q7nGrZ^);H(et>0P?(;fW#{ER5lrzJAskXYOhxT25{=qOgubVh&w0PX$
zOJk9p%-V>scGU3#%)JKr;N$*}t;O0hlcJ(qy~+(eA}eYJr-o($n0@53QQn8B%PurS
zXD-%?=W~77X<6StOlL1@f46Eh9t6T_R3h)x$haE1Opdsh&iajgUjA}d<(l6li?C_A
z6JnL8`ebNg+L(BjCvH9SFr80L91qzoJ(oLX!V@d}Kt<ThXSRLf;PP?rbM<Y^YuRos
zQRD52eo}|Y5(m$Sv0<leV+YqHGGYz~DyPzVe__A*w6=aUUG$N_Wa`V!kD55^F0$Ow
z*`zhHFDCBf^jT|n`nTb$1&K{j5fZDqub2}%G)H>q=^MnZ#a*25pAKS5-G|{jnItMB
zzNgKiJHS)uXy@47s~_xKBDa^zxSffxoAA9Qbz1*k;Y^h6V@E|ULwnsv3nA(Xw0jrj
znpB#bPO-XhQkfWhTfuib3S7@A9WPc-O1kv&Y`1jFpwGlwP)_&fkJ67E>|X@DxczR|
z*8GxCmqTA_p6`5Dce66&k)CIeq1anh3~d8`p3du9%fpD$rW;loT^(;j>alM_w%iL-
zbQIzG*})Wc$3}?Ltbu;j@!XTqxoi_r{^P3_-_ZchezQk-;uep(1Lt_WV;GK&F<OkU
zf9qkBYS5S&!0ed*BFyo;$bFNJity6=5!R&O=}s&3*$2MeC&V9Ib#H91l9HIVwY19^
z5XSRZb01Gpe&w~ga_P}y=iNui#ATwd!FtQ-*v{8&RX$@Ar<o<c3l3f>&M;Ce`@Xc7
zAyq8-jK_SG9hH;>_m`;SZ7#X9#HPKM?wWI+{3OL!@08-JbMfQU@%J2KnD99h;qFH+
z*nk8+CpxA~tCX!KTy*i6M;bzb-BeFwzDNo`<Q(+hAMPegD?PycT%ZkSk~cF>`{U`D
zx5Trn%$Ln%aatMlXM8|e`Hdh;j6pkb+Bk;kv!?mZQ<loygru=bbiaCZgl=y$?+yP;
zl`H<f#MON?WqCZ+H@s;lKWtu*-EEsOKB8D~I-OSRW9vS_*%B{46WhCU3H(iIoVz+%
zh8d5wv@0>Q%lT!Ga<Z!PoV&@LmGd!<<NeaJ>Q%96W+hw#<1<An?yvp?SN~ksy}i93
zKDs-(SB>mDmc(tR^NPyt@v&<0k%gIKWuf&#+fSC{G8VYqYVr=ta(P;9)+V%%3L|Cr
zmd8(I$Go1(lat)J8AjZX<iro}$+@F#lxlt|%{=xXQRN8l=E=RMOk^|o9GS$8UQRL5
zFBwJ{Jo2ai>BMyWiPM!?&d{P8S&@3Jtqiv^XP6~3qC8cWA4hcN>uM@b2TVxwUQ<yT
z(f9k>PW*XuiFS434abtqed^(=(HmE`OZUnKWR!Y{J$hzv<K3)DYj*dlYvz7yYONe@
zhrI$fS$AJ;*>nFgr>2%UU7e*v@rAS3`R#VO1|Q4nblXbe(7i7d|FW+wZMJ4~qRPi-
zX*Z^a&mu1{TrTkG)@m<pKTV&XqRXz+`ah+3LiKg@BX2ZlYU{tjX2(297XGyUX#I0p
zK&SC1PHB2$gN50GZ_-zb)V~(=r_Sw6>NxDcJ>f#;Nchz71--_$Ltwe5r_pmvSMQt8
z`p|;Ny9%D61)g}_GNnBX`GEo_j?;(;_(!%{M#^4K@48Y~WGX@dx7PvS_V)}a;PxKB
z!0nl7Mcg_`tQ@nUOcZeY73<jSUUtXKEj6`0r8mcB(fxN&ipdfmi$~w!SZLA?94@+<
z?bx-8X<^mz<?+*&IUaYoC&H4l9vc_`NR`(~T=V2uovhW^wSM~g`j!LP)3GodFOER^
zFTmvgf?oJ9(1m|M82*7uKl%SBR62q3bNvl)6BO)p2p;|qa1#{XY=E2i69@jE0Zt&G
z(jjPcEao?8bS#0>=ufcc0FwX!aO3b;P68SWAV1I;{BJPm0N|WR5XBGxf(QZz9Z$sn
z2lmH5py>Z+@aHH_5*{Op!UL2L6HWlg41hiUg=YtF3r2VhP83JM1qT~|$KXY=08`^1
zV0AQxL`DOMaJ(q`7sNURZ2cb^9^j7P&?qzkbVU{={A!0sp#dxjmIBI-BZy*21R@5&
za)58~1h7sDlsgXeO<6sLj1whe&?FKk2@5b&h`)f`|NRD!C4e5$0I>YG@%|kdOCpI9
zh?H+}pg$r7HiZ*QCWzulI4r;b`L`DwfLbBq{+F=lCjWqi;8DNBg%Bxh{tub`??5K7
zI1&QbJop-FU%+>-VBvmw<<6cRfv@}MM8~U1KAUnC6%VA>x{vhl9xoMXksXm}JX96Q
z7;ZJ8RvL3tvm=&#%Cz(e2KUWFXYVtu4u|pON(a@7u%EFeXcTDV%_?#}KL65wc>rwg
z(Dx=G=wawdzjQp~p-k?M>41m%%2hVp&vw^{ozD=76%O^1$1^q>p(~j=Tt_Su^SI9%
zNu14BUhA7Xy0g}&{-9%1Rhp}y3g)^~puDyU%U4154xCL!uHQ_G+(*4w>Fcij*Wwhl
ze_$>|T?G$Rz0oSz!gu!?kJ;5%cW?5XciYFw%*|{rQkx(vDyOl`*&wQS<Hq~ktjK<T
zi{Z~B@5%GB`@{r4ofxRmc%gCBO{4wzo(QQ>y_-k8sf>eFv<9T|UzBf0)yLDR7$xPz
z=*5oOPtp0bbi|ppp6eVNJkZ{CRD?L>Rq!BlVutO9g+}YUL(aXA<6vD%{3CYHe}_}@
zCw20_ja2gM0f>!ACBKB^cTGq9?NNyTL@N0UZT=V9{4ccmUug5c(B^-k&HqB1|AjXH
z3vK=v+WarH`Cn-BztHA?q0Rq7oBxG2{|jyY7ux(UwE16X^Z(n><{<U{ZwC8+RcX@u
z{}tN&SHg8e2KKkdCI4&HaINVVcQ(|TU>^KGt2CiFjs8!d&3{jX|97>DztHBy{|WH@
zzdKD4nGLU@!cy_STQDF}BoXlz>aU&pO<X<QtZnGPo5e&t9qQjdpz;SEM&`8P{FjCX
z)2964boz&eMd2~vY32<y@IN>bIP#P~|F*;7P?Qt0frclLQJ~Pefkpst03+KGF*ppU
zd2DD$!eFrwjSNQF*baPy2Y~z=zeVA3WW@YXC@dLN>^8K+q0v|rs324R{O3Br(ojeq
zP-w{h0AGld_qKok7Ayh}-bUC!LxCZ%V0$*S!{UjQE&H7Y+JQF}Hqx*t0*dma?S^(3
zJRokQfp%DEZFnpSR8u#6i^G#KB*eEUEFMQh&_I6#JaTPBJeq{yGk6(-fE)t_UUES4
z5A;W-D8UWuz+*AUb)WzZhmb!&!$R_cB4S9OBKLcLIP$Oh_68a#0fRv{wnLE#1T5lP
zAOv_af(M`=j0T1E4gG<3BphOYK{*?|4zRHuU_B^#Z=|8oKmwt0K`9zBKRgzPAtJxU
zkO?G2J1mNXrKp(Sc>p>Chj1eev?HLAa|VN;5p%%<4uBdsqCYf-Qg{4)4A38_rEjEx
zO9li`A>Ysr(1_5P2B!!q<7iN=N1kaQxi~y>Z9v2^h%*D)5iy88LKA@mB4}8^d*ocu
zL~tnrv2UOqnvCQDXb15gjlxl0uK1lVXyUIM2pediKLXSr34_5R_Xr3ZlFw)of%47@
zqCYhBEzl%r5`tHF5>N+-eM6IoWTZ?2jRWx>D0`q`pm9l*hh2VOFF2@VJVJ)B;87TG
zKLXK?0Pcfqq=9x=5|Rffpqh|0G=>1}5eiEpBjy77BO!SJE`|WhfE*XJM9dGg!{DHC
zu~<kZu|xt=mw;9T$S$C<IHWECW8fegg$7qkp#24g0iH8_j(}!@d5R^W5qpjW*KCmb
z3e1H}K*%^22pbOCBODgee`sJap*_c8;PZw9;)disj)1gLV1AGu0yI43;@a=BMrjB0
z3P*<a2#q5m<qv#ILY^%^Ba$Ir0Zk6^09-PH=0bT5201@G>>r@P!%GmaC`J$Z7DsW_
zHm(;BZZ1JI5)P7GaMuZ*3lXyC;7$}QlLWvSXbdt28uw3n2u~(M-x6?0p8*S$JAB@N
z7(hHAfWwNM3xNpBI1qbyTms~aq6q{P#1|s)3ZXH;jWCEtM*0?D9b^>rEfEXrN#Y-D
z3h-5+eIr7?4;C0CJhV0<4)Ph$L_B;Jh<M1)Mgx5htqr)H@La&FR!AOzJ8}?>ghBeE
zKyLtTjQo~_hIJwd_HBXHqP+RFQSM2w-bItZL5JG?L2r;iZ~(OfiVaC4V`2MCMp5nz
zZk!7lva47$84cSMG6oOnIx-IFBY|&$_YIAKNBTpc9TDa!`46%|Cc|fj3|?e|#sD5K
zf`$Rn26E0AU@l=AhJ>`W7!-K)4eAeEGlgitNI^6_GL{4ikp$Uaa5|tf4QSAr#-NCh
z&j7A+{$YM($akc;D$xAUD9Dch9xD`oV1Qvo?j;5seVB%abS(H5vTqnP5Evw{&_F3d
zG}vxoz+G9m9SJ(C7_f1W9AI$pxPUQ`9DsBVOaqdNoF4}JhjHO}6@$UUa{=x>!~+Zz
zR{$nMF&Ll`VV+{h&{@EM=mp{xFg-90yzGZu8;C<;8XlH45Wqp_0}HYqP=CNELo}c$
zAsP{uKj1z?yvGqCp9=$gJ*0jH@hW6PF@NwAfj0#1R&Uga7#tRvw*cNV2J**&SV6W7
zgM<BN5JW&Z9^j25^8#QDGOUMiWSIAO;5{Pej7P!e9L{NBLDU2JR~V3dfcOV;OMjq2
zej)}u5DA?(JZx8i^?=Vg9?F-1`GLS2xi$i9e=!8$R7361$oLlvtT{5DL!lva0Dy)i
z!2J;*JBR_k8N_?=69Y(22?SV9!BeA<tPw%l4O$26pJIq;$nOMM3&`ikfMW#lkN5|j
zL&QRHH-<?50}T(`3gCx9JOC_!^a~O8JAsD%!#YT?tdah(UeX`d3&L|~E+DB2@qmPd
z<%;wNUI8-=?IlPHz%=kX3go_#h_G!0;V-o3Bob^_Nq^8`AU6l`6u9V+J_Y$E=nRto
zu)kysY|F^M-lW~&6M{S(r0cNYXDRR)Bq-JZW(JC#F=R62--C8gyg*4IBiD-sE-Orf
z^4{P>pzsm<0g~5{eg?@+NJoIgEyPn`LZKW5_?C>6HIV#*WCJAZAlU#(C`gZEfruk{
z3fe(&07z!Qd<Hp7q}~7lKjd$Kpbk2hU|c8`qNJ(e{@~b@5*$E$Mw6iP2HHXKB^Ee^
zNSgxOA!H5|I3O69_dpDg`k7*sAsR@jLh=IgX2>%`F*L|?i3Q3Nd8UD3fcFwZg6s#F
zGzppuIBt-<0F?vH1qd%p1JMgoo<X`D+9Qy@g650`h9CMCwwG8e9zN&bCu{Irpc)YH
z63LLx0bT^CvTgLGKszXo$AUyUv<^^Cfxg9o(}3&`xSi1cf*+|tdx^(DHU(rdVEF@S
zIQUy46fa<bPXqB8Pl9q#fTi%BgU|pv=L9&e08s^$>jN}+e+eKZf#k~{{1@Pk!)KKM
zl84Z@z@da`kbi{*`6hT=keP?RCBnQ1p)Rz)z(s=jLWX6Ch=O82EO4J8IVFO!7jiBj
zR|U=Q54kEVSO&xcA{nAlL=wpZkV1y^E)Gk8>>G$ep_mDH5s*BCA{8`eAi9vw2Cvma
zXNCaIFLE6OFlm?u3Ze*Jfodq^|A9<16zdYva88B@5(vosB?6}(c~(LB5?M<H8GRhG
zegtU1fkDiV1Og=FUXnoG3@HZyd<Uuzg6tm-dCp02t_oDZf%CX=T=0`z6!HuL8kC2l
zR1LuIa5v~b9Iy&V83!~RGG+(SB^s&Q0S(+3K=cR7E=aqI1L__rLx2Y5+W`#>g6I$Y
z(ifT^xM={*4`ecswK1?*s7?n0VjR-P1T>J~MUD$xerPUa9JCIQB}D2MurN^3L-a=k
zwGM=AfIA?-!Xev%d?K<P3An7txqy@})E@~HqmliAY9ms&0|r3)3eceZ71&7-)oq*~
zNVI?-dqXrLGA02ve-zTj0~%yk@t`t6M4S&mgYtwxf}j`{REi)w1FR}^_k&_-k#Y*|
z27u%yVjaLAN7{3+Lm**-YzJH#guH-uWTfo|<$ZAR0r4%6U8D}fg9RhwGC(6EZ3X3y
z5VDp40thJA4Ae7Z&wr_GgsuZLAc2VafwBhD|D)Wnfz}Il1DVgE+@^tK16Wn0oPrU+
zr3u8iAQJ!GKXrGruy?d}qmz^r)3Lv3{p-Gzn6|UCJ12k`pxm;e6H|7wapnY~_zQUA
ZoV$ga`>(rIz-<PCLC41@uc<)yKLDf!<`n<{

literal 0
HcmV?d00001

diff --git a/internal/crawler/crawler.go b/internal/crawler/crawler.go
index 751c093..9755b9b 100644
--- a/internal/crawler/crawler.go
+++ b/internal/crawler/crawler.go
@@ -103,6 +103,80 @@ type Crawler struct {
 	// path (enqueueLinks) consults this set so we don't keep
 	// re-enqueuing the same dead URLs the sweeper just purged.
 	autoBlocked sync.Map // host (string) → struct{}
+
+	// Dynamic allowlist: runtime-promoted domains that allowedDomain accepts
+	// IN ADDITION to the static cfg.IncludeDomains. Lets curated sources
+	// (HN/Reddit harvesters) grow the crawlable set organically — a domain
+	// that recurs on HN's front page is promoted via AddAllowedDomain and
+	// persisted to dynDomainsFile so it survives restart. Empty file path
+	// (COSIFT_DYNAMIC_DOMAINS_FILE unset) disables the feature.
+	dynDomains    sync.Map // eTLD+1 / host (string) → struct{}
+	dynDomainsFile string
+	dynDomainsMu  sync.Mutex // serializes file appends
+}
+
+// LoadDynamicDomains reads previously-promoted domains from dynDomainsFile into
+// the in-memory set. Called at startup. Missing file is fine (no promotions yet).
+func (c *Crawler) LoadDynamicDomains() {
+	if c.dynDomainsFile == "" {
+		return
+	}
+	b, err := os.ReadFile(c.dynDomainsFile)
+	if err != nil {
+		return
+	}
+	n := 0
+	for _, line := range strings.Split(string(b), "\n") {
+		d := strings.TrimSpace(strings.ToLower(line))
+		if d == "" || strings.HasPrefix(d, "#") {
+			continue
+		}
+		c.dynDomains.Store(d, struct{}{})
+		n++
+	}
+	if n > 0 {
+		log.Printf("crawler: loaded %d dynamically-allowed domains from %s", n, c.dynDomainsFile)
+	}
+}
+
+// AddAllowedDomain promotes a domain into the dynamic allowlist (idempotent) and
+// persists it. Safe for concurrent callers. No-op if the feature is disabled.
+func (c *Crawler) AddAllowedDomain(domain string) error {
+	domain = strings.TrimSpace(strings.ToLower(domain))
+	if domain == "" {
+		return nil
+	}
+	if _, exists := c.dynDomains.LoadOrStore(domain, struct{}{}); exists {
+		return nil // already promoted
+	}
+	if c.dynDomainsFile == "" {
+		return nil // in-memory only (feature persistence disabled)
+	}
+	c.dynDomainsMu.Lock()
+	defer c.dynDomainsMu.Unlock()
+	f, err := os.OpenFile(c.dynDomainsFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	_, err = f.WriteString(domain + "\n")
+	log.Printf("crawler: promoted domain to dynamic allowlist: %s", domain)
+	return err
+}
+
+// dynamicAllowed reports whether host matches any promoted domain
+// (exact or dot-boundary subdomain).
+func (c *Crawler) dynamicAllowed(host string) bool {
+	allowed := false
+	c.dynDomains.Range(func(k, _ any) bool {
+		d := k.(string)
+		if host == d || strings.HasSuffix(host, "."+d) {
+			allowed = true
+			return false // stop
+		}
+		return true
+	})
+	return allowed
 }
 
 // markCompletedInline records that the URL's frontier transition
@@ -255,12 +329,15 @@ func newBare(cfg config.Crawler) *Crawler {
 			sitemapCap = n
 		}
 	}
-	return &Crawler{
-		cfg:        cfg,
-		http:       httpClient,
-		robots:     robots,
-		sitemapSem: make(chan struct{}, sitemapCap),
+	c := &Crawler{
+		cfg:            cfg,
+		http:           httpClient,
+		robots:         robots,
+		sitemapSem:     make(chan struct{}, sitemapCap),
+		dynDomainsFile: os.Getenv("COSIFT_DYNAMIC_DOMAINS_FILE"),
 	}
+	c.LoadDynamicDomains()
+	return c
 }
 
 // maybeAutoSitemap kicks off a background sitemap discovery the first
@@ -492,6 +569,7 @@ func (c *Crawler) Run(ctx context.Context) error {
 		embedWG.Wait()
 		log.Printf("crawler: embed pool drained — queued=%d done=%d failed=%d dropped=%d",
 			c.embedQueued.Load(), c.embedDone.Load(), c.embedFailed.Load(), c.embedDropped.Load())
+		c.embedQ = nil // nil so FetchAndIndexNow doesn't send to closed channel between restarts
 	}
 	return nil
 }
@@ -1421,6 +1499,10 @@ func (c *Crawler) allowedDomain(rawURL string) bool {
 			return true
 		}
 	}
+	// Runtime-promoted domains (HN/Reddit harvesters grow this organically).
+	if c.dynamicAllowed(h) {
+		return true
+	}
 	return false
 }
 
diff --git a/internal/crawler/dynamic_allowlist_test.go b/internal/crawler/dynamic_allowlist_test.go
new file mode 100644
index 0000000..a0f7ce4
--- /dev/null
+++ b/internal/crawler/dynamic_allowlist_test.go
@@ -0,0 +1,57 @@
+package crawler
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+)
+
+// TestDynamicAllowlist verifies that AddAllowedDomain promotes a domain so
+// allowedDomain accepts it (and its subdomains), alongside static IncludeDomains,
+// and that promotions persist to the file + survive a reload.
+func TestDynamicAllowlist(t *testing.T) {
+	dynFile := filepath.Join(t.TempDir(), "dyn-domains.txt")
+	t.Setenv("COSIFT_DYNAMIC_DOMAINS_FILE", dynFile)
+
+	cfg := config.Default().Crawler
+	cfg.RespectRobots = false
+	cfg.IncludeDomains = []string{"arxiv.org"} // static allowlist (non-empty)
+	c := newBare(cfg)
+
+	// Static domain allowed; unknown domain rejected.
+	if !c.allowedDomain("https://arxiv.org/abs/1234") {
+		t.Error("static allowlisted arxiv.org should be allowed")
+	}
+	if c.allowedDomain("https://example.com/x") {
+		t.Error("example.com should be rejected before promotion")
+	}
+
+	// Promote example.com.
+	if err := c.AddAllowedDomain("example.com"); err != nil {
+		t.Fatalf("AddAllowedDomain: %v", err)
+	}
+	if !c.allowedDomain("https://example.com/x") {
+		t.Error("example.com should be allowed after promotion")
+	}
+	if !c.allowedDomain("https://blog.example.com/y") {
+		t.Error("subdomain of promoted domain should be allowed (dot-boundary)")
+	}
+	// Adversarial: evilexample.com must NOT match promoted example.com.
+	if c.allowedDomain("https://evilexample.com/z") {
+		t.Error("evilexample.com must not match promoted example.com")
+	}
+
+	// Persisted to file.
+	b, err := os.ReadFile(dynFile)
+	if err != nil || len(b) == 0 {
+		t.Fatalf("promotion not persisted: %v", err)
+	}
+
+	// A fresh crawler loading the same file inherits the promotion.
+	c2 := newBare(cfg)
+	if !c2.allowedDomain("https://example.com/x") {
+		t.Error("reloaded crawler should inherit promoted domain from file")
+	}
+}
diff --git a/internal/crawler/store_iface.go b/internal/crawler/store_iface.go
index 6b637a6..d73189e 100644
--- a/internal/crawler/store_iface.go
+++ b/internal/crawler/store_iface.go
@@ -61,6 +61,15 @@ type LexicalIndexer interface {
 	IndexDocument(ctx context.Context, docID int64, title, text string) error
 }
 
+// BulkLexicalIndexer is the optional fast path for bulk ingest (WET): index
+// BM25 postings WITHOUT the host-partition write, halving write amplification
+// for one-off web hosts that site= queries don't target. *index.PebbleBM25
+// implements it; backends that don't are transparently handled by the caller
+// falling back to IndexDocument.
+type BulkLexicalIndexer interface {
+	IndexDocumentBulk(ctx context.Context, docID int64, title, text string) error
+}
+
 // HostFrontierPurger is the optional surface the in-crawler host sweeper
 // uses to drain dead hosts. Pebble satisfies it; the SQLite legacy path
 // doesn't need it (no auto-sweeper there).
diff --git a/internal/crawler/wet.go b/internal/crawler/wet.go
index 92261f5..c6537e1 100644
--- a/internal/crawler/wet.go
+++ b/internal/crawler/wet.go
@@ -273,7 +273,15 @@ func (c *Crawler) indexWetRecord(ctx context.Context, rec *WetRecord, lexicalOnl
 	if err != nil {
 		return err
 	}
-	if err := c.idx.IndexDocument(ctx, id, title, text); err != nil {
+	// Bulk WET ingest pulls millions of one-off web hosts that site= queries
+	// never target, so use the host-partition-skipping fast path when the
+	// backend offers it — halves posting writes and prevents the import from
+	// saturating IO. Falls back to the normal write if unsupported.
+	if bulk, ok := c.idx.(BulkLexicalIndexer); ok {
+		if err := bulk.IndexDocumentBulk(ctx, id, title, text); err != nil {
+			return err
+		}
+	} else if err := c.idx.IndexDocument(ctx, id, title, text); err != nil {
 		return err
 	}
 	if lexicalOnly {
diff --git a/internal/embed/chat.go b/internal/embed/chat.go
index bcea21b..d20514f 100644
--- a/internal/embed/chat.go
+++ b/internal/embed/chat.go
@@ -100,12 +100,15 @@ func chatMaxTokens() int {
 	return 2048
 }
 
-// chatTemplateKwargs is the per-call extra args dict vLLM forwards into the
-// model's Jinja chat template. Today the only consumer is qwen3/qwen3.5
-// `enable_thinking` toggle — emitting "Thinking Process:" prose mid-answer
-// is a quality + latency regression for /answer. Disable by default; iter
-// 477e. Operators wanting to inspect reasoning can flip COSIFT_THINKING=1.
-func chatTemplateKwargs() map[string]interface{} {
+// chatTemplateKwargs returns the per-call extra args dict vLLM forwards into
+// the model's Jinja chat template. Only sent for Qwen3/Qwen3.5 models —
+// OpenAI and other backends reject unknown fields. Disables the thinking mode
+// by default (quality + latency regression for /answer); COSIFT_THINKING=1
+// re-enables it.
+func chatTemplateKwargs(model string) map[string]interface{} {
+	if !strings.Contains(strings.ToLower(model), "qwen3") {
+		return nil
+	}
 	if os.Getenv("COSIFT_THINKING") == "1" {
 		return nil
 	}
@@ -159,7 +162,7 @@ func (c *OpenAIChatClient) Chat(ctx context.Context, msgs []ChatMsg) (string, er
 	if len(msgs) == 0 {
 		return "", errors.New("chat: no messages")
 	}
-	body, err := json.Marshal(chatReq{Model: c.model, Messages: msgs, Temperature: 0, MaxTokens: chatMaxTokens(), ChatTemplateKwargs: chatTemplateKwargs()})
+	body, err := json.Marshal(chatReq{Model: c.model, Messages: msgs, Temperature: 0, MaxTokens: chatMaxTokens(), ChatTemplateKwargs: chatTemplateKwargs(c.model)})
 	if err != nil {
 		return "", err
 	}
@@ -219,7 +222,7 @@ func (c *OpenAIChatClient) ChatStream(ctx context.Context, msgs []ChatMsg, onChu
 	if len(msgs) == 0 {
 		return "", errors.New("chat: no messages")
 	}
-	body, err := json.Marshal(chatStreamReq{Model: c.model, Messages: msgs, Temperature: 0, Stream: true, MaxTokens: chatMaxTokens(), ChatTemplateKwargs: chatTemplateKwargs()})
+	body, err := json.Marshal(chatStreamReq{Model: c.model, Messages: msgs, Temperature: 0, Stream: true, MaxTokens: chatMaxTokens(), ChatTemplateKwargs: chatTemplateKwargs(c.model)})
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/index/host_partition_test.go b/internal/index/host_partition_test.go
new file mode 100644
index 0000000..e1caf26
--- /dev/null
+++ b/internal/index/host_partition_test.go
@@ -0,0 +1,159 @@
+package index
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// indexHostDocs upserts + indexes docs across two hosts. When the
+// COSIFT_HOST_PARTITION env is set by the caller before this runs, the 'P'
+// family is populated on index; otherwise the caller backfills.
+func indexHostDocs(t *testing.T, ps *store.PebbleStore, idx *PebbleBM25) {
+	t.Helper()
+	ctx := context.Background()
+	docs := []struct {
+		url, domain, title, text string
+	}{
+		{"https://site-a.com/install", "site-a.com", "Install guide", "install the daemon and run the cli tool to register"},
+		{"https://site-a.com/trust", "site-a.com", "Trust model", "trust model overlay network peers handshake encryption"},
+		{"https://site-a.com/cooking", "site-a.com", "Pasta recipe", "boil water salt pasta drain sauce al dente"},
+		{"https://other-b.com/install", "other-b.com", "Install other", "install the daemon and run the cli tool to register agents"},
+		{"https://other-b.com/trust", "other-b.com", "Trust other", "trust model overlay network peers handshake encryption setup"},
+	}
+	for _, d := range docs {
+		id, err := ps.UpsertDocument(ctx, &store.Document{
+			URL: d.url, Domain: d.domain, Title: d.title, Text: d.text, FetchedAt: time.Now(),
+		})
+		if err != nil {
+			t.Fatalf("upsert: %v", err)
+		}
+		if err := idx.IndexDocument(ctx, id, d.title, d.text); err != nil {
+			t.Fatalf("index: %v", err)
+		}
+	}
+}
+
+// TestSearchInHostScopesToHost: with the partition written at index time,
+// SearchInHost returns ONLY docs from the requested host, and its result set
+// equals Search filtered to that host.
+func TestSearchInHostScopesToHost(t *testing.T) {
+	t.Setenv("COSIFT_HOST_PARTITION", "1")
+	ps, idx := newPebbleBM25(t)
+	ctx := context.Background()
+	indexHostDocs(t, ps, idx)
+
+	hits, err := idx.SearchInHost(ctx, "install daemon cli register", "site-a.com", 10)
+	if err != nil {
+		t.Fatalf("SearchInHost: %v", err)
+	}
+	if len(hits) == 0 {
+		t.Fatal("no hits from SearchInHost")
+	}
+	for _, h := range hits {
+		if !contains(h.URL, "site-a.com") {
+			t.Errorf("SearchInHost leaked a non-site-a host: %s", h.URL)
+		}
+	}
+	// Top hit should be the install page, not the trust or cooking page.
+	if !contains(hits[0].URL, "/install") {
+		t.Errorf("top hit: got %s, want a /install page", hits[0].URL)
+	}
+}
+
+// TestSearchInHostEmptyPartition: a host with no partition returns the
+// sentinel so callers can fall back.
+func TestSearchInHostEmptyPartition(t *testing.T) {
+	t.Setenv("COSIFT_HOST_PARTITION", "1")
+	ps, idx := newPebbleBM25(t)
+	indexHostDocs(t, ps, idx)
+	_, err := idx.SearchInHost(context.Background(), "anything", "never-indexed.example", 10)
+	if !errors.Is(err, ErrHostPartitionEmpty) {
+		t.Fatalf("want ErrHostPartitionEmpty, got %v", err)
+	}
+}
+
+// TestBackfillHostPostings: index WITHOUT the write flag (no 'P' family),
+// then backfill, then SearchInHost works and matches the at-index-time path.
+func TestBackfillHostPostings(t *testing.T) {
+	ps, idx := newPebbleBM25(t) // flag NOT set → no partition on index
+	ctx := context.Background()
+	indexHostDocs(t, ps, idx)
+
+	// Before backfill: partition is empty.
+	if _, err := idx.SearchInHost(ctx, "install", "site-a.com", 10); !errors.Is(err, ErrHostPartitionEmpty) {
+		t.Fatalf("pre-backfill want ErrHostPartitionEmpty, got %v", err)
+	}
+
+	written, err := ps.BackfillHostPostings(ctx, "", nil)
+	if err != nil {
+		t.Fatalf("backfill: %v", err)
+	}
+	if written == 0 {
+		t.Fatal("backfill wrote 0 postings")
+	}
+
+	hits, err := idx.SearchInHost(ctx, "install daemon cli register", "site-a.com", 10)
+	if err != nil {
+		t.Fatalf("post-backfill SearchInHost: %v", err)
+	}
+	if len(hits) == 0 {
+		t.Fatal("post-backfill: no hits")
+	}
+	for _, h := range hits {
+		if !contains(h.URL, "site-a.com") {
+			t.Errorf("post-backfill leaked host: %s", h.URL)
+		}
+	}
+}
+
+// TestIndexDocumentBulkSkipsHostPartition: even with the partition write flag
+// ON, docs indexed via IndexDocumentBulk must NOT land in the 'P' family, so
+// SearchInHost can't find them (they fall back to the boost path). This is the
+// WET-ingest write-amplification fix.
+func TestIndexDocumentBulkSkipsHostPartition(t *testing.T) {
+	t.Setenv("COSIFT_HOST_PARTITION", "1")
+	ps, idx := newPebbleBM25(t)
+	ctx := context.Background()
+
+	// Normal index → partitioned.
+	id1, err := ps.UpsertDocument(ctx, &store.Document{
+		URL: "https://normal.com/p", Domain: "normal.com", Title: "Normal", Text: "alpha beta gamma", FetchedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatalf("upsert normal: %v", err)
+	}
+	if err := idx.IndexDocument(ctx, id1, "Normal", "alpha beta gamma"); err != nil {
+		t.Fatalf("index normal: %v", err)
+	}
+	// Bulk index → must NOT be partitioned.
+	id2, err := ps.UpsertDocument(ctx, &store.Document{
+		URL: "https://bulk.com/p", Domain: "bulk.com", Title: "Bulk", Text: "alpha beta gamma", FetchedAt: time.Now(),
+	})
+	if err != nil {
+		t.Fatalf("upsert bulk: %v", err)
+	}
+	if err := idx.IndexDocumentBulk(ctx, id2, "Bulk", "alpha beta gamma"); err != nil {
+		t.Fatalf("index bulk: %v", err)
+	}
+
+	// normal.com has a partition (found via SearchInHost).
+	hits, err := idx.SearchInHost(ctx, "alpha beta gamma", "normal.com", 10)
+	if err != nil {
+		t.Fatalf("SearchInHost normal: %v", err)
+	}
+	if len(hits) == 0 {
+		t.Error("normal.com should be in the host partition but SearchInHost found nothing")
+	}
+	// bulk.com has NO partition → SearchInHost returns the empty sentinel.
+	_, err = idx.SearchInHost(ctx, "alpha beta gamma", "bulk.com", 10)
+	if !errors.Is(err, ErrHostPartitionEmpty) {
+		t.Errorf("bulk.com should NOT be partitioned; want ErrHostPartitionEmpty, got %v", err)
+	}
+}
+
+func contains(s, sub string) bool { return strings.Contains(s, sub) }
diff --git a/internal/index/pebble_bm25.go b/internal/index/pebble_bm25.go
index cf618d6..9772d45 100644
--- a/internal/index/pebble_bm25.go
+++ b/internal/index/pebble_bm25.go
@@ -13,6 +13,7 @@ package index
 
 import (
 	"context"
+	"errors"
 	"math"
 	"net/url"
 	"os"
@@ -53,6 +54,12 @@ type PebbleBM25 struct {
 	// in the long tail without requiring a separate ranking pass. Nil
 	// = passthrough (multiplier = 1.0 for every hit).
 	authority *authority.Scorer
+
+	// boostIDs maps docID → score multiplier. Applied post-scoring so
+	// site-filtered queries can surface small-site docs that BM25 ranks
+	// below top-k globally. Created via WithBoost (returns a shallow copy);
+	// nil = no boost.
+	boostIDs map[int64]float64
 }
 
 // NewPebbleBM25 returns a search-only handle over the given PebbleStore.
@@ -70,6 +77,16 @@ func (b *PebbleBM25) WithAuthority(a *authority.Scorer) *PebbleBM25 {
 	return b
 }
 
+// WithBoost returns a shallow copy of b with the given docID→multiplier map
+// applied post-scoring. Use this for site= queries: enumerate the site's
+// docIDs, pass a 50× multiplier, and the site's docs will always appear in
+// top-k even when they rank outside the global top-k on raw BM25 score.
+func (b *PebbleBM25) WithBoost(ids map[int64]float64) *PebbleBM25 {
+	c := *b
+	c.boostIDs = ids
+	return &c
+}
+
 // WithBM25Params overrides the default k1 / b for this instance. Values ≤0
 // are ignored (keep the package-constant default for that knob). Chainable.
 func (b *PebbleBM25) WithBM25Params(k1, blen float64) *PebbleBM25 {
@@ -97,6 +114,12 @@ func (b *PebbleBM25) IndexDocument(ctx context.Context, docID int64, title, text
 	return b.store.IndexDocument(ctx, docID, title, text, Tokenize, TitleBoost)
 }
 
+// IndexDocumentBulk is IndexDocument without the host-partition write — the
+// fast path for bulk WET ingest. See PebbleStore.IndexDocumentBulk.
+func (b *PebbleBM25) IndexDocumentBulk(ctx context.Context, docID int64, title, text string) error {
+	return b.store.IndexDocumentBulk(ctx, docID, title, text, Tokenize, TitleBoost)
+}
+
 // Search returns the top-k hits for q from the Pebble-backed index.
 // Algorithm matches BM25.Search verbatim (k1, b, title-boost, phrase filter);
 // only the storage backend differs.
@@ -186,6 +209,21 @@ func (b *PebbleBM25) Search(ctx context.Context, q string, k int) ([]Hit, error)
 		}
 	}
 	for i, c := range active {
+		// Pre-scan MaxScore check: decide whether term i (and everything
+		// after it, since active is sorted descending by IDF) can still push
+		// an unseen doc into top-K BEFORE paying to scan term i's postings.
+		// remainingMax here is the sum of max contributions of terms i..end
+		// (idf*(k1+1) each). A doc not yet in `scores` can gain at most
+		// remainingMax from the un-scanned terms; if that's below the current
+		// K-th best score, scanning i..end can only reorder within top-K —
+		// which the reranker fixes — so stop. This catches the common-term
+		// last-term full scan the old post-scan i==len-1 guard always paid.
+		if maxScoreEnabled && i > 0 && len(scores) >= k {
+			theta := kthLargest(scores, k)
+			if remainingMax < theta {
+				break
+			}
+		}
 		err := b.store.IteratePostings(ctx, c.info.ID, func(p store.PostingEntry) bool {
 			// docLen is inline in the posting value — no separate
 			// GetDocLen call. Removed ~25k Pebble Gets per query at N=10k.
@@ -202,17 +240,36 @@ func (b *PebbleBM25) Search(ctx context.Context, q string, k int) ([]Hit, error)
 		if err != nil {
 			return nil, err
 		}
-		if !maxScoreEnabled || i == len(active)-1 || len(scores) < k {
-			continue
+		// Consume term i's max contribution now that it's been scanned, so
+		// remainingMax entering the next iteration covers only un-scanned terms.
+		if maxScoreEnabled {
+			remainingMax -= c.idf * (b.k1 + 1.0)
 		}
-		remainingMax -= c.idf * (b.k1 + 1.0)
-		// Find current K-th best score (threshold for top-K membership).
-		theta := kthLargest(scores, k)
-		// No unseen doc can accumulate more than remainingMax. If that's
-		// below the current threshold, remaining terms can only shuffle
-		// in-top-K ranking — which the reranker fixes — so stop.
-		if remainingMax < theta {
-			break
+	}
+
+	// Apply per-doc boosts (e.g. site= queries) before sorting. Boosted docs
+	// already present in `scores` (i.e. they matched ≥1 query term) get the
+	// full multiplier. Boosted docs with zero term overlap are absent from
+	// `scores`; for small boost sets we seed them with a tiny base score
+	// (boostSeedBase) before multiplying so they still enter the candidate
+	// pool — landing at boostSeedBase*mult (e.g. 0.05), below any genuine
+	// single-term BM25 match but enough for the reranker to judge them. This
+	// also closes the MaxScore early-termination gap: a boosted doc whose only
+	// matching posting list was skipped still gets seeded and surfaced.
+	//
+	// Seeding is gated by boostSeedMaxIDs: large boost sets (big sites) would
+	// inject a GetDocMeta per zero-overlap doc and flood the pool, so above
+	// the threshold we keep the old present-only behavior.
+	const (
+		boostSeedBase   = 0.001
+		boostSeedMaxIDs = 256
+	)
+	seedZeroOverlap := len(b.boostIDs) > 0 && len(b.boostIDs) <= boostSeedMaxIDs
+	for id, mult := range b.boostIDs {
+		if cur, ok := scores[id]; ok {
+			scores[id] = cur * mult
+		} else if seedZeroOverlap {
+			scores[id] = boostSeedBase * mult
 		}
 	}
 
@@ -258,6 +315,116 @@ func (b *PebbleBM25) Search(ctx context.Context, q string, k int) ([]Hit, error)
 	return hits, nil
 }
 
+// ErrHostPartitionEmpty signals that the host has no 'P'-family partition
+// (never indexed under COSIFT_HOST_PARTITION, or backfill pending). Callers
+// fall back to the global Search + post-filter path.
+var ErrHostPartitionEmpty = errors.New("pebble-bm25: host partition empty")
+
+// SearchInHost is Search scoped to a single host via the 'P' posting
+// partition: it scans only that host's posting lists (O(site_docs)) instead of
+// the global lists (O(corpus)). IDF and avgDocLen stay GLOBAL — a host-local
+// IDF would over-weight terms common across the web but rare on the site, and
+// no per-host DocFreq exists. Returns ErrHostPartitionEmpty when the host has
+// no partition so the caller can fall back. MaxScore early-termination is
+// omitted: host lists are tiny, so a full lossless scan is cheap.
+func (b *PebbleBM25) SearchInHost(ctx context.Context, q, host string, k int) ([]Hit, error) {
+	hostID, ok, err := b.store.GetHostID(ctx, host)
+	if err != nil {
+		return nil, err
+	}
+	if !ok {
+		return nil, ErrHostPartitionEmpty
+	}
+
+	searchQ, phrases := parsePhrases(q)
+	tokens := Tokenize(searchQ)
+	if len(tokens) == 0 {
+		return nil, nil
+	}
+	totalDocs, avgDocLen, err := b.corpusStats(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if totalDocs == 0 {
+		return nil, nil
+	}
+	if avgDocLen < 1 {
+		avgDocLen = 1
+	}
+
+	scores := make(map[int64]float64)
+	minIDF := bm25MinIDF()
+	type termPost struct {
+		idf  float64
+		info store.TermInfo
+	}
+	uniqTerms := dedupeStrings(tokens)
+	candidates := make([]termPost, 0, len(uniqTerms))
+	for _, term := range uniqTerms {
+		info, ok, err := b.store.GetTermInfo(ctx, term)
+		if err != nil {
+			return nil, err
+		}
+		if !ok || info.DocFreq == 0 {
+			continue
+		}
+		idf := math.Log(1.0 + (float64(totalDocs)-float64(info.DocFreq)+0.5)/(float64(info.DocFreq)+0.5))
+		candidates = append(candidates, termPost{idf: idf, info: info})
+	}
+	if len(candidates) == 0 {
+		return nil, nil
+	}
+	sort.Slice(candidates, func(i, j int) bool { return candidates[i].idf > candidates[j].idf })
+	active := candidates[:0]
+	for _, c := range candidates {
+		if c.idf >= minIDF {
+			active = append(active, c)
+		}
+	}
+	if len(active) == 0 {
+		active = candidates[:1]
+	}
+
+	for _, c := range active {
+		idf := c.idf
+		if err := b.store.IterateHostPostings(ctx, hostID, c.info.ID, func(p store.PostingEntry) bool {
+			docLen := p.DocLen
+			if docLen <= 0 {
+				docLen = 1
+			}
+			tfF := float64(p.TF)
+			lenNorm := 1.0 - b.b + b.b*(float64(docLen)/avgDocLen)
+			scores[p.DocID] += idf * ((tfF * (b.k1 + 1.0)) / (tfF + b.k1*lenNorm))
+			return true
+		}); err != nil {
+			return nil, err
+		}
+	}
+
+	// Hit resolution mirrors Search: cheap 'i' side-blob, authority multiplier,
+	// phrase filter, sort, top-k. No boostIDs path — the partition already
+	// guarantees host membership, so the 50× site boost is unnecessary here.
+	hits := make([]Hit, 0, len(scores))
+	for docID, sc := range scores {
+		url, title, ok, err := b.store.GetDocMeta(ctx, docID)
+		if err != nil || !ok || url == "" {
+			continue
+		}
+		if b.authority != nil {
+			sc *= b.authority.Multiplier(hostFromURL(url))
+		}
+		hits = append(hits, Hit{DocID: docID, URL: url, Title: title, Score: sc})
+	}
+	sort.Slice(hits, func(i, j int) bool { return hits[i].Score > hits[j].Score })
+
+	if len(phrases) > 0 {
+		hits = b.filterByPhrasesPebble(ctx, hits, phrases, k)
+	} else if k > 0 && len(hits) > k {
+		hits = hits[:k]
+	}
+	return hits, nil
+}
+
 // corpusStats returns (indexedDocs, avgDocLen). Reads the
 // running (sum_doc_len, indexed_docs) counters maintained by
 // PebbleStore.IndexDocument. O(1) per query; replaces the per-query
diff --git a/internal/store/pebble.go b/internal/store/pebble.go
index b758bb4..31159d8 100644
--- a/internal/store/pebble.go
+++ b/internal/store/pebble.go
@@ -107,6 +107,13 @@ const (
 	//                       reverse index from docID to its term IDs, so
 	//                       re-indexing the same doc can delete orphaned postings
 	//                       for terms that vanished from the new content.
+	famHostTerm    byte = 'T' // 'T' + host-string → uint64-be(hostID)
+	//                          stable per-host id, allocated like termID.
+	famHostPosting byte = 'P' // 'P' + hostID(8) + termID(8) + docID(8) → (tf, docLen)
+	//                          host-partitioned postings: a site= query scans
+	//                          only one host's lists (O(site_docs)) instead of
+	//                          the global 'p' family (O(corpus)). Written
+	//                          alongside 'p' when COSIFT_HOST_PARTITION=1.
 	famFrontier byte = 'f' // 'f' + 'u' + url → packed frontier entry
 	//                       Status byte +
 	//                       depth + priority + enqueued_at + attempts + host
@@ -796,6 +803,40 @@ func postingPrefixUpper(termID int64) []byte {
 	return k
 }
 
+func hostTermKey(host string) []byte {
+	k := make([]byte, 1+len(host))
+	k[0] = famHostTerm
+	copy(k[1:], host)
+	return k
+}
+
+func hostPostingKey(hostID, termID, docID int64) []byte {
+	k := make([]byte, 1+8+8+8)
+	k[0] = famHostPosting
+	binary.BigEndian.PutUint64(k[1:], uint64(hostID))
+	binary.BigEndian.PutUint64(k[9:], uint64(termID))
+	binary.BigEndian.PutUint64(k[17:], uint64(docID))
+	return k
+}
+
+func hostPostingPrefix(hostID, termID int64) []byte {
+	k := make([]byte, 1+8+8)
+	k[0] = famHostPosting
+	binary.BigEndian.PutUint64(k[1:], uint64(hostID))
+	binary.BigEndian.PutUint64(k[9:], uint64(termID))
+	return k
+}
+
+// hostPostingPrefixUpper is the exclusive upper bound for a (hostID, termID)
+// scan: same hostID, termID+1.
+func hostPostingPrefixUpper(hostID, termID int64) []byte {
+	k := make([]byte, 1+8+8)
+	k[0] = famHostPosting
+	binary.BigEndian.PutUint64(k[1:], uint64(hostID))
+	binary.BigEndian.PutUint64(k[9:], uint64(termID+1))
+	return k
+}
+
 func docLenKey(docID int64) []byte {
 	k := make([]byte, 1+8)
 	k[0] = famDocLen
@@ -1123,6 +1164,20 @@ type TermInfo struct {
 // owns the postings layout. Title tokens contribute the title
 // boost (3x TF). doc_len records raw token count for BM25 length norm.
 func (p *PebbleStore) IndexDocument(ctx context.Context, docID int64, title, text string, tokenize func(string) []string, titleBoost int) error {
+	return p.indexDocumentImpl(ctx, docID, title, text, tokenize, titleBoost, true)
+}
+
+// IndexDocumentBulk is IndexDocument WITHOUT the host-partition ('P' family)
+// write, for bulk ingest paths (e.g. CommonCrawl WET) that index millions of
+// one-off web hosts site= queries never target. Skipping the partition halves
+// the per-doc posting writes — the doubling otherwise saturates IO and starves
+// the box during large imports. Those hosts still resolve via the 50× boost
+// fallback if ever site-scoped.
+func (p *PebbleStore) IndexDocumentBulk(ctx context.Context, docID int64, title, text string, tokenize func(string) []string, titleBoost int) error {
+	return p.indexDocumentImpl(ctx, docID, title, text, tokenize, titleBoost, false)
+}
+
+func (p *PebbleStore) indexDocumentImpl(ctx context.Context, docID int64, title, text string, tokenize func(string) []string, titleBoost int, writeHostPart bool) error {
 	if err := ctx.Err(); err != nil {
 		return err
 	}
@@ -1210,6 +1265,19 @@ func (p *PebbleStore) IndexDocument(ctx context.Context, docID int64, title, tex
 	}
 	newSet := make(map[int64]struct{}, len(tf))
 
+	// Host-partition write (opt-in). IndexDocument lacks the domain in its
+	// signature, so when enabled we read it from the doc record (cheap Get,
+	// non-hot path) and mirror every posting into the 'P' family keyed by
+	// hostID. hostID==0 (flag off, empty domain, or doc missing) skips it.
+	var hostID int64
+	if writeHostPart && HostPartitionEnabled() {
+		if d, derr := p.GetDocByID(ctx, docID); derr == nil && d != nil && d.Domain != "" {
+			if hid, herr := p.getOrAllocHostIDLocked(d.Domain); herr == nil {
+				hostID = hid
+			}
+		}
+	}
+
 	for term, freq := range tf {
 		info, ok, err := p.getTermInfoLocked(term)
 		if err != nil {
@@ -1236,6 +1304,11 @@ func (p *PebbleStore) IndexDocument(ctx context.Context, docID int64, title, tex
 		if err := batch.Set(postingKey(info.ID, docID), pvBuf, nil); err != nil {
 			return err
 		}
+		if hostID != 0 {
+			if err := batch.Set(hostPostingKey(hostID, info.ID, docID), pvBuf, nil); err != nil {
+				return err
+			}
+		}
 	}
 
 	// delete postings for terms in oldSet \ newSet (vanished from
@@ -1250,6 +1323,11 @@ func (p *PebbleStore) IndexDocument(ctx context.Context, docID int64, title, tex
 		if err := batch.Delete(postingKey(oldID, docID), nil); err != nil {
 			return err
 		}
+		if hostID != 0 {
+			if err := batch.Delete(hostPostingKey(hostID, oldID, docID), nil); err != nil {
+				return err
+			}
+		}
 	}
 
 	// Write the new term-ID set for this doc.
@@ -1414,6 +1492,16 @@ func (p *PebbleStore) WriteCrawlResult(
 		}
 		newSet := make(map[int64]struct{}, len(tf))
 
+		// Host-partition write (opt-in): d.Domain is in hand here, so mirror
+		// every posting into the 'P' family keyed by hostID. hostID==0 (flag
+		// off or empty domain) skips it.
+		var hostID int64
+		if HostPartitionEnabled() && d.Domain != "" {
+			if hid, herr := p.getOrAllocHostIDLocked(d.Domain); herr == nil {
+				hostID = hid
+			}
+		}
+
 		for term, freq := range tf {
 			info, ok, err := p.getTermInfoLocked(term)
 			if err != nil {
@@ -1435,6 +1523,11 @@ func (p *PebbleStore) WriteCrawlResult(
 			if err := batch.Set(postingKey(info.ID, id), pvBuf, nil); err != nil {
 				return 0, err
 			}
+			if hostID != 0 {
+				if err := batch.Set(hostPostingKey(hostID, info.ID, id), pvBuf, nil); err != nil {
+					return 0, err
+				}
+			}
 		}
 		for oldID := range oldSet {
 			if _, stillPresent := newSet[oldID]; stillPresent {
@@ -1443,6 +1536,11 @@ func (p *PebbleStore) WriteCrawlResult(
 			if err := batch.Delete(postingKey(oldID, id), nil); err != nil {
 				return 0, err
 			}
+			if hostID != 0 {
+				if err := batch.Delete(hostPostingKey(hostID, oldID, id), nil); err != nil {
+					return 0, err
+				}
+			}
 		}
 		newIDs := make([]int64, 0, len(newSet))
 		for tid := range newSet {
@@ -2229,6 +2327,48 @@ func (p *PebbleStore) IterDocsLite(ctx context.Context, fn func(docID int64, url
 	return nil
 }
 
+// IterHostDocIDs iterates over all docIDs whose stored Domain equals host
+// (exact match, case-folded). Uses the famHost prefix index — O(site_docs)
+// rather than a full corpus scan. Caller returns false from fn to stop early.
+func (p *PebbleStore) IterHostDocIDs(ctx context.Context, host string, fn func(docID int64) bool) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	host = strings.ToLower(strings.TrimSpace(host))
+	if host == "" {
+		return nil
+	}
+	// Key layout: [famHost][host bytes][0x00][docID uint64-be]
+	lower := make([]byte, 1+len(host)+1)
+	lower[0] = famHost
+	copy(lower[1:], host)
+	lower[len(lower)-1] = 0x00
+	upper := make([]byte, 1+len(host)+1)
+	upper[0] = famHost
+	copy(upper[1:], host)
+	upper[len(upper)-1] = 0x01 // one past 0x00 → terminates the range
+	it, err := p.db.NewIter(&pebble.IterOptions{LowerBound: lower, UpperBound: upper})
+	if err != nil {
+		return err
+	}
+	defer it.Close()
+	prefixLen := len(lower)
+	for valid := it.First(); valid; valid = it.Next() {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		key := it.Key()
+		if len(key) < prefixLen+8 {
+			continue
+		}
+		id := int64(binary.BigEndian.Uint64(key[prefixLen:]))
+		if !fn(id) {
+			return nil
+		}
+	}
+	return nil
+}
+
 // IterDocMeta is like IterDocsLite but also yields the document title from
 // the cheap 'i' side-blob (no full gob decode). Used by content sweeps
 // (e.g. purge-adult) that classify on URL + title across the whole corpus.
@@ -3425,6 +3565,319 @@ func (p *PebbleStore) nextTermID() int64 {
 	return next
 }
 
+// HostPartitionEnabled reports whether host-partitioned postings should be
+// written on index. Gated by COSIFT_HOST_PARTITION=1 so the ~2x posting
+// write-amplification is opt-in until the backfill has run.
+func HostPartitionEnabled() bool {
+	return os.Getenv("COSIFT_HOST_PARTITION") == "1"
+}
+
+// getOrAllocHostIDLocked returns a stable hostID for host, allocating one on
+// first sight. Called under p.mu; the counter Set mirrors nextTermID's pattern
+// (persist immediately, race held off by p.mu). Returns 0 for empty host.
+func (p *PebbleStore) getOrAllocHostIDLocked(host string) (int64, error) {
+	if host == "" {
+		return 0, nil
+	}
+	val, closer, err := p.db.Get(hostTermKey(host))
+	if err == nil {
+		var id int64
+		if len(val) == 8 {
+			id = int64(binary.BigEndian.Uint64(val))
+		}
+		_ = closer.Close()
+		if id != 0 {
+			return id, nil
+		}
+	} else if !errors.Is(err, pebble.ErrNotFound) {
+		return 0, err
+	}
+	// Allocate.
+	cur, c2, err := p.db.Get(metaKey("next_host_id"))
+	var current int64
+	if err == nil {
+		if len(cur) == 8 {
+			current = int64(binary.BigEndian.Uint64(cur))
+		}
+		_ = c2.Close()
+	} else if !errors.Is(err, pebble.ErrNotFound) {
+		return 0, err
+	}
+	next := current + 1
+	buf := make([]byte, 8)
+	binary.BigEndian.PutUint64(buf, uint64(next))
+	if err := p.db.Set(metaKey("next_host_id"), buf, nil); err != nil {
+		return 0, err
+	}
+	if err := p.db.Set(hostTermKey(host), buf, nil); err != nil {
+		return 0, err
+	}
+	return next, nil
+}
+
+// GetHostID resolves an existing hostID. ok=false means the host has no
+// partition (never indexed under COSIFT_HOST_PARTITION, or backfill pending) —
+// callers fall back to the global posting scan.
+func (p *PebbleStore) GetHostID(ctx context.Context, host string) (int64, bool, error) {
+	if host == "" {
+		return 0, false, nil
+	}
+	val, closer, err := p.db.Get(hostTermKey(host))
+	if errors.Is(err, pebble.ErrNotFound) {
+		return 0, false, nil
+	}
+	if err != nil {
+		return 0, false, err
+	}
+	defer closer.Close()
+	if len(val) != 8 {
+		return 0, false, nil
+	}
+	return int64(binary.BigEndian.Uint64(val)), true, nil
+}
+
+// BackfillHostPostings rebuilds the 'P' host-partition family from existing
+// data, for corpora indexed before COSIFT_HOST_PARTITION was enabled. No
+// re-tokenize, no text decode — a pure key reshuffle reusing 'h', 'g' and 'p'.
+// It only writes the new 'P'/'T' families (and the 'next_host_id' counter),
+// never touching 'p'/'d'/'v'. Run it with the COSIFT_HOST_PARTITION WRITE flag
+// OFF so concurrent crawl indexing can't race hostID allocation.
+//
+// onlyHost == "": full-corpus single-pass — build a docID→hostID map from one
+// 'h' scan, then stream the global 'p' family once routing each posting to its
+// host. onlyHost != "": fast targeted path — for just that host's docs, walk
+// the 'g' reverse index (docID→termIDs) and copy each posting. The targeted
+// path is O(host_docs × terms_per_doc) — near-instant for a small site.
+//
+// progress, if non-nil, is called periodically with postingsWritten. Returns
+// the number of host postings written.
+func (p *PebbleStore) BackfillHostPostings(ctx context.Context, onlyHost string, progress func(written int64)) (int64, error) {
+	onlyHost = strings.ToLower(strings.TrimSpace(onlyHost))
+	if onlyHost != "" {
+		return p.backfillHostPostingsTargeted(ctx, onlyHost, progress)
+	}
+	return p.backfillHostPostingsFull(ctx, progress)
+}
+
+// backfillHostPostingsTargeted handles a single host via the 'g' reverse index.
+func (p *PebbleStore) backfillHostPostingsTargeted(ctx context.Context, host string, progress func(int64)) (int64, error) {
+	hostID, err := p.getOrAllocHostIDLocked(host)
+	if err != nil {
+		return 0, err
+	}
+	if hostID == 0 {
+		return 0, nil
+	}
+	// Collect this host's docIDs (exact match on the doc's stored domain;
+	// IterHostDocIDs uses the 'h' index which is keyed by d.Domain).
+	var docIDs []int64
+	if err := p.IterHostDocIDs(ctx, host, func(id int64) bool {
+		docIDs = append(docIDs, id)
+		return true
+	}); err != nil {
+		return 0, err
+	}
+	batch := p.db.NewBatch()
+	defer func() { _ = batch.Close() }()
+	var written, pending int64
+	for _, docID := range docIDs {
+		if err := ctx.Err(); err != nil {
+			return written, err
+		}
+		termIDs, err := p.readDocTermsLocked(docID)
+		if err != nil {
+			return written, err
+		}
+		for _, termID := range termIDs {
+			val, closer, gerr := p.db.Get(postingKey(termID, docID))
+			if gerr != nil {
+				continue // posting absent (shouldn't happen) — skip
+			}
+			if len(val) == 16 {
+				vcopy := make([]byte, 16)
+				copy(vcopy, val)
+				if err := batch.Set(hostPostingKey(hostID, termID, docID), vcopy, nil); err != nil {
+					_ = closer.Close()
+					return written, err
+				}
+				written++
+				pending++
+			}
+			_ = closer.Close()
+			if pending >= 10000 {
+				if err := batch.Commit(p.writeOpts); err != nil {
+					return written, err
+				}
+				_ = batch.Close()
+				batch = p.db.NewBatch()
+				pending = 0
+				if progress != nil {
+					progress(written)
+				}
+			}
+		}
+	}
+	if pending > 0 {
+		if err := batch.Commit(p.writeOpts); err != nil {
+			return written, err
+		}
+	}
+	if progress != nil {
+		progress(written)
+	}
+	return written, nil
+}
+
+// backfillHostPostingsFull is the full-corpus single-pass variant.
+func (p *PebbleStore) backfillHostPostingsFull(ctx context.Context, progress func(written int64)) (int64, error) {
+	// Phase 1: docID → hostID, allocating a stable hostID per distinct host.
+	docToHost := make(map[int64]int64, 1<<20)
+	hostToID := make(map[string]int64, 1<<16)
+	{
+		it, err := p.db.NewIter(&pebble.IterOptions{
+			LowerBound: []byte{famHost},
+			UpperBound: []byte{famHost + 1},
+		})
+		if err != nil {
+			return 0, err
+		}
+		for valid := it.First(); valid; valid = it.Next() {
+			if err := ctx.Err(); err != nil {
+				_ = it.Close()
+				return 0, err
+			}
+			key := it.Key()
+			if len(key) < 1+1+8 { // 'h' + host(≥0) + 0x00 + docID(8) — need ≥10
+				continue
+			}
+			docID := int64(binary.BigEndian.Uint64(key[len(key)-8:]))
+			host := string(key[1 : len(key)-9]) // drop trailing 0x00 + docID
+			if host == "" {
+				continue
+			}
+			hid, ok := hostToID[host]
+			if !ok {
+				hid, err = p.getOrAllocHostIDLocked(host)
+				if err != nil {
+					_ = it.Close()
+					return 0, err
+				}
+				hostToID[host] = hid
+			}
+			docToHost[docID] = hid
+		}
+		if err := it.Close(); err != nil {
+			return 0, err
+		}
+	}
+
+	// Phase 2: stream the global 'p' family; mirror each posting into 'P'.
+	it, err := p.db.NewIter(&pebble.IterOptions{
+		LowerBound: []byte{famPosting},
+		UpperBound: []byte{famPosting + 1},
+	})
+	if err != nil {
+		return 0, err
+	}
+	defer it.Close()
+	batch := p.db.NewBatch()
+	defer func() { _ = batch.Close() }()
+	const batchFlush = 10000
+	var written, pending int64
+	for valid := it.First(); valid; valid = it.Next() {
+		if err := ctx.Err(); err != nil {
+			return written, err
+		}
+		key := it.Key()
+		if len(key) != 17 { // 'p' + termID(8) + docID(8)
+			continue
+		}
+		termID := int64(binary.BigEndian.Uint64(key[1:9]))
+		docID := int64(binary.BigEndian.Uint64(key[9:17]))
+		hid, ok := docToHost[docID]
+		if !ok {
+			continue // doc has no host index entry — skip
+		}
+		val, err := it.ValueAndErr()
+		if err != nil {
+			return written, err
+		}
+		if len(val) != 16 {
+			continue
+		}
+		vcopy := make([]byte, 16)
+		copy(vcopy, val)
+		if err := batch.Set(hostPostingKey(hid, termID, docID), vcopy, nil); err != nil {
+			return written, err
+		}
+		written++
+		pending++
+		if pending >= batchFlush {
+			if err := batch.Commit(p.writeOpts); err != nil {
+				return written, err
+			}
+			_ = batch.Close()
+			batch = p.db.NewBatch()
+			pending = 0
+			if progress != nil {
+				progress(written)
+			}
+		}
+	}
+	if pending > 0 {
+		if err := batch.Commit(p.writeOpts); err != nil {
+			return written, err
+		}
+	}
+	if progress != nil {
+		progress(written)
+	}
+	return written, nil
+}
+
+// IterateHostPostings scans the host-partitioned posting list for one
+// (hostID, termID). Mirrors IteratePostings but over the 'P' family, so the
+// scan is bounded by the host's docs that contain termID — not the global
+// posting list. Caller returns false from fn to stop early.
+func (p *PebbleStore) IterateHostPostings(ctx context.Context, hostID, termID int64, fn func(PostingEntry) bool) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	it, err := p.db.NewIter(&pebble.IterOptions{
+		LowerBound: hostPostingPrefix(hostID, termID),
+		UpperBound: hostPostingPrefixUpper(hostID, termID),
+	})
+	if err != nil {
+		return err
+	}
+	defer it.Close()
+	for valid := it.First(); valid; valid = it.Next() {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		key := it.Key()
+		if len(key) != 25 { // 'P' + hostID(8) + termID(8) + docID(8)
+			continue
+		}
+		val, err := it.ValueAndErr()
+		if err != nil {
+			return err
+		}
+		if len(val) != 16 {
+			continue
+		}
+		entry := PostingEntry{
+			DocID:  int64(binary.BigEndian.Uint64(key[17:])),
+			TF:     int64(binary.BigEndian.Uint64(val[0:8])),
+			DocLen: int64(binary.BigEndian.Uint64(val[8:16])),
+		}
+		if !fn(entry) {
+			return nil
+		}
+	}
+	return nil
+}
+
 func packTermInfo(t TermInfo) []byte {
 	b := make([]byte, 16)
 	binary.BigEndian.PutUint64(b[0:8], uint64(t.ID))
diff --git a/testdata/eval/queries-realworld.json b/testdata/eval/queries-realworld.json
new file mode 100644
index 0000000..907987f
--- /dev/null
+++ b/testdata/eval/queries-realworld.json
@@ -0,0 +1,36 @@
+{
+  "name": "realworld-intents",
+  "description": "Representative real-user queries spanning the intents cosift must serve — especially known-item/resource lookup (the failure mode the LPR feedback exposed), which the prior eval sets never tested. relevant[] left empty: this set is for the LLM-judge answer-eval (answer quality/grounding), not recall metrics. Edit/extend freely; this is the definition-of-useful artifact.",
+  "queries": [
+    { "text": "license plate detection model for NVIDIA Jetson aarch64 with OCR", "relevant": [], "intent": "resource" },
+    { "text": "rust async postgres connection pool crate", "relevant": [], "intent": "resource" },
+    { "text": "python library to extract tables from PDF", "relevant": [], "intent": "resource" },
+    { "text": "streaming low-latency speech-to-text model", "relevant": [], "intent": "resource" },
+    { "text": "embeddable vector database for on-device RAG", "relevant": [], "intent": "resource" },
+    { "text": "go library for robust HTML parsing and scraping", "relevant": [], "intent": "resource" },
+    { "text": "open source OCR that handles handwriting", "relevant": [], "intent": "resource" },
+    { "text": "small language model that runs on a raspberry pi", "relevant": [], "intent": "resource" },
+
+    { "text": "how to quantize a model to INT8 with TensorRT on Jetson", "relevant": [], "intent": "howto" },
+    { "text": "how to set up OAuth for the Reddit API", "relevant": [], "intent": "howto" },
+    { "text": "how to do retrieval-augmented generation with citations", "relevant": [], "intent": "howto" },
+    { "text": "how to serve an LLM with vLLM behind an API", "relevant": [], "intent": "howto" },
+
+    { "text": "polars vs pandas for large dataframe pipelines", "relevant": [], "intent": "comparison" },
+    { "text": "qwen vs llama for local inference quality and speed", "relevant": [], "intent": "comparison" },
+    { "text": "BM25 vs dense retrieval vs hybrid for search", "relevant": [], "intent": "comparison" },
+    { "text": "gRPC vs REST for internal microservices", "relevant": [], "intent": "comparison" },
+
+    { "text": "how does Raft achieve distributed consensus", "relevant": [], "intent": "explain" },
+    { "text": "what is HNSW and why is it fast for vector search", "relevant": [], "intent": "explain" },
+    { "text": "how does NAT traversal work for peer-to-peer connections", "relevant": [], "intent": "explain" },
+    { "text": "explain the transformer attention mechanism", "relevant": [], "intent": "explain" },
+
+    { "text": "recent advances in small language models 2026", "relevant": [], "intent": "fresh" },
+    { "text": "latest approaches to long-context LLM inference", "relevant": [], "intent": "fresh" },
+    { "text": "state of the art in real-time object detection", "relevant": [], "intent": "fresh" },
+
+    { "text": "build an edge ANPR security camera system end to end", "relevant": [], "intent": "multifaceted" },
+    { "text": "design a self-hosted semantic search engine with reranking", "relevant": [], "intent": "multifaceted" }
+  ]
+}

From feb7bcf2d7409f4c6f8452d3202c73d1c8b81fb4 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Wed, 24 Jun 2026 17:25:01 +0300
Subject: [PATCH 03/11] ops: capture content-pipeline harvesters + systemd
 units + lists in repo

Pulled from the GH200 so the whole crawl/index content pipeline is reproducible
from git, not only on the box. 12 harvesters, 22 systemd units, 3 source lists,
README documenting sources/cadence/env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 deploy/README.md                              |  35 +++
 deploy/harvesters/cosift-arxiv-harvest.sh     |  43 +++
 deploy/harvesters/cosift-compact.sh           |  26 ++
 deploy/harvesters/cosift-eval.sh              |  20 ++
 .../harvesters/cosift-github-topic-harvest.py |  58 ++++
 deploy/harvesters/cosift-hf-full-harvest.py   |  95 +++++++
 deploy/harvesters/cosift-hf-harvest.py        |  68 +++++
 deploy/harvesters/cosift-hf-task-harvest.py   |  56 ++++
 deploy/harvesters/cosift-hn-harvest.py        | 122 +++++++++
 deploy/harvesters/cosift-pypi-harvest.py      |  42 +++
 deploy/harvesters/cosift-reddit-harvest.py    | 108 ++++++++
 deploy/harvesters/cosift-sitemap-refresh.sh   |  39 +++
 deploy/harvesters/cosift-wet-refresh.sh       |  77 ++++++
 deploy/lists/cosift-feeds.txt                 | 254 ++++++++++++++++++
 deploy/lists/cosift-sites.txt                 |  28 ++
 deploy/lists/cosift-subreddits.txt            |  25 ++
 deploy/systemd/cosift-arxiv-harvest.service   |  11 +
 deploy/systemd/cosift-arxiv-harvest.timer     |  10 +
 .../cosift-github-topic-harvest.service       |  10 +
 .../systemd/cosift-github-topic-harvest.timer |   8 +
 deploy/systemd/cosift-hf-full-harvest.service |  11 +
 deploy/systemd/cosift-hf-full-harvest.timer   |   8 +
 deploy/systemd/cosift-hf-harvest.service      |  10 +
 deploy/systemd/cosift-hf-harvest.timer        |   8 +
 deploy/systemd/cosift-hf-task-harvest.service |  10 +
 deploy/systemd/cosift-hf-task-harvest.timer   |   8 +
 deploy/systemd/cosift-hn-harvest.service      |  10 +
 deploy/systemd/cosift-hn-harvest.timer        |   8 +
 deploy/systemd/cosift-pypi-harvest.service    |  10 +
 deploy/systemd/cosift-pypi-harvest.timer      |   8 +
 deploy/systemd/cosift-reddit-harvest.service  |  10 +
 deploy/systemd/cosift-reddit-harvest.timer    |   8 +
 deploy/systemd/cosift-rss-refresh.service     |  11 +
 deploy/systemd/cosift-rss-refresh.timer       |  10 +
 deploy/systemd/cosift-sitemap-refresh.service |  11 +
 deploy/systemd/cosift-sitemap-refresh.timer   |  11 +
 deploy/systemd/cosift-wet-refresh.service     |   9 +
 deploy/systemd/cosift-wet-refresh.timer       |  10 +
 38 files changed, 1306 insertions(+)
 create mode 100644 deploy/README.md
 create mode 100755 deploy/harvesters/cosift-arxiv-harvest.sh
 create mode 100755 deploy/harvesters/cosift-compact.sh
 create mode 100755 deploy/harvesters/cosift-eval.sh
 create mode 100755 deploy/harvesters/cosift-github-topic-harvest.py
 create mode 100755 deploy/harvesters/cosift-hf-full-harvest.py
 create mode 100755 deploy/harvesters/cosift-hf-harvest.py
 create mode 100755 deploy/harvesters/cosift-hf-task-harvest.py
 create mode 100755 deploy/harvesters/cosift-hn-harvest.py
 create mode 100755 deploy/harvesters/cosift-pypi-harvest.py
 create mode 100755 deploy/harvesters/cosift-reddit-harvest.py
 create mode 100755 deploy/harvesters/cosift-sitemap-refresh.sh
 create mode 100755 deploy/harvesters/cosift-wet-refresh.sh
 create mode 100644 deploy/lists/cosift-feeds.txt
 create mode 100644 deploy/lists/cosift-sites.txt
 create mode 100644 deploy/lists/cosift-subreddits.txt
 create mode 100644 deploy/systemd/cosift-arxiv-harvest.service
 create mode 100644 deploy/systemd/cosift-arxiv-harvest.timer
 create mode 100644 deploy/systemd/cosift-github-topic-harvest.service
 create mode 100644 deploy/systemd/cosift-github-topic-harvest.timer
 create mode 100644 deploy/systemd/cosift-hf-full-harvest.service
 create mode 100644 deploy/systemd/cosift-hf-full-harvest.timer
 create mode 100644 deploy/systemd/cosift-hf-harvest.service
 create mode 100644 deploy/systemd/cosift-hf-harvest.timer
 create mode 100644 deploy/systemd/cosift-hf-task-harvest.service
 create mode 100644 deploy/systemd/cosift-hf-task-harvest.timer
 create mode 100644 deploy/systemd/cosift-hn-harvest.service
 create mode 100644 deploy/systemd/cosift-hn-harvest.timer
 create mode 100644 deploy/systemd/cosift-pypi-harvest.service
 create mode 100644 deploy/systemd/cosift-pypi-harvest.timer
 create mode 100644 deploy/systemd/cosift-reddit-harvest.service
 create mode 100644 deploy/systemd/cosift-reddit-harvest.timer
 create mode 100644 deploy/systemd/cosift-rss-refresh.service
 create mode 100644 deploy/systemd/cosift-rss-refresh.timer
 create mode 100644 deploy/systemd/cosift-sitemap-refresh.service
 create mode 100644 deploy/systemd/cosift-sitemap-refresh.timer
 create mode 100644 deploy/systemd/cosift-wet-refresh.service
 create mode 100644 deploy/systemd/cosift-wet-refresh.timer

diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 0000000..36b1916
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,35 @@
+# cosift deploy — content pipeline (GH200 production)
+
+Operational artifacts for the running cosift backend (`cosift.pilotprotocol.network`,
+binary `/home/ubuntu/cosift`, service `cosift-serve`). Captured from the server so the
+content pipeline is reproducible from git, not only on the box.
+
+## Layout
+- `harvesters/` — scripts in `/usr/local/bin/` that feed the crawl frontier via the
+  cosift admin API (`/admin/crawl-enqueue`, `/admin/rss-import`, `/admin/wet-import-bulk`,
+  `/admin/site-submit`). All free/OSS, stdlib-only.
+- `systemd/` — `.service` (oneshot) + `.timer` units that schedule the harvesters.
+- `lists/` — source lists the harvesters read (`cosift-feeds.txt` RSS feeds,
+  `cosift-subreddits.txt`, `cosift-sites.txt`).
+
+## Sources & cadence
+| Harvester | Source | Schedule |
+|---|---|---|
+| rss-refresh | `cosift-feeds.txt` (RSS/Atom incl. macrumors, tomshardware, arXiv cs.*) | 30 min |
+| arxiv-harvest | arXiv export API (recent papers per cs.* category) | daily 05:30 |
+| hf-harvest | HF Hub API top-likes models/datasets/spaces + blog | daily 06:30 |
+| hf-full-harvest | full HF Hub enumeration (cursor-paginated, resumable) | every 3h |
+| hn-harvest | HN Firebase API + external-link domain promotion | 4×/day |
+| reddit-harvest | per-subreddit Atom RSS + link promotion (rate-limited by reddit) | 4×/day |
+| wet-refresh | CommonCrawl WET (rotating offset, lexical-only) | daily 03:00 |
+| pypi/hf-task/github-topic | popular PyPI / HF-by-task / GitHub-by-topic | weekly |
+| sitemap-refresh | (disabled — net-negative on single box) | — |
+
+## Notes
+- Curated ingester: `disable_link_following=true` + `include_domains` allowlist in
+  `cosift.json` (on the server). `/admin/allow-domain` grows it at runtime from HN/Reddit
+  link-domain frequency (persisted to `cosift-dynamic-domains.txt`).
+- Env (systemd drop-ins on server): `COSIFT_HOST_PARTITION[_READ]=1`, `COSIFT_QUERY_LOG`,
+  `COSIFT_DYNAMIC_DOMAINS_FILE`, WET/feedback tunables.
+- To re-deploy: copy `harvesters/*` → `/usr/local/bin/`, `systemd/*` → `/etc/systemd/system/`,
+  `lists/*` → `/home/ubuntu/`, then `systemctl daemon-reload && systemctl enable --now <timer>`.
diff --git a/deploy/harvesters/cosift-arxiv-harvest.sh b/deploy/harvesters/cosift-arxiv-harvest.sh
new file mode 100755
index 0000000..b794891
--- /dev/null
+++ b/deploy/harvesters/cosift-arxiv-harvest.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+# cosift-arxiv-harvest — enqueue the latest arXiv papers per category into the
+# crawl frontier. THE always-new anchor for the curated corpus.
+#
+# Why this exists: cosift runs link-following OFF (curated ingester), so it only
+# indexes URLs explicitly fed to it. arXiv's RSS endpoints are dead (0 items),
+# but the export API (Atom) reliably returns recent submissions. arXiv publishes
+# ~500-1000 papers/day across cs.* — all in the quality allowlist — so feeding
+# each new paper's abs URL guarantees a continuous stream of new documents.
+#
+# Frontier dedup means re-running is safe: only genuinely-new papers (the day's
+# submissions) actually enter the queue; the rest are no-ops.
+set -u
+
+ADDR="http://127.0.0.1:7777"
+API="https://export.arxiv.org/api/query"
+TOKEN=$(python3 -c "import json;c=json.load(open('/home/ubuntu/cosift.json'));print(c.get('cluster',{}).get('peer_auth_token',''))" 2>/dev/null || echo "")
+CATS="${COSIFT_ARXIV_CATS:-cs.AI cs.LG cs.CL cs.CV cs.DC cs.SE cs.CR cs.IR cs.NE cs.DS cs.DB cs.RO stat.ML}"
+MAXR="${COSIFT_ARXIV_MAX:-100}"
+
+total=0
+for cat in $CATS; do
+  # arXiv asks for >=3s between API hits; -L follows the http->https redirect.
+  xml=$(curl -sL --max-time 90 "${API}?search_query=cat:${cat}&sortBy=submittedDate&sortOrder=descending&max_results=${MAXR}")
+  urls=$(printf '%s' "$xml" | python3 -c "
+import sys,re
+ids=re.findall(r'<id>(https?://arxiv\.org/abs/[^<]+)</id>', sys.stdin.read())
+for u in ids: print(u)
+")
+  n=0
+  while IFS= read -r u; do
+    [ -z "$u" ] && continue
+    curl -s -o /dev/null --max-time 30 -X POST "$ADDR/admin/crawl-enqueue" \
+      -H "Content-Type: application/json" \
+      ${TOKEN:+-H "Authorization: Bearer $TOKEN"} \
+      -d "{\"url\":\"$u\"}"
+    n=$((n+1))
+  done <<< "$urls"
+  echo "cosift-arxiv-harvest: $cat -> enqueued $n"
+  total=$((total + n))
+  sleep 3
+done
+echo "cosift-arxiv-harvest: total enqueued=$total at $(date -u +%FT%TZ)"
diff --git a/deploy/harvesters/cosift-compact.sh b/deploy/harvesters/cosift-compact.sh
new file mode 100755
index 0000000..a693ae4
--- /dev/null
+++ b/deploy/harvesters/cosift-compact.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# cosift-compact.sh — invoke hnsw-compact when zombies exceed a threshold.
+# Run from cosift-compact.timer (weekly recommended).
+set -e
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+THRESHOLD_PCT=30
+STATS=$(curl -s --max-time 30 http://127.0.0.1:7777/stats)
+if [ -z "$STATS" ]; then
+  echo "${TS} stats fetch failed" | sudo tee -a /var/log/cosift-compact.log >/dev/null
+  exit 0
+fi
+PCT=$(echo "$STATS" | python3 -c "
+import json,sys
+d=json.load(sys.stdin)
+t=d[\"pq\"][\"nodes_total\"]
+z=d[\"pq\"][\"zombie_nodes\"]
+if t==0: print(0); exit()
+print(int(100*z/t))
+")
+echo "${TS} zombies=${PCT}% threshold=${THRESHOLD_PCT}%" | sudo tee -a /var/log/cosift-compact.log >/dev/null
+if [ "$PCT" -lt "$THRESHOLD_PCT" ]; then
+  echo "${TS} below threshold, skipping compact" | sudo tee -a /var/log/cosift-compact.log >/dev/null
+  exit 0
+fi
+RESULT=$(curl -s --max-time 1800 -X POST http://127.0.0.1:7777/admin/hnsw-compact)
+echo "${TS} compact result: ${RESULT}" | sudo tee -a /var/log/cosift-compact.log >/dev/null
diff --git a/deploy/harvesters/cosift-eval.sh b/deploy/harvesters/cosift-eval.sh
new file mode 100755
index 0000000..05503f0
--- /dev/null
+++ b/deploy/harvesters/cosift-eval.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# Iter 500: daily eval smoke run. Hits /admin/eval-quick, appends one line
+# per run to /var/log/cosift-eval.log with timestamp + JSON summary. Lets
+# operators grep historical answer rates and spot quality regressions
+# tied to corpus growth or code changes.
+set -e
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+RESULT=$(curl -s --max-time 300 http://127.0.0.1:7777/admin/eval-quick)
+# Compact one-line JSON summary (drop the verbose per-query results for the log).
+SUMMARY=$(echo "$RESULT" | python3 -c '
+import json,sys
+try:
+    d=json.load(sys.stdin)
+    out={k:d[k] for k in ["queries","answered","no_info","empty","errors","answer_rate_pct","avg_latency_ms","total_elapsed","chat_model"] if k in d}
+    print(json.dumps(out))
+except Exception as e:
+    print("{\"error\":\"%s\"}" % e)
+')
+echo "${TS} ${SUMMARY}" | sudo tee -a /var/log/cosift-eval.log >/dev/null
+echo "${TS} ${SUMMARY}"
diff --git a/deploy/harvesters/cosift-github-topic-harvest.py b/deploy/harvesters/cosift-github-topic-harvest.py
new file mode 100755
index 0000000..9449a02
--- /dev/null
+++ b/deploy/harvesters/cosift-github-topic-harvest.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""cosift-github-topic-harvest — index top-starred GitHub repos per topic.
+
+READMEs are the canonical install/usage docs for tools/libraries. Harvesting by
+topic warms the corpus with high-quality, actively-maintained repos. github.com
+is allowlisted. The GitHub search API is unauthenticated here (≈10 req/min), so
+we space topic queries. Stdlib only.
+"""
+import json, os, urllib.request, urllib.parse, time
+
+ADDR = "http://127.0.0.1:7777"
+PER = int(os.environ.get("COSIFT_GH_TOPIC_LIMIT", "30"))
+SPACING = float(os.environ.get("COSIFT_GH_SPACING", "7"))  # unauth search ~10/min
+TOPICS = os.environ.get("COSIFT_GH_TOPICS",
+    "machine-learning deep-learning computer-vision nlp llm ocr object-detection "
+    "speech-recognition reinforcement-learning robotics jetson embedded "
+    "kubernetes devops observability rust golang database "
+    "web-framework security cryptography").split()
+
+def token():
+    try: return json.load(open("/home/ubuntu/cosift.json")).get("cluster",{}).get("peer_auth_token","")
+    except Exception: return ""
+TOKEN = token()
+
+def get_json(url):
+    req = urllib.request.Request(url, headers={"User-Agent":"cosift-gh-topic/1.0",
+        "Accept":"application/vnd.github+json"})
+    with urllib.request.urlopen(req, timeout=30) as r: return json.loads(r.read())
+
+def post(path, payload):
+    req = urllib.request.Request(ADDR+path, data=json.dumps(payload).encode(),
+        method="POST", headers={"Content-Type":"application/json"})
+    if TOKEN: req.add_header("Authorization","Bearer "+TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r: return r.status
+    except Exception as e: return str(e)
+
+def main():
+    total = 0
+    for topic in TOPICS:
+        url = ("https://api.github.com/search/repositories?q=topic:"
+               + urllib.parse.quote(topic) + f"&sort=stars&order=desc&per_page={PER}")
+        try:
+            res = get_json(url)
+        except Exception as e:
+            print(f"gh-topic-harvest: {topic} failed: {e}"); time.sleep(SPACING); continue
+        items = res.get("items", [])
+        n = 0
+        for it in items:
+            u = it.get("html_url")
+            if u: post("/admin/crawl-enqueue", {"url": u}); n += 1
+        print(f"gh-topic-harvest: {topic} -> enqueued {n}")
+        total += n
+        time.sleep(SPACING)
+    print(f"gh-topic-harvest: total {total} at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-hf-full-harvest.py b/deploy/harvesters/cosift-hf-full-harvest.py
new file mode 100755
index 0000000..0634228
--- /dev/null
+++ b/deploy/harvesters/cosift-hf-full-harvest.py
@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""cosift-hf-full-harvest — enumerate the ENTIRE HuggingFace Hub and enqueue
+every model, dataset, and Space for indexing. "As many as possible" coverage.
+
+Walks the Hub via cursor pagination (Link: rel="next" header), limit=1000/page.
+RESUMABLE: the per-kind cursor is checkpointed to STATE after every page, so a
+run picks up exactly where the last left off — across crashes, restarts, and the
+per-run budget. When a kind is fully enumerated it resets (next cycle re-walks to
+pick up newly-published repos).
+
+Reality check: enumeration is fast, but the crawler then has to fetch+embed each
+page at its per-host rate — full-Hub coverage is a multi-week grind on one box.
+The frontier is the buffer; we throttle enqueue per run so we don't build an
+absurd backlog faster than it can be reasoned about. Stdlib only.
+"""
+import json, os, sys, time, urllib.request
+
+ADDR = "http://127.0.0.1:7777"
+HF = "https://huggingface.co"
+STATE = "/home/ubuntu/cosift-hf-cursor.json"
+BUDGET = int(os.environ.get("COSIFT_HF_FULL_BUDGET", "50000"))  # max enqueues per run
+PAGE = int(os.environ.get("COSIFT_HF_FULL_PAGE", "1000"))
+KINDS = [("models", "/"), ("datasets", "/datasets/"), ("spaces", "/spaces/")]
+
+def token():
+    try: return json.load(open("/home/ubuntu/cosift.json")).get("cluster",{}).get("peer_auth_token","")
+    except Exception: return ""
+TOKEN = token()
+
+def http(url):
+    """GET returning (json_body, next_url_or_None) using the Link rel=next header."""
+    req = urllib.request.Request(url, headers={"User-Agent":"cosift-hf-full/1.0"})
+    with urllib.request.urlopen(req, timeout=60) as r:
+        body = json.loads(r.read())
+        nxt = None
+        link = r.headers.get("Link", "")
+        for part in link.split(","):
+            if 'rel="next"' in part:
+                s = part.find("<"); e = part.find(">")
+                if s != -1 and e != -1:
+                    nxt = part[s+1:e]
+        return body, nxt
+
+def post(path, payload):
+    req = urllib.request.Request(ADDR+path, data=json.dumps(payload).encode(),
+        method="POST", headers={"Content-Type":"application/json"})
+    if TOKEN: req.add_header("Authorization","Bearer "+TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r: return r.status
+    except Exception: return 0
+
+def load_state():
+    if os.path.exists(STATE):
+        try: return json.load(open(STATE))
+        except Exception: pass
+    return {}
+
+def main():
+    st = load_state()
+    enq = 0
+    for kind, prefix in KINDS:
+        if enq >= BUDGET:
+            break
+        ck = "cursor_" + kind
+        # Resume from saved cursor; empty/"DONE" means start fresh this cycle.
+        cur = st.get(ck) or ""
+        url = f"{HF}/api/{kind}?limit={PAGE}" + (f"&cursor={cur}" if cur else "")
+        page_n = 0
+        while enq < BUDGET:
+            try:
+                items, nxt = http(url)
+            except Exception as e:
+                print(f"hf-full: {kind} page failed: {e}", file=sys.stderr); break
+            for it in items:
+                i = it.get("id")
+                if i:
+                    post("/admin/crawl-enqueue", {"url": f"{HF}{prefix}{i}"})
+                    enq += 1
+            page_n += 1
+            if not nxt:
+                st[ck] = ""  # fully enumerated; restart next cycle for new repos
+                print(f"hf-full: {kind} FULLY enumerated this cycle")
+                break
+            # checkpoint the cursor from the next URL so we resume mid-kind.
+            cidx = nxt.find("cursor=")
+            st[ck] = nxt[cidx+7:] if cidx != -1 else ""
+            url = nxt
+            if enq >= BUDGET:
+                print(f"hf-full: {kind} budget hit at page {page_n}, cursor saved")
+                break
+        json.dump(st, open(STATE, "w"))
+    print(f"hf-full: enqueued {enq} this run at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-hf-harvest.py b/deploy/harvesters/cosift-hf-harvest.py
new file mode 100755
index 0000000..43bb95a
--- /dev/null
+++ b/deploy/harvesters/cosift-hf-harvest.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""cosift-hf-harvest — index HuggingFace via the public Hub API (free, OSS).
+
+Enqueues the most-liked models, datasets, and Spaces (popularity = quality, vs
+sort=lastModified which is auto-uploaded checkpoint spam), plus recent blog
+posts. huggingface.co is already in the allowlist, so no domain promotion is
+needed — just enqueue. Stdlib only.
+
+URL shapes: model <id> -> /<id>; dataset -> /datasets/<id>; space -> /spaces/<id>.
+"""
+import json, os, sys, time, urllib.request
+
+ADDR = "http://127.0.0.1:7777"
+HF = "https://huggingface.co"
+LIMIT = int(os.environ.get("COSIFT_HF_LIMIT", "100"))
+SORT = os.environ.get("COSIFT_HF_SORT", "likes")
+
+def token():
+    try:
+        return json.load(open("/home/ubuntu/cosift.json")).get("cluster", {}).get("peer_auth_token", "")
+    except Exception:
+        return ""
+TOKEN = token()
+
+def get_json(url, timeout=40):
+    req = urllib.request.Request(url, headers={"User-Agent": "cosift-hf/1.0"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return json.loads(r.read())
+
+def post(path, payload):
+    data = json.dumps(payload).encode()
+    req = urllib.request.Request(ADDR + path, data=data, method="POST",
+                                 headers={"Content-Type": "application/json"})
+    if TOKEN:
+        req.add_header("Authorization", "Bearer " + TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return r.status
+    except Exception as e:
+        return str(e)
+
+def harvest(kind, path_prefix):
+    """kind: api endpoint (models/datasets/spaces); path_prefix: URL prefix."""
+    try:
+        items = get_json(f"{HF}/api/{kind}?sort={SORT}&direction=-1&limit={LIMIT}")
+    except Exception as e:
+        print(f"hf-harvest: {kind} failed: {e}", file=sys.stderr); return 0
+    n = 0
+    for it in items:
+        i = it.get("id")
+        if not i:
+            continue
+        post("/admin/crawl-enqueue", {"url": f"{HF}{path_prefix}{i}"}); n += 1
+    print(f"hf-harvest: {kind} -> enqueued {n} (sort={SORT})")
+    return n
+
+def main():
+    total = 0
+    total += harvest("models", "/")
+    total += harvest("datasets", "/datasets/")
+    total += harvest("spaces", "/spaces/")
+    # Blog index (posts are also covered by the blog RSS feed).
+    post("/admin/crawl-enqueue", {"url": f"{HF}/blog"})
+    total += 1
+    print(f"hf-harvest: total enqueued={total} at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-hf-task-harvest.py b/deploy/harvesters/cosift-hf-task-harvest.py
new file mode 100755
index 0000000..66b0403
--- /dev/null
+++ b/deploy/harvesters/cosift-hf-task-harvest.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""cosift-hf-task-harvest — index top HF models per ML task/pipeline tag.
+
+Complements cosift-hf-harvest.py (which does global top-by-likes and misses
+niche-but-relevant models). Harvesting top-N PER TASK surfaces the best model
+for each capability (object-detection, OCR/image-to-text, ASR, etc.) — e.g.
+license-plate / DETR detectors that never crack the global likes leaderboard.
+huggingface.co is allowlisted. Stdlib only.
+"""
+import json, os, urllib.request, urllib.parse, time
+
+ADDR = "http://127.0.0.1:7777"
+HF = "https://huggingface.co"
+PER = int(os.environ.get("COSIFT_HF_TASK_LIMIT", "50"))
+TASKS = os.environ.get("COSIFT_HF_TASKS",
+    "object-detection image-segmentation image-classification image-to-text "
+    "automatic-speech-recognition text-to-speech text-generation text-classification "
+    "token-classification question-answering summarization translation "
+    "sentence-similarity feature-extraction zero-shot-classification "
+    "text-to-image image-to-image depth-estimation").split()
+
+def token():
+    try: return json.load(open("/home/ubuntu/cosift.json")).get("cluster",{}).get("peer_auth_token","")
+    except Exception: return ""
+TOKEN = token()
+
+def get_json(url):
+    req = urllib.request.Request(url, headers={"User-Agent":"cosift-hf-task/1.0"})
+    with urllib.request.urlopen(req, timeout=40) as r: return json.loads(r.read())
+
+def post(path, payload):
+    req = urllib.request.Request(ADDR+path, data=json.dumps(payload).encode(),
+        method="POST", headers={"Content-Type":"application/json"})
+    if TOKEN: req.add_header("Authorization","Bearer "+TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r: return r.status
+    except Exception as e: return str(e)
+
+def main():
+    total = 0
+    for task in TASKS:
+        url = f"{HF}/api/models?filter={urllib.parse.quote(task)}&sort=likes&direction=-1&limit={PER}"
+        try: items = get_json(url)
+        except Exception as e:
+            print(f"hf-task-harvest: {task} failed: {e}"); continue
+        n = 0
+        for it in items:
+            i = it.get("id")
+            if i: post("/admin/crawl-enqueue", {"url": f"{HF}/{i}"}); n += 1
+        print(f"hf-task-harvest: {task} -> enqueued {n}")
+        total += n
+        time.sleep(1)
+    print(f"hf-task-harvest: total {total} at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-hn-harvest.py b/deploy/harvesters/cosift-hn-harvest.py
new file mode 100755
index 0000000..fcec725
--- /dev/null
+++ b/deploy/harvesters/cosift-hn-harvest.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+"""cosift-hn-harvest — index Hacker News via the official Firebase API.
+
+Enqueues each story's HN discussion page (news.ycombinator.com, allowlisted)
+AND its external link. External links live on arbitrary domains, so we grow the
+crawl allowlist ORGANICALLY: a link-target domain that recurs on HN >= THRESHOLD
+times is promoted via /admin/allow-domain, then its URLs are enqueued. One-off
+junk domains never cross the threshold and stay filtered.
+
+Stdlib only (urllib + json) — no pip deps. Frequency state persists across runs.
+"""
+import json, os, sys, time, urllib.request, urllib.parse
+from collections import Counter
+
+ADDR = "http://127.0.0.1:7777"
+HN = "https://hacker-news.firebaseio.com/v0"
+STATE = "/home/ubuntu/cosift-hn-domains.json"   # {domain: count, "_promoted":[...]}
+THRESHOLD = int(os.environ.get("COSIFT_HN_PROMOTE_THRESHOLD", "3"))
+PER_LIST = int(os.environ.get("COSIFT_HN_PER_LIST", "60"))
+LISTS = ["topstories", "beststories", "newstories", "askstories", "showstories"]
+
+def token():
+    try:
+        return json.load(open("/home/ubuntu/cosift.json")).get("cluster", {}).get("peer_auth_token", "")
+    except Exception:
+        return ""
+TOKEN = token()
+
+def get(url, timeout=30):
+    req = urllib.request.Request(url, headers={"User-Agent": "cosift-hn/1.0"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return r.read()
+
+def post(path, payload):
+    data = json.dumps(payload).encode()
+    req = urllib.request.Request(ADDR + path, data=data, method="POST",
+                                 headers={"Content-Type": "application/json"})
+    if TOKEN:
+        req.add_header("Authorization", "Bearer " + TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return r.status
+    except Exception as e:
+        return str(e)
+
+def host_of(u):
+    try:
+        h = urllib.parse.urlparse(u).hostname or ""
+        return h.lower().lstrip(".")
+    except Exception:
+        return ""
+
+def etld1(h):
+    # crude eTLD+1 (good enough for promotion granularity)
+    parts = h.split(".")
+    return ".".join(parts[-2:]) if len(parts) >= 2 else h
+
+def main():
+    state = {}
+    if os.path.exists(STATE):
+        try: state = json.load(open(STATE))
+        except Exception: state = {}
+    counts = Counter({k: v for k, v in state.items() if not k.startswith("_")})
+    promoted = set(state.get("_promoted", []))
+
+    # 1. Collect story ids across lists.
+    ids = []
+    seen = set()
+    for lst in LISTS:
+        try:
+            arr = json.loads(get(f"{HN}/{lst}.json"))
+        except Exception as e:
+            print(f"hn-harvest: {lst} failed: {e}", file=sys.stderr); continue
+        for i in (arr or [])[:PER_LIST]:
+            if i not in seen:
+                seen.add(i); ids.append(i)
+    print(f"hn-harvest: {len(ids)} unique stories")
+
+    hn_pages, ext_urls = [], []
+    for i in ids:
+        try:
+            it = json.loads(get(f"{HN}/item/{i}.json"))
+        except Exception:
+            continue
+        if not it:
+            continue
+        hn_pages.append(f"https://news.ycombinator.com/item?id={i}")
+        u = it.get("url")
+        if u and u.startswith("http"):
+            ext_urls.append(u)
+
+    # 2. Count external-link domains; promote those crossing THRESHOLD.
+    newly_promoted = []
+    for u in ext_urls:
+        d = etld1(host_of(u))
+        if d:
+            counts[d] += 1
+    for d, n in counts.items():
+        if n >= THRESHOLD and d not in promoted:
+            r = post("/admin/allow-domain", {"domain": d})
+            if r in (200, "200") or str(r) == "200":
+                promoted.add(d); newly_promoted.append(d)
+    print(f"hn-harvest: promoted {len(newly_promoted)} new domains: {newly_promoted[:20]}")
+
+    # 3. Enqueue HN pages (always) + external urls whose domain is promoted.
+    nq = 0
+    for u in hn_pages:
+        post("/admin/crawl-enqueue", {"url": u}); nq += 1
+    ne = 0
+    for u in ext_urls:
+        if etld1(host_of(u)) in promoted:
+            post("/admin/crawl-enqueue", {"url": u}); ne += 1
+    print(f"hn-harvest: enqueued {nq} HN pages + {ne} external links")
+
+    # 4. Persist counts + promotions.
+    out = dict(counts); out["_promoted"] = sorted(promoted)
+    json.dump(out, open(STATE, "w"))
+    print(f"hn-harvest: done at {time.strftime('%FT%TZ', time.gmtime())} "
+          f"({len(promoted)} domains promoted total)")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-pypi-harvest.py b/deploy/harvesters/cosift-pypi-harvest.py
new file mode 100755
index 0000000..ccf11e1
--- /dev/null
+++ b/deploy/harvesters/cosift-pypi-harvest.py
@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+"""cosift-pypi-harvest — index the most-used PyPI packages' project pages.
+
+Pre-indexing for baseline coverage: the top-N packages by download count (from
+hugovk's well-known list) cover the common Python ecosystem so /search and
+/research can answer "what does package X do / how to install it". The long tail
+of niche packages is handled live by /find. pypi.org is allowlisted; we enqueue
+project pages and the crawler indexes the description + README. Stdlib only.
+"""
+import json, os, urllib.request, time
+
+ADDR = "http://127.0.0.1:7777"
+TOP = int(os.environ.get("COSIFT_PYPI_TOP", "1000"))
+LIST = "https://hugovk.github.io/top-pypi-packages/top-pypi-packages.min.json"
+
+def token():
+    try: return json.load(open("/home/ubuntu/cosift.json")).get("cluster",{}).get("peer_auth_token","")
+    except Exception: return ""
+TOKEN = token()
+
+def post(path, payload):
+    req = urllib.request.Request(ADDR+path, data=json.dumps(payload).encode(),
+        method="POST", headers={"Content-Type":"application/json"})
+    if TOKEN: req.add_header("Authorization","Bearer "+TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r: return r.status
+    except Exception as e: return str(e)
+
+def main():
+    req = urllib.request.Request(LIST, headers={"User-Agent":"cosift-pypi/1.0"})
+    with urllib.request.urlopen(req, timeout=30) as r:
+        rows = json.loads(r.read()).get("rows", [])
+    n = 0
+    for row in rows[:TOP]:
+        name = row.get("project")
+        if not name: continue
+        post("/admin/crawl-enqueue", {"url": f"https://pypi.org/project/{name}/"})
+        n += 1
+    print(f"pypi-harvest: enqueued {n} package pages (top {TOP}) at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-reddit-harvest.py b/deploy/harvesters/cosift-reddit-harvest.py
new file mode 100755
index 0000000..fe6f022
--- /dev/null
+++ b/deploy/harvesters/cosift-reddit-harvest.py
@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""cosift-reddit-harvest — index Reddit via per-subreddit RSS/Atom (free, OSS).
+
+Reddit's .json API serves HTML to datacenter IPs, but the .rss (Atom) endpoint
+works. Per subreddit we enqueue the comment page (reddit.com, allowlisted) and
+the post's external link, with the SAME organic domain-promotion as HN: an
+external domain recurring >= THRESHOLD times is promoted via /admin/allow-domain.
+
+Stdlib only. Evaluation notes (logged): per-feed item count + HTTP status, so we
+can see reddit's reliability/rate-limiting vs HN over time.
+"""
+import json, os, re, sys, time, urllib.request, urllib.parse
+from collections import Counter
+
+ADDR = "http://127.0.0.1:7777"
+SUBS_FILE = "/home/ubuntu/cosift-subreddits.txt"
+STATE = "/home/ubuntu/cosift-reddit-domains.json"
+THRESHOLD = int(os.environ.get("COSIFT_REDDIT_PROMOTE_THRESHOLD", "3"))
+SPACING = float(os.environ.get("COSIFT_REDDIT_SPACING", "2"))
+
+def token():
+    try:
+        return json.load(open("/home/ubuntu/cosift.json")).get("cluster", {}).get("peer_auth_token", "")
+    except Exception:
+        return ""
+TOKEN = token()
+
+def get(url, timeout=30):
+    req = urllib.request.Request(url, headers={"User-Agent": "cosift-reddit/1.0"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            return r.read().decode("utf-8", "replace"), r.status
+    except Exception as e:
+        return "", str(e)
+
+def post(path, payload):
+    data = json.dumps(payload).encode()
+    req = urllib.request.Request(ADDR + path, data=data, method="POST",
+                                 headers={"Content-Type": "application/json"})
+    if TOKEN:
+        req.add_header("Authorization", "Bearer " + TOKEN)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as r:
+            return r.status
+    except Exception as e:
+        return str(e)
+
+def host_of(u):
+    try:
+        return (urllib.parse.urlparse(u).hostname or "").lower().lstrip(".")
+    except Exception:
+        return ""
+
+def etld1(h):
+    p = h.split(".")
+    return ".".join(p[-2:]) if len(p) >= 2 else h
+
+def main():
+    if not os.path.exists(SUBS_FILE):
+        print(f"reddit-harvest: {SUBS_FILE} missing", file=sys.stderr); return
+    subs = [l.strip() for l in open(SUBS_FILE) if l.strip() and not l.startswith("#")]
+
+    state = {}
+    if os.path.exists(STATE):
+        try: state = json.load(open(STATE))
+        except Exception: state = {}
+    counts = Counter({k: v for k, v in state.items() if not k.startswith("_")})
+    promoted = set(state.get("_promoted", []))
+
+    comment_pages, ext_urls = [], []
+    for sub in subs:
+        url = f"https://www.reddit.com/r/{sub}/.rss"
+        body, status = get(url)
+        # Atom entries: comment-page link + external [link] href in content.
+        cpages = re.findall(r'<link href="(https://www\.reddit\.com/r/[^"]+)"', body)
+        exts = re.findall(r'href="([^"]+)">\[link\]</a>', body)
+        comment_pages.extend(cpages)
+        ext_urls.extend(e for e in exts if e.startswith("http"))
+        print(f"reddit-harvest: r/{sub} -> {len(cpages)} threads, {len(exts)} ext (http={status})")
+        time.sleep(SPACING)  # reddit politeness
+
+    # Count + promote external domains.
+    newly = []
+    for u in ext_urls:
+        d = etld1(host_of(u))
+        if d:
+            counts[d] += 1
+    for d, n in counts.items():
+        if n >= THRESHOLD and d not in promoted:
+            if str(post("/admin/allow-domain", {"domain": d})) == "200":
+                promoted.add(d); newly.append(d)
+    print(f"reddit-harvest: promoted {len(newly)} new domains: {newly[:20]}")
+
+    # Enqueue comment pages (allowlisted) + external urls from promoted domains.
+    nq = ne = 0
+    for u in set(comment_pages):
+        post("/admin/crawl-enqueue", {"url": u}); nq += 1
+    for u in set(ext_urls):
+        if etld1(host_of(u)) in promoted:
+            post("/admin/crawl-enqueue", {"url": u}); ne += 1
+    print(f"reddit-harvest: enqueued {nq} threads + {ne} external links")
+
+    out = dict(counts); out["_promoted"] = sorted(promoted)
+    json.dump(out, open(STATE, "w"))
+    print(f"reddit-harvest: done at {time.strftime('%FT%TZ', time.gmtime())}")
+
+if __name__ == "__main__":
+    main()
diff --git a/deploy/harvesters/cosift-sitemap-refresh.sh b/deploy/harvesters/cosift-sitemap-refresh.sh
new file mode 100755
index 0000000..277fdfe
--- /dev/null
+++ b/deploy/harvesters/cosift-sitemap-refresh.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# cosift-sitemap-refresh — re-discover + queue sitemaps for curated quality
+# hosts (cosift-sites.txt) so newly-published pages enter the crawl frontier.
+# Companion to cosift-rss-refresh.sh: RSS catches the latest-N article links
+# fast (every 30min); this sweeps each host's full sitemap a few times a day to
+# catch pages RSS missed. The crawler's refetch window (COSIFT_REFETCH_AFTER_*)
+# + frontier dedup mean re-submitting mostly queues genuinely-new URLs.
+#
+# Runs SEQUENTIALLY with spacing — site-submit pulls full sitemaps (can be
+# large), so we keep it gentle to avoid a crawl/index burst.
+set -u
+
+SITES=/home/ubuntu/cosift-sites.txt
+ADDR="http://127.0.0.1:7777"
+LANE="${COSIFT_SITEMAP_LANE:-refresh}"
+SPACING="${COSIFT_SITEMAP_SPACING:-3}"   # seconds between hosts
+TOKEN=$(python3 -c "import json; c=json.load(open('/home/ubuntu/cosift.json')); print(c.get('cluster',{}).get('peer_auth_token',''))" 2>/dev/null || echo "")
+
+if [ ! -f "$SITES" ]; then
+  echo "cosift-sitemap-refresh: $SITES not found; nothing to do"
+  exit 0
+fi
+
+total=0
+while IFS= read -r HOST; do
+  case "$HOST" in ''|\#*) continue;; esac
+  HOST=$(echo "$HOST" | tr -d '[:space:]')
+  [ -z "$HOST" ] && continue
+  RESP=$(curl -s --max-time 300 -X POST "$ADDR/admin/site-submit" \
+    -H "Content-Type: application/json" \
+    ${TOKEN:+-H "Authorization: Bearer $TOKEN"} \
+    -d "{\"host\":\"$HOST\",\"lane\":\"$LANE\"}")
+  Q=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_queued','?'))" 2>/dev/null || echo "?")
+  echo "cosift-sitemap-refresh: $HOST -> queued $Q (lane=$LANE)"
+  [ "$Q" != "?" ] && [ -n "$Q" ] && total=$((total + Q))
+  sleep "$SPACING"
+done < "$SITES"
+
+echo "cosift-sitemap-refresh: done, total queued=$total at $(date -u +%FT%TZ)"
diff --git a/deploy/harvesters/cosift-wet-refresh.sh b/deploy/harvesters/cosift-wet-refresh.sh
new file mode 100755
index 0000000..960498a
--- /dev/null
+++ b/deploy/harvesters/cosift-wet-refresh.sh
@@ -0,0 +1,77 @@
+#!/bin/bash
+# cosift-wet-refresh — rotating CommonCrawl WET ingest.
+#
+# Walks a CC release's ~100k-file manifest one slice per run so each run
+# ingests NEW files instead of re-reading 0-9 (the old script hardcoded
+# skip=0,count=10 and dedup'd to ~zero net docs every week). State (release +
+# next offset) persists in STATE_FILE. When a newer CC release appears, the
+# offset resets to 0 so we migrate to the freshest crawl automatically.
+#
+# Tunables (env):
+#   COSIFT_WET_COUNT         files per run        (default 100 ≈ 2.1M docs)
+#   COSIFT_WET_CONCURRENCY   parallel imports     (default 4, handler caps 8)
+#   COSIFT_WET_LEXICAL_ONLY  skip embeddings      (default true — fast BM25 ingest)
+set -u
+
+ADDR="http://127.0.0.1:7777"
+STATE_FILE="/home/ubuntu/cosift-wet-state.txt"
+COUNT="${COSIFT_WET_COUNT:-50}"
+CONCURRENCY="${COSIFT_WET_CONCURRENCY:-2}"
+LEXICAL_ONLY="${COSIFT_WET_LEXICAL_ONLY:-true}"
+MANIFEST_FILES=100000   # CC releases ship ~100k WET files
+
+TOKEN=$(python3 -c "import json; c=json.load(open('/home/ubuntu/cosift.json')); print(c.get('cluster',{}).get('peer_auth_token',''))" 2>/dev/null || echo "")
+
+# Latest CC release id (e.g. CC-MAIN-2026-21).
+LATEST=$(curl -s --max-time 30 https://data.commoncrawl.org/crawl-data/index.html \
+  | grep -oE 'CC-MAIN-[0-9]{4}-[0-9]{2}' | sort -u | tail -1)
+if [ -z "$LATEST" ]; then
+  echo "cosift-wet-refresh: could not determine latest release; aborting"
+  exit 1
+fi
+
+# Persisted (release, offset). Reset to 0 when the release rolls over.
+STATE_RELEASE=""
+OFFSET=0
+if [ -f "$STATE_FILE" ]; then
+  read -r STATE_RELEASE OFFSET < "$STATE_FILE" || true
+  [ -z "${OFFSET:-}" ] && OFFSET=0
+fi
+if [ "$STATE_RELEASE" != "$LATEST" ]; then
+  echo "cosift-wet-refresh: release rolled '${STATE_RELEASE:-none}' -> $LATEST, resetting offset to 0"
+  OFFSET=0
+fi
+if [ "$OFFSET" -ge "$MANIFEST_FILES" ]; then
+  echo "cosift-wet-refresh: walked entire $LATEST manifest, wrapping offset to 0"
+  OFFSET=0
+fi
+
+JSON=$(printf '{"manifest_url":"https://data.commoncrawl.org/crawl-data/%s/wet.paths.gz","count":%d,"skip":%d,"concurrency":%d,"lexical_only":%s}' \
+  "$LATEST" "$COUNT" "$OFFSET" "$CONCURRENCY" "$LEXICAL_ONLY")
+echo "cosift-wet-refresh: release=$LATEST skip=$OFFSET count=$COUNT concurrency=$CONCURRENCY"
+
+# Advance the offset BEFORE the import. wet-import-bulk is idempotent (URL
+# dedup), so the worst case from advancing early is skipping a slice on a hard
+# failure — acceptable in a 100k-file manifest. The failure we actually hit was
+# the opposite: a successful server-side import whose response the loaded box
+# dropped, leaving the offset stuck and re-reading the same slice forever.
+# Advancing first makes the walk monotonic regardless of response delivery.
+NEXT=$((OFFSET + COUNT))
+echo "$LATEST $NEXT" > "$STATE_FILE"
+
+RESP=$(curl -s --retry 2 --retry-delay 30 --max-time 7200 -X POST "$ADDR/admin/wet-import-bulk" \
+  -H 'Content-Type: application/json' \
+  ${TOKEN:+-H "Authorization: Bearer $TOKEN"} \
+  -d "$JSON")
+
+TOTAL=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_indexed',''))" 2>/dev/null || echo "")
+if [ -z "$TOTAL" ]; then
+  # Import may have succeeded server-side even if we couldn't read the response
+  # (heavy write bursts can drop the client connection). Offset already advanced,
+  # so the walk continues; check the cosift-serve journal for the real result.
+  echo "cosift-wet-refresh: response unreadable (import may have succeeded server-side); offset already advanced $OFFSET -> $NEXT. Check 'journalctl -u cosift-serve' for 'wet-import-bulk: indexed'. Response head:"
+  echo "$RESP" | head -c 500
+  exit 0
+fi
+
+echo "cosift-wet-refresh: indexed=$TOTAL, advanced offset $OFFSET -> $NEXT, done at $(date -u +%FT%TZ)"
diff --git a/deploy/lists/cosift-feeds.txt b/deploy/lists/cosift-feeds.txt
new file mode 100644
index 0000000..c28f235
--- /dev/null
+++ b/deploy/lists/cosift-feeds.txt
@@ -0,0 +1,254 @@
+https://www.reddit.com/r/programming/.rss
+https://www.reddit.com/r/golang/.rss
+https://www.reddit.com/r/rust/.rss
+https://www.reddit.com/r/MachineLearning/.rss
+https://www.reddit.com/r/LocalLLaMA/.rss
+https://www.reddit.com/r/Python/.rss
+https://www.reddit.com/r/javascript/.rss
+https://www.reddit.com/r/node/.rss
+https://www.reddit.com/r/reactjs/.rss
+https://www.reddit.com/r/dotnet/.rss
+https://www.reddit.com/r/cpp/.rss
+https://www.reddit.com/r/java/.rss
+https://www.reddit.com/r/django/.rss
+https://www.reddit.com/r/flask/.rss
+https://www.reddit.com/r/learnprogramming/.rss
+https://www.reddit.com/r/compsci/.rss
+https://www.reddit.com/r/datascience/.rss
+https://www.reddit.com/r/ArtificialIntelligence/.rss
+https://www.reddit.com/r/OpenAI/.rss
+https://www.reddit.com/r/Anthropic/.rss
+https://www.reddit.com/r/ClaudeAI/.rss
+https://www.reddit.com/r/singularity/.rss
+https://www.reddit.com/r/StableDiffusion/.rss
+https://www.reddit.com/r/selfhosted/.rss
+https://www.reddit.com/r/homelab/.rss
+https://www.reddit.com/r/sysadmin/.rss
+https://www.reddit.com/r/linux/.rss
+https://www.reddit.com/r/linuxquestions/.rss
+https://www.reddit.com/r/security/.rss
+https://www.reddit.com/r/netsec/.rss
+https://www.reddit.com/r/cybersecurity/.rss
+https://www.reddit.com/r/science/.rss
+https://www.reddit.com/r/askscience/.rss
+https://www.reddit.com/r/space/.rss
+https://www.reddit.com/r/physics/.rss
+https://www.reddit.com/r/biology/.rss
+https://www.reddit.com/r/chemistry/.rss
+https://www.reddit.com/r/math/.rss
+https://www.reddit.com/r/worldnews/.rss
+https://www.reddit.com/r/news/.rss
+https://www.reddit.com/r/technology/.rss
+https://www.reddit.com/r/futurology/.rss
+https://www.reddit.com/r/todayilearned/.rss
+https://www.reddit.com/r/explainlikeimfive/.rss
+https://www.reddit.com/r/AskHistorians/.rss
+https://www.reddit.com/r/history/.rss
+https://www.reddit.com/r/philosophy/.rss
+https://www.reddit.com/r/books/.rss
+https://www.reddit.com/r/movies/.rss
+https://www.reddit.com/r/television/.rss
+https://www.reddit.com/r/gaming/.rss
+https://www.reddit.com/r/Games/.rss
+https://www.reddit.com/r/boardgames/.rss
+https://www.reddit.com/r/sports/.rss
+https://www.reddit.com/r/Fitness/.rss
+https://www.reddit.com/r/food/.rss
+https://www.reddit.com/r/Cooking/.rss
+https://www.reddit.com/r/photography/.rss
+https://www.reddit.com/r/business/.rss
+https://www.reddit.com/r/economics/.rss
+https://www.reddit.com/r/investing/.rss
+https://www.reddit.com/r/personalfinance/.rss
+https://www.reddit.com/r/Entrepreneur/.rss
+https://www.reddit.com/r/startups/.rss
+https://www.reddit.com/r/stocks/.rss
+https://www.reddit.com/r/Health/.rss
+https://www.reddit.com/r/medicine/.rss
+https://www.reddit.com/r/nutrition/.rss
+https://www.reddit.com/r/mentalhealth/.rss
+https://www.reddit.com/r/travel/.rss
+https://www.reddit.com/r/geography/.rss
+https://www.reddit.com/r/geopolitics/.rss
+https://www.reddit.com/r/environment/.rss
+https://www.reddit.com/r/climate/.rss
+https://www.reddit.com/r/sociology/.rss
+https://www.reddit.com/r/psychology/.rss
+https://www.reddit.com/r/Education/.rss
+https://www.reddit.com/r/dataisbeautiful/.rss
+https://www.reddit.com/r/mildlyinteresting/.rss
+https://www.reddit.com/r/art/.rss
+https://www.reddit.com/r/Music/.rss
+https://www.reddit.com/r/writing/.rss
+https://www.reddit.com/r/literature/.rss
+https://www.reddit.com/r/Cars/.rss
+https://www.reddit.com/r/formula1/.rss
+https://www.reddit.com/r/aviation/.rss
+https://www.reddit.com/r/Bitcoin/.rss
+https://www.reddit.com/r/CryptoCurrency/.rss
+https://www.reddit.com/r/ethereum/.rss
+https://www.reddit.com/r/apple/.rss
+https://www.reddit.com/r/android/.rss
+https://www.reddit.com/r/3Dprinting/.rss
+https://www.reddit.com/r/electronics/.rss
+https://www.reddit.com/r/arduino/.rss
+https://www.reddit.com/r/raspberry_pi/.rss
+https://www.reddit.com/r/buildapc/.rss
+https://www.reddit.com/r/AskReddit/.rss
+https://www.reddit.com/r/IAmA/.rss
+https://www.reddit.com/r/nosleep/.rss
+https://www.reddit.com/r/UpliftingNews/.rss
+https://www.reddit.com/r/Documentaries/.rss
+https://hnrss.org/newest
+https://hnrss.org/frontpage
+https://hnrss.org/best
+https://hnrss.org/ask
+https://hnrss.org/show
+https://hnrss.org/jobs
+https://lobste.rs/rss
+https://lwn.net/headlines/newrss
+https://www.phoronix.com/rss.php
+https://arxiv.org/rss/cs.LG
+https://arxiv.org/rss/cs.CL
+https://arxiv.org/rss/cs.AI
+https://arxiv.org/rss/cs.DC
+https://arxiv.org/rss/cs.CR
+https://arxiv.org/rss/cs.IR
+https://arxiv.org/rss/cs.SE
+https://arxiv.org/rss/cs.PL
+https://arxiv.org/rss/cs.DS
+https://arxiv.org/rss/cs.DB
+https://arxiv.org/rss/cs.OS
+https://arxiv.org/rss/cs.NI
+https://arxiv.org/rss/cs.CV
+https://arxiv.org/rss/cs.RO
+https://arxiv.org/rss/stat.ML
+https://arxiv.org/rss/math.PR
+https://arxiv.org/rss/math.ST
+https://arxiv.org/rss/physics.comp-ph
+https://www.docker.com/blog/feed/
+https://aws.amazon.com/blogs/aws/feed/
+https://stackoverflow.blog/feed/
+https://hackaday.com/feed/
+https://www.theverge.com/rss/index.xml
+https://techcrunch.com/feed/
+https://feeds.arstechnica.com/arstechnica/index
+https://www.wired.com/feed/rss
+https://feeds.feedburner.com/oreilly/radar
+https://blog.golang.org/feed.atom
+https://blog.rust-lang.org/feed.xml
+https://kubernetes.io/feed.xml
+https://blog.cloudflare.com/rss/
+https://github.blog/feed/
+https://news.ycombinator.com/rss
+https://martinfowler.com/feed.atom
+https://overreacted.io/rss.xml
+https://kentcdodds.com/blog/rss.xml
+https://www.joelonsoftware.com/feed/
+https://blog.pragmaticengineer.com/rss/
+https://www.allthingsdistributed.com/atom.xml
+https://eng.uber.com/feed/
+https://netflixtechblog.com/feed
+https://engineering.linkedin.com/blog.rss.html
+https://medium.com/feed/airbnb-engineering
+https://slack.engineering/feed/
+https://dropbox.tech/feed
+https://eng.lyft.com/feed
+https://blog.discord.com/feed
+https://shopify.engineering/blog.atom
+https://medium.com/feed/pinterest-engineering
+https://engineering.fb.com/feed/
+https://opensource.googleblog.com/feeds/posts/default
+https://huggingface.co/blog/feed.xml
+https://openai.com/blog/rss.xml
+https://blog.langchain.dev/rss/
+https://blog.cohere.com/rss/
+https://www.databricks.com/blog/feed
+https://qdrant.tech/feed/
+https://vercel.com/atom.xml
+https://supabase.com/feed.xml
+https://feeds.bbci.co.uk/news/rss.xml
+https://feeds.bbci.co.uk/news/world/rss.xml
+https://feeds.bbci.co.uk/news/business/rss.xml
+https://feeds.bbci.co.uk/news/technology/rss.xml
+https://feeds.bbci.co.uk/news/science_and_environment/rss.xml
+https://feeds.bbci.co.uk/news/health/rss.xml
+https://www.reuters.com/rssFeed/topNews
+https://www.theguardian.com/world/rss
+https://www.theguardian.com/technology/rss
+https://www.theguardian.com/science/rss
+https://www.nytimes.com/services/xml/rss/nyt/HomePage.xml
+https://www.nytimes.com/services/xml/rss/nyt/World.xml
+https://www.nytimes.com/services/xml/rss/nyt/Technology.xml
+https://www.nytimes.com/services/xml/rss/nyt/Science.xml
+https://www.npr.org/rss/rss.php?id=1001
+https://www.npr.org/rss/rss.php?id=1004
+https://www.npr.org/rss/rss.php?id=1019
+https://www.economist.com/sections/science-technology/rss.xml
+https://www.aljazeera.com/xml/rss/all.xml
+https://www.spiegel.de/international/index.rss
+https://www.cdc.gov/podcasts/feed.xml
+https://tools.cdc.gov/podcasts/feed.aspx
+https://www.fda.gov/about-fda/contact-fda/stay-informed/rss-feeds/press-releases/rss.xml
+https://www.nasa.gov/news-release/feed/
+https://blogs.nasa.gov/feed/
+https://feeds.nature.com/nature/rss/current
+https://www.nature.com/subjects/computer-science.rss
+https://feeds.feedburner.com/PubmedTopReads
+https://venturebeat.com/feed/
+https://thenextweb.com/feed
+https://www.engadget.com/rss.xml
+https://gizmodo.com/rss
+https://lifehacker.com/rss
+https://mashable.com/feeds/rss/tech
+https://hbr.org/feed
+https://www.fastcompany.com/latest/rss
+https://feeds.feedburner.com/businessinsider
+https://www.bloomberg.com/feed/podcast/index.rss
+https://www.ft.com/rss/home
+https://blog.acolyer.org/feed/
+https://research.google/blog/rss/
+https://blogs.nvidia.com/feed/
+https://about.fb.com/feed/
+https://feeds.gawker.com/jalopnik/full
+https://torrentfreak.com/feed/
+https://www.smashingmagazine.com/feed/
+https://css-tricks.com/feed/
+https://www.freecodecamp.org/news/rss/
+https://medium.com/feed/better-programming
+https://medium.com/feed/javascript-scene
+https://daringfireball.net/feeds/main
+https://www.macrumors.com/macrumors.xml
+https://www.androidauthority.com/feed/
+https://9to5mac.com/feed/
+https://www.theinformation.com/feed
+https://rss.nytimes.com/services/xml/rss/nyt/HomePage.xml
+https://www.theguardian.com/international/rss
+https://feeds.npr.org/1001/rss.xml
+https://moxie.foxnews.com/google-publisher/latest.xml
+https://feeds.feedburner.com/TheHackersNews
+https://krebsonsecurity.com/feed/
+https://www.bleepingcomputer.com/feed/
+https://devblogs.microsoft.com/feed/
+https://blog.jetbrains.com/feed/
+https://www.nature.com/nature.rss
+https://www.science.org/rss/news_current.xml
+https://phys.org/rss-feed/
+https://www.quantamagazine.org/feed/
+https://www.newscientist.com/feed/home/
+https://rss.arxiv.org/rss/cs.AI
+https://rss.arxiv.org/rss/cs.LG
+https://rss.arxiv.org/rss/cs.CL
+https://rss.arxiv.org/rss/cs.DC
+https://rss.arxiv.org/rss/cs.SE
+https://bair.berkeley.edu/blog/feed.xml
+https://blog.research.google/feeds/posts/default
+https://deepmind.google/blog/rss.xml
+https://lwn.net/headlines/rss
+https://www.infoq.com/feed/
+https://rss.arxiv.org/rss/cs.CV
+https://rss.arxiv.org/rss/cs.NE
+https://rss.arxiv.org/rss/stat.ML
+https://rss.arxiv.org/rss/cs.IR
+https://rss.arxiv.org/rss/cs.CR
+https://www.tomshardware.com/feeds/all
diff --git a/deploy/lists/cosift-sites.txt b/deploy/lists/cosift-sites.txt
new file mode 100644
index 0000000..7ac7023
--- /dev/null
+++ b/deploy/lists/cosift-sites.txt
@@ -0,0 +1,28 @@
+# cosift-sites.txt — curated quality hosts whose sitemaps are re-submitted
+# periodically by cosift-sitemap-refresh.timer so newly-published pages enter
+# the crawl frontier. Bare hostnames, one per line. '#' comments allowed.
+# Pick hosts with frequently-updated sitemaps (news/tech/docs) that don't
+# hard-block bots.
+#
+# News / journalism
+arstechnica.com
+theverge.com
+techcrunch.com
+wired.com
+theguardian.com
+bbc.com
+apnews.com
+# Tech / engineering blogs
+stackoverflow.blog
+github.blog
+blog.cloudflare.com
+netflixtechblog.com
+# Science / research
+nature.com
+quantamagazine.org
+phys.org
+# AI / ML
+huggingface.co
+# Docs (update regularly, high authority)
+developer.mozilla.org
+kubernetes.io
diff --git a/deploy/lists/cosift-subreddits.txt b/deploy/lists/cosift-subreddits.txt
new file mode 100644
index 0000000..b2e918e
--- /dev/null
+++ b/deploy/lists/cosift-subreddits.txt
@@ -0,0 +1,25 @@
+# Quality subreddits for cosift-reddit-harvest. One per line, '#' comments.
+programming
+MachineLearning
+LocalLLaMA
+compsci
+datascience
+science
+askscience
+technology
+hardware
+selfhosted
+devops
+rust
+golang
+python
+cpp
+java
+javascript
+ExperiencedDevs
+ArtificialIntelligence
+AskHistorians
+math
+statistics
+netsec
+cybersecurity
diff --git a/deploy/systemd/cosift-arxiv-harvest.service b/deploy/systemd/cosift-arxiv-harvest.service
new file mode 100644
index 0000000..b674488
--- /dev/null
+++ b/deploy/systemd/cosift-arxiv-harvest.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cosift arXiv harvest (enqueue latest papers per category)
+After=cosift-serve.service
+Wants=cosift-serve.service
+
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-arxiv-harvest.sh
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-arxiv-harvest.timer b/deploy/systemd/cosift-arxiv-harvest.timer
new file mode 100644
index 0000000..447b1b5
--- /dev/null
+++ b/deploy/systemd/cosift-arxiv-harvest.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift arXiv harvest — daily (arXiv announces ~once/day on weekdays)
+
+[Timer]
+OnCalendar=*-*-* 05:30:00
+Persistent=true
+AccuracySec=5min
+
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-github-topic-harvest.service b/deploy/systemd/cosift-github-topic-harvest.service
new file mode 100644
index 0000000..d5e128e
--- /dev/null
+++ b/deploy/systemd/cosift-github-topic-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift github-topic pre-index harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-github-topic-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-github-topic-harvest.timer b/deploy/systemd/cosift-github-topic-harvest.timer
new file mode 100644
index 0000000..c57c9c1
--- /dev/null
+++ b/deploy/systemd/cosift-github-topic-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift github-topic pre-index schedule
+[Timer]
+OnCalendar=Wed *-*-* 07:00:00
+Persistent=true
+AccuracySec=10min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-hf-full-harvest.service b/deploy/systemd/cosift-hf-full-harvest.service
new file mode 100644
index 0000000..9527dc9
--- /dev/null
+++ b/deploy/systemd/cosift-hf-full-harvest.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cosift HF FULL Hub enumeration harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+Environment=COSIFT_HF_FULL_BUDGET=50000
+ExecStart=/usr/local/bin/cosift-hf-full-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-hf-full-harvest.timer b/deploy/systemd/cosift-hf-full-harvest.timer
new file mode 100644
index 0000000..b7a67ef
--- /dev/null
+++ b/deploy/systemd/cosift-hf-full-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift HF full enumeration schedule
+[Timer]
+OnCalendar=*-*-* 00/3:00:00
+Persistent=true
+AccuracySec=10min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-hf-harvest.service b/deploy/systemd/cosift-hf-harvest.service
new file mode 100644
index 0000000..e99cdd8
--- /dev/null
+++ b/deploy/systemd/cosift-hf-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift HuggingFace harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-hf-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-hf-harvest.timer b/deploy/systemd/cosift-hf-harvest.timer
new file mode 100644
index 0000000..30bd08b
--- /dev/null
+++ b/deploy/systemd/cosift-hf-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift HuggingFace harvest schedule
+[Timer]
+OnCalendar=*-*-* 06:30:00
+Persistent=true
+AccuracySec=5min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-hf-task-harvest.service b/deploy/systemd/cosift-hf-task-harvest.service
new file mode 100644
index 0000000..0df319e
--- /dev/null
+++ b/deploy/systemd/cosift-hf-task-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift hf-task pre-index harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-hf-task-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-hf-task-harvest.timer b/deploy/systemd/cosift-hf-task-harvest.timer
new file mode 100644
index 0000000..3bd5d37
--- /dev/null
+++ b/deploy/systemd/cosift-hf-task-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift hf-task pre-index schedule
+[Timer]
+OnCalendar=Tue *-*-* 07:00:00
+Persistent=true
+AccuracySec=10min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-hn-harvest.service b/deploy/systemd/cosift-hn-harvest.service
new file mode 100644
index 0000000..b0a2461
--- /dev/null
+++ b/deploy/systemd/cosift-hn-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift Hacker News harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-hn-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-hn-harvest.timer b/deploy/systemd/cosift-hn-harvest.timer
new file mode 100644
index 0000000..b797fa7
--- /dev/null
+++ b/deploy/systemd/cosift-hn-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift Hacker News harvest schedule
+[Timer]
+OnCalendar=*-*-* 02,08,14,20:00:00
+Persistent=true
+AccuracySec=5min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-pypi-harvest.service b/deploy/systemd/cosift-pypi-harvest.service
new file mode 100644
index 0000000..be50e1e
--- /dev/null
+++ b/deploy/systemd/cosift-pypi-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift pypi pre-index harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-pypi-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-pypi-harvest.timer b/deploy/systemd/cosift-pypi-harvest.timer
new file mode 100644
index 0000000..7fa251b
--- /dev/null
+++ b/deploy/systemd/cosift-pypi-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift pypi pre-index schedule
+[Timer]
+OnCalendar=Mon *-*-* 07:00:00
+Persistent=true
+AccuracySec=10min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-reddit-harvest.service b/deploy/systemd/cosift-reddit-harvest.service
new file mode 100644
index 0000000..1b0dc95
--- /dev/null
+++ b/deploy/systemd/cosift-reddit-harvest.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift Reddit harvest
+After=cosift-serve.service
+Wants=cosift-serve.service
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-reddit-harvest.py
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-reddit-harvest.timer b/deploy/systemd/cosift-reddit-harvest.timer
new file mode 100644
index 0000000..98af143
--- /dev/null
+++ b/deploy/systemd/cosift-reddit-harvest.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Cosift Reddit harvest schedule
+[Timer]
+OnCalendar=*-*-* 04,10,16,22:00:00
+Persistent=true
+AccuracySec=5min
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-rss-refresh.service b/deploy/systemd/cosift-rss-refresh.service
new file mode 100644
index 0000000..75ae97c
--- /dev/null
+++ b/deploy/systemd/cosift-rss-refresh.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cosift RSS refresh (re-import every tracked feed)
+After=cosift-serve.service
+Wants=cosift-serve.service
+
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/home/ubuntu/cosift-rss-refresh.sh
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-rss-refresh.timer b/deploy/systemd/cosift-rss-refresh.timer
new file mode 100644
index 0000000..2c057e3
--- /dev/null
+++ b/deploy/systemd/cosift-rss-refresh.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Cosift RSS refresh — every 30 minutes
+
+[Timer]
+OnBootSec=10min
+OnUnitActiveSec=30min
+AccuracySec=1min
+
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-sitemap-refresh.service b/deploy/systemd/cosift-sitemap-refresh.service
new file mode 100644
index 0000000..8340a9d
--- /dev/null
+++ b/deploy/systemd/cosift-sitemap-refresh.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cosift sitemap refresh (re-submit curated quality hosts)
+After=cosift-serve.service
+Wants=cosift-serve.service
+
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-sitemap-refresh.sh
+StandardOutput=journal
+StandardError=journal
diff --git a/deploy/systemd/cosift-sitemap-refresh.timer b/deploy/systemd/cosift-sitemap-refresh.timer
new file mode 100644
index 0000000..4a61a1e
--- /dev/null
+++ b/deploy/systemd/cosift-sitemap-refresh.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Cosift sitemap refresh — every 6 hours
+
+[Timer]
+OnBootSec=20min
+OnUnitActiveSec=6h
+AccuracySec=5min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/deploy/systemd/cosift-wet-refresh.service b/deploy/systemd/cosift-wet-refresh.service
new file mode 100644
index 0000000..617e991
--- /dev/null
+++ b/deploy/systemd/cosift-wet-refresh.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Cosift WET ingest from latest CommonCrawl
+After=cosift-serve.service
+Requires=cosift-serve.service
+
+[Service]
+Type=oneshot
+User=ubuntu
+ExecStart=/usr/local/bin/cosift-wet-refresh.sh
diff --git a/deploy/systemd/cosift-wet-refresh.timer b/deploy/systemd/cosift-wet-refresh.timer
new file mode 100644
index 0000000..5342d70
--- /dev/null
+++ b/deploy/systemd/cosift-wet-refresh.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Run cosift-wet-refresh weekly
+
+[Timer]
+OnCalendar=*-*-* 03:00:00
+Persistent=true
+Unit=cosift-wet-refresh.service
+
+[Install]
+WantedBy=timers.target

From c77c106da17b5446ee6b476651648ee3a491bb17 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:19:38 +0300
Subject: [PATCH 04/11] refactor(cleanup): remove dead code, fix vet copylock,
 dedup vector dot

Pre-handover cleanup; tree now green on build/vet/test/gofmt/deadcode.

- gofmt 6 files; fix TestRunAnswerEvalBadCorpus (self-contained tempdir fixture)
- fix go vet copylocks at pebble_serve.go (pass index by param, drop tmp := *s)
- delete duplicate internal/index/hnsw_writer.go + test (unused in prod)
- remove dead Federation config, 5 dead struct fields, openaiMock.SetEmbedDim
- simplify 2 unparam signatures; dedup vector dot (export index.Dot, drop cosineUnit)
- remove 7 orphaned v0 systemd units in scripts/ (superseded by deploy/systemd/)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cmd/cosift/feedback.go              |  10 +-
 cmd/cosift/find.go                  |   6 +-
 cmd/cosift/main.go                  | 237 ++++++++++++++++++++++++++++
 cmd/cosift/pebble_serve.go          |  64 ++++----
 cmd/cosift/querylog.go              |   2 +-
 cmd/cosift/zz_round3_test.go        |   9 +-
 cmd/cosift/zz_round4_test.go        |  17 +-
 internal/config/config.go           |  42 +++--
 internal/crawler/crawler.go         |  84 ++++++++--
 internal/index/bm25.go              |  10 --
 internal/index/hnsw.go              |   8 +-
 internal/index/hnsw_writer.go       | 105 ------------
 internal/index/hnsw_writer_test.go  | 126 ---------------
 internal/index/vector.go            |  11 +-
 internal/server/http.go             |   9 +-
 internal/sla/sla.go                 |  27 ++--
 internal/store/pebble.go            |  22 ++-
 internal/store/store.go             |  24 ++-
 scripts/cosift-crawl.service        |  22 ---
 scripts/cosift-crawl.timer          |  14 --
 scripts/cosift-serve.service        |  30 ----
 scripts/cosift-snapshot.service     |  19 ---
 scripts/cosift-snapshot.timer       |  13 --
 scripts/ollama-replica.service.tmpl |  18 ---
 scripts/ollama.service              |  16 --
 25 files changed, 446 insertions(+), 499 deletions(-)
 delete mode 100644 internal/index/hnsw_writer.go
 delete mode 100644 internal/index/hnsw_writer_test.go
 delete mode 100644 scripts/cosift-crawl.service
 delete mode 100644 scripts/cosift-crawl.timer
 delete mode 100644 scripts/cosift-serve.service
 delete mode 100644 scripts/cosift-snapshot.service
 delete mode 100644 scripts/cosift-snapshot.timer
 delete mode 100644 scripts/ollama-replica.service.tmpl
 delete mode 100644 scripts/ollama.service

diff --git a/cmd/cosift/feedback.go b/cmd/cosift/feedback.go
index c7e1763..16a9901 100644
--- a/cmd/cosift/feedback.go
+++ b/cmd/cosift/feedback.go
@@ -21,11 +21,11 @@ import (
 // aggregated evidence, never absolute truth. caller is logged for dedup/abuse.
 
 type feedbackRec struct {
-	TS      string `json:"ts"`
-	Qid     string `json:"qid"`
-	Rating  int    `json:"rating"`
-	Reason  string `json:"reason,omitempty"`
-	Caller  string `json:"caller,omitempty"`
+	TS     string `json:"ts"`
+	Qid    string `json:"qid"`
+	Rating int    `json:"rating"`
+	Reason string `json:"reason,omitempty"`
+	Caller string `json:"caller,omitempty"`
 }
 
 // feedbackLogPath resolves the feedback log location: explicit env, else beside
diff --git a/cmd/cosift/find.go b/cmd/cosift/find.go
index 0e3c05d..130faf7 100644
--- a/cmd/cosift/find.go
+++ b/cmd/cosift/find.go
@@ -67,9 +67,9 @@ func federateHF(ctx context.Context, q string) []findHit {
 			continue
 		}
 		var items []struct {
-			ID       string `json:"id"`
-			Likes    int    `json:"likes"`
-			Downloads int   `json:"downloads"`
+			ID        string `json:"id"`
+			Likes     int    `json:"likes"`
+			Downloads int    `json:"downloads"`
 		}
 		if json.Unmarshal(b, &items) != nil {
 			continue
diff --git a/cmd/cosift/main.go b/cmd/cosift/main.go
index cf170be..47c7b85 100644
--- a/cmd/cosift/main.go
+++ b/cmd/cosift/main.go
@@ -28,6 +28,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/pilot-protocol/cosift/internal/authority"
 	"github.com/pilot-protocol/cosift/internal/config"
 	"github.com/pilot-protocol/cosift/internal/crawler"
 	"github.com/pilot-protocol/cosift/internal/embed"
@@ -330,6 +331,14 @@ func run(cfgPath string) error {
 		if err := runFrontierClear(ctx, flag.Args()[1:]); err != nil {
 			return fmt.Errorf("frontier-clear: %w", err)
 		}
+	case "frontier-trim":
+		if err := runFrontierTrim(ctx, cfg, flag.Args()[1:]); err != nil {
+			return fmt.Errorf("frontier-trim: %w", err)
+		}
+	case "seed-tranco":
+		if err := runSeedTranco(ctx, cfg, flag.Args()[1:]); err != nil {
+			return fmt.Errorf("seed-tranco: %w", err)
+		}
 	case "domain-audit":
 		if err := runDomainAudit(ctx, flag.Args()[1:]); err != nil {
 			return fmt.Errorf("domain-audit: %w", err)
@@ -536,6 +545,46 @@ func runCrawl(ctx context.Context, cfg *config.Config, args []string) error {
 		return fmt.Errorf("crawl: unknown -backend %q (want: sqlite | pebble)", *backend)
 	}
 
+	// Authority-weighted frontier priority: load Tranco / Majestic CSVs when
+	// configured. The scorer is read-only after loading — safe to share with
+	// the crawler's concurrent worker pool.
+	if cfg.Crawler.AuthorityPriority {
+		scorer := authority.New()
+		if cfg.Crawler.AuthorityTrancoCSV != "" {
+			f, ferr := os.Open(cfg.Crawler.AuthorityTrancoCSV)
+			if ferr != nil {
+				log.Printf("crawler: authority: open tranco csv %s: %v (skipping)", cfg.Crawler.AuthorityTrancoCSV, ferr)
+			} else {
+				n, lerr := scorer.LoadTranco(f)
+				_ = f.Close()
+				if lerr != nil {
+					log.Printf("crawler: authority: load tranco: %v (skipping)", lerr)
+				} else {
+					log.Printf("crawler: authority: loaded %d tranco entries from %s", n, cfg.Crawler.AuthorityTrancoCSV)
+				}
+			}
+		}
+		if cfg.Crawler.AuthorityMajesticCSV != "" {
+			f, ferr := os.Open(cfg.Crawler.AuthorityMajesticCSV)
+			if ferr != nil {
+				log.Printf("crawler: authority: open majestic csv %s: %v (skipping)", cfg.Crawler.AuthorityMajesticCSV, ferr)
+			} else {
+				n, lerr := scorer.LoadMajestic(f)
+				_ = f.Close()
+				if lerr != nil {
+					log.Printf("crawler: authority: load majestic: %v (skipping)", lerr)
+				} else {
+					log.Printf("crawler: authority: loaded %d majestic entries from %s", n, cfg.Crawler.AuthorityMajesticCSV)
+				}
+			}
+		}
+		// Even without CSV data the embedded whitelist in authority.New() gives
+		// known-good sites (arxiv, MDN, Wikipedia, kernel.org, …) a priority boost.
+		c = c.WithAuthority(scorer)
+		log.Printf("crawler: authority-weighted frontier priority enabled (tranco=%s majestic=%s)",
+			cfg.Crawler.AuthorityTrancoCSV, cfg.Crawler.AuthorityMajesticCSV)
+	}
+
 	// Auto-wire embedder when configured. For the Pebble backend, also
 	// build and persist an HNSW graph via the hnswPassageWriter bridge
 	// — that's the path /search?retriever=dense
@@ -4323,6 +4372,194 @@ func runGC(ctx context.Context, cfg *config.Config, args []string) error {
 	return nil
 }
 
+// runFrontierTrim deletes completed (status='done') frontier rows older than a
+// configurable age and optionally VACUUMs the database.
+//
+// Background: the GC command (runGC) only drops status='error' rows. Completed
+// rows accumulate indefinitely — a 500k-URL crawl leaves 500k done rows that
+// serve no purpose once the URL is in the documents table. Over months of
+// continuous crawling this can reach tens of millions of rows, bloating the DB
+// by several GB and slowing ClaimFrontier's ORDER BY scan even with an index.
+//
+// Default -older-than of 168h (7 days) is safe for the default refresh cycle
+// (refresh-due at 24h): a URL that was crawled 7 days ago and whose done row
+// is deleted will re-enter the frontier on the next refresh-due pass, which is
+// the correct behavior. Operators with longer refresh cycles should raise this
+// value accordingly (e.g. -older-than=720h for monthly refreshes).
+func runFrontierTrim(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("frontier-trim", flag.ExitOnError)
+	olderThan := fs.Duration("older-than", 7*24*time.Hour, "delete done rows enqueued more than this long ago (e.g. 168h, 720h)")
+	dryRun := fs.Bool("dry-run", false, "print what would be deleted without actually deleting")
+	vacuum := fs.Bool("vacuum", true, "run VACUUM after deletion to reclaim disk space")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	stats, serr := s.GetFrontierStats(ctx)
+	if serr != nil {
+		return fmt.Errorf("frontier-trim: stats: %w", serr)
+	}
+	log.Printf("frontier-trim: before — queued=%d in_flight=%d done=%d error=%d",
+		stats.Queued, stats.InFlight, stats.Done, stats.Errored)
+
+	if *dryRun {
+		log.Printf("frontier-trim: dry-run — would delete done rows older than %s (skipping actual delete)", *olderThan)
+		return nil
+	}
+
+	n, derr := s.TrimDoneFrontier(ctx, *olderThan)
+	if derr != nil {
+		return fmt.Errorf("frontier-trim: %w", derr)
+	}
+	log.Printf("frontier-trim: removed %d done rows older than %s", n, *olderThan)
+
+	if *vacuum && n > 0 {
+		log.Printf("frontier-trim: vacuuming (this may take a while on large databases)…")
+		if verr := s.Vacuum(ctx); verr != nil {
+			return fmt.Errorf("frontier-trim: vacuum: %w", verr)
+		}
+		log.Printf("frontier-trim: vacuum complete")
+	}
+	return nil
+}
+
+// runSeedTranco reads a Tranco top-1M CSV and pushes the top-N root URLs into
+// the frontier as depth-0 seeds. This is the fastest way to bootstrap a broad
+// crawl from a high-quality, authority-ranked URL set without having to curate
+// a manual seeds file.
+//
+// Each Tranco entry becomes https://<domain>/ with a priority derived from its
+// rank: rank 1 → priority 1.0, rank 1M → priority 0.1, log-scale in between.
+// The INSERT OR IGNORE semantics of PushFrontier mean this is safe to run
+// repeatedly — it only adds URLs not already in the frontier (regardless of
+// their current status).
+//
+// Download the latest Tranco CSV from https://tranco-list.eu/ (updated weekly,
+// ~7 MB compressed). The format is "rank,hostname" with no header.
+//
+// Example:
+//
+//	cosift seed-tranco -tranco tranco-top1m.csv -top 10000
+func runSeedTranco(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("seed-tranco", flag.ExitOnError)
+	trancoPath := fs.String("tranco", "", "path to Tranco top-1M CSV (required)")
+	topN := fs.Int("top", 10000, "seed only the top-N domains (0 = all)")
+	scheme := fs.String("scheme", "https", "URL scheme to prepend (https or http)")
+	dryRun := fs.Bool("dry-run", false, "print URLs that would be seeded without writing to the frontier")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *trancoPath == "" {
+		return errors.New("seed-tranco: -tranco is required")
+	}
+	if *scheme != "https" && *scheme != "http" {
+		return fmt.Errorf("seed-tranco: -scheme must be https or http, got %q", *scheme)
+	}
+
+	f, ferr := os.Open(*trancoPath)
+	if ferr != nil {
+		return fmt.Errorf("seed-tranco: open %s: %w", *trancoPath, ferr)
+	}
+	defer f.Close()
+
+	// Parse the CSV into (rank, host) pairs up to topN.
+	type entry struct {
+		rank int
+		host string
+	}
+	entries := make([]entry, 0, 10000)
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 4096), 1<<20)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		var rankStr, host string
+		if i := strings.IndexAny(line, ",\t"); i > 0 {
+			rankStr = strings.TrimSpace(line[:i])
+			host = strings.ToLower(strings.TrimSpace(line[i+1:]))
+		} else {
+			continue
+		}
+		rank, err := strconv.Atoi(rankStr)
+		if err != nil || rank <= 0 {
+			continue
+		}
+		host = strings.TrimPrefix(host, "www.")
+		if host == "" {
+			continue
+		}
+		if *topN > 0 && rank > *topN {
+			break
+		}
+		entries = append(entries, entry{rank: rank, host: host})
+	}
+	if err := scanner.Err(); err != nil {
+		return fmt.Errorf("seed-tranco: scan: %w", err)
+	}
+	log.Printf("seed-tranco: parsed %d entries from %s (top %d)", len(entries), *trancoPath, *topN)
+
+	if *dryRun {
+		limit := len(entries)
+		if limit > 20 {
+			limit = 20
+		}
+		for _, e := range entries[:limit] {
+			log.Printf("  [dry-run] rank=%d  %s://%s/", e.rank, *scheme, e.host)
+		}
+		if len(entries) > 20 {
+			log.Printf("  … and %d more", len(entries)-20)
+		}
+		return nil
+	}
+
+	s, serr := store.Open(cfg.DataDir)
+	if serr != nil {
+		return serr
+	}
+	defer s.Close()
+
+	// trancoPriority converts a Tranco rank to a frontier priority [0.1, 1.0].
+	// Uses decimal-digit counting as a cheap log10 proxy — good enough for
+	// priority bucketing. rank=1→1.0, rank=10→0.83, rank=100→0.67,
+	// rank=1k→0.50, rank=10k→0.33, rank=100k→0.17, rank=1M→0.10.
+	trancoPriority := func(rank int) float64 {
+		if rank <= 0 {
+			return 0.5
+		}
+		digits := 0
+		r := rank
+		for r >= 10 {
+			r /= 10
+			digits++
+		}
+		p := 1.0 - float64(digits)/6.0
+		if p < 0.1 {
+			p = 0.1
+		}
+		return p
+	}
+
+	pushed := 0
+	for _, e := range entries {
+		rawURL := fmt.Sprintf("%s://%s/", *scheme, e.host)
+		priority := trancoPriority(e.rank)
+		if err := s.PushFrontier(ctx, rawURL, 0, priority); err != nil {
+			log.Printf("seed-tranco: push %s: %v", rawURL, err)
+			continue
+		}
+		pushed++
+	}
+	log.Printf("seed-tranco: pushed %d URLs into frontier (INSERT OR IGNORE — already-present URLs unchanged)", pushed)
+	return nil
+}
+
 // runOutcomes exports query_outcomes for offline calibration work. JSON for
 // programmatic consumers, CSV for spreadsheet / pandas notebooks.
 func runOutcomes(ctx context.Context, cfg *config.Config, args []string) (err error) {
diff --git a/cmd/cosift/pebble_serve.go b/cmd/cosift/pebble_serve.go
index 01d7156..f782568 100644
--- a/cmd/cosift/pebble_serve.go
+++ b/cmd/cosift/pebble_serve.go
@@ -1046,7 +1046,7 @@ type pebbleHTTP struct {
 	// crawlAllowDomain promotes a domain into the crawler's runtime dynamic
 	// allowlist (used by /admin/allow-domain for organic HN/Reddit growth).
 	crawlAllowDomain func(domain string) error
-	crawlRecrawl         func(ctx context.Context, url string) error
+	crawlRecrawl     func(ctx context.Context, url string) error
 
 	// doc count at startup so /stats can report crawl rate
 	// without persistent counter tables. docs_added = current - startup,
@@ -5202,25 +5202,6 @@ func parseMMRLambda(raw string) (float64, bool) {
 	return v, true
 }
 
-// cosineUnit returns the dot product of two unit-normalized float32 slices.
-// HNSW stores vectors in unit form, so this is equivalent to cosine similarity.
-// Returns 0 on length mismatch — caller is responsible for filtering missing
-// vectors before calling.
-func cosineUnit(a, b []float32) float32 {
-	if len(a) != len(b) {
-		return 0
-	}
-	var s float32
-	i := 0
-	for ; i <= len(a)-4; i += 4 {
-		s += a[i]*b[i] + a[i+1]*b[i+1] + a[i+2]*b[i+2] + a[i+3]*b[i+3]
-	}
-	for ; i < len(a); i++ {
-		s += a[i] * b[i]
-	}
-	return s
-}
-
 // mmrOrder computes a permutation of [0..n-1] via Maximal Marginal Relevance
 // (Carbonell & Goldstein '98). At each step picks the candidate maximizing
 //
@@ -5243,7 +5224,7 @@ func mmrOrder(qVec []float32, hitVecs [][]float32, lambda float64) []int {
 	rel := make([]float64, n)
 	for i := range hitVecs {
 		if len(hitVecs[i]) > 0 {
-			rel[i] = float64(cosineUnit(qVec, hitVecs[i]))
+			rel[i] = float64(index.Dot(qVec, hitVecs[i]))
 		}
 	}
 	for len(order) < n {
@@ -5258,7 +5239,7 @@ func mmrOrder(qVec []float32, hitVecs [][]float32, lambda float64) []int {
 				if len(hitVecs[i]) == 0 || len(hitVecs[j]) == 0 {
 					continue
 				}
-				sim := float64(cosineUnit(hitVecs[i], hitVecs[j]))
+				sim := float64(index.Dot(hitVecs[i], hitVecs[j]))
 				if sim > maxSim {
 					maxSim = sim
 				}
@@ -5405,6 +5386,14 @@ func (s *pebbleHTTP) applyAuthorityToDense(vhits []index.VectorHit) []index.Hit
 }
 
 func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
+	return s.retrieveWith(ctx, s.idx, q, fetchK, retrieverParam, expandMode)
+}
+
+// retrieveWith is retrieve parameterized over the BM25 index, so callers that
+// need a transformed index (e.g. the site-boosted index from WithBoost) can
+// pass it in without shallow-copying the whole pebbleHTTP (which embeds
+// mutexes — copying it trips go vet's lock-copy check and is unsafe).
+func (s *pebbleHTTP) retrieveWith(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
 	denseReady := s.hnsw != nil && s.embedder != nil
 	switch {
 	case retrieverParam == "dense" && denseReady:
@@ -5416,7 +5405,7 @@ func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retriev
 		hits := s.applyAuthorityToDense(vhits)
 		return hits, q, nil
 	case retrieverParam == "hybrid" && denseReady:
-		bm25Hits, bm25Eff, bm25Err := s.retrieveWithExpansion(ctx, q, fetchK, expandMode)
+		bm25Hits, bm25Eff, bm25Err := s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
 		if bm25Err != nil {
 			return nil, "", bm25Err
 		}
@@ -5432,7 +5421,7 @@ func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retriev
 		}
 		return hits, bm25Eff, nil
 	default:
-		return s.retrieveWithExpansion(ctx, q, fetchK, expandMode)
+		return s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
 	}
 }
 
@@ -5554,27 +5543,28 @@ func (s *pebbleHTTP) retrieveForSites(ctx context.Context, q string, fetchK int,
 	if len(boostIDs) == 0 {
 		return s.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
 	}
-	tmp := *s
-	tmp.idx = s.idx.WithBoost(boostIDs)
-	return tmp.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
+	return s.retrieveWith(ctx, s.idx.WithBoost(boostIDs), q, fetchK, retrieverParam, expandMode)
 }
 
-// retrieveWithExpansion dispatches the BM25 call across the three
+// retrieveWithExpansionIdx dispatches the BM25 call across the three
 // expansion strategies /search and /answer share — bare, HyDE, paraphrase+RRF.
 // Returns (hits, effectiveQuery, err). effectiveQuery == q when no expansion
-// fired (bare path, or expansion no-op'd because chat is down).
-func (s *pebbleHTTP) retrieveWithExpansion(ctx context.Context, q string, fetchK int, expandMode string) ([]index.Hit, string, error) {
+// fired (bare path, or expansion no-op'd because chat is down). It is
+// parameterized over the BM25 index so a transformed index (e.g. the
+// site-boosted one from WithBoost) can be passed in without shallow-copying the
+// whole pebbleHTTP struct (which embeds mutexes).
+func (s *pebbleHTTP) retrieveWithExpansionIdx(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, expandMode string) ([]index.Hit, string, error) {
 	switch expandMode {
 	case "paraphrase":
 		paras := s.paraphraseQuery(ctx, q, 3)
 		if len(paras) == 0 {
-			hits, err := s.idx.Search(ctx, q, fetchK)
+			hits, err := idx.Search(ctx, q, fetchK)
 			return hits, q, err
 		}
 		queries := append([]string{q}, paras...)
 		lists := make([][]index.Hit, 0, len(queries))
 		for _, qq := range queries {
-			h, lerr := s.idx.Search(ctx, qq, fetchK)
+			h, lerr := idx.Search(ctx, qq, fetchK)
 			if lerr != nil {
 				continue
 			}
@@ -5587,7 +5577,7 @@ func (s *pebbleHTTP) retrieveWithExpansion(ctx context.Context, q string, fetchK
 		return hits, q + " | " + strings.Join(paras, " | "), nil
 	case "true", "hyde":
 		eq := s.expandQuery(ctx, q)
-		hits, err := s.idx.Search(ctx, eq, fetchK)
+		hits, err := idx.Search(ctx, eq, fetchK)
 		return hits, eq, err
 	case "entity":
 		// Rule-based query rewrite for question-form entity lookups
@@ -5601,11 +5591,11 @@ func (s *pebbleHTTP) retrieveWithExpansion(ctx context.Context, q string, fetchK
 		// scoring contributions where biographical pages exist.
 		rewrites := qexpand.RewriteEntity(q)
 		if len(rewrites) == 0 {
-			hits, err := s.idx.Search(ctx, q, fetchK)
+			hits, err := idx.Search(ctx, q, fetchK)
 			return hits, q, err
 		}
 		expanded := q + " " + strings.Join(rewrites, " ")
-		hits, err := s.idx.Search(ctx, expanded, fetchK)
+		hits, err := idx.Search(ctx, expanded, fetchK)
 		return hits, expanded, err
 	default:
 		// Bare path runs entity-expansion when the query matches a
@@ -5621,11 +5611,11 @@ func (s *pebbleHTTP) retrieveWithExpansion(ctx context.Context, q string, fetchK
 		if os.Getenv("COSIFT_DISABLE_ENTITY_EXPAND") == "" {
 			if rewrites := qexpand.RewriteEntity(q); len(rewrites) > 0 {
 				expanded := q + " " + strings.Join(rewrites, " ")
-				hits, err := s.idx.Search(ctx, expanded, fetchK)
+				hits, err := idx.Search(ctx, expanded, fetchK)
 				return hits, expanded, err
 			}
 		}
-		hits, err := s.idx.Search(ctx, q, fetchK)
+		hits, err := idx.Search(ctx, q, fetchK)
 		return hits, q, err
 	}
 }
diff --git a/cmd/cosift/querylog.go b/cmd/cosift/querylog.go
index 1493c6f..3f3c985 100644
--- a/cmd/cosift/querylog.go
+++ b/cmd/cosift/querylog.go
@@ -20,7 +20,7 @@ import (
 // conservative (rotate/truncate the file); don't hoard raw queries indefinitely.
 
 type queryLogRec struct {
-	Qid    string `json:"qid"`              // stable id; returned to caller via X-Cosift-Query-Id so feedback can reference it
+	Qid    string `json:"qid"` // stable id; returned to caller via X-Cosift-Query-Id so feedback can reference it
 	TS     string `json:"ts"`
 	Ep     string `json:"ep"`               // path, e.g. /search
 	Q      string `json:"q"`                // the q= param (empty for POST-body queries)
diff --git a/cmd/cosift/zz_round3_test.go b/cmd/cosift/zz_round3_test.go
index 5b2231d..c5e44f9 100644
--- a/cmd/cosift/zz_round3_test.go
+++ b/cmd/cosift/zz_round3_test.go
@@ -53,7 +53,7 @@ type openaiMock struct {
 //   - embeddings return one vector of `embedDim` floats per input (a hash of
 //     the text bytes scaled to [0,1])
 //
-// Override per-test via SetChatResponse / SetEmbedDim.
+// Override per-test via SetChatResponse.
 func openaiTestServer(t *testing.T) *openaiMock {
 	t.Helper()
 	m := &openaiMock{embedDim: 8}
@@ -134,13 +134,6 @@ func (m *openaiMock) SetChatResponses(seq ...string) {
 	m.chatRespQueue = append([]string{}, seq...)
 }
 
-// SetEmbedDim swaps the embedding vector dimensionality.
-func (m *openaiMock) SetEmbedDim(d int) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.embedDim = d
-}
-
 // ChatCalls returns the number of /v1/chat/completions requests served.
 func (m *openaiMock) ChatCalls() int { m.mu.Lock(); defer m.mu.Unlock(); return m.chatCalls }
 
diff --git a/cmd/cosift/zz_round4_test.go b/cmd/cosift/zz_round4_test.go
index 92b38ea..06ece1a 100644
--- a/cmd/cosift/zz_round4_test.go
+++ b/cmd/cosift/zz_round4_test.go
@@ -899,10 +899,23 @@ func TestRunAnswerEvalNoKey(t *testing.T) {
 func TestRunAnswerEvalBadCorpus(t *testing.T) {
 	_ = os.Unsetenv("OPENAI_API_KEY")
 	_ = os.Unsetenv("OPENAI")
+	// Self-contained: write a valid query set so the queries load (which runs
+	// first) succeeds, then point -corpus at a missing file so the corpus load
+	// is the branch that fails. -chat-url satisfies the API-key gate without a
+	// real key; no -dry-run so execution proceeds past the queries load to the
+	// in-process corpus load.
+	tmp := t.TempDir()
+	queriesPath := filepath.Join(tmp, "queries.json")
+	mustWriteJSON(t, queriesPath, map[string]any{
+		"name": "bad-corpus",
+		"queries": []any{
+			map[string]any{"text": "first query", "relevant": []string{"https://example.com/a"}},
+		},
+	})
 	err := runAnswerEval(context.Background(), []string{
 		"-corpus", "/no/such/corpus.json",
-		"-queries", "testdata/eval/queries.json",
-		"-dry-run",
+		"-queries", queriesPath,
+		"-chat-url", "http://127.0.0.1:1",
 	})
 	if err == nil || !strings.Contains(err.Error(), "load corpus") {
 		t.Errorf("got %v", err)
diff --git a/internal/config/config.go b/internal/config/config.go
index 09ef8db..ebf2ad2 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -22,9 +22,6 @@ type Config struct {
 
 	Crawler Crawler `json:"crawler"`
 
-	// Federation: which external retrieval sources to consult. Each is optional.
-	Federation Federation `json:"federation"`
-
 	// Embeddings: address of an HTTP embedding service. Empty = vector search disabled.
 	Embeddings Embeddings `json:"embeddings"`
 
@@ -287,19 +284,33 @@ type Crawler struct {
 	// the offline `cosift purge-adult` sweep cleans content already
 	// indexed before this was enabled.
 	FilterAdult bool `json:"filter_adult,omitempty"`
-}
-
-// Federation configures upstream search backends used as no-key
-// fallbacks when the local corpus is empty or partial.
-type Federation struct {
-	// DuckDuckGoHTML enables the no-key DDG HTML proxy fallback for /search.
-	DuckDuckGoHTML bool `json:"duckduckgo_html"`
 
-	// SearXNGURL points at a self-hosted SearXNG instance, if any.
-	SearXNGURL string `json:"searxng_url"`
-
-	// Pilot enables the cosift→Pilot specialist router (requires pilotctl).
-	Pilot bool `json:"pilot"`
+	// AuthorityPriority, when true, uses domain-authority signals (Tranco
+	// rank, Majestic TrustFlow, embedded whitelist) to set the frontier
+	// priority for every discovered link. High-authority hosts
+	// (arxiv.org, Wikipedia, MDN, …) receive priority ~0.8-1.0; unknown
+	// blogs fall back to 0.5. The priority feeds ClaimFrontier's ORDER BY
+	// so the worker pool naturally crawls the best-known domains first.
+	//
+	// Requires at least one of AuthorityTrancoCSV / AuthorityMajesticCSV
+	// to be populated, or relies on the embedded trusted-host whitelist
+	// alone (still useful for a known-good bootstrap set).
+	//
+	// Default false preserves uniform-priority (0.5) behavior.
+	AuthorityPriority bool `json:"authority_priority,omitempty"`
+
+	// AuthorityTrancoCSV is the local path to the Tranco top-1M CSV file.
+	// Download: https://tranco-list.eu/ (updated weekly, ~7 MB).
+	// File format: "rank,hostname" per line, no header. Rank 1 = most popular.
+	// Only read at startup; the crawler does not hot-reload it.
+	// Ignored when AuthorityPriority=false.
+	AuthorityTrancoCSV string `json:"authority_tranco_csv,omitempty"`
+
+	// AuthorityMajesticCSV is the local path to the Majestic Million CSV.
+	// Download: https://majestic.com/reports/majestic-million (~35 MB).
+	// Columns 2 (Domain) and 9 (TrustFlow 0–100) are used; header is auto-detected.
+	// Ignored when AuthorityPriority=false.
+	AuthorityMajesticCSV string `json:"authority_majestic_csv,omitempty"`
 }
 
 // Embeddings configures the dense-vector backend: model, dimension,
@@ -449,7 +460,6 @@ func Default() *Config {
 			MaxDepth:       2,
 			RespectRobots:  true,
 		},
-		Federation: Federation{},
 		Embeddings: Embeddings{},
 	}
 }
diff --git a/internal/crawler/crawler.go b/internal/crawler/crawler.go
index 9755b9b..5f4315e 100644
--- a/internal/crawler/crawler.go
+++ b/internal/crawler/crawler.go
@@ -69,7 +69,7 @@ type Crawler struct {
 	// an int read on the hot path; not atomic — diagnostic only).
 	zombieDebugLogged int
 
-// per-host error-rate tracking via sync.Map + atomic
+	// per-host error-rate tracking via sync.Map + atomic
 	// counters. With 512 workers we cannot afford a single write lock
 	// on every claim's completion — that bottlenecked and cost
 	// ~25% throughput. sync.Map.LoadOrStore lets us avoid the lock on
@@ -87,11 +87,11 @@ type Crawler struct {
 	// keeps memory predictable; non-blocking send means a slow embedder
 	// can't stall the crawl (dropped jobs land in embed-backfill later,
 	// which the operator runs anyway).
-	embedQ         chan *embedJob
-	embedQueued    atomic.Int64
-	embedDropped   atomic.Int64
-	embedDone      atomic.Int64
-	embedFailed    atomic.Int64
+	embedQ       chan *embedJob
+	embedQueued  atomic.Int64
+	embedDropped atomic.Int64
+	embedDone    atomic.Int64
+	embedFailed  atomic.Int64
 
 	// URLs whose frontier transition happened inside processClaimed via
 	// WriteCrawlResult. The worker checks this set before its own
@@ -110,9 +110,14 @@ type Crawler struct {
 	// that recurs on HN's front page is promoted via AddAllowedDomain and
 	// persisted to dynDomainsFile so it survives restart. Empty file path
 	// (COSIFT_DYNAMIC_DOMAINS_FILE unset) disables the feature.
-	dynDomains    sync.Map // eTLD+1 / host (string) → struct{}
+	dynDomains     sync.Map // eTLD+1 / host (string) → struct{}
 	dynDomainsFile string
-	dynDomainsMu  sync.Mutex // serializes file appends
+	dynDomainsMu   sync.Mutex // serializes file appends
+
+	// authority provides per-host quality scores used to set frontier
+	// priority on discovered links. nil = uniform 0.5 priority (pre behavior).
+	// Populated via WithAuthority when cfg.AuthorityPriority=true.
+	authority authorityScorer
 }
 
 // LoadDynamicDomains reads previously-promoted domains from dynDomainsFile into
@@ -450,6 +455,56 @@ func (c *Crawler) WithRouter(route RouteFn, forward ForwardFn) *Crawler {
 	return c
 }
 
+// authorityScorer is a narrow interface so the crawler package does not import
+// internal/authority directly — avoids a potential dep-graph cycle and keeps
+// the package boundary clean. internal/authority.Scorer satisfies this.
+type authorityScorer interface {
+	Score(host string) float64
+}
+
+// WithAuthority attaches a domain-authority scorer. When set, links discovered
+// during crawl are pushed to the frontier with a priority derived from the
+// host's authority score instead of the flat 0.5 default. Chaining-style builder.
+//
+// The scorer is read-only after this call (Score is called on the hot path);
+// callers must finish loading Tranco/Majestic data BEFORE calling WithAuthority.
+func (c *Crawler) WithAuthority(s authorityScorer) *Crawler {
+	c.authority = s
+	return c
+}
+
+// linkPriority returns the frontier priority to assign to a discovered link at
+// the given crawl depth. When authority scoring is enabled, high-authority
+// domains (Tranco top-1k, Majestic high-TF, embedded whitelist) receive
+// priority up to 1.0; unknown domains fall back to 0.5.
+//
+// Depth decay keeps shallow-found links from high-authority domains ahead of
+// deep-found links from any domain:
+//
+//	priority = authority_score / (1 + 0.25 * depth)
+//
+// At depth 0 (seed-equivalent): no decay — top-authority host stays at 1.0.
+// At depth 4: divisor = 2.0, so even a top-authority host is at 0.5, equal to
+// an unknown host at depth 0. Deep discoveries from weak domains converge to
+// ~0.25, staying below any shallow discovery.
+//
+// Floor of 0.05 ensures even low-authority deep links are eventually processed
+// when the frontier drains.
+func (c *Crawler) linkPriority(host string, depth int) float64 {
+	base := 0.5
+	if c.authority != nil {
+		base = c.authority.Score(host)
+	}
+	if depth <= 0 {
+		return base
+	}
+	p := base / (1.0 + 0.25*float64(depth))
+	if p < 0.05 {
+		return 0.05
+	}
+	return p
+}
+
 // Seed pushes a URL onto the persistent frontier at depth 0.
 //
 // `INSERT OR IGNORE` semantics: if the URL is already in the frontier (queued,
@@ -847,9 +902,9 @@ func (c *Crawler) runHostSweep(
 	demoter HostFrontierDemoter,
 ) {
 	type hostJudgement struct {
-		host    string
-		dead    bool
-		attempts int32
+		host      string
+		dead      bool
+		attempts  int32
 		successes int32
 	}
 	var verdicts []hostJudgement
@@ -1464,7 +1519,12 @@ func (c *Crawler) enqueueLinks(ctx context.Context, links []string, depth int) {
 			}
 		}
 		// PushFrontier is INSERT OR IGNORE — dedup is at the persistent layer.
-		_ = c.store.PushFrontier(ctx, cand.canon, depth, 0.5)
+		// Priority is authority-weighted when a scorer is attached; otherwise
+		// falls back to flat 0.5 (pre-authority behavior). INSERT OR IGNORE means
+		// we never downgrade the priority of a URL already in the queue — first
+		// writer wins, which is fine since seeds (depth=0, priority≥base) always
+		// arrive before link-discovered copies (depth≥1).
+		_ = c.store.PushFrontier(ctx, cand.canon, depth, c.linkPriority(cand.host, depth))
 		if hostCap > 0 {
 			queuedPerHost[cand.host]++
 		}
diff --git a/internal/index/bm25.go b/internal/index/bm25.go
index b41fe34..67319af 100644
--- a/internal/index/bm25.go
+++ b/internal/index/bm25.go
@@ -47,16 +47,6 @@ type Hit struct {
 	URL   string
 	Title string
 	Score float64
-
-	// Snippet is a short window of the document body centered on the earliest
-	// query-term match, populated for top-k hits when text is available.
-	// Empty when computation was skipped (text not indexed, or no terms hit).
-	// replaces BM25 hits' generic body-prefix excerpt with a
-	// query-aware passage. Dense/hybrid hits keep their existing per-passage
-	// Highlight (computed from the embedded passage span); this fills the
-	// equivalent gap for BM25-only hits.
-	Snippet       string
-	SnippetOffset int
 }
 
 // NewBM25 returns a BM25 index backed by the SQLite store. Parameters
diff --git a/internal/index/hnsw.go b/internal/index/hnsw.go
index b38a6ad..2513135 100644
--- a/internal/index/hnsw.go
+++ b/internal/index/hnsw.go
@@ -185,7 +185,7 @@ func (h *HNSW) PQStatus() PQStatus {
 //     over reconstructed (uncompressed) approximation. For unit-normalized
 //     vectors this is monotonic with cosine distance, so HNSW pruning
 //     thresholds stay coherent.
-//   - Raw branch: -dot(q, h.nodes[idx].vec). Identical to the
+//   - Raw branch: -Dot(q, h.nodes[idx].vec). Identical to the
 //     baseline.
 //
 // pqTable is the M*K-element lookup precomputed once per search via
@@ -209,7 +209,7 @@ func (h *HNSW) distanceToNode(q []float32, pqTable []float32, idx int) float64 {
 	if len(h.nodes[idx].vec) == 0 {
 		return math.MaxFloat64 // skip zombie nodes
 	}
-	return -float64(dot(q, h.nodes[idx].vec))
+	return -float64(Dot(q, h.nodes[idx].vec))
 }
 
 // BruteForceTopK performs an exact O(N) scan over every valid node and
@@ -240,7 +240,7 @@ func (h *HNSW) BruteForceTopK(query []float32, k int) []VectorHit {
 		if len(h.nodes[i].vec) == 0 {
 			continue // zombie / partial-persisted
 		}
-		s := dot(q, h.nodes[i].vec)
+		s := Dot(q, h.nodes[i].vec)
 		url := h.nodes[i].url
 		cur, ok := bestByURL[url]
 		if !ok || s > cur.score {
@@ -806,7 +806,7 @@ func (h *HNSW) addBackLink(neighbor, newIdx, lvl int) {
 		if nb < 0 || nb >= len(h.nodes) {
 			continue // drop oob neighbor entries silently
 		}
-		cands = append(cands, candEntry{idx: nb, dist: -dot(nbVec, h.nodes[nb].vec)})
+		cands = append(cands, candEntry{idx: nb, dist: -Dot(nbVec, h.nodes[nb].vec)})
 	}
 	sort.Slice(cands, func(a, b int) bool { return cands[a].dist < cands[b].dist })
 	if len(cands) > mCap {
diff --git a/internal/index/hnsw_writer.go b/internal/index/hnsw_writer.go
deleted file mode 100644
index 53d59e5..0000000
--- a/internal/index/hnsw_writer.go
+++ /dev/null
@@ -1,105 +0,0 @@
-// HNSW write bridge for the Pebble-backed crawler path.
-//
-// The PassageWriter interface lets the crawler stream passage
-// vectors to whatever backend the operator wires. On SQLite, *store.Store
-// satisfies it directly (writes go to the passages table). On Pebble there
-// was no implementation — vector indexing during crawl was silently
-// skipped, which made the Pebble path BM25-only.
-//
-// HNSWWriter bridges the gap: passages flow into an in-memory HNSW graph
-// and get periodically flushed to the PebbleStore via HNSW.Persist.
-// Cheap per-passage cost (one graph insert + one
-// GetDocMeta lookup); the heavy on-disk write is amortized across
-// many inserts.
-
-package index
-
-import (
-	"context"
-	"fmt"
-	"sync"
-
-	"github.com/pilot-protocol/cosift/internal/store"
-)
-
-// HNSWWriter satisfies the crawler's PassageWriter interface against a
-// PebbleStore + HNSW pair. Passage URLs/titles are resolved from the
-// 'i' family (cheap, no full Document gob decode).
-//
-// Persistence is checkpointed every PersistEvery passages. Setting
-// PersistEvery to 0 (the default if you don't configure it) means
-// "never auto-persist" — callers can call Persist manually at safe
-// points (e.g. crawler shutdown).
-type HNSWWriter struct {
-	hnsw         *HNSW
-	store        *store.PebbleStore
-	persistEvery int
-
-	mu             sync.Mutex
-	sinceLastFlush int
-}
-
-// NewHNSWWriter returns a PassageWriter that adds each incoming passage
-// to the HNSW graph and persists to the PebbleStore every persistEvery
-// passages. persistEvery=0 disables auto-persist (caller drives it via
-// HNSWWriter.Flush).
-func NewHNSWWriter(h *HNSW, ps *store.PebbleStore, persistEvery int) *HNSWWriter {
-	return &HNSWWriter{hnsw: h, store: ps, persistEvery: persistEvery}
-}
-
-// UpsertPassage satisfies crawler.PassageWriter. Resolves the doc's URL +
-// title via PebbleStore.GetDocMeta, adds the passage to HNSW, and
-// triggers a checkpoint Persist when the threshold is reached.
-//
-// store.Passage carries Embedding + DocID + Offset/Length + Model;
-// HNSW.AddPassage needs URL + title for hit-display.
-func (w *HNSWWriter) UpsertPassage(ctx context.Context, p *store.Passage) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
-	url, title, ok, err := w.store.GetDocMeta(ctx, p.DocID)
-	if err != nil {
-		return fmt.Errorf("lookup doc %d: %w", p.DocID, err)
-	}
-	if !ok {
-		// Doc was deleted between Upsert and Passage write. Skip silently —
-		// no point indexing a vector pointing at nothing.
-		return nil
-	}
-
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	w.hnsw.AddPassage(url, title, p.Offset, p.Length, p.Embedding)
-	w.sinceLastFlush++
-	if w.persistEvery > 0 && w.sinceLastFlush >= w.persistEvery {
-		w.sinceLastFlush = 0
-		// Persist holds the HNSW RLock; we release our own writer mutex
-		// briefly first? Actually no — w.mu protects sinceLastFlush, not
-		// HNSW. HNSW.Persist takes its own RLock independent of ours.
-		if err := w.hnsw.Persist(ctx, w.store); err != nil {
-			return fmt.Errorf("hnsw persist: %w", err)
-		}
-	}
-	return nil
-}
-
-// MarkURLInvalid zeros out every HNSW node whose url matches. Returns
-// the count zeroed. Lets the crawler tell us "this URL's prior passages
-// are stale" before pushing the new chunk batch. Satisfies the optional
-// crawler.URLInvalidator interface.
-func (w *HNSWWriter) MarkURLInvalid(ctx context.Context, url string) (int, error) {
-	if err := ctx.Err(); err != nil {
-		return 0, err
-	}
-	return w.hnsw.MarkURLPassagesInvalid(url), nil
-}
-
-// Flush forces an immediate Persist of the current HNSW state. Crawler
-// callers should invoke this at shutdown so the last partial batch of
-// in-memory inserts isn't lost on next startup.
-func (w *HNSWWriter) Flush(ctx context.Context) error {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	w.sinceLastFlush = 0
-	return w.hnsw.Persist(ctx, w.store)
-}
diff --git a/internal/index/hnsw_writer_test.go b/internal/index/hnsw_writer_test.go
deleted file mode 100644
index 56a0922..0000000
--- a/internal/index/hnsw_writer_test.go
+++ /dev/null
@@ -1,126 +0,0 @@
-package index
-
-import (
-	"context"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/pilot-protocol/cosift/internal/store"
-)
-
-// TestHNSWWriterBridgesPassagesIntoGraph — The PassageWriter
-// satisfies the crawler interface and routes incoming passages into the
-// HNSW graph + the PebbleStore.
-func TestHNSWWriterBridgesPassagesIntoGraph(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "pebble")
-	ps, err := store.OpenPebble(dir)
-	if err != nil {
-		t.Fatalf("OpenPebble: %v", err)
-	}
-	defer ps.Close()
-
-	// Need a Document in the store so GetDocMeta resolves URL+title.
-	ctx := context.Background()
-	id, err := ps.UpsertDocument(ctx, &store.Document{
-		URL: "https://x/doc1", Title: "Doc One", FetchedAt: time.Now(),
-	})
-	if err != nil {
-		t.Fatalf("upsert: %v", err)
-	}
-
-	h := NewHNSW(4)
-	w := NewHNSWWriter(h, ps, 0) // no auto-flush; test drives Flush manually
-
-	vec := []float32{0.7, 0.1, 0.1, 0.7}
-	if err := w.UpsertPassage(ctx, &store.Passage{
-		DocID: id, Offset: 0, Length: 50, Model: "test", Embedding: vec,
-	}); err != nil {
-		t.Fatalf("upsert passage: %v", err)
-	}
-
-	// HNSW now holds one entry; search returns the right URL.
-	hits := h.Search(ctx, vec, 5)
-	if len(hits) != 1 {
-		t.Fatalf("want 1 hit, got %d", len(hits))
-	}
-	if hits[0].URL != "https://x/doc1" {
-		t.Errorf("hit URL: want https://x/doc1, got %s", hits[0].URL)
-	}
-	if hits[0].Title != "Doc One" {
-		t.Errorf("hit Title: got %q", hits[0].Title)
-	}
-
-	// Persist + reload — confirm the bridge produces a recoverable graph.
-	if err := w.Flush(ctx); err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-	loaded, ok, err := LoadHNSW(ctx, ps)
-	if err != nil || !ok {
-		t.Fatalf("load: ok=%v err=%v", ok, err)
-	}
-	loadedHits := loaded.Search(ctx, vec, 5)
-	if len(loadedHits) != 1 || loadedHits[0].URL != "https://x/doc1" {
-		t.Errorf("post-reload hits: %+v", loadedHits)
-	}
-}
-
-// TestHNSWWriterAutoFlushOnThreshold — when persistEvery is set, the
-// writer triggers Persist automatically after N inserts. Locks in the
-// auto-checkpoint contract so callers don't have to poll Flush manually.
-func TestHNSWWriterAutoFlushOnThreshold(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "pebble")
-	ps, err := store.OpenPebble(dir)
-	if err != nil {
-		t.Fatalf("OpenPebble: %v", err)
-	}
-	defer ps.Close()
-
-	ctx := context.Background()
-	// Three docs to write three passages for.
-	for i := 1; i <= 3; i++ {
-		_, err := ps.UpsertDocument(ctx, &store.Document{
-			URL:       "https://x/" + string(rune('a'+i-1)),
-			Title:     "doc",
-			FetchedAt: time.Now(),
-		})
-		if err != nil {
-			t.Fatalf("upsert %d: %v", i, err)
-		}
-	}
-
-	h := NewHNSW(4)
-	w := NewHNSWWriter(h, ps, 2) // auto-persist every 2 passages
-
-	vec := []float32{1, 0, 0, 0}
-	for i := int64(1); i <= 3; i++ {
-		if err := w.UpsertPassage(ctx, &store.Passage{
-			DocID: i, Offset: 0, Length: 50, Model: "test", Embedding: vec,
-		}); err != nil {
-			t.Fatalf("passage %d: %v", i, err)
-		}
-	}
-
-	// After 3 passages and persistEvery=2, exactly one auto-persist
-	// happened (after the 2nd). The 3rd is in memory but not yet on disk —
-	// load should see 2 nodes, not 3.
-	loaded, ok, err := LoadHNSW(ctx, ps)
-	if err != nil || !ok {
-		t.Fatalf("load: ok=%v err=%v", ok, err)
-	}
-	// Loaded must have at least the auto-flushed batch; in-memory writer
-	// has all three. After explicit Flush, persisted count catches up.
-	if loaded.Len() < 2 {
-		t.Errorf("auto-flush at threshold 2: want loaded ≥2 nodes, got %d", loaded.Len())
-	}
-	if err := w.Flush(ctx); err != nil {
-		t.Fatalf("manual flush: %v", err)
-	}
-	loaded2, ok, err := LoadHNSW(ctx, ps)
-	if err != nil || !ok {
-		t.Fatalf("re-load: ok=%v err=%v", ok, err)
-	}
-	if loaded2.Len() != 3 {
-		t.Errorf("post-flush count: want 3, got %d", loaded2.Len())
-	}
-}
diff --git a/internal/index/vector.go b/internal/index/vector.go
index 3e3dbaf..5f01c47 100644
--- a/internal/index/vector.go
+++ b/internal/index/vector.go
@@ -96,7 +96,7 @@ func (v *VectorIndex) Search(_ context.Context, query []float32, k int) []Vector
 	}
 	bestByURL := make(map[string]entry, len(v.docs))
 	for i := range v.docs {
-		s := dot(q, v.docs[i].vec)
+		s := Dot(q, v.docs[i].vec)
 		url := v.docs[i].url
 		cur, ok := bestByURL[url]
 		if !ok || s > cur.score {
@@ -229,7 +229,7 @@ func (v *VectorIndex) SearchMMR(ctx context.Context, query []float32, k int, lam
 		maxSimToSel = maxSimToSel[:last]
 		// Update maxSimToSel for the now-shorter remaining slice using picked.vec.
 		for i := range remaining {
-			sim := dot(picked.vec, remaining[i].vec)
+			sim := Dot(picked.vec, remaining[i].vec)
 			if sim > maxSimToSel[i] {
 				maxSimToSel[i] = sim
 			}
@@ -256,12 +256,15 @@ func (v *VectorIndex) Len() int {
 	return len(v.docs)
 }
 
-func dot(a, b []float32) float32 {
+// Dot returns the dot product of two equal-length float32 slices, or 0 on
+// length mismatch. For unit-normalized vectors (as HNSW stores them) this is
+// equivalent to cosine similarity. Hand-unrolled by 4 — modest speed up
+// without going SIMD.
+func Dot(a, b []float32) float32 {
 	if len(a) != len(b) {
 		return 0
 	}
 	var s float32
-	// Hand-unrolled by 4 — modest speed up without going SIMD.
 	i := 0
 	for ; i <= len(a)-4; i += 4 {
 		s += a[i]*b[i] + a[i+1]*b[i+1] + a[i+2]*b[i+2] + a[i+3]*b[i+3]
diff --git a/internal/server/http.go b/internal/server/http.go
index e4f4e5c..86fe674 100644
--- a/internal/server/http.go
+++ b/internal/server/http.go
@@ -959,11 +959,10 @@ func (s *Server) handleAdminReembed(w http.ResponseWriter, r *http.Request) {
 
 // SearchResponse is the on-the-wire shape of /search results.
 type SearchResponse struct {
-	Query string         `json:"query"`
-	K     int            `json:"k"`
-	Hits  []SearchHit    `json:"hits"`
-	Took  string         `json:"took"`
-	Meta  map[string]any `json:"meta,omitempty"`
+	Query string      `json:"query"`
+	K     int         `json:"k"`
+	Hits  []SearchHit `json:"hits"`
+	Took  string      `json:"took"`
 }
 
 // SearchHit is one result row in /search responses: URL, title, fused score,
diff --git a/internal/sla/sla.go b/internal/sla/sla.go
index c30247f..59d07f8 100644
--- a/internal/sla/sla.go
+++ b/internal/sla/sla.go
@@ -26,7 +26,6 @@ package sla
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"os"
 	"sort"
 	"sync"
@@ -51,15 +50,14 @@ type Sample struct {
 
 // Violation is what the evaluator records when a target is breached.
 type Violation struct {
-	Endpoint   string        `json:"endpoint"`
-	At         time.Time     `json:"at"`
-	Metric     string        `json:"metric"`   // "p95", "p99", "error_rate"
-	Observed   float64       `json:"observed"` // ms for latency, ratio for error_rate
-	Target     float64       `json:"target"`
-	WindowSec  int           `json:"window_sec"`
-	SampleSize int           `json:"sample_size"`
-	Severity   string        `json:"severity"` // "warn" / "critical"
-	Latency    time.Duration `json:"-"`
+	Endpoint   string    `json:"endpoint"`
+	At         time.Time `json:"at"`
+	Metric     string    `json:"metric"`   // "p95", "p99", "error_rate"
+	Observed   float64   `json:"observed"` // ms for latency, ratio for error_rate
+	Target     float64   `json:"target"`
+	WindowSec  int       `json:"window_sec"`
+	SampleSize int       `json:"sample_size"`
+	Severity   string    `json:"severity"` // "warn" / "critical"
 }
 
 // Monitor is the in-process SLA tracker.
@@ -124,9 +122,7 @@ func New(targets []Target, window time.Duration, logPath string) (*Monitor, erro
 		m.buckets[t.Endpoint] = newRingBuffer(1024)
 	}
 	if logPath != "" {
-		if err := m.rotateLog(); err != nil {
-			return nil, fmt.Errorf("sla: rotate log: %w", err)
-		}
+		m.rotateLog()
 	}
 	return m, nil
 }
@@ -308,15 +304,14 @@ func (m *Monitor) persist(v Violation) {
 
 // rotateLog moves any pre-existing log aside with a timestamp suffix
 // so the live log file stays bounded.
-func (m *Monitor) rotateLog() error {
+func (m *Monitor) rotateLog() {
 	if m.logPath == "" {
-		return nil
+		return
 	}
 	if _, err := os.Stat(m.logPath); err == nil {
 		ts := time.Now().Format("20060102T150405")
 		_ = os.Rename(m.logPath, m.logPath+"."+ts)
 	}
-	return nil
 }
 
 // Snapshot returns the latest evaluation state.
diff --git a/internal/store/pebble.go b/internal/store/pebble.go
index 31159d8..e41d602 100644
--- a/internal/store/pebble.go
+++ b/internal/store/pebble.go
@@ -107,7 +107,7 @@ const (
 	//                       reverse index from docID to its term IDs, so
 	//                       re-indexing the same doc can delete orphaned postings
 	//                       for terms that vanished from the new content.
-	famHostTerm    byte = 'T' // 'T' + host-string → uint64-be(hostID)
+	famHostTerm byte = 'T' // 'T' + host-string → uint64-be(hostID)
 	//                          stable per-host id, allocated like termID.
 	famHostPosting byte = 'P' // 'P' + hostID(8) + termID(8) + docID(8) → (tf, docLen)
 	//                          host-partitioned postings: a site= query scans
@@ -450,20 +450,19 @@ func frontierStatusIndexKeyLane(sub, lane byte, host, url string) []byte {
 	return k
 }
 
-// frontierStatusIndexHostLane extracts (host, lane) from a lane-format
-// secondary index key. Returns ("", 0) if the key shape is wrong.
-func frontierStatusIndexHostLane(key []byte) (host string, lane byte) {
+// frontierStatusIndexHostLane extracts the host from a lane-format secondary
+// index key. Returns "" if the key shape is wrong.
+func frontierStatusIndexHostLane(key []byte) (host string) {
 	if len(key) < 4 || key[0] != famFrontier {
-		return "", 0
+		return ""
 	}
-	lane = key[2]
 	rest := key[3:]
 	for i, b := range rest {
 		if b == 0x00 {
-			return string(rest[:i]), lane
+			return string(rest[:i])
 		}
 	}
-	return "", 0
+	return ""
 }
 
 // frontierLanePrefix is the lower bound for an iteration scoped to one
@@ -1897,8 +1896,7 @@ func decodeFrontierIndexHost(key []byte) string {
 		return ""
 	}
 	if key[2] < laneCount {
-		h, _ := frontierStatusIndexHostLane(key)
-		return h
+		return frontierStatusIndexHostLane(key)
 	}
 	return frontierStatusIndexHost(key)
 }
@@ -1926,7 +1924,7 @@ func (p *PebbleStore) scanLaneForFreeHost(lane byte, inflightHosts map[string]st
 
 	scan := func(start func() bool) (found bool) {
 		for valid := start(); valid; valid = qIt.Next() {
-			h, _ := frontierStatusIndexHostLane(qIt.Key())
+			h := frontierStatusIndexHostLane(qIt.Key())
 			if h == "" {
 				continue
 			}
@@ -3035,7 +3033,7 @@ func (p *PebbleStore) PurgeStaleInFlight(ctx context.Context) (int, error) {
 		}
 		var host, url string
 		if k[2] < laneCount {
-			host, _ = frontierStatusIndexHostLane(k)
+			host = frontierStatusIndexHostLane(k)
 			urlOffset := 3 + len(host) + 1
 			if urlOffset > len(k) {
 				continue
diff --git a/internal/store/store.go b/internal/store/store.go
index 236721f..f75a5c4 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -1084,6 +1084,29 @@ func (s *Store) GCErroredFrontier(ctx context.Context, minAttempts int) (int64,
 	return res.RowsAffected()
 }
 
+// TrimDoneFrontier deletes completed (status='done') frontier rows that were
+// enqueued more than maxAge ago. Long-lived crawls accumulate millions of done
+// rows that serve no purpose — dedup is handled by INSERT OR IGNORE so a done
+// row is only useful for the IsKnownURL fast-path, which already falls through
+// to the documents table. Trimming done rows reclaims disk space and keeps
+// ClaimFrontier's ORDER BY scan fast.
+//
+// Rows younger than maxAge are kept because a short-TTL re-crawl (refresh-due
+// at 24 h) may re-enqueue them; dropping them would lose the dedup guard
+// and cause redundant fetches. Pass maxAge ≥ your refresh interval
+// (e.g. 7*24*time.Hour for a weekly refresh cycle).
+//
+// Returns the number of rows deleted.
+func (s *Store) TrimDoneFrontier(ctx context.Context, maxAge time.Duration) (int64, error) {
+	cutoff := time.Now().Add(-maxAge).Unix()
+	res, err := s.db.ExecContext(ctx,
+		`DELETE FROM frontier WHERE status = 'done' AND enqueued_at < ?;`, cutoff)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
 // Vacuum reclaims disk space after large deletes. Cheap on small DBs, can
 // take minutes on multi-GB ones — caller's responsibility to schedule.
 func (s *Store) Vacuum(ctx context.Context) error {
@@ -1391,7 +1414,6 @@ func (s *Store) RecrawlURL(ctx context.Context, url string) error {
 
 // Passage is one (doc_id, offset, length, model, vec) row.
 type Passage struct {
-	ID        int64
 	DocID     int64
 	Offset    int
 	Length    int
diff --git a/scripts/cosift-crawl.service b/scripts/cosift-crawl.service
deleted file mode 100644
index 5ef3af0..0000000
--- a/scripts/cosift-crawl.service
+++ /dev/null
@@ -1,22 +0,0 @@
-[Unit]
-Description=cosift crawl (oneshot — stops cosift-serve, crawls, restarts serve)
-# Both services want the Pebble writer lock; declare mutual exclusion so
-# starting one cleanly stops the other.
-Conflicts=cosift-serve.service
-
-[Service]
-Type=oneshot
-User=ubuntu
-Group=ubuntu
-WorkingDirectory=/home/ubuntu
-Environment=COSIFT_HNSW_CHECKPOINT_SEC=60
-# Run for up to 30 minutes per cycle. Periodic HNSW checkpoint means we
-# keep all vectors even if SIGTERM cuts us short.
-ExecStart=/home/ubuntu/cosift -config /home/ubuntu/cosift.json crawl -backend pebble -seeds-file /home/ubuntu/seeds.txt -duration 30m
-ExecStartPost=/bin/systemctl start cosift-serve.service
-TimeoutStartSec=2400
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=multi-user.target
diff --git a/scripts/cosift-crawl.timer b/scripts/cosift-crawl.timer
deleted file mode 100644
index 13dfab4..0000000
--- a/scripts/cosift-crawl.timer
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=cosift crawl — cycle every 6h
-# Triggers cosift-crawl.service, which stops cosift-serve.service via the
-# Conflicts= directive, runs the crawl, then ExecStartPost restarts serve.
-
-[Timer]
-# 4 cycles per day. Crawl runs 30 min, serve runs the other ~85 min before
-# the next trigger. Tune to taste.
-OnCalendar=*-*-* 00,06,12,18:00:00
-Persistent=true
-Unit=cosift-crawl.service
-
-[Install]
-WantedBy=timers.target
diff --git a/scripts/cosift-serve.service b/scripts/cosift-serve.service
deleted file mode 100644
index 9b107ab..0000000
--- a/scripts/cosift-serve.service
+++ /dev/null
@@ -1,30 +0,0 @@
-[Unit]
-Description=cosift pebble-serve (with in-process continuous crawler)
-After=network-online.target ollama.service
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=ubuntu
-Group=ubuntu
-WorkingDirectory=/home/ubuntu
-Environment=COSIFT_LOAD_HNSW=true
-Environment=COSIFT_RATELIMIT_RPM=240
-Environment=COSIFT_RATELIMIT_BURST=80
-Environment=COSIFT_RATELIMIT_WHITELIST=104.28.216.88,127.0.0.1
-Environment=COSIFT_PPROF_ADDR=127.0.0.1:6060
-Environment=COSIFT_MUTEX_PROFILE_FRACTION=100
-Environment=COSIFT_DISABLE_PQ=true
-Environment=COSIFT_HNSW_EF_SEARCH=200
-Environment=COSIFT_CRAWL_EMBED_CONCURRENCY=16
-Environment=COSIFT_PEBBLE_CACHE_MB=32768
-ExecStart=/home/ubuntu/cosift -config /home/ubuntu/cosift.json pebble-serve -dir /home/ubuntu/cosift-data/pebble -addr 127.0.0.1:7777 -crawl-seeds-file /home/ubuntu/seeds.txt -crawl-checkpoint 60s
-Restart=on-failure
-RestartSec=5
-LimitNOFILE=131072
-TimeoutStopSec=30
-MemoryMax=262G
-MemoryHigh=240G
-
-[Install]
-WantedBy=multi-user.target
diff --git a/scripts/cosift-snapshot.service b/scripts/cosift-snapshot.service
deleted file mode 100644
index 2f86294..0000000
--- a/scripts/cosift-snapshot.service
+++ /dev/null
@@ -1,19 +0,0 @@
-[Unit]
-Description=cosift snapshot — tarball pebble + config, upload to GCS
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-User=ubuntu
-Group=ubuntu
-WorkingDirectory=/home/ubuntu
-Environment=COSIFT_ADMIN_URL=http://127.0.0.1:7777
-Environment=COSIFT_CONFIG=/home/ubuntu/cosift.json
-Environment=COSIFT_GCS_BUCKET=gs://pilot-cosift-index
-Environment=COSIFT_KEEP=14
-# COSIFT_ADMIN_TOKEN — set via /etc/cosift/snapshot.env if cluster.peer_auth_token is configured
-EnvironmentFile=-/etc/cosift/snapshot.env
-ExecStart=/usr/bin/bash /home/ubuntu/snapshot.sh
-StandardOutput=journal
-StandardError=journal
diff --git a/scripts/cosift-snapshot.timer b/scripts/cosift-snapshot.timer
deleted file mode 100644
index 834d86d..0000000
--- a/scripts/cosift-snapshot.timer
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=cosift snapshot — every 4h
-# Triggers cosift-snapshot.service. 4-hour cadence × KEEP=14 = ~56 hours
-# of recovery history. Tune by changing OnCalendar + COSIFT_KEEP env.
-
-[Timer]
-OnCalendar=*-*-* 00,04,08,12,16,20:00:00
-Persistent=true
-RandomizedDelaySec=60
-Unit=cosift-snapshot.service
-
-[Install]
-WantedBy=timers.target
diff --git a/scripts/ollama-replica.service.tmpl b/scripts/ollama-replica.service.tmpl
deleted file mode 100644
index b01cc72..0000000
--- a/scripts/ollama-replica.service.tmpl
+++ /dev/null
@@ -1,18 +0,0 @@
-[Unit]
-Description=Ollama Service (replica 1, port 11435)
-After=network-online.target
-
-[Service]
-ExecStart=/usr/local/bin/ollama serve
-User=ollama
-Group=ollama
-Restart=always
-RestartSec=3
-Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-Environment="OLLAMA_HOST=127.0.0.1:11435"
-Environment="OLLAMA_NUM_PARALLEL=32"
-Environment="OLLAMA_KEEP_ALIVE=24h"
-Environment="HOME=/usr/share/ollama"
-
-[Install]
-WantedBy=default.target
diff --git a/scripts/ollama.service b/scripts/ollama.service
deleted file mode 100644
index 875e97a..0000000
--- a/scripts/ollama.service
+++ /dev/null
@@ -1,16 +0,0 @@
-[Unit]
-Description=Ollama Service
-After=network-online.target
-
-[Service]
-ExecStart=/usr/local/bin/ollama serve
-Environment="OLLAMA_NUM_PARALLEL=10"
-Environment="OLLAMA_KEEP_ALIVE=24h"
-User=ollama
-Group=ollama
-Restart=always
-RestartSec=3
-Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin"
-
-[Install]
-WantedBy=default.target

From f100bae32e9ebbb819df63afc6655166e50f81c3 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:19:53 +0300
Subject: [PATCH 05/11] ci: signed pull-based deploy to GH200 + arm64/vet CI
 gates

- fix Makefile ldflags module path (calinteodor -> pilot-protocol); version stamping now lands
- ci.yml: add go vet + linux/arm64 cross-compile build
- deploy.yml: build signed arm64 release (sha256 + minisign) on tag
- box self-updater (deploy/scripts + deploy/systemd/cosift-self-update.*): sha256+minisign verify, atomic swap + rollback, health-gated; keeps SSH key out of CI

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                  |  10 +
 .github/workflows/deploy.yml              | 148 ++++++++++++++
 Makefile                                  |   2 +-
 deploy/scripts/README.md                  | 131 +++++++++++++
 deploy/scripts/cosift-self-update.sh      | 227 ++++++++++++++++++++++
 deploy/systemd/cosift-self-update.service |  33 ++++
 deploy/systemd/cosift-self-update.timer   |  16 ++
 7 files changed, 566 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/deploy.yml
 create mode 100644 deploy/scripts/README.md
 create mode 100755 deploy/scripts/cosift-self-update.sh
 create mode 100644 deploy/systemd/cosift-self-update.service
 create mode 100644 deploy/systemd/cosift-self-update.timer

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c7f8357..01e4a58 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,16 @@ jobs:
           go-version: '1.25'
           cache: true
 
+      - name: go vet
+        run: go vet ./...
+
+      - name: Cross-compile for prod target (linux/arm64)
+        # Production runs on a GH200 (linux/arm64). Pure-Go + CGO_ENABLED=0
+        # means this is a clean cross-compile on the amd64 runner — no QEMU,
+        # no self-hosted runner. Catches a compile break on the prod arch
+        # that the host-arch test build would miss.
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build ./cmd/cosift
+
       - name: Run tests with coverage
         # cosift's internal/crawler hits ~25s; allow 5m total headroom.
         run: go test -race -coverprofile=coverage.out -covermode=atomic -timeout 5m ./...
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..070d714
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,148 @@
+name: deploy
+
+# Build + sign + publish a release artifact. PULL-BASED deploy:
+# this workflow never touches the production box and never holds an SSH key.
+# The box runs cosift-self-update.timer, which polls the latest GitHub Release,
+# verifies sha256 + minisign signature against a public key baked on the box,
+# snapshots, atomically swaps the binary, restarts, and health-gates with
+# auto-rollback. See deploy/scripts/README.md.
+#
+# Triggers:
+#   - push of a version tag (v*)         → cut a release for that tag
+#   - manual workflow_dispatch           → build from a chosen ref (no release
+#                                          unless a tag is also present)
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write   # needed to create the GitHub Release + upload assets
+
+jobs:
+  # (a) verify — gate the release on vet + race tests + a smoke subset.
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          cache: true
+
+      - name: go vet
+        run: go vet ./...
+
+      - name: Tests (race)
+        run: go test -race -timeout 5m ./...
+
+      - name: Smoke subset (build + serve roundtrip)
+        # make smoke builds the binary, crawls, and asserts /healthz + /search.
+        # Guarded with a timeout so a hung crawl can't wedge the release.
+        run: timeout 300 make smoke
+
+  # (b) build — reproducible static arm64 binary, sha256, minisign signature.
+  build:
+    needs: verify
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.ver.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0   # full history so version stamping is meaningful
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.25'
+          cache: true
+
+      - name: Resolve version stamp
+        id: ver
+        # Tag name when triggered by a tag push; otherwise the short SHA.
+        run: |
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            echo "version=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build (linux/arm64, static, trimmed)
+        env:
+          CGO_ENABLED: '0'
+          GOOS: linux
+          GOARCH: arm64
+          VERSION: ${{ steps.ver.outputs.version }}
+        # Stamp both main.version and internal/server.Version so /healthz and
+        # /metrics report the shipped version. Matches the Makefile `build`
+        # target's ldflags exactly (kept in sync deliberately).
+        run: |
+          go build -trimpath \
+            -ldflags "-s -w -X main.version=${VERSION} -X github.com/pilot-protocol/cosift/internal/server.Version=${VERSION}" \
+            -o cosift-linux-arm64 ./cmd/cosift
+
+      - name: sha256
+        run: sha256sum cosift-linux-arm64 | tee cosift-linux-arm64.sha256
+
+      - name: Install minisign
+        run: sudo apt-get update && sudo apt-get install -y minisign
+
+      - name: Sign with minisign
+        env:
+          # Repo secret. The matching PUBLIC key is baked on the box at
+          # /etc/cosift/minisign.pub. Generate with `minisign -G` (see
+          # deploy/scripts/README.md). NEVER commit the secret key.
+          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
+        run: |
+          if [ -z "${MINISIGN_SECRET_KEY}" ]; then
+            echo "::error::MINISIGN_SECRET_KEY secret is not set" >&2
+            exit 1
+          fi
+          printf '%s' "${MINISIGN_SECRET_KEY}" > minisign.key
+          # -W: secret key is unencrypted (no interactive passphrase prompt).
+          # Trusted comment carries the version so the box can sanity-check it.
+          minisign -S -W -s minisign.key \
+            -m cosift-linux-arm64 \
+            -t "cosift ${{ steps.ver.outputs.version }} linux/arm64"
+          rm -f minisign.key
+          # Verification against the embedded public key is done on the box;
+          # here we just confirm the .minisig was produced.
+          test -f cosift-linux-arm64.minisig
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: cosift-release-artifacts
+          path: |
+            cosift-linux-arm64
+            cosift-linux-arm64.sha256
+            cosift-linux-arm64.minisig
+          retention-days: 30
+
+  # (c) release — publish the signed binary as a GitHub Release asset.
+  # Only on a tag push (workflow_dispatch builds the artifact but does not
+  # cut a release).
+  release:
+    needs: build
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v7
+        with:
+          name: cosift-release-artifacts
+
+      - name: Create / update GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: cosift ${{ github.ref_name }}
+          generate_release_notes: true
+          fail_on_unmatched_files: true
+          files: |
+            cosift-linux-arm64
+            cosift-linux-arm64.sha256
+            cosift-linux-arm64.minisig
diff --git a/Makefile b/Makefile
index 1ef0533..df9ef4e 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,7 @@ smoke:
 	@./scripts/smoke-test.sh
 
 build:
-	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=$(VERSION) -X github.com/calinteodor/cosift/internal/server.Version=$(VERSION)" -o $(BINARY) $(PKG)
+	CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=$(VERSION) -X github.com/pilot-protocol/cosift/internal/server.Version=$(VERSION)" -o $(BINARY) $(PKG)
 
 # Light-touch verification: compile + vet + unit tests on packages that
 # don't need OPENAI/COHERE keys or live network. Catches latent compile
diff --git a/deploy/scripts/README.md b/deploy/scripts/README.md
new file mode 100644
index 0000000..bd16231
--- /dev/null
+++ b/deploy/scripts/README.md
@@ -0,0 +1,131 @@
+# cosift deploy — PULL-based self-update (signed releases)
+
+How a new cosift build reaches the GH200 **without CI ever holding the
+production SSH key**. CI builds, signs, and publishes a GitHub Release; the
+box pulls, verifies the signature against a public key baked locally, snapshots,
+atomically swaps the binary, restarts, and health-gates with auto-rollback.
+
+```
+  tag push (vX.Y.Z)                         GH200 box (every ~5 min)
+        │                                          │
+  ┌─────▼─────────────────────┐            ┌───────▼────────────────────────┐
+  │ .github/workflows/         │            │ cosift-self-update.timer        │
+  │   deploy.yml               │            │   → cosift-self-update.service  │
+  │ verify → build → sign      │  Release   │   → cosift-self-update.sh       │
+  │ (minisign, secret key)     │ ─────────► │ poll latest release             │
+  │ upload binary+.sha256+.sig │  assets    │ verify sha256 + minisign(pub)   │
+  └────────────────────────────┘            │ snapshot → swap → restart       │
+                                            │ health-gate /healthz, rollback  │
+                                            └─────────────────────────────────┘
+```
+
+No SSH key, no box credentials, ever live in GitHub Actions. The trust anchor
+is the minisign keypair: the **private** key lives only as a GitHub secret; the
+**public** key is baked on the box and is the only thing that authorizes an
+install.
+
+## One-time setup
+
+### 1. Generate the minisign keypair (do this locally, once)
+
+```bash
+minisign -G -p minisign.pub -s minisign.key
+# -G generates a keypair. Choose a passphrase OR use -W for an unencrypted
+# secret key. CI signs non-interactively, so the secret key stored in the
+# GitHub secret must be UNENCRYPTED — generate with -W:
+minisign -G -W -p minisign.pub -s minisign.key
+```
+
+This produces two files:
+- `minisign.pub`  — public key (safe to commit / publish / bake on the box)
+- `minisign.key`  — secret key (NEVER commit; goes into the GitHub secret)
+
+### 2. Store the secret key as a GitHub Actions secret
+
+Repo → Settings → Secrets and variables → Actions → New repository secret:
+
+- **Name:** `MINISIGN_SECRET_KEY`
+- **Value:** the full contents of `minisign.key`
+
+`deploy.yml` writes it to a temp file, signs with `minisign -S -W`, and deletes
+it. Because the workflow signs non-interactively, the secret key must be the
+**unencrypted** form (`minisign -G -W`).
+
+> Anyone who can edit `deploy.yml` and trigger it can sign a release. Protect
+> the workflow with branch/tag protection and required reviews accordingly.
+
+### 3. Bake the PUBLIC key on the box
+
+```bash
+sudo mkdir -p /etc/cosift
+sudo cp minisign.pub /etc/cosift/minisign.pub
+sudo chmod 0644 /etc/cosift/minisign.pub
+```
+
+The self-updater verifies every download against `/etc/cosift/minisign.pub`
+and refuses to install anything that doesn't verify.
+
+### 4. Install the self-update script + timer on the box
+
+```bash
+# script (the serve unit expects it under /home/ubuntu/scripts/)
+sudo install -o ubuntu -g ubuntu -m 0755 \
+  deploy/scripts/cosift-self-update.sh /home/ubuntu/scripts/cosift-self-update.sh
+
+# the snapshot script it reuses must also be present + executable
+sudo install -o ubuntu -g ubuntu -m 0755 \
+  scripts/snapshot.sh /home/ubuntu/scripts/snapshot.sh
+
+# systemd units
+sudo cp deploy/systemd/cosift-self-update.service /etc/systemd/system/
+sudo cp deploy/systemd/cosift-self-update.timer   /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now cosift-self-update.timer
+
+# verify
+systemctl status cosift-self-update.timer
+systemctl list-timers cosift-self-update.timer
+```
+
+Dependencies on the box: `curl`, `jq`, `sha256sum` (coreutils), `minisign`,
+`systemctl`. Install minisign with `sudo apt-get install -y minisign`.
+
+## Cutting a release
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+The `deploy.yml` workflow runs `verify` (vet + race tests + smoke), `build`
+(static `linux/arm64`, sha256, minisign signature), and `release` (uploads
+`cosift-linux-arm64`, `.sha256`, `.minisig` as Release assets). Within ~5 min
+the box's timer fires, verifies, and rolls the update out. `workflow_dispatch`
+builds + signs the artifact for inspection but does **not** cut a Release
+(only tag pushes do).
+
+## Operating the self-updater
+
+```bash
+# trigger a poll right now (don't wait for the timer)
+sudo systemctl start cosift-self-update.service
+
+# watch what it did
+journalctl -u cosift-self-update.service -n 200 --no-pager
+
+# pause / resume automatic polling
+sudo systemctl disable --now cosift-self-update.timer
+sudo systemctl enable  --now cosift-self-update.timer
+```
+
+Safety properties baked into `cosift-self-update.sh`:
+- `set -euo pipefail` + `flock` (no concurrent runs racing the swap).
+- Installs only if sha256 **and** minisign signature verify against the baked
+  public key; also cross-checks the downloaded binary's `version` against the
+  release tag.
+- Pre-restart GCS snapshot via `scripts/snapshot.sh`.
+- Atomic swap: stage `cosift.new` → keep `cosift.prev` → `mv` over `cosift`.
+- Health gate: polls `/healthz` every 10s for up to 10 min (the listener binds
+  only after the ~4-5 min HNSW load, so a 200 is true readiness).
+- Auto-rollback: on health-gate failure, restores `cosift.prev`, restarts, and
+  exits non-zero.
diff --git a/deploy/scripts/cosift-self-update.sh b/deploy/scripts/cosift-self-update.sh
new file mode 100755
index 0000000..6a3df33
--- /dev/null
+++ b/deploy/scripts/cosift-self-update.sh
@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+# cosift-self-update.sh — PULL-based self-updater for the cosift production box.
+#
+# Polls the latest GitHub Release for a newer cosift binary, verifies it
+# (sha256 + minisign signature against a public key baked on the box),
+# snapshots the index to GCS, atomically swaps the binary, restarts the
+# service, and HEALTH-GATES the new process with automatic rollback.
+#
+# CI never holds the SSH key: the box pulls, CI only pushes signed releases.
+#
+# Run by cosift-self-update.timer every ~5 min. Logs to journald.
+#
+# Exit codes:
+#   0  no update needed, or update applied and healthy
+#   1  update attempted but failed (rolled back where possible)
+#   2  precondition / environment error (no binary, no pubkey, missing deps)
+#
+# Configurable via environment (defaults target the GH200 prod layout):
+#   COSIFT_REPO          pilot-protocol/cosift
+#   COSIFT_BIN           /home/ubuntu/cosift
+#   COSIFT_SERVICE       cosift-serve
+#   COSIFT_PUBKEY        /etc/cosift/minisign.pub
+#   COSIFT_HEALTH_URL    http://127.0.0.1:7777/healthz
+#   COSIFT_ASSET         cosift-linux-arm64
+#   COSIFT_SNAPSHOT      /home/ubuntu/scripts/snapshot.sh   (best-effort)
+#   COSIFT_HEALTH_TIMEOUT_S  600   (10 min; HNSW load is ~4-5 min)
+#   COSIFT_HEALTH_INTERVAL_S 10
+#   GITHUB_TOKEN         (optional; raises the GitHub API rate limit)
+set -euo pipefail
+
+REPO="${COSIFT_REPO:-pilot-protocol/cosift}"
+BIN="${COSIFT_BIN:-/home/ubuntu/cosift}"
+SERVICE="${COSIFT_SERVICE:-cosift-serve}"
+PUBKEY="${COSIFT_PUBKEY:-/etc/cosift/minisign.pub}"
+HEALTH_URL="${COSIFT_HEALTH_URL:-http://127.0.0.1:7777/healthz}"
+ASSET="${COSIFT_ASSET:-cosift-linux-arm64}"
+SNAPSHOT="${COSIFT_SNAPSHOT:-/home/ubuntu/scripts/snapshot.sh}"
+HEALTH_TIMEOUT_S="${COSIFT_HEALTH_TIMEOUT_S:-600}"
+HEALTH_INTERVAL_S="${COSIFT_HEALTH_INTERVAL_S:-10}"
+API="https://api.github.com/repos/${REPO}/releases/latest"
+
+log() { echo "self-update: $*"; }
+err() { echo "self-update: ERROR: $*" >&2; }
+
+# --- Concurrency lock: never let two runs race the binary swap. ----------
+# flock on a dedicated FD; -n means fail fast if another run holds it.
+LOCKFILE="/run/cosift-self-update.lock"
+exec 9>"$LOCKFILE" 2>/dev/null || exec 9>"/tmp/cosift-self-update.lock"
+if ! flock -n 9; then
+  log "another self-update run holds the lock; skipping this tick"
+  exit 0
+fi
+
+# --- Preconditions -------------------------------------------------------
+for dep in curl jq sha256sum minisign systemctl; do
+  if ! command -v "$dep" >/dev/null 2>&1; then
+    err "missing required dependency: $dep"
+    exit 2
+  fi
+done
+if [[ ! -x "$BIN" ]]; then
+  err "current binary not found or not executable: $BIN"
+  exit 2
+fi
+if [[ ! -f "$PUBKEY" ]]; then
+  err "minisign public key not found: $PUBKEY (bake it on the box first)"
+  exit 2
+fi
+
+# --- Determine running vs. latest version --------------------------------
+running="$("$BIN" version 2>/dev/null | tr -d '[:space:]' || true)"
+if [[ -z "$running" ]]; then
+  err "could not read running version via '$BIN version'; aborting (fail-safe)"
+  exit 2
+fi
+log "running version: $running"
+
+auth_args=()
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  auth_args=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+fi
+
+release_json="$(curl -fsSL "${auth_args[@]}" \
+  -H "Accept: application/vnd.github+json" \
+  -H "X-GitHub-Api-Version: 2022-11-28" \
+  "$API" 2>/dev/null || true)"
+if [[ -z "$release_json" ]]; then
+  err "failed to query latest release from $API"
+  exit 1
+fi
+
+latest_tag="$(printf '%s' "$release_json" | jq -r '.tag_name // empty')"
+if [[ -z "$latest_tag" ]]; then
+  err "latest release has no tag_name (response truncated below)"
+  printf '%s\n' "$release_json" | head -c 400 >&2
+  exit 1
+fi
+log "latest release tag: $latest_tag"
+
+# Compare. We strip a leading 'v' so a binary stamped '1.2.3' matches tag
+# 'v1.2.3'. If they already match, nothing to do.
+norm() { printf '%s' "${1#v}"; }
+if [[ "$(norm "$running")" == "$(norm "$latest_tag")" ]]; then
+  log "already at latest ($running); nothing to do"
+  exit 0
+fi
+log "update available: $running -> $latest_tag"
+
+# --- Resolve asset download URLs ----------------------------------------
+asset_url() {
+  printf '%s' "$release_json" \
+    | jq -r --arg n "$1" '.assets[] | select(.name == $n) | .browser_download_url' \
+    | head -n1
+}
+bin_url="$(asset_url "$ASSET")"
+sha_url="$(asset_url "${ASSET}.sha256")"
+sig_url="$(asset_url "${ASSET}.minisig")"
+if [[ -z "$bin_url" || -z "$sha_url" || -z "$sig_url" ]]; then
+  err "release $latest_tag missing one of: $ASSET / .sha256 / .minisig"
+  exit 1
+fi
+
+# --- Download into a private temp dir -----------------------------------
+tmp="$(mktemp -d)"
+cleanup() { rm -rf "$tmp"; }
+trap cleanup EXIT
+
+log "downloading $ASSET, .sha256, .minisig"
+curl -fsSL "${auth_args[@]}" -o "$tmp/$ASSET"          "$bin_url"
+curl -fsSL "${auth_args[@]}" -o "$tmp/${ASSET}.sha256" "$sha_url"
+curl -fsSL "${auth_args[@]}" -o "$tmp/${ASSET}.minisig" "$sig_url"
+
+# --- VERIFY sha256 -------------------------------------------------------
+# The .sha256 file is `sha256sum` output: "<hex>  <name>". Recompute and
+# compare against the hex column rather than trusting the filename column.
+expected_sha="$(awk '{print $1}' "$tmp/${ASSET}.sha256")"
+actual_sha="$(sha256sum "$tmp/$ASSET" | awk '{print $1}')"
+if [[ -z "$expected_sha" || "$expected_sha" != "$actual_sha" ]]; then
+  err "sha256 mismatch (expected=$expected_sha actual=$actual_sha) — refusing"
+  exit 1
+fi
+log "sha256 OK ($actual_sha)"
+
+# --- VERIFY minisign signature against the box-baked public key ----------
+# This is the trust anchor: only releases signed by the matching secret key
+# (held as a GitHub secret in CI) are accepted. A good sha256 alone is not
+# enough — an attacker who can serve assets could forge a matching checksum.
+if ! minisign -V -p "$PUBKEY" -m "$tmp/$ASSET" -x "$tmp/${ASSET}.minisig"; then
+  err "minisign signature verification FAILED — refusing to install"
+  exit 1
+fi
+log "minisign signature OK (verified against $PUBKEY)"
+
+# Sanity: the downloaded binary should report the version we expect.
+chmod +x "$tmp/$ASSET"
+dl_version="$("$tmp/$ASSET" version 2>/dev/null | tr -d '[:space:]' || true)"
+if [[ -n "$dl_version" && "$(norm "$dl_version")" != "$(norm "$latest_tag")" ]]; then
+  err "downloaded binary reports '$dl_version' but release tag is '$latest_tag' — refusing"
+  exit 1
+fi
+
+# --- Pre-restart GCS snapshot (best-effort but logged) -------------------
+if [[ -x "$SNAPSHOT" ]]; then
+  log "taking pre-restart snapshot via $SNAPSHOT"
+  if ! "$SNAPSHOT"; then
+    err "snapshot failed; continuing with update (index is also recoverable from prior snapshot)"
+  fi
+else
+  log "snapshot script not executable at $SNAPSHOT; skipping pre-restart snapshot"
+fi
+
+# --- Atomic swap ---------------------------------------------------------
+# Stage alongside the live binary so the final mv is a same-filesystem
+# rename (atomic). Keep the previous binary for rollback.
+new="${BIN}.new"
+prev="${BIN}.prev"
+cp -f "$tmp/$ASSET" "$new"
+chmod +x "$new"
+log "staged new binary at $new"
+
+cp -f "$BIN" "$prev"        # snapshot current binary for rollback
+mv -f "$new" "$BIN"         # atomic rename over the live path
+log "swapped in $latest_tag (previous kept at $prev)"
+
+# --- Restart -------------------------------------------------------------
+log "restarting $SERVICE"
+systemctl restart "$SERVICE"
+
+# --- HEALTH GATE ---------------------------------------------------------
+# The listener only binds AFTER the ~4-5 min synchronous HNSW load, so a
+# 200 from /healthz is a true readiness signal. Poll up to the timeout.
+log "health-gating $HEALTH_URL (timeout ${HEALTH_TIMEOUT_S}s, every ${HEALTH_INTERVAL_S}s)"
+deadline=$(( $(date +%s) + HEALTH_TIMEOUT_S ))
+healthy=0
+while (( $(date +%s) < deadline )); do
+  if curl -fsS --max-time 5 "$HEALTH_URL" >/dev/null 2>&1; then
+    healthy=1
+    break
+  fi
+  sleep "$HEALTH_INTERVAL_S"
+done
+
+if (( healthy == 1 )); then
+  log "healthy on $latest_tag — update complete"
+  exit 0
+fi
+
+# --- AUTO-ROLLBACK -------------------------------------------------------
+err "new version $latest_tag did not become healthy within ${HEALTH_TIMEOUT_S}s — rolling back to $running"
+if [[ -f "$prev" ]]; then
+  mv -f "$prev" "$BIN"
+  systemctl restart "$SERVICE"
+  # Give the rolled-back process a chance to come back so the box isn't
+  # left dark. Best-effort; we still exit non-zero to flag the failure.
+  rb_deadline=$(( $(date +%s) + HEALTH_TIMEOUT_S ))
+  while (( $(date +%s) < rb_deadline )); do
+    if curl -fsS --max-time 5 "$HEALTH_URL" >/dev/null 2>&1; then
+      err "rolled back to $running and healthy again"
+      exit 1
+    fi
+    sleep "$HEALTH_INTERVAL_S"
+  done
+  err "rollback restarted $SERVICE but it is not yet healthy — manual attention needed"
+else
+  err "no previous binary at $prev to roll back to — manual attention needed"
+fi
+exit 1
diff --git a/deploy/systemd/cosift-self-update.service b/deploy/systemd/cosift-self-update.service
new file mode 100644
index 0000000..747a482
--- /dev/null
+++ b/deploy/systemd/cosift-self-update.service
@@ -0,0 +1,33 @@
+[Unit]
+Description=cosift PULL-based self-updater (verify + snapshot + swap + health-gate + rollback)
+# Don't poll until the box is on the network and the serve unit is up; the
+# updater health-gates the same service it restarts.
+After=network-online.target cosift-serve.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=ubuntu
+Group=ubuntu
+WorkingDirectory=/home/ubuntu
+# Public verification key baked on the box. The matching private key lives
+# only as the MINISIGN_SECRET_KEY GitHub Actions secret (CI signs releases).
+Environment=COSIFT_REPO=pilot-protocol/cosift
+Environment=COSIFT_BIN=/home/ubuntu/cosift
+Environment=COSIFT_SERVICE=cosift-serve
+Environment=COSIFT_PUBKEY=/etc/cosift/minisign.pub
+Environment=COSIFT_HEALTH_URL=http://127.0.0.1:7777/healthz
+Environment=COSIFT_SNAPSHOT=/home/ubuntu/scripts/snapshot.sh
+# Optional: drop a GITHUB_TOKEN here (or in a drop-in) to raise the API rate
+# limit. Public releases work unauthenticated, so it's not required.
+# Environment=GITHUB_TOKEN=
+ExecStart=/home/ubuntu/scripts/cosift-self-update.sh
+# The health gate plus a possible rollback can each take the full ~10 min
+# HNSW load window; give the unit generous headroom before systemd kills it.
+TimeoutStartSec=1500
+# A failed self-update (non-zero exit) is informational, not fatal for the
+# box — the running service is unaffected (or already rolled back).
+SuccessExitStatus=0
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy/systemd/cosift-self-update.timer b/deploy/systemd/cosift-self-update.timer
new file mode 100644
index 0000000..f2e5fb2
--- /dev/null
+++ b/deploy/systemd/cosift-self-update.timer
@@ -0,0 +1,16 @@
+[Unit]
+Description=Poll for a newer signed cosift release every ~5 min
+
+[Timer]
+# First poll 2 min after boot (let cosift-serve finish its HNSW load), then
+# every 5 min. RandomizedDelaySec smears load off the GitHub API and avoids
+# a thundering-herd if multiple boxes ever run this.
+OnBootSec=2min
+OnUnitInactiveSec=5min
+RandomizedDelaySec=60
+AccuracySec=30s
+Persistent=true
+Unit=cosift-self-update.service
+
+[Install]
+WantedBy=timers.target

From 68d5a85bde6439009fefd020bded7b5c72caedcc Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:19:53 +0300
Subject: [PATCH 06/11] docs: add handover runbook (secret matrix,
 confidentiality cutover, deploy model)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/HANDOVER.md | 401 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 401 insertions(+)
 create mode 100644 docs/HANDOVER.md

diff --git a/docs/HANDOVER.md b/docs/HANDOVER.md
new file mode 100644
index 0000000..deeb7d6
--- /dev/null
+++ b/docs/HANDOVER.md
@@ -0,0 +1,401 @@
+# cosift — Operational Handover Runbook
+
+**Audience:** the incoming operations agency (the "agency") and the principal (system owner).
+**Scope:** giving the agency operational control of the production cosift system while keeping
+real user queries and responses confidential from the agency.
+**Status of this document:** authoritative handover runbook. Read it end to end before touching prod.
+
+---
+
+## 0. The handover model (read first)
+
+This is the decided model. Everything below implements it.
+
+- **The agency GETS full SSH** to the production GH200 box (host `192.222.56.72`, public name
+  `cosift.pilotprotocol.network`). They operate it: deploy, debug, restart, run admin/offline
+  tooling, manage the harvesters. Box shell is real root-equivalent control of the corpus and service.
+- **Real user queries and responses must stay confidential from the agency.** The resolution has
+  two parts:
+  1. **No on-box persistence of raw queries.** The on-box query log is disabled or redacted, the
+     feedback log is off or redacted, retention is bounded, and no ingress component (Caddy) is
+     allowed to log query-bearing URLs. This removes passive/accidental exposure: an operator who
+     pokes around the box finds no historical record of what users asked.
+  2. **Query observability moves off-box to a principal-controlled passthrough.** A thin reverse
+     proxy that the principal owns fronts all requests, terminates ingress, and is the only place
+     `{query, ts, latency, endpoint}` is recorded — for the principal, not the agency.
+
+### Residual risk — state this plainly to the agency and the principal
+
+The two measures above stop **passive and accidental** exposure. They do **not** stop a determined
+malicious operator. A root operator on the box can:
+
+- attach to the live process or sniff loopback (`127.0.0.1:7777`) traffic and read plaintext
+  queries in flight (`tcpdump -i lo`, `strace`/`bpftrace` on the process, an `LD_PRELOAD` shim, etc.);
+- wiretap or replace the local LLM / embed calls the service makes;
+- add their own logging drop-in and restart the service.
+
+The GH200 still receives **plaintext queries** because it has to search them. Technical hardening
+(no logs, localhost-only admin, redaction) raises the cost and removes the easy/accidental paths,
+but the gap against an active malicious root operator is **closed by contract and trust, not by
+technical means.** Put this in writing in the operating agreement. Do not represent the technical
+controls as making queries cryptographically invisible to the operator — they do not.
+
+---
+
+## 1. Secret-ownership matrix
+
+Three ownership classes:
+
+- **principal-only** — only the principal holds the value. Never enters CI, never enters a handover
+  tree, never handed to the agency. (The agency can still *operate* the box; they just don't get the
+  literal secret in their own control plane.)
+- **runtime-on-box** — lives on the box for the service/harvesters to read at runtime. The agency,
+  having SSH, can read these; that is accepted. Keep them out of git and CI.
+- **agency** — the agency owns/rotates it as part of operating the system.
+
+| Secret | Owner | Location | Rotation |
+|---|---|---|---|
+| **OpenAI API key** | principal-only **+** runtime-on-box | **MUST be rotated at handover.** Currently sits in `cosift/.env` (`OPENAI=sk-proj-…`) — that value is compromised by being in the working tree and must be revoked. Move the new key to a systemd `EnvironmentFile` at `/etc/cosift/cosift.env`, owner `root:cosift`, mode `0640`, referenced from `cosift-serve.service`. **Never** in CI, **never** in any handover/git tree, **never** in `.env`. | Rotate now (at handover). Rotate again on any suspected exposure. Principal issues the key; the box reads it. |
+| **`cluster.peer_auth_token`** | runtime-on-box | `/home/ubuntu/cosift.json` (`cluster.peer_auth_token`). Gates **all** `/admin/*` and `/admin/query-log` etc. on the production `pebble-serve` path. **Currently EMPTY → admin gate is skipped.** See §3. | Set at handover; rotate on operator turnover. Same value must be provisioned to the harvesters (§3). |
+| **`server.admin_token`** | runtime-on-box | `/home/ubuntu/cosift.json` (`server.admin_token`). **Note:** this gates only the legacy `serve` path (`internal/server/http.go`). It does **NOT** gate the production `pebble-serve` path — that path uses `cluster.peer_auth_token`. Don't rely on `admin_token` for prod auth. | Low priority; keep set for the legacy path but treat `peer_auth_token` as the real prod gate. |
+| **`crawler.remote_fetcher_token`** | runtime-on-box | `/home/ubuntu/cosift.json` (`crawler.remote_fetcher_token`). Shared Bearer between cosift and any remote fetcher. | On operator turnover. |
+| **`rerank.api_key` / `COHERE_API_KEY` / `VOYAGE_API_KEY`** | runtime-on-box | `rerank.api_key` in `/home/ubuntu/cosift.json`, **or** env `COHERE_API_KEY` / `VOYAGE_API_KEY` (config falls back to env — see `internal/config/config.go` `APIKey`). Put env values in `/etc/cosift/cosift.env` alongside the OpenAI key. | On provider rotation or operator turnover. |
+| **`cosift.pem` (SSH key to the GH200)** | principal-only | Local at `~/Downloads/cosift.pem` (chmod 600). **Never to CI.** CI uses **pull-based** deploy (§4), so the deploy pipeline never needs this key. The agency gets their **own** SSH access (separate key / authorized_keys entry) — do not hand them this exact key; provision per-operator keys so access can be revoked individually. | Rotate when an operator leaves. Per-operator keys make revocation a one-line `authorized_keys` edit. |
+| **ed25519 `cosift-app` publisher key** | principal-only | Principal's machine / secret store. App publishing (the pilot app-store artifact) is **independent of backend deploy** — the agency operating the backend does **not** need this. | Principal-controlled; rotate independently of backend secrets. |
+| **`CANARY_DISPATCH_TOKEN`** | principal-only → replace before repo handover | GitHub repo secret, consumed by `.github/workflows/notify-canary.yml`. **Currently a personal PAT.** Before handing the repo to the agency, **replace it with a scoped app token** (fine-grained, repo-scoped, dispatch-only) so handing over the repo doesn't hand over a personal PAT. | Replace at repo handover; rotate on operator turnover. |
+
+**General rule:** the only secrets that ever reach git or CI are *none of the above*. CI builds and
+signs; it does not hold the SSH key, the OpenAI key, or any runtime secret.
+
+---
+
+## 2. Confidentiality / no-persistence cutover (do this AT handover)
+
+Concrete steps to take on the box before the agency gets the keys.
+
+### 2.1 Disable (or redact) on-box raw query logging
+
+The query log is controlled by the `COSIFT_QUERY_LOG` env var. On prod it is enabled via a systemd
+drop-in. Two acceptable resolutions — **pick one** (open decision, see §7):
+
+**Option A — disable entirely (simplest, recommended for clean confidentiality):**
+
+```bash
+# Remove the drop-in that sets COSIFT_QUERY_LOG.
+sudo rm /etc/systemd/system/cosift-serve.service.d/zz-query-log.conf
+sudo systemctl daemon-reload
+sudo systemctl restart cosift-serve     # 4–5 min HNSW reload — see §4
+```
+
+With `COSIFT_QUERY_LOG` unset, `s.qlogFile == nil` and `qlog()` is a no-op (see
+`cmd/cosift/querylog.go`). `/admin/query-log` then returns `501 query log disabled`. The feedback
+log keys off the same var (`cmd/cosift/feedback.go`), so it goes dark too.
+
+**Option B — keep observability but redact (if the principal wants on-box latency/empty-rate signal):**
+
+Edit `cmd/cosift/querylog.go` so the persisted record cannot reconstruct a user's query or identity:
+
+- hash or truncate the `Q` field (e.g. store `sha256(q)[:8]` or just the length, not the text);
+- drop the `Caller` field entirely (it is `X-Forwarded-For` / `RemoteAddr` today — that is the
+  user's IP).
+
+This keeps `{ts, ep, status, ms, bytes}` for health/perf while removing the query text and caller IP.
+Rebuild and deploy via §4.
+
+> **Note:** Option B still leaves the *hashed* query on the box, which is a confirmation oracle for a
+> guessed query. Prefer Option A unless the principal specifically needs on-box query observability —
+> and remember the principal passthrough (§5) is the *intended* home for query observability anyway.
+
+### 2.2 Feedback log
+
+`COSIFT_FEEDBACK_LOG` (or the default beside the query log) records feedback rows. Ensure it is
+**off** (unset) or redacted the same way as §2.1. Under Option A it is already off because the
+feedback path is gated on `COSIFT_QUERY_LOG` being set.
+
+### 2.3 Bound retention on anything that remains
+
+The code has **no retention/rotation** for the query/feedback logs — `writeQueryLog` only appends
+(`cmd/cosift/querylog.go`). If any log remains (Option B, or operational logs), impose retention at
+the OS level so nothing accumulates indefinitely:
+
+```bash
+# /etc/logrotate.d/cosift
+/var/log/cosift/*.log /home/ubuntu/cosift-data/*.jsonl {
+  daily
+  rotate 3
+  compress
+  missingok
+  notifempty
+  copytruncate
+}
+```
+
+Tune `rotate`/frequency to the principal's retention policy. Under Option A there is nothing to rotate
+here, but keep the rule in place as a backstop.
+
+### 2.4 Embed-cache is a timing / confirmation oracle — decide
+
+The embedder caches vectors to disk as `sha256(model \x00 text)` named `.vec` files
+(`internal/embed/client.go`). If query embeddings share the cache directory with doc embeddings, the
+**presence of a `.vec` file whose name matches `sha256(model\x00<guessed-query>)`** confirms that
+query was issued, and file mtime leaks *when*. This is a confirmation oracle, not a plaintext leak.
+
+Decision (open — §7):
+
+- **(a) Separate caches:** point query-time embedding at a non-persistent / `tmpfs` cache (or disable
+  caching on the query path) so query embeds leave no on-disk fingerprint; keep the persistent cache
+  for doc/eval embeds only.
+- **(b) Accept it:** if the corpus is huge and queries are short/generic, an attacker must already
+  *guess* the exact query to confirm it. Document the residual oracle and move on.
+
+Default recommendation: separate, if cheap to wire; otherwise accept-and-document.
+
+### 2.5 Forbid a Caddy `log` directive
+
+`GET /search?q=…` and `/answer?q=…` carry the **query in the URL**. A Caddy `log` directive writes
+request URLs to disk — that is a raw query log by another name.
+
+- **FORBID** any `log { ... }` block in the production Caddyfile.
+- The repo's `scripts/Caddyfile.tls` contains a `log { output file … }` block — **do not deploy that
+  variant as-is.** Use the no-log `scripts/Caddyfile` shape (or strip the `log` block) for prod.
+- This applies to any front proxy, including the principal passthrough (§5): there, query logging is
+  *intended* and lives with the principal — but it must not be duplicated on the box.
+
+### 2.6 Already done — public `/admin/*` leak closed
+
+The public exposure of `/admin/*` and `/debug/*` has **already been closed** on the production Caddy
+front via a `handle` block that returns **404 for `/admin/*` and `/debug/*`** from the public
+internet. Record this as **DONE** (it was the URGENT fix). Verify it still holds after any Caddy
+change:
+
+```bash
+curl -s -o /dev/null -w '%{http_code}\n' https://cosift.pilotprotocol.network/admin/query-log   # expect 404
+curl -s -o /dev/null -w '%{http_code}\n' https://cosift.pilotprotocol.network/debug/pprof/        # expect 404
+```
+
+> The repo Caddyfiles (`scripts/Caddyfile*`) predate this block — the live prod Caddyfile on the box
+> is the source of truth for the 404 handles. If you regenerate the Caddyfile from the repo, re-add
+> the `/admin/*` + `/debug/*` 404 handles **and** keep the no-`log` rule (§2.5).
+
+---
+
+## 3. Admin auth SOP
+
+**Current state:** `cluster.peer_auth_token` is **EMPTY** in `/home/ubuntu/cosift.json`. Every admin
+handler on the `pebble-serve` path guards with `if want := s.cluster.PeerAuthToken; want != ""` —
+**empty means the gate is skipped.** Public exposure is blocked by Caddy (§2.6), but locally
+everything is open. Set the token so admin actions require a Bearer even from localhost.
+
+### Procedure
+
+1. **Generate a token** and set it in the config:
+
+   ```bash
+   TOKEN=$(openssl rand -hex 32)
+   # Edit /home/ubuntu/cosift.json: set cluster.peer_auth_token = "$TOKEN"
+   ```
+
+2. **Provision the SAME token to the harvesters.** The harvesters already read a `TOKEN` env var and
+   send `Authorization: Bearer $TOKEN` to the admin endpoints. Put the token in a shared
+   `EnvironmentFile` and reference it from the harvester units:
+
+   ```ini
+   # /etc/cosift/harvester.env   (root:cosift 0640)
+   TOKEN=<the same hex token>
+   ```
+   ```ini
+   # in each deploy/systemd/cosift-*-harvest.service (and *-refresh.service):
+   [Service]
+   EnvironmentFile=/etc/cosift/harvester.env
+   ```
+
+3. **Fix `deploy/harvesters/cosift-compact.sh`.** It calls `POST /admin/hnsw-compact` **without** a
+   token:
+
+   ```bash
+   RESULT=$(curl -s --max-time 1800 -X POST http://127.0.0.1:7777/admin/hnsw-compact)
+   ```
+
+   Once the gate is on, that call gets `401`. Patch it to send the Bearer:
+
+   ```bash
+   RESULT=$(curl -s --max-time 1800 -X POST \
+     -H "Authorization: Bearer ${TOKEN}" \
+     http://127.0.0.1:7777/admin/hnsw-compact)
+   ```
+
+   (and ensure the compact timer unit also pulls `EnvironmentFile=/etc/cosift/harvester.env`).
+
+4. **Restart cosift** to pick up the new config:
+
+   ```bash
+   sudo systemctl restart cosift-serve
+   # 4–5 min HNSW reload (43.9M nodes). Poll until ready:
+   until curl -sf http://127.0.0.1:7777/healthz >/dev/null; do sleep 5; done
+   ```
+
+5. **Keep `/admin/*` and `/debug/pprof` localhost-only.** Caddy already 404s them publicly (§2.6).
+   The Bearer token is defense-in-depth for the loopback surface; the public block is the primary
+   control. Never expose either to the public internet.
+
+---
+
+## 4. Deploy model — signed, pull-based, key-out-of-CI
+
+The deploy pipeline is built so the SSH key never enters CI.
+
+```
+ push to main ─► CI (GitHub Actions, .github/workflows/deploy.yml)
+                   • GOOS=linux GOARCH=arm64 go build
+                   • sign artifact: sha256 + minisign
+                   • publish as a GitHub Release
+                              │
+                              ▼
+ GH200 box-side self-update timer (deploy/systemd + deploy/scripts)
+                   • polls Releases for a new signed artifact
+                   • verifies sha256 + minisign signature
+                   • atomic swap into /home/ubuntu/cosift (keeps cosift.prev)
+                   • restart cosift-serve, health-gate /healthz (up to 10 min for HNSW reload)
+                   • auto-rollback to cosift.prev if /healthz never goes green
+```
+
+**Why pull-based:** the box *pulls* a verified artifact rather than CI *pushing* over SSH. CI holds
+no SSH key and no runtime secret — it only builds and signs. The minisign verify key is public; the
+**signing** key is the principal's (or a CI secret scoped to signing only), never the deploy path's.
+
+**File locations (target layout):**
+
+- `.github/workflows/deploy.yml` — build + sign + publish Release.
+- `deploy/scripts/` — the self-update script (pull, verify sha256+minisign, atomic swap, health-gate,
+  rollback).
+- `deploy/systemd/` — the self-update `.timer` + `.service` units, plus the harvester units already
+  present here.
+
+> **Status note:** today the canonical manual deploy is the build/scp/swap procedure in the GH200
+> reference (build arm64 → `scp` to `/tmp/cosift-new` → `mv` into place → restart). The pull-based
+> pipeline above is the **handover target** so the agency operates without ever holding `cosift.pem`
+> in CI. If `deploy.yml` / `deploy/scripts` are not yet wired when you read this, wire them as part
+> of cutover; until then, deploys go through the agency's own per-operator SSH key, not CI.
+
+### Every binary deploy is a HARD 4–5 minute outage
+
+Single box, synchronous HNSW load (43.9M nodes) on every restart. There is **no rolling deploy** —
+the service is down for the duration of the HNSW reload (4–5 min, allow up to 10 for the health gate).
+**Schedule and communicate every deploy.** Health-gate before declaring success:
+
+```bash
+until curl -sf http://127.0.0.1:7777/healthz >/dev/null; do sleep 5; done   # {"status":"ok"} when ready
+```
+
+---
+
+## 5. Principal passthrough design
+
+A thin, **principal-controlled** logging reverse proxy fronts **all** requests. This is where query
+observability and feedback live for the principal — it **replaces** the on-box query log removed in §2.
+
+### What it does
+
+- Terminates public ingress (TLS, the `cosift.pilotprotocol.network` hostname).
+- Logs, for the principal only, a minimal record per request: `{query, ts, latency, endpoint}`
+  (plus status / response size if wanted). This is the principal's observability substrate.
+- Forwards the request to the GH200 (`127.0.0.1:7777` via a private tunnel, or the box's private
+  address) and streams the response back.
+- Owns retention of *its* log per the principal's policy — this log lives on a host the **agency does
+  not control.**
+
+### Hosting options (trade-offs) — the host is an OPEN DECISION for the principal (§7)
+
+| Option | What it is | Pros | Cons |
+|---|---|---|---|
+| **(a) Small principal VPS** running Caddy / nginx / a tiny Go proxy | A cheap box the principal owns, in front of the GH200 | Full control of logging + retention; arbitrary logic; no third party | Principal runs another box; a hop of latency; needs its own TLS + uptime |
+| **(b) Cloudflare Worker** in front | The site is **already behind Cloudflare** — add a Worker that logs `{query, ts, latency, endpoint}` to principal-owned storage (KV / R2 / Logpush) | Zero new infra; rides existing Cloudflare ingress; global edge | Logging logic constrained to the Worker model; observability data sits in Cloudflare (principal-owned, but third-party-hosted) |
+| **(c) Local Mac pilot-daemon path** for overlay traffic | For requests arriving over the pilot overlay, the principal's local pilot daemon is already the entry point and can log there | Reuses an existing principal-controlled hop; natural for overlay/app-store traffic | Only covers overlay traffic, not public-web HTTPS hits; the Mac must be up |
+
+A combination is reasonable: (b) for public web traffic (it's already the front), (c) for overlay
+traffic, with (a) as the fallback if the principal wants logging logic Cloudflare can't express.
+
+### Hard limit — the passthrough relocates observability, it does NOT hide queries from the box
+
+The GH200 **still receives plaintext queries** — it has to, to search them. The passthrough moves
+the *observability record* to a principal-controlled host and removes it from the box; it does
+**not** prevent the box from seeing each query in plaintext at request time. That is exactly the
+residual-risk point in §0: confidentiality from the agency rests on (no on-box persistence) +
+(observability off-box) + (contract/trust for the live-traffic gap). Don't oversell the passthrough.
+
+---
+
+## 6. Control-surface reference
+
+What "the agency gets SSH" actually grants.
+
+### Public endpoints (fronted by Caddy / the passthrough)
+
+`/search` · `/answer` · `/research` · `/find` · `/stats` · `/healthz` · `/metrics` · `/feedback`
+
+These are the user-facing API (`cmd/cosift/pebble_serve.go`). Note `/search?q=` and `/answer?q=`
+carry queries in the URL — the reason §2.5 forbids any front-proxy `log` directive on the box.
+
+### Admin endpoints (24, localhost-only, Bearer-gated by `peer_auth_token`)
+
+All under `/admin/*` on `pebble-serve`, e.g.:
+`crawl-enqueue`, `allow-domain`, `frontier-purge-host`, `frontier-clear`, `frontier-demote-host`,
+`frontier-purge-stale-inflight`, `rss-import`, `crawl-now`, `wet-import`, `wet-import-bulk`,
+`site-pack`, `site-submit`, `embed-backfill`, `host-backfill`, `eval-quick`, `hnsw-compact`,
+`sitemap-import`, `recrawl-sitemap`, `pq-train`, `pq-encode`, `checkpoint`, `query-log`, `feedback`,
+`domains-audit`. Plus `/debug/pprof/*`. **Public access to all of these is 404'd by Caddy** (§2.6);
+local access is gated by `peer_auth_token` once §3 is done.
+
+### Offline subcommands bypass HTTP auth entirely
+
+`purge-domain`, `purge-adult`, `frontier-clear`, `gc`, `reembed` (and similar) are **CLI
+subcommands** in `cmd/cosift/main.go` that open the Pebble store **directly on disk**
+(`openPebbleOrFriendlyErr`). They **do not** go through the HTTP server, so **no token gates them** —
+they need only **disk access** to the data dir (`/home/ubuntu/cosift-data/pebble`).
+
+**Implication:** **box shell == full corpus-mutation power.** Anyone with SSH and disk access can
+purge domains, wipe the frontier, garbage-collect, or re-embed the entire corpus with zero auth.
+This is the core of what "agency gets SSH" grants — it is total operational control of the corpus,
+not just the HTTP surface. Treat SSH access as the real trust boundary, and gate it per-operator
+(§1) so it can be revoked individually.
+
+> Pebble is single-writer: offline subcommands that mutate the store **cannot** run while
+> `cosift-serve` holds the lock. Stop the service first (incurring the §4 outage), or use the
+> equivalent admin endpoint against the live process where one exists (e.g. `host-backfill`).
+
+---
+
+## 7. Open decisions for the principal (decide before cutover)
+
+1. **Query-log resolution (§2.1):** Option A (disable entirely) vs Option B (redact: hash/truncate
+   `q`, drop `Caller`). Recommendation: A, since the passthrough (§5) is the intended observability home.
+2. **Embed-cache oracle (§2.4):** separate query-embeds from doc-embeds (tmpfs / disable on query
+   path) vs accept-and-document the confirmation oracle.
+3. **Passthrough host (§5):** (a) principal VPS, (b) Cloudflare Worker, (c) Mac pilot-daemon — or a
+   combination. This determines where the principal's query observability physically lives.
+4. **Per-operator SSH provisioning (§1):** confirm the agency gets per-operator keys (revocable
+   individually), not a shared copy of `cosift.pem`.
+
+---
+
+## 8. Cutover checklist (one pass, in order)
+
+- [ ] **Rotate the OpenAI key**; revoke the old `sk-proj-…` from `.env`; write the new one to
+      `/etc/cosift/cosift.env` (`root:cosift 0640`); point `cosift-serve.service` at it; remove the
+      key from `.env`.
+- [ ] Move `COHERE_API_KEY` / `VOYAGE_API_KEY` into `/etc/cosift/cosift.env` too.
+- [ ] **Resolve the query log** (§2.1, Option A or B) + ensure feedback log off/redacted (§2.2).
+- [ ] Install the `logrotate` backstop (§2.3).
+- [ ] Decide + apply the embed-cache choice (§2.4).
+- [ ] Confirm **no `log` directive** in the prod Caddyfile (§2.5).
+- [ ] Verify `/admin/*` and `/debug/*` still **404 publicly** (§2.6).
+- [ ] **Set `cluster.peer_auth_token`** in `cosift.json`; provision the same token to harvesters via
+      `EnvironmentFile`; **patch `cosift-compact.sh`** to send the Bearer (§3).
+- [ ] Stand up the **principal passthrough** on the chosen host; point it at the GH200; confirm it
+      logs `{query, ts, latency, endpoint}` to principal-owned storage (§5).
+- [ ] Replace `CANARY_DISPATCH_TOKEN` (personal PAT → scoped app token) **before** repo handover (§1).
+- [ ] Provision **per-operator SSH keys** for the agency; do **not** hand over `cosift.pem`; keep the
+      `cosift-app` publisher key and `cosift.pem` principal-only (§1).
+- [ ] Wire / verify the **pull-based deploy pipeline** so the agency never holds the SSH key in CI (§4).
+- [ ] Restart `cosift-serve`, health-gate `/healthz` (4–5 min HNSW reload), confirm green (§3–§4).
+- [ ] Put the **residual-risk statement (§0)** in the operating agreement in writing.

From ce64cb0c97bbe0c6ce10272a013b44d60702e244 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:29:22 +0300
Subject: [PATCH 07/11] refactor: split pebble_serve.go and main.go into
 logical files

Pure-motion, same-package split for navigability/editability. No behavior
change: every top-level declaration (and its doc comments / //go:embed
directives) was moved verbatim; only per-file import blocks were recomputed
by goimports. Verified byte-identical via a gofmt-normalized decl-multiset
diff. All gates green: go build, go vet, go test (all packages), gofmt -l
(empty), deadcode -test (clean, no new flags).

pebble_serve.go (~8095 lines) -> 7 files:
  serve_setup.go    runPebbleServe, in-process crawl bootstrap, pebbleHTTP
                    type, rate-limit/count middleware, statusCapturingWriter,
                    embedded static assets + their handlers
  serve_search.go   /search /find_similar /query /contents handlers, scatter +
                    gateways, full retrieval pipeline (retrieve*, MMR, RRF,
                    decay, expansion, site boosts)
  serve_answer.go   /answer /research synthesis, SSE, chat/rerank, prompts
  serve_admin.go    PQ encode/train, checkpoint, HNSW compact, eval-quick,
                    host/embed backfill, embed-lite truncation
  serve_crawl.go    crawl-enqueue/now, allow-domain, sitemap/rss/wet import,
                    site-submit/pack, frontier ops, lane helpers
  serve_stats.go    /healthz /stats /metrics /sla /domains /queue /verify
  serve_helpers.go  retrieval filters, site scopes, host/date helpers,
                    writeJSON/writeProblem, pebble verify/info commands

main.go (~6517 lines) -> kept main(), the dispatch switch, usage, version,
usageError, and shared CLI helpers (chunkerWith, resolveAPIKey(s), firstEnv,
contains, truncate, truncStr, abs); subcommands moved to:
  cmd_query.go        query/search/research/answer/find-similar/contents
                      clients + render/SSE consumers
  cmd_admin.go        admin client + stats/status-file/crawl-status
  cmd_eval.go         eval/answer-eval*/bench* + retriever adapters + judge
  cmd_crawl.go        crawl/refresh-due/check-robots/crawl-errors
  cmd_index.go        ingest/export/reembed/compact-index/migrate-to-pebble
  cmd_serve.go        runServe + hnswPassageWriter + authStatus
  cmd_maintenance.go  gc/init/doctor/frontier-trim/seed-tranco/outcomes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cmd/cosift/cmd_admin.go       |  878 ++++
 cmd/cosift/cmd_crawl.go       |  459 ++
 cmd/cosift/cmd_eval.go        | 1842 ++++++++
 cmd/cosift/cmd_index.go       |  819 ++++
 cmd/cosift/cmd_maintenance.go |  720 +++
 cmd/cosift/cmd_query.go       | 1308 ++++++
 cmd/cosift/cmd_serve.go       |  210 +
 cmd/cosift/main.go            | 6135 +------------------------
 cmd/cosift/pebble_serve.go    | 8095 ---------------------------------
 cmd/cosift/serve_admin.go     |  623 +++
 cmd/cosift/serve_answer.go    | 1697 +++++++
 cmd/cosift/serve_crawl.go     |  851 ++++
 cmd/cosift/serve_helpers.go   |  496 ++
 cmd/cosift/serve_search.go    | 2521 ++++++++++
 cmd/cosift/serve_setup.go     | 1396 ++++++
 cmd/cosift/serve_stats.go     |  615 +++
 16 files changed, 14453 insertions(+), 14212 deletions(-)
 create mode 100644 cmd/cosift/cmd_admin.go
 create mode 100644 cmd/cosift/cmd_crawl.go
 create mode 100644 cmd/cosift/cmd_eval.go
 create mode 100644 cmd/cosift/cmd_index.go
 create mode 100644 cmd/cosift/cmd_maintenance.go
 create mode 100644 cmd/cosift/cmd_query.go
 create mode 100644 cmd/cosift/cmd_serve.go
 delete mode 100644 cmd/cosift/pebble_serve.go
 create mode 100644 cmd/cosift/serve_admin.go
 create mode 100644 cmd/cosift/serve_answer.go
 create mode 100644 cmd/cosift/serve_crawl.go
 create mode 100644 cmd/cosift/serve_helpers.go
 create mode 100644 cmd/cosift/serve_search.go
 create mode 100644 cmd/cosift/serve_setup.go
 create mode 100644 cmd/cosift/serve_stats.go

diff --git a/cmd/cosift/cmd_admin.go b/cmd/cosift/cmd_admin.go
new file mode 100644
index 0000000..bd1aa4a
--- /dev/null
+++ b/cmd/cosift/cmd_admin.go
@@ -0,0 +1,878 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/server"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// runAdmin dispatches to a sub-operation under `cosift admin <op>`. Sub-ops
+// share bearer-token resolution: -token flag wins, then COSIFT_ADMIN_TOKEN env.
+// Empty token still hits the server (and gets a clear 401) — the CLI doesn't
+// pre-fail because the operator might be running an instance without admin
+// auth enabled (rare, but the failure path is the server's to own).
+// adminUsageError returns the multi-line help message printed when the
+// `cosift admin` parent is invoked without a subcommand. Listed alphabetically
+// by subcommand name so the output is stable across iterations.
+//
+// Extracted as a function (rather than a const) so tests can assert on the
+// listing's structure — every admin subcommand must appear here, in the same
+// alphabetic order it appears in runAdmin's dispatch switch.
+func adminUsageError() string {
+	return `admin: subcommand required.
+
+Available subcommands:
+  config                   Retriever defaults and capability flags.
+  recrawl <url...>         Re-enqueue specific URLs into the crawl frontier. Requires -y.
+  recrawl-domain <pattern> Bulk re-enqueue every doc matching the domain pattern. Requires -y or -dry-run.
+  reembed                  Re-embed every doc with the configured model (streams progress).
+                           Requires -y. Supports -drop-old and -since DATE.
+  stats                    Index counts, frontier breakdown, top domains, capability flags.
+                           Supports -summary for one-line output (monitoring / shell prompts).
+
+Common flags:
+  -server URL              cosift server URL (default: from local cosift.json)
+  -token TOKEN             admin bearer token (or COSIFT_ADMIN_TOKEN env)
+  -json                    raw JSON output instead of human-readable
+
+Usage: cosift admin <subcommand> [flags]
+`
+}
+
+func runAdmin(ctx context.Context, cfg *config.Config, op string, args []string) error {
+	switch op {
+	case "stats":
+		return runAdminStats(ctx, cfg, args)
+	case "config":
+		return runAdminConfig(ctx, cfg, args)
+	case "recrawl":
+		return runAdminRecrawl(ctx, cfg, args)
+	case "recrawl-domain":
+		return runAdminRecrawlDomain(ctx, cfg, args)
+	case "reembed":
+		return runAdminReembedCLI(ctx, cfg, args)
+	default:
+		return fmt.Errorf("unknown admin subcommand %q (want: stats | config | recrawl | recrawl-domain | reembed)", op)
+	}
+}
+
+// adminCommonFlags parses the -server/-token/-json flags shared by every admin
+// sub-operation. Returns parsed values + the leftover positional args (none for
+// stats/config; future ops like recrawl will have positional URL args).
+type adminCommonOpts struct {
+	server string
+	token  string
+	json   bool
+}
+
+func parseAdminCommon(name string, cfg *config.Config, args []string) (adminCommonOpts, []string, error) {
+	fs := flag.NewFlagSet(name, flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	server := fs.String("server", defaultServer, "cosift server URL")
+	// Token: -token flag overrides env. Env is the secure default — keeps the
+	// token out of shell history / process listings.
+	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
+	if err := fs.Parse(args); err != nil {
+		return adminCommonOpts{}, nil, err
+	}
+	resolvedToken := *token
+	if resolvedToken == "" {
+		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+	}
+	return adminCommonOpts{server: *server, token: resolvedToken, json: *jsonOut}, fs.Args(), nil
+}
+
+// adminRequest builds an authenticated request to the given /admin/* path. The
+// Authorization header is omitted when token is empty (server returns 401,
+// which is the right error to surface).
+func adminRequest(ctx context.Context, method, server, path, token string, body io.Reader) (*http.Request, error) {
+	endpoint := strings.TrimRight(server, "/") + path
+	req, err := http.NewRequestWithContext(ctx, method, endpoint, body)
+	if err != nil {
+		return nil, err
+	}
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	return req, nil
+}
+
+func runAdminStats(ctx context.Context, cfg *config.Config, args []string) error {
+	// inline flag parsing (vs parseAdminCommon) so we can add the
+	// -summary flag. Same shape as runAdminRecrawl's flag set —
+	// admin sub-ops with op-specific flags bypass the common helper.
+	fs := flag.NewFlagSet("admin stats", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response")
+	summary := fs.Bool("summary", false, "one-line compact output for monitoring / shell prompts")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *summary && *jsonOut {
+		return errors.New("-summary and -json are mutually exclusive")
+	}
+	resolvedToken := *token
+	if resolvedToken == "" {
+		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+	}
+
+	req, err := adminRequest(ctx, http.MethodGet, *serverURL, "/admin/stats", resolvedToken, nil)
+	if err != nil {
+		return err
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	var st server.AdminStatsResponse
+	if err := json.Unmarshal(body, &st); err != nil {
+		return fmt.Errorf("decode: %w", err)
+	}
+	if *summary {
+		// Compact one-line format designed for: shell prompts, cron, status
+		// scripts. Always-present fields (docs/queued/errored). Embedder named
+		// only when configured (omitted with " · " to keep separator clean).
+		parts := []string{
+			fmt.Sprintf("%d docs", st.Documents),
+			fmt.Sprintf("%d queued", st.Frontier.Queued),
+			fmt.Sprintf("%d errored", st.Frontier.Errored),
+		}
+		if st.EmbedderModel != "" {
+			parts = append(parts, "embedder="+st.EmbedderModel)
+		}
+		fmt.Println(strings.Join(parts, " · "))
+		return nil
+	}
+	fmt.Println("=== Index ===")
+	fmt.Printf("  Documents:           %d\n", st.Documents)
+	fmt.Printf("  Terms:               %d\n", st.Terms)
+	fmt.Printf("  Passages:            %d\n", st.Passages)
+	if st.DocsWithPublishedAt > 0 {
+		pct := float64(st.DocsWithPublishedAt) / float64(st.Documents) * 100
+		fmt.Printf("  Docs w/ published_at: %d (%.1f%%)\n", st.DocsWithPublishedAt, pct)
+	}
+	// LLM-cache sizes. Show only when populated — a fresh
+	// deployment with no LLM cache yet shouldn't bloat the dashboard.
+	if st.Paraphrases > 0 || st.HyDECache > 0 {
+		fmt.Println()
+		fmt.Println("=== LLM caches ===")
+		if st.Paraphrases > 0 {
+			fmt.Printf("  Paraphrases:         %d\n", st.Paraphrases)
+		}
+		if st.HyDECache > 0 {
+			fmt.Printf("  HyDE passages:       %d\n", st.HyDECache)
+		}
+	}
+	fmt.Println()
+	fmt.Println("=== Frontier ===")
+	fmt.Printf("  Queued:    %d\n", st.Frontier.Queued)
+	fmt.Printf("  In-flight: %d\n", st.Frontier.InFlight)
+	fmt.Printf("  Done:      %d\n", st.Frontier.Done)
+	fmt.Printf("  Errored:   %d\n", st.Frontier.Errored)
+	fmt.Println()
+	fmt.Println("=== Capabilities ===")
+	fmt.Printf("  Dense:    %t\n", st.DenseEnabled)
+	fmt.Printf("  Answer:   %t\n", st.AnswerEnabled)
+	fmt.Printf("  Fetcher:  %t\n", st.FetcherEnabled)
+	if st.EmbedderModel != "" {
+		fmt.Printf("  Embedder: %s\n", st.EmbedderModel)
+	}
+	if st.ChatModel != "" {
+		fmt.Printf("  Chat:     %s\n", st.ChatModel)
+	}
+	if st.RerankerName != "" {
+		fmt.Printf("  Reranker: %s\n", st.RerankerName)
+	}
+	if len(st.TopDomains) > 0 {
+		fmt.Println()
+		fmt.Println("=== Top Domains ===")
+		// Map iteration order is random; sort by count desc, then domain asc.
+		type kv struct {
+			k string
+			v int64
+		}
+		pairs := make([]kv, 0, len(st.TopDomains))
+		for k, v := range st.TopDomains {
+			pairs = append(pairs, kv{k, v})
+		}
+		sort.Slice(pairs, func(i, j int) bool {
+			if pairs[i].v != pairs[j].v {
+				return pairs[i].v > pairs[j].v
+			}
+			return pairs[i].k < pairs[j].k
+		})
+		for _, p := range pairs {
+			fmt.Printf("  %-32s %d\n", p.k, p.v)
+		}
+	}
+	return nil
+}
+
+func runAdminConfig(ctx context.Context, cfg *config.Config, args []string) error {
+	opts, _, err := parseAdminCommon("admin config", cfg, args)
+	if err != nil {
+		return err
+	}
+	req, err := adminRequest(ctx, http.MethodGet, opts.server, "/admin/config", opts.token, nil)
+	if err != nil {
+		return err
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", opts.server, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+	if opts.json {
+		fmt.Println(string(body))
+		return nil
+	}
+	var cfgResp server.AdminConfigResponse
+	if err := json.Unmarshal(body, &cfgResp); err != nil {
+		return fmt.Errorf("decode: %w", err)
+	}
+	fmt.Printf("Cosift version: %s\n\n", cfgResp.Version)
+	fmt.Println("=== Defaults ===")
+	d := cfgResp.Defaults
+	fmt.Printf("  Retriever: %s\n", d.Retriever)
+	fmt.Printf("  Expand:    %t\n", d.Expand)
+	fmt.Println()
+	fmt.Println("=== Capabilities ===")
+	c := cfgResp.Capabilities
+	fmt.Printf("  Dense:        %t\n", c.DenseEnabled)
+	fmt.Printf("  Chat:         %t\n", c.ChatEnabled)
+	fmt.Printf("  Rerank:       %t\n", c.RerankEnabled)
+	fmt.Printf("  Paraphraser:  %t\n", c.ParaphraserEnabled)
+	fmt.Printf("  Fetcher:      %t\n", c.FetcherEnabled)
+	fmt.Printf("  Admin:        %t\n", c.AdminEnabled)
+	if c.EmbedderModel != "" {
+		fmt.Printf("  Embedder model:  %s\n", c.EmbedderModel)
+	}
+	if c.ChatModel != "" {
+		fmt.Printf("  Chat model:      %s\n", c.ChatModel)
+	}
+	if c.RerankerName != "" {
+		fmt.Printf("  Reranker name:   %s\n", c.RerankerName)
+	}
+	return nil
+}
+
+// runAdminRecrawl re-enqueues the given URLs into the crawler frontier. First
+// destructive admin operation — requires `-y` to confirm. URLs come from
+// positional args, `-file`, or both (mirrors's `contents` CLI pattern).
+func runAdminRecrawl(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("admin recrawl", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
+	filePath := fs.String("file", "", "read URLs from FILE (one per line, # comments allowed)")
+	confirm := fs.Bool("y", false, "confirm the destructive operation (recrawl re-enqueues URLs into the frontier)")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	urls := fs.Args()
+	if *filePath != "" {
+		extra, err := readURLsFromFile(*filePath)
+		if err != nil {
+			return fmt.Errorf("read -file: %w", err)
+		}
+		urls = append(urls, extra...)
+	}
+	if len(urls) == 0 {
+		return errors.New("at least one URL or -file required")
+	}
+	if !*confirm {
+		return fmt.Errorf("admin recrawl is destructive (re-enqueues %d URL(s) into the crawl frontier). Add -y to confirm", len(urls))
+	}
+
+	resolvedToken := *token
+	if resolvedToken == "" {
+		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+	}
+
+	reqBody, err := json.Marshal(server.AdminRecrawlRequest{URLs: urls})
+	if err != nil {
+		return err
+	}
+	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/recrawl", resolvedToken, bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	client := &http.Client{Timeout: 60 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("post %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	var rr server.AdminRecrawlResponse
+	if err := json.Unmarshal(body, &rr); err != nil {
+		return fmt.Errorf("decode: %w", err)
+	}
+	fmt.Printf("Queued %d URL(s) for recrawl.\n", len(rr.Queued))
+	if len(rr.Errors) > 0 {
+		fmt.Printf("\n%d URL(s) failed to enqueue:\n", len(rr.Errors))
+		// Sort error URLs for stable output across runs.
+		keys := make([]string, 0, len(rr.Errors))
+		for k := range rr.Errors {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, u := range keys {
+			fmt.Printf("  %s: %s\n", u, rr.Errors[u])
+		}
+	}
+	return nil
+}
+
+// runAdminRecrawlDomain bulk-recrawls every doc whose domain matches `pattern`
+// (positional arg). Wraps's /admin/recrawl-by-domain endpoint. Requires
+// `-y` to commit or `-dry-run` to preview the matched count without queuing.
+// If both flags are set, `-dry-run` wins (safer-on-conflict).
+func runAdminRecrawlDomain(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("admin recrawl-domain", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
+	confirm := fs.Bool("y", false, "confirm the destructive operation (recrawl every matching URL)")
+	dryRun := fs.Bool("dry-run", false, "enumerate matched URLs without queuing — preview the blast radius")
+	// cap dry-run URL listing to avoid console spam on large matches.
+	// 0 = no list (count only — behavior). 20 = default safe cap.
+	// -1 = unlimited (operator explicitly wants the full list).
+	listLimit := fs.Int("limit-list", 20, "in dry-run mode, max URLs to print (0 = count only, -1 = unlimited)")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if fs.NArg() < 1 {
+		return errors.New("domain pattern required (positional arg)")
+	}
+	if fs.NArg() > 1 {
+		return errors.New("only one domain pattern supported per call")
+	}
+	pattern := fs.Arg(0)
+
+	if !*confirm && !*dryRun {
+		return fmt.Errorf("admin recrawl-domain is destructive (would re-enqueue every URL matching %q). Add -y to commit or -dry-run to preview", pattern)
+	}
+
+	resolvedToken := *token
+	if resolvedToken == "" {
+		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+	}
+
+	// dry-run wins when both flags are set. Operator who typed both probably
+	// meant the safer option; the destructive interpretation requires they
+	// explicitly drop -dry-run.
+	effectiveDryRun := *dryRun
+
+	reqBody, err := json.Marshal(server.AdminRecrawlByDomainRequest{
+		Domain: pattern,
+		DryRun: effectiveDryRun,
+	})
+	if err != nil {
+		return err
+	}
+	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/recrawl-by-domain", resolvedToken, bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	client := &http.Client{Timeout: 120 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("post %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	var rr server.AdminRecrawlByDomainResponse
+	if err := json.Unmarshal(body, &rr); err != nil {
+		return fmt.Errorf("decode: %w", err)
+	}
+	if effectiveDryRun {
+		fmt.Printf("Dry-run: %d URL(s) match %q. Re-run with -y (not -dry-run) to queue them.\n", rr.Matched, rr.Domain)
+		// -limit-list 0 → count only. -limit-list -1 → unlimited (operator
+		// wants the full list, accepts console spam). Otherwise: print up
+		// to listLimit and append a "... (N more)" suffix.
+		if *listLimit != 0 && len(rr.URLs) > 0 {
+			n := *listLimit
+			if n < 0 || n > len(rr.URLs) {
+				n = len(rr.URLs)
+			}
+			for _, u := range rr.URLs[:n] {
+				fmt.Printf("  %s\n", u)
+			}
+			if remaining := len(rr.URLs) - n; remaining > 0 {
+				fmt.Printf("  ... (%d more — use -limit-list -1 to see all)\n", remaining)
+			}
+		}
+		return nil
+	}
+	fmt.Printf("Queued %d/%d URL(s) for recrawl matching %q.\n", rr.Queued, rr.Matched, rr.Domain)
+	if len(rr.Errors) > 0 {
+		fmt.Printf("\n%d URL(s) failed to enqueue:\n", len(rr.Errors))
+		keys := make([]string, 0, len(rr.Errors))
+		for k := range rr.Errors {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, u := range keys {
+			fmt.Printf("  %s: %s\n", u, rr.Errors[u])
+		}
+	}
+	return nil
+}
+
+// runAdminReembedCLI triggers a server-side reembed via the
+// `/admin/reembed` SSE endpoint. Requires `-y` to commit (reembed costs
+// LLM credits; same destructive-op guard pattern as other admin verbs).
+// `-drop-old` propagates to the server's `DropPassagesNotModel` step.
+func runAdminReembedCLI(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("admin reembed", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
+	dropOld := fs.Bool("drop-old", false, "also delete passages from other models after re-embedding")
+	// -since restricts reembed to docs published >= DATE. Client-side
+	// validation catches malformed dates before the HTTP call (saves a round-trip
+	// for the common typo case).
+	since := fs.String("since", "", "ISO date — only re-embed docs published >= this. Drops undated docs when set")
+	confirm := fs.Bool("y", false, "confirm the operation (reembed re-runs every embedding call; counts as LLM spend)")
+	// -dry-run shows the would-be-processed count without spending
+	// LLM credits. Either -y OR -dry-run is required.
+	dryRun := fs.Bool("dry-run", false, "preview the count of docs that would be re-embedded, without actually embedding")
+	jsonOut := fs.Bool("json", false, "emit raw SSE response instead of human-readable progress lines")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	// Validate -since client-side before checking -y, so operators see "bad
+	// date" before they've committed with -y (clearer iteration).
+	if _, err := parseExportDate(*since); err != nil {
+		return fmt.Errorf("-since: %w", err)
+	}
+	// dry-run wins when both flags set (safer-on-conflict, matches
+	// pattern on /admin/recrawl-by-domain).
+	effectiveDryRun := *dryRun
+	if !*confirm && !*dryRun {
+		guard := "every doc"
+		if *dropOld {
+			guard = "every doc AND drop other-model passages"
+		}
+		if *since != "" {
+			guard = "every doc published >= " + *since
+			if *dropOld {
+				guard += " AND drop other-model passages"
+			}
+		}
+		return fmt.Errorf("admin reembed will re-embed %s (counts as LLM spend). Add -y to commit or -dry-run to preview", guard)
+	}
+
+	resolvedToken := *token
+	if resolvedToken == "" {
+		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+	}
+
+	reqBody, err := json.Marshal(server.AdminReembedRequest{
+		DropOld: *dropOld,
+		Since:   *since,
+		DryRun:  effectiveDryRun,
+	})
+	if err != nil {
+		return err
+	}
+	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/reembed", resolvedToken, bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "text/event-stream")
+	// Reembed can run for tens of minutes on large corpora. Bump the HTTP
+	// client timeout well past the synth CLIs; the server emits keep-alive
+	// progress events every ~2s so the connection stays warm.
+	client := &http.Client{Timeout: 60 * time.Minute}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("post %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
+		return fmt.Errorf("server %d: %s", resp.StatusCode, b)
+	}
+	if *jsonOut {
+		// In JSON mode, just stream the raw SSE bytes through to stdout. Useful
+		// for piping into a custom parser or log file. Different shape from the
+		// other admin CLIs' -json because reembed has no terminal JSON blob —
+		// the event stream IS the response.
+		_, err := io.Copy(os.Stdout, resp.Body)
+		return err
+	}
+	return consumeReembedSSE(resp.Body)
+}
+
+// consumeReembedSSE reads /admin/reembed events and renders progress lines.
+// third SSE consumer in the CLI (after research and
+// answer), reusing the forEachSSEEvent scanner.
+func consumeReembedSSE(body io.Reader) error {
+	var sawDone bool
+	// track the started event's total_docs and target_model so the
+	// dry-run done-event branch can reference them (the dry-run done payload
+	// reports zeros for processed/passages, but the meaningful count is in started).
+	var startedTotal int
+	var startedTarget string
+
+	err := forEachSSEEvent(body, func(event, data string) error {
+		switch event {
+		case "started":
+			var s struct {
+				TotalDocs   int    `json:"total_docs"`
+				TargetModel string `json:"target_model"`
+			}
+			if err := json.Unmarshal([]byte(data), &s); err != nil {
+				return nil // tolerate malformed mid-stream event
+			}
+			startedTotal = s.TotalDocs
+			startedTarget = s.TargetModel
+			fmt.Printf("[reembed started: %d docs, target=%s]\n", s.TotalDocs, s.TargetModel)
+		case "progress":
+			var p struct {
+				DocsProcessed   int `json:"docs_processed"`
+				PassagesWritten int `json:"passages_written"`
+			}
+			if err := json.Unmarshal([]byte(data), &p); err != nil {
+				return nil
+			}
+			fmt.Printf("[progress: %d docs, %d passages]\n", p.DocsProcessed, p.PassagesWritten)
+		case "done":
+			sawDone = true
+			var d struct {
+				DocsProcessed   int    `json:"docs_processed"`
+				PassagesWritten int    `json:"passages_written"`
+				DroppedOld      int64  `json:"dropped_old"`
+				DryRun          bool   `json:"dry_run,omitempty"`
+				Took            string `json:"took"`
+			}
+			if err := json.Unmarshal([]byte(data), &d); err != nil {
+				return fmt.Errorf("parse done event: %w", err)
+			}
+			if d.DryRun {
+				// dry-run summary — reference the started event's
+				// count (the meaningful "would-be-processed" number).
+				fmt.Printf("Dry-run: %d docs would be re-embedded with target=%s. Re-run without -dry-run (or with -y) to actually do it.\n",
+					startedTotal, startedTarget)
+			} else {
+				fmt.Printf("Done: %d docs reembedded, %d passages written, %d dropped, took %s.\n",
+					d.DocsProcessed, d.PassagesWritten, d.DroppedOld, d.Took)
+			}
+			return errSSEDone
+		case "error":
+			var e struct {
+				Detail string `json:"detail"`
+			}
+			_ = json.Unmarshal([]byte(data), &e)
+			return fmt.Errorf("server stream error: %s", e.Detail)
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	if !sawDone {
+		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
+	}
+	return nil
+}
+
+// peekWarnings extracts the warnings field from a server
+// response body without committing to a full typed decode. When the CLI hits
+// pebble-serve, the response carries a warnings[] slice naming silent no-ops
+// (unknown expand, rerank without reranker, malformed include_domains, etc).
+// Without surfacing these on stderr the human CLI mode swallows them.
+func peekWarnings(body []byte) []string {
+	var probe struct {
+		Warnings []string `json:"warnings"`
+	}
+	if err := json.Unmarshal(body, &probe); err != nil {
+		return nil
+	}
+	return probe.Warnings
+}
+
+// emitWarnings prints each warning to stderr with a 'cosift:' prefix.
+func emitWarnings(body []byte) {
+	for _, w := range peekWarnings(body) {
+		fmt.Fprintln(os.Stderr, "cosift: warning:", w)
+	}
+}
+
+func runStats(ctx context.Context, cfg *config.Config, args []string) error {
+	// -backend flag (-backend=pebble reads the Pebble subdir).
+	fs := flag.NewFlagSet("stats", flag.ExitOnError)
+	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	switch *backend {
+	case "sqlite", "":
+		s, err := store.Open(cfg.DataDir)
+		if err != nil {
+			return err
+		}
+		defer s.Close()
+		stats, err := s.Stats(ctx)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("documents: %d\nterms: %d\ndata_dir: %s\nbackend: sqlite\n",
+			stats.Documents, stats.Terms, cfg.DataDir)
+	case "pebble":
+		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
+		ps, err := openPebbleOrFriendlyErr(pebbleDir)
+		if err != nil {
+			return err
+		}
+		defer ps.Close()
+		stats, err := ps.Stats(ctx)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("documents: %d\ndata_dir: %s\nbackend: pebble\n",
+			stats.Documents, pebbleDir)
+	default:
+		return fmt.Errorf("stats: unknown -backend %q (want: sqlite | pebble)", *backend)
+	}
+	return nil
+}
+
+// runCrawlStatus prints an operator-friendly snapshot of an ongoing crawl:
+// counts, frontier breakdown, top hosts by indexed-doc count, recent error
+// classes, and rolling-window doc rates with a 1M-doc ETA. Safe to run
+// concurrently with a live `cosift crawl` — SQLite WAL mode allows readers
+// alongside the writer.
+// runStatusFile reads the crawl-status.json (the file the live
+// crawler writes every 10s) and pretty-prints it. Useful when an operator
+// can't run `cosift stats -backend=pebble` because Pebble's single-writer
+// lock is held by the crawl process.
+//
+// Default path: <cfg.DataDir>/crawl-status.json. -file flag overrides.
+func runStatusFile(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("status-file", flag.ExitOnError)
+	path := fs.String("file", "", "path to crawl-status.json (defaults to <data_dir>/crawl-status.json)")
+	asJSON := fs.Bool("json", false, "emit raw status JSON plus a derived 'age_seconds' field; suitable for jq / Prometheus")
+	target := fs.Int64("target", 0, "doc count target — show indexed/target progress percent (default 0 = no target line)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	p := *path
+	if p == "" {
+		p = filepath.Join(cfg.DataDir, "crawl-status.json")
+	}
+	buf, err := os.ReadFile(p)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", p, err)
+	}
+	var d struct {
+		Queued             int64     `json:"frontier_queued"`
+		InFlight           int64     `json:"frontier_in_flight"`
+		Done               int64     `json:"frontier_done"`
+		Errored            int64     `json:"frontier_errored"`
+		IndexedDocs        int64     `json:"indexed_docs,omitempty"`
+		IndexedDocsAtStart int64     `json:"indexed_docs_at_start,omitempty"`
+		AvgDocLen          float64   `json:"avg_doc_len,omitempty"`
+		StartedAt          time.Time `json:"started_at,omitempty"`
+		WrittenAt          time.Time `json:"written_at"`
+	}
+	if err := json.Unmarshal(buf, &d); err != nil {
+		return fmt.Errorf("decode %s: %w", p, err)
+	}
+	age := time.Since(d.WrittenAt).Round(time.Second)
+	if *asJSON {
+		out := map[string]any{
+			"path":                  p,
+			"frontier_queued":       d.Queued,
+			"frontier_in_flight":    d.InFlight,
+			"frontier_done":         d.Done,
+			"frontier_errored":      d.Errored,
+			"indexed_docs":          d.IndexedDocs,
+			"indexed_docs_at_start": d.IndexedDocsAtStart,
+			"avg_doc_len":           d.AvgDocLen,
+			"started_at":            d.StartedAt,
+			"written_at":            d.WrittenAt,
+			"age_seconds":           int64(age.Seconds()),
+			"stale":                 age > 30*time.Second,
+		}
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		return enc.Encode(out)
+	}
+	fmt.Printf("status file: %s  (written %s ago)\n\n", p, age)
+	fmt.Printf("  queued:     %d\n", d.Queued)
+	fmt.Printf("  in_flight:  %d\n", d.InFlight)
+	fmt.Printf("  done:       %d\n", d.Done)
+	fmt.Printf("  errored:    %d\n", d.Errored)
+	if d.IndexedDocs > 0 {
+		fmt.Printf("  indexed:    %d (avg doc length: %.0f tokens)\n", d.IndexedDocs, d.AvgDocLen)
+	}
+	total := d.Queued + d.InFlight + d.Done + d.Errored
+	if total > 0 {
+		processed := d.Done + d.Errored
+		fmt.Printf("  processed:  %d / %d (%.1f%%)\n",
+			processed, total, float64(processed)/float64(total)*100)
+	}
+	// ?-target N → 'indexed/target (pct)' line for long crawls toward
+	// a known doc-count goal. No-op when target is unset or already met.
+	// ETA from started_at + indexed_docs_at_start fields.
+	// Rate is averaged since the dumper's first poll, not instantaneous.
+	if *target > 0 && d.IndexedDocs > 0 {
+		pct := float64(d.IndexedDocs) / float64(*target) * 100
+		// cap pct display at 100% and append a 'reached' marker when
+		// the crawl has met or exceeded the goal — operators watching a long
+		// crawl see the win line instead of '237.4%' growing confusingly.
+		switch {
+		case d.IndexedDocs >= *target:
+			fmt.Printf("  target:     %d / %d (100.0%%, reached)\n", d.IndexedDocs, *target)
+		default:
+			fmt.Printf("  target:     %d / %d (%.1f%%)\n", d.IndexedDocs, *target, pct)
+		}
+		gained := d.IndexedDocs - d.IndexedDocsAtStart
+		elapsed := d.WrittenAt.Sub(d.StartedAt)
+		if gained > 0 && elapsed > time.Second && d.IndexedDocs < *target {
+			rate := float64(gained) / elapsed.Seconds()
+			remaining := float64(*target - d.IndexedDocs)
+			eta := time.Duration(remaining/rate) * time.Second
+			fmt.Printf("  rate:       %.1f docs/sec  eta: %s\n", rate, eta.Round(time.Second))
+		}
+	}
+	if age > 30*time.Second {
+		fmt.Printf("\n  WARNING: status is %s old; crawler may have stopped\n", age)
+	}
+	return nil
+}
+
+func runCrawlStatus(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("crawl-status", flag.ExitOnError)
+	hostsN := fs.Int("hosts", 10, "show top N hosts by indexed-doc count")
+	errsN := fs.Int("errors", 8, "show top N distinct error classes")
+	target := fs.Int64("target", 1_000_000, "doc count target for ETA projection")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	r, err := s.CrawlStatus(ctx, *hostsN, *errsN)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("crawl status — %s\n\n", cfg.DataDir)
+	fmt.Printf("  documents:        %d\n", r.Documents)
+	fmt.Printf("  terms:            %d\n", r.Terms)
+	fmt.Printf("  unique hosts:     %d\n", r.UniqueHosts)
+	fmt.Println()
+	fmt.Println("  frontier:")
+	for _, fs := range r.FrontierByStatus {
+		fmt.Printf("    %-12s %d\n", fs.Status, fs.Count)
+	}
+	fmt.Println()
+	fmt.Println("  doc rate (rolling, by fetched_at):")
+	for _, win := range r.RateWindows {
+		ratePerMin := float64(win.Count) / float64(win.WindowSec) * 60.0
+		fmt.Printf("    last %2dmin: %5d docs (%7.0f /min)\n", win.WindowSec/60, win.Count, ratePerMin)
+	}
+	if len(r.RateWindows) > 0 {
+		// Use the longest available rolling window for ETA — most stable signal.
+		win := r.RateWindows[len(r.RateWindows)-1]
+		ratePerMin := float64(win.Count) / float64(win.WindowSec) * 60.0
+		if ratePerMin > 0 {
+			remaining := *target - r.Documents
+			if remaining < 0 {
+				remaining = 0
+			}
+			etaHours := float64(remaining) / ratePerMin / 60.0
+			fmt.Printf("    → ETA to %d docs: %.1f hours = %.2f days (at the %dmin rate)\n",
+				*target, etaHours, etaHours/24.0, win.WindowSec/60)
+		}
+	}
+	if len(r.TopHosts) > 0 {
+		fmt.Printf("\n  top %d hosts (by indexed doc count):\n", len(r.TopHosts))
+		for _, h := range r.TopHosts {
+			fmt.Printf("    %-50s %d\n", truncStr(h.Host, 50), h.Count)
+		}
+	}
+	if len(r.ErrorClasses) > 0 {
+		fmt.Printf("\n  top %d error classes:\n", len(r.ErrorClasses))
+		for _, e := range r.ErrorClasses {
+			fmt.Printf("    %-60s %d\n", truncStr(e.LastError, 60), e.Count)
+		}
+	}
+	return nil
+}
diff --git a/cmd/cosift/cmd_crawl.go b/cmd/cosift/cmd_crawl.go
new file mode 100644
index 0000000..c71b4b9
--- /dev/null
+++ b/cmd/cosift/cmd_crawl.go
@@ -0,0 +1,459 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/authority"
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/crawler"
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+func runCrawl(ctx context.Context, cfg *config.Config, args []string) error {
+	// hoisted PebbleStore handle so the embedder wiring below can
+	// reach it to attach the HNSW bridge after the backend switch.
+	var pebbleStoreForCrawl *store.PebbleStore
+	fs := flag.NewFlagSet("crawl", flag.ExitOnError)
+	refresh := fs.Bool("refresh", false, "force re-crawl of URLs already in the frontier")
+	sitemap := fs.String("sitemap", "", "URL of a sitemap.xml (or sitemap index) to seed from")
+	seedsFile := fs.String("seeds-file", "", "path to a text file with one seed URL per line (blank lines and # comments ignored)")
+	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
+	duration := fs.Duration("duration", 0, "stop the crawl cleanly after this much time (0 = run until frontier empty or SIGTERM)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	urls := fs.Args()
+	// -seeds-file lets operators target specific websites in bulk
+	// without stuffing dozens of URLs on the command line. Each non-blank,
+	// non-comment line is treated as a seed.
+	if *seedsFile != "" {
+		buf, err := os.ReadFile(*seedsFile)
+		if err != nil {
+			return fmt.Errorf("read -seeds-file %s: %w", *seedsFile, err)
+		}
+		for _, line := range strings.Split(string(buf), "\n") {
+			s := strings.TrimSpace(line)
+			if s == "" || strings.HasPrefix(s, "#") {
+				continue
+			}
+			urls = append(urls, s)
+		}
+		log.Printf("crawler: loaded %d seeds from %s (after dedup of positional args, total queued = %d)", len(urls)-fs.NArg(), *seedsFile, len(urls))
+	}
+	if len(urls) == 0 && *sitemap == "" {
+		return errors.New("crawl: at least one URL, -seeds-file, or -sitemap is required")
+	}
+
+	// Wraps the caller's ctx with a
+	// timeout; workers see ctx.Err() != nil and exit cleanly. Pebble flushes
+	// on Close (via the deferred ps.Close() below) so durability is preserved.
+	if *duration > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, *duration)
+		defer cancel()
+		log.Printf("crawler: bounded run, will stop after %s", *duration)
+	}
+
+	var c *crawler.Crawler
+	switch *backend {
+	case "sqlite", "":
+		s, err := store.Open(cfg.DataDir)
+		if err != nil {
+			return err
+		}
+		defer s.Close()
+		c = crawler.New(cfg.Crawler, s)
+	case "pebble":
+		// route through the  Pebble path. The
+		// data dir layout under cfg.DataDir for Pebble: a sibling "pebble"
+		// subdir so SQLite and Pebble stores can coexist during migration.
+		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
+		var err error
+		pebbleStoreForCrawl, err = openPebbleOrFriendlyErr(pebbleDir)
+		if err != nil {
+			return err
+		}
+		defer pebbleStoreForCrawl.Close()
+		c = crawler.NewWithBackend(cfg.Crawler, pebbleStoreForCrawl, index.NewPebbleBM25(pebbleStoreForCrawl))
+		log.Printf("crawler: pebble backend at %s", pebbleDir)
+	default:
+		return fmt.Errorf("crawl: unknown -backend %q (want: sqlite | pebble)", *backend)
+	}
+
+	// Authority-weighted frontier priority: load Tranco / Majestic CSVs when
+	// configured. The scorer is read-only after loading — safe to share with
+	// the crawler's concurrent worker pool.
+	if cfg.Crawler.AuthorityPriority {
+		scorer := authority.New()
+		if cfg.Crawler.AuthorityTrancoCSV != "" {
+			f, ferr := os.Open(cfg.Crawler.AuthorityTrancoCSV)
+			if ferr != nil {
+				log.Printf("crawler: authority: open tranco csv %s: %v (skipping)", cfg.Crawler.AuthorityTrancoCSV, ferr)
+			} else {
+				n, lerr := scorer.LoadTranco(f)
+				_ = f.Close()
+				if lerr != nil {
+					log.Printf("crawler: authority: load tranco: %v (skipping)", lerr)
+				} else {
+					log.Printf("crawler: authority: loaded %d tranco entries from %s", n, cfg.Crawler.AuthorityTrancoCSV)
+				}
+			}
+		}
+		if cfg.Crawler.AuthorityMajesticCSV != "" {
+			f, ferr := os.Open(cfg.Crawler.AuthorityMajesticCSV)
+			if ferr != nil {
+				log.Printf("crawler: authority: open majestic csv %s: %v (skipping)", cfg.Crawler.AuthorityMajesticCSV, ferr)
+			} else {
+				n, lerr := scorer.LoadMajestic(f)
+				_ = f.Close()
+				if lerr != nil {
+					log.Printf("crawler: authority: load majestic: %v (skipping)", lerr)
+				} else {
+					log.Printf("crawler: authority: loaded %d majestic entries from %s", n, cfg.Crawler.AuthorityMajesticCSV)
+				}
+			}
+		}
+		// Even without CSV data the embedded whitelist in authority.New() gives
+		// known-good sites (arxiv, MDN, Wikipedia, kernel.org, …) a priority boost.
+		c = c.WithAuthority(scorer)
+		log.Printf("crawler: authority-weighted frontier priority enabled (tranco=%s majestic=%s)",
+			cfg.Crawler.AuthorityTrancoCSV, cfg.Crawler.AuthorityMajesticCSV)
+	}
+
+	// Auto-wire embedder when configured. For the Pebble backend, also
+	// build and persist an HNSW graph via the hnswPassageWriter bridge
+	// — that's the path /search?retriever=dense
+	// needs and that pre was a documented no-op.
+	// API key is OPTIONAL when cfg.Embeddings.URL points at a
+	// custom endpoint (Ollama / vLLM / TEI / etc — local self-hosted
+	// embedders don't need a Bearer token). Required only when hitting the
+	// default OpenAI endpoint.
+	if cfg.Embeddings.Model != "" {
+		apiKey := resolveEmbedAPIKey()
+		needsKey := cfg.Embeddings.URL == "" // default OpenAI requires a key
+		if apiKey != "" || !needsKey {
+			dim := cfg.Embeddings.Dim
+			if dim == 0 {
+				dim = 1536
+			}
+			emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
+			c = c.WithEmbedder(emb)
+			authStatus := "anonymous"
+			if apiKey != "" {
+				authStatus = "bearer-token"
+			}
+			log.Printf("crawler: dense embeddings enabled (model=%s, dim=%d, auth=%s)", cfg.Embeddings.Model, dim, authStatus)
+			if pebbleStoreForCrawl != nil {
+				h := index.NewHNSW(dim)
+				c = c.WithPassageWriter(&hnswPassageWriter{ps: pebbleStoreForCrawl, hnsw: h})
+				// periodic checkpoint every COSIFT_HNSW_CHECKPOINT_SEC
+				// (default 60s). Without this, a crash / SIGKILL / time-cap
+				// deadline mid-crawl loses all in-memory vectors because Persist
+				// only runs at deferred end-of-crawl. Goroutine exits when
+				// ctx.Done() fires (either deadline or SIGTERM).
+				checkpointEvery := 60 * time.Second
+				if v := os.Getenv("COSIFT_HNSW_CHECKPOINT_SEC"); v != "" {
+					if s, err := strconv.Atoi(v); err == nil && s >= 5 {
+						checkpointEvery = time.Duration(s) * time.Second
+					}
+				}
+				log.Printf("crawler: HNSW vector index attached (in-memory build, checkpoint every %s, final persist at crawl end)", checkpointEvery)
+				ckpDone := make(chan struct{})
+				go func() {
+					defer close(ckpDone)
+					t := time.NewTicker(checkpointEvery)
+					defer t.Stop()
+					var lastN int
+					for {
+						select {
+						case <-ctx.Done():
+							return
+						case <-t.C:
+							n := h.Len()
+							if n == 0 || n == lastN {
+								continue // nothing new to persist
+							}
+							log.Printf("crawler: HNSW checkpoint at %d nodes (delta=%d) ...", n, n-lastN)
+							if err := h.Persist(context.Background(), pebbleStoreForCrawl); err != nil {
+								log.Printf("crawler: HNSW checkpoint failed: %v", err)
+								continue
+							}
+							lastN = n
+						}
+					}
+				}()
+				defer func() {
+					<-ckpDone // ensure ticker goroutine exits before final persist
+					if h.Len() == 0 {
+						return
+					}
+					log.Printf("crawler: final HNSW persist (%d nodes, dim=%d) to Pebble...", h.Len(), dim)
+					if err := h.Persist(context.Background(), pebbleStoreForCrawl); err != nil {
+						log.Printf("crawler: HNSW persist failed: %v", err)
+					} else {
+						log.Printf("crawler: HNSW persist complete")
+					}
+				}()
+			}
+		} else {
+			log.Printf("warning: embeddings configured (default OpenAI endpoint) but no OPENAI_API_KEY in env; crawling BM25 only")
+		}
+	}
+	if *sitemap != "" {
+		n, err := c.SeedSitemap(ctx, *sitemap)
+		if err != nil {
+			return fmt.Errorf("sitemap %s: %w", *sitemap, err)
+		}
+		log.Printf("seeded %d URLs from sitemap %s", n, *sitemap)
+	}
+	for _, u := range urls {
+		if *refresh {
+			if err := c.Recrawl(ctx, u); err != nil {
+				return fmt.Errorf("recrawl %s: %w", u, err)
+			}
+		} else {
+			if err := c.Seed(u); err != nil {
+				return fmt.Errorf("seed %s: %w", u, err)
+			}
+		}
+	}
+	return c.Run(ctx)
+}
+
+// runRefreshDue re-queues URLs whose adaptive interval has elapsed.
+// Combined with conditional GET, a refresh-due pass over a stable corpus
+// mostly costs 304 round-trips — no body, no parse, no embed.
+//
+// One-shot by default. Pass `-interval` to loop forever — useful when running
+// as a systemd service or inside the Docker image (no extra cron needed).
+func runRefreshDue(ctx context.Context, cfg *config.Config, args []string) (err error) {
+	fs := flag.NewFlagSet("refresh-due", flag.ExitOnError)
+	minH := fs.Duration("min", 1*time.Hour, "minimum re-crawl interval")
+	maxH := fs.Duration("max", 30*24*time.Hour, "maximum re-crawl interval")
+	limit := fs.Int("limit", 100, "max URLs to enqueue per pass")
+	dryRun := fs.Bool("dry-run", false, "print URLs that would be refreshed, don't enqueue")
+	interval := fs.Duration("interval", 0, "loop with this delay between passes (0 = one-shot)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	pass := func() error {
+		due, err := s.DueForRefresh(ctx, *minH, *maxH, *limit)
+		if err != nil {
+			return err
+		}
+		if len(due) == 0 {
+			log.Printf("refresh-due: 0 URLs due")
+			return nil
+		}
+		log.Printf("refresh-due: %d URLs due (limit %d, min=%s max=%s)", len(due), *limit, *minH, *maxH)
+		if *dryRun {
+			for _, u := range due {
+				fmt.Println(u)
+			}
+			return nil
+		}
+		c := crawler.New(cfg.Crawler, s)
+		for _, u := range due {
+			if err := c.Recrawl(ctx, u); err != nil {
+				log.Printf("recrawl %s: %v", u, err)
+			}
+		}
+		return c.Run(ctx)
+	}
+
+	if *interval <= 0 {
+		return pass()
+	}
+	// Daemon mode: pass, sleep, pass, ... until ctx cancelled.
+	for {
+		if err := pass(); err != nil {
+			log.Printf("refresh-due pass: %v", err)
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(*interval):
+		}
+	}
+}
+
+// siteToHost extracts the hostname from a URL or returns the input verbatim if
+// it's already a bare host (e.g. "docs.example.com" vs "https://docs.example.com").
+// Used by `cosift init -site` to populate include_domains.
+func siteToHost(s string) (string, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return "", errors.New("empty site")
+	}
+	// If no scheme, treat as bare host and validate.
+	if !strings.Contains(s, "://") {
+		// reject if it looks like a path or has whitespace
+		if strings.ContainsAny(s, " /\t\n") {
+			return "", fmt.Errorf("not a hostname: %q", s)
+		}
+		return s, nil
+	}
+	u, err := url.Parse(s)
+	if err != nil {
+		return "", err
+	}
+	if u.Host == "" {
+		return "", fmt.Errorf("could not extract host from %q", s)
+	}
+	return u.Host, nil
+}
+
+// runCheckRobots reports whether each URL is crawlable under the site's
+// robots.txt, plus any Crawl-delay. Lets operators plan crawls without
+// hand-inspecting the site's robots.txt.
+//
+// Wraps the existing internal/crawler.Robots so the CLI uses exactly the
+// same enforcement logic the real crawler would. No drift.
+func runCheckRobots(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("check-robots", flag.ExitOnError)
+	userAgent := fs.String("user-agent", cfg.Crawler.UserAgent, "User-Agent the check pretends to be (defaults to cfg.crawler.user_agent)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	urls := fs.Args()
+	if len(urls) == 0 {
+		return errors.New("usage: cosift check-robots [-user-agent UA] <url...>")
+	}
+	if *userAgent == "" {
+		*userAgent = "CosiftBot/0.0 (+https://github.com/pilot-protocol/cosift)"
+	}
+	httpClient := &http.Client{Timeout: 15 * time.Second}
+	r := crawler.NewRobots(httpClient, *userAgent)
+
+	fmt.Printf("user-agent: %s\n", *userAgent)
+
+	// Probe robots.txt for each unique host before running per-URL checks.
+	// Robots.Allowed returns (true, ...) when robots.txt is unreachable
+	// (graceful degradation suits the crawler), but the operator running
+	// check-robots wants to see "this host has no reachable robots.txt"
+	// explicitly. Group URLs by host so we only probe each host once.
+	hosts := uniqueHosts(urls)
+	fmt.Println()
+	for _, h := range hosts {
+		probeURL := h + "/robots.txt"
+		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, probeURL, http.NoBody)
+		req.Header.Set("User-Agent", *userAgent)
+		resp, err := httpClient.Do(req)
+		if err != nil {
+			fmt.Printf("robots.txt   %s — UNREACHABLE: %v (crawler will assume ALLOWED for everything on this host)\n", probeURL, err)
+			continue
+		}
+		_ = resp.Body.Close()
+		switch {
+		case resp.StatusCode == 200:
+			fmt.Printf("robots.txt   %s — OK (status 200)\n", probeURL)
+		case resp.StatusCode == 404:
+			fmt.Printf("robots.txt   %s — 404, no rules (crawler will assume ALLOWED)\n", probeURL)
+		default:
+			fmt.Printf("robots.txt   %s — status %d (crawler will assume ALLOWED on non-2xx/404)\n", probeURL, resp.StatusCode)
+		}
+		// surface Sitemap: directives from robots.txt. Modern
+		// crawlers auto-discover sitemaps this way; this output lets operators
+		// see what `cosift crawl -sitemap <URL>` could seed from.
+		if sitemaps := r.Sitemaps(ctx, h); len(sitemaps) > 0 {
+			for _, sm := range sitemaps {
+				fmt.Printf("  Sitemap:   %s\n", sm)
+			}
+		}
+	}
+	fmt.Println()
+	for _, u := range urls {
+		allowed, crawlDelay, err := r.Allowed(ctx, u)
+		if err != nil {
+			fmt.Printf("[ERR ]  %s — %v\n", u, err)
+			continue
+		}
+		mark := "[OK  ]"
+		if !allowed {
+			mark = "[DENY]"
+		}
+		extra := ""
+		if crawlDelay > 0 {
+			extra = fmt.Sprintf("  crawl-delay=%s", crawlDelay)
+		}
+		fmt.Printf("%s  %s%s\n", mark, u, extra)
+	}
+	return nil
+}
+
+// uniqueHosts extracts the scheme+host part from each URL, deduped + in order.
+// Used by check-robots to probe each host's robots.txt exactly once.
+func uniqueHosts(urls []string) []string {
+	seen := make(map[string]bool)
+	out := []string{}
+	for _, raw := range urls {
+		u, err := url.Parse(raw)
+		if err != nil || u.Host == "" {
+			continue
+		}
+		key := u.Scheme + "://" + u.Host
+		if !seen[key] {
+			seen[key] = true
+			out = append(out, key)
+		}
+	}
+	return out
+}
+
+// runCrawlErrors lists recently-errored frontier URLs with their failure reason.
+// operator diagnostic for "why are 142 URLs in error state?" without
+// requiring SQLite shell access. Pure read-only; no side effects on the index.
+//
+// The error column is's addition to the frontier schema; pre
+// errored URLs will have an empty reason.
+func runCrawlErrors(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("crawl-errors", flag.ExitOnError)
+	limit := fs.Int("limit", 50, "max number of errored URLs to list (most recent first)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return fmt.Errorf("open store: %w", err)
+	}
+	defer s.Close()
+
+	errs, err := s.ListErroredFrontier(ctx, *limit)
+	if err != nil {
+		return fmt.Errorf("list errored: %w", err)
+	}
+	if len(errs) == 0 {
+		fmt.Println("no errored frontier entries.")
+		return nil
+	}
+	fmt.Printf("%d errored frontier entries (most recent first):\n", len(errs))
+	fmt.Println()
+	for _, e := range errs {
+		reason := e.LastError
+		if reason == "" {
+			reason = "(no reason recorded — entry predates)"
+		}
+		fmt.Printf("  attempts=%d  %s\n    → %s\n", e.Attempts, e.URL, reason)
+	}
+	return nil
+}
diff --git a/cmd/cosift/cmd_eval.go b/cmd/cosift/cmd_eval.go
new file mode 100644
index 0000000..bc1d73c
--- /dev/null
+++ b/cmd/cosift/cmd_eval.go
@@ -0,0 +1,1842 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"math/rand"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/crawler"
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/eval"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/rerank"
+	"github.com/pilot-protocol/cosift/internal/server"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// bm25Adapter adapts index.BM25 to the eval.Retriever interface (URL-only result list).
+type bm25Adapter struct{ inner *index.BM25 }
+
+func (a *bm25Adapter) Search(ctx context.Context, q string, k int) ([]string, error) {
+	hits, err := a.inner.Search(ctx, q, k)
+	if err != nil {
+		return nil, err
+	}
+	urls := make([]string, len(hits))
+	for i, h := range hits {
+		urls[i] = h.URL
+	}
+	return urls, nil
+}
+
+// denseAdapter is a Retriever backed by an in-memory VectorIndex + an Embedder.
+// The embedder is consulted once per query at search time.
+type denseAdapter struct {
+	idx *index.VectorIndex
+	emb embed.Embedder
+}
+
+func (a *denseAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
+	vecs, err := a.emb.Embed(ctx, []string{q})
+	if err != nil {
+		return nil, err
+	}
+	hits := a.idx.Search(ctx, vecs[0], k)
+	urls := make([]string, len(hits))
+	for i, h := range hits {
+		urls[i] = h.URL
+	}
+	return urls, nil
+}
+
+// hybridAdapter fans out to two retrievers and fuses with RRF (k=60).
+type hybridAdapter struct {
+	a, b eval.Retriever
+}
+
+func (h *hybridAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
+	// Each retriever gets to vote on 2k candidates so RRF has room to work.
+	cand := k * 2
+	if cand < 10 {
+		cand = 10
+	}
+	ra, errA := h.a.Search(ctx, q, cand)
+	if errA != nil {
+		return nil, errA
+	}
+	rb, errB := h.b.Search(ctx, q, cand)
+	if errB != nil {
+		return nil, errB
+	}
+	return index.RRF([][]string{ra, rb}, k, 60), nil
+}
+
+// rerankAdapter wraps any Retriever with a reranker. The inner retriever is
+// asked for `candidateK` candidates; the reranker reorders them; the top k come back.
+// textByURL provides the passage text the reranker reads.
+type rerankAdapter struct {
+	inner      eval.Retriever
+	reranker   rerank.Reranker
+	textByURL  map[string]string
+	candidateK int
+}
+
+func (a *rerankAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
+	candK := a.candidateK
+	if candK <= 0 || candK < k {
+		candK = k * 5
+	}
+	urls, err := a.inner.Search(ctx, q, candK)
+	if err != nil {
+		return nil, err
+	}
+	if len(urls) <= 1 {
+		return urls, nil
+	}
+	cands := make([]rerank.Candidate, 0, len(urls))
+	for _, u := range urls {
+		text := a.textByURL[u]
+		if text == "" {
+			text = u
+		}
+		cands = append(cands, rerank.Candidate{ID: u, Text: text})
+	}
+	reranked, err := a.reranker.Rerank(ctx, q, cands)
+	if err != nil {
+		return urls, nil // fall back to inner order
+	}
+	if len(reranked) > k {
+		reranked = reranked[:k]
+	}
+	return reranked, nil
+}
+
+func runEval(ctx context.Context, args []string) error {
+	fs := flag.NewFlagSet("eval", flag.ExitOnError)
+	corpusPath := fs.String("corpus", "testdata/eval/corpus.json", "corpus JSON")
+	queriesPath := fs.String("queries", "testdata/eval/queries.json", "queries JSON")
+	savePath := fs.String("save", "", "save run summary")
+	baselinePath := fs.String("baseline", "", "compare against a prior summary")
+	retriever := fs.String("retriever", "bm25", "retriever: bm25 | dense | hybrid")
+	embModel := fs.String("embed-model", "text-embedding-3-small", "embedding model name")
+	embURL := fs.String("embed-url", "", "embedding endpoint URL (default OpenAI)")
+	embDim := fs.Int("embed-dim", 1536, "embedding dimensionality")
+	embCacheDir := fs.String("embed-cache", "./eval-embed-cache", "embedding cache dir (set empty to disable)")
+	useRerank := fs.Bool("rerank", false, "wrap retriever with the LLM listwise reranker")
+	rerankModel := fs.String("rerank-model", "gpt-4o-mini", "chat model for the reranker")
+	candK := fs.Int("rerank-k", 20, "candidates pulled from inner retriever before rerank")
+	apiURL := fs.String("api", "", "if set, query the remote cosift HTTP API instead of building a local index")
+	apiBearer := fs.String("api-bearer", "", "optional bearer token for the remote API")
+	distractors := fs.Int("distractors", 0, "inject N synthetic distractor docs into the index before scoring (tests robustness vs an inflated candidate set)")
+	distractorSeed := fs.Int64("distractor-seed", 42, "deterministic seed for distractor generation")
+	distractorMode := fs.String("distractor-mode", "diverse", "diverse (90-word neutral pool) | narrow (single-topic 7-word pool)")
+	embBatch := fs.Int("embed-batch", 256, "embedding batch size — lower for large-dim models (text-embedding-3-large returns malformed JSON at 1000)")
+	chunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = index.NewChunker default 320); A/B across runs to compare retrieval at different granularities")
+	chunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = default 64)")
+	autoParaphrase := fs.Bool("auto-paraphrase", false, "generate N paraphrases per query via the chat client at eval time + RRF-fuse results")
+	paraphraseN := fs.Int("paraphrase-n", 2, "number of paraphrases per query")
+	paraphraseModel := fs.String("paraphrase-model", "gpt-4o-mini", "chat model for paraphrase generation")
+	mainWeight := fs.Float64("main-weight", 0, "main-query weight in -auto-paraphrase OR -planner RRF fusion (paraphrases / sub-queries each weight 1.0); 0 = equal-weight (standard RRF); mirrors server-side Defaults.ExpandMainWeight for offline measurement")
+	usePlanner := fs.Bool("planner", false, "decompose each query into 2-3 sub-queries via the /research planner prompt + RRF-fuse results (mirror /research retrieval, no synth)")
+	plannerModel := fs.String("planner-model", "gpt-4o-mini", "chat model for the planner decomposition")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	qs, err := eval.LoadQuerySet(*queriesPath)
+	if err != nil {
+		return err
+	}
+
+	// --api short-circuit: run the queries straight against a deployed cosift's
+	// /search endpoint. Skip the local corpus/embed/index work entirely —
+	// the deployed instance owns its own index. The corpus.json's relevance
+	// labels still apply because they're declared independently of the index.
+	if *apiURL != "" {
+		ret := &httpAPIRetriever{
+			baseURL:   strings.TrimRight(*apiURL, "/"),
+			bearer:    *apiBearer,
+			retriever: *retriever,
+			rerank:    *useRerank,
+			http:      &http.Client{Timeout: 30 * time.Second},
+		}
+		summary, e := eval.Run(ctx, qs, ret)
+		if e != nil {
+			return e
+		}
+		summary.Name = fmt.Sprintf("%s/api(%s)", qs.Name, *apiURL)
+		fmt.Print(eval.PrintTable(summary))
+		if *baselinePath != "" {
+			base, e := eval.LoadSummary(*baselinePath)
+			if e != nil {
+				return fmt.Errorf("baseline: %w", e)
+			}
+			fmt.Printf("\nvs baseline (%s):\n%s", *baselinePath, eval.Diff(base, summary))
+		}
+		if *savePath != "" {
+			if e := eval.SaveSummary(summary, *savePath); e != nil {
+				return fmt.Errorf("save: %w", e)
+			}
+			fmt.Printf("\nsaved summary to %s\n", *savePath)
+		}
+		return nil
+	}
+
+	corpus, err := eval.LoadCorpus(*corpusPath)
+	if err != nil {
+		return err
+	}
+
+	// Build an ephemeral store in a temp dir — eval doesn't touch the user's index.
+	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-eval-%d", time.Now().UnixNano()))
+	s, err := store.Open(tmpDir)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		s.Close()
+		_ = os.RemoveAll(tmpDir)
+	}()
+
+	bm := index.NewBM25(s)
+	for _, d := range corpus.Docs {
+		id, e := s.UpsertDocument(ctx, &store.Document{
+			URL: d.URL, Title: d.Title, Text: d.Text,
+			Source: "eval", FetchedAt: time.Now(),
+		})
+		if e != nil {
+			return fmt.Errorf("ingest %s: %w", d.URL, e)
+		}
+		if e := bm.IndexDocument(ctx, id, d.Title, d.Text); e != nil {
+			return fmt.Errorf("index %s: %w", d.URL, e)
+		}
+	}
+
+	// BM25 distractor injection: synthetic noise to stress-test retrieval at
+	// higher index sizes than the 20-doc canonical set. Each distractor is 100
+	// random tokens from a neutral vocab disjoint from the eval queries' vocab —
+	// they should NEVER be relevant, so any showing up in top-K = measurable degradation.
+	// Dense distractors are embedded alongside the corpus in the dense block below.
+	var distractorTexts []string
+	if *distractors > 0 {
+		drng := rand.New(rand.NewSource(*distractorSeed))
+		neutralVocab := neutralVocabForDistractors()
+		// Narrow mode: clamp to the first topic group (pottery — 7 words).
+		// Tests the hypothesis that smaller-but-more-similar noise
+		// is harder for the reranker than larger-but-diverse noise.
+		if *distractorMode == "narrow" {
+			neutralVocab = neutralVocab[:7]
+		} else if *distractorMode != "diverse" {
+			return fmt.Errorf("unknown distractor-mode %q (diverse | narrow)", *distractorMode)
+		}
+		distractorTexts = make([]string, *distractors)
+		for i := 0; i < *distractors; i++ {
+			dURL := fmt.Sprintf("https://distractor.test/%d", i)
+			dTitle := fmt.Sprintf("Distractor %d", i)
+			dText := generateDistractorText(drng, neutralVocab, 100)
+			distractorTexts[i] = dText
+			id, e := s.UpsertDocument(ctx, &store.Document{
+				URL: dURL, Title: dTitle, Text: dText, Source: "distractor", FetchedAt: time.Now(),
+			})
+			if e != nil {
+				return fmt.Errorf("distractor %d: %w", i, e)
+			}
+			if e := bm.IndexDocument(ctx, id, dTitle, dText); e != nil {
+				return fmt.Errorf("index distractor %d: %w", i, e)
+			}
+		}
+		fmt.Printf("injected %d distractor docs into BM25 index\n", *distractors)
+	}
+
+	// Build the requested retriever.
+	var ret eval.Retriever
+	switch *retriever {
+	case "bm25":
+		ret = &bm25Adapter{inner: bm}
+	case "dense", "hybrid":
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI") // accept the short form too
+		}
+		if apiKey == "" {
+			return errors.New("OPENAI_API_KEY (or OPENAI) not set (put it in .env)")
+		}
+		oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
+		var emb embed.Embedder = oai
+		if *embCacheDir != "" {
+			emb = embed.NewCachedEmbedder(oai, *embCacheDir)
+		}
+		// Chunk corpus into passage windows, then batch-embed.
+		// Same chunker the crawler uses → eval and serve behave identically.
+		chunker := chunkerWith(*chunkSize, *chunkOverlap)
+		type passageRef struct {
+			docIdx int
+			chunk  index.Chunk
+		}
+		var allTexts []string
+		var refs []passageRef
+		for i, d := range corpus.Docs {
+			text := d.Title + "\n\n" + d.Text
+			for _, c := range chunker.Chunk(text) {
+				allTexts = append(allTexts, c.Text)
+				refs = append(refs, passageRef{docIdx: i, chunk: c})
+			}
+		}
+		fmt.Printf("embedding %d passages across %d docs with %s (batch=%d)...\n", len(allTexts), len(corpus.Docs), *embModel, *embBatch)
+		vecs, e := batchEmbed(ctx, emb, allTexts, *embBatch)
+		if e != nil {
+			return fmt.Errorf("embed corpus: %w", e)
+		}
+		vi := index.NewVectorIndex(*embDim)
+		for j, v := range vecs {
+			d := corpus.Docs[refs[j].docIdx]
+			vi.AddPassage(d.URL, d.Title, refs[j].chunk.Offset, refs[j].chunk.Length, v)
+		}
+		// Embed + add distractor passages into the SAME vector index.
+		// batchEmbed splits into ≤1000-input chunks for provider limits.
+		if len(distractorTexts) > 0 {
+			fmt.Printf("embedding %d distractor passages (batch=%d)...\n", len(distractorTexts), *embBatch)
+			dvecs, err := batchEmbed(ctx, emb, distractorTexts, *embBatch)
+			if err != nil {
+				return fmt.Errorf("embed distractors: %w", err)
+			}
+			for i, v := range dvecs {
+				vi.AddPassage(fmt.Sprintf("https://distractor.test/%d", i), "Distractor", 0, len(distractorTexts[i]), v)
+			}
+		}
+		denseRet := &denseAdapter{idx: vi, emb: emb}
+		if *retriever == "dense" {
+			ret = denseRet
+		} else {
+			ret = &hybridAdapter{a: &bm25Adapter{inner: bm}, b: denseRet}
+		}
+	default:
+		return fmt.Errorf("unknown retriever %q", *retriever)
+	}
+
+	// Apply paraphrase + rerank wrappers below.
+	suffix := *retriever
+	if *useRerank {
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI")
+		}
+		if apiKey == "" {
+			return errors.New("rerank: OPENAI_API_KEY (or OPENAI) not set")
+		}
+		chat := embed.NewOpenAIChat(apiKey, "", *rerankModel)
+		rr := rerank.NewLLMReranker(chat)
+		textByURL := make(map[string]string, len(corpus.Docs))
+		for _, d := range corpus.Docs {
+			textByURL[d.URL] = d.Title + "\n\n" + d.Text
+		}
+		ret = &rerankAdapter{inner: ret, reranker: rr, textByURL: textByURL, candidateK: *candK}
+		suffix = fmt.Sprintf("%s+rerank(%s)", *retriever, *rerankModel)
+	}
+
+	// Planner wrapper — applied BEFORE paraphrase so a "both" run looks like
+	// (rerank ⊂ planner ⊂ paraphrase). Mirrors /research's plan→retrieve pipeline
+	// without the synth step, so we measure planner *retrieval coverage* in isolation.
+	if *usePlanner {
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI")
+		}
+		if apiKey == "" {
+			return errors.New("planner: OPENAI_API_KEY (or OPENAI) not set")
+		}
+		chat := embed.NewOpenAIChat(apiKey, "", *plannerModel)
+		ret = &plannerRetriever{inner: ret, chat: chat, mainWeight: *mainWeight, cache: make(map[string][]string)}
+		if *mainWeight > 0 {
+			suffix = fmt.Sprintf("%s+planner(%s,mw=%.2f)", suffix, *plannerModel, *mainWeight)
+		} else {
+			suffix = fmt.Sprintf("%s+planner(%s)", suffix, *plannerModel)
+		}
+	}
+
+	// Auto-paraphrase wrapper — outermost so paraphrases hit the FULL retriever
+	// stack (including rerank, if enabled).
+	if *autoParaphrase {
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI")
+		}
+		if apiKey == "" {
+			return errors.New("auto-paraphrase: OPENAI_API_KEY (or OPENAI) not set")
+		}
+		chat := embed.NewOpenAIChat(apiKey, "", *paraphraseModel)
+		ret = &paraphraseRetriever{inner: ret, chat: chat, n: *paraphraseN, mainWeight: *mainWeight, cache: make(map[string][]string)}
+		if *mainWeight > 0 {
+			suffix = fmt.Sprintf("%s+paraphrase(%d/%s,mw=%.2f)", suffix, *paraphraseN, *paraphraseModel, *mainWeight)
+		} else {
+			suffix = fmt.Sprintf("%s+paraphrase(%d/%s)", suffix, *paraphraseN, *paraphraseModel)
+		}
+	}
+
+	summary, err := eval.Run(ctx, qs, ret)
+	if err != nil {
+		return err
+	}
+	summary.Name = fmt.Sprintf("%s/%s", qs.Name, suffix)
+	fmt.Print(eval.PrintTable(summary))
+
+	if *baselinePath != "" {
+		base, err := eval.LoadSummary(*baselinePath)
+		if err != nil {
+			return fmt.Errorf("baseline: %w", err)
+		}
+		fmt.Printf("\nvs baseline (%s):\n%s", *baselinePath, eval.Diff(base, summary))
+	}
+	if *savePath != "" {
+		if err := eval.SaveSummary(summary, *savePath); err != nil {
+			return fmt.Errorf("save: %w", err)
+		}
+		fmt.Printf("\nsaved summary to %s\n", *savePath)
+	}
+	return nil
+}
+
+// runBench measures search latency under synthetic load. No API calls, no disk
+// for the vector path (in-memory only); BM25 uses a temp SQLite.
+//
+// Use it to decide:
+//   - When to swap brute-force kNN for HNSW (when vector p50 > ~50 ms or
+//     p99 > ~200 ms at your target N).
+//   - When BM25 needs Tantivy or another inverted-index lib (when BM25 p50
+//     exceeds a comparable threshold).
+//
+// benchResult holds one mode's bench output. Each field maps to a JSON key
+// when `-json` is set; human-readable output uses the formatHuman method.
+type benchResult struct {
+	Mode           string  `json:"mode"`
+	N              int     `json:"n"`
+	Dim            int     `json:"dim,omitempty"`
+	Queries        int     `json:"queries,omitempty"`
+	P50Micros      int64   `json:"p50_us,omitempty"`
+	P95Micros      int64   `json:"p95_us,omitempty"`
+	P99Micros      int64   `json:"p99_us,omitempty"`
+	QPS            float64 `json:"qps,omitempty"`
+	ElapsedMicros  int64   `json:"elapsed_us,omitempty"`
+	Docs           int64   `json:"docs,omitempty"`
+	PagesPerSec    float64 `json:"pages_per_sec,omitempty"`
+	Terms          int64   `json:"terms,omitempty"`
+	PerHostDelayMs int     `json:"per_host_delay_ms,omitempty"`
+}
+
+func runBench(ctx context.Context, args []string) error {
+	fs := flag.NewFlagSet("bench", flag.ExitOnError)
+	n := fs.Int("n", 10000, "number of passages (for vector/bm25 modes) or pages (for crawl mode)")
+	dim := fs.Int("dim", 384, "embedding dimensionality (vector mode)")
+	queries := fs.Int("queries", 100, "queries per run (vector/bm25 modes)")
+	mode := fs.String("mode", "vector", "vector | bm25 | crawl | all")
+	perHostDelay := fs.Int("per-host-delay", 0, "per-host delay in ms for crawl mode (default 0 — localhost throughput; set 100-1000 to measure under realistic politeness)")
+	jsonOut := fs.Bool("json", false, "emit one JSON object per mode instead of a human-readable line — useful for CI ingestion + dashboards")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	emit := func(r *benchResult) {
+		if *jsonOut {
+			b, _ := json.Marshal(r)
+			fmt.Println(string(b))
+		} else {
+			fmt.Println(r.formatHuman())
+		}
+	}
+
+	if *mode == "vector" || *mode == "all" || *mode == "both" {
+		emit(benchVector(*n, *dim, *queries))
+	}
+	if *mode == "bm25" || *mode == "all" || *mode == "both" {
+		r, err := benchBM25(ctx, *n, *queries)
+		if err != nil {
+			return err
+		}
+		emit(r)
+	}
+	if *mode == "crawl" || *mode == "all" {
+		// Crawl mode uses a smaller default — N=10k pages of an in-process site
+		// would slow the bench without proportional signal. 200 is plenty to
+		// measure pages/sec accurately on a typical host.
+		crawlN := *n
+		if crawlN > 1000 {
+			crawlN = 200
+		}
+		r, err := benchCrawl(ctx, crawlN, *perHostDelay)
+		if err != nil {
+			return err
+		}
+		emit(r)
+	}
+	if *mode == "storage" || *mode == "all" {
+		// SQLite vs Pebble head-to-head. Same N synthetic docs, same
+		// K queries, two backends. Emit one result per backend; consumers diff
+		// the two lines (or use cosift bench-compare on the saved JSON).
+		sq, err := benchBM25SQLite(ctx, *n, *queries)
+		if err != nil {
+			return err
+		}
+		emit(sq)
+		pb, err := benchBM25Pebble(ctx, *n, *queries)
+		if err != nil {
+			return err
+		}
+		emit(pb)
+	}
+	return nil
+}
+
+// formatHuman renders the result as the one-line format the bench used in iter
+// 1–70 — preserves the existing UX when `-json` isn't set.
+func (r *benchResult) formatHuman() string {
+	switch r.Mode {
+	case "vector":
+		return fmt.Sprintf("vector  n=%d dim=%d  p50=%-9s p95=%-9s p99=%-9s qps=%.0f",
+			r.N, r.Dim,
+			time.Duration(r.P50Micros)*time.Microsecond,
+			time.Duration(r.P95Micros)*time.Microsecond,
+			time.Duration(r.P99Micros)*time.Microsecond,
+			r.QPS)
+	case "bm25":
+		return fmt.Sprintf("bm25    n=%d  p50=%-9s p95=%-9s p99=%-9s qps=%.0f",
+			r.N,
+			time.Duration(r.P50Micros)*time.Microsecond,
+			time.Duration(r.P95Micros)*time.Microsecond,
+			time.Duration(r.P99Micros)*time.Microsecond,
+			r.QPS)
+	case "crawl":
+		delay := ""
+		if r.PerHostDelayMs > 0 {
+			delay = fmt.Sprintf(" per-host-delay=%dms", r.PerHostDelayMs)
+		}
+		return fmt.Sprintf("crawl   n=%-5d elapsed=%-10s docs=%-5d  pages/sec=%-6.0f  terms=%d%s",
+			r.N,
+			(time.Duration(r.ElapsedMicros) * time.Microsecond).Round(time.Millisecond),
+			r.Docs, r.PagesPerSec, r.Terms, delay)
+	}
+	return fmt.Sprintf("%+v", *r)
+}
+
+// loadBenchReport parses a `cosift bench -json` output file. Format: one
+// benchResult JSON object per line (NDJSON). Lines that don't parse as JSON
+// are skipped silently — this lets users pipe `bench -json` into a file
+// alongside other tool output if they want.
+func loadBenchReport(path string) (map[string]*benchResult, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	out := make(map[string]*benchResult)
+	for _, line := range strings.Split(string(b), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || !strings.HasPrefix(line, "{") {
+			continue
+		}
+		var r benchResult
+		if err := json.Unmarshal([]byte(line), &r); err != nil {
+			continue // skip unparseable lines rather than failing the whole report
+		}
+		if r.Mode == "" {
+			continue
+		}
+		out[r.Mode] = &r
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("%s: no parseable bench records (expecting NDJSON from `cosift bench -json`)", path)
+	}
+	return out, nil
+}
+
+// runBenchCompare diffs two saved bench reports side-by-side. Mirrors
+// answer-eval-compare for the bench surface — locks the JSON contract
+// as a stable interface tools can rely on.
+//
+// For each mode present in either report, prints the absolute numbers + deltas.
+// Reports a mode as "missing in BASELINE" or "missing in NEW" rather than
+// silently skipping — operators benefit from knowing the compare wasn't
+// fully apples-to-apples.
+func runBenchCompare(args []string) error {
+	fs := flag.NewFlagSet("bench-compare", flag.ExitOnError)
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	rest := fs.Args()
+	if len(rest) != 2 {
+		return errors.New("usage: cosift bench-compare BASELINE.json NEW.json")
+	}
+	a, err := loadBenchReport(rest[0])
+	if err != nil {
+		return fmt.Errorf("baseline: %w", err)
+	}
+	b, err := loadBenchReport(rest[1])
+	if err != nil {
+		return fmt.Errorf("new: %w", err)
+	}
+	fmt.Printf("BASELINE: %s  (modes: %v)\n", rest[0], sortedModes(a))
+	fmt.Printf("NEW:      %s  (modes: %v)\n", rest[1], sortedModes(b))
+	fmt.Println()
+
+	// Compare any mode present in either report. Stable order: vector, bm25, crawl.
+	allModes := union(a, b)
+	for _, mode := range allModes {
+		ar := a[mode]
+		br := b[mode]
+		switch {
+		case ar == nil:
+			fmt.Printf("%-7s (missing in BASELINE — new in this run)\n", mode)
+		case br == nil:
+			fmt.Printf("%-7s (missing in NEW — present in BASELINE only)\n", mode)
+		default:
+			printBenchDelta(mode, ar, br)
+		}
+	}
+	return nil
+}
+
+func sortedModes(m map[string]*benchResult) []string {
+	order := []string{"vector", "bm25", "crawl"}
+	out := make([]string, 0, len(m))
+	for _, k := range order {
+		if _, ok := m[k]; ok {
+			out = append(out, k)
+		}
+	}
+	// Catch any modes outside the known order too.
+	for k := range m {
+		if k != "vector" && k != "bm25" && k != "crawl" {
+			out = append(out, k)
+		}
+	}
+	return out
+}
+
+func union(a, b map[string]*benchResult) []string {
+	seen := make(map[string]bool)
+	order := []string{"vector", "bm25", "crawl"}
+	out := []string{}
+	for _, k := range order {
+		if _, ok := a[k]; ok {
+			seen[k] = true
+			out = append(out, k)
+		}
+		if _, ok := b[k]; ok && !seen[k] {
+			seen[k] = true
+			out = append(out, k)
+		}
+	}
+	for _, m := range []map[string]*benchResult{a, b} {
+		for k := range m {
+			if !seen[k] {
+				seen[k] = true
+				out = append(out, k)
+			}
+		}
+	}
+	return out
+}
+
+// printBenchDelta prints one mode's before/after side-by-side. Format
+// matches answer-eval-compare's row style.
+func printBenchDelta(mode string, a, b *benchResult) {
+	switch mode {
+	case "vector", "bm25":
+		// QPS is the headline; latency percentiles are signal too.
+		fmt.Printf("%-7s n=%d→%d  qps %.0f→%.0f (%+.0f)  p50 %dµs→%dµs (%+dµs)  p95 %dµs→%dµs (%+dµs)\n",
+			mode, a.N, b.N,
+			a.QPS, b.QPS, b.QPS-a.QPS,
+			a.P50Micros, b.P50Micros, b.P50Micros-a.P50Micros,
+			a.P95Micros, b.P95Micros, b.P95Micros-a.P95Micros,
+		)
+	case "crawl":
+		fmt.Printf("%-7s n=%d→%d  pages/sec %.0f→%.0f (%+.0f)  elapsed %dms→%dms  docs %d→%d\n",
+			mode, a.N, b.N,
+			a.PagesPerSec, b.PagesPerSec, b.PagesPerSec-a.PagesPerSec,
+			a.ElapsedMicros/1000, b.ElapsedMicros/1000,
+			a.Docs, b.Docs,
+		)
+	default:
+		fmt.Printf("%-7s (unknown mode — raw: a=%+v b=%+v)\n", mode, *a, *b)
+	}
+}
+
+func benchVector(n, dim, queries int) *benchResult {
+	rng := newSeededRand()
+	vi := index.NewVectorIndex(dim)
+	for i := 0; i < n; i++ {
+		v := randUnit(rng, dim)
+		vi.AddPassage(fmt.Sprintf("https://test/p%d", i), "doc", i*100, 100, v)
+	}
+	// Time `queries` searches.
+	q := make([][]float32, queries)
+	for i := range q {
+		q[i] = randUnit(rng, dim)
+	}
+	lats := make([]time.Duration, queries)
+	for i, qv := range q {
+		start := time.Now()
+		_ = vi.Search(context.Background(), qv, 10)
+		lats[i] = time.Since(start)
+	}
+	p50, p95, p99 := percentiles(lats)
+	return &benchResult{
+		Mode: "vector", N: n, Dim: dim, Queries: queries,
+		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
+		QPS: float64(queries) / sumDur(lats).Seconds(),
+	}
+}
+
+func benchBM25(ctx context.Context, n, queries int) (*benchResult, error) {
+	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-bench-%d", time.Now().UnixNano()))
+	s, err := store.Open(tmpDir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		s.Close()
+		_ = os.RemoveAll(tmpDir)
+	}()
+	bm := index.NewBM25(s)
+
+	rng := newSeededRand()
+	vocab := []string{"alpha", "beta", "gamma", "delta", "epsilon", "go", "rust", "python",
+		"distributed", "consensus", "raft", "paxos", "quantum", "entanglement", "cell",
+		"mitochondria", "roman", "empire", "pacific", "midway", "tennis", "soccer",
+		"bitcoin", "blockchain", "transformer", "attention", "model", "vector", "index"}
+	// Build N synthetic docs of ~50 random vocab words each.
+	for i := 0; i < n; i++ {
+		var sb strings.Builder
+		for j := 0; j < 50; j++ {
+			if j > 0 {
+				sb.WriteByte(' ')
+			}
+			sb.WriteString(vocab[rng.Intn(len(vocab))])
+		}
+		id, err := s.UpsertDocument(ctx, &store.Document{
+			URL: fmt.Sprintf("https://test/d%d", i), Title: vocab[rng.Intn(len(vocab))],
+			Text: sb.String(), Source: "bench", FetchedAt: time.Now(),
+		})
+		if err != nil {
+			return nil, err
+		}
+		if err := bm.IndexDocument(ctx, id, "", sb.String()); err != nil {
+			return nil, err
+		}
+	}
+
+	// Random queries of 2-4 vocab words.
+	qstrs := make([]string, queries)
+	for i := range qstrs {
+		k := 2 + rng.Intn(3)
+		var sb strings.Builder
+		for j := 0; j < k; j++ {
+			if j > 0 {
+				sb.WriteByte(' ')
+			}
+			sb.WriteString(vocab[rng.Intn(len(vocab))])
+		}
+		qstrs[i] = sb.String()
+	}
+
+	lats := make([]time.Duration, queries)
+	for i, q := range qstrs {
+		start := time.Now()
+		_, err := bm.Search(ctx, q, 10)
+		if err != nil {
+			return nil, err
+		}
+		lats[i] = time.Since(start)
+	}
+	p50, p95, p99 := percentiles(lats)
+	return &benchResult{
+		Mode: "bm25", N: n, Queries: queries,
+		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
+		QPS: float64(queries) / sumDur(lats).Seconds(),
+	}, nil
+}
+
+// benchBM25SQLite is an alias of benchBM25 with an explicit "bm25-sqlite" Mode
+// label so storage-mode output is unambiguous when both backends are emitted.
+func benchBM25SQLite(ctx context.Context, n, queries int) (*benchResult, error) {
+	r, err := benchBM25(ctx, n, queries)
+	if err != nil {
+		return nil, err
+	}
+	r.Mode = "bm25-sqlite"
+	return r, nil
+}
+
+// benchBM25Pebble mirrors benchBM25 but runs against PebbleStore + PebbleBM25.
+// Deterministic vocab + RNG seed so SQLite and Pebble runs produce comparable
+// numbers (same N docs, same K queries, same query distribution).
+// empirical validation of the path-2 storage rework.
+func benchBM25Pebble(ctx context.Context, n, queries int) (*benchResult, error) {
+	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-pebble-bench-%d", time.Now().UnixNano()))
+	ps, err := store.OpenPebble(tmpDir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		ps.Close()
+		_ = os.RemoveAll(tmpDir)
+	}()
+	bm := index.NewPebbleBM25(ps)
+
+	rng := newSeededRand()
+	vocab := []string{"alpha", "beta", "gamma", "delta", "epsilon", "go", "rust", "python",
+		"distributed", "consensus", "raft", "paxos", "quantum", "entanglement", "cell",
+		"mitochondria", "roman", "empire", "pacific", "midway", "tennis", "soccer",
+		"bitcoin", "blockchain", "transformer", "attention", "model", "vector", "index"}
+	for i := 0; i < n; i++ {
+		var sb strings.Builder
+		for j := 0; j < 50; j++ {
+			if j > 0 {
+				sb.WriteByte(' ')
+			}
+			sb.WriteString(vocab[rng.Intn(len(vocab))])
+		}
+		id, err := ps.UpsertDocument(ctx, &store.Document{
+			URL: fmt.Sprintf("https://test/d%d", i), Title: vocab[rng.Intn(len(vocab))],
+			Text: sb.String(), Source: "bench", FetchedAt: time.Now(),
+		})
+		if err != nil {
+			return nil, err
+		}
+		if err := bm.IndexDocument(ctx, id, "", sb.String()); err != nil {
+			return nil, err
+		}
+	}
+
+	qstrs := make([]string, queries)
+	for i := range qstrs {
+		k := 2 + rng.Intn(3)
+		var sb strings.Builder
+		for j := 0; j < k; j++ {
+			if j > 0 {
+				sb.WriteByte(' ')
+			}
+			sb.WriteString(vocab[rng.Intn(len(vocab))])
+		}
+		qstrs[i] = sb.String()
+	}
+
+	lats := make([]time.Duration, queries)
+	for i, q := range qstrs {
+		start := time.Now()
+		_, err := bm.Search(ctx, q, 10)
+		if err != nil {
+			return nil, err
+		}
+		lats[i] = time.Since(start)
+	}
+	p50, p95, p99 := percentiles(lats)
+	return &benchResult{
+		Mode: "bm25-pebble", N: n, Queries: queries,
+		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
+		QPS: float64(queries) / sumDur(lats).Seconds(),
+	}, nil
+}
+
+func newSeededRand() *rand.Rand {
+	return rand.New(rand.NewSource(42)) // deterministic so runs are comparable
+}
+
+func randUnit(rng *rand.Rand, dim int) []float32 {
+	v := make([]float32, dim)
+	var norm float64
+	for i := range v {
+		v[i] = float32(rng.NormFloat64())
+		norm += float64(v[i]) * float64(v[i])
+	}
+	if norm == 0 {
+		v[0] = 1
+		return v
+	}
+	inv := float32(1.0 / sqrt(norm))
+	for i := range v {
+		v[i] *= inv
+	}
+	return v
+}
+
+func sqrt(x float64) float64 {
+	// stdlib math import already pulled through other packages; just do it here.
+	z := x / 2
+	for i := 0; i < 20; i++ {
+		if z == 0 {
+			break
+		}
+		z = (z + x/z) / 2
+	}
+	return z
+}
+
+// benchCrawl measures end-to-end crawler throughput against an in-process
+// website with N linked synthetic pages. Backs up the project directive's
+// "lightweight, on-par with modern crawlers" claim with measured pages/sec.
+//
+// The fixture: an httptest server serving N pages, each linking to the next
+// few via <a href="/pN+1">. The crawler is configured with per_host_delay=0
+// (we're hitting localhost), max_concurrent=8, robots disabled (would add a
+// constant ~1 fetch of /robots.txt unrelated to the throughput question).
+func benchCrawl(ctx context.Context, n, perHostDelayMs int) (*benchResult, error) {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		// Parse "/pN" from request path.
+		if !strings.HasPrefix(r.URL.Path, "/p") {
+			http.NotFound(w, r)
+			return
+		}
+		idx, err := strconv.Atoi(r.URL.Path[2:])
+		if err != nil || idx < 0 || idx >= n {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprintf(w, `<!doctype html><html><head><title>Page %d</title></head><body><h1>Page %d</h1>`, idx, idx)
+		fmt.Fprintf(w, `<p>Synthetic content for page %d. The crawler follows links from this page to nearby pages, building up the index.</p>`, idx)
+		// Link to next 3 pages so the crawler has a graph to walk.
+		for j := idx + 1; j < idx+4 && j < n; j++ {
+			fmt.Fprintf(w, `<a href="/p%d">page %d</a> `, j, j)
+		}
+		fmt.Fprint(w, `</body></html>`)
+	})
+	srv := httptest.NewServer(mux)
+	defer srv.Close()
+
+	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-bench-crawl-%d", time.Now().UnixNano()))
+	s, err := store.Open(tmpDir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		s.Close()
+		_ = os.RemoveAll(tmpDir)
+	}()
+
+	cfg := config.Default().Crawler
+	// -per-host-delay propagates from the bench CLI flag. Default 0
+	// (localhost throughput); set to 100–1000 to measure under realistic politeness.
+	cfg.PerHostDelayMs = perHostDelayMs
+	// Lower concurrency than the default 8 — bench output gets noisy with
+	// SQLite BUSY contention messages at high parallelism, and the bench
+	// metric is meant to be repeatable. Real deployments crawling many hosts
+	// at once should keep the default 8.
+	cfg.MaxConcurrent = 4
+	cfg.MaxDepth = 100 // ensure no depth ceiling cuts the crawl short
+	cfg.RespectRobots = false
+	cfg.IncludeDomains = nil // accept the httptest host (port-bound)
+
+	c := crawler.New(cfg, s)
+	// Seed ALL pages — measures pure fetch+parse+index throughput, not the
+	// crawler's link-discovery rate. Avoids the 1.5s "frontier empty"
+	// terminator firing before link parsing has populated more work.
+	for i := 0; i < n; i++ {
+		if e := c.Seed(fmt.Sprintf("%s/p%d", srv.URL, i)); e != nil {
+			return nil, fmt.Errorf("seed p%d: %w", i, e)
+		}
+	}
+
+	start := time.Now()
+	// Cap the run at 60s in case something goes wrong — bench should never hang.
+	runCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+	if err := c.Run(runCtx); err != nil {
+		return nil, fmt.Errorf("run: %w", err)
+	}
+	elapsed := time.Since(start)
+
+	st, err := s.Stats(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &benchResult{
+		Mode: "crawl", N: n,
+		ElapsedMicros:  elapsed.Microseconds(),
+		Docs:           st.Documents,
+		PagesPerSec:    float64(st.Documents) / elapsed.Seconds(),
+		Terms:          st.Terms,
+		PerHostDelayMs: perHostDelayMs,
+	}, nil
+	// Note: the crawler's termination detector adds ~1.5s of polling at the
+	// end of every run. For small N this dominates elapsed and the pages/sec
+	// figure understates steady-state throughput. Larger N is more representative.
+}
+
+func percentiles(d []time.Duration) (p50, p95, p99 time.Duration) {
+	if len(d) == 0 {
+		return 0, 0, 0
+	}
+	sorted := make([]time.Duration, len(d))
+	copy(sorted, d)
+	// Simple sort — durations as int64 nanos.
+	for i := 1; i < len(sorted); i++ {
+		for j := i; j > 0 && sorted[j] < sorted[j-1]; j-- {
+			sorted[j], sorted[j-1] = sorted[j-1], sorted[j]
+		}
+	}
+	q := func(p float64) time.Duration {
+		idx := int(float64(len(sorted)-1) * p)
+		return sorted[idx]
+	}
+	return q(0.5), q(0.95), q(0.99)
+}
+
+func sumDur(d []time.Duration) time.Duration {
+	var s time.Duration
+	for _, x := range d {
+		s += x
+	}
+	return s
+}
+
+// paraphraseRetriever wraps any Retriever with on-the-fly query expansion via
+// a chat client. For each search, asks the LLM for N paraphrases, runs all of
+// them through the inner retriever, RRF-fuses the result lists.
+//
+// measured that hand-written paraphrases recover 0.02 nDCG at 10k
+// distractors. This is the auto-generated version — removes the hand-writing
+// requirement and makes the prescription deployable. Per-query overhead:
+// one extra chat call (~$0.0001 at gpt-4o-mini) + N extra inner-retriever calls.
+//
+// In-memory cache by exact query text — eval re-runs hit it; production /search
+// calls don't (different process). For production, the cache would move into
+// the SQLite store or a small Redis-shaped layer.
+type paraphraseRetriever struct {
+	inner      eval.Retriever
+	chat       embed.ChatClient
+	n          int
+	mainWeight float64 // 0 = equal-weight RRF (pre); >0 = main query gets this weight, paraphrases each 1.0
+	cache      map[string][]string
+	mu         sync.Mutex
+}
+
+const paraphraseSystem = `Generate paraphrases of a search query. Each paraphrase preserves the semantic intent but uses different vocabulary — different keywords that a target document might also use. Output ONLY a JSON array of strings.
+Example output for "go programming language": ["golang concurrent compiled language", "Google's systems programming language with goroutines"]`
+
+func (p *paraphraseRetriever) generateParaphrases(ctx context.Context, q string) []string {
+	p.mu.Lock()
+	if cached, ok := p.cache[q]; ok {
+		p.mu.Unlock()
+		return cached
+	}
+	p.mu.Unlock()
+
+	resp, err := p.chat.Chat(ctx, []embed.ChatMsg{
+		{Role: "system", Content: paraphraseSystem},
+		{Role: "user", Content: fmt.Sprintf("Generate %d paraphrases of: %s", p.n, q)},
+	})
+	if err != nil {
+		return nil
+	}
+	// Same robust JSON-array parsing as the research planner.
+	raw := strings.TrimSpace(resp)
+	for _, fence := range []string{"```json", "```"} {
+		raw = strings.TrimPrefix(raw, fence)
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	raw = strings.TrimSpace(raw)
+	start := strings.Index(raw, "[")
+	end := strings.LastIndex(raw, "]")
+	if start < 0 || end <= start {
+		return nil
+	}
+	var arr []string
+	if err := json.Unmarshal([]byte(raw[start:end+1]), &arr); err != nil {
+		return nil
+	}
+	if len(arr) > p.n {
+		arr = arr[:p.n]
+	}
+	p.mu.Lock()
+	p.cache[q] = arr
+	p.mu.Unlock()
+	return arr
+}
+
+func (p *paraphraseRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
+	main, err := p.inner.Search(ctx, q, k)
+	if err != nil {
+		return nil, err
+	}
+	paras := p.generateParaphrases(ctx, q)
+	if len(paras) == 0 {
+		return main, nil
+	}
+	lists := make([][]string, 0, 1+len(paras))
+	lists = append(lists, main)
+	for _, p2 := range paras {
+		extra, err := p.inner.Search(ctx, p2, k)
+		if err != nil {
+			continue
+		}
+		lists = append(lists, extra)
+	}
+	// Matches the server expand
+	// path's behavior so eval-time measurements use the same fusion
+	// math as production.
+	var weights []float64
+	if p.mainWeight > 0 {
+		weights = make([]float64, len(lists))
+		weights[0] = p.mainWeight
+		for i := 1; i < len(weights); i++ {
+			weights[i] = 1.0
+		}
+	}
+	return index.RRFWeighted(lists, weights, k, 60), nil
+}
+
+// plannerRetriever wraps any Retriever with the /research planner's
+// decomposition step: ask the LLM for 2-3 focused sub-queries, run each through
+// the inner retriever, RRF-fuse the results. Mirrors /research minus the synth.
+//
+// This exists so we can measure whether the planner's decomposition
+// already subsumes paraphrase expansion — that claim was asserted in
+// when we chose not to add ?expand=true to /research, but never measured.
+const plannerSystemPrompt = `Decompose the user's research question into 2-3 focused sub-queries that, taken together, would cover the answer. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["sub-query 1", "sub-query 2"]`
+
+type plannerRetriever struct {
+	inner      eval.Retriever
+	chat       embed.ChatClient
+	mainWeight float64 // 0 = equal-weight RRF; >0 = main query gets this weight, sub-queries each 1.0
+	cache      map[string][]string
+	mu         sync.Mutex
+}
+
+func (p *plannerRetriever) plan(ctx context.Context, q string) []string {
+	p.mu.Lock()
+	if cached, ok := p.cache[q]; ok {
+		p.mu.Unlock()
+		return cached
+	}
+	p.mu.Unlock()
+
+	resp, err := p.chat.Chat(ctx, []embed.ChatMsg{
+		{Role: "system", Content: plannerSystemPrompt},
+		{Role: "user", Content: q},
+	})
+	if err != nil {
+		return nil
+	}
+	raw := strings.TrimSpace(resp)
+	for _, fence := range []string{"```json", "```"} {
+		raw = strings.TrimPrefix(raw, fence)
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	raw = strings.TrimSpace(raw)
+	start := strings.Index(raw, "[")
+	end := strings.LastIndex(raw, "]")
+	if start < 0 || end <= start {
+		return nil
+	}
+	var arr []string
+	if err := json.Unmarshal([]byte(raw[start:end+1]), &arr); err != nil {
+		return nil
+	}
+	if len(arr) > 5 {
+		arr = arr[:5] // hard cap matches /research planner
+	}
+	p.mu.Lock()
+	p.cache[q] = arr
+	p.mu.Unlock()
+	return arr
+}
+
+func (p *plannerRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
+	main, err := p.inner.Search(ctx, q, k)
+	if err != nil {
+		return nil, err
+	}
+	subs := p.plan(ctx, q)
+	if len(subs) == 0 {
+		return main, nil
+	}
+	lists := make([][]string, 0, 1+len(subs))
+	lists = append(lists, main)
+	for _, sq := range subs {
+		extra, err := p.inner.Search(ctx, sq, k)
+		if err != nil {
+			continue
+		}
+		lists = append(lists, extra)
+	}
+	// Same shape as
+	// paraphraseRetriever; main query gets mainWeight, sub-queries each 1.0.
+	var weights []float64
+	if p.mainWeight > 0 {
+		weights = make([]float64, len(lists))
+		weights[0] = p.mainWeight
+		for i := 1; i < len(weights); i++ {
+			weights[i] = 1.0
+		}
+	}
+	return index.RRFWeighted(lists, weights, k, 60), nil
+}
+
+// httpAPIRetriever queries a deployed cosift's /search endpoint and adapts the
+// JSON response to eval.Retriever. Lets `cosift eval -api <url>` validate a
+// remote deployment with the same metric harness used for local development.
+type httpAPIRetriever struct {
+	baseURL   string
+	bearer    string
+	retriever string
+	rerank    bool
+	http      *http.Client
+}
+
+func (r *httpAPIRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
+	v := url.Values{}
+	v.Set("q", q)
+	v.Set("k", strconv.Itoa(k))
+	if r.retriever != "" {
+		v.Set("retriever", r.retriever)
+	}
+	if r.rerank {
+		v.Set("rerank", "true")
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, r.baseURL+"/search?"+v.Encode(), http.NoBody)
+	if err != nil {
+		return nil, err
+	}
+	if r.bearer != "" {
+		req.Header.Set("Authorization", "Bearer "+r.bearer)
+	}
+	resp, err := r.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return nil, fmt.Errorf("api %d: %s", resp.StatusCode, body)
+	}
+	var sr struct {
+		Hits []struct {
+			URL string `json:"url"`
+		} `json:"hits"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&sr); err != nil {
+		return nil, fmt.Errorf("decode: %w", err)
+	}
+	urls := make([]string, len(sr.Hits))
+	for i, h := range sr.Hits {
+		urls[i] = h.URL
+	}
+	return urls, nil
+}
+
+// neutralVocabForDistractors returns words that don't appear in the eval queries
+// or relevant docs, so any distractor returning in top-K is unambiguous noise.
+// Picked from common-but-eval-disjoint domains (pottery, lighthouses, knitting,
+// dentistry, beekeeping, etc.).
+func neutralVocabForDistractors() []string {
+	return []string{
+		"kiln", "pottery", "glaze", "ceramic", "wheel", "stoneware", "earthenware",
+		"lighthouse", "beacon", "keeper", "lantern", "rocky", "shoal", "fog",
+		"yarn", "knit", "purl", "stitch", "skein", "needle", "cable",
+		"dentistry", "molar", "incisor", "filling", "enamel", "gingival",
+		"beekeeping", "hive", "queen", "drone", "wax", "pollen", "swarm",
+		"bookbinding", "spine", "endpaper", "cloth", "headband", "signature",
+		"masonry", "mortar", "trowel", "course", "wythe", "lintel", "soffit",
+		"falconry", "raptor", "perch", "lure", "jess", "creance", "mews",
+		"weaving", "warp", "weft", "shuttle", "heddle", "treadle", "selvedge",
+		"smithing", "forge", "anvil", "tongs", "quench", "temper", "billet",
+		"glassblowing", "punty", "marver", "blowpipe", "annealing", "cane",
+		"watchmaking", "balance", "escapement", "mainspring", "barrel", "jewel",
+		"taxidermy", "tan", "mount", "armature", "habitat", "diorama",
+		"calligraphy", "nib", "ink", "stroke", "kerning", "ascender", "descender",
+		"thatching", "reed", "spar", "ridge", "rafter", "eaves",
+	}
+}
+
+// generateDistractorText assembles a short text out of the neutral vocab.
+func generateDistractorText(rng *rand.Rand, vocab []string, words int) string {
+	parts := make([]string, words)
+	for i := range parts {
+		parts[i] = vocab[rng.Intn(len(vocab))]
+	}
+	return strings.Join(parts, " ")
+}
+
+// runAnswerEval is's measurement of /research answer quality across
+// the two retrieval strategies (planner vs paraphrase). Iters 52-53 measured
+// *retrieval coverage* via nDCG and found paraphrase wins; added
+// ?strategy=paraphrase but kept planner as the default *because we hadn't
+// measured synthesis quality*. This subcommand fills that gap.
+//
+// Flow per query:
+//  1. Build an in-memory cosift HTTP server with corpus ingested, dense index
+//     built, chat + paraphraser configured.
+//  2. Call /research?strategy=planner and /research?strategy=paraphrase.
+//  3. Send (question, answer, sources) to a judge LLM with a different model.
+//  4. Parse two scores: coverage (1-5) and grounding (1-5). Comments are kept
+//     for the per-query report.
+//  5. Aggregate means per strategy and print a comparison table.
+//
+// Cost note: ~$0.005 per query at gpt-4o-mini synth + gpt-4o judge for the
+// 10 multi-faceted queries → roughly $0.10 total per run. Manageable but not
+// free; the -dry-run flag prints the plan without LLM calls.
+func runAnswerEval(ctx context.Context, args []string) error {
+	fs := flag.NewFlagSet("answer-eval", flag.ExitOnError)
+	corpusPath := fs.String("corpus", "testdata/eval/corpus.json", "corpus JSON")
+	queriesPath := fs.String("queries", "testdata/eval/queries-multifaceted.json", "queries JSON (multi-faceted by default — these stress synthesis the most)")
+	synthModel := fs.String("synth-model", "gpt-4o-mini", "chat model for /research synthesis + planner/paraphraser")
+	judgeModel := fs.String("judge-model", "gpt-4o", "chat model for the judge (use a different + stronger model than synth to avoid self-preference)")
+	savePath := fs.String("save", "", "save full per-query report as JSON")
+	embModel := fs.String("embed-model", "text-embedding-3-small", "embedding model name")
+	embDim := fs.Int("embed-dim", 1536, "embedding dimensionality")
+	embCacheDir := fs.String("embed-cache", "./eval-embed-cache", "embedding cache dir (set empty to disable)")
+	embURL := fs.String("embed-url", "", "embedding endpoint URL (leave empty for OpenAI default)")
+	chatURL := fs.String("chat-url", "", "chat endpoint URL for synth+judge models")
+	answerChunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = default 320)")
+	answerChunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = default 64)")
+	dryRun := fs.Bool("dry-run", false, "build the harness + print the plan, but issue NO LLM calls")
+	useRerank := fs.Bool("rerank", false, "wire the LLM listwise reranker into the in-process server; tests whether rerank cuts the grounding=1 cases on single-doc")
+	rerankModel := fs.String("rerank-model", "gpt-4o-mini", "chat model for the reranker (kept default = synth-model so cost stays predictable)")
+	synthK := fs.Int("synth-k", 0, "cap synth-source count via WithDefaults({ResearchSynthK: N}); 0 = preserve built-in default (10). tests whether K=5 trades coverage for grounding on single-doc workloads.")
+	serverURL := fs.String("server", "", "live server base URL (e.g. https://cosift.pilotprotocol.network); skips in-process build, corpus+embed flags ignored")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	apiKey := os.Getenv("OPENAI_API_KEY")
+	if apiKey == "" {
+		apiKey = os.Getenv("OPENAI")
+	}
+	if apiKey == "" && *embURL == "" && *chatURL == "" && !*dryRun {
+		return errors.New("OPENAI_API_KEY (or OPENAI) not set; pass -embed-url/-chat-url for a local endpoint, or -dry-run to inspect")
+	}
+	if apiKey == "" {
+		apiKey = "local"
+	}
+
+	qs, err := eval.LoadQuerySet(*queriesPath)
+	if err != nil {
+		return fmt.Errorf("load queries: %w", err)
+	}
+
+	liveMode := *serverURL != ""
+	fmt.Printf("answer-eval: %d queries × 2 strategies × judge calls\n", len(qs.Queries))
+	if liveMode {
+		fmt.Printf("server = %s   judge model = %s   dry-run = %v\n", *serverURL, *judgeModel, *dryRun)
+	} else {
+		fmt.Printf("synth model = %s   judge model = %s   rerank = %v   synth_k = %d   dry-run = %v\n", *synthModel, *judgeModel, *useRerank, *synthK, *dryRun)
+	}
+	if *dryRun {
+		for _, q := range qs.Queries {
+			fmt.Printf("  - %s  (relevant: %d docs)\n", q.Text, len(q.Relevant))
+		}
+		return nil
+	}
+
+	// researchBaseURL is the base for /research calls — either live server or httptest.
+	var researchBaseURL string
+	judge := embed.NewOpenAIChat(apiKey, *chatURL, *judgeModel)
+
+	if liveMode {
+		researchBaseURL = strings.TrimRight(*serverURL, "/")
+	} else {
+		corpus, err := eval.LoadCorpus(*corpusPath)
+		if err != nil {
+			return fmt.Errorf("load corpus: %w", err)
+		}
+
+		// Build an ephemeral store + indexes (in-memory style, but SQLite needs a dir).
+		tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-answer-eval-%d", time.Now().UnixNano()))
+		st, err := store.Open(tmpDir)
+		if err != nil {
+			return err
+		}
+		defer func() {
+			st.Close()
+			_ = os.RemoveAll(tmpDir)
+		}()
+
+		bm := index.NewBM25(st)
+		oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
+		var emb embed.Embedder = oai
+		if *embCacheDir != "" {
+			emb = embed.NewCachedEmbedder(oai, *embCacheDir)
+		}
+		chunker := chunkerWith(*answerChunkSize, *answerChunkOverlap)
+		var allTexts []string
+		for _, d := range corpus.Docs {
+			id, err := st.UpsertDocument(ctx, &store.Document{
+				URL: d.URL, Title: d.Title, Text: d.Text, Source: "answer-eval", FetchedAt: time.Now(),
+			})
+			if err != nil {
+				return err
+			}
+			if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
+				return err
+			}
+			text := d.Title + "\n\n" + d.Text
+			for _, c := range chunker.Chunk(text) {
+				allTexts = append(allTexts, c.Text)
+			}
+		}
+		fmt.Printf("embedding %d passages across %d docs...\n", len(allTexts), len(corpus.Docs))
+		vecs, err := batchEmbed(ctx, emb, allTexts, 256)
+		if err != nil {
+			return fmt.Errorf("embed: %w", err)
+		}
+		vi := index.NewVectorIndex(*embDim)
+		idx := 0
+		for _, d := range corpus.Docs {
+			text := d.Title + "\n\n" + d.Text
+			for _, c := range chunker.Chunk(text) {
+				if idx >= len(vecs) {
+					break
+				}
+				vi.AddPassage(d.URL, d.Title, c.Offset, c.Length, vecs[idx])
+				idx++
+			}
+		}
+
+		chat := embed.NewOpenAIChat(apiKey, *chatURL, *synthModel)
+
+		srv := server.New(st).
+			WithVector(vi, emb).
+			WithChat(chat).
+			WithParaphraser(chat, 2).
+			WithLLMLimiter(0, 0) // disable rate limiter — this is an in-process eval, not a public endpoint. caught this when the 10/min default 429'd after 5 queries.
+		if *useRerank {
+			rerankChat := chat
+			if *rerankModel != *synthModel {
+				rerankChat = embed.NewOpenAIChat(apiKey, "", *rerankModel)
+			}
+			srv = srv.WithReranker(rerank.NewLLMReranker(rerankChat), 20)
+		}
+		if *synthK > 0 {
+			srv = srv.WithDefaults(server.Defaults{ResearchSynthK: *synthK})
+		}
+		httpSrv := httptest.NewServer(srv.Handler())
+		defer httpSrv.Close()
+		researchBaseURL = httpSrv.URL
+	}
+
+	type strategyReport struct {
+		Strategy     string   `json:"strategy"`
+		Answer       string   `json:"answer"`
+		SourceURLs   []string `json:"source_urls"`
+		Coverage     int      `json:"coverage"`
+		Grounding    int      `json:"grounding"`
+		JudgeComment string   `json:"judge_comment"`
+	}
+	type queryReport struct {
+		Query   string           `json:"query"`
+		Gold    []string         `json:"gold_relevant"`
+		Reports []strategyReport `json:"reports"`
+	}
+
+	all := make([]queryReport, 0, len(qs.Queries))
+	httpClient := &http.Client{Timeout: 120 * time.Second}
+
+	for qi, q := range qs.Queries {
+		fmt.Printf("\n[%d/%d] %s\n", qi+1, len(qs.Queries), q.Text)
+		qr := queryReport{Query: q.Text, Gold: q.Relevant}
+
+		for _, strategy := range []string{"planner", "paraphrase"} {
+			// /research call.
+			u := researchBaseURL + "/research?strategy=" + strategy + "&q=" + url.QueryEscape(q.Text)
+			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, http.NoBody)
+			resp, err := httpClient.Do(req)
+			if err != nil {
+				fmt.Printf("  %s: research call failed: %v\n", strategy, err)
+				continue
+			}
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			if resp.StatusCode != 200 {
+				fmt.Printf("  %s: research returned %d: %s\n", strategy, resp.StatusCode, string(body))
+				continue
+			}
+			var rr struct {
+				Query    string   `json:"query"`
+				Strategy string   `json:"strategy"`
+				Plan     []string `json:"plan"`
+				Answer   string   `json:"answer"`
+				Sources  []struct {
+					ID    int    `json:"id"`
+					URL   string `json:"url"`
+					Title string `json:"title"`
+				} `json:"sources"`
+			}
+			if err := json.Unmarshal(body, &rr); err != nil {
+				fmt.Printf("  %s: parse research: %v\n", strategy, err)
+				continue
+			}
+			sourceURLs := make([]string, len(rr.Sources))
+			for i, src := range rr.Sources {
+				sourceURLs[i] = src.URL
+			}
+			fmt.Printf("  %-10s answer=%dchars sources=%d  plan=%v\n", strategy, len(rr.Answer), len(rr.Sources), rr.Plan)
+
+			// Judge call.
+			score, err := judgeAnswer(ctx, judge, q.Text, rr.Answer, rr.Sources)
+			if err != nil {
+				fmt.Printf("    judge failed: %v\n", err)
+				continue
+			}
+			fmt.Printf("    judge: coverage=%d grounding=%d  — %s\n", score.Coverage, score.Grounding, score.Comment)
+			qr.Reports = append(qr.Reports, strategyReport{
+				Strategy:     strategy,
+				Answer:       rr.Answer,
+				SourceURLs:   sourceURLs,
+				Coverage:     score.Coverage,
+				Grounding:    score.Grounding,
+				JudgeComment: score.Comment,
+			})
+		}
+		all = append(all, qr)
+	}
+
+	// Aggregate. Exported field names matter — saved unexported agg
+	// fields which JSON-marshalled to `{}`. Now the summary in the saved JSON
+	// is actually inspectable by jq.
+	type strategySummary struct {
+		N             int     `json:"n"`
+		MeanCoverage  float64 `json:"mean_coverage"`
+		MeanGrounding float64 `json:"mean_grounding"`
+		Combined      float64 `json:"combined"`
+	}
+	rawAcc := map[string]struct{ cov, grd, n int }{"planner": {}, "paraphrase": {}}
+	for _, q := range all {
+		for _, sr := range q.Reports {
+			a, ok := rawAcc[sr.Strategy]
+			if !ok {
+				continue
+			}
+			a.cov += sr.Coverage
+			a.grd += sr.Grounding
+			a.n++
+			rawAcc[sr.Strategy] = a
+		}
+	}
+	summary := map[string]strategySummary{}
+	for _, name := range []string{"planner", "paraphrase"} {
+		a := rawAcc[name]
+		s := strategySummary{N: a.n}
+		if a.n > 0 {
+			s.MeanCoverage = float64(a.cov) / float64(a.n)
+			s.MeanGrounding = float64(a.grd) / float64(a.n)
+			s.Combined = s.MeanCoverage + s.MeanGrounding
+		}
+		summary[name] = s
+	}
+
+	fmt.Println("\n=== summary ===")
+	fmt.Printf("%-12s  N   mean coverage   mean grounding   combined\n", "strategy")
+	for _, name := range []string{"planner", "paraphrase"} {
+		s := summary[name]
+		if s.N == 0 {
+			fmt.Printf("%-12s  0   —                —                —\n", name)
+			continue
+		}
+		fmt.Printf("%-12s  %d   %.2f            %.2f             %.2f\n", name, s.N, s.MeanCoverage, s.MeanGrounding, s.Combined)
+	}
+
+	if *savePath != "" {
+		buf, _ := json.MarshalIndent(map[string]any{
+			"synth_model": *synthModel,
+			"judge_model": *judgeModel,
+			"queries":     *queriesPath,
+			"rerank":      *useRerank,
+			"synth_k":     *synthK,
+			"reports":     all,
+			"summary":     summary,
+			"when":        time.Now().UTC().Format(time.RFC3339),
+		}, "", "  ")
+		if err := os.WriteFile(*savePath, buf, 0o644); err != nil {
+			return fmt.Errorf("save report: %w", err)
+		}
+		fmt.Printf("\nsaved full report to %s\n", *savePath)
+	}
+	return nil
+}
+
+// judgeScore is what we parse out of the judge LLM's JSON response.
+type judgeScore struct {
+	Coverage  int    `json:"coverage"`
+	Grounding int    `json:"grounding"`
+	Comment   string `json:"comment"`
+}
+
+// judgeSystemPrompt was rewritten in after the trace revealed
+// the prior judge was evaluating the full source LIST relevance instead of the
+// CITED sources' accuracy. That bias deflated grounding scores in proportion
+// to how many tangential sources were in the list (paraphrase: 10, planner: 4-6).
+// The new prompt is explicit + the harness pre-filters sources to only those
+// the answer actually cites via [N].
+const judgeSystemPrompt = `You are an expert judge evaluating a research answer's quality. Score on TWO dimensions, each on a 1-5 integer scale:
+
+  - coverage: does the answer address every aspect of the question? (1 = misses major aspects, 5 = covers everything the question asked)
+  - grounding: do the sources the answer CITES via [N] actually support the claims those citations are attached to? (1 = cited sources don't support the claims they're attached to, 5 = every cited source genuinely supports the claim it appears next to)
+
+CRITICAL: Only consider sources the answer actually cites via [N]. Sources are listed by the IDs the answer used; uncited sources are not shown. Do not penalize the answer for not citing additional material.
+
+Output ONLY a single JSON object with this exact shape:
+{"coverage": <int 1-5>, "grounding": <int 1-5>, "comment": "<one sentence explaining the lower of the two scores>"}
+
+Do not output anything else — no preamble, no code fences, no markdown.`
+
+// citedSourceIDs extracts the integer ids referenced by [N] or [N,M,K] in the
+// answer text. fix for the judge-bias bug — we now pass only the
+// actually-cited sources to the judge, not the full source list.
+func citedSourceIDs(answer string) map[int]bool {
+	ids := make(map[int]bool)
+	// Match [1] or [1,2] or [1, 2, 3] inside square brackets.
+	for _, m := range citationRE.FindAllStringSubmatch(answer, -1) {
+		// m[1] is the contents inside the brackets.
+		for _, tok := range strings.Split(m[1], ",") {
+			n, err := strconv.Atoi(strings.TrimSpace(tok))
+			if err == nil {
+				ids[n] = true
+			}
+		}
+	}
+	return ids
+}
+
+var citationRE = regexp.MustCompile(`\[([0-9, ]+)\]`)
+
+// judgeAnswer asks the judge LLM to score a single (question, answer, sources)
+// triple. pre-filters sources to only those cited in the answer, so
+// the judge can't be confused by uncited tangential material in the list.
+// Returns a judgeScore or an error.
+func judgeAnswer(ctx context.Context, judge embed.ChatClient, question, answer string, sources []struct {
+	ID    int    `json:"id"`
+	URL   string `json:"url"`
+	Title string `json:"title"`
+}) (judgeScore, error) {
+	cited := citedSourceIDs(answer)
+	var sb strings.Builder
+	for _, src := range sources {
+		if !cited[src.ID] {
+			continue // skip uncited sources — judge only evaluates citation accuracy
+		}
+		fmt.Fprintf(&sb, "[%d] %s (%s)\n", src.ID, src.Title, src.URL)
+	}
+	citedBlock := sb.String()
+	if citedBlock == "" {
+		citedBlock = "(the answer did not cite any sources via [N])\n"
+	}
+	userMsg := fmt.Sprintf("Question: %s\n\nSources actually cited by the answer:\n%s\nAnswer:\n%s\n\nScore this answer.", question, citedBlock, answer)
+	raw, err := judge.Chat(ctx, []embed.ChatMsg{
+		{Role: "system", Content: judgeSystemPrompt},
+		{Role: "user", Content: userMsg},
+	})
+	if err != nil {
+		return judgeScore{}, fmt.Errorf("judge call: %w", err)
+	}
+	raw = strings.TrimSpace(raw)
+	for _, fence := range []string{"```json", "```"} {
+		raw = strings.TrimPrefix(raw, fence)
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	raw = strings.TrimSpace(raw)
+	startIdx := strings.Index(raw, "{")
+	endIdx := strings.LastIndex(raw, "}")
+	if startIdx < 0 || endIdx <= startIdx {
+		return judgeScore{}, fmt.Errorf("judge: no JSON object in response: %q", raw)
+	}
+	var sc judgeScore
+	if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &sc); err != nil {
+		return judgeScore{}, fmt.Errorf("judge: parse JSON: %w (raw=%q)", err, raw)
+	}
+	if sc.Coverage < 1 || sc.Coverage > 5 || sc.Grounding < 1 || sc.Grounding > 5 {
+		return judgeScore{}, fmt.Errorf("judge: scores out of 1-5 range: %+v", sc)
+	}
+	return sc, nil
+}
+
+// savedAnswerEvalReport mirrors the structure runAnswerEval writes. Used by
+// runAnswerEvalCompare to load and diff two prior reports without re-running
+// the eval. The shape is the same map[string]any savedJSON shape; this struct
+// carries only the fields we need for comparison.
+type savedAnswerEvalReport struct {
+	SynthModel string `json:"synth_model"`
+	JudgeModel string `json:"judge_model"`
+	Queries    string `json:"queries"`
+	Rerank     bool   `json:"rerank"`
+	SynthK     int    `json:"synth_k"`
+	When       string `json:"when"`
+	Summary    map[string]struct {
+		N             int     `json:"n"`
+		MeanCoverage  float64 `json:"mean_coverage"`
+		MeanGrounding float64 `json:"mean_grounding"`
+		Combined      float64 `json:"combined"`
+	} `json:"summary"`
+	Reports []struct {
+		Query   string `json:"query"`
+		Reports []struct {
+			Strategy     string `json:"strategy"`
+			Coverage     int    `json:"coverage"`
+			Grounding    int    `json:"grounding"`
+			JudgeComment string `json:"judge_comment"`
+		} `json:"reports"`
+	} `json:"reports"`
+}
+
+func loadAnswerEvalReport(path string) (*savedAnswerEvalReport, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	var r savedAnswerEvalReport
+	if err := json.Unmarshal(b, &r); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", path, err)
+	}
+	// Old reports had an empty summary because the agg struct used
+	// unexported fields. Recompute the summary on the fly for those.
+	if len(r.Summary) == 0 || r.Summary["planner"].N == 0 {
+		r.Summary = recomputeSummary(r)
+	}
+	return &r, nil
+}
+
+func recomputeSummary(r savedAnswerEvalReport) map[string]struct {
+	N             int     `json:"n"`
+	MeanCoverage  float64 `json:"mean_coverage"`
+	MeanGrounding float64 `json:"mean_grounding"`
+	Combined      float64 `json:"combined"`
+} {
+	out := make(map[string]struct {
+		N             int     `json:"n"`
+		MeanCoverage  float64 `json:"mean_coverage"`
+		MeanGrounding float64 `json:"mean_grounding"`
+		Combined      float64 `json:"combined"`
+	})
+	for _, strategy := range []string{"planner", "paraphrase"} {
+		var covSum, grdSum, n int
+		for _, q := range r.Reports {
+			for _, sr := range q.Reports {
+				if sr.Strategy == strategy {
+					covSum += sr.Coverage
+					grdSum += sr.Grounding
+					n++
+				}
+			}
+		}
+		s := out[strategy]
+		s.N = n
+		if n > 0 {
+			s.MeanCoverage = float64(covSum) / float64(n)
+			s.MeanGrounding = float64(grdSum) / float64(n)
+			s.Combined = s.MeanCoverage + s.MeanGrounding
+		}
+		out[strategy] = s
+	}
+	return out
+}
+
+// runAnswerEvalCompare loads two saved answer-eval JSON reports and prints
+// side-by-side coverage/grounding/combined deltas + per-query moves above a
+// configurable threshold. No LLM calls; pure file-to-file diff —
+// first-class replacement for the ad-hoc python one-liners operators
+// previously chained for the same report.
+func runAnswerEvalCompare(_ context.Context, args []string) error {
+	fs := flag.NewFlagSet("answer-eval-compare", flag.ExitOnError)
+	threshold := fs.Int("query-threshold", 2, "report per-query moves of |Δgrounding| or |Δcoverage| ≥ this value (1-5 scale)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	rest := fs.Args()
+	if len(rest) != 2 {
+		return errors.New("usage: cosift answer-eval-compare [-query-threshold N] BASELINE.json NEW.json")
+	}
+	a, err := loadAnswerEvalReport(rest[0])
+	if err != nil {
+		return fmt.Errorf("baseline: %w", err)
+	}
+	b, err := loadAnswerEvalReport(rest[1])
+	if err != nil {
+		return fmt.Errorf("new: %w", err)
+	}
+	// Header — record what we're comparing.
+	fmt.Printf("BASELINE: %s\n", rest[0])
+	fmt.Printf("  synth=%s judge=%s rerank=%v synth_k=%d queries=%s\n", a.SynthModel, a.JudgeModel, a.Rerank, a.SynthK, a.Queries)
+	fmt.Printf("  when: %s\n", a.When)
+	fmt.Printf("NEW:      %s\n", rest[1])
+	fmt.Printf("  synth=%s judge=%s rerank=%v synth_k=%d queries=%s\n", b.SynthModel, b.JudgeModel, b.Rerank, b.SynthK, b.Queries)
+	fmt.Printf("  when: %s\n", b.When)
+	fmt.Println()
+
+	// Summary deltas.
+	fmt.Printf("%-12s   N     cov     grnd    comb   |   Δcov    Δgrnd   Δcomb\n", "strategy")
+	fmt.Println("-----------------------------------------------------------------------")
+	for _, strategy := range []string{"planner", "paraphrase"} {
+		ab, bb := a.Summary[strategy], b.Summary[strategy]
+		if ab.N == 0 && bb.N == 0 {
+			fmt.Printf("%-12s   (not present in either report)\n", strategy)
+			continue
+		}
+		fmt.Printf("%-12s %3d→%-3d %.2f→%.2f %.2f→%.2f %.2f→%.2f | %+.2f  %+.2f  %+.2f\n",
+			strategy, ab.N, bb.N,
+			ab.MeanCoverage, bb.MeanCoverage,
+			ab.MeanGrounding, bb.MeanGrounding,
+			ab.Combined, bb.Combined,
+			bb.MeanCoverage-ab.MeanCoverage,
+			bb.MeanGrounding-ab.MeanGrounding,
+			bb.Combined-ab.Combined,
+		)
+	}
+
+	// Per-query moves.
+	if *threshold > 0 {
+		// Index by (query, strategy) for fast lookup.
+		aIdx := make(map[string]struct{ cov, grd int })
+		for _, q := range a.Reports {
+			for _, sr := range q.Reports {
+				aIdx[q.Query+"\x00"+sr.Strategy] = struct{ cov, grd int }{sr.Coverage, sr.Grounding}
+			}
+		}
+		type move struct {
+			query, strategy string
+			oldCov, oldGrd  int
+			newCov, newGrd  int
+		}
+		var moves []move
+		for _, q := range b.Reports {
+			for _, sr := range q.Reports {
+				ab, ok := aIdx[q.Query+"\x00"+sr.Strategy]
+				if !ok {
+					continue
+				}
+				dc := abs(sr.Coverage - ab.cov)
+				dg := abs(sr.Grounding - ab.grd)
+				if dc >= *threshold || dg >= *threshold {
+					moves = append(moves, move{q.Query, sr.Strategy, ab.cov, ab.grd, sr.Coverage, sr.Grounding})
+				}
+			}
+		}
+		if len(moves) > 0 {
+			fmt.Printf("\nPer-query moves with |Δ| ≥ %d:\n", *threshold)
+			fmt.Printf("  %-10s  %-50s  cov   grnd\n", "strategy", "query")
+			for _, m := range moves {
+				fmt.Printf("  %-10s  %-50s  %d→%d  %d→%d\n",
+					m.strategy, truncate(m.query, 50),
+					m.oldCov, m.newCov,
+					m.oldGrd, m.newGrd,
+				)
+			}
+		} else {
+			fmt.Printf("\nNo per-query moves with |Δ| ≥ %d.\n", *threshold)
+		}
+	}
+	return nil
+}
diff --git a/cmd/cosift/cmd_index.go b/cmd/cosift/cmd_index.go
new file mode 100644
index 0000000..87ca882
--- /dev/null
+++ b/cmd/cosift/cmd_index.go
@@ -0,0 +1,819 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/eval"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// runIngest loads a corpus.json directly into the local store + indexes —
+// useful for evaluation, vertical deployments, and users with a pre-curated
+// dataset who don't need a crawler.
+//
+// The corpus shape matches eval.Corpus: {"docs": [{"url","title","text"}...]}.
+// If embeddings are configured, every doc is chunked + embedded + persisted
+// to the passages table the same way the crawler does.
+// progressReporter logs progress for a long-running CLI loop at most once per
+// configured interval. Time-based (vs every-N-iterations) so the cadence is
+// consistent regardless of per-item cost variance. Set interval to 0 to
+// disable. Designed for ingest but generic enough for other loops.
+type progressReporter struct {
+	label    string
+	total    int
+	interval time.Duration
+	last     time.Time
+}
+
+func newProgressReporter(label string, total int, interval time.Duration) *progressReporter {
+	return &progressReporter{
+		label:    label,
+		total:    total,
+		interval: interval,
+		// Initialize `last` to now so the first call after construction
+		// doesn't immediately log (avoids a noisy first-iter "0/N" line).
+		last: time.Now(),
+	}
+}
+
+// maybeLog emits a progress line only if `interval` has elapsed since the last
+// emission. Callers pass the 1-indexed current item count. No-op when interval
+// is <= 0 or when total is 0 (avoids divide-by-zero in the percentage).
+func (p *progressReporter) maybeLog(current int) {
+	if p.interval <= 0 || p.total <= 0 {
+		return
+	}
+	if time.Since(p.last) < p.interval {
+		return
+	}
+	pct := float64(current) / float64(p.total) * 100
+	log.Printf("%s: %d/%d (%.1f%%)", p.label, current, p.total, pct)
+	p.last = time.Now()
+}
+
+// loadCorpusJSONL reads a JSONL file (one eval.CorpusDoc per line) into a
+// Corpus. Empty lines are skipped (some tools emit trailing blanks). Pairs
+// with's `export -format jsonl` to close the round-trip for ML
+// pipelines.
+func loadCorpusJSONL(path string) (*eval.Corpus, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	defer f.Close()
+	scanner := bufio.NewScanner(f)
+	// JSONL lines can be large (full doc text); raise the scanner buffer cap
+	// well above the default 64KB. 4MB matches's SSE parser ceiling.
+	scanner.Buffer(make([]byte, 0, 64<<10), 4<<20)
+	c := &eval.Corpus{}
+	lineNum := 0
+	for scanner.Scan() {
+		lineNum++
+		raw := strings.TrimSpace(scanner.Text())
+		if raw == "" {
+			continue
+		}
+		var d eval.CorpusDoc
+		if err := json.Unmarshal([]byte(raw), &d); err != nil {
+			return nil, fmt.Errorf("parse %s line %d: %w", path, lineNum, err)
+		}
+		c.Docs = append(c.Docs, d)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read %s: %w", path, err)
+	}
+	return c, nil
+}
+
+func runIngest(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("ingest", flag.ExitOnError)
+	corpusPath := fs.String("corpus", "", "path to corpus file (required)")
+	source := fs.String("source", "ingest", "source tag for documents")
+	// -format selects the loader. Default "auto" infers from file
+	// extension (.jsonl → jsonl, anything else → json). Explicit override
+	// avoids ambiguity when files have non-standard extensions.
+	format := fs.String("format", "auto", "input format: auto (default — infer from extension) | json | jsonl")
+	// Operators ingesting large corpora need
+	// some signal that work is happening. 0 disables.
+	progressInterval := fs.Duration("progress", 5*time.Second, "log per-doc/per-passage progress every N (0 disables)")
+	// CLI override for chunker config (mirrors on eval/answer-eval).
+	// 0 → fall through to cfg.Crawler.{ChunkSize,ChunkOverlap}, then to NewChunker defaults.
+	ingestChunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = use cfg.Crawler.ChunkSize, then NewChunker default 320)")
+	ingestChunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = use cfg.Crawler.ChunkOverlap, then default 64)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *corpusPath == "" {
+		return errors.New("ingest: -corpus is required")
+	}
+	resolvedFormat := *format
+	if resolvedFormat == "auto" {
+		if strings.HasSuffix(strings.ToLower(*corpusPath), ".jsonl") {
+			resolvedFormat = "jsonl"
+		} else {
+			resolvedFormat = "json"
+		}
+	}
+	var corpus *eval.Corpus
+	var err error
+	switch resolvedFormat {
+	case "json":
+		corpus, err = eval.LoadCorpus(*corpusPath)
+	case "jsonl":
+		corpus, err = loadCorpusJSONL(*corpusPath)
+	default:
+		return fmt.Errorf("unknown -format %q (want: auto | json | jsonl)", *format)
+	}
+	if err != nil {
+		return err
+	}
+
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+	bm := index.NewBM25(s)
+
+	// Optional embedder — same auto-wire as runServe.
+	var emb embed.Embedder
+	if cfg.Embeddings.Model != "" {
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI")
+		}
+		if apiKey != "" {
+			dim := cfg.Embeddings.Dim
+			if dim == 0 {
+				dim = 1536
+			}
+			emb = embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
+		} else {
+			log.Printf("warning: embeddings configured but no API key; ingesting BM25 only")
+		}
+	}
+
+	// Pre-compute chunks for the whole corpus so we can batch-embed in one call.
+	// CLI flag wins over cfg.Crawler.ChunkSize (only when flag is set).
+	chunkSize := cfg.Crawler.ChunkSize
+	if *ingestChunkSize > 0 {
+		chunkSize = *ingestChunkSize
+	}
+	chunkOverlap := cfg.Crawler.ChunkOverlap
+	if *ingestChunkOverlap > 0 {
+		chunkOverlap = *ingestChunkOverlap
+	}
+	chunker := chunkerWith(chunkSize, chunkOverlap)
+	type passageRef struct {
+		docIdx int
+		chunk  index.Chunk
+	}
+	var allTexts []string
+	var refs []passageRef
+	if emb != nil {
+		for i, d := range corpus.Docs {
+			for _, c := range chunker.Chunk(d.Title + "\n\n" + d.Text) {
+				allTexts = append(allTexts, c.Text)
+				refs = append(refs, passageRef{docIdx: i, chunk: c})
+			}
+		}
+		log.Printf("ingest: embedding %d passages across %d docs with %s", len(allTexts), len(corpus.Docs), cfg.Embeddings.Model)
+	}
+
+	var vecs [][]float32
+	if emb != nil && len(allTexts) > 0 {
+		vecs, err = emb.Embed(ctx, allTexts)
+		if err != nil {
+			return fmt.Errorf("embed: %w", err)
+		}
+	}
+
+	// Map docIdx → docID for the passage writes.
+	docIDs := make([]int64, len(corpus.Docs))
+	docProgress := newProgressReporter("ingest docs", len(corpus.Docs), *progressInterval)
+	for i, d := range corpus.Docs {
+		sha := sha256.Sum256([]byte(d.Text))
+		id, err := s.UpsertDocument(ctx, &store.Document{
+			URL: d.URL, Title: d.Title, Text: d.Text,
+			Source: *source, Quality: 0.7, FetchedAt: time.Now(),
+			ContentSHA: sha[:],
+		})
+		if err != nil {
+			return fmt.Errorf("upsert %s: %w", d.URL, err)
+		}
+		if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
+			return fmt.Errorf("index %s: %w", d.URL, err)
+		}
+		docIDs[i] = id
+		docProgress.maybeLog(i + 1)
+	}
+
+	// Write passages.
+	if emb != nil && len(vecs) == len(refs) {
+		passageProgress := newProgressReporter("ingest passages", len(vecs), *progressInterval)
+		for j, v := range vecs {
+			ref := refs[j]
+			p := &store.Passage{
+				DocID:     docIDs[ref.docIdx],
+				Offset:    ref.chunk.Offset,
+				Length:    ref.chunk.Length,
+				Model:     emb.Model(),
+				Embedding: v,
+			}
+			if err := s.UpsertPassage(ctx, p); err != nil {
+				return fmt.Errorf("passage %s offset=%d: %w", corpus.Docs[ref.docIdx].URL, ref.chunk.Offset, err)
+			}
+			passageProgress.maybeLog(j + 1)
+		}
+	}
+
+	log.Printf("ingest: %d docs, %d passages", len(corpus.Docs), len(vecs))
+	return nil
+}
+
+// runExport writes the local store's documents to a portable corpus.json,
+// shape-compatible with `cosift ingest`. Round-trips cleanly:
+//
+//	cosift export -output corpus.json
+//	cosift -config other.json ingest -corpus corpus.json
+//
+// Documents only — passages (embeddings) aren't exported because the receiver
+// likely uses a different embedding model.
+// runMigrateToPebble copies a SQLite-backed cosift data directory into a
+// fresh Pebble store. Fifth piece of the path-2 storage rework.
+//
+// Migrates:
+//   - documents (URL, title, text, metadata) via PebbleStore.UpsertDocument
+//   - BM25 postings (re-tokenized + re-indexed to preserve title
+//     boost; the SQLite postings table is NOT copied directly because
+//     re-indexing through PebbleBM25 is the same code path that production
+//     uses going forward — eliminates the divergence risk of two
+//     posting-write paths)
+//
+// Does NOT migrate (deferred): frontier rows, query_outcomes feedback,
+// paraphrase/HyDE caches, vector embeddings. Operators starting from a
+// migrated Pebble store get a working BM25 index immediately; dense + LLM
+// caches rebuild from scratch on the new instance.
+//
+// The destination directory must be empty; the migration refuses to
+// overwrite existing data so a mistyped path can't clobber a working store.
+func runMigrateToPebble(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("migrate-to-pebble", flag.ExitOnError)
+	output := fs.String("output", "", "output directory for the Pebble store (required)")
+	progress := fs.Duration("progress", 5*time.Second, "log progress every N (0 disables)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *output == "" {
+		return errors.New("migrate-to-pebble: -output is required")
+	}
+	// Refuse to write into a directory that already contains a Pebble store.
+	if entries, err := os.ReadDir(*output); err == nil && len(entries) > 0 {
+		return fmt.Errorf("migrate-to-pebble: -output %s is non-empty; refusing to overwrite (move or remove first)", *output)
+	}
+
+	src, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return fmt.Errorf("open source SQLite store at %s: %w", cfg.DataDir, err)
+	}
+	defer src.Close()
+
+	dst, err := openPebbleOrFriendlyErr(*output)
+	if err != nil {
+		return err
+	}
+	defer dst.Close()
+
+	pidx := index.NewPebbleBM25(dst)
+
+	docs, err := src.ListDocuments(ctx, 0)
+	if err != nil {
+		return fmt.Errorf("list source documents: %w", err)
+	}
+	log.Printf("migrate-to-pebble: %d documents to copy (source: %s → destination: %s)",
+		len(docs), cfg.DataDir, *output)
+
+	reporter := newProgressReporter("migrate docs", len(docs), *progress)
+	for i, d := range docs {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		// Upsert the doc into Pebble — assigns a fresh Pebble-side ID.
+		newID, err := dst.UpsertDocument(ctx, d)
+		if err != nil {
+			return fmt.Errorf("upsert doc %s: %w", d.URL, err)
+		}
+		// Re-index in Pebble BM25. Uses the same Tokenize + TitleBoost that
+		// production reads through, so behavior of the migrated index matches
+		// what a fresh crawl would produce.
+		if err := pidx.IndexDocument(ctx, newID, d.Title, d.Text); err != nil {
+			return fmt.Errorf("index doc %s: %w", d.URL, err)
+		}
+		reporter.maybeLog(i + 1)
+	}
+
+	stats, err := dst.Stats(ctx)
+	if err != nil {
+		return err
+	}
+	log.Printf("migrate-to-pebble: %d documents indexed into Pebble at %s", stats.Documents, *output)
+	return nil
+}
+
+func runExport(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("export", flag.ExitOnError)
+	output := fs.String("output", "", "output path (default depends on -format: corpus-export.{json,jsonl,txt,md})")
+	limit := fs.Int("limit", 0, "max docs to export (0 = all, applied AFTER filters)")
+	// -format selects the on-disk shape.
+	//   json (default — eval.Corpus pretty-printed; backward-compatible with)
+	//   jsonl — one {url,title,text} per line; common for ML fine-tuning pipelines
+	//   text  — Title/URL header + body + --- separator; for RAG corpora / grep
+	//   md    — `# Title` + URL line + body + horizontal rule; for LLM prompt piping
+	format := fs.String("format", "json", "output format: json | jsonl | text | md")
+	// All applied client-side after ListDocuments.
+	includeDomains := fs.String("include-domains", "", "comma-separated allowlist of domains (suffix match on dot boundary)")
+	excludeDomains := fs.String("exclude-domains", "", "comma-separated denylist of domains")
+	since := fs.String("since", "", "ISO date — only docs with published_at on or after (drops undated docs)")
+	until := fs.String("until", "", "ISO date — only docs with published_at on or before (drops undated docs)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if err := validateExportFormat(*format); err != nil {
+		return err
+	}
+	if *output == "" {
+		*output = "corpus-export." + exportExtension(*format)
+	}
+
+	sinceT, err := parseExportDate(*since)
+	if err != nil {
+		return fmt.Errorf("-since: %w", err)
+	}
+	untilT, err := parseExportDate(*until)
+	if err != nil {
+		return fmt.Errorf("-until: %w", err)
+	}
+	includeList := splitDomainCSV(*includeDomains)
+	excludeList := splitDomainCSV(*excludeDomains)
+	hasDateFilter := !sinceT.IsZero() || !untilT.IsZero()
+
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	// limit applies AFTER filters now — operators expect "give me 100
+	// docs from example.com" to mean 100 example.com docs, not 100 docs total
+	// of which some are from example.com. Pass 0 (no limit) to ListDocuments
+	// and apply the limit client-side after filtering.
+	rawLimit := 0
+	if *limit > 0 && !hasDateFilter && len(includeList) == 0 && len(excludeList) == 0 {
+		// No filters → push the limit down to ListDocuments (faster, less memory).
+		rawLimit = *limit
+	}
+	docs, err := s.ListDocuments(ctx, rawLimit)
+	if err != nil {
+		return err
+	}
+
+	docs = filterExportDocs(docs, includeList, excludeList, sinceT, untilT)
+	if *limit > 0 && len(docs) > *limit {
+		docs = docs[:*limit]
+	}
+
+	f, cerr := os.Create(*output)
+	if cerr != nil {
+		return cerr
+	}
+	defer func() {
+		if closeErr := f.Close(); closeErr != nil && err == nil {
+			err = fmt.Errorf("close output: %w", closeErr)
+		}
+	}()
+
+	switch *format {
+	case "json":
+		// wire shape: eval.Corpus pretty-printed. Preserved as default.
+		corpus := eval.Corpus{Docs: make([]eval.CorpusDoc, 0, len(docs))}
+		for _, d := range docs {
+			corpus.Docs = append(corpus.Docs, eval.CorpusDoc{URL: d.URL, Title: d.Title, Text: d.Text})
+		}
+		enc := json.NewEncoder(f)
+		enc.SetIndent("", "  ")
+		if err := enc.Encode(corpus); err != nil {
+			return fmt.Errorf("encode: %w", err)
+		}
+	case "jsonl":
+		// One {url,title,text} per line. No outer array — caller streams line-by-line.
+		enc := json.NewEncoder(f)
+		for _, d := range docs {
+			if err := enc.Encode(eval.CorpusDoc{URL: d.URL, Title: d.Title, Text: d.Text}); err != nil {
+				return fmt.Errorf("encode jsonl: %w", err)
+			}
+		}
+	case "text":
+		// Title:/URL: headers + blank + body + --- separator. Matches
+		// `contents -text` batch separator convention (LLMs interpret `---` as
+		// section breaks).
+		for i, d := range docs {
+			if i > 0 {
+				fmt.Fprintln(f, "---")
+				fmt.Fprintln(f)
+			}
+			if d.Title != "" {
+				fmt.Fprintf(f, "Title: %s\n", d.Title)
+			}
+			fmt.Fprintf(f, "URL: %s\n\n", d.URL)
+			fmt.Fprintln(f, d.Text)
+		}
+	case "md":
+		// `# Title` heading + italic URL line + body + horizontal rule. For
+		// piping into LLM prompt contexts that render markdown.
+		for i, d := range docs {
+			if i > 0 {
+				fmt.Fprintln(f)
+				fmt.Fprintln(f, "---")
+				fmt.Fprintln(f)
+			}
+			if d.Title != "" {
+				fmt.Fprintf(f, "# %s\n\n", d.Title)
+			}
+			fmt.Fprintf(f, "_%s_\n\n", d.URL)
+			fmt.Fprintln(f, d.Text)
+		}
+	}
+	log.Printf("export: %d docs → %s (%s)", len(docs), *output, *format)
+	return nil
+}
+
+// parseExportDate accepts YYYY-MM-DD or full RFC3339 (matches the
+// /search?since=/?until= conventions). Empty input returns zero time + nil
+// error (no filter).
+func parseExportDate(s string) (time.Time, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return time.Time{}, nil
+	}
+	if t, err := time.Parse(time.RFC3339, s); err == nil {
+		return t, nil
+	}
+	if t, err := time.Parse("2006-01-02", s); err == nil {
+		return t, nil
+	}
+	return time.Time{}, fmt.Errorf("could not parse date %q", s)
+}
+
+// splitDomainCSV parses a comma-separated list of domains into lowercased
+// non-empty entries. (mirrors internal/server's unexported splitCSV).
+func splitDomainCSV(s string) []string {
+	if s == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		t := strings.ToLower(strings.TrimSpace(p))
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+// matchesDomainPattern is the strict suffix-on-dot-boundary match the
+// /search filter uses. `example.com` matches `blog.example.com` but NOT
+// `evilexample.com`.
+func matchesDomainPattern(host string, patterns []string) bool {
+	host = strings.ToLower(host)
+	for _, p := range patterns {
+		if host == p || strings.HasSuffix(host, "."+p) {
+			return true
+		}
+	}
+	return false
+}
+
+// hostFromURL extracts the lowercased host without port from a URL. Returns
+// empty string when parsing fails so callers can treat unparseable URLs
+// uniformly (typically: excluded from include-filtered exports).
+func hostFromURL(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return ""
+	}
+	return strings.ToLower(u.Hostname())
+}
+
+// filterExportDocs applies the export filters to a doc slice
+// in-memory. Returns the filtered slice (in input order — preserves whatever
+// ordering ListDocuments returned).
+func filterExportDocs(docs []*store.Document, include, exclude []string, since, until time.Time) []*store.Document {
+	hasDateFilter := !since.IsZero() || !until.IsZero()
+	hasDomainFilter := len(include) > 0 || len(exclude) > 0
+	if !hasDateFilter && !hasDomainFilter {
+		return docs
+	}
+	out := make([]*store.Document, 0, len(docs))
+	for _, d := range docs {
+		// Date filter: undated docs are excluded when ANY date bound is set
+		// (matches /search?since=/?until= semantics).
+		if hasDateFilter {
+			if d.PublishedAt.IsZero() {
+				continue
+			}
+			if !since.IsZero() && d.PublishedAt.Before(since) {
+				continue
+			}
+			if !until.IsZero() && d.PublishedAt.After(until) {
+				continue
+			}
+		}
+		if hasDomainFilter {
+			host := hostFromURL(d.URL)
+			if len(include) > 0 && !matchesDomainPattern(host, include) {
+				continue
+			}
+			if len(exclude) > 0 && matchesDomainPattern(host, exclude) {
+				continue
+			}
+		}
+		out = append(out, d)
+	}
+	return out
+}
+
+// validateExportFormat is the export-side counterpart to's
+// validateFormat. Different accept-list because export supports json/jsonl
+// (file-shaped) which the synth-output CLIs don't, and synth CLIs support
+// markdown aliases which export doesn't need (single canonical name reduces
+// confusion when picking a file extension).
+func validateExportFormat(v string) error {
+	switch v {
+	case "json", "jsonl", "text", "md":
+		return nil
+	default:
+		return fmt.Errorf("export format must be one of: json, jsonl, text, md (got %q)", v)
+	}
+}
+
+// exportExtension picks a conventional file extension for each export format.
+// Used to derive a default -output path when the operator doesn't specify one.
+func exportExtension(format string) string {
+	switch format {
+	case "jsonl":
+		return "jsonl"
+	case "text":
+		return "txt"
+	case "md":
+		return "md"
+	default: // json
+		return "json"
+	}
+}
+
+// runReembed walks every document, chunks it, embeds the chunks with the
+// configured model, and writes them as new passages. The new rows coexist with
+// the old (different model_id) until `-drop-old` is passed.
+//
+// Recommended sequence:
+//
+//	cosift reembed                       # write new passages alongside old
+//	# verify search quality on new model …
+//	cosift reembed -drop-old             # drop the others
+//
+// Or just `cosift reembed -drop-old` if you're confident.
+func runReembed(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("reembed", flag.ExitOnError)
+	dropOld := fs.Bool("drop-old", false, "after re-embed, delete passages with a different model_id")
+	batchSize := fs.Int("batch", 256, "embeddings per API call (provider-dependent cap)")
+	// time-based progress reporting (shared helper from).
+	progressInterval := fs.Duration("progress", 5*time.Second, "log re-embed progress every N (0 disables)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if cfg.Embeddings.Model == "" {
+		return errors.New("reembed: cfg.Embeddings.Model must be set")
+	}
+	apiKey := os.Getenv("OPENAI_API_KEY")
+	if apiKey == "" {
+		apiKey = os.Getenv("OPENAI")
+	}
+	if apiKey == "" {
+		return errors.New("reembed: no OPENAI key in env")
+	}
+	dim := cfg.Embeddings.Dim
+	if dim == 0 {
+		dim = 1536
+	}
+	emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
+
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	docs, err := s.ListDocuments(ctx, 0)
+	if err != nil {
+		return err
+	}
+	if len(docs) == 0 {
+		log.Printf("reembed: 0 docs in store — nothing to do")
+		return nil
+	}
+
+	// Pre-existing models (informational; useful for the operator).
+	models, _ := s.PassageModels(ctx)
+	log.Printf("reembed: %d docs · target model=%s · existing models=%v · batch=%d",
+		len(docs), cfg.Embeddings.Model, models, *batchSize)
+
+	chunker := chunkerWith(cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
+	type ref struct {
+		docID int64
+		chunk index.Chunk
+	}
+	var (
+		texts   []string
+		refs    []ref
+		total   int
+		flush   func() error
+		written int
+	)
+	flush = func() error {
+		if len(texts) == 0 {
+			return nil
+		}
+		vecs, err := emb.Embed(ctx, texts)
+		if err != nil {
+			return fmt.Errorf("embed batch (%d texts): %w", len(texts), err)
+		}
+		if len(vecs) != len(texts) {
+			return fmt.Errorf("embed count mismatch: %d vs %d", len(vecs), len(texts))
+		}
+		for i, v := range vecs {
+			if err := s.UpsertPassage(ctx, &store.Passage{
+				DocID:     refs[i].docID,
+				Offset:    refs[i].chunk.Offset,
+				Length:    refs[i].chunk.Length,
+				Model:     emb.Model(),
+				Embedding: v,
+			}); err != nil {
+				return fmt.Errorf("write passage: %w", err)
+			}
+			written++
+		}
+		texts = texts[:0]
+		refs = refs[:0]
+		return nil
+	}
+
+	docProgress := newProgressReporter("reembed docs", len(docs), *progressInterval)
+	for docIdx, d := range docs {
+		for _, c := range chunker.Chunk(d.Title + "\n\n" + d.Text) {
+			texts = append(texts, c.Text)
+			refs = append(refs, ref{docID: d.ID, chunk: c})
+			total++
+			if len(texts) >= *batchSize {
+				if err := flush(); err != nil {
+					return err
+				}
+			}
+		}
+		docProgress.maybeLog(docIdx + 1)
+	}
+	if err := flush(); err != nil {
+		return err
+	}
+	log.Printf("reembed: wrote %d passages with model=%s", written, cfg.Embeddings.Model)
+
+	if *dropOld {
+		n, err := s.DropPassagesNotModel(ctx, cfg.Embeddings.Model)
+		if err != nil {
+			return fmt.Errorf("drop old: %w", err)
+		}
+		log.Printf("reembed: dropped %d passages from other models", n)
+	} else if len(models) > 0 && !contains(models, cfg.Embeddings.Model) {
+		log.Printf("reembed: %d other-model passages remain — run with -drop-old to remove", len(models))
+	}
+	return nil
+}
+
+// runCompactIndex drops orphaned passages and terms, then VACUUMs.
+// Companion to `cosift gc` — gc cleans the frontier; compact-index cleans
+// the index proper.
+func runCompactIndex(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("compact-index", flag.ExitOnError)
+	vacuum := fs.Bool("vacuum", true, "run VACUUM after deletes to reclaim disk")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	dropped, err := s.DropOrphanedPassages(ctx)
+	if err != nil {
+		return fmt.Errorf("drop orphan passages: %w", err)
+	}
+	log.Printf("compact-index: dropped %d orphan passages", dropped)
+
+	terms, err := s.DropOrphanedTerms(ctx)
+	if err != nil {
+		return fmt.Errorf("drop orphan terms: %w", err)
+	}
+	log.Printf("compact-index: dropped %d orphan terms", terms)
+
+	if *vacuum {
+		log.Printf("compact-index: vacuuming...")
+		if err := s.Vacuum(ctx); err != nil {
+			return fmt.Errorf("vacuum: %w", err)
+		}
+		log.Printf("compact-index: vacuum complete")
+	}
+	return nil
+}
+
+// batchEmbed chunks a large text slice into provider-safe batches before
+// calling the embedder. OpenAI's text-embedding-3-* caps at 2048 inputs OR
+// 300k tokens per request; 1000 is a safe default that respects both at
+// our typical chunk sizes. Returns vectors in the input order.
+//
+// Between batches we sleep 200ms — keeps multi-batch runs under OpenAI's
+// 1M-TPM org limit for text-embedding-3-small, which hit at ~50k inputs.
+// Provider rate-limit errors get one bounded retry with the suggested delay.
+func batchEmbed(ctx context.Context, e embed.Embedder, texts []string, batchSize int) ([][]float32, error) {
+	if batchSize <= 0 {
+		batchSize = 256
+	}
+	// 1000 is the published OpenAI per-call cap, but large-dim models
+	// (text-embedding-3-large @ 3072) return malformed JSON well before that
+	// in practice. 256 is safe across the model lineup.
+	if batchSize > 1000 {
+		batchSize = 1000
+	}
+	if len(texts) <= batchSize {
+		return e.Embed(ctx, texts)
+	}
+	out := make([][]float32, 0, len(texts))
+	for i := 0; i < len(texts); i += batchSize {
+		end := i + batchSize
+		if end > len(texts) {
+			end = len(texts)
+		}
+		vecs, err := embedWithRetry(ctx, e, texts[i:end])
+		if err != nil {
+			return nil, fmt.Errorf("batch %d-%d: %w", i, end, err)
+		}
+		if len(vecs) != end-i {
+			return nil, fmt.Errorf("batch %d-%d: %d returned, expected %d", i, end, len(vecs), end-i)
+		}
+		out = append(out, vecs...)
+		if end < len(texts) {
+			select {
+			case <-ctx.Done():
+				return out, ctx.Err()
+			case <-time.After(200 * time.Millisecond):
+			}
+		}
+	}
+	return out, nil
+}
+
+// embedWithRetry retries once on rate-limit errors with a fixed backoff.
+// Crude but effective at our scale — keeps full distractor runs from failing
+// when a single batch slips past the TPM bucket. Production deployments with
+// higher request volumes want exponential backoff + provider-supplied delay
+// parsing; deferred until traffic warrants.
+func embedWithRetry(ctx context.Context, e embed.Embedder, texts []string) ([][]float32, error) {
+	vecs, err := e.Embed(ctx, texts)
+	if err == nil {
+		return vecs, nil
+	}
+	msg := err.Error()
+	if !strings.Contains(msg, "rate_limit") && !strings.Contains(msg, "429") {
+		return nil, err
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-time.After(2 * time.Second):
+	}
+	return e.Embed(ctx, texts)
+}
diff --git a/cmd/cosift/cmd_maintenance.go b/cmd/cosift/cmd_maintenance.go
new file mode 100644
index 0000000..457e0cf
--- /dev/null
+++ b/cmd/cosift/cmd_maintenance.go
@@ -0,0 +1,720 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"encoding/csv"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/server"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// runGC drops persistently-errored frontier rows and (optionally) VACUUMs
+// the SQLite file. Designed for long-lived deployments where frontier garbage
+// would otherwise accumulate.
+func runGC(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("gc", flag.ExitOnError)
+	minAttempts := fs.Int("min-attempts", 5, "drop frontier rows with status='error' AND attempts >= N")
+	paraphraseTTL := fs.Duration("paraphrase-ttl", 0, "drop query_paraphrases rows older than this (0 = skip)")
+	vacuum := fs.Bool("vacuum", true, "run VACUUM after cleanup to reclaim disk")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	n, err := s.GCErroredFrontier(ctx, *minAttempts)
+	if err != nil {
+		return fmt.Errorf("gc frontier: %w", err)
+	}
+	log.Printf("gc: removed %d errored frontier rows (min_attempts=%d)", n, *minAttempts)
+
+	if *paraphraseTTL > 0 {
+		pn, err := s.PruneStaleParaphrases(ctx, *paraphraseTTL)
+		if err != nil {
+			return fmt.Errorf("gc paraphrases: %w", err)
+		}
+		log.Printf("gc: pruned %d stale paraphrases (ttl=%s)", pn, *paraphraseTTL)
+	}
+
+	if *vacuum {
+		log.Printf("gc: vacuuming...")
+		if err := s.Vacuum(ctx); err != nil {
+			return fmt.Errorf("vacuum: %w", err)
+		}
+		log.Printf("gc: vacuum complete")
+	}
+	return nil
+}
+
+// runFrontierTrim deletes completed (status='done') frontier rows older than a
+// configurable age and optionally VACUUMs the database.
+//
+// Background: the GC command (runGC) only drops status='error' rows. Completed
+// rows accumulate indefinitely — a 500k-URL crawl leaves 500k done rows that
+// serve no purpose once the URL is in the documents table. Over months of
+// continuous crawling this can reach tens of millions of rows, bloating the DB
+// by several GB and slowing ClaimFrontier's ORDER BY scan even with an index.
+//
+// Default -older-than of 168h (7 days) is safe for the default refresh cycle
+// (refresh-due at 24h): a URL that was crawled 7 days ago and whose done row
+// is deleted will re-enter the frontier on the next refresh-due pass, which is
+// the correct behavior. Operators with longer refresh cycles should raise this
+// value accordingly (e.g. -older-than=720h for monthly refreshes).
+func runFrontierTrim(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("frontier-trim", flag.ExitOnError)
+	olderThan := fs.Duration("older-than", 7*24*time.Hour, "delete done rows enqueued more than this long ago (e.g. 168h, 720h)")
+	dryRun := fs.Bool("dry-run", false, "print what would be deleted without actually deleting")
+	vacuum := fs.Bool("vacuum", true, "run VACUUM after deletion to reclaim disk space")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	stats, serr := s.GetFrontierStats(ctx)
+	if serr != nil {
+		return fmt.Errorf("frontier-trim: stats: %w", serr)
+	}
+	log.Printf("frontier-trim: before — queued=%d in_flight=%d done=%d error=%d",
+		stats.Queued, stats.InFlight, stats.Done, stats.Errored)
+
+	if *dryRun {
+		log.Printf("frontier-trim: dry-run — would delete done rows older than %s (skipping actual delete)", *olderThan)
+		return nil
+	}
+
+	n, derr := s.TrimDoneFrontier(ctx, *olderThan)
+	if derr != nil {
+		return fmt.Errorf("frontier-trim: %w", derr)
+	}
+	log.Printf("frontier-trim: removed %d done rows older than %s", n, *olderThan)
+
+	if *vacuum && n > 0 {
+		log.Printf("frontier-trim: vacuuming (this may take a while on large databases)…")
+		if verr := s.Vacuum(ctx); verr != nil {
+			return fmt.Errorf("frontier-trim: vacuum: %w", verr)
+		}
+		log.Printf("frontier-trim: vacuum complete")
+	}
+	return nil
+}
+
+// runSeedTranco reads a Tranco top-1M CSV and pushes the top-N root URLs into
+// the frontier as depth-0 seeds. This is the fastest way to bootstrap a broad
+// crawl from a high-quality, authority-ranked URL set without having to curate
+// a manual seeds file.
+//
+// Each Tranco entry becomes https://<domain>/ with a priority derived from its
+// rank: rank 1 → priority 1.0, rank 1M → priority 0.1, log-scale in between.
+// The INSERT OR IGNORE semantics of PushFrontier mean this is safe to run
+// repeatedly — it only adds URLs not already in the frontier (regardless of
+// their current status).
+//
+// Download the latest Tranco CSV from https://tranco-list.eu/ (updated weekly,
+// ~7 MB compressed). The format is "rank,hostname" with no header.
+//
+// Example:
+//
+//	cosift seed-tranco -tranco tranco-top1m.csv -top 10000
+func runSeedTranco(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("seed-tranco", flag.ExitOnError)
+	trancoPath := fs.String("tranco", "", "path to Tranco top-1M CSV (required)")
+	topN := fs.Int("top", 10000, "seed only the top-N domains (0 = all)")
+	scheme := fs.String("scheme", "https", "URL scheme to prepend (https or http)")
+	dryRun := fs.Bool("dry-run", false, "print URLs that would be seeded without writing to the frontier")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *trancoPath == "" {
+		return errors.New("seed-tranco: -tranco is required")
+	}
+	if *scheme != "https" && *scheme != "http" {
+		return fmt.Errorf("seed-tranco: -scheme must be https or http, got %q", *scheme)
+	}
+
+	f, ferr := os.Open(*trancoPath)
+	if ferr != nil {
+		return fmt.Errorf("seed-tranco: open %s: %w", *trancoPath, ferr)
+	}
+	defer f.Close()
+
+	// Parse the CSV into (rank, host) pairs up to topN.
+	type entry struct {
+		rank int
+		host string
+	}
+	entries := make([]entry, 0, 10000)
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 4096), 1<<20)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		var rankStr, host string
+		if i := strings.IndexAny(line, ",\t"); i > 0 {
+			rankStr = strings.TrimSpace(line[:i])
+			host = strings.ToLower(strings.TrimSpace(line[i+1:]))
+		} else {
+			continue
+		}
+		rank, err := strconv.Atoi(rankStr)
+		if err != nil || rank <= 0 {
+			continue
+		}
+		host = strings.TrimPrefix(host, "www.")
+		if host == "" {
+			continue
+		}
+		if *topN > 0 && rank > *topN {
+			break
+		}
+		entries = append(entries, entry{rank: rank, host: host})
+	}
+	if err := scanner.Err(); err != nil {
+		return fmt.Errorf("seed-tranco: scan: %w", err)
+	}
+	log.Printf("seed-tranco: parsed %d entries from %s (top %d)", len(entries), *trancoPath, *topN)
+
+	if *dryRun {
+		limit := len(entries)
+		if limit > 20 {
+			limit = 20
+		}
+		for _, e := range entries[:limit] {
+			log.Printf("  [dry-run] rank=%d  %s://%s/", e.rank, *scheme, e.host)
+		}
+		if len(entries) > 20 {
+			log.Printf("  … and %d more", len(entries)-20)
+		}
+		return nil
+	}
+
+	s, serr := store.Open(cfg.DataDir)
+	if serr != nil {
+		return serr
+	}
+	defer s.Close()
+
+	// trancoPriority converts a Tranco rank to a frontier priority [0.1, 1.0].
+	// Uses decimal-digit counting as a cheap log10 proxy — good enough for
+	// priority bucketing. rank=1→1.0, rank=10→0.83, rank=100→0.67,
+	// rank=1k→0.50, rank=10k→0.33, rank=100k→0.17, rank=1M→0.10.
+	trancoPriority := func(rank int) float64 {
+		if rank <= 0 {
+			return 0.5
+		}
+		digits := 0
+		r := rank
+		for r >= 10 {
+			r /= 10
+			digits++
+		}
+		p := 1.0 - float64(digits)/6.0
+		if p < 0.1 {
+			p = 0.1
+		}
+		return p
+	}
+
+	pushed := 0
+	for _, e := range entries {
+		rawURL := fmt.Sprintf("%s://%s/", *scheme, e.host)
+		priority := trancoPriority(e.rank)
+		if err := s.PushFrontier(ctx, rawURL, 0, priority); err != nil {
+			log.Printf("seed-tranco: push %s: %v", rawURL, err)
+			continue
+		}
+		pushed++
+	}
+	log.Printf("seed-tranco: pushed %d URLs into frontier (INSERT OR IGNORE — already-present URLs unchanged)", pushed)
+	return nil
+}
+
+// runOutcomes exports query_outcomes for offline calibration work. JSON for
+// programmatic consumers, CSV for spreadsheet / pandas notebooks.
+func runOutcomes(ctx context.Context, cfg *config.Config, args []string) (err error) {
+	fs := flag.NewFlagSet("outcomes", flag.ExitOnError)
+	output := fs.String("output", "outcomes.json", "output path")
+	format := fs.String("format", "json", "json | csv")
+	limit := fs.Int("limit", 0, "max rows (0 = all)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *format != "json" && *format != "csv" {
+		return fmt.Errorf("unsupported format %q (use json or csv)", *format)
+	}
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	rows, err := s.ListOutcomes(ctx, *limit)
+	if err != nil {
+		return err
+	}
+	f, cerr := os.Create(*output)
+	if cerr != nil {
+		return cerr
+	}
+	defer func() {
+		if closeErr := f.Close(); closeErr != nil && err == nil {
+			err = fmt.Errorf("close output: %w", closeErr)
+		}
+	}()
+
+	switch *format {
+	case "json":
+		enc := json.NewEncoder(f)
+		enc.SetIndent("", "  ")
+		if err := enc.Encode(rows); err != nil {
+			return err
+		}
+	case "csv":
+		w := csv.NewWriter(f)
+		_ = w.Write([]string{"id", "query", "url", "score", "useful", "source", "recorded_at"})
+		for _, r := range rows {
+			useful := "0"
+			if r.Useful {
+				useful = "1"
+			}
+			_ = w.Write([]string{
+				strconv.FormatInt(r.ID, 10),
+				r.Query, r.URL,
+				strconv.FormatFloat(r.Score, 'f', -1, 64),
+				useful, r.Source,
+				r.RecordedAt.Format(time.RFC3339),
+			})
+		}
+		w.Flush()
+		if err := w.Error(); err != nil {
+			return err
+		}
+	}
+	log.Printf("outcomes: %d rows → %s (%s)", len(rows), *output, *format)
+	return nil
+}
+
+// runDoctor checks the local install: data dir writable, schema open,
+// fixtures present, env recognized. Pure local checks — no network calls,
+// no API key spending. Use `cosift eval` for an end-to-end smoke against
+// real services.
+//
+// Exit code: 0 if everything is PASS or WARN; 1 if any FAIL.
+// doctorCheck is one row of the doctor report. Promoted from a locally-typed
+// struct so the defaults check can be tested without stdout capture.
+type doctorCheck struct {
+	Name   string `json:"name"`
+	Status string `json:"status"` // "PASS" | "WARN" | "FAIL" | "INFO" | "SKIP"
+	Detail string `json:"detail"`
+}
+
+// doctorDefaultsChecks cross-checks the defaults block against
+// configured capabilities. Returns the rows that would be appended to the
+// doctor report. Pure function — no IO, no stdout, no environment reads.
+// hasEmbed/hasChat reflect "is the capability available at all" (config
+// fields populated or env keys present); the caller resolves those before
+// calling.
+func doctorDefaultsChecks(d config.Defaults, hasEmbed, hasChat bool) []doctorCheck {
+	if d.Retriever == "" && !d.Expand && d.ResearchStrategy == "" && d.ResearchSynthK == 0 {
+		return []doctorCheck{{
+			Name:   "defaults",
+			Status: "PASS",
+			Detail: "no defaults set (per-request params win; planner is the /research default)",
+		}}
+	}
+	checks := []doctorCheck{{
+		Name:   "defaults",
+		Status: "PASS",
+		Detail: fmt.Sprintf("retriever=%q expand=%v research_strategy=%q research_synth_k=%d", d.Retriever, d.Expand, d.ResearchStrategy, d.ResearchSynthK),
+	}}
+	if d.ResearchSynthK < 0 {
+		checks = append(checks, doctorCheck{
+			Name:   "defaults.research_synth_k",
+			Status: "FAIL",
+			Detail: fmt.Sprintf("research_synth_k must be ≥ 0 (got %d). 0 = use built-in default (10); positive = cap", d.ResearchSynthK),
+		})
+	}
+	switch d.Retriever {
+	case "dense", "hybrid":
+		if !hasEmbed {
+			checks = append(checks, doctorCheck{
+				Name:   "defaults.retriever",
+				Status: "WARN",
+				Detail: fmt.Sprintf("%q default needs embeddings model — set cfg.Embeddings.Model or OPENAI_API_KEY", d.Retriever),
+			})
+		}
+	case "", "bm25":
+		// no-op; bm25 needs no capability beyond the SQLite index.
+	default:
+		checks = append(checks, doctorCheck{
+			Name:   "defaults.retriever",
+			Status: "FAIL",
+			Detail: fmt.Sprintf("unknown retriever %q (valid: bm25, dense, hybrid)", d.Retriever),
+		})
+	}
+	if d.Expand && !hasChat {
+		checks = append(checks, doctorCheck{
+			Name:   "defaults.expand",
+			Status: "WARN",
+			Detail: "expand=true needs a chat model for paraphrasing — set cfg.Chat.Model or OPENAI_API_KEY",
+		})
+	}
+	switch d.ResearchStrategy {
+	case "paraphrase":
+		if !hasChat {
+			checks = append(checks, doctorCheck{
+				Name:   "defaults.research_strategy",
+				Status: "WARN",
+				Detail: "paraphrase needs a chat model for the paraphraser — set cfg.Chat.Model or OPENAI_API_KEY",
+			})
+		}
+	case "", "planner":
+		// no-op; planner is the historic default.
+	default:
+		checks = append(checks, doctorCheck{
+			Name:   "defaults.research_strategy",
+			Status: "FAIL",
+			Detail: fmt.Sprintf("unknown strategy %q (valid: planner, paraphrase)", d.ResearchStrategy),
+		})
+	}
+	return checks
+}
+
+// runInit writes a sensible default cosift.json to the requested path. By
+// default it refuses to overwrite an existing file; -force opts in.
+//
+// The optional -site URL pre-populates `crawler.include_domains` so the user
+// can immediately `cosift crawl <url>` against a target site without editing
+// the config first. Lowers the onboarding cost for the self-hostable use case.
+func runInit(cfgPath string, args []string) error {
+	fs := flag.NewFlagSet("init", flag.ExitOnError)
+	force := fs.Bool("force", false, "overwrite an existing config file")
+	site := fs.String("site", "", "URL of a site to pre-populate crawler.include_domains with (e.g. https://docs.example.com)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	if _, err := os.Stat(cfgPath); err == nil && !*force {
+		return fmt.Errorf("%s already exists; pass -force to overwrite", cfgPath)
+	}
+
+	cfg := config.Default()
+	if *site != "" {
+		host, err := siteToHost(*site)
+		if err != nil {
+			return fmt.Errorf("-site: %w", err)
+		}
+		cfg.Crawler.IncludeDomains = []string{host}
+	}
+
+	buf, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal: %w", err)
+	}
+	// cosift.json carries Server.AdminToken and may be the sink for
+	// LoadDotEnv-sourced secrets (OPENAI_API_KEY, etc.). Owner-only.
+	if err := os.WriteFile(cfgPath, buf, 0o600); err != nil {
+		return fmt.Errorf("write %s: %w", cfgPath, err)
+	}
+
+	fmt.Printf("wrote %s\n", cfgPath)
+	if cfg.Crawler.IncludeDomains != nil {
+		fmt.Printf("  crawler.include_domains: %v\n", cfg.Crawler.IncludeDomains)
+	}
+	fmt.Println()
+	fmt.Println("next steps:")
+	if *site != "" {
+		fmt.Printf("  1. cosift crawl %s\n", *site)
+	} else {
+		fmt.Println("  1. cosift crawl <url...>")
+	}
+	fmt.Println("  2. cosift serve")
+	fmt.Println()
+	fmt.Println("optional: set OPENAI_API_KEY in your environment (or .env) to enable")
+	fmt.Println("  dense/hybrid retrieval, /answer, /research, and ?expand=true.")
+	return nil
+}
+
+func runDoctor(ctx context.Context, cfg *config.Config, args []string) error {
+	// When -server is empty, doctor stays
+	// purely local. When -server is set, doctor also pings
+	// the server's /healthz and /stats; if -token is also set (or env), it
+	// validates the token by hitting /admin/config.
+	fs := flag.NewFlagSet("doctor", flag.ExitOnError)
+	remoteServer := fs.String("server", "", "remote cosift URL to additionally probe (empty = local checks only)")
+	remoteToken := fs.String("token", "", "admin bearer token for -server admin-endpoint check (defaults to COSIFT_ADMIN_TOKEN env)")
+	// Same checks, same
+	// non-zero exit on FAIL, just JSON instead of '[PASS] name — detail'.
+	asJSON := fs.Bool("json", false, "emit JSON instead of human-readable text (suitable for jq / CI)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	var checks []doctorCheck
+	add := func(name, status, detail string) { checks = append(checks, doctorCheck{name, status, detail}) }
+
+	// 1. Data dir writable.
+	probe := filepath.Join(cfg.DataDir, ".doctor.probe")
+	// Match store.Open's 0o700 — MkdirAll's perm only applies to NEW dirs,
+	// but doctor running first must not silently leave a looser mode behind.
+	if err := os.MkdirAll(cfg.DataDir, 0o700); err != nil {
+		add("data_dir writable", "FAIL", fmt.Sprintf("mkdir %s: %v", cfg.DataDir, err))
+	} else if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {
+		add("data_dir writable", "FAIL", fmt.Sprintf("write %s: %v", probe, err))
+	} else {
+		_ = os.Remove(probe)
+		add("data_dir writable", "PASS", cfg.DataDir)
+	}
+
+	// 2. SQLite open + schema migrated.
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		add("sqlite open + schema", "FAIL", err.Error())
+	} else {
+		st, _ := s.Stats(ctx)
+		_ = s.Close()
+		add("sqlite open + schema", "PASS", fmt.Sprintf("%d docs, %d terms", st.Documents, st.Terms))
+	}
+
+	// 2b. Pebble open + counters. Pebble is optional; "absent" is
+	// not a failure, just a SKIP. When present, verify open + read counters.
+	// the open can fail because pebble-serve / a crawl holds the
+	// single-writer lock — that's a healthy state, not a FAIL. Distinguish
+	// the lock error from real corruption.
+	pebbleDir := filepath.Join(cfg.DataDir, "pebble")
+	if _, statErr := os.Stat(pebbleDir); statErr != nil {
+		add("pebble store", "SKIP", "no pebble dir (sqlite-only deployment)")
+	} else if ps, err := store.OpenPebble(pebbleDir); err != nil {
+		msg := err.Error()
+		if strings.Contains(msg, "lock") || strings.Contains(msg, "resource temporarily unavailable") {
+			add("pebble store", "INFO", "another process holds the writer lock (pebble-serve / crawl in flight)")
+		} else {
+			add("pebble store", "FAIL", msg)
+		}
+	} else {
+		_, n, _ := ps.CorpusStats(ctx)
+		// also report HNSW availability so operators can tell from
+		// `cosift doctor` whether dense / hybrid retrievers will work without
+		// firing pebble-info or pebble-serve /stats. Cheap — same 20-byte
+		// meta blob read pebble-info already does.
+		meta, hnswOK, _ := index.LoadHNSWMeta(ctx, ps)
+		_ = ps.Close()
+		add("pebble store", "PASS", fmt.Sprintf("%d indexed docs", n))
+		if hnswOK {
+			add("HNSW graph", "PASS", fmt.Sprintf("%d nodes, dim=%d — dense/hybrid available (load with COSIFT_LOAD_HNSW=true)", meta.NodeCount, meta.Dim))
+		} else {
+			add("HNSW graph", "INFO", "no vectors persisted — only bm25 / bm25-mlt retrievers (set cfg.Embeddings.Model and re-crawl to add dense)")
+		}
+	}
+
+	// 2c. COSIFT_* env vars. Lists which path-2 env overrides are
+	// set so operators can confirm 'is my override actually live'. Silent
+	// typos previously hid behind 'env unset → keep default' branches.
+	cosiftEnvs := []string{
+		"COSIFT_PEBBLE_CACHE_MB", "COSIFT_PEBBLE_MEMTABLE_MB", "COSIFT_PEBBLE_MEMTABLES", "COSIFT_PEBBLE_SYNC",
+		"COSIFT_BM25_K1", "COSIFT_BM25_B",
+		"COSIFT_HYDE_CACHE_SIZE", "COSIFT_PARA_CACHE_SIZE",
+		"COSIFT_LOAD_HNSW", //
+	}
+	var setEnvs []string
+	for _, name := range cosiftEnvs {
+		if v := os.Getenv(name); v != "" {
+			setEnvs = append(setEnvs, name+"="+v)
+		}
+	}
+	if len(setEnvs) == 0 {
+		add("COSIFT_* env", "INFO", "no path-2 overrides set (using defaults)")
+	} else {
+		add("COSIFT_* env", "INFO", strings.Join(setEnvs, ", "))
+	}
+
+	// 3. Config recognized.
+	add("config", "PASS", fmt.Sprintf("addr=%s, data_dir=%s", cfg.Server.Addr, cfg.DataDir))
+
+	// 4. API key env (warn — actually pinging is `cosift eval` territory).
+	// a custom embedder/chat URL (Ollama / vLLM / TEI) doesn't
+	// need a key; PASS when URL is set even without a key. Hosted defaults
+	// (empty URL) still require a key for the configured capability.
+	embedKey := resolveEmbedAPIKey()
+	chatKey := os.Getenv("OPENAI_API_KEY")
+	if chatKey == "" {
+		chatKey = os.Getenv("OPENAI")
+	}
+	embedConfigured := cfg.Embeddings.Model != ""
+	chatConfigured := cfg.Chat.Model != ""
+	embedLocal := cfg.Embeddings.URL != ""
+	chatLocal := cfg.Chat.URL != ""
+	switch {
+	case !embedConfigured && !chatConfigured:
+		add("embed/chat auth", "INFO", "no embed/chat models configured (fine for bm25-only)")
+	case (embedConfigured && (embedKey != "" || embedLocal)) && (!chatConfigured || chatKey != "" || chatLocal):
+		add("embed/chat auth", "PASS", fmt.Sprintf("embed=%s chat=%s", authStatus(embedConfigured, embedKey, embedLocal), authStatus(chatConfigured, chatKey, chatLocal)))
+	default:
+		var missing []string
+		if embedConfigured && embedKey == "" && !embedLocal {
+			missing = append(missing, "embed (no URL, no key)")
+		}
+		if chatConfigured && chatKey == "" && !chatLocal {
+			missing = append(missing, "chat (no URL, no key)")
+		}
+		add("embed/chat auth", "WARN", strings.Join(missing, ", ")+" — set COSIFT_EMBED_API_KEY / OPENAI_API_KEY, or point Embeddings.URL / Chat.URL at a local server")
+	}
+
+	// 5. Eval fixtures.
+	corpusPath := "testdata/eval/corpus.json"
+	queriesPath := "testdata/eval/queries.json"
+	if _, err := os.Stat(corpusPath); err != nil {
+		add("eval fixtures", "WARN", "testdata/eval/corpus.json missing (eval won't run)")
+	} else if _, err := os.Stat(queriesPath); err != nil {
+		add("eval fixtures", "WARN", "testdata/eval/queries.json missing")
+	} else {
+		add("eval fixtures", "PASS", "corpus.json + queries.json present")
+	}
+
+	// 6. Admin token configured if /admin/* is to be used.
+	if cfg.Server.AdminToken != "" {
+		add("admin_token", "PASS", "set (length redacted)")
+	} else {
+		add("admin_token", "WARN", "unset — /admin/* will return 403")
+	}
+
+	// 7. Defaults vs capabilities. The defaults block lets operators
+	// pre-configure retrieval behavior, but a default that requires capability
+	// the server isn't configured for (e.g. retriever=hybrid without an
+	// embedder) will silently fail at request time — 400 on every call. Catch
+	// the mismatch HERE instead of at first traffic.
+	hasEmbed := cfg.Embeddings.Model != "" || os.Getenv("OPENAI_API_KEY") != "" || os.Getenv("OPENAI") != ""
+	hasChat := cfg.Chat.Model != "" || os.Getenv("OPENAI_API_KEY") != "" || os.Getenv("OPENAI") != ""
+	checks = append(checks, doctorDefaultsChecks(cfg.Defaults, hasEmbed, hasChat)...)
+
+	// 8. Remote checks — only when -server is set. Token resolution
+	// mirrors admin CLIs: -token flag wins, then env.
+	if *remoteServer != "" {
+		resolvedToken := *remoteToken
+		if resolvedToken == "" {
+			resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
+		}
+		checks = append(checks, doctorRemoteChecks(ctx, *remoteServer, resolvedToken)...)
+	}
+
+	fail := 0
+	for _, c := range checks {
+		if c.Status == "FAIL" {
+			fail++
+		}
+	}
+	if *asJSON {
+		out := map[string]any{
+			"checks": checks,
+			"fail":   fail,
+			"ready":  fail == 0,
+		}
+		blob, _ := json.MarshalIndent(out, "", "  ")
+		fmt.Println(string(blob))
+		if fail > 0 {
+			return errors.New("doctor failures")
+		}
+		return nil
+	}
+	for _, c := range checks {
+		fmt.Printf("%-6s %s — %s\n", "["+c.Status+"]", c.Name, c.Detail)
+	}
+	fmt.Println()
+	if fail > 0 {
+		fmt.Printf("%d FAIL — fix the issues above before running `cosift serve`\n", fail)
+		return errors.New("doctor failures")
+	}
+	fmt.Println("ready.")
+	return nil
+}
+
+// doctorRemoteChecks probes a remote cosift server: /healthz reachable, /stats
+// returns a sensible shape, and (when token non-empty) /admin/config validates
+// the bearer token. Returns a slice of doctorCheck rows for the main runDoctor
+// loop to render.
+func doctorRemoteChecks(ctx context.Context, serverURL, token string) []doctorCheck {
+	var out []doctorCheck
+	base := strings.TrimRight(strings.Replace(serverURL, "0.0.0.0", "127.0.0.1", 1), "/")
+	client := &http.Client{Timeout: 10 * time.Second}
+
+	// /healthz
+	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, base+"/healthz", http.NoBody)
+	resp, err := client.Do(req)
+	if err != nil {
+		out = append(out, doctorCheck{"remote /healthz", "FAIL", fmt.Sprintf("%s: %v", serverURL, err)})
+		// If /healthz is unreachable, downstream checks will all fail too —
+		// emit one row and skip the cascade.
+		return out
+	}
+	resp.Body.Close()
+	if resp.StatusCode == http.StatusOK {
+		out = append(out, doctorCheck{"remote /healthz", "PASS", base})
+	} else {
+		out = append(out, doctorCheck{"remote /healthz", "FAIL", fmt.Sprintf("%s returned %d", base, resp.StatusCode)})
+	}
+
+	// /stats
+	req, _ = http.NewRequestWithContext(ctx, http.MethodGet, base+"/stats", http.NoBody)
+	resp, err = client.Do(req)
+	if err != nil {
+		out = append(out, doctorCheck{"remote /stats", "FAIL", err.Error()})
+	} else {
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			out = append(out, doctorCheck{"remote /stats", "FAIL", fmt.Sprintf("returned %d", resp.StatusCode)})
+		} else {
+			var st server.StatsResponse
+			body, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+			if err := json.Unmarshal(body, &st); err != nil {
+				out = append(out, doctorCheck{"remote /stats", "WARN", fmt.Sprintf("decode: %v", err)})
+			} else {
+				out = append(out, doctorCheck{"remote /stats", "PASS", fmt.Sprintf("%d docs", st.Documents)})
+			}
+		}
+	}
+
+	// /admin/config — only when token is provided. No token → skip silently
+	// (not a failure; operator may not have admin auth enabled).
+	if token != "" {
+		req, _ = http.NewRequestWithContext(ctx, http.MethodGet, base+"/admin/config", http.NoBody)
+		req.Header.Set("Authorization", "Bearer "+token)
+		resp, err = client.Do(req)
+		if err != nil {
+			out = append(out, doctorCheck{"remote admin token", "FAIL", err.Error()})
+			return out
+		}
+		defer resp.Body.Close()
+		switch resp.StatusCode {
+		case http.StatusOK:
+			out = append(out, doctorCheck{"remote admin token", "PASS", "/admin/config accepted the token"})
+		case http.StatusUnauthorized, http.StatusForbidden:
+			out = append(out, doctorCheck{"remote admin token", "FAIL", fmt.Sprintf("token rejected (HTTP %d)", resp.StatusCode)})
+		default:
+			out = append(out, doctorCheck{"remote admin token", "WARN", fmt.Sprintf("unexpected status %d", resp.StatusCode)})
+		}
+	}
+	return out
+}
diff --git a/cmd/cosift/cmd_query.go b/cmd/cosift/cmd_query.go
new file mode 100644
index 0000000..b49b45b
--- /dev/null
+++ b/cmd/cosift/cmd_query.go
@@ -0,0 +1,1308 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/server"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+func runQuery(ctx context.Context, cfg *config.Config, q string, args []string) error {
+	fs := flag.NewFlagSet("query", flag.ExitOnError)
+	k := fs.Int("k", 10, "max results")
+	jsonOut := fs.Bool("json", false, "emit JSON array instead of human-readable list — for shell pipelines")
+	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *k <= 0 || *k > 100 {
+		return errors.New("k must be in [1, 100]")
+	}
+
+	// -backend flag mirrors on crawl + stats. Both
+	// BM25 implementations expose the same Search(ctx, q, k) signature so
+	// the rest of runQuery is backend-agnostic.
+	type searcher interface {
+		Search(ctx context.Context, q string, k int) ([]index.Hit, error)
+	}
+	var idx searcher
+	switch *backend {
+	case "sqlite", "":
+		s, err := store.Open(cfg.DataDir)
+		if err != nil {
+			return err
+		}
+		defer s.Close()
+		idx = index.NewBM25(s)
+	case "pebble":
+		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
+		ps, err := openPebbleOrFriendlyErr(pebbleDir)
+		if err != nil {
+			return err
+		}
+		defer ps.Close()
+		// runQuery previously
+		// always used defaults; with env overrides set, score values diverged
+		// silently from pebble-serve's. Now they line up.
+		pidx := index.NewPebbleBM25(ps)
+		applyBM25EnvOverrides(pidx)
+		idx = pidx
+	default:
+		return fmt.Errorf("query: unknown -backend %q (want: sqlite | pebble)", *backend)
+	}
+	hits, err := idx.Search(ctx, q, *k)
+	if err != nil {
+		return err
+	}
+
+	if *jsonOut {
+		// Wire format matches the public /search response's per-hit shape
+		// (sans Highlight / Domain / Excerpt — those need a store lookup
+		// and `cosift query` is the no-server path).
+		type jsonHit struct {
+			URL   string  `json:"url"`
+			Title string  `json:"title"`
+			Score float64 `json:"score"`
+		}
+		out := make([]jsonHit, len(hits))
+		for i, h := range hits {
+			out[i] = jsonHit{URL: h.URL, Title: h.Title, Score: h.Score}
+		}
+		b, err := json.Marshal(out)
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+		return nil
+	}
+	for i, h := range hits {
+		fmt.Printf("%2d. [%.3f] %s\n    %s\n", i+1, h.Score, h.Title, h.URL)
+	}
+	return nil
+}
+
+// runSearchCLI hits a running cosift server's /search endpoint over HTTP.
+// Unlike runQuery (local BM25 only), this exercises the full pipeline:
+// dense/hybrid retrieval, LLM rerank, paraphrase expansion, date/domain
+// filters, custom sort. Useful from operator shells without curl + jq.
+func runSearchCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
+	fs := flag.NewFlagSet("search", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	// 0.0.0.0 is a bind-only sentinel; clients must dial loopback.
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	k := fs.Int("k", 10, "max results")
+	retriever := fs.String("retriever", "", "bm25 | dense | hybrid (server default if empty)")
+	// MMR lambda passthrough for /search.
+	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (needs HNSW + embedder server-side)")
+	rerankFlag := fs.Bool("rerank", false, "wrap retrieval with LLM listwise reranker (server must have it configured)")
+	expand := fs.Bool("expand", false, "LLM paraphrase + RRF fusion (server must have a paraphraser)")
+	since := fs.String("since", "", "ISO date — only results published on or after")
+	until := fs.String("until", "", "ISO date — only results published on or before")
+	includeDomains := fs.String("include-domains", "", "comma-separated allowlist of result domains")
+	excludeDomains := fs.String("exclude-domains", "", "comma-separated denylist of result domains")
+	sortMode := fs.String("sort", "", "relevance | date_desc | date_asc (server default if empty)")
+	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable list")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *k <= 0 || *k > 100 {
+		return errors.New("k must be in [1, 100]")
+	}
+	if err := validateFormat(*format); err != nil {
+		return err
+	}
+
+	v := url.Values{}
+	v.Set("q", q)
+	v.Set("k", strconv.Itoa(*k))
+	if *retriever != "" {
+		v.Set("retriever", *retriever)
+	}
+	if *mmr != "" {
+		v.Set("mmr", *mmr)
+	}
+	if *rerankFlag {
+		v.Set("rerank", "true")
+	}
+	if *expand {
+		v.Set("expand", "true")
+	}
+	if *since != "" {
+		v.Set("since", *since)
+	}
+	if *until != "" {
+		v.Set("until", *until)
+	}
+	if *includeDomains != "" {
+		v.Set("include_domains", *includeDomains)
+	}
+	if *excludeDomains != "" {
+		v.Set("exclude_domains", *excludeDomains)
+	}
+	if *sortMode != "" {
+		v.Set("sort", *sortMode)
+	}
+
+	endpoint := strings.TrimRight(*serverURL, "/") + "/search?" + v.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return err
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+
+	if *jsonOut {
+		// Pass the server's JSON straight through — same shape as /search.
+		fmt.Println(string(body))
+		return nil
+	}
+	emitWarnings(body)
+	var sr server.SearchResponse
+	if err := json.Unmarshal(body, &sr); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	if *format == "md" || *format == "markdown" {
+		fmt.Print(renderRankedMarkdown("Results: "+sr.Query, sr.Hits))
+		return nil
+	}
+	if len(sr.Hits) == 0 {
+		fmt.Println("(no results)")
+		return nil
+	}
+	for i, h := range sr.Hits {
+		date := ""
+		if h.PublishedAt != nil {
+			date = " " + h.PublishedAt.Format("2006-01-02")
+		}
+		domain := ""
+		if h.Domain != "" {
+			domain = " [" + h.Domain + "]"
+		}
+		fmt.Printf("%2d. [%.3f]%s%s %s\n    %s\n", i+1, h.Score, domain, date, h.Title, h.URL)
+		if h.Highlight != nil && h.Highlight.Text != "" {
+			fmt.Printf("    > %s\n", truncate(h.Highlight.Text, 200))
+		} else if h.Excerpt != "" {
+			fmt.Printf("    > %s\n", truncate(h.Excerpt, 200))
+		}
+	}
+	return nil
+}
+
+// runResearchCLI hits a running cosift server's /research endpoint over HTTP.
+// Sibling to runSearchCLI: same -server / -json affordance, but pulls
+// an LLM-synthesized answer with cited sources rather than a ranked URL list.
+// Non-streaming — the SSE mode (?stream=true) is a separate code path; this
+// returns the same JSON the non-streaming endpoint produces.
+// renderAnswerMarkdown formats a /research or /answer response as markdown,
+// suitable for piping into LLM contexts or markdown viewers. Used by both
+// runResearchCLI and runAnswerCLI via the shared `-format md|markdown` flag.
+// strategy/plan are research-only; pass "" / nil from /answer's callsite.
+func renderAnswerMarkdown(query, strategy string, plan []string, answer string, sources []server.AnswerSource) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "# %s\n\n", query)
+	if strategy != "" {
+		fmt.Fprintf(&b, "> Strategy: `%s`", strategy)
+		if len(plan) > 0 {
+			fmt.Fprintf(&b, " (plan: %s)", strings.Join(plan, " | "))
+		}
+		b.WriteString("\n\n")
+	}
+	b.WriteString(answer)
+	if !strings.HasSuffix(answer, "\n") {
+		b.WriteString("\n")
+	}
+	if len(sources) > 0 {
+		b.WriteString("\n## Sources\n\n")
+		for i, s := range sources {
+			// `N. [Title](URL)` — the leading N matches the citation IDs the
+			// LLM emits inline (e.g. `[1]` in the answer references source 1).
+			fmt.Fprintf(&b, "%d. [%s](%s)", sourceIDOf(i, s), s.Title, s.URL)
+			var trailing []string
+			if s.Domain != "" {
+				trailing = append(trailing, s.Domain)
+			}
+			if s.PublishedAt != nil {
+				trailing = append(trailing, s.PublishedAt.Format("2006-01-02"))
+			}
+			if len(trailing) > 0 {
+				fmt.Fprintf(&b, " — %s", strings.Join(trailing, ", "))
+			}
+			b.WriteString("\n")
+		}
+	}
+	return b.String()
+}
+
+// renderRankedMarkdown formats a ranked-hits response (search, find-similar)
+// as markdown for LLM piping or markdown viewers. `title` is the H1 text —
+// renderRankedMarkdown renders a ranked hit list as markdown. Callers
+// pass "Results: <query>" for /search or "Similar to: <url>" for
+// /find_similar; the hit-list shape is the same in both cases.
+func renderRankedMarkdown(title string, hits []server.SearchHit) string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "# %s\n\n", title)
+	if len(hits) == 0 {
+		b.WriteString("_No results._\n")
+		return b.String()
+	}
+	for i, h := range hits {
+		fmt.Fprintf(&b, "## %d. [%s](%s)\n\n", i+1, h.Title, h.URL)
+		var meta []string
+		meta = append(meta, fmt.Sprintf("Score: %.3f", h.Score))
+		if h.Domain != "" {
+			meta = append(meta, h.Domain)
+		}
+		if h.PublishedAt != nil {
+			meta = append(meta, h.PublishedAt.Format("2006-01-02"))
+		}
+		fmt.Fprintf(&b, "_%s_\n", strings.Join(meta, " · "))
+		// Excerpt OR highlight as a blockquote. Highlight wins when both are
+		// present (it's the matched passage, more relevant than the prefix).
+		var excerpt string
+		if h.Highlight != nil && h.Highlight.Text != "" {
+			excerpt = h.Highlight.Text
+		} else if h.Excerpt != "" {
+			excerpt = h.Excerpt
+		}
+		if excerpt != "" {
+			b.WriteString("\n> ")
+			b.WriteString(truncate(excerpt, 240))
+			b.WriteString("\n")
+		}
+		// Trailing blank line between hits, but not after the last one.
+		if i < len(hits)-1 {
+			b.WriteString("\n")
+		}
+	}
+	return b.String()
+}
+
+// forEachSSEEvent reads an SSE response body and invokes handle(event, data)
+// for each `event: <name>\ndata: <json>\n\n` block. The handler can return
+// errSSEDone to signal terminal completion (the scanner returns nil), or any
+// other error to abort. Multi-line `data:` lines are concatenated with `\n`
+// per the SSE spec. Extracted from's consumeResearchSSE so
+// both research and answer CLI consumers share the framing logic.
+func forEachSSEEvent(body io.Reader, handle func(event, data string) error) error {
+	scanner := bufio.NewScanner(body)
+	// SSE events can be larger than the default 64KB scanner buffer (the
+	// terminal `done` blob in /research carries the full ResearchResponse).
+	scanner.Buffer(make([]byte, 0, 64<<10), 4<<20)
+
+	var event, data string
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			// Blank line terminates an event block — dispatch.
+			if event != "" {
+				if err := handle(event, data); err != nil {
+					if errors.Is(err, errSSEDone) {
+						return nil
+					}
+					return err
+				}
+			}
+			event, data = "", ""
+			continue
+		}
+		switch {
+		case strings.HasPrefix(line, "event:"):
+			event = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
+		case strings.HasPrefix(line, "data:"):
+			d := strings.TrimSpace(strings.TrimPrefix(line, "data:"))
+			if data == "" {
+				data = d
+			} else {
+				data = data + "\n" + d
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return fmt.Errorf("read stream: %w", err)
+	}
+	// Stream ended without a terminal event — caller's responsibility to flag
+	// (this function just reports the natural end-of-stream as success).
+	return nil
+}
+
+// consumeResearchSSE reads a /research?stream=true response body and renders
+// each event as it arrives. Terminal events: "done" (full response) emits a
+// final newline + Sources section; "error" emits the detail and returns an
+// error. First streaming CLI in cosift. Refactored in to
+// use the generic forEachSSEEvent scanner.
+func consumeResearchSSE(body io.Reader, format string) error {
+	useMarkdown := format == "md" || format == "markdown"
+	var answerStarted, sawDone bool
+	// capture pebble-serve's sources event payload so we can render
+	// the final Sources section when pebble's minimal done event arrives.
+	var pebbleSources []server.AnswerSource
+
+	err := forEachSSEEvent(body, func(event, data string) error {
+		switch event {
+		case "warnings":
+			// pebble-serve emits this event when the
+			// request had silent no-ops. Surface to stderr like the sync CLI.
+			var w struct {
+				Warnings []string `json:"warnings"`
+			}
+			if err := json.Unmarshal([]byte(data), &w); err == nil {
+				for _, msg := range w.Warnings {
+					fmt.Fprintln(os.Stderr, "cosift: warning:", msg)
+				}
+			}
+		case "plan":
+			var p struct {
+				Strategy string   `json:"strategy"`
+				Variants []string `json:"variants"`
+				// pebble-serve uses 'plan' for the sub-query list and
+				// emits an 'expand' label instead of 'strategy'. Decode both
+				// shapes; fall back to "planner" when only plan is set.
+				Plan   []string `json:"plan"`
+				Expand string   `json:"expand"`
+			}
+			if err := json.Unmarshal([]byte(data), &p); err != nil {
+				return nil // tolerate malformed mid-stream event
+			}
+			strategy := p.Strategy
+			variants := p.Variants
+			if strategy == "" && len(p.Plan) > 0 {
+				strategy = "planner"
+				if p.Expand != "" {
+					strategy = "planner+" + p.Expand
+				}
+			}
+			if len(variants) == 0 {
+				variants = p.Plan
+			}
+			if useMarkdown {
+				fmt.Printf("> Strategy: `%s`", strategy)
+				if len(variants) > 0 {
+					fmt.Printf(" (plan: %s)", strings.Join(variants, " | "))
+				}
+				fmt.Println()
+				fmt.Println()
+			} else {
+				fmt.Printf("Strategy: %s", strategy)
+				if len(variants) > 0 {
+					fmt.Printf(" (plan: %s)", strings.Join(variants, " | "))
+				}
+				fmt.Println()
+			}
+		case "retrieved":
+			var r struct {
+				Variant string   `json:"variant"`
+				URLs    []string `json:"urls"`
+			}
+			if err := json.Unmarshal([]byte(data), &r); err != nil {
+				return nil
+			}
+			fmt.Printf("[retrieved %d url(s) for %q]\n", len(r.URLs), r.Variant)
+		case "synthesizing":
+			var s struct {
+				Sources int `json:"sources"`
+			}
+			if err := json.Unmarshal([]byte(data), &s); err != nil {
+				return nil
+			}
+			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", s.Sources)
+		case "sources":
+			// pebble-serve emits one 'sources' event after retrieval
+			// that combines what the SQLite server splits across
+			// retrieved+synthesizing. Render the same progress line.
+			// also capture the sources slice so the final 'done'
+			// event (pebble's is minimal) can still render the Sources block.
+			var s struct {
+				Sources []server.AnswerSource `json:"sources"`
+			}
+			if err := json.Unmarshal([]byte(data), &s); err != nil {
+				return nil
+			}
+			pebbleSources = s.Sources
+			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", len(s.Sources))
+		case "answer_chunk":
+			var c struct {
+				Text string `json:"text"`
+			}
+			if err := json.Unmarshal([]byte(data), &c); err != nil {
+				return nil
+			}
+			fmt.Print(c.Text)
+			answerStarted = true
+		case "done":
+			sawDone = true
+			if answerStarted {
+				fmt.Println()
+			}
+			var rr server.ResearchResponse
+			if err := json.Unmarshal([]byte(data), &rr); err != nil || len(rr.Sources) == 0 {
+				// pebble's done event has a minimal payload —
+				// fall back to the sources captured from the event.
+				renderStreamingSources(pebbleSources, useMarkdown)
+				return errSSEDone
+			}
+			renderStreamingSources(rr.Sources, useMarkdown)
+			return errSSEDone
+		case "error":
+			var e struct {
+				Detail string `json:"detail"`
+				// pebble-serve uses 'error' field instead of 'detail'.
+				Error string `json:"error"`
+				// pebble-serve tags errors with the phase that failed.
+				Phase string `json:"phase"`
+			}
+			_ = json.Unmarshal([]byte(data), &e)
+			msg := e.Detail
+			if msg == "" {
+				msg = e.Error
+			}
+			if e.Phase != "" {
+				return fmt.Errorf("server stream error (phase=%s): %s", e.Phase, msg)
+			}
+			return fmt.Errorf("server stream error: %s", msg)
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	if !sawDone {
+		// Stream ended without a terminal event — flag for operators but
+		// don't error (matches behavior).
+		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
+	}
+	return nil
+}
+
+// renderStreamingSources writes the terminal Sources section for both the
+// research and answer SSE consumers. Format matches the non-stream paths so
+// operators get consistent output regardless of whether they used -stream.
+// position-based ID fallback for source rendering when the
+// server didn't emit an id field (pebble-serve's source payload). SQLite-side
+// servers always emit non-zero IDs, so their output is unchanged.
+func sourceIDOf(i int, s server.AnswerSource) int {
+	if s.ID > 0 {
+		return s.ID
+	}
+	return i + 1
+}
+
+func renderStreamingSources(sources []server.AnswerSource, useMarkdown bool) {
+	if len(sources) == 0 {
+		return
+	}
+	idOf := sourceIDOf
+	if useMarkdown {
+		fmt.Println()
+		fmt.Println("## Sources")
+		fmt.Println()
+		for i, s := range sources {
+			fmt.Fprintf(os.Stdout, "%d. [%s](%s)", idOf(i, s), s.Title, s.URL)
+			var trailing []string
+			if s.Domain != "" {
+				trailing = append(trailing, s.Domain)
+			}
+			if s.PublishedAt != nil {
+				trailing = append(trailing, s.PublishedAt.Format("2006-01-02"))
+			}
+			if len(trailing) > 0 {
+				fmt.Printf(" — %s", strings.Join(trailing, ", "))
+			}
+			fmt.Println()
+		}
+		return
+	}
+	fmt.Println()
+	fmt.Println("Sources:")
+	for i, s := range sources {
+		date := ""
+		if s.PublishedAt != nil {
+			date = " " + s.PublishedAt.Format("2006-01-02")
+		}
+		domain := ""
+		if s.Domain != "" {
+			domain = " [" + s.Domain + "]"
+		}
+		fmt.Printf("  [%d]%s%s %s\n      %s\n", idOf(i, s), domain, date, s.Title, s.URL)
+	}
+}
+
+// consumeAnswerSSE reads an /answer?stream=true response and renders events as
+// they arrive. Same event vocabulary as consumeResearchSSE minus the `plan`
+// event (/answer has no expansion phase).
+func consumeAnswerSSE(body io.Reader, format string) error {
+	useMarkdown := format == "md" || format == "markdown"
+	var answerStarted, sawDone bool
+	var pebbleSources []server.AnswerSource //
+
+	err := forEachSSEEvent(body, func(event, data string) error {
+		switch event {
+		case "warnings":
+			// pebble-serve emits this event when the
+			// request had silent no-ops. Surface to stderr.
+			var w struct {
+				Warnings []string `json:"warnings"`
+			}
+			if err := json.Unmarshal([]byte(data), &w); err == nil {
+				for _, msg := range w.Warnings {
+					fmt.Fprintln(os.Stderr, "cosift: warning:", msg)
+				}
+			}
+		case "retrieved":
+			// /answer emits a single retrieved event with the k URLs (vs
+			// /research's one-per-variant).
+			var r struct {
+				URLs []string `json:"urls"`
+			}
+			if err := json.Unmarshal([]byte(data), &r); err != nil {
+				return nil
+			}
+			fmt.Printf("[retrieved %d source(s)]\n", len(r.URLs))
+		case "synthesizing":
+			var s struct {
+				Sources int `json:"sources"`
+			}
+			if err := json.Unmarshal([]byte(data), &s); err != nil {
+				return nil
+			}
+			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", s.Sources)
+		case "sources":
+			// pebble-serve emits 'sources' as the combined
+			// retrieved+synthesizing signal. Render the synthesizing line.
+			// capture for the final Sources block.
+			var s struct {
+				Sources []server.AnswerSource `json:"sources"`
+			}
+			if err := json.Unmarshal([]byte(data), &s); err != nil {
+				return nil
+			}
+			pebbleSources = s.Sources
+			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", len(s.Sources))
+		case "answer_chunk":
+			var c struct {
+				Text string `json:"text"`
+			}
+			if err := json.Unmarshal([]byte(data), &c); err != nil {
+				return nil
+			}
+			fmt.Print(c.Text)
+			answerStarted = true
+		case "done":
+			sawDone = true
+			if answerStarted {
+				fmt.Println()
+			}
+			var ar server.AnswerResponse
+			if err := json.Unmarshal([]byte(data), &ar); err != nil || len(ar.Sources) == 0 {
+				// tolerate pebble's minimal done payload; fall
+				// back to the sources captured from the sources event.
+				renderStreamingSources(pebbleSources, useMarkdown)
+				return errSSEDone
+			}
+			renderStreamingSources(ar.Sources, useMarkdown)
+			return errSSEDone
+		case "error":
+			var e struct {
+				Detail string `json:"detail"`
+				// pebble-serve uses 'error' field instead of 'detail'.
+				Error string `json:"error"`
+				// pebble-serve tags errors with the phase that failed.
+				Phase string `json:"phase"`
+			}
+			_ = json.Unmarshal([]byte(data), &e)
+			msg := e.Detail
+			if msg == "" {
+				msg = e.Error
+			}
+			if e.Phase != "" {
+				return fmt.Errorf("server stream error (phase=%s): %s", e.Phase, msg)
+			}
+			return fmt.Errorf("server stream error: %s", msg)
+		}
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+	if !sawDone {
+		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
+	}
+	return nil
+}
+
+// errSSEDone signals consumeResearchSSE's outer loop that the terminal "done"
+// event was processed and the read loop should exit cleanly. Sentinel error,
+// not surfaced to the caller.
+var errSSEDone = errors.New("sse-done")
+
+// validateFormat returns nil if v is one of the accepted output-format values
+// for the synth CLIs (`-format`). "" is rejected — flag.String defaults to ""
+// when the user passes `-format` without a value, and we want that to fail
+// loudly rather than silently behave as text.
+func validateFormat(v string) error {
+	switch v {
+	case "text", "md", "markdown":
+		return nil
+	default:
+		return fmt.Errorf("format must be one of: text, markdown (got %q)", v)
+	}
+}
+
+func runResearchCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
+	fs := flag.NewFlagSet("research", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	strategy := fs.String("strategy", "", "planner | paraphrase (server default if empty)")
+	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
+	stream := fs.Bool("stream", false, "stream progress + token-by-token answer over SSE.")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable answer+sources")
+	// Expose the quality + scope flags on the CLI.
+	k := fs.Int("k", 0, "number of sources fed to synth (1-20, server default if 0)")
+	expand := fs.String("expand", "", "retrieval expansion: hyde | paraphrase (empty = no expansion)")
+	rerank := fs.Bool("rerank", false, "rerank retrieved sources before synth")
+	// per-sub-query retriever choice — applies to every sub-query
+	// the planner emits. Server uses bm25 by default if this is empty.
+	retriever := fs.String("retriever", "", "retriever: bm25 | dense | hybrid (server must have HNSW + embedder for dense/hybrid)")
+	// MMR lambda passthrough for /research.
+	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (needs HNSW + embedder server-side)")
+	since := fs.String("since", "", "ISO date — only sources published on or after")
+	until := fs.String("until", "", "ISO date — only sources published on or before")
+	includeDomains := fs.String("include-domains", "", "CSV allowlist of source domains")
+	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of source domains")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if err := validateFormat(*format); err != nil {
+		return err
+	}
+	if *stream && *jsonOut {
+		return errors.New("-stream and -json are mutually exclusive (stream is event-by-event, json is the final blob)")
+	}
+	if *k < 0 || *k > 20 {
+		return errors.New("k must be in [1, 20] or 0 to use server default")
+	}
+
+	v := url.Values{}
+	v.Set("q", q)
+	if *strategy != "" {
+		v.Set("strategy", *strategy)
+	}
+	if *k > 0 {
+		v.Set("k", strconv.Itoa(*k))
+	}
+	if *expand != "" {
+		v.Set("expand", *expand)
+	}
+	if *rerank {
+		v.Set("rerank", "true")
+	}
+	if *retriever != "" {
+		v.Set("retriever", *retriever)
+	}
+	if *mmr != "" {
+		v.Set("mmr", *mmr)
+	}
+	if *since != "" {
+		v.Set("since", *since)
+	}
+	if *until != "" {
+		v.Set("until", *until)
+	}
+	if *includeDomains != "" {
+		v.Set("include_domains", *includeDomains)
+	}
+	if *excludeDomains != "" {
+		v.Set("exclude_domains", *excludeDomains)
+	}
+	if *stream {
+		v.Set("stream", "true")
+	}
+
+	endpoint := strings.TrimRight(*serverURL, "/") + "/research?" + v.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return err
+	}
+	if *stream {
+		req.Header.Set("Accept", "text/event-stream")
+	}
+	// /research issues multiple LLM calls (expand + retrieve + synth); bump the
+	// client timeout from search's 30s so slow chat backends don't get cut off.
+	// In stream mode the timeout has to cover the whole response (multiple LLM
+	// chunks emitted incrementally), so it's still 120s — there's no per-event
+	// deadline; if needed in future, a custom transport timeout would do that.
+	client := &http.Client{Timeout: 120 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	if *stream {
+		if resp.StatusCode != http.StatusOK {
+			// Server may emit a JSON problem doc on non-200 even with SSE Accept.
+			b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
+			return fmt.Errorf("server %d: %s", resp.StatusCode, b)
+		}
+		return consumeResearchSSE(resp.Body, *format)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	emitWarnings(body)
+	var rr server.ResearchResponse
+	if err := json.Unmarshal(body, &rr); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	if *format == "md" || *format == "markdown" {
+		fmt.Print(renderAnswerMarkdown(rr.Query, rr.Strategy, rr.Plan, rr.Answer, rr.Sources))
+		return nil
+	}
+	fmt.Printf("Q: %s\n", rr.Query)
+	if rr.Strategy != "" {
+		fmt.Printf("Strategy: %s", rr.Strategy)
+		if len(rr.Plan) > 0 {
+			fmt.Printf(" (plan: %s)", strings.Join(rr.Plan, " | "))
+		}
+		fmt.Println()
+	}
+	fmt.Println()
+	fmt.Println(rr.Answer)
+	if len(rr.Sources) > 0 {
+		fmt.Println()
+		fmt.Println("Sources:")
+		for i, s := range rr.Sources {
+			date := ""
+			if s.PublishedAt != nil {
+				date = " " + s.PublishedAt.Format("2006-01-02")
+			}
+			domain := ""
+			if s.Domain != "" {
+				domain = " [" + s.Domain + "]"
+			}
+			fmt.Printf("  [%d]%s%s %s\n      %s\n", sourceIDOf(i, s), domain, date, s.Title, s.URL)
+		}
+	}
+	return nil
+}
+
+// runFindSimilarCLI hits a running cosift server's /find_similar endpoint.
+// Completes the  CLI matrix:
+//   - query        local BM25 only
+//   - search       /search (full retrieval pipeline)
+//   - research     /research (LLM synthesis)
+//   - find-similar /find_similar (dense neighbors of an indexed URL)
+func runFindSimilarCLI(ctx context.Context, cfg *config.Config, sourceURL string, args []string) error {
+	fs := flag.NewFlagSet("find-similar", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	k := fs.Int("k", 10, "max results")
+	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable list")
+	// alternative inputs — feed arbitrary text (or a file of text)
+	// instead of an indexed source URL. Mirrors /find_similar text mode.
+	textInput := fs.String("text", "", "arbitrary text for content-based MLT (no positional URL needed)")
+	textFile := fs.String("text-file", "", "read MLT source text from FILE")
+	textTitle := fs.String("text-title", "", "optional title (×3 boost) when using -text or -text-file")
+	// surface the filter + rerank flags on the CLI.
+	rerank := fs.Bool("rerank", false, "rerank neighbors against the MLT query (server must have rerank configured)")
+	// retriever choice — bm25-mlt (default) | dense | hybrid.
+	// Dense reads source vector from HNSW for URL-mode; hybrid RRF-fuses
+	// BM25-MLT and dense. Both require COSIFT_LOAD_HNSW=true server-side.
+	retriever := fs.String("retriever", "", "retriever: bm25 (BM25-MLT) | dense | hybrid (server must have HNSW; text-mode dense/hybrid also needs embedder)")
+	// MMR diversification for /find_similar.
+	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (URL-mode reuses graph vector — no embedder needed)")
+	since := fs.String("since", "", "ISO date — only neighbors published on or after")
+	until := fs.String("until", "", "ISO date — only neighbors published on or before")
+	includeDomains := fs.String("include-domains", "", "CSV allowlist of neighbor domains")
+	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of neighbor domains")
+	qExtra := fs.String("q", "", "extra query terms appended to the auto-derived MLT query")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *k <= 0 || *k > 100 {
+		return errors.New("k must be in [1, 100]")
+	}
+	if err := validateFormat(*format); err != nil {
+		return err
+	}
+
+	if *textFile != "" {
+		buf, err := os.ReadFile(*textFile)
+		if err != nil {
+			return fmt.Errorf("read -text-file %s: %w", *textFile, err)
+		}
+		*textInput = string(buf)
+	}
+	if sourceURL == "" && *textInput == "" {
+		return errors.New("find-similar: positional URL or -text/-text-file required")
+	}
+
+	v := url.Values{}
+	if sourceURL != "" {
+		v.Set("url", sourceURL)
+	}
+	if *textInput != "" {
+		v.Set("text", *textInput)
+	}
+	if *textTitle != "" {
+		v.Set("title", *textTitle)
+	}
+	v.Set("k", strconv.Itoa(*k))
+	// filter + rerank passthroughs.
+	if *rerank {
+		v.Set("rerank", "true")
+	}
+	if *retriever != "" {
+		v.Set("retriever", *retriever)
+	}
+	if *mmr != "" {
+		v.Set("mmr", *mmr)
+	}
+	if *since != "" {
+		v.Set("since", *since)
+	}
+	if *until != "" {
+		v.Set("until", *until)
+	}
+	if *includeDomains != "" {
+		v.Set("include_domains", *includeDomains)
+	}
+	if *excludeDomains != "" {
+		v.Set("exclude_domains", *excludeDomains)
+	}
+	if *qExtra != "" {
+		v.Set("q", *qExtra)
+	}
+
+	// switch GET → POST when -text is large (URL params have practical
+	// limits ~8 KB). The POST endpoint accepts the same flag set as a JSON body.
+	useMethod := http.MethodGet
+	endpoint := strings.TrimRight(*serverURL, "/") + "/find_similar?" + v.Encode()
+	var bodyBuf io.Reader
+	if len(*textInput) > 4096 {
+		useMethod = http.MethodPost
+		body := map[string]any{"k": *k}
+		if sourceURL != "" {
+			body["url"] = sourceURL
+		}
+		if *textInput != "" {
+			body["text"] = *textInput
+		}
+		if *textTitle != "" {
+			body["title"] = *textTitle
+		}
+		if *rerank {
+			body["rerank"] = true
+		}
+		if *retriever != "" {
+			body["retriever"] = *retriever
+		}
+		if *mmr != "" {
+			body["mmr"] = *mmr
+		}
+		if *since != "" {
+			body["since"] = *since
+		}
+		if *until != "" {
+			body["until"] = *until
+		}
+		if *includeDomains != "" {
+			body["include_domains"] = *includeDomains
+		}
+		if *excludeDomains != "" {
+			body["exclude_domains"] = *excludeDomains
+		}
+		if *qExtra != "" {
+			body["q"] = *qExtra
+		}
+		jb, _ := json.Marshal(body)
+		bodyBuf = bytes.NewReader(jb)
+		endpoint = strings.TrimRight(*serverURL, "/") + "/find_similar"
+	}
+	req, err := http.NewRequestWithContext(ctx, useMethod, endpoint, bodyBuf)
+	if err != nil {
+		return err
+	}
+	if useMethod == http.MethodPost {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	// /find_similar embeds the source doc (one embedder call) and does a vector
+	// search — 30s mirrors search's timeout.
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	emitWarnings(body)
+	var fr server.FindSimilarResponse
+	if err := json.Unmarshal(body, &fr); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	if *format == "md" || *format == "markdown" {
+		fmt.Print(renderRankedMarkdown("Similar to: "+fr.URL, fr.Hits))
+		return nil
+	}
+	if len(fr.Hits) == 0 {
+		fmt.Println("(no similar documents)")
+		return nil
+	}
+	fmt.Printf("Similar to: %s\n\n", fr.URL)
+	for i, h := range fr.Hits {
+		date := ""
+		if h.PublishedAt != nil {
+			date = " " + h.PublishedAt.Format("2006-01-02")
+		}
+		domain := ""
+		if h.Domain != "" {
+			domain = " [" + h.Domain + "]"
+		}
+		fmt.Printf("%2d. [%.3f]%s%s %s\n    %s\n", i+1, h.Score, domain, date, h.Title, h.URL)
+	}
+	return nil
+}
+
+// runContentsCLI hits a running cosift server's /contents endpoint.
+// Single URL → GET /contents?url=<url>. Multiple URLs (positional or via
+// -file) → POST /contents with {urls: [...]} body.
+func runContentsCLI(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("contents", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	filePath := fs.String("file", "", "read URLs from FILE (one per line, # comments allowed)")
+	textOnly := fs.Bool("text", false, "print only the document text (no metadata) — useful for piping into LLMs")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable output")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+
+	urls := fs.Args()
+	if *filePath != "" {
+		extra, err := readURLsFromFile(*filePath)
+		if err != nil {
+			return fmt.Errorf("read -file: %w", err)
+		}
+		urls = append(urls, extra...)
+	}
+	if len(urls) == 0 {
+		return errors.New("at least one URL or -file required")
+	}
+
+	base := strings.TrimRight(*serverURL, "/")
+	client := &http.Client{Timeout: 60 * time.Second}
+
+	if len(urls) == 1 {
+		// Single — GET /contents?url=<url>.
+		v := url.Values{}
+		v.Set("url", urls[0])
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/contents?"+v.Encode(), http.NoBody)
+		if err != nil {
+			return err
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			return fmt.Errorf("get %s: %w", *serverURL, err)
+		}
+		defer resp.Body.Close()
+		body, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
+		if err != nil {
+			return fmt.Errorf("read response: %w", err)
+		}
+		if resp.StatusCode != http.StatusOK {
+			return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+		}
+		if *jsonOut {
+			fmt.Println(string(body))
+			return nil
+		}
+		var cr server.ContentsResponse
+		if err := json.Unmarshal(body, &cr); err != nil {
+			return fmt.Errorf("decode response: %w", err)
+		}
+		if *textOnly {
+			fmt.Println(cr.Text)
+			return nil
+		}
+		fmt.Printf("URL:        %s\n", cr.URL)
+		fmt.Printf("Title:      %s\n", cr.Title)
+		fmt.Printf("Cached:     %t\n", cr.Cached)
+		if !cr.FetchedAt.IsZero() {
+			fmt.Printf("FetchedAt:  %s\n", cr.FetchedAt.Format(time.RFC3339))
+		}
+		if cr.Lang != "" {
+			fmt.Printf("Lang:       %s\n", cr.Lang)
+		}
+		fmt.Println()
+		fmt.Println(cr.Text)
+		return nil
+	}
+
+	// Batch — POST /contents with {urls: [...]}.
+	reqBody, err := json.Marshal(server.ContentsBatchRequest{URLs: urls})
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+"/contents", bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("post %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 64<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	var br server.ContentsBatchResponse
+	if err := json.Unmarshal(body, &br); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	if *textOnly {
+		// Separator between docs lets downstream tools chunk by `---` if they want.
+		for i, item := range br.Results {
+			if i > 0 {
+				fmt.Println("---")
+			}
+			if !item.Found {
+				continue
+			}
+			fmt.Println(item.Text)
+		}
+		return nil
+	}
+	for _, item := range br.Results {
+		fmt.Printf("URL: %s\n", item.URL)
+		if !item.Found {
+			fmt.Printf("  (not found: %s)\n\n", item.Error)
+			continue
+		}
+		status := "fetched"
+		if item.Cached {
+			status = "cached"
+		}
+		fmt.Printf("  Title:      %s\n", item.Title)
+		fmt.Printf("  Status:     %s\n", status)
+		if !item.FetchedAt.IsZero() {
+			fmt.Printf("  FetchedAt:  %s\n", item.FetchedAt.Format(time.RFC3339))
+		}
+		if item.Lang != "" {
+			fmt.Printf("  Lang:       %s\n", item.Lang)
+		}
+		fmt.Printf("  Text:       %s\n\n", truncate(item.Text, 240))
+	}
+	return nil
+}
+
+// readURLsFromFile parses one URL per line. Blank lines and `#`-prefixed
+// comments are ignored. Used by `cosift contents -file`.
+func readURLsFromFile(path string) ([]string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	var urls []string
+	for _, line := range strings.Split(string(b), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		urls = append(urls, line)
+	}
+	return urls, nil
+}
+
+// runAnswerCLI hits a running cosift server's /answer endpoint. Sibling to
+// runResearchCLI but no planner/paraphrase strategy surface —
+// /answer just retrieves k sources and synthesizes a cited answer. Smaller K
+// cap [1,20] mirrors the server's bound (vs /search's [1,100]).
+func runAnswerCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
+	fs := flag.NewFlagSet("answer", flag.ExitOnError)
+	defaultServer := "http://" + cfg.Server.Addr
+	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
+	serverURL := fs.String("server", defaultServer, "cosift server URL")
+	k := fs.Int("k", 5, "number of sources to retrieve (1-20)")
+	expand := fs.Bool("expand", false, "LLM paraphrase + RRF fusion of retrieval inputs (server must have a paraphraser)")
+	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
+	stream := fs.Bool("stream", false, "stream progress + token-by-token answer over SSE.")
+	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable answer+sources")
+	// Expose the quality + scope flags on the CLI.
+	rerank := fs.Bool("rerank", false, "rerank retrieved sources before synth (server must have rerank configured)")
+	// Empty
+	// passes nothing → server uses its default (bm25).
+	retriever := fs.String("retriever", "", "retriever: bm25 | dense | hybrid (server must have HNSW + embedder for dense/hybrid)")
+	// MMR lambda passthrough. Empty → no diversification.
+	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (0.7 = mostly relevance with some diversity; needs HNSW + embedder server-side)")
+	since := fs.String("since", "", "ISO date — only sources published on or after")
+	until := fs.String("until", "", "ISO date — only sources published on or before")
+	includeDomains := fs.String("include-domains", "", "CSV allowlist of source domains")
+	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of source domains")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *k <= 0 || *k > 20 {
+		return errors.New("k must be in [1, 20]")
+	}
+	if err := validateFormat(*format); err != nil {
+		return err
+	}
+	if *stream && *jsonOut {
+		return errors.New("-stream and -json are mutually exclusive (stream is event-by-event, json is the final blob)")
+	}
+
+	v := url.Values{}
+	v.Set("q", q)
+	v.Set("k", strconv.Itoa(*k))
+	if *expand {
+		v.Set("expand", "true")
+	}
+	if *rerank {
+		v.Set("rerank", "true")
+	}
+	if *retriever != "" {
+		v.Set("retriever", *retriever)
+	}
+	if *mmr != "" {
+		v.Set("mmr", *mmr)
+	}
+	if *since != "" {
+		v.Set("since", *since)
+	}
+	if *until != "" {
+		v.Set("until", *until)
+	}
+	if *includeDomains != "" {
+		v.Set("include_domains", *includeDomains)
+	}
+	if *excludeDomains != "" {
+		v.Set("exclude_domains", *excludeDomains)
+	}
+	if *stream {
+		v.Set("stream", "true")
+	}
+
+	endpoint := strings.TrimRight(*serverURL, "/") + "/answer?" + v.Encode()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return err
+	}
+	if *stream {
+		req.Header.Set("Accept", "text/event-stream")
+	}
+	// /answer issues retrieval + 1 synth LLM call; 120s mirrors /research.
+	client := &http.Client{Timeout: 120 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("get %s: %w", *serverURL, err)
+	}
+	defer resp.Body.Close()
+	if *stream {
+		if resp.StatusCode != http.StatusOK {
+			b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
+			return fmt.Errorf("server %d: %s", resp.StatusCode, b)
+		}
+		return consumeAnswerSSE(resp.Body, *format)
+	}
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
+	}
+
+	if *jsonOut {
+		fmt.Println(string(body))
+		return nil
+	}
+	emitWarnings(body)
+	var ar server.AnswerResponse
+	if err := json.Unmarshal(body, &ar); err != nil {
+		return fmt.Errorf("decode response: %w", err)
+	}
+	if *format == "md" || *format == "markdown" {
+		// /answer has no strategy or plan — pass empty/nil so the shared
+		// renderer just skips the strategy line.
+		fmt.Print(renderAnswerMarkdown(ar.Query, "", nil, ar.Answer, ar.Sources))
+		return nil
+	}
+	fmt.Printf("Q: %s\n\n", ar.Query)
+	fmt.Println(ar.Answer)
+	if len(ar.Sources) > 0 {
+		fmt.Println()
+		fmt.Println("Sources:")
+		for i, s := range ar.Sources {
+			date := ""
+			if s.PublishedAt != nil {
+				date = " " + s.PublishedAt.Format("2006-01-02")
+			}
+			domain := ""
+			if s.Domain != "" {
+				domain = " [" + s.Domain + "]"
+			}
+			fmt.Printf("  [%d]%s%s %s\n      %s\n", sourceIDOf(i, s), domain, date, s.Title, s.URL)
+		}
+	}
+	return nil
+}
diff --git a/cmd/cosift/cmd_serve.go b/cmd/cosift/cmd_serve.go
new file mode 100644
index 0000000..7f52e25
--- /dev/null
+++ b/cmd/cosift/cmd_serve.go
@@ -0,0 +1,210 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/crawler"
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/rerank"
+	"github.com/pilot-protocol/cosift/internal/server"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// authStatus describes how a configured capability will authenticate to its
+// endpoint, for /doctor output.
+func authStatus(configured bool, key string, urlSet bool) string {
+	switch {
+	case !configured:
+		return "(none)"
+	case key != "":
+		return "bearer-token"
+	case urlSet:
+		return "anonymous(custom-url)"
+	default:
+		return "MISSING"
+	}
+}
+
+// hnswPassageWriter bridges the crawler's PassageWriter contract to
+// an in-memory index.HNSW graph. Each embedded passage looks up the doc's URL
+// and Title (via *PebbleStore.GetDocByID) and is inserted into the graph; the
+// graph is persisted to Pebble's 'v' family in a single Persist() call at the
+// end of the crawl.
+type hnswPassageWriter struct {
+	ps   *store.PebbleStore
+	hnsw *index.HNSW
+}
+
+func (w *hnswPassageWriter) UpsertPassage(ctx context.Context, p *store.Passage) error {
+	doc, err := w.ps.GetDocByID(ctx, p.DocID)
+	if err != nil {
+		return err
+	}
+	if doc == nil {
+		return nil // doc was deleted between index and embed — skip silently
+	}
+	w.hnsw.AddPassage(doc.URL, doc.Title, p.Offset, p.Length, p.Embedding)
+	return nil
+}
+
+// UpsertPassageBatch writes all passages in a single HNSW lock
+// acquisition — meaningful when a doc has many chunks. Implements the
+// optional crawler.PassageWriterBatch interface; the crawler will call
+// this when present instead of looping UpsertPassage per chunk.
+func (w *hnswPassageWriter) UpsertPassageBatch(ctx context.Context, ps []*store.Passage) error {
+	if len(ps) == 0 {
+		return nil
+	}
+	// All passages in a batch belong to the same DocID (the crawler hands
+	// us one doc's chunks). Resolve url + title once.
+	doc, err := w.ps.GetDocByID(ctx, ps[0].DocID)
+	if err != nil {
+		return err
+	}
+	if doc == nil {
+		return nil
+	}
+	items := make([]index.PassageInput, 0, len(ps))
+	for _, p := range ps {
+		items = append(items, index.PassageInput{
+			URL: doc.URL, Title: doc.Title, Offset: p.Offset, Length: p.Length, Vec: p.Embedding,
+		})
+	}
+	w.hnsw.AddPassageBatch(items)
+	return nil
+}
+
+// MarkURLInvalid satisfies the optional crawler.URLInvalidator interface.
+// Lets the crawler reclaim zombie passages (prior generations of chunks for
+// the same URL) before pushing a fresh chunk batch. Returns count zeroed.
+func (w *hnswPassageWriter) MarkURLInvalid(ctx context.Context, url string) (int, error) {
+	if err := ctx.Err(); err != nil {
+		return 0, err
+	}
+	return w.hnsw.MarkURLPassagesInvalid(url), nil
+}
+
+func runServe(ctx context.Context, cfg *config.Config) error {
+	s, err := store.Open(cfg.DataDir)
+	if err != nil {
+		return err
+	}
+	defer s.Close()
+
+	srv := server.New(s)
+	// Instance-wide retrieval defaults from cfg.Defaults. Per-request query
+	// params still override; this is just what the handler picks up when the
+	// caller doesn't specify.
+	srv = srv.WithDefaults(server.Defaults{
+		Retriever:         cfg.Defaults.Retriever,
+		Expand:            cfg.Defaults.Expand,
+		ResearchStrategy:  cfg.Defaults.ResearchStrategy,
+		ResearchSynthK:    cfg.Defaults.ResearchSynthK,
+		ExpandMainWeight:  cfg.Defaults.ExpandMainWeight,
+		HybridDenseWeight: cfg.Defaults.HybridDenseWeight,
+	})
+	if cfg.Defaults.Retriever != "" || cfg.Defaults.Expand || cfg.Defaults.ResearchStrategy != "" || cfg.Defaults.ResearchSynthK > 0 || cfg.Defaults.ExpandMainWeight > 0 || cfg.Defaults.HybridDenseWeight > 0 {
+		log.Printf("defaults: retriever=%q expand=%v research_strategy=%q research_synth_k=%d expand_main_weight=%v hybrid_dense_weight=%v",
+			cfg.Defaults.Retriever, cfg.Defaults.Expand, cfg.Defaults.ResearchStrategy, cfg.Defaults.ResearchSynthK, cfg.Defaults.ExpandMainWeight, cfg.Defaults.HybridDenseWeight)
+	}
+	// thread chunker config to /admin/reembed handler so re-embed
+	// produces passages with the same shape as crawl-time indexing.
+	if cfg.Crawler.ChunkSize > 0 || cfg.Crawler.ChunkOverlap > 0 {
+		srv = srv.WithChunker(cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
+		log.Printf("chunker: size=%d overlap=%d", cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
+	}
+	if tok := cfg.Server.AdminToken; tok != "" {
+		srv = srv.WithAdminToken(tok)
+		log.Printf("/admin/* endpoints enabled (bearer-auth)")
+	}
+	if len(cfg.Server.TrustedProxies) > 0 {
+		s2, err := srv.WithTrustedProxies(cfg.Server.TrustedProxies)
+		if err != nil {
+			return fmt.Errorf("trusted_proxies: %w", err)
+		}
+		srv = s2
+		log.Printf("X-Forwarded-For trusted from %v", cfg.Server.TrustedProxies)
+	}
+
+	// Auto-wire embeddings if model is set and an API key is in env.
+	if cfg.Embeddings.Model != "" {
+		apiKey := os.Getenv("OPENAI_API_KEY")
+		if apiKey == "" {
+			apiKey = os.Getenv("OPENAI")
+		}
+		if apiKey == "" {
+			log.Printf("warning: embeddings configured but no OPENAI_API_KEY in env; dense/hybrid disabled")
+		} else {
+			model := cfg.Embeddings.Model
+			dim := cfg.Embeddings.Dim
+			if dim == 0 {
+				dim = 1536
+			}
+			emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, model, dim)
+			vi, err := index.LoadVectorIndex(ctx, s, model, dim)
+			if err != nil {
+				return fmt.Errorf("load vector index: %w", err)
+			}
+			srv = srv.WithVector(vi, emb)
+			log.Printf("vector index loaded: %d passages, model=%s dim=%d", vi.Len(), model, dim)
+
+			// Chat is opt-in via cfg.Chat.Model. Reuses the same API key.
+			if cfg.Chat.Model != "" {
+				chat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Chat.Model)
+				srv = srv.WithChat(chat)
+				log.Printf("/answer enabled with chat model=%s", cfg.Chat.Model)
+				// Auto-enable /search?expand=true via the same chat client.
+				// measured +0.02 nDCG at 10k distractors for $0.004 per run.
+				srv = srv.WithParaphraser(chat, 2)
+				log.Printf("/search?expand=true enabled (auto-paraphrase via %s)", cfg.Chat.Model)
+			}
+
+			// Reranker: HTTP backend wins if URL is set; otherwise LLM backend
+			// (only if chat is configured). Either is opt-out via cfg.Rerank.Enabled=false
+			// even when configured.
+			var rr rerank.Reranker
+			rerankWanted := cfg.Rerank.URL != "" || cfg.Chat.Model != ""
+			if !cfg.Rerank.Enabled && rerankWanted {
+				// Default ON when wired; flip cfg.Rerank.Enabled false to skip.
+				cfg.Rerank.Enabled = true
+			}
+			if cfg.Rerank.Enabled && cfg.Rerank.URL != "" {
+				rerankKey := cfg.Rerank.APIKey
+				if rerankKey == "" {
+					rerankKey = firstEnv("COHERE_API_KEY", "VOYAGE_API_KEY")
+				}
+				rr = rerank.NewHTTPReranker(cfg.Rerank.URL, rerankKey, cfg.Rerank.Model)
+				log.Printf("rerank enabled with http endpoint=%s model=%s", cfg.Rerank.URL, cfg.Rerank.Model)
+			} else if cfg.Rerank.Enabled && cfg.Chat.Model != "" {
+				rerankModel := cfg.Rerank.Model
+				if rerankModel == "" {
+					rerankModel = cfg.Chat.Model
+				}
+				rerankChat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, rerankModel)
+				rr = rerank.NewLLMReranker(rerankChat)
+				log.Printf("rerank enabled with LLM model=%s (fallback path; consider an HTTP reranker for cost)", rerankModel)
+			}
+			if rr != nil {
+				srv = srv.WithReranker(rr, cfg.Rerank.CandidateK)
+			}
+		}
+	}
+
+	// On-demand /contents: use the crawler's FetchOne. Doesn't share the worker
+	// pool's rate gate or robots cache — callers should set a sensible UA + body cap.
+	srv = srv.WithFetcher(func(ctx context.Context, u string) (string, string, string, error) {
+		r, err := crawler.FetchOne(ctx, nil, cfg.Crawler.UserAgent, u, cfg.Crawler.MaxBodyBytes)
+		if err != nil {
+			return "", "", "", err
+		}
+		return r.Title, r.Text, r.Lang, nil
+	})
+
+	log.Printf("cosift serving on %s", cfg.Server.Addr)
+	return server.ListenAndServe(ctx, cfg.Server.Addr, srv.Handler())
+}
diff --git a/cmd/cosift/main.go b/cmd/cosift/main.go
index 47c7b85..eff60a4 100644
--- a/cmd/cosift/main.go
+++ b/cmd/cosift/main.go
@@ -1,42 +1,19 @@
 package main
 
 import (
-	"bufio"
-	"bytes"
 	"context"
-	"crypto/sha256"
-	"encoding/csv"
-	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
-	"io"
-	"log"
-	"math/rand"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
 	"os"
 	"os/signal"
-	"path/filepath"
-	"regexp"
 	"runtime/debug"
-	"sort"
-	"strconv"
 	"strings"
-	"sync"
 	"syscall"
-	"time"
 
-	"github.com/pilot-protocol/cosift/internal/authority"
 	"github.com/pilot-protocol/cosift/internal/config"
 	"github.com/pilot-protocol/cosift/internal/crawler"
-	"github.com/pilot-protocol/cosift/internal/embed"
-	"github.com/pilot-protocol/cosift/internal/eval"
 	"github.com/pilot-protocol/cosift/internal/index"
-	"github.com/pilot-protocol/cosift/internal/rerank"
-	"github.com/pilot-protocol/cosift/internal/server"
-	"github.com/pilot-protocol/cosift/internal/store"
 )
 
 const usage = `cosift — self-hostable search + research
@@ -366,21 +343,6 @@ func run(cfgPath string) error {
 	return nil
 }
 
-// authStatus describes how a configured capability will authenticate to its
-// endpoint, for /doctor output.
-func authStatus(configured bool, key string, urlSet bool) string {
-	switch {
-	case !configured:
-		return "(none)"
-	case key != "":
-		return "bearer-token"
-	case urlSet:
-		return "anonymous(custom-url)"
-	default:
-		return "MISSING"
-	}
-}
-
 // resolveAPIKey returns the first non-empty API key from a slot-specific env
 // var, falling back to OPENAI_API_KEY / OPENAI. Lets operators using a
 // non-OpenAI embedder or chat endpoint name keys for what they
@@ -415,6100 +377,39 @@ func resolveAPIKey(slot string) string {
 // callers should use resolveAPIKey("embed").
 func resolveEmbedAPIKey() string { return resolveAPIKey("embed") }
 
-// hnswPassageWriter bridges the crawler's PassageWriter contract to
-// an in-memory index.HNSW graph. Each embedded passage looks up the doc's URL
-// and Title (via *PebbleStore.GetDocByID) and is inserted into the graph; the
-// graph is persisted to Pebble's 'v' family in a single Persist() call at the
-// end of the crawl.
-type hnswPassageWriter struct {
-	ps   *store.PebbleStore
-	hnsw *index.HNSW
-}
-
-func (w *hnswPassageWriter) UpsertPassage(ctx context.Context, p *store.Passage) error {
-	doc, err := w.ps.GetDocByID(ctx, p.DocID)
-	if err != nil {
-		return err
-	}
-	if doc == nil {
-		return nil // doc was deleted between index and embed — skip silently
-	}
-	w.hnsw.AddPassage(doc.URL, doc.Title, p.Offset, p.Length, p.Embedding)
-	return nil
-}
-
-// UpsertPassageBatch writes all passages in a single HNSW lock
-// acquisition — meaningful when a doc has many chunks. Implements the
-// optional crawler.PassageWriterBatch interface; the crawler will call
-// this when present instead of looping UpsertPassage per chunk.
-func (w *hnswPassageWriter) UpsertPassageBatch(ctx context.Context, ps []*store.Passage) error {
-	if len(ps) == 0 {
-		return nil
-	}
-	// All passages in a batch belong to the same DocID (the crawler hands
-	// us one doc's chunks). Resolve url + title once.
-	doc, err := w.ps.GetDocByID(ctx, ps[0].DocID)
-	if err != nil {
-		return err
-	}
-	if doc == nil {
-		return nil
-	}
-	items := make([]index.PassageInput, 0, len(ps))
-	for _, p := range ps {
-		items = append(items, index.PassageInput{
-			URL: doc.URL, Title: doc.Title, Offset: p.Offset, Length: p.Length, Vec: p.Embedding,
-		})
-	}
-	w.hnsw.AddPassageBatch(items)
-	return nil
-}
-
-// MarkURLInvalid satisfies the optional crawler.URLInvalidator interface.
-// Lets the crawler reclaim zombie passages (prior generations of chunks for
-// the same URL) before pushing a fresh chunk batch. Returns count zeroed.
-func (w *hnswPassageWriter) MarkURLInvalid(ctx context.Context, url string) (int, error) {
-	if err := ctx.Err(); err != nil {
-		return 0, err
-	}
-	return w.hnsw.MarkURLPassagesInvalid(url), nil
-}
-
-func runCrawl(ctx context.Context, cfg *config.Config, args []string) error {
-	// hoisted PebbleStore handle so the embedder wiring below can
-	// reach it to attach the HNSW bridge after the backend switch.
-	var pebbleStoreForCrawl *store.PebbleStore
-	fs := flag.NewFlagSet("crawl", flag.ExitOnError)
-	refresh := fs.Bool("refresh", false, "force re-crawl of URLs already in the frontier")
-	sitemap := fs.String("sitemap", "", "URL of a sitemap.xml (or sitemap index) to seed from")
-	seedsFile := fs.String("seeds-file", "", "path to a text file with one seed URL per line (blank lines and # comments ignored)")
-	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
-	duration := fs.Duration("duration", 0, "stop the crawl cleanly after this much time (0 = run until frontier empty or SIGTERM)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	urls := fs.Args()
-	// -seeds-file lets operators target specific websites in bulk
-	// without stuffing dozens of URLs on the command line. Each non-blank,
-	// non-comment line is treated as a seed.
-	if *seedsFile != "" {
-		buf, err := os.ReadFile(*seedsFile)
-		if err != nil {
-			return fmt.Errorf("read -seeds-file %s: %w", *seedsFile, err)
-		}
-		for _, line := range strings.Split(string(buf), "\n") {
-			s := strings.TrimSpace(line)
-			if s == "" || strings.HasPrefix(s, "#") {
-				continue
-			}
-			urls = append(urls, s)
-		}
-		log.Printf("crawler: loaded %d seeds from %s (after dedup of positional args, total queued = %d)", len(urls)-fs.NArg(), *seedsFile, len(urls))
-	}
-	if len(urls) == 0 && *sitemap == "" {
-		return errors.New("crawl: at least one URL, -seeds-file, or -sitemap is required")
-	}
-
-	// Wraps the caller's ctx with a
-	// timeout; workers see ctx.Err() != nil and exit cleanly. Pebble flushes
-	// on Close (via the deferred ps.Close() below) so durability is preserved.
-	if *duration > 0 {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, *duration)
-		defer cancel()
-		log.Printf("crawler: bounded run, will stop after %s", *duration)
-	}
-
-	var c *crawler.Crawler
-	switch *backend {
-	case "sqlite", "":
-		s, err := store.Open(cfg.DataDir)
-		if err != nil {
-			return err
-		}
-		defer s.Close()
-		c = crawler.New(cfg.Crawler, s)
-	case "pebble":
-		// route through the  Pebble path. The
-		// data dir layout under cfg.DataDir for Pebble: a sibling "pebble"
-		// subdir so SQLite and Pebble stores can coexist during migration.
-		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
-		var err error
-		pebbleStoreForCrawl, err = openPebbleOrFriendlyErr(pebbleDir)
-		if err != nil {
-			return err
-		}
-		defer pebbleStoreForCrawl.Close()
-		c = crawler.NewWithBackend(cfg.Crawler, pebbleStoreForCrawl, index.NewPebbleBM25(pebbleStoreForCrawl))
-		log.Printf("crawler: pebble backend at %s", pebbleDir)
-	default:
-		return fmt.Errorf("crawl: unknown -backend %q (want: sqlite | pebble)", *backend)
-	}
-
-	// Authority-weighted frontier priority: load Tranco / Majestic CSVs when
-	// configured. The scorer is read-only after loading — safe to share with
-	// the crawler's concurrent worker pool.
-	if cfg.Crawler.AuthorityPriority {
-		scorer := authority.New()
-		if cfg.Crawler.AuthorityTrancoCSV != "" {
-			f, ferr := os.Open(cfg.Crawler.AuthorityTrancoCSV)
-			if ferr != nil {
-				log.Printf("crawler: authority: open tranco csv %s: %v (skipping)", cfg.Crawler.AuthorityTrancoCSV, ferr)
-			} else {
-				n, lerr := scorer.LoadTranco(f)
-				_ = f.Close()
-				if lerr != nil {
-					log.Printf("crawler: authority: load tranco: %v (skipping)", lerr)
-				} else {
-					log.Printf("crawler: authority: loaded %d tranco entries from %s", n, cfg.Crawler.AuthorityTrancoCSV)
-				}
-			}
-		}
-		if cfg.Crawler.AuthorityMajesticCSV != "" {
-			f, ferr := os.Open(cfg.Crawler.AuthorityMajesticCSV)
-			if ferr != nil {
-				log.Printf("crawler: authority: open majestic csv %s: %v (skipping)", cfg.Crawler.AuthorityMajesticCSV, ferr)
-			} else {
-				n, lerr := scorer.LoadMajestic(f)
-				_ = f.Close()
-				if lerr != nil {
-					log.Printf("crawler: authority: load majestic: %v (skipping)", lerr)
-				} else {
-					log.Printf("crawler: authority: loaded %d majestic entries from %s", n, cfg.Crawler.AuthorityMajesticCSV)
-				}
-			}
-		}
-		// Even without CSV data the embedded whitelist in authority.New() gives
-		// known-good sites (arxiv, MDN, Wikipedia, kernel.org, …) a priority boost.
-		c = c.WithAuthority(scorer)
-		log.Printf("crawler: authority-weighted frontier priority enabled (tranco=%s majestic=%s)",
-			cfg.Crawler.AuthorityTrancoCSV, cfg.Crawler.AuthorityMajesticCSV)
-	}
-
-	// Auto-wire embedder when configured. For the Pebble backend, also
-	// build and persist an HNSW graph via the hnswPassageWriter bridge
-	// — that's the path /search?retriever=dense
-	// needs and that pre was a documented no-op.
-	// API key is OPTIONAL when cfg.Embeddings.URL points at a
-	// custom endpoint (Ollama / vLLM / TEI / etc — local self-hosted
-	// embedders don't need a Bearer token). Required only when hitting the
-	// default OpenAI endpoint.
-	if cfg.Embeddings.Model != "" {
-		apiKey := resolveEmbedAPIKey()
-		needsKey := cfg.Embeddings.URL == "" // default OpenAI requires a key
-		if apiKey != "" || !needsKey {
-			dim := cfg.Embeddings.Dim
-			if dim == 0 {
-				dim = 1536
-			}
-			emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
-			c = c.WithEmbedder(emb)
-			authStatus := "anonymous"
-			if apiKey != "" {
-				authStatus = "bearer-token"
-			}
-			log.Printf("crawler: dense embeddings enabled (model=%s, dim=%d, auth=%s)", cfg.Embeddings.Model, dim, authStatus)
-			if pebbleStoreForCrawl != nil {
-				h := index.NewHNSW(dim)
-				c = c.WithPassageWriter(&hnswPassageWriter{ps: pebbleStoreForCrawl, hnsw: h})
-				// periodic checkpoint every COSIFT_HNSW_CHECKPOINT_SEC
-				// (default 60s). Without this, a crash / SIGKILL / time-cap
-				// deadline mid-crawl loses all in-memory vectors because Persist
-				// only runs at deferred end-of-crawl. Goroutine exits when
-				// ctx.Done() fires (either deadline or SIGTERM).
-				checkpointEvery := 60 * time.Second
-				if v := os.Getenv("COSIFT_HNSW_CHECKPOINT_SEC"); v != "" {
-					if s, err := strconv.Atoi(v); err == nil && s >= 5 {
-						checkpointEvery = time.Duration(s) * time.Second
-					}
-				}
-				log.Printf("crawler: HNSW vector index attached (in-memory build, checkpoint every %s, final persist at crawl end)", checkpointEvery)
-				ckpDone := make(chan struct{})
-				go func() {
-					defer close(ckpDone)
-					t := time.NewTicker(checkpointEvery)
-					defer t.Stop()
-					var lastN int
-					for {
-						select {
-						case <-ctx.Done():
-							return
-						case <-t.C:
-							n := h.Len()
-							if n == 0 || n == lastN {
-								continue // nothing new to persist
-							}
-							log.Printf("crawler: HNSW checkpoint at %d nodes (delta=%d) ...", n, n-lastN)
-							if err := h.Persist(context.Background(), pebbleStoreForCrawl); err != nil {
-								log.Printf("crawler: HNSW checkpoint failed: %v", err)
-								continue
-							}
-							lastN = n
-						}
-					}
-				}()
-				defer func() {
-					<-ckpDone // ensure ticker goroutine exits before final persist
-					if h.Len() == 0 {
-						return
-					}
-					log.Printf("crawler: final HNSW persist (%d nodes, dim=%d) to Pebble...", h.Len(), dim)
-					if err := h.Persist(context.Background(), pebbleStoreForCrawl); err != nil {
-						log.Printf("crawler: HNSW persist failed: %v", err)
-					} else {
-						log.Printf("crawler: HNSW persist complete")
-					}
-				}()
-			}
-		} else {
-			log.Printf("warning: embeddings configured (default OpenAI endpoint) but no OPENAI_API_KEY in env; crawling BM25 only")
-		}
-	}
-	if *sitemap != "" {
-		n, err := c.SeedSitemap(ctx, *sitemap)
-		if err != nil {
-			return fmt.Errorf("sitemap %s: %w", *sitemap, err)
-		}
-		log.Printf("seeded %d URLs from sitemap %s", n, *sitemap)
-	}
-	for _, u := range urls {
-		if *refresh {
-			if err := c.Recrawl(ctx, u); err != nil {
-				return fmt.Errorf("recrawl %s: %w", u, err)
-			}
-		} else {
-			if err := c.Seed(u); err != nil {
-				return fmt.Errorf("seed %s: %w", u, err)
-			}
-		}
-	}
-	return c.Run(ctx)
-}
-
-func runQuery(ctx context.Context, cfg *config.Config, q string, args []string) error {
-	fs := flag.NewFlagSet("query", flag.ExitOnError)
-	k := fs.Int("k", 10, "max results")
-	jsonOut := fs.Bool("json", false, "emit JSON array instead of human-readable list — for shell pipelines")
-	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *k <= 0 || *k > 100 {
-		return errors.New("k must be in [1, 100]")
-	}
-
-	// -backend flag mirrors on crawl + stats. Both
-	// BM25 implementations expose the same Search(ctx, q, k) signature so
-	// the rest of runQuery is backend-agnostic.
-	type searcher interface {
-		Search(ctx context.Context, q string, k int) ([]index.Hit, error)
-	}
-	var idx searcher
-	switch *backend {
-	case "sqlite", "":
-		s, err := store.Open(cfg.DataDir)
-		if err != nil {
-			return err
-		}
-		defer s.Close()
-		idx = index.NewBM25(s)
-	case "pebble":
-		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
-		ps, err := openPebbleOrFriendlyErr(pebbleDir)
-		if err != nil {
-			return err
-		}
-		defer ps.Close()
-		// runQuery previously
-		// always used defaults; with env overrides set, score values diverged
-		// silently from pebble-serve's. Now they line up.
-		pidx := index.NewPebbleBM25(ps)
-		applyBM25EnvOverrides(pidx)
-		idx = pidx
-	default:
-		return fmt.Errorf("query: unknown -backend %q (want: sqlite | pebble)", *backend)
-	}
-	hits, err := idx.Search(ctx, q, *k)
-	if err != nil {
-		return err
-	}
-
-	if *jsonOut {
-		// Wire format matches the public /search response's per-hit shape
-		// (sans Highlight / Domain / Excerpt — those need a store lookup
-		// and `cosift query` is the no-server path).
-		type jsonHit struct {
-			URL   string  `json:"url"`
-			Title string  `json:"title"`
-			Score float64 `json:"score"`
-		}
-		out := make([]jsonHit, len(hits))
-		for i, h := range hits {
-			out[i] = jsonHit{URL: h.URL, Title: h.Title, Score: h.Score}
-		}
-		b, err := json.Marshal(out)
-		if err != nil {
-			return err
-		}
-		fmt.Println(string(b))
-		return nil
-	}
-	for i, h := range hits {
-		fmt.Printf("%2d. [%.3f] %s\n    %s\n", i+1, h.Score, h.Title, h.URL)
-	}
-	return nil
-}
-
-// runSearchCLI hits a running cosift server's /search endpoint over HTTP.
-// Unlike runQuery (local BM25 only), this exercises the full pipeline:
-// dense/hybrid retrieval, LLM rerank, paraphrase expansion, date/domain
-// filters, custom sort. Useful from operator shells without curl + jq.
-func runSearchCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
-	fs := flag.NewFlagSet("search", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	// 0.0.0.0 is a bind-only sentinel; clients must dial loopback.
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	k := fs.Int("k", 10, "max results")
-	retriever := fs.String("retriever", "", "bm25 | dense | hybrid (server default if empty)")
-	// MMR lambda passthrough for /search.
-	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (needs HNSW + embedder server-side)")
-	rerankFlag := fs.Bool("rerank", false, "wrap retrieval with LLM listwise reranker (server must have it configured)")
-	expand := fs.Bool("expand", false, "LLM paraphrase + RRF fusion (server must have a paraphraser)")
-	since := fs.String("since", "", "ISO date — only results published on or after")
-	until := fs.String("until", "", "ISO date — only results published on or before")
-	includeDomains := fs.String("include-domains", "", "comma-separated allowlist of result domains")
-	excludeDomains := fs.String("exclude-domains", "", "comma-separated denylist of result domains")
-	sortMode := fs.String("sort", "", "relevance | date_desc | date_asc (server default if empty)")
-	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable list")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *k <= 0 || *k > 100 {
-		return errors.New("k must be in [1, 100]")
-	}
-	if err := validateFormat(*format); err != nil {
-		return err
-	}
-
-	v := url.Values{}
-	v.Set("q", q)
-	v.Set("k", strconv.Itoa(*k))
-	if *retriever != "" {
-		v.Set("retriever", *retriever)
-	}
-	if *mmr != "" {
-		v.Set("mmr", *mmr)
-	}
-	if *rerankFlag {
-		v.Set("rerank", "true")
-	}
-	if *expand {
-		v.Set("expand", "true")
-	}
-	if *since != "" {
-		v.Set("since", *since)
-	}
-	if *until != "" {
-		v.Set("until", *until)
-	}
-	if *includeDomains != "" {
-		v.Set("include_domains", *includeDomains)
-	}
-	if *excludeDomains != "" {
-		v.Set("exclude_domains", *excludeDomains)
-	}
-	if *sortMode != "" {
-		v.Set("sort", *sortMode)
-	}
-
-	endpoint := strings.TrimRight(*serverURL, "/") + "/search?" + v.Encode()
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
-	if err != nil {
-		return err
-	}
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-
-	if *jsonOut {
-		// Pass the server's JSON straight through — same shape as /search.
-		fmt.Println(string(body))
-		return nil
-	}
-	emitWarnings(body)
-	var sr server.SearchResponse
-	if err := json.Unmarshal(body, &sr); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	if *format == "md" || *format == "markdown" {
-		fmt.Print(renderRankedMarkdown("Results: "+sr.Query, sr.Hits))
-		return nil
-	}
-	if len(sr.Hits) == 0 {
-		fmt.Println("(no results)")
-		return nil
-	}
-	for i, h := range sr.Hits {
-		date := ""
-		if h.PublishedAt != nil {
-			date = " " + h.PublishedAt.Format("2006-01-02")
-		}
-		domain := ""
-		if h.Domain != "" {
-			domain = " [" + h.Domain + "]"
-		}
-		fmt.Printf("%2d. [%.3f]%s%s %s\n    %s\n", i+1, h.Score, domain, date, h.Title, h.URL)
-		if h.Highlight != nil && h.Highlight.Text != "" {
-			fmt.Printf("    > %s\n", truncate(h.Highlight.Text, 200))
-		} else if h.Excerpt != "" {
-			fmt.Printf("    > %s\n", truncate(h.Excerpt, 200))
-		}
-	}
-	return nil
-}
-
-// runResearchCLI hits a running cosift server's /research endpoint over HTTP.
-// Sibling to runSearchCLI: same -server / -json affordance, but pulls
-// an LLM-synthesized answer with cited sources rather than a ranked URL list.
-// Non-streaming — the SSE mode (?stream=true) is a separate code path; this
-// returns the same JSON the non-streaming endpoint produces.
-// renderAnswerMarkdown formats a /research or /answer response as markdown,
-// suitable for piping into LLM contexts or markdown viewers. Used by both
-// runResearchCLI and runAnswerCLI via the shared `-format md|markdown` flag.
-// strategy/plan are research-only; pass "" / nil from /answer's callsite.
-func renderAnswerMarkdown(query, strategy string, plan []string, answer string, sources []server.AnswerSource) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "# %s\n\n", query)
-	if strategy != "" {
-		fmt.Fprintf(&b, "> Strategy: `%s`", strategy)
-		if len(plan) > 0 {
-			fmt.Fprintf(&b, " (plan: %s)", strings.Join(plan, " | "))
-		}
-		b.WriteString("\n\n")
-	}
-	b.WriteString(answer)
-	if !strings.HasSuffix(answer, "\n") {
-		b.WriteString("\n")
-	}
-	if len(sources) > 0 {
-		b.WriteString("\n## Sources\n\n")
-		for i, s := range sources {
-			// `N. [Title](URL)` — the leading N matches the citation IDs the
-			// LLM emits inline (e.g. `[1]` in the answer references source 1).
-			fmt.Fprintf(&b, "%d. [%s](%s)", sourceIDOf(i, s), s.Title, s.URL)
-			var trailing []string
-			if s.Domain != "" {
-				trailing = append(trailing, s.Domain)
-			}
-			if s.PublishedAt != nil {
-				trailing = append(trailing, s.PublishedAt.Format("2006-01-02"))
-			}
-			if len(trailing) > 0 {
-				fmt.Fprintf(&b, " — %s", strings.Join(trailing, ", "))
-			}
-			b.WriteString("\n")
-		}
-	}
-	return b.String()
-}
-
-// renderRankedMarkdown formats a ranked-hits response (search, find-similar)
-// as markdown for LLM piping or markdown viewers. `title` is the H1 text —
-// renderRankedMarkdown renders a ranked hit list as markdown. Callers
-// pass "Results: <query>" for /search or "Similar to: <url>" for
-// /find_similar; the hit-list shape is the same in both cases.
-func renderRankedMarkdown(title string, hits []server.SearchHit) string {
-	var b strings.Builder
-	fmt.Fprintf(&b, "# %s\n\n", title)
-	if len(hits) == 0 {
-		b.WriteString("_No results._\n")
-		return b.String()
-	}
-	for i, h := range hits {
-		fmt.Fprintf(&b, "## %d. [%s](%s)\n\n", i+1, h.Title, h.URL)
-		var meta []string
-		meta = append(meta, fmt.Sprintf("Score: %.3f", h.Score))
-		if h.Domain != "" {
-			meta = append(meta, h.Domain)
-		}
-		if h.PublishedAt != nil {
-			meta = append(meta, h.PublishedAt.Format("2006-01-02"))
-		}
-		fmt.Fprintf(&b, "_%s_\n", strings.Join(meta, " · "))
-		// Excerpt OR highlight as a blockquote. Highlight wins when both are
-		// present (it's the matched passage, more relevant than the prefix).
-		var excerpt string
-		if h.Highlight != nil && h.Highlight.Text != "" {
-			excerpt = h.Highlight.Text
-		} else if h.Excerpt != "" {
-			excerpt = h.Excerpt
-		}
-		if excerpt != "" {
-			b.WriteString("\n> ")
-			b.WriteString(truncate(excerpt, 240))
-			b.WriteString("\n")
-		}
-		// Trailing blank line between hits, but not after the last one.
-		if i < len(hits)-1 {
-			b.WriteString("\n")
-		}
-	}
-	return b.String()
-}
-
-// forEachSSEEvent reads an SSE response body and invokes handle(event, data)
-// for each `event: <name>\ndata: <json>\n\n` block. The handler can return
-// errSSEDone to signal terminal completion (the scanner returns nil), or any
-// other error to abort. Multi-line `data:` lines are concatenated with `\n`
-// per the SSE spec. Extracted from's consumeResearchSSE so
-// both research and answer CLI consumers share the framing logic.
-func forEachSSEEvent(body io.Reader, handle func(event, data string) error) error {
-	scanner := bufio.NewScanner(body)
-	// SSE events can be larger than the default 64KB scanner buffer (the
-	// terminal `done` blob in /research carries the full ResearchResponse).
-	scanner.Buffer(make([]byte, 0, 64<<10), 4<<20)
-
-	var event, data string
-	for scanner.Scan() {
-		line := scanner.Text()
-		if line == "" {
-			// Blank line terminates an event block — dispatch.
-			if event != "" {
-				if err := handle(event, data); err != nil {
-					if errors.Is(err, errSSEDone) {
-						return nil
-					}
-					return err
-				}
-			}
-			event, data = "", ""
-			continue
-		}
-		switch {
-		case strings.HasPrefix(line, "event:"):
-			event = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
-		case strings.HasPrefix(line, "data:"):
-			d := strings.TrimSpace(strings.TrimPrefix(line, "data:"))
-			if data == "" {
-				data = d
-			} else {
-				data = data + "\n" + d
-			}
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return fmt.Errorf("read stream: %w", err)
-	}
-	// Stream ended without a terminal event — caller's responsibility to flag
-	// (this function just reports the natural end-of-stream as success).
-	return nil
-}
-
-// consumeResearchSSE reads a /research?stream=true response body and renders
-// each event as it arrives. Terminal events: "done" (full response) emits a
-// final newline + Sources section; "error" emits the detail and returns an
-// error. First streaming CLI in cosift. Refactored in to
-// use the generic forEachSSEEvent scanner.
-func consumeResearchSSE(body io.Reader, format string) error {
-	useMarkdown := format == "md" || format == "markdown"
-	var answerStarted, sawDone bool
-	// capture pebble-serve's sources event payload so we can render
-	// the final Sources section when pebble's minimal done event arrives.
-	var pebbleSources []server.AnswerSource
-
-	err := forEachSSEEvent(body, func(event, data string) error {
-		switch event {
-		case "warnings":
-			// pebble-serve emits this event when the
-			// request had silent no-ops. Surface to stderr like the sync CLI.
-			var w struct {
-				Warnings []string `json:"warnings"`
-			}
-			if err := json.Unmarshal([]byte(data), &w); err == nil {
-				for _, msg := range w.Warnings {
-					fmt.Fprintln(os.Stderr, "cosift: warning:", msg)
-				}
-			}
-		case "plan":
-			var p struct {
-				Strategy string   `json:"strategy"`
-				Variants []string `json:"variants"`
-				// pebble-serve uses 'plan' for the sub-query list and
-				// emits an 'expand' label instead of 'strategy'. Decode both
-				// shapes; fall back to "planner" when only plan is set.
-				Plan   []string `json:"plan"`
-				Expand string   `json:"expand"`
-			}
-			if err := json.Unmarshal([]byte(data), &p); err != nil {
-				return nil // tolerate malformed mid-stream event
-			}
-			strategy := p.Strategy
-			variants := p.Variants
-			if strategy == "" && len(p.Plan) > 0 {
-				strategy = "planner"
-				if p.Expand != "" {
-					strategy = "planner+" + p.Expand
-				}
-			}
-			if len(variants) == 0 {
-				variants = p.Plan
-			}
-			if useMarkdown {
-				fmt.Printf("> Strategy: `%s`", strategy)
-				if len(variants) > 0 {
-					fmt.Printf(" (plan: %s)", strings.Join(variants, " | "))
-				}
-				fmt.Println()
-				fmt.Println()
-			} else {
-				fmt.Printf("Strategy: %s", strategy)
-				if len(variants) > 0 {
-					fmt.Printf(" (plan: %s)", strings.Join(variants, " | "))
-				}
-				fmt.Println()
-			}
-		case "retrieved":
-			var r struct {
-				Variant string   `json:"variant"`
-				URLs    []string `json:"urls"`
-			}
-			if err := json.Unmarshal([]byte(data), &r); err != nil {
-				return nil
-			}
-			fmt.Printf("[retrieved %d url(s) for %q]\n", len(r.URLs), r.Variant)
-		case "synthesizing":
-			var s struct {
-				Sources int `json:"sources"`
-			}
-			if err := json.Unmarshal([]byte(data), &s); err != nil {
-				return nil
-			}
-			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", s.Sources)
-		case "sources":
-			// pebble-serve emits one 'sources' event after retrieval
-			// that combines what the SQLite server splits across
-			// retrieved+synthesizing. Render the same progress line.
-			// also capture the sources slice so the final 'done'
-			// event (pebble's is minimal) can still render the Sources block.
-			var s struct {
-				Sources []server.AnswerSource `json:"sources"`
-			}
-			if err := json.Unmarshal([]byte(data), &s); err != nil {
-				return nil
-			}
-			pebbleSources = s.Sources
-			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", len(s.Sources))
-		case "answer_chunk":
-			var c struct {
-				Text string `json:"text"`
-			}
-			if err := json.Unmarshal([]byte(data), &c); err != nil {
-				return nil
-			}
-			fmt.Print(c.Text)
-			answerStarted = true
-		case "done":
-			sawDone = true
-			if answerStarted {
-				fmt.Println()
-			}
-			var rr server.ResearchResponse
-			if err := json.Unmarshal([]byte(data), &rr); err != nil || len(rr.Sources) == 0 {
-				// pebble's done event has a minimal payload —
-				// fall back to the sources captured from the event.
-				renderStreamingSources(pebbleSources, useMarkdown)
-				return errSSEDone
-			}
-			renderStreamingSources(rr.Sources, useMarkdown)
-			return errSSEDone
-		case "error":
-			var e struct {
-				Detail string `json:"detail"`
-				// pebble-serve uses 'error' field instead of 'detail'.
-				Error string `json:"error"`
-				// pebble-serve tags errors with the phase that failed.
-				Phase string `json:"phase"`
-			}
-			_ = json.Unmarshal([]byte(data), &e)
-			msg := e.Detail
-			if msg == "" {
-				msg = e.Error
-			}
-			if e.Phase != "" {
-				return fmt.Errorf("server stream error (phase=%s): %s", e.Phase, msg)
-			}
-			return fmt.Errorf("server stream error: %s", msg)
-		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	if !sawDone {
-		// Stream ended without a terminal event — flag for operators but
-		// don't error (matches behavior).
-		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
-	}
-	return nil
-}
-
-// renderStreamingSources writes the terminal Sources section for both the
-// research and answer SSE consumers. Format matches the non-stream paths so
-// operators get consistent output regardless of whether they used -stream.
-// position-based ID fallback for source rendering when the
-// server didn't emit an id field (pebble-serve's source payload). SQLite-side
-// servers always emit non-zero IDs, so their output is unchanged.
-func sourceIDOf(i int, s server.AnswerSource) int {
-	if s.ID > 0 {
-		return s.ID
-	}
-	return i + 1
-}
-
-func renderStreamingSources(sources []server.AnswerSource, useMarkdown bool) {
-	if len(sources) == 0 {
-		return
-	}
-	idOf := sourceIDOf
-	if useMarkdown {
-		fmt.Println()
-		fmt.Println("## Sources")
-		fmt.Println()
-		for i, s := range sources {
-			fmt.Fprintf(os.Stdout, "%d. [%s](%s)", idOf(i, s), s.Title, s.URL)
-			var trailing []string
-			if s.Domain != "" {
-				trailing = append(trailing, s.Domain)
-			}
-			if s.PublishedAt != nil {
-				trailing = append(trailing, s.PublishedAt.Format("2006-01-02"))
-			}
-			if len(trailing) > 0 {
-				fmt.Printf(" — %s", strings.Join(trailing, ", "))
-			}
-			fmt.Println()
-		}
-		return
-	}
-	fmt.Println()
-	fmt.Println("Sources:")
-	for i, s := range sources {
-		date := ""
-		if s.PublishedAt != nil {
-			date = " " + s.PublishedAt.Format("2006-01-02")
-		}
-		domain := ""
-		if s.Domain != "" {
-			domain = " [" + s.Domain + "]"
+// firstEnv returns the first non-empty value among the named environment vars.
+func firstEnv(names ...string) string {
+	for _, n := range names {
+		if v := os.Getenv(n); v != "" {
+			return v
 		}
-		fmt.Printf("  [%d]%s%s %s\n      %s\n", idOf(i, s), domain, date, s.Title, s.URL)
 	}
+	return ""
 }
 
-// consumeAnswerSSE reads an /answer?stream=true response and renders events as
-// they arrive. Same event vocabulary as consumeResearchSSE minus the `plan`
-// event (/answer has no expansion phase).
-func consumeAnswerSSE(body io.Reader, format string) error {
-	useMarkdown := format == "md" || format == "markdown"
-	var answerStarted, sawDone bool
-	var pebbleSources []server.AnswerSource //
-
-	err := forEachSSEEvent(body, func(event, data string) error {
-		switch event {
-		case "warnings":
-			// pebble-serve emits this event when the
-			// request had silent no-ops. Surface to stderr.
-			var w struct {
-				Warnings []string `json:"warnings"`
-			}
-			if err := json.Unmarshal([]byte(data), &w); err == nil {
-				for _, msg := range w.Warnings {
-					fmt.Fprintln(os.Stderr, "cosift: warning:", msg)
-				}
-			}
-		case "retrieved":
-			// /answer emits a single retrieved event with the k URLs (vs
-			// /research's one-per-variant).
-			var r struct {
-				URLs []string `json:"urls"`
-			}
-			if err := json.Unmarshal([]byte(data), &r); err != nil {
-				return nil
-			}
-			fmt.Printf("[retrieved %d source(s)]\n", len(r.URLs))
-		case "synthesizing":
-			var s struct {
-				Sources int `json:"sources"`
-			}
-			if err := json.Unmarshal([]byte(data), &s); err != nil {
-				return nil
-			}
-			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", s.Sources)
-		case "sources":
-			// pebble-serve emits 'sources' as the combined
-			// retrieved+synthesizing signal. Render the synthesizing line.
-			// capture for the final Sources block.
-			var s struct {
-				Sources []server.AnswerSource `json:"sources"`
-			}
-			if err := json.Unmarshal([]byte(data), &s); err != nil {
-				return nil
-			}
-			pebbleSources = s.Sources
-			fmt.Printf("[synthesizing answer over %d source(s)]\n\n", len(s.Sources))
-		case "answer_chunk":
-			var c struct {
-				Text string `json:"text"`
-			}
-			if err := json.Unmarshal([]byte(data), &c); err != nil {
-				return nil
-			}
-			fmt.Print(c.Text)
-			answerStarted = true
-		case "done":
-			sawDone = true
-			if answerStarted {
-				fmt.Println()
-			}
-			var ar server.AnswerResponse
-			if err := json.Unmarshal([]byte(data), &ar); err != nil || len(ar.Sources) == 0 {
-				// tolerate pebble's minimal done payload; fall
-				// back to the sources captured from the sources event.
-				renderStreamingSources(pebbleSources, useMarkdown)
-				return errSSEDone
-			}
-			renderStreamingSources(ar.Sources, useMarkdown)
-			return errSSEDone
-		case "error":
-			var e struct {
-				Detail string `json:"detail"`
-				// pebble-serve uses 'error' field instead of 'detail'.
-				Error string `json:"error"`
-				// pebble-serve tags errors with the phase that failed.
-				Phase string `json:"phase"`
-			}
-			_ = json.Unmarshal([]byte(data), &e)
-			msg := e.Detail
-			if msg == "" {
-				msg = e.Error
-			}
-			if e.Phase != "" {
-				return fmt.Errorf("server stream error (phase=%s): %s", e.Phase, msg)
-			}
-			return fmt.Errorf("server stream error: %s", msg)
+func contains(ss []string, x string) bool {
+	for _, s := range ss {
+		if s == x {
+			return true
 		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	if !sawDone {
-		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
-	}
-	return nil
-}
-
-// errSSEDone signals consumeResearchSSE's outer loop that the terminal "done"
-// event was processed and the read loop should exit cleanly. Sentinel error,
-// not surfaced to the caller.
-var errSSEDone = errors.New("sse-done")
-
-// validateFormat returns nil if v is one of the accepted output-format values
-// for the synth CLIs (`-format`). "" is rejected — flag.String defaults to ""
-// when the user passes `-format` without a value, and we want that to fail
-// loudly rather than silently behave as text.
-func validateFormat(v string) error {
-	switch v {
-	case "text", "md", "markdown":
-		return nil
-	default:
-		return fmt.Errorf("format must be one of: text, markdown (got %q)", v)
 	}
+	return false
 }
 
-func runResearchCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
-	fs := flag.NewFlagSet("research", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	strategy := fs.String("strategy", "", "planner | paraphrase (server default if empty)")
-	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
-	stream := fs.Bool("stream", false, "stream progress + token-by-token answer over SSE.")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable answer+sources")
-	// Expose the quality + scope flags on the CLI.
-	k := fs.Int("k", 0, "number of sources fed to synth (1-20, server default if 0)")
-	expand := fs.String("expand", "", "retrieval expansion: hyde | paraphrase (empty = no expansion)")
-	rerank := fs.Bool("rerank", false, "rerank retrieved sources before synth")
-	// per-sub-query retriever choice — applies to every sub-query
-	// the planner emits. Server uses bm25 by default if this is empty.
-	retriever := fs.String("retriever", "", "retriever: bm25 | dense | hybrid (server must have HNSW + embedder for dense/hybrid)")
-	// MMR lambda passthrough for /research.
-	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (needs HNSW + embedder server-side)")
-	since := fs.String("since", "", "ISO date — only sources published on or after")
-	until := fs.String("until", "", "ISO date — only sources published on or before")
-	includeDomains := fs.String("include-domains", "", "CSV allowlist of source domains")
-	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of source domains")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if err := validateFormat(*format); err != nil {
-		return err
-	}
-	if *stream && *jsonOut {
-		return errors.New("-stream and -json are mutually exclusive (stream is event-by-event, json is the final blob)")
-	}
-	if *k < 0 || *k > 20 {
-		return errors.New("k must be in [1, 20] or 0 to use server default")
-	}
-
-	v := url.Values{}
-	v.Set("q", q)
-	if *strategy != "" {
-		v.Set("strategy", *strategy)
-	}
-	if *k > 0 {
-		v.Set("k", strconv.Itoa(*k))
-	}
-	if *expand != "" {
-		v.Set("expand", *expand)
-	}
-	if *rerank {
-		v.Set("rerank", "true")
-	}
-	if *retriever != "" {
-		v.Set("retriever", *retriever)
-	}
-	if *mmr != "" {
-		v.Set("mmr", *mmr)
-	}
-	if *since != "" {
-		v.Set("since", *since)
-	}
-	if *until != "" {
-		v.Set("until", *until)
-	}
-	if *includeDomains != "" {
-		v.Set("include_domains", *includeDomains)
-	}
-	if *excludeDomains != "" {
-		v.Set("exclude_domains", *excludeDomains)
-	}
-	if *stream {
-		v.Set("stream", "true")
-	}
-
-	endpoint := strings.TrimRight(*serverURL, "/") + "/research?" + v.Encode()
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
-	if err != nil {
-		return err
-	}
-	if *stream {
-		req.Header.Set("Accept", "text/event-stream")
-	}
-	// /research issues multiple LLM calls (expand + retrieve + synth); bump the
-	// client timeout from search's 30s so slow chat backends don't get cut off.
-	// In stream mode the timeout has to cover the whole response (multiple LLM
-	// chunks emitted incrementally), so it's still 120s — there's no per-event
-	// deadline; if needed in future, a custom transport timeout would do that.
-	client := &http.Client{Timeout: 120 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	if *stream {
-		if resp.StatusCode != http.StatusOK {
-			// Server may emit a JSON problem doc on non-200 even with SSE Accept.
-			b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
-			return fmt.Errorf("server %d: %s", resp.StatusCode, b)
-		}
-		return consumeResearchSSE(resp.Body, *format)
-	}
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	emitWarnings(body)
-	var rr server.ResearchResponse
-	if err := json.Unmarshal(body, &rr); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	if *format == "md" || *format == "markdown" {
-		fmt.Print(renderAnswerMarkdown(rr.Query, rr.Strategy, rr.Plan, rr.Answer, rr.Sources))
-		return nil
-	}
-	fmt.Printf("Q: %s\n", rr.Query)
-	if rr.Strategy != "" {
-		fmt.Printf("Strategy: %s", rr.Strategy)
-		if len(rr.Plan) > 0 {
-			fmt.Printf(" (plan: %s)", strings.Join(rr.Plan, " | "))
-		}
-		fmt.Println()
-	}
-	fmt.Println()
-	fmt.Println(rr.Answer)
-	if len(rr.Sources) > 0 {
-		fmt.Println()
-		fmt.Println("Sources:")
-		for i, s := range rr.Sources {
-			date := ""
-			if s.PublishedAt != nil {
-				date = " " + s.PublishedAt.Format("2006-01-02")
-			}
-			domain := ""
-			if s.Domain != "" {
-				domain = " [" + s.Domain + "]"
-			}
-			fmt.Printf("  [%d]%s%s %s\n      %s\n", sourceIDOf(i, s), domain, date, s.Title, s.URL)
-		}
+func abs(n int) int {
+	if n < 0 {
+		return -n
 	}
-	return nil
+	return n
 }
 
-// runFindSimilarCLI hits a running cosift server's /find_similar endpoint.
-// Completes the  CLI matrix:
-//   - query        local BM25 only
-//   - search       /search (full retrieval pipeline)
-//   - research     /research (LLM synthesis)
-//   - find-similar /find_similar (dense neighbors of an indexed URL)
-func runFindSimilarCLI(ctx context.Context, cfg *config.Config, sourceURL string, args []string) error {
-	fs := flag.NewFlagSet("find-similar", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	k := fs.Int("k", 10, "max results")
-	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable list")
-	// alternative inputs — feed arbitrary text (or a file of text)
-	// instead of an indexed source URL. Mirrors /find_similar text mode.
-	textInput := fs.String("text", "", "arbitrary text for content-based MLT (no positional URL needed)")
-	textFile := fs.String("text-file", "", "read MLT source text from FILE")
-	textTitle := fs.String("text-title", "", "optional title (×3 boost) when using -text or -text-file")
-	// surface the filter + rerank flags on the CLI.
-	rerank := fs.Bool("rerank", false, "rerank neighbors against the MLT query (server must have rerank configured)")
-	// retriever choice — bm25-mlt (default) | dense | hybrid.
-	// Dense reads source vector from HNSW for URL-mode; hybrid RRF-fuses
-	// BM25-MLT and dense. Both require COSIFT_LOAD_HNSW=true server-side.
-	retriever := fs.String("retriever", "", "retriever: bm25 (BM25-MLT) | dense | hybrid (server must have HNSW; text-mode dense/hybrid also needs embedder)")
-	// MMR diversification for /find_similar.
-	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (URL-mode reuses graph vector — no embedder needed)")
-	since := fs.String("since", "", "ISO date — only neighbors published on or after")
-	until := fs.String("until", "", "ISO date — only neighbors published on or before")
-	includeDomains := fs.String("include-domains", "", "CSV allowlist of neighbor domains")
-	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of neighbor domains")
-	qExtra := fs.String("q", "", "extra query terms appended to the auto-derived MLT query")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *k <= 0 || *k > 100 {
-		return errors.New("k must be in [1, 100]")
-	}
-	if err := validateFormat(*format); err != nil {
-		return err
-	}
-
-	if *textFile != "" {
-		buf, err := os.ReadFile(*textFile)
-		if err != nil {
-			return fmt.Errorf("read -text-file %s: %w", *textFile, err)
-		}
-		*textInput = string(buf)
-	}
-	if sourceURL == "" && *textInput == "" {
-		return errors.New("find-similar: positional URL or -text/-text-file required")
-	}
-
-	v := url.Values{}
-	if sourceURL != "" {
-		v.Set("url", sourceURL)
-	}
-	if *textInput != "" {
-		v.Set("text", *textInput)
-	}
-	if *textTitle != "" {
-		v.Set("title", *textTitle)
-	}
-	v.Set("k", strconv.Itoa(*k))
-	// filter + rerank passthroughs.
-	if *rerank {
-		v.Set("rerank", "true")
-	}
-	if *retriever != "" {
-		v.Set("retriever", *retriever)
-	}
-	if *mmr != "" {
-		v.Set("mmr", *mmr)
-	}
-	if *since != "" {
-		v.Set("since", *since)
-	}
-	if *until != "" {
-		v.Set("until", *until)
-	}
-	if *includeDomains != "" {
-		v.Set("include_domains", *includeDomains)
-	}
-	if *excludeDomains != "" {
-		v.Set("exclude_domains", *excludeDomains)
-	}
-	if *qExtra != "" {
-		v.Set("q", *qExtra)
-	}
-
-	// switch GET → POST when -text is large (URL params have practical
-	// limits ~8 KB). The POST endpoint accepts the same flag set as a JSON body.
-	useMethod := http.MethodGet
-	endpoint := strings.TrimRight(*serverURL, "/") + "/find_similar?" + v.Encode()
-	var bodyBuf io.Reader
-	if len(*textInput) > 4096 {
-		useMethod = http.MethodPost
-		body := map[string]any{"k": *k}
-		if sourceURL != "" {
-			body["url"] = sourceURL
-		}
-		if *textInput != "" {
-			body["text"] = *textInput
-		}
-		if *textTitle != "" {
-			body["title"] = *textTitle
-		}
-		if *rerank {
-			body["rerank"] = true
-		}
-		if *retriever != "" {
-			body["retriever"] = *retriever
-		}
-		if *mmr != "" {
-			body["mmr"] = *mmr
-		}
-		if *since != "" {
-			body["since"] = *since
-		}
-		if *until != "" {
-			body["until"] = *until
-		}
-		if *includeDomains != "" {
-			body["include_domains"] = *includeDomains
-		}
-		if *excludeDomains != "" {
-			body["exclude_domains"] = *excludeDomains
-		}
-		if *qExtra != "" {
-			body["q"] = *qExtra
-		}
-		jb, _ := json.Marshal(body)
-		bodyBuf = bytes.NewReader(jb)
-		endpoint = strings.TrimRight(*serverURL, "/") + "/find_similar"
-	}
-	req, err := http.NewRequestWithContext(ctx, useMethod, endpoint, bodyBuf)
-	if err != nil {
-		return err
-	}
-	if useMethod == http.MethodPost {
-		req.Header.Set("Content-Type", "application/json")
-	}
-	// /find_similar embeds the source doc (one embedder call) and does a vector
-	// search — 30s mirrors search's timeout.
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	emitWarnings(body)
-	var fr server.FindSimilarResponse
-	if err := json.Unmarshal(body, &fr); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	if *format == "md" || *format == "markdown" {
-		fmt.Print(renderRankedMarkdown("Similar to: "+fr.URL, fr.Hits))
-		return nil
-	}
-	if len(fr.Hits) == 0 {
-		fmt.Println("(no similar documents)")
-		return nil
-	}
-	fmt.Printf("Similar to: %s\n\n", fr.URL)
-	for i, h := range fr.Hits {
-		date := ""
-		if h.PublishedAt != nil {
-			date = " " + h.PublishedAt.Format("2006-01-02")
-		}
-		domain := ""
-		if h.Domain != "" {
-			domain = " [" + h.Domain + "]"
-		}
-		fmt.Printf("%2d. [%.3f]%s%s %s\n    %s\n", i+1, h.Score, domain, date, h.Title, h.URL)
-	}
-	return nil
-}
-
-// runContentsCLI hits a running cosift server's /contents endpoint.
-// Single URL → GET /contents?url=<url>. Multiple URLs (positional or via
-// -file) → POST /contents with {urls: [...]} body.
-func runContentsCLI(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("contents", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	filePath := fs.String("file", "", "read URLs from FILE (one per line, # comments allowed)")
-	textOnly := fs.Bool("text", false, "print only the document text (no metadata) — useful for piping into LLMs")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable output")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	urls := fs.Args()
-	if *filePath != "" {
-		extra, err := readURLsFromFile(*filePath)
-		if err != nil {
-			return fmt.Errorf("read -file: %w", err)
-		}
-		urls = append(urls, extra...)
-	}
-	if len(urls) == 0 {
-		return errors.New("at least one URL or -file required")
-	}
-
-	base := strings.TrimRight(*serverURL, "/")
-	client := &http.Client{Timeout: 60 * time.Second}
-
-	if len(urls) == 1 {
-		// Single — GET /contents?url=<url>.
-		v := url.Values{}
-		v.Set("url", urls[0])
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/contents?"+v.Encode(), http.NoBody)
-		if err != nil {
-			return err
-		}
-		resp, err := client.Do(req)
-		if err != nil {
-			return fmt.Errorf("get %s: %w", *serverURL, err)
-		}
-		defer resp.Body.Close()
-		body, err := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
-		if err != nil {
-			return fmt.Errorf("read response: %w", err)
-		}
-		if resp.StatusCode != http.StatusOK {
-			return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-		}
-		if *jsonOut {
-			fmt.Println(string(body))
-			return nil
-		}
-		var cr server.ContentsResponse
-		if err := json.Unmarshal(body, &cr); err != nil {
-			return fmt.Errorf("decode response: %w", err)
-		}
-		if *textOnly {
-			fmt.Println(cr.Text)
-			return nil
-		}
-		fmt.Printf("URL:        %s\n", cr.URL)
-		fmt.Printf("Title:      %s\n", cr.Title)
-		fmt.Printf("Cached:     %t\n", cr.Cached)
-		if !cr.FetchedAt.IsZero() {
-			fmt.Printf("FetchedAt:  %s\n", cr.FetchedAt.Format(time.RFC3339))
-		}
-		if cr.Lang != "" {
-			fmt.Printf("Lang:       %s\n", cr.Lang)
-		}
-		fmt.Println()
-		fmt.Println(cr.Text)
-		return nil
-	}
-
-	// Batch — POST /contents with {urls: [...]}.
-	reqBody, err := json.Marshal(server.ContentsBatchRequest{URLs: urls})
-	if err != nil {
-		return err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+"/contents", bytes.NewReader(reqBody))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("post %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 64<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	var br server.ContentsBatchResponse
-	if err := json.Unmarshal(body, &br); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	if *textOnly {
-		// Separator between docs lets downstream tools chunk by `---` if they want.
-		for i, item := range br.Results {
-			if i > 0 {
-				fmt.Println("---")
-			}
-			if !item.Found {
-				continue
-			}
-			fmt.Println(item.Text)
-		}
-		return nil
-	}
-	for _, item := range br.Results {
-		fmt.Printf("URL: %s\n", item.URL)
-		if !item.Found {
-			fmt.Printf("  (not found: %s)\n\n", item.Error)
-			continue
-		}
-		status := "fetched"
-		if item.Cached {
-			status = "cached"
-		}
-		fmt.Printf("  Title:      %s\n", item.Title)
-		fmt.Printf("  Status:     %s\n", status)
-		if !item.FetchedAt.IsZero() {
-			fmt.Printf("  FetchedAt:  %s\n", item.FetchedAt.Format(time.RFC3339))
-		}
-		if item.Lang != "" {
-			fmt.Printf("  Lang:       %s\n", item.Lang)
-		}
-		fmt.Printf("  Text:       %s\n\n", truncate(item.Text, 240))
-	}
-	return nil
-}
-
-// readURLsFromFile parses one URL per line. Blank lines and `#`-prefixed
-// comments are ignored. Used by `cosift contents -file`.
-func readURLsFromFile(path string) ([]string, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-	var urls []string
-	for _, line := range strings.Split(string(b), "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		urls = append(urls, line)
-	}
-	return urls, nil
-}
-
-// runAnswerCLI hits a running cosift server's /answer endpoint. Sibling to
-// runResearchCLI but no planner/paraphrase strategy surface —
-// /answer just retrieves k sources and synthesizes a cited answer. Smaller K
-// cap [1,20] mirrors the server's bound (vs /search's [1,100]).
-func runAnswerCLI(ctx context.Context, cfg *config.Config, q string, args []string) error {
-	fs := flag.NewFlagSet("answer", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	k := fs.Int("k", 5, "number of sources to retrieve (1-20)")
-	expand := fs.Bool("expand", false, "LLM paraphrase + RRF fusion of retrieval inputs (server must have a paraphraser)")
-	format := fs.String("format", "text", "human-output format: text | markdown (or md).")
-	stream := fs.Bool("stream", false, "stream progress + token-by-token answer over SSE.")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable answer+sources")
-	// Expose the quality + scope flags on the CLI.
-	rerank := fs.Bool("rerank", false, "rerank retrieved sources before synth (server must have rerank configured)")
-	// Empty
-	// passes nothing → server uses its default (bm25).
-	retriever := fs.String("retriever", "", "retriever: bm25 | dense | hybrid (server must have HNSW + embedder for dense/hybrid)")
-	// MMR lambda passthrough. Empty → no diversification.
-	mmr := fs.String("mmr", "", "MMR diversification lambda in [0,1] (0.7 = mostly relevance with some diversity; needs HNSW + embedder server-side)")
-	since := fs.String("since", "", "ISO date — only sources published on or after")
-	until := fs.String("until", "", "ISO date — only sources published on or before")
-	includeDomains := fs.String("include-domains", "", "CSV allowlist of source domains")
-	excludeDomains := fs.String("exclude-domains", "", "CSV denylist of source domains")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *k <= 0 || *k > 20 {
-		return errors.New("k must be in [1, 20]")
-	}
-	if err := validateFormat(*format); err != nil {
-		return err
-	}
-	if *stream && *jsonOut {
-		return errors.New("-stream and -json are mutually exclusive (stream is event-by-event, json is the final blob)")
-	}
-
-	v := url.Values{}
-	v.Set("q", q)
-	v.Set("k", strconv.Itoa(*k))
-	if *expand {
-		v.Set("expand", "true")
-	}
-	if *rerank {
-		v.Set("rerank", "true")
-	}
-	if *retriever != "" {
-		v.Set("retriever", *retriever)
-	}
-	if *mmr != "" {
-		v.Set("mmr", *mmr)
-	}
-	if *since != "" {
-		v.Set("since", *since)
-	}
-	if *until != "" {
-		v.Set("until", *until)
-	}
-	if *includeDomains != "" {
-		v.Set("include_domains", *includeDomains)
-	}
-	if *excludeDomains != "" {
-		v.Set("exclude_domains", *excludeDomains)
-	}
-	if *stream {
-		v.Set("stream", "true")
-	}
-
-	endpoint := strings.TrimRight(*serverURL, "/") + "/answer?" + v.Encode()
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
-	if err != nil {
-		return err
-	}
-	if *stream {
-		req.Header.Set("Accept", "text/event-stream")
-	}
-	// /answer issues retrieval + 1 synth LLM call; 120s mirrors /research.
-	client := &http.Client{Timeout: 120 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	if *stream {
-		if resp.StatusCode != http.StatusOK {
-			b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
-			return fmt.Errorf("server %d: %s", resp.StatusCode, b)
-		}
-		return consumeAnswerSSE(resp.Body, *format)
-	}
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 16<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	emitWarnings(body)
-	var ar server.AnswerResponse
-	if err := json.Unmarshal(body, &ar); err != nil {
-		return fmt.Errorf("decode response: %w", err)
-	}
-	if *format == "md" || *format == "markdown" {
-		// /answer has no strategy or plan — pass empty/nil so the shared
-		// renderer just skips the strategy line.
-		fmt.Print(renderAnswerMarkdown(ar.Query, "", nil, ar.Answer, ar.Sources))
-		return nil
-	}
-	fmt.Printf("Q: %s\n\n", ar.Query)
-	fmt.Println(ar.Answer)
-	if len(ar.Sources) > 0 {
-		fmt.Println()
-		fmt.Println("Sources:")
-		for i, s := range ar.Sources {
-			date := ""
-			if s.PublishedAt != nil {
-				date = " " + s.PublishedAt.Format("2006-01-02")
-			}
-			domain := ""
-			if s.Domain != "" {
-				domain = " [" + s.Domain + "]"
-			}
-			fmt.Printf("  [%d]%s%s %s\n      %s\n", sourceIDOf(i, s), domain, date, s.Title, s.URL)
-		}
-	}
-	return nil
-}
-
-// runAdmin dispatches to a sub-operation under `cosift admin <op>`. Sub-ops
-// share bearer-token resolution: -token flag wins, then COSIFT_ADMIN_TOKEN env.
-// Empty token still hits the server (and gets a clear 401) — the CLI doesn't
-// pre-fail because the operator might be running an instance without admin
-// auth enabled (rare, but the failure path is the server's to own).
-// adminUsageError returns the multi-line help message printed when the
-// `cosift admin` parent is invoked without a subcommand. Listed alphabetically
-// by subcommand name so the output is stable across iterations.
-//
-// Extracted as a function (rather than a const) so tests can assert on the
-// listing's structure — every admin subcommand must appear here, in the same
-// alphabetic order it appears in runAdmin's dispatch switch.
-func adminUsageError() string {
-	return `admin: subcommand required.
-
-Available subcommands:
-  config                   Retriever defaults and capability flags.
-  recrawl <url...>         Re-enqueue specific URLs into the crawl frontier. Requires -y.
-  recrawl-domain <pattern> Bulk re-enqueue every doc matching the domain pattern. Requires -y or -dry-run.
-  reembed                  Re-embed every doc with the configured model (streams progress).
-                           Requires -y. Supports -drop-old and -since DATE.
-  stats                    Index counts, frontier breakdown, top domains, capability flags.
-                           Supports -summary for one-line output (monitoring / shell prompts).
-
-Common flags:
-  -server URL              cosift server URL (default: from local cosift.json)
-  -token TOKEN             admin bearer token (or COSIFT_ADMIN_TOKEN env)
-  -json                    raw JSON output instead of human-readable
-
-Usage: cosift admin <subcommand> [flags]
-`
-}
-
-func runAdmin(ctx context.Context, cfg *config.Config, op string, args []string) error {
-	switch op {
-	case "stats":
-		return runAdminStats(ctx, cfg, args)
-	case "config":
-		return runAdminConfig(ctx, cfg, args)
-	case "recrawl":
-		return runAdminRecrawl(ctx, cfg, args)
-	case "recrawl-domain":
-		return runAdminRecrawlDomain(ctx, cfg, args)
-	case "reembed":
-		return runAdminReembedCLI(ctx, cfg, args)
-	default:
-		return fmt.Errorf("unknown admin subcommand %q (want: stats | config | recrawl | recrawl-domain | reembed)", op)
-	}
-}
-
-// adminCommonFlags parses the -server/-token/-json flags shared by every admin
-// sub-operation. Returns parsed values + the leftover positional args (none for
-// stats/config; future ops like recrawl will have positional URL args).
-type adminCommonOpts struct {
-	server string
-	token  string
-	json   bool
-}
-
-func parseAdminCommon(name string, cfg *config.Config, args []string) (adminCommonOpts, []string, error) {
-	fs := flag.NewFlagSet(name, flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	server := fs.String("server", defaultServer, "cosift server URL")
-	// Token: -token flag overrides env. Env is the secure default — keeps the
-	// token out of shell history / process listings.
-	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
-	if err := fs.Parse(args); err != nil {
-		return adminCommonOpts{}, nil, err
-	}
-	resolvedToken := *token
-	if resolvedToken == "" {
-		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-	}
-	return adminCommonOpts{server: *server, token: resolvedToken, json: *jsonOut}, fs.Args(), nil
-}
-
-// adminRequest builds an authenticated request to the given /admin/* path. The
-// Authorization header is omitted when token is empty (server returns 401,
-// which is the right error to surface).
-func adminRequest(ctx context.Context, method, server, path, token string, body io.Reader) (*http.Request, error) {
-	endpoint := strings.TrimRight(server, "/") + path
-	req, err := http.NewRequestWithContext(ctx, method, endpoint, body)
-	if err != nil {
-		return nil, err
-	}
-	if token != "" {
-		req.Header.Set("Authorization", "Bearer "+token)
-	}
-	return req, nil
-}
-
-func runAdminStats(ctx context.Context, cfg *config.Config, args []string) error {
-	// inline flag parsing (vs parseAdminCommon) so we can add the
-	// -summary flag. Same shape as runAdminRecrawl's flag set —
-	// admin sub-ops with op-specific flags bypass the common helper.
-	fs := flag.NewFlagSet("admin stats", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response")
-	summary := fs.Bool("summary", false, "one-line compact output for monitoring / shell prompts")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *summary && *jsonOut {
-		return errors.New("-summary and -json are mutually exclusive")
-	}
-	resolvedToken := *token
-	if resolvedToken == "" {
-		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-	}
-
-	req, err := adminRequest(ctx, http.MethodGet, *serverURL, "/admin/stats", resolvedToken, nil)
-	if err != nil {
-		return err
-	}
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	var st server.AdminStatsResponse
-	if err := json.Unmarshal(body, &st); err != nil {
-		return fmt.Errorf("decode: %w", err)
-	}
-	if *summary {
-		// Compact one-line format designed for: shell prompts, cron, status
-		// scripts. Always-present fields (docs/queued/errored). Embedder named
-		// only when configured (omitted with " · " to keep separator clean).
-		parts := []string{
-			fmt.Sprintf("%d docs", st.Documents),
-			fmt.Sprintf("%d queued", st.Frontier.Queued),
-			fmt.Sprintf("%d errored", st.Frontier.Errored),
-		}
-		if st.EmbedderModel != "" {
-			parts = append(parts, "embedder="+st.EmbedderModel)
-		}
-		fmt.Println(strings.Join(parts, " · "))
-		return nil
-	}
-	fmt.Println("=== Index ===")
-	fmt.Printf("  Documents:           %d\n", st.Documents)
-	fmt.Printf("  Terms:               %d\n", st.Terms)
-	fmt.Printf("  Passages:            %d\n", st.Passages)
-	if st.DocsWithPublishedAt > 0 {
-		pct := float64(st.DocsWithPublishedAt) / float64(st.Documents) * 100
-		fmt.Printf("  Docs w/ published_at: %d (%.1f%%)\n", st.DocsWithPublishedAt, pct)
-	}
-	// LLM-cache sizes. Show only when populated — a fresh
-	// deployment with no LLM cache yet shouldn't bloat the dashboard.
-	if st.Paraphrases > 0 || st.HyDECache > 0 {
-		fmt.Println()
-		fmt.Println("=== LLM caches ===")
-		if st.Paraphrases > 0 {
-			fmt.Printf("  Paraphrases:         %d\n", st.Paraphrases)
-		}
-		if st.HyDECache > 0 {
-			fmt.Printf("  HyDE passages:       %d\n", st.HyDECache)
-		}
-	}
-	fmt.Println()
-	fmt.Println("=== Frontier ===")
-	fmt.Printf("  Queued:    %d\n", st.Frontier.Queued)
-	fmt.Printf("  In-flight: %d\n", st.Frontier.InFlight)
-	fmt.Printf("  Done:      %d\n", st.Frontier.Done)
-	fmt.Printf("  Errored:   %d\n", st.Frontier.Errored)
-	fmt.Println()
-	fmt.Println("=== Capabilities ===")
-	fmt.Printf("  Dense:    %t\n", st.DenseEnabled)
-	fmt.Printf("  Answer:   %t\n", st.AnswerEnabled)
-	fmt.Printf("  Fetcher:  %t\n", st.FetcherEnabled)
-	if st.EmbedderModel != "" {
-		fmt.Printf("  Embedder: %s\n", st.EmbedderModel)
-	}
-	if st.ChatModel != "" {
-		fmt.Printf("  Chat:     %s\n", st.ChatModel)
-	}
-	if st.RerankerName != "" {
-		fmt.Printf("  Reranker: %s\n", st.RerankerName)
-	}
-	if len(st.TopDomains) > 0 {
-		fmt.Println()
-		fmt.Println("=== Top Domains ===")
-		// Map iteration order is random; sort by count desc, then domain asc.
-		type kv struct {
-			k string
-			v int64
-		}
-		pairs := make([]kv, 0, len(st.TopDomains))
-		for k, v := range st.TopDomains {
-			pairs = append(pairs, kv{k, v})
-		}
-		sort.Slice(pairs, func(i, j int) bool {
-			if pairs[i].v != pairs[j].v {
-				return pairs[i].v > pairs[j].v
-			}
-			return pairs[i].k < pairs[j].k
-		})
-		for _, p := range pairs {
-			fmt.Printf("  %-32s %d\n", p.k, p.v)
-		}
-	}
-	return nil
-}
-
-func runAdminConfig(ctx context.Context, cfg *config.Config, args []string) error {
-	opts, _, err := parseAdminCommon("admin config", cfg, args)
-	if err != nil {
-		return err
-	}
-	req, err := adminRequest(ctx, http.MethodGet, opts.server, "/admin/config", opts.token, nil)
-	if err != nil {
-		return err
-	}
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("get %s: %w", opts.server, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-	if opts.json {
-		fmt.Println(string(body))
-		return nil
-	}
-	var cfgResp server.AdminConfigResponse
-	if err := json.Unmarshal(body, &cfgResp); err != nil {
-		return fmt.Errorf("decode: %w", err)
-	}
-	fmt.Printf("Cosift version: %s\n\n", cfgResp.Version)
-	fmt.Println("=== Defaults ===")
-	d := cfgResp.Defaults
-	fmt.Printf("  Retriever: %s\n", d.Retriever)
-	fmt.Printf("  Expand:    %t\n", d.Expand)
-	fmt.Println()
-	fmt.Println("=== Capabilities ===")
-	c := cfgResp.Capabilities
-	fmt.Printf("  Dense:        %t\n", c.DenseEnabled)
-	fmt.Printf("  Chat:         %t\n", c.ChatEnabled)
-	fmt.Printf("  Rerank:       %t\n", c.RerankEnabled)
-	fmt.Printf("  Paraphraser:  %t\n", c.ParaphraserEnabled)
-	fmt.Printf("  Fetcher:      %t\n", c.FetcherEnabled)
-	fmt.Printf("  Admin:        %t\n", c.AdminEnabled)
-	if c.EmbedderModel != "" {
-		fmt.Printf("  Embedder model:  %s\n", c.EmbedderModel)
-	}
-	if c.ChatModel != "" {
-		fmt.Printf("  Chat model:      %s\n", c.ChatModel)
-	}
-	if c.RerankerName != "" {
-		fmt.Printf("  Reranker name:   %s\n", c.RerankerName)
-	}
-	return nil
-}
-
-// runAdminRecrawl re-enqueues the given URLs into the crawler frontier. First
-// destructive admin operation — requires `-y` to confirm. URLs come from
-// positional args, `-file`, or both (mirrors's `contents` CLI pattern).
-func runAdminRecrawl(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("admin recrawl", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
-	filePath := fs.String("file", "", "read URLs from FILE (one per line, # comments allowed)")
-	confirm := fs.Bool("y", false, "confirm the destructive operation (recrawl re-enqueues URLs into the frontier)")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	urls := fs.Args()
-	if *filePath != "" {
-		extra, err := readURLsFromFile(*filePath)
-		if err != nil {
-			return fmt.Errorf("read -file: %w", err)
-		}
-		urls = append(urls, extra...)
-	}
-	if len(urls) == 0 {
-		return errors.New("at least one URL or -file required")
-	}
-	if !*confirm {
-		return fmt.Errorf("admin recrawl is destructive (re-enqueues %d URL(s) into the crawl frontier). Add -y to confirm", len(urls))
-	}
-
-	resolvedToken := *token
-	if resolvedToken == "" {
-		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-	}
-
-	reqBody, err := json.Marshal(server.AdminRecrawlRequest{URLs: urls})
-	if err != nil {
-		return err
-	}
-	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/recrawl", resolvedToken, bytes.NewReader(reqBody))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	client := &http.Client{Timeout: 60 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("post %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	var rr server.AdminRecrawlResponse
-	if err := json.Unmarshal(body, &rr); err != nil {
-		return fmt.Errorf("decode: %w", err)
-	}
-	fmt.Printf("Queued %d URL(s) for recrawl.\n", len(rr.Queued))
-	if len(rr.Errors) > 0 {
-		fmt.Printf("\n%d URL(s) failed to enqueue:\n", len(rr.Errors))
-		// Sort error URLs for stable output across runs.
-		keys := make([]string, 0, len(rr.Errors))
-		for k := range rr.Errors {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-		for _, u := range keys {
-			fmt.Printf("  %s: %s\n", u, rr.Errors[u])
-		}
-	}
-	return nil
-}
-
-// runAdminRecrawlDomain bulk-recrawls every doc whose domain matches `pattern`
-// (positional arg). Wraps's /admin/recrawl-by-domain endpoint. Requires
-// `-y` to commit or `-dry-run` to preview the matched count without queuing.
-// If both flags are set, `-dry-run` wins (safer-on-conflict).
-func runAdminRecrawlDomain(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("admin recrawl-domain", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
-	confirm := fs.Bool("y", false, "confirm the destructive operation (recrawl every matching URL)")
-	dryRun := fs.Bool("dry-run", false, "enumerate matched URLs without queuing — preview the blast radius")
-	// cap dry-run URL listing to avoid console spam on large matches.
-	// 0 = no list (count only — behavior). 20 = default safe cap.
-	// -1 = unlimited (operator explicitly wants the full list).
-	listLimit := fs.Int("limit-list", 20, "in dry-run mode, max URLs to print (0 = count only, -1 = unlimited)")
-	jsonOut := fs.Bool("json", false, "emit raw JSON response instead of human-readable summary")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if fs.NArg() < 1 {
-		return errors.New("domain pattern required (positional arg)")
-	}
-	if fs.NArg() > 1 {
-		return errors.New("only one domain pattern supported per call")
-	}
-	pattern := fs.Arg(0)
-
-	if !*confirm && !*dryRun {
-		return fmt.Errorf("admin recrawl-domain is destructive (would re-enqueue every URL matching %q). Add -y to commit or -dry-run to preview", pattern)
-	}
-
-	resolvedToken := *token
-	if resolvedToken == "" {
-		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-	}
-
-	// dry-run wins when both flags are set. Operator who typed both probably
-	// meant the safer option; the destructive interpretation requires they
-	// explicitly drop -dry-run.
-	effectiveDryRun := *dryRun
-
-	reqBody, err := json.Marshal(server.AdminRecrawlByDomainRequest{
-		Domain: pattern,
-		DryRun: effectiveDryRun,
-	})
-	if err != nil {
-		return err
-	}
-	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/recrawl-by-domain", resolvedToken, bytes.NewReader(reqBody))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	client := &http.Client{Timeout: 120 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("post %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-	if err != nil {
-		return fmt.Errorf("read response: %w", err)
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("server %d: %s", resp.StatusCode, body)
-	}
-	if *jsonOut {
-		fmt.Println(string(body))
-		return nil
-	}
-	var rr server.AdminRecrawlByDomainResponse
-	if err := json.Unmarshal(body, &rr); err != nil {
-		return fmt.Errorf("decode: %w", err)
-	}
-	if effectiveDryRun {
-		fmt.Printf("Dry-run: %d URL(s) match %q. Re-run with -y (not -dry-run) to queue them.\n", rr.Matched, rr.Domain)
-		// -limit-list 0 → count only. -limit-list -1 → unlimited (operator
-		// wants the full list, accepts console spam). Otherwise: print up
-		// to listLimit and append a "... (N more)" suffix.
-		if *listLimit != 0 && len(rr.URLs) > 0 {
-			n := *listLimit
-			if n < 0 || n > len(rr.URLs) {
-				n = len(rr.URLs)
-			}
-			for _, u := range rr.URLs[:n] {
-				fmt.Printf("  %s\n", u)
-			}
-			if remaining := len(rr.URLs) - n; remaining > 0 {
-				fmt.Printf("  ... (%d more — use -limit-list -1 to see all)\n", remaining)
-			}
-		}
-		return nil
-	}
-	fmt.Printf("Queued %d/%d URL(s) for recrawl matching %q.\n", rr.Queued, rr.Matched, rr.Domain)
-	if len(rr.Errors) > 0 {
-		fmt.Printf("\n%d URL(s) failed to enqueue:\n", len(rr.Errors))
-		keys := make([]string, 0, len(rr.Errors))
-		for k := range rr.Errors {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-		for _, u := range keys {
-			fmt.Printf("  %s: %s\n", u, rr.Errors[u])
-		}
-	}
-	return nil
-}
-
-// runAdminReembedCLI triggers a server-side reembed via the
-// `/admin/reembed` SSE endpoint. Requires `-y` to commit (reembed costs
-// LLM credits; same destructive-op guard pattern as other admin verbs).
-// `-drop-old` propagates to the server's `DropPassagesNotModel` step.
-func runAdminReembedCLI(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("admin reembed", flag.ExitOnError)
-	defaultServer := "http://" + cfg.Server.Addr
-	defaultServer = strings.Replace(defaultServer, "0.0.0.0", "127.0.0.1", 1)
-	serverURL := fs.String("server", defaultServer, "cosift server URL")
-	token := fs.String("token", "", "admin bearer token (defaults to COSIFT_ADMIN_TOKEN env)")
-	dropOld := fs.Bool("drop-old", false, "also delete passages from other models after re-embedding")
-	// -since restricts reembed to docs published >= DATE. Client-side
-	// validation catches malformed dates before the HTTP call (saves a round-trip
-	// for the common typo case).
-	since := fs.String("since", "", "ISO date — only re-embed docs published >= this. Drops undated docs when set")
-	confirm := fs.Bool("y", false, "confirm the operation (reembed re-runs every embedding call; counts as LLM spend)")
-	// -dry-run shows the would-be-processed count without spending
-	// LLM credits. Either -y OR -dry-run is required.
-	dryRun := fs.Bool("dry-run", false, "preview the count of docs that would be re-embedded, without actually embedding")
-	jsonOut := fs.Bool("json", false, "emit raw SSE response instead of human-readable progress lines")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	// Validate -since client-side before checking -y, so operators see "bad
-	// date" before they've committed with -y (clearer iteration).
-	if _, err := parseExportDate(*since); err != nil {
-		return fmt.Errorf("-since: %w", err)
-	}
-	// dry-run wins when both flags set (safer-on-conflict, matches
-	// pattern on /admin/recrawl-by-domain).
-	effectiveDryRun := *dryRun
-	if !*confirm && !*dryRun {
-		guard := "every doc"
-		if *dropOld {
-			guard = "every doc AND drop other-model passages"
-		}
-		if *since != "" {
-			guard = "every doc published >= " + *since
-			if *dropOld {
-				guard += " AND drop other-model passages"
-			}
-		}
-		return fmt.Errorf("admin reembed will re-embed %s (counts as LLM spend). Add -y to commit or -dry-run to preview", guard)
-	}
-
-	resolvedToken := *token
-	if resolvedToken == "" {
-		resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-	}
-
-	reqBody, err := json.Marshal(server.AdminReembedRequest{
-		DropOld: *dropOld,
-		Since:   *since,
-		DryRun:  effectiveDryRun,
-	})
-	if err != nil {
-		return err
-	}
-	req, err := adminRequest(ctx, http.MethodPost, *serverURL, "/admin/reembed", resolvedToken, bytes.NewReader(reqBody))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Accept", "text/event-stream")
-	// Reembed can run for tens of minutes on large corpora. Bump the HTTP
-	// client timeout well past the synth CLIs; the server emits keep-alive
-	// progress events every ~2s so the connection stays warm.
-	client := &http.Client{Timeout: 60 * time.Minute}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("post %s: %w", *serverURL, err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
-		return fmt.Errorf("server %d: %s", resp.StatusCode, b)
-	}
-	if *jsonOut {
-		// In JSON mode, just stream the raw SSE bytes through to stdout. Useful
-		// for piping into a custom parser or log file. Different shape from the
-		// other admin CLIs' -json because reembed has no terminal JSON blob —
-		// the event stream IS the response.
-		_, err := io.Copy(os.Stdout, resp.Body)
-		return err
-	}
-	return consumeReembedSSE(resp.Body)
-}
-
-// consumeReembedSSE reads /admin/reembed events and renders progress lines.
-// third SSE consumer in the CLI (after research and
-// answer), reusing the forEachSSEEvent scanner.
-func consumeReembedSSE(body io.Reader) error {
-	var sawDone bool
-	// track the started event's total_docs and target_model so the
-	// dry-run done-event branch can reference them (the dry-run done payload
-	// reports zeros for processed/passages, but the meaningful count is in started).
-	var startedTotal int
-	var startedTarget string
-
-	err := forEachSSEEvent(body, func(event, data string) error {
-		switch event {
-		case "started":
-			var s struct {
-				TotalDocs   int    `json:"total_docs"`
-				TargetModel string `json:"target_model"`
-			}
-			if err := json.Unmarshal([]byte(data), &s); err != nil {
-				return nil // tolerate malformed mid-stream event
-			}
-			startedTotal = s.TotalDocs
-			startedTarget = s.TargetModel
-			fmt.Printf("[reembed started: %d docs, target=%s]\n", s.TotalDocs, s.TargetModel)
-		case "progress":
-			var p struct {
-				DocsProcessed   int `json:"docs_processed"`
-				PassagesWritten int `json:"passages_written"`
-			}
-			if err := json.Unmarshal([]byte(data), &p); err != nil {
-				return nil
-			}
-			fmt.Printf("[progress: %d docs, %d passages]\n", p.DocsProcessed, p.PassagesWritten)
-		case "done":
-			sawDone = true
-			var d struct {
-				DocsProcessed   int    `json:"docs_processed"`
-				PassagesWritten int    `json:"passages_written"`
-				DroppedOld      int64  `json:"dropped_old"`
-				DryRun          bool   `json:"dry_run,omitempty"`
-				Took            string `json:"took"`
-			}
-			if err := json.Unmarshal([]byte(data), &d); err != nil {
-				return fmt.Errorf("parse done event: %w", err)
-			}
-			if d.DryRun {
-				// dry-run summary — reference the started event's
-				// count (the meaningful "would-be-processed" number).
-				fmt.Printf("Dry-run: %d docs would be re-embedded with target=%s. Re-run without -dry-run (or with -y) to actually do it.\n",
-					startedTotal, startedTarget)
-			} else {
-				fmt.Printf("Done: %d docs reembedded, %d passages written, %d dropped, took %s.\n",
-					d.DocsProcessed, d.PassagesWritten, d.DroppedOld, d.Took)
-			}
-			return errSSEDone
-		case "error":
-			var e struct {
-				Detail string `json:"detail"`
-			}
-			_ = json.Unmarshal([]byte(data), &e)
-			return fmt.Errorf("server stream error: %s", e.Detail)
-		}
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-	if !sawDone {
-		fmt.Fprintln(os.Stderr, "(stream ended without `done` event)")
-	}
-	return nil
-}
-
-// bm25Adapter adapts index.BM25 to the eval.Retriever interface (URL-only result list).
-type bm25Adapter struct{ inner *index.BM25 }
-
-func (a *bm25Adapter) Search(ctx context.Context, q string, k int) ([]string, error) {
-	hits, err := a.inner.Search(ctx, q, k)
-	if err != nil {
-		return nil, err
-	}
-	urls := make([]string, len(hits))
-	for i, h := range hits {
-		urls[i] = h.URL
-	}
-	return urls, nil
-}
-
-// denseAdapter is a Retriever backed by an in-memory VectorIndex + an Embedder.
-// The embedder is consulted once per query at search time.
-type denseAdapter struct {
-	idx *index.VectorIndex
-	emb embed.Embedder
-}
-
-func (a *denseAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
-	vecs, err := a.emb.Embed(ctx, []string{q})
-	if err != nil {
-		return nil, err
-	}
-	hits := a.idx.Search(ctx, vecs[0], k)
-	urls := make([]string, len(hits))
-	for i, h := range hits {
-		urls[i] = h.URL
-	}
-	return urls, nil
-}
-
-// hybridAdapter fans out to two retrievers and fuses with RRF (k=60).
-type hybridAdapter struct {
-	a, b eval.Retriever
-}
-
-func (h *hybridAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
-	// Each retriever gets to vote on 2k candidates so RRF has room to work.
-	cand := k * 2
-	if cand < 10 {
-		cand = 10
-	}
-	ra, errA := h.a.Search(ctx, q, cand)
-	if errA != nil {
-		return nil, errA
-	}
-	rb, errB := h.b.Search(ctx, q, cand)
-	if errB != nil {
-		return nil, errB
-	}
-	return index.RRF([][]string{ra, rb}, k, 60), nil
-}
-
-// rerankAdapter wraps any Retriever with a reranker. The inner retriever is
-// asked for `candidateK` candidates; the reranker reorders them; the top k come back.
-// textByURL provides the passage text the reranker reads.
-type rerankAdapter struct {
-	inner      eval.Retriever
-	reranker   rerank.Reranker
-	textByURL  map[string]string
-	candidateK int
-}
-
-func (a *rerankAdapter) Search(ctx context.Context, q string, k int) ([]string, error) {
-	candK := a.candidateK
-	if candK <= 0 || candK < k {
-		candK = k * 5
-	}
-	urls, err := a.inner.Search(ctx, q, candK)
-	if err != nil {
-		return nil, err
-	}
-	if len(urls) <= 1 {
-		return urls, nil
-	}
-	cands := make([]rerank.Candidate, 0, len(urls))
-	for _, u := range urls {
-		text := a.textByURL[u]
-		if text == "" {
-			text = u
-		}
-		cands = append(cands, rerank.Candidate{ID: u, Text: text})
-	}
-	reranked, err := a.reranker.Rerank(ctx, q, cands)
-	if err != nil {
-		return urls, nil // fall back to inner order
-	}
-	if len(reranked) > k {
-		reranked = reranked[:k]
-	}
-	return reranked, nil
-}
-
-func runEval(ctx context.Context, args []string) error {
-	fs := flag.NewFlagSet("eval", flag.ExitOnError)
-	corpusPath := fs.String("corpus", "testdata/eval/corpus.json", "corpus JSON")
-	queriesPath := fs.String("queries", "testdata/eval/queries.json", "queries JSON")
-	savePath := fs.String("save", "", "save run summary")
-	baselinePath := fs.String("baseline", "", "compare against a prior summary")
-	retriever := fs.String("retriever", "bm25", "retriever: bm25 | dense | hybrid")
-	embModel := fs.String("embed-model", "text-embedding-3-small", "embedding model name")
-	embURL := fs.String("embed-url", "", "embedding endpoint URL (default OpenAI)")
-	embDim := fs.Int("embed-dim", 1536, "embedding dimensionality")
-	embCacheDir := fs.String("embed-cache", "./eval-embed-cache", "embedding cache dir (set empty to disable)")
-	useRerank := fs.Bool("rerank", false, "wrap retriever with the LLM listwise reranker")
-	rerankModel := fs.String("rerank-model", "gpt-4o-mini", "chat model for the reranker")
-	candK := fs.Int("rerank-k", 20, "candidates pulled from inner retriever before rerank")
-	apiURL := fs.String("api", "", "if set, query the remote cosift HTTP API instead of building a local index")
-	apiBearer := fs.String("api-bearer", "", "optional bearer token for the remote API")
-	distractors := fs.Int("distractors", 0, "inject N synthetic distractor docs into the index before scoring (tests robustness vs an inflated candidate set)")
-	distractorSeed := fs.Int64("distractor-seed", 42, "deterministic seed for distractor generation")
-	distractorMode := fs.String("distractor-mode", "diverse", "diverse (90-word neutral pool) | narrow (single-topic 7-word pool)")
-	embBatch := fs.Int("embed-batch", 256, "embedding batch size — lower for large-dim models (text-embedding-3-large returns malformed JSON at 1000)")
-	chunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = index.NewChunker default 320); A/B across runs to compare retrieval at different granularities")
-	chunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = default 64)")
-	autoParaphrase := fs.Bool("auto-paraphrase", false, "generate N paraphrases per query via the chat client at eval time + RRF-fuse results")
-	paraphraseN := fs.Int("paraphrase-n", 2, "number of paraphrases per query")
-	paraphraseModel := fs.String("paraphrase-model", "gpt-4o-mini", "chat model for paraphrase generation")
-	mainWeight := fs.Float64("main-weight", 0, "main-query weight in -auto-paraphrase OR -planner RRF fusion (paraphrases / sub-queries each weight 1.0); 0 = equal-weight (standard RRF); mirrors server-side Defaults.ExpandMainWeight for offline measurement")
-	usePlanner := fs.Bool("planner", false, "decompose each query into 2-3 sub-queries via the /research planner prompt + RRF-fuse results (mirror /research retrieval, no synth)")
-	plannerModel := fs.String("planner-model", "gpt-4o-mini", "chat model for the planner decomposition")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	qs, err := eval.LoadQuerySet(*queriesPath)
-	if err != nil {
-		return err
-	}
-
-	// --api short-circuit: run the queries straight against a deployed cosift's
-	// /search endpoint. Skip the local corpus/embed/index work entirely —
-	// the deployed instance owns its own index. The corpus.json's relevance
-	// labels still apply because they're declared independently of the index.
-	if *apiURL != "" {
-		ret := &httpAPIRetriever{
-			baseURL:   strings.TrimRight(*apiURL, "/"),
-			bearer:    *apiBearer,
-			retriever: *retriever,
-			rerank:    *useRerank,
-			http:      &http.Client{Timeout: 30 * time.Second},
-		}
-		summary, e := eval.Run(ctx, qs, ret)
-		if e != nil {
-			return e
-		}
-		summary.Name = fmt.Sprintf("%s/api(%s)", qs.Name, *apiURL)
-		fmt.Print(eval.PrintTable(summary))
-		if *baselinePath != "" {
-			base, e := eval.LoadSummary(*baselinePath)
-			if e != nil {
-				return fmt.Errorf("baseline: %w", e)
-			}
-			fmt.Printf("\nvs baseline (%s):\n%s", *baselinePath, eval.Diff(base, summary))
-		}
-		if *savePath != "" {
-			if e := eval.SaveSummary(summary, *savePath); e != nil {
-				return fmt.Errorf("save: %w", e)
-			}
-			fmt.Printf("\nsaved summary to %s\n", *savePath)
-		}
-		return nil
-	}
-
-	corpus, err := eval.LoadCorpus(*corpusPath)
-	if err != nil {
-		return err
-	}
-
-	// Build an ephemeral store in a temp dir — eval doesn't touch the user's index.
-	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-eval-%d", time.Now().UnixNano()))
-	s, err := store.Open(tmpDir)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		s.Close()
-		_ = os.RemoveAll(tmpDir)
-	}()
-
-	bm := index.NewBM25(s)
-	for _, d := range corpus.Docs {
-		id, e := s.UpsertDocument(ctx, &store.Document{
-			URL: d.URL, Title: d.Title, Text: d.Text,
-			Source: "eval", FetchedAt: time.Now(),
-		})
-		if e != nil {
-			return fmt.Errorf("ingest %s: %w", d.URL, e)
-		}
-		if e := bm.IndexDocument(ctx, id, d.Title, d.Text); e != nil {
-			return fmt.Errorf("index %s: %w", d.URL, e)
-		}
-	}
-
-	// BM25 distractor injection: synthetic noise to stress-test retrieval at
-	// higher index sizes than the 20-doc canonical set. Each distractor is 100
-	// random tokens from a neutral vocab disjoint from the eval queries' vocab —
-	// they should NEVER be relevant, so any showing up in top-K = measurable degradation.
-	// Dense distractors are embedded alongside the corpus in the dense block below.
-	var distractorTexts []string
-	if *distractors > 0 {
-		drng := rand.New(rand.NewSource(*distractorSeed))
-		neutralVocab := neutralVocabForDistractors()
-		// Narrow mode: clamp to the first topic group (pottery — 7 words).
-		// Tests the hypothesis that smaller-but-more-similar noise
-		// is harder for the reranker than larger-but-diverse noise.
-		if *distractorMode == "narrow" {
-			neutralVocab = neutralVocab[:7]
-		} else if *distractorMode != "diverse" {
-			return fmt.Errorf("unknown distractor-mode %q (diverse | narrow)", *distractorMode)
-		}
-		distractorTexts = make([]string, *distractors)
-		for i := 0; i < *distractors; i++ {
-			dURL := fmt.Sprintf("https://distractor.test/%d", i)
-			dTitle := fmt.Sprintf("Distractor %d", i)
-			dText := generateDistractorText(drng, neutralVocab, 100)
-			distractorTexts[i] = dText
-			id, e := s.UpsertDocument(ctx, &store.Document{
-				URL: dURL, Title: dTitle, Text: dText, Source: "distractor", FetchedAt: time.Now(),
-			})
-			if e != nil {
-				return fmt.Errorf("distractor %d: %w", i, e)
-			}
-			if e := bm.IndexDocument(ctx, id, dTitle, dText); e != nil {
-				return fmt.Errorf("index distractor %d: %w", i, e)
-			}
-		}
-		fmt.Printf("injected %d distractor docs into BM25 index\n", *distractors)
-	}
-
-	// Build the requested retriever.
-	var ret eval.Retriever
-	switch *retriever {
-	case "bm25":
-		ret = &bm25Adapter{inner: bm}
-	case "dense", "hybrid":
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI") // accept the short form too
-		}
-		if apiKey == "" {
-			return errors.New("OPENAI_API_KEY (or OPENAI) not set (put it in .env)")
-		}
-		oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
-		var emb embed.Embedder = oai
-		if *embCacheDir != "" {
-			emb = embed.NewCachedEmbedder(oai, *embCacheDir)
-		}
-		// Chunk corpus into passage windows, then batch-embed.
-		// Same chunker the crawler uses → eval and serve behave identically.
-		chunker := chunkerWith(*chunkSize, *chunkOverlap)
-		type passageRef struct {
-			docIdx int
-			chunk  index.Chunk
-		}
-		var allTexts []string
-		var refs []passageRef
-		for i, d := range corpus.Docs {
-			text := d.Title + "\n\n" + d.Text
-			for _, c := range chunker.Chunk(text) {
-				allTexts = append(allTexts, c.Text)
-				refs = append(refs, passageRef{docIdx: i, chunk: c})
-			}
-		}
-		fmt.Printf("embedding %d passages across %d docs with %s (batch=%d)...\n", len(allTexts), len(corpus.Docs), *embModel, *embBatch)
-		vecs, e := batchEmbed(ctx, emb, allTexts, *embBatch)
-		if e != nil {
-			return fmt.Errorf("embed corpus: %w", e)
-		}
-		vi := index.NewVectorIndex(*embDim)
-		for j, v := range vecs {
-			d := corpus.Docs[refs[j].docIdx]
-			vi.AddPassage(d.URL, d.Title, refs[j].chunk.Offset, refs[j].chunk.Length, v)
-		}
-		// Embed + add distractor passages into the SAME vector index.
-		// batchEmbed splits into ≤1000-input chunks for provider limits.
-		if len(distractorTexts) > 0 {
-			fmt.Printf("embedding %d distractor passages (batch=%d)...\n", len(distractorTexts), *embBatch)
-			dvecs, err := batchEmbed(ctx, emb, distractorTexts, *embBatch)
-			if err != nil {
-				return fmt.Errorf("embed distractors: %w", err)
-			}
-			for i, v := range dvecs {
-				vi.AddPassage(fmt.Sprintf("https://distractor.test/%d", i), "Distractor", 0, len(distractorTexts[i]), v)
-			}
-		}
-		denseRet := &denseAdapter{idx: vi, emb: emb}
-		if *retriever == "dense" {
-			ret = denseRet
-		} else {
-			ret = &hybridAdapter{a: &bm25Adapter{inner: bm}, b: denseRet}
-		}
-	default:
-		return fmt.Errorf("unknown retriever %q", *retriever)
-	}
-
-	// Apply paraphrase + rerank wrappers below.
-	suffix := *retriever
-	if *useRerank {
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI")
-		}
-		if apiKey == "" {
-			return errors.New("rerank: OPENAI_API_KEY (or OPENAI) not set")
-		}
-		chat := embed.NewOpenAIChat(apiKey, "", *rerankModel)
-		rr := rerank.NewLLMReranker(chat)
-		textByURL := make(map[string]string, len(corpus.Docs))
-		for _, d := range corpus.Docs {
-			textByURL[d.URL] = d.Title + "\n\n" + d.Text
-		}
-		ret = &rerankAdapter{inner: ret, reranker: rr, textByURL: textByURL, candidateK: *candK}
-		suffix = fmt.Sprintf("%s+rerank(%s)", *retriever, *rerankModel)
-	}
-
-	// Planner wrapper — applied BEFORE paraphrase so a "both" run looks like
-	// (rerank ⊂ planner ⊂ paraphrase). Mirrors /research's plan→retrieve pipeline
-	// without the synth step, so we measure planner *retrieval coverage* in isolation.
-	if *usePlanner {
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI")
-		}
-		if apiKey == "" {
-			return errors.New("planner: OPENAI_API_KEY (or OPENAI) not set")
-		}
-		chat := embed.NewOpenAIChat(apiKey, "", *plannerModel)
-		ret = &plannerRetriever{inner: ret, chat: chat, mainWeight: *mainWeight, cache: make(map[string][]string)}
-		if *mainWeight > 0 {
-			suffix = fmt.Sprintf("%s+planner(%s,mw=%.2f)", suffix, *plannerModel, *mainWeight)
-		} else {
-			suffix = fmt.Sprintf("%s+planner(%s)", suffix, *plannerModel)
-		}
-	}
-
-	// Auto-paraphrase wrapper — outermost so paraphrases hit the FULL retriever
-	// stack (including rerank, if enabled).
-	if *autoParaphrase {
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI")
-		}
-		if apiKey == "" {
-			return errors.New("auto-paraphrase: OPENAI_API_KEY (or OPENAI) not set")
-		}
-		chat := embed.NewOpenAIChat(apiKey, "", *paraphraseModel)
-		ret = &paraphraseRetriever{inner: ret, chat: chat, n: *paraphraseN, mainWeight: *mainWeight, cache: make(map[string][]string)}
-		if *mainWeight > 0 {
-			suffix = fmt.Sprintf("%s+paraphrase(%d/%s,mw=%.2f)", suffix, *paraphraseN, *paraphraseModel, *mainWeight)
-		} else {
-			suffix = fmt.Sprintf("%s+paraphrase(%d/%s)", suffix, *paraphraseN, *paraphraseModel)
-		}
-	}
-
-	summary, err := eval.Run(ctx, qs, ret)
-	if err != nil {
-		return err
-	}
-	summary.Name = fmt.Sprintf("%s/%s", qs.Name, suffix)
-	fmt.Print(eval.PrintTable(summary))
-
-	if *baselinePath != "" {
-		base, err := eval.LoadSummary(*baselinePath)
-		if err != nil {
-			return fmt.Errorf("baseline: %w", err)
-		}
-		fmt.Printf("\nvs baseline (%s):\n%s", *baselinePath, eval.Diff(base, summary))
-	}
-	if *savePath != "" {
-		if err := eval.SaveSummary(summary, *savePath); err != nil {
-			return fmt.Errorf("save: %w", err)
-		}
-		fmt.Printf("\nsaved summary to %s\n", *savePath)
-	}
-	return nil
-}
-
-// firstEnv returns the first non-empty value among the named environment vars.
-func firstEnv(names ...string) string {
-	for _, n := range names {
-		if v := os.Getenv(n); v != "" {
-			return v
-		}
-	}
-	return ""
-}
-
-func runServe(ctx context.Context, cfg *config.Config) error {
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	srv := server.New(s)
-	// Instance-wide retrieval defaults from cfg.Defaults. Per-request query
-	// params still override; this is just what the handler picks up when the
-	// caller doesn't specify.
-	srv = srv.WithDefaults(server.Defaults{
-		Retriever:         cfg.Defaults.Retriever,
-		Expand:            cfg.Defaults.Expand,
-		ResearchStrategy:  cfg.Defaults.ResearchStrategy,
-		ResearchSynthK:    cfg.Defaults.ResearchSynthK,
-		ExpandMainWeight:  cfg.Defaults.ExpandMainWeight,
-		HybridDenseWeight: cfg.Defaults.HybridDenseWeight,
-	})
-	if cfg.Defaults.Retriever != "" || cfg.Defaults.Expand || cfg.Defaults.ResearchStrategy != "" || cfg.Defaults.ResearchSynthK > 0 || cfg.Defaults.ExpandMainWeight > 0 || cfg.Defaults.HybridDenseWeight > 0 {
-		log.Printf("defaults: retriever=%q expand=%v research_strategy=%q research_synth_k=%d expand_main_weight=%v hybrid_dense_weight=%v",
-			cfg.Defaults.Retriever, cfg.Defaults.Expand, cfg.Defaults.ResearchStrategy, cfg.Defaults.ResearchSynthK, cfg.Defaults.ExpandMainWeight, cfg.Defaults.HybridDenseWeight)
-	}
-	// thread chunker config to /admin/reembed handler so re-embed
-	// produces passages with the same shape as crawl-time indexing.
-	if cfg.Crawler.ChunkSize > 0 || cfg.Crawler.ChunkOverlap > 0 {
-		srv = srv.WithChunker(cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
-		log.Printf("chunker: size=%d overlap=%d", cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
-	}
-	if tok := cfg.Server.AdminToken; tok != "" {
-		srv = srv.WithAdminToken(tok)
-		log.Printf("/admin/* endpoints enabled (bearer-auth)")
-	}
-	if len(cfg.Server.TrustedProxies) > 0 {
-		s2, err := srv.WithTrustedProxies(cfg.Server.TrustedProxies)
-		if err != nil {
-			return fmt.Errorf("trusted_proxies: %w", err)
-		}
-		srv = s2
-		log.Printf("X-Forwarded-For trusted from %v", cfg.Server.TrustedProxies)
-	}
-
-	// Auto-wire embeddings if model is set and an API key is in env.
-	if cfg.Embeddings.Model != "" {
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI")
-		}
-		if apiKey == "" {
-			log.Printf("warning: embeddings configured but no OPENAI_API_KEY in env; dense/hybrid disabled")
-		} else {
-			model := cfg.Embeddings.Model
-			dim := cfg.Embeddings.Dim
-			if dim == 0 {
-				dim = 1536
-			}
-			emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, model, dim)
-			vi, err := index.LoadVectorIndex(ctx, s, model, dim)
-			if err != nil {
-				return fmt.Errorf("load vector index: %w", err)
-			}
-			srv = srv.WithVector(vi, emb)
-			log.Printf("vector index loaded: %d passages, model=%s dim=%d", vi.Len(), model, dim)
-
-			// Chat is opt-in via cfg.Chat.Model. Reuses the same API key.
-			if cfg.Chat.Model != "" {
-				chat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Chat.Model)
-				srv = srv.WithChat(chat)
-				log.Printf("/answer enabled with chat model=%s", cfg.Chat.Model)
-				// Auto-enable /search?expand=true via the same chat client.
-				// measured +0.02 nDCG at 10k distractors for $0.004 per run.
-				srv = srv.WithParaphraser(chat, 2)
-				log.Printf("/search?expand=true enabled (auto-paraphrase via %s)", cfg.Chat.Model)
-			}
-
-			// Reranker: HTTP backend wins if URL is set; otherwise LLM backend
-			// (only if chat is configured). Either is opt-out via cfg.Rerank.Enabled=false
-			// even when configured.
-			var rr rerank.Reranker
-			rerankWanted := cfg.Rerank.URL != "" || cfg.Chat.Model != ""
-			if !cfg.Rerank.Enabled && rerankWanted {
-				// Default ON when wired; flip cfg.Rerank.Enabled false to skip.
-				cfg.Rerank.Enabled = true
-			}
-			if cfg.Rerank.Enabled && cfg.Rerank.URL != "" {
-				rerankKey := cfg.Rerank.APIKey
-				if rerankKey == "" {
-					rerankKey = firstEnv("COHERE_API_KEY", "VOYAGE_API_KEY")
-				}
-				rr = rerank.NewHTTPReranker(cfg.Rerank.URL, rerankKey, cfg.Rerank.Model)
-				log.Printf("rerank enabled with http endpoint=%s model=%s", cfg.Rerank.URL, cfg.Rerank.Model)
-			} else if cfg.Rerank.Enabled && cfg.Chat.Model != "" {
-				rerankModel := cfg.Rerank.Model
-				if rerankModel == "" {
-					rerankModel = cfg.Chat.Model
-				}
-				rerankChat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, rerankModel)
-				rr = rerank.NewLLMReranker(rerankChat)
-				log.Printf("rerank enabled with LLM model=%s (fallback path; consider an HTTP reranker for cost)", rerankModel)
-			}
-			if rr != nil {
-				srv = srv.WithReranker(rr, cfg.Rerank.CandidateK)
-			}
-		}
-	}
-
-	// On-demand /contents: use the crawler's FetchOne. Doesn't share the worker
-	// pool's rate gate or robots cache — callers should set a sensible UA + body cap.
-	srv = srv.WithFetcher(func(ctx context.Context, u string) (string, string, string, error) {
-		r, err := crawler.FetchOne(ctx, nil, cfg.Crawler.UserAgent, u, cfg.Crawler.MaxBodyBytes)
-		if err != nil {
-			return "", "", "", err
-		}
-		return r.Title, r.Text, r.Lang, nil
-	})
-
-	log.Printf("cosift serving on %s", cfg.Server.Addr)
-	return server.ListenAndServe(ctx, cfg.Server.Addr, srv.Handler())
-}
-
-// runIngest loads a corpus.json directly into the local store + indexes —
-// useful for evaluation, vertical deployments, and users with a pre-curated
-// dataset who don't need a crawler.
-//
-// The corpus shape matches eval.Corpus: {"docs": [{"url","title","text"}...]}.
-// If embeddings are configured, every doc is chunked + embedded + persisted
-// to the passages table the same way the crawler does.
-// progressReporter logs progress for a long-running CLI loop at most once per
-// configured interval. Time-based (vs every-N-iterations) so the cadence is
-// consistent regardless of per-item cost variance. Set interval to 0 to
-// disable. Designed for ingest but generic enough for other loops.
-type progressReporter struct {
-	label    string
-	total    int
-	interval time.Duration
-	last     time.Time
-}
-
-func newProgressReporter(label string, total int, interval time.Duration) *progressReporter {
-	return &progressReporter{
-		label:    label,
-		total:    total,
-		interval: interval,
-		// Initialize `last` to now so the first call after construction
-		// doesn't immediately log (avoids a noisy first-iter "0/N" line).
-		last: time.Now(),
-	}
-}
-
-// maybeLog emits a progress line only if `interval` has elapsed since the last
-// emission. Callers pass the 1-indexed current item count. No-op when interval
-// is <= 0 or when total is 0 (avoids divide-by-zero in the percentage).
-func (p *progressReporter) maybeLog(current int) {
-	if p.interval <= 0 || p.total <= 0 {
-		return
-	}
-	if time.Since(p.last) < p.interval {
-		return
-	}
-	pct := float64(current) / float64(p.total) * 100
-	log.Printf("%s: %d/%d (%.1f%%)", p.label, current, p.total, pct)
-	p.last = time.Now()
-}
-
-// loadCorpusJSONL reads a JSONL file (one eval.CorpusDoc per line) into a
-// Corpus. Empty lines are skipped (some tools emit trailing blanks). Pairs
-// with's `export -format jsonl` to close the round-trip for ML
-// pipelines.
-func loadCorpusJSONL(path string) (*eval.Corpus, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, fmt.Errorf("read %s: %w", path, err)
-	}
-	defer f.Close()
-	scanner := bufio.NewScanner(f)
-	// JSONL lines can be large (full doc text); raise the scanner buffer cap
-	// well above the default 64KB. 4MB matches's SSE parser ceiling.
-	scanner.Buffer(make([]byte, 0, 64<<10), 4<<20)
-	c := &eval.Corpus{}
-	lineNum := 0
-	for scanner.Scan() {
-		lineNum++
-		raw := strings.TrimSpace(scanner.Text())
-		if raw == "" {
-			continue
-		}
-		var d eval.CorpusDoc
-		if err := json.Unmarshal([]byte(raw), &d); err != nil {
-			return nil, fmt.Errorf("parse %s line %d: %w", path, lineNum, err)
-		}
-		c.Docs = append(c.Docs, d)
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("read %s: %w", path, err)
-	}
-	return c, nil
-}
-
-func runIngest(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("ingest", flag.ExitOnError)
-	corpusPath := fs.String("corpus", "", "path to corpus file (required)")
-	source := fs.String("source", "ingest", "source tag for documents")
-	// -format selects the loader. Default "auto" infers from file
-	// extension (.jsonl → jsonl, anything else → json). Explicit override
-	// avoids ambiguity when files have non-standard extensions.
-	format := fs.String("format", "auto", "input format: auto (default — infer from extension) | json | jsonl")
-	// Operators ingesting large corpora need
-	// some signal that work is happening. 0 disables.
-	progressInterval := fs.Duration("progress", 5*time.Second, "log per-doc/per-passage progress every N (0 disables)")
-	// CLI override for chunker config (mirrors on eval/answer-eval).
-	// 0 → fall through to cfg.Crawler.{ChunkSize,ChunkOverlap}, then to NewChunker defaults.
-	ingestChunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = use cfg.Crawler.ChunkSize, then NewChunker default 320)")
-	ingestChunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = use cfg.Crawler.ChunkOverlap, then default 64)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *corpusPath == "" {
-		return errors.New("ingest: -corpus is required")
-	}
-	resolvedFormat := *format
-	if resolvedFormat == "auto" {
-		if strings.HasSuffix(strings.ToLower(*corpusPath), ".jsonl") {
-			resolvedFormat = "jsonl"
-		} else {
-			resolvedFormat = "json"
-		}
-	}
-	var corpus *eval.Corpus
-	var err error
-	switch resolvedFormat {
-	case "json":
-		corpus, err = eval.LoadCorpus(*corpusPath)
-	case "jsonl":
-		corpus, err = loadCorpusJSONL(*corpusPath)
-	default:
-		return fmt.Errorf("unknown -format %q (want: auto | json | jsonl)", *format)
-	}
-	if err != nil {
-		return err
-	}
-
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-	bm := index.NewBM25(s)
-
-	// Optional embedder — same auto-wire as runServe.
-	var emb embed.Embedder
-	if cfg.Embeddings.Model != "" {
-		apiKey := os.Getenv("OPENAI_API_KEY")
-		if apiKey == "" {
-			apiKey = os.Getenv("OPENAI")
-		}
-		if apiKey != "" {
-			dim := cfg.Embeddings.Dim
-			if dim == 0 {
-				dim = 1536
-			}
-			emb = embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
-		} else {
-			log.Printf("warning: embeddings configured but no API key; ingesting BM25 only")
-		}
-	}
-
-	// Pre-compute chunks for the whole corpus so we can batch-embed in one call.
-	// CLI flag wins over cfg.Crawler.ChunkSize (only when flag is set).
-	chunkSize := cfg.Crawler.ChunkSize
-	if *ingestChunkSize > 0 {
-		chunkSize = *ingestChunkSize
-	}
-	chunkOverlap := cfg.Crawler.ChunkOverlap
-	if *ingestChunkOverlap > 0 {
-		chunkOverlap = *ingestChunkOverlap
-	}
-	chunker := chunkerWith(chunkSize, chunkOverlap)
-	type passageRef struct {
-		docIdx int
-		chunk  index.Chunk
-	}
-	var allTexts []string
-	var refs []passageRef
-	if emb != nil {
-		for i, d := range corpus.Docs {
-			for _, c := range chunker.Chunk(d.Title + "\n\n" + d.Text) {
-				allTexts = append(allTexts, c.Text)
-				refs = append(refs, passageRef{docIdx: i, chunk: c})
-			}
-		}
-		log.Printf("ingest: embedding %d passages across %d docs with %s", len(allTexts), len(corpus.Docs), cfg.Embeddings.Model)
-	}
-
-	var vecs [][]float32
-	if emb != nil && len(allTexts) > 0 {
-		vecs, err = emb.Embed(ctx, allTexts)
-		if err != nil {
-			return fmt.Errorf("embed: %w", err)
-		}
-	}
-
-	// Map docIdx → docID for the passage writes.
-	docIDs := make([]int64, len(corpus.Docs))
-	docProgress := newProgressReporter("ingest docs", len(corpus.Docs), *progressInterval)
-	for i, d := range corpus.Docs {
-		sha := sha256.Sum256([]byte(d.Text))
-		id, err := s.UpsertDocument(ctx, &store.Document{
-			URL: d.URL, Title: d.Title, Text: d.Text,
-			Source: *source, Quality: 0.7, FetchedAt: time.Now(),
-			ContentSHA: sha[:],
-		})
-		if err != nil {
-			return fmt.Errorf("upsert %s: %w", d.URL, err)
-		}
-		if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
-			return fmt.Errorf("index %s: %w", d.URL, err)
-		}
-		docIDs[i] = id
-		docProgress.maybeLog(i + 1)
-	}
-
-	// Write passages.
-	if emb != nil && len(vecs) == len(refs) {
-		passageProgress := newProgressReporter("ingest passages", len(vecs), *progressInterval)
-		for j, v := range vecs {
-			ref := refs[j]
-			p := &store.Passage{
-				DocID:     docIDs[ref.docIdx],
-				Offset:    ref.chunk.Offset,
-				Length:    ref.chunk.Length,
-				Model:     emb.Model(),
-				Embedding: v,
-			}
-			if err := s.UpsertPassage(ctx, p); err != nil {
-				return fmt.Errorf("passage %s offset=%d: %w", corpus.Docs[ref.docIdx].URL, ref.chunk.Offset, err)
-			}
-			passageProgress.maybeLog(j + 1)
-		}
-	}
-
-	log.Printf("ingest: %d docs, %d passages", len(corpus.Docs), len(vecs))
-	return nil
-}
-
-// runBench measures search latency under synthetic load. No API calls, no disk
-// for the vector path (in-memory only); BM25 uses a temp SQLite.
-//
-// Use it to decide:
-//   - When to swap brute-force kNN for HNSW (when vector p50 > ~50 ms or
-//     p99 > ~200 ms at your target N).
-//   - When BM25 needs Tantivy or another inverted-index lib (when BM25 p50
-//     exceeds a comparable threshold).
-//
-// benchResult holds one mode's bench output. Each field maps to a JSON key
-// when `-json` is set; human-readable output uses the formatHuman method.
-type benchResult struct {
-	Mode           string  `json:"mode"`
-	N              int     `json:"n"`
-	Dim            int     `json:"dim,omitempty"`
-	Queries        int     `json:"queries,omitempty"`
-	P50Micros      int64   `json:"p50_us,omitempty"`
-	P95Micros      int64   `json:"p95_us,omitempty"`
-	P99Micros      int64   `json:"p99_us,omitempty"`
-	QPS            float64 `json:"qps,omitempty"`
-	ElapsedMicros  int64   `json:"elapsed_us,omitempty"`
-	Docs           int64   `json:"docs,omitempty"`
-	PagesPerSec    float64 `json:"pages_per_sec,omitempty"`
-	Terms          int64   `json:"terms,omitempty"`
-	PerHostDelayMs int     `json:"per_host_delay_ms,omitempty"`
-}
-
-func runBench(ctx context.Context, args []string) error {
-	fs := flag.NewFlagSet("bench", flag.ExitOnError)
-	n := fs.Int("n", 10000, "number of passages (for vector/bm25 modes) or pages (for crawl mode)")
-	dim := fs.Int("dim", 384, "embedding dimensionality (vector mode)")
-	queries := fs.Int("queries", 100, "queries per run (vector/bm25 modes)")
-	mode := fs.String("mode", "vector", "vector | bm25 | crawl | all")
-	perHostDelay := fs.Int("per-host-delay", 0, "per-host delay in ms for crawl mode (default 0 — localhost throughput; set 100-1000 to measure under realistic politeness)")
-	jsonOut := fs.Bool("json", false, "emit one JSON object per mode instead of a human-readable line — useful for CI ingestion + dashboards")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	emit := func(r *benchResult) {
-		if *jsonOut {
-			b, _ := json.Marshal(r)
-			fmt.Println(string(b))
-		} else {
-			fmt.Println(r.formatHuman())
-		}
-	}
-
-	if *mode == "vector" || *mode == "all" || *mode == "both" {
-		emit(benchVector(*n, *dim, *queries))
-	}
-	if *mode == "bm25" || *mode == "all" || *mode == "both" {
-		r, err := benchBM25(ctx, *n, *queries)
-		if err != nil {
-			return err
-		}
-		emit(r)
-	}
-	if *mode == "crawl" || *mode == "all" {
-		// Crawl mode uses a smaller default — N=10k pages of an in-process site
-		// would slow the bench without proportional signal. 200 is plenty to
-		// measure pages/sec accurately on a typical host.
-		crawlN := *n
-		if crawlN > 1000 {
-			crawlN = 200
-		}
-		r, err := benchCrawl(ctx, crawlN, *perHostDelay)
-		if err != nil {
-			return err
-		}
-		emit(r)
-	}
-	if *mode == "storage" || *mode == "all" {
-		// SQLite vs Pebble head-to-head. Same N synthetic docs, same
-		// K queries, two backends. Emit one result per backend; consumers diff
-		// the two lines (or use cosift bench-compare on the saved JSON).
-		sq, err := benchBM25SQLite(ctx, *n, *queries)
-		if err != nil {
-			return err
-		}
-		emit(sq)
-		pb, err := benchBM25Pebble(ctx, *n, *queries)
-		if err != nil {
-			return err
-		}
-		emit(pb)
-	}
-	return nil
-}
-
-// formatHuman renders the result as the one-line format the bench used in iter
-// 1–70 — preserves the existing UX when `-json` isn't set.
-func (r *benchResult) formatHuman() string {
-	switch r.Mode {
-	case "vector":
-		return fmt.Sprintf("vector  n=%d dim=%d  p50=%-9s p95=%-9s p99=%-9s qps=%.0f",
-			r.N, r.Dim,
-			time.Duration(r.P50Micros)*time.Microsecond,
-			time.Duration(r.P95Micros)*time.Microsecond,
-			time.Duration(r.P99Micros)*time.Microsecond,
-			r.QPS)
-	case "bm25":
-		return fmt.Sprintf("bm25    n=%d  p50=%-9s p95=%-9s p99=%-9s qps=%.0f",
-			r.N,
-			time.Duration(r.P50Micros)*time.Microsecond,
-			time.Duration(r.P95Micros)*time.Microsecond,
-			time.Duration(r.P99Micros)*time.Microsecond,
-			r.QPS)
-	case "crawl":
-		delay := ""
-		if r.PerHostDelayMs > 0 {
-			delay = fmt.Sprintf(" per-host-delay=%dms", r.PerHostDelayMs)
-		}
-		return fmt.Sprintf("crawl   n=%-5d elapsed=%-10s docs=%-5d  pages/sec=%-6.0f  terms=%d%s",
-			r.N,
-			(time.Duration(r.ElapsedMicros) * time.Microsecond).Round(time.Millisecond),
-			r.Docs, r.PagesPerSec, r.Terms, delay)
-	}
-	return fmt.Sprintf("%+v", *r)
-}
-
-// loadBenchReport parses a `cosift bench -json` output file. Format: one
-// benchResult JSON object per line (NDJSON). Lines that don't parse as JSON
-// are skipped silently — this lets users pipe `bench -json` into a file
-// alongside other tool output if they want.
-func loadBenchReport(path string) (map[string]*benchResult, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("read %s: %w", path, err)
-	}
-	out := make(map[string]*benchResult)
-	for _, line := range strings.Split(string(b), "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || !strings.HasPrefix(line, "{") {
-			continue
-		}
-		var r benchResult
-		if err := json.Unmarshal([]byte(line), &r); err != nil {
-			continue // skip unparseable lines rather than failing the whole report
-		}
-		if r.Mode == "" {
-			continue
-		}
-		out[r.Mode] = &r
-	}
-	if len(out) == 0 {
-		return nil, fmt.Errorf("%s: no parseable bench records (expecting NDJSON from `cosift bench -json`)", path)
-	}
-	return out, nil
-}
-
-// runBenchCompare diffs two saved bench reports side-by-side. Mirrors
-// answer-eval-compare for the bench surface — locks the JSON contract
-// as a stable interface tools can rely on.
-//
-// For each mode present in either report, prints the absolute numbers + deltas.
-// Reports a mode as "missing in BASELINE" or "missing in NEW" rather than
-// silently skipping — operators benefit from knowing the compare wasn't
-// fully apples-to-apples.
-func runBenchCompare(args []string) error {
-	fs := flag.NewFlagSet("bench-compare", flag.ExitOnError)
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	rest := fs.Args()
-	if len(rest) != 2 {
-		return errors.New("usage: cosift bench-compare BASELINE.json NEW.json")
-	}
-	a, err := loadBenchReport(rest[0])
-	if err != nil {
-		return fmt.Errorf("baseline: %w", err)
-	}
-	b, err := loadBenchReport(rest[1])
-	if err != nil {
-		return fmt.Errorf("new: %w", err)
-	}
-	fmt.Printf("BASELINE: %s  (modes: %v)\n", rest[0], sortedModes(a))
-	fmt.Printf("NEW:      %s  (modes: %v)\n", rest[1], sortedModes(b))
-	fmt.Println()
-
-	// Compare any mode present in either report. Stable order: vector, bm25, crawl.
-	allModes := union(a, b)
-	for _, mode := range allModes {
-		ar := a[mode]
-		br := b[mode]
-		switch {
-		case ar == nil:
-			fmt.Printf("%-7s (missing in BASELINE — new in this run)\n", mode)
-		case br == nil:
-			fmt.Printf("%-7s (missing in NEW — present in BASELINE only)\n", mode)
-		default:
-			printBenchDelta(mode, ar, br)
-		}
-	}
-	return nil
-}
-
-func sortedModes(m map[string]*benchResult) []string {
-	order := []string{"vector", "bm25", "crawl"}
-	out := make([]string, 0, len(m))
-	for _, k := range order {
-		if _, ok := m[k]; ok {
-			out = append(out, k)
-		}
-	}
-	// Catch any modes outside the known order too.
-	for k := range m {
-		if k != "vector" && k != "bm25" && k != "crawl" {
-			out = append(out, k)
-		}
-	}
-	return out
-}
-
-func union(a, b map[string]*benchResult) []string {
-	seen := make(map[string]bool)
-	order := []string{"vector", "bm25", "crawl"}
-	out := []string{}
-	for _, k := range order {
-		if _, ok := a[k]; ok {
-			seen[k] = true
-			out = append(out, k)
-		}
-		if _, ok := b[k]; ok && !seen[k] {
-			seen[k] = true
-			out = append(out, k)
-		}
-	}
-	for _, m := range []map[string]*benchResult{a, b} {
-		for k := range m {
-			if !seen[k] {
-				seen[k] = true
-				out = append(out, k)
-			}
-		}
-	}
-	return out
-}
-
-// printBenchDelta prints one mode's before/after side-by-side. Format
-// matches answer-eval-compare's row style.
-func printBenchDelta(mode string, a, b *benchResult) {
-	switch mode {
-	case "vector", "bm25":
-		// QPS is the headline; latency percentiles are signal too.
-		fmt.Printf("%-7s n=%d→%d  qps %.0f→%.0f (%+.0f)  p50 %dµs→%dµs (%+dµs)  p95 %dµs→%dµs (%+dµs)\n",
-			mode, a.N, b.N,
-			a.QPS, b.QPS, b.QPS-a.QPS,
-			a.P50Micros, b.P50Micros, b.P50Micros-a.P50Micros,
-			a.P95Micros, b.P95Micros, b.P95Micros-a.P95Micros,
-		)
-	case "crawl":
-		fmt.Printf("%-7s n=%d→%d  pages/sec %.0f→%.0f (%+.0f)  elapsed %dms→%dms  docs %d→%d\n",
-			mode, a.N, b.N,
-			a.PagesPerSec, b.PagesPerSec, b.PagesPerSec-a.PagesPerSec,
-			a.ElapsedMicros/1000, b.ElapsedMicros/1000,
-			a.Docs, b.Docs,
-		)
-	default:
-		fmt.Printf("%-7s (unknown mode — raw: a=%+v b=%+v)\n", mode, *a, *b)
-	}
-}
-
-func benchVector(n, dim, queries int) *benchResult {
-	rng := newSeededRand()
-	vi := index.NewVectorIndex(dim)
-	for i := 0; i < n; i++ {
-		v := randUnit(rng, dim)
-		vi.AddPassage(fmt.Sprintf("https://test/p%d", i), "doc", i*100, 100, v)
-	}
-	// Time `queries` searches.
-	q := make([][]float32, queries)
-	for i := range q {
-		q[i] = randUnit(rng, dim)
-	}
-	lats := make([]time.Duration, queries)
-	for i, qv := range q {
-		start := time.Now()
-		_ = vi.Search(context.Background(), qv, 10)
-		lats[i] = time.Since(start)
-	}
-	p50, p95, p99 := percentiles(lats)
-	return &benchResult{
-		Mode: "vector", N: n, Dim: dim, Queries: queries,
-		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
-		QPS: float64(queries) / sumDur(lats).Seconds(),
-	}
-}
-
-func benchBM25(ctx context.Context, n, queries int) (*benchResult, error) {
-	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-bench-%d", time.Now().UnixNano()))
-	s, err := store.Open(tmpDir)
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		s.Close()
-		_ = os.RemoveAll(tmpDir)
-	}()
-	bm := index.NewBM25(s)
-
-	rng := newSeededRand()
-	vocab := []string{"alpha", "beta", "gamma", "delta", "epsilon", "go", "rust", "python",
-		"distributed", "consensus", "raft", "paxos", "quantum", "entanglement", "cell",
-		"mitochondria", "roman", "empire", "pacific", "midway", "tennis", "soccer",
-		"bitcoin", "blockchain", "transformer", "attention", "model", "vector", "index"}
-	// Build N synthetic docs of ~50 random vocab words each.
-	for i := 0; i < n; i++ {
-		var sb strings.Builder
-		for j := 0; j < 50; j++ {
-			if j > 0 {
-				sb.WriteByte(' ')
-			}
-			sb.WriteString(vocab[rng.Intn(len(vocab))])
-		}
-		id, err := s.UpsertDocument(ctx, &store.Document{
-			URL: fmt.Sprintf("https://test/d%d", i), Title: vocab[rng.Intn(len(vocab))],
-			Text: sb.String(), Source: "bench", FetchedAt: time.Now(),
-		})
-		if err != nil {
-			return nil, err
-		}
-		if err := bm.IndexDocument(ctx, id, "", sb.String()); err != nil {
-			return nil, err
-		}
-	}
-
-	// Random queries of 2-4 vocab words.
-	qstrs := make([]string, queries)
-	for i := range qstrs {
-		k := 2 + rng.Intn(3)
-		var sb strings.Builder
-		for j := 0; j < k; j++ {
-			if j > 0 {
-				sb.WriteByte(' ')
-			}
-			sb.WriteString(vocab[rng.Intn(len(vocab))])
-		}
-		qstrs[i] = sb.String()
-	}
-
-	lats := make([]time.Duration, queries)
-	for i, q := range qstrs {
-		start := time.Now()
-		_, err := bm.Search(ctx, q, 10)
-		if err != nil {
-			return nil, err
-		}
-		lats[i] = time.Since(start)
-	}
-	p50, p95, p99 := percentiles(lats)
-	return &benchResult{
-		Mode: "bm25", N: n, Queries: queries,
-		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
-		QPS: float64(queries) / sumDur(lats).Seconds(),
-	}, nil
-}
-
-// benchBM25SQLite is an alias of benchBM25 with an explicit "bm25-sqlite" Mode
-// label so storage-mode output is unambiguous when both backends are emitted.
-func benchBM25SQLite(ctx context.Context, n, queries int) (*benchResult, error) {
-	r, err := benchBM25(ctx, n, queries)
-	if err != nil {
-		return nil, err
-	}
-	r.Mode = "bm25-sqlite"
-	return r, nil
-}
-
-// benchBM25Pebble mirrors benchBM25 but runs against PebbleStore + PebbleBM25.
-// Deterministic vocab + RNG seed so SQLite and Pebble runs produce comparable
-// numbers (same N docs, same K queries, same query distribution).
-// empirical validation of the path-2 storage rework.
-func benchBM25Pebble(ctx context.Context, n, queries int) (*benchResult, error) {
-	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-pebble-bench-%d", time.Now().UnixNano()))
-	ps, err := store.OpenPebble(tmpDir)
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		ps.Close()
-		_ = os.RemoveAll(tmpDir)
-	}()
-	bm := index.NewPebbleBM25(ps)
-
-	rng := newSeededRand()
-	vocab := []string{"alpha", "beta", "gamma", "delta", "epsilon", "go", "rust", "python",
-		"distributed", "consensus", "raft", "paxos", "quantum", "entanglement", "cell",
-		"mitochondria", "roman", "empire", "pacific", "midway", "tennis", "soccer",
-		"bitcoin", "blockchain", "transformer", "attention", "model", "vector", "index"}
-	for i := 0; i < n; i++ {
-		var sb strings.Builder
-		for j := 0; j < 50; j++ {
-			if j > 0 {
-				sb.WriteByte(' ')
-			}
-			sb.WriteString(vocab[rng.Intn(len(vocab))])
-		}
-		id, err := ps.UpsertDocument(ctx, &store.Document{
-			URL: fmt.Sprintf("https://test/d%d", i), Title: vocab[rng.Intn(len(vocab))],
-			Text: sb.String(), Source: "bench", FetchedAt: time.Now(),
-		})
-		if err != nil {
-			return nil, err
-		}
-		if err := bm.IndexDocument(ctx, id, "", sb.String()); err != nil {
-			return nil, err
-		}
-	}
-
-	qstrs := make([]string, queries)
-	for i := range qstrs {
-		k := 2 + rng.Intn(3)
-		var sb strings.Builder
-		for j := 0; j < k; j++ {
-			if j > 0 {
-				sb.WriteByte(' ')
-			}
-			sb.WriteString(vocab[rng.Intn(len(vocab))])
-		}
-		qstrs[i] = sb.String()
-	}
-
-	lats := make([]time.Duration, queries)
-	for i, q := range qstrs {
-		start := time.Now()
-		_, err := bm.Search(ctx, q, 10)
-		if err != nil {
-			return nil, err
-		}
-		lats[i] = time.Since(start)
-	}
-	p50, p95, p99 := percentiles(lats)
-	return &benchResult{
-		Mode: "bm25-pebble", N: n, Queries: queries,
-		P50Micros: p50.Microseconds(), P95Micros: p95.Microseconds(), P99Micros: p99.Microseconds(),
-		QPS: float64(queries) / sumDur(lats).Seconds(),
-	}, nil
-}
-
-func newSeededRand() *rand.Rand {
-	return rand.New(rand.NewSource(42)) // deterministic so runs are comparable
-}
-
-func randUnit(rng *rand.Rand, dim int) []float32 {
-	v := make([]float32, dim)
-	var norm float64
-	for i := range v {
-		v[i] = float32(rng.NormFloat64())
-		norm += float64(v[i]) * float64(v[i])
-	}
-	if norm == 0 {
-		v[0] = 1
-		return v
-	}
-	inv := float32(1.0 / sqrt(norm))
-	for i := range v {
-		v[i] *= inv
-	}
-	return v
-}
-
-func sqrt(x float64) float64 {
-	// stdlib math import already pulled through other packages; just do it here.
-	z := x / 2
-	for i := 0; i < 20; i++ {
-		if z == 0 {
-			break
-		}
-		z = (z + x/z) / 2
-	}
-	return z
-}
-
-// benchCrawl measures end-to-end crawler throughput against an in-process
-// website with N linked synthetic pages. Backs up the project directive's
-// "lightweight, on-par with modern crawlers" claim with measured pages/sec.
-//
-// The fixture: an httptest server serving N pages, each linking to the next
-// few via <a href="/pN+1">. The crawler is configured with per_host_delay=0
-// (we're hitting localhost), max_concurrent=8, robots disabled (would add a
-// constant ~1 fetch of /robots.txt unrelated to the throughput question).
-func benchCrawl(ctx context.Context, n, perHostDelayMs int) (*benchResult, error) {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		// Parse "/pN" from request path.
-		if !strings.HasPrefix(r.URL.Path, "/p") {
-			http.NotFound(w, r)
-			return
-		}
-		idx, err := strconv.Atoi(r.URL.Path[2:])
-		if err != nil || idx < 0 || idx >= n {
-			http.NotFound(w, r)
-			return
-		}
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		fmt.Fprintf(w, `<!doctype html><html><head><title>Page %d</title></head><body><h1>Page %d</h1>`, idx, idx)
-		fmt.Fprintf(w, `<p>Synthetic content for page %d. The crawler follows links from this page to nearby pages, building up the index.</p>`, idx)
-		// Link to next 3 pages so the crawler has a graph to walk.
-		for j := idx + 1; j < idx+4 && j < n; j++ {
-			fmt.Fprintf(w, `<a href="/p%d">page %d</a> `, j, j)
-		}
-		fmt.Fprint(w, `</body></html>`)
-	})
-	srv := httptest.NewServer(mux)
-	defer srv.Close()
-
-	tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-bench-crawl-%d", time.Now().UnixNano()))
-	s, err := store.Open(tmpDir)
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		s.Close()
-		_ = os.RemoveAll(tmpDir)
-	}()
-
-	cfg := config.Default().Crawler
-	// -per-host-delay propagates from the bench CLI flag. Default 0
-	// (localhost throughput); set to 100–1000 to measure under realistic politeness.
-	cfg.PerHostDelayMs = perHostDelayMs
-	// Lower concurrency than the default 8 — bench output gets noisy with
-	// SQLite BUSY contention messages at high parallelism, and the bench
-	// metric is meant to be repeatable. Real deployments crawling many hosts
-	// at once should keep the default 8.
-	cfg.MaxConcurrent = 4
-	cfg.MaxDepth = 100 // ensure no depth ceiling cuts the crawl short
-	cfg.RespectRobots = false
-	cfg.IncludeDomains = nil // accept the httptest host (port-bound)
-
-	c := crawler.New(cfg, s)
-	// Seed ALL pages — measures pure fetch+parse+index throughput, not the
-	// crawler's link-discovery rate. Avoids the 1.5s "frontier empty"
-	// terminator firing before link parsing has populated more work.
-	for i := 0; i < n; i++ {
-		if e := c.Seed(fmt.Sprintf("%s/p%d", srv.URL, i)); e != nil {
-			return nil, fmt.Errorf("seed p%d: %w", i, e)
-		}
-	}
-
-	start := time.Now()
-	// Cap the run at 60s in case something goes wrong — bench should never hang.
-	runCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
-	defer cancel()
-	if err := c.Run(runCtx); err != nil {
-		return nil, fmt.Errorf("run: %w", err)
-	}
-	elapsed := time.Since(start)
-
-	st, err := s.Stats(ctx)
-	if err != nil {
-		return nil, err
-	}
-	return &benchResult{
-		Mode: "crawl", N: n,
-		ElapsedMicros:  elapsed.Microseconds(),
-		Docs:           st.Documents,
-		PagesPerSec:    float64(st.Documents) / elapsed.Seconds(),
-		Terms:          st.Terms,
-		PerHostDelayMs: perHostDelayMs,
-	}, nil
-	// Note: the crawler's termination detector adds ~1.5s of polling at the
-	// end of every run. For small N this dominates elapsed and the pages/sec
-	// figure understates steady-state throughput. Larger N is more representative.
-}
-
-func percentiles(d []time.Duration) (p50, p95, p99 time.Duration) {
-	if len(d) == 0 {
-		return 0, 0, 0
-	}
-	sorted := make([]time.Duration, len(d))
-	copy(sorted, d)
-	// Simple sort — durations as int64 nanos.
-	for i := 1; i < len(sorted); i++ {
-		for j := i; j > 0 && sorted[j] < sorted[j-1]; j-- {
-			sorted[j], sorted[j-1] = sorted[j-1], sorted[j]
-		}
-	}
-	q := func(p float64) time.Duration {
-		idx := int(float64(len(sorted)-1) * p)
-		return sorted[idx]
-	}
-	return q(0.5), q(0.95), q(0.99)
-}
-
-func sumDur(d []time.Duration) time.Duration {
-	var s time.Duration
-	for _, x := range d {
-		s += x
-	}
-	return s
-}
-
-// runRefreshDue re-queues URLs whose adaptive interval has elapsed.
-// Combined with conditional GET, a refresh-due pass over a stable corpus
-// mostly costs 304 round-trips — no body, no parse, no embed.
-//
-// One-shot by default. Pass `-interval` to loop forever — useful when running
-// as a systemd service or inside the Docker image (no extra cron needed).
-func runRefreshDue(ctx context.Context, cfg *config.Config, args []string) (err error) {
-	fs := flag.NewFlagSet("refresh-due", flag.ExitOnError)
-	minH := fs.Duration("min", 1*time.Hour, "minimum re-crawl interval")
-	maxH := fs.Duration("max", 30*24*time.Hour, "maximum re-crawl interval")
-	limit := fs.Int("limit", 100, "max URLs to enqueue per pass")
-	dryRun := fs.Bool("dry-run", false, "print URLs that would be refreshed, don't enqueue")
-	interval := fs.Duration("interval", 0, "loop with this delay between passes (0 = one-shot)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	pass := func() error {
-		due, err := s.DueForRefresh(ctx, *minH, *maxH, *limit)
-		if err != nil {
-			return err
-		}
-		if len(due) == 0 {
-			log.Printf("refresh-due: 0 URLs due")
-			return nil
-		}
-		log.Printf("refresh-due: %d URLs due (limit %d, min=%s max=%s)", len(due), *limit, *minH, *maxH)
-		if *dryRun {
-			for _, u := range due {
-				fmt.Println(u)
-			}
-			return nil
-		}
-		c := crawler.New(cfg.Crawler, s)
-		for _, u := range due {
-			if err := c.Recrawl(ctx, u); err != nil {
-				log.Printf("recrawl %s: %v", u, err)
-			}
-		}
-		return c.Run(ctx)
-	}
-
-	if *interval <= 0 {
-		return pass()
-	}
-	// Daemon mode: pass, sleep, pass, ... until ctx cancelled.
-	for {
-		if err := pass(); err != nil {
-			log.Printf("refresh-due pass: %v", err)
-		}
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case <-time.After(*interval):
-		}
-	}
-}
-
-// runExport writes the local store's documents to a portable corpus.json,
-// shape-compatible with `cosift ingest`. Round-trips cleanly:
-//
-//	cosift export -output corpus.json
-//	cosift -config other.json ingest -corpus corpus.json
-//
-// Documents only — passages (embeddings) aren't exported because the receiver
-// likely uses a different embedding model.
-// runMigrateToPebble copies a SQLite-backed cosift data directory into a
-// fresh Pebble store. Fifth piece of the path-2 storage rework.
-//
-// Migrates:
-//   - documents (URL, title, text, metadata) via PebbleStore.UpsertDocument
-//   - BM25 postings (re-tokenized + re-indexed to preserve title
-//     boost; the SQLite postings table is NOT copied directly because
-//     re-indexing through PebbleBM25 is the same code path that production
-//     uses going forward — eliminates the divergence risk of two
-//     posting-write paths)
-//
-// Does NOT migrate (deferred): frontier rows, query_outcomes feedback,
-// paraphrase/HyDE caches, vector embeddings. Operators starting from a
-// migrated Pebble store get a working BM25 index immediately; dense + LLM
-// caches rebuild from scratch on the new instance.
-//
-// The destination directory must be empty; the migration refuses to
-// overwrite existing data so a mistyped path can't clobber a working store.
-func runMigrateToPebble(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("migrate-to-pebble", flag.ExitOnError)
-	output := fs.String("output", "", "output directory for the Pebble store (required)")
-	progress := fs.Duration("progress", 5*time.Second, "log progress every N (0 disables)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *output == "" {
-		return errors.New("migrate-to-pebble: -output is required")
-	}
-	// Refuse to write into a directory that already contains a Pebble store.
-	if entries, err := os.ReadDir(*output); err == nil && len(entries) > 0 {
-		return fmt.Errorf("migrate-to-pebble: -output %s is non-empty; refusing to overwrite (move or remove first)", *output)
-	}
-
-	src, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return fmt.Errorf("open source SQLite store at %s: %w", cfg.DataDir, err)
-	}
-	defer src.Close()
-
-	dst, err := openPebbleOrFriendlyErr(*output)
-	if err != nil {
-		return err
-	}
-	defer dst.Close()
-
-	pidx := index.NewPebbleBM25(dst)
-
-	docs, err := src.ListDocuments(ctx, 0)
-	if err != nil {
-		return fmt.Errorf("list source documents: %w", err)
-	}
-	log.Printf("migrate-to-pebble: %d documents to copy (source: %s → destination: %s)",
-		len(docs), cfg.DataDir, *output)
-
-	reporter := newProgressReporter("migrate docs", len(docs), *progress)
-	for i, d := range docs {
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-		// Upsert the doc into Pebble — assigns a fresh Pebble-side ID.
-		newID, err := dst.UpsertDocument(ctx, d)
-		if err != nil {
-			return fmt.Errorf("upsert doc %s: %w", d.URL, err)
-		}
-		// Re-index in Pebble BM25. Uses the same Tokenize + TitleBoost that
-		// production reads through, so behavior of the migrated index matches
-		// what a fresh crawl would produce.
-		if err := pidx.IndexDocument(ctx, newID, d.Title, d.Text); err != nil {
-			return fmt.Errorf("index doc %s: %w", d.URL, err)
-		}
-		reporter.maybeLog(i + 1)
-	}
-
-	stats, err := dst.Stats(ctx)
-	if err != nil {
-		return err
-	}
-	log.Printf("migrate-to-pebble: %d documents indexed into Pebble at %s", stats.Documents, *output)
-	return nil
-}
-
-func runExport(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("export", flag.ExitOnError)
-	output := fs.String("output", "", "output path (default depends on -format: corpus-export.{json,jsonl,txt,md})")
-	limit := fs.Int("limit", 0, "max docs to export (0 = all, applied AFTER filters)")
-	// -format selects the on-disk shape.
-	//   json (default — eval.Corpus pretty-printed; backward-compatible with)
-	//   jsonl — one {url,title,text} per line; common for ML fine-tuning pipelines
-	//   text  — Title/URL header + body + --- separator; for RAG corpora / grep
-	//   md    — `# Title` + URL line + body + horizontal rule; for LLM prompt piping
-	format := fs.String("format", "json", "output format: json | jsonl | text | md")
-	// All applied client-side after ListDocuments.
-	includeDomains := fs.String("include-domains", "", "comma-separated allowlist of domains (suffix match on dot boundary)")
-	excludeDomains := fs.String("exclude-domains", "", "comma-separated denylist of domains")
-	since := fs.String("since", "", "ISO date — only docs with published_at on or after (drops undated docs)")
-	until := fs.String("until", "", "ISO date — only docs with published_at on or before (drops undated docs)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if err := validateExportFormat(*format); err != nil {
-		return err
-	}
-	if *output == "" {
-		*output = "corpus-export." + exportExtension(*format)
-	}
-
-	sinceT, err := parseExportDate(*since)
-	if err != nil {
-		return fmt.Errorf("-since: %w", err)
-	}
-	untilT, err := parseExportDate(*until)
-	if err != nil {
-		return fmt.Errorf("-until: %w", err)
-	}
-	includeList := splitDomainCSV(*includeDomains)
-	excludeList := splitDomainCSV(*excludeDomains)
-	hasDateFilter := !sinceT.IsZero() || !untilT.IsZero()
-
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	// limit applies AFTER filters now — operators expect "give me 100
-	// docs from example.com" to mean 100 example.com docs, not 100 docs total
-	// of which some are from example.com. Pass 0 (no limit) to ListDocuments
-	// and apply the limit client-side after filtering.
-	rawLimit := 0
-	if *limit > 0 && !hasDateFilter && len(includeList) == 0 && len(excludeList) == 0 {
-		// No filters → push the limit down to ListDocuments (faster, less memory).
-		rawLimit = *limit
-	}
-	docs, err := s.ListDocuments(ctx, rawLimit)
-	if err != nil {
-		return err
-	}
-
-	docs = filterExportDocs(docs, includeList, excludeList, sinceT, untilT)
-	if *limit > 0 && len(docs) > *limit {
-		docs = docs[:*limit]
-	}
-
-	f, cerr := os.Create(*output)
-	if cerr != nil {
-		return cerr
-	}
-	defer func() {
-		if closeErr := f.Close(); closeErr != nil && err == nil {
-			err = fmt.Errorf("close output: %w", closeErr)
-		}
-	}()
-
-	switch *format {
-	case "json":
-		// wire shape: eval.Corpus pretty-printed. Preserved as default.
-		corpus := eval.Corpus{Docs: make([]eval.CorpusDoc, 0, len(docs))}
-		for _, d := range docs {
-			corpus.Docs = append(corpus.Docs, eval.CorpusDoc{URL: d.URL, Title: d.Title, Text: d.Text})
-		}
-		enc := json.NewEncoder(f)
-		enc.SetIndent("", "  ")
-		if err := enc.Encode(corpus); err != nil {
-			return fmt.Errorf("encode: %w", err)
-		}
-	case "jsonl":
-		// One {url,title,text} per line. No outer array — caller streams line-by-line.
-		enc := json.NewEncoder(f)
-		for _, d := range docs {
-			if err := enc.Encode(eval.CorpusDoc{URL: d.URL, Title: d.Title, Text: d.Text}); err != nil {
-				return fmt.Errorf("encode jsonl: %w", err)
-			}
-		}
-	case "text":
-		// Title:/URL: headers + blank + body + --- separator. Matches
-		// `contents -text` batch separator convention (LLMs interpret `---` as
-		// section breaks).
-		for i, d := range docs {
-			if i > 0 {
-				fmt.Fprintln(f, "---")
-				fmt.Fprintln(f)
-			}
-			if d.Title != "" {
-				fmt.Fprintf(f, "Title: %s\n", d.Title)
-			}
-			fmt.Fprintf(f, "URL: %s\n\n", d.URL)
-			fmt.Fprintln(f, d.Text)
-		}
-	case "md":
-		// `# Title` heading + italic URL line + body + horizontal rule. For
-		// piping into LLM prompt contexts that render markdown.
-		for i, d := range docs {
-			if i > 0 {
-				fmt.Fprintln(f)
-				fmt.Fprintln(f, "---")
-				fmt.Fprintln(f)
-			}
-			if d.Title != "" {
-				fmt.Fprintf(f, "# %s\n\n", d.Title)
-			}
-			fmt.Fprintf(f, "_%s_\n\n", d.URL)
-			fmt.Fprintln(f, d.Text)
-		}
-	}
-	log.Printf("export: %d docs → %s (%s)", len(docs), *output, *format)
-	return nil
-}
-
-// parseExportDate accepts YYYY-MM-DD or full RFC3339 (matches the
-// /search?since=/?until= conventions). Empty input returns zero time + nil
-// error (no filter).
-func parseExportDate(s string) (time.Time, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return time.Time{}, nil
-	}
-	if t, err := time.Parse(time.RFC3339, s); err == nil {
-		return t, nil
-	}
-	if t, err := time.Parse("2006-01-02", s); err == nil {
-		return t, nil
-	}
-	return time.Time{}, fmt.Errorf("could not parse date %q", s)
-}
-
-// splitDomainCSV parses a comma-separated list of domains into lowercased
-// non-empty entries. (mirrors internal/server's unexported splitCSV).
-func splitDomainCSV(s string) []string {
-	if s == "" {
-		return nil
-	}
-	parts := strings.Split(s, ",")
-	out := make([]string, 0, len(parts))
-	for _, p := range parts {
-		t := strings.ToLower(strings.TrimSpace(p))
-		if t != "" {
-			out = append(out, t)
-		}
-	}
-	return out
-}
-
-// matchesDomainPattern is the strict suffix-on-dot-boundary match the
-// /search filter uses. `example.com` matches `blog.example.com` but NOT
-// `evilexample.com`.
-func matchesDomainPattern(host string, patterns []string) bool {
-	host = strings.ToLower(host)
-	for _, p := range patterns {
-		if host == p || strings.HasSuffix(host, "."+p) {
-			return true
-		}
-	}
-	return false
-}
-
-// hostFromURL extracts the lowercased host without port from a URL. Returns
-// empty string when parsing fails so callers can treat unparseable URLs
-// uniformly (typically: excluded from include-filtered exports).
-func hostFromURL(rawURL string) string {
-	u, err := url.Parse(rawURL)
-	if err != nil {
-		return ""
-	}
-	return strings.ToLower(u.Hostname())
-}
-
-// filterExportDocs applies the export filters to a doc slice
-// in-memory. Returns the filtered slice (in input order — preserves whatever
-// ordering ListDocuments returned).
-func filterExportDocs(docs []*store.Document, include, exclude []string, since, until time.Time) []*store.Document {
-	hasDateFilter := !since.IsZero() || !until.IsZero()
-	hasDomainFilter := len(include) > 0 || len(exclude) > 0
-	if !hasDateFilter && !hasDomainFilter {
-		return docs
-	}
-	out := make([]*store.Document, 0, len(docs))
-	for _, d := range docs {
-		// Date filter: undated docs are excluded when ANY date bound is set
-		// (matches /search?since=/?until= semantics).
-		if hasDateFilter {
-			if d.PublishedAt.IsZero() {
-				continue
-			}
-			if !since.IsZero() && d.PublishedAt.Before(since) {
-				continue
-			}
-			if !until.IsZero() && d.PublishedAt.After(until) {
-				continue
-			}
-		}
-		if hasDomainFilter {
-			host := hostFromURL(d.URL)
-			if len(include) > 0 && !matchesDomainPattern(host, include) {
-				continue
-			}
-			if len(exclude) > 0 && matchesDomainPattern(host, exclude) {
-				continue
-			}
-		}
-		out = append(out, d)
-	}
-	return out
-}
-
-// validateExportFormat is the export-side counterpart to's
-// validateFormat. Different accept-list because export supports json/jsonl
-// (file-shaped) which the synth-output CLIs don't, and synth CLIs support
-// markdown aliases which export doesn't need (single canonical name reduces
-// confusion when picking a file extension).
-func validateExportFormat(v string) error {
-	switch v {
-	case "json", "jsonl", "text", "md":
-		return nil
-	default:
-		return fmt.Errorf("export format must be one of: json, jsonl, text, md (got %q)", v)
-	}
-}
-
-// exportExtension picks a conventional file extension for each export format.
-// Used to derive a default -output path when the operator doesn't specify one.
-func exportExtension(format string) string {
-	switch format {
-	case "jsonl":
-		return "jsonl"
-	case "text":
-		return "txt"
-	case "md":
-		return "md"
-	default: // json
-		return "json"
-	}
-}
-
-// runGC drops persistently-errored frontier rows and (optionally) VACUUMs
-// the SQLite file. Designed for long-lived deployments where frontier garbage
-// would otherwise accumulate.
-func runGC(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("gc", flag.ExitOnError)
-	minAttempts := fs.Int("min-attempts", 5, "drop frontier rows with status='error' AND attempts >= N")
-	paraphraseTTL := fs.Duration("paraphrase-ttl", 0, "drop query_paraphrases rows older than this (0 = skip)")
-	vacuum := fs.Bool("vacuum", true, "run VACUUM after cleanup to reclaim disk")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	n, err := s.GCErroredFrontier(ctx, *minAttempts)
-	if err != nil {
-		return fmt.Errorf("gc frontier: %w", err)
-	}
-	log.Printf("gc: removed %d errored frontier rows (min_attempts=%d)", n, *minAttempts)
-
-	if *paraphraseTTL > 0 {
-		pn, err := s.PruneStaleParaphrases(ctx, *paraphraseTTL)
-		if err != nil {
-			return fmt.Errorf("gc paraphrases: %w", err)
-		}
-		log.Printf("gc: pruned %d stale paraphrases (ttl=%s)", pn, *paraphraseTTL)
-	}
-
-	if *vacuum {
-		log.Printf("gc: vacuuming...")
-		if err := s.Vacuum(ctx); err != nil {
-			return fmt.Errorf("vacuum: %w", err)
-		}
-		log.Printf("gc: vacuum complete")
-	}
-	return nil
-}
-
-// runFrontierTrim deletes completed (status='done') frontier rows older than a
-// configurable age and optionally VACUUMs the database.
-//
-// Background: the GC command (runGC) only drops status='error' rows. Completed
-// rows accumulate indefinitely — a 500k-URL crawl leaves 500k done rows that
-// serve no purpose once the URL is in the documents table. Over months of
-// continuous crawling this can reach tens of millions of rows, bloating the DB
-// by several GB and slowing ClaimFrontier's ORDER BY scan even with an index.
-//
-// Default -older-than of 168h (7 days) is safe for the default refresh cycle
-// (refresh-due at 24h): a URL that was crawled 7 days ago and whose done row
-// is deleted will re-enter the frontier on the next refresh-due pass, which is
-// the correct behavior. Operators with longer refresh cycles should raise this
-// value accordingly (e.g. -older-than=720h for monthly refreshes).
-func runFrontierTrim(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("frontier-trim", flag.ExitOnError)
-	olderThan := fs.Duration("older-than", 7*24*time.Hour, "delete done rows enqueued more than this long ago (e.g. 168h, 720h)")
-	dryRun := fs.Bool("dry-run", false, "print what would be deleted without actually deleting")
-	vacuum := fs.Bool("vacuum", true, "run VACUUM after deletion to reclaim disk space")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	stats, serr := s.GetFrontierStats(ctx)
-	if serr != nil {
-		return fmt.Errorf("frontier-trim: stats: %w", serr)
-	}
-	log.Printf("frontier-trim: before — queued=%d in_flight=%d done=%d error=%d",
-		stats.Queued, stats.InFlight, stats.Done, stats.Errored)
-
-	if *dryRun {
-		log.Printf("frontier-trim: dry-run — would delete done rows older than %s (skipping actual delete)", *olderThan)
-		return nil
-	}
-
-	n, derr := s.TrimDoneFrontier(ctx, *olderThan)
-	if derr != nil {
-		return fmt.Errorf("frontier-trim: %w", derr)
-	}
-	log.Printf("frontier-trim: removed %d done rows older than %s", n, *olderThan)
-
-	if *vacuum && n > 0 {
-		log.Printf("frontier-trim: vacuuming (this may take a while on large databases)…")
-		if verr := s.Vacuum(ctx); verr != nil {
-			return fmt.Errorf("frontier-trim: vacuum: %w", verr)
-		}
-		log.Printf("frontier-trim: vacuum complete")
-	}
-	return nil
-}
-
-// runSeedTranco reads a Tranco top-1M CSV and pushes the top-N root URLs into
-// the frontier as depth-0 seeds. This is the fastest way to bootstrap a broad
-// crawl from a high-quality, authority-ranked URL set without having to curate
-// a manual seeds file.
-//
-// Each Tranco entry becomes https://<domain>/ with a priority derived from its
-// rank: rank 1 → priority 1.0, rank 1M → priority 0.1, log-scale in between.
-// The INSERT OR IGNORE semantics of PushFrontier mean this is safe to run
-// repeatedly — it only adds URLs not already in the frontier (regardless of
-// their current status).
-//
-// Download the latest Tranco CSV from https://tranco-list.eu/ (updated weekly,
-// ~7 MB compressed). The format is "rank,hostname" with no header.
-//
-// Example:
-//
-//	cosift seed-tranco -tranco tranco-top1m.csv -top 10000
-func runSeedTranco(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("seed-tranco", flag.ExitOnError)
-	trancoPath := fs.String("tranco", "", "path to Tranco top-1M CSV (required)")
-	topN := fs.Int("top", 10000, "seed only the top-N domains (0 = all)")
-	scheme := fs.String("scheme", "https", "URL scheme to prepend (https or http)")
-	dryRun := fs.Bool("dry-run", false, "print URLs that would be seeded without writing to the frontier")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *trancoPath == "" {
-		return errors.New("seed-tranco: -tranco is required")
-	}
-	if *scheme != "https" && *scheme != "http" {
-		return fmt.Errorf("seed-tranco: -scheme must be https or http, got %q", *scheme)
-	}
-
-	f, ferr := os.Open(*trancoPath)
-	if ferr != nil {
-		return fmt.Errorf("seed-tranco: open %s: %w", *trancoPath, ferr)
-	}
-	defer f.Close()
-
-	// Parse the CSV into (rank, host) pairs up to topN.
-	type entry struct {
-		rank int
-		host string
-	}
-	entries := make([]entry, 0, 10000)
-	scanner := bufio.NewScanner(f)
-	scanner.Buffer(make([]byte, 0, 4096), 1<<20)
-	for scanner.Scan() {
-		line := strings.TrimSpace(scanner.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		var rankStr, host string
-		if i := strings.IndexAny(line, ",\t"); i > 0 {
-			rankStr = strings.TrimSpace(line[:i])
-			host = strings.ToLower(strings.TrimSpace(line[i+1:]))
-		} else {
-			continue
-		}
-		rank, err := strconv.Atoi(rankStr)
-		if err != nil || rank <= 0 {
-			continue
-		}
-		host = strings.TrimPrefix(host, "www.")
-		if host == "" {
-			continue
-		}
-		if *topN > 0 && rank > *topN {
-			break
-		}
-		entries = append(entries, entry{rank: rank, host: host})
-	}
-	if err := scanner.Err(); err != nil {
-		return fmt.Errorf("seed-tranco: scan: %w", err)
-	}
-	log.Printf("seed-tranco: parsed %d entries from %s (top %d)", len(entries), *trancoPath, *topN)
-
-	if *dryRun {
-		limit := len(entries)
-		if limit > 20 {
-			limit = 20
-		}
-		for _, e := range entries[:limit] {
-			log.Printf("  [dry-run] rank=%d  %s://%s/", e.rank, *scheme, e.host)
-		}
-		if len(entries) > 20 {
-			log.Printf("  … and %d more", len(entries)-20)
-		}
-		return nil
-	}
-
-	s, serr := store.Open(cfg.DataDir)
-	if serr != nil {
-		return serr
-	}
-	defer s.Close()
-
-	// trancoPriority converts a Tranco rank to a frontier priority [0.1, 1.0].
-	// Uses decimal-digit counting as a cheap log10 proxy — good enough for
-	// priority bucketing. rank=1→1.0, rank=10→0.83, rank=100→0.67,
-	// rank=1k→0.50, rank=10k→0.33, rank=100k→0.17, rank=1M→0.10.
-	trancoPriority := func(rank int) float64 {
-		if rank <= 0 {
-			return 0.5
-		}
-		digits := 0
-		r := rank
-		for r >= 10 {
-			r /= 10
-			digits++
-		}
-		p := 1.0 - float64(digits)/6.0
-		if p < 0.1 {
-			p = 0.1
-		}
-		return p
-	}
-
-	pushed := 0
-	for _, e := range entries {
-		rawURL := fmt.Sprintf("%s://%s/", *scheme, e.host)
-		priority := trancoPriority(e.rank)
-		if err := s.PushFrontier(ctx, rawURL, 0, priority); err != nil {
-			log.Printf("seed-tranco: push %s: %v", rawURL, err)
-			continue
-		}
-		pushed++
-	}
-	log.Printf("seed-tranco: pushed %d URLs into frontier (INSERT OR IGNORE — already-present URLs unchanged)", pushed)
-	return nil
-}
-
-// runOutcomes exports query_outcomes for offline calibration work. JSON for
-// programmatic consumers, CSV for spreadsheet / pandas notebooks.
-func runOutcomes(ctx context.Context, cfg *config.Config, args []string) (err error) {
-	fs := flag.NewFlagSet("outcomes", flag.ExitOnError)
-	output := fs.String("output", "outcomes.json", "output path")
-	format := fs.String("format", "json", "json | csv")
-	limit := fs.Int("limit", 0, "max rows (0 = all)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *format != "json" && *format != "csv" {
-		return fmt.Errorf("unsupported format %q (use json or csv)", *format)
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	rows, err := s.ListOutcomes(ctx, *limit)
-	if err != nil {
-		return err
-	}
-	f, cerr := os.Create(*output)
-	if cerr != nil {
-		return cerr
-	}
-	defer func() {
-		if closeErr := f.Close(); closeErr != nil && err == nil {
-			err = fmt.Errorf("close output: %w", closeErr)
-		}
-	}()
-
-	switch *format {
-	case "json":
-		enc := json.NewEncoder(f)
-		enc.SetIndent("", "  ")
-		if err := enc.Encode(rows); err != nil {
-			return err
-		}
-	case "csv":
-		w := csv.NewWriter(f)
-		_ = w.Write([]string{"id", "query", "url", "score", "useful", "source", "recorded_at"})
-		for _, r := range rows {
-			useful := "0"
-			if r.Useful {
-				useful = "1"
-			}
-			_ = w.Write([]string{
-				strconv.FormatInt(r.ID, 10),
-				r.Query, r.URL,
-				strconv.FormatFloat(r.Score, 'f', -1, 64),
-				useful, r.Source,
-				r.RecordedAt.Format(time.RFC3339),
-			})
-		}
-		w.Flush()
-		if err := w.Error(); err != nil {
-			return err
-		}
-	}
-	log.Printf("outcomes: %d rows → %s (%s)", len(rows), *output, *format)
-	return nil
-}
-
-// runDoctor checks the local install: data dir writable, schema open,
-// fixtures present, env recognized. Pure local checks — no network calls,
-// no API key spending. Use `cosift eval` for an end-to-end smoke against
-// real services.
-//
-// Exit code: 0 if everything is PASS or WARN; 1 if any FAIL.
-// doctorCheck is one row of the doctor report. Promoted from a locally-typed
-// struct so the defaults check can be tested without stdout capture.
-type doctorCheck struct {
-	Name   string `json:"name"`
-	Status string `json:"status"` // "PASS" | "WARN" | "FAIL" | "INFO" | "SKIP"
-	Detail string `json:"detail"`
-}
-
-// doctorDefaultsChecks cross-checks the defaults block against
-// configured capabilities. Returns the rows that would be appended to the
-// doctor report. Pure function — no IO, no stdout, no environment reads.
-// hasEmbed/hasChat reflect "is the capability available at all" (config
-// fields populated or env keys present); the caller resolves those before
-// calling.
-func doctorDefaultsChecks(d config.Defaults, hasEmbed, hasChat bool) []doctorCheck {
-	if d.Retriever == "" && !d.Expand && d.ResearchStrategy == "" && d.ResearchSynthK == 0 {
-		return []doctorCheck{{
-			Name:   "defaults",
-			Status: "PASS",
-			Detail: "no defaults set (per-request params win; planner is the /research default)",
-		}}
-	}
-	checks := []doctorCheck{{
-		Name:   "defaults",
-		Status: "PASS",
-		Detail: fmt.Sprintf("retriever=%q expand=%v research_strategy=%q research_synth_k=%d", d.Retriever, d.Expand, d.ResearchStrategy, d.ResearchSynthK),
-	}}
-	if d.ResearchSynthK < 0 {
-		checks = append(checks, doctorCheck{
-			Name:   "defaults.research_synth_k",
-			Status: "FAIL",
-			Detail: fmt.Sprintf("research_synth_k must be ≥ 0 (got %d). 0 = use built-in default (10); positive = cap", d.ResearchSynthK),
-		})
-	}
-	switch d.Retriever {
-	case "dense", "hybrid":
-		if !hasEmbed {
-			checks = append(checks, doctorCheck{
-				Name:   "defaults.retriever",
-				Status: "WARN",
-				Detail: fmt.Sprintf("%q default needs embeddings model — set cfg.Embeddings.Model or OPENAI_API_KEY", d.Retriever),
-			})
-		}
-	case "", "bm25":
-		// no-op; bm25 needs no capability beyond the SQLite index.
-	default:
-		checks = append(checks, doctorCheck{
-			Name:   "defaults.retriever",
-			Status: "FAIL",
-			Detail: fmt.Sprintf("unknown retriever %q (valid: bm25, dense, hybrid)", d.Retriever),
-		})
-	}
-	if d.Expand && !hasChat {
-		checks = append(checks, doctorCheck{
-			Name:   "defaults.expand",
-			Status: "WARN",
-			Detail: "expand=true needs a chat model for paraphrasing — set cfg.Chat.Model or OPENAI_API_KEY",
-		})
-	}
-	switch d.ResearchStrategy {
-	case "paraphrase":
-		if !hasChat {
-			checks = append(checks, doctorCheck{
-				Name:   "defaults.research_strategy",
-				Status: "WARN",
-				Detail: "paraphrase needs a chat model for the paraphraser — set cfg.Chat.Model or OPENAI_API_KEY",
-			})
-		}
-	case "", "planner":
-		// no-op; planner is the historic default.
-	default:
-		checks = append(checks, doctorCheck{
-			Name:   "defaults.research_strategy",
-			Status: "FAIL",
-			Detail: fmt.Sprintf("unknown strategy %q (valid: planner, paraphrase)", d.ResearchStrategy),
-		})
-	}
-	return checks
-}
-
-// runInit writes a sensible default cosift.json to the requested path. By
-// default it refuses to overwrite an existing file; -force opts in.
-//
-// The optional -site URL pre-populates `crawler.include_domains` so the user
-// can immediately `cosift crawl <url>` against a target site without editing
-// the config first. Lowers the onboarding cost for the self-hostable use case.
-func runInit(cfgPath string, args []string) error {
-	fs := flag.NewFlagSet("init", flag.ExitOnError)
-	force := fs.Bool("force", false, "overwrite an existing config file")
-	site := fs.String("site", "", "URL of a site to pre-populate crawler.include_domains with (e.g. https://docs.example.com)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	if _, err := os.Stat(cfgPath); err == nil && !*force {
-		return fmt.Errorf("%s already exists; pass -force to overwrite", cfgPath)
-	}
-
-	cfg := config.Default()
-	if *site != "" {
-		host, err := siteToHost(*site)
-		if err != nil {
-			return fmt.Errorf("-site: %w", err)
-		}
-		cfg.Crawler.IncludeDomains = []string{host}
-	}
-
-	buf, err := json.MarshalIndent(cfg, "", "  ")
-	if err != nil {
-		return fmt.Errorf("marshal: %w", err)
-	}
-	// cosift.json carries Server.AdminToken and may be the sink for
-	// LoadDotEnv-sourced secrets (OPENAI_API_KEY, etc.). Owner-only.
-	if err := os.WriteFile(cfgPath, buf, 0o600); err != nil {
-		return fmt.Errorf("write %s: %w", cfgPath, err)
-	}
-
-	fmt.Printf("wrote %s\n", cfgPath)
-	if cfg.Crawler.IncludeDomains != nil {
-		fmt.Printf("  crawler.include_domains: %v\n", cfg.Crawler.IncludeDomains)
-	}
-	fmt.Println()
-	fmt.Println("next steps:")
-	if *site != "" {
-		fmt.Printf("  1. cosift crawl %s\n", *site)
-	} else {
-		fmt.Println("  1. cosift crawl <url...>")
-	}
-	fmt.Println("  2. cosift serve")
-	fmt.Println()
-	fmt.Println("optional: set OPENAI_API_KEY in your environment (or .env) to enable")
-	fmt.Println("  dense/hybrid retrieval, /answer, /research, and ?expand=true.")
-	return nil
-}
-
-// siteToHost extracts the hostname from a URL or returns the input verbatim if
-// it's already a bare host (e.g. "docs.example.com" vs "https://docs.example.com").
-// Used by `cosift init -site` to populate include_domains.
-func siteToHost(s string) (string, error) {
-	s = strings.TrimSpace(s)
-	if s == "" {
-		return "", errors.New("empty site")
-	}
-	// If no scheme, treat as bare host and validate.
-	if !strings.Contains(s, "://") {
-		// reject if it looks like a path or has whitespace
-		if strings.ContainsAny(s, " /\t\n") {
-			return "", fmt.Errorf("not a hostname: %q", s)
-		}
-		return s, nil
-	}
-	u, err := url.Parse(s)
-	if err != nil {
-		return "", err
-	}
-	if u.Host == "" {
-		return "", fmt.Errorf("could not extract host from %q", s)
-	}
-	return u.Host, nil
-}
-
-// runCheckRobots reports whether each URL is crawlable under the site's
-// robots.txt, plus any Crawl-delay. Lets operators plan crawls without
-// hand-inspecting the site's robots.txt.
-//
-// Wraps the existing internal/crawler.Robots so the CLI uses exactly the
-// same enforcement logic the real crawler would. No drift.
-func runCheckRobots(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("check-robots", flag.ExitOnError)
-	userAgent := fs.String("user-agent", cfg.Crawler.UserAgent, "User-Agent the check pretends to be (defaults to cfg.crawler.user_agent)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	urls := fs.Args()
-	if len(urls) == 0 {
-		return errors.New("usage: cosift check-robots [-user-agent UA] <url...>")
-	}
-	if *userAgent == "" {
-		*userAgent = "CosiftBot/0.0 (+https://github.com/pilot-protocol/cosift)"
-	}
-	httpClient := &http.Client{Timeout: 15 * time.Second}
-	r := crawler.NewRobots(httpClient, *userAgent)
-
-	fmt.Printf("user-agent: %s\n", *userAgent)
-
-	// Probe robots.txt for each unique host before running per-URL checks.
-	// Robots.Allowed returns (true, ...) when robots.txt is unreachable
-	// (graceful degradation suits the crawler), but the operator running
-	// check-robots wants to see "this host has no reachable robots.txt"
-	// explicitly. Group URLs by host so we only probe each host once.
-	hosts := uniqueHosts(urls)
-	fmt.Println()
-	for _, h := range hosts {
-		probeURL := h + "/robots.txt"
-		req, _ := http.NewRequestWithContext(ctx, http.MethodGet, probeURL, http.NoBody)
-		req.Header.Set("User-Agent", *userAgent)
-		resp, err := httpClient.Do(req)
-		if err != nil {
-			fmt.Printf("robots.txt   %s — UNREACHABLE: %v (crawler will assume ALLOWED for everything on this host)\n", probeURL, err)
-			continue
-		}
-		_ = resp.Body.Close()
-		switch {
-		case resp.StatusCode == 200:
-			fmt.Printf("robots.txt   %s — OK (status 200)\n", probeURL)
-		case resp.StatusCode == 404:
-			fmt.Printf("robots.txt   %s — 404, no rules (crawler will assume ALLOWED)\n", probeURL)
-		default:
-			fmt.Printf("robots.txt   %s — status %d (crawler will assume ALLOWED on non-2xx/404)\n", probeURL, resp.StatusCode)
-		}
-		// surface Sitemap: directives from robots.txt. Modern
-		// crawlers auto-discover sitemaps this way; this output lets operators
-		// see what `cosift crawl -sitemap <URL>` could seed from.
-		if sitemaps := r.Sitemaps(ctx, h); len(sitemaps) > 0 {
-			for _, sm := range sitemaps {
-				fmt.Printf("  Sitemap:   %s\n", sm)
-			}
-		}
-	}
-	fmt.Println()
-	for _, u := range urls {
-		allowed, crawlDelay, err := r.Allowed(ctx, u)
-		if err != nil {
-			fmt.Printf("[ERR ]  %s — %v\n", u, err)
-			continue
-		}
-		mark := "[OK  ]"
-		if !allowed {
-			mark = "[DENY]"
-		}
-		extra := ""
-		if crawlDelay > 0 {
-			extra = fmt.Sprintf("  crawl-delay=%s", crawlDelay)
-		}
-		fmt.Printf("%s  %s%s\n", mark, u, extra)
-	}
-	return nil
-}
-
-// uniqueHosts extracts the scheme+host part from each URL, deduped + in order.
-// Used by check-robots to probe each host's robots.txt exactly once.
-func uniqueHosts(urls []string) []string {
-	seen := make(map[string]bool)
-	out := []string{}
-	for _, raw := range urls {
-		u, err := url.Parse(raw)
-		if err != nil || u.Host == "" {
-			continue
-		}
-		key := u.Scheme + "://" + u.Host
-		if !seen[key] {
-			seen[key] = true
-			out = append(out, key)
-		}
-	}
-	return out
-}
-
-// runCrawlErrors lists recently-errored frontier URLs with their failure reason.
-// operator diagnostic for "why are 142 URLs in error state?" without
-// requiring SQLite shell access. Pure read-only; no side effects on the index.
-//
-// The error column is's addition to the frontier schema; pre
-// errored URLs will have an empty reason.
-func runCrawlErrors(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("crawl-errors", flag.ExitOnError)
-	limit := fs.Int("limit", 50, "max number of errored URLs to list (most recent first)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return fmt.Errorf("open store: %w", err)
-	}
-	defer s.Close()
-
-	errs, err := s.ListErroredFrontier(ctx, *limit)
-	if err != nil {
-		return fmt.Errorf("list errored: %w", err)
-	}
-	if len(errs) == 0 {
-		fmt.Println("no errored frontier entries.")
-		return nil
-	}
-	fmt.Printf("%d errored frontier entries (most recent first):\n", len(errs))
-	fmt.Println()
-	for _, e := range errs {
-		reason := e.LastError
-		if reason == "" {
-			reason = "(no reason recorded — entry predates)"
-		}
-		fmt.Printf("  attempts=%d  %s\n    → %s\n", e.Attempts, e.URL, reason)
-	}
-	return nil
-}
-
-func runDoctor(ctx context.Context, cfg *config.Config, args []string) error {
-	// When -server is empty, doctor stays
-	// purely local. When -server is set, doctor also pings
-	// the server's /healthz and /stats; if -token is also set (or env), it
-	// validates the token by hitting /admin/config.
-	fs := flag.NewFlagSet("doctor", flag.ExitOnError)
-	remoteServer := fs.String("server", "", "remote cosift URL to additionally probe (empty = local checks only)")
-	remoteToken := fs.String("token", "", "admin bearer token for -server admin-endpoint check (defaults to COSIFT_ADMIN_TOKEN env)")
-	// Same checks, same
-	// non-zero exit on FAIL, just JSON instead of '[PASS] name — detail'.
-	asJSON := fs.Bool("json", false, "emit JSON instead of human-readable text (suitable for jq / CI)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	var checks []doctorCheck
-	add := func(name, status, detail string) { checks = append(checks, doctorCheck{name, status, detail}) }
-
-	// 1. Data dir writable.
-	probe := filepath.Join(cfg.DataDir, ".doctor.probe")
-	// Match store.Open's 0o700 — MkdirAll's perm only applies to NEW dirs,
-	// but doctor running first must not silently leave a looser mode behind.
-	if err := os.MkdirAll(cfg.DataDir, 0o700); err != nil {
-		add("data_dir writable", "FAIL", fmt.Sprintf("mkdir %s: %v", cfg.DataDir, err))
-	} else if err := os.WriteFile(probe, []byte("ok"), 0o600); err != nil {
-		add("data_dir writable", "FAIL", fmt.Sprintf("write %s: %v", probe, err))
-	} else {
-		_ = os.Remove(probe)
-		add("data_dir writable", "PASS", cfg.DataDir)
-	}
-
-	// 2. SQLite open + schema migrated.
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		add("sqlite open + schema", "FAIL", err.Error())
-	} else {
-		st, _ := s.Stats(ctx)
-		_ = s.Close()
-		add("sqlite open + schema", "PASS", fmt.Sprintf("%d docs, %d terms", st.Documents, st.Terms))
-	}
-
-	// 2b. Pebble open + counters. Pebble is optional; "absent" is
-	// not a failure, just a SKIP. When present, verify open + read counters.
-	// the open can fail because pebble-serve / a crawl holds the
-	// single-writer lock — that's a healthy state, not a FAIL. Distinguish
-	// the lock error from real corruption.
-	pebbleDir := filepath.Join(cfg.DataDir, "pebble")
-	if _, statErr := os.Stat(pebbleDir); statErr != nil {
-		add("pebble store", "SKIP", "no pebble dir (sqlite-only deployment)")
-	} else if ps, err := store.OpenPebble(pebbleDir); err != nil {
-		msg := err.Error()
-		if strings.Contains(msg, "lock") || strings.Contains(msg, "resource temporarily unavailable") {
-			add("pebble store", "INFO", "another process holds the writer lock (pebble-serve / crawl in flight)")
-		} else {
-			add("pebble store", "FAIL", msg)
-		}
-	} else {
-		_, n, _ := ps.CorpusStats(ctx)
-		// also report HNSW availability so operators can tell from
-		// `cosift doctor` whether dense / hybrid retrievers will work without
-		// firing pebble-info or pebble-serve /stats. Cheap — same 20-byte
-		// meta blob read pebble-info already does.
-		meta, hnswOK, _ := index.LoadHNSWMeta(ctx, ps)
-		_ = ps.Close()
-		add("pebble store", "PASS", fmt.Sprintf("%d indexed docs", n))
-		if hnswOK {
-			add("HNSW graph", "PASS", fmt.Sprintf("%d nodes, dim=%d — dense/hybrid available (load with COSIFT_LOAD_HNSW=true)", meta.NodeCount, meta.Dim))
-		} else {
-			add("HNSW graph", "INFO", "no vectors persisted — only bm25 / bm25-mlt retrievers (set cfg.Embeddings.Model and re-crawl to add dense)")
-		}
-	}
-
-	// 2c. COSIFT_* env vars. Lists which path-2 env overrides are
-	// set so operators can confirm 'is my override actually live'. Silent
-	// typos previously hid behind 'env unset → keep default' branches.
-	cosiftEnvs := []string{
-		"COSIFT_PEBBLE_CACHE_MB", "COSIFT_PEBBLE_MEMTABLE_MB", "COSIFT_PEBBLE_MEMTABLES", "COSIFT_PEBBLE_SYNC",
-		"COSIFT_BM25_K1", "COSIFT_BM25_B",
-		"COSIFT_HYDE_CACHE_SIZE", "COSIFT_PARA_CACHE_SIZE",
-		"COSIFT_LOAD_HNSW", //
-	}
-	var setEnvs []string
-	for _, name := range cosiftEnvs {
-		if v := os.Getenv(name); v != "" {
-			setEnvs = append(setEnvs, name+"="+v)
-		}
-	}
-	if len(setEnvs) == 0 {
-		add("COSIFT_* env", "INFO", "no path-2 overrides set (using defaults)")
-	} else {
-		add("COSIFT_* env", "INFO", strings.Join(setEnvs, ", "))
-	}
-
-	// 3. Config recognized.
-	add("config", "PASS", fmt.Sprintf("addr=%s, data_dir=%s", cfg.Server.Addr, cfg.DataDir))
-
-	// 4. API key env (warn — actually pinging is `cosift eval` territory).
-	// a custom embedder/chat URL (Ollama / vLLM / TEI) doesn't
-	// need a key; PASS when URL is set even without a key. Hosted defaults
-	// (empty URL) still require a key for the configured capability.
-	embedKey := resolveEmbedAPIKey()
-	chatKey := os.Getenv("OPENAI_API_KEY")
-	if chatKey == "" {
-		chatKey = os.Getenv("OPENAI")
-	}
-	embedConfigured := cfg.Embeddings.Model != ""
-	chatConfigured := cfg.Chat.Model != ""
-	embedLocal := cfg.Embeddings.URL != ""
-	chatLocal := cfg.Chat.URL != ""
-	switch {
-	case !embedConfigured && !chatConfigured:
-		add("embed/chat auth", "INFO", "no embed/chat models configured (fine for bm25-only)")
-	case (embedConfigured && (embedKey != "" || embedLocal)) && (!chatConfigured || chatKey != "" || chatLocal):
-		add("embed/chat auth", "PASS", fmt.Sprintf("embed=%s chat=%s", authStatus(embedConfigured, embedKey, embedLocal), authStatus(chatConfigured, chatKey, chatLocal)))
-	default:
-		var missing []string
-		if embedConfigured && embedKey == "" && !embedLocal {
-			missing = append(missing, "embed (no URL, no key)")
-		}
-		if chatConfigured && chatKey == "" && !chatLocal {
-			missing = append(missing, "chat (no URL, no key)")
-		}
-		add("embed/chat auth", "WARN", strings.Join(missing, ", ")+" — set COSIFT_EMBED_API_KEY / OPENAI_API_KEY, or point Embeddings.URL / Chat.URL at a local server")
-	}
-
-	// 5. Eval fixtures.
-	corpusPath := "testdata/eval/corpus.json"
-	queriesPath := "testdata/eval/queries.json"
-	if _, err := os.Stat(corpusPath); err != nil {
-		add("eval fixtures", "WARN", "testdata/eval/corpus.json missing (eval won't run)")
-	} else if _, err := os.Stat(queriesPath); err != nil {
-		add("eval fixtures", "WARN", "testdata/eval/queries.json missing")
-	} else {
-		add("eval fixtures", "PASS", "corpus.json + queries.json present")
-	}
-
-	// 6. Admin token configured if /admin/* is to be used.
-	if cfg.Server.AdminToken != "" {
-		add("admin_token", "PASS", "set (length redacted)")
-	} else {
-		add("admin_token", "WARN", "unset — /admin/* will return 403")
-	}
-
-	// 7. Defaults vs capabilities. The defaults block lets operators
-	// pre-configure retrieval behavior, but a default that requires capability
-	// the server isn't configured for (e.g. retriever=hybrid without an
-	// embedder) will silently fail at request time — 400 on every call. Catch
-	// the mismatch HERE instead of at first traffic.
-	hasEmbed := cfg.Embeddings.Model != "" || os.Getenv("OPENAI_API_KEY") != "" || os.Getenv("OPENAI") != ""
-	hasChat := cfg.Chat.Model != "" || os.Getenv("OPENAI_API_KEY") != "" || os.Getenv("OPENAI") != ""
-	checks = append(checks, doctorDefaultsChecks(cfg.Defaults, hasEmbed, hasChat)...)
-
-	// 8. Remote checks — only when -server is set. Token resolution
-	// mirrors admin CLIs: -token flag wins, then env.
-	if *remoteServer != "" {
-		resolvedToken := *remoteToken
-		if resolvedToken == "" {
-			resolvedToken = os.Getenv("COSIFT_ADMIN_TOKEN")
-		}
-		checks = append(checks, doctorRemoteChecks(ctx, *remoteServer, resolvedToken)...)
-	}
-
-	fail := 0
-	for _, c := range checks {
-		if c.Status == "FAIL" {
-			fail++
-		}
-	}
-	if *asJSON {
-		out := map[string]any{
-			"checks": checks,
-			"fail":   fail,
-			"ready":  fail == 0,
-		}
-		blob, _ := json.MarshalIndent(out, "", "  ")
-		fmt.Println(string(blob))
-		if fail > 0 {
-			return errors.New("doctor failures")
-		}
-		return nil
-	}
-	for _, c := range checks {
-		fmt.Printf("%-6s %s — %s\n", "["+c.Status+"]", c.Name, c.Detail)
-	}
-	fmt.Println()
-	if fail > 0 {
-		fmt.Printf("%d FAIL — fix the issues above before running `cosift serve`\n", fail)
-		return errors.New("doctor failures")
-	}
-	fmt.Println("ready.")
-	return nil
-}
-
-// doctorRemoteChecks probes a remote cosift server: /healthz reachable, /stats
-// returns a sensible shape, and (when token non-empty) /admin/config validates
-// the bearer token. Returns a slice of doctorCheck rows for the main runDoctor
-// loop to render.
-func doctorRemoteChecks(ctx context.Context, serverURL, token string) []doctorCheck {
-	var out []doctorCheck
-	base := strings.TrimRight(strings.Replace(serverURL, "0.0.0.0", "127.0.0.1", 1), "/")
-	client := &http.Client{Timeout: 10 * time.Second}
-
-	// /healthz
-	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, base+"/healthz", http.NoBody)
-	resp, err := client.Do(req)
-	if err != nil {
-		out = append(out, doctorCheck{"remote /healthz", "FAIL", fmt.Sprintf("%s: %v", serverURL, err)})
-		// If /healthz is unreachable, downstream checks will all fail too —
-		// emit one row and skip the cascade.
-		return out
-	}
-	resp.Body.Close()
-	if resp.StatusCode == http.StatusOK {
-		out = append(out, doctorCheck{"remote /healthz", "PASS", base})
-	} else {
-		out = append(out, doctorCheck{"remote /healthz", "FAIL", fmt.Sprintf("%s returned %d", base, resp.StatusCode)})
-	}
-
-	// /stats
-	req, _ = http.NewRequestWithContext(ctx, http.MethodGet, base+"/stats", http.NoBody)
-	resp, err = client.Do(req)
-	if err != nil {
-		out = append(out, doctorCheck{"remote /stats", "FAIL", err.Error()})
-	} else {
-		defer resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			out = append(out, doctorCheck{"remote /stats", "FAIL", fmt.Sprintf("returned %d", resp.StatusCode)})
-		} else {
-			var st server.StatsResponse
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
-			if err := json.Unmarshal(body, &st); err != nil {
-				out = append(out, doctorCheck{"remote /stats", "WARN", fmt.Sprintf("decode: %v", err)})
-			} else {
-				out = append(out, doctorCheck{"remote /stats", "PASS", fmt.Sprintf("%d docs", st.Documents)})
-			}
-		}
-	}
-
-	// /admin/config — only when token is provided. No token → skip silently
-	// (not a failure; operator may not have admin auth enabled).
-	if token != "" {
-		req, _ = http.NewRequestWithContext(ctx, http.MethodGet, base+"/admin/config", http.NoBody)
-		req.Header.Set("Authorization", "Bearer "+token)
-		resp, err = client.Do(req)
-		if err != nil {
-			out = append(out, doctorCheck{"remote admin token", "FAIL", err.Error()})
-			return out
-		}
-		defer resp.Body.Close()
-		switch resp.StatusCode {
-		case http.StatusOK:
-			out = append(out, doctorCheck{"remote admin token", "PASS", "/admin/config accepted the token"})
-		case http.StatusUnauthorized, http.StatusForbidden:
-			out = append(out, doctorCheck{"remote admin token", "FAIL", fmt.Sprintf("token rejected (HTTP %d)", resp.StatusCode)})
-		default:
-			out = append(out, doctorCheck{"remote admin token", "WARN", fmt.Sprintf("unexpected status %d", resp.StatusCode)})
-		}
-	}
-	return out
-}
-
-// runReembed walks every document, chunks it, embeds the chunks with the
-// configured model, and writes them as new passages. The new rows coexist with
-// the old (different model_id) until `-drop-old` is passed.
-//
-// Recommended sequence:
-//
-//	cosift reembed                       # write new passages alongside old
-//	# verify search quality on new model …
-//	cosift reembed -drop-old             # drop the others
-//
-// Or just `cosift reembed -drop-old` if you're confident.
-func runReembed(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("reembed", flag.ExitOnError)
-	dropOld := fs.Bool("drop-old", false, "after re-embed, delete passages with a different model_id")
-	batchSize := fs.Int("batch", 256, "embeddings per API call (provider-dependent cap)")
-	// time-based progress reporting (shared helper from).
-	progressInterval := fs.Duration("progress", 5*time.Second, "log re-embed progress every N (0 disables)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if cfg.Embeddings.Model == "" {
-		return errors.New("reembed: cfg.Embeddings.Model must be set")
-	}
-	apiKey := os.Getenv("OPENAI_API_KEY")
-	if apiKey == "" {
-		apiKey = os.Getenv("OPENAI")
-	}
-	if apiKey == "" {
-		return errors.New("reembed: no OPENAI key in env")
-	}
-	dim := cfg.Embeddings.Dim
-	if dim == 0 {
-		dim = 1536
-	}
-	emb := embed.NewOpenAIClient(apiKey, cfg.Embeddings.URL, cfg.Embeddings.Model, dim)
-
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	docs, err := s.ListDocuments(ctx, 0)
-	if err != nil {
-		return err
-	}
-	if len(docs) == 0 {
-		log.Printf("reembed: 0 docs in store — nothing to do")
-		return nil
-	}
-
-	// Pre-existing models (informational; useful for the operator).
-	models, _ := s.PassageModels(ctx)
-	log.Printf("reembed: %d docs · target model=%s · existing models=%v · batch=%d",
-		len(docs), cfg.Embeddings.Model, models, *batchSize)
-
-	chunker := chunkerWith(cfg.Crawler.ChunkSize, cfg.Crawler.ChunkOverlap)
-	type ref struct {
-		docID int64
-		chunk index.Chunk
-	}
-	var (
-		texts   []string
-		refs    []ref
-		total   int
-		flush   func() error
-		written int
-	)
-	flush = func() error {
-		if len(texts) == 0 {
-			return nil
-		}
-		vecs, err := emb.Embed(ctx, texts)
-		if err != nil {
-			return fmt.Errorf("embed batch (%d texts): %w", len(texts), err)
-		}
-		if len(vecs) != len(texts) {
-			return fmt.Errorf("embed count mismatch: %d vs %d", len(vecs), len(texts))
-		}
-		for i, v := range vecs {
-			if err := s.UpsertPassage(ctx, &store.Passage{
-				DocID:     refs[i].docID,
-				Offset:    refs[i].chunk.Offset,
-				Length:    refs[i].chunk.Length,
-				Model:     emb.Model(),
-				Embedding: v,
-			}); err != nil {
-				return fmt.Errorf("write passage: %w", err)
-			}
-			written++
-		}
-		texts = texts[:0]
-		refs = refs[:0]
-		return nil
-	}
-
-	docProgress := newProgressReporter("reembed docs", len(docs), *progressInterval)
-	for docIdx, d := range docs {
-		for _, c := range chunker.Chunk(d.Title + "\n\n" + d.Text) {
-			texts = append(texts, c.Text)
-			refs = append(refs, ref{docID: d.ID, chunk: c})
-			total++
-			if len(texts) >= *batchSize {
-				if err := flush(); err != nil {
-					return err
-				}
-			}
-		}
-		docProgress.maybeLog(docIdx + 1)
-	}
-	if err := flush(); err != nil {
-		return err
-	}
-	log.Printf("reembed: wrote %d passages with model=%s", written, cfg.Embeddings.Model)
-
-	if *dropOld {
-		n, err := s.DropPassagesNotModel(ctx, cfg.Embeddings.Model)
-		if err != nil {
-			return fmt.Errorf("drop old: %w", err)
-		}
-		log.Printf("reembed: dropped %d passages from other models", n)
-	} else if len(models) > 0 && !contains(models, cfg.Embeddings.Model) {
-		log.Printf("reembed: %d other-model passages remain — run with -drop-old to remove", len(models))
-	}
-	return nil
-}
-
-func contains(ss []string, x string) bool {
-	for _, s := range ss {
-		if s == x {
-			return true
-		}
-	}
-	return false
-}
-
-// runCompactIndex drops orphaned passages and terms, then VACUUMs.
-// Companion to `cosift gc` — gc cleans the frontier; compact-index cleans
-// the index proper.
-func runCompactIndex(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("compact-index", flag.ExitOnError)
-	vacuum := fs.Bool("vacuum", true, "run VACUUM after deletes to reclaim disk")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	dropped, err := s.DropOrphanedPassages(ctx)
-	if err != nil {
-		return fmt.Errorf("drop orphan passages: %w", err)
-	}
-	log.Printf("compact-index: dropped %d orphan passages", dropped)
-
-	terms, err := s.DropOrphanedTerms(ctx)
-	if err != nil {
-		return fmt.Errorf("drop orphan terms: %w", err)
-	}
-	log.Printf("compact-index: dropped %d orphan terms", terms)
-
-	if *vacuum {
-		log.Printf("compact-index: vacuuming...")
-		if err := s.Vacuum(ctx); err != nil {
-			return fmt.Errorf("vacuum: %w", err)
-		}
-		log.Printf("compact-index: vacuum complete")
-	}
-	return nil
-}
-
-// batchEmbed chunks a large text slice into provider-safe batches before
-// calling the embedder. OpenAI's text-embedding-3-* caps at 2048 inputs OR
-// 300k tokens per request; 1000 is a safe default that respects both at
-// our typical chunk sizes. Returns vectors in the input order.
-//
-// Between batches we sleep 200ms — keeps multi-batch runs under OpenAI's
-// 1M-TPM org limit for text-embedding-3-small, which hit at ~50k inputs.
-// Provider rate-limit errors get one bounded retry with the suggested delay.
-func batchEmbed(ctx context.Context, e embed.Embedder, texts []string, batchSize int) ([][]float32, error) {
-	if batchSize <= 0 {
-		batchSize = 256
-	}
-	// 1000 is the published OpenAI per-call cap, but large-dim models
-	// (text-embedding-3-large @ 3072) return malformed JSON well before that
-	// in practice. 256 is safe across the model lineup.
-	if batchSize > 1000 {
-		batchSize = 1000
-	}
-	if len(texts) <= batchSize {
-		return e.Embed(ctx, texts)
-	}
-	out := make([][]float32, 0, len(texts))
-	for i := 0; i < len(texts); i += batchSize {
-		end := i + batchSize
-		if end > len(texts) {
-			end = len(texts)
-		}
-		vecs, err := embedWithRetry(ctx, e, texts[i:end])
-		if err != nil {
-			return nil, fmt.Errorf("batch %d-%d: %w", i, end, err)
-		}
-		if len(vecs) != end-i {
-			return nil, fmt.Errorf("batch %d-%d: %d returned, expected %d", i, end, len(vecs), end-i)
-		}
-		out = append(out, vecs...)
-		if end < len(texts) {
-			select {
-			case <-ctx.Done():
-				return out, ctx.Err()
-			case <-time.After(200 * time.Millisecond):
-			}
-		}
-	}
-	return out, nil
-}
-
-// embedWithRetry retries once on rate-limit errors with a fixed backoff.
-// Crude but effective at our scale — keeps full distractor runs from failing
-// when a single batch slips past the TPM bucket. Production deployments with
-// higher request volumes want exponential backoff + provider-supplied delay
-// parsing; deferred until traffic warrants.
-func embedWithRetry(ctx context.Context, e embed.Embedder, texts []string) ([][]float32, error) {
-	vecs, err := e.Embed(ctx, texts)
-	if err == nil {
-		return vecs, nil
-	}
-	msg := err.Error()
-	if !strings.Contains(msg, "rate_limit") && !strings.Contains(msg, "429") {
-		return nil, err
-	}
-	select {
-	case <-ctx.Done():
-		return nil, ctx.Err()
-	case <-time.After(2 * time.Second):
-	}
-	return e.Embed(ctx, texts)
-}
-
-// paraphraseRetriever wraps any Retriever with on-the-fly query expansion via
-// a chat client. For each search, asks the LLM for N paraphrases, runs all of
-// them through the inner retriever, RRF-fuses the result lists.
-//
-// measured that hand-written paraphrases recover 0.02 nDCG at 10k
-// distractors. This is the auto-generated version — removes the hand-writing
-// requirement and makes the prescription deployable. Per-query overhead:
-// one extra chat call (~$0.0001 at gpt-4o-mini) + N extra inner-retriever calls.
-//
-// In-memory cache by exact query text — eval re-runs hit it; production /search
-// calls don't (different process). For production, the cache would move into
-// the SQLite store or a small Redis-shaped layer.
-type paraphraseRetriever struct {
-	inner      eval.Retriever
-	chat       embed.ChatClient
-	n          int
-	mainWeight float64 // 0 = equal-weight RRF (pre); >0 = main query gets this weight, paraphrases each 1.0
-	cache      map[string][]string
-	mu         sync.Mutex
-}
-
-const paraphraseSystem = `Generate paraphrases of a search query. Each paraphrase preserves the semantic intent but uses different vocabulary — different keywords that a target document might also use. Output ONLY a JSON array of strings.
-Example output for "go programming language": ["golang concurrent compiled language", "Google's systems programming language with goroutines"]`
-
-func (p *paraphraseRetriever) generateParaphrases(ctx context.Context, q string) []string {
-	p.mu.Lock()
-	if cached, ok := p.cache[q]; ok {
-		p.mu.Unlock()
-		return cached
-	}
-	p.mu.Unlock()
-
-	resp, err := p.chat.Chat(ctx, []embed.ChatMsg{
-		{Role: "system", Content: paraphraseSystem},
-		{Role: "user", Content: fmt.Sprintf("Generate %d paraphrases of: %s", p.n, q)},
-	})
-	if err != nil {
-		return nil
-	}
-	// Same robust JSON-array parsing as the research planner.
-	raw := strings.TrimSpace(resp)
-	for _, fence := range []string{"```json", "```"} {
-		raw = strings.TrimPrefix(raw, fence)
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	raw = strings.TrimSpace(raw)
-	start := strings.Index(raw, "[")
-	end := strings.LastIndex(raw, "]")
-	if start < 0 || end <= start {
-		return nil
-	}
-	var arr []string
-	if err := json.Unmarshal([]byte(raw[start:end+1]), &arr); err != nil {
-		return nil
-	}
-	if len(arr) > p.n {
-		arr = arr[:p.n]
-	}
-	p.mu.Lock()
-	p.cache[q] = arr
-	p.mu.Unlock()
-	return arr
-}
-
-func (p *paraphraseRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
-	main, err := p.inner.Search(ctx, q, k)
-	if err != nil {
-		return nil, err
-	}
-	paras := p.generateParaphrases(ctx, q)
-	if len(paras) == 0 {
-		return main, nil
-	}
-	lists := make([][]string, 0, 1+len(paras))
-	lists = append(lists, main)
-	for _, p2 := range paras {
-		extra, err := p.inner.Search(ctx, p2, k)
-		if err != nil {
-			continue
-		}
-		lists = append(lists, extra)
-	}
-	// Matches the server expand
-	// path's behavior so eval-time measurements use the same fusion
-	// math as production.
-	var weights []float64
-	if p.mainWeight > 0 {
-		weights = make([]float64, len(lists))
-		weights[0] = p.mainWeight
-		for i := 1; i < len(weights); i++ {
-			weights[i] = 1.0
-		}
-	}
-	return index.RRFWeighted(lists, weights, k, 60), nil
-}
-
-// plannerRetriever wraps any Retriever with the /research planner's
-// decomposition step: ask the LLM for 2-3 focused sub-queries, run each through
-// the inner retriever, RRF-fuse the results. Mirrors /research minus the synth.
-//
-// This exists so we can measure whether the planner's decomposition
-// already subsumes paraphrase expansion — that claim was asserted in
-// when we chose not to add ?expand=true to /research, but never measured.
-const plannerSystemPrompt = `Decompose the user's research question into 2-3 focused sub-queries that, taken together, would cover the answer. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["sub-query 1", "sub-query 2"]`
-
-type plannerRetriever struct {
-	inner      eval.Retriever
-	chat       embed.ChatClient
-	mainWeight float64 // 0 = equal-weight RRF; >0 = main query gets this weight, sub-queries each 1.0
-	cache      map[string][]string
-	mu         sync.Mutex
-}
-
-func (p *plannerRetriever) plan(ctx context.Context, q string) []string {
-	p.mu.Lock()
-	if cached, ok := p.cache[q]; ok {
-		p.mu.Unlock()
-		return cached
-	}
-	p.mu.Unlock()
-
-	resp, err := p.chat.Chat(ctx, []embed.ChatMsg{
-		{Role: "system", Content: plannerSystemPrompt},
-		{Role: "user", Content: q},
-	})
-	if err != nil {
-		return nil
-	}
-	raw := strings.TrimSpace(resp)
-	for _, fence := range []string{"```json", "```"} {
-		raw = strings.TrimPrefix(raw, fence)
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	raw = strings.TrimSpace(raw)
-	start := strings.Index(raw, "[")
-	end := strings.LastIndex(raw, "]")
-	if start < 0 || end <= start {
-		return nil
-	}
-	var arr []string
-	if err := json.Unmarshal([]byte(raw[start:end+1]), &arr); err != nil {
-		return nil
-	}
-	if len(arr) > 5 {
-		arr = arr[:5] // hard cap matches /research planner
-	}
-	p.mu.Lock()
-	p.cache[q] = arr
-	p.mu.Unlock()
-	return arr
-}
-
-func (p *plannerRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
-	main, err := p.inner.Search(ctx, q, k)
-	if err != nil {
-		return nil, err
-	}
-	subs := p.plan(ctx, q)
-	if len(subs) == 0 {
-		return main, nil
-	}
-	lists := make([][]string, 0, 1+len(subs))
-	lists = append(lists, main)
-	for _, sq := range subs {
-		extra, err := p.inner.Search(ctx, sq, k)
-		if err != nil {
-			continue
-		}
-		lists = append(lists, extra)
-	}
-	// Same shape as
-	// paraphraseRetriever; main query gets mainWeight, sub-queries each 1.0.
-	var weights []float64
-	if p.mainWeight > 0 {
-		weights = make([]float64, len(lists))
-		weights[0] = p.mainWeight
-		for i := 1; i < len(weights); i++ {
-			weights[i] = 1.0
-		}
-	}
-	return index.RRFWeighted(lists, weights, k, 60), nil
-}
-
-// httpAPIRetriever queries a deployed cosift's /search endpoint and adapts the
-// JSON response to eval.Retriever. Lets `cosift eval -api <url>` validate a
-// remote deployment with the same metric harness used for local development.
-type httpAPIRetriever struct {
-	baseURL   string
-	bearer    string
-	retriever string
-	rerank    bool
-	http      *http.Client
-}
-
-func (r *httpAPIRetriever) Search(ctx context.Context, q string, k int) ([]string, error) {
-	v := url.Values{}
-	v.Set("q", q)
-	v.Set("k", strconv.Itoa(k))
-	if r.retriever != "" {
-		v.Set("retriever", r.retriever)
-	}
-	if r.rerank {
-		v.Set("rerank", "true")
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, r.baseURL+"/search?"+v.Encode(), http.NoBody)
-	if err != nil {
-		return nil, err
-	}
-	if r.bearer != "" {
-		req.Header.Set("Authorization", "Bearer "+r.bearer)
-	}
-	resp, err := r.http.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
-		return nil, fmt.Errorf("api %d: %s", resp.StatusCode, body)
-	}
-	var sr struct {
-		Hits []struct {
-			URL string `json:"url"`
-		} `json:"hits"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&sr); err != nil {
-		return nil, fmt.Errorf("decode: %w", err)
-	}
-	urls := make([]string, len(sr.Hits))
-	for i, h := range sr.Hits {
-		urls[i] = h.URL
-	}
-	return urls, nil
-}
-
-// neutralVocabForDistractors returns words that don't appear in the eval queries
-// or relevant docs, so any distractor returning in top-K is unambiguous noise.
-// Picked from common-but-eval-disjoint domains (pottery, lighthouses, knitting,
-// dentistry, beekeeping, etc.).
-func neutralVocabForDistractors() []string {
-	return []string{
-		"kiln", "pottery", "glaze", "ceramic", "wheel", "stoneware", "earthenware",
-		"lighthouse", "beacon", "keeper", "lantern", "rocky", "shoal", "fog",
-		"yarn", "knit", "purl", "stitch", "skein", "needle", "cable",
-		"dentistry", "molar", "incisor", "filling", "enamel", "gingival",
-		"beekeeping", "hive", "queen", "drone", "wax", "pollen", "swarm",
-		"bookbinding", "spine", "endpaper", "cloth", "headband", "signature",
-		"masonry", "mortar", "trowel", "course", "wythe", "lintel", "soffit",
-		"falconry", "raptor", "perch", "lure", "jess", "creance", "mews",
-		"weaving", "warp", "weft", "shuttle", "heddle", "treadle", "selvedge",
-		"smithing", "forge", "anvil", "tongs", "quench", "temper", "billet",
-		"glassblowing", "punty", "marver", "blowpipe", "annealing", "cane",
-		"watchmaking", "balance", "escapement", "mainspring", "barrel", "jewel",
-		"taxidermy", "tan", "mount", "armature", "habitat", "diorama",
-		"calligraphy", "nib", "ink", "stroke", "kerning", "ascender", "descender",
-		"thatching", "reed", "spar", "ridge", "rafter", "eaves",
-	}
-}
-
-// generateDistractorText assembles a short text out of the neutral vocab.
-func generateDistractorText(rng *rand.Rand, vocab []string, words int) string {
-	parts := make([]string, words)
-	for i := range parts {
-		parts[i] = vocab[rng.Intn(len(vocab))]
-	}
-	return strings.Join(parts, " ")
-}
-
-// runAnswerEval is's measurement of /research answer quality across
-// the two retrieval strategies (planner vs paraphrase). Iters 52-53 measured
-// *retrieval coverage* via nDCG and found paraphrase wins; added
-// ?strategy=paraphrase but kept planner as the default *because we hadn't
-// measured synthesis quality*. This subcommand fills that gap.
-//
-// Flow per query:
-//  1. Build an in-memory cosift HTTP server with corpus ingested, dense index
-//     built, chat + paraphraser configured.
-//  2. Call /research?strategy=planner and /research?strategy=paraphrase.
-//  3. Send (question, answer, sources) to a judge LLM with a different model.
-//  4. Parse two scores: coverage (1-5) and grounding (1-5). Comments are kept
-//     for the per-query report.
-//  5. Aggregate means per strategy and print a comparison table.
-//
-// Cost note: ~$0.005 per query at gpt-4o-mini synth + gpt-4o judge for the
-// 10 multi-faceted queries → roughly $0.10 total per run. Manageable but not
-// free; the -dry-run flag prints the plan without LLM calls.
-func runAnswerEval(ctx context.Context, args []string) error {
-	fs := flag.NewFlagSet("answer-eval", flag.ExitOnError)
-	corpusPath := fs.String("corpus", "testdata/eval/corpus.json", "corpus JSON")
-	queriesPath := fs.String("queries", "testdata/eval/queries-multifaceted.json", "queries JSON (multi-faceted by default — these stress synthesis the most)")
-	synthModel := fs.String("synth-model", "gpt-4o-mini", "chat model for /research synthesis + planner/paraphraser")
-	judgeModel := fs.String("judge-model", "gpt-4o", "chat model for the judge (use a different + stronger model than synth to avoid self-preference)")
-	savePath := fs.String("save", "", "save full per-query report as JSON")
-	embModel := fs.String("embed-model", "text-embedding-3-small", "embedding model name")
-	embDim := fs.Int("embed-dim", 1536, "embedding dimensionality")
-	embCacheDir := fs.String("embed-cache", "./eval-embed-cache", "embedding cache dir (set empty to disable)")
-	embURL := fs.String("embed-url", "", "embedding endpoint URL (leave empty for OpenAI default)")
-	chatURL := fs.String("chat-url", "", "chat endpoint URL for synth+judge models")
-	answerChunkSize := fs.Int("chunk-size", 0, "passage chunker target words (0 = default 320)")
-	answerChunkOverlap := fs.Int("chunk-overlap", 0, "passage chunker overlap words (0 = default 64)")
-	dryRun := fs.Bool("dry-run", false, "build the harness + print the plan, but issue NO LLM calls")
-	useRerank := fs.Bool("rerank", false, "wire the LLM listwise reranker into the in-process server; tests whether rerank cuts the grounding=1 cases on single-doc")
-	rerankModel := fs.String("rerank-model", "gpt-4o-mini", "chat model for the reranker (kept default = synth-model so cost stays predictable)")
-	synthK := fs.Int("synth-k", 0, "cap synth-source count via WithDefaults({ResearchSynthK: N}); 0 = preserve built-in default (10). tests whether K=5 trades coverage for grounding on single-doc workloads.")
-	serverURL := fs.String("server", "", "live server base URL (e.g. https://cosift.pilotprotocol.network); skips in-process build, corpus+embed flags ignored")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-
-	apiKey := os.Getenv("OPENAI_API_KEY")
-	if apiKey == "" {
-		apiKey = os.Getenv("OPENAI")
-	}
-	if apiKey == "" && *embURL == "" && *chatURL == "" && !*dryRun {
-		return errors.New("OPENAI_API_KEY (or OPENAI) not set; pass -embed-url/-chat-url for a local endpoint, or -dry-run to inspect")
-	}
-	if apiKey == "" {
-		apiKey = "local"
-	}
-
-	qs, err := eval.LoadQuerySet(*queriesPath)
-	if err != nil {
-		return fmt.Errorf("load queries: %w", err)
-	}
-
-	liveMode := *serverURL != ""
-	fmt.Printf("answer-eval: %d queries × 2 strategies × judge calls\n", len(qs.Queries))
-	if liveMode {
-		fmt.Printf("server = %s   judge model = %s   dry-run = %v\n", *serverURL, *judgeModel, *dryRun)
-	} else {
-		fmt.Printf("synth model = %s   judge model = %s   rerank = %v   synth_k = %d   dry-run = %v\n", *synthModel, *judgeModel, *useRerank, *synthK, *dryRun)
-	}
-	if *dryRun {
-		for _, q := range qs.Queries {
-			fmt.Printf("  - %s  (relevant: %d docs)\n", q.Text, len(q.Relevant))
-		}
-		return nil
-	}
-
-	// researchBaseURL is the base for /research calls — either live server or httptest.
-	var researchBaseURL string
-	judge := embed.NewOpenAIChat(apiKey, *chatURL, *judgeModel)
-
-	if liveMode {
-		researchBaseURL = strings.TrimRight(*serverURL, "/")
-	} else {
-		corpus, err := eval.LoadCorpus(*corpusPath)
-		if err != nil {
-			return fmt.Errorf("load corpus: %w", err)
-		}
-
-		// Build an ephemeral store + indexes (in-memory style, but SQLite needs a dir).
-		tmpDir := filepath.Join(os.TempDir(), fmt.Sprintf("cosift-answer-eval-%d", time.Now().UnixNano()))
-		st, err := store.Open(tmpDir)
-		if err != nil {
-			return err
-		}
-		defer func() {
-			st.Close()
-			_ = os.RemoveAll(tmpDir)
-		}()
-
-		bm := index.NewBM25(st)
-		oai := embed.NewOpenAIClient(apiKey, *embURL, *embModel, *embDim)
-		var emb embed.Embedder = oai
-		if *embCacheDir != "" {
-			emb = embed.NewCachedEmbedder(oai, *embCacheDir)
-		}
-		chunker := chunkerWith(*answerChunkSize, *answerChunkOverlap)
-		var allTexts []string
-		for _, d := range corpus.Docs {
-			id, err := st.UpsertDocument(ctx, &store.Document{
-				URL: d.URL, Title: d.Title, Text: d.Text, Source: "answer-eval", FetchedAt: time.Now(),
-			})
-			if err != nil {
-				return err
-			}
-			if err := bm.IndexDocument(ctx, id, d.Title, d.Text); err != nil {
-				return err
-			}
-			text := d.Title + "\n\n" + d.Text
-			for _, c := range chunker.Chunk(text) {
-				allTexts = append(allTexts, c.Text)
-			}
-		}
-		fmt.Printf("embedding %d passages across %d docs...\n", len(allTexts), len(corpus.Docs))
-		vecs, err := batchEmbed(ctx, emb, allTexts, 256)
-		if err != nil {
-			return fmt.Errorf("embed: %w", err)
-		}
-		vi := index.NewVectorIndex(*embDim)
-		idx := 0
-		for _, d := range corpus.Docs {
-			text := d.Title + "\n\n" + d.Text
-			for _, c := range chunker.Chunk(text) {
-				if idx >= len(vecs) {
-					break
-				}
-				vi.AddPassage(d.URL, d.Title, c.Offset, c.Length, vecs[idx])
-				idx++
-			}
-		}
-
-		chat := embed.NewOpenAIChat(apiKey, *chatURL, *synthModel)
-
-		srv := server.New(st).
-			WithVector(vi, emb).
-			WithChat(chat).
-			WithParaphraser(chat, 2).
-			WithLLMLimiter(0, 0) // disable rate limiter — this is an in-process eval, not a public endpoint. caught this when the 10/min default 429'd after 5 queries.
-		if *useRerank {
-			rerankChat := chat
-			if *rerankModel != *synthModel {
-				rerankChat = embed.NewOpenAIChat(apiKey, "", *rerankModel)
-			}
-			srv = srv.WithReranker(rerank.NewLLMReranker(rerankChat), 20)
-		}
-		if *synthK > 0 {
-			srv = srv.WithDefaults(server.Defaults{ResearchSynthK: *synthK})
-		}
-		httpSrv := httptest.NewServer(srv.Handler())
-		defer httpSrv.Close()
-		researchBaseURL = httpSrv.URL
-	}
-
-	type strategyReport struct {
-		Strategy     string   `json:"strategy"`
-		Answer       string   `json:"answer"`
-		SourceURLs   []string `json:"source_urls"`
-		Coverage     int      `json:"coverage"`
-		Grounding    int      `json:"grounding"`
-		JudgeComment string   `json:"judge_comment"`
-	}
-	type queryReport struct {
-		Query   string           `json:"query"`
-		Gold    []string         `json:"gold_relevant"`
-		Reports []strategyReport `json:"reports"`
-	}
-
-	all := make([]queryReport, 0, len(qs.Queries))
-	httpClient := &http.Client{Timeout: 120 * time.Second}
-
-	for qi, q := range qs.Queries {
-		fmt.Printf("\n[%d/%d] %s\n", qi+1, len(qs.Queries), q.Text)
-		qr := queryReport{Query: q.Text, Gold: q.Relevant}
-
-		for _, strategy := range []string{"planner", "paraphrase"} {
-			// /research call.
-			u := researchBaseURL + "/research?strategy=" + strategy + "&q=" + url.QueryEscape(q.Text)
-			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, http.NoBody)
-			resp, err := httpClient.Do(req)
-			if err != nil {
-				fmt.Printf("  %s: research call failed: %v\n", strategy, err)
-				continue
-			}
-			body, _ := io.ReadAll(resp.Body)
-			resp.Body.Close()
-			if resp.StatusCode != 200 {
-				fmt.Printf("  %s: research returned %d: %s\n", strategy, resp.StatusCode, string(body))
-				continue
-			}
-			var rr struct {
-				Query    string   `json:"query"`
-				Strategy string   `json:"strategy"`
-				Plan     []string `json:"plan"`
-				Answer   string   `json:"answer"`
-				Sources  []struct {
-					ID    int    `json:"id"`
-					URL   string `json:"url"`
-					Title string `json:"title"`
-				} `json:"sources"`
-			}
-			if err := json.Unmarshal(body, &rr); err != nil {
-				fmt.Printf("  %s: parse research: %v\n", strategy, err)
-				continue
-			}
-			sourceURLs := make([]string, len(rr.Sources))
-			for i, src := range rr.Sources {
-				sourceURLs[i] = src.URL
-			}
-			fmt.Printf("  %-10s answer=%dchars sources=%d  plan=%v\n", strategy, len(rr.Answer), len(rr.Sources), rr.Plan)
-
-			// Judge call.
-			score, err := judgeAnswer(ctx, judge, q.Text, rr.Answer, rr.Sources)
-			if err != nil {
-				fmt.Printf("    judge failed: %v\n", err)
-				continue
-			}
-			fmt.Printf("    judge: coverage=%d grounding=%d  — %s\n", score.Coverage, score.Grounding, score.Comment)
-			qr.Reports = append(qr.Reports, strategyReport{
-				Strategy:     strategy,
-				Answer:       rr.Answer,
-				SourceURLs:   sourceURLs,
-				Coverage:     score.Coverage,
-				Grounding:    score.Grounding,
-				JudgeComment: score.Comment,
-			})
-		}
-		all = append(all, qr)
-	}
-
-	// Aggregate. Exported field names matter — saved unexported agg
-	// fields which JSON-marshalled to `{}`. Now the summary in the saved JSON
-	// is actually inspectable by jq.
-	type strategySummary struct {
-		N             int     `json:"n"`
-		MeanCoverage  float64 `json:"mean_coverage"`
-		MeanGrounding float64 `json:"mean_grounding"`
-		Combined      float64 `json:"combined"`
-	}
-	rawAcc := map[string]struct{ cov, grd, n int }{"planner": {}, "paraphrase": {}}
-	for _, q := range all {
-		for _, sr := range q.Reports {
-			a, ok := rawAcc[sr.Strategy]
-			if !ok {
-				continue
-			}
-			a.cov += sr.Coverage
-			a.grd += sr.Grounding
-			a.n++
-			rawAcc[sr.Strategy] = a
-		}
-	}
-	summary := map[string]strategySummary{}
-	for _, name := range []string{"planner", "paraphrase"} {
-		a := rawAcc[name]
-		s := strategySummary{N: a.n}
-		if a.n > 0 {
-			s.MeanCoverage = float64(a.cov) / float64(a.n)
-			s.MeanGrounding = float64(a.grd) / float64(a.n)
-			s.Combined = s.MeanCoverage + s.MeanGrounding
-		}
-		summary[name] = s
-	}
-
-	fmt.Println("\n=== summary ===")
-	fmt.Printf("%-12s  N   mean coverage   mean grounding   combined\n", "strategy")
-	for _, name := range []string{"planner", "paraphrase"} {
-		s := summary[name]
-		if s.N == 0 {
-			fmt.Printf("%-12s  0   —                —                —\n", name)
-			continue
-		}
-		fmt.Printf("%-12s  %d   %.2f            %.2f             %.2f\n", name, s.N, s.MeanCoverage, s.MeanGrounding, s.Combined)
-	}
-
-	if *savePath != "" {
-		buf, _ := json.MarshalIndent(map[string]any{
-			"synth_model": *synthModel,
-			"judge_model": *judgeModel,
-			"queries":     *queriesPath,
-			"rerank":      *useRerank,
-			"synth_k":     *synthK,
-			"reports":     all,
-			"summary":     summary,
-			"when":        time.Now().UTC().Format(time.RFC3339),
-		}, "", "  ")
-		if err := os.WriteFile(*savePath, buf, 0o644); err != nil {
-			return fmt.Errorf("save report: %w", err)
-		}
-		fmt.Printf("\nsaved full report to %s\n", *savePath)
-	}
-	return nil
-}
-
-// judgeScore is what we parse out of the judge LLM's JSON response.
-type judgeScore struct {
-	Coverage  int    `json:"coverage"`
-	Grounding int    `json:"grounding"`
-	Comment   string `json:"comment"`
-}
-
-// judgeSystemPrompt was rewritten in after the trace revealed
-// the prior judge was evaluating the full source LIST relevance instead of the
-// CITED sources' accuracy. That bias deflated grounding scores in proportion
-// to how many tangential sources were in the list (paraphrase: 10, planner: 4-6).
-// The new prompt is explicit + the harness pre-filters sources to only those
-// the answer actually cites via [N].
-const judgeSystemPrompt = `You are an expert judge evaluating a research answer's quality. Score on TWO dimensions, each on a 1-5 integer scale:
-
-  - coverage: does the answer address every aspect of the question? (1 = misses major aspects, 5 = covers everything the question asked)
-  - grounding: do the sources the answer CITES via [N] actually support the claims those citations are attached to? (1 = cited sources don't support the claims they're attached to, 5 = every cited source genuinely supports the claim it appears next to)
-
-CRITICAL: Only consider sources the answer actually cites via [N]. Sources are listed by the IDs the answer used; uncited sources are not shown. Do not penalize the answer for not citing additional material.
-
-Output ONLY a single JSON object with this exact shape:
-{"coverage": <int 1-5>, "grounding": <int 1-5>, "comment": "<one sentence explaining the lower of the two scores>"}
-
-Do not output anything else — no preamble, no code fences, no markdown.`
-
-// citedSourceIDs extracts the integer ids referenced by [N] or [N,M,K] in the
-// answer text. fix for the judge-bias bug — we now pass only the
-// actually-cited sources to the judge, not the full source list.
-func citedSourceIDs(answer string) map[int]bool {
-	ids := make(map[int]bool)
-	// Match [1] or [1,2] or [1, 2, 3] inside square brackets.
-	for _, m := range citationRE.FindAllStringSubmatch(answer, -1) {
-		// m[1] is the contents inside the brackets.
-		for _, tok := range strings.Split(m[1], ",") {
-			n, err := strconv.Atoi(strings.TrimSpace(tok))
-			if err == nil {
-				ids[n] = true
-			}
-		}
-	}
-	return ids
-}
-
-var citationRE = regexp.MustCompile(`\[([0-9, ]+)\]`)
-
-// judgeAnswer asks the judge LLM to score a single (question, answer, sources)
-// triple. pre-filters sources to only those cited in the answer, so
-// the judge can't be confused by uncited tangential material in the list.
-// Returns a judgeScore or an error.
-func judgeAnswer(ctx context.Context, judge embed.ChatClient, question, answer string, sources []struct {
-	ID    int    `json:"id"`
-	URL   string `json:"url"`
-	Title string `json:"title"`
-}) (judgeScore, error) {
-	cited := citedSourceIDs(answer)
-	var sb strings.Builder
-	for _, src := range sources {
-		if !cited[src.ID] {
-			continue // skip uncited sources — judge only evaluates citation accuracy
-		}
-		fmt.Fprintf(&sb, "[%d] %s (%s)\n", src.ID, src.Title, src.URL)
-	}
-	citedBlock := sb.String()
-	if citedBlock == "" {
-		citedBlock = "(the answer did not cite any sources via [N])\n"
-	}
-	userMsg := fmt.Sprintf("Question: %s\n\nSources actually cited by the answer:\n%s\nAnswer:\n%s\n\nScore this answer.", question, citedBlock, answer)
-	raw, err := judge.Chat(ctx, []embed.ChatMsg{
-		{Role: "system", Content: judgeSystemPrompt},
-		{Role: "user", Content: userMsg},
-	})
-	if err != nil {
-		return judgeScore{}, fmt.Errorf("judge call: %w", err)
-	}
-	raw = strings.TrimSpace(raw)
-	for _, fence := range []string{"```json", "```"} {
-		raw = strings.TrimPrefix(raw, fence)
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	raw = strings.TrimSpace(raw)
-	startIdx := strings.Index(raw, "{")
-	endIdx := strings.LastIndex(raw, "}")
-	if startIdx < 0 || endIdx <= startIdx {
-		return judgeScore{}, fmt.Errorf("judge: no JSON object in response: %q", raw)
-	}
-	var sc judgeScore
-	if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &sc); err != nil {
-		return judgeScore{}, fmt.Errorf("judge: parse JSON: %w (raw=%q)", err, raw)
-	}
-	if sc.Coverage < 1 || sc.Coverage > 5 || sc.Grounding < 1 || sc.Grounding > 5 {
-		return judgeScore{}, fmt.Errorf("judge: scores out of 1-5 range: %+v", sc)
-	}
-	return sc, nil
-}
-
-// savedAnswerEvalReport mirrors the structure runAnswerEval writes. Used by
-// runAnswerEvalCompare to load and diff two prior reports without re-running
-// the eval. The shape is the same map[string]any savedJSON shape; this struct
-// carries only the fields we need for comparison.
-type savedAnswerEvalReport struct {
-	SynthModel string `json:"synth_model"`
-	JudgeModel string `json:"judge_model"`
-	Queries    string `json:"queries"`
-	Rerank     bool   `json:"rerank"`
-	SynthK     int    `json:"synth_k"`
-	When       string `json:"when"`
-	Summary    map[string]struct {
-		N             int     `json:"n"`
-		MeanCoverage  float64 `json:"mean_coverage"`
-		MeanGrounding float64 `json:"mean_grounding"`
-		Combined      float64 `json:"combined"`
-	} `json:"summary"`
-	Reports []struct {
-		Query   string `json:"query"`
-		Reports []struct {
-			Strategy     string `json:"strategy"`
-			Coverage     int    `json:"coverage"`
-			Grounding    int    `json:"grounding"`
-			JudgeComment string `json:"judge_comment"`
-		} `json:"reports"`
-	} `json:"reports"`
-}
-
-func loadAnswerEvalReport(path string) (*savedAnswerEvalReport, error) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return nil, fmt.Errorf("read %s: %w", path, err)
-	}
-	var r savedAnswerEvalReport
-	if err := json.Unmarshal(b, &r); err != nil {
-		return nil, fmt.Errorf("parse %s: %w", path, err)
-	}
-	// Old reports had an empty summary because the agg struct used
-	// unexported fields. Recompute the summary on the fly for those.
-	if len(r.Summary) == 0 || r.Summary["planner"].N == 0 {
-		r.Summary = recomputeSummary(r)
-	}
-	return &r, nil
-}
-
-func recomputeSummary(r savedAnswerEvalReport) map[string]struct {
-	N             int     `json:"n"`
-	MeanCoverage  float64 `json:"mean_coverage"`
-	MeanGrounding float64 `json:"mean_grounding"`
-	Combined      float64 `json:"combined"`
-} {
-	out := make(map[string]struct {
-		N             int     `json:"n"`
-		MeanCoverage  float64 `json:"mean_coverage"`
-		MeanGrounding float64 `json:"mean_grounding"`
-		Combined      float64 `json:"combined"`
-	})
-	for _, strategy := range []string{"planner", "paraphrase"} {
-		var covSum, grdSum, n int
-		for _, q := range r.Reports {
-			for _, sr := range q.Reports {
-				if sr.Strategy == strategy {
-					covSum += sr.Coverage
-					grdSum += sr.Grounding
-					n++
-				}
-			}
-		}
-		s := out[strategy]
-		s.N = n
-		if n > 0 {
-			s.MeanCoverage = float64(covSum) / float64(n)
-			s.MeanGrounding = float64(grdSum) / float64(n)
-			s.Combined = s.MeanCoverage + s.MeanGrounding
-		}
-		out[strategy] = s
-	}
-	return out
-}
-
-// runAnswerEvalCompare loads two saved answer-eval JSON reports and prints
-// side-by-side coverage/grounding/combined deltas + per-query moves above a
-// configurable threshold. No LLM calls; pure file-to-file diff —
-// first-class replacement for the ad-hoc python one-liners operators
-// previously chained for the same report.
-func runAnswerEvalCompare(_ context.Context, args []string) error {
-	fs := flag.NewFlagSet("answer-eval-compare", flag.ExitOnError)
-	threshold := fs.Int("query-threshold", 2, "report per-query moves of |Δgrounding| or |Δcoverage| ≥ this value (1-5 scale)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	rest := fs.Args()
-	if len(rest) != 2 {
-		return errors.New("usage: cosift answer-eval-compare [-query-threshold N] BASELINE.json NEW.json")
-	}
-	a, err := loadAnswerEvalReport(rest[0])
-	if err != nil {
-		return fmt.Errorf("baseline: %w", err)
-	}
-	b, err := loadAnswerEvalReport(rest[1])
-	if err != nil {
-		return fmt.Errorf("new: %w", err)
-	}
-	// Header — record what we're comparing.
-	fmt.Printf("BASELINE: %s\n", rest[0])
-	fmt.Printf("  synth=%s judge=%s rerank=%v synth_k=%d queries=%s\n", a.SynthModel, a.JudgeModel, a.Rerank, a.SynthK, a.Queries)
-	fmt.Printf("  when: %s\n", a.When)
-	fmt.Printf("NEW:      %s\n", rest[1])
-	fmt.Printf("  synth=%s judge=%s rerank=%v synth_k=%d queries=%s\n", b.SynthModel, b.JudgeModel, b.Rerank, b.SynthK, b.Queries)
-	fmt.Printf("  when: %s\n", b.When)
-	fmt.Println()
-
-	// Summary deltas.
-	fmt.Printf("%-12s   N     cov     grnd    comb   |   Δcov    Δgrnd   Δcomb\n", "strategy")
-	fmt.Println("-----------------------------------------------------------------------")
-	for _, strategy := range []string{"planner", "paraphrase"} {
-		ab, bb := a.Summary[strategy], b.Summary[strategy]
-		if ab.N == 0 && bb.N == 0 {
-			fmt.Printf("%-12s   (not present in either report)\n", strategy)
-			continue
-		}
-		fmt.Printf("%-12s %3d→%-3d %.2f→%.2f %.2f→%.2f %.2f→%.2f | %+.2f  %+.2f  %+.2f\n",
-			strategy, ab.N, bb.N,
-			ab.MeanCoverage, bb.MeanCoverage,
-			ab.MeanGrounding, bb.MeanGrounding,
-			ab.Combined, bb.Combined,
-			bb.MeanCoverage-ab.MeanCoverage,
-			bb.MeanGrounding-ab.MeanGrounding,
-			bb.Combined-ab.Combined,
-		)
-	}
-
-	// Per-query moves.
-	if *threshold > 0 {
-		// Index by (query, strategy) for fast lookup.
-		aIdx := make(map[string]struct{ cov, grd int })
-		for _, q := range a.Reports {
-			for _, sr := range q.Reports {
-				aIdx[q.Query+"\x00"+sr.Strategy] = struct{ cov, grd int }{sr.Coverage, sr.Grounding}
-			}
-		}
-		type move struct {
-			query, strategy string
-			oldCov, oldGrd  int
-			newCov, newGrd  int
-		}
-		var moves []move
-		for _, q := range b.Reports {
-			for _, sr := range q.Reports {
-				ab, ok := aIdx[q.Query+"\x00"+sr.Strategy]
-				if !ok {
-					continue
-				}
-				dc := abs(sr.Coverage - ab.cov)
-				dg := abs(sr.Grounding - ab.grd)
-				if dc >= *threshold || dg >= *threshold {
-					moves = append(moves, move{q.Query, sr.Strategy, ab.cov, ab.grd, sr.Coverage, sr.Grounding})
-				}
-			}
-		}
-		if len(moves) > 0 {
-			fmt.Printf("\nPer-query moves with |Δ| ≥ %d:\n", *threshold)
-			fmt.Printf("  %-10s  %-50s  cov   grnd\n", "strategy", "query")
-			for _, m := range moves {
-				fmt.Printf("  %-10s  %-50s  %d→%d  %d→%d\n",
-					m.strategy, truncate(m.query, 50),
-					m.oldCov, m.newCov,
-					m.oldGrd, m.newGrd,
-				)
-			}
-		} else {
-			fmt.Printf("\nNo per-query moves with |Δ| ≥ %d.\n", *threshold)
-		}
-	}
-	return nil
-}
-
-func abs(n int) int {
-	if n < 0 {
-		return -n
-	}
-	return n
-}
-
-func truncate(s string, n int) string {
-	if len(s) <= n {
-		return s
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
 	}
 	return s[:n-1] + "…"
 }
 
-// peekWarnings extracts the warnings field from a server
-// response body without committing to a full typed decode. When the CLI hits
-// pebble-serve, the response carries a warnings[] slice naming silent no-ops
-// (unknown expand, rerank without reranker, malformed include_domains, etc).
-// Without surfacing these on stderr the human CLI mode swallows them.
-func peekWarnings(body []byte) []string {
-	var probe struct {
-		Warnings []string `json:"warnings"`
-	}
-	if err := json.Unmarshal(body, &probe); err != nil {
-		return nil
-	}
-	return probe.Warnings
-}
-
-// emitWarnings prints each warning to stderr with a 'cosift:' prefix.
-func emitWarnings(body []byte) {
-	for _, w := range peekWarnings(body) {
-		fmt.Fprintln(os.Stderr, "cosift: warning:", w)
-	}
-}
-
-func runStats(ctx context.Context, cfg *config.Config, args []string) error {
-	// -backend flag (-backend=pebble reads the Pebble subdir).
-	fs := flag.NewFlagSet("stats", flag.ExitOnError)
-	backend := fs.String("backend", "sqlite", "storage backend: sqlite (default) | pebble")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	switch *backend {
-	case "sqlite", "":
-		s, err := store.Open(cfg.DataDir)
-		if err != nil {
-			return err
-		}
-		defer s.Close()
-		stats, err := s.Stats(ctx)
-		if err != nil {
-			return err
-		}
-		fmt.Printf("documents: %d\nterms: %d\ndata_dir: %s\nbackend: sqlite\n",
-			stats.Documents, stats.Terms, cfg.DataDir)
-	case "pebble":
-		pebbleDir := filepath.Join(cfg.DataDir, "pebble")
-		ps, err := openPebbleOrFriendlyErr(pebbleDir)
-		if err != nil {
-			return err
-		}
-		defer ps.Close()
-		stats, err := ps.Stats(ctx)
-		if err != nil {
-			return err
-		}
-		fmt.Printf("documents: %d\ndata_dir: %s\nbackend: pebble\n",
-			stats.Documents, pebbleDir)
-	default:
-		return fmt.Errorf("stats: unknown -backend %q (want: sqlite | pebble)", *backend)
-	}
-	return nil
-}
-
-// runCrawlStatus prints an operator-friendly snapshot of an ongoing crawl:
-// counts, frontier breakdown, top hosts by indexed-doc count, recent error
-// classes, and rolling-window doc rates with a 1M-doc ETA. Safe to run
-// concurrently with a live `cosift crawl` — SQLite WAL mode allows readers
-// alongside the writer.
-// runStatusFile reads the crawl-status.json (the file the live
-// crawler writes every 10s) and pretty-prints it. Useful when an operator
-// can't run `cosift stats -backend=pebble` because Pebble's single-writer
-// lock is held by the crawl process.
-//
-// Default path: <cfg.DataDir>/crawl-status.json. -file flag overrides.
-func runStatusFile(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("status-file", flag.ExitOnError)
-	path := fs.String("file", "", "path to crawl-status.json (defaults to <data_dir>/crawl-status.json)")
-	asJSON := fs.Bool("json", false, "emit raw status JSON plus a derived 'age_seconds' field; suitable for jq / Prometheus")
-	target := fs.Int64("target", 0, "doc count target — show indexed/target progress percent (default 0 = no target line)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	p := *path
-	if p == "" {
-		p = filepath.Join(cfg.DataDir, "crawl-status.json")
-	}
-	buf, err := os.ReadFile(p)
-	if err != nil {
-		return fmt.Errorf("read %s: %w", p, err)
-	}
-	var d struct {
-		Queued             int64     `json:"frontier_queued"`
-		InFlight           int64     `json:"frontier_in_flight"`
-		Done               int64     `json:"frontier_done"`
-		Errored            int64     `json:"frontier_errored"`
-		IndexedDocs        int64     `json:"indexed_docs,omitempty"`
-		IndexedDocsAtStart int64     `json:"indexed_docs_at_start,omitempty"`
-		AvgDocLen          float64   `json:"avg_doc_len,omitempty"`
-		StartedAt          time.Time `json:"started_at,omitempty"`
-		WrittenAt          time.Time `json:"written_at"`
-	}
-	if err := json.Unmarshal(buf, &d); err != nil {
-		return fmt.Errorf("decode %s: %w", p, err)
-	}
-	age := time.Since(d.WrittenAt).Round(time.Second)
-	if *asJSON {
-		out := map[string]any{
-			"path":                  p,
-			"frontier_queued":       d.Queued,
-			"frontier_in_flight":    d.InFlight,
-			"frontier_done":         d.Done,
-			"frontier_errored":      d.Errored,
-			"indexed_docs":          d.IndexedDocs,
-			"indexed_docs_at_start": d.IndexedDocsAtStart,
-			"avg_doc_len":           d.AvgDocLen,
-			"started_at":            d.StartedAt,
-			"written_at":            d.WrittenAt,
-			"age_seconds":           int64(age.Seconds()),
-			"stale":                 age > 30*time.Second,
-		}
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		return enc.Encode(out)
-	}
-	fmt.Printf("status file: %s  (written %s ago)\n\n", p, age)
-	fmt.Printf("  queued:     %d\n", d.Queued)
-	fmt.Printf("  in_flight:  %d\n", d.InFlight)
-	fmt.Printf("  done:       %d\n", d.Done)
-	fmt.Printf("  errored:    %d\n", d.Errored)
-	if d.IndexedDocs > 0 {
-		fmt.Printf("  indexed:    %d (avg doc length: %.0f tokens)\n", d.IndexedDocs, d.AvgDocLen)
-	}
-	total := d.Queued + d.InFlight + d.Done + d.Errored
-	if total > 0 {
-		processed := d.Done + d.Errored
-		fmt.Printf("  processed:  %d / %d (%.1f%%)\n",
-			processed, total, float64(processed)/float64(total)*100)
-	}
-	// ?-target N → 'indexed/target (pct)' line for long crawls toward
-	// a known doc-count goal. No-op when target is unset or already met.
-	// ETA from started_at + indexed_docs_at_start fields.
-	// Rate is averaged since the dumper's first poll, not instantaneous.
-	if *target > 0 && d.IndexedDocs > 0 {
-		pct := float64(d.IndexedDocs) / float64(*target) * 100
-		// cap pct display at 100% and append a 'reached' marker when
-		// the crawl has met or exceeded the goal — operators watching a long
-		// crawl see the win line instead of '237.4%' growing confusingly.
-		switch {
-		case d.IndexedDocs >= *target:
-			fmt.Printf("  target:     %d / %d (100.0%%, reached)\n", d.IndexedDocs, *target)
-		default:
-			fmt.Printf("  target:     %d / %d (%.1f%%)\n", d.IndexedDocs, *target, pct)
-		}
-		gained := d.IndexedDocs - d.IndexedDocsAtStart
-		elapsed := d.WrittenAt.Sub(d.StartedAt)
-		if gained > 0 && elapsed > time.Second && d.IndexedDocs < *target {
-			rate := float64(gained) / elapsed.Seconds()
-			remaining := float64(*target - d.IndexedDocs)
-			eta := time.Duration(remaining/rate) * time.Second
-			fmt.Printf("  rate:       %.1f docs/sec  eta: %s\n", rate, eta.Round(time.Second))
-		}
-	}
-	if age > 30*time.Second {
-		fmt.Printf("\n  WARNING: status is %s old; crawler may have stopped\n", age)
-	}
-	return nil
-}
-
-func runCrawlStatus(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("crawl-status", flag.ExitOnError)
-	hostsN := fs.Int("hosts", 10, "show top N hosts by indexed-doc count")
-	errsN := fs.Int("errors", 8, "show top N distinct error classes")
-	target := fs.Int64("target", 1_000_000, "doc count target for ETA projection")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	s, err := store.Open(cfg.DataDir)
-	if err != nil {
-		return err
-	}
-	defer s.Close()
-
-	r, err := s.CrawlStatus(ctx, *hostsN, *errsN)
-	if err != nil {
-		return err
-	}
-
-	fmt.Printf("crawl status — %s\n\n", cfg.DataDir)
-	fmt.Printf("  documents:        %d\n", r.Documents)
-	fmt.Printf("  terms:            %d\n", r.Terms)
-	fmt.Printf("  unique hosts:     %d\n", r.UniqueHosts)
-	fmt.Println()
-	fmt.Println("  frontier:")
-	for _, fs := range r.FrontierByStatus {
-		fmt.Printf("    %-12s %d\n", fs.Status, fs.Count)
-	}
-	fmt.Println()
-	fmt.Println("  doc rate (rolling, by fetched_at):")
-	for _, win := range r.RateWindows {
-		ratePerMin := float64(win.Count) / float64(win.WindowSec) * 60.0
-		fmt.Printf("    last %2dmin: %5d docs (%7.0f /min)\n", win.WindowSec/60, win.Count, ratePerMin)
-	}
-	if len(r.RateWindows) > 0 {
-		// Use the longest available rolling window for ETA — most stable signal.
-		win := r.RateWindows[len(r.RateWindows)-1]
-		ratePerMin := float64(win.Count) / float64(win.WindowSec) * 60.0
-		if ratePerMin > 0 {
-			remaining := *target - r.Documents
-			if remaining < 0 {
-				remaining = 0
-			}
-			etaHours := float64(remaining) / ratePerMin / 60.0
-			fmt.Printf("    → ETA to %d docs: %.1f hours = %.2f days (at the %dmin rate)\n",
-				*target, etaHours, etaHours/24.0, win.WindowSec/60)
-		}
-	}
-	if len(r.TopHosts) > 0 {
-		fmt.Printf("\n  top %d hosts (by indexed doc count):\n", len(r.TopHosts))
-		for _, h := range r.TopHosts {
-			fmt.Printf("    %-50s %d\n", truncStr(h.Host, 50), h.Count)
-		}
-	}
-	if len(r.ErrorClasses) > 0 {
-		fmt.Printf("\n  top %d error classes:\n", len(r.ErrorClasses))
-		for _, e := range r.ErrorClasses {
-			fmt.Printf("    %-60s %d\n", truncStr(e.LastError, 60), e.Count)
-		}
-	}
-	return nil
-}
-
 func truncStr(s string, n int) string {
 	if len(s) <= n {
 		return s
diff --git a/cmd/cosift/pebble_serve.go b/cmd/cosift/pebble_serve.go
deleted file mode 100644
index f782568..0000000
--- a/cmd/cosift/pebble_serve.go
+++ /dev/null
@@ -1,8095 +0,0 @@
-// minimal HTTP server backed by PebbleStore + PebbleBM25.
-//
-// Parallel to the SQLite-backed `cosift serve`. Read-only endpoints only:
-// /healthz, /stats, /search, /contents. No crawler, no admin, no /answer
-// or /research yet — those need the SQLite-side server's chat-client +
-// admin-token plumbing, which is the work.
-//
-// Purpose: proves the path-2 storage rework works end-to-end through HTTP,
-// and gives a clean benchmark surface against the existing SQLite server.
-// Operators evaluating cosift's billion-scale capability run this against
-// a Pebble store and compare /search latency + index size to the SQLite
-// equivalent.
-package main
-
-import (
-	"bytes"
-	"compress/gzip"
-	"context"
-	_ "embed"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"io"
-	"log"
-	"math"
-	"net"
-	"net/http"
-	"net/http/pprof"
-	"net/url"
-	"os"
-	"path/filepath"
-	"regexp"
-	"runtime"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"crypto/sha256"
-	"encoding/hex"
-
-	"github.com/pilot-protocol/cosift/internal/crawler"
-
-	"github.com/pilot-protocol/cosift/internal/answercache"
-	"github.com/pilot-protocol/cosift/internal/authority"
-	"github.com/pilot-protocol/cosift/internal/chatgate"
-	"github.com/pilot-protocol/cosift/internal/config"
-	"github.com/pilot-protocol/cosift/internal/embed"
-	"github.com/pilot-protocol/cosift/internal/index"
-	"github.com/pilot-protocol/cosift/internal/judge"
-	"github.com/pilot-protocol/cosift/internal/qexpand"
-	"github.com/pilot-protocol/cosift/internal/rerank"
-	"github.com/pilot-protocol/cosift/internal/sla"
-	"github.com/pilot-protocol/cosift/internal/store"
-)
-
-func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("pebble-serve", flag.ExitOnError)
-	dir := fs.String("dir", "", "PebbleStore directory (required; the SQLite cfg.DataDir is ignored)")
-	addr := fs.String("addr", cfg.Server.Addr, "listen address (defaults to server.addr from cosift.json)")
-	// -crawl-seeds-file lets pebble-serve run an in-process crawler
-	// against the same PebbleStore. Eliminates the writer-lock dance between
-	// cosift-serve and cosift-crawl — search + crawl + index growth all in one
-	// process, one binary, one lock. The crawler runs as a goroutine for the
-	// lifetime of the server.
-	crawlSeeds := fs.String("crawl-seeds-file", "", "if set, run a continuous in-process crawler against these seeds while serving")
-	crawlCheckpoint := fs.Duration("crawl-checkpoint", 60*time.Second, "HNSW persist cadence for the in-serve crawler")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *dir == "" {
-		return errors.New("pebble-serve: -dir is required")
-	}
-	if *addr == "" {
-		*addr = "127.0.0.1:7777"
-	}
-
-	ps, err := store.OpenPebble(*dir)
-	if err != nil {
-		return fmt.Errorf("open pebble: %w", err)
-	}
-	defer ps.Close()
-
-	// log corpus size at startup so operators see whether the
-	// store opened with the expected doc count (silent open would force them
-	// to curl /stats just to confirm a restart loaded the right data dir).
-	if _, indexedDocs, err := ps.CorpusStats(ctx); err == nil && indexedDocs > 0 {
-		log.Printf("pebble-serve: opened store with %d indexed docs", indexedDocs)
-	}
-
-	// Meta is 20 bytes (dim+nodeCount); first-entry probe is the fallback
-	// when meta is absent but vector entries exist (partial persist).
-	// We never load the full graph here — gigabytes of RAM at 10M-vector scale.
-	hasVectors := false
-	var vectorDim, vectorNodes int
-	if meta, ok, err := index.LoadHNSWMeta(ctx, ps); err == nil && ok {
-		hasVectors = true
-		vectorDim = meta.Dim
-		vectorNodes = meta.NodeCount
-	} else {
-		_ = ps.IterateVectorNodes(ctx, func(_ uint64, _ []byte) bool {
-			hasVectors = true
-			return false
-		})
-	}
-	// Loading is
-	// gigabytes of RAM at production scale (10M vectors × 1536 dim ≈ 60GB),
-	// so it's opt-in. When the env var isn't set we just keep the cheap meta
-	// snapshot from and operators see has_vectors=true.
-	var hnswGraph *index.HNSW
-	if hasVectors && os.Getenv("COSIFT_LOAD_HNSW") == "true" {
-		g, ok, err := index.LoadHNSW(ctx, ps)
-		switch {
-		case err != nil:
-			log.Printf("pebble-serve: COSIFT_LOAD_HNSW=true but LoadHNSW failed: %v", err)
-		case !ok:
-			log.Printf("pebble-serve: COSIFT_LOAD_HNSW=true but no HNSW meta on store")
-		default:
-			hnswGraph = g
-			log.Printf("pebble-serve: HNSW graph loaded into memory: %d nodes, dim=%d", g.Len(), vectorDim)
-			// Default 50 from NewHNSW
-			// underfits big graphs grown via AddPassage; raising to ~200
-			// restored Recall@10 from 0.47 to ~0.85 on the 800K-vector
-			// production corpus without a graph rebuild.
-			if v := os.Getenv("COSIFT_HNSW_EF_SEARCH"); v != "" {
-				if n, err := strconv.Atoi(v); err == nil && n > 0 {
-					g.SetEfSearch(n)
-					log.Printf("pebble-serve: HNSW efSearch override = %d", n)
-				}
-			}
-			// if a PQ codebook + codes exist in this store, wire
-			// them so /search uses asymmetric PQ distance (much faster on
-			// large graphs). When absent, search falls back to raw vectors.
-			//
-			// bench-pq exposed that PQ on this dim=768 corpus drops
-			// Recall@10 from ~0.89 to ~0.60 — the 32× compression has a
-			// recall cost that may exceed the speed benefit. Operators can
-			// keep the codes on disk but disable the runtime path by setting
-			// COSIFT_DISABLE_PQ=true.
-			if os.Getenv("COSIFT_DISABLE_PQ") == "true" {
-				log.Printf("pebble-serve: PQ disabled via COSIFT_DISABLE_PQ — using raw vectors for search")
-			} else if cb, cbOK, _ := index.LoadPQCodebook(ctx, ps); cbOK {
-				codes := make([][]uint16, g.Len())
-				loaded := 0
-				if err := ps.IteratePQCodes(ctx, func(nodeID uint64, blob []byte) bool {
-					if int(nodeID) >= len(codes) {
-						return true
-					}
-					// codebook-aware decode handles both byte-packed
-					// (new, K≤256) and uint16 LE (legacy) blob shapes.
-					code, err := cb.DecodeCodeBlob(blob)
-					if err != nil || len(code) != cb.M {
-						return true
-					}
-					codes[int(nodeID)] = code
-					loaded++
-					return true
-				}); err != nil {
-					log.Printf("pebble-serve: PQ codes iterate failed: %v — falling back to raw vectors", err)
-				} else {
-					g.UsePQ(cb, codes)
-					log.Printf("pebble-serve: PQ search enabled (codebook: dim=%d M=%d K=%d, codes=%d/%d)",
-						cb.Dim, cb.M, cb.K, loaded, g.Len())
-				}
-			}
-		}
-	}
-	if hasVectors {
-		if vectorNodes > 0 {
-			suffix := "(graph not loaded into memory; set COSIFT_LOAD_HNSW=true to load)"
-			if hnswGraph != nil {
-				suffix = "(graph loaded)"
-			}
-			log.Printf("pebble-serve: HNSW index present: %d nodes, dim=%d %s", vectorNodes, vectorDim, suffix)
-		} else {
-			log.Printf("pebble-serve: HNSW vector entries present (no meta blob — partial persist?)")
-		}
-	}
-
-	// configurable HyDE + paraphrase cache caps (defaults 256).
-	hydeCap := 256
-	if v := os.Getenv("COSIFT_HYDE_CACHE_SIZE"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			hydeCap = n
-			log.Printf("pebble-serve: HyDE cache size override = %d", n)
-		} else {
-			// surface unparseable env vars as warnings at startup
-			// instead of silently keeping defaults. Catches typos like
-			// COSIFT_HYDE_CACHE_SIZE="512m" or negative values.
-			log.Printf("pebble-serve: WARN COSIFT_HYDE_CACHE_SIZE=%q is not a positive integer — using default %d", v, hydeCap)
-		}
-	}
-	paraCap := 256
-	if v := os.Getenv("COSIFT_PARA_CACHE_SIZE"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			paraCap = n
-			log.Printf("pebble-serve: paraphrase cache size override = %d", n)
-		} else {
-			log.Printf("pebble-serve: WARN COSIFT_PARA_CACHE_SIZE=%q is not a positive integer — using default %d", v, paraCap)
-		}
-	}
-	idx := index.NewPebbleBM25(ps)
-	// Wikipedia / kernel.org / arxiv float
-	// above spam directories in the long tail. Optional Tranco /
-	// Majestic CSVs at COSIFT_TRANCO_CSV / COSIFT_MAJESTIC_CSV improve
-	// the score; with no CSVs the embedded whitelist + TLD heuristics
-	// still produce useful signals.
-	scorer := authority.New()
-	if v := os.Getenv("COSIFT_AUTHORITY_ALPHA"); v != "" {
-		if a, err := strconv.ParseFloat(v, 64); err == nil && a >= 0 {
-			scorer = scorer.WithAlpha(a)
-		}
-	}
-	if path := os.Getenv("COSIFT_TRANCO_CSV"); path != "" {
-		if f, err := os.Open(path); err == nil {
-			n, _ := scorer.LoadTranco(f)
-			_ = f.Close()
-			log.Printf("pebble-serve: authority Tranco loaded (%d entries from %s)", n, path)
-		} else {
-			log.Printf("pebble-serve: WARN COSIFT_TRANCO_CSV=%q: %v", path, err)
-		}
-	}
-	if path := os.Getenv("COSIFT_MAJESTIC_CSV"); path != "" {
-		if f, err := os.Open(path); err == nil {
-			n, _ := scorer.LoadMajestic(f)
-			_ = f.Close()
-			log.Printf("pebble-serve: authority Majestic loaded (%d entries from %s)", n, path)
-		} else {
-			log.Printf("pebble-serve: WARN COSIFT_MAJESTIC_CSV=%q: %v", path, err)
-		}
-	}
-	idx = idx.WithAuthority(scorer)
-	log.Printf("pebble-serve: authority scoring enabled (alpha=%.2f, trusted=%d, tranco=%d, majestic=%d)",
-		scorer.Alpha(), scorer.Stats().TrustedHosts, scorer.Stats().TrancoEntries, scorer.Stats().MajesticEntries)
-	// COSIFT_BM25_K1 / COSIFT_BM25_B override per instance.
-	// Shared with runQuery via applyBM25EnvOverrides so any PebbleBM25 built
-	// from CLI or server honors the same env.
-	o := applyBM25EnvOverrides(idx)
-	if o.k1Set {
-		log.Printf("pebble-serve: BM25 k1 override = %.2f", o.k1Val)
-	}
-	if o.bSet {
-		log.Printf("pebble-serve: BM25 b override = %.2f", o.bVal)
-	}
-	if o.k1Bad != "" {
-		log.Printf("pebble-serve: WARN COSIFT_BM25_K1=%q is not a positive float — using default %.2f", o.k1Bad, idx.K1())
-	}
-	if o.bBad != "" {
-		log.Printf("pebble-serve: WARN COSIFT_BM25_B=%q is not a positive float — using default %.2f", o.bBad, idx.B())
-	}
-	srv := &pebbleHTTP{
-		store:        ps,
-		idx:          idx,
-		hydeCache:    make(map[string]string, hydeCap),
-		hydeCacheCap: hydeCap,
-		paraCache:    make(map[string][]string, paraCap),
-		paraCacheCap: paraCap,
-		hasVectors:   hasVectors,
-		vectorDim:    vectorDim,
-		vectorNodes:  vectorNodes,
-		hnsw:         hnswGraph,
-		started:      time.Now(),
-		authority:    scorer,
-		// capture doc count at startup so /stats can compute
-		// per-minute crawl rate without long-term counters.
-		startupDocs: vectorNodes, // placeholder; overwritten below
-	}
-	// Read actual doc count at startup for crawl-rate baseline. Uses
-	// CorpusStats (the atomic-mirror indexed_docs counter) — NOT
-	// Stats.Documents which scans the raw 'd' family. The two diverge
-	// in two ways:
-	//
-	//   - Stats.Documents may include partially-upserted rows that the
-	//     indexed_docs counter hasn't seen yet, leaving startupDocs >
-	//     indexedDocs and freezing docs_added_since_start at 0 forever.
-	//   - On a cold corpus, Stats does a 12s scan that returns the
-	//     count AT END-OF-SCAN, by which time the crawler has already
-	//     added 50+ more docs, pushing startupDocs above the post-boot
-	//     indexed_docs atomic.
-	//
-	// CorpusStats reads the atomic directly (or bootstraps it from the
-	// indexed_docs meta key on first call), giving an exact match with
-	// the indexedDocs value the rate calc uses below.
-	if _, count, err := ps.CorpusStats(ctx); err == nil && count > 0 {
-		srv.startupDocs = int(count)
-	} else {
-		srv.startupDocs = 0
-	}
-	// stamp cluster config onto srv early so /search's
-	// gateway-mode check fires even on nodes that don't run a crawler.
-	if err := cfg.Cluster.Validate(); err != nil {
-		log.Printf("pebble-serve: cluster config invalid (%v) — running single-node", err)
-	} else {
-		srv.cluster = cfg.Cluster
-		if cfg.Cluster.IsClustered() {
-			role := "leaf"
-			if cfg.Cluster.GatewayMode {
-				role = "gateway+leaf"
-			}
-			log.Printf("pebble-serve: cluster mode (role=%s, shard=%d/%d, peers=%d)",
-				role, cfg.Cluster.MyShardID, cfg.Cluster.NumShards, len(cfg.Cluster.Peers))
-		}
-	}
-	// Uses the same OpenAI-compatible chat
-	// client the SQLite-side server uses; works against OpenAI, Together,
-	// Azure, llama.cpp, vLLM, Ollama, anything speaking /v1/chat/completions.
-	// anonymous auth when cfg.Chat.URL is set (self-hosted, no key
-	// needed). Required only for hosted defaults (empty URL = api.openai.com).
-	// Shared between answer + rerank pools so an
-	// /answer burst can't also exhaust the rerank pool's goroutines.
-	srv.chatGate = chatgate.New(
-		envIntDefault("COSIFT_LLM_GATE_RERANK", 8),
-		envIntDefault("COSIFT_LLM_GATE_ANSWER", 4),
-	)
-	// /answer response cache. Default TTL 60s + 1024-entry cap is a
-	// reasonable starting point for a workload with a few hundred
-	// recurring queries; raise via COSIFT_ANSWER_CACHE_TTL_SEC for
-	// stable corpora, disable with =0 if every query is unique.
-	srv.answerCache = answercache.New(
-		time.Duration(envIntDefault("COSIFT_ANSWER_CACHE_TTL_SEC", 60))*time.Second,
-		envIntDefault("COSIFT_ANSWER_CACHE_CAP", 1024),
-	)
-	srv.researchCache = answercache.New(
-		time.Duration(envIntDefault("COSIFT_RESEARCH_CACHE_TTL_SEC", 600))*time.Second,
-		envIntDefault("COSIFT_RESEARCH_CACHE_CAP", 256),
-	)
-	// Query log (observability). COSIFT_QUERY_LOG=/path enables JSONL append
-	// of every query-endpoint request. Disabled if unset.
-	if qp := os.Getenv("COSIFT_QUERY_LOG"); qp != "" {
-		if f, err := os.OpenFile(qp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
-			srv.qlogFile = f
-			log.Printf("pebble-serve: query log enabled → %s", qp)
-		} else {
-			log.Printf("pebble-serve: query log open failed (%s): %v", qp, err)
-		}
-	}
-	// Feedback rate limiter — always on (stricter than global). Per-client via
-	// XFF. Override COSIFT_FEEDBACK_RPM / _BURST.
-	srv.fbRL = &rateLimiter{
-		rpm:       float64(envIntDefault("COSIFT_FEEDBACK_RPM", 20)),
-		burst:     float64(envIntDefault("COSIFT_FEEDBACK_BURST", 5)),
-		whitelist: map[string]bool{},
-	}
-	// Feedback log. COSIFT_FEEDBACK_LOG=/path, or defaults beside the query log.
-	if fp := feedbackLogPath(); fp != "" {
-		if f, err := os.OpenFile(fp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
-			srv.fbFile = f
-			log.Printf("pebble-serve: feedback log enabled → %s", fp)
-		} else {
-			log.Printf("pebble-serve: feedback log open failed (%s): %v", fp, err)
-		}
-	}
-	// Tries the vLLM /metrics endpoint at the chat origin (works for
-	// self-hosted vLLM, no-op against OpenAI). Threshold default 8 — that
-	// matches the answer-pool cap so when the chat backend is already
-	// saturated we stop trying to add more LLM work.
-	if cfg.Chat.URL != "" {
-		probeURL := chatgate.VLLMMetricsURLFrom(cfg.Chat.URL)
-		threshold := envIntDefault("COSIFT_LLM_DEGRADE_QUEUE", 8)
-		interval := envDurationMsDefault("COSIFT_LLM_PROBE_MS", 2*time.Second)
-		srv.llmProbe = chatgate.NewLoadProbe(probeURL, threshold, interval)
-		go srv.llmProbe.Run(ctx)
-		log.Printf("pebble-serve: vLLM load probe started (url=%s, threshold=%d, interval=%s)", probeURL, threshold, interval)
-	}
-	// Defaults match the
-	// June-3 baseline measurements; ops can override per env. Violation
-	// log defaults under cfg.DataDir so it co-locates with the rest of
-	// the operational state.
-	slaLogPath := os.Getenv("COSIFT_SLA_LOG_PATH")
-	if slaLogPath == "" && cfg.DataDir != "" {
-		slaLogPath = filepath.Join(cfg.DataDir, "sla-violations.jsonl")
-	}
-	slaTargets := []sla.Target{
-		{Endpoint: "/search", P95: envDurationMsDefault("COSIFT_SLA_SEARCH_P95_MS", 1500*time.Millisecond), P99: envDurationMsDefault("COSIFT_SLA_SEARCH_P99_MS", 4*time.Second), MaxErrorRate: 0.02},
-		{Endpoint: "/answer", P95: envDurationMsDefault("COSIFT_SLA_ANSWER_P95_MS", 8*time.Second), P99: envDurationMsDefault("COSIFT_SLA_ANSWER_P99_MS", 20*time.Second), MaxErrorRate: 0.05},
-		{Endpoint: "/research", P95: envDurationMsDefault("COSIFT_SLA_RESEARCH_P95_MS", 30*time.Second), P99: envDurationMsDefault("COSIFT_SLA_RESEARCH_P99_MS", 60*time.Second), MaxErrorRate: 0.05},
-		{Endpoint: "/healthz", P95: 50 * time.Millisecond, P99: 200 * time.Millisecond, MaxErrorRate: 0.01},
-		{Endpoint: "/stats", P95: 200 * time.Millisecond, P99: time.Second, MaxErrorRate: 0.01},
-	}
-	slaWindow := envDurationMsDefault("COSIFT_SLA_WINDOW_MS", 5*time.Minute)
-	slaEvalInterval := envDurationMsDefault("COSIFT_SLA_EVAL_MS", 30*time.Second)
-	if m, err := sla.New(slaTargets, slaWindow, slaLogPath); err == nil {
-		srv.sla = m
-		go srv.sla.Run(ctx.Done(), slaEvalInterval)
-		log.Printf("pebble-serve: SLA monitor started (window=%s, eval=%s, log=%s)", slaWindow, slaEvalInterval, slaLogPath)
-	} else {
-		log.Printf("pebble-serve: SLA monitor disabled: %v", err)
-	}
-	// Holds the unwrapped OpenAIChatClient so the rerank
-	// wrapper below can sit directly on top of the inner client (single
-	// gate acquisition per call) instead of stacking on srv.chatSafe.
-	var rawChatForRerank embed.ChatClient
-	if cfg.Chat.Model != "" {
-		apiKey := resolveAPIKey("chat")
-		rawChat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Chat.Model)
-		rawChatForRerank = rawChat
-		srv.chatSafe = chatgate.NewSafeChat(rawChat, chatgate.Options{
-			Gate:          srv.chatGate,
-			Kind:          chatgate.KindAnswer,
-			StageDeadline: envDurationMsDefault("COSIFT_LLM_DEADLINE_ANSWER_MS", 30*time.Second),
-			MaxRetries:    envIntDefault("COSIFT_LLM_RETRIES", 1),
-		})
-		srv.chat = srv.chatSafe
-		auth := "anonymous"
-		if apiKey != "" {
-			auth = "bearer-token"
-		}
-		st := srv.chatGate.Stats()
-		log.Printf("pebble-serve: /answer enabled (chat model=%s, auth=%s, gate=answer:%d/rerank:%d)",
-			cfg.Chat.Model, auth, st.AnswerCap, st.RerankCap)
-	}
-	// Same anonymous-when-URL
-	// semantics as chat above.
-	if cfg.Embeddings.Model != "" {
-		apiKey := resolveAPIKey("embed")
-		// when cfg.Embeddings.URLs is set, build one client per
-		// URL and wrap them in a RoundRobinEmbedder so cosift fans embed
-		// requests across multiple backends. Falls back to single-URL
-		// behavior when URLs is empty.
-		urls := cfg.Embeddings.URLs
-		if len(urls) == 0 {
-			urls = []string{cfg.Embeddings.URL}
-		}
-		clients := make([]embed.Embedder, 0, len(urls))
-		for _, u := range urls {
-			clients = append(clients, embed.NewOpenAIClient(apiKey, u, cfg.Embeddings.Model, cfg.Embeddings.Dim))
-		}
-		var base embed.Embedder = embed.NewRoundRobinEmbedder(clients)
-		// Both search and
-		// crawler embed paths share the cache layer — same text returns
-		// instantly on re-fetch / re-query, no ollama call.
-		cacheNote := ""
-		if cfg.Embeddings.CacheDir != "" {
-			base = embed.NewCachedEmbedder(base, cfg.Embeddings.CacheDir)
-			cacheNote = fmt.Sprintf(", cache=%s", cfg.Embeddings.CacheDir)
-		}
-		srv.embedder = base
-		auth := "anonymous"
-		if apiKey != "" {
-			auth = "bearer-token"
-		}
-		log.Printf("pebble-serve: embedder configured (model=%s, dim=%d, auth=%s, backends=%d%s)",
-			cfg.Embeddings.Model, cfg.Embeddings.Dim, auth, len(clients), cacheNote)
-	}
-	// wire rerank.Reranker when cfg.Rerank is configured. Two paths
-	// (matching the SQLite-side): cfg.Rerank.URL → HTTPReranker (Cohere/Voyage/
-	// Jina/TEI wire shape); otherwise cfg.Chat.Model present → LLMReranker
-	// (RankGPT-style listwise via chat). /search?rerank=true gates the wrapper.
-	if cfg.Rerank.URL != "" {
-		apiKey := cfg.Rerank.APIKey
-		if apiKey == "" {
-			apiKey = os.Getenv("COHERE_API_KEY")
-			if apiKey == "" {
-				apiKey = os.Getenv("VOYAGE_API_KEY")
-			}
-		}
-		srv.reranker = rerank.NewHTTPReranker(cfg.Rerank.URL, apiKey, cfg.Rerank.Model)
-		log.Printf("pebble-serve: rerank enabled (http: %s, model=%s)", cfg.Rerank.URL, cfg.Rerank.Model)
-	} else if cfg.Rerank.Enabled && srv.chat != nil {
-		// when cfg.Rerank.Model is set and differs from cfg.Chat.Model,
-		// build a separate chat client for rerank pointing at the same /v1 URL
-		// but with the alternate model. Lets operators dedicate a small/fast
-		// model (e.g. qwen3.5:0.8b) to rerank so it doesn't queue behind chat
-		// generations on the same model. Falls back to the main chat client
-		// when Rerank.Model is empty or equal to Chat.Model.
-		var rerankInner embed.ChatClient = rawChatForRerank
-		if cfg.Rerank.Model != "" && cfg.Rerank.Model != cfg.Chat.Model {
-			apiKey := resolveAPIKey("chat")
-			rerankInner = embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Rerank.Model)
-			log.Printf("pebble-serve: rerank using dedicated chat (model=%s, url=%s)", cfg.Rerank.Model, cfg.Chat.URL)
-		}
-		srv.rerankSafe = chatgate.NewSafeChat(rerankInner, chatgate.Options{
-			Gate:          srv.chatGate,
-			Kind:          chatgate.KindRerank,
-			StageDeadline: envDurationMsDefault("COSIFT_LLM_DEADLINE_RERANK_MS", 5*time.Second),
-			MaxRetries:    envIntDefault("COSIFT_LLM_RETRIES", 1),
-		})
-		srv.reranker = rerank.NewLLMReranker(srv.rerankSafe)
-		log.Printf("pebble-serve: rerank enabled (llm: %s, gated)", srv.rerankSafe.Model())
-	}
-	srv.rerankCandK = cfg.Rerank.CandidateK
-	if srv.rerankCandK <= 0 {
-		srv.rerankCandK = 20
-	}
-	srv.hostBoosts = cfg.Defaults.HostBoosts
-
-	mux := http.NewServeMux()
-	// Built once from env;
-	// nil when disabled (COSIFT_RATELIMIT_RPM unset or 0). Wraps every route
-	// below — including /healthz so monitoring hits are budgeted too;
-	// operators wanting unlimited probes should set
-	// COSIFT_RATELIMIT_WHITELIST to include their monitoring source.
-	srv.rl = newRateLimiterFromEnv()
-	if srv.rl != nil {
-		log.Printf("pebble-serve: rate limit active (rpm=%.0f burst=%.0f whitelist=%v)", srv.rl.rpm, srv.rl.burst, srv.rl.whitelistList())
-	}
-	wrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(h)) }
-	// qwrap adds query logging (innermost, so it sees the real status+bytes) for
-	// the user-facing query endpoints — the observability substrate we lacked.
-	qwrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(srv.qlog(h))) }
-	// landing page at / and OpenAPI 3.1 spec at /openapi.json.
-	// Both embedded into the binary at build time — operators get a single
-	// self-contained executable, no separate static-asset deployment.
-	mux.HandleFunc("GET /", wrap(srv.handleLanding))
-	// Streams /answer or /research SSE
-	// into a multi-turn conversation view with citation rendering.
-	mux.HandleFunc("GET /chat", wrap(srv.handleChat))
-	mux.HandleFunc("GET /openapi.json", wrap(srv.handleOpenAPI))
-	// Swagger UI bundled into the binary. /docs renders the
-	// interactive spec; /docs/swagger-ui.css and /docs/swagger-ui-bundle.js
-	// serve the dist assets locally so the page works air-gapped (no CDN).
-	mux.HandleFunc("GET /docs", wrap(srv.handleSwaggerUI))
-	mux.HandleFunc("GET /docs/{file...}", wrap(srv.handleSwaggerAsset))
-	mux.HandleFunc("GET /healthz", wrap(srv.handleHealthz))
-	mux.HandleFunc("GET /find", qwrap(srv.handleFind))
-	mux.HandleFunc("GET /stats", wrap(srv.handleStats))
-	mux.HandleFunc("GET /domains", wrap(srv.handleDomains))
-	// frontier queue visibility — counts by status + top-N
-	// hosts in queue. Distinct from /domains which is over INDEXED docs.
-	mux.HandleFunc("GET /queue", wrap(srv.handleQueue))
-	// Single-node deployments still expose
-	// this; it's just unused. Authenticated by cfg.Cluster.PeerAuthToken
-	// (Bearer); when token is empty, requests from any source are accepted.
-	mux.HandleFunc("POST /admin/crawl-enqueue", wrap(srv.handleCrawlEnqueue))
-	mux.HandleFunc("POST /admin/allow-domain", wrap(srv.handleAllowDomain))
-	mux.HandleFunc("POST /admin/frontier-purge-host", wrap(srv.handleFrontierPurgeHost))
-	mux.HandleFunc("POST /admin/frontier-clear", wrap(srv.handleFrontierClear))
-	mux.HandleFunc("POST /admin/frontier-demote-host", wrap(srv.handleFrontierDemoteHost))
-	mux.HandleFunc("POST /admin/frontier-purge-stale-inflight", wrap(srv.handleFrontierPurgeStaleInFlight))
-	mux.HandleFunc("POST /admin/rss-import", wrap(srv.handleRSSImport))
-	mux.HandleFunc("POST /admin/crawl-now", wrap(srv.handleCrawlNow))
-	mux.HandleFunc("POST /admin/wet-import", wrap(srv.handleWETImport))
-	mux.HandleFunc("POST /admin/wet-import-bulk", wrap(srv.handleWETImportBulk))
-	mux.HandleFunc("POST /admin/site-pack", wrap(srv.handleSitePack))
-	mux.HandleFunc("POST /admin/site-submit", wrap(srv.handleSiteSubmit))
-	mux.HandleFunc("POST /admin/embed-backfill", wrap(srv.handleEmbedBackfill))
-	mux.HandleFunc("POST /admin/host-backfill", wrap(srv.handleHostBackfill))
-	mux.HandleFunc("GET /admin/eval-quick", wrap(srv.handleEvalQuick))
-	mux.HandleFunc("POST /admin/hnsw-compact", wrap(srv.handleHNSWCompact))
-	mux.HandleFunc("GET /query", qwrap(srv.handleQuery))
-	mux.HandleFunc("POST /query", qwrap(srv.handleQuery))
-	// import a sitemap.xml (or sitemap-index) and push every
-	// listed URL into the live frontier.
-	mux.HandleFunc("POST /admin/sitemap-import", wrap(srv.handleSitemapImport))
-	mux.HandleFunc("POST /admin/recrawl-sitemap", wrap(srv.handleRecrawlSitemap))
-	// PQ training admin endpoint. Same auth as crawl-enqueue
-	// (Bearer cfg.Cluster.PeerAuthToken). Runs synchronously — for the
-	// 224K-vec corpus we have today it takes ~minutes; operator-only.
-	mux.HandleFunc("POST /admin/pq-train", wrap(srv.handlePQTrain))
-	// backfill-only — re-encode every node that doesn't have a
-	// code yet against the existing codebook. No retrain. Fast.
-	mux.HandleFunc("POST /admin/pq-encode", wrap(srv.handlePQEncode))
-	// Creates a hard-linked, consistent
-	// snapshot dir that's safe to tar without racing background compactions.
-	mux.HandleFunc("POST /admin/checkpoint", wrap(srv.handleCheckpoint))
-	mux.HandleFunc("GET /search", qwrap(srv.handleSearch))
-	mux.HandleFunc("POST /search", qwrap(srv.handleSearchPOST))
-	mux.HandleFunc("GET /contents", wrap(srv.handleContents))
-	mux.HandleFunc("POST /contents", wrap(srv.handleContentsBatch))
-	mux.HandleFunc("GET /verify", wrap(srv.handleVerify))
-	mux.HandleFunc("GET /metrics", wrap(srv.handleMetrics))
-	mux.HandleFunc("GET /admin/query-log", wrap(srv.handleQueryLog))
-	mux.HandleFunc("POST /feedback", wrap(srv.handleFeedback))
-	mux.HandleFunc("GET /admin/feedback", wrap(srv.handleFeedbackList))
-	mux.HandleFunc("GET /sla", wrap(srv.handleSLA))
-	mux.HandleFunc("GET /admin/domains-audit", wrap(srv.handleDomainsAudit))
-	mux.HandleFunc("GET /find_similar", qwrap(srv.handleFindSimilar))
-	mux.HandleFunc("POST /find_similar", qwrap(srv.handleFindSimilarPOST))
-	mux.HandleFunc("GET /answer", qwrap(srv.handleAnswer))
-	mux.HandleFunc("POST /answer", qwrap(srv.handleAnswerPOST))
-	mux.HandleFunc("GET /research", qwrap(srv.handleResearch))
-	mux.HandleFunc("POST /research", qwrap(srv.handleResearchPOST))
-
-	httpSrv := &http.Server{
-		Addr:              *addr,
-		Handler:           mux,
-		ReadHeaderTimeout: 10 * time.Second,
-		ReadTimeout:       30 * time.Second,
-		WriteTimeout:      60 * time.Second,
-		IdleTimeout:       120 * time.Second,
-		MaxHeaderBytes:    1 << 20, // 1 MB
-	}
-
-	log.Printf("pebble-serve: listening on %s (PebbleStore at %s)", *addr, *dir)
-	// Production state observed on GH200: after a restart series that
-	// healed HNSW zombies, the meta counters showed 0 while the 'l'
-	// family had 10.87M entries — degraded BM25 length normalization.
-	// Off the hot path so HNSW load + first request aren't blocked.
-	go func() {
-		// Brief settle so an active IndexDocument can populate counters
-		// the cheap way before we kick the O(N) scan.
-		time.Sleep(10 * time.Second)
-		sumLen, count, recomputed, err := ps.BootstrapCorpusStats(ctx)
-		if err != nil {
-			log.Printf("pebble-serve: corpus stats bootstrap failed: %v", err)
-			return
-		}
-		if recomputed {
-			log.Printf("pebble-serve: corpus stats bootstrapped (indexed_docs=%d, sum_doc_len=%d)", count, sumLen)
-		}
-	}()
-	// Without this the
-	// subdomain-density penalty in authority.Score never fires — we
-	// saw 6.68M .cfd/.sbs hosts on GH200 sitting at score 0.20 instead
-	// of dropping to "block." Single-pass iteration is ~18s at 9M hosts;
-	// runs off the hot path so HNSW load isn't blocked. Re-runs every
-	// 6h to track ongoing crawl growth without operator intervention.
-	go func() {
-		// Initial settle so the rest of startup completes first.
-		time.Sleep(15 * time.Second)
-		refresh := func() {
-			counts := map[string]int{}
-			err := ps.IterateDomains(ctx, func(host string, _ int) bool {
-				// Use the Scorer's eTLD+1 logic so the bucket keys we
-				// produce here match what Score() looks up — without this
-				// the publicsuffix-aware Scorer keys on "bbc.co.uk" while
-				// the bootstrap keys on "co.uk" and the lookup misses.
-				e := authority.ETLD1(host)
-				if e == "" {
-					return true
-				}
-				counts[e]++
-				return true
-			})
-			if err != nil {
-				log.Printf("pebble-serve: subdomain-count refresh: %v", err)
-				return
-			}
-			srv.authority.SetSubdomainCounts(counts)
-			log.Printf("pebble-serve: authority subdomain counts refreshed (%d eTLD+1 buckets)", len(counts))
-		}
-		refresh()
-		// Re-scan periodically to absorb ongoing crawl growth.
-		t := time.NewTicker(6 * time.Hour)
-		defer t.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				refresh()
-			}
-		}
-	}()
-	// Only
-	// listens on loopback so it can never be exposed publicly through the
-	// reverse proxy. Set COSIFT_PPROF_ADDR=127.0.0.1:6060 to enable.
-	if pprofAddr := os.Getenv("COSIFT_PPROF_ADDR"); pprofAddr != "" {
-		// optional mutex / block sampling so the
-		// dense-search-latency investigation has data. Off by default
-		// because each sample is a couple-µs overhead per contended
-		// lock event. Set rate ≥1 to enable; 1000 means "sample 1 in
-		// 1000 lock waits" which is plenty for diagnosis.
-		if v := os.Getenv("COSIFT_MUTEX_PROFILE_FRACTION"); v != "" {
-			if n, err := strconv.Atoi(v); err == nil && n > 0 {
-				runtime.SetMutexProfileFraction(n)
-				log.Printf("pebble-serve: mutex profile fraction = %d", n)
-			}
-		}
-		if v := os.Getenv("COSIFT_BLOCK_PROFILE_RATE"); v != "" {
-			if n, err := strconv.Atoi(v); err == nil && n > 0 {
-				runtime.SetBlockProfileRate(n)
-				log.Printf("pebble-serve: block profile rate = %d", n)
-			}
-		}
-		pprofMux := http.NewServeMux()
-		pprofMux.HandleFunc("/debug/pprof/", pprof.Index)
-		pprofMux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-		pprofMux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-		pprofMux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-		pprofMux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-		go func() {
-			log.Printf("pebble-serve: pprof listening on %s", pprofAddr)
-			// Bare ListenAndServe uses zero-value Server with no timeouts —
-			// a slow-reader on the pprof port can pin goroutines indefinitely.
-			// WriteTimeout is generous because CPU profile and trace endpoints
-			// stream for 30s+ by design.
-			srv := &http.Server{
-				Addr:              pprofAddr,
-				Handler:           pprofMux,
-				ReadHeaderTimeout: 10 * time.Second,
-				ReadTimeout:       30 * time.Second,
-				WriteTimeout:      5 * time.Minute,
-				IdleTimeout:       120 * time.Second,
-				MaxHeaderBytes:    1 << 20,
-			}
-			if err := srv.ListenAndServe(); err != nil {
-				log.Printf("pebble-serve: pprof exited: %v", err)
-			}
-		}()
-	}
-	go func() {
-		<-ctx.Done()
-		log.Printf("pebble-serve: shutting down")
-		shutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		_ = httpSrv.Shutdown(shutCtx)
-	}()
-
-	// Reuses ps + srv.hnsw + srv.embedder. The
-	// crawler.Crawler uses concurrency from cfg.Crawler.MaxConcurrent. Vectors
-	// land into the SAME HNSW pointer that /search reads from, so freshly
-	// crawled content is searchable as soon as AddPassage returns.
-	// Checkpoint goroutine persists the graph every crawlCheckpoint.
-	// collect a WaitGroup of crawler goroutines so the final
-	// HNSW persist runs BEFORE ps.Close() — fixes a 'pebble: closed' panic.
-	var crawlWG sync.WaitGroup
-	if *crawlSeeds != "" {
-		if err := srv.startInProcessCrawl(ctx, ps, *crawlSeeds, *crawlCheckpoint, cfg, &crawlWG); err != nil {
-			log.Printf("pebble-serve: in-process crawler not started: %v", err)
-		}
-	}
-
-	servErr := httpSrv.ListenAndServe()
-	// wait for crawler + checkpoint goroutines to finish their
-	// final persist before the deferred ps.Close() runs. Otherwise Persist
-	// can race ps.Close() and panic.
-	crawlWG.Wait()
-	if servErr != nil && servErr != http.ErrServerClosed {
-		return servErr
-	}
-	return nil
-}
-
-// startInProcessCrawl wires the crawler-inside-serve flow. Bumps
-// srv.hnsw to a fresh empty graph if none was loaded (so dense retrieval is
-// live as soon as the first passage lands), then runs the crawler in a
-// goroutine for the server's lifetime.
-func (s *pebbleHTTP) startInProcessCrawl(ctx context.Context, ps *store.PebbleStore, seedsFile string, ckpEvery time.Duration, cfg *config.Config, wg *sync.WaitGroup) error {
-	if s.embedder == nil {
-		return errors.New("crawl requires embedder configuration (cfg.Embeddings.Model)")
-	}
-	buf, err := os.ReadFile(seedsFile)
-	if err != nil {
-		return fmt.Errorf("read seeds file: %w", err)
-	}
-	var seeds []string
-	for _, line := range strings.Split(string(buf), "\n") {
-		t := strings.TrimSpace(line)
-		if t == "" || strings.HasPrefix(t, "#") {
-			continue
-		}
-		seeds = append(seeds, t)
-	}
-	if len(seeds) == 0 {
-		return errors.New("seeds file empty after parsing")
-	}
-
-	// Ensure HNSW is non-nil so the bridge can call AddPassage. /search reads
-	// the same pointer, so growth is immediately searchable.
-	if s.hnsw == nil {
-		s.hnsw = index.NewHNSW(s.embedder.Dim())
-		log.Printf("in-serve crawler: created fresh HNSW (dim=%d)", s.embedder.Dim())
-	}
-
-	c := crawler.NewWithBackend(cfg.Crawler, ps, index.NewPebbleBM25(ps))
-	// crawler embedder is wrapped in a semaphore-throttled
-	// wrapper so the bulk crawl can never queue enough requests at
-	// ollama to starve interactive /search?retriever=dense calls.
-	// Default cap = 8 (well under OLLAMA_NUM_PARALLEL=32); operator
-	// override via COSIFT_CRAWL_EMBED_CONCURRENCY.
-	crawlEmbedCap := 8
-	if v := os.Getenv("COSIFT_CRAWL_EMBED_CONCURRENCY"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			crawlEmbedCap = n
-		}
-	}
-	// Coalesces many
-	// per-doc embed calls into one larger inner.Embed per ~20 ms window
-	// (up to maxBatch=128 texts). Search bypasses the batcher (uses
-	// s.embedder directly) so interactive latency stays sub-100 ms.
-	// Operator overrides:
-	//   COSIFT_EMBED_BATCH=128       — texts per inner call
-	//   COSIFT_EMBED_BATCH_WAIT_MS=20 — drain timer in ms
-	batchMax := 128
-	if v := os.Getenv("COSIFT_EMBED_BATCH"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			batchMax = n
-		}
-	}
-	batchWait := 20 * time.Millisecond
-	if v := os.Getenv("COSIFT_EMBED_BATCH_WAIT_MS"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			batchWait = time.Duration(n) * time.Millisecond
-		}
-	}
-	batchedEmbedder := embed.NewBatchingEmbedder(s.embedder, batchMax, batchWait)
-	crawlEmbedder := embed.NewThrottledEmbedder(batchedEmbedder, crawlEmbedCap)
-	log.Printf("pebble-serve: crawler embed = throttle(%d) → batch(max=%d, wait=%s) → round-robin → backends; search bypasses batcher",
-		crawlEmbedCap, batchMax, batchWait)
-	c = c.WithEmbedder(crawlEmbedder)
-	c = c.WithPassageWriter(&hnswPassageWriter{ps: ps, hnsw: s.hnsw})
-	// Single-node config
-	// (NumShards <= 1) makes route fn a no-op (every URL ownsLocally).
-	// s.cluster was stamped at server-init time so search-only nodes also
-	// see it; we just need the router here.
-	if cfg.Cluster.IsClustered() {
-		c = c.WithRouter(
-			func(url string) (bool, string) {
-				if cfg.Cluster.OwnsURL(url) {
-					return true, ""
-				}
-				return false, cfg.Cluster.PeerForURL(url)
-			},
-			s.forwardURLToPeer,
-		)
-		log.Printf("in-serve crawler: cluster mode (shard=%d/%d, peers=%d)",
-			cfg.Cluster.MyShardID, cfg.Cluster.NumShards, len(cfg.Cluster.Peers))
-	}
-	// Expose Seed so /admin/crawl-enqueue can hand off forwarded URLs.
-	s.crawlSeed = c.Seed
-	// expose SeedSitemap so /admin/sitemap-import can push
-	// sitemap-discovered URLs into the live frontier.
-	s.crawlSeedSitemap = c.SeedSitemap
-	// expose SeedSitemapLane so /admin/site-submit can push a whole site's
-	// URLs into a chosen priority lane (default: submitted/priority).
-	s.crawlSeedSitemapLane = c.SeedSitemapLane
-	// expose Recrawl so /admin/recrawl-sitemap can reset done/errored URLs.
-	s.crawlRecrawl = c.Recrawl
-	s.crawlSeedRSS = c.SeedRSS
-	s.crawlFetchNow = c.FetchAndIndexNow
-	s.crawlSeedWET = c.SeedWET
-	s.crawlAllowDomain = c.AddAllowedDomain
-	for _, u := range seeds {
-		// Only seed locally-owned URLs in cluster mode; the rest get forwarded.
-		if cfg.Cluster.IsClustered() && !cfg.Cluster.OwnsURL(u) {
-			if err := s.forwardURLToPeer(ctx, u, cfg.Cluster.PeerForURL(u)); err != nil {
-				log.Printf("in-serve crawler: forward initial seed %s: %v", u, err)
-			}
-			continue
-		}
-		_ = c.Seed(u)
-	}
-	log.Printf("in-serve crawler: %d seeds queued (concurrency=%d, depth=%d, checkpoint=%s)",
-		len(seeds), cfg.Crawler.MaxConcurrent, cfg.Crawler.MaxDepth, ckpEvery)
-	s.crawlActive = true
-
-	// Checkpoint goroutine: incremental persist via PersistFrom — each
-	// tick only writes nodes [lastN, n). Shutdown does a full persist
-	// from 0 so any backlinks added to older nodes get refreshed.
-	// Seeding lastN from the loaded graph means the first checkpoint
-	// after restart only writes nodes added during this run; the prior
-	// N are already on disk.
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		t := time.NewTicker(ckpEvery)
-		defer t.Stop()
-		lastN := s.hnsw.Len()
-		if lastN > 0 {
-			log.Printf("in-serve crawler: checkpoint baseline = %d nodes (loaded from disk)", lastN)
-		}
-		for {
-			select {
-			case <-ctx.Done():
-				n := s.hnsw.Len()
-				if n > 0 {
-					t0 := time.Now()
-					log.Printf("in-serve crawler: final HNSW persist at shutdown (%d nodes, full)", n)
-					if err := s.hnsw.Persist(context.Background(), ps); err != nil {
-						log.Printf("in-serve crawler: final HNSW persist failed: %v", err)
-					} else {
-						log.Printf("in-serve crawler: final HNSW persist complete in %s", time.Since(t0))
-					}
-				}
-				return
-			case <-t.C:
-				n := s.hnsw.Len()
-				if n == 0 || n == lastN {
-					continue
-				}
-				// graph can shrink (e.g., /admin/hnsw-compact rewrites
-				// indices and writes a smaller meta). When that happens, lastN
-				// from before the compaction is stale and > n; PersistFrom(lastN)
-				// would be a no-op forever, stranding any new AddPassages until
-				// shutdown. The compact handler does its own full Persist so disk
-				// is already in sync; we just need to resync lastN here.
-				if n < lastN {
-					lastN = n
-					continue
-				}
-				t0 := time.Now()
-				if err := s.hnsw.PersistFrom(context.Background(), ps, lastN); err != nil {
-					log.Printf("in-serve crawler: HNSW persist (incremental from %d) failed: %v", lastN, err)
-					continue
-				}
-				// alongside HNSW node writes, persist any newly-
-				// encoded PQ codes for nodes [lastN, n). Skipped silently
-				// when no codebook is loaded.
-				pqWritten := 0
-				if s.hnsw.HasPQ() {
-					if w, err := s.hnsw.PersistPQCodesFrom(context.Background(), ps, lastN); err != nil {
-						log.Printf("in-serve crawler: PQ codes persist failed: %v", err)
-					} else {
-						pqWritten = w
-					}
-				}
-				if pqWritten > 0 {
-					log.Printf("in-serve crawler: HNSW checkpoint at %d nodes (+%d incremental, +%d PQ codes, took %s)",
-						n, n-lastN, pqWritten, time.Since(t0))
-				} else {
-					log.Printf("in-serve crawler: HNSW checkpoint at %d nodes (+%d incremental, took %s)",
-						n, n-lastN, time.Since(t0))
-				}
-				lastN = n
-			}
-		}
-	}()
-
-	// Crawler goroutine — restarts automatically when new items appear in the
-	// frontier after a drain. This ensures that site-submit / recrawl-sitemap
-	// URLs submitted while the crawler is idle are picked up without a service
-	// restart. Poll every 5s after drain; resume as soon as queued > 0.
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		for {
-			log.Printf("in-serve crawler: starting")
-			if err := c.Run(ctx); err != nil {
-				log.Printf("in-serve crawler: exited with error: %v", err)
-				return
-			}
-			log.Printf("in-serve crawler: frontier drained, waiting for new work…")
-			// Poll until the parent context is cancelled or new items appear.
-			for {
-				select {
-				case <-ctx.Done():
-					return
-				case <-time.After(5 * time.Second):
-				}
-				fs, err := s.store.GetFrontierStats(ctx)
-				if err != nil {
-					continue
-				}
-				if fs.Queued > 0 {
-					log.Printf("in-serve crawler: %d new frontier items, restarting", fs.Queued)
-					break
-				}
-			}
-			if ctx.Err() != nil {
-				return
-			}
-		}
-	}()
-	return nil
-}
-
-// pebbleHTTP holds the read-side handles. Stays small on purpose — the
-// SQLite-side Server struct accumulated a lot of config knobs over many iters;
-// the Pebble surface starts minimal and grows feature-by-feature.
-type pebbleHTTP struct {
-	store       *store.PebbleStore
-	idx         *index.PebbleBM25
-	chat        embed.ChatClient // nil when cfg.Chat.Model is unset; /answer returns 501
-	reranker    rerank.Reranker  // nil when no rerank is configured; ?rerank=true is a no-op then
-	rerankCandK int              // candidates pulled for rerank; default 20
-
-	// Bounded LLM concurrency + circuit breaker. chatGate is shared
-	// between the answer and rerank pools so a burst on one side can't
-	// also pin the goroutines of the other (the auto-sitemap-style leak
-	// that took the box down). chatSafe wraps the answer-class client
-	// (used for /answer, planner, HyDE, paraphrase) with KindAnswer;
-	// rerankSafe wraps the per-passage scoring client with KindRerank.
-	// Nil = uninitialized (tests / mocks).
-	chatGate   *chatgate.Gate
-	chatSafe   *chatgate.SafeChat
-	rerankSafe *chatgate.SafeChat
-
-	// TTL'd response cache + singleflight for /answer. A popular query
-	// during a load spike costs one hybrid + rerank + LLM call; the
-	// next 100 callers hit the cache in microseconds OR join the
-	// in-flight call (sub-second). Disabled when ttl=0.
-	answerCache *answercache.Cache
-
-	// /research SSE stream cache. Captures and replays the full SSE byte
-	// stream so repeat research queries skip retrieval + LLM entirely.
-	researchCache *answercache.Cache
-
-	// Query log: appends one JSON line per query-endpoint request so we have
-	// real observability into what users ask, what returns empty, and latency.
-	// nil file = disabled (COSIFT_QUERY_LOG unset). See querylog.go.
-	qlogFile *os.File
-	qlogMu   sync.Mutex
-
-	// Feedback log: appends one JSON line per /feedback rating, correlated to a
-	// query by qid. The real usefulness signal (penalize/reward). See feedback.go.
-	fbFile *os.File
-	fbMu   sync.Mutex
-	// fbRL rate-limits /feedback per real client (XFF) — always on, stricter than
-	// the global limiter, since feedback is public/unauthed and abusable.
-	fbRL *rateLimiter
-
-	// Per-site docID boost map cache. key = canonical site string (e.g.
-	// "pilotprotocol.network"). Populated lazily on first site= query;
-	// subsequent calls are sub-microsecond map lookups.
-	siteBoostCache sync.Map // map[string]map[int64]float64
-
-	// Per-site page-title cache for planner context. key = canonical site
-	// string (same scheme as siteBoostCache). value = []string (<=10 titles).
-	// Populated lazily on first site= research query.
-	siteTitleCache sync.Map // map[string][]string
-
-	// Polls vLLM /metrics. When num_requests_waiting exceeds
-	// COSIFT_LLM_DEGRADE_QUEUE, optional LLM stages (rerank, HyDE,
-	// paraphrase) are silently skipped — graceful degradation rather
-	// than queue-then-timeout.
-	llmProbe *chatgate.LoadProbe
-
-	// Per-host authority Scorer; multiplies BM25 / hybrid scores by
-	// (1 + alpha * Score(host)). Wikipedia / kernel.org / arxiv float
-	// over the spam directories in the long tail of the crawl.
-	authority *authority.Scorer
-
-	// Per-endpoint latency + error-rate tracking against
-	// operator-configured targets. Violations are appended to disk
-	// (COSIFT_SLA_LOG_PATH) and surfaced on /sla.
-	sla *sla.Monitor
-
-	// hostBoosts is the operator-configured host-suffix →
-	// multiplier map, applied to fused retrieval scores by /query.
-	// Empty / nil = no boosts (fast path).
-	hostBoosts map[string]float64
-
-	// Nil = disabled.
-	rl *rateLimiter
-
-	// Empty cluster cfg = single-node, no-ops below.
-	cluster config.Cluster
-	// crawlSeed is set after startInProcessCrawl runs so /admin/crawl-enqueue
-	// can hand off forwarded URLs into the in-process frontier. Nil when no
-	// in-serve crawler is wired.
-	crawlSeed func(url string) error
-	// crawlSeedSitemap wraps Crawler.SeedSitemap so the /admin/
-	// sitemap-import endpoint can push sitemap URLs into the live frontier.
-	crawlSeedSitemap func(ctx context.Context, url string) (int, error)
-	// crawlSeedSitemapLane is like crawlSeedSitemap but lets the caller pick
-	// the frontier lane — used by /admin/site-submit to land a site's URLs
-	// in the high-priority submitted lane.
-	crawlSeedSitemapLane func(ctx context.Context, url string, lane byte) (int, error)
-	crawlSeedRSS         func(ctx context.Context, url string) (int, error)
-	crawlFetchNow        func(ctx context.Context, url string) error
-	crawlSeedWET         func(ctx context.Context, url string, dedupeFresh, lexicalOnly bool) (int, error)
-	// crawlAllowDomain promotes a domain into the crawler's runtime dynamic
-	// allowlist (used by /admin/allow-domain for organic HN/Reddit growth).
-	crawlAllowDomain func(domain string) error
-	crawlRecrawl     func(ctx context.Context, url string) error
-
-	// doc count at startup so /stats can report crawl rate
-	// without persistent counter tables. docs_added = current - startup,
-	// rate = docs_added / uptime.
-	startupDocs int
-	// crawlActive = true when in-serve crawler is running.
-	crawlActive bool
-
-	// /research?expand=true issues a
-	// chat call PER sub-query, so a sticky workload (repeated queries, slow
-	// sub-query rephrasings from the planner) hits the chat provider many
-	// times for the same passage. Cap at 256 entries; on overflow drop one
-	// arbitrary entry (Go map iteration order is randomized, good enough).
-	hydeMu       sync.RWMutex
-	hydeCache    map[string]string
-	hydeCacheCap int // env-configurable via COSIFT_HYDE_CACHE_SIZE
-
-	// PQStatus's lock contended
-	// hard with the crawler's AddPassage writers — observed /stats
-	// latency varied 0.2 s to 5.5 s. 5 s TTL keeps the cache effective
-	// for the landing page (polls every ~30 s) without serving very
-	// stale numbers.
-	//
-	// After TTL, return stale body
-	// immediately and refresh async; only the first-ever call pays the
-	// cold-cache cost. statsRefreshing is a single-flight guard so we
-	// don't fan out N background refreshes when a burst arrives stale.
-	statsBodyMu     sync.Mutex
-	statsBodyBlob   []byte
-	statsBodyAt     time.Time
-	statsRefreshing atomic.Bool
-
-	// /research?expand=paraphrase fans
-	// out 3 paraphrases × N sub-queries — same hot path as HyDE but each
-	// miss is 3x larger by output volume. Keyed on q only (fixed n=3 today).
-	paraMu       sync.RWMutex
-	paraCache    map[string][]string
-	paraCacheCap int // env-configurable via COSIFT_PARA_CACHE_SIZE
-	paraHits     atomic.Int64
-	paraMisses   atomic.Int64
-
-	// atomic counters surfaced on /metrics so operators can size the
-	// HyDE cache against a real workload — if misses dominate, raise the cap
-	// or move to an L2 store; if hits dominate at a tight working set, the
-	// cap is sufficient and you can mostly forget about it.
-	hydeHits   atomic.Int64
-	hydeMisses atomic.Int64
-
-	// snapshot at startup of whether persisted HNSW vectors exist
-	// in the 'v' family. Cheap peek (first-hit short-circuit). Surfaced on
-	// /stats so operators know whether the store is ready for the future
-	// ?retriever=dense path without needing to grep pebble-info.
-	hasVectors bool
-	// when an HNSW meta blob is persisted (the normal case),
-	// surface dim + node count too. Cheap 20-byte read at startup.
-	vectorDim   int
-	vectorNodes int
-	// Loaded
-	// only when COSIFT_LOAD_HNSW=true at startup (gigabytes RAM at scale).
-	// Nil = graph not loaded; /search?retriever=dense returns a warning.
-	hnsw *index.HNSW
-	// Required by
-	// /search?retriever=dense alongside s.hnsw. Built at startup when
-	// cfg.Embeddings.Model is set. Nil → ?retriever=dense warns + falls back.
-	embedder embed.Embedder
-
-	// Rerank failures fall back
-	// to BM25 order silently — that's the right reliability move, but without
-	// a counter operators can't tell whether their LLM/HTTP reranker is
-	// healthy or quietly broken.
-	rerankAttempts atomic.Int64
-	rerankFailures atomic.Int64
-
-	// chat call attempt + failure counters across HyDE expansion,
-	// /answer synth (sync + SSE), and /research plan + synth (sync + SSE).
-	// A spike in failures (provider 429s, network blips) is the clearest
-	// early signal that synth endpoints are degraded.
-	chatAttempts atomic.Int64
-	chatFailures atomic.Int64
-
-	// count responses that carried at least one warning.
-	// Operators alerting on this catch 'a deploy started sending malformed
-	// requests' without having to parse response bodies.
-	warningsEmitted atomic.Int64
-
-	// /metrics divides this by
-	// chatAttempts to give mean chat latency, separated from the
-	// per-endpoint duration. Diagnoses 'where did the seconds go' on a
-	// slow /research stream: chat-side or retrieval-side?
-	chatDurationNanos atomic.Int64
-
-	// per-endpoint request counters + duration sums via a
-	// counting middleware wrapping every mux entry. sync.Map keeps the hot
-	// path lock-free; /metrics reads via Range. Path is the label so a
-	// misrouted call (404) doesn't get counted under an existing endpoint.
-	// rate(sum)/rate(count) over the duration sum gives mean latency in PromQL.
-	requestCounts sync.Map // map[string]*endpointMetrics
-
-	started time.Time
-}
-
-type endpointMetrics struct {
-	count    atomic.Int64
-	sumNanos atomic.Int64
-}
-
-// count is the request-counting middleware. Bumps a per-path
-// {count, sumNanos} struct, lazily created on first request to a path. Hot
-// path is sync.Map.Load + two atomic Adds — no contention even under high
-// RPS. Duration is sampled after the handler returns so streaming endpoints
-// account for their full open connection time.
-// envIntDefault reads name as an int; falls back to def when unset or
-// unparseable. Used by gate / deadline knobs so operators can tune via
-// env without a config-file roundtrip.
-func envIntDefault(name string, def int) int {
-	if v := os.Getenv(name); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			return n
-		}
-	}
-	return def
-}
-
-// envDurationMsDefault reads name as a millisecond integer; returns def
-// on missing/invalid. Chose ms over Go's "2s" parse to keep operator
-// muscle memory consistent with the other COSIFT_*_MS knobs.
-func envDurationMsDefault(name string, def time.Duration) time.Duration {
-	if v := os.Getenv(name); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			return time.Duration(n) * time.Millisecond
-		}
-	}
-	return def
-}
-
-// rateLimiter is a per-IP token-bucket limiter. Active when
-// COSIFT_RATELIMIT_RPM > 0; nil = disabled. Whitelisted IPs bypass entirely.
-type rateLimiter struct {
-	rpm       float64
-	burst     float64
-	whitelist map[string]bool
-	buckets   sync.Map // string IP → *rateLimitBucket
-}
-
-type rateLimitBucket struct {
-	mu     sync.Mutex
-	tokens float64
-	last   time.Time
-}
-
-// newRateLimiterFromEnv reads COSIFT_RATELIMIT_RPM / _BURST / _WHITELIST.
-// Returns nil when RPM is unset or non-positive — limiting is off by default
-// so the no-config self-host story stays simple.
-func newRateLimiterFromEnv() *rateLimiter {
-	rpmStr := os.Getenv("COSIFT_RATELIMIT_RPM")
-	if rpmStr == "" {
-		return nil
-	}
-	rpm, err := strconv.ParseFloat(rpmStr, 64)
-	if err != nil || rpm <= 0 {
-		return nil
-	}
-	burst := 10.0
-	if v := os.Getenv("COSIFT_RATELIMIT_BURST"); v != "" {
-		if b, err := strconv.ParseFloat(v, 64); err == nil && b > 0 {
-			burst = b
-		}
-	}
-	wl := map[string]bool{}
-	for _, ip := range strings.Split(os.Getenv("COSIFT_RATELIMIT_WHITELIST"), ",") {
-		ip = strings.TrimSpace(ip)
-		if ip != "" {
-			wl[ip] = true
-		}
-	}
-	return &rateLimiter{rpm: rpm, burst: burst, whitelist: wl}
-}
-
-// whitelistList returns the whitelisted IPs as a slice (for logging only).
-func (rl *rateLimiter) whitelistList() []string {
-	if rl == nil {
-		return nil
-	}
-	out := make([]string, 0, len(rl.whitelist))
-	for ip := range rl.whitelist {
-		out = append(out, ip)
-	}
-	sort.Strings(out)
-	return out
-}
-
-// allow returns whether the request from ip may proceed. Side-effects: drains
-// one token from the IP's bucket on success.
-func (rl *rateLimiter) allow(ip string) bool {
-	if rl == nil {
-		return true
-	}
-	if rl.whitelist[ip] {
-		return true
-	}
-	bv, _ := rl.buckets.LoadOrStore(ip, &rateLimitBucket{tokens: rl.burst, last: time.Now()})
-	b := bv.(*rateLimitBucket)
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	now := time.Now()
-	elapsed := now.Sub(b.last).Seconds()
-	b.tokens += elapsed * rl.rpm / 60.0
-	if b.tokens > rl.burst {
-		b.tokens = rl.burst
-	}
-	b.last = now
-	if b.tokens < 1 {
-		return false
-	}
-	b.tokens--
-	return true
-}
-
-// stripPort drops ":port" from a "host:port" or "[v6]:port" RemoteAddr. Falls
-// back to the input on parse failure (so we still get SOME per-client key).
-func stripPort(remoteAddr string) string {
-	host, _, err := net.SplitHostPort(remoteAddr)
-	if err != nil {
-		return remoteAddr
-	}
-	return host
-}
-
-// rateLimit is the HTTP middleware that gates each request through the per-IP
-// limiter. Returns 429 with a JSON problem doc + Retry-After hint when the
-// bucket is empty. No-op when s.rl is nil.
-//
-// X-Forwarded-For is honored ONLY when the request came from a configured
-// trusted proxy; otherwise clients could spoof their IP by setting the header.
-// For self-host with cosift directly on the public network, leave
-// cfg.Server.TrustedProxies empty (default) and the RemoteAddr is used.
-func (s *pebbleHTTP) rateLimit(h http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		ip := stripPort(r.RemoteAddr)
-		if !s.rl.allow(ip) {
-			w.Header().Set("Retry-After", "60")
-			writeProblem(w, http.StatusTooManyRequests, "rate limit exceeded for ip="+ip)
-			return
-		}
-		h(w, r)
-	}
-}
-
-func (s *pebbleHTTP) count(h http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		key := r.URL.Path
-		v, ok := s.requestCounts.Load(key)
-		if !ok {
-			v, _ = s.requestCounts.LoadOrStore(key, &endpointMetrics{})
-		}
-		m := v.(*endpointMetrics)
-		m.count.Add(1)
-		start := time.Now()
-		// Wrap the writer so the SLA monitor knows whether the call
-		// succeeded; default status to 200 because handlers that just
-		// w.Write() never call WriteHeader explicitly.
-		sw := &statusCapturingWriter{ResponseWriter: w, status: 200}
-		h(sw, r)
-		dur := time.Since(start)
-		m.sumNanos.Add(dur.Nanoseconds())
-		if s.sla != nil {
-			s.sla.Observe(key, dur, sw.status < 500)
-		}
-	}
-}
-
-// statusCapturingWriter lets the count middleware record the response
-// status for the SLA observer. The middleware treats 5xx as failures
-// for SLA purposes; 4xx are client errors and don't count against us.
-type statusCapturingWriter struct {
-	http.ResponseWriter
-	status      int
-	wroteHeader bool
-	bytes       int64 // response body bytes — used by the query logger as an empty-result proxy
-}
-
-func (s *statusCapturingWriter) WriteHeader(code int) {
-	if !s.wroteHeader {
-		s.status = code
-		s.wroteHeader = true
-	}
-	s.ResponseWriter.WriteHeader(code)
-}
-
-func (s *statusCapturingWriter) Write(p []byte) (int, error) {
-	if !s.wroteHeader {
-		s.wroteHeader = true
-	}
-	n, err := s.ResponseWriter.Write(p)
-	s.bytes += int64(n)
-	return n, err
-}
-
-// Flush passes through to support SSE / streaming handlers.
-func (s *statusCapturingWriter) Flush() {
-	if f, ok := s.ResponseWriter.(http.Flusher); ok {
-		f.Flush()
-	}
-}
-
-//go:embed assets/landing.html
-var landingHTML []byte
-
-//go:embed assets/chat.html
-var chatHTML []byte
-
-//go:embed assets/openapi.json
-var openapiJSON []byte
-
-//go:embed assets/swagger/index.html
-var swaggerIndexHTML []byte
-
-//go:embed assets/swagger/swagger-ui.css
-var swaggerUICSS []byte
-
-//go:embed assets/swagger/swagger-ui-bundle.js
-var swaggerUIJS []byte
-
-// handleLanding serves the self-host dashboard. Only matches exact
-// "/" — Go 1.22's ServeMux routes sub-paths to the longest match, so this
-// won't accidentally swallow /search etc.
-func (s *pebbleHTTP) handleLanding(w http.ResponseWriter, r *http.Request) {
-	if r.URL.Path != "/" {
-		http.NotFound(w, r)
-		return
-	}
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Header().Set("Cache-Control", "public, max-age=60")
-	w.Write(landingHTML)
-}
-
-// handleChat serves the multi-turn chat UI. JS calls /answer
-// or /research with stream=true and renders SSE events incrementally.
-func (s *pebbleHTTP) handleChat(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Header().Set("Cache-Control", "public, max-age=60")
-	_, _ = w.Write(chatHTML)
-}
-
-func (s *pebbleHTTP) handleOpenAPI(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Cache-Control", "public, max-age=3600")
-	w.Write(openapiJSON)
-}
-
-func (s *pebbleHTTP) handleSwaggerUI(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	w.Header().Set("Cache-Control", "public, max-age=300")
-	w.Write(swaggerIndexHTML)
-}
-
-func (s *pebbleHTTP) handleSwaggerAsset(w http.ResponseWriter, r *http.Request) {
-	file := r.PathValue("file")
-	switch file {
-	case "swagger-ui.css":
-		w.Header().Set("Content-Type", "text/css")
-		w.Header().Set("Cache-Control", "public, max-age=86400")
-		w.Write(swaggerUICSS)
-	case "swagger-ui-bundle.js":
-		w.Header().Set("Content-Type", "application/javascript")
-		w.Header().Set("Cache-Control", "public, max-age=86400")
-		w.Write(swaggerUIJS)
-	default:
-		http.NotFound(w, r)
-	}
-}
-
-func (s *pebbleHTTP) handleHealthz(w http.ResponseWriter, r *http.Request) {
-	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
-}
-
-// forwardURLToPeer POSTs a URL to peer's /admin/crawl-enqueue. Best-effort:
-// caller logs failures and the URL is dropped — no retry or persistent queue.
-var forwardHTTP = &http.Client{Timeout: 10 * time.Second}
-
-func (s *pebbleHTTP) forwardURLToPeer(ctx context.Context, rawURL, peerAddr string) error {
-	body, _ := json.Marshal(crawlEnqueueReq{URL: rawURL})
-	// peerAddr is host:port; assume http inside the cluster (mTLS / VPN
-	// would be a wrapper concern). Switch to https://... if peers expose TLS.
-	endpoint := "http://" + peerAddr + "/admin/crawl-enqueue"
-	if strings.HasPrefix(peerAddr, "http://") || strings.HasPrefix(peerAddr, "https://") {
-		endpoint = strings.TrimRight(peerAddr, "/") + "/admin/crawl-enqueue"
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	if t := s.cluster.PeerAuthToken; t != "" {
-		req.Header.Set("Authorization", "Bearer "+t)
-	}
-	resp, err := forwardHTTP.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 300 {
-		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
-		return fmt.Errorf("peer %s returned %d: %s", peerAddr, resp.StatusCode, b)
-	}
-	return nil
-}
-
-// scatterSearch fans /search out to every peer with the given params,
-// collects per-peer hit lists, RRF-merges them, and returns the merged
-// top-k. Used by /search, /answer, /research gateway modes.
-// includeText forces text inlining on the scatter so callers that need
-// passages (synth endpoints) get them in one round trip.
-func (s *pebbleHTTP) scatterSearch(ctx context.Context, q string, k int, perPeerK int, params url.Values, includeText bool) (hits []searchHit, warns []string, totalCandidates int) {
-	srcQ := url.Values{}
-	for kk, vv := range params {
-		srcQ[kk] = vv
-	}
-	srcQ.Set("q", q)
-	srcQ.Set("k", strconv.Itoa(perPeerK))
-	srcQ.Set("cluster_local", "1")
-	if includeText {
-		srcQ.Set("include_text", "true")
-	}
-	queryStr := srcQ.Encode()
-
-	type peerResult struct {
-		peerIdx int
-		hits    []searchHit
-		err     error
-	}
-	resCh := make(chan peerResult, len(s.cluster.Peers))
-	httpClient := &http.Client{Timeout: 15 * time.Second}
-	for i, peer := range s.cluster.Peers {
-		if peer == "" {
-			continue
-		}
-		i, peer := i, peer
-		go func() {
-			endpoint := "http://" + peer + "/search?" + queryStr
-			if strings.HasPrefix(peer, "http://") || strings.HasPrefix(peer, "https://") {
-				endpoint = strings.TrimRight(peer, "/") + "/search?" + queryStr
-			}
-			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
-			if t := s.cluster.PeerAuthToken; t != "" {
-				req.Header.Set("Authorization", "Bearer "+t)
-			}
-			resp, err := httpClient.Do(req)
-			if err != nil {
-				resCh <- peerResult{peerIdx: i, err: err}
-				return
-			}
-			defer resp.Body.Close()
-			if resp.StatusCode >= 300 {
-				resCh <- peerResult{peerIdx: i, err: fmt.Errorf("peer %s returned %d", peer, resp.StatusCode)}
-				return
-			}
-			var sr struct {
-				Hits []searchHit `json:"hits"`
-			}
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
-			if err := json.Unmarshal(body, &sr); err != nil {
-				resCh <- peerResult{peerIdx: i, err: err}
-				return
-			}
-			resCh <- peerResult{peerIdx: i, hits: sr.Hits}
-		}()
-	}
-	lists := [][]index.Hit{}
-	hitFull := map[string]searchHit{}
-gather:
-	for i := 0; i < len(s.cluster.Peers); i++ {
-		if s.cluster.Peers[i] == "" {
-			continue
-		}
-		select {
-		case res := <-resCh:
-			if res.err != nil {
-				warns = append(warns, fmt.Sprintf("peer %d (%s) failed: %v", res.peerIdx, s.cluster.Peers[res.peerIdx], res.err))
-				continue
-			}
-			totalCandidates += len(res.hits)
-			peerList := make([]index.Hit, len(res.hits))
-			for j, h := range res.hits {
-				peerList[j] = index.Hit{URL: h.URL, Title: h.Title, Score: h.Score}
-				if _, ok := hitFull[h.URL]; !ok {
-					hitFull[h.URL] = h
-				}
-			}
-			lists = append(lists, peerList)
-		case <-ctx.Done():
-			warns = append(warns, "client context cancelled before all peers responded")
-			break gather
-		}
-	}
-	fused := rrfFuse(lists)
-	if len(fused) > k {
-		fused = fused[:k]
-	}
-	hits = make([]searchHit, 0, len(fused))
-	for _, f := range fused {
-		full, ok := hitFull[f.URL]
-		if !ok {
-			full = searchHit{URL: f.URL, Title: f.Title}
-		}
-		full.Score = f.Score
-		hits = append(hits, full)
-	}
-	return hits, warns, totalCandidates
-}
-
-// handleSearchGateway is the scatter-gather entry. It fans out the
-// search to every peer's /search (including its own shard via the peers[]
-// table), each peer over-fetches k*2 candidates locally, gateway RRF-merges
-// the per-peer lists, and returns the top-k. Slow / failing peers are
-// included in a warnings[] entry but don't block the response.
-func (s *pebbleHTTP) handleSearchGateway(w http.ResponseWriter, r *http.Request) {
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	k := 10
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
-			k = n
-		}
-	}
-	perPeerK := k * 2
-	if perPeerK < 20 {
-		perPeerK = 20
-	}
-	// delegated to shared scatterSearch helper.
-	hits, warns, total := s.scatterSearch(r.Context(), q, k, perPeerK, r.URL.Query(), r.URL.Query().Get("include_text") == "true")
-	resp := searchResponse{
-		Query:           q,
-		Retriever:       fmt.Sprintf("gateway:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
-		Hits:            hits,
-		TotalCandidates: total,
-		Warnings:        append(warns, s.warningsFor(r)...),
-		Took:            time.Since(start).String(),
-	}
-	writeJSON(w, http.StatusOK, resp)
-}
-
-// numNonEmpty counts non-empty entries in a peer list (peers[i]="" means
-// "skip", typically MyShardID).
-func numNonEmpty(ps []string) int {
-	n := 0
-	for _, p := range ps {
-		if p != "" {
-			n++
-		}
-	}
-	return n
-}
-
-// handleFindSimilarGateway scatters /find_similar to every shard. The
-// owning shard (URL-mode) or every shard (text-mode) produces real
-// neighbors; others return empty. Gateway RRF-merges.
-func (s *pebbleHTTP) handleFindSimilarGateway(w http.ResponseWriter, r *http.Request) {
-	start := time.Now()
-	k := 10
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
-			k = n
-		}
-	}
-	perPeerK := k * 2
-	if perPeerK < 20 {
-		perPeerK = 20
-	}
-	srcQ := url.Values{}
-	for kk, vv := range r.URL.Query() {
-		srcQ[kk] = vv
-	}
-	srcQ.Set("k", strconv.Itoa(perPeerK))
-	srcQ.Set("cluster_local", "1")
-	queryStr := srcQ.Encode()
-
-	type peerResult struct {
-		peerIdx int
-		hits    []searchHit
-		err     error
-	}
-	resCh := make(chan peerResult, len(s.cluster.Peers))
-	httpClient := &http.Client{Timeout: 15 * time.Second}
-	for i, peer := range s.cluster.Peers {
-		if peer == "" {
-			continue
-		}
-		i, peer := i, peer
-		go func() {
-			endpoint := "http://" + peer + "/find_similar?" + queryStr
-			if strings.HasPrefix(peer, "http://") || strings.HasPrefix(peer, "https://") {
-				endpoint = strings.TrimRight(peer, "/") + "/find_similar?" + queryStr
-			}
-			req, _ := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint, http.NoBody)
-			if t := s.cluster.PeerAuthToken; t != "" {
-				req.Header.Set("Authorization", "Bearer "+t)
-			}
-			resp, err := httpClient.Do(req)
-			if err != nil {
-				resCh <- peerResult{peerIdx: i, err: err}
-				return
-			}
-			defer resp.Body.Close()
-			if resp.StatusCode >= 300 {
-				resCh <- peerResult{peerIdx: i, err: fmt.Errorf("peer %s returned %d", peer, resp.StatusCode)}
-				return
-			}
-			var sr struct {
-				Hits []searchHit `json:"hits"`
-			}
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
-			if err := json.Unmarshal(body, &sr); err != nil {
-				resCh <- peerResult{peerIdx: i, err: err}
-				return
-			}
-			resCh <- peerResult{peerIdx: i, hits: sr.Hits}
-		}()
-	}
-	lists := [][]index.Hit{}
-	hitFull := map[string]searchHit{}
-	warns := []string{}
-	total := 0
-gather:
-	for i := 0; i < len(s.cluster.Peers); i++ {
-		if s.cluster.Peers[i] == "" {
-			continue
-		}
-		select {
-		case res := <-resCh:
-			if res.err != nil {
-				warns = append(warns, fmt.Sprintf("peer %d (%s) failed: %v", res.peerIdx, s.cluster.Peers[res.peerIdx], res.err))
-				continue
-			}
-			total += len(res.hits)
-			peerList := make([]index.Hit, len(res.hits))
-			for j, h := range res.hits {
-				peerList[j] = index.Hit{URL: h.URL, Title: h.Title, Score: h.Score}
-				if _, ok := hitFull[h.URL]; !ok {
-					hitFull[h.URL] = h
-				}
-			}
-			lists = append(lists, peerList)
-		case <-r.Context().Done():
-			warns = append(warns, "client context cancelled")
-			break gather
-		}
-	}
-	fused := rrfFuse(lists)
-	if len(fused) > k {
-		fused = fused[:k]
-	}
-	out := make([]searchHit, 0, len(fused))
-	for _, f := range fused {
-		full, ok := hitFull[f.URL]
-		if !ok {
-			full = searchHit{URL: f.URL, Title: f.Title}
-		}
-		full.Score = f.Score
-		out = append(out, full)
-	}
-	writeJSON(w, http.StatusOK, searchResponse{
-		Query:           r.URL.Query().Get("url"),
-		Retriever:       fmt.Sprintf("gateway:find_similar:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
-		Hits:            out,
-		TotalCandidates: total,
-		Warnings:        append(warns, s.warningsFor(r)...),
-		Took:            time.Since(start).String(),
-	})
-}
-
-// handleResearchGateway runs the planner on the gateway, scatters
-// each sub-query to peers (collecting RRF-merged hits with text), then
-// runs a single research synth.
-func (s *pebbleHTTP) handleResearchGateway(w http.ResponseWriter, r *http.Request) {
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented, "/research requires cfg.Chat.Model on the gateway")
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	k := 8
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
-			k = n
-		}
-	}
-	// 1. Plan via chat.
-	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: researchPlanPrompt},
-		{Role: "user", Content: q},
-	})
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
-		return
-	}
-	subs := parseSubQueries(planRaw, q)
-	if len(subs) > 5 {
-		subs = subs[:5]
-	}
-	// 2. Scatter per sub-query. Dedup by URL, keep best fused score.
-	type ranked struct {
-		score float64
-		hit   searchHit
-	}
-	best := make(map[string]ranked, k*len(subs))
-	allWarns := []string{}
-	perSub := k * 2
-	for _, sq := range subs {
-		hits, warns, _ := s.scatterSearch(r.Context(), sq, perSub, perSub, r.URL.Query(), true)
-		allWarns = append(allWarns, warns...)
-		for _, h := range hits {
-			if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
-				best[h.URL] = ranked{score: h.Score, hit: h}
-			}
-		}
-	}
-	pooled := make([]ranked, 0, len(best))
-	for _, v := range best {
-		pooled = append(pooled, v)
-	}
-	sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
-	if len(pooled) > k {
-		pooled = pooled[:k]
-	}
-	// 3. Build prompt.
-	sources := make([]answerSource, 0, len(pooled))
-	var promptSources strings.Builder
-	for i, p := range pooled {
-		src := answerSource{ID: i + 1, URL: p.hit.URL, Title: p.hit.Title, Excerpt: p.hit.Excerpt, Author: p.hit.Author, PublishedAt: p.hit.PublishedAt}
-		text := p.hit.Text
-		if text == "" {
-			text = p.hit.Excerpt
-		}
-		sources = append(sources, src)
-		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, p.hit.Title, p.hit.URL, text)
-	}
-	if len(sources) == 0 {
-		writeJSON(w, http.StatusOK, researchResponse{
-			Query: q, Plan: subs, Answer: "No matching sources across the cluster.",
-			Sources: sources, Model: s.chat.Model(),
-			Warnings: allWarns, Took: time.Since(start).String(),
-		})
-		return
-	}
-	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: researchSynthPrompt},
-		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Original question: " + q},
-	})
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, researchResponse{
-		Query: q, Plan: subs, Answer: answer, Sources: sources,
-		Model:     s.chat.Model(),
-		Retriever: fmt.Sprintf("gateway:rrf(%d-shard,%d-sub)", numNonEmpty(s.cluster.Peers), len(subs)),
-		Warnings:  allWarns, Took: time.Since(start).String(),
-	})
-}
-
-// handleAnswerGateway scatters /search across peers with include_text, runs
-// a SINGLE chat synth on the gateway.
-func (s *pebbleHTTP) handleAnswerGateway(w http.ResponseWriter, r *http.Request) {
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented, "/answer requires cfg.Chat.Model on the gateway")
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	k := 5
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
-			k = n
-		}
-	}
-	hits, warns, total := s.scatterSearch(r.Context(), q, k, k*2, r.URL.Query(), true)
-	if len(hits) == 0 {
-		writeJSON(w, http.StatusOK, answerResponse{
-			Query: q, Answer: "No matching sources across the cluster.",
-			Sources: []answerSource{}, Model: s.chat.Model(),
-			TotalCandidates: total, Warnings: warns, Took: time.Since(start).String(),
-		})
-		return
-	}
-	sources := make([]answerSource, 0, len(hits))
-	var promptSources strings.Builder
-	for i, h := range hits {
-		src := answerSource{ID: i + 1, URL: h.URL, Title: h.Title, Excerpt: h.Excerpt, Author: h.Author, PublishedAt: h.PublishedAt}
-		text := h.Text
-		if text == "" {
-			text = h.Excerpt
-		}
-		sources = append(sources, src)
-		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, h.Title, h.URL, text)
-	}
-	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: answerSystemPrompt},
-		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Question: " + q},
-	})
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, answerResponse{
-		Query: q, Answer: answer, Sources: sources, Model: s.chat.Model(),
-		Retriever:       fmt.Sprintf("gateway:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
-		TotalCandidates: total, Warnings: warns, Took: time.Since(start).String(),
-	})
-}
-
-// handlePQEncode backfills PQ codes for every node currently missing one,
-// against the codebook already loaded on this serve. Order-of-magnitude
-// faster than handlePQTrain because it skips k-means; just encode loop.
-func (s *pebbleHTTP) handlePQEncode(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.hnsw == nil {
-		writeProblem(w, http.StatusBadRequest, "pq-encode: no HNSW loaded")
-		return
-	}
-	if !s.hnsw.HasPQ() {
-		writeProblem(w, http.StatusBadRequest, "pq-encode: no codebook loaded — run /admin/pq-train first")
-		return
-	}
-	t0 := time.Now()
-	ids, codes, err := s.hnsw.EncodeMissing()
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, "encode: "+err.Error())
-		return
-	}
-	encodeElapsed := time.Since(t0)
-	if len(ids) == 0 {
-		writeJSON(w, http.StatusOK, map[string]any{
-			"encoded":       0,
-			"total":         s.hnsw.Len(),
-			"already_full":  true,
-			"total_elapsed": encodeElapsed.String(),
-		})
-		return
-	}
-	// Persist freshly-encoded codes in a single batch.
-	pq := s.hnsw.PQStatus()
-	cb := &index.PQCodebook{Dim: pq.Dim, M: pq.M, K: pq.K, SubDim: pq.Dim / pq.M}
-	entries := make([]store.PQCodeEntry, len(ids))
-	for i := range ids {
-		entries[i] = store.PQCodeEntry{ID: ids[i], Blob: cb.EncodeCodeBlob(codes[i])}
-	}
-	persistT0 := time.Now()
-	if err := s.store.PutPQCodesBatch(r.Context(), entries); err != nil {
-		writeProblem(w, http.StatusInternalServerError, "persist codes: "+err.Error())
-		return
-	}
-	persistElapsed := time.Since(persistT0)
-	total := s.hnsw.Len()
-	coverage := 100.0 * float64(pq.NodesWithCode+len(ids)) / float64(total)
-	totalElapsed := time.Since(t0)
-	log.Printf("pq-encode: backfilled %d codes in %s (persist %s, total %s) → coverage %.1f%%",
-		len(ids), encodeElapsed-persistElapsed, persistElapsed, totalElapsed, coverage)
-	writeJSON(w, http.StatusOK, map[string]any{
-		"encoded":         len(ids),
-		"total":           total,
-		"coverage_pct":    coverage,
-		"encode_elapsed":  (encodeElapsed - persistElapsed).String(),
-		"persist_elapsed": persistElapsed.String(),
-		"total_elapsed":   totalElapsed.String(),
-	})
-}
-
-// handleCheckpoint creates a Pebble checkpoint (hard-linked, point-in-time)
-// at a server-chosen path under COSIFT_CHECKPOINT_DIR (default /tmp). The
-// returned path is safe to tar — Pebble's compactor cannot mutate hard-linked
-// SSTs. Caller is responsible for deleting the dir after consuming it.
-func (s *pebbleHTTP) handleCheckpoint(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	base := os.Getenv("COSIFT_CHECKPOINT_DIR")
-	if base == "" {
-		base = "/tmp"
-	}
-	dest := filepath.Join(base, fmt.Sprintf("cosift-ckpt-%d", time.Now().UnixNano()))
-	t0 := time.Now()
-	if err := s.store.Checkpoint(dest); err != nil {
-		writeProblem(w, http.StatusInternalServerError, "checkpoint: "+err.Error())
-		return
-	}
-	elapsed := time.Since(t0)
-	log.Printf("checkpoint: created %q in %s", dest, elapsed)
-	writeJSON(w, http.StatusOK, map[string]any{
-		"path":    dest,
-		"elapsed": elapsed.String(),
-	})
-}
-
-// handlePQTrain trains a PQ codebook on a sample of the current HNSW
-// graph, then encodes ALL nodes and persists codes + codebook to Pebble.
-// Synchronous; returns when training completes.
-type pqTrainReq struct {
-	SampleSize int `json:"sample_size"` // default 50000
-	M          int `json:"m"`           // default dim/8 (subspaces of size 8)
-	K          int `json:"k"`           // default 256
-	Iters      int `json:"iters"`       // default 15
-	Parallel   int `json:"parallel"`    // default GOMAXPROCS
-}
-
-func (s *pebbleHTTP) handlePQTrain(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.hnsw == nil || s.hnsw.Len() == 0 {
-		writeProblem(w, http.StatusBadRequest, "pq-train requires an in-memory HNSW with nodes")
-		return
-	}
-	var req pqTrainReq
-	if r.ContentLength > 0 {
-		body, _ := io.ReadAll(io.LimitReader(r.Body, 4<<10))
-		_ = json.Unmarshal(body, &req)
-	}
-	if req.SampleSize <= 0 {
-		req.SampleSize = 50000
-	}
-	if req.K <= 0 {
-		req.K = 256
-	}
-	if req.Iters <= 0 {
-		req.Iters = 15
-	}
-	if req.Parallel <= 0 {
-		req.Parallel = 8
-	}
-	if s.embedder == nil {
-		writeProblem(w, http.StatusBadRequest, "pq-train needs an embedder to know the vector dim")
-		return
-	}
-	dim := s.embedder.Dim()
-	M := req.M
-	if M <= 0 {
-		// Default: 1 subspace per 8 dims. For 768d → 96 subspaces.
-		M = dim / 8
-		if M <= 0 {
-			M = 1
-		}
-	}
-	if dim%M != 0 {
-		writeProblem(w, http.StatusBadRequest, fmt.Sprintf("dim %d not divisible by M %d", dim, M))
-		return
-	}
-	t0 := time.Now()
-	log.Printf("pq-train: sampling %d / %d vectors (dim=%d, M=%d, K=%d, iters=%d, parallel=%d)",
-		req.SampleSize, s.hnsw.Len(), dim, M, req.K, req.Iters, req.Parallel)
-	sample := s.hnsw.SampleVectors(req.SampleSize, time.Now().UnixNano())
-	sampledN := len(sample)
-	log.Printf("pq-train: training codebook on %d samples...", sampledN)
-	cb, err := index.TrainPQCodebookParallel(sample, dim, M, req.K, req.Iters, req.Parallel, time.Now().UnixNano())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, "train: "+err.Error())
-		return
-	}
-	trainElapsed := time.Since(t0)
-	log.Printf("pq-train: codebook trained in %s; persisting...", trainElapsed)
-	if err := cb.Persist(r.Context(), s.store); err != nil {
-		writeProblem(w, http.StatusInternalServerError, "persist codebook: "+err.Error())
-		return
-	}
-	encodeT0 := time.Now()
-	log.Printf("pq-train: encoding %d nodes...", s.hnsw.Len())
-	ids, codes, err := s.hnsw.EncodeAll(cb)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, "encode: "+err.Error())
-		return
-	}
-	entries := make([]store.PQCodeEntry, len(ids))
-	for i := range ids {
-		// K≤256 → byte-packed for 2x disk savings.
-		entries[i] = store.PQCodeEntry{ID: ids[i], Blob: cb.EncodeCodeBlob(codes[i])}
-	}
-	if err := s.store.PutPQCodesBatch(r.Context(), entries); err != nil {
-		writeProblem(w, http.StatusInternalServerError, "put codes: "+err.Error())
-		return
-	}
-	encodeElapsed := time.Since(encodeT0)
-	totalElapsed := time.Since(t0)
-	log.Printf("pq-train: done in %s (train=%s, encode+persist=%s, %d codes written)",
-		totalElapsed, trainElapsed, encodeElapsed, len(ids))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"sample_size":    sampledN,
-		"dim":            dim,
-		"M":              M,
-		"K":              req.K,
-		"iters":          req.Iters,
-		"nodes_encoded":  len(ids),
-		"train_elapsed":  trainElapsed.String(),
-		"encode_elapsed": encodeElapsed.String(),
-		"total_elapsed":  totalElapsed.String(),
-	})
-}
-
-// handleCrawlEnqueue accepts a single URL forwarded from a peer shard and
-// pushes it onto the local crawler's frontier. Auth via cfg.Cluster.
-// PeerAuthToken Bearer header.
-type crawlEnqueueReq struct {
-	URL string `json:"url"`
-}
-
-func (s *pebbleHTTP) handleCrawlEnqueue(w http.ResponseWriter, r *http.Request) {
-	// Auth
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
-			return
-		}
-	}
-	if s.crawlSeed == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req crawlEnqueueReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"...\"}")
-		return
-	}
-	if err := s.crawlSeed(req.URL); err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"queued": req.URL})
-}
-
-// handleAllowDomain promotes a domain into the crawler's runtime dynamic
-// allowlist so subsequently-crawled URLs from it pass allowedDomain(). Used by
-// the HN/Reddit harvesters to grow the crawlable set organically once a
-// link-target domain recurs above their frequency threshold. Persisted so it
-// survives restart. Body: {"domain":"example.com"}.
-func (s *pebbleHTTP) handleAllowDomain(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
-			return
-		}
-	}
-	if s.crawlAllowDomain == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
-		return
-	}
-	var req struct {
-		Domain string `json:"domain"`
-	}
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 8<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.Domain == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"domain\": \"example.com\"}")
-		return
-	}
-	if err := s.crawlAllowDomain(req.Domain); err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"allowed": strings.ToLower(strings.TrimSpace(req.Domain))})
-}
-
-// handleFrontierClear wipes the entire frontier in a single Pebble
-// DeleteRange — every queued URL, primary + secondary index. Used when
-// the frontier is so polluted by spam-discovery crawls that
-// claim-time exclude rules can't drain it in reasonable time. Operator
-// re-seeds via seeds-file restart or /admin/sitemap-import calls.
-//
-// Sees the same PeerAuthToken as the other admin endpoints. Returns the
-// approximate count of deleted entries (DeleteRange is O(tombstones),
-// not O(N), so the count is reported as -1 to signal "swept range").
-func (s *pebbleHTTP) handleFrontierClear(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
-			return
-		}
-	}
-	if err := s.store.ClearFrontier(r.Context()); err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"cleared": true})
-}
-
-// handleFrontierPurgeHost deletes every queued frontier entry whose host
-// matches the supplied value. Used to drain blacklisted hosts that the
-// round-robin cursor would take days to chew through one-by-one (the
-// cursor visits each host once per cycle; a 5M-entry host needs 5M
-// cycles to drain, days of cycle time at typical claim rates).
-type frontierPurgeReq struct {
-	Host string `json:"host"`
-}
-
-func (s *pebbleHTTP) handleFrontierPurgeHost(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
-			return
-		}
-	}
-	var req frontierPurgeReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"host\": \"...\"}")
-		return
-	}
-	n, err := s.store.PurgeFrontierByHost(r.Context(), req.Host)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"purged": n, "host": req.Host})
-}
-
-// handleSitemapImport fetches a sitemap.xml (or sitemap-index, one level
-// of recursion) and pushes every <loc> entry to the live frontier. Same
-// auth as crawl-enqueue. Synchronous — returns when all URLs are queued.
-// For very large sitemaps (>50K URLs) the call may take seconds.
-type sitemapImportReq struct {
-	URL string `json:"url"`
-}
-
-func (s *pebbleHTTP) handleSitemapImport(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedSitemap == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req sitemapImportReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"https://.../sitemap.xml\"}")
-		return
-	}
-	t0 := time.Now()
-	n, err := s.crawlSeedSitemap(r.Context(), req.URL)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	log.Printf("sitemap-import: queued %d URLs from %s in %s", n, req.URL, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"sitemap": req.URL,
-		"queued":  n,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// handleRecrawlSitemap fetches a sitemap.xml and calls Recrawl on every URL,
-// resetting done/errored entries back to queued so the crawler re-visits them.
-// Use this when a domain was previously blocked by include rules and its frontier
-// entries are stuck in errored state — sitemap-import's INSERT OR IGNORE won't
-// re-queue them, but Recrawl will.
-func (s *pebbleHTTP) handleRecrawlSitemap(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlRecrawl == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
-		return
-	}
-	var req sitemapImportReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
-		writeProblem(w, http.StatusBadRequest, `expected {"url": "https://.../sitemap.xml"}`)
-		return
-	}
-	// Fetch and parse the sitemap.
-	hc := &http.Client{Timeout: 20 * time.Second}
-	resp, err := hc.Get(req.URL)
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "fetch sitemap: "+err.Error())
-		return
-	}
-	defer resp.Body.Close()
-	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 8<<20))
-	// Extract <loc> entries — simple text scan avoids XML namespace headaches.
-	// Handles both pretty-printed (one tag per line) and compact sitemaps
-	// where <url><loc>…</loc></url> all appear on one line.
-	t0 := time.Now()
-	var reset, skipped int
-	src := string(raw)
-	for {
-		start := strings.Index(src, "<loc>")
-		if start < 0 {
-			break
-		}
-		src = src[start+len("<loc>"):]
-		end := strings.Index(src, "</loc>")
-		if end < 0 {
-			break
-		}
-		u := strings.TrimSpace(src[:end])
-		src = src[end+len("</loc>"):]
-		if err := s.crawlRecrawl(r.Context(), u); err != nil {
-			skipped++
-		} else {
-			reset++
-		}
-	}
-	log.Printf("recrawl-sitemap: reset %d, skipped %d from %s in %s", reset, skipped, req.URL, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"sitemap": req.URL,
-		"reset":   reset,
-		"skipped": skipped,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// handleCrawlNow runs the fetch-parse-index pipeline synchronously for one
-// or more URLs, bypassing the persistent frontier entirely. Use this when
-// the round-robin cursor in a large frontier (10M+) would take hours to
-// reach an explicitly-seeded URL — direct fetch + UpsertDocument + chunk +
-// embed all happen in this request. Returns per-URL outcomes.
-type crawlNowReq struct {
-	URLs []string `json:"urls"`
-	URL  string   `json:"url,omitempty"`
-}
-
-func (s *pebbleHTTP) handleCrawlNow(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlFetchNow == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req crawlNowReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 1<<20))
-	if err := json.Unmarshal(body, &req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "expected {\"urls\":[...]} or {\"url\":\"...\"}")
-		return
-	}
-	urls := req.URLs
-	if req.URL != "" {
-		urls = append(urls, req.URL)
-	}
-	if len(urls) == 0 {
-		writeProblem(w, http.StatusBadRequest, "no URLs in body")
-		return
-	}
-	results := make([]map[string]any, 0, len(urls))
-	t0 := time.Now()
-	for _, u := range urls {
-		err := s.crawlFetchNow(r.Context(), u)
-		out := map[string]any{"url": u}
-		if err != nil {
-			out["error"] = err.Error()
-		} else {
-			out["ok"] = true
-		}
-		results = append(results, out)
-	}
-	writeJSON(w, http.StatusOK, map[string]any{
-		"results": results,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// evalQuickQueries is the canned smoke-eval set. Chosen for breadth:
-// 3 definition + 3 technical-howto + 2 comparison + 2 findability. Tracks
-// the same answered/no-info/error verdicts the external 60-Q harness uses,
-// so a regression here predicts a regression in the bigger eval. Hardcoded
-// (no new deps) so any operator can hit /admin/eval-quick and get an
-// answer rate without setting up Python or external test infra.
-var evalQuickQueries = []string{
-	"what is BM25 ranking function",
-	"what is HNSW algorithm",
-	"what is reciprocal rank fusion",
-	"how does retrieval augmented generation work",
-	"how does Go goroutines scheduling work",
-	"explain CAP theorem in distributed systems",
-	"compare BM25 vs dense vector retrieval",
-	"compare REST vs GraphQL APIs",
-	"what is Pilot Protocol overlay network",
-	"what is sentence embedding",
-}
-
-// handleEvalQuick runs the 10-query smoke eval against the running cosift
-// and returns answered-rate + per-query verdicts. Each query hits /answer
-// in-process (re-uses the same chat/retrieval stack as a real /answer call),
-// so the rate that comes back matches what users see.
-func (s *pebbleHTTP) handleEvalQuick(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented, "eval-quick requires cfg.Chat.Model")
-		return
-	}
-	// the server-wide WriteTimeout (60s) was killing this handler
-	// before 10 sequential /answer calls finished — connection closed mid-write,
-	// curl saw "empty reply from server" (exit 52). Disable the deadline for
-	// this long-running admin endpoint via ResponseController. Pairs with
-	// bounded-parallel dispatch below so the 10-query batch finishes in
-	// ~one chat-LLM round-trip instead of ten.
-	if rc := http.NewResponseController(w); rc != nil {
-		_ = rc.SetWriteDeadline(time.Time{})
-	}
-	type queryResult struct {
-		Query     string `json:"query"`
-		Verdict   string `json:"verdict"` // answered | no_info | empty | error
-		LatencyMs int    `json:"latency_ms"`
-		Sources   int    `json:"sources"`
-		Suggest   string `json:"suggest_escalation,omitempty"`
-	}
-	results := make([]queryResult, len(evalQuickQueries))
-	t0 := time.Now()
-
-	// Bounded-parallel dispatch. vLLM batches concurrent requests so 4-wide
-	// fan-out finishes in roughly one chat round-trip rather than 10.
-	sem := make(chan struct{}, 4)
-	var wg sync.WaitGroup
-	for i, q := range evalQuickQueries {
-		wg.Add(1)
-		go func(i int, q string) {
-			defer wg.Done()
-			sem <- struct{}{}
-			defer func() { <-sem }()
-			qStart := time.Now()
-			subReq, _ := http.NewRequestWithContext(r.Context(), http.MethodGet,
-				"/answer?q="+url.QueryEscape(q)+"&stream=false&retriever=hybrid", nil)
-			rec := newResponseRecorder()
-			s.handleAnswer(rec, subReq)
-			latencyMs := int(time.Since(qStart) / time.Millisecond)
-
-			var ar answerResponse
-			if jerr := json.Unmarshal(rec.body.Bytes(), &ar); jerr != nil || rec.code >= 400 {
-				results[i] = queryResult{Query: q, Verdict: "error", LatencyMs: latencyMs}
-				return
-			}
-			var verdict string
-			switch {
-			case len(ar.Answer) < 30:
-				verdict = "empty"
-			case answerLooksLikeNoInfo(ar.Answer):
-				verdict = "no_info"
-			default:
-				verdict = "answered"
-			}
-			results[i] = queryResult{
-				Query:     q,
-				Verdict:   verdict,
-				LatencyMs: latencyMs,
-				Sources:   len(ar.Sources),
-				Suggest:   ar.SuggestEscalation,
-			}
-		}(i, q)
-	}
-	wg.Wait()
-
-	answered, noInfo, errCount, empty, totalMs := 0, 0, 0, 0, 0
-	for _, r := range results {
-		totalMs += r.LatencyMs
-		switch r.Verdict {
-		case "answered":
-			answered++
-		case "no_info":
-			noInfo++
-		case "empty":
-			empty++
-		default:
-			errCount++
-		}
-	}
-	n := len(evalQuickQueries)
-	writeJSON(w, http.StatusOK, map[string]any{
-		"queries":         n,
-		"answered":        answered,
-		"no_info":         noInfo,
-		"empty":           empty,
-		"errors":          errCount,
-		"answer_rate_pct": 100 * answered / n,
-		"avg_latency_ms":  totalMs / n,
-		"total_elapsed":   time.Since(t0).String(),
-		"chat_model":      s.chat.Model(),
-		"results":         results,
-	})
-}
-
-// handleHNSWCompact runs HNSW.Compact() in-place, then clears the persisted
-// 'v' family and writes a fresh full snapshot so disk matches the compacted
-// in-memory graph. Cheaper than the offline hnsw-rebuild subcommand: Compact
-// keeps the existing topology among surviving nodes (O(N + edges)), whereas
-// Rebuild re-inserts every node via HNSW search (multiple minutes per million
-// passages). Operators run this when stats.zombie_nodes climbs above ~30% of
-// nodes_total.
-//
-// Synchronous; holds the HNSW write lock during the compact step and the
-// read lock during the persist step. Dense retrieval and AddPassage calls
-// queue for the duration. The server-wide WriteTimeout is disabled here via
-// ResponseController because compacting a multi-million-node graph routinely
-// runs past 60s. Returns counters so operators can confirm progress.
-func (s *pebbleHTTP) handleHNSWCompact(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.hnsw == nil {
-		writeProblem(w, http.StatusNotImplemented, "hnsw-compact requires a loaded HNSW graph")
-		return
-	}
-	if rc := http.NewResponseController(w); rc != nil {
-		_ = rc.SetWriteDeadline(time.Time{})
-	}
-	skipPersist := r.URL.Query().Get("skip_persist") == "1"
-
-	before := s.hnsw.Len()
-	t0 := time.Now()
-	removed := s.hnsw.Compact()
-	compactDur := time.Since(t0)
-	after := s.hnsw.Len()
-
-	resp := map[string]any{
-		"nodes_before": before,
-		"nodes_after":  after,
-		"removed":      removed,
-		"compact_ms":   compactDur.Milliseconds(),
-		"persisted":    false,
-	}
-
-	if removed == 0 || skipPersist {
-		writeJSON(w, http.StatusOK, resp)
-		return
-	}
-
-	// Compact remapped node indices; the persisted 'v' family now points at
-	// stale slots. Wipe and full-rewrite. PQ codes follow node indices too,
-	// so clear 'q' as well — operators must re-run /admin/pq-train if PQ was
-	// in use.
-	persistT0 := time.Now()
-	ctx := r.Context()
-	if err := s.store.ClearVectorFamily(ctx); err != nil {
-		resp["persist_error"] = "clear vector family: " + err.Error()
-		writeJSON(w, http.StatusInternalServerError, resp)
-		return
-	}
-	if err := s.store.ClearPQFamily(ctx); err != nil {
-		resp["persist_error"] = "clear pq family: " + err.Error()
-		writeJSON(w, http.StatusInternalServerError, resp)
-		return
-	}
-	if err := s.hnsw.Persist(ctx, s.store); err != nil {
-		resp["persist_error"] = "persist: " + err.Error()
-		writeJSON(w, http.StatusInternalServerError, resp)
-		return
-	}
-	resp["persisted"] = true
-	resp["persist_ms"] = time.Since(persistT0).Milliseconds()
-	log.Printf("hnsw-compact: removed=%d (%.1f%% zombies) compact=%s persist=%s nodes %d→%d",
-		removed, 100*float64(removed)/float64(before),
-		compactDur.Round(time.Millisecond), time.Since(persistT0).Round(time.Millisecond),
-		before, after)
-	writeJSON(w, http.StatusOK, resp)
-}
-
-// responseRecorder captures an http.Handler's output for in-process
-// dispatch. Minimal — only what handleEvalQuick needs.
-type responseRecorder struct {
-	hdr  http.Header
-	body bytes.Buffer
-	code int
-}
-
-func newResponseRecorder() *responseRecorder {
-	return &responseRecorder{hdr: make(http.Header), code: 200}
-}
-
-func (r *responseRecorder) Header() http.Header         { return r.hdr }
-func (r *responseRecorder) Write(b []byte) (int, error) { return r.body.Write(b) }
-func (r *responseRecorder) WriteHeader(c int)           { r.code = c }
-
-// handleEmbedBackfill walks famDocMeta, finds docs whose URL has zero
-// HNSW vector nodes (lexical-only ingest from WET imports, or any docs
-// indexed before an embedder was wired), and embeds them. Pairs with
-// /admin/wet-import?lexical_only=true so bulk-loaded content gets dense
-// retrieval after the fast lexical pass.
-//
-// Body: {"limit": 10000, "workers": 4}
-//   - limit:   cap on docs processed this call (0 = unlimited)
-//   - workers: concurrent embed pipelines (default 4)
-//
-// Idempotent against concurrent re-runs — re-embedding a doc that
-// already has vectors is a no-op because UpsertPassage just adds more
-// nodes pointing at the same URL (which the dedup-by-URL in
-// HNSW.Search picks the best of anyway). Cleaner: zombie-reclaim kicks
-// in to invalidate prior, then fresh vectors take over.
-type embedBackfillReq struct {
-	Limit   int `json:"limit,omitempty"`
-	Workers int `json:"workers,omitempty"`
-}
-
-// handleHostBackfill triggers the 'P' host-partition backfill IN-PROCESS, in a
-// detached background goroutine (Pebble is single-writer, so this can't run as
-// a separate process against a live store). Returns immediately; progress is
-// logged. ?host=<host> runs the fast targeted path; omit for the full corpus.
-//
-// Run this with the COSIFT_HOST_PARTITION write flag OFF so the backfill is the
-// sole writer of the 'T'/'next_host_id' families (no race with crawl indexing).
-// After it logs "done", set COSIFT_HOST_PARTITION_READ=1 (and =1 for the write
-// flag to keep it fresh) and restart.
-func (s *pebbleHTTP) handleHostBackfill(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.store == nil {
-		writeProblem(w, http.StatusNotImplemented, "host-backfill requires a PebbleStore")
-		return
-	}
-	host := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("host")))
-	// Detached context so the long backfill survives the request returning.
-	go func() {
-		t0 := time.Now()
-		scope := "full corpus"
-		if host != "" {
-			scope = "host=" + host
-		}
-		log.Printf("host-backfill: starting (%s)", scope)
-		written, err := s.store.BackfillHostPostings(context.Background(), host, func(n int64) {
-			log.Printf("host-backfill: %d postings written (%s elapsed)", n, time.Since(t0).Round(time.Second))
-		})
-		if err != nil {
-			log.Printf("host-backfill: FAILED after %d postings: %v", written, err)
-			return
-		}
-		log.Printf("host-backfill: DONE — %d postings in %s. Set COSIFT_HOST_PARTITION_READ=1 and restart.",
-			written, time.Since(t0).Round(time.Second))
-	}()
-	writeJSON(w, http.StatusAccepted, map[string]any{
-		"status": "started", "scope": host, "note": "running in background; watch server logs for progress + 'DONE'",
-	})
-}
-
-func (s *pebbleHTTP) handleEmbedBackfill(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.embedder == nil || s.hnsw == nil {
-		writeProblem(w, http.StatusNotImplemented, "embed backfill requires both an embedder and HNSW graph to be configured")
-		return
-	}
-	var req embedBackfillReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	_ = json.Unmarshal(body, &req)
-	if req.Workers <= 0 {
-		req.Workers = 4
-	}
-	if req.Workers > 32 {
-		req.Workers = 32
-	}
-
-	// Pipeline: iter docs → filter (no-vector) → chunker → embed → write.
-	// Bounded channel so we don't materialize the candidate list in memory.
-	type cand struct {
-		docID int64
-		url   string
-	}
-	candCh := make(chan cand, req.Workers*4)
-
-	t0 := time.Now()
-	var scanned, missing, embedded atomic.Int64
-
-	// Find candidates: docs with zero HNSW vectors. Producer.
-	go func() {
-		defer close(candCh)
-		_ = s.store.IterDocsLite(r.Context(), func(docID int64, url string) error {
-			scanned.Add(1)
-			if req.Limit > 0 && missing.Load() >= int64(req.Limit) {
-				return errors.New("limit reached") // sentinel — stops IterDocsLite
-			}
-			if _, ok := s.hnsw.LookupVectorByURL(url); ok {
-				return nil // already has vectors
-			}
-			missing.Add(1)
-			select {
-			case candCh <- cand{docID: docID, url: url}:
-			case <-r.Context().Done():
-				return r.Context().Err()
-			}
-			return nil
-		})
-	}()
-
-	// Worker pool: chunk + embed + write passages per doc.
-	var wg sync.WaitGroup
-	for i := 0; i < req.Workers; i++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for c := range candCh {
-				doc, err := s.store.GetDocByID(r.Context(), c.docID)
-				if err != nil || doc == nil || doc.Text == "" {
-					continue
-				}
-				// Use index defaults (NewChunker passes 0,0 = default 320/64).
-				chunker := index.NewChunker()
-				chunks := chunker.Chunk(doc.Text)
-				if len(chunks) == 0 {
-					continue
-				}
-				const tokenCap = 1500
-				texts := make([]string, len(chunks))
-				for j, ch := range chunks {
-					texts[j] = truncateForEmbedLite(ch.Text, tokenCap)
-				}
-				vecs, eErr := s.embedder.Embed(r.Context(), texts)
-				if eErr != nil || len(vecs) != len(chunks) {
-					continue
-				}
-				for j, ch := range chunks {
-					s.hnsw.AddPassage(doc.URL, doc.Title, ch.Offset, ch.Length, vecs[j])
-					_ = j
-				}
-				embedded.Add(1)
-			}
-		}()
-	}
-	wg.Wait()
-
-	log.Printf("embed-backfill: scanned=%d missing=%d embedded=%d in %s",
-		scanned.Load(), missing.Load(), embedded.Load(), time.Since(t0).Round(time.Second))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"scanned":  scanned.Load(),
-		"missing":  missing.Load(),
-		"embedded": embedded.Load(),
-		"elapsed":  time.Since(t0).String(),
-	})
-}
-
-// truncateForEmbedLite mirrors the crawler's helper without pulling the
-// crawler package in. Same heuristic: cap by approximate token count.
-func truncateForEmbedLite(s string, tokenCap int) string {
-	// Rough: 1 token ≈ 4 chars for ASCII; cap at 4×tokenCap bytes as a
-	// fast upper bound. Real chunker is at ~320 words = ~1200 tokens, so
-	// 1500-token cap rarely triggers.
-	maxBytes := tokenCap * 4
-	if len(s) <= maxBytes {
-		return s
-	}
-	return s[:maxBytes]
-}
-
-// handleSitePack discovers a site's sitemaps + RSS feeds and bulk-enqueues
-// everything found. Targets the "I want to index THIS site" operator flow
-// without editing cosift.json + restarting + waiting for the cursor.
-// Discovery order:
-//  1. GET https://<host>/robots.txt — look for `Sitemap:` directives
-//  2. Fallback to canonical /sitemap.xml + /sitemap_index.xml
-//  3. RSS at common paths: /feed, /feed.xml, /rss, /rss.xml, /atom.xml, /feed/atom
-//
-// Each found resource is run through the existing SeedSitemap / SeedRSS
-// primitives. Returns per-resource counts.
-type sitePackReq struct {
-	Host string `json:"host"` // e.g. "example.com" or "blog.example.com" — no scheme
-}
-
-func (s *pebbleHTTP) handleSitePack(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedSitemap == nil || s.crawlSeedRSS == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req sitePackReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"example.com\"}")
-		return
-	}
-	host, ok := normalizeBareHost(req.Host)
-	if !ok {
-		writeProblem(w, http.StatusBadRequest, "host must be a bare hostname like example.com")
-		return
-	}
-	base := "https://" + host
-	hc := &http.Client{Timeout: 20 * time.Second}
-
-	type result struct {
-		Source  string `json:"source"` // "robots-sitemap" | "fallback-sitemap" | "rss"
-		URL     string `json:"url"`
-		Indexed int    `json:"indexed"`
-		Error   string `json:"error,omitempty"`
-	}
-	results := make([]result, 0, 8)
-	t0 := time.Now()
-
-	candidateSitemaps, fromRobots := discoverSitemaps(r.Context(), hc, base)
-	for _, su := range candidateSitemaps {
-		n, err := s.crawlSeedSitemap(r.Context(), su)
-		res := result{URL: su, Indexed: n}
-		if fromRobots {
-			res.Source = "robots-sitemap"
-		} else {
-			res.Source = "fallback-sitemap"
-		}
-		if err != nil {
-			res.Error = err.Error()
-		}
-		results = append(results, res)
-	}
-	// Step 3: common RSS paths.
-	for _, p := range []string{"/feed", "/feed.xml", "/rss", "/rss.xml", "/atom.xml", "/feed/atom"} {
-		fu := base + p
-		n, err := s.crawlSeedRSS(r.Context(), fu)
-		// Silently skip RSS paths that 404 / don't parse — most sites have
-		// only one of the listed paths.
-		if err != nil && n == 0 {
-			continue
-		}
-		results = append(results, result{Source: "rss", URL: fu, Indexed: n})
-	}
-
-	total := 0
-	for _, r := range results {
-		total += r.Indexed
-	}
-	log.Printf("site-pack: %s discovered %d resources, enqueued %d URLs in %s",
-		host, len(results), total, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"host":          host,
-		"resources":     len(results),
-		"total_indexed": total,
-		"elapsed":       time.Since(t0).String(),
-		"results":       results,
-	})
-}
-
-// normalizeBareHost strips scheme/trailing-slash from a host or URL and
-// returns the bare hostname. ok is false when the result still contains a
-// path segment (so callers can reject "example.com/foo" as a host).
-func normalizeBareHost(s string) (host string, ok bool) {
-	host = strings.TrimSpace(s)
-	host = strings.TrimPrefix(host, "https://")
-	host = strings.TrimPrefix(host, "http://")
-	host = strings.TrimSuffix(host, "/")
-	host = strings.ToLower(host)
-	if host == "" || strings.Contains(host, "/") {
-		return "", false
-	}
-	return host, true
-}
-
-// discoverSitemaps returns candidate sitemap URLs for a site, given its base
-// origin (e.g. "https://example.com"). It prefers Sitemap: directives in
-// robots.txt; when robots.txt yields none it falls back to a small ordered
-// list of canonical/CMS paths. fromRobots reports which source was used.
-func discoverSitemaps(ctx context.Context, hc *http.Client, base string) (sitemaps []string, fromRobots bool) {
-	if hc == nil {
-		hc = &http.Client{Timeout: 20 * time.Second}
-	}
-	if req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/robots.txt", nil); err == nil {
-		if rresp, err := hc.Do(req); err == nil {
-			if rresp.StatusCode < 400 {
-				rbody, _ := io.ReadAll(io.LimitReader(rresp.Body, 2<<20))
-				for _, line := range strings.Split(string(rbody), "\n") {
-					line = strings.TrimSpace(line)
-					if strings.HasPrefix(strings.ToLower(line), "sitemap:") {
-						if val := strings.TrimSpace(line[len("sitemap:"):]); val != "" {
-							sitemaps = append(sitemaps, val)
-						}
-					}
-				}
-			}
-			rresp.Body.Close()
-		}
-	}
-	if len(sitemaps) > 0 {
-		return sitemaps, true
-	}
-	// /sitemap.xml is the canonical spec but many CMSes (WordPress, Yoast,
-	// Ghost, Hugo themes) ship at non-canonical paths. Try a small ordered
-	// list before giving up: /sitemap.xml (most common), then WordPress's
-	// /wp-sitemap.xml + Yoast's per-content-type splits, then index variants.
-	for _, p := range []string{
-		"/sitemap.xml",
-		"/wp-sitemap.xml",    // WordPress 5.5+
-		"/sitemap_index.xml", // Yoast SEO
-		"/post-sitemap.xml",  // Yoast posts
-		"/page-sitemap.xml",  // Yoast pages
-		"/sitemap-index.xml", // some CMSes hyphenate
-		"/sitemap.xml.gz",    // gzipped variant (sitemap.go handles .gz)
-	} {
-		sitemaps = append(sitemaps, base+p)
-	}
-	return sitemaps, false
-}
-
-// parseLaneName maps a friendly lane name to a frontier lane byte. The empty
-// string and unknown values default to the high-priority submitted lane,
-// which is the point of /admin/site-submit: jump a site to the front.
-func parseLaneName(s string) byte {
-	switch strings.ToLower(strings.TrimSpace(s)) {
-	case "refresh":
-		return store.LaneRefresh
-	case "discovered":
-		return store.LaneDiscovered
-	case "bulk":
-		return store.LaneBulk
-	default: // "", "priority", "submitted", or anything unrecognized
-		return store.LaneSubmitted
-	}
-}
-
-func laneName(lane byte) string {
-	switch lane {
-	case store.LaneSubmitted:
-		return "submitted"
-	case store.LaneRefresh:
-		return "refresh"
-	case store.LaneDiscovered:
-		return "discovered"
-	case store.LaneBulk:
-		return "bulk"
-	default:
-		return "submitted"
-	}
-}
-
-// handleSiteSubmit discovers every URL of a website (via robots.txt sitemaps,
-// then canonical fallbacks) and pushes them all onto the live crawl frontier
-// in a chosen priority lane — by default the high-priority "submitted" lane,
-// so the whole site jumps ahead of the generic discovery backlog. Same auth
-// as the other admin endpoints. Synchronous; large sitemaps take seconds.
-//
-// Body: {"host":"pilotprotocol.network", "lane":"priority"}
-//
-//	lane: "priority" (default) | "refresh" | "discovered" | "bulk"
-type siteSubmitReq struct {
-	Host string `json:"host"`
-	Lane string `json:"lane,omitempty"`
-}
-
-func (s *pebbleHTTP) handleSiteSubmit(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedSitemapLane == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req siteSubmitReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"example.com\", \"lane\":\"priority\"}")
-		return
-	}
-	host, ok := normalizeBareHost(req.Host)
-	if !ok {
-		writeProblem(w, http.StatusBadRequest, "host must be a bare hostname like example.com")
-		return
-	}
-	lane := parseLaneName(req.Lane)
-	base := "https://" + host
-	hc := &http.Client{Timeout: 20 * time.Second}
-	t0 := time.Now()
-
-	type result struct {
-		Source string `json:"source"` // "robots-sitemap" | "fallback-sitemap"
-		URL    string `json:"url"`
-		Queued int    `json:"queued"`
-		Error  string `json:"error,omitempty"`
-	}
-	candidateSitemaps, fromRobots := discoverSitemaps(r.Context(), hc, base)
-	source := "fallback-sitemap"
-	if fromRobots {
-		source = "robots-sitemap"
-	}
-	results := make([]result, 0, len(candidateSitemaps))
-	total := 0
-	for _, su := range candidateSitemaps {
-		n, err := s.crawlSeedSitemapLane(r.Context(), su, lane)
-		res := result{Source: source, URL: su, Queued: n}
-		if err != nil {
-			res.Error = err.Error()
-		}
-		total += n
-		results = append(results, res)
-	}
-	log.Printf("site-submit: %s → lane=%s discovered %d sitemap(s), queued %d URLs in %s",
-		host, laneName(lane), len(results), total, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"host":         host,
-		"lane":         laneName(lane),
-		"sitemaps":     len(results),
-		"total_queued": total,
-		"elapsed":      time.Since(t0).String(),
-		"results":      results,
-	})
-}
-
-// handleWETImportBulk fetches a CommonCrawl `wet.paths.gz` manifest,
-// takes the first N entries (or skip+take), and runs `/admin/wet-import`
-// against each one in parallel. Lets operators bulk-ingest a release with
-// one call instead of repeatedly POSTing per file. Synchronous — blocks
-// until all N finish, returns total docs indexed.
-//
-// Example body:
-//
-//	{"manifest_url":"https://data.commoncrawl.org/crawl-data/CC-MAIN-2024-51/wet.paths.gz",
-//	 "count":4, "skip":0, "concurrency":2, "lexical_only":true}
-type wetImportBulkReq struct {
-	ManifestURL string `json:"manifest_url"`
-	Count       int    `json:"count"`
-	Skip        int    `json:"skip,omitempty"`
-	Concurrency int    `json:"concurrency,omitempty"`
-	LexicalOnly bool   `json:"lexical_only,omitempty"`
-	DedupeFresh bool   `json:"dedupe_fresh,omitempty"`
-}
-
-func (s *pebbleHTTP) handleWETImportBulk(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedWET == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req wetImportBulkReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.ManifestURL == "" || req.Count <= 0 {
-		writeProblem(w, http.StatusBadRequest, "expected {\"manifest_url\":\"https://.../wet.paths.gz\",\"count\":N}")
-		return
-	}
-	if req.Concurrency <= 0 {
-		req.Concurrency = 2
-	}
-	if req.Concurrency > 8 {
-		req.Concurrency = 8 // beyond this the pebble write lock dominates anyway
-	}
-
-	// Fetch the manifest. wet.paths.gz is a gzipped newline-delimited list
-	// of relative paths under data.commoncrawl.org.
-	mreq, err := http.NewRequestWithContext(r.Context(), http.MethodGet, req.ManifestURL, http.NoBody)
-	if err != nil {
-		writeProblem(w, http.StatusBadRequest, "build manifest request: "+err.Error())
-		return
-	}
-	mreq.Header.Set("User-Agent", "cosift-bulk-import")
-	mresp, err := (&http.Client{Timeout: 60 * time.Second}).Do(mreq)
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "fetch manifest: "+err.Error())
-		return
-	}
-	defer mresp.Body.Close()
-	if mresp.StatusCode >= 400 {
-		writeProblem(w, http.StatusBadGateway, fmt.Sprintf("manifest http %d", mresp.StatusCode))
-		return
-	}
-	zr, err := gzip.NewReader(mresp.Body)
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "gunzip manifest: "+err.Error())
-		return
-	}
-	defer zr.Close()
-	mbody, err := io.ReadAll(io.LimitReader(zr, 32<<20))
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "read manifest: "+err.Error())
-		return
-	}
-	// Each line is a path like "crawl-data/CC-MAIN-.../wet/...warc.wet.gz".
-	// Prepend the data.commoncrawl.org base.
-	all := strings.Split(strings.TrimSpace(string(mbody)), "\n")
-	if req.Skip >= len(all) {
-		writeProblem(w, http.StatusBadRequest, fmt.Sprintf("skip=%d exceeds manifest size %d", req.Skip, len(all)))
-		return
-	}
-	end := req.Skip + req.Count
-	if end > len(all) {
-		end = len(all)
-	}
-	paths := all[req.Skip:end]
-
-	// Run imports in parallel, bounded by concurrency.
-	type result struct {
-		URL     string `json:"url"`
-		Indexed int    `json:"indexed"`
-		Elapsed string `json:"elapsed"`
-		Error   string `json:"error,omitempty"`
-	}
-	results := make([]result, len(paths))
-	sem := make(chan struct{}, req.Concurrency)
-	var wg sync.WaitGroup
-	t0 := time.Now()
-	for i, p := range paths {
-		i, p := i, strings.TrimSpace(p)
-		if p == "" {
-			continue
-		}
-		wg.Add(1)
-		sem <- struct{}{}
-		go func() {
-			defer wg.Done()
-			defer func() { <-sem }()
-			full := "https://data.commoncrawl.org/" + p
-			start := time.Now()
-			n, err := s.crawlSeedWET(r.Context(), full, req.DedupeFresh, req.LexicalOnly)
-			results[i].URL = full
-			results[i].Indexed = n
-			results[i].Elapsed = time.Since(start).Round(time.Second).String()
-			if err != nil {
-				results[i].Error = err.Error()
-			}
-		}()
-	}
-	wg.Wait()
-
-	total := 0
-	for _, r := range results {
-		total += r.Indexed
-	}
-	log.Printf("wet-import-bulk: indexed %d docs from %d WET files in %s", total, len(paths), time.Since(t0).Round(time.Second))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"manifest_url":  req.ManifestURL,
-		"files":         len(paths),
-		"total_indexed": total,
-		"elapsed":       time.Since(t0).String(),
-		"results":       results,
-	})
-}
-
-// handleWETImport streams a CommonCrawl WET file (gzipped, pre-extracted
-// plain text per URL) and runs each record through UpsertDocument + BM25
-// indexing + chunk + embed. Bypasses the fetch-and-parse pipeline entirely
-// because WET bodies are already extracted text — typically 50-100× faster
-// than open-web crawling.
-//
-// Example: POST {"url":"https://data.commoncrawl.org/crawl-data/CC-MAIN-2025-09/segments/.../wet/CC-MAIN-...wet.gz"}
-type wetImportReq struct {
-	URL         string `json:"url"`
-	DedupeFresh bool   `json:"dedupe_fresh,omitempty"` // skip URLs already-fresh in famDoc
-	LexicalOnly bool   `json:"lexical_only,omitempty"` // BM25-only ingest, defer dense embed to /admin/embed-backfill
-}
-
-func (s *pebbleHTTP) handleWETImport(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedWET == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req wetImportReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"url\":\"https://.../...warc.wet.gz\"}")
-		return
-	}
-	t0 := time.Now()
-	n, err := s.crawlSeedWET(r.Context(), req.URL, req.DedupeFresh, req.LexicalOnly)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	log.Printf("wet-import: indexed %d docs from %s in %s", n, req.URL, time.Since(t0).Round(time.Second))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"wet":     req.URL,
-		"indexed": n,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// handleFrontierDemoteHost re-keys every queued URL for a host into a
-// different lane. The escape hatch for the cloud.google.com problem:
-// 2.8M queued URLs on one host (65% of the queue) starve host-fair
-// claim slots from fresher lanes. Demote to lane 3 (bulk, 5% weight)
-// and lane 1/2 actually get the work.
-//
-// POST body: {"host": "cloud.google.com", "lane": 3}
-type frontierDemoteHostReq struct {
-	Host string `json:"host"`
-	Lane int    `json:"lane"`
-}
-
-func (s *pebbleHTTP) handleFrontierDemoteHost(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	ps, ok := any(s.store).(*store.PebbleStore)
-	if !ok {
-		writeProblem(w, http.StatusNotImplemented, "lanes are PebbleStore-only")
-		return
-	}
-	var req frontierDemoteHostReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"foo.com\",\"lane\":0..3}")
-		return
-	}
-	if req.Lane < 0 || req.Lane > 3 {
-		writeProblem(w, http.StatusBadRequest, "lane must be 0..3")
-		return
-	}
-	t0 := time.Now()
-	n, err := ps.DemoteHostToLane(r.Context(), req.Host, byte(req.Lane))
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	log.Printf("frontier-demote-host: moved %d URLs (%s -> lane %d) in %s", n, req.Host, req.Lane, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"host":    req.Host,
-		"lane":    req.Lane,
-		"moved":   n,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// handleFrontierPurgeStaleInFlight clears the stale 'i' secondary keys
-// left over from the pre-fix RecoverInFlight bug. Pre-fix, every restart
-// re-queued in-flight URLs via the LEGACY 'q' index only and skipped the
-// lane-aware 'i' delete, so each restart leaked the URL's lane-aware 'i'
-// key. GetLaneStats then reported impossibly-high in_flight counts
-// (>max_concurrent). Idempotent — re-running is a no-op once clean.
-func (s *pebbleHTTP) handleFrontierPurgeStaleInFlight(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	ps, ok := any(s.store).(*store.PebbleStore)
-	if !ok {
-		writeProblem(w, http.StatusNotImplemented, "PebbleStore-only")
-		return
-	}
-	t0 := time.Now()
-	n, err := ps.PurgeStaleInFlight(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	log.Printf("frontier-purge-stale-inflight: purged %d keys in %s", n, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{"purged": n, "elapsed": time.Since(t0).String()})
-}
-
-// handleRSSImport fetches an RSS 2.0 or Atom feed and pushes every <item>/
-// <entry> link to the live frontier. Same auth shape as sitemap-import.
-// Designed to be cron-friendly: idempotent against the frontier (re-seeding
-// the same feed only adds newly-listed items).
-type rssImportReq struct {
-	URL string `json:"url"`
-}
-
-func (s *pebbleHTTP) handleRSSImport(w http.ResponseWriter, r *http.Request) {
-	if want := s.cluster.PeerAuthToken; want != "" {
-		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
-		if got != want {
-			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
-			return
-		}
-	}
-	if s.crawlSeedRSS == nil {
-		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
-		return
-	}
-	var req rssImportReq
-	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
-	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
-		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"https://.../feed.xml\"}")
-		return
-	}
-	t0 := time.Now()
-	n, err := s.crawlSeedRSS(r.Context(), req.URL)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	log.Printf("rss-import: queued %d URLs from %s in %s", n, req.URL, time.Since(t0).Round(time.Millisecond))
-	writeJSON(w, http.StatusOK, map[string]any{
-		"feed":    req.URL,
-		"queued":  n,
-		"elapsed": time.Since(t0).String(),
-	})
-}
-
-// handleDomains returns indexed hosts by doc count.
-//
-// Query params:
-//   - top:    legacy alias for limit (capped at 500). Preserved for the
-//     landing page contract.
-//   - q:      substring filter (case-insensitive) on the host name.
-//   - offset: pagination offset (default 0).
-//   - limit:  page size (default 50, capped at 500).
-//
-// Response:
-//
-//	{"total": N, "offset": M, "limit": L, "domains": [...]}
-func (s *pebbleHTTP) handleDomains(w http.ResponseWriter, r *http.Request) {
-	q := r.URL.Query().Get("q")
-	offset := 0
-	if v := r.URL.Query().Get("offset"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
-			offset = n
-		}
-	}
-	limit := 50
-	if v := r.URL.Query().Get("limit"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
-			limit = n
-		}
-	}
-	// Legacy 'top' alias from When set, behaves like limit + no
-	// search/offset; lands as the first page.
-	if v := r.URL.Query().Get("top"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
-			limit = n
-			offset = 0
-		}
-	}
-	domains, total, err := s.store.ListDomains(r.Context(), q, offset, limit)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{
-		"total":   total,
-		"offset":  offset,
-		"limit":   limit,
-		"q":       q,
-		"domains": domains,
-	})
-}
-
-// handleQueue surfaces frontier queue depth + top-N hosts currently queued
-// for crawl. Fills the gap left by /domains, which only shows
-// already-indexed hosts.
-func (s *pebbleHTTP) handleQueue(w http.ResponseWriter, r *http.Request) {
-	topN := 25
-	if v := r.URL.Query().Get("top"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
-			topN = n
-		}
-	}
-	fs, err := s.store.GetFrontierStats(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	hosts, err := s.store.TopQueuedHosts(r.Context(), topN)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	body := map[string]any{
-		"queued":    fs.Queued,
-		"in_flight": fs.InFlight,
-		"done":      fs.Done,
-		"errored":   fs.Errored,
-		"top_hosts": hosts,
-	}
-	// Lane breakdown: PebbleStore-only (SQLite Store has no lanes). When the
-	// store is a PebbleStore, surface the per-lane queued/in_flight counts so
-	// operators can see whether the weighted RR is actually draining RSS
-	// (lane 1) ahead of bulk (lane 3).
-	if ps, ok := any(s.store).(*store.PebbleStore); ok {
-		if ls, lerr := ps.GetLaneStats(r.Context()); lerr == nil {
-			laneNames := [4]string{"submitted", "refresh", "discovered", "bulk"}
-			lanesOut := make([]map[string]any, 0, 4)
-			for i, n := range laneNames {
-				lanesOut = append(lanesOut, map[string]any{
-					"lane":      i,
-					"name":      n,
-					"queued":    ls.Lanes[i].Queued,
-					"in_flight": ls.Lanes[i].InFlight,
-				})
-			}
-			body["lanes"] = lanesOut
-			body["legacy_queued"] = ls.LegacyQueued
-			body["legacy_in_flight"] = ls.LegacyInFlight
-		}
-	}
-	writeJSON(w, http.StatusOK, body)
-}
-
-// handleDomainsAudit streams the entire 'h' family as JSONL, one
-// {host, count, authority, etld1, tld} record per line. Single pass
-// over the index — at 9M hosts on the GH200 this is ~30 seconds of
-// streaming, vs the 18000 full scans that brute-paginating /domains
-// would force. Read-only; safe to run live.
-//
-// Query params:
-//
-//	min_count=N — emit only hosts with count >= N (default 1)
-//	limit=N     — cap the number of emitted rows (default unlimited)
-//	below=F     — emit only hosts with authority score < F (filter
-//	              for the blocklist proposal stream; default 1.0)
-//	above=F     — emit only hosts with score >= F (filter for the
-//	              authority-list inspection; default 0.0)
-func (s *pebbleHTTP) handleDomainsAudit(w http.ResponseWriter, r *http.Request) {
-	minCount := 1
-	if v := r.URL.Query().Get("min_count"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			minCount = n
-		}
-	}
-	limit := -1
-	if v := r.URL.Query().Get("limit"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			limit = n
-		}
-	}
-	below := 1.0
-	if v := r.URL.Query().Get("below"); v != "" {
-		if f, err := strconv.ParseFloat(v, 64); err == nil {
-			below = f
-		}
-	}
-	above := 0.0
-	if v := r.URL.Query().Get("above"); v != "" {
-		if f, err := strconv.ParseFloat(v, 64); err == nil {
-			above = f
-		}
-	}
-	w.Header().Set("Content-Type", "application/x-ndjson")
-	w.Header().Set("Cache-Control", "no-store")
-	enc := json.NewEncoder(w)
-	emitted := 0
-	flusher, _ := w.(http.Flusher)
-	flushEvery := 256
-	err := s.store.IterateDomains(r.Context(), func(host string, count int) bool {
-		if count < minCount {
-			return true
-		}
-		var score float64 = 0.5
-		if s.authority != nil {
-			score = s.authority.Score(host)
-		}
-		if score >= below || score < above {
-			return true
-		}
-		rec := map[string]any{
-			"host":      host,
-			"count":     count,
-			"authority": score,
-			"recommend": classify(score),
-		}
-		if err := enc.Encode(rec); err != nil {
-			return false
-		}
-		emitted++
-		if limit > 0 && emitted >= limit {
-			return false
-		}
-		if flusher != nil && emitted%flushEvery == 0 {
-			flusher.Flush()
-		}
-		return true
-	})
-	if err != nil {
-		// Best-effort: log and stop; we may have already flushed
-		// partial output, so don't try to writeProblem.
-		log.Printf("handleDomainsAudit: %v", err)
-	}
-	if flusher != nil {
-		flusher.Flush()
-	}
-}
-
-// handleSLA returns the current SLA evaluation snapshot. Read-only.
-// Surfaces per-endpoint p50/p95/p99 + error rate, configured targets,
-// and the most recent violations. Operators consume this in dashboards
-// + on-call paging.
-func (s *pebbleHTTP) handleSLA(w http.ResponseWriter, _ *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Cache-Control", "no-store")
-	if s.sla == nil {
-		_, _ = w.Write([]byte(`{"enabled":false}`))
-		return
-	}
-	enc := json.NewEncoder(w)
-	enc.SetIndent("", "  ")
-	_ = enc.Encode(s.sla.Snapshot())
-}
-
-func (s *pebbleHTTP) handleStats(w http.ResponseWriter, r *http.Request) {
-	// stale-while-revalidate cache.
-	//   - Fresh hit (< TTL): return cached, X-Cache: HIT.
-	//   - Stale (have cache, past TTL but under maxStale): return cached,
-	//     X-Cache: STALE, kick a background refresh (single-flight).
-	//   - Very stale (past maxStale): fall through to synchronous compute
-	//     — protects against the case where a refresh goroutine
-	//     hangs under HNSW lock contention and the cache shows ancient
-	//     values (we saw a startup-time vec=654 served for ~15 min).
-	//   - Cold (no cache): compute synchronously, X-Cache: MISS.
-	const statsBodyTTL = 5 * time.Second
-	const statsBodyMaxStale = 60 * time.Second
-	s.statsBodyMu.Lock()
-	body := s.statsBodyBlob
-	age := time.Since(s.statsBodyAt)
-	cached := body != nil && !s.statsBodyAt.IsZero()
-	s.statsBodyMu.Unlock()
-
-	if cached && age < statsBodyTTL {
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("X-Cache", "HIT")
-		_, _ = w.Write(body)
-		return
-	}
-	if cached && age < statsBodyMaxStale {
-		if s.statsRefreshing.CompareAndSwap(false, true) {
-			go func() {
-				defer s.statsRefreshing.Store(false)
-				ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-				defer cancel()
-				if newBody, err := s.buildStatsBody(ctx); err == nil {
-					s.statsBodyMu.Lock()
-					s.statsBodyBlob = newBody
-					s.statsBodyAt = time.Now()
-					s.statsBodyMu.Unlock()
-				}
-			}()
-		}
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("X-Cache", "STALE")
-		_, _ = w.Write(body)
-		return
-	}
-
-	// Cold path: compute synchronously and populate the cache.
-	newBody, err := s.buildStatsBody(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	s.statsBodyMu.Lock()
-	s.statsBodyBlob = newBody
-	s.statsBodyAt = time.Now()
-	s.statsBodyMu.Unlock()
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("X-Cache", "MISS")
-	_, _ = w.Write(newBody)
-}
-
-// buildStatsBody collects every signal /stats surfaces and marshals it.
-// Heavy paths: PebbleStore.Stats (d-family scan, partially counter-cached
-// since), HNSW.PQStatus (O(N) under h.mu read lock that
-// contends with crawler writers). Called by handleStats both
-// synchronously (cold) and from a background goroutine (SWR refresh).
-func (s *pebbleHTTP) buildStatsBody(ctx context.Context) ([]byte, error) {
-	// /stats was observed taking 31s under load
-	// when the SWR cache exceeded maxStale: store.Stats() iterates the
-	// entire 'd' family (10.87M entries) every cold compute. The
-	// CorpusStats counter is an O(1) atomic read mirror of the persisted
-	// indexed_docs meta — equivalent doc count for any operator-facing
-	// purpose, microseconds instead of seconds. Terms isn't populated in
-	// the Pebble path (always 0) so dropping the scan loses nothing.
-	sumLen, indexedDocs, err := s.store.CorpusStats(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var avg float64
-	if indexedDocs > 0 {
-		avg = float64(sumLen) / float64(indexedDocs)
-	}
-	// surface config knobs that affect retrieval/synth quality so
-	// operators can verify env overrides took effect from one endpoint.
-	out := map[string]any{
-		"documents":    indexedDocs,
-		"terms":        int64(0),
-		"indexed_docs": indexedDocs,
-		"sum_doc_len":  sumLen,
-		"avg_doc_len":  avg,
-		"uptime":       time.Since(s.started).String(),
-		"backend":      "pebble",
-		"bm25_k1":      s.idx.K1(),
-		"bm25_b":       s.idx.B(),
-	}
-	if s.reranker != nil {
-		out["reranker"] = s.reranker.Name()
-		out["rerank_candidate_k"] = s.rerankCandK
-	}
-	if s.chat != nil {
-		out["chat_model"] = s.chat.Model()
-		// surface the cache caps so operators can verify
-		// COSIFT_HYDE_CACHE_SIZE / _PARA_CACHE_SIZE overrides took effect.
-		out["hyde_cache_size"] = s.hydeCacheCap
-		out["paraphrase_cache_size"] = s.paraCacheCap
-	}
-	// Bounded LLM concurrency + circuit-breaker state. Surfaced so
-	// operators can see whether the gate is shedding load (rejected > 0)
-	// or holding requests (in_flight = cap) and whether the breaker has
-	// tripped (state != "closed").
-	if s.chatGate != nil {
-		out["llm_gate"] = s.chatGate.Stats()
-	}
-	if s.chatSafe != nil {
-		out["llm_answer_circuit"] = s.chatSafe.CircuitState()
-	}
-	if s.rerankSafe != nil {
-		out["llm_rerank_circuit"] = s.rerankSafe.CircuitState()
-	}
-	if s.answerCache != nil {
-		out["answer_cache"] = s.answerCache.Stats()
-	}
-	if s.llmProbe != nil {
-		out["llm_load"] = s.llmProbe.Stats()
-	}
-	if s.sla != nil {
-		out["sla"] = s.sla.Snapshot()
-	}
-	if s.authority != nil {
-		out["authority"] = s.authority.Stats()
-	}
-	// embed cache hit/miss counters so operators can see how
-	// often re-fetches are skipping ollama. The cache wraps the round-
-	// robin embedder when cfg.Embeddings.CacheDir is set; type-assert
-	// down to extract the counters.
-	if ce, ok := s.embedder.(*embed.CachedEmbedder); ok {
-		hits := ce.Hits()
-		misses := ce.Misses()
-		total := hits + misses
-		hitRate := 0.0
-		if total > 0 {
-			hitRate = 100 * float64(hits) / float64(total)
-		}
-		out["embed_cache"] = map[string]any{
-			"hits":         hits,
-			"misses":       misses,
-			"hit_rate_pct": hitRate,
-		}
-	}
-	// signal whether the store has HNSW vectors persisted, and
-	// (when meta is available) surface dim + node count.
-	// when the graph is loaded in memory, report s.hnsw.Len()
-	// instead of the startup-cached vectorNodes count — otherwise /stats
-	// shows the corpus frozen in time while the in-serve crawler keeps
-	// growing the graph.
-	// "% of the indexed web" novelty stat. The web is too big to
-	// give a meaningful number, but Common Crawl's monthly snapshot is
-	// ~3.5 B unique pages — a recognizable reference point. Operators can
-	// override with COSIFT_WEB_DENOMINATOR if they want a different scale
-	// (e.g. their own intranet, a TLD slice, etc.).
-	webDenom := int64(3_500_000_000)
-	if v := os.Getenv("COSIFT_WEB_DENOMINATOR"); v != "" {
-		if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
-			webDenom = n
-		}
-	}
-	out["web_pct"] = 100.0 * float64(indexedDocs) / float64(webDenom)
-	out["web_denominator"] = webDenom
-	out["has_vectors"] = s.hasVectors
-	switch {
-	case s.hnsw != nil:
-		out["vector_nodes"] = s.hnsw.Len()
-		out["vector_dim"] = s.vectorDim
-	case s.vectorNodes > 0:
-		out["vector_nodes"] = s.vectorNodes
-		out["vector_dim"] = s.vectorDim
-	}
-	// whether the graph is loaded into memory for dense retrieval.
-	out["hnsw_loaded"] = s.hnsw != nil
-	// PQ status — operator-facing visibility into compression
-	// state. Only present when the graph is loaded; nil otherwise.
-	if s.hnsw != nil {
-		pq := s.hnsw.PQStatus()
-		// coverage is over VALID nodes (vec != nil), not raw total —
-		// zombie slots from pre partial persists inflate the total
-		// without being searchable. NodesTotal still surfaced for context.
-		denom := pq.NodesValid
-		if denom == 0 {
-			denom = pq.NodesTotal // avoid div-by-zero on a fresh load
-		}
-		coverage := 0.0
-		if denom > 0 {
-			coverage = 100 * float64(pq.NodesWithCode) / float64(denom)
-		}
-		zombies := pq.NodesTotal - pq.NodesValid
-		pqInfo := map[string]any{
-			"enabled":         pq.Enabled,
-			"nodes_with_code": pq.NodesWithCode,
-			"nodes_valid":     pq.NodesValid,
-			"nodes_total":     pq.NodesTotal,
-			"zombie_nodes":    zombies,
-			"coverage_pct":    coverage,
-		}
-		if pq.Enabled {
-			pqInfo["dim"] = pq.Dim
-			pqInfo["m"] = pq.M
-			pqInfo["k"] = pq.K
-		}
-		out["pq"] = pqInfo
-	}
-	// Clients can read
-	// this once instead of probing ?retriever=dense + parsing the warning.
-	// bm25 always — index is always available. dense/hybrid require a
-	// loaded graph; the embedder lets dense/hybrid handle text-mode and
-	// new queries. /find_similar URL-mode dense works without embedder, but
-	// that's an endpoint-specific carve-out — keep this list general.
-	retrievers := []string{"bm25", "bm25-mlt"}
-	if s.hnsw != nil && s.embedder != nil {
-		retrievers = append(retrievers, "dense", "hybrid")
-	} else if s.hnsw != nil {
-		// Graph but no embedder — only URL-mode /find_similar can use dense.
-		retrievers = append(retrievers, "dense:find_similar_url_only")
-	}
-	out["retrievers"] = retrievers
-	// crawl-rate surface for the in-serve crawler.
-	// Computes docs added since process start and per-minute rate.
-	if s.crawlActive {
-		uptimeMin := time.Since(s.started).Minutes()
-		added := int(indexedDocs) - s.startupDocs
-		if added < 0 {
-			added = 0
-		}
-		rate := 0.0
-		if uptimeMin > 0 {
-			rate = float64(added) / uptimeMin
-		}
-		out["crawl_active"] = true
-		out["docs_added_since_start"] = added
-		out["docs_per_minute"] = rate
-	}
-	return json.Marshal(out)
-}
-
-// Prometheus-format scrape endpoint. Hand-written plain text
-// (no client_golang dep) — exposition format is simple enough that
-// pulling in a dep just to print four gauges isn't justified.
-// Quantities chosen to be O(1) reads (CorpusStats counters + uptime);
-// frontier scans deliberately excluded so scrape latency stays flat
-// regardless of corpus size.
-func (s *pebbleHTTP) handleMetrics(w http.ResponseWriter, r *http.Request) {
-	sumLen, count, err := s.store.CorpusStats(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	var avg float64
-	if count > 0 {
-		avg = float64(sumLen) / float64(count)
-	}
-	uptime := time.Since(s.started).Seconds()
-	w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
-	w.WriteHeader(http.StatusOK)
-	fmt.Fprintf(w, "# HELP cosift_indexed_docs Number of documents passed through IndexDocument.\n")
-	fmt.Fprintf(w, "# TYPE cosift_indexed_docs gauge\n")
-	fmt.Fprintf(w, "cosift_indexed_docs %d\n", count)
-	fmt.Fprintf(w, "# HELP cosift_sum_doc_len_total Sum of indexed document lengths in tokens.\n")
-	fmt.Fprintf(w, "# TYPE cosift_sum_doc_len_total counter\n")
-	fmt.Fprintf(w, "cosift_sum_doc_len_total %d\n", sumLen)
-	fmt.Fprintf(w, "# HELP cosift_avg_doc_len Average document length in tokens (derived).\n")
-	fmt.Fprintf(w, "# TYPE cosift_avg_doc_len gauge\n")
-	fmt.Fprintf(w, "cosift_avg_doc_len %.2f\n", avg)
-	fmt.Fprintf(w, "# HELP cosift_uptime_seconds Seconds since pebble-serve started.\n")
-	fmt.Fprintf(w, "# TYPE cosift_uptime_seconds counter\n")
-	fmt.Fprintf(w, "cosift_uptime_seconds %.0f\n", uptime)
-	// crawl_active gauges whether
-	// the crawler goroutine is running; docs_added is monotonic
-	// since process start; docs_per_minute is the rolling rate.
-	crawlActiveGauge := 0
-	if s.crawlActive {
-		crawlActiveGauge = 1
-	}
-	fmt.Fprintf(w, "# HELP cosift_crawl_active 1 if in-serve crawler is running, 0 otherwise.\n")
-	fmt.Fprintf(w, "# TYPE cosift_crawl_active gauge\n")
-	fmt.Fprintf(w, "cosift_crawl_active %d\n", crawlActiveGauge)
-	if s.crawlActive {
-		added := count - int64(s.startupDocs)
-		if added < 0 {
-			added = 0
-		}
-		fmt.Fprintf(w, "# HELP cosift_crawl_docs_added_total Documents added by the in-serve crawler since process start.\n")
-		fmt.Fprintf(w, "# TYPE cosift_crawl_docs_added_total counter\n")
-		fmt.Fprintf(w, "cosift_crawl_docs_added_total %d\n", added)
-		rate := 0.0
-		if uptime > 0 {
-			rate = float64(added) / (uptime / 60)
-		}
-		fmt.Fprintf(w, "# HELP cosift_crawl_docs_per_minute Recent crawl rate (docs added per minute, averaged since process start).\n")
-		fmt.Fprintf(w, "# TYPE cosift_crawl_docs_per_minute gauge\n")
-		fmt.Fprintf(w, "cosift_crawl_docs_per_minute %.2f\n", rate)
-	}
-	// HyDE cache effectiveness. Hits/misses both monotonic so
-	// Prometheus rate() over these gives cache pressure under load.
-	fmt.Fprintf(w, "# HELP cosift_hyde_cache_hits_total HyDE cache hits (expandQuery served from memory).\n")
-	fmt.Fprintf(w, "# TYPE cosift_hyde_cache_hits_total counter\n")
-	fmt.Fprintf(w, "cosift_hyde_cache_hits_total %d\n", s.hydeHits.Load())
-	fmt.Fprintf(w, "# HELP cosift_hyde_cache_misses_total HyDE cache misses (expandQuery called the LLM).\n")
-	fmt.Fprintf(w, "# TYPE cosift_hyde_cache_misses_total counter\n")
-	fmt.Fprintf(w, "cosift_hyde_cache_misses_total %d\n", s.hydeMisses.Load())
-	fmt.Fprintf(w, "# HELP cosift_paraphrase_cache_hits_total Paraphrase cache hits (paraphraseQuery served from memory).\n")
-	fmt.Fprintf(w, "# TYPE cosift_paraphrase_cache_hits_total counter\n")
-	fmt.Fprintf(w, "cosift_paraphrase_cache_hits_total %d\n", s.paraHits.Load())
-	fmt.Fprintf(w, "# HELP cosift_paraphrase_cache_misses_total Paraphrase cache misses (paraphraseQuery called the LLM).\n")
-	fmt.Fprintf(w, "# TYPE cosift_paraphrase_cache_misses_total counter\n")
-	fmt.Fprintf(w, "cosift_paraphrase_cache_misses_total %d\n", s.paraMisses.Load())
-	fmt.Fprintf(w, "# HELP cosift_rerank_attempts_total Rerank calls invoked (any endpoint with ?rerank=true).\n")
-	fmt.Fprintf(w, "# TYPE cosift_rerank_attempts_total counter\n")
-	fmt.Fprintf(w, "cosift_rerank_attempts_total %d\n", s.rerankAttempts.Load())
-	fmt.Fprintf(w, "# HELP cosift_rerank_failures_total Rerank calls that returned an error (silently fell back to BM25 order).\n")
-	fmt.Fprintf(w, "# TYPE cosift_rerank_failures_total counter\n")
-	fmt.Fprintf(w, "cosift_rerank_failures_total %d\n", s.rerankFailures.Load())
-	fmt.Fprintf(w, "# HELP cosift_chat_attempts_total Chat-client calls invoked (HyDE, /answer synth, /research plan + synth).\n")
-	fmt.Fprintf(w, "# TYPE cosift_chat_attempts_total counter\n")
-	fmt.Fprintf(w, "cosift_chat_attempts_total %d\n", s.chatAttempts.Load())
-	fmt.Fprintf(w, "# HELP cosift_chat_failures_total Chat-client calls that returned an error.\n")
-	fmt.Fprintf(w, "# TYPE cosift_chat_failures_total counter\n")
-	fmt.Fprintf(w, "cosift_chat_failures_total %d\n", s.chatFailures.Load())
-	fmt.Fprintf(w, "# HELP cosift_chat_duration_seconds_sum Cumulative wall-clock spent inside chat-client calls.\n")
-	fmt.Fprintf(w, "# TYPE cosift_chat_duration_seconds_sum counter\n")
-	fmt.Fprintf(w, "cosift_chat_duration_seconds_sum %.6f\n", float64(s.chatDurationNanos.Load())/1e9)
-	fmt.Fprintf(w, "# HELP cosift_warnings_emitted_total Responses that carried at least one warning (misconfigured request).\n")
-	fmt.Fprintf(w, "# TYPE cosift_warnings_emitted_total counter\n")
-	fmt.Fprintf(w, "cosift_warnings_emitted_total %d\n", s.warningsEmitted.Load())
-	// HNSW vector index shape. Live count when graph is
-	// loaded; startup-cached otherwise.
-	vectorNodesLive := s.vectorNodes
-	if s.hnsw != nil {
-		vectorNodesLive = s.hnsw.Len()
-	}
-	if vectorNodesLive > 0 {
-		fmt.Fprintf(w, "# HELP cosift_vector_nodes Number of HNSW vector nodes in memory (or persisted when not loaded).\n")
-		fmt.Fprintf(w, "# TYPE cosift_vector_nodes gauge\n")
-		fmt.Fprintf(w, "cosift_vector_nodes %d\n", vectorNodesLive)
-		fmt.Fprintf(w, "# HELP cosift_vector_dim Embedding dimension of the persisted HNSW index.\n")
-		fmt.Fprintf(w, "# TYPE cosift_vector_dim gauge\n")
-		fmt.Fprintf(w, "cosift_vector_dim %d\n", s.vectorDim)
-	}
-	// PromQL
-	// rate(cosift_request_duration_seconds_sum) / rate(cosift_requests_total)
-	// gives mean latency in any window. Labels = path; misrouted calls (404)
-	// don't share a label with any handled path.
-	fmt.Fprintf(w, "# HELP cosift_requests_total HTTP requests served, by endpoint.\n")
-	fmt.Fprintf(w, "# TYPE cosift_requests_total counter\n")
-	fmt.Fprintf(w, "# HELP cosift_request_duration_seconds_sum Cumulative request duration, by endpoint.\n")
-	fmt.Fprintf(w, "# TYPE cosift_request_duration_seconds_sum counter\n")
-	s.requestCounts.Range(func(k, v any) bool {
-		path := k.(string)
-		m := v.(*endpointMetrics)
-		fmt.Fprintf(w, "cosift_requests_total{endpoint=%q} %d\n", path, m.count.Load())
-		fmt.Fprintf(w, "cosift_request_duration_seconds_sum{endpoint=%q} %.6f\n", path, float64(m.sumNanos.Load())/1e9)
-		return true
-	})
-}
-
-// HTTP form of `cosift verify`. Same comparison (running
-// counters vs authoritative 'l' family scan) on the already-open store, so
-// monitoring can poll without contending for the single-writer lock or
-// shelling into the container. 503 on drift makes this composable with
-// Kubernetes liveness / load-balancer health checks.
-func (s *pebbleHTTP) handleVerify(w http.ResponseWriter, r *http.Request) {
-	counterSum, counterCount, err := s.store.CorpusStats(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	scanSum, scanCount, err := s.store.SumDocLengths(r.Context())
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	driftCount := counterCount - scanCount
-	driftSum := counterSum - scanSum
-	ok := driftCount == 0 && driftSum == 0
-	body := map[string]any{
-		"ok":                   ok,
-		"indexed_docs_counter": counterCount,
-		"indexed_docs_scan":    scanCount,
-		"indexed_docs_drift":   driftCount,
-		"sum_doc_len_counter":  counterSum,
-		"sum_doc_len_scan":     scanSum,
-		"sum_doc_len_drift":    driftSum,
-	}
-	status := http.StatusOK
-	if !ok {
-		status = http.StatusServiceUnavailable
-	}
-	writeJSON(w, status, body)
-}
-
-// searchHit is the minimal hit shape returned by pebble-serve's /search.
-// Intentionally narrower than the SQLite server's SearchHit — feature
-// parity (highlight, excerpt, calibration, paragraph filters) grows as
-// follow-up iters port each one through the Pebble side.
-type searchHit struct {
-	URL         string     `json:"url"`
-	Title       string     `json:"title"`
-	Score       float64    `json:"score"`
-	Excerpt     string     `json:"excerpt,omitempty"`
-	PublishedAt *time.Time `json:"published_at,omitempty"`
-	Author      string     `json:"author,omitempty"`
-	Text        string     `json:"text,omitempty"`
-}
-
-type searchResponse struct {
-	Query           string      `json:"query"`
-	EffectiveQuery  string      `json:"effective_query,omitempty"`
-	Expand          string      `json:"expand,omitempty"`
-	Retriever       string      `json:"retriever"`
-	Hits            []searchHit `json:"hits"`
-	TotalCandidates int         `json:"total_candidates,omitempty"`
-	Warnings        []string    `json:"warnings,omitempty"`
-	Took            string      `json:"took"`
-}
-
-// POST /search with JSON body — for callers whose query lists,
-// quoted phrases, or filter CSVs are awkward to URL-encode. Decodes into a
-// searchRequest, re-encodes as r.URL.RawQuery, then calls handleSearch so
-// every param the GET form supports works identically here. The hand-off
-// shape (URL.Values) is the cosift contract — easier to keep one parser
-// than to fork it across method handlers.
-type searchRequest struct {
-	Q              string `json:"q"`
-	K              int    `json:"k,omitempty"`
-	IncludeDomains string `json:"include_domains,omitempty"`
-	ExcludeDomains string `json:"exclude_domains,omitempty"`
-	Site           string `json:"site,omitempty"`
-	Since          string `json:"since,omitempty"`
-	Until          string `json:"until,omitempty"`
-	Sort           string `json:"sort,omitempty"`
-	Enrich         *bool  `json:"enrich,omitempty"`
-	IncludeText    bool   `json:"include_text,omitempty"`
-	Rerank         bool   `json:"rerank,omitempty"`
-	Expand         string `json:"expand,omitempty"`
-}
-
-func (s *pebbleHTTP) handleSearchPOST(w http.ResponseWriter, r *http.Request) {
-	var req searchRequest
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
-		return
-	}
-	v := url.Values{}
-	if req.Q != "" {
-		v.Set("q", req.Q)
-	}
-	if req.K > 0 {
-		v.Set("k", strconv.Itoa(req.K))
-	}
-	if req.IncludeDomains != "" {
-		v.Set("include_domains", req.IncludeDomains)
-	}
-	if req.ExcludeDomains != "" {
-		v.Set("exclude_domains", req.ExcludeDomains)
-	}
-	if req.Site != "" {
-		v.Set("site", req.Site)
-	}
-	if req.Since != "" {
-		v.Set("since", req.Since)
-	}
-	if req.Until != "" {
-		v.Set("until", req.Until)
-	}
-	if req.Sort != "" {
-		v.Set("sort", req.Sort)
-	}
-	if req.Enrich != nil && !*req.Enrich {
-		v.Set("enrich", "false")
-	}
-	if req.IncludeText {
-		v.Set("include_text", "true")
-	}
-	if req.Rerank {
-		v.Set("rerank", "true")
-	}
-	if req.Expand != "" {
-		v.Set("expand", req.Expand)
-	}
-	r.URL.RawQuery = v.Encode()
-	s.handleSearch(w, r)
-}
-
-// POST variants of /find_similar, /answer, /research. Same pattern
-// as POST /search — re-encode JSON body as URL.Values, hand off to the GET
-// handler. The GET handlers own the param semantics; POST is a wire-level
-// alternative for callers whose payloads don't fit cleanly into a query string.
-
-type findSimilarRequest struct {
-	URL            string `json:"url,omitempty"`
-	Text           string `json:"text,omitempty"`  // content-based MLT, no source URL needed
-	Title          string `json:"title,omitempty"` // optional title-boost when using text mode
-	K              int    `json:"k,omitempty"`
-	Q              string `json:"q,omitempty"`
-	IncludeDomains string `json:"include_domains,omitempty"`
-	ExcludeDomains string `json:"exclude_domains,omitempty"`
-	Since          string `json:"since,omitempty"`
-	Until          string `json:"until,omitempty"`
-	IncludeText    bool   `json:"include_text,omitempty"`
-	Rerank         bool   `json:"rerank,omitempty"`
-}
-
-func (s *pebbleHTTP) handleFindSimilarPOST(w http.ResponseWriter, r *http.Request) {
-	var req findSimilarRequest
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
-		return
-	}
-	v := url.Values{}
-	if req.URL != "" {
-		v.Set("url", req.URL)
-	}
-	if req.Text != "" {
-		v.Set("text", req.Text)
-	}
-	if req.Title != "" {
-		v.Set("title", req.Title)
-	}
-	if req.K > 0 {
-		v.Set("k", strconv.Itoa(req.K))
-	}
-	if req.Q != "" {
-		v.Set("q", req.Q)
-	}
-	if req.IncludeDomains != "" {
-		v.Set("include_domains", req.IncludeDomains)
-	}
-	if req.ExcludeDomains != "" {
-		v.Set("exclude_domains", req.ExcludeDomains)
-	}
-	if req.Since != "" {
-		v.Set("since", req.Since)
-	}
-	if req.Until != "" {
-		v.Set("until", req.Until)
-	}
-	if req.IncludeText {
-		v.Set("include_text", "true")
-	}
-	if req.Rerank {
-		v.Set("rerank", "true")
-	}
-	r.URL.RawQuery = v.Encode()
-	s.handleFindSimilar(w, r)
-}
-
-type synthRequest struct {
-	Q              string `json:"q"`
-	K              int    `json:"k,omitempty"`
-	IncludeDomains string `json:"include_domains,omitempty"`
-	ExcludeDomains string `json:"exclude_domains,omitempty"`
-	Site           string `json:"site,omitempty"`
-	Since          string `json:"since,omitempty"`
-	Until          string `json:"until,omitempty"`
-	IncludeText    bool   `json:"include_text,omitempty"`
-	Rerank         bool   `json:"rerank,omitempty"`
-	Expand         string `json:"expand,omitempty"`
-	Stream         bool   `json:"stream,omitempty"`
-}
-
-func (req synthRequest) toValues() url.Values {
-	v := url.Values{}
-	if req.Q != "" {
-		v.Set("q", req.Q)
-	}
-	if req.K > 0 {
-		v.Set("k", strconv.Itoa(req.K))
-	}
-	if req.IncludeDomains != "" {
-		v.Set("include_domains", req.IncludeDomains)
-	}
-	if req.ExcludeDomains != "" {
-		v.Set("exclude_domains", req.ExcludeDomains)
-	}
-	if req.Site != "" {
-		v.Set("site", req.Site)
-	}
-	if req.Since != "" {
-		v.Set("since", req.Since)
-	}
-	if req.Until != "" {
-		v.Set("until", req.Until)
-	}
-	if req.IncludeText {
-		v.Set("include_text", "true")
-	}
-	if req.Rerank {
-		v.Set("rerank", "true")
-	}
-	if req.Expand != "" {
-		v.Set("expand", req.Expand)
-	}
-	if req.Stream {
-		v.Set("stream", "true")
-	}
-	return v
-}
-
-func (s *pebbleHTTP) handleAnswerPOST(w http.ResponseWriter, r *http.Request) {
-	var req synthRequest
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
-		return
-	}
-	r.URL.RawQuery = req.toValues().Encode()
-	s.handleAnswer(w, r)
-}
-
-func (s *pebbleHTTP) handleResearchPOST(w http.ResponseWriter, r *http.Request) {
-	var req synthRequest
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
-		return
-	}
-	r.URL.RawQuery = req.toValues().Encode()
-	s.handleResearch(w, r)
-}
-
-func (s *pebbleHTTP) handleSearch(w http.ResponseWriter, r *http.Request) {
-	// When this process is in cluster
-	// gateway-mode AND the caller hasn't already set ?cluster_local=1
-	// (which is how the gateway tells peers "just do your local search,
-	// don't fan out again"), fan out to peers and RRF-merge their results.
-	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
-		s.handleSearchGateway(w, r)
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	k := 10
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
-			k = n
-		}
-	}
-	// include_domains / exclude_domains — mirrors the
-	// SQLite-side server semantics (CSV, dot-boundary suffix match).
-	// since / until — ISO-date filters on doc.PublishedAt.
-	// When any filter is active we over-fetch so the post-filter has
-	// enough candidates to fill k; same brute-force shape SQLite used
-	// before it grew a proper index, fine at pebble-serve's scale.
-	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
-	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
-	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
-	if sinceErr != nil {
-		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
-		return
-	}
-	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
-	if untilErr != nil {
-		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
-		return
-	}
-	dateFilter := !since.IsZero() || !until.IsZero()
-	// site — scope results to one or more host[/path] sections, e.g.
-	// ?site=pilotprotocol.network/docs. Host-suffix + path-prefix match,
-	// ANDed with include/exclude. Applied post-retrieval like the domain
-	// filters, so it widens the over-fetch below.
-	sites := parseSiteScopes(r.URL.Query().Get("site"))
-	siteFilter := len(sites) > 0
-	// rerank widens both the fetch and the keep-cap before filtering,
-	// so the reranker sees a healthy candidate pool even with restrictive filters.
-	wantRerank := r.URL.Query().Get("rerank") == "true" && s.reranker != nil
-	keepCap := k
-	if wantRerank {
-		keepCap = s.rerankCandK
-		if keepCap < k {
-			keepCap = k
-		}
-	}
-	fetchK := keepCap
-	if len(include) > 0 || len(exclude) > 0 || dateFilter || siteFilter {
-		mult := 5
-		if dateFilter {
-			mult = 10
-		}
-		if siteFilter {
-			// site= uses a fixed pool regardless of k — fetching proportionally
-			// (k*100) hits the 2000-cap and spends 20s+ on BM25 for common terms.
-			// 300 candidates is enough to include a small site's relevant pages
-			// while keeping latency under ~3s even for high-frequency query terms.
-			fetchK = 300
-		} else {
-			fetchK = keepCap * mult
-			if fetchK > 500 {
-				fetchK = 500
-			}
-		}
-	} else if wantRerank {
-		fetchK = keepCap * 2
-	}
-	// expansion dispatch (bare / HyDE / paraphrase+RRF).
-	// Shared
-	// helper used by /answer + /research so all three get the same matrix.
-	// Reranker still scores against the original q regardless of strategy.
-	expandMode := r.URL.Query().Get("expand")
-	retrieverParam := r.URL.Query().Get("retriever")
-	denseReady := s.hnsw != nil && s.embedder != nil
-	hits, effectiveQuery, err := s.retrieve(r.Context(), q, fetchK, retrieverParam, expandMode)
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	// enrich each surviving hit with Excerpt + PublishedAt + Author
-	// via a single GetDocByURL per hit. Cost: k extra Gets — block-cache hot,
-	// ~ms-scale at the k≤100 we accept. Opt out with ?enrich=false for callers
-	// that only need scoring. The date filter forces a doc fetch
-	// even when enrich=false, since PublishedAt lives on the gob.
-	// ?include_text=true inlines doc.Text on each hit so research
-	// pipelines avoid the N+1 round trip to /contents. Off by default —
-	// payload size grows linearly with k and average doc length.
-	enrich := r.URL.Query().Get("enrich") != "false"
-	if wantRerank {
-		enrich = true // rerank needs per-doc text — overrides enrich opt-out
-	}
-	// time-decay multiplier needs PublishedAt per hit, which lives
-	// behind the enrich flag. Force enrich when decay is requested so the
-	// signal is available downstream.
-	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
-	if decaySet {
-		enrich = true
-	}
-	includeText := r.URL.Query().Get("include_text") == "true"
-	out := make([]searchHit, 0, keepCap)
-	var rerankTexts []string
-	if wantRerank {
-		rerankTexts = make([]string, 0, keepCap)
-	}
-	for _, h := range hits {
-		if len(include) > 0 || len(exclude) > 0 {
-			host := hostOf(h.URL)
-			if len(include) > 0 && !matchesAnyDomain(host, include) {
-				continue
-			}
-			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
-				continue
-			}
-		}
-		if siteFilter && !matchesAnySite(h.URL, sites) {
-			continue
-		}
-		hit := searchHit{URL: h.URL, Title: h.Title, Score: h.Score}
-		if enrich || dateFilter || includeText {
-			doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
-			if derr != nil || doc == nil {
-				continue
-			}
-			if dateFilter {
-				if doc.PublishedAt.IsZero() {
-					continue // zero PublishedAt = unknown; drop under any date filter
-				}
-				if !since.IsZero() && doc.PublishedAt.Before(since) {
-					continue
-				}
-				if !until.IsZero() && doc.PublishedAt.After(until) {
-					continue
-				}
-			}
-			if enrich {
-				hit.Excerpt = textExcerpt(doc.Text, 320)
-				if !doc.PublishedAt.IsZero() {
-					t := doc.PublishedAt
-					hit.PublishedAt = &t
-				}
-				hit.Author = doc.Author
-			}
-			if includeText {
-				hit.Text = doc.Text
-			}
-			if wantRerank {
-				rerankTexts = append(rerankTexts, doc.Title+"\n"+doc.Text)
-			}
-		}
-		out = append(out, hit)
-		if len(out) >= keepCap {
-			break
-		}
-	}
-	// Runs BEFORE rerank so the rerank pool
-	// reflects both quality and recency — when fetchK is over-fetched, the
-	// reranker still sees the freshest-AND-most-relevant top-N. Hits without
-	// PublishedAt are left alone (no signal, no penalty). The pool re-sort
-	// re-aligns rerankTexts via a URL→text map so both knobs compose.
-	if decaySet {
-		var textByURL map[string]string
-		if wantRerank && len(rerankTexts) == len(out) {
-			textByURL = make(map[string]string, len(out))
-			for i, h := range out {
-				textByURL[h.URL] = rerankTexts[i]
-			}
-		}
-		applyTimeDecay(out, decayHalfLife, time.Now())
-		if textByURL != nil {
-			rerankTexts = rerankTexts[:0]
-			for _, h := range out {
-				rerankTexts = append(rerankTexts, textByURL[h.URL])
-			}
-		}
-	}
-	// rerank now that we have keepCap candidates with text.
-	if wantRerank && len(out) > 1 && len(rerankTexts) == len(out) {
-		cands := make([]rerank.Candidate, len(out))
-		for i := range out {
-			cands[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: rerankTexts[i]}
-		}
-		if order, rerr := s.doRerank(r.Context(), q, cands); rerr == nil && len(order) > 0 {
-			reordered := make([]searchHit, 0, len(out))
-			seen := make(map[int]bool, len(out))
-			for _, id := range order {
-				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(out) && !seen[n] {
-					reordered = append(reordered, out[n])
-					seen[n] = true
-				}
-			}
-			// Drop nothing: if the reranker omitted any IDs, append in original order.
-			for i, h := range out {
-				if !seen[i] {
-					reordered = append(reordered, h)
-				}
-			}
-			out = reordered
-		}
-	}
-	// MMR diversification. ?mmr=<lambda> (0..1) reorders the
-	// candidate pool to balance query relevance against diversity from
-	// previously-selected hits. Requires HNSW (per-hit vectors) and an
-	// embedder when the query vector wasn't already computed by the
-	// dense/hybrid path. Composes after rerank — rerank gives quality
-	// ordering, MMR diversifies it. warningsFor() handles the silent
-	// fall-through when MMR was requested but couldn't fire.
-	if mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr")); mmrSet && len(out) > 1 && s.hnsw != nil {
-		var qVec []float32
-		// Hybrid/dense path already embedded the query — try to reuse it.
-		// For BM25-only path we need to embed q if an embedder is configured.
-		if s.embedder != nil {
-			if vecs, embErr := s.embedder.Embed(r.Context(), []string{q}); embErr == nil && len(vecs) > 0 {
-				qVec = vecs[0]
-			}
-		}
-		if len(qVec) > 0 {
-			hitVecs := make([][]float32, len(out))
-			for i := range out {
-				if v, ok := s.hnsw.LookupVectorByURL(out[i].URL); ok {
-					hitVecs[i] = v
-				}
-			}
-			out = mmrSelect(qVec, out, hitVecs, mmrLambda)
-		}
-	}
-	if len(out) > k {
-		out = out[:k]
-	}
-	// Applies to
-	// the already-collected top-k pool; raise k to widen the pool before
-	// re-sorting if you need more candidates for date ordering.
-	switch r.URL.Query().Get("sort") {
-	case "date_desc":
-		sortHitsByDate(out, false)
-	case "date_asc":
-		sortHitsByDate(out, true)
-	}
-	// label centralized in buildRetrieverLabel so /answer
-	// and /research report the same vocabulary as /search.
-	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, effectiveQuery != q, wantRerank)
-	// mmr suffix when diversification actually fired (HNSW loaded
-	// + embedder available). Same conditional as the apply site above —
-	// the label tracks the real pipeline.
-	if mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr")); mmrSet && s.hnsw != nil && s.embedder != nil && mmrLambda < 1.0 {
-		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
-	}
-	// decay suffix when time-decay was applied.
-	if decaySet {
-		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
-	}
-	resp := searchResponse{
-		Query:     q,
-		Expand:    normalizeExpandMode(expandMode),
-		Retriever: retrieverLabel,
-		Hits:      out,
-		// total_candidates = BM25 candidates considered before
-		// filter (capped at fetchK). Operators tuning over-fetch can see
-		// whether their filter is dropping a lot — when out=k but
-		// total_candidates is close to fetchK, the filter is restrictive
-		// enough that you may want to raise k or relax filters.
-		TotalCandidates: len(hits),
-		Took:            time.Since(start).String(),
-	}
-	// surface the post-HyDE query when it actually changed, so callers
-	// can debug whether expand=true contributed any extra terms or returned q
-	// unchanged (chat down, empty passage, etc).
-	if effectiveQuery != q {
-		resp.EffectiveQuery = effectiveQuery
-	}
-	resp.Warnings = s.warningsFor(r)
-	writeJSON(w, http.StatusOK, resp)
-}
-
-// sortHitsByDate orders hits by PublishedAt. Hits with no PublishedAt sink to
-// the end regardless of direction — they have no comparable value. asc=true
-// gives oldest-first; asc=false gives newest-first.
-func sortHitsByDate(hits []searchHit, asc bool) {
-	sort.SliceStable(hits, func(i, j int) bool {
-		ai := hits[i].PublishedAt != nil
-		aj := hits[j].PublishedAt != nil
-		if ai != aj {
-			return ai // hits with dates come before hits without
-		}
-		if !ai {
-			return false
-		}
-		if asc {
-			return hits[i].PublishedAt.Before(*hits[j].PublishedAt)
-		}
-		return hits[i].PublishedAt.After(*hits[j].PublishedAt)
-	})
-}
-
-// BM25-only "more like this". Mirrors EXA's /findSimilar shape but
-// stays dependency-free: no embeddings required. Algorithm is Lucene's MLT —
-// pick the source doc's top-N terms by tf·idf, build a query from them, run
-// the existing BM25 search, drop the source URL itself. With dense vectors
-// off the table on the Pebble path (HNSW indexing during crawl is the iter
-// follow-up), this is the cheapest credible /find_similar we can ship.
-func (s *pebbleHTTP) handleFindSimilar(w http.ResponseWriter, r *http.Request) {
-	// /find_similar runs locally with a
-	// known URL+vec, but in a cluster the URL's shard owns its vector and
-	// only one shard has it. We fan-out to all shards anyway: the owning
-	// shard does the real work; others either fall back to text-mode (if
-	// text supplied) or return empty.
-	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
-		s.handleFindSimilarGateway(w, r)
-		return
-	}
-	start := time.Now()
-	// accept either ?url= (existing behavior) or ?text= (content-
-	// based similarity for unindexed drafts). text path skips the source-URL
-	// exclusion since there's no source URL to exclude.
-	rawURL := r.URL.Query().Get("url")
-	rawText := r.URL.Query().Get("text")
-	if rawURL == "" && rawText == "" {
-		writeProblem(w, http.StatusBadRequest, "missing url or text parameter")
-		return
-	}
-	var srcTitle, srcText, srcURL string
-	if rawURL != "" {
-		decoded, err := url.QueryUnescape(rawURL)
-		if err != nil {
-			writeProblem(w, http.StatusBadRequest, "url parameter is not URL-encoded")
-			return
-		}
-		src, err := s.store.GetDocByURL(r.Context(), decoded)
-		if errors.Is(err, store.ErrNotFound) {
-			writeProblem(w, http.StatusNotFound, "url not in index")
-			return
-		}
-		if err != nil {
-			writeProblem(w, http.StatusInternalServerError, err.Error())
-			return
-		}
-		srcTitle, srcText, srcURL = src.Title, src.Text, src.URL
-	} else {
-		srcText = rawText
-		srcTitle = r.URL.Query().Get("title") // optional title boost when text mode
-	}
-	k := 10
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
-			k = n
-		}
-	}
-
-	// Tokenize title (×3) and body; mirror IndexDocument's title boost so
-	// title terms dominate the similarity query.
-	tf := make(map[string]int, 256)
-	for _, t := range index.Tokenize(srcTitle) {
-		tf[t] += 3
-	}
-	for _, t := range index.Tokenize(srcText) {
-		tf[t]++
-	}
-
-	_, n, _ := s.store.CorpusStats(r.Context())
-	if n <= 0 {
-		n = 1
-	}
-	logN := math.Log(float64(n))
-
-	type termScore struct {
-		term  string
-		score float64
-	}
-	scored := make([]termScore, 0, len(tf))
-	for term, freq := range tf {
-		info, ok, err := s.store.GetTermInfo(r.Context(), term)
-		if err != nil || !ok || info.DocFreq <= 0 {
-			continue
-		}
-		idf := logN - math.Log(float64(info.DocFreq))
-		if idf <= 0 {
-			continue // term appears in every doc; useless signal
-		}
-		scored = append(scored, termScore{term: term, score: float64(freq) * idf})
-	}
-	sort.Slice(scored, func(i, j int) bool { return scored[i].score > scored[j].score })
-
-	topN := 10
-	if len(scored) < topN {
-		topN = len(scored)
-	}
-	if topN == 0 {
-		// previously referenced `decoded` (only in scope in the
-		// url-mode branch) — broken since's text-mode addition.
-		// Use srcURL when present, else echo the bare text/title as the
-		// source identifier so the empty response still tells the caller
-		// what was searched.
-		emptyQuery := srcURL
-		if emptyQuery == "" {
-			emptyQuery = srcTitle
-			if emptyQuery == "" {
-				emptyQuery = srcText
-			}
-		}
-		writeJSON(w, http.StatusOK, searchResponse{
-			Query: emptyQuery, Retriever: "bm25-mlt",
-			Hits: []searchHit{}, Took: time.Since(start).String(),
-		})
-		return
-	}
-	terms := make([]string, topN)
-	for i := 0; i < topN; i++ {
-		terms[i] = scored[i].term
-	}
-	queryStr := strings.Join(terms, " ")
-	// optional ?q= augments the auto-derived MLT query so callers
-	// can constrain "more like this URL" with an extra concept (e.g.
-	// /find_similar?url=...&q=pricing). Appended verbatim — supports the
-	// same quoted-phrase shape /search accepts.
-	if extra := strings.TrimSpace(r.URL.Query().Get("q")); extra != "" {
-		queryStr = queryStr + " " + extra
-	}
-
-	// scope MLT with the same retrieval filters /search and /answer
-	// accept. 'find pages similar to X but only on docs.example.com' is the
-	// archetype EXA findSimilar shape. Over-fetch enough that the source
-	// exclusion + filter still fills k.
-	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
-	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
-	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
-	if sinceErr != nil {
-		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
-		return
-	}
-	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
-	if untilErr != nil {
-		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
-		return
-	}
-	dateFilter := !since.IsZero() || !until.IsZero()
-	includeText := r.URL.Query().Get("include_text") == "true"
-	// ?rerank=true closes /find_similar's parity gap with the other
-	// retrieval endpoints. The MLT query is auto-derived from the source doc,
-	// so reranking the candidate neighbors against THAT query is exactly what
-	// EXA's findSimilar quality boost is doing under the hood.
-	wantRerank := r.URL.Query().Get("rerank") == "true" && s.reranker != nil
-	keepCap := k
-	if wantRerank {
-		keepCap = s.rerankCandK
-		if keepCap < k {
-			keepCap = k
-		}
-	}
-	fetchK := keepCap + 1 // +1 to absorb the source-URL exclusion
-	if len(include) > 0 || len(exclude) > 0 || dateFilter {
-		mult := 5
-		if dateFilter {
-			mult = 10
-		}
-		fetchK = keepCap * mult
-		if fetchK > 500 {
-			fetchK = 500
-		}
-	} else if wantRerank {
-		fetchK = keepCap * 2
-	}
-
-	// /find_similar?retriever=dense reuses the source's
-	// persisted vector (URL-mode) or embeds the user's text (text-mode) and
-	// runs an HNSW cosine search instead of BM25-MLT. ?retriever=hybrid
-	// runs BOTH BM25-MLT and dense, then RRF-fuses — the
-	// strongest "find similar" signal: lexical precision + semantic recall.
-	//
-	// Requires COSIFT_LOAD_HNSW=true at server start (for the graph);
-	// text-mode additionally needs a configured embedder. URL-mode dense
-	// works without an embedder — the source vector is already in the graph
-	// from indexing. Missing requirements fall through to BM25-MLT;
-	// warningsFor() flags it (carves out the URL-mode-no-embedder
-	// case so the warning isn't misleading).
-	retrieverParam := r.URL.Query().Get("retriever")
-	useDense := retrieverParam == "dense" && s.hnsw != nil
-	useHybrid := retrieverParam == "hybrid" && s.hnsw != nil
-	var (
-		hits       []index.Hit
-		denseFired bool
-		bm25Fired  bool
-	)
-	// Helper: fetch the query vector (URL-mode lookup, falling back to
-	// text-mode embed when allowed). Returns ok=false when neither path
-	// produced a usable vector.
-	getQueryVec := func() ([]float32, bool) {
-		if srcURL != "" {
-			if v, ok := s.hnsw.LookupVectorByURL(srcURL); ok {
-				return v, true
-			}
-		}
-		if s.embedder != nil && (srcText != "" || srcTitle != "") {
-			seed := strings.TrimSpace(srcTitle + " " + srcText)
-			if seed != "" {
-				vecs, embErr := s.embedder.Embed(r.Context(), []string{seed})
-				if embErr == nil && len(vecs) > 0 {
-					return vecs[0], true
-				}
-			}
-		}
-		return nil, false
-	}
-	if useDense {
-		if queryVec, ok := getQueryVec(); ok {
-			vhits := s.hnsw.Search(r.Context(), queryVec, fetchK)
-			hits = make([]index.Hit, len(vhits))
-			for i, vh := range vhits {
-				hits[i] = index.Hit{URL: vh.URL, Title: vh.Title, Score: vh.Score}
-			}
-			denseFired = true
-		}
-	} else if useHybrid {
-		// Run BM25-MLT and dense in series; RRF-fuse the two ranked lists.
-		// Each retriever votes fetchK candidates so the fused top-fetchK has
-		// room to balance both signals before filter/enrich/rerank.
-		bm25Hits, bm25Err := s.idx.Search(r.Context(), queryStr, fetchK)
-		if bm25Err != nil {
-			writeProblem(w, http.StatusInternalServerError, bm25Err.Error())
-			return
-		}
-		bm25Fired = true
-		if queryVec, ok := getQueryVec(); ok {
-			vhits := s.hnsw.Search(r.Context(), queryVec, fetchK)
-			denseHits := s.applyAuthorityToDense(vhits)
-			hits = rrfFuse([][]index.Hit{bm25Hits, denseHits})
-			if len(hits) > fetchK {
-				hits = hits[:fetchK]
-			}
-			denseFired = true
-		} else {
-			// Hybrid fell through to BM25-only (e.g. text-mode + no embedder).
-			// Keep the BM25 hits we already paid for.
-			hits = bm25Hits
-		}
-	}
-	if !denseFired && !bm25Fired {
-		var err error
-		hits, err = s.idx.Search(r.Context(), queryStr, fetchK)
-		if err != nil {
-			writeProblem(w, http.StatusInternalServerError, err.Error())
-			return
-		}
-	}
-	type fsCand struct {
-		hit        searchHit
-		rerankText string
-	}
-	cands := make([]fsCand, 0, keepCap)
-	for _, h := range hits {
-		if srcURL != "" && h.URL == srcURL {
-			continue
-		}
-		if len(include) > 0 || len(exclude) > 0 {
-			host := hostOf(h.URL)
-			if len(include) > 0 && !matchesAnyDomain(host, include) {
-				continue
-			}
-			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
-				continue
-			}
-		}
-		hit := searchHit{URL: h.URL, Title: h.Title, Score: h.Score}
-		doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
-		if derr != nil || doc == nil {
-			continue
-		}
-		if dateFilter {
-			if doc.PublishedAt.IsZero() {
-				continue
-			}
-			if !since.IsZero() && doc.PublishedAt.Before(since) {
-				continue
-			}
-			if !until.IsZero() && doc.PublishedAt.After(until) {
-				continue
-			}
-		}
-		hit.Excerpt = textExcerpt(doc.Text, 320)
-		if !doc.PublishedAt.IsZero() {
-			t := doc.PublishedAt
-			hit.PublishedAt = &t
-		}
-		hit.Author = doc.Author
-		if includeText {
-			hit.Text = doc.Text
-		}
-		c := fsCand{hit: hit}
-		if wantRerank {
-			c.rerankText = doc.Title + "\n" + doc.Text
-		}
-		cands = append(cands, c)
-		if len(cands) >= keepCap {
-			break
-		}
-	}
-	// Same pre-rerank placement as
-	// /search — re-sort cands by adjusted score so rerank sees a freshness-
-	// aware pool. Re-aligns rerankText too via URL→text map.
-	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
-	if decaySet && len(cands) > 0 {
-		now := time.Now()
-		for i := range cands {
-			cands[i].hit.Score *= decayMultiplier(cands[i].hit.PublishedAt, now, decayHalfLife)
-		}
-		sort.SliceStable(cands, func(i, j int) bool { return cands[i].hit.Score > cands[j].hit.Score })
-	}
-	if wantRerank && len(cands) > 1 {
-		rc := make([]rerank.Candidate, len(cands))
-		for i := range cands {
-			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
-		}
-		if order, rerr := s.doRerank(r.Context(), queryStr, rc); rerr == nil && len(order) > 0 {
-			reordered := make([]fsCand, 0, len(cands))
-			seen := make(map[int]bool, len(cands))
-			for _, id := range order {
-				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
-					reordered = append(reordered, cands[n])
-					seen[n] = true
-				}
-			}
-			for i, c := range cands {
-				if !seen[i] {
-					reordered = append(reordered, c)
-				}
-			}
-			cands = reordered
-		}
-	}
-	// MMR diversification on /find_similar. Anchored at the
-	// source vector — URL-mode reuses the persisted vec, text-mode embeds
-	// the seed via getQueryVec (defined above for dense/hybrid dispatch).
-	// Without an explicit user query, the source IS the query — this is
-	// the right anchor for "find similar but diverse".
-	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
-	mmrFired := false
-	if mmrSet && len(cands) > 1 && s.hnsw != nil {
-		if qVec, ok := getQueryVec(); ok {
-			hitVecs := make([][]float32, len(cands))
-			for i, c := range cands {
-				if v, vok := s.hnsw.LookupVectorByURL(c.hit.URL); vok {
-					hitVecs[i] = v
-				}
-			}
-			order := mmrOrder(qVec, hitVecs, mmrLambda)
-			if order != nil {
-				reordered := make([]fsCand, len(order))
-				for i, idx := range order {
-					reordered[i] = cands[idx]
-				}
-				cands = reordered
-				mmrFired = true
-			}
-		}
-	}
-	if len(cands) > k {
-		cands = cands[:k]
-	}
-	out := make([]searchHit, 0, len(cands))
-	for _, c := range cands {
-		out = append(out, c.hit)
-	}
-	// label tracks which retrievers actually fired.
-	//   bm25-mlt              — default, BM25 only
-	//   dense                 — ?retriever=dense fired (graph + vec found)
-	//   bm25-mlt+dense:rrf    — ?retriever=hybrid, both BM25 and dense fired
-	// If dense was requested but fell through (no graph, no vec), the label
-	// stays bm25-mlt and warningsFor() carries the reason.
-	retrieverLabel := "bm25-mlt"
-	switch {
-	case bm25Fired && denseFired:
-		retrieverLabel = "bm25-mlt+dense:rrf"
-	case denseFired:
-		retrieverLabel = "dense"
-	}
-	if wantRerank {
-		retrieverLabel += "+rerank:" + s.reranker.Name()
-	}
-	if mmrFired {
-		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
-	}
-	if decaySet {
-		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
-	}
-	writeJSON(w, http.StatusOK, searchResponse{
-		Query:           queryStr,
-		Retriever:       retrieverLabel,
-		Hits:            out,
-		TotalCandidates: len(hits),
-		Warnings:        s.warningsFor(r),
-		Took:            time.Since(start).String(),
-	})
-}
-
-// /answer — synthesis over BM25 retrieval. Mirrors the SQLite-side
-// /answer in spirit (top-k sources → cited synthesis) but stays minimal: no
-// streaming, no rerank, no query expansion. Those land in follow-up iters
-// once this surface is exercised. Returns 501 when no chat model is
-// configured so the absent capability fails loud instead of silent.
-const answerSystemPrompt = `You are a research assistant. Answer the user's question using the provided sources.
-- Cite sources by their numeric id in square brackets, e.g. [1] or [2,3]. Every factual claim needs a citation.
-- Synthesize the answer from what the sources state, including reasonable inferences from adjacent context — sources rarely state every answer verbatim.
-- Only fall back to "the sources do not cover X" if NONE of the sources have any relevant material at all. Do not refuse just because the exact formula, number, or phrase isn't quoted verbatim — extract whatever IS there and say so.
-- IGNORE sources that are irrelevant to the question — login forms, page-not-found stubs, wiki edit/diff/admin pages, navigation menus, raw image directories, or content about a different topic. Do not cite them. Do not mention them in your answer. Pretend they weren't in the source list.
-- Do not invent facts not supported by the sources.
-- Keep the answer focused on what the sources actually say; do not pad.`
-
-// HyDE-style query expansion prompt. Borrowed verbatim from
-// internal/server/hyde.go so the SQLite and Pebble paths produce comparable
-// expansions and operators don't have to learn two prompt shapes.
-const hydeSystemPrompt = `Write a brief, factual passage (2-4 sentences) that would directly answer the user's question. Output ONLY the passage — no preamble, no commentary, no apology if you're uncertain. If the question is ambiguous, pick the most plausible interpretation and answer that. The passage doesn't need to be true; it needs to be the SHAPE of what a relevant document would say. Embedding this passage and searching by its vector will find documents that look like real answers, even if the user's original query was just a few keywords.`
-
-// doChat wraps ChatClient.Chat with attempt/failure counters.
-// Takes the client as a parameter so it works for both s.chat and the
-// StreamingChatClient passed into streamResearch/streamAnswer.
-func (s *pebbleHTTP) doChat(ctx context.Context, c embed.ChatClient, msgs []embed.ChatMsg) (string, error) {
-	s.chatAttempts.Add(1)
-	start := time.Now()
-	out, err := c.Chat(ctx, msgs)
-	s.chatDurationNanos.Add(time.Since(start).Nanoseconds())
-	if err != nil {
-		s.chatFailures.Add(1)
-	}
-	return out, err
-}
-
-// doChatStream wraps StreamingChatClient.ChatStream with the same counters.
-func (s *pebbleHTTP) doChatStream(ctx context.Context, c embed.StreamingChatClient, msgs []embed.ChatMsg, onChunk func(string)) (string, error) {
-	s.chatAttempts.Add(1)
-	start := time.Now()
-	out, err := c.ChatStream(ctx, msgs, onChunk)
-	s.chatDurationNanos.Add(time.Since(start).Nanoseconds())
-	if err != nil {
-		s.chatFailures.Add(1)
-	}
-	return out, err
-}
-
-// doRerank wraps s.reranker.Rerank with attempt/failure counters.
-// Returning the original error unchanged so callers keep their existing
-// silent-fallback behavior; only the operator-side visibility changed.
-func (s *pebbleHTTP) doRerank(ctx context.Context, q string, cands []rerank.Candidate) ([]string, error) {
-	s.rerankAttempts.Add(1)
-	order, err := s.reranker.Rerank(ctx, q, cands)
-	if err != nil {
-		s.rerankFailures.Add(1)
-	}
-	return order, err
-}
-
-// applyBM25EnvOverrides reads COSIFT_BM25_K1 / _B and applies them
-// to idx. Shared by runPebbleServe and runQuery so both honor the same env.
-// Returns which knobs landed so callers can log selectively.
-type bm25EnvResult struct {
-	k1Set, bSet bool
-	k1Val, bVal float64
-	k1Bad, bBad string // non-empty when env was set but unparseable
-}
-
-func applyBM25EnvOverrides(idx *index.PebbleBM25) bm25EnvResult {
-	var out bm25EnvResult
-	if v := os.Getenv("COSIFT_BM25_K1"); v != "" {
-		if k1, err := strconv.ParseFloat(v, 64); err == nil && k1 > 0 {
-			idx.WithBM25Params(k1, 0)
-			out.k1Set, out.k1Val = true, k1
-		} else {
-			out.k1Bad = v
-		}
-	}
-	if v := os.Getenv("COSIFT_BM25_B"); v != "" {
-		if b, err := strconv.ParseFloat(v, 64); err == nil && b > 0 {
-			idx.WithBM25Params(0, b)
-			out.bSet, out.bVal = true, b
-		} else {
-			out.bBad = v
-		}
-	}
-	return out
-}
-
-// paraphraseQuery returns up to n paraphrases of q via the chat
-// client, parses the JSON array shape the SQLite-side paraphraser already
-// uses, and falls back to nil on any failure (no chat client, empty / malformed
-// reply, parse error). Caller decides what to do with an empty list — the
-// downstream RRF strategy treats it as 'no expansion, fall back to single
-// query'. No cache yet — keyed on (q, n) would need a different shape than
-// the HyDE cache; revisit when workload justifies.
-func (s *pebbleHTTP) paraphraseQuery(ctx context.Context, q string, n int) []string {
-	if s.chat == nil || n <= 0 {
-		return nil
-	}
-	s.paraMu.RLock()
-	if cached, ok := s.paraCache[q]; ok {
-		s.paraMu.RUnlock()
-		s.paraHits.Add(1)
-		return cached
-	}
-	s.paraMu.RUnlock()
-	s.paraMisses.Add(1)
-	const sys = `Generate paraphrases of a search query. Each paraphrase preserves the semantic intent but uses different vocabulary — different keywords that a target document might also use. Output ONLY a JSON array of strings.
-Example output for "go programming language": ["golang concurrent compiled language", "Google's systems programming language with goroutines"]`
-	resp, err := s.doChat(ctx, s.chat, []embed.ChatMsg{
-		{Role: "system", Content: sys},
-		{Role: "user", Content: fmt.Sprintf("Generate %d paraphrases of: %s", n, q)},
-	})
-	if err != nil {
-		return nil
-	}
-	raw := strings.TrimSpace(resp)
-	for _, fence := range []string{"```json", "```"} {
-		raw = strings.TrimPrefix(raw, fence)
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	raw = strings.TrimSpace(raw)
-	startIdx := strings.Index(raw, "[")
-	endIdx := strings.LastIndex(raw, "]")
-	if startIdx < 0 || endIdx <= startIdx {
-		return nil
-	}
-	var arr []string
-	if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &arr); err != nil {
-		return nil
-	}
-	out := make([]string, 0, len(arr))
-	for _, p := range arr {
-		t := strings.TrimSpace(p)
-		if t != "" {
-			out = append(out, t)
-		}
-	}
-	if len(out) > 0 {
-		s.paraMu.Lock()
-		if len(s.paraCache) >= s.paraCacheCap {
-			for k := range s.paraCache {
-				delete(s.paraCache, k)
-				break
-			}
-		}
-		s.paraCache[q] = out
-		s.paraMu.Unlock()
-	}
-	return out
-}
-
-// rrfFuse implements Reciprocal Rank Fusion across N ranked lists.
-// k=60 is the standard Cormack et al. constant; tweaking rarely changes top-k
-// ordering meaningfully. Each list contributes 1/(k + rank+1) to a URL's
-// fused score; URLs appearing in more lists at higher ranks rise. Returns
-// synthesized Hits ordered by fused score (URL/Title from first encounter,
-// Score = fused RRF score).
-func rrfFuse(lists [][]index.Hit) []index.Hit {
-	const fuseK = 60
-	type fused struct {
-		hit   index.Hit
-		score float64
-	}
-	scored := make(map[string]*fused, 64)
-	for _, list := range lists {
-		for rank, h := range list {
-			if existing, ok := scored[h.URL]; ok {
-				existing.score += 1.0 / float64(fuseK+rank+1)
-			} else {
-				scored[h.URL] = &fused{hit: h, score: 1.0 / float64(fuseK+rank+1)}
-			}
-		}
-	}
-	flat := make([]*fused, 0, len(scored))
-	for _, f := range scored {
-		flat = append(flat, f)
-	}
-	sort.Slice(flat, func(i, j int) bool { return flat[i].score > flat[j].score })
-	out := make([]index.Hit, len(flat))
-	for i, f := range flat {
-		out[i] = f.hit
-		out[i].Score = f.score
-	}
-	return out
-}
-
-// warningsFor surfaces silent no-ops that callers used to have to
-// derive from absent effective_query / retriever fields. Each warning is one
-// human-readable sentence; consumers programmatically inspect the slice.
-func (s *pebbleHTTP) warningsFor(r *http.Request) []string {
-	var w []string
-	if mode := r.URL.Query().Get("expand"); mode != "" {
-		if s.chat == nil {
-			w = append(w, "expand="+mode+" requested but no chat client configured (set cfg.Chat.Model)")
-		} else if normalizeExpandMode(mode) == "" {
-			// unknown expand value used to be silently ignored.
-			w = append(w, "expand="+mode+" is not a known strategy (try: hyde, paraphrase) — treated as no expansion")
-		}
-	}
-	if r.URL.Query().Get("rerank") == "true" && s.reranker == nil {
-		w = append(w, "rerank=true requested but no reranker configured (set cfg.Rerank.URL or cfg.Rerank.Enabled)")
-	}
-	// dense + hybrid retrievers need both a loaded HNSW graph
-	// and an embedder. Missing either falls through to BM25 with a warning.
-	// /find_similar?url=X URL-mode-dense reads the source vector
-	// directly from the graph via LookupVectorByURL — no embed RPC. Skip the
-	// embedder warning in that case (would otherwise be misleading: the
-	// request succeeded without an embedder).
-	// /find_similar falls back to bm25-mlt (not bm25), so the
-	// warning says so — caller's retriever label matches the warning text.
-	if rv := r.URL.Query().Get("retriever"); rv == "dense" || rv == "hybrid" {
-		isFindSimilar := strings.HasSuffix(r.URL.Path, "/find_similar")
-		isFindSimilarURLMode := isFindSimilar && r.URL.Query().Get("url") != ""
-		fallback := "BM25"
-		if isFindSimilar {
-			fallback = "BM25-MLT"
-		}
-		switch {
-		case s.hnsw == nil:
-			w = append(w, "retriever="+rv+" requested but HNSW graph not loaded (set COSIFT_LOAD_HNSW=true at server start) — fell back to "+fallback)
-		case s.embedder == nil && !isFindSimilarURLMode:
-			w = append(w, "retriever="+rv+" requested but no embedder configured (set cfg.Embeddings.Model) — fell back to "+fallback)
-		}
-	}
-	// MMR diversification needs HNSW + embedder. Bad values (non-
-	// float, out of [0,1]) fall through silently — flag them. Missing
-	// requirements also warn.
-	// /find_similar?url=X reuses the source vector from the graph
-	// for the MMR anchor — no embedder needed. Same carve-out as
-	// for the retriever warning.
-	if raw := r.URL.Query().Get("mmr"); raw != "" {
-		isFindSimilarURLMode := strings.HasSuffix(r.URL.Path, "/find_similar") && r.URL.Query().Get("url") != ""
-		if _, ok := parseMMRLambda(raw); !ok {
-			w = append(w, "mmr="+raw+" is not a float in [0,1] — diversification skipped")
-		} else if s.hnsw == nil {
-			w = append(w, "mmr requires HNSW graph (set COSIFT_LOAD_HNSW=true at server start) — diversification skipped")
-		} else if s.embedder == nil && !isFindSimilarURLMode {
-			w = append(w, "mmr requires an embedder to vectorize the query (set cfg.Embeddings.Model) — diversification skipped")
-		}
-	}
-	// invalid decay half-life flags loudly instead of silently
-	// being ignored. Empty value is fine (no decay requested).
-	if raw := r.URL.Query().Get("decay"); raw != "" {
-		if _, ok := parseDecayHalfLife(raw); !ok {
-			w = append(w, "decay="+raw+" is not a positive half-life in days (≤ 36500) — time-decay skipped")
-		}
-	}
-	// catch unknown ?sort= values (silently treated as relevance).
-	if sortVal := r.URL.Query().Get("sort"); sortVal != "" {
-		switch sortVal {
-		case "relevance", "date_desc", "date_asc":
-			// valid
-		default:
-			w = append(w, "sort="+sortVal+" is not a known mode (try: relevance, date_desc, date_asc) — treated as relevance")
-		}
-	}
-	// catch obviously-bad ?k= values that silently fell back to the
-	// per-endpoint default. Upper-bound clamping varies per endpoint so we
-	// flag only the universally-invalid cases (non-integer, zero, negative).
-	if kVal := r.URL.Query().Get("k"); kVal != "" {
-		if n, err := strconv.Atoi(kVal); err != nil || n <= 0 {
-			w = append(w, "k="+kVal+" is not a positive integer — using server default")
-		}
-	}
-	// Users sometimes
-	// pass 'https://example.com/foo' when 'example.com' was wanted; the
-	// dot-boundary matcher silently drops every result.
-	for _, key := range []string{"include_domains", "exclude_domains"} {
-		if v := r.URL.Query().Get(key); v != "" {
-			for _, d := range strings.Split(v, ",") {
-				d = strings.TrimSpace(d)
-				if strings.Contains(d, "://") || strings.Contains(d, "/") {
-					w = append(w, key+" entry "+d+" looks like a URL — pass a hostname (e.g., example.com), not a URL")
-					break // one warning per filter list is enough
-				}
-			}
-		}
-	}
-	if len(w) > 0 {
-		s.warningsEmitted.Add(1)
-	}
-	return w
-}
-
-// normalizeExpandMode returns the canonical strategy name for an `expand`
-// param value: "true" → "hyde" (alias), "hyde"/"paraphrase" pass through,
-// anything else → "" (so the response field doesn't echo a value that had
-// no effect).
-func normalizeExpandMode(raw string) string {
-	switch raw {
-	case "true", "hyde":
-		return "hyde"
-	case "paraphrase":
-		return "paraphrase"
-	default:
-		return ""
-	}
-}
-
-// parseDecayHalfLife parses ?decay= as a positive half-life in days. Returns
-// (halfLife, true) when valid. Empty / non-positive → (0, false) so caller
-// short-circuits. Bounded at 36500 (100 years) to avoid pathological values.
-func parseDecayHalfLife(raw string) (float64, bool) {
-	if raw == "" {
-		// Half-life from COSIFT_DEFAULT_DECAY_DAYS
-		// (default 180 days = 6 months). Docs older than 6 months get exponentially
-		// less weight in the score; recent docs surface naturally without keyword
-		// hacks like the JS regex. Set the env to 0 to disable globally.
-		// Explicit ?decay=N still wins.
-		def := 180.0
-		if v := os.Getenv("COSIFT_DEFAULT_DECAY_DAYS"); v != "" {
-			if f, err := strconv.ParseFloat(v, 64); err == nil && f >= 0 {
-				def = f
-			}
-		}
-		if def <= 0 {
-			return 0, false
-		}
-		return def, true
-	}
-	// explicit decay=0 disables (even if env default is on).
-	if raw == "0" {
-		return 0, false
-	}
-	v, err := strconv.ParseFloat(raw, 64)
-	if err != nil {
-		return 0, false
-	}
-	if math.IsNaN(v) || math.IsInf(v, 0) || v <= 0 || v > 36500 {
-		return 0, false
-	}
-	return v, true
-}
-
-// decayMultiplier computes the time-decay weight for a single PublishedAt.
-// Half-life H: doc from H days ago → 0.5x, 2H → 0.25x. Missing date or
-// non-positive halfLife → 1.0 (no decay).
-func decayMultiplier(publishedAt *time.Time, now time.Time, halfLifeDays float64) float64 {
-	if halfLifeDays <= 0 || publishedAt == nil || publishedAt.IsZero() {
-		return 1
-	}
-	ageDays := now.Sub(*publishedAt).Hours() / 24.0
-	if ageDays < 0 {
-		ageDays = 0 // future-dated → treated as fresh, never boosted
-	}
-	return math.Exp(-math.Ln2 * ageDays / halfLifeDays)
-}
-
-// applyTimeDecay multiplies each hit's Score by decayMultiplier and resorts.
-func applyTimeDecay(hits []searchHit, halfLifeDays float64, now time.Time) {
-	if halfLifeDays <= 0 || len(hits) == 0 {
-		return
-	}
-	for i := range hits {
-		hits[i].Score *= decayMultiplier(hits[i].PublishedAt, now, halfLifeDays)
-	}
-	sort.SliceStable(hits, func(i, j int) bool { return hits[i].Score > hits[j].Score })
-}
-
-// parseMMRLambda parses ?mmr= as a float in [0, 1]. Returns (lambda, true)
-// when valid. Empty value or out-of-range returns (0, false) so the caller
-// can short-circuit without firing MMR.
-func parseMMRLambda(raw string) (float64, bool) {
-	if raw == "" {
-		return 0, false
-	}
-	v, err := strconv.ParseFloat(raw, 64)
-	if err != nil {
-		return 0, false
-	}
-	if v < 0 || v > 1 {
-		return 0, false
-	}
-	return v, true
-}
-
-// mmrOrder computes a permutation of [0..n-1] via Maximal Marginal Relevance
-// (Carbonell & Goldstein '98). At each step picks the candidate maximizing
-//
-//	score = λ · sim(q, c) - (1-λ) · max_{s∈selected} sim(c, s)
-//
-// Candidates whose vectors are missing (zero-length) score 0 on relevance
-// and 0 against any other missing-vec candidate — MMR can only diversify
-// what it can compare. lambda=1 → pure relevance (no diversification);
-// lambda=0 → pure diversity. 0.5–0.7 is a typical starting point.
-//
-// Returns the permutation as a []int; never drops anything. The caller
-// applies it to whatever URL-keyed slice it has.
-func mmrOrder(qVec []float32, hitVecs [][]float32, lambda float64) []int {
-	n := len(hitVecs)
-	if n == 0 {
-		return nil
-	}
-	selected := make([]bool, n)
-	order := make([]int, 0, n)
-	rel := make([]float64, n)
-	for i := range hitVecs {
-		if len(hitVecs[i]) > 0 {
-			rel[i] = float64(index.Dot(qVec, hitVecs[i]))
-		}
-	}
-	for len(order) < n {
-		bestI := -1
-		bestScore := -math.MaxFloat64
-		for i := 0; i < n; i++ {
-			if selected[i] {
-				continue
-			}
-			var maxSim float64
-			for _, j := range order {
-				if len(hitVecs[i]) == 0 || len(hitVecs[j]) == 0 {
-					continue
-				}
-				sim := float64(index.Dot(hitVecs[i], hitVecs[j]))
-				if sim > maxSim {
-					maxSim = sim
-				}
-			}
-			score := lambda*rel[i] - (1.0-lambda)*maxSim
-			if score > bestScore {
-				bestScore = score
-				bestI = i
-			}
-		}
-		if bestI < 0 {
-			break
-		}
-		selected[bestI] = true
-		order = append(order, bestI)
-	}
-	return order
-}
-
-// mmrSelect — thin /search wrapper around mmrOrder that operates on []searchHit
-// directly.
-func mmrSelect(qVec []float32, hits []searchHit, hitVecs [][]float32, lambda float64) []searchHit {
-	if len(hits) <= 1 || lambda >= 1.0 {
-		return hits
-	}
-	order := mmrOrder(qVec, hitVecs, lambda)
-	out := make([]searchHit, 0, len(hits))
-	for _, i := range order {
-		out = append(out, hits[i])
-	}
-	return out
-}
-
-// applyMMRPermutation embeds q, looks up per-URL vectors from HNSW, and
-// returns an MMR permutation. Returns nil when MMR can't fire (no graph,
-// no embedder, embed failed, λ≥1, single-element pool). Shared by /answer
-// and /research synth endpoints.
-func (s *pebbleHTTP) applyMMRPermutation(ctx context.Context, urls []string, q string, lambda float64) []int {
-	if s.hnsw == nil || s.embedder == nil || len(urls) <= 1 || lambda >= 1.0 {
-		return nil
-	}
-	vecs, err := s.embedder.Embed(ctx, []string{q})
-	if err != nil || len(vecs) == 0 {
-		return nil
-	}
-	hitVecs := make([][]float32, len(urls))
-	for i, u := range urls {
-		if v, ok := s.hnsw.LookupVectorByURL(u); ok {
-			hitVecs[i] = v
-		}
-	}
-	return mmrOrder(vecs[0], hitVecs, lambda)
-}
-
-// buildRetrieverLabel produces the human-readable retriever string
-// surfaced on /search, /answer, /research responses. Mirrors the
-// /search inline switch so all three endpoints report the same vocabulary.
-// expansionFired is the post-hoc "did expand=hyde/paraphrase actually run"
-// signal (effectiveQuery != q for /search & /answer; chat-present for
-// /research where sub-queries are individual). wantRerank appends the
-// "+rerank:<name>" suffix when rerank fired.
-func (s *pebbleHTTP) buildRetrieverLabel(retrieverParam, expandMode string, denseReady, expansionFired, wantRerank bool) string {
-	label := "bm25"
-	switch {
-	case retrieverParam == "dense" && denseReady:
-		label = "dense"
-	case retrieverParam == "hybrid" && denseReady:
-		label = "bm25+dense:rrf"
-	default:
-		switch expandMode {
-		case "paraphrase":
-			if expansionFired {
-				label = "bm25+paraphrase"
-			}
-		case "true", "hyde":
-			if expansionFired {
-				label = "bm25+hyde"
-			}
-		}
-	}
-	if wantRerank && s.reranker != nil {
-		label += "+rerank:" + s.reranker.Name()
-	}
-	return label
-}
-
-// applyLLMEndpointDefaults sets the retriever-choice and rerank defaults
-// the LLM-synthesized endpoints (/answer, /research) want. BM25 alone is
-// too slow at multi-million-doc corpora for synchronous LLM use, and the
-// reranker is the proven quality recovery layer — so /answer and /research
-// default to hybrid + rerank whenever the components are wired, while
-// /search keeps its plain-BM25 default for low-latency operator use.
-//
-// Operators retain full control: ?retriever=bm25|dense|hybrid and
-// ?rerank=true|false|1|0 override either default.
-func (s *pebbleHTTP) applyLLMEndpointDefaults(retrieverParam, rerankParam string) (string, bool) {
-	denseReady := s.hnsw != nil && s.embedder != nil
-	if retrieverParam == "" && denseReady {
-		retrieverParam = "hybrid"
-	}
-	wantRerank := s.reranker != nil
-	switch rerankParam {
-	case "false", "0":
-		wantRerank = false
-	case "true", "1":
-		wantRerank = s.reranker != nil
-	}
-	// When the vLLM probe says the backend is queue-deep, silently
-	// disable rerank. Operators can override by passing ?rerank=true
-	// explicitly — but with COSIFT_LLM_DEGRADE_QUEUE breached, the
-	// rerank call would just queue and time out anyway. Better to ship
-	// hybrid scores fast than block on a doomed LLM call.
-	if wantRerank && rerankParam == "" && s.llmProbe != nil && s.llmProbe.Loaded() {
-		wantRerank = false
-	}
-	return retrieverParam, wantRerank
-}
-
-// retrieve dispatches retriever choice (bm25 / dense / hybrid) and
-// then expansion (bare / HyDE / paraphrase+RRF) for BM25 paths. Shared by
-// /search, /answer, /research so all three endpoints get the same retriever
-// matrix. Dense / hybrid require both the loaded HNSW graph and an
-// embedder; missing either falls through to BM25 — warningsFor()
-// surfaces that to the client.
-// applyAuthorityToDense converts HNSW VectorHits into index.Hits with
-// the per-host authority multiplier applied to the score, AND re-sorts
-// the result by the new score so the rank order reflects authority.
-// RRF fusion downstream uses rank position, not raw score, so without
-// the re-sort the multiplier was a no-op (observed: 'What is the C10K
-// problem?' still cited 3 luanjiao.cfd subdomains after applying the
-// multiplier alone). PebbleBM25.Search already multiplies AND sorts
-// internally; this helper mirrors that contract for the dense path.
-func (s *pebbleHTTP) applyAuthorityToDense(vhits []index.VectorHit) []index.Hit {
-	out := make([]index.Hit, len(vhits))
-	for i, vh := range vhits {
-		score := vh.Score
-		if s.authority != nil {
-			score *= s.authority.Multiplier(hostFromURL(vh.URL))
-		}
-		out[i] = index.Hit{URL: vh.URL, Title: vh.Title, Score: score}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Score > out[j].Score })
-	return out
-}
-
-func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
-	return s.retrieveWith(ctx, s.idx, q, fetchK, retrieverParam, expandMode)
-}
-
-// retrieveWith is retrieve parameterized over the BM25 index, so callers that
-// need a transformed index (e.g. the site-boosted index from WithBoost) can
-// pass it in without shallow-copying the whole pebbleHTTP (which embeds
-// mutexes — copying it trips go vet's lock-copy check and is unsafe).
-func (s *pebbleHTTP) retrieveWith(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
-	denseReady := s.hnsw != nil && s.embedder != nil
-	switch {
-	case retrieverParam == "dense" && denseReady:
-		vecs, err := s.embedder.Embed(ctx, []string{q})
-		if err != nil {
-			return nil, "", fmt.Errorf("embedder: %w", err)
-		}
-		vhits := s.hnsw.Search(ctx, vecs[0], fetchK)
-		hits := s.applyAuthorityToDense(vhits)
-		return hits, q, nil
-	case retrieverParam == "hybrid" && denseReady:
-		bm25Hits, bm25Eff, bm25Err := s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
-		if bm25Err != nil {
-			return nil, "", bm25Err
-		}
-		vecs, embErr := s.embedder.Embed(ctx, []string{q})
-		if embErr != nil {
-			return nil, "", fmt.Errorf("embedder: %w", embErr)
-		}
-		denseV := s.hnsw.Search(ctx, vecs[0], fetchK)
-		denseHits := s.applyAuthorityToDense(denseV)
-		hits := rrfFuse([][]index.Hit{bm25Hits, denseHits})
-		if len(hits) > fetchK {
-			hits = hits[:fetchK]
-		}
-		return hits, bm25Eff, nil
-	default:
-		return s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
-	}
-}
-
-// getSiteBoostIDs returns a docID→50× multiplier map for all docs belonging
-// to the given site scopes. Populated lazily on first call; cached in
-// siteBoostCache thereafter. Using the famHost index so the scan is
-// O(site_docs) not O(corpus).
-func (s *pebbleHTTP) getSiteBoostIDs(ctx context.Context, scopes []siteScope) map[int64]float64 {
-	if len(scopes) == 0 || s.store == nil {
-		return nil
-	}
-	key := func() string {
-		parts := make([]string, len(scopes))
-		for i, sc := range scopes {
-			parts[i] = sc.host
-			if sc.path != "" {
-				parts[i] += sc.path
-			}
-		}
-		sort.Strings(parts)
-		return strings.Join(parts, "|")
-	}()
-	if cached, ok := s.siteBoostCache.Load(key); ok {
-		return cached.(map[int64]float64)
-	}
-	boost := make(map[int64]float64)
-	for _, sc := range scopes {
-		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
-			boost[id] = 50.0
-			return true
-		})
-	}
-	if len(boost) > 0 {
-		s.siteBoostCache.Store(key, boost)
-	}
-	return boost
-}
-
-// getSiteTitles returns up to maxSiteTitles real page titles from the given
-// site scopes, for injection into the research planner prompt so the LLM sees
-// the site's actual vocabulary. Bounded and cheap: a single early-stopping
-// famHost scan per scope plus <=10 GetDocMeta side-blob lookups. Cached in
-// siteTitleCache thereafter. Returns nil if nothing usable is found.
-func (s *pebbleHTTP) getSiteTitles(ctx context.Context, scopes []siteScope) []string {
-	if len(scopes) == 0 || s.store == nil {
-		return nil
-	}
-	key := func() string {
-		parts := make([]string, len(scopes))
-		for i, sc := range scopes {
-			parts[i] = sc.host
-			if sc.path != "" {
-				parts[i] += sc.path
-			}
-		}
-		sort.Strings(parts)
-		return strings.Join(parts, "|")
-	}()
-	if cached, ok := s.siteTitleCache.Load(key); ok {
-		return cached.([]string)
-	}
-	const maxSiteTitles = 10
-	titles := make([]string, 0, maxSiteTitles)
-	seen := make(map[string]struct{}, maxSiteTitles)
-	for _, sc := range scopes {
-		if len(titles) >= maxSiteTitles {
-			break
-		}
-		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
-			_, title, ok, err := s.store.GetDocMeta(ctx, id)
-			if err != nil {
-				return false // stop this scope on error
-			}
-			if !ok {
-				return true
-			}
-			t := strings.TrimSpace(title)
-			if t == "" {
-				return true
-			}
-			if _, dup := seen[t]; dup {
-				return true
-			}
-			seen[t] = struct{}{}
-			titles = append(titles, t)
-			return len(titles) < maxSiteTitles // stop once we have 10
-		})
-	}
-	if len(titles) > 0 {
-		s.siteTitleCache.Store(key, titles)
-	}
-	return titles
-}
-
-// hostPartitionReadEnabled reports whether site= queries should route to the
-// 'P'-family host partition via SearchInHost. Gated by
-// COSIFT_HOST_PARTITION_READ=1; off → the 50× boost path is used.
-func hostPartitionReadEnabled() bool {
-	return os.Getenv("COSIFT_HOST_PARTITION_READ") == "1"
-}
-
-// retrieveForSites resolves a site-scoped sub-query. When the host partition
-// is enabled and the scope is a single bare host, it scans only that host's
-// posting partition (O(site_docs)) via SearchInHost — the definitive fix for
-// the global-scan latency + recall problem. Otherwise (multi-site, path-scoped,
-// flag off, or partition not yet backfilled for the host) it falls back to the
-// 50× BM25 boost over the global index.
-func (s *pebbleHTTP) retrieveForSites(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string, boostIDs map[int64]float64, scopes []siteScope) ([]index.Hit, string, error) {
-	if hostPartitionReadEnabled() && len(scopes) == 1 && scopes[0].path == "" && scopes[0].host != "" {
-		hits, err := s.idx.SearchInHost(ctx, q, scopes[0].host, fetchK)
-		if err == nil {
-			return hits, q, nil
-		}
-		if !errors.Is(err, index.ErrHostPartitionEmpty) {
-			return nil, "", err
-		}
-		// partition empty for this host → fall through to the boost path.
-	}
-	if len(boostIDs) == 0 {
-		return s.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
-	}
-	return s.retrieveWith(ctx, s.idx.WithBoost(boostIDs), q, fetchK, retrieverParam, expandMode)
-}
-
-// retrieveWithExpansionIdx dispatches the BM25 call across the three
-// expansion strategies /search and /answer share — bare, HyDE, paraphrase+RRF.
-// Returns (hits, effectiveQuery, err). effectiveQuery == q when no expansion
-// fired (bare path, or expansion no-op'd because chat is down). It is
-// parameterized over the BM25 index so a transformed index (e.g. the
-// site-boosted one from WithBoost) can be passed in without shallow-copying the
-// whole pebbleHTTP struct (which embeds mutexes).
-func (s *pebbleHTTP) retrieveWithExpansionIdx(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, expandMode string) ([]index.Hit, string, error) {
-	switch expandMode {
-	case "paraphrase":
-		paras := s.paraphraseQuery(ctx, q, 3)
-		if len(paras) == 0 {
-			hits, err := idx.Search(ctx, q, fetchK)
-			return hits, q, err
-		}
-		queries := append([]string{q}, paras...)
-		lists := make([][]index.Hit, 0, len(queries))
-		for _, qq := range queries {
-			h, lerr := idx.Search(ctx, qq, fetchK)
-			if lerr != nil {
-				continue
-			}
-			lists = append(lists, h)
-		}
-		hits := rrfFuse(lists)
-		if len(hits) > fetchK {
-			hits = hits[:fetchK]
-		}
-		return hits, q + " | " + strings.Join(paras, " | "), nil
-	case "true", "hyde":
-		eq := s.expandQuery(ctx, q)
-		hits, err := idx.Search(ctx, eq, fetchK)
-		return hits, eq, err
-	case "entity":
-		// Rule-based query rewrite for question-form entity lookups
-		// ("who created X", "how tall is X", "what is the capital of
-		// X"). Strips the question form, appends canonical-attribute
-		// keywords to the original, single BM25 call. The earlier
-		// RRF-fusion variant regressed legitimate passes because
-		// equal-weight fusion across 4 queries pushed the original's
-		// top hit out of the reranker's top-30. Concat preserves the
-		// original signal while letting the new keywords add positive
-		// scoring contributions where biographical pages exist.
-		rewrites := qexpand.RewriteEntity(q)
-		if len(rewrites) == 0 {
-			hits, err := idx.Search(ctx, q, fetchK)
-			return hits, q, err
-		}
-		expanded := q + " " + strings.Join(rewrites, " ")
-		hits, err := idx.Search(ctx, expanded, fetchK)
-		return hits, expanded, err
-	default:
-		// Bare path runs entity-expansion when the query matches a
-		// question-form pattern. Earlier RRF-fuse experiment regressed
-		// 'who created the World Wide Web' (passing → bail) because
-		// equal-weight fusion across 4 queries pushed the
-		// previously-#1 Berners-Lee bio out of the reranker's top-30.
-		// Concat-into-single-query avoids the fusion-weight problem:
-		// the rewrites only add positive scoring contributions for
-		// pages that contain the canonical-attribute words ("creator,"
-		// "inventor"), without diluting the original query's ranking
-		// signal. Operators can disable with COSIFT_DISABLE_ENTITY_EXPAND=1.
-		if os.Getenv("COSIFT_DISABLE_ENTITY_EXPAND") == "" {
-			if rewrites := qexpand.RewriteEntity(q); len(rewrites) > 0 {
-				expanded := q + " " + strings.Join(rewrites, " ")
-				hits, err := idx.Search(ctx, expanded, fetchK)
-				return hits, expanded, err
-			}
-		}
-		hits, err := idx.Search(ctx, q, fetchK)
-		return hits, q, err
-	}
-}
-
-// expandQuery returns q + " " + a HyDE-generated passage when a chat client is
-// configured. On any error (no chat client, chat call fails, empty passage),
-// returns q unchanged so callers can compose safely without explicit guards.
-// added a bounded in-memory cache to skip the chat call on
-// repeat queries — important for /research?expand=true where the same
-// sub-query rephrasing can fire across many similar research requests.
-func (s *pebbleHTTP) expandQuery(ctx context.Context, q string) string {
-	if s.chat == nil {
-		return q
-	}
-	s.hydeMu.RLock()
-	cached, hit := s.hydeCache[q]
-	s.hydeMu.RUnlock()
-	if hit {
-		s.hydeHits.Add(1)
-		return q + " " + cached
-	}
-	s.hydeMisses.Add(1)
-	passage, err := s.doChat(ctx, s.chat, []embed.ChatMsg{
-		{Role: "system", Content: hydeSystemPrompt},
-		{Role: "user", Content: q},
-	})
-	if err != nil {
-		return q
-	}
-	passage = strings.TrimSpace(passage)
-	if passage == "" {
-		return q
-	}
-	s.hydeMu.Lock()
-	if len(s.hydeCache) >= s.hydeCacheCap {
-		// Bounded: drop one arbitrary entry (Go map range is randomized).
-		for k := range s.hydeCache {
-			delete(s.hydeCache, k)
-			break
-		}
-	}
-	s.hydeCache[q] = passage
-	s.hydeMu.Unlock()
-	return q + " " + passage
-}
-
-type answerSource struct {
-	// Matches the [N] tokens the synth prompt produces in the answer
-	// text. SQLite-side AnswerSource has had this; pebble's was missing,
-	// which caused the CLI to render every source as '[0]' before the
-	// i+1 fallback landed.
-	ID          int        `json:"id"`
-	URL         string     `json:"url"`
-	Title       string     `json:"title"`
-	Excerpt     string     `json:"excerpt,omitempty"`
-	PublishedAt *time.Time `json:"published_at,omitempty"`
-	Author      string     `json:"author,omitempty"`
-	Text        string     `json:"text,omitempty"`
-}
-
-type answerResponse struct {
-	Query          string `json:"query"`
-	EffectiveQuery string `json:"effective_query,omitempty"`
-	Expand         string `json:"expand,omitempty"`
-	// retriever label — same vocabulary as /search ("bm25",
-	// "dense", "bm25+dense:rrf", "+hyde"/"+paraphrase", "+rerank:<name>").
-	Retriever       string         `json:"retriever,omitempty"`
-	Answer          string         `json:"answer"`
-	Sources         []answerSource `json:"sources"`
-	Model           string         `json:"model"`
-	Warnings        []string       `json:"warnings,omitempty"`
-	TotalCandidates int            `json:"total_candidates,omitempty"`
-	Took            string         `json:"took"`
-	// when the answer matches a "sources do not contain" pattern,
-	// surface a hint URL pointing at /research?strategy=planner. The 60-Q
-	// eval showed multi-hop decomposition rescues ~40% of findability +
-	// factual-lookup misses. Purely additive — clients decide whether to
-	// render a "Try research mode" affordance.
-	SuggestEscalation string `json:"suggest_escalation,omitempty"`
-}
-
-// answerLooksLikeNoInfo returns true when the answer reads as "sources don't
-// cover this" — the canonical /research-escalation trigger. Same phrase set
-// the eval uses; kept in sync so eval results predict escalation rate.
-func answerLooksLikeNoInfo(s string) bool {
-	if len(s) > 800 {
-		// Long answers with one disclaimer line aren't bails — only treat
-		// short, mostly-disclaimer responses as escalation candidates.
-		return false
-	}
-	low := strings.ToLower(s)
-	for _, p := range []string{
-		"do not contain", "do not provide", "sources don",
-		"not contain the", "no information", "do not include",
-		"do not have", "do not cover", "not mention", "no mention",
-	} {
-		if strings.Contains(low, p) {
-			return true
-		}
-	}
-	return false
-}
-
-func (s *pebbleHTTP) handleAnswer(w http.ResponseWriter, r *http.Request) {
-	// When clustered + gateway mode +
-	// not already serving as a leaf for someone else, fan-out retrieval
-	// to peers (with include_text), then run a SINGLE synth here.
-	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
-		s.handleAnswerGateway(w, r)
-		return
-	}
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented,
-			"/answer requires cfg.Chat.Model to be set (point cosift.json's chat.url at any OpenAI-compatible endpoint)")
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	// Cache + singleflight on /answer. Key is the full query-string
-	// (sorted) so different filter combos don't collide. We capture the
-	// rendered body into a buffer; on success the buffer is the cache
-	// value. Skip the cache for explicit no-cache requests and for
-	// streaming clients — bufferedResponse can't flush, so SSE would
-	// silently fall through to the sync JSON path.
-	if s.answerCache != nil && r.Header.Get("Cache-Control") != "no-cache" && !wantsSSE(r) {
-		key := answerCacheKey(r)
-		body, err, shared := s.answerCache.Do(key, func() ([]byte, error) {
-			rec := &bufferedResponse{header: http.Header{}, status: 200}
-			s.handleAnswerInner(rec, r, start)
-			if rec.status != http.StatusOK {
-				return nil, errAnswerNotOK
-			}
-			return rec.buf.Bytes(), nil
-		})
-		if err == nil {
-			if shared {
-				w.Header().Set("X-Cache", "hit")
-			} else {
-				w.Header().Set("X-Cache", "miss")
-			}
-			w.Header().Set("Content-Type", "application/json")
-			_, _ = w.Write(body)
-			return
-		}
-		// On non-OK from the inner handler, fall through to the
-		// uncached path so the real status code reaches the client.
-	}
-	s.handleAnswerInner(w, r, start)
-}
-
-// errAnswerNotOK signals that the inner handler wrote a non-2xx
-// response — don't cache it, and let the caller re-run uncached so
-// the proper status reaches the client.
-var errAnswerNotOK = errors.New("answer: non-OK response, not cached")
-
-// answerCacheKey is the deterministic cache key for a given /answer
-// request. Sorts query parameters so URL-order doesn't fragment the
-// cache; drops parameters that don't affect the response.
-func answerCacheKey(r *http.Request) string {
-	q := r.URL.Query()
-	// Don't key on transport-only or debug-only flags.
-	q.Del("cluster_local")
-	q.Del("trace")
-	keys := make([]string, 0, len(q))
-	for k := range q {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	var sb strings.Builder
-	for _, k := range keys {
-		for _, v := range q[k] {
-			sb.WriteString(k)
-			sb.WriteByte('=')
-			sb.WriteString(v)
-			sb.WriteByte('\x00')
-		}
-	}
-	sum := sha256.Sum256([]byte(sb.String()))
-	return hex.EncodeToString(sum[:16])
-}
-
-// bufferedResponse captures a handler's writes into a buffer so we
-// can store the rendered JSON in answerCache before flushing to the
-// real response writer.
-type bufferedResponse struct {
-	buf    bytes.Buffer
-	header http.Header
-	status int
-}
-
-func (b *bufferedResponse) Header() http.Header        { return b.header }
-func (b *bufferedResponse) WriteHeader(statusCode int) { b.status = statusCode }
-func (b *bufferedResponse) Write(p []byte) (int, error) {
-	if b.status == 0 {
-		b.status = http.StatusOK
-	}
-	return b.buf.Write(p)
-}
-
-// handleAnswerInner is the uncached body. Called both via the cache
-// path (with a bufferedResponse) and directly when the cache is
-// disabled or a non-OK response needs the real writer.
-func (s *pebbleHTTP) handleAnswerInner(w http.ResponseWriter, r *http.Request, start time.Time) {
-	q := r.URL.Query().Get("q")
-	k := 5
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
-			k = n
-		}
-	}
-	// /answer respects the same retrieval filters /search does —
-	// scoping research to a domain or date window is the common EXA shape.
-	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
-	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
-	sites := parseSiteScopes(r.URL.Query().Get("site"))
-	siteFilter := len(sites) > 0
-	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
-	if sinceErr != nil {
-		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
-		return
-	}
-	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
-	if untilErr != nil {
-		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
-		return
-	}
-	dateFilter := !since.IsZero() || !until.IsZero()
-	includeText := r.URL.Query().Get("include_text") == "true"
-	// Default to hybrid + rerank on /answer — the reranker is the proven
-	// quality recovery layer; ?retriever=bm25 and ?rerank=false opt out.
-	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
-		r.URL.Query().Get("retriever"),
-		r.URL.Query().Get("rerank"),
-	)
-	keepCap := k
-	if wantRerank {
-		keepCap = s.rerankCandK
-		if keepCap < k {
-			keepCap = k
-		}
-	}
-	fetchK := keepCap
-	if len(include) > 0 || len(exclude) > 0 || dateFilter || siteFilter {
-		mult := 5
-		if dateFilter {
-			mult = 10
-		}
-		if siteFilter {
-			mult = 50 // site= over-fetches aggressively: small site in a large corpus
-		}
-		fetchK = keepCap * mult
-		cap := 200 // /answer caps tighter than /search — full doc text per source is expensive
-		if siteFilter && cap < 500 {
-			cap = 500
-		}
-		if fetchK > cap {
-			fetchK = cap
-		}
-	} else if wantRerank {
-		fetchK = keepCap * 2
-	}
-	// SSE opt-in. Open the stream BEFORE retrieve() so phase events can
-	// surface backend pipeline progress (retrieve / rerank / judge / mmr /
-	// synth_start) instead of just the synth-chunk tail. Opt in via
-	// ?stream=true or Accept: text/event-stream. Caps requirement: chat
-	// client must implement StreamingChatClient AND the ResponseWriter
-	// must support http.Flusher; if either is missing, fall through to
-	// sync (today's behavior).
-	wantStream := wantsSSE(r)
-	var sse *answerSSE
-	var streamChat embed.StreamingChatClient
-	if wantStream {
-		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
-			if a := newAnswerSSE(w, start); a != nil {
-				sse, streamChat = a, sc
-				stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
-				defer stopKA()
-				sse.warnings(s.warningsFor(r))
-				sse.phase("parsed", map[string]any{
-					"q": q, "k": k, "fetch_k": fetchK,
-					"retriever": retrieverParam, "rerank": wantRerank,
-				})
-			}
-		}
-	}
-
-	// expansion dispatch (bare / HyDE / paraphrase+RRF).
-	// retriever dispatch (bm25 / dense / hybrid) via shared helper.
-	expandMode := r.URL.Query().Get("expand")
-	hits, effectiveQuery, err := s.retrieve(r.Context(), q, fetchK, retrieverParam, expandMode)
-	if err != nil {
-		if sse != nil {
-			sse.errorEvt(err.Error())
-			return
-		}
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	if sse != nil {
-		sse.phase("retrieve", map[string]any{
-			"hits": len(hits), "effective_query": effectiveQuery,
-		})
-	}
-	type cand struct {
-		src        answerSource
-		excerpt    string
-		rerankText string
-		score      float64 // retrieval score, used by time-decay
-	}
-	cands := make([]cand, 0, keepCap)
-	for _, h := range hits {
-		if len(include) > 0 || len(exclude) > 0 {
-			host := hostOf(h.URL)
-			if len(include) > 0 && !matchesAnyDomain(host, include) {
-				continue
-			}
-			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
-				continue
-			}
-		}
-		if siteFilter && !matchesAnySite(h.URL, sites) {
-			continue
-		}
-		doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
-		if derr != nil || doc == nil {
-			continue
-		}
-		if dateFilter {
-			if doc.PublishedAt.IsZero() {
-				continue
-			}
-			if !since.IsZero() && doc.PublishedAt.Before(since) {
-				continue
-			}
-			if !until.IsZero() && doc.PublishedAt.After(until) {
-				continue
-			}
-		}
-		excerpt := textExcerpt(doc.Text, 1200)
-		src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
-		if !doc.PublishedAt.IsZero() {
-			t := doc.PublishedAt
-			src.PublishedAt = &t
-		}
-		if includeText {
-			src.Text = doc.Text
-		}
-		c := cand{src: src, excerpt: excerpt, score: h.Score}
-		if wantRerank {
-			c.rerankText = doc.Title + "\n" + doc.Text
-		}
-		cands = append(cands, c)
-		if len(cands) >= keepCap {
-			break
-		}
-	}
-	if sse != nil {
-		sse.phase("filter", map[string]any{"candidates": len(cands)})
-	}
-	// time-decay re-weights then re-sorts BEFORE rerank, mirroring
-	// the /search pre-rerank placement so the reranker sees a freshness-
-	// aware pool.
-	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
-	if decaySet && len(cands) > 0 {
-		now := time.Now()
-		for i := range cands {
-			cands[i].score *= decayMultiplier(cands[i].src.PublishedAt, now, decayHalfLife)
-		}
-		sort.SliceStable(cands, func(i, j int) bool { return cands[i].score > cands[j].score })
-		if sse != nil {
-			sse.phase("decay", map[string]any{"half_life_days": decayHalfLife})
-		}
-	}
-	// Optional rerank, then truncate to k. Done in this order so citation
-	// numbers in the prompt match the final rank-ordered sources list.
-	if wantRerank && len(cands) > 1 {
-		rc := make([]rerank.Candidate, len(cands))
-		for i := range cands {
-			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
-		}
-		if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
-			reordered := make([]cand, 0, len(cands))
-			seen := make(map[int]bool, len(cands))
-			for _, id := range order {
-				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
-					reordered = append(reordered, cands[n])
-					seen[n] = true
-				}
-			}
-			for i, c := range cands {
-				if !seen[i] {
-					reordered = append(reordered, c)
-				}
-			}
-			cands = reordered
-		}
-		if sse != nil {
-			sse.phase("rerank", map[string]any{"reranker": s.reranker.Name(), "candidates": len(cands)})
-		}
-	}
-	// LLM relevance judge — STRICT gate. The reranker re-orders but
-	// doesn't drop; without this gate, marginal content (Wikipedia
-	// diff/admin pages, dead .edu PDFs, JS-only landing pages with
-	// stub HTML) leaks into the synth context and produces "based on
-	// the sources, here is some irrelevant trivia" answers.
-	//
-	// Strict means: if a candidate fails the relevance threshold, it
-	// is DROPPED — we do not top up from the rejected pool to reach k.
-	// Better to return 2 truly relevant sources than 5 sources where 3
-	// are noise. If 0 candidates pass, downstream returns the "no
-	// matching sources" response (already handled below).
-	//
-	// Skip when ?judge=false or no chat client (correctness-preserving).
-	if r.URL.Query().Get("judge") != "false" && s.chat != nil && len(cands) > 1 {
-		before := len(cands)
-		jCands := make([]judge.Candidate, len(cands))
-		for i, c := range cands {
-			jCands[i] = judge.Candidate{ID: strconv.Itoa(i), Excerpt: c.rerankText}
-		}
-		verdicts := judge.Judge(r.Context(), s.chat, q, jCands, judge.Options{MinScore: 0.3})
-		keep := make([]cand, 0, len(cands))
-		for i, c := range cands {
-			if i < len(verdicts) && verdicts[i].Keep {
-				keep = append(keep, c)
-			}
-		}
-		cands = keep
-		if sse != nil {
-			sse.phase("judge", map[string]any{
-				"before": before, "kept": len(cands), "dropped": before - len(cands),
-			})
-		}
-	}
-	// MMR diversification on /answer — same pattern as /search.
-	// Synth quality benefits when the top-k sources cover different
-	// angles instead of being 5 paraphrases of the same paper.
-	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
-	mmrFired := false
-	if mmrSet && len(cands) > 1 {
-		urls := make([]string, len(cands))
-		for i := range cands {
-			urls[i] = cands[i].src.URL
-		}
-		if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
-			reordered := make([]cand, len(order))
-			for i, idx := range order {
-				reordered[i] = cands[idx]
-			}
-			cands = reordered
-			mmrFired = true
-		}
-		if sse != nil && mmrFired {
-			sse.phase("mmr", map[string]any{"lambda": mmrLambda, "candidates": len(cands)})
-		}
-	}
-	if len(cands) > k {
-		cands = cands[:k]
-	}
-	sources := make([]answerSource, 0, len(cands))
-	var promptSources strings.Builder
-	for i, c := range cands {
-		// stamp ID = i+1 so the JSON response matches the [N]
-		// citation tokens we emit in the synth prompt below.
-		c.src.ID = i + 1
-		sources = append(sources, c.src)
-		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, c.excerpt)
-	}
-	// same retriever label vocabulary as /search.
-	denseReady := s.hnsw != nil && s.embedder != nil
-	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, effectiveQuery != q, wantRerank)
-	if mmrFired {
-		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
-	}
-	if decaySet {
-		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
-	}
-	if len(sources) == 0 {
-		// Distinguish the two failure modes so the client can tell
-		// "we have nothing on this topic" (retrieval returned 0 hits)
-		// from "we retrieved candidates but the relevance judge dropped
-		// every one of them" (the corpus has noise, not the answer).
-		msg := "No matching sources in the index."
-		if len(hits) > 0 {
-			msg = "Retrieval returned candidates but none were judged relevant to the question. The corpus may not cover this topic in usable detail."
-		}
-		if sse != nil {
-			sse.sources(q, sources, streamChat.Model(), retrieverLabel, len(hits))
-			sse.chunk(msg)
-			sse.done()
-			return
-		}
-		empty := answerResponse{
-			Query: q, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
-			Answer:  msg,
-			Sources: sources, Model: s.chat.Model(), TotalCandidates: len(hits), Took: time.Since(start).String(),
-		}
-		if effectiveQuery != q {
-			empty.EffectiveQuery = effectiveQuery
-		}
-		empty.Warnings = s.warningsFor(r)
-		writeJSON(w, http.StatusOK, empty)
-		return
-	}
-
-	msgs := []embed.ChatMsg{
-		{Role: "system", Content: answerSystemPrompt},
-		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Question: " + q},
-	}
-
-	if sse != nil {
-		sse.sources(q, sources, streamChat.Model(), retrieverLabel, len(hits))
-		sse.phase("synth_start", map[string]any{"sources": len(sources), "model": streamChat.Model()})
-		full, cerr := s.doChatStream(r.Context(), streamChat, msgs, sse.chunk)
-		if cerr != nil {
-			sse.errorEvt(cerr.Error())
-			return
-		}
-		if answerLooksLikeNoInfo(full) {
-			sse.suggestEscalation(q)
-		}
-		sse.done()
-		return
-	}
-
-	answer, err := s.doChat(r.Context(), s.chat, msgs)
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "chat: "+err.Error())
-		return
-	}
-	resp := answerResponse{
-		Query: q, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
-		Answer: answer, Sources: sources,
-		Model: s.chat.Model(), TotalCandidates: len(hits), Took: time.Since(start).String(),
-	}
-	if effectiveQuery != q {
-		resp.EffectiveQuery = effectiveQuery
-	}
-	resp.Warnings = s.warningsFor(r)
-	// suggest /research escalation when the model bailed.
-	if answerLooksLikeNoInfo(answer) {
-		resp.SuggestEscalation = "/research?q=" + url.QueryEscape(q) + "&strategy=planner"
-	}
-	writeJSON(w, http.StatusOK, resp)
-}
-
-// recordingWriter wraps an http.ResponseWriter and captures every byte
-// written to it. Used to record SSE streams for the research cache — the
-// captured bytes can later be replayed to a new client directly.
-type recordingWriter struct {
-	http.ResponseWriter
-	buf bytes.Buffer
-}
-
-func (r *recordingWriter) Write(b []byte) (int, error) {
-	r.buf.Write(b)
-	return r.ResponseWriter.Write(b)
-}
-
-func (r *recordingWriter) Flush() {
-	if f, ok := r.ResponseWriter.(http.Flusher); ok {
-		f.Flush()
-	}
-}
-
-// wantsSSE reports whether the request opts into Server-Sent Events,
-// either via ?stream=true or an Accept: text/event-stream header. Both
-// /answer, /query, and /research check the same envelope.
-func wantsSSE(r *http.Request) bool {
-	return r.URL.Query().Get("stream") == "true" ||
-		strings.Contains(r.Header.Get("Accept"), "text/event-stream")
-}
-
-// answerSSE wraps the SSE writer for /answer streaming. Methods emit the
-// well-known event types (phase, sources, answer_chunk, warnings, error,
-// suggest_escalation, done). Phase events surface pipeline progress
-// (retrieve / rerank / judge / mmr / synth_start) so clients can render a
-// timeline of what the backend is doing.
-//
-// Writes are mu-protected because the keepalive ticker can race with
-// the main handler goroutine. The handler does the substantive event
-// writes; the ticker emits SSE comment frames (": ka\n\n") to keep
-// the HTTP/2 stream alive across long retrieval / rerank / chat calls
-// — without them, browsers (Safari especially) close the stream when
-// no bytes flow for 10–30 s and the request fails mid-pipeline.
-type answerSSE struct {
-	w       http.ResponseWriter
-	flusher http.Flusher
-	start   time.Time
-	last    time.Time // last phase emit; used to compute per-phase duration
-	mu      sync.Mutex
-}
-
-// newAnswerSSE opens an SSE stream. Returns nil if the writer can't flush.
-// Caller is responsible for not calling writeProblem after this point —
-// the response status (200) and headers are committed here.
-//
-// Disables the server-wide WriteTimeout (60s) via ResponseController.
-// Multi-pass /research can run 90-180s with 3-5 passes against a slow
-// chat model; the deadline would kill the connection mid-stream and
-// the browser fetch would surface a generic "Load failed". SSE handlers
-// flush their own progress, so a stuck handler still gets killed by
-// ctx cancellation when the client disconnects.
-func newAnswerSSE(w http.ResponseWriter, start time.Time) *answerSSE {
-	flusher, ok := w.(http.Flusher)
-	if !ok {
-		return nil
-	}
-	w.Header().Set("Content-Type", "text/event-stream")
-	w.Header().Set("Cache-Control", "no-cache")
-	w.Header().Set("X-Accel-Buffering", "no")
-	if rc := http.NewResponseController(w); rc != nil {
-		_ = rc.SetWriteDeadline(time.Time{})
-	}
-	w.WriteHeader(http.StatusOK)
-	return &answerSSE{w: w, flusher: flusher, start: start, last: start}
-}
-
-func (a *answerSSE) send(payload any) {
-	buf, _ := json.Marshal(payload)
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	fmt.Fprintf(a.w, "data: %s\n\n", buf)
-	a.flusher.Flush()
-}
-
-// startKeepalive launches a goroutine that emits SSE data frames every
-// interval, keeping the HTTP/2 stream and any intermediate proxy alive
-// across long retrieval / chat calls that emit no real data. Returns a
-// stop function the caller defers; stopping is idempotent.
-//
-// We deliberately emit `data: {"type":"ka", ...}` frames rather than the
-// spec's `: comment` form. Safari's CFNetwork stream stack tracks
-// "no payload data received" separately from "no bytes received" — a
-// long-running stream of nothing but comment frames still trips its
-// internal timeout and the browser surfaces it as "Error: Load failed".
-// JSON ka frames count as real data; the chat UI ignores `type:"ka"`.
-func (a *answerSSE) startKeepalive(ctx context.Context, interval time.Duration) (stop func()) {
-	done := make(chan struct{})
-	go func() {
-		t := time.NewTicker(interval)
-		defer t.Stop()
-		for {
-			select {
-			case <-done:
-				return
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				a.send(map[string]any{
-					"type":       "ka",
-					"elapsed_ms": time.Since(a.start).Milliseconds(),
-				})
-			}
-		}
-	}()
-	var once sync.Once
-	return func() { once.Do(func() { close(done) }) }
-}
-
-// phase emits a pipeline-step event with elapsed-since-start and
-// duration-since-last-phase, plus any caller-supplied detail fields.
-// Holds a.mu for the whole call so the read+write of a.last and the
-// write-to-the-wire are all atomic with respect to concurrent phase
-// calls and the keepalive ticker.
-func (a *answerSSE) phase(name string, details map[string]any) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	now := time.Now()
-	evt := map[string]any{
-		"type":        "phase",
-		"name":        name,
-		"elapsed_ms":  now.Sub(a.start).Milliseconds(),
-		"duration_ms": now.Sub(a.last).Milliseconds(),
-	}
-	for k, v := range details {
-		evt[k] = v
-	}
-	a.last = now
-	buf, _ := json.Marshal(evt)
-	fmt.Fprintf(a.w, "data: %s\n\n", buf)
-	a.flusher.Flush()
-}
-
-func (a *answerSSE) warnings(warns []string) {
-	if len(warns) == 0 {
-		return
-	}
-	a.send(map[string]any{"type": "warnings", "warnings": warns})
-}
-
-func (a *answerSSE) sources(q string, src []answerSource, model, retrieverLabel string, totalCandidates int) {
-	evt := map[string]any{
-		"type":             "sources",
-		"query":            q,
-		"sources":          src,
-		"model":            model,
-		"total_candidates": totalCandidates,
-	}
-	if retrieverLabel != "" {
-		evt["retriever"] = retrieverLabel
-	}
-	a.send(evt)
-}
-
-func (a *answerSSE) chunk(delta string) {
-	a.send(map[string]any{"type": "answer_chunk", "text": delta})
-}
-
-func (a *answerSSE) errorEvt(msg string) {
-	a.send(map[string]any{"type": "error", "error": msg})
-}
-
-func (a *answerSSE) suggestEscalation(q string) {
-	a.send(map[string]any{
-		"type":               "suggest_escalation",
-		"suggest_escalation": "/research?q=" + url.QueryEscape(q) + "&strategy=planner",
-	})
-}
-
-func (a *answerSSE) done() {
-	a.send(map[string]any{"type": "done", "took": time.Since(a.start).String()})
-}
-
-// /research — multi-step retrieval + synthesis. LLM decomposes the
-// question into 2-3 sub-queries, each sub-query runs BM25, results are deduped
-// by URL keeping the best score, top-k feed a cited synthesis. Mirrors the
-// SQLite-side /research planner strategy. No streaming, no rerank, no
-// paraphrase strategy yet — those follow once this surface is exercised.
-const researchPlanPrompt = `Decompose the user's research question into 2-3 short keyword search phrases (3-6 words each, NOT full sentences). Each phrase MUST target a DIFFERENT facet so the phrases do not overlap: one conceptual/definitional (what it is), one procedural/how-to (steps, configuration, usage), and one edge-case/troubleshooting (errors, limits, gotchas, comparisons). Skip a facet only if it does not apply. Do NOT output near-duplicate rephrasings of the same idea. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["consensus algorithm overview", "configure validator node", "leader election failure recovery"]`
-
-// queryPlanPrompt is the LLM-orchestrator prompt. The model
-// analyzes the user's natural-language query, classifies intent, and
-// outputs a structured retrieval plan: expanded queries (3 variations
-// covering different angles), recency window, retriever choice, and
-// optionally a domain allowlist. The plan then drives a broader RRF-
-// fused retrieval. JSON schema is strict; sanity-checked on receive.
-const queryPlanPrompt = `You analyze a user's natural-language search query and output a JSON retrieval plan.
-
-Output ONLY a JSON object (no markdown, no prose, no commentary) with this exact shape:
-{
-  "intent": "current_news" | "factual_lookup" | "comparison" | "research" | "findability",
-  "queries": ["expanded query 1", "expanded query 2", "expanded query 3"],
-  "since_days": null | <positive integer, days lookback from today>,
-  "retriever": "bm25" | "dense" | "hybrid",
-  "decay_days": <positive integer half-life> | null
-}
-
-Guidance:
-- "queries": 3 paraphrases/expansions of the original. Include entity names, synonyms, related terms. e.g. "latest news from Romania" → ["Romania political news 2026", "Romanian government coalition PSD AUR", "Bucharest current events"]
-- "since_days": only set when the query implies recency (latest/current/recent/today/news). null otherwise.
-- "decay_days": half-life in days. For current-events queries use 60. For factual/research queries use null or 365.
-- "retriever": hybrid is the safe default. Use "bm25" only for exact-term lookups (model names, error codes). Use "dense" only for purely conceptual queries with no keyword overlap.
-- DO NOT invent include_domains. The corpus chooses sources, not you.
-
-Examples:
-Input: "latest news from Romania"
-{"intent":"current_news","queries":["Romania political news 2026","Romanian PSD AUR coalition government","Bucharest economy and politics current"],"since_days":90,"retriever":"hybrid","decay_days":60}
-
-Input: "what is BM25 ranking"
-{"intent":"factual_lookup","queries":["BM25 Okapi ranking function formula","BM25 information retrieval probabilistic","term frequency inverse document frequency BM25"],"since_days":null,"retriever":"hybrid","decay_days":null}
-
-Input: "compare HNSW vs IVF"
-{"intent":"comparison","queries":["HNSW vs IVF approximate nearest neighbor","Hierarchical Navigable Small World versus Inverted File","ANN index tradeoffs HNSW IVF performance"],"since_days":null,"retriever":"hybrid","decay_days":730}`
-
-// queryPlan captures the LLM's structured retrieval plan. Sanitized on
-// parse — out-of-range values clipped to safe defaults.
-type queryPlan struct {
-	Intent    string   `json:"intent"`
-	Queries   []string `json:"queries"`
-	SinceDays *int     `json:"since_days"`
-	Retriever string   `json:"retriever"`
-	DecayDays *int     `json:"decay_days"`
-}
-
-// parseQueryPlan extracts the planner's JSON output and applies guard-rails.
-// Returns a plan with sane defaults if the LLM produces garbage — never
-// errors at the caller, so /query always succeeds.
-func parseQueryPlan(raw, original string) queryPlan {
-	defaultPlan := queryPlan{
-		Intent:    "research",
-		Queries:   []string{original},
-		Retriever: "hybrid",
-	}
-	// Strip code fences if the LLM wrapped output despite the prompt.
-	raw = strings.TrimSpace(raw)
-	if strings.HasPrefix(raw, "```") {
-		if i := strings.Index(raw, "\n"); i > 0 {
-			raw = raw[i+1:]
-		}
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	var p queryPlan
-	if err := json.Unmarshal([]byte(raw), &p); err != nil {
-		return defaultPlan
-	}
-	if len(p.Queries) == 0 {
-		p.Queries = []string{original}
-	}
-	if len(p.Queries) > 5 {
-		p.Queries = p.Queries[:5]
-	}
-	switch p.Retriever {
-	case "bm25", "dense", "hybrid":
-		// ok
-	default:
-		p.Retriever = "hybrid"
-	}
-	if p.SinceDays != nil && (*p.SinceDays <= 0 || *p.SinceDays > 3650) {
-		p.SinceDays = nil
-	}
-	if p.DecayDays != nil && (*p.DecayDays <= 0 || *p.DecayDays > 3650) {
-		p.DecayDays = nil
-	}
-	if p.Intent == "" {
-		p.Intent = "research"
-	}
-	return p
-}
-
-// handleQuery is the LLM-orchestrated search/research endpoint.
-// Flow: (1) LLM planner analyzes intent + emits expanded queries, (2) each
-// expansion runs through /search internals (hybrid + decay), (3) RRF-fuse
-// the per-expansion result lists, (4) optional rerank, (5) synth with
-// citations. Returns the plan in the response so callers can see what was
-// done.
-//
-// Effectively: /research planner-style decomposition, but optimized for
-// QUERY EXPANSION not sub-question DECOMPOSITION. The two are different —
-// research splits multi-faceted questions ("compare X and Y" → "X facts",
-// "Y facts", "X vs Y tradeoffs"); query expands a single intent into
-// paraphrases that catch corpus phrasing variation.
-func (s *pebbleHTTP) handleQuery(w http.ResponseWriter, r *http.Request) {
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented, "/query requires cfg.Chat.Model")
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-
-	// SSE opt-in. Stream phase events through the planner → expand → fuse
-	// → synth pipeline so operators see the LLM's sub-queries, per-expansion
-	// hit counts, fusion result, and synth tokens as they're produced.
-	wantStream := wantsSSE(r)
-	var sse *answerSSE
-	var streamChat embed.StreamingChatClient
-	if wantStream {
-		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
-			if a := newAnswerSSE(w, start); a != nil {
-				sse, streamChat = a, sc
-				stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
-				defer stopKA()
-				sse.phase("plan_start", map[string]any{"q": q, "model": s.chat.Model()})
-			}
-		}
-	}
-
-	// Step 1: LLM planner.
-	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: queryPlanPrompt},
-		{Role: "user", Content: q},
-	})
-	if err != nil {
-		if sse != nil {
-			sse.errorEvt("plan: " + err.Error())
-			return
-		}
-		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
-		return
-	}
-	plan := parseQueryPlan(planRaw, q)
-	if sse != nil {
-		details := map[string]any{
-			"intent":    plan.Intent,
-			"retriever": plan.Retriever,
-			"queries":   plan.Queries,
-		}
-		if plan.SinceDays != nil {
-			details["since_days"] = *plan.SinceDays
-		}
-		if plan.DecayDays != nil {
-			details["decay_days"] = *plan.DecayDays
-		}
-		sse.phase("plan", details)
-	}
-
-	// Step 2: run each expanded query through retrieval, dedupe by URL.
-	type hitInfo struct {
-		hit    index.Hit
-		bestRR float64 // best reciprocal rank across expansions
-	}
-	byURL := make(map[string]*hitInfo, 64)
-	fetchK := 30
-	for _, sub := range plan.Queries {
-		hits, _, err := s.retrieve(r.Context(), sub, fetchK, plan.Retriever, "")
-		if err != nil {
-			if sse != nil {
-				sse.phase("expand", map[string]any{"query": sub, "error": err.Error()})
-			}
-			continue
-		}
-		for rank, h := range hits {
-			rr := 1.0 / float64(60+rank) // RRF with k=60
-			if existing, ok := byURL[h.URL]; ok {
-				if rr > existing.bestRR {
-					existing.bestRR = rr
-				}
-			} else {
-				byURL[h.URL] = &hitInfo{hit: h, bestRR: rr}
-			}
-		}
-		if sse != nil {
-			sse.phase("expand", map[string]any{"query": sub, "hits": len(hits)})
-		}
-	}
-
-	// Step 3: sort by fused RRF score with optional per-host boosts.
-	fused := make([]index.Hit, 0, len(byURL))
-	for _, v := range byURL {
-		h := v.hit
-		h.Score = v.bestRR
-		if len(s.hostBoosts) > 0 {
-			h.Score *= index.HostBoostFor(h.URL, s.hostBoosts)
-		}
-		fused = append(fused, h)
-	}
-	sort.Slice(fused, func(i, j int) bool { return fused[i].Score > fused[j].Score })
-	if sse != nil {
-		sse.phase("fuse", map[string]any{"unique_urls": len(fused)})
-	}
-
-	// Step 4: optional since filter + decay (decay handled by /answer-style
-	// path when we materialize). Apply since filter here on PublishedAt.
-	keep := 10
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
-			keep = n
-		}
-	}
-	var since time.Time
-	if plan.SinceDays != nil {
-		since = time.Now().AddDate(0, 0, -(*plan.SinceDays))
-	}
-
-	// Step 5: enrich + filter by since.
-	type cand struct {
-		src     answerSource
-		excerpt string
-		text    string
-	}
-	cands := make([]cand, 0, keep)
-	for _, h := range fused {
-		if len(cands) >= keep {
-			break
-		}
-		doc, err := s.store.GetDocByURL(r.Context(), h.URL)
-		if err != nil || doc == nil {
-			continue
-		}
-		if !since.IsZero() && (doc.PublishedAt.IsZero() || doc.PublishedAt.Before(since)) {
-			continue
-		}
-		c := cand{
-			src: answerSource{
-				ID:    len(cands) + 1,
-				URL:   h.URL,
-				Title: h.Title,
-			},
-			excerpt: textExcerpt(doc.Text, 320),
-			text:    doc.Text,
-		}
-		if !doc.PublishedAt.IsZero() {
-			t := doc.PublishedAt
-			c.src.PublishedAt = &t
-		}
-		cands = append(cands, c)
-	}
-	if sse != nil {
-		sse.phase("materialize", map[string]any{"candidates": len(cands)})
-	}
-
-	// Step 6: synth via answerSystemPrompt.
-	var promptSrcs strings.Builder
-	sources := make([]answerSource, 0, len(cands))
-	for i, c := range cands {
-		c.src.ID = i + 1
-		c.src.Excerpt = c.excerpt
-		fmt.Fprintf(&promptSrcs, "[%d] %s\n%s\n\n", c.src.ID, c.src.URL, truncateForPromptLite(c.text, 1200))
-		sources = append(sources, c.src)
-	}
-
-	if sse != nil {
-		sse.sources(q, sources, s.chat.Model(), "query:planner+hybrid+rrf", len(fused))
-		if len(cands) == 0 {
-			sse.chunk("No sources matched the planner's expanded queries within the chosen time window.")
-			sse.done()
-			return
-		}
-		sse.phase("synth_start", map[string]any{"sources": len(sources), "model": streamChat.Model()})
-		_, cerr := s.doChatStream(r.Context(), streamChat, []embed.ChatMsg{
-			{Role: "system", Content: answerSystemPrompt},
-			{Role: "user", Content: "Sources:\n\n" + promptSrcs.String() + "Question: " + q},
-		}, sse.chunk)
-		if cerr != nil {
-			sse.errorEvt("synth: " + cerr.Error())
-			return
-		}
-		sse.done()
-		return
-	}
-
-	answerText := ""
-	if len(cands) > 0 {
-		answerText, err = s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-			{Role: "system", Content: answerSystemPrompt},
-			{Role: "user", Content: "Sources:\n\n" + promptSrcs.String() + "Question: " + q},
-		})
-		if err != nil {
-			writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
-			return
-		}
-	} else {
-		answerText = "No sources matched the planner's expanded queries within the chosen time window."
-	}
-
-	writeJSON(w, http.StatusOK, map[string]any{
-		"query":   q,
-		"plan":    plan,
-		"answer":  answerText,
-		"sources": sources,
-		"model":   s.chat.Model(),
-		"took":    time.Since(start).String(),
-	})
-}
-
-// truncateForPromptLite caps text by approximate char count for source
-// prompts. Same heuristic the eval-quick path uses.
-func truncateForPromptLite(s string, maxChars int) string {
-	if len(s) <= maxChars {
-		return s
-	}
-	return s[:maxChars] + "…"
-}
-
-const researchSynthPrompt = `You are a research assistant. Synthesize an answer to the original question using ONLY the provided sources.
-- Cite sources by their numeric id, e.g. [1] or [2,3]. Every factual claim needs a citation.
-- If the sources don't cover something, say so plainly — do not invent.
-- Keep the answer focused on what the sources actually say.`
-
-// researchRefineSynthPrompt is the system prompt for pass 2+ of a multi-pass
-// /research call. The user message includes the prior draft answer alongside
-// the expanded source pool. The instruction shape mirrors the standard synth
-// prompt but explicitly directs the model to revise rather than start fresh.
-const researchRefineSynthPrompt = `You are a research assistant. You have a draft answer from a prior research pass plus additional sources that were gathered to close gaps. Produce a REVISED answer using all the sources now available.
-- Cite sources by their numeric id, e.g. [1] or [2,3]. Every factual claim needs a citation.
-- Keep correct claims from the draft. Correct or extend where the new sources change the picture.
-- If sources still don't cover something, say so plainly — do not invent.
-- Output the FULL revised answer, not a delta.`
-
-// selfEvalPrompt asks the model to judge whether its own draft answer is
-// sufficient given the question and sources. JSON-only output keeps parsing
-// deterministic. The "missing" + "refine_queries" fields drive the next
-// research pass when sufficient=false.
-const selfEvalPrompt = `You wrote a research answer. Judge whether it's sufficient given the question and sources.
-
-Output ONLY a JSON object (no markdown, no prose):
-{"sufficient": true|false, "missing": "<one-line gap, empty if sufficient>", "refine_queries": ["<query>", ...]}
-
-Rules:
-- "sufficient": true ONLY if the answer fully addresses the question with current sources.
-- "missing": one short sentence describing what would strengthen the answer (empty string if sufficient).
-- "refine_queries": 1-3 specific search queries that would close the gap (empty array if sufficient). Make them concrete — entity + concept + qualifier — not vague paraphrases.
-- Be honest. Most first-pass answers benefit from one more pass on a specific gap.`
-
-// selfEval is the parsed shape of the JSON the self-eval LLM call emits.
-type selfEval struct {
-	Sufficient    bool     `json:"sufficient"`
-	Missing       string   `json:"missing"`
-	RefineQueries []string `json:"refine_queries"`
-}
-
-// parseSelfEval extracts the {sufficient, missing, refine_queries} JSON from
-// the LLM response. Tolerates leading/trailing prose and markdown fences. On
-// any parse failure returns ok=false so the caller can treat as "stop and
-// keep the current answer" instead of crashing the stream.
-func parseSelfEval(s string) (selfEval, bool) {
-	s = strings.TrimSpace(s)
-	s = jsonFenceRE.ReplaceAllString(s, "$1")
-	// Find the first '{' and last '}' to skip any preamble.
-	i := strings.IndexByte(s, '{')
-	j := strings.LastIndexByte(s, '}')
-	if i < 0 || j <= i {
-		return selfEval{}, false
-	}
-	var ev selfEval
-	if err := json.Unmarshal([]byte(s[i:j+1]), &ev); err != nil {
-		return selfEval{}, false
-	}
-	if len(ev.RefineQueries) > 3 {
-		ev.RefineQueries = ev.RefineQueries[:3]
-	}
-	return ev, true
-}
-
-// jsonFenceRE strips ```json fences and bare ``` fences from LLM output. The
-// judge package has its own copy with the same intent; not worth pulling into
-// a shared package for two callers.
-var jsonFenceRE = regexp.MustCompile("(?s)```(?:json)?\\s*(.*?)\\s*```")
-
-// researchMaxPasses parses ?max_passes from the request. Default 3, valid
-// range 1-10 (clamped). 1 disables the self-eval loop entirely (single-pass
-// /research, today's behavior). The upper cap exists to bound LLM cost +
-// wall-clock: each non-final pass costs 1 synth + 1 self-eval call on top
-// of the per-sub-query retrieval, and the model can in theory loop forever
-// emitting "not yet sufficient" verdicts.
-func researchMaxPasses(r *http.Request) int {
-	const defaultMax = 3
-	const hardCap = 10
-	v := r.URL.Query().Get("max_passes")
-	if v == "" {
-		return defaultMax
-	}
-	n, err := strconv.Atoi(v)
-	if err != nil || n < 1 {
-		return defaultMax
-	}
-	if n > hardCap {
-		return hardCap
-	}
-	return n
-}
-
-type researchResponse struct {
-	Query  string   `json:"query"`
-	Plan   []string `json:"plan"`
-	Expand string   `json:"expand,omitempty"`
-	// retriever label, mirroring /search/answer vocabulary.
-	Retriever       string         `json:"retriever,omitempty"`
-	Answer          string         `json:"answer"`
-	Sources         []answerSource `json:"sources"`
-	Model           string         `json:"model"`
-	Warnings        []string       `json:"warnings,omitempty"`
-	TotalCandidates int            `json:"total_candidates,omitempty"`
-	Took            string         `json:"took"`
-}
-
-// researchSubFanOut bounds how many sub-queries retrieve concurrently within
-// a single /research pass. Shared by the sync (handleResearch) and streaming
-// (streamResearch) paths so their latency profiles stay identical. 3 keeps the
-// site= budget at 3 sub-queries × fan-out-3 = one concurrent batch.
-const researchSubFanOut = 3
-
-func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
-	// Planner runs once on gateway,
-	// each sub-query scatters to peers, single synth here.
-	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
-		s.handleResearchGateway(w, r)
-		return
-	}
-	if s.chat == nil {
-		writeProblem(w, http.StatusNotImplemented,
-			"/research requires cfg.Chat.Model to be set")
-		return
-	}
-	start := time.Now()
-	q := r.URL.Query().Get("q")
-	if q == "" {
-		writeProblem(w, http.StatusBadRequest, "missing q parameter")
-		return
-	}
-	k := 8
-	if v := r.URL.Query().Get("k"); v != "" {
-		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
-			k = n
-		}
-	}
-	// same retrieval filters /search/answer/find_similar accept.
-	// Parsed once here so the streaming and sync paths share semantics.
-	filt, err := parseRetrievalFilters(r)
-	if err != nil {
-		writeProblem(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	includeText := r.URL.Query().Get("include_text") == "true"
-	// SSE streaming for /research. Same trigger as /answer.
-	// Emits phase-aware events so the UI can render the plan and source list
-	// before the synth call completes — /research often runs 10–30s
-	// (2-3 plan→retrieve→synth chat rounds), so phase visibility matters.
-	wantStream := wantsSSE(r)
-	if wantStream {
-		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
-			cacheKey := "research|" + q + "|" + r.URL.Query().Get("site") + "|" + strconv.Itoa(k)
-			if r.Header.Get("Cache-Control") != "no-cache" {
-				if cached, ok := s.researchCache.Get(cacheKey); ok {
-					w.Header().Set("Content-Type", "text/event-stream")
-					w.Header().Set("Cache-Control", "no-cache")
-					w.Header().Set("X-Accel-Buffering", "no")
-					w.WriteHeader(http.StatusOK)
-					_, _ = w.Write(cached)
-					if f, ok2 := w.(http.Flusher); ok2 {
-						f.Flush()
-					}
-					return
-				}
-			}
-			rec := &recordingWriter{ResponseWriter: w}
-			s.streamResearch(rec, r, sc, q, k, filt, start)
-			if rec.buf.Len() > 0 {
-				s.researchCache.Set(cacheKey, rec.buf.Bytes())
-			}
-			return
-		}
-	}
-
-	// Plan — include site domain so the LLM generates site-specific sub-queries
-	// rather than generic web queries that miss small-site content.
-	planQ := q
-	if len(filt.sites) > 0 {
-		siteHints := make([]string, len(filt.sites))
-		for si, ss := range filt.sites {
-			siteHints[si] = ss.host
-			if ss.path != "" {
-				siteHints[si] += ss.path
-			}
-		}
-		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
-		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
-			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
-		}
-	}
-	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: researchPlanPrompt},
-		{Role: "user", Content: planQ},
-	})
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
-		return
-	}
-	subs := parseSubQueries(planRaw, q)
-	maxSubs := 5
-	// site= scope limits the search to a small domain. 3 sub-queries with
-	// fan-out 3 complete in one concurrent batch (~21s each), keeping total
-	// retrieval under 25s so LLM synthesis fits within the 60s budget.
-	if len(filt.sites) > 0 && maxSubs > 3 {
-		maxSubs = 3
-	}
-	if len(subs) > maxSubs {
-		subs = subs[:maxSubs]
-	}
-
-	// Retrieve per sub-query, dedupe by URL keeping best score.
-	type ranked struct {
-		score float64
-		hit   index.Hit
-	}
-	best := make(map[string]ranked, k*len(subs))
-	// Build the site boost map first: its length equals the site's doc count,
-	// which drives the adaptive perSub below.
-	syncBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
-	perSub := k * 2
-	if perSub > 40 {
-		perSub = 40
-	}
-	if len(filt.sites) > 0 {
-		// Fetch deep enough to cover the whole site (×1.2 headroom) so the 50×
-		// boost can reorder every site doc into top-k. Floor 200 preserves the
-		// MaxScore-firing window for tiny site-key terms (e.g. "pilotctl");
-		// ceiling 1000 bounds per-sub BM25 latency. Issue #2's MaxScore
-		// pre-check is what keeps the larger fetch affordable.
-		perSub = max(200, min(1000, int(math.Ceil(float64(len(syncBoostIDs))*1.2))))
-	}
-	// each sub-query goes through retrieveWithExpansion, so
-	// ?expand=hyde gives per-sub-query HyDE (was's behavior) and
-	// ?expand=paraphrase fans out 3 paraphrases × N sub-queries → RRF per
-	// sub-query → merge into best{}. The cross-sub-query merge stays
-	// score-keep-best (not a second RRF) — that's what specified.
-	// retriever dispatch (bm25 / dense / hybrid) applies per
-	// sub-query — every sub-query runs through the same retriever.
-	expandMode := r.URL.Query().Get("expand")
-	// Default to hybrid + rerank on /research — same rationale as /answer.
-	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
-		r.URL.Query().Get("retriever"),
-		r.URL.Query().Get("rerank"),
-	)
-	// Sub-queries are independent retrieve calls and the per-call cost dominates
-	// total latency, so fan them out with a bounded concurrency identical to the
-	// streaming path. bestMu guards the shared best map; hits and syncBoostIDs
-	// are goroutine-local / read-only respectively. There is no seenURLs set in
-	// the sync path (single pass), so the merge is a plain keep-best-score dedupe.
-	var bestMu sync.Mutex
-	var wg sync.WaitGroup
-	sem := make(chan struct{}, researchSubFanOut)
-	for _, sq := range subs {
-		sq := sq
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			sem <- struct{}{}
-			defer func() { <-sem }()
-			hits, _, err := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, syncBoostIDs, filt.sites)
-			if err != nil {
-				// log the specific sub-query so operators can diagnose
-				// 'why was this research thin on sources' — previously silent.
-				log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, err)
-				return
-			}
-			bestMu.Lock()
-			for _, h := range hits {
-				if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
-					best[h.URL] = ranked{score: h.Score, hit: h}
-				}
-			}
-			bestMu.Unlock()
-		}()
-	}
-	wg.Wait()
-	pooled := make([]ranked, 0, len(best))
-	for _, v := range best {
-		pooled = append(pooled, v)
-	}
-	sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
-	// same rerank wiring as /search and /answer — pool widens to
-	// rerankCandK before materialization, rerank reorders the pool, truncate
-	// to k after rerank so citation numbers track the final order.
-	keepCap := k
-	if wantRerank {
-		keepCap = s.rerankCandK
-		if keepCap < k {
-			keepCap = k
-		}
-	}
-	// Truncate the sorted pool to keepCap before materialization. For site=
-	// queries the 50x boost (applied in Search before its descending sort)
-	// guarantees the site's matched docs occupy the front of pooled, so this
-	// cut keeps exactly the boosted docs and bounds the rerank candidate count
-	// (was ~138 for site= queries; now keepCap, default rerankCandK=20).
-	if len(pooled) > keepCap {
-		pooled = pooled[:keepCap]
-	}
-
-	// Materialize candidates; defer sources + prompt build until after rerank.
-	type cand struct {
-		src        answerSource
-		excerpt    string
-		rerankText string
-		score      float64 // pooled score, used by time-decay
-	}
-	cands := make([]cand, 0, len(pooled))
-	for _, p := range pooled {
-		doc, derr := s.store.GetDocByURL(r.Context(), p.hit.URL)
-		if derr != nil || doc == nil {
-			continue
-		}
-		if !filt.allow(doc.URL, doc.PublishedAt) {
-			continue
-		}
-		excerpt := textExcerpt(doc.Text, 1200)
-		src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
-		if !doc.PublishedAt.IsZero() {
-			t := doc.PublishedAt
-			src.PublishedAt = &t
-		}
-		if includeText {
-			src.Text = doc.Text
-		}
-		c := cand{src: src, excerpt: excerpt, score: p.score}
-		if wantRerank {
-			c.rerankText = doc.Title + "\n" + doc.Text
-		}
-		cands = append(cands, c)
-	}
-	// time-decay on /research sync — re-weight pooled cands before
-	// rerank. Sub-queries that hit recent docs bubble up first.
-	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
-	if decaySet && len(cands) > 0 {
-		now := time.Now()
-		for i := range cands {
-			cands[i].score *= decayMultiplier(cands[i].src.PublishedAt, now, decayHalfLife)
-		}
-		sort.SliceStable(cands, func(i, j int) bool { return cands[i].score > cands[j].score })
-	}
-	if wantRerank && len(cands) > 1 {
-		rc := make([]rerank.Candidate, len(cands))
-		for i := range cands {
-			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
-		}
-		if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
-			reordered := make([]cand, 0, len(cands))
-			seen := make(map[int]bool, len(cands))
-			for _, id := range order {
-				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
-					reordered = append(reordered, cands[n])
-					seen[n] = true
-				}
-			}
-			for i, c := range cands {
-				if !seen[i] {
-					reordered = append(reordered, c)
-				}
-			}
-			cands = reordered
-		}
-	}
-	// MMR diversification on /research sync. /research aggregates
-	// across sub-queries — duplicate-ish docs accumulate fast. MMR after
-	// rerank, before truncation.
-	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
-	mmrFired := false
-	if mmrSet && len(cands) > 1 {
-		urls := make([]string, len(cands))
-		for i := range cands {
-			urls[i] = cands[i].src.URL
-		}
-		if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
-			reordered := make([]cand, len(order))
-			for i, idx := range order {
-				reordered[i] = cands[idx]
-			}
-			cands = reordered
-			mmrFired = true
-		}
-	}
-	if len(cands) > k {
-		cands = cands[:k]
-	}
-	sources := make([]answerSource, 0, len(cands))
-	var promptSources strings.Builder
-	for i, c := range cands {
-		// stamp ID = i+1 so the JSON response matches the [N]
-		// citation tokens we emit in the synth prompt below.
-		c.src.ID = i + 1
-		sources = append(sources, c.src)
-		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, c.excerpt)
-	}
-	// Sub-queries don't yield a
-	// single effectiveQuery, so "expansion fired" is approximated by intent:
-	// chat is up and expandMode requested it. Matches what warningsFor() uses
-	// to decide whether to flag a silent no-op.
-	denseReady := s.hnsw != nil && s.embedder != nil
-	expandFired := expandMode != "" && s.chat != nil
-	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, expandFired, wantRerank)
-	if mmrFired {
-		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
-	}
-	if decaySet {
-		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
-	}
-	if len(sources) == 0 {
-		writeJSON(w, http.StatusOK, researchResponse{
-			Query: q, Plan: subs, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
-			Answer:  "No matching sources for any sub-query.",
-			Sources: sources, Model: s.chat.Model(), Warnings: s.warningsFor(r),
-			TotalCandidates: len(best), Took: time.Since(start).String(),
-		})
-		return
-	}
-
-	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
-		{Role: "system", Content: researchSynthPrompt},
-		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Original question: " + q},
-	})
-	if err != nil {
-		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, researchResponse{
-		Query: q, Plan: subs, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
-		Answer: answer, Sources: sources,
-		Model: s.chat.Model(), Warnings: s.warningsFor(r),
-		TotalCandidates: len(best), Took: time.Since(start).String(),
-	})
-}
-
-// streamResearch is the SSE form of handleResearch. Event sequence:
-//
-//	plan    — sub-queries returned by the planner
-//	sources — deduped + ranked pool fed to the synthesizer
-//	chunk   — per chat delta during synth
-//	done    — final {"took": "..."}
-//	error   — terminal; either plan, retrieval, or synth failed
-func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc embed.StreamingChatClient, q string, k int, filt retrievalFilters, start time.Time) {
-	sse := newAnswerSSE(w, start)
-	if sse == nil {
-		writeProblem(w, http.StatusInternalServerError, "streaming requires http.Flusher")
-		return
-	}
-	// /research can sit on a single slow retrieve or chat call for
-	// 10–30 s. Without a keepalive, the browser's HTTP/2 stream times
-	// out as inactive and the request fails mid-pipeline. 7 s gives
-	// generous headroom under Safari's ~30 s idle limit.
-	stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
-	defer stopKA()
-	includeText := r.URL.Query().Get("include_text") == "true"
-
-	// surface silent no-ops upfront so SSE clients can render them
-	// while the plan call is still in flight. Fires before plan to give the
-	// fastest visual feedback when a misconfigured request arrives.
-	sse.warnings(s.warningsFor(r))
-	sse.phase("plan_start", map[string]any{"q": q, "model": sc.Model()})
-
-	// site= hint: LLM generates site-specific sub-queries with domain terminology
-	// rather than generic queries that miss small-site content in BM25 top-200.
-	planQ := q
-	if len(filt.sites) > 0 {
-		siteHints := make([]string, len(filt.sites))
-		for si, ss := range filt.sites {
-			siteHints[si] = ss.host
-			if ss.path != "" {
-				siteHints[si] += ss.path
-			}
-		}
-		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
-		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
-			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
-		}
-	}
-	planRaw, err := s.doChat(r.Context(), sc, []embed.ChatMsg{
-		{Role: "system", Content: researchPlanPrompt},
-		{Role: "user", Content: planQ},
-	})
-	if err != nil {
-		sse.send(map[string]any{"type": "error", "phase": "plan", "error": err.Error()})
-		return
-	}
-	subs := parseSubQueries(planRaw, q)
-	{
-		maxSubs := 5
-		if len(filt.sites) > 0 && maxSubs > 3 {
-			maxSubs = 3 // site= budget: 3 sub-queries × fan-out-3 = one concurrent batch (~21s) + LLM fits in 60s
-		}
-		if len(subs) > maxSubs {
-			subs = subs[:maxSubs]
-		}
-	}
-	// per-sub-query expansion via retrieveWithExpansion.
-	// per-sub-query retriever dispatch (bm25 / dense / hybrid).
-	// read retriever + wantRerank early so the plan event can
-	// surface the full retriever label, not just expand.
-	// Default to hybrid + rerank on /research streaming — same rationale as /answer.
-	expandMode := r.URL.Query().Get("expand")
-	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
-		r.URL.Query().Get("retriever"),
-		r.URL.Query().Get("rerank"),
-	)
-	denseReady := s.hnsw != nil && s.embedder != nil
-	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, expandMode != "", wantRerank)
-
-	// surface the active expansion strategy on the plan event so
-	// UIs can render 'using paraphrase' or 'using HyDE' as soon as the plan
-	// arrives, before per-sub-query expansion fires.
-	planEvent := map[string]any{"type": "plan", "query": q, "plan": subs, "model": sc.Model()}
-	if mode := normalizeExpandMode(expandMode); mode != "" {
-		planEvent["expand"] = mode
-	}
-	if retrieverLabel != "" {
-		planEvent["retriever"] = retrieverLabel
-	}
-	sse.send(planEvent)
-	// Phase event mirrors /query's shape so the chat UI's timeline strip
-	// renders identical rows across all three synth endpoints. Co-exists
-	// with the legacy `type: plan` event above, which the CLI client at
-	// cmd/cosift/main.go keys on.
-	planPhase := map[string]any{"queries": subs, "retriever": retrieverLabel}
-	if mode := normalizeExpandMode(expandMode); mode != "" {
-		planPhase["expand"] = mode
-	}
-	sse.phase("plan", planPhase)
-
-	type ranked struct {
-		score float64
-		hit   index.Hit
-	}
-	type cand struct {
-		src        answerSource
-		excerpt    string
-		rerankText string
-		score      float64
-	}
-
-	// Multi-pass research loop. Each pass: retrieve for the current subs →
-	// fuse → materialize → rerank → mmr → synth → self-eval. Cumulative URL
-	// set across passes; new passes skip URLs already seen so retrieval
-	// widens rather than re-fetching the same docs. After synth, the model
-	// judges whether its draft is sufficient. If not, we use its
-	// refine_queries to drive the next pass. Cap at maxPasses to bound
-	// latency + LLM cost.
-	maxPasses := researchMaxPasses(r)
-	// site= constrains to a small domain: multi-pass BM25 at fetchK=300 costs
-	// 21s × passes beyond the 60s budget. Cap to 1 pass — a small site's corpus
-	// is fully represented in the first retrieval round anyway.
-	if len(filt.sites) > 0 && maxPasses > 1 {
-		maxPasses = 1
-	}
-	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
-	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
-	// Pre-build site boost map once per request (O(site_docs) famHost scan,
-	// cached for repeat queries). Nil when site= is absent or store unavailable.
-	// Built before perSub because its length equals the site doc count.
-	siteBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
-	perSub := k * 2
-	if perSub > 40 {
-		perSub = 40
-	}
-	if len(filt.sites) > 0 {
-		// Fetch deep enough to cover the whole site (×1.2 headroom); floor 200
-		// preserves the MaxScore-firing window for tiny site-key terms, ceiling
-		// 1000 bounds per-sub BM25 latency. Mitigated by Issue #2's MaxScore
-		// pre-check.
-		perSub = max(200, min(1000, int(math.Ceil(float64(len(siteBoostIDs))*1.2))))
-	}
-	keepCap := k
-	if wantRerank {
-		keepCap = s.rerankCandK
-		if keepCap < k {
-			keepCap = k
-		}
-	}
-
-	seenURLs := make(map[string]bool)
-	allCands := make([]cand, 0, k*maxPasses)
-	totalCandidates := 0 // counts URL contributions across passes for the sources event
-	var lastAnswer string
-	var finalRetrieverLabel string
-
-	for pass := 1; pass <= maxPasses; pass++ {
-		sse.phase("pass_start", map[string]any{"pass": pass, "queries": subs})
-
-		// Retrieval round for this pass. Sub-queries run concurrently with
-		// a bounded fan-out — they're independent calls to s.retrieve and
-		// the per-call cost dominates total pass latency. Serial execution
-		// of N sub-queries at ~12 s each pushed pass-1+pass-2 wall-clock
-		// past 60 s on this corpus, blowing the browser's hardcoded fetch
-		// timeout on long-streaming responses. With fan-out the pass
-		// shrinks to ~max(sub-query latency) plus the per-goroutine
-		// bookkeeping. sse.send is mutex-protected; bestMu protects best.
-		// seenURLs is read-only during this loop (last written at the end
-		// of the prior pass), so no synchronization is needed for it.
-		best := make(map[string]ranked, k*len(subs))
-		var bestMu sync.Mutex
-		var wg sync.WaitGroup
-		sem := make(chan struct{}, researchSubFanOut)
-		for _, sq := range subs {
-			sq := sq
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				sem <- struct{}{}
-				defer func() { <-sem }()
-				sse.phase("retrieving", map[string]any{"pass": pass, "query": sq})
-				hits, _, rerr := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, siteBoostIDs, filt.sites)
-				if rerr != nil {
-					log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, rerr)
-					sse.phase("expand", map[string]any{"pass": pass, "query": sq, "error": rerr.Error()})
-					return
-				}
-				bestMu.Lock()
-				for _, h := range hits {
-					if seenURLs[h.URL] {
-						continue
-					}
-					if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
-						best[h.URL] = ranked{score: h.Score, hit: h}
-					}
-				}
-				bestMu.Unlock()
-				sse.phase("expand", map[string]any{"pass": pass, "query": sq, "hits": len(hits)})
-			}()
-		}
-		wg.Wait()
-		totalCandidates += len(best)
-		pooled := make([]ranked, 0, len(best))
-		for _, v := range best {
-			pooled = append(pooled, v)
-		}
-		sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
-		sse.phase("fuse", map[string]any{"pass": pass, "unique_urls": len(pooled)})
-		// Truncate the sorted pool to keepCap before materialization. For site=
-		// queries the 50x boost (applied in Search before its descending sort)
-		// puts the site's matched docs at the front of pooled, so this cut keeps
-		// the boosted docs and bounds the LLM rerank candidate count to keepCap.
-		if len(pooled) > keepCap {
-			pooled = pooled[:keepCap]
-		}
-
-		// Materialize this pass's new candidates (filt-aware).
-		newCands := make([]cand, 0, len(pooled))
-		for _, p := range pooled {
-			doc, derr := s.store.GetDocByURL(r.Context(), p.hit.URL)
-			if derr != nil || doc == nil {
-				continue
-			}
-			if !filt.allow(doc.URL, doc.PublishedAt) {
-				continue
-			}
-			excerpt := textExcerpt(doc.Text, 1200)
-			src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
-			if !doc.PublishedAt.IsZero() {
-				t := doc.PublishedAt
-				src.PublishedAt = &t
-			}
-			if includeText {
-				src.Text = doc.Text
-			}
-			c := cand{src: src, excerpt: excerpt, score: p.score}
-			if wantRerank {
-				c.rerankText = doc.Title + "\n" + doc.Text
-			}
-			newCands = append(newCands, c)
-		}
-		sse.phase("materialize", map[string]any{"pass": pass, "candidates": len(newCands)})
-
-		// Optional time-decay on this pass's new candidates.
-		passLabel := retrieverLabel
-		if decaySet && len(newCands) > 0 {
-			now := time.Now()
-			for i := range newCands {
-				newCands[i].score *= decayMultiplier(newCands[i].src.PublishedAt, now, decayHalfLife)
-			}
-			sort.SliceStable(newCands, func(i, j int) bool { return newCands[i].score > newCands[j].score })
-			passLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
-		}
-		if wantRerank && len(newCands) > 1 {
-			rc := make([]rerank.Candidate, len(newCands))
-			for i := range newCands {
-				rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: newCands[i].rerankText}
-			}
-			if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
-				reordered := make([]cand, 0, len(newCands))
-				seenIdx := make(map[int]bool, len(newCands))
-				for _, id := range order {
-					if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(newCands) && !seenIdx[n] {
-						reordered = append(reordered, newCands[n])
-						seenIdx[n] = true
-					}
-				}
-				for i, c := range newCands {
-					if !seenIdx[i] {
-						reordered = append(reordered, c)
-					}
-				}
-				newCands = reordered
-			}
-			sse.phase("rerank", map[string]any{"pass": pass, "reranker": s.reranker.Name(), "candidates": len(newCands)})
-		}
-		if mmrSet && len(newCands) > 1 {
-			urls := make([]string, len(newCands))
-			for i := range newCands {
-				urls[i] = newCands[i].src.URL
-			}
-			if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
-				reordered := make([]cand, len(order))
-				for i, idx := range order {
-					reordered[i] = newCands[idx]
-				}
-				newCands = reordered
-				passLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
-				sse.phase("mmr", map[string]any{"pass": pass, "lambda": mmrLambda, "candidates": len(newCands)})
-			}
-		}
-		if len(newCands) > k {
-			newCands = newCands[:k]
-		}
-		// Promote into the cumulative pool.
-		for _, c := range newCands {
-			seenURLs[c.src.URL] = true
-			allCands = append(allCands, c)
-		}
-		finalRetrieverLabel = passLabel
-
-		// First-pass-empty path mirrors today's behavior: if pass 1 finds
-		// no usable sources at all, bail with empty=true.
-		if pass == 1 && len(allCands) == 0 {
-			sse.send(map[string]any{"type": "done", "took": time.Since(start).String(), "empty": true})
-			return
-		}
-		// Later-pass empty (no new sources added): synth would just rewrite
-		// the prior answer with no new signal. Stop and keep lastAnswer.
-		if pass > 1 && len(newCands) == 0 {
-			break
-		}
-
-		// Build the cumulative sources slice + prompt block, stamping IDs
-		// 1..N in the order URLs were promoted.
-		// For site= queries trim excerpts to 600 chars — reduces synthesis
-		// context from ~9.6k to ~4.8k chars, cutting synthesis latency ~40%.
-		synthExcerptLen := 1200
-		if len(filt.sites) > 0 {
-			synthExcerptLen = 600
-		}
-		cumulativeSources := make([]answerSource, 0, len(allCands))
-		var promptSources strings.Builder
-		for i, c := range allCands {
-			c.src.ID = i + 1
-			cumulativeSources = append(cumulativeSources, c.src)
-			ex := c.excerpt
-			if len(ex) > synthExcerptLen {
-				ex = ex[:synthExcerptLen]
-			}
-			fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, ex)
-		}
-		srcEvt := map[string]any{
-			"type": "sources", "sources": cumulativeSources,
-			"total_candidates": totalCandidates, "pass": pass,
-		}
-		if finalRetrieverLabel != "" {
-			srcEvt["retriever"] = finalRetrieverLabel
-		}
-		sse.send(srcEvt)
-
-		// Synth. Pass 1 uses the standard prompt; pass 2+ uses the refine
-		// prompt with the prior draft injected.
-		sse.phase("synth_start", map[string]any{
-			"pass": pass, "sources": len(cumulativeSources), "model": sc.Model(),
-		})
-		var synthMsgs []embed.ChatMsg
-		userMsg := "Sources:\n\n" + promptSources.String() + "Original question: " + q
-		if pass == 1 {
-			synthMsgs = []embed.ChatMsg{
-				{Role: "system", Content: researchSynthPrompt},
-				{Role: "user", Content: userMsg},
-			}
-		} else {
-			synthMsgs = []embed.ChatMsg{
-				{Role: "system", Content: researchRefineSynthPrompt},
-				{Role: "user", Content: userMsg + "\n\nYour prior draft answer:\n" + lastAnswer},
-			}
-		}
-		full, serr := s.doChatStream(r.Context(), sc, synthMsgs, sse.chunk)
-		if serr != nil {
-			sse.send(map[string]any{"type": "error", "phase": "synth", "error": serr.Error()})
-			return
-		}
-		lastAnswer = full
-
-		// On the final pass, skip self-eval — nothing to escalate to.
-		if pass == maxPasses {
-			break
-		}
-
-		// Self-evaluate. The model decides whether to escalate.
-		sse.phase("self_eval_start", map[string]any{"pass": pass})
-		evalUserMsg := fmt.Sprintf(
-			"Question: %s\n\nYour answer:\n%s\n\nSources used (id — title — url):\n%s",
-			q, lastAnswer, summarizeSourceList(cumulativeSources),
-		)
-		evalRaw, eerr := s.doChat(r.Context(), sc, []embed.ChatMsg{
-			{Role: "system", Content: selfEvalPrompt},
-			{Role: "user", Content: evalUserMsg},
-		})
-		if eerr != nil {
-			log.Printf("pebble-serve: /research self-eval pass %d failed: %v", pass, eerr)
-			sse.phase("self_eval", map[string]any{"pass": pass, "error": eerr.Error()})
-			break
-		}
-		ev, ok := parseSelfEval(evalRaw)
-		if !ok {
-			sse.phase("self_eval", map[string]any{"pass": pass, "parse_failed": true})
-			break
-		}
-		sse.phase("self_eval", map[string]any{
-			"pass": pass, "sufficient": ev.Sufficient,
-			"missing": ev.Missing, "refine_queries": ev.RefineQueries,
-		})
-		if ev.Sufficient {
-			break
-		}
-		// Blurb summarizing why we're escalating; UI renders inline.
-		blurbText := strings.TrimSpace(ev.Missing)
-		if blurbText == "" {
-			blurbText = "More depth needed"
-		}
-		blurbText += " — searching deeper."
-		sse.phase("blurb", map[string]any{"pass": pass, "text": blurbText})
-
-		// Drive the next pass with the refined queries the model proposed.
-		if len(ev.RefineQueries) == 0 {
-			break
-		}
-		subs = ev.RefineQueries
-		if len(subs) > 5 {
-			subs = subs[:5]
-		}
-	}
-
-	sse.done()
-}
-
-// summarizeSourceList formats sources into compact "[id] title — url" lines
-// for the self-eval user message. Avoids piping the full excerpts back into
-// the eval prompt — the eval is about coverage, not re-reading.
-func summarizeSourceList(srcs []answerSource) string {
-	var sb strings.Builder
-	for _, s := range srcs {
-		fmt.Fprintf(&sb, "[%d] %s — %s\n", s.ID, s.Title, s.URL)
-	}
-	return sb.String()
-}
-
-// retrievalFilters bundles the four post-retrieval predicates /search,
-// /answer, /find_similar, and /research all share. Centralized in
-// so /research's sync + stream paths stay in lockstep.
-type retrievalFilters struct {
-	include    []string
-	exclude    []string
-	sites      []siteScope
-	since      time.Time
-	until      time.Time
-	dateActive bool
-}
-
-func parseRetrievalFilters(r *http.Request) (retrievalFilters, error) {
-	f := retrievalFilters{
-		include: splitDomainsCSV(r.URL.Query().Get("include_domains")),
-		exclude: splitDomainsCSV(r.URL.Query().Get("exclude_domains")),
-		sites:   parseSiteScopes(r.URL.Query().Get("site")),
-	}
-	since, err := parseDateBound(r.URL.Query().Get("since"))
-	if err != nil {
-		return f, fmt.Errorf("since: %w", err)
-	}
-	until, err := parseDateBound(r.URL.Query().Get("until"))
-	if err != nil {
-		return f, fmt.Errorf("until: %w", err)
-	}
-	f.since = since
-	f.until = until
-	f.dateActive = !since.IsZero() || !until.IsZero()
-	return f, nil
-}
-
-// allow reports whether (url, publishedAt) clears the filter. publishedAt
-// can be the zero Time when the caller doesn't have it loaded; zero is
-// treated as "unknown" and dropped under any date filter.
-func (f retrievalFilters) allow(rawURL string, publishedAt time.Time) bool {
-	if len(f.include) > 0 || len(f.exclude) > 0 {
-		host := hostOf(rawURL)
-		if len(f.include) > 0 && !matchesAnyDomain(host, f.include) {
-			return false
-		}
-		if len(f.exclude) > 0 && matchesAnyDomain(host, f.exclude) {
-			return false
-		}
-	}
-	if len(f.sites) > 0 && !matchesAnySite(rawURL, f.sites) {
-		return false
-	}
-	if f.dateActive {
-		if publishedAt.IsZero() {
-			return false
-		}
-		if !f.since.IsZero() && publishedAt.Before(f.since) {
-			return false
-		}
-		if !f.until.IsZero() && publishedAt.After(f.until) {
-			return false
-		}
-	}
-	return true
-}
-
-func parseSubQueries(raw, fallback string) []string {
-	raw = strings.TrimSpace(raw)
-	for _, fence := range []string{"```json", "```"} {
-		raw = strings.TrimPrefix(raw, fence)
-		raw = strings.TrimSuffix(raw, "```")
-	}
-	raw = strings.TrimSpace(raw)
-	startIdx := strings.Index(raw, "[")
-	endIdx := strings.LastIndex(raw, "]")
-	if startIdx >= 0 && endIdx > startIdx {
-		var arr []string
-		if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &arr); err == nil && len(arr) > 0 {
-			return arr
-		}
-	}
-	return []string{fallback}
-}
-
-func splitDomainsCSV(s string) []string {
-	if s == "" {
-		return nil
-	}
-	parts := strings.Split(s, ",")
-	out := make([]string, 0, len(parts))
-	for _, p := range parts {
-		t := strings.ToLower(strings.TrimSpace(p))
-		if t != "" {
-			out = append(out, t)
-		}
-	}
-	return out
-}
-
-func matchesAnyDomain(host string, patterns []string) bool {
-	host = strings.ToLower(host)
-	for _, p := range patterns {
-		if host == p || strings.HasSuffix(host, "."+p) {
-			return true
-		}
-	}
-	return false
-}
-
-func hostOf(rawURL string) string {
-	u, err := url.Parse(rawURL)
-	if err != nil {
-		return ""
-	}
-	return u.Hostname()
-}
-
-// siteScope is one entry of the `site` search filter: a host (suffix-matched
-// on dot boundaries, same as include_domains) plus an optional URL path
-// prefix. A zero path matches the whole host; a non-empty path scopes results
-// to a section of the site (e.g. host "pilotprotocol.network" + path "/docs").
-type siteScope struct {
-	host string
-	path string // normalized, no trailing slash; "" = any path
-}
-
-// parseSiteScopes parses the `site` parameter — a CSV of host or host/path
-// (or full-URL) entries — into scopes. Examples of a single entry:
-//
-//	pilotprotocol.network              → whole host (and subdomains)
-//	pilotprotocol.network/docs         → only URLs under /docs
-//	https://pilotprotocol.network/docs → same (scheme tolerated)
-func parseSiteScopes(csv string) []siteScope {
-	if csv == "" {
-		return nil
-	}
-	var out []siteScope
-	for _, raw := range strings.Split(csv, ",") {
-		t := strings.TrimSpace(raw)
-		if t == "" {
-			continue
-		}
-		t = strings.TrimPrefix(t, "https://")
-		t = strings.TrimPrefix(t, "http://")
-		host, path := t, ""
-		if i := strings.IndexByte(t, '/'); i >= 0 {
-			host, path = t[:i], t[i:]
-		}
-		host = strings.ToLower(strings.TrimSpace(host))
-		path = strings.TrimRight(strings.TrimSpace(path), "/")
-		if host == "" {
-			continue
-		}
-		out = append(out, siteScope{host: host, path: path})
-	}
-	return out
-}
-
-// matchesAnySite reports whether rawURL falls within any of the scopes. Host
-// matching reuses include_domains semantics (exact or dot-boundary suffix);
-// path matching is a segment-boundary prefix so "/docs" matches "/docs" and
-// "/docs/x" but not "/docsearch".
-func matchesAnySite(rawURL string, scopes []siteScope) bool {
-	if len(scopes) == 0 {
-		return true
-	}
-	u, err := url.Parse(rawURL)
-	if err != nil {
-		return false
-	}
-	host := strings.ToLower(u.Hostname())
-	p := u.Path
-	for _, sc := range scopes {
-		if host != sc.host && !strings.HasSuffix(host, "."+sc.host) {
-			continue
-		}
-		if sc.path == "" || p == sc.path || strings.HasPrefix(p, sc.path+"/") {
-			return true
-		}
-	}
-	return false
-}
-
-// parseDateBound accepts the same forms as the SQLite-side server: empty
-// (zero time), RFC3339 ("2026-01-15T00:00:00Z"), or a bare date
-// ("2026-01-15", treated as UTC midnight).
-func parseDateBound(s string) (time.Time, error) {
-	if s == "" {
-		return time.Time{}, nil
-	}
-	if t, err := time.Parse(time.RFC3339, s); err == nil {
-		return t, nil
-	}
-	if t, err := time.Parse("2006-01-02", s); err == nil {
-		return t, nil
-	}
-	return time.Time{}, fmt.Errorf("expected YYYY-MM-DD or RFC3339, got %q", s)
-}
-
-// textExcerpt returns a body-prefix excerpt no longer than maxBytes, cut at a
-// word boundary if one is available within the trailing 16 bytes.
-// Static prefix (not query-aware) — matches the SQLite-side DocMeta.Excerpt
-// shape; a query-aware passage extractor is the path on the index
-// hot path and lives there, not in the HTTP handler.
-func textExcerpt(text string, maxBytes int) string {
-	if len(text) <= maxBytes {
-		return text
-	}
-	cut := text[:maxBytes]
-	for i := len(cut) - 1; i >= len(cut)-16 && i > 0; i-- {
-		if cut[i] == ' ' || cut[i] == '\n' || cut[i] == '\t' {
-			cut = cut[:i]
-			break
-		}
-	}
-	return strings.TrimSpace(cut) + "…"
-}
-
-func (s *pebbleHTTP) handleContents(w http.ResponseWriter, r *http.Request) {
-	rawURL := r.URL.Query().Get("url")
-	if rawURL == "" {
-		writeProblem(w, http.StatusBadRequest, "missing url parameter")
-		return
-	}
-	decoded, err := url.QueryUnescape(rawURL)
-	if err != nil {
-		writeProblem(w, http.StatusBadRequest, "url parameter is not URL-encoded")
-		return
-	}
-	doc, err := s.store.GetDocByURL(r.Context(), decoded)
-	if errors.Is(err, store.ErrNotFound) {
-		writeProblem(w, http.StatusNotFound, "url not in index")
-		return
-	}
-	if err != nil {
-		writeProblem(w, http.StatusInternalServerError, err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{
-		"url":          doc.URL,
-		"title":        doc.Title,
-		"text":         doc.Text,
-		"author":       doc.Author,
-		"published_at": doc.PublishedAt,
-		"fetched_at":   doc.FetchedAt,
-	})
-}
-
-// POST /contents — batch URL → document. Up to 100 URLs in
-// one round-trip. URLs not in the index emit a {url, found:false, error}
-// stub in the same slot so the caller can correlate positionally. Wire
-// shape (results+took, per-item found+cached+lang) mirrors the SQLite-side
-// /contents POST so `cosift contents <url> <url>` works against either
-// backend without code changes.
-type contentsBatchReq struct {
-	URLs []string `json:"urls"`
-}
-
-type contentsBatchItem struct {
-	URL         string    `json:"url"`
-	Found       bool      `json:"found"`
-	Title       string    `json:"title,omitempty"`
-	Text        string    `json:"text,omitempty"`
-	Lang        string    `json:"lang,omitempty"`
-	Cached      bool      `json:"cached"`
-	Author      string    `json:"author,omitempty"`
-	PublishedAt time.Time `json:"published_at,omitempty"`
-	FetchedAt   time.Time `json:"fetched_at,omitempty"`
-	Error       string    `json:"error,omitempty"`
-}
-
-func (s *pebbleHTTP) handleContentsBatch(w http.ResponseWriter, r *http.Request) {
-	start := time.Now()
-	var req contentsBatchReq
-	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
-		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
-		return
-	}
-	if len(req.URLs) == 0 {
-		writeProblem(w, http.StatusBadRequest, "urls: must be a non-empty array")
-		return
-	}
-	if len(req.URLs) > 100 {
-		writeProblem(w, http.StatusBadRequest, "urls: at most 100 per request")
-		return
-	}
-	results := make([]contentsBatchItem, 0, len(req.URLs))
-	for _, u := range req.URLs {
-		item := contentsBatchItem{URL: u}
-		doc, err := s.store.GetDocByURL(r.Context(), u)
-		switch {
-		case errors.Is(err, store.ErrNotFound):
-			item.Error = "not in index"
-		case err != nil:
-			item.Error = err.Error()
-		case doc == nil:
-			item.Error = "not in index"
-		default:
-			item.Found = true
-			item.Cached = true
-			item.Title = doc.Title
-			item.Text = doc.Text
-			item.Lang = doc.Lang
-			item.Author = doc.Author
-			item.PublishedAt = doc.PublishedAt
-			item.FetchedAt = doc.FetchedAt
-		}
-		results = append(results, item)
-	}
-	writeJSON(w, http.StatusOK, map[string]any{
-		"results": results,
-		"took":    time.Since(start).String(),
-	})
-}
-
-// runPebbleInfo prints Pebble's built-in metrics for the store at -dir.
-// openPebbleOrFriendlyErr wraps store.OpenPebble with a more
-// helpful error message when the underlying failure is lock contention (a
-// pebble-serve / live crawl is holding the single-writer lock). Callers
-// using offline CLI subcommands (pebble-info, verify) hit this when run
-// during an active deployment.
-func openPebbleOrFriendlyErr(d string) (*store.PebbleStore, error) {
-	ps, err := store.OpenPebble(d)
-	if err != nil {
-		msg := err.Error()
-		if strings.Contains(msg, "lock") || strings.Contains(msg, "resource temporarily unavailable") {
-			return nil, fmt.Errorf("open pebble at %s: writer lock is held by another process (pebble-serve / crawl in flight); stop the running service first", d)
-		}
-		return nil, fmt.Errorf("open pebble at %s: %w", d, err)
-	}
-	return ps, nil
-}
-
-// runVerifyViaServer GETs pebble-serve's /verify endpoint and
-// renders the JSON body in the same shape runVerifyPebble's local path emits.
-// Lets `cosift verify -server URL` work against a running pebble-serve while
-// the writer lock is held by the crawl / serve process.
-func runVerifyViaServer(ctx context.Context, serverURL string, asJSON bool) error {
-	endpoint := strings.TrimRight(serverURL, "/") + "/verify"
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
-	if err != nil {
-		return err
-	}
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("GET %s: %w", endpoint, err)
-	}
-	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return err
-	}
-	if asJSON {
-		fmt.Println(string(body))
-	} else {
-		var d struct {
-			OK                 bool  `json:"ok"`
-			IndexedDocsCounter int64 `json:"indexed_docs_counter"`
-			IndexedDocsScan    int64 `json:"indexed_docs_scan"`
-			IndexedDocsDrift   int64 `json:"indexed_docs_drift"`
-			SumDocLenCounter   int64 `json:"sum_doc_len_counter"`
-			SumDocLenScan      int64 `json:"sum_doc_len_scan"`
-			SumDocLenDrift     int64 `json:"sum_doc_len_drift"`
-		}
-		if err := json.Unmarshal(body, &d); err != nil {
-			return fmt.Errorf("decode %s: %w", endpoint, err)
-		}
-		fmt.Printf("pebble-serve: %s\n\n", serverURL)
-		fmt.Printf("  indexed_docs (counter): %d\n", d.IndexedDocsCounter)
-		fmt.Printf("  indexed_docs (scan):    %d\n", d.IndexedDocsScan)
-		fmt.Printf("  sum_doc_len  (counter): %d\n", d.SumDocLenCounter)
-		fmt.Printf("  sum_doc_len  (scan):    %d\n", d.SumDocLenScan)
-		if d.OK {
-			fmt.Println("\nOK: counters match the 'l' family scan.")
-		} else {
-			fmt.Printf("\nDRIFT: indexed_docs Δ=%+d, sum_doc_len Δ=%+d\n", d.IndexedDocsDrift, d.SumDocLenDrift)
-		}
-	}
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("counter drift detected (server returned %d)", resp.StatusCode)
-	}
-	return nil
-}
-
-// pebbleInfoJSON shapes the -json output of `cosift pebble-info`. Extracted
-// in so the shape can be unit-tested without spawning a subprocess.
-// Mirrors the /stats response — same jq filters compose against either source.
-func pebbleInfoJSON(path string, st store.Stats, sumLen, indexedDocs int64, meta index.HNSWMeta, hnswOK bool) map[string]any {
-	retrievers := []string{"bm25", "bm25-mlt"}
-	if hnswOK {
-		retrievers = append(retrievers, "dense", "hybrid")
-	}
-	out := map[string]any{
-		"path":         path,
-		"documents":    st.Documents,
-		"indexed_docs": indexedDocs,
-		"sum_doc_len":  sumLen,
-		"hnsw_loaded":  hnswOK,
-		"retrievers":   retrievers,
-	}
-	if indexedDocs > 0 {
-		out["avg_doc_len"] = float64(sumLen) / float64(indexedDocs)
-	}
-	if hnswOK {
-		out["vector_nodes"] = meta.NodeCount
-		out["vector_dim"] = meta.Dim
-	}
-	return out
-}
-
-// operator visibility into LSM levels, WAL state, on-disk
-// size, and compaction queue, surfaced via pebble.Metrics().String().
-func runPebbleInfo(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("pebble-info", flag.ExitOnError)
-	dir := fs.String("dir", "", "PebbleStore directory (defaults to <cfg.DataDir>/pebble)")
-	// Mirrors
-	// the shape /stats returns ( retrievers list,'s
-	// vector meta) so the same jq filters compose against either source.
-	asJSON := fs.Bool("json", false, "emit JSON instead of human-readable text (no pebble.Metrics dump)")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	d := *dir
-	if d == "" {
-		d = filepath.Join(cfg.DataDir, "pebble")
-	}
-	ps, err := openPebbleOrFriendlyErr(d)
-	if err != nil {
-		return err
-	}
-	defer ps.Close()
-
-	st, err := ps.Stats(ctx)
-	if err != nil {
-		return err
-	}
-	sumLen, indexedDocs, _ := ps.CorpusStats(ctx)
-	meta, hnswOK, _ := index.LoadHNSWMeta(ctx, ps)
-
-	if *asJSON {
-		out := pebbleInfoJSON(d, st, sumLen, indexedDocs, meta, hnswOK)
-		blob, _ := json.MarshalIndent(out, "", "  ")
-		fmt.Println(string(blob))
-		return nil
-	}
-
-	fmt.Printf("PebbleStore: %s\n\n", d)
-	fmt.Printf("  documents:    %d\n", st.Documents)
-	// pebble-info already needs
-	// to read the store; reading them costs O(1) and gives operators 'is this
-	// store healthy' without round-tripping through pebble-serve /stats.
-	if indexedDocs > 0 {
-		fmt.Printf("  indexed_docs: %d\n", indexedDocs)
-		fmt.Printf("  sum_doc_len:  %d\n", sumLen)
-		fmt.Printf("  avg_doc_len:  %.2f\n", float64(sumLen)/float64(indexedDocs))
-	}
-	// when an HNSW meta blob is persisted, surface dim+nodes here
-	// too. Same cheap 20-byte read pebble-serve does at startup.
-	// Operators running pebble-info to inspect an offline store get the dense
-	// shape without opening pebble-serve.
-	// bm25/bm25-mlt
-	// always. dense/hybrid need the graph (meta present) AND, for non-URL
-	// modes, a runtime embedder — offline we can only check the persisted
-	// shape, so we report 'available with embedder' rather than asserting.
-	if hnswOK {
-		fmt.Printf("  vector_nodes: %d\n", meta.NodeCount)
-		fmt.Printf("  vector_dim:   %d\n", meta.Dim)
-	}
-	fmt.Println()
-	fmt.Println("--- retrievers ---")
-	fmt.Println("  bm25, bm25-mlt: always (BM25 index)")
-	if hnswOK {
-		fmt.Println("  dense:          available — /find_similar?url= works without embedder;")
-		fmt.Println("                  /search /answer /research need an embedder configured at server start")
-		fmt.Println("  hybrid:         available (same requirements as dense)")
-	} else {
-		fmt.Println("  dense, hybrid:  unavailable — no HNSW graph persisted in this store")
-		fmt.Println("                  (build embeddings during crawl with cfg.Embeddings.Model set)")
-	}
-	fmt.Println()
-	fmt.Println("--- pebble.Metrics ---")
-	fmt.Println(ps.Metrics().String())
-	return nil
-}
-
-// verify the running counters ('m'+indexed_docs,
-// 'm'+sum_doc_len) against an authoritative scan of the 'l' family.
-// Drift would mean a crash or bug left the counter inconsistent —
-// flagged here so it can be re-derived from the scan.
-func runVerifyPebble(ctx context.Context, cfg *config.Config, args []string) error {
-	fs := flag.NewFlagSet("verify", flag.ExitOnError)
-	dir := fs.String("dir", "", "PebbleStore directory (defaults to <cfg.DataDir>/pebble)")
-	// machine-readable output for CI integration.
-	asJSON := fs.Bool("json", false, "emit JSON report instead of human text (suitable for jq / CI)")
-	// -server URL routes the check through a running pebble-serve's
-	// /verify endpoint instead of opening the store directly. Useful when a
-	// crawl or pebble-serve is holding the writer lock.
-	serverURL := fs.String("server", "", "pebble-serve URL — when set, GETs /verify instead of opening the store")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	if *serverURL != "" {
-		return runVerifyViaServer(ctx, *serverURL, *asJSON)
-	}
-	d := *dir
-	if d == "" {
-		d = filepath.Join(cfg.DataDir, "pebble")
-	}
-	ps, err := openPebbleOrFriendlyErr(d)
-	if err != nil {
-		return err
-	}
-	defer ps.Close()
-
-	counterSum, counterCount, err := ps.CorpusStats(ctx)
-	if err != nil {
-		return fmt.Errorf("read counters: %w", err)
-	}
-	scanSum, scanCount, err := ps.SumDocLengths(ctx)
-	if err != nil {
-		return fmt.Errorf("scan 'l' family: %w", err)
-	}
-
-	driftCount := counterCount - scanCount
-	driftSum := counterSum - scanSum
-	ok := driftCount == 0 && driftSum == 0
-
-	if *asJSON {
-		out := map[string]any{
-			"path":                 d,
-			"ok":                   ok,
-			"indexed_docs_counter": counterCount,
-			"indexed_docs_scan":    scanCount,
-			"indexed_docs_drift":   driftCount,
-			"sum_doc_len_counter":  counterSum,
-			"sum_doc_len_scan":     scanSum,
-			"sum_doc_len_drift":    driftSum,
-		}
-		enc := json.NewEncoder(os.Stdout)
-		enc.SetIndent("", "  ")
-		_ = enc.Encode(out)
-		if !ok {
-			return fmt.Errorf("counter drift detected")
-		}
-		return nil
-	}
-
-	fmt.Printf("PebbleStore: %s\n\n", d)
-	fmt.Printf("  indexed_docs (counter): %d\n", counterCount)
-	fmt.Printf("  indexed_docs (scan):    %d\n", scanCount)
-	fmt.Printf("  sum_doc_len  (counter): %d\n", counterSum)
-	fmt.Printf("  sum_doc_len  (scan):    %d\n", scanSum)
-	if ok {
-		fmt.Println("\nOK: counters match the 'l' family scan.")
-		return nil
-	}
-	fmt.Printf("\nDRIFT: indexed_docs Δ=%+d, sum_doc_len Δ=%+d\n", driftCount, driftSum)
-	return fmt.Errorf("counter drift detected")
-}
-
-func writeJSON(w http.ResponseWriter, status int, body any) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(body)
-}
-
-func writeProblem(w http.ResponseWriter, status int, detail string) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(map[string]any{
-		"error":  http.StatusText(status),
-		"status": status,
-		"detail": detail,
-	})
-}
diff --git a/cmd/cosift/serve_admin.go b/cmd/cosift/serve_admin.go
new file mode 100644
index 0000000..3eabfa8
--- /dev/null
+++ b/cmd/cosift/serve_admin.go
@@ -0,0 +1,623 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// handlePQEncode backfills PQ codes for every node currently missing one,
+// against the codebook already loaded on this serve. Order-of-magnitude
+// faster than handlePQTrain because it skips k-means; just encode loop.
+func (s *pebbleHTTP) handlePQEncode(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.hnsw == nil {
+		writeProblem(w, http.StatusBadRequest, "pq-encode: no HNSW loaded")
+		return
+	}
+	if !s.hnsw.HasPQ() {
+		writeProblem(w, http.StatusBadRequest, "pq-encode: no codebook loaded — run /admin/pq-train first")
+		return
+	}
+	t0 := time.Now()
+	ids, codes, err := s.hnsw.EncodeMissing()
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, "encode: "+err.Error())
+		return
+	}
+	encodeElapsed := time.Since(t0)
+	if len(ids) == 0 {
+		writeJSON(w, http.StatusOK, map[string]any{
+			"encoded":       0,
+			"total":         s.hnsw.Len(),
+			"already_full":  true,
+			"total_elapsed": encodeElapsed.String(),
+		})
+		return
+	}
+	// Persist freshly-encoded codes in a single batch.
+	pq := s.hnsw.PQStatus()
+	cb := &index.PQCodebook{Dim: pq.Dim, M: pq.M, K: pq.K, SubDim: pq.Dim / pq.M}
+	entries := make([]store.PQCodeEntry, len(ids))
+	for i := range ids {
+		entries[i] = store.PQCodeEntry{ID: ids[i], Blob: cb.EncodeCodeBlob(codes[i])}
+	}
+	persistT0 := time.Now()
+	if err := s.store.PutPQCodesBatch(r.Context(), entries); err != nil {
+		writeProblem(w, http.StatusInternalServerError, "persist codes: "+err.Error())
+		return
+	}
+	persistElapsed := time.Since(persistT0)
+	total := s.hnsw.Len()
+	coverage := 100.0 * float64(pq.NodesWithCode+len(ids)) / float64(total)
+	totalElapsed := time.Since(t0)
+	log.Printf("pq-encode: backfilled %d codes in %s (persist %s, total %s) → coverage %.1f%%",
+		len(ids), encodeElapsed-persistElapsed, persistElapsed, totalElapsed, coverage)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"encoded":         len(ids),
+		"total":           total,
+		"coverage_pct":    coverage,
+		"encode_elapsed":  (encodeElapsed - persistElapsed).String(),
+		"persist_elapsed": persistElapsed.String(),
+		"total_elapsed":   totalElapsed.String(),
+	})
+}
+
+// handleCheckpoint creates a Pebble checkpoint (hard-linked, point-in-time)
+// at a server-chosen path under COSIFT_CHECKPOINT_DIR (default /tmp). The
+// returned path is safe to tar — Pebble's compactor cannot mutate hard-linked
+// SSTs. Caller is responsible for deleting the dir after consuming it.
+func (s *pebbleHTTP) handleCheckpoint(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	base := os.Getenv("COSIFT_CHECKPOINT_DIR")
+	if base == "" {
+		base = "/tmp"
+	}
+	dest := filepath.Join(base, fmt.Sprintf("cosift-ckpt-%d", time.Now().UnixNano()))
+	t0 := time.Now()
+	if err := s.store.Checkpoint(dest); err != nil {
+		writeProblem(w, http.StatusInternalServerError, "checkpoint: "+err.Error())
+		return
+	}
+	elapsed := time.Since(t0)
+	log.Printf("checkpoint: created %q in %s", dest, elapsed)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"path":    dest,
+		"elapsed": elapsed.String(),
+	})
+}
+
+// handlePQTrain trains a PQ codebook on a sample of the current HNSW
+// graph, then encodes ALL nodes and persists codes + codebook to Pebble.
+// Synchronous; returns when training completes.
+type pqTrainReq struct {
+	SampleSize int `json:"sample_size"` // default 50000
+	M          int `json:"m"`           // default dim/8 (subspaces of size 8)
+	K          int `json:"k"`           // default 256
+	Iters      int `json:"iters"`       // default 15
+	Parallel   int `json:"parallel"`    // default GOMAXPROCS
+}
+
+func (s *pebbleHTTP) handlePQTrain(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.hnsw == nil || s.hnsw.Len() == 0 {
+		writeProblem(w, http.StatusBadRequest, "pq-train requires an in-memory HNSW with nodes")
+		return
+	}
+	var req pqTrainReq
+	if r.ContentLength > 0 {
+		body, _ := io.ReadAll(io.LimitReader(r.Body, 4<<10))
+		_ = json.Unmarshal(body, &req)
+	}
+	if req.SampleSize <= 0 {
+		req.SampleSize = 50000
+	}
+	if req.K <= 0 {
+		req.K = 256
+	}
+	if req.Iters <= 0 {
+		req.Iters = 15
+	}
+	if req.Parallel <= 0 {
+		req.Parallel = 8
+	}
+	if s.embedder == nil {
+		writeProblem(w, http.StatusBadRequest, "pq-train needs an embedder to know the vector dim")
+		return
+	}
+	dim := s.embedder.Dim()
+	M := req.M
+	if M <= 0 {
+		// Default: 1 subspace per 8 dims. For 768d → 96 subspaces.
+		M = dim / 8
+		if M <= 0 {
+			M = 1
+		}
+	}
+	if dim%M != 0 {
+		writeProblem(w, http.StatusBadRequest, fmt.Sprintf("dim %d not divisible by M %d", dim, M))
+		return
+	}
+	t0 := time.Now()
+	log.Printf("pq-train: sampling %d / %d vectors (dim=%d, M=%d, K=%d, iters=%d, parallel=%d)",
+		req.SampleSize, s.hnsw.Len(), dim, M, req.K, req.Iters, req.Parallel)
+	sample := s.hnsw.SampleVectors(req.SampleSize, time.Now().UnixNano())
+	sampledN := len(sample)
+	log.Printf("pq-train: training codebook on %d samples...", sampledN)
+	cb, err := index.TrainPQCodebookParallel(sample, dim, M, req.K, req.Iters, req.Parallel, time.Now().UnixNano())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, "train: "+err.Error())
+		return
+	}
+	trainElapsed := time.Since(t0)
+	log.Printf("pq-train: codebook trained in %s; persisting...", trainElapsed)
+	if err := cb.Persist(r.Context(), s.store); err != nil {
+		writeProblem(w, http.StatusInternalServerError, "persist codebook: "+err.Error())
+		return
+	}
+	encodeT0 := time.Now()
+	log.Printf("pq-train: encoding %d nodes...", s.hnsw.Len())
+	ids, codes, err := s.hnsw.EncodeAll(cb)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, "encode: "+err.Error())
+		return
+	}
+	entries := make([]store.PQCodeEntry, len(ids))
+	for i := range ids {
+		// K≤256 → byte-packed for 2x disk savings.
+		entries[i] = store.PQCodeEntry{ID: ids[i], Blob: cb.EncodeCodeBlob(codes[i])}
+	}
+	if err := s.store.PutPQCodesBatch(r.Context(), entries); err != nil {
+		writeProblem(w, http.StatusInternalServerError, "put codes: "+err.Error())
+		return
+	}
+	encodeElapsed := time.Since(encodeT0)
+	totalElapsed := time.Since(t0)
+	log.Printf("pq-train: done in %s (train=%s, encode+persist=%s, %d codes written)",
+		totalElapsed, trainElapsed, encodeElapsed, len(ids))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"sample_size":    sampledN,
+		"dim":            dim,
+		"M":              M,
+		"K":              req.K,
+		"iters":          req.Iters,
+		"nodes_encoded":  len(ids),
+		"train_elapsed":  trainElapsed.String(),
+		"encode_elapsed": encodeElapsed.String(),
+		"total_elapsed":  totalElapsed.String(),
+	})
+}
+
+// evalQuickQueries is the canned smoke-eval set. Chosen for breadth:
+// 3 definition + 3 technical-howto + 2 comparison + 2 findability. Tracks
+// the same answered/no-info/error verdicts the external 60-Q harness uses,
+// so a regression here predicts a regression in the bigger eval. Hardcoded
+// (no new deps) so any operator can hit /admin/eval-quick and get an
+// answer rate without setting up Python or external test infra.
+var evalQuickQueries = []string{
+	"what is BM25 ranking function",
+	"what is HNSW algorithm",
+	"what is reciprocal rank fusion",
+	"how does retrieval augmented generation work",
+	"how does Go goroutines scheduling work",
+	"explain CAP theorem in distributed systems",
+	"compare BM25 vs dense vector retrieval",
+	"compare REST vs GraphQL APIs",
+	"what is Pilot Protocol overlay network",
+	"what is sentence embedding",
+}
+
+// handleEvalQuick runs the 10-query smoke eval against the running cosift
+// and returns answered-rate + per-query verdicts. Each query hits /answer
+// in-process (re-uses the same chat/retrieval stack as a real /answer call),
+// so the rate that comes back matches what users see.
+func (s *pebbleHTTP) handleEvalQuick(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented, "eval-quick requires cfg.Chat.Model")
+		return
+	}
+	// the server-wide WriteTimeout (60s) was killing this handler
+	// before 10 sequential /answer calls finished — connection closed mid-write,
+	// curl saw "empty reply from server" (exit 52). Disable the deadline for
+	// this long-running admin endpoint via ResponseController. Pairs with
+	// bounded-parallel dispatch below so the 10-query batch finishes in
+	// ~one chat-LLM round-trip instead of ten.
+	if rc := http.NewResponseController(w); rc != nil {
+		_ = rc.SetWriteDeadline(time.Time{})
+	}
+	type queryResult struct {
+		Query     string `json:"query"`
+		Verdict   string `json:"verdict"` // answered | no_info | empty | error
+		LatencyMs int    `json:"latency_ms"`
+		Sources   int    `json:"sources"`
+		Suggest   string `json:"suggest_escalation,omitempty"`
+	}
+	results := make([]queryResult, len(evalQuickQueries))
+	t0 := time.Now()
+
+	// Bounded-parallel dispatch. vLLM batches concurrent requests so 4-wide
+	// fan-out finishes in roughly one chat round-trip rather than 10.
+	sem := make(chan struct{}, 4)
+	var wg sync.WaitGroup
+	for i, q := range evalQuickQueries {
+		wg.Add(1)
+		go func(i int, q string) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+			qStart := time.Now()
+			subReq, _ := http.NewRequestWithContext(r.Context(), http.MethodGet,
+				"/answer?q="+url.QueryEscape(q)+"&stream=false&retriever=hybrid", nil)
+			rec := newResponseRecorder()
+			s.handleAnswer(rec, subReq)
+			latencyMs := int(time.Since(qStart) / time.Millisecond)
+
+			var ar answerResponse
+			if jerr := json.Unmarshal(rec.body.Bytes(), &ar); jerr != nil || rec.code >= 400 {
+				results[i] = queryResult{Query: q, Verdict: "error", LatencyMs: latencyMs}
+				return
+			}
+			var verdict string
+			switch {
+			case len(ar.Answer) < 30:
+				verdict = "empty"
+			case answerLooksLikeNoInfo(ar.Answer):
+				verdict = "no_info"
+			default:
+				verdict = "answered"
+			}
+			results[i] = queryResult{
+				Query:     q,
+				Verdict:   verdict,
+				LatencyMs: latencyMs,
+				Sources:   len(ar.Sources),
+				Suggest:   ar.SuggestEscalation,
+			}
+		}(i, q)
+	}
+	wg.Wait()
+
+	answered, noInfo, errCount, empty, totalMs := 0, 0, 0, 0, 0
+	for _, r := range results {
+		totalMs += r.LatencyMs
+		switch r.Verdict {
+		case "answered":
+			answered++
+		case "no_info":
+			noInfo++
+		case "empty":
+			empty++
+		default:
+			errCount++
+		}
+	}
+	n := len(evalQuickQueries)
+	writeJSON(w, http.StatusOK, map[string]any{
+		"queries":         n,
+		"answered":        answered,
+		"no_info":         noInfo,
+		"empty":           empty,
+		"errors":          errCount,
+		"answer_rate_pct": 100 * answered / n,
+		"avg_latency_ms":  totalMs / n,
+		"total_elapsed":   time.Since(t0).String(),
+		"chat_model":      s.chat.Model(),
+		"results":         results,
+	})
+}
+
+// handleHNSWCompact runs HNSW.Compact() in-place, then clears the persisted
+// 'v' family and writes a fresh full snapshot so disk matches the compacted
+// in-memory graph. Cheaper than the offline hnsw-rebuild subcommand: Compact
+// keeps the existing topology among surviving nodes (O(N + edges)), whereas
+// Rebuild re-inserts every node via HNSW search (multiple minutes per million
+// passages). Operators run this when stats.zombie_nodes climbs above ~30% of
+// nodes_total.
+//
+// Synchronous; holds the HNSW write lock during the compact step and the
+// read lock during the persist step. Dense retrieval and AddPassage calls
+// queue for the duration. The server-wide WriteTimeout is disabled here via
+// ResponseController because compacting a multi-million-node graph routinely
+// runs past 60s. Returns counters so operators can confirm progress.
+func (s *pebbleHTTP) handleHNSWCompact(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.hnsw == nil {
+		writeProblem(w, http.StatusNotImplemented, "hnsw-compact requires a loaded HNSW graph")
+		return
+	}
+	if rc := http.NewResponseController(w); rc != nil {
+		_ = rc.SetWriteDeadline(time.Time{})
+	}
+	skipPersist := r.URL.Query().Get("skip_persist") == "1"
+
+	before := s.hnsw.Len()
+	t0 := time.Now()
+	removed := s.hnsw.Compact()
+	compactDur := time.Since(t0)
+	after := s.hnsw.Len()
+
+	resp := map[string]any{
+		"nodes_before": before,
+		"nodes_after":  after,
+		"removed":      removed,
+		"compact_ms":   compactDur.Milliseconds(),
+		"persisted":    false,
+	}
+
+	if removed == 0 || skipPersist {
+		writeJSON(w, http.StatusOK, resp)
+		return
+	}
+
+	// Compact remapped node indices; the persisted 'v' family now points at
+	// stale slots. Wipe and full-rewrite. PQ codes follow node indices too,
+	// so clear 'q' as well — operators must re-run /admin/pq-train if PQ was
+	// in use.
+	persistT0 := time.Now()
+	ctx := r.Context()
+	if err := s.store.ClearVectorFamily(ctx); err != nil {
+		resp["persist_error"] = "clear vector family: " + err.Error()
+		writeJSON(w, http.StatusInternalServerError, resp)
+		return
+	}
+	if err := s.store.ClearPQFamily(ctx); err != nil {
+		resp["persist_error"] = "clear pq family: " + err.Error()
+		writeJSON(w, http.StatusInternalServerError, resp)
+		return
+	}
+	if err := s.hnsw.Persist(ctx, s.store); err != nil {
+		resp["persist_error"] = "persist: " + err.Error()
+		writeJSON(w, http.StatusInternalServerError, resp)
+		return
+	}
+	resp["persisted"] = true
+	resp["persist_ms"] = time.Since(persistT0).Milliseconds()
+	log.Printf("hnsw-compact: removed=%d (%.1f%% zombies) compact=%s persist=%s nodes %d→%d",
+		removed, 100*float64(removed)/float64(before),
+		compactDur.Round(time.Millisecond), time.Since(persistT0).Round(time.Millisecond),
+		before, after)
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// responseRecorder captures an http.Handler's output for in-process
+// dispatch. Minimal — only what handleEvalQuick needs.
+type responseRecorder struct {
+	hdr  http.Header
+	body bytes.Buffer
+	code int
+}
+
+func newResponseRecorder() *responseRecorder {
+	return &responseRecorder{hdr: make(http.Header), code: 200}
+}
+
+func (r *responseRecorder) Header() http.Header { return r.hdr }
+
+func (r *responseRecorder) Write(b []byte) (int, error) { return r.body.Write(b) }
+
+func (r *responseRecorder) WriteHeader(c int) { r.code = c }
+
+// handleEmbedBackfill walks famDocMeta, finds docs whose URL has zero
+// HNSW vector nodes (lexical-only ingest from WET imports, or any docs
+// indexed before an embedder was wired), and embeds them. Pairs with
+// /admin/wet-import?lexical_only=true so bulk-loaded content gets dense
+// retrieval after the fast lexical pass.
+//
+// Body: {"limit": 10000, "workers": 4}
+//   - limit:   cap on docs processed this call (0 = unlimited)
+//   - workers: concurrent embed pipelines (default 4)
+//
+// Idempotent against concurrent re-runs — re-embedding a doc that
+// already has vectors is a no-op because UpsertPassage just adds more
+// nodes pointing at the same URL (which the dedup-by-URL in
+// HNSW.Search picks the best of anyway). Cleaner: zombie-reclaim kicks
+// in to invalidate prior, then fresh vectors take over.
+type embedBackfillReq struct {
+	Limit   int `json:"limit,omitempty"`
+	Workers int `json:"workers,omitempty"`
+}
+
+// handleHostBackfill triggers the 'P' host-partition backfill IN-PROCESS, in a
+// detached background goroutine (Pebble is single-writer, so this can't run as
+// a separate process against a live store). Returns immediately; progress is
+// logged. ?host=<host> runs the fast targeted path; omit for the full corpus.
+//
+// Run this with the COSIFT_HOST_PARTITION write flag OFF so the backfill is the
+// sole writer of the 'T'/'next_host_id' families (no race with crawl indexing).
+// After it logs "done", set COSIFT_HOST_PARTITION_READ=1 (and =1 for the write
+// flag to keep it fresh) and restart.
+func (s *pebbleHTTP) handleHostBackfill(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.store == nil {
+		writeProblem(w, http.StatusNotImplemented, "host-backfill requires a PebbleStore")
+		return
+	}
+	host := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("host")))
+	// Detached context so the long backfill survives the request returning.
+	go func() {
+		t0 := time.Now()
+		scope := "full corpus"
+		if host != "" {
+			scope = "host=" + host
+		}
+		log.Printf("host-backfill: starting (%s)", scope)
+		written, err := s.store.BackfillHostPostings(context.Background(), host, func(n int64) {
+			log.Printf("host-backfill: %d postings written (%s elapsed)", n, time.Since(t0).Round(time.Second))
+		})
+		if err != nil {
+			log.Printf("host-backfill: FAILED after %d postings: %v", written, err)
+			return
+		}
+		log.Printf("host-backfill: DONE — %d postings in %s. Set COSIFT_HOST_PARTITION_READ=1 and restart.",
+			written, time.Since(t0).Round(time.Second))
+	}()
+	writeJSON(w, http.StatusAccepted, map[string]any{
+		"status": "started", "scope": host, "note": "running in background; watch server logs for progress + 'DONE'",
+	})
+}
+
+func (s *pebbleHTTP) handleEmbedBackfill(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.embedder == nil || s.hnsw == nil {
+		writeProblem(w, http.StatusNotImplemented, "embed backfill requires both an embedder and HNSW graph to be configured")
+		return
+	}
+	var req embedBackfillReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	_ = json.Unmarshal(body, &req)
+	if req.Workers <= 0 {
+		req.Workers = 4
+	}
+	if req.Workers > 32 {
+		req.Workers = 32
+	}
+
+	// Pipeline: iter docs → filter (no-vector) → chunker → embed → write.
+	// Bounded channel so we don't materialize the candidate list in memory.
+	type cand struct {
+		docID int64
+		url   string
+	}
+	candCh := make(chan cand, req.Workers*4)
+
+	t0 := time.Now()
+	var scanned, missing, embedded atomic.Int64
+
+	// Find candidates: docs with zero HNSW vectors. Producer.
+	go func() {
+		defer close(candCh)
+		_ = s.store.IterDocsLite(r.Context(), func(docID int64, url string) error {
+			scanned.Add(1)
+			if req.Limit > 0 && missing.Load() >= int64(req.Limit) {
+				return errors.New("limit reached") // sentinel — stops IterDocsLite
+			}
+			if _, ok := s.hnsw.LookupVectorByURL(url); ok {
+				return nil // already has vectors
+			}
+			missing.Add(1)
+			select {
+			case candCh <- cand{docID: docID, url: url}:
+			case <-r.Context().Done():
+				return r.Context().Err()
+			}
+			return nil
+		})
+	}()
+
+	// Worker pool: chunk + embed + write passages per doc.
+	var wg sync.WaitGroup
+	for i := 0; i < req.Workers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for c := range candCh {
+				doc, err := s.store.GetDocByID(r.Context(), c.docID)
+				if err != nil || doc == nil || doc.Text == "" {
+					continue
+				}
+				// Use index defaults (NewChunker passes 0,0 = default 320/64).
+				chunker := index.NewChunker()
+				chunks := chunker.Chunk(doc.Text)
+				if len(chunks) == 0 {
+					continue
+				}
+				const tokenCap = 1500
+				texts := make([]string, len(chunks))
+				for j, ch := range chunks {
+					texts[j] = truncateForEmbedLite(ch.Text, tokenCap)
+				}
+				vecs, eErr := s.embedder.Embed(r.Context(), texts)
+				if eErr != nil || len(vecs) != len(chunks) {
+					continue
+				}
+				for j, ch := range chunks {
+					s.hnsw.AddPassage(doc.URL, doc.Title, ch.Offset, ch.Length, vecs[j])
+					_ = j
+				}
+				embedded.Add(1)
+			}
+		}()
+	}
+	wg.Wait()
+
+	log.Printf("embed-backfill: scanned=%d missing=%d embedded=%d in %s",
+		scanned.Load(), missing.Load(), embedded.Load(), time.Since(t0).Round(time.Second))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"scanned":  scanned.Load(),
+		"missing":  missing.Load(),
+		"embedded": embedded.Load(),
+		"elapsed":  time.Since(t0).String(),
+	})
+}
+
+// truncateForEmbedLite mirrors the crawler's helper without pulling the
+// crawler package in. Same heuristic: cap by approximate token count.
+func truncateForEmbedLite(s string, tokenCap int) string {
+	// Rough: 1 token ≈ 4 chars for ASCII; cap at 4×tokenCap bytes as a
+	// fast upper bound. Real chunker is at ~320 words = ~1200 tokens, so
+	// 1500-token cap rarely triggers.
+	maxBytes := tokenCap * 4
+	if len(s) <= maxBytes {
+		return s
+	}
+	return s[:maxBytes]
+}
diff --git a/cmd/cosift/serve_answer.go b/cmd/cosift/serve_answer.go
new file mode 100644
index 0000000..ef312ed
--- /dev/null
+++ b/cmd/cosift/serve_answer.go
@@ -0,0 +1,1697 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"math"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"crypto/sha256"
+	"encoding/hex"
+
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/judge"
+	"github.com/pilot-protocol/cosift/internal/rerank"
+)
+
+type synthRequest struct {
+	Q              string `json:"q"`
+	K              int    `json:"k,omitempty"`
+	IncludeDomains string `json:"include_domains,omitempty"`
+	ExcludeDomains string `json:"exclude_domains,omitempty"`
+	Site           string `json:"site,omitempty"`
+	Since          string `json:"since,omitempty"`
+	Until          string `json:"until,omitempty"`
+	IncludeText    bool   `json:"include_text,omitempty"`
+	Rerank         bool   `json:"rerank,omitempty"`
+	Expand         string `json:"expand,omitempty"`
+	Stream         bool   `json:"stream,omitempty"`
+}
+
+func (req synthRequest) toValues() url.Values {
+	v := url.Values{}
+	if req.Q != "" {
+		v.Set("q", req.Q)
+	}
+	if req.K > 0 {
+		v.Set("k", strconv.Itoa(req.K))
+	}
+	if req.IncludeDomains != "" {
+		v.Set("include_domains", req.IncludeDomains)
+	}
+	if req.ExcludeDomains != "" {
+		v.Set("exclude_domains", req.ExcludeDomains)
+	}
+	if req.Site != "" {
+		v.Set("site", req.Site)
+	}
+	if req.Since != "" {
+		v.Set("since", req.Since)
+	}
+	if req.Until != "" {
+		v.Set("until", req.Until)
+	}
+	if req.IncludeText {
+		v.Set("include_text", "true")
+	}
+	if req.Rerank {
+		v.Set("rerank", "true")
+	}
+	if req.Expand != "" {
+		v.Set("expand", req.Expand)
+	}
+	if req.Stream {
+		v.Set("stream", "true")
+	}
+	return v
+}
+
+func (s *pebbleHTTP) handleAnswerPOST(w http.ResponseWriter, r *http.Request) {
+	var req synthRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	r.URL.RawQuery = req.toValues().Encode()
+	s.handleAnswer(w, r)
+}
+
+func (s *pebbleHTTP) handleResearchPOST(w http.ResponseWriter, r *http.Request) {
+	var req synthRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	r.URL.RawQuery = req.toValues().Encode()
+	s.handleResearch(w, r)
+}
+
+// /answer — synthesis over BM25 retrieval. Mirrors the SQLite-side
+// /answer in spirit (top-k sources → cited synthesis) but stays minimal: no
+// streaming, no rerank, no query expansion. Those land in follow-up iters
+// once this surface is exercised. Returns 501 when no chat model is
+// configured so the absent capability fails loud instead of silent.
+const answerSystemPrompt = `You are a research assistant. Answer the user's question using the provided sources.
+- Cite sources by their numeric id in square brackets, e.g. [1] or [2,3]. Every factual claim needs a citation.
+- Synthesize the answer from what the sources state, including reasonable inferences from adjacent context — sources rarely state every answer verbatim.
+- Only fall back to "the sources do not cover X" if NONE of the sources have any relevant material at all. Do not refuse just because the exact formula, number, or phrase isn't quoted verbatim — extract whatever IS there and say so.
+- IGNORE sources that are irrelevant to the question — login forms, page-not-found stubs, wiki edit/diff/admin pages, navigation menus, raw image directories, or content about a different topic. Do not cite them. Do not mention them in your answer. Pretend they weren't in the source list.
+- Do not invent facts not supported by the sources.
+- Keep the answer focused on what the sources actually say; do not pad.`
+
+// HyDE-style query expansion prompt. Borrowed verbatim from
+// internal/server/hyde.go so the SQLite and Pebble paths produce comparable
+// expansions and operators don't have to learn two prompt shapes.
+const hydeSystemPrompt = `Write a brief, factual passage (2-4 sentences) that would directly answer the user's question. Output ONLY the passage — no preamble, no commentary, no apology if you're uncertain. If the question is ambiguous, pick the most plausible interpretation and answer that. The passage doesn't need to be true; it needs to be the SHAPE of what a relevant document would say. Embedding this passage and searching by its vector will find documents that look like real answers, even if the user's original query was just a few keywords.`
+
+// doChat wraps ChatClient.Chat with attempt/failure counters.
+// Takes the client as a parameter so it works for both s.chat and the
+// StreamingChatClient passed into streamResearch/streamAnswer.
+func (s *pebbleHTTP) doChat(ctx context.Context, c embed.ChatClient, msgs []embed.ChatMsg) (string, error) {
+	s.chatAttempts.Add(1)
+	start := time.Now()
+	out, err := c.Chat(ctx, msgs)
+	s.chatDurationNanos.Add(time.Since(start).Nanoseconds())
+	if err != nil {
+		s.chatFailures.Add(1)
+	}
+	return out, err
+}
+
+// doChatStream wraps StreamingChatClient.ChatStream with the same counters.
+func (s *pebbleHTTP) doChatStream(ctx context.Context, c embed.StreamingChatClient, msgs []embed.ChatMsg, onChunk func(string)) (string, error) {
+	s.chatAttempts.Add(1)
+	start := time.Now()
+	out, err := c.ChatStream(ctx, msgs, onChunk)
+	s.chatDurationNanos.Add(time.Since(start).Nanoseconds())
+	if err != nil {
+		s.chatFailures.Add(1)
+	}
+	return out, err
+}
+
+type answerSource struct {
+	// Matches the [N] tokens the synth prompt produces in the answer
+	// text. SQLite-side AnswerSource has had this; pebble's was missing,
+	// which caused the CLI to render every source as '[0]' before the
+	// i+1 fallback landed.
+	ID          int        `json:"id"`
+	URL         string     `json:"url"`
+	Title       string     `json:"title"`
+	Excerpt     string     `json:"excerpt,omitempty"`
+	PublishedAt *time.Time `json:"published_at,omitempty"`
+	Author      string     `json:"author,omitempty"`
+	Text        string     `json:"text,omitempty"`
+}
+
+type answerResponse struct {
+	Query          string `json:"query"`
+	EffectiveQuery string `json:"effective_query,omitempty"`
+	Expand         string `json:"expand,omitempty"`
+	// retriever label — same vocabulary as /search ("bm25",
+	// "dense", "bm25+dense:rrf", "+hyde"/"+paraphrase", "+rerank:<name>").
+	Retriever       string         `json:"retriever,omitempty"`
+	Answer          string         `json:"answer"`
+	Sources         []answerSource `json:"sources"`
+	Model           string         `json:"model"`
+	Warnings        []string       `json:"warnings,omitempty"`
+	TotalCandidates int            `json:"total_candidates,omitempty"`
+	Took            string         `json:"took"`
+	// when the answer matches a "sources do not contain" pattern,
+	// surface a hint URL pointing at /research?strategy=planner. The 60-Q
+	// eval showed multi-hop decomposition rescues ~40% of findability +
+	// factual-lookup misses. Purely additive — clients decide whether to
+	// render a "Try research mode" affordance.
+	SuggestEscalation string `json:"suggest_escalation,omitempty"`
+}
+
+// answerLooksLikeNoInfo returns true when the answer reads as "sources don't
+// cover this" — the canonical /research-escalation trigger. Same phrase set
+// the eval uses; kept in sync so eval results predict escalation rate.
+func answerLooksLikeNoInfo(s string) bool {
+	if len(s) > 800 {
+		// Long answers with one disclaimer line aren't bails — only treat
+		// short, mostly-disclaimer responses as escalation candidates.
+		return false
+	}
+	low := strings.ToLower(s)
+	for _, p := range []string{
+		"do not contain", "do not provide", "sources don",
+		"not contain the", "no information", "do not include",
+		"do not have", "do not cover", "not mention", "no mention",
+	} {
+		if strings.Contains(low, p) {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *pebbleHTTP) handleAnswer(w http.ResponseWriter, r *http.Request) {
+	// When clustered + gateway mode +
+	// not already serving as a leaf for someone else, fan-out retrieval
+	// to peers (with include_text), then run a SINGLE synth here.
+	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
+		s.handleAnswerGateway(w, r)
+		return
+	}
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented,
+			"/answer requires cfg.Chat.Model to be set (point cosift.json's chat.url at any OpenAI-compatible endpoint)")
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	// Cache + singleflight on /answer. Key is the full query-string
+	// (sorted) so different filter combos don't collide. We capture the
+	// rendered body into a buffer; on success the buffer is the cache
+	// value. Skip the cache for explicit no-cache requests and for
+	// streaming clients — bufferedResponse can't flush, so SSE would
+	// silently fall through to the sync JSON path.
+	if s.answerCache != nil && r.Header.Get("Cache-Control") != "no-cache" && !wantsSSE(r) {
+		key := answerCacheKey(r)
+		body, err, shared := s.answerCache.Do(key, func() ([]byte, error) {
+			rec := &bufferedResponse{header: http.Header{}, status: 200}
+			s.handleAnswerInner(rec, r, start)
+			if rec.status != http.StatusOK {
+				return nil, errAnswerNotOK
+			}
+			return rec.buf.Bytes(), nil
+		})
+		if err == nil {
+			if shared {
+				w.Header().Set("X-Cache", "hit")
+			} else {
+				w.Header().Set("X-Cache", "miss")
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write(body)
+			return
+		}
+		// On non-OK from the inner handler, fall through to the
+		// uncached path so the real status code reaches the client.
+	}
+	s.handleAnswerInner(w, r, start)
+}
+
+// errAnswerNotOK signals that the inner handler wrote a non-2xx
+// response — don't cache it, and let the caller re-run uncached so
+// the proper status reaches the client.
+var errAnswerNotOK = errors.New("answer: non-OK response, not cached")
+
+// answerCacheKey is the deterministic cache key for a given /answer
+// request. Sorts query parameters so URL-order doesn't fragment the
+// cache; drops parameters that don't affect the response.
+func answerCacheKey(r *http.Request) string {
+	q := r.URL.Query()
+	// Don't key on transport-only or debug-only flags.
+	q.Del("cluster_local")
+	q.Del("trace")
+	keys := make([]string, 0, len(q))
+	for k := range q {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var sb strings.Builder
+	for _, k := range keys {
+		for _, v := range q[k] {
+			sb.WriteString(k)
+			sb.WriteByte('=')
+			sb.WriteString(v)
+			sb.WriteByte('\x00')
+		}
+	}
+	sum := sha256.Sum256([]byte(sb.String()))
+	return hex.EncodeToString(sum[:16])
+}
+
+// bufferedResponse captures a handler's writes into a buffer so we
+// can store the rendered JSON in answerCache before flushing to the
+// real response writer.
+type bufferedResponse struct {
+	buf    bytes.Buffer
+	header http.Header
+	status int
+}
+
+func (b *bufferedResponse) Header() http.Header { return b.header }
+
+func (b *bufferedResponse) WriteHeader(statusCode int) { b.status = statusCode }
+
+func (b *bufferedResponse) Write(p []byte) (int, error) {
+	if b.status == 0 {
+		b.status = http.StatusOK
+	}
+	return b.buf.Write(p)
+}
+
+// handleAnswerInner is the uncached body. Called both via the cache
+// path (with a bufferedResponse) and directly when the cache is
+// disabled or a non-OK response needs the real writer.
+func (s *pebbleHTTP) handleAnswerInner(w http.ResponseWriter, r *http.Request, start time.Time) {
+	q := r.URL.Query().Get("q")
+	k := 5
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
+			k = n
+		}
+	}
+	// /answer respects the same retrieval filters /search does —
+	// scoping research to a domain or date window is the common EXA shape.
+	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
+	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
+	sites := parseSiteScopes(r.URL.Query().Get("site"))
+	siteFilter := len(sites) > 0
+	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
+	if sinceErr != nil {
+		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
+		return
+	}
+	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
+	if untilErr != nil {
+		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
+		return
+	}
+	dateFilter := !since.IsZero() || !until.IsZero()
+	includeText := r.URL.Query().Get("include_text") == "true"
+	// Default to hybrid + rerank on /answer — the reranker is the proven
+	// quality recovery layer; ?retriever=bm25 and ?rerank=false opt out.
+	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
+		r.URL.Query().Get("retriever"),
+		r.URL.Query().Get("rerank"),
+	)
+	keepCap := k
+	if wantRerank {
+		keepCap = s.rerankCandK
+		if keepCap < k {
+			keepCap = k
+		}
+	}
+	fetchK := keepCap
+	if len(include) > 0 || len(exclude) > 0 || dateFilter || siteFilter {
+		mult := 5
+		if dateFilter {
+			mult = 10
+		}
+		if siteFilter {
+			mult = 50 // site= over-fetches aggressively: small site in a large corpus
+		}
+		fetchK = keepCap * mult
+		cap := 200 // /answer caps tighter than /search — full doc text per source is expensive
+		if siteFilter && cap < 500 {
+			cap = 500
+		}
+		if fetchK > cap {
+			fetchK = cap
+		}
+	} else if wantRerank {
+		fetchK = keepCap * 2
+	}
+	// SSE opt-in. Open the stream BEFORE retrieve() so phase events can
+	// surface backend pipeline progress (retrieve / rerank / judge / mmr /
+	// synth_start) instead of just the synth-chunk tail. Opt in via
+	// ?stream=true or Accept: text/event-stream. Caps requirement: chat
+	// client must implement StreamingChatClient AND the ResponseWriter
+	// must support http.Flusher; if either is missing, fall through to
+	// sync (today's behavior).
+	wantStream := wantsSSE(r)
+	var sse *answerSSE
+	var streamChat embed.StreamingChatClient
+	if wantStream {
+		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
+			if a := newAnswerSSE(w, start); a != nil {
+				sse, streamChat = a, sc
+				stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
+				defer stopKA()
+				sse.warnings(s.warningsFor(r))
+				sse.phase("parsed", map[string]any{
+					"q": q, "k": k, "fetch_k": fetchK,
+					"retriever": retrieverParam, "rerank": wantRerank,
+				})
+			}
+		}
+	}
+
+	// expansion dispatch (bare / HyDE / paraphrase+RRF).
+	// retriever dispatch (bm25 / dense / hybrid) via shared helper.
+	expandMode := r.URL.Query().Get("expand")
+	hits, effectiveQuery, err := s.retrieve(r.Context(), q, fetchK, retrieverParam, expandMode)
+	if err != nil {
+		if sse != nil {
+			sse.errorEvt(err.Error())
+			return
+		}
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	if sse != nil {
+		sse.phase("retrieve", map[string]any{
+			"hits": len(hits), "effective_query": effectiveQuery,
+		})
+	}
+	type cand struct {
+		src        answerSource
+		excerpt    string
+		rerankText string
+		score      float64 // retrieval score, used by time-decay
+	}
+	cands := make([]cand, 0, keepCap)
+	for _, h := range hits {
+		if len(include) > 0 || len(exclude) > 0 {
+			host := hostOf(h.URL)
+			if len(include) > 0 && !matchesAnyDomain(host, include) {
+				continue
+			}
+			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
+				continue
+			}
+		}
+		if siteFilter && !matchesAnySite(h.URL, sites) {
+			continue
+		}
+		doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
+		if derr != nil || doc == nil {
+			continue
+		}
+		if dateFilter {
+			if doc.PublishedAt.IsZero() {
+				continue
+			}
+			if !since.IsZero() && doc.PublishedAt.Before(since) {
+				continue
+			}
+			if !until.IsZero() && doc.PublishedAt.After(until) {
+				continue
+			}
+		}
+		excerpt := textExcerpt(doc.Text, 1200)
+		src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
+		if !doc.PublishedAt.IsZero() {
+			t := doc.PublishedAt
+			src.PublishedAt = &t
+		}
+		if includeText {
+			src.Text = doc.Text
+		}
+		c := cand{src: src, excerpt: excerpt, score: h.Score}
+		if wantRerank {
+			c.rerankText = doc.Title + "\n" + doc.Text
+		}
+		cands = append(cands, c)
+		if len(cands) >= keepCap {
+			break
+		}
+	}
+	if sse != nil {
+		sse.phase("filter", map[string]any{"candidates": len(cands)})
+	}
+	// time-decay re-weights then re-sorts BEFORE rerank, mirroring
+	// the /search pre-rerank placement so the reranker sees a freshness-
+	// aware pool.
+	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
+	if decaySet && len(cands) > 0 {
+		now := time.Now()
+		for i := range cands {
+			cands[i].score *= decayMultiplier(cands[i].src.PublishedAt, now, decayHalfLife)
+		}
+		sort.SliceStable(cands, func(i, j int) bool { return cands[i].score > cands[j].score })
+		if sse != nil {
+			sse.phase("decay", map[string]any{"half_life_days": decayHalfLife})
+		}
+	}
+	// Optional rerank, then truncate to k. Done in this order so citation
+	// numbers in the prompt match the final rank-ordered sources list.
+	if wantRerank && len(cands) > 1 {
+		rc := make([]rerank.Candidate, len(cands))
+		for i := range cands {
+			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
+		}
+		if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
+			reordered := make([]cand, 0, len(cands))
+			seen := make(map[int]bool, len(cands))
+			for _, id := range order {
+				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
+					reordered = append(reordered, cands[n])
+					seen[n] = true
+				}
+			}
+			for i, c := range cands {
+				if !seen[i] {
+					reordered = append(reordered, c)
+				}
+			}
+			cands = reordered
+		}
+		if sse != nil {
+			sse.phase("rerank", map[string]any{"reranker": s.reranker.Name(), "candidates": len(cands)})
+		}
+	}
+	// LLM relevance judge — STRICT gate. The reranker re-orders but
+	// doesn't drop; without this gate, marginal content (Wikipedia
+	// diff/admin pages, dead .edu PDFs, JS-only landing pages with
+	// stub HTML) leaks into the synth context and produces "based on
+	// the sources, here is some irrelevant trivia" answers.
+	//
+	// Strict means: if a candidate fails the relevance threshold, it
+	// is DROPPED — we do not top up from the rejected pool to reach k.
+	// Better to return 2 truly relevant sources than 5 sources where 3
+	// are noise. If 0 candidates pass, downstream returns the "no
+	// matching sources" response (already handled below).
+	//
+	// Skip when ?judge=false or no chat client (correctness-preserving).
+	if r.URL.Query().Get("judge") != "false" && s.chat != nil && len(cands) > 1 {
+		before := len(cands)
+		jCands := make([]judge.Candidate, len(cands))
+		for i, c := range cands {
+			jCands[i] = judge.Candidate{ID: strconv.Itoa(i), Excerpt: c.rerankText}
+		}
+		verdicts := judge.Judge(r.Context(), s.chat, q, jCands, judge.Options{MinScore: 0.3})
+		keep := make([]cand, 0, len(cands))
+		for i, c := range cands {
+			if i < len(verdicts) && verdicts[i].Keep {
+				keep = append(keep, c)
+			}
+		}
+		cands = keep
+		if sse != nil {
+			sse.phase("judge", map[string]any{
+				"before": before, "kept": len(cands), "dropped": before - len(cands),
+			})
+		}
+	}
+	// MMR diversification on /answer — same pattern as /search.
+	// Synth quality benefits when the top-k sources cover different
+	// angles instead of being 5 paraphrases of the same paper.
+	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
+	mmrFired := false
+	if mmrSet && len(cands) > 1 {
+		urls := make([]string, len(cands))
+		for i := range cands {
+			urls[i] = cands[i].src.URL
+		}
+		if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
+			reordered := make([]cand, len(order))
+			for i, idx := range order {
+				reordered[i] = cands[idx]
+			}
+			cands = reordered
+			mmrFired = true
+		}
+		if sse != nil && mmrFired {
+			sse.phase("mmr", map[string]any{"lambda": mmrLambda, "candidates": len(cands)})
+		}
+	}
+	if len(cands) > k {
+		cands = cands[:k]
+	}
+	sources := make([]answerSource, 0, len(cands))
+	var promptSources strings.Builder
+	for i, c := range cands {
+		// stamp ID = i+1 so the JSON response matches the [N]
+		// citation tokens we emit in the synth prompt below.
+		c.src.ID = i + 1
+		sources = append(sources, c.src)
+		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, c.excerpt)
+	}
+	// same retriever label vocabulary as /search.
+	denseReady := s.hnsw != nil && s.embedder != nil
+	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, effectiveQuery != q, wantRerank)
+	if mmrFired {
+		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
+	}
+	if decaySet {
+		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
+	}
+	if len(sources) == 0 {
+		// Distinguish the two failure modes so the client can tell
+		// "we have nothing on this topic" (retrieval returned 0 hits)
+		// from "we retrieved candidates but the relevance judge dropped
+		// every one of them" (the corpus has noise, not the answer).
+		msg := "No matching sources in the index."
+		if len(hits) > 0 {
+			msg = "Retrieval returned candidates but none were judged relevant to the question. The corpus may not cover this topic in usable detail."
+		}
+		if sse != nil {
+			sse.sources(q, sources, streamChat.Model(), retrieverLabel, len(hits))
+			sse.chunk(msg)
+			sse.done()
+			return
+		}
+		empty := answerResponse{
+			Query: q, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
+			Answer:  msg,
+			Sources: sources, Model: s.chat.Model(), TotalCandidates: len(hits), Took: time.Since(start).String(),
+		}
+		if effectiveQuery != q {
+			empty.EffectiveQuery = effectiveQuery
+		}
+		empty.Warnings = s.warningsFor(r)
+		writeJSON(w, http.StatusOK, empty)
+		return
+	}
+
+	msgs := []embed.ChatMsg{
+		{Role: "system", Content: answerSystemPrompt},
+		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Question: " + q},
+	}
+
+	if sse != nil {
+		sse.sources(q, sources, streamChat.Model(), retrieverLabel, len(hits))
+		sse.phase("synth_start", map[string]any{"sources": len(sources), "model": streamChat.Model()})
+		full, cerr := s.doChatStream(r.Context(), streamChat, msgs, sse.chunk)
+		if cerr != nil {
+			sse.errorEvt(cerr.Error())
+			return
+		}
+		if answerLooksLikeNoInfo(full) {
+			sse.suggestEscalation(q)
+		}
+		sse.done()
+		return
+	}
+
+	answer, err := s.doChat(r.Context(), s.chat, msgs)
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "chat: "+err.Error())
+		return
+	}
+	resp := answerResponse{
+		Query: q, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
+		Answer: answer, Sources: sources,
+		Model: s.chat.Model(), TotalCandidates: len(hits), Took: time.Since(start).String(),
+	}
+	if effectiveQuery != q {
+		resp.EffectiveQuery = effectiveQuery
+	}
+	resp.Warnings = s.warningsFor(r)
+	// suggest /research escalation when the model bailed.
+	if answerLooksLikeNoInfo(answer) {
+		resp.SuggestEscalation = "/research?q=" + url.QueryEscape(q) + "&strategy=planner"
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// recordingWriter wraps an http.ResponseWriter and captures every byte
+// written to it. Used to record SSE streams for the research cache — the
+// captured bytes can later be replayed to a new client directly.
+type recordingWriter struct {
+	http.ResponseWriter
+	buf bytes.Buffer
+}
+
+func (r *recordingWriter) Write(b []byte) (int, error) {
+	r.buf.Write(b)
+	return r.ResponseWriter.Write(b)
+}
+
+func (r *recordingWriter) Flush() {
+	if f, ok := r.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+// wantsSSE reports whether the request opts into Server-Sent Events,
+// either via ?stream=true or an Accept: text/event-stream header. Both
+// /answer, /query, and /research check the same envelope.
+func wantsSSE(r *http.Request) bool {
+	return r.URL.Query().Get("stream") == "true" ||
+		strings.Contains(r.Header.Get("Accept"), "text/event-stream")
+}
+
+// answerSSE wraps the SSE writer for /answer streaming. Methods emit the
+// well-known event types (phase, sources, answer_chunk, warnings, error,
+// suggest_escalation, done). Phase events surface pipeline progress
+// (retrieve / rerank / judge / mmr / synth_start) so clients can render a
+// timeline of what the backend is doing.
+//
+// Writes are mu-protected because the keepalive ticker can race with
+// the main handler goroutine. The handler does the substantive event
+// writes; the ticker emits SSE comment frames (": ka\n\n") to keep
+// the HTTP/2 stream alive across long retrieval / rerank / chat calls
+// — without them, browsers (Safari especially) close the stream when
+// no bytes flow for 10–30 s and the request fails mid-pipeline.
+type answerSSE struct {
+	w       http.ResponseWriter
+	flusher http.Flusher
+	start   time.Time
+	last    time.Time // last phase emit; used to compute per-phase duration
+	mu      sync.Mutex
+}
+
+// newAnswerSSE opens an SSE stream. Returns nil if the writer can't flush.
+// Caller is responsible for not calling writeProblem after this point —
+// the response status (200) and headers are committed here.
+//
+// Disables the server-wide WriteTimeout (60s) via ResponseController.
+// Multi-pass /research can run 90-180s with 3-5 passes against a slow
+// chat model; the deadline would kill the connection mid-stream and
+// the browser fetch would surface a generic "Load failed". SSE handlers
+// flush their own progress, so a stuck handler still gets killed by
+// ctx cancellation when the client disconnects.
+func newAnswerSSE(w http.ResponseWriter, start time.Time) *answerSSE {
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		return nil
+	}
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("X-Accel-Buffering", "no")
+	if rc := http.NewResponseController(w); rc != nil {
+		_ = rc.SetWriteDeadline(time.Time{})
+	}
+	w.WriteHeader(http.StatusOK)
+	return &answerSSE{w: w, flusher: flusher, start: start, last: start}
+}
+
+func (a *answerSSE) send(payload any) {
+	buf, _ := json.Marshal(payload)
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	fmt.Fprintf(a.w, "data: %s\n\n", buf)
+	a.flusher.Flush()
+}
+
+// startKeepalive launches a goroutine that emits SSE data frames every
+// interval, keeping the HTTP/2 stream and any intermediate proxy alive
+// across long retrieval / chat calls that emit no real data. Returns a
+// stop function the caller defers; stopping is idempotent.
+//
+// We deliberately emit `data: {"type":"ka", ...}` frames rather than the
+// spec's `: comment` form. Safari's CFNetwork stream stack tracks
+// "no payload data received" separately from "no bytes received" — a
+// long-running stream of nothing but comment frames still trips its
+// internal timeout and the browser surfaces it as "Error: Load failed".
+// JSON ka frames count as real data; the chat UI ignores `type:"ka"`.
+func (a *answerSSE) startKeepalive(ctx context.Context, interval time.Duration) (stop func()) {
+	done := make(chan struct{})
+	go func() {
+		t := time.NewTicker(interval)
+		defer t.Stop()
+		for {
+			select {
+			case <-done:
+				return
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				a.send(map[string]any{
+					"type":       "ka",
+					"elapsed_ms": time.Since(a.start).Milliseconds(),
+				})
+			}
+		}
+	}()
+	var once sync.Once
+	return func() { once.Do(func() { close(done) }) }
+}
+
+// phase emits a pipeline-step event with elapsed-since-start and
+// duration-since-last-phase, plus any caller-supplied detail fields.
+// Holds a.mu for the whole call so the read+write of a.last and the
+// write-to-the-wire are all atomic with respect to concurrent phase
+// calls and the keepalive ticker.
+func (a *answerSSE) phase(name string, details map[string]any) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	now := time.Now()
+	evt := map[string]any{
+		"type":        "phase",
+		"name":        name,
+		"elapsed_ms":  now.Sub(a.start).Milliseconds(),
+		"duration_ms": now.Sub(a.last).Milliseconds(),
+	}
+	for k, v := range details {
+		evt[k] = v
+	}
+	a.last = now
+	buf, _ := json.Marshal(evt)
+	fmt.Fprintf(a.w, "data: %s\n\n", buf)
+	a.flusher.Flush()
+}
+
+func (a *answerSSE) warnings(warns []string) {
+	if len(warns) == 0 {
+		return
+	}
+	a.send(map[string]any{"type": "warnings", "warnings": warns})
+}
+
+func (a *answerSSE) sources(q string, src []answerSource, model, retrieverLabel string, totalCandidates int) {
+	evt := map[string]any{
+		"type":             "sources",
+		"query":            q,
+		"sources":          src,
+		"model":            model,
+		"total_candidates": totalCandidates,
+	}
+	if retrieverLabel != "" {
+		evt["retriever"] = retrieverLabel
+	}
+	a.send(evt)
+}
+
+func (a *answerSSE) chunk(delta string) {
+	a.send(map[string]any{"type": "answer_chunk", "text": delta})
+}
+
+func (a *answerSSE) errorEvt(msg string) {
+	a.send(map[string]any{"type": "error", "error": msg})
+}
+
+func (a *answerSSE) suggestEscalation(q string) {
+	a.send(map[string]any{
+		"type":               "suggest_escalation",
+		"suggest_escalation": "/research?q=" + url.QueryEscape(q) + "&strategy=planner",
+	})
+}
+
+func (a *answerSSE) done() {
+	a.send(map[string]any{"type": "done", "took": time.Since(a.start).String()})
+}
+
+// /research — multi-step retrieval + synthesis. LLM decomposes the
+// question into 2-3 sub-queries, each sub-query runs BM25, results are deduped
+// by URL keeping the best score, top-k feed a cited synthesis. Mirrors the
+// SQLite-side /research planner strategy. No streaming, no rerank, no
+// paraphrase strategy yet — those follow once this surface is exercised.
+const researchPlanPrompt = `Decompose the user's research question into 2-3 short keyword search phrases (3-6 words each, NOT full sentences). Each phrase MUST target a DIFFERENT facet so the phrases do not overlap: one conceptual/definitional (what it is), one procedural/how-to (steps, configuration, usage), and one edge-case/troubleshooting (errors, limits, gotchas, comparisons). Skip a facet only if it does not apply. Do NOT output near-duplicate rephrasings of the same idea. Output ONLY a JSON array of strings — no prose, no markdown. Example: ["consensus algorithm overview", "configure validator node", "leader election failure recovery"]`
+
+// truncateForPromptLite caps text by approximate char count for source
+// prompts. Same heuristic the eval-quick path uses.
+func truncateForPromptLite(s string, maxChars int) string {
+	if len(s) <= maxChars {
+		return s
+	}
+	return s[:maxChars] + "…"
+}
+
+const researchSynthPrompt = `You are a research assistant. Synthesize an answer to the original question using ONLY the provided sources.
+- Cite sources by their numeric id, e.g. [1] or [2,3]. Every factual claim needs a citation.
+- If the sources don't cover something, say so plainly — do not invent.
+- Keep the answer focused on what the sources actually say.`
+
+// researchRefineSynthPrompt is the system prompt for pass 2+ of a multi-pass
+// /research call. The user message includes the prior draft answer alongside
+// the expanded source pool. The instruction shape mirrors the standard synth
+// prompt but explicitly directs the model to revise rather than start fresh.
+const researchRefineSynthPrompt = `You are a research assistant. You have a draft answer from a prior research pass plus additional sources that were gathered to close gaps. Produce a REVISED answer using all the sources now available.
+- Cite sources by their numeric id, e.g. [1] or [2,3]. Every factual claim needs a citation.
+- Keep correct claims from the draft. Correct or extend where the new sources change the picture.
+- If sources still don't cover something, say so plainly — do not invent.
+- Output the FULL revised answer, not a delta.`
+
+// selfEvalPrompt asks the model to judge whether its own draft answer is
+// sufficient given the question and sources. JSON-only output keeps parsing
+// deterministic. The "missing" + "refine_queries" fields drive the next
+// research pass when sufficient=false.
+const selfEvalPrompt = `You wrote a research answer. Judge whether it's sufficient given the question and sources.
+
+Output ONLY a JSON object (no markdown, no prose):
+{"sufficient": true|false, "missing": "<one-line gap, empty if sufficient>", "refine_queries": ["<query>", ...]}
+
+Rules:
+- "sufficient": true ONLY if the answer fully addresses the question with current sources.
+- "missing": one short sentence describing what would strengthen the answer (empty string if sufficient).
+- "refine_queries": 1-3 specific search queries that would close the gap (empty array if sufficient). Make them concrete — entity + concept + qualifier — not vague paraphrases.
+- Be honest. Most first-pass answers benefit from one more pass on a specific gap.`
+
+// selfEval is the parsed shape of the JSON the self-eval LLM call emits.
+type selfEval struct {
+	Sufficient    bool     `json:"sufficient"`
+	Missing       string   `json:"missing"`
+	RefineQueries []string `json:"refine_queries"`
+}
+
+// parseSelfEval extracts the {sufficient, missing, refine_queries} JSON from
+// the LLM response. Tolerates leading/trailing prose and markdown fences. On
+// any parse failure returns ok=false so the caller can treat as "stop and
+// keep the current answer" instead of crashing the stream.
+func parseSelfEval(s string) (selfEval, bool) {
+	s = strings.TrimSpace(s)
+	s = jsonFenceRE.ReplaceAllString(s, "$1")
+	// Find the first '{' and last '}' to skip any preamble.
+	i := strings.IndexByte(s, '{')
+	j := strings.LastIndexByte(s, '}')
+	if i < 0 || j <= i {
+		return selfEval{}, false
+	}
+	var ev selfEval
+	if err := json.Unmarshal([]byte(s[i:j+1]), &ev); err != nil {
+		return selfEval{}, false
+	}
+	if len(ev.RefineQueries) > 3 {
+		ev.RefineQueries = ev.RefineQueries[:3]
+	}
+	return ev, true
+}
+
+// jsonFenceRE strips ```json fences and bare ``` fences from LLM output. The
+// judge package has its own copy with the same intent; not worth pulling into
+// a shared package for two callers.
+var jsonFenceRE = regexp.MustCompile("(?s)```(?:json)?\\s*(.*?)\\s*```")
+
+// researchMaxPasses parses ?max_passes from the request. Default 3, valid
+// range 1-10 (clamped). 1 disables the self-eval loop entirely (single-pass
+// /research, today's behavior). The upper cap exists to bound LLM cost +
+// wall-clock: each non-final pass costs 1 synth + 1 self-eval call on top
+// of the per-sub-query retrieval, and the model can in theory loop forever
+// emitting "not yet sufficient" verdicts.
+func researchMaxPasses(r *http.Request) int {
+	const defaultMax = 3
+	const hardCap = 10
+	v := r.URL.Query().Get("max_passes")
+	if v == "" {
+		return defaultMax
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil || n < 1 {
+		return defaultMax
+	}
+	if n > hardCap {
+		return hardCap
+	}
+	return n
+}
+
+type researchResponse struct {
+	Query  string   `json:"query"`
+	Plan   []string `json:"plan"`
+	Expand string   `json:"expand,omitempty"`
+	// retriever label, mirroring /search/answer vocabulary.
+	Retriever       string         `json:"retriever,omitempty"`
+	Answer          string         `json:"answer"`
+	Sources         []answerSource `json:"sources"`
+	Model           string         `json:"model"`
+	Warnings        []string       `json:"warnings,omitempty"`
+	TotalCandidates int            `json:"total_candidates,omitempty"`
+	Took            string         `json:"took"`
+}
+
+// researchSubFanOut bounds how many sub-queries retrieve concurrently within
+// a single /research pass. Shared by the sync (handleResearch) and streaming
+// (streamResearch) paths so their latency profiles stay identical. 3 keeps the
+// site= budget at 3 sub-queries × fan-out-3 = one concurrent batch.
+const researchSubFanOut = 3
+
+func (s *pebbleHTTP) handleResearch(w http.ResponseWriter, r *http.Request) {
+	// Planner runs once on gateway,
+	// each sub-query scatters to peers, single synth here.
+	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
+		s.handleResearchGateway(w, r)
+		return
+	}
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented,
+			"/research requires cfg.Chat.Model to be set")
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	k := 8
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
+			k = n
+		}
+	}
+	// same retrieval filters /search/answer/find_similar accept.
+	// Parsed once here so the streaming and sync paths share semantics.
+	filt, err := parseRetrievalFilters(r)
+	if err != nil {
+		writeProblem(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	includeText := r.URL.Query().Get("include_text") == "true"
+	// SSE streaming for /research. Same trigger as /answer.
+	// Emits phase-aware events so the UI can render the plan and source list
+	// before the synth call completes — /research often runs 10–30s
+	// (2-3 plan→retrieve→synth chat rounds), so phase visibility matters.
+	wantStream := wantsSSE(r)
+	if wantStream {
+		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
+			cacheKey := "research|" + q + "|" + r.URL.Query().Get("site") + "|" + strconv.Itoa(k)
+			if r.Header.Get("Cache-Control") != "no-cache" {
+				if cached, ok := s.researchCache.Get(cacheKey); ok {
+					w.Header().Set("Content-Type", "text/event-stream")
+					w.Header().Set("Cache-Control", "no-cache")
+					w.Header().Set("X-Accel-Buffering", "no")
+					w.WriteHeader(http.StatusOK)
+					_, _ = w.Write(cached)
+					if f, ok2 := w.(http.Flusher); ok2 {
+						f.Flush()
+					}
+					return
+				}
+			}
+			rec := &recordingWriter{ResponseWriter: w}
+			s.streamResearch(rec, r, sc, q, k, filt, start)
+			if rec.buf.Len() > 0 {
+				s.researchCache.Set(cacheKey, rec.buf.Bytes())
+			}
+			return
+		}
+	}
+
+	// Plan — include site domain so the LLM generates site-specific sub-queries
+	// rather than generic web queries that miss small-site content.
+	planQ := q
+	if len(filt.sites) > 0 {
+		siteHints := make([]string, len(filt.sites))
+		for si, ss := range filt.sites {
+			siteHints[si] = ss.host
+			if ss.path != "" {
+				siteHints[si] += ss.path
+			}
+		}
+		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
+		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
+			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
+		}
+	}
+	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: researchPlanPrompt},
+		{Role: "user", Content: planQ},
+	})
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
+		return
+	}
+	subs := parseSubQueries(planRaw, q)
+	maxSubs := 5
+	// site= scope limits the search to a small domain. 3 sub-queries with
+	// fan-out 3 complete in one concurrent batch (~21s each), keeping total
+	// retrieval under 25s so LLM synthesis fits within the 60s budget.
+	if len(filt.sites) > 0 && maxSubs > 3 {
+		maxSubs = 3
+	}
+	if len(subs) > maxSubs {
+		subs = subs[:maxSubs]
+	}
+
+	// Retrieve per sub-query, dedupe by URL keeping best score.
+	type ranked struct {
+		score float64
+		hit   index.Hit
+	}
+	best := make(map[string]ranked, k*len(subs))
+	// Build the site boost map first: its length equals the site's doc count,
+	// which drives the adaptive perSub below.
+	syncBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
+	perSub := k * 2
+	if perSub > 40 {
+		perSub = 40
+	}
+	if len(filt.sites) > 0 {
+		// Fetch deep enough to cover the whole site (×1.2 headroom) so the 50×
+		// boost can reorder every site doc into top-k. Floor 200 preserves the
+		// MaxScore-firing window for tiny site-key terms (e.g. "pilotctl");
+		// ceiling 1000 bounds per-sub BM25 latency. Issue #2's MaxScore
+		// pre-check is what keeps the larger fetch affordable.
+		perSub = max(200, min(1000, int(math.Ceil(float64(len(syncBoostIDs))*1.2))))
+	}
+	// each sub-query goes through retrieveWithExpansion, so
+	// ?expand=hyde gives per-sub-query HyDE (was's behavior) and
+	// ?expand=paraphrase fans out 3 paraphrases × N sub-queries → RRF per
+	// sub-query → merge into best{}. The cross-sub-query merge stays
+	// score-keep-best (not a second RRF) — that's what specified.
+	// retriever dispatch (bm25 / dense / hybrid) applies per
+	// sub-query — every sub-query runs through the same retriever.
+	expandMode := r.URL.Query().Get("expand")
+	// Default to hybrid + rerank on /research — same rationale as /answer.
+	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
+		r.URL.Query().Get("retriever"),
+		r.URL.Query().Get("rerank"),
+	)
+	// Sub-queries are independent retrieve calls and the per-call cost dominates
+	// total latency, so fan them out with a bounded concurrency identical to the
+	// streaming path. bestMu guards the shared best map; hits and syncBoostIDs
+	// are goroutine-local / read-only respectively. There is no seenURLs set in
+	// the sync path (single pass), so the merge is a plain keep-best-score dedupe.
+	var bestMu sync.Mutex
+	var wg sync.WaitGroup
+	sem := make(chan struct{}, researchSubFanOut)
+	for _, sq := range subs {
+		sq := sq
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+			hits, _, err := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, syncBoostIDs, filt.sites)
+			if err != nil {
+				// log the specific sub-query so operators can diagnose
+				// 'why was this research thin on sources' — previously silent.
+				log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, err)
+				return
+			}
+			bestMu.Lock()
+			for _, h := range hits {
+				if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
+					best[h.URL] = ranked{score: h.Score, hit: h}
+				}
+			}
+			bestMu.Unlock()
+		}()
+	}
+	wg.Wait()
+	pooled := make([]ranked, 0, len(best))
+	for _, v := range best {
+		pooled = append(pooled, v)
+	}
+	sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
+	// same rerank wiring as /search and /answer — pool widens to
+	// rerankCandK before materialization, rerank reorders the pool, truncate
+	// to k after rerank so citation numbers track the final order.
+	keepCap := k
+	if wantRerank {
+		keepCap = s.rerankCandK
+		if keepCap < k {
+			keepCap = k
+		}
+	}
+	// Truncate the sorted pool to keepCap before materialization. For site=
+	// queries the 50x boost (applied in Search before its descending sort)
+	// guarantees the site's matched docs occupy the front of pooled, so this
+	// cut keeps exactly the boosted docs and bounds the rerank candidate count
+	// (was ~138 for site= queries; now keepCap, default rerankCandK=20).
+	if len(pooled) > keepCap {
+		pooled = pooled[:keepCap]
+	}
+
+	// Materialize candidates; defer sources + prompt build until after rerank.
+	type cand struct {
+		src        answerSource
+		excerpt    string
+		rerankText string
+		score      float64 // pooled score, used by time-decay
+	}
+	cands := make([]cand, 0, len(pooled))
+	for _, p := range pooled {
+		doc, derr := s.store.GetDocByURL(r.Context(), p.hit.URL)
+		if derr != nil || doc == nil {
+			continue
+		}
+		if !filt.allow(doc.URL, doc.PublishedAt) {
+			continue
+		}
+		excerpt := textExcerpt(doc.Text, 1200)
+		src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
+		if !doc.PublishedAt.IsZero() {
+			t := doc.PublishedAt
+			src.PublishedAt = &t
+		}
+		if includeText {
+			src.Text = doc.Text
+		}
+		c := cand{src: src, excerpt: excerpt, score: p.score}
+		if wantRerank {
+			c.rerankText = doc.Title + "\n" + doc.Text
+		}
+		cands = append(cands, c)
+	}
+	// time-decay on /research sync — re-weight pooled cands before
+	// rerank. Sub-queries that hit recent docs bubble up first.
+	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
+	if decaySet && len(cands) > 0 {
+		now := time.Now()
+		for i := range cands {
+			cands[i].score *= decayMultiplier(cands[i].src.PublishedAt, now, decayHalfLife)
+		}
+		sort.SliceStable(cands, func(i, j int) bool { return cands[i].score > cands[j].score })
+	}
+	if wantRerank && len(cands) > 1 {
+		rc := make([]rerank.Candidate, len(cands))
+		for i := range cands {
+			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
+		}
+		if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
+			reordered := make([]cand, 0, len(cands))
+			seen := make(map[int]bool, len(cands))
+			for _, id := range order {
+				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
+					reordered = append(reordered, cands[n])
+					seen[n] = true
+				}
+			}
+			for i, c := range cands {
+				if !seen[i] {
+					reordered = append(reordered, c)
+				}
+			}
+			cands = reordered
+		}
+	}
+	// MMR diversification on /research sync. /research aggregates
+	// across sub-queries — duplicate-ish docs accumulate fast. MMR after
+	// rerank, before truncation.
+	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
+	mmrFired := false
+	if mmrSet && len(cands) > 1 {
+		urls := make([]string, len(cands))
+		for i := range cands {
+			urls[i] = cands[i].src.URL
+		}
+		if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
+			reordered := make([]cand, len(order))
+			for i, idx := range order {
+				reordered[i] = cands[idx]
+			}
+			cands = reordered
+			mmrFired = true
+		}
+	}
+	if len(cands) > k {
+		cands = cands[:k]
+	}
+	sources := make([]answerSource, 0, len(cands))
+	var promptSources strings.Builder
+	for i, c := range cands {
+		// stamp ID = i+1 so the JSON response matches the [N]
+		// citation tokens we emit in the synth prompt below.
+		c.src.ID = i + 1
+		sources = append(sources, c.src)
+		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, c.excerpt)
+	}
+	// Sub-queries don't yield a
+	// single effectiveQuery, so "expansion fired" is approximated by intent:
+	// chat is up and expandMode requested it. Matches what warningsFor() uses
+	// to decide whether to flag a silent no-op.
+	denseReady := s.hnsw != nil && s.embedder != nil
+	expandFired := expandMode != "" && s.chat != nil
+	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, expandFired, wantRerank)
+	if mmrFired {
+		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
+	}
+	if decaySet {
+		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
+	}
+	if len(sources) == 0 {
+		writeJSON(w, http.StatusOK, researchResponse{
+			Query: q, Plan: subs, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
+			Answer:  "No matching sources for any sub-query.",
+			Sources: sources, Model: s.chat.Model(), Warnings: s.warningsFor(r),
+			TotalCandidates: len(best), Took: time.Since(start).String(),
+		})
+		return
+	}
+
+	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: researchSynthPrompt},
+		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Original question: " + q},
+	})
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, researchResponse{
+		Query: q, Plan: subs, Expand: normalizeExpandMode(expandMode), Retriever: retrieverLabel,
+		Answer: answer, Sources: sources,
+		Model: s.chat.Model(), Warnings: s.warningsFor(r),
+		TotalCandidates: len(best), Took: time.Since(start).String(),
+	})
+}
+
+// streamResearch is the SSE form of handleResearch. Event sequence:
+//
+//	plan    — sub-queries returned by the planner
+//	sources — deduped + ranked pool fed to the synthesizer
+//	chunk   — per chat delta during synth
+//	done    — final {"took": "..."}
+//	error   — terminal; either plan, retrieval, or synth failed
+func (s *pebbleHTTP) streamResearch(w http.ResponseWriter, r *http.Request, sc embed.StreamingChatClient, q string, k int, filt retrievalFilters, start time.Time) {
+	sse := newAnswerSSE(w, start)
+	if sse == nil {
+		writeProblem(w, http.StatusInternalServerError, "streaming requires http.Flusher")
+		return
+	}
+	// /research can sit on a single slow retrieve or chat call for
+	// 10–30 s. Without a keepalive, the browser's HTTP/2 stream times
+	// out as inactive and the request fails mid-pipeline. 7 s gives
+	// generous headroom under Safari's ~30 s idle limit.
+	stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
+	defer stopKA()
+	includeText := r.URL.Query().Get("include_text") == "true"
+
+	// surface silent no-ops upfront so SSE clients can render them
+	// while the plan call is still in flight. Fires before plan to give the
+	// fastest visual feedback when a misconfigured request arrives.
+	sse.warnings(s.warningsFor(r))
+	sse.phase("plan_start", map[string]any{"q": q, "model": sc.Model()})
+
+	// site= hint: LLM generates site-specific sub-queries with domain terminology
+	// rather than generic queries that miss small-site content in BM25 top-200.
+	planQ := q
+	if len(filt.sites) > 0 {
+		siteHints := make([]string, len(filt.sites))
+		for si, ss := range filt.sites {
+			siteHints[si] = ss.host
+			if ss.path != "" {
+				siteHints[si] += ss.path
+			}
+		}
+		planQ = q + "\n\nSite filter: " + strings.Join(siteHints, ", ") + ". Generate sub-queries using specific terminology likely found on this site."
+		if titles := s.getSiteTitles(r.Context(), filt.sites); len(titles) > 0 {
+			planQ += "\n\nExample pages on this site: " + strings.Join(titles, ", ") + "."
+		}
+	}
+	planRaw, err := s.doChat(r.Context(), sc, []embed.ChatMsg{
+		{Role: "system", Content: researchPlanPrompt},
+		{Role: "user", Content: planQ},
+	})
+	if err != nil {
+		sse.send(map[string]any{"type": "error", "phase": "plan", "error": err.Error()})
+		return
+	}
+	subs := parseSubQueries(planRaw, q)
+	{
+		maxSubs := 5
+		if len(filt.sites) > 0 && maxSubs > 3 {
+			maxSubs = 3 // site= budget: 3 sub-queries × fan-out-3 = one concurrent batch (~21s) + LLM fits in 60s
+		}
+		if len(subs) > maxSubs {
+			subs = subs[:maxSubs]
+		}
+	}
+	// per-sub-query expansion via retrieveWithExpansion.
+	// per-sub-query retriever dispatch (bm25 / dense / hybrid).
+	// read retriever + wantRerank early so the plan event can
+	// surface the full retriever label, not just expand.
+	// Default to hybrid + rerank on /research streaming — same rationale as /answer.
+	expandMode := r.URL.Query().Get("expand")
+	retrieverParam, wantRerank := s.applyLLMEndpointDefaults(
+		r.URL.Query().Get("retriever"),
+		r.URL.Query().Get("rerank"),
+	)
+	denseReady := s.hnsw != nil && s.embedder != nil
+	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, expandMode != "", wantRerank)
+
+	// surface the active expansion strategy on the plan event so
+	// UIs can render 'using paraphrase' or 'using HyDE' as soon as the plan
+	// arrives, before per-sub-query expansion fires.
+	planEvent := map[string]any{"type": "plan", "query": q, "plan": subs, "model": sc.Model()}
+	if mode := normalizeExpandMode(expandMode); mode != "" {
+		planEvent["expand"] = mode
+	}
+	if retrieverLabel != "" {
+		planEvent["retriever"] = retrieverLabel
+	}
+	sse.send(planEvent)
+	// Phase event mirrors /query's shape so the chat UI's timeline strip
+	// renders identical rows across all three synth endpoints. Co-exists
+	// with the legacy `type: plan` event above, which the CLI client at
+	// cmd/cosift/main.go keys on.
+	planPhase := map[string]any{"queries": subs, "retriever": retrieverLabel}
+	if mode := normalizeExpandMode(expandMode); mode != "" {
+		planPhase["expand"] = mode
+	}
+	sse.phase("plan", planPhase)
+
+	type ranked struct {
+		score float64
+		hit   index.Hit
+	}
+	type cand struct {
+		src        answerSource
+		excerpt    string
+		rerankText string
+		score      float64
+	}
+
+	// Multi-pass research loop. Each pass: retrieve for the current subs →
+	// fuse → materialize → rerank → mmr → synth → self-eval. Cumulative URL
+	// set across passes; new passes skip URLs already seen so retrieval
+	// widens rather than re-fetching the same docs. After synth, the model
+	// judges whether its draft is sufficient. If not, we use its
+	// refine_queries to drive the next pass. Cap at maxPasses to bound
+	// latency + LLM cost.
+	maxPasses := researchMaxPasses(r)
+	// site= constrains to a small domain: multi-pass BM25 at fetchK=300 costs
+	// 21s × passes beyond the 60s budget. Cap to 1 pass — a small site's corpus
+	// is fully represented in the first retrieval round anyway.
+	if len(filt.sites) > 0 && maxPasses > 1 {
+		maxPasses = 1
+	}
+	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
+	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
+	// Pre-build site boost map once per request (O(site_docs) famHost scan,
+	// cached for repeat queries). Nil when site= is absent or store unavailable.
+	// Built before perSub because its length equals the site doc count.
+	siteBoostIDs := s.getSiteBoostIDs(r.Context(), filt.sites)
+	perSub := k * 2
+	if perSub > 40 {
+		perSub = 40
+	}
+	if len(filt.sites) > 0 {
+		// Fetch deep enough to cover the whole site (×1.2 headroom); floor 200
+		// preserves the MaxScore-firing window for tiny site-key terms, ceiling
+		// 1000 bounds per-sub BM25 latency. Mitigated by Issue #2's MaxScore
+		// pre-check.
+		perSub = max(200, min(1000, int(math.Ceil(float64(len(siteBoostIDs))*1.2))))
+	}
+	keepCap := k
+	if wantRerank {
+		keepCap = s.rerankCandK
+		if keepCap < k {
+			keepCap = k
+		}
+	}
+
+	seenURLs := make(map[string]bool)
+	allCands := make([]cand, 0, k*maxPasses)
+	totalCandidates := 0 // counts URL contributions across passes for the sources event
+	var lastAnswer string
+	var finalRetrieverLabel string
+
+	for pass := 1; pass <= maxPasses; pass++ {
+		sse.phase("pass_start", map[string]any{"pass": pass, "queries": subs})
+
+		// Retrieval round for this pass. Sub-queries run concurrently with
+		// a bounded fan-out — they're independent calls to s.retrieve and
+		// the per-call cost dominates total pass latency. Serial execution
+		// of N sub-queries at ~12 s each pushed pass-1+pass-2 wall-clock
+		// past 60 s on this corpus, blowing the browser's hardcoded fetch
+		// timeout on long-streaming responses. With fan-out the pass
+		// shrinks to ~max(sub-query latency) plus the per-goroutine
+		// bookkeeping. sse.send is mutex-protected; bestMu protects best.
+		// seenURLs is read-only during this loop (last written at the end
+		// of the prior pass), so no synchronization is needed for it.
+		best := make(map[string]ranked, k*len(subs))
+		var bestMu sync.Mutex
+		var wg sync.WaitGroup
+		sem := make(chan struct{}, researchSubFanOut)
+		for _, sq := range subs {
+			sq := sq
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				sem <- struct{}{}
+				defer func() { <-sem }()
+				sse.phase("retrieving", map[string]any{"pass": pass, "query": sq})
+				hits, _, rerr := s.retrieveForSites(r.Context(), sq, perSub, retrieverParam, expandMode, siteBoostIDs, filt.sites)
+				if rerr != nil {
+					log.Printf("pebble-serve: /research sub-query %q failed: %v", sq, rerr)
+					sse.phase("expand", map[string]any{"pass": pass, "query": sq, "error": rerr.Error()})
+					return
+				}
+				bestMu.Lock()
+				for _, h := range hits {
+					if seenURLs[h.URL] {
+						continue
+					}
+					if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
+						best[h.URL] = ranked{score: h.Score, hit: h}
+					}
+				}
+				bestMu.Unlock()
+				sse.phase("expand", map[string]any{"pass": pass, "query": sq, "hits": len(hits)})
+			}()
+		}
+		wg.Wait()
+		totalCandidates += len(best)
+		pooled := make([]ranked, 0, len(best))
+		for _, v := range best {
+			pooled = append(pooled, v)
+		}
+		sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
+		sse.phase("fuse", map[string]any{"pass": pass, "unique_urls": len(pooled)})
+		// Truncate the sorted pool to keepCap before materialization. For site=
+		// queries the 50x boost (applied in Search before its descending sort)
+		// puts the site's matched docs at the front of pooled, so this cut keeps
+		// the boosted docs and bounds the LLM rerank candidate count to keepCap.
+		if len(pooled) > keepCap {
+			pooled = pooled[:keepCap]
+		}
+
+		// Materialize this pass's new candidates (filt-aware).
+		newCands := make([]cand, 0, len(pooled))
+		for _, p := range pooled {
+			doc, derr := s.store.GetDocByURL(r.Context(), p.hit.URL)
+			if derr != nil || doc == nil {
+				continue
+			}
+			if !filt.allow(doc.URL, doc.PublishedAt) {
+				continue
+			}
+			excerpt := textExcerpt(doc.Text, 1200)
+			src := answerSource{URL: doc.URL, Title: doc.Title, Excerpt: excerpt, Author: doc.Author}
+			if !doc.PublishedAt.IsZero() {
+				t := doc.PublishedAt
+				src.PublishedAt = &t
+			}
+			if includeText {
+				src.Text = doc.Text
+			}
+			c := cand{src: src, excerpt: excerpt, score: p.score}
+			if wantRerank {
+				c.rerankText = doc.Title + "\n" + doc.Text
+			}
+			newCands = append(newCands, c)
+		}
+		sse.phase("materialize", map[string]any{"pass": pass, "candidates": len(newCands)})
+
+		// Optional time-decay on this pass's new candidates.
+		passLabel := retrieverLabel
+		if decaySet && len(newCands) > 0 {
+			now := time.Now()
+			for i := range newCands {
+				newCands[i].score *= decayMultiplier(newCands[i].src.PublishedAt, now, decayHalfLife)
+			}
+			sort.SliceStable(newCands, func(i, j int) bool { return newCands[i].score > newCands[j].score })
+			passLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
+		}
+		if wantRerank && len(newCands) > 1 {
+			rc := make([]rerank.Candidate, len(newCands))
+			for i := range newCands {
+				rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: newCands[i].rerankText}
+			}
+			if order, rerr := s.doRerank(r.Context(), q, rc); rerr == nil && len(order) > 0 {
+				reordered := make([]cand, 0, len(newCands))
+				seenIdx := make(map[int]bool, len(newCands))
+				for _, id := range order {
+					if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(newCands) && !seenIdx[n] {
+						reordered = append(reordered, newCands[n])
+						seenIdx[n] = true
+					}
+				}
+				for i, c := range newCands {
+					if !seenIdx[i] {
+						reordered = append(reordered, c)
+					}
+				}
+				newCands = reordered
+			}
+			sse.phase("rerank", map[string]any{"pass": pass, "reranker": s.reranker.Name(), "candidates": len(newCands)})
+		}
+		if mmrSet && len(newCands) > 1 {
+			urls := make([]string, len(newCands))
+			for i := range newCands {
+				urls[i] = newCands[i].src.URL
+			}
+			if order := s.applyMMRPermutation(r.Context(), urls, q, mmrLambda); order != nil {
+				reordered := make([]cand, len(order))
+				for i, idx := range order {
+					reordered[i] = newCands[idx]
+				}
+				newCands = reordered
+				passLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
+				sse.phase("mmr", map[string]any{"pass": pass, "lambda": mmrLambda, "candidates": len(newCands)})
+			}
+		}
+		if len(newCands) > k {
+			newCands = newCands[:k]
+		}
+		// Promote into the cumulative pool.
+		for _, c := range newCands {
+			seenURLs[c.src.URL] = true
+			allCands = append(allCands, c)
+		}
+		finalRetrieverLabel = passLabel
+
+		// First-pass-empty path mirrors today's behavior: if pass 1 finds
+		// no usable sources at all, bail with empty=true.
+		if pass == 1 && len(allCands) == 0 {
+			sse.send(map[string]any{"type": "done", "took": time.Since(start).String(), "empty": true})
+			return
+		}
+		// Later-pass empty (no new sources added): synth would just rewrite
+		// the prior answer with no new signal. Stop and keep lastAnswer.
+		if pass > 1 && len(newCands) == 0 {
+			break
+		}
+
+		// Build the cumulative sources slice + prompt block, stamping IDs
+		// 1..N in the order URLs were promoted.
+		// For site= queries trim excerpts to 600 chars — reduces synthesis
+		// context from ~9.6k to ~4.8k chars, cutting synthesis latency ~40%.
+		synthExcerptLen := 1200
+		if len(filt.sites) > 0 {
+			synthExcerptLen = 600
+		}
+		cumulativeSources := make([]answerSource, 0, len(allCands))
+		var promptSources strings.Builder
+		for i, c := range allCands {
+			c.src.ID = i + 1
+			cumulativeSources = append(cumulativeSources, c.src)
+			ex := c.excerpt
+			if len(ex) > synthExcerptLen {
+				ex = ex[:synthExcerptLen]
+			}
+			fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, c.src.Title, c.src.URL, ex)
+		}
+		srcEvt := map[string]any{
+			"type": "sources", "sources": cumulativeSources,
+			"total_candidates": totalCandidates, "pass": pass,
+		}
+		if finalRetrieverLabel != "" {
+			srcEvt["retriever"] = finalRetrieverLabel
+		}
+		sse.send(srcEvt)
+
+		// Synth. Pass 1 uses the standard prompt; pass 2+ uses the refine
+		// prompt with the prior draft injected.
+		sse.phase("synth_start", map[string]any{
+			"pass": pass, "sources": len(cumulativeSources), "model": sc.Model(),
+		})
+		var synthMsgs []embed.ChatMsg
+		userMsg := "Sources:\n\n" + promptSources.String() + "Original question: " + q
+		if pass == 1 {
+			synthMsgs = []embed.ChatMsg{
+				{Role: "system", Content: researchSynthPrompt},
+				{Role: "user", Content: userMsg},
+			}
+		} else {
+			synthMsgs = []embed.ChatMsg{
+				{Role: "system", Content: researchRefineSynthPrompt},
+				{Role: "user", Content: userMsg + "\n\nYour prior draft answer:\n" + lastAnswer},
+			}
+		}
+		full, serr := s.doChatStream(r.Context(), sc, synthMsgs, sse.chunk)
+		if serr != nil {
+			sse.send(map[string]any{"type": "error", "phase": "synth", "error": serr.Error()})
+			return
+		}
+		lastAnswer = full
+
+		// On the final pass, skip self-eval — nothing to escalate to.
+		if pass == maxPasses {
+			break
+		}
+
+		// Self-evaluate. The model decides whether to escalate.
+		sse.phase("self_eval_start", map[string]any{"pass": pass})
+		evalUserMsg := fmt.Sprintf(
+			"Question: %s\n\nYour answer:\n%s\n\nSources used (id — title — url):\n%s",
+			q, lastAnswer, summarizeSourceList(cumulativeSources),
+		)
+		evalRaw, eerr := s.doChat(r.Context(), sc, []embed.ChatMsg{
+			{Role: "system", Content: selfEvalPrompt},
+			{Role: "user", Content: evalUserMsg},
+		})
+		if eerr != nil {
+			log.Printf("pebble-serve: /research self-eval pass %d failed: %v", pass, eerr)
+			sse.phase("self_eval", map[string]any{"pass": pass, "error": eerr.Error()})
+			break
+		}
+		ev, ok := parseSelfEval(evalRaw)
+		if !ok {
+			sse.phase("self_eval", map[string]any{"pass": pass, "parse_failed": true})
+			break
+		}
+		sse.phase("self_eval", map[string]any{
+			"pass": pass, "sufficient": ev.Sufficient,
+			"missing": ev.Missing, "refine_queries": ev.RefineQueries,
+		})
+		if ev.Sufficient {
+			break
+		}
+		// Blurb summarizing why we're escalating; UI renders inline.
+		blurbText := strings.TrimSpace(ev.Missing)
+		if blurbText == "" {
+			blurbText = "More depth needed"
+		}
+		blurbText += " — searching deeper."
+		sse.phase("blurb", map[string]any{"pass": pass, "text": blurbText})
+
+		// Drive the next pass with the refined queries the model proposed.
+		if len(ev.RefineQueries) == 0 {
+			break
+		}
+		subs = ev.RefineQueries
+		if len(subs) > 5 {
+			subs = subs[:5]
+		}
+	}
+
+	sse.done()
+}
+
+// summarizeSourceList formats sources into compact "[id] title — url" lines
+// for the self-eval user message. Avoids piping the full excerpts back into
+// the eval prompt — the eval is about coverage, not re-reading.
+func summarizeSourceList(srcs []answerSource) string {
+	var sb strings.Builder
+	for _, s := range srcs {
+		fmt.Fprintf(&sb, "[%d] %s — %s\n", s.ID, s.Title, s.URL)
+	}
+	return sb.String()
+}
diff --git a/cmd/cosift/serve_crawl.go b/cmd/cosift/serve_crawl.go
new file mode 100644
index 0000000..5039f13
--- /dev/null
+++ b/cmd/cosift/serve_crawl.go
@@ -0,0 +1,851 @@
+package main
+
+import (
+	"compress/gzip"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// handleCrawlEnqueue accepts a single URL forwarded from a peer shard and
+// pushes it onto the local crawler's frontier. Auth via cfg.Cluster.
+// PeerAuthToken Bearer header.
+type crawlEnqueueReq struct {
+	URL string `json:"url"`
+}
+
+func (s *pebbleHTTP) handleCrawlEnqueue(w http.ResponseWriter, r *http.Request) {
+	// Auth
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+			return
+		}
+	}
+	if s.crawlSeed == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req crawlEnqueueReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"...\"}")
+		return
+	}
+	if err := s.crawlSeed(req.URL); err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"queued": req.URL})
+}
+
+// handleAllowDomain promotes a domain into the crawler's runtime dynamic
+// allowlist so subsequently-crawled URLs from it pass allowedDomain(). Used by
+// the HN/Reddit harvesters to grow the crawlable set organically once a
+// link-target domain recurs above their frequency threshold. Persisted so it
+// survives restart. Body: {"domain":"example.com"}.
+func (s *pebbleHTTP) handleAllowDomain(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+			return
+		}
+	}
+	if s.crawlAllowDomain == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
+		return
+	}
+	var req struct {
+		Domain string `json:"domain"`
+	}
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 8<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Domain == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"domain\": \"example.com\"}")
+		return
+	}
+	if err := s.crawlAllowDomain(req.Domain); err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"allowed": strings.ToLower(strings.TrimSpace(req.Domain))})
+}
+
+// handleFrontierClear wipes the entire frontier in a single Pebble
+// DeleteRange — every queued URL, primary + secondary index. Used when
+// the frontier is so polluted by spam-discovery crawls that
+// claim-time exclude rules can't drain it in reasonable time. Operator
+// re-seeds via seeds-file restart or /admin/sitemap-import calls.
+//
+// Sees the same PeerAuthToken as the other admin endpoints. Returns the
+// approximate count of deleted entries (DeleteRange is O(tombstones),
+// not O(N), so the count is reported as -1 to signal "swept range").
+func (s *pebbleHTTP) handleFrontierClear(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+			return
+		}
+	}
+	if err := s.store.ClearFrontier(r.Context()); err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"cleared": true})
+}
+
+// handleFrontierPurgeHost deletes every queued frontier entry whose host
+// matches the supplied value. Used to drain blacklisted hosts that the
+// round-robin cursor would take days to chew through one-by-one (the
+// cursor visits each host once per cycle; a 5M-entry host needs 5M
+// cycles to drain, days of cycle time at typical claim rates).
+type frontierPurgeReq struct {
+	Host string `json:"host"`
+}
+
+func (s *pebbleHTTP) handleFrontierPurgeHost(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+			return
+		}
+	}
+	var req frontierPurgeReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"host\": \"...\"}")
+		return
+	}
+	n, err := s.store.PurgeFrontierByHost(r.Context(), req.Host)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"purged": n, "host": req.Host})
+}
+
+// handleSitemapImport fetches a sitemap.xml (or sitemap-index, one level
+// of recursion) and pushes every <loc> entry to the live frontier. Same
+// auth as crawl-enqueue. Synchronous — returns when all URLs are queued.
+// For very large sitemaps (>50K URLs) the call may take seconds.
+type sitemapImportReq struct {
+	URL string `json:"url"`
+}
+
+func (s *pebbleHTTP) handleSitemapImport(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedSitemap == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req sitemapImportReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"https://.../sitemap.xml\"}")
+		return
+	}
+	t0 := time.Now()
+	n, err := s.crawlSeedSitemap(r.Context(), req.URL)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	log.Printf("sitemap-import: queued %d URLs from %s in %s", n, req.URL, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"sitemap": req.URL,
+		"queued":  n,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
+// handleRecrawlSitemap fetches a sitemap.xml and calls Recrawl on every URL,
+// resetting done/errored entries back to queued so the crawler re-visits them.
+// Use this when a domain was previously blocked by include rules and its frontier
+// entries are stuck in errored state — sitemap-import's INSERT OR IGNORE won't
+// re-queue them, but Recrawl will.
+func (s *pebbleHTTP) handleRecrawlSitemap(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlRecrawl == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler")
+		return
+	}
+	var req sitemapImportReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, `expected {"url": "https://.../sitemap.xml"}`)
+		return
+	}
+	// Fetch and parse the sitemap.
+	hc := &http.Client{Timeout: 20 * time.Second}
+	resp, err := hc.Get(req.URL)
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "fetch sitemap: "+err.Error())
+		return
+	}
+	defer resp.Body.Close()
+	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 8<<20))
+	// Extract <loc> entries — simple text scan avoids XML namespace headaches.
+	// Handles both pretty-printed (one tag per line) and compact sitemaps
+	// where <url><loc>…</loc></url> all appear on one line.
+	t0 := time.Now()
+	var reset, skipped int
+	src := string(raw)
+	for {
+		start := strings.Index(src, "<loc>")
+		if start < 0 {
+			break
+		}
+		src = src[start+len("<loc>"):]
+		end := strings.Index(src, "</loc>")
+		if end < 0 {
+			break
+		}
+		u := strings.TrimSpace(src[:end])
+		src = src[end+len("</loc>"):]
+		if err := s.crawlRecrawl(r.Context(), u); err != nil {
+			skipped++
+		} else {
+			reset++
+		}
+	}
+	log.Printf("recrawl-sitemap: reset %d, skipped %d from %s in %s", reset, skipped, req.URL, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"sitemap": req.URL,
+		"reset":   reset,
+		"skipped": skipped,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
+// handleCrawlNow runs the fetch-parse-index pipeline synchronously for one
+// or more URLs, bypassing the persistent frontier entirely. Use this when
+// the round-robin cursor in a large frontier (10M+) would take hours to
+// reach an explicitly-seeded URL — direct fetch + UpsertDocument + chunk +
+// embed all happen in this request. Returns per-URL outcomes.
+type crawlNowReq struct {
+	URLs []string `json:"urls"`
+	URL  string   `json:"url,omitempty"`
+}
+
+func (s *pebbleHTTP) handleCrawlNow(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlFetchNow == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req crawlNowReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+	if err := json.Unmarshal(body, &req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "expected {\"urls\":[...]} or {\"url\":\"...\"}")
+		return
+	}
+	urls := req.URLs
+	if req.URL != "" {
+		urls = append(urls, req.URL)
+	}
+	if len(urls) == 0 {
+		writeProblem(w, http.StatusBadRequest, "no URLs in body")
+		return
+	}
+	results := make([]map[string]any, 0, len(urls))
+	t0 := time.Now()
+	for _, u := range urls {
+		err := s.crawlFetchNow(r.Context(), u)
+		out := map[string]any{"url": u}
+		if err != nil {
+			out["error"] = err.Error()
+		} else {
+			out["ok"] = true
+		}
+		results = append(results, out)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"results": results,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
+// handleSitePack discovers a site's sitemaps + RSS feeds and bulk-enqueues
+// everything found. Targets the "I want to index THIS site" operator flow
+// without editing cosift.json + restarting + waiting for the cursor.
+// Discovery order:
+//  1. GET https://<host>/robots.txt — look for `Sitemap:` directives
+//  2. Fallback to canonical /sitemap.xml + /sitemap_index.xml
+//  3. RSS at common paths: /feed, /feed.xml, /rss, /rss.xml, /atom.xml, /feed/atom
+//
+// Each found resource is run through the existing SeedSitemap / SeedRSS
+// primitives. Returns per-resource counts.
+type sitePackReq struct {
+	Host string `json:"host"` // e.g. "example.com" or "blog.example.com" — no scheme
+}
+
+func (s *pebbleHTTP) handleSitePack(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedSitemap == nil || s.crawlSeedRSS == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req sitePackReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"example.com\"}")
+		return
+	}
+	host, ok := normalizeBareHost(req.Host)
+	if !ok {
+		writeProblem(w, http.StatusBadRequest, "host must be a bare hostname like example.com")
+		return
+	}
+	base := "https://" + host
+	hc := &http.Client{Timeout: 20 * time.Second}
+
+	type result struct {
+		Source  string `json:"source"` // "robots-sitemap" | "fallback-sitemap" | "rss"
+		URL     string `json:"url"`
+		Indexed int    `json:"indexed"`
+		Error   string `json:"error,omitempty"`
+	}
+	results := make([]result, 0, 8)
+	t0 := time.Now()
+
+	candidateSitemaps, fromRobots := discoverSitemaps(r.Context(), hc, base)
+	for _, su := range candidateSitemaps {
+		n, err := s.crawlSeedSitemap(r.Context(), su)
+		res := result{URL: su, Indexed: n}
+		if fromRobots {
+			res.Source = "robots-sitemap"
+		} else {
+			res.Source = "fallback-sitemap"
+		}
+		if err != nil {
+			res.Error = err.Error()
+		}
+		results = append(results, res)
+	}
+	// Step 3: common RSS paths.
+	for _, p := range []string{"/feed", "/feed.xml", "/rss", "/rss.xml", "/atom.xml", "/feed/atom"} {
+		fu := base + p
+		n, err := s.crawlSeedRSS(r.Context(), fu)
+		// Silently skip RSS paths that 404 / don't parse — most sites have
+		// only one of the listed paths.
+		if err != nil && n == 0 {
+			continue
+		}
+		results = append(results, result{Source: "rss", URL: fu, Indexed: n})
+	}
+
+	total := 0
+	for _, r := range results {
+		total += r.Indexed
+	}
+	log.Printf("site-pack: %s discovered %d resources, enqueued %d URLs in %s",
+		host, len(results), total, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"host":          host,
+		"resources":     len(results),
+		"total_indexed": total,
+		"elapsed":       time.Since(t0).String(),
+		"results":       results,
+	})
+}
+
+// normalizeBareHost strips scheme/trailing-slash from a host or URL and
+// returns the bare hostname. ok is false when the result still contains a
+// path segment (so callers can reject "example.com/foo" as a host).
+func normalizeBareHost(s string) (host string, ok bool) {
+	host = strings.TrimSpace(s)
+	host = strings.TrimPrefix(host, "https://")
+	host = strings.TrimPrefix(host, "http://")
+	host = strings.TrimSuffix(host, "/")
+	host = strings.ToLower(host)
+	if host == "" || strings.Contains(host, "/") {
+		return "", false
+	}
+	return host, true
+}
+
+// discoverSitemaps returns candidate sitemap URLs for a site, given its base
+// origin (e.g. "https://example.com"). It prefers Sitemap: directives in
+// robots.txt; when robots.txt yields none it falls back to a small ordered
+// list of canonical/CMS paths. fromRobots reports which source was used.
+func discoverSitemaps(ctx context.Context, hc *http.Client, base string) (sitemaps []string, fromRobots bool) {
+	if hc == nil {
+		hc = &http.Client{Timeout: 20 * time.Second}
+	}
+	if req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+"/robots.txt", nil); err == nil {
+		if rresp, err := hc.Do(req); err == nil {
+			if rresp.StatusCode < 400 {
+				rbody, _ := io.ReadAll(io.LimitReader(rresp.Body, 2<<20))
+				for _, line := range strings.Split(string(rbody), "\n") {
+					line = strings.TrimSpace(line)
+					if strings.HasPrefix(strings.ToLower(line), "sitemap:") {
+						if val := strings.TrimSpace(line[len("sitemap:"):]); val != "" {
+							sitemaps = append(sitemaps, val)
+						}
+					}
+				}
+			}
+			rresp.Body.Close()
+		}
+	}
+	if len(sitemaps) > 0 {
+		return sitemaps, true
+	}
+	// /sitemap.xml is the canonical spec but many CMSes (WordPress, Yoast,
+	// Ghost, Hugo themes) ship at non-canonical paths. Try a small ordered
+	// list before giving up: /sitemap.xml (most common), then WordPress's
+	// /wp-sitemap.xml + Yoast's per-content-type splits, then index variants.
+	for _, p := range []string{
+		"/sitemap.xml",
+		"/wp-sitemap.xml",    // WordPress 5.5+
+		"/sitemap_index.xml", // Yoast SEO
+		"/post-sitemap.xml",  // Yoast posts
+		"/page-sitemap.xml",  // Yoast pages
+		"/sitemap-index.xml", // some CMSes hyphenate
+		"/sitemap.xml.gz",    // gzipped variant (sitemap.go handles .gz)
+	} {
+		sitemaps = append(sitemaps, base+p)
+	}
+	return sitemaps, false
+}
+
+// parseLaneName maps a friendly lane name to a frontier lane byte. The empty
+// string and unknown values default to the high-priority submitted lane,
+// which is the point of /admin/site-submit: jump a site to the front.
+func parseLaneName(s string) byte {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case "refresh":
+		return store.LaneRefresh
+	case "discovered":
+		return store.LaneDiscovered
+	case "bulk":
+		return store.LaneBulk
+	default: // "", "priority", "submitted", or anything unrecognized
+		return store.LaneSubmitted
+	}
+}
+
+func laneName(lane byte) string {
+	switch lane {
+	case store.LaneSubmitted:
+		return "submitted"
+	case store.LaneRefresh:
+		return "refresh"
+	case store.LaneDiscovered:
+		return "discovered"
+	case store.LaneBulk:
+		return "bulk"
+	default:
+		return "submitted"
+	}
+}
+
+// handleSiteSubmit discovers every URL of a website (via robots.txt sitemaps,
+// then canonical fallbacks) and pushes them all onto the live crawl frontier
+// in a chosen priority lane — by default the high-priority "submitted" lane,
+// so the whole site jumps ahead of the generic discovery backlog. Same auth
+// as the other admin endpoints. Synchronous; large sitemaps take seconds.
+//
+// Body: {"host":"pilotprotocol.network", "lane":"priority"}
+//
+//	lane: "priority" (default) | "refresh" | "discovered" | "bulk"
+type siteSubmitReq struct {
+	Host string `json:"host"`
+	Lane string `json:"lane,omitempty"`
+}
+
+func (s *pebbleHTTP) handleSiteSubmit(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedSitemapLane == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req siteSubmitReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"example.com\", \"lane\":\"priority\"}")
+		return
+	}
+	host, ok := normalizeBareHost(req.Host)
+	if !ok {
+		writeProblem(w, http.StatusBadRequest, "host must be a bare hostname like example.com")
+		return
+	}
+	lane := parseLaneName(req.Lane)
+	base := "https://" + host
+	hc := &http.Client{Timeout: 20 * time.Second}
+	t0 := time.Now()
+
+	type result struct {
+		Source string `json:"source"` // "robots-sitemap" | "fallback-sitemap"
+		URL    string `json:"url"`
+		Queued int    `json:"queued"`
+		Error  string `json:"error,omitempty"`
+	}
+	candidateSitemaps, fromRobots := discoverSitemaps(r.Context(), hc, base)
+	source := "fallback-sitemap"
+	if fromRobots {
+		source = "robots-sitemap"
+	}
+	results := make([]result, 0, len(candidateSitemaps))
+	total := 0
+	for _, su := range candidateSitemaps {
+		n, err := s.crawlSeedSitemapLane(r.Context(), su, lane)
+		res := result{Source: source, URL: su, Queued: n}
+		if err != nil {
+			res.Error = err.Error()
+		}
+		total += n
+		results = append(results, res)
+	}
+	log.Printf("site-submit: %s → lane=%s discovered %d sitemap(s), queued %d URLs in %s",
+		host, laneName(lane), len(results), total, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"host":         host,
+		"lane":         laneName(lane),
+		"sitemaps":     len(results),
+		"total_queued": total,
+		"elapsed":      time.Since(t0).String(),
+		"results":      results,
+	})
+}
+
+// handleWETImportBulk fetches a CommonCrawl `wet.paths.gz` manifest,
+// takes the first N entries (or skip+take), and runs `/admin/wet-import`
+// against each one in parallel. Lets operators bulk-ingest a release with
+// one call instead of repeatedly POSTing per file. Synchronous — blocks
+// until all N finish, returns total docs indexed.
+//
+// Example body:
+//
+//	{"manifest_url":"https://data.commoncrawl.org/crawl-data/CC-MAIN-2024-51/wet.paths.gz",
+//	 "count":4, "skip":0, "concurrency":2, "lexical_only":true}
+type wetImportBulkReq struct {
+	ManifestURL string `json:"manifest_url"`
+	Count       int    `json:"count"`
+	Skip        int    `json:"skip,omitempty"`
+	Concurrency int    `json:"concurrency,omitempty"`
+	LexicalOnly bool   `json:"lexical_only,omitempty"`
+	DedupeFresh bool   `json:"dedupe_fresh,omitempty"`
+}
+
+func (s *pebbleHTTP) handleWETImportBulk(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedWET == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req wetImportBulkReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.ManifestURL == "" || req.Count <= 0 {
+		writeProblem(w, http.StatusBadRequest, "expected {\"manifest_url\":\"https://.../wet.paths.gz\",\"count\":N}")
+		return
+	}
+	if req.Concurrency <= 0 {
+		req.Concurrency = 2
+	}
+	if req.Concurrency > 8 {
+		req.Concurrency = 8 // beyond this the pebble write lock dominates anyway
+	}
+
+	// Fetch the manifest. wet.paths.gz is a gzipped newline-delimited list
+	// of relative paths under data.commoncrawl.org.
+	mreq, err := http.NewRequestWithContext(r.Context(), http.MethodGet, req.ManifestURL, http.NoBody)
+	if err != nil {
+		writeProblem(w, http.StatusBadRequest, "build manifest request: "+err.Error())
+		return
+	}
+	mreq.Header.Set("User-Agent", "cosift-bulk-import")
+	mresp, err := (&http.Client{Timeout: 60 * time.Second}).Do(mreq)
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "fetch manifest: "+err.Error())
+		return
+	}
+	defer mresp.Body.Close()
+	if mresp.StatusCode >= 400 {
+		writeProblem(w, http.StatusBadGateway, fmt.Sprintf("manifest http %d", mresp.StatusCode))
+		return
+	}
+	zr, err := gzip.NewReader(mresp.Body)
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "gunzip manifest: "+err.Error())
+		return
+	}
+	defer zr.Close()
+	mbody, err := io.ReadAll(io.LimitReader(zr, 32<<20))
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "read manifest: "+err.Error())
+		return
+	}
+	// Each line is a path like "crawl-data/CC-MAIN-.../wet/...warc.wet.gz".
+	// Prepend the data.commoncrawl.org base.
+	all := strings.Split(strings.TrimSpace(string(mbody)), "\n")
+	if req.Skip >= len(all) {
+		writeProblem(w, http.StatusBadRequest, fmt.Sprintf("skip=%d exceeds manifest size %d", req.Skip, len(all)))
+		return
+	}
+	end := req.Skip + req.Count
+	if end > len(all) {
+		end = len(all)
+	}
+	paths := all[req.Skip:end]
+
+	// Run imports in parallel, bounded by concurrency.
+	type result struct {
+		URL     string `json:"url"`
+		Indexed int    `json:"indexed"`
+		Elapsed string `json:"elapsed"`
+		Error   string `json:"error,omitempty"`
+	}
+	results := make([]result, len(paths))
+	sem := make(chan struct{}, req.Concurrency)
+	var wg sync.WaitGroup
+	t0 := time.Now()
+	for i, p := range paths {
+		i, p := i, strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		wg.Add(1)
+		sem <- struct{}{}
+		go func() {
+			defer wg.Done()
+			defer func() { <-sem }()
+			full := "https://data.commoncrawl.org/" + p
+			start := time.Now()
+			n, err := s.crawlSeedWET(r.Context(), full, req.DedupeFresh, req.LexicalOnly)
+			results[i].URL = full
+			results[i].Indexed = n
+			results[i].Elapsed = time.Since(start).Round(time.Second).String()
+			if err != nil {
+				results[i].Error = err.Error()
+			}
+		}()
+	}
+	wg.Wait()
+
+	total := 0
+	for _, r := range results {
+		total += r.Indexed
+	}
+	log.Printf("wet-import-bulk: indexed %d docs from %d WET files in %s", total, len(paths), time.Since(t0).Round(time.Second))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"manifest_url":  req.ManifestURL,
+		"files":         len(paths),
+		"total_indexed": total,
+		"elapsed":       time.Since(t0).String(),
+		"results":       results,
+	})
+}
+
+// handleWETImport streams a CommonCrawl WET file (gzipped, pre-extracted
+// plain text per URL) and runs each record through UpsertDocument + BM25
+// indexing + chunk + embed. Bypasses the fetch-and-parse pipeline entirely
+// because WET bodies are already extracted text — typically 50-100× faster
+// than open-web crawling.
+//
+// Example: POST {"url":"https://data.commoncrawl.org/crawl-data/CC-MAIN-2025-09/segments/.../wet/CC-MAIN-...wet.gz"}
+type wetImportReq struct {
+	URL         string `json:"url"`
+	DedupeFresh bool   `json:"dedupe_fresh,omitempty"` // skip URLs already-fresh in famDoc
+	LexicalOnly bool   `json:"lexical_only,omitempty"` // BM25-only ingest, defer dense embed to /admin/embed-backfill
+}
+
+func (s *pebbleHTTP) handleWETImport(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedWET == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req wetImportReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"url\":\"https://.../...warc.wet.gz\"}")
+		return
+	}
+	t0 := time.Now()
+	n, err := s.crawlSeedWET(r.Context(), req.URL, req.DedupeFresh, req.LexicalOnly)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	log.Printf("wet-import: indexed %d docs from %s in %s", n, req.URL, time.Since(t0).Round(time.Second))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"wet":     req.URL,
+		"indexed": n,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
+// handleFrontierDemoteHost re-keys every queued URL for a host into a
+// different lane. The escape hatch for the cloud.google.com problem:
+// 2.8M queued URLs on one host (65% of the queue) starve host-fair
+// claim slots from fresher lanes. Demote to lane 3 (bulk, 5% weight)
+// and lane 1/2 actually get the work.
+//
+// POST body: {"host": "cloud.google.com", "lane": 3}
+type frontierDemoteHostReq struct {
+	Host string `json:"host"`
+	Lane int    `json:"lane"`
+}
+
+func (s *pebbleHTTP) handleFrontierDemoteHost(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	ps, ok := any(s.store).(*store.PebbleStore)
+	if !ok {
+		writeProblem(w, http.StatusNotImplemented, "lanes are PebbleStore-only")
+		return
+	}
+	var req frontierDemoteHostReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.Host == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"host\":\"foo.com\",\"lane\":0..3}")
+		return
+	}
+	if req.Lane < 0 || req.Lane > 3 {
+		writeProblem(w, http.StatusBadRequest, "lane must be 0..3")
+		return
+	}
+	t0 := time.Now()
+	n, err := ps.DemoteHostToLane(r.Context(), req.Host, byte(req.Lane))
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	log.Printf("frontier-demote-host: moved %d URLs (%s -> lane %d) in %s", n, req.Host, req.Lane, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"host":    req.Host,
+		"lane":    req.Lane,
+		"moved":   n,
+		"elapsed": time.Since(t0).String(),
+	})
+}
+
+// handleFrontierPurgeStaleInFlight clears the stale 'i' secondary keys
+// left over from the pre-fix RecoverInFlight bug. Pre-fix, every restart
+// re-queued in-flight URLs via the LEGACY 'q' index only and skipped the
+// lane-aware 'i' delete, so each restart leaked the URL's lane-aware 'i'
+// key. GetLaneStats then reported impossibly-high in_flight counts
+// (>max_concurrent). Idempotent — re-running is a no-op once clean.
+func (s *pebbleHTTP) handleFrontierPurgeStaleInFlight(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	ps, ok := any(s.store).(*store.PebbleStore)
+	if !ok {
+		writeProblem(w, http.StatusNotImplemented, "PebbleStore-only")
+		return
+	}
+	t0 := time.Now()
+	n, err := ps.PurgeStaleInFlight(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	log.Printf("frontier-purge-stale-inflight: purged %d keys in %s", n, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{"purged": n, "elapsed": time.Since(t0).String()})
+}
+
+// handleRSSImport fetches an RSS 2.0 or Atom feed and pushes every <item>/
+// <entry> link to the live frontier. Same auth shape as sitemap-import.
+// Designed to be cron-friendly: idempotent against the frontier (re-seeding
+// the same feed only adds newly-listed items).
+type rssImportReq struct {
+	URL string `json:"url"`
+}
+
+func (s *pebbleHTTP) handleRSSImport(w http.ResponseWriter, r *http.Request) {
+	if want := s.cluster.PeerAuthToken; want != "" {
+		got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+		if got != want {
+			writeProblem(w, http.StatusUnauthorized, "missing or invalid admin token")
+			return
+		}
+	}
+	if s.crawlSeedRSS == nil {
+		writeProblem(w, http.StatusNotImplemented, "this shard has no in-serve crawler (-crawl-seeds-file not set)")
+		return
+	}
+	var req rssImportReq
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 64<<10))
+	if err := json.Unmarshal(body, &req); err != nil || req.URL == "" {
+		writeProblem(w, http.StatusBadRequest, "expected {\"url\": \"https://.../feed.xml\"}")
+		return
+	}
+	t0 := time.Now()
+	n, err := s.crawlSeedRSS(r.Context(), req.URL)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	log.Printf("rss-import: queued %d URLs from %s in %s", n, req.URL, time.Since(t0).Round(time.Millisecond))
+	writeJSON(w, http.StatusOK, map[string]any{
+		"feed":    req.URL,
+		"queued":  n,
+		"elapsed": time.Since(t0).String(),
+	})
+}
diff --git a/cmd/cosift/serve_helpers.go b/cmd/cosift/serve_helpers.go
new file mode 100644
index 0000000..38f38ac
--- /dev/null
+++ b/cmd/cosift/serve_helpers.go
@@ -0,0 +1,496 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// retrievalFilters bundles the four post-retrieval predicates /search,
+// /answer, /find_similar, and /research all share. Centralized in
+// so /research's sync + stream paths stay in lockstep.
+type retrievalFilters struct {
+	include    []string
+	exclude    []string
+	sites      []siteScope
+	since      time.Time
+	until      time.Time
+	dateActive bool
+}
+
+func parseRetrievalFilters(r *http.Request) (retrievalFilters, error) {
+	f := retrievalFilters{
+		include: splitDomainsCSV(r.URL.Query().Get("include_domains")),
+		exclude: splitDomainsCSV(r.URL.Query().Get("exclude_domains")),
+		sites:   parseSiteScopes(r.URL.Query().Get("site")),
+	}
+	since, err := parseDateBound(r.URL.Query().Get("since"))
+	if err != nil {
+		return f, fmt.Errorf("since: %w", err)
+	}
+	until, err := parseDateBound(r.URL.Query().Get("until"))
+	if err != nil {
+		return f, fmt.Errorf("until: %w", err)
+	}
+	f.since = since
+	f.until = until
+	f.dateActive = !since.IsZero() || !until.IsZero()
+	return f, nil
+}
+
+// allow reports whether (url, publishedAt) clears the filter. publishedAt
+// can be the zero Time when the caller doesn't have it loaded; zero is
+// treated as "unknown" and dropped under any date filter.
+func (f retrievalFilters) allow(rawURL string, publishedAt time.Time) bool {
+	if len(f.include) > 0 || len(f.exclude) > 0 {
+		host := hostOf(rawURL)
+		if len(f.include) > 0 && !matchesAnyDomain(host, f.include) {
+			return false
+		}
+		if len(f.exclude) > 0 && matchesAnyDomain(host, f.exclude) {
+			return false
+		}
+	}
+	if len(f.sites) > 0 && !matchesAnySite(rawURL, f.sites) {
+		return false
+	}
+	if f.dateActive {
+		if publishedAt.IsZero() {
+			return false
+		}
+		if !f.since.IsZero() && publishedAt.Before(f.since) {
+			return false
+		}
+		if !f.until.IsZero() && publishedAt.After(f.until) {
+			return false
+		}
+	}
+	return true
+}
+
+func parseSubQueries(raw, fallback string) []string {
+	raw = strings.TrimSpace(raw)
+	for _, fence := range []string{"```json", "```"} {
+		raw = strings.TrimPrefix(raw, fence)
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	raw = strings.TrimSpace(raw)
+	startIdx := strings.Index(raw, "[")
+	endIdx := strings.LastIndex(raw, "]")
+	if startIdx >= 0 && endIdx > startIdx {
+		var arr []string
+		if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &arr); err == nil && len(arr) > 0 {
+			return arr
+		}
+	}
+	return []string{fallback}
+}
+
+func splitDomainsCSV(s string) []string {
+	if s == "" {
+		return nil
+	}
+	parts := strings.Split(s, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		t := strings.ToLower(strings.TrimSpace(p))
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+func matchesAnyDomain(host string, patterns []string) bool {
+	host = strings.ToLower(host)
+	for _, p := range patterns {
+		if host == p || strings.HasSuffix(host, "."+p) {
+			return true
+		}
+	}
+	return false
+}
+
+func hostOf(rawURL string) string {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return ""
+	}
+	return u.Hostname()
+}
+
+// siteScope is one entry of the `site` search filter: a host (suffix-matched
+// on dot boundaries, same as include_domains) plus an optional URL path
+// prefix. A zero path matches the whole host; a non-empty path scopes results
+// to a section of the site (e.g. host "pilotprotocol.network" + path "/docs").
+type siteScope struct {
+	host string
+	path string // normalized, no trailing slash; "" = any path
+}
+
+// parseSiteScopes parses the `site` parameter — a CSV of host or host/path
+// (or full-URL) entries — into scopes. Examples of a single entry:
+//
+//	pilotprotocol.network              → whole host (and subdomains)
+//	pilotprotocol.network/docs         → only URLs under /docs
+//	https://pilotprotocol.network/docs → same (scheme tolerated)
+func parseSiteScopes(csv string) []siteScope {
+	if csv == "" {
+		return nil
+	}
+	var out []siteScope
+	for _, raw := range strings.Split(csv, ",") {
+		t := strings.TrimSpace(raw)
+		if t == "" {
+			continue
+		}
+		t = strings.TrimPrefix(t, "https://")
+		t = strings.TrimPrefix(t, "http://")
+		host, path := t, ""
+		if i := strings.IndexByte(t, '/'); i >= 0 {
+			host, path = t[:i], t[i:]
+		}
+		host = strings.ToLower(strings.TrimSpace(host))
+		path = strings.TrimRight(strings.TrimSpace(path), "/")
+		if host == "" {
+			continue
+		}
+		out = append(out, siteScope{host: host, path: path})
+	}
+	return out
+}
+
+// matchesAnySite reports whether rawURL falls within any of the scopes. Host
+// matching reuses include_domains semantics (exact or dot-boundary suffix);
+// path matching is a segment-boundary prefix so "/docs" matches "/docs" and
+// "/docs/x" but not "/docsearch".
+func matchesAnySite(rawURL string, scopes []siteScope) bool {
+	if len(scopes) == 0 {
+		return true
+	}
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return false
+	}
+	host := strings.ToLower(u.Hostname())
+	p := u.Path
+	for _, sc := range scopes {
+		if host != sc.host && !strings.HasSuffix(host, "."+sc.host) {
+			continue
+		}
+		if sc.path == "" || p == sc.path || strings.HasPrefix(p, sc.path+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// parseDateBound accepts the same forms as the SQLite-side server: empty
+// (zero time), RFC3339 ("2026-01-15T00:00:00Z"), or a bare date
+// ("2026-01-15", treated as UTC midnight).
+func parseDateBound(s string) (time.Time, error) {
+	if s == "" {
+		return time.Time{}, nil
+	}
+	if t, err := time.Parse(time.RFC3339, s); err == nil {
+		return t, nil
+	}
+	if t, err := time.Parse("2006-01-02", s); err == nil {
+		return t, nil
+	}
+	return time.Time{}, fmt.Errorf("expected YYYY-MM-DD or RFC3339, got %q", s)
+}
+
+// textExcerpt returns a body-prefix excerpt no longer than maxBytes, cut at a
+// word boundary if one is available within the trailing 16 bytes.
+// Static prefix (not query-aware) — matches the SQLite-side DocMeta.Excerpt
+// shape; a query-aware passage extractor is the path on the index
+// hot path and lives there, not in the HTTP handler.
+func textExcerpt(text string, maxBytes int) string {
+	if len(text) <= maxBytes {
+		return text
+	}
+	cut := text[:maxBytes]
+	for i := len(cut) - 1; i >= len(cut)-16 && i > 0; i-- {
+		if cut[i] == ' ' || cut[i] == '\n' || cut[i] == '\t' {
+			cut = cut[:i]
+			break
+		}
+	}
+	return strings.TrimSpace(cut) + "…"
+}
+
+// runPebbleInfo prints Pebble's built-in metrics for the store at -dir.
+// openPebbleOrFriendlyErr wraps store.OpenPebble with a more
+// helpful error message when the underlying failure is lock contention (a
+// pebble-serve / live crawl is holding the single-writer lock). Callers
+// using offline CLI subcommands (pebble-info, verify) hit this when run
+// during an active deployment.
+func openPebbleOrFriendlyErr(d string) (*store.PebbleStore, error) {
+	ps, err := store.OpenPebble(d)
+	if err != nil {
+		msg := err.Error()
+		if strings.Contains(msg, "lock") || strings.Contains(msg, "resource temporarily unavailable") {
+			return nil, fmt.Errorf("open pebble at %s: writer lock is held by another process (pebble-serve / crawl in flight); stop the running service first", d)
+		}
+		return nil, fmt.Errorf("open pebble at %s: %w", d, err)
+	}
+	return ps, nil
+}
+
+// runVerifyViaServer GETs pebble-serve's /verify endpoint and
+// renders the JSON body in the same shape runVerifyPebble's local path emits.
+// Lets `cosift verify -server URL` work against a running pebble-serve while
+// the writer lock is held by the crawl / serve process.
+func runVerifyViaServer(ctx context.Context, serverURL string, asJSON bool) error {
+	endpoint := strings.TrimRight(serverURL, "/") + "/verify"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return err
+	}
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("GET %s: %w", endpoint, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if asJSON {
+		fmt.Println(string(body))
+	} else {
+		var d struct {
+			OK                 bool  `json:"ok"`
+			IndexedDocsCounter int64 `json:"indexed_docs_counter"`
+			IndexedDocsScan    int64 `json:"indexed_docs_scan"`
+			IndexedDocsDrift   int64 `json:"indexed_docs_drift"`
+			SumDocLenCounter   int64 `json:"sum_doc_len_counter"`
+			SumDocLenScan      int64 `json:"sum_doc_len_scan"`
+			SumDocLenDrift     int64 `json:"sum_doc_len_drift"`
+		}
+		if err := json.Unmarshal(body, &d); err != nil {
+			return fmt.Errorf("decode %s: %w", endpoint, err)
+		}
+		fmt.Printf("pebble-serve: %s\n\n", serverURL)
+		fmt.Printf("  indexed_docs (counter): %d\n", d.IndexedDocsCounter)
+		fmt.Printf("  indexed_docs (scan):    %d\n", d.IndexedDocsScan)
+		fmt.Printf("  sum_doc_len  (counter): %d\n", d.SumDocLenCounter)
+		fmt.Printf("  sum_doc_len  (scan):    %d\n", d.SumDocLenScan)
+		if d.OK {
+			fmt.Println("\nOK: counters match the 'l' family scan.")
+		} else {
+			fmt.Printf("\nDRIFT: indexed_docs Δ=%+d, sum_doc_len Δ=%+d\n", d.IndexedDocsDrift, d.SumDocLenDrift)
+		}
+	}
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("counter drift detected (server returned %d)", resp.StatusCode)
+	}
+	return nil
+}
+
+// pebbleInfoJSON shapes the -json output of `cosift pebble-info`. Extracted
+// in so the shape can be unit-tested without spawning a subprocess.
+// Mirrors the /stats response — same jq filters compose against either source.
+func pebbleInfoJSON(path string, st store.Stats, sumLen, indexedDocs int64, meta index.HNSWMeta, hnswOK bool) map[string]any {
+	retrievers := []string{"bm25", "bm25-mlt"}
+	if hnswOK {
+		retrievers = append(retrievers, "dense", "hybrid")
+	}
+	out := map[string]any{
+		"path":         path,
+		"documents":    st.Documents,
+		"indexed_docs": indexedDocs,
+		"sum_doc_len":  sumLen,
+		"hnsw_loaded":  hnswOK,
+		"retrievers":   retrievers,
+	}
+	if indexedDocs > 0 {
+		out["avg_doc_len"] = float64(sumLen) / float64(indexedDocs)
+	}
+	if hnswOK {
+		out["vector_nodes"] = meta.NodeCount
+		out["vector_dim"] = meta.Dim
+	}
+	return out
+}
+
+// operator visibility into LSM levels, WAL state, on-disk
+// size, and compaction queue, surfaced via pebble.Metrics().String().
+func runPebbleInfo(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("pebble-info", flag.ExitOnError)
+	dir := fs.String("dir", "", "PebbleStore directory (defaults to <cfg.DataDir>/pebble)")
+	// Mirrors
+	// the shape /stats returns ( retrievers list,'s
+	// vector meta) so the same jq filters compose against either source.
+	asJSON := fs.Bool("json", false, "emit JSON instead of human-readable text (no pebble.Metrics dump)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	d := *dir
+	if d == "" {
+		d = filepath.Join(cfg.DataDir, "pebble")
+	}
+	ps, err := openPebbleOrFriendlyErr(d)
+	if err != nil {
+		return err
+	}
+	defer ps.Close()
+
+	st, err := ps.Stats(ctx)
+	if err != nil {
+		return err
+	}
+	sumLen, indexedDocs, _ := ps.CorpusStats(ctx)
+	meta, hnswOK, _ := index.LoadHNSWMeta(ctx, ps)
+
+	if *asJSON {
+		out := pebbleInfoJSON(d, st, sumLen, indexedDocs, meta, hnswOK)
+		blob, _ := json.MarshalIndent(out, "", "  ")
+		fmt.Println(string(blob))
+		return nil
+	}
+
+	fmt.Printf("PebbleStore: %s\n\n", d)
+	fmt.Printf("  documents:    %d\n", st.Documents)
+	// pebble-info already needs
+	// to read the store; reading them costs O(1) and gives operators 'is this
+	// store healthy' without round-tripping through pebble-serve /stats.
+	if indexedDocs > 0 {
+		fmt.Printf("  indexed_docs: %d\n", indexedDocs)
+		fmt.Printf("  sum_doc_len:  %d\n", sumLen)
+		fmt.Printf("  avg_doc_len:  %.2f\n", float64(sumLen)/float64(indexedDocs))
+	}
+	// when an HNSW meta blob is persisted, surface dim+nodes here
+	// too. Same cheap 20-byte read pebble-serve does at startup.
+	// Operators running pebble-info to inspect an offline store get the dense
+	// shape without opening pebble-serve.
+	// bm25/bm25-mlt
+	// always. dense/hybrid need the graph (meta present) AND, for non-URL
+	// modes, a runtime embedder — offline we can only check the persisted
+	// shape, so we report 'available with embedder' rather than asserting.
+	if hnswOK {
+		fmt.Printf("  vector_nodes: %d\n", meta.NodeCount)
+		fmt.Printf("  vector_dim:   %d\n", meta.Dim)
+	}
+	fmt.Println()
+	fmt.Println("--- retrievers ---")
+	fmt.Println("  bm25, bm25-mlt: always (BM25 index)")
+	if hnswOK {
+		fmt.Println("  dense:          available — /find_similar?url= works without embedder;")
+		fmt.Println("                  /search /answer /research need an embedder configured at server start")
+		fmt.Println("  hybrid:         available (same requirements as dense)")
+	} else {
+		fmt.Println("  dense, hybrid:  unavailable — no HNSW graph persisted in this store")
+		fmt.Println("                  (build embeddings during crawl with cfg.Embeddings.Model set)")
+	}
+	fmt.Println()
+	fmt.Println("--- pebble.Metrics ---")
+	fmt.Println(ps.Metrics().String())
+	return nil
+}
+
+// verify the running counters ('m'+indexed_docs,
+// 'm'+sum_doc_len) against an authoritative scan of the 'l' family.
+// Drift would mean a crash or bug left the counter inconsistent —
+// flagged here so it can be re-derived from the scan.
+func runVerifyPebble(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("verify", flag.ExitOnError)
+	dir := fs.String("dir", "", "PebbleStore directory (defaults to <cfg.DataDir>/pebble)")
+	// machine-readable output for CI integration.
+	asJSON := fs.Bool("json", false, "emit JSON report instead of human text (suitable for jq / CI)")
+	// -server URL routes the check through a running pebble-serve's
+	// /verify endpoint instead of opening the store directly. Useful when a
+	// crawl or pebble-serve is holding the writer lock.
+	serverURL := fs.String("server", "", "pebble-serve URL — when set, GETs /verify instead of opening the store")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *serverURL != "" {
+		return runVerifyViaServer(ctx, *serverURL, *asJSON)
+	}
+	d := *dir
+	if d == "" {
+		d = filepath.Join(cfg.DataDir, "pebble")
+	}
+	ps, err := openPebbleOrFriendlyErr(d)
+	if err != nil {
+		return err
+	}
+	defer ps.Close()
+
+	counterSum, counterCount, err := ps.CorpusStats(ctx)
+	if err != nil {
+		return fmt.Errorf("read counters: %w", err)
+	}
+	scanSum, scanCount, err := ps.SumDocLengths(ctx)
+	if err != nil {
+		return fmt.Errorf("scan 'l' family: %w", err)
+	}
+
+	driftCount := counterCount - scanCount
+	driftSum := counterSum - scanSum
+	ok := driftCount == 0 && driftSum == 0
+
+	if *asJSON {
+		out := map[string]any{
+			"path":                 d,
+			"ok":                   ok,
+			"indexed_docs_counter": counterCount,
+			"indexed_docs_scan":    scanCount,
+			"indexed_docs_drift":   driftCount,
+			"sum_doc_len_counter":  counterSum,
+			"sum_doc_len_scan":     scanSum,
+			"sum_doc_len_drift":    driftSum,
+		}
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		_ = enc.Encode(out)
+		if !ok {
+			return fmt.Errorf("counter drift detected")
+		}
+		return nil
+	}
+
+	fmt.Printf("PebbleStore: %s\n\n", d)
+	fmt.Printf("  indexed_docs (counter): %d\n", counterCount)
+	fmt.Printf("  indexed_docs (scan):    %d\n", scanCount)
+	fmt.Printf("  sum_doc_len  (counter): %d\n", counterSum)
+	fmt.Printf("  sum_doc_len  (scan):    %d\n", scanSum)
+	if ok {
+		fmt.Println("\nOK: counters match the 'l' family scan.")
+		return nil
+	}
+	fmt.Printf("\nDRIFT: indexed_docs Δ=%+d, sum_doc_len Δ=%+d\n", driftCount, driftSum)
+	return fmt.Errorf("counter drift detected")
+}
+
+func writeJSON(w http.ResponseWriter, status int, body any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(body)
+}
+
+func writeProblem(w http.ResponseWriter, status int, detail string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"error":  http.StatusText(status),
+		"status": status,
+		"detail": detail,
+	})
+}
diff --git a/cmd/cosift/serve_search.go b/cmd/cosift/serve_search.go
new file mode 100644
index 0000000..2042753
--- /dev/null
+++ b/cmd/cosift/serve_search.go
@@ -0,0 +1,2521 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net/http"
+	"net/url"
+	"os"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/qexpand"
+	"github.com/pilot-protocol/cosift/internal/rerank"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+// forwardURLToPeer POSTs a URL to peer's /admin/crawl-enqueue. Best-effort:
+// caller logs failures and the URL is dropped — no retry or persistent queue.
+var forwardHTTP = &http.Client{Timeout: 10 * time.Second}
+
+func (s *pebbleHTTP) forwardURLToPeer(ctx context.Context, rawURL, peerAddr string) error {
+	body, _ := json.Marshal(crawlEnqueueReq{URL: rawURL})
+	// peerAddr is host:port; assume http inside the cluster (mTLS / VPN
+	// would be a wrapper concern). Switch to https://... if peers expose TLS.
+	endpoint := "http://" + peerAddr + "/admin/crawl-enqueue"
+	if strings.HasPrefix(peerAddr, "http://") || strings.HasPrefix(peerAddr, "https://") {
+		endpoint = strings.TrimRight(peerAddr, "/") + "/admin/crawl-enqueue"
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	if t := s.cluster.PeerAuthToken; t != "" {
+		req.Header.Set("Authorization", "Bearer "+t)
+	}
+	resp, err := forwardHTTP.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4<<10))
+		return fmt.Errorf("peer %s returned %d: %s", peerAddr, resp.StatusCode, b)
+	}
+	return nil
+}
+
+// scatterSearch fans /search out to every peer with the given params,
+// collects per-peer hit lists, RRF-merges them, and returns the merged
+// top-k. Used by /search, /answer, /research gateway modes.
+// includeText forces text inlining on the scatter so callers that need
+// passages (synth endpoints) get them in one round trip.
+func (s *pebbleHTTP) scatterSearch(ctx context.Context, q string, k int, perPeerK int, params url.Values, includeText bool) (hits []searchHit, warns []string, totalCandidates int) {
+	srcQ := url.Values{}
+	for kk, vv := range params {
+		srcQ[kk] = vv
+	}
+	srcQ.Set("q", q)
+	srcQ.Set("k", strconv.Itoa(perPeerK))
+	srcQ.Set("cluster_local", "1")
+	if includeText {
+		srcQ.Set("include_text", "true")
+	}
+	queryStr := srcQ.Encode()
+
+	type peerResult struct {
+		peerIdx int
+		hits    []searchHit
+		err     error
+	}
+	resCh := make(chan peerResult, len(s.cluster.Peers))
+	httpClient := &http.Client{Timeout: 15 * time.Second}
+	for i, peer := range s.cluster.Peers {
+		if peer == "" {
+			continue
+		}
+		i, peer := i, peer
+		go func() {
+			endpoint := "http://" + peer + "/search?" + queryStr
+			if strings.HasPrefix(peer, "http://") || strings.HasPrefix(peer, "https://") {
+				endpoint = strings.TrimRight(peer, "/") + "/search?" + queryStr
+			}
+			req, _ := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+			if t := s.cluster.PeerAuthToken; t != "" {
+				req.Header.Set("Authorization", "Bearer "+t)
+			}
+			resp, err := httpClient.Do(req)
+			if err != nil {
+				resCh <- peerResult{peerIdx: i, err: err}
+				return
+			}
+			defer resp.Body.Close()
+			if resp.StatusCode >= 300 {
+				resCh <- peerResult{peerIdx: i, err: fmt.Errorf("peer %s returned %d", peer, resp.StatusCode)}
+				return
+			}
+			var sr struct {
+				Hits []searchHit `json:"hits"`
+			}
+			body, _ := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
+			if err := json.Unmarshal(body, &sr); err != nil {
+				resCh <- peerResult{peerIdx: i, err: err}
+				return
+			}
+			resCh <- peerResult{peerIdx: i, hits: sr.Hits}
+		}()
+	}
+	lists := [][]index.Hit{}
+	hitFull := map[string]searchHit{}
+gather:
+	for i := 0; i < len(s.cluster.Peers); i++ {
+		if s.cluster.Peers[i] == "" {
+			continue
+		}
+		select {
+		case res := <-resCh:
+			if res.err != nil {
+				warns = append(warns, fmt.Sprintf("peer %d (%s) failed: %v", res.peerIdx, s.cluster.Peers[res.peerIdx], res.err))
+				continue
+			}
+			totalCandidates += len(res.hits)
+			peerList := make([]index.Hit, len(res.hits))
+			for j, h := range res.hits {
+				peerList[j] = index.Hit{URL: h.URL, Title: h.Title, Score: h.Score}
+				if _, ok := hitFull[h.URL]; !ok {
+					hitFull[h.URL] = h
+				}
+			}
+			lists = append(lists, peerList)
+		case <-ctx.Done():
+			warns = append(warns, "client context cancelled before all peers responded")
+			break gather
+		}
+	}
+	fused := rrfFuse(lists)
+	if len(fused) > k {
+		fused = fused[:k]
+	}
+	hits = make([]searchHit, 0, len(fused))
+	for _, f := range fused {
+		full, ok := hitFull[f.URL]
+		if !ok {
+			full = searchHit{URL: f.URL, Title: f.Title}
+		}
+		full.Score = f.Score
+		hits = append(hits, full)
+	}
+	return hits, warns, totalCandidates
+}
+
+// handleSearchGateway is the scatter-gather entry. It fans out the
+// search to every peer's /search (including its own shard via the peers[]
+// table), each peer over-fetches k*2 candidates locally, gateway RRF-merges
+// the per-peer lists, and returns the top-k. Slow / failing peers are
+// included in a warnings[] entry but don't block the response.
+func (s *pebbleHTTP) handleSearchGateway(w http.ResponseWriter, r *http.Request) {
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	k := 10
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
+			k = n
+		}
+	}
+	perPeerK := k * 2
+	if perPeerK < 20 {
+		perPeerK = 20
+	}
+	// delegated to shared scatterSearch helper.
+	hits, warns, total := s.scatterSearch(r.Context(), q, k, perPeerK, r.URL.Query(), r.URL.Query().Get("include_text") == "true")
+	resp := searchResponse{
+		Query:           q,
+		Retriever:       fmt.Sprintf("gateway:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
+		Hits:            hits,
+		TotalCandidates: total,
+		Warnings:        append(warns, s.warningsFor(r)...),
+		Took:            time.Since(start).String(),
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// numNonEmpty counts non-empty entries in a peer list (peers[i]="" means
+// "skip", typically MyShardID).
+func numNonEmpty(ps []string) int {
+	n := 0
+	for _, p := range ps {
+		if p != "" {
+			n++
+		}
+	}
+	return n
+}
+
+// handleFindSimilarGateway scatters /find_similar to every shard. The
+// owning shard (URL-mode) or every shard (text-mode) produces real
+// neighbors; others return empty. Gateway RRF-merges.
+func (s *pebbleHTTP) handleFindSimilarGateway(w http.ResponseWriter, r *http.Request) {
+	start := time.Now()
+	k := 10
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
+			k = n
+		}
+	}
+	perPeerK := k * 2
+	if perPeerK < 20 {
+		perPeerK = 20
+	}
+	srcQ := url.Values{}
+	for kk, vv := range r.URL.Query() {
+		srcQ[kk] = vv
+	}
+	srcQ.Set("k", strconv.Itoa(perPeerK))
+	srcQ.Set("cluster_local", "1")
+	queryStr := srcQ.Encode()
+
+	type peerResult struct {
+		peerIdx int
+		hits    []searchHit
+		err     error
+	}
+	resCh := make(chan peerResult, len(s.cluster.Peers))
+	httpClient := &http.Client{Timeout: 15 * time.Second}
+	for i, peer := range s.cluster.Peers {
+		if peer == "" {
+			continue
+		}
+		i, peer := i, peer
+		go func() {
+			endpoint := "http://" + peer + "/find_similar?" + queryStr
+			if strings.HasPrefix(peer, "http://") || strings.HasPrefix(peer, "https://") {
+				endpoint = strings.TrimRight(peer, "/") + "/find_similar?" + queryStr
+			}
+			req, _ := http.NewRequestWithContext(r.Context(), http.MethodGet, endpoint, http.NoBody)
+			if t := s.cluster.PeerAuthToken; t != "" {
+				req.Header.Set("Authorization", "Bearer "+t)
+			}
+			resp, err := httpClient.Do(req)
+			if err != nil {
+				resCh <- peerResult{peerIdx: i, err: err}
+				return
+			}
+			defer resp.Body.Close()
+			if resp.StatusCode >= 300 {
+				resCh <- peerResult{peerIdx: i, err: fmt.Errorf("peer %s returned %d", peer, resp.StatusCode)}
+				return
+			}
+			var sr struct {
+				Hits []searchHit `json:"hits"`
+			}
+			body, _ := io.ReadAll(io.LimitReader(resp.Body, 32<<20))
+			if err := json.Unmarshal(body, &sr); err != nil {
+				resCh <- peerResult{peerIdx: i, err: err}
+				return
+			}
+			resCh <- peerResult{peerIdx: i, hits: sr.Hits}
+		}()
+	}
+	lists := [][]index.Hit{}
+	hitFull := map[string]searchHit{}
+	warns := []string{}
+	total := 0
+gather:
+	for i := 0; i < len(s.cluster.Peers); i++ {
+		if s.cluster.Peers[i] == "" {
+			continue
+		}
+		select {
+		case res := <-resCh:
+			if res.err != nil {
+				warns = append(warns, fmt.Sprintf("peer %d (%s) failed: %v", res.peerIdx, s.cluster.Peers[res.peerIdx], res.err))
+				continue
+			}
+			total += len(res.hits)
+			peerList := make([]index.Hit, len(res.hits))
+			for j, h := range res.hits {
+				peerList[j] = index.Hit{URL: h.URL, Title: h.Title, Score: h.Score}
+				if _, ok := hitFull[h.URL]; !ok {
+					hitFull[h.URL] = h
+				}
+			}
+			lists = append(lists, peerList)
+		case <-r.Context().Done():
+			warns = append(warns, "client context cancelled")
+			break gather
+		}
+	}
+	fused := rrfFuse(lists)
+	if len(fused) > k {
+		fused = fused[:k]
+	}
+	out := make([]searchHit, 0, len(fused))
+	for _, f := range fused {
+		full, ok := hitFull[f.URL]
+		if !ok {
+			full = searchHit{URL: f.URL, Title: f.Title}
+		}
+		full.Score = f.Score
+		out = append(out, full)
+	}
+	writeJSON(w, http.StatusOK, searchResponse{
+		Query:           r.URL.Query().Get("url"),
+		Retriever:       fmt.Sprintf("gateway:find_similar:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
+		Hits:            out,
+		TotalCandidates: total,
+		Warnings:        append(warns, s.warningsFor(r)...),
+		Took:            time.Since(start).String(),
+	})
+}
+
+// handleResearchGateway runs the planner on the gateway, scatters
+// each sub-query to peers (collecting RRF-merged hits with text), then
+// runs a single research synth.
+func (s *pebbleHTTP) handleResearchGateway(w http.ResponseWriter, r *http.Request) {
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented, "/research requires cfg.Chat.Model on the gateway")
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	k := 8
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
+			k = n
+		}
+	}
+	// 1. Plan via chat.
+	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: researchPlanPrompt},
+		{Role: "user", Content: q},
+	})
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
+		return
+	}
+	subs := parseSubQueries(planRaw, q)
+	if len(subs) > 5 {
+		subs = subs[:5]
+	}
+	// 2. Scatter per sub-query. Dedup by URL, keep best fused score.
+	type ranked struct {
+		score float64
+		hit   searchHit
+	}
+	best := make(map[string]ranked, k*len(subs))
+	allWarns := []string{}
+	perSub := k * 2
+	for _, sq := range subs {
+		hits, warns, _ := s.scatterSearch(r.Context(), sq, perSub, perSub, r.URL.Query(), true)
+		allWarns = append(allWarns, warns...)
+		for _, h := range hits {
+			if prev, ok := best[h.URL]; !ok || h.Score > prev.score {
+				best[h.URL] = ranked{score: h.Score, hit: h}
+			}
+		}
+	}
+	pooled := make([]ranked, 0, len(best))
+	for _, v := range best {
+		pooled = append(pooled, v)
+	}
+	sort.Slice(pooled, func(i, j int) bool { return pooled[i].score > pooled[j].score })
+	if len(pooled) > k {
+		pooled = pooled[:k]
+	}
+	// 3. Build prompt.
+	sources := make([]answerSource, 0, len(pooled))
+	var promptSources strings.Builder
+	for i, p := range pooled {
+		src := answerSource{ID: i + 1, URL: p.hit.URL, Title: p.hit.Title, Excerpt: p.hit.Excerpt, Author: p.hit.Author, PublishedAt: p.hit.PublishedAt}
+		text := p.hit.Text
+		if text == "" {
+			text = p.hit.Excerpt
+		}
+		sources = append(sources, src)
+		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, p.hit.Title, p.hit.URL, text)
+	}
+	if len(sources) == 0 {
+		writeJSON(w, http.StatusOK, researchResponse{
+			Query: q, Plan: subs, Answer: "No matching sources across the cluster.",
+			Sources: sources, Model: s.chat.Model(),
+			Warnings: allWarns, Took: time.Since(start).String(),
+		})
+		return
+	}
+	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: researchSynthPrompt},
+		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Original question: " + q},
+	})
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, researchResponse{
+		Query: q, Plan: subs, Answer: answer, Sources: sources,
+		Model:     s.chat.Model(),
+		Retriever: fmt.Sprintf("gateway:rrf(%d-shard,%d-sub)", numNonEmpty(s.cluster.Peers), len(subs)),
+		Warnings:  allWarns, Took: time.Since(start).String(),
+	})
+}
+
+// handleAnswerGateway scatters /search across peers with include_text, runs
+// a SINGLE chat synth on the gateway.
+func (s *pebbleHTTP) handleAnswerGateway(w http.ResponseWriter, r *http.Request) {
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented, "/answer requires cfg.Chat.Model on the gateway")
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	k := 5
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
+			k = n
+		}
+	}
+	hits, warns, total := s.scatterSearch(r.Context(), q, k, k*2, r.URL.Query(), true)
+	if len(hits) == 0 {
+		writeJSON(w, http.StatusOK, answerResponse{
+			Query: q, Answer: "No matching sources across the cluster.",
+			Sources: []answerSource{}, Model: s.chat.Model(),
+			TotalCandidates: total, Warnings: warns, Took: time.Since(start).String(),
+		})
+		return
+	}
+	sources := make([]answerSource, 0, len(hits))
+	var promptSources strings.Builder
+	for i, h := range hits {
+		src := answerSource{ID: i + 1, URL: h.URL, Title: h.Title, Excerpt: h.Excerpt, Author: h.Author, PublishedAt: h.PublishedAt}
+		text := h.Text
+		if text == "" {
+			text = h.Excerpt
+		}
+		sources = append(sources, src)
+		fmt.Fprintf(&promptSources, "[%d] %s\n%s\n%s\n\n", i+1, h.Title, h.URL, text)
+	}
+	answer, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: answerSystemPrompt},
+		{Role: "user", Content: "Sources:\n\n" + promptSources.String() + "Question: " + q},
+	})
+	if err != nil {
+		writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, answerResponse{
+		Query: q, Answer: answer, Sources: sources, Model: s.chat.Model(),
+		Retriever:       fmt.Sprintf("gateway:rrf(%d-shard)", numNonEmpty(s.cluster.Peers)-len(warns)),
+		TotalCandidates: total, Warnings: warns, Took: time.Since(start).String(),
+	})
+}
+
+// searchHit is the minimal hit shape returned by pebble-serve's /search.
+// Intentionally narrower than the SQLite server's SearchHit — feature
+// parity (highlight, excerpt, calibration, paragraph filters) grows as
+// follow-up iters port each one through the Pebble side.
+type searchHit struct {
+	URL         string     `json:"url"`
+	Title       string     `json:"title"`
+	Score       float64    `json:"score"`
+	Excerpt     string     `json:"excerpt,omitempty"`
+	PublishedAt *time.Time `json:"published_at,omitempty"`
+	Author      string     `json:"author,omitempty"`
+	Text        string     `json:"text,omitempty"`
+}
+
+type searchResponse struct {
+	Query           string      `json:"query"`
+	EffectiveQuery  string      `json:"effective_query,omitempty"`
+	Expand          string      `json:"expand,omitempty"`
+	Retriever       string      `json:"retriever"`
+	Hits            []searchHit `json:"hits"`
+	TotalCandidates int         `json:"total_candidates,omitempty"`
+	Warnings        []string    `json:"warnings,omitempty"`
+	Took            string      `json:"took"`
+}
+
+// POST /search with JSON body — for callers whose query lists,
+// quoted phrases, or filter CSVs are awkward to URL-encode. Decodes into a
+// searchRequest, re-encodes as r.URL.RawQuery, then calls handleSearch so
+// every param the GET form supports works identically here. The hand-off
+// shape (URL.Values) is the cosift contract — easier to keep one parser
+// than to fork it across method handlers.
+type searchRequest struct {
+	Q              string `json:"q"`
+	K              int    `json:"k,omitempty"`
+	IncludeDomains string `json:"include_domains,omitempty"`
+	ExcludeDomains string `json:"exclude_domains,omitempty"`
+	Site           string `json:"site,omitempty"`
+	Since          string `json:"since,omitempty"`
+	Until          string `json:"until,omitempty"`
+	Sort           string `json:"sort,omitempty"`
+	Enrich         *bool  `json:"enrich,omitempty"`
+	IncludeText    bool   `json:"include_text,omitempty"`
+	Rerank         bool   `json:"rerank,omitempty"`
+	Expand         string `json:"expand,omitempty"`
+}
+
+func (s *pebbleHTTP) handleSearchPOST(w http.ResponseWriter, r *http.Request) {
+	var req searchRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	v := url.Values{}
+	if req.Q != "" {
+		v.Set("q", req.Q)
+	}
+	if req.K > 0 {
+		v.Set("k", strconv.Itoa(req.K))
+	}
+	if req.IncludeDomains != "" {
+		v.Set("include_domains", req.IncludeDomains)
+	}
+	if req.ExcludeDomains != "" {
+		v.Set("exclude_domains", req.ExcludeDomains)
+	}
+	if req.Site != "" {
+		v.Set("site", req.Site)
+	}
+	if req.Since != "" {
+		v.Set("since", req.Since)
+	}
+	if req.Until != "" {
+		v.Set("until", req.Until)
+	}
+	if req.Sort != "" {
+		v.Set("sort", req.Sort)
+	}
+	if req.Enrich != nil && !*req.Enrich {
+		v.Set("enrich", "false")
+	}
+	if req.IncludeText {
+		v.Set("include_text", "true")
+	}
+	if req.Rerank {
+		v.Set("rerank", "true")
+	}
+	if req.Expand != "" {
+		v.Set("expand", req.Expand)
+	}
+	r.URL.RawQuery = v.Encode()
+	s.handleSearch(w, r)
+}
+
+type findSimilarRequest struct {
+	URL            string `json:"url,omitempty"`
+	Text           string `json:"text,omitempty"`  // content-based MLT, no source URL needed
+	Title          string `json:"title,omitempty"` // optional title-boost when using text mode
+	K              int    `json:"k,omitempty"`
+	Q              string `json:"q,omitempty"`
+	IncludeDomains string `json:"include_domains,omitempty"`
+	ExcludeDomains string `json:"exclude_domains,omitempty"`
+	Since          string `json:"since,omitempty"`
+	Until          string `json:"until,omitempty"`
+	IncludeText    bool   `json:"include_text,omitempty"`
+	Rerank         bool   `json:"rerank,omitempty"`
+}
+
+func (s *pebbleHTTP) handleFindSimilarPOST(w http.ResponseWriter, r *http.Request) {
+	var req findSimilarRequest
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	v := url.Values{}
+	if req.URL != "" {
+		v.Set("url", req.URL)
+	}
+	if req.Text != "" {
+		v.Set("text", req.Text)
+	}
+	if req.Title != "" {
+		v.Set("title", req.Title)
+	}
+	if req.K > 0 {
+		v.Set("k", strconv.Itoa(req.K))
+	}
+	if req.Q != "" {
+		v.Set("q", req.Q)
+	}
+	if req.IncludeDomains != "" {
+		v.Set("include_domains", req.IncludeDomains)
+	}
+	if req.ExcludeDomains != "" {
+		v.Set("exclude_domains", req.ExcludeDomains)
+	}
+	if req.Since != "" {
+		v.Set("since", req.Since)
+	}
+	if req.Until != "" {
+		v.Set("until", req.Until)
+	}
+	if req.IncludeText {
+		v.Set("include_text", "true")
+	}
+	if req.Rerank {
+		v.Set("rerank", "true")
+	}
+	r.URL.RawQuery = v.Encode()
+	s.handleFindSimilar(w, r)
+}
+
+func (s *pebbleHTTP) handleSearch(w http.ResponseWriter, r *http.Request) {
+	// When this process is in cluster
+	// gateway-mode AND the caller hasn't already set ?cluster_local=1
+	// (which is how the gateway tells peers "just do your local search,
+	// don't fan out again"), fan out to peers and RRF-merge their results.
+	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
+		s.handleSearchGateway(w, r)
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+	k := 10
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
+			k = n
+		}
+	}
+	// include_domains / exclude_domains — mirrors the
+	// SQLite-side server semantics (CSV, dot-boundary suffix match).
+	// since / until — ISO-date filters on doc.PublishedAt.
+	// When any filter is active we over-fetch so the post-filter has
+	// enough candidates to fill k; same brute-force shape SQLite used
+	// before it grew a proper index, fine at pebble-serve's scale.
+	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
+	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
+	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
+	if sinceErr != nil {
+		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
+		return
+	}
+	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
+	if untilErr != nil {
+		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
+		return
+	}
+	dateFilter := !since.IsZero() || !until.IsZero()
+	// site — scope results to one or more host[/path] sections, e.g.
+	// ?site=pilotprotocol.network/docs. Host-suffix + path-prefix match,
+	// ANDed with include/exclude. Applied post-retrieval like the domain
+	// filters, so it widens the over-fetch below.
+	sites := parseSiteScopes(r.URL.Query().Get("site"))
+	siteFilter := len(sites) > 0
+	// rerank widens both the fetch and the keep-cap before filtering,
+	// so the reranker sees a healthy candidate pool even with restrictive filters.
+	wantRerank := r.URL.Query().Get("rerank") == "true" && s.reranker != nil
+	keepCap := k
+	if wantRerank {
+		keepCap = s.rerankCandK
+		if keepCap < k {
+			keepCap = k
+		}
+	}
+	fetchK := keepCap
+	if len(include) > 0 || len(exclude) > 0 || dateFilter || siteFilter {
+		mult := 5
+		if dateFilter {
+			mult = 10
+		}
+		if siteFilter {
+			// site= uses a fixed pool regardless of k — fetching proportionally
+			// (k*100) hits the 2000-cap and spends 20s+ on BM25 for common terms.
+			// 300 candidates is enough to include a small site's relevant pages
+			// while keeping latency under ~3s even for high-frequency query terms.
+			fetchK = 300
+		} else {
+			fetchK = keepCap * mult
+			if fetchK > 500 {
+				fetchK = 500
+			}
+		}
+	} else if wantRerank {
+		fetchK = keepCap * 2
+	}
+	// expansion dispatch (bare / HyDE / paraphrase+RRF).
+	// Shared
+	// helper used by /answer + /research so all three get the same matrix.
+	// Reranker still scores against the original q regardless of strategy.
+	expandMode := r.URL.Query().Get("expand")
+	retrieverParam := r.URL.Query().Get("retriever")
+	denseReady := s.hnsw != nil && s.embedder != nil
+	hits, effectiveQuery, err := s.retrieve(r.Context(), q, fetchK, retrieverParam, expandMode)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	// enrich each surviving hit with Excerpt + PublishedAt + Author
+	// via a single GetDocByURL per hit. Cost: k extra Gets — block-cache hot,
+	// ~ms-scale at the k≤100 we accept. Opt out with ?enrich=false for callers
+	// that only need scoring. The date filter forces a doc fetch
+	// even when enrich=false, since PublishedAt lives on the gob.
+	// ?include_text=true inlines doc.Text on each hit so research
+	// pipelines avoid the N+1 round trip to /contents. Off by default —
+	// payload size grows linearly with k and average doc length.
+	enrich := r.URL.Query().Get("enrich") != "false"
+	if wantRerank {
+		enrich = true // rerank needs per-doc text — overrides enrich opt-out
+	}
+	// time-decay multiplier needs PublishedAt per hit, which lives
+	// behind the enrich flag. Force enrich when decay is requested so the
+	// signal is available downstream.
+	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
+	if decaySet {
+		enrich = true
+	}
+	includeText := r.URL.Query().Get("include_text") == "true"
+	out := make([]searchHit, 0, keepCap)
+	var rerankTexts []string
+	if wantRerank {
+		rerankTexts = make([]string, 0, keepCap)
+	}
+	for _, h := range hits {
+		if len(include) > 0 || len(exclude) > 0 {
+			host := hostOf(h.URL)
+			if len(include) > 0 && !matchesAnyDomain(host, include) {
+				continue
+			}
+			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
+				continue
+			}
+		}
+		if siteFilter && !matchesAnySite(h.URL, sites) {
+			continue
+		}
+		hit := searchHit{URL: h.URL, Title: h.Title, Score: h.Score}
+		if enrich || dateFilter || includeText {
+			doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
+			if derr != nil || doc == nil {
+				continue
+			}
+			if dateFilter {
+				if doc.PublishedAt.IsZero() {
+					continue // zero PublishedAt = unknown; drop under any date filter
+				}
+				if !since.IsZero() && doc.PublishedAt.Before(since) {
+					continue
+				}
+				if !until.IsZero() && doc.PublishedAt.After(until) {
+					continue
+				}
+			}
+			if enrich {
+				hit.Excerpt = textExcerpt(doc.Text, 320)
+				if !doc.PublishedAt.IsZero() {
+					t := doc.PublishedAt
+					hit.PublishedAt = &t
+				}
+				hit.Author = doc.Author
+			}
+			if includeText {
+				hit.Text = doc.Text
+			}
+			if wantRerank {
+				rerankTexts = append(rerankTexts, doc.Title+"\n"+doc.Text)
+			}
+		}
+		out = append(out, hit)
+		if len(out) >= keepCap {
+			break
+		}
+	}
+	// Runs BEFORE rerank so the rerank pool
+	// reflects both quality and recency — when fetchK is over-fetched, the
+	// reranker still sees the freshest-AND-most-relevant top-N. Hits without
+	// PublishedAt are left alone (no signal, no penalty). The pool re-sort
+	// re-aligns rerankTexts via a URL→text map so both knobs compose.
+	if decaySet {
+		var textByURL map[string]string
+		if wantRerank && len(rerankTexts) == len(out) {
+			textByURL = make(map[string]string, len(out))
+			for i, h := range out {
+				textByURL[h.URL] = rerankTexts[i]
+			}
+		}
+		applyTimeDecay(out, decayHalfLife, time.Now())
+		if textByURL != nil {
+			rerankTexts = rerankTexts[:0]
+			for _, h := range out {
+				rerankTexts = append(rerankTexts, textByURL[h.URL])
+			}
+		}
+	}
+	// rerank now that we have keepCap candidates with text.
+	if wantRerank && len(out) > 1 && len(rerankTexts) == len(out) {
+		cands := make([]rerank.Candidate, len(out))
+		for i := range out {
+			cands[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: rerankTexts[i]}
+		}
+		if order, rerr := s.doRerank(r.Context(), q, cands); rerr == nil && len(order) > 0 {
+			reordered := make([]searchHit, 0, len(out))
+			seen := make(map[int]bool, len(out))
+			for _, id := range order {
+				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(out) && !seen[n] {
+					reordered = append(reordered, out[n])
+					seen[n] = true
+				}
+			}
+			// Drop nothing: if the reranker omitted any IDs, append in original order.
+			for i, h := range out {
+				if !seen[i] {
+					reordered = append(reordered, h)
+				}
+			}
+			out = reordered
+		}
+	}
+	// MMR diversification. ?mmr=<lambda> (0..1) reorders the
+	// candidate pool to balance query relevance against diversity from
+	// previously-selected hits. Requires HNSW (per-hit vectors) and an
+	// embedder when the query vector wasn't already computed by the
+	// dense/hybrid path. Composes after rerank — rerank gives quality
+	// ordering, MMR diversifies it. warningsFor() handles the silent
+	// fall-through when MMR was requested but couldn't fire.
+	if mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr")); mmrSet && len(out) > 1 && s.hnsw != nil {
+		var qVec []float32
+		// Hybrid/dense path already embedded the query — try to reuse it.
+		// For BM25-only path we need to embed q if an embedder is configured.
+		if s.embedder != nil {
+			if vecs, embErr := s.embedder.Embed(r.Context(), []string{q}); embErr == nil && len(vecs) > 0 {
+				qVec = vecs[0]
+			}
+		}
+		if len(qVec) > 0 {
+			hitVecs := make([][]float32, len(out))
+			for i := range out {
+				if v, ok := s.hnsw.LookupVectorByURL(out[i].URL); ok {
+					hitVecs[i] = v
+				}
+			}
+			out = mmrSelect(qVec, out, hitVecs, mmrLambda)
+		}
+	}
+	if len(out) > k {
+		out = out[:k]
+	}
+	// Applies to
+	// the already-collected top-k pool; raise k to widen the pool before
+	// re-sorting if you need more candidates for date ordering.
+	switch r.URL.Query().Get("sort") {
+	case "date_desc":
+		sortHitsByDate(out, false)
+	case "date_asc":
+		sortHitsByDate(out, true)
+	}
+	// label centralized in buildRetrieverLabel so /answer
+	// and /research report the same vocabulary as /search.
+	retrieverLabel := s.buildRetrieverLabel(retrieverParam, expandMode, denseReady, effectiveQuery != q, wantRerank)
+	// mmr suffix when diversification actually fired (HNSW loaded
+	// + embedder available). Same conditional as the apply site above —
+	// the label tracks the real pipeline.
+	if mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr")); mmrSet && s.hnsw != nil && s.embedder != nil && mmrLambda < 1.0 {
+		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
+	}
+	// decay suffix when time-decay was applied.
+	if decaySet {
+		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
+	}
+	resp := searchResponse{
+		Query:     q,
+		Expand:    normalizeExpandMode(expandMode),
+		Retriever: retrieverLabel,
+		Hits:      out,
+		// total_candidates = BM25 candidates considered before
+		// filter (capped at fetchK). Operators tuning over-fetch can see
+		// whether their filter is dropping a lot — when out=k but
+		// total_candidates is close to fetchK, the filter is restrictive
+		// enough that you may want to raise k or relax filters.
+		TotalCandidates: len(hits),
+		Took:            time.Since(start).String(),
+	}
+	// surface the post-HyDE query when it actually changed, so callers
+	// can debug whether expand=true contributed any extra terms or returned q
+	// unchanged (chat down, empty passage, etc).
+	if effectiveQuery != q {
+		resp.EffectiveQuery = effectiveQuery
+	}
+	resp.Warnings = s.warningsFor(r)
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// sortHitsByDate orders hits by PublishedAt. Hits with no PublishedAt sink to
+// the end regardless of direction — they have no comparable value. asc=true
+// gives oldest-first; asc=false gives newest-first.
+func sortHitsByDate(hits []searchHit, asc bool) {
+	sort.SliceStable(hits, func(i, j int) bool {
+		ai := hits[i].PublishedAt != nil
+		aj := hits[j].PublishedAt != nil
+		if ai != aj {
+			return ai // hits with dates come before hits without
+		}
+		if !ai {
+			return false
+		}
+		if asc {
+			return hits[i].PublishedAt.Before(*hits[j].PublishedAt)
+		}
+		return hits[i].PublishedAt.After(*hits[j].PublishedAt)
+	})
+}
+
+// BM25-only "more like this". Mirrors EXA's /findSimilar shape but
+// stays dependency-free: no embeddings required. Algorithm is Lucene's MLT —
+// pick the source doc's top-N terms by tf·idf, build a query from them, run
+// the existing BM25 search, drop the source URL itself. With dense vectors
+// off the table on the Pebble path (HNSW indexing during crawl is the iter
+// follow-up), this is the cheapest credible /find_similar we can ship.
+func (s *pebbleHTTP) handleFindSimilar(w http.ResponseWriter, r *http.Request) {
+	// /find_similar runs locally with a
+	// known URL+vec, but in a cluster the URL's shard owns its vector and
+	// only one shard has it. We fan-out to all shards anyway: the owning
+	// shard does the real work; others either fall back to text-mode (if
+	// text supplied) or return empty.
+	if s.cluster.GatewayMode && s.cluster.IsClustered() && r.URL.Query().Get("cluster_local") != "1" {
+		s.handleFindSimilarGateway(w, r)
+		return
+	}
+	start := time.Now()
+	// accept either ?url= (existing behavior) or ?text= (content-
+	// based similarity for unindexed drafts). text path skips the source-URL
+	// exclusion since there's no source URL to exclude.
+	rawURL := r.URL.Query().Get("url")
+	rawText := r.URL.Query().Get("text")
+	if rawURL == "" && rawText == "" {
+		writeProblem(w, http.StatusBadRequest, "missing url or text parameter")
+		return
+	}
+	var srcTitle, srcText, srcURL string
+	if rawURL != "" {
+		decoded, err := url.QueryUnescape(rawURL)
+		if err != nil {
+			writeProblem(w, http.StatusBadRequest, "url parameter is not URL-encoded")
+			return
+		}
+		src, err := s.store.GetDocByURL(r.Context(), decoded)
+		if errors.Is(err, store.ErrNotFound) {
+			writeProblem(w, http.StatusNotFound, "url not in index")
+			return
+		}
+		if err != nil {
+			writeProblem(w, http.StatusInternalServerError, err.Error())
+			return
+		}
+		srcTitle, srcText, srcURL = src.Title, src.Text, src.URL
+	} else {
+		srcText = rawText
+		srcTitle = r.URL.Query().Get("title") // optional title boost when text mode
+	}
+	k := 10
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 100 {
+			k = n
+		}
+	}
+
+	// Tokenize title (×3) and body; mirror IndexDocument's title boost so
+	// title terms dominate the similarity query.
+	tf := make(map[string]int, 256)
+	for _, t := range index.Tokenize(srcTitle) {
+		tf[t] += 3
+	}
+	for _, t := range index.Tokenize(srcText) {
+		tf[t]++
+	}
+
+	_, n, _ := s.store.CorpusStats(r.Context())
+	if n <= 0 {
+		n = 1
+	}
+	logN := math.Log(float64(n))
+
+	type termScore struct {
+		term  string
+		score float64
+	}
+	scored := make([]termScore, 0, len(tf))
+	for term, freq := range tf {
+		info, ok, err := s.store.GetTermInfo(r.Context(), term)
+		if err != nil || !ok || info.DocFreq <= 0 {
+			continue
+		}
+		idf := logN - math.Log(float64(info.DocFreq))
+		if idf <= 0 {
+			continue // term appears in every doc; useless signal
+		}
+		scored = append(scored, termScore{term: term, score: float64(freq) * idf})
+	}
+	sort.Slice(scored, func(i, j int) bool { return scored[i].score > scored[j].score })
+
+	topN := 10
+	if len(scored) < topN {
+		topN = len(scored)
+	}
+	if topN == 0 {
+		// previously referenced `decoded` (only in scope in the
+		// url-mode branch) — broken since's text-mode addition.
+		// Use srcURL when present, else echo the bare text/title as the
+		// source identifier so the empty response still tells the caller
+		// what was searched.
+		emptyQuery := srcURL
+		if emptyQuery == "" {
+			emptyQuery = srcTitle
+			if emptyQuery == "" {
+				emptyQuery = srcText
+			}
+		}
+		writeJSON(w, http.StatusOK, searchResponse{
+			Query: emptyQuery, Retriever: "bm25-mlt",
+			Hits: []searchHit{}, Took: time.Since(start).String(),
+		})
+		return
+	}
+	terms := make([]string, topN)
+	for i := 0; i < topN; i++ {
+		terms[i] = scored[i].term
+	}
+	queryStr := strings.Join(terms, " ")
+	// optional ?q= augments the auto-derived MLT query so callers
+	// can constrain "more like this URL" with an extra concept (e.g.
+	// /find_similar?url=...&q=pricing). Appended verbatim — supports the
+	// same quoted-phrase shape /search accepts.
+	if extra := strings.TrimSpace(r.URL.Query().Get("q")); extra != "" {
+		queryStr = queryStr + " " + extra
+	}
+
+	// scope MLT with the same retrieval filters /search and /answer
+	// accept. 'find pages similar to X but only on docs.example.com' is the
+	// archetype EXA findSimilar shape. Over-fetch enough that the source
+	// exclusion + filter still fills k.
+	include := splitDomainsCSV(r.URL.Query().Get("include_domains"))
+	exclude := splitDomainsCSV(r.URL.Query().Get("exclude_domains"))
+	since, sinceErr := parseDateBound(r.URL.Query().Get("since"))
+	if sinceErr != nil {
+		writeProblem(w, http.StatusBadRequest, "since: "+sinceErr.Error())
+		return
+	}
+	until, untilErr := parseDateBound(r.URL.Query().Get("until"))
+	if untilErr != nil {
+		writeProblem(w, http.StatusBadRequest, "until: "+untilErr.Error())
+		return
+	}
+	dateFilter := !since.IsZero() || !until.IsZero()
+	includeText := r.URL.Query().Get("include_text") == "true"
+	// ?rerank=true closes /find_similar's parity gap with the other
+	// retrieval endpoints. The MLT query is auto-derived from the source doc,
+	// so reranking the candidate neighbors against THAT query is exactly what
+	// EXA's findSimilar quality boost is doing under the hood.
+	wantRerank := r.URL.Query().Get("rerank") == "true" && s.reranker != nil
+	keepCap := k
+	if wantRerank {
+		keepCap = s.rerankCandK
+		if keepCap < k {
+			keepCap = k
+		}
+	}
+	fetchK := keepCap + 1 // +1 to absorb the source-URL exclusion
+	if len(include) > 0 || len(exclude) > 0 || dateFilter {
+		mult := 5
+		if dateFilter {
+			mult = 10
+		}
+		fetchK = keepCap * mult
+		if fetchK > 500 {
+			fetchK = 500
+		}
+	} else if wantRerank {
+		fetchK = keepCap * 2
+	}
+
+	// /find_similar?retriever=dense reuses the source's
+	// persisted vector (URL-mode) or embeds the user's text (text-mode) and
+	// runs an HNSW cosine search instead of BM25-MLT. ?retriever=hybrid
+	// runs BOTH BM25-MLT and dense, then RRF-fuses — the
+	// strongest "find similar" signal: lexical precision + semantic recall.
+	//
+	// Requires COSIFT_LOAD_HNSW=true at server start (for the graph);
+	// text-mode additionally needs a configured embedder. URL-mode dense
+	// works without an embedder — the source vector is already in the graph
+	// from indexing. Missing requirements fall through to BM25-MLT;
+	// warningsFor() flags it (carves out the URL-mode-no-embedder
+	// case so the warning isn't misleading).
+	retrieverParam := r.URL.Query().Get("retriever")
+	useDense := retrieverParam == "dense" && s.hnsw != nil
+	useHybrid := retrieverParam == "hybrid" && s.hnsw != nil
+	var (
+		hits       []index.Hit
+		denseFired bool
+		bm25Fired  bool
+	)
+	// Helper: fetch the query vector (URL-mode lookup, falling back to
+	// text-mode embed when allowed). Returns ok=false when neither path
+	// produced a usable vector.
+	getQueryVec := func() ([]float32, bool) {
+		if srcURL != "" {
+			if v, ok := s.hnsw.LookupVectorByURL(srcURL); ok {
+				return v, true
+			}
+		}
+		if s.embedder != nil && (srcText != "" || srcTitle != "") {
+			seed := strings.TrimSpace(srcTitle + " " + srcText)
+			if seed != "" {
+				vecs, embErr := s.embedder.Embed(r.Context(), []string{seed})
+				if embErr == nil && len(vecs) > 0 {
+					return vecs[0], true
+				}
+			}
+		}
+		return nil, false
+	}
+	if useDense {
+		if queryVec, ok := getQueryVec(); ok {
+			vhits := s.hnsw.Search(r.Context(), queryVec, fetchK)
+			hits = make([]index.Hit, len(vhits))
+			for i, vh := range vhits {
+				hits[i] = index.Hit{URL: vh.URL, Title: vh.Title, Score: vh.Score}
+			}
+			denseFired = true
+		}
+	} else if useHybrid {
+		// Run BM25-MLT and dense in series; RRF-fuse the two ranked lists.
+		// Each retriever votes fetchK candidates so the fused top-fetchK has
+		// room to balance both signals before filter/enrich/rerank.
+		bm25Hits, bm25Err := s.idx.Search(r.Context(), queryStr, fetchK)
+		if bm25Err != nil {
+			writeProblem(w, http.StatusInternalServerError, bm25Err.Error())
+			return
+		}
+		bm25Fired = true
+		if queryVec, ok := getQueryVec(); ok {
+			vhits := s.hnsw.Search(r.Context(), queryVec, fetchK)
+			denseHits := s.applyAuthorityToDense(vhits)
+			hits = rrfFuse([][]index.Hit{bm25Hits, denseHits})
+			if len(hits) > fetchK {
+				hits = hits[:fetchK]
+			}
+			denseFired = true
+		} else {
+			// Hybrid fell through to BM25-only (e.g. text-mode + no embedder).
+			// Keep the BM25 hits we already paid for.
+			hits = bm25Hits
+		}
+	}
+	if !denseFired && !bm25Fired {
+		var err error
+		hits, err = s.idx.Search(r.Context(), queryStr, fetchK)
+		if err != nil {
+			writeProblem(w, http.StatusInternalServerError, err.Error())
+			return
+		}
+	}
+	type fsCand struct {
+		hit        searchHit
+		rerankText string
+	}
+	cands := make([]fsCand, 0, keepCap)
+	for _, h := range hits {
+		if srcURL != "" && h.URL == srcURL {
+			continue
+		}
+		if len(include) > 0 || len(exclude) > 0 {
+			host := hostOf(h.URL)
+			if len(include) > 0 && !matchesAnyDomain(host, include) {
+				continue
+			}
+			if len(exclude) > 0 && matchesAnyDomain(host, exclude) {
+				continue
+			}
+		}
+		hit := searchHit{URL: h.URL, Title: h.Title, Score: h.Score}
+		doc, derr := s.store.GetDocByURL(r.Context(), h.URL)
+		if derr != nil || doc == nil {
+			continue
+		}
+		if dateFilter {
+			if doc.PublishedAt.IsZero() {
+				continue
+			}
+			if !since.IsZero() && doc.PublishedAt.Before(since) {
+				continue
+			}
+			if !until.IsZero() && doc.PublishedAt.After(until) {
+				continue
+			}
+		}
+		hit.Excerpt = textExcerpt(doc.Text, 320)
+		if !doc.PublishedAt.IsZero() {
+			t := doc.PublishedAt
+			hit.PublishedAt = &t
+		}
+		hit.Author = doc.Author
+		if includeText {
+			hit.Text = doc.Text
+		}
+		c := fsCand{hit: hit}
+		if wantRerank {
+			c.rerankText = doc.Title + "\n" + doc.Text
+		}
+		cands = append(cands, c)
+		if len(cands) >= keepCap {
+			break
+		}
+	}
+	// Same pre-rerank placement as
+	// /search — re-sort cands by adjusted score so rerank sees a freshness-
+	// aware pool. Re-aligns rerankText too via URL→text map.
+	decayHalfLife, decaySet := parseDecayHalfLife(r.URL.Query().Get("decay"))
+	if decaySet && len(cands) > 0 {
+		now := time.Now()
+		for i := range cands {
+			cands[i].hit.Score *= decayMultiplier(cands[i].hit.PublishedAt, now, decayHalfLife)
+		}
+		sort.SliceStable(cands, func(i, j int) bool { return cands[i].hit.Score > cands[j].hit.Score })
+	}
+	if wantRerank && len(cands) > 1 {
+		rc := make([]rerank.Candidate, len(cands))
+		for i := range cands {
+			rc[i] = rerank.Candidate{ID: strconv.Itoa(i), Text: cands[i].rerankText}
+		}
+		if order, rerr := s.doRerank(r.Context(), queryStr, rc); rerr == nil && len(order) > 0 {
+			reordered := make([]fsCand, 0, len(cands))
+			seen := make(map[int]bool, len(cands))
+			for _, id := range order {
+				if n, perr := strconv.Atoi(id); perr == nil && n >= 0 && n < len(cands) && !seen[n] {
+					reordered = append(reordered, cands[n])
+					seen[n] = true
+				}
+			}
+			for i, c := range cands {
+				if !seen[i] {
+					reordered = append(reordered, c)
+				}
+			}
+			cands = reordered
+		}
+	}
+	// MMR diversification on /find_similar. Anchored at the
+	// source vector — URL-mode reuses the persisted vec, text-mode embeds
+	// the seed via getQueryVec (defined above for dense/hybrid dispatch).
+	// Without an explicit user query, the source IS the query — this is
+	// the right anchor for "find similar but diverse".
+	mmrLambda, mmrSet := parseMMRLambda(r.URL.Query().Get("mmr"))
+	mmrFired := false
+	if mmrSet && len(cands) > 1 && s.hnsw != nil {
+		if qVec, ok := getQueryVec(); ok {
+			hitVecs := make([][]float32, len(cands))
+			for i, c := range cands {
+				if v, vok := s.hnsw.LookupVectorByURL(c.hit.URL); vok {
+					hitVecs[i] = v
+				}
+			}
+			order := mmrOrder(qVec, hitVecs, mmrLambda)
+			if order != nil {
+				reordered := make([]fsCand, len(order))
+				for i, idx := range order {
+					reordered[i] = cands[idx]
+				}
+				cands = reordered
+				mmrFired = true
+			}
+		}
+	}
+	if len(cands) > k {
+		cands = cands[:k]
+	}
+	out := make([]searchHit, 0, len(cands))
+	for _, c := range cands {
+		out = append(out, c.hit)
+	}
+	// label tracks which retrievers actually fired.
+	//   bm25-mlt              — default, BM25 only
+	//   dense                 — ?retriever=dense fired (graph + vec found)
+	//   bm25-mlt+dense:rrf    — ?retriever=hybrid, both BM25 and dense fired
+	// If dense was requested but fell through (no graph, no vec), the label
+	// stays bm25-mlt and warningsFor() carries the reason.
+	retrieverLabel := "bm25-mlt"
+	switch {
+	case bm25Fired && denseFired:
+		retrieverLabel = "bm25-mlt+dense:rrf"
+	case denseFired:
+		retrieverLabel = "dense"
+	}
+	if wantRerank {
+		retrieverLabel += "+rerank:" + s.reranker.Name()
+	}
+	if mmrFired {
+		retrieverLabel += fmt.Sprintf("+mmr:%.2f", mmrLambda)
+	}
+	if decaySet {
+		retrieverLabel += fmt.Sprintf("+decay:%gd", decayHalfLife)
+	}
+	writeJSON(w, http.StatusOK, searchResponse{
+		Query:           queryStr,
+		Retriever:       retrieverLabel,
+		Hits:            out,
+		TotalCandidates: len(hits),
+		Warnings:        s.warningsFor(r),
+		Took:            time.Since(start).String(),
+	})
+}
+
+// doRerank wraps s.reranker.Rerank with attempt/failure counters.
+// Returning the original error unchanged so callers keep their existing
+// silent-fallback behavior; only the operator-side visibility changed.
+func (s *pebbleHTTP) doRerank(ctx context.Context, q string, cands []rerank.Candidate) ([]string, error) {
+	s.rerankAttempts.Add(1)
+	order, err := s.reranker.Rerank(ctx, q, cands)
+	if err != nil {
+		s.rerankFailures.Add(1)
+	}
+	return order, err
+}
+
+// applyBM25EnvOverrides reads COSIFT_BM25_K1 / _B and applies them
+// to idx. Shared by runPebbleServe and runQuery so both honor the same env.
+// Returns which knobs landed so callers can log selectively.
+type bm25EnvResult struct {
+	k1Set, bSet bool
+	k1Val, bVal float64
+	k1Bad, bBad string // non-empty when env was set but unparseable
+}
+
+func applyBM25EnvOverrides(idx *index.PebbleBM25) bm25EnvResult {
+	var out bm25EnvResult
+	if v := os.Getenv("COSIFT_BM25_K1"); v != "" {
+		if k1, err := strconv.ParseFloat(v, 64); err == nil && k1 > 0 {
+			idx.WithBM25Params(k1, 0)
+			out.k1Set, out.k1Val = true, k1
+		} else {
+			out.k1Bad = v
+		}
+	}
+	if v := os.Getenv("COSIFT_BM25_B"); v != "" {
+		if b, err := strconv.ParseFloat(v, 64); err == nil && b > 0 {
+			idx.WithBM25Params(0, b)
+			out.bSet, out.bVal = true, b
+		} else {
+			out.bBad = v
+		}
+	}
+	return out
+}
+
+// paraphraseQuery returns up to n paraphrases of q via the chat
+// client, parses the JSON array shape the SQLite-side paraphraser already
+// uses, and falls back to nil on any failure (no chat client, empty / malformed
+// reply, parse error). Caller decides what to do with an empty list — the
+// downstream RRF strategy treats it as 'no expansion, fall back to single
+// query'. No cache yet — keyed on (q, n) would need a different shape than
+// the HyDE cache; revisit when workload justifies.
+func (s *pebbleHTTP) paraphraseQuery(ctx context.Context, q string, n int) []string {
+	if s.chat == nil || n <= 0 {
+		return nil
+	}
+	s.paraMu.RLock()
+	if cached, ok := s.paraCache[q]; ok {
+		s.paraMu.RUnlock()
+		s.paraHits.Add(1)
+		return cached
+	}
+	s.paraMu.RUnlock()
+	s.paraMisses.Add(1)
+	const sys = `Generate paraphrases of a search query. Each paraphrase preserves the semantic intent but uses different vocabulary — different keywords that a target document might also use. Output ONLY a JSON array of strings.
+Example output for "go programming language": ["golang concurrent compiled language", "Google's systems programming language with goroutines"]`
+	resp, err := s.doChat(ctx, s.chat, []embed.ChatMsg{
+		{Role: "system", Content: sys},
+		{Role: "user", Content: fmt.Sprintf("Generate %d paraphrases of: %s", n, q)},
+	})
+	if err != nil {
+		return nil
+	}
+	raw := strings.TrimSpace(resp)
+	for _, fence := range []string{"```json", "```"} {
+		raw = strings.TrimPrefix(raw, fence)
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	raw = strings.TrimSpace(raw)
+	startIdx := strings.Index(raw, "[")
+	endIdx := strings.LastIndex(raw, "]")
+	if startIdx < 0 || endIdx <= startIdx {
+		return nil
+	}
+	var arr []string
+	if err := json.Unmarshal([]byte(raw[startIdx:endIdx+1]), &arr); err != nil {
+		return nil
+	}
+	out := make([]string, 0, len(arr))
+	for _, p := range arr {
+		t := strings.TrimSpace(p)
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	if len(out) > 0 {
+		s.paraMu.Lock()
+		if len(s.paraCache) >= s.paraCacheCap {
+			for k := range s.paraCache {
+				delete(s.paraCache, k)
+				break
+			}
+		}
+		s.paraCache[q] = out
+		s.paraMu.Unlock()
+	}
+	return out
+}
+
+// rrfFuse implements Reciprocal Rank Fusion across N ranked lists.
+// k=60 is the standard Cormack et al. constant; tweaking rarely changes top-k
+// ordering meaningfully. Each list contributes 1/(k + rank+1) to a URL's
+// fused score; URLs appearing in more lists at higher ranks rise. Returns
+// synthesized Hits ordered by fused score (URL/Title from first encounter,
+// Score = fused RRF score).
+func rrfFuse(lists [][]index.Hit) []index.Hit {
+	const fuseK = 60
+	type fused struct {
+		hit   index.Hit
+		score float64
+	}
+	scored := make(map[string]*fused, 64)
+	for _, list := range lists {
+		for rank, h := range list {
+			if existing, ok := scored[h.URL]; ok {
+				existing.score += 1.0 / float64(fuseK+rank+1)
+			} else {
+				scored[h.URL] = &fused{hit: h, score: 1.0 / float64(fuseK+rank+1)}
+			}
+		}
+	}
+	flat := make([]*fused, 0, len(scored))
+	for _, f := range scored {
+		flat = append(flat, f)
+	}
+	sort.Slice(flat, func(i, j int) bool { return flat[i].score > flat[j].score })
+	out := make([]index.Hit, len(flat))
+	for i, f := range flat {
+		out[i] = f.hit
+		out[i].Score = f.score
+	}
+	return out
+}
+
+// warningsFor surfaces silent no-ops that callers used to have to
+// derive from absent effective_query / retriever fields. Each warning is one
+// human-readable sentence; consumers programmatically inspect the slice.
+func (s *pebbleHTTP) warningsFor(r *http.Request) []string {
+	var w []string
+	if mode := r.URL.Query().Get("expand"); mode != "" {
+		if s.chat == nil {
+			w = append(w, "expand="+mode+" requested but no chat client configured (set cfg.Chat.Model)")
+		} else if normalizeExpandMode(mode) == "" {
+			// unknown expand value used to be silently ignored.
+			w = append(w, "expand="+mode+" is not a known strategy (try: hyde, paraphrase) — treated as no expansion")
+		}
+	}
+	if r.URL.Query().Get("rerank") == "true" && s.reranker == nil {
+		w = append(w, "rerank=true requested but no reranker configured (set cfg.Rerank.URL or cfg.Rerank.Enabled)")
+	}
+	// dense + hybrid retrievers need both a loaded HNSW graph
+	// and an embedder. Missing either falls through to BM25 with a warning.
+	// /find_similar?url=X URL-mode-dense reads the source vector
+	// directly from the graph via LookupVectorByURL — no embed RPC. Skip the
+	// embedder warning in that case (would otherwise be misleading: the
+	// request succeeded without an embedder).
+	// /find_similar falls back to bm25-mlt (not bm25), so the
+	// warning says so — caller's retriever label matches the warning text.
+	if rv := r.URL.Query().Get("retriever"); rv == "dense" || rv == "hybrid" {
+		isFindSimilar := strings.HasSuffix(r.URL.Path, "/find_similar")
+		isFindSimilarURLMode := isFindSimilar && r.URL.Query().Get("url") != ""
+		fallback := "BM25"
+		if isFindSimilar {
+			fallback = "BM25-MLT"
+		}
+		switch {
+		case s.hnsw == nil:
+			w = append(w, "retriever="+rv+" requested but HNSW graph not loaded (set COSIFT_LOAD_HNSW=true at server start) — fell back to "+fallback)
+		case s.embedder == nil && !isFindSimilarURLMode:
+			w = append(w, "retriever="+rv+" requested but no embedder configured (set cfg.Embeddings.Model) — fell back to "+fallback)
+		}
+	}
+	// MMR diversification needs HNSW + embedder. Bad values (non-
+	// float, out of [0,1]) fall through silently — flag them. Missing
+	// requirements also warn.
+	// /find_similar?url=X reuses the source vector from the graph
+	// for the MMR anchor — no embedder needed. Same carve-out as
+	// for the retriever warning.
+	if raw := r.URL.Query().Get("mmr"); raw != "" {
+		isFindSimilarURLMode := strings.HasSuffix(r.URL.Path, "/find_similar") && r.URL.Query().Get("url") != ""
+		if _, ok := parseMMRLambda(raw); !ok {
+			w = append(w, "mmr="+raw+" is not a float in [0,1] — diversification skipped")
+		} else if s.hnsw == nil {
+			w = append(w, "mmr requires HNSW graph (set COSIFT_LOAD_HNSW=true at server start) — diversification skipped")
+		} else if s.embedder == nil && !isFindSimilarURLMode {
+			w = append(w, "mmr requires an embedder to vectorize the query (set cfg.Embeddings.Model) — diversification skipped")
+		}
+	}
+	// invalid decay half-life flags loudly instead of silently
+	// being ignored. Empty value is fine (no decay requested).
+	if raw := r.URL.Query().Get("decay"); raw != "" {
+		if _, ok := parseDecayHalfLife(raw); !ok {
+			w = append(w, "decay="+raw+" is not a positive half-life in days (≤ 36500) — time-decay skipped")
+		}
+	}
+	// catch unknown ?sort= values (silently treated as relevance).
+	if sortVal := r.URL.Query().Get("sort"); sortVal != "" {
+		switch sortVal {
+		case "relevance", "date_desc", "date_asc":
+			// valid
+		default:
+			w = append(w, "sort="+sortVal+" is not a known mode (try: relevance, date_desc, date_asc) — treated as relevance")
+		}
+	}
+	// catch obviously-bad ?k= values that silently fell back to the
+	// per-endpoint default. Upper-bound clamping varies per endpoint so we
+	// flag only the universally-invalid cases (non-integer, zero, negative).
+	if kVal := r.URL.Query().Get("k"); kVal != "" {
+		if n, err := strconv.Atoi(kVal); err != nil || n <= 0 {
+			w = append(w, "k="+kVal+" is not a positive integer — using server default")
+		}
+	}
+	// Users sometimes
+	// pass 'https://example.com/foo' when 'example.com' was wanted; the
+	// dot-boundary matcher silently drops every result.
+	for _, key := range []string{"include_domains", "exclude_domains"} {
+		if v := r.URL.Query().Get(key); v != "" {
+			for _, d := range strings.Split(v, ",") {
+				d = strings.TrimSpace(d)
+				if strings.Contains(d, "://") || strings.Contains(d, "/") {
+					w = append(w, key+" entry "+d+" looks like a URL — pass a hostname (e.g., example.com), not a URL")
+					break // one warning per filter list is enough
+				}
+			}
+		}
+	}
+	if len(w) > 0 {
+		s.warningsEmitted.Add(1)
+	}
+	return w
+}
+
+// normalizeExpandMode returns the canonical strategy name for an `expand`
+// param value: "true" → "hyde" (alias), "hyde"/"paraphrase" pass through,
+// anything else → "" (so the response field doesn't echo a value that had
+// no effect).
+func normalizeExpandMode(raw string) string {
+	switch raw {
+	case "true", "hyde":
+		return "hyde"
+	case "paraphrase":
+		return "paraphrase"
+	default:
+		return ""
+	}
+}
+
+// parseDecayHalfLife parses ?decay= as a positive half-life in days. Returns
+// (halfLife, true) when valid. Empty / non-positive → (0, false) so caller
+// short-circuits. Bounded at 36500 (100 years) to avoid pathological values.
+func parseDecayHalfLife(raw string) (float64, bool) {
+	if raw == "" {
+		// Half-life from COSIFT_DEFAULT_DECAY_DAYS
+		// (default 180 days = 6 months). Docs older than 6 months get exponentially
+		// less weight in the score; recent docs surface naturally without keyword
+		// hacks like the JS regex. Set the env to 0 to disable globally.
+		// Explicit ?decay=N still wins.
+		def := 180.0
+		if v := os.Getenv("COSIFT_DEFAULT_DECAY_DAYS"); v != "" {
+			if f, err := strconv.ParseFloat(v, 64); err == nil && f >= 0 {
+				def = f
+			}
+		}
+		if def <= 0 {
+			return 0, false
+		}
+		return def, true
+	}
+	// explicit decay=0 disables (even if env default is on).
+	if raw == "0" {
+		return 0, false
+	}
+	v, err := strconv.ParseFloat(raw, 64)
+	if err != nil {
+		return 0, false
+	}
+	if math.IsNaN(v) || math.IsInf(v, 0) || v <= 0 || v > 36500 {
+		return 0, false
+	}
+	return v, true
+}
+
+// decayMultiplier computes the time-decay weight for a single PublishedAt.
+// Half-life H: doc from H days ago → 0.5x, 2H → 0.25x. Missing date or
+// non-positive halfLife → 1.0 (no decay).
+func decayMultiplier(publishedAt *time.Time, now time.Time, halfLifeDays float64) float64 {
+	if halfLifeDays <= 0 || publishedAt == nil || publishedAt.IsZero() {
+		return 1
+	}
+	ageDays := now.Sub(*publishedAt).Hours() / 24.0
+	if ageDays < 0 {
+		ageDays = 0 // future-dated → treated as fresh, never boosted
+	}
+	return math.Exp(-math.Ln2 * ageDays / halfLifeDays)
+}
+
+// applyTimeDecay multiplies each hit's Score by decayMultiplier and resorts.
+func applyTimeDecay(hits []searchHit, halfLifeDays float64, now time.Time) {
+	if halfLifeDays <= 0 || len(hits) == 0 {
+		return
+	}
+	for i := range hits {
+		hits[i].Score *= decayMultiplier(hits[i].PublishedAt, now, halfLifeDays)
+	}
+	sort.SliceStable(hits, func(i, j int) bool { return hits[i].Score > hits[j].Score })
+}
+
+// parseMMRLambda parses ?mmr= as a float in [0, 1]. Returns (lambda, true)
+// when valid. Empty value or out-of-range returns (0, false) so the caller
+// can short-circuit without firing MMR.
+func parseMMRLambda(raw string) (float64, bool) {
+	if raw == "" {
+		return 0, false
+	}
+	v, err := strconv.ParseFloat(raw, 64)
+	if err != nil {
+		return 0, false
+	}
+	if v < 0 || v > 1 {
+		return 0, false
+	}
+	return v, true
+}
+
+// mmrOrder computes a permutation of [0..n-1] via Maximal Marginal Relevance
+// (Carbonell & Goldstein '98). At each step picks the candidate maximizing
+//
+//	score = λ · sim(q, c) - (1-λ) · max_{s∈selected} sim(c, s)
+//
+// Candidates whose vectors are missing (zero-length) score 0 on relevance
+// and 0 against any other missing-vec candidate — MMR can only diversify
+// what it can compare. lambda=1 → pure relevance (no diversification);
+// lambda=0 → pure diversity. 0.5–0.7 is a typical starting point.
+//
+// Returns the permutation as a []int; never drops anything. The caller
+// applies it to whatever URL-keyed slice it has.
+func mmrOrder(qVec []float32, hitVecs [][]float32, lambda float64) []int {
+	n := len(hitVecs)
+	if n == 0 {
+		return nil
+	}
+	selected := make([]bool, n)
+	order := make([]int, 0, n)
+	rel := make([]float64, n)
+	for i := range hitVecs {
+		if len(hitVecs[i]) > 0 {
+			rel[i] = float64(index.Dot(qVec, hitVecs[i]))
+		}
+	}
+	for len(order) < n {
+		bestI := -1
+		bestScore := -math.MaxFloat64
+		for i := 0; i < n; i++ {
+			if selected[i] {
+				continue
+			}
+			var maxSim float64
+			for _, j := range order {
+				if len(hitVecs[i]) == 0 || len(hitVecs[j]) == 0 {
+					continue
+				}
+				sim := float64(index.Dot(hitVecs[i], hitVecs[j]))
+				if sim > maxSim {
+					maxSim = sim
+				}
+			}
+			score := lambda*rel[i] - (1.0-lambda)*maxSim
+			if score > bestScore {
+				bestScore = score
+				bestI = i
+			}
+		}
+		if bestI < 0 {
+			break
+		}
+		selected[bestI] = true
+		order = append(order, bestI)
+	}
+	return order
+}
+
+// mmrSelect — thin /search wrapper around mmrOrder that operates on []searchHit
+// directly.
+func mmrSelect(qVec []float32, hits []searchHit, hitVecs [][]float32, lambda float64) []searchHit {
+	if len(hits) <= 1 || lambda >= 1.0 {
+		return hits
+	}
+	order := mmrOrder(qVec, hitVecs, lambda)
+	out := make([]searchHit, 0, len(hits))
+	for _, i := range order {
+		out = append(out, hits[i])
+	}
+	return out
+}
+
+// applyMMRPermutation embeds q, looks up per-URL vectors from HNSW, and
+// returns an MMR permutation. Returns nil when MMR can't fire (no graph,
+// no embedder, embed failed, λ≥1, single-element pool). Shared by /answer
+// and /research synth endpoints.
+func (s *pebbleHTTP) applyMMRPermutation(ctx context.Context, urls []string, q string, lambda float64) []int {
+	if s.hnsw == nil || s.embedder == nil || len(urls) <= 1 || lambda >= 1.0 {
+		return nil
+	}
+	vecs, err := s.embedder.Embed(ctx, []string{q})
+	if err != nil || len(vecs) == 0 {
+		return nil
+	}
+	hitVecs := make([][]float32, len(urls))
+	for i, u := range urls {
+		if v, ok := s.hnsw.LookupVectorByURL(u); ok {
+			hitVecs[i] = v
+		}
+	}
+	return mmrOrder(vecs[0], hitVecs, lambda)
+}
+
+// buildRetrieverLabel produces the human-readable retriever string
+// surfaced on /search, /answer, /research responses. Mirrors the
+// /search inline switch so all three endpoints report the same vocabulary.
+// expansionFired is the post-hoc "did expand=hyde/paraphrase actually run"
+// signal (effectiveQuery != q for /search & /answer; chat-present for
+// /research where sub-queries are individual). wantRerank appends the
+// "+rerank:<name>" suffix when rerank fired.
+func (s *pebbleHTTP) buildRetrieverLabel(retrieverParam, expandMode string, denseReady, expansionFired, wantRerank bool) string {
+	label := "bm25"
+	switch {
+	case retrieverParam == "dense" && denseReady:
+		label = "dense"
+	case retrieverParam == "hybrid" && denseReady:
+		label = "bm25+dense:rrf"
+	default:
+		switch expandMode {
+		case "paraphrase":
+			if expansionFired {
+				label = "bm25+paraphrase"
+			}
+		case "true", "hyde":
+			if expansionFired {
+				label = "bm25+hyde"
+			}
+		}
+	}
+	if wantRerank && s.reranker != nil {
+		label += "+rerank:" + s.reranker.Name()
+	}
+	return label
+}
+
+// applyLLMEndpointDefaults sets the retriever-choice and rerank defaults
+// the LLM-synthesized endpoints (/answer, /research) want. BM25 alone is
+// too slow at multi-million-doc corpora for synchronous LLM use, and the
+// reranker is the proven quality recovery layer — so /answer and /research
+// default to hybrid + rerank whenever the components are wired, while
+// /search keeps its plain-BM25 default for low-latency operator use.
+//
+// Operators retain full control: ?retriever=bm25|dense|hybrid and
+// ?rerank=true|false|1|0 override either default.
+func (s *pebbleHTTP) applyLLMEndpointDefaults(retrieverParam, rerankParam string) (string, bool) {
+	denseReady := s.hnsw != nil && s.embedder != nil
+	if retrieverParam == "" && denseReady {
+		retrieverParam = "hybrid"
+	}
+	wantRerank := s.reranker != nil
+	switch rerankParam {
+	case "false", "0":
+		wantRerank = false
+	case "true", "1":
+		wantRerank = s.reranker != nil
+	}
+	// When the vLLM probe says the backend is queue-deep, silently
+	// disable rerank. Operators can override by passing ?rerank=true
+	// explicitly — but with COSIFT_LLM_DEGRADE_QUEUE breached, the
+	// rerank call would just queue and time out anyway. Better to ship
+	// hybrid scores fast than block on a doomed LLM call.
+	if wantRerank && rerankParam == "" && s.llmProbe != nil && s.llmProbe.Loaded() {
+		wantRerank = false
+	}
+	return retrieverParam, wantRerank
+}
+
+// retrieve dispatches retriever choice (bm25 / dense / hybrid) and
+// then expansion (bare / HyDE / paraphrase+RRF) for BM25 paths. Shared by
+// /search, /answer, /research so all three endpoints get the same retriever
+// matrix. Dense / hybrid require both the loaded HNSW graph and an
+// embedder; missing either falls through to BM25 — warningsFor()
+// surfaces that to the client.
+// applyAuthorityToDense converts HNSW VectorHits into index.Hits with
+// the per-host authority multiplier applied to the score, AND re-sorts
+// the result by the new score so the rank order reflects authority.
+// RRF fusion downstream uses rank position, not raw score, so without
+// the re-sort the multiplier was a no-op (observed: 'What is the C10K
+// problem?' still cited 3 luanjiao.cfd subdomains after applying the
+// multiplier alone). PebbleBM25.Search already multiplies AND sorts
+// internally; this helper mirrors that contract for the dense path.
+func (s *pebbleHTTP) applyAuthorityToDense(vhits []index.VectorHit) []index.Hit {
+	out := make([]index.Hit, len(vhits))
+	for i, vh := range vhits {
+		score := vh.Score
+		if s.authority != nil {
+			score *= s.authority.Multiplier(hostFromURL(vh.URL))
+		}
+		out[i] = index.Hit{URL: vh.URL, Title: vh.Title, Score: score}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Score > out[j].Score })
+	return out
+}
+
+func (s *pebbleHTTP) retrieve(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
+	return s.retrieveWith(ctx, s.idx, q, fetchK, retrieverParam, expandMode)
+}
+
+// retrieveWith is retrieve parameterized over the BM25 index, so callers that
+// need a transformed index (e.g. the site-boosted index from WithBoost) can
+// pass it in without shallow-copying the whole pebbleHTTP (which embeds
+// mutexes — copying it trips go vet's lock-copy check and is unsafe).
+func (s *pebbleHTTP) retrieveWith(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, retrieverParam, expandMode string) ([]index.Hit, string, error) {
+	denseReady := s.hnsw != nil && s.embedder != nil
+	switch {
+	case retrieverParam == "dense" && denseReady:
+		vecs, err := s.embedder.Embed(ctx, []string{q})
+		if err != nil {
+			return nil, "", fmt.Errorf("embedder: %w", err)
+		}
+		vhits := s.hnsw.Search(ctx, vecs[0], fetchK)
+		hits := s.applyAuthorityToDense(vhits)
+		return hits, q, nil
+	case retrieverParam == "hybrid" && denseReady:
+		bm25Hits, bm25Eff, bm25Err := s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
+		if bm25Err != nil {
+			return nil, "", bm25Err
+		}
+		vecs, embErr := s.embedder.Embed(ctx, []string{q})
+		if embErr != nil {
+			return nil, "", fmt.Errorf("embedder: %w", embErr)
+		}
+		denseV := s.hnsw.Search(ctx, vecs[0], fetchK)
+		denseHits := s.applyAuthorityToDense(denseV)
+		hits := rrfFuse([][]index.Hit{bm25Hits, denseHits})
+		if len(hits) > fetchK {
+			hits = hits[:fetchK]
+		}
+		return hits, bm25Eff, nil
+	default:
+		return s.retrieveWithExpansionIdx(ctx, idx, q, fetchK, expandMode)
+	}
+}
+
+// getSiteBoostIDs returns a docID→50× multiplier map for all docs belonging
+// to the given site scopes. Populated lazily on first call; cached in
+// siteBoostCache thereafter. Using the famHost index so the scan is
+// O(site_docs) not O(corpus).
+func (s *pebbleHTTP) getSiteBoostIDs(ctx context.Context, scopes []siteScope) map[int64]float64 {
+	if len(scopes) == 0 || s.store == nil {
+		return nil
+	}
+	key := func() string {
+		parts := make([]string, len(scopes))
+		for i, sc := range scopes {
+			parts[i] = sc.host
+			if sc.path != "" {
+				parts[i] += sc.path
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, "|")
+	}()
+	if cached, ok := s.siteBoostCache.Load(key); ok {
+		return cached.(map[int64]float64)
+	}
+	boost := make(map[int64]float64)
+	for _, sc := range scopes {
+		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
+			boost[id] = 50.0
+			return true
+		})
+	}
+	if len(boost) > 0 {
+		s.siteBoostCache.Store(key, boost)
+	}
+	return boost
+}
+
+// getSiteTitles returns up to maxSiteTitles real page titles from the given
+// site scopes, for injection into the research planner prompt so the LLM sees
+// the site's actual vocabulary. Bounded and cheap: a single early-stopping
+// famHost scan per scope plus <=10 GetDocMeta side-blob lookups. Cached in
+// siteTitleCache thereafter. Returns nil if nothing usable is found.
+func (s *pebbleHTTP) getSiteTitles(ctx context.Context, scopes []siteScope) []string {
+	if len(scopes) == 0 || s.store == nil {
+		return nil
+	}
+	key := func() string {
+		parts := make([]string, len(scopes))
+		for i, sc := range scopes {
+			parts[i] = sc.host
+			if sc.path != "" {
+				parts[i] += sc.path
+			}
+		}
+		sort.Strings(parts)
+		return strings.Join(parts, "|")
+	}()
+	if cached, ok := s.siteTitleCache.Load(key); ok {
+		return cached.([]string)
+	}
+	const maxSiteTitles = 10
+	titles := make([]string, 0, maxSiteTitles)
+	seen := make(map[string]struct{}, maxSiteTitles)
+	for _, sc := range scopes {
+		if len(titles) >= maxSiteTitles {
+			break
+		}
+		_ = s.store.IterHostDocIDs(ctx, sc.host, func(id int64) bool {
+			_, title, ok, err := s.store.GetDocMeta(ctx, id)
+			if err != nil {
+				return false // stop this scope on error
+			}
+			if !ok {
+				return true
+			}
+			t := strings.TrimSpace(title)
+			if t == "" {
+				return true
+			}
+			if _, dup := seen[t]; dup {
+				return true
+			}
+			seen[t] = struct{}{}
+			titles = append(titles, t)
+			return len(titles) < maxSiteTitles // stop once we have 10
+		})
+	}
+	if len(titles) > 0 {
+		s.siteTitleCache.Store(key, titles)
+	}
+	return titles
+}
+
+// hostPartitionReadEnabled reports whether site= queries should route to the
+// 'P'-family host partition via SearchInHost. Gated by
+// COSIFT_HOST_PARTITION_READ=1; off → the 50× boost path is used.
+func hostPartitionReadEnabled() bool {
+	return os.Getenv("COSIFT_HOST_PARTITION_READ") == "1"
+}
+
+// retrieveForSites resolves a site-scoped sub-query. When the host partition
+// is enabled and the scope is a single bare host, it scans only that host's
+// posting partition (O(site_docs)) via SearchInHost — the definitive fix for
+// the global-scan latency + recall problem. Otherwise (multi-site, path-scoped,
+// flag off, or partition not yet backfilled for the host) it falls back to the
+// 50× BM25 boost over the global index.
+func (s *pebbleHTTP) retrieveForSites(ctx context.Context, q string, fetchK int, retrieverParam, expandMode string, boostIDs map[int64]float64, scopes []siteScope) ([]index.Hit, string, error) {
+	if hostPartitionReadEnabled() && len(scopes) == 1 && scopes[0].path == "" && scopes[0].host != "" {
+		hits, err := s.idx.SearchInHost(ctx, q, scopes[0].host, fetchK)
+		if err == nil {
+			return hits, q, nil
+		}
+		if !errors.Is(err, index.ErrHostPartitionEmpty) {
+			return nil, "", err
+		}
+		// partition empty for this host → fall through to the boost path.
+	}
+	if len(boostIDs) == 0 {
+		return s.retrieve(ctx, q, fetchK, retrieverParam, expandMode)
+	}
+	return s.retrieveWith(ctx, s.idx.WithBoost(boostIDs), q, fetchK, retrieverParam, expandMode)
+}
+
+// retrieveWithExpansionIdx dispatches the BM25 call across the three
+// expansion strategies /search and /answer share — bare, HyDE, paraphrase+RRF.
+// Returns (hits, effectiveQuery, err). effectiveQuery == q when no expansion
+// fired (bare path, or expansion no-op'd because chat is down). It is
+// parameterized over the BM25 index so a transformed index (e.g. the
+// site-boosted one from WithBoost) can be passed in without shallow-copying the
+// whole pebbleHTTP struct (which embeds mutexes).
+func (s *pebbleHTTP) retrieveWithExpansionIdx(ctx context.Context, idx *index.PebbleBM25, q string, fetchK int, expandMode string) ([]index.Hit, string, error) {
+	switch expandMode {
+	case "paraphrase":
+		paras := s.paraphraseQuery(ctx, q, 3)
+		if len(paras) == 0 {
+			hits, err := idx.Search(ctx, q, fetchK)
+			return hits, q, err
+		}
+		queries := append([]string{q}, paras...)
+		lists := make([][]index.Hit, 0, len(queries))
+		for _, qq := range queries {
+			h, lerr := idx.Search(ctx, qq, fetchK)
+			if lerr != nil {
+				continue
+			}
+			lists = append(lists, h)
+		}
+		hits := rrfFuse(lists)
+		if len(hits) > fetchK {
+			hits = hits[:fetchK]
+		}
+		return hits, q + " | " + strings.Join(paras, " | "), nil
+	case "true", "hyde":
+		eq := s.expandQuery(ctx, q)
+		hits, err := idx.Search(ctx, eq, fetchK)
+		return hits, eq, err
+	case "entity":
+		// Rule-based query rewrite for question-form entity lookups
+		// ("who created X", "how tall is X", "what is the capital of
+		// X"). Strips the question form, appends canonical-attribute
+		// keywords to the original, single BM25 call. The earlier
+		// RRF-fusion variant regressed legitimate passes because
+		// equal-weight fusion across 4 queries pushed the original's
+		// top hit out of the reranker's top-30. Concat preserves the
+		// original signal while letting the new keywords add positive
+		// scoring contributions where biographical pages exist.
+		rewrites := qexpand.RewriteEntity(q)
+		if len(rewrites) == 0 {
+			hits, err := idx.Search(ctx, q, fetchK)
+			return hits, q, err
+		}
+		expanded := q + " " + strings.Join(rewrites, " ")
+		hits, err := idx.Search(ctx, expanded, fetchK)
+		return hits, expanded, err
+	default:
+		// Bare path runs entity-expansion when the query matches a
+		// question-form pattern. Earlier RRF-fuse experiment regressed
+		// 'who created the World Wide Web' (passing → bail) because
+		// equal-weight fusion across 4 queries pushed the
+		// previously-#1 Berners-Lee bio out of the reranker's top-30.
+		// Concat-into-single-query avoids the fusion-weight problem:
+		// the rewrites only add positive scoring contributions for
+		// pages that contain the canonical-attribute words ("creator,"
+		// "inventor"), without diluting the original query's ranking
+		// signal. Operators can disable with COSIFT_DISABLE_ENTITY_EXPAND=1.
+		if os.Getenv("COSIFT_DISABLE_ENTITY_EXPAND") == "" {
+			if rewrites := qexpand.RewriteEntity(q); len(rewrites) > 0 {
+				expanded := q + " " + strings.Join(rewrites, " ")
+				hits, err := idx.Search(ctx, expanded, fetchK)
+				return hits, expanded, err
+			}
+		}
+		hits, err := idx.Search(ctx, q, fetchK)
+		return hits, q, err
+	}
+}
+
+// expandQuery returns q + " " + a HyDE-generated passage when a chat client is
+// configured. On any error (no chat client, chat call fails, empty passage),
+// returns q unchanged so callers can compose safely without explicit guards.
+// added a bounded in-memory cache to skip the chat call on
+// repeat queries — important for /research?expand=true where the same
+// sub-query rephrasing can fire across many similar research requests.
+func (s *pebbleHTTP) expandQuery(ctx context.Context, q string) string {
+	if s.chat == nil {
+		return q
+	}
+	s.hydeMu.RLock()
+	cached, hit := s.hydeCache[q]
+	s.hydeMu.RUnlock()
+	if hit {
+		s.hydeHits.Add(1)
+		return q + " " + cached
+	}
+	s.hydeMisses.Add(1)
+	passage, err := s.doChat(ctx, s.chat, []embed.ChatMsg{
+		{Role: "system", Content: hydeSystemPrompt},
+		{Role: "user", Content: q},
+	})
+	if err != nil {
+		return q
+	}
+	passage = strings.TrimSpace(passage)
+	if passage == "" {
+		return q
+	}
+	s.hydeMu.Lock()
+	if len(s.hydeCache) >= s.hydeCacheCap {
+		// Bounded: drop one arbitrary entry (Go map range is randomized).
+		for k := range s.hydeCache {
+			delete(s.hydeCache, k)
+			break
+		}
+	}
+	s.hydeCache[q] = passage
+	s.hydeMu.Unlock()
+	return q + " " + passage
+}
+
+// queryPlanPrompt is the LLM-orchestrator prompt. The model
+// analyzes the user's natural-language query, classifies intent, and
+// outputs a structured retrieval plan: expanded queries (3 variations
+// covering different angles), recency window, retriever choice, and
+// optionally a domain allowlist. The plan then drives a broader RRF-
+// fused retrieval. JSON schema is strict; sanity-checked on receive.
+const queryPlanPrompt = `You analyze a user's natural-language search query and output a JSON retrieval plan.
+
+Output ONLY a JSON object (no markdown, no prose, no commentary) with this exact shape:
+{
+  "intent": "current_news" | "factual_lookup" | "comparison" | "research" | "findability",
+  "queries": ["expanded query 1", "expanded query 2", "expanded query 3"],
+  "since_days": null | <positive integer, days lookback from today>,
+  "retriever": "bm25" | "dense" | "hybrid",
+  "decay_days": <positive integer half-life> | null
+}
+
+Guidance:
+- "queries": 3 paraphrases/expansions of the original. Include entity names, synonyms, related terms. e.g. "latest news from Romania" → ["Romania political news 2026", "Romanian government coalition PSD AUR", "Bucharest current events"]
+- "since_days": only set when the query implies recency (latest/current/recent/today/news). null otherwise.
+- "decay_days": half-life in days. For current-events queries use 60. For factual/research queries use null or 365.
+- "retriever": hybrid is the safe default. Use "bm25" only for exact-term lookups (model names, error codes). Use "dense" only for purely conceptual queries with no keyword overlap.
+- DO NOT invent include_domains. The corpus chooses sources, not you.
+
+Examples:
+Input: "latest news from Romania"
+{"intent":"current_news","queries":["Romania political news 2026","Romanian PSD AUR coalition government","Bucharest economy and politics current"],"since_days":90,"retriever":"hybrid","decay_days":60}
+
+Input: "what is BM25 ranking"
+{"intent":"factual_lookup","queries":["BM25 Okapi ranking function formula","BM25 information retrieval probabilistic","term frequency inverse document frequency BM25"],"since_days":null,"retriever":"hybrid","decay_days":null}
+
+Input: "compare HNSW vs IVF"
+{"intent":"comparison","queries":["HNSW vs IVF approximate nearest neighbor","Hierarchical Navigable Small World versus Inverted File","ANN index tradeoffs HNSW IVF performance"],"since_days":null,"retriever":"hybrid","decay_days":730}`
+
+// queryPlan captures the LLM's structured retrieval plan. Sanitized on
+// parse — out-of-range values clipped to safe defaults.
+type queryPlan struct {
+	Intent    string   `json:"intent"`
+	Queries   []string `json:"queries"`
+	SinceDays *int     `json:"since_days"`
+	Retriever string   `json:"retriever"`
+	DecayDays *int     `json:"decay_days"`
+}
+
+// parseQueryPlan extracts the planner's JSON output and applies guard-rails.
+// Returns a plan with sane defaults if the LLM produces garbage — never
+// errors at the caller, so /query always succeeds.
+func parseQueryPlan(raw, original string) queryPlan {
+	defaultPlan := queryPlan{
+		Intent:    "research",
+		Queries:   []string{original},
+		Retriever: "hybrid",
+	}
+	// Strip code fences if the LLM wrapped output despite the prompt.
+	raw = strings.TrimSpace(raw)
+	if strings.HasPrefix(raw, "```") {
+		if i := strings.Index(raw, "\n"); i > 0 {
+			raw = raw[i+1:]
+		}
+		raw = strings.TrimSuffix(raw, "```")
+	}
+	var p queryPlan
+	if err := json.Unmarshal([]byte(raw), &p); err != nil {
+		return defaultPlan
+	}
+	if len(p.Queries) == 0 {
+		p.Queries = []string{original}
+	}
+	if len(p.Queries) > 5 {
+		p.Queries = p.Queries[:5]
+	}
+	switch p.Retriever {
+	case "bm25", "dense", "hybrid":
+		// ok
+	default:
+		p.Retriever = "hybrid"
+	}
+	if p.SinceDays != nil && (*p.SinceDays <= 0 || *p.SinceDays > 3650) {
+		p.SinceDays = nil
+	}
+	if p.DecayDays != nil && (*p.DecayDays <= 0 || *p.DecayDays > 3650) {
+		p.DecayDays = nil
+	}
+	if p.Intent == "" {
+		p.Intent = "research"
+	}
+	return p
+}
+
+// handleQuery is the LLM-orchestrated search/research endpoint.
+// Flow: (1) LLM planner analyzes intent + emits expanded queries, (2) each
+// expansion runs through /search internals (hybrid + decay), (3) RRF-fuse
+// the per-expansion result lists, (4) optional rerank, (5) synth with
+// citations. Returns the plan in the response so callers can see what was
+// done.
+//
+// Effectively: /research planner-style decomposition, but optimized for
+// QUERY EXPANSION not sub-question DECOMPOSITION. The two are different —
+// research splits multi-faceted questions ("compare X and Y" → "X facts",
+// "Y facts", "X vs Y tradeoffs"); query expands a single intent into
+// paraphrases that catch corpus phrasing variation.
+func (s *pebbleHTTP) handleQuery(w http.ResponseWriter, r *http.Request) {
+	if s.chat == nil {
+		writeProblem(w, http.StatusNotImplemented, "/query requires cfg.Chat.Model")
+		return
+	}
+	start := time.Now()
+	q := r.URL.Query().Get("q")
+	if q == "" {
+		writeProblem(w, http.StatusBadRequest, "missing q parameter")
+		return
+	}
+
+	// SSE opt-in. Stream phase events through the planner → expand → fuse
+	// → synth pipeline so operators see the LLM's sub-queries, per-expansion
+	// hit counts, fusion result, and synth tokens as they're produced.
+	wantStream := wantsSSE(r)
+	var sse *answerSSE
+	var streamChat embed.StreamingChatClient
+	if wantStream {
+		if sc, ok := s.chat.(embed.StreamingChatClient); ok {
+			if a := newAnswerSSE(w, start); a != nil {
+				sse, streamChat = a, sc
+				stopKA := sse.startKeepalive(r.Context(), 7*time.Second)
+				defer stopKA()
+				sse.phase("plan_start", map[string]any{"q": q, "model": s.chat.Model()})
+			}
+		}
+	}
+
+	// Step 1: LLM planner.
+	planRaw, err := s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+		{Role: "system", Content: queryPlanPrompt},
+		{Role: "user", Content: q},
+	})
+	if err != nil {
+		if sse != nil {
+			sse.errorEvt("plan: " + err.Error())
+			return
+		}
+		writeProblem(w, http.StatusBadGateway, "plan: "+err.Error())
+		return
+	}
+	plan := parseQueryPlan(planRaw, q)
+	if sse != nil {
+		details := map[string]any{
+			"intent":    plan.Intent,
+			"retriever": plan.Retriever,
+			"queries":   plan.Queries,
+		}
+		if plan.SinceDays != nil {
+			details["since_days"] = *plan.SinceDays
+		}
+		if plan.DecayDays != nil {
+			details["decay_days"] = *plan.DecayDays
+		}
+		sse.phase("plan", details)
+	}
+
+	// Step 2: run each expanded query through retrieval, dedupe by URL.
+	type hitInfo struct {
+		hit    index.Hit
+		bestRR float64 // best reciprocal rank across expansions
+	}
+	byURL := make(map[string]*hitInfo, 64)
+	fetchK := 30
+	for _, sub := range plan.Queries {
+		hits, _, err := s.retrieve(r.Context(), sub, fetchK, plan.Retriever, "")
+		if err != nil {
+			if sse != nil {
+				sse.phase("expand", map[string]any{"query": sub, "error": err.Error()})
+			}
+			continue
+		}
+		for rank, h := range hits {
+			rr := 1.0 / float64(60+rank) // RRF with k=60
+			if existing, ok := byURL[h.URL]; ok {
+				if rr > existing.bestRR {
+					existing.bestRR = rr
+				}
+			} else {
+				byURL[h.URL] = &hitInfo{hit: h, bestRR: rr}
+			}
+		}
+		if sse != nil {
+			sse.phase("expand", map[string]any{"query": sub, "hits": len(hits)})
+		}
+	}
+
+	// Step 3: sort by fused RRF score with optional per-host boosts.
+	fused := make([]index.Hit, 0, len(byURL))
+	for _, v := range byURL {
+		h := v.hit
+		h.Score = v.bestRR
+		if len(s.hostBoosts) > 0 {
+			h.Score *= index.HostBoostFor(h.URL, s.hostBoosts)
+		}
+		fused = append(fused, h)
+	}
+	sort.Slice(fused, func(i, j int) bool { return fused[i].Score > fused[j].Score })
+	if sse != nil {
+		sse.phase("fuse", map[string]any{"unique_urls": len(fused)})
+	}
+
+	// Step 4: optional since filter + decay (decay handled by /answer-style
+	// path when we materialize). Apply since filter here on PublishedAt.
+	keep := 10
+	if v := r.URL.Query().Get("k"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 20 {
+			keep = n
+		}
+	}
+	var since time.Time
+	if plan.SinceDays != nil {
+		since = time.Now().AddDate(0, 0, -(*plan.SinceDays))
+	}
+
+	// Step 5: enrich + filter by since.
+	type cand struct {
+		src     answerSource
+		excerpt string
+		text    string
+	}
+	cands := make([]cand, 0, keep)
+	for _, h := range fused {
+		if len(cands) >= keep {
+			break
+		}
+		doc, err := s.store.GetDocByURL(r.Context(), h.URL)
+		if err != nil || doc == nil {
+			continue
+		}
+		if !since.IsZero() && (doc.PublishedAt.IsZero() || doc.PublishedAt.Before(since)) {
+			continue
+		}
+		c := cand{
+			src: answerSource{
+				ID:    len(cands) + 1,
+				URL:   h.URL,
+				Title: h.Title,
+			},
+			excerpt: textExcerpt(doc.Text, 320),
+			text:    doc.Text,
+		}
+		if !doc.PublishedAt.IsZero() {
+			t := doc.PublishedAt
+			c.src.PublishedAt = &t
+		}
+		cands = append(cands, c)
+	}
+	if sse != nil {
+		sse.phase("materialize", map[string]any{"candidates": len(cands)})
+	}
+
+	// Step 6: synth via answerSystemPrompt.
+	var promptSrcs strings.Builder
+	sources := make([]answerSource, 0, len(cands))
+	for i, c := range cands {
+		c.src.ID = i + 1
+		c.src.Excerpt = c.excerpt
+		fmt.Fprintf(&promptSrcs, "[%d] %s\n%s\n\n", c.src.ID, c.src.URL, truncateForPromptLite(c.text, 1200))
+		sources = append(sources, c.src)
+	}
+
+	if sse != nil {
+		sse.sources(q, sources, s.chat.Model(), "query:planner+hybrid+rrf", len(fused))
+		if len(cands) == 0 {
+			sse.chunk("No sources matched the planner's expanded queries within the chosen time window.")
+			sse.done()
+			return
+		}
+		sse.phase("synth_start", map[string]any{"sources": len(sources), "model": streamChat.Model()})
+		_, cerr := s.doChatStream(r.Context(), streamChat, []embed.ChatMsg{
+			{Role: "system", Content: answerSystemPrompt},
+			{Role: "user", Content: "Sources:\n\n" + promptSrcs.String() + "Question: " + q},
+		}, sse.chunk)
+		if cerr != nil {
+			sse.errorEvt("synth: " + cerr.Error())
+			return
+		}
+		sse.done()
+		return
+	}
+
+	answerText := ""
+	if len(cands) > 0 {
+		answerText, err = s.doChat(r.Context(), s.chat, []embed.ChatMsg{
+			{Role: "system", Content: answerSystemPrompt},
+			{Role: "user", Content: "Sources:\n\n" + promptSrcs.String() + "Question: " + q},
+		})
+		if err != nil {
+			writeProblem(w, http.StatusBadGateway, "synth: "+err.Error())
+			return
+		}
+	} else {
+		answerText = "No sources matched the planner's expanded queries within the chosen time window."
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"query":   q,
+		"plan":    plan,
+		"answer":  answerText,
+		"sources": sources,
+		"model":   s.chat.Model(),
+		"took":    time.Since(start).String(),
+	})
+}
+
+func (s *pebbleHTTP) handleContents(w http.ResponseWriter, r *http.Request) {
+	rawURL := r.URL.Query().Get("url")
+	if rawURL == "" {
+		writeProblem(w, http.StatusBadRequest, "missing url parameter")
+		return
+	}
+	decoded, err := url.QueryUnescape(rawURL)
+	if err != nil {
+		writeProblem(w, http.StatusBadRequest, "url parameter is not URL-encoded")
+		return
+	}
+	doc, err := s.store.GetDocByURL(r.Context(), decoded)
+	if errors.Is(err, store.ErrNotFound) {
+		writeProblem(w, http.StatusNotFound, "url not in index")
+		return
+	}
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"url":          doc.URL,
+		"title":        doc.Title,
+		"text":         doc.Text,
+		"author":       doc.Author,
+		"published_at": doc.PublishedAt,
+		"fetched_at":   doc.FetchedAt,
+	})
+}
+
+// POST /contents — batch URL → document. Up to 100 URLs in
+// one round-trip. URLs not in the index emit a {url, found:false, error}
+// stub in the same slot so the caller can correlate positionally. Wire
+// shape (results+took, per-item found+cached+lang) mirrors the SQLite-side
+// /contents POST so `cosift contents <url> <url>` works against either
+// backend without code changes.
+type contentsBatchReq struct {
+	URLs []string `json:"urls"`
+}
+
+type contentsBatchItem struct {
+	URL         string    `json:"url"`
+	Found       bool      `json:"found"`
+	Title       string    `json:"title,omitempty"`
+	Text        string    `json:"text,omitempty"`
+	Lang        string    `json:"lang,omitempty"`
+	Cached      bool      `json:"cached"`
+	Author      string    `json:"author,omitempty"`
+	PublishedAt time.Time `json:"published_at,omitempty"`
+	FetchedAt   time.Time `json:"fetched_at,omitempty"`
+	Error       string    `json:"error,omitempty"`
+}
+
+func (s *pebbleHTTP) handleContentsBatch(w http.ResponseWriter, r *http.Request) {
+	start := time.Now()
+	var req contentsBatchReq
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&req); err != nil {
+		writeProblem(w, http.StatusBadRequest, "invalid JSON body: "+err.Error())
+		return
+	}
+	if len(req.URLs) == 0 {
+		writeProblem(w, http.StatusBadRequest, "urls: must be a non-empty array")
+		return
+	}
+	if len(req.URLs) > 100 {
+		writeProblem(w, http.StatusBadRequest, "urls: at most 100 per request")
+		return
+	}
+	results := make([]contentsBatchItem, 0, len(req.URLs))
+	for _, u := range req.URLs {
+		item := contentsBatchItem{URL: u}
+		doc, err := s.store.GetDocByURL(r.Context(), u)
+		switch {
+		case errors.Is(err, store.ErrNotFound):
+			item.Error = "not in index"
+		case err != nil:
+			item.Error = err.Error()
+		case doc == nil:
+			item.Error = "not in index"
+		default:
+			item.Found = true
+			item.Cached = true
+			item.Title = doc.Title
+			item.Text = doc.Text
+			item.Lang = doc.Lang
+			item.Author = doc.Author
+			item.PublishedAt = doc.PublishedAt
+			item.FetchedAt = doc.FetchedAt
+		}
+		results = append(results, item)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"results": results,
+		"took":    time.Since(start).String(),
+	})
+}
diff --git a/cmd/cosift/serve_setup.go b/cmd/cosift/serve_setup.go
new file mode 100644
index 0000000..cf29525
--- /dev/null
+++ b/cmd/cosift/serve_setup.go
@@ -0,0 +1,1396 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"net/http/pprof"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/crawler"
+
+	"github.com/pilot-protocol/cosift/internal/answercache"
+	"github.com/pilot-protocol/cosift/internal/authority"
+	"github.com/pilot-protocol/cosift/internal/chatgate"
+	"github.com/pilot-protocol/cosift/internal/config"
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/index"
+	"github.com/pilot-protocol/cosift/internal/rerank"
+	"github.com/pilot-protocol/cosift/internal/sla"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) error {
+	fs := flag.NewFlagSet("pebble-serve", flag.ExitOnError)
+	dir := fs.String("dir", "", "PebbleStore directory (required; the SQLite cfg.DataDir is ignored)")
+	addr := fs.String("addr", cfg.Server.Addr, "listen address (defaults to server.addr from cosift.json)")
+	// -crawl-seeds-file lets pebble-serve run an in-process crawler
+	// against the same PebbleStore. Eliminates the writer-lock dance between
+	// cosift-serve and cosift-crawl — search + crawl + index growth all in one
+	// process, one binary, one lock. The crawler runs as a goroutine for the
+	// lifetime of the server.
+	crawlSeeds := fs.String("crawl-seeds-file", "", "if set, run a continuous in-process crawler against these seeds while serving")
+	crawlCheckpoint := fs.Duration("crawl-checkpoint", 60*time.Second, "HNSW persist cadence for the in-serve crawler")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *dir == "" {
+		return errors.New("pebble-serve: -dir is required")
+	}
+	if *addr == "" {
+		*addr = "127.0.0.1:7777"
+	}
+
+	ps, err := store.OpenPebble(*dir)
+	if err != nil {
+		return fmt.Errorf("open pebble: %w", err)
+	}
+	defer ps.Close()
+
+	// log corpus size at startup so operators see whether the
+	// store opened with the expected doc count (silent open would force them
+	// to curl /stats just to confirm a restart loaded the right data dir).
+	if _, indexedDocs, err := ps.CorpusStats(ctx); err == nil && indexedDocs > 0 {
+		log.Printf("pebble-serve: opened store with %d indexed docs", indexedDocs)
+	}
+
+	// Meta is 20 bytes (dim+nodeCount); first-entry probe is the fallback
+	// when meta is absent but vector entries exist (partial persist).
+	// We never load the full graph here — gigabytes of RAM at 10M-vector scale.
+	hasVectors := false
+	var vectorDim, vectorNodes int
+	if meta, ok, err := index.LoadHNSWMeta(ctx, ps); err == nil && ok {
+		hasVectors = true
+		vectorDim = meta.Dim
+		vectorNodes = meta.NodeCount
+	} else {
+		_ = ps.IterateVectorNodes(ctx, func(_ uint64, _ []byte) bool {
+			hasVectors = true
+			return false
+		})
+	}
+	// Loading is
+	// gigabytes of RAM at production scale (10M vectors × 1536 dim ≈ 60GB),
+	// so it's opt-in. When the env var isn't set we just keep the cheap meta
+	// snapshot from and operators see has_vectors=true.
+	var hnswGraph *index.HNSW
+	if hasVectors && os.Getenv("COSIFT_LOAD_HNSW") == "true" {
+		g, ok, err := index.LoadHNSW(ctx, ps)
+		switch {
+		case err != nil:
+			log.Printf("pebble-serve: COSIFT_LOAD_HNSW=true but LoadHNSW failed: %v", err)
+		case !ok:
+			log.Printf("pebble-serve: COSIFT_LOAD_HNSW=true but no HNSW meta on store")
+		default:
+			hnswGraph = g
+			log.Printf("pebble-serve: HNSW graph loaded into memory: %d nodes, dim=%d", g.Len(), vectorDim)
+			// Default 50 from NewHNSW
+			// underfits big graphs grown via AddPassage; raising to ~200
+			// restored Recall@10 from 0.47 to ~0.85 on the 800K-vector
+			// production corpus without a graph rebuild.
+			if v := os.Getenv("COSIFT_HNSW_EF_SEARCH"); v != "" {
+				if n, err := strconv.Atoi(v); err == nil && n > 0 {
+					g.SetEfSearch(n)
+					log.Printf("pebble-serve: HNSW efSearch override = %d", n)
+				}
+			}
+			// if a PQ codebook + codes exist in this store, wire
+			// them so /search uses asymmetric PQ distance (much faster on
+			// large graphs). When absent, search falls back to raw vectors.
+			//
+			// bench-pq exposed that PQ on this dim=768 corpus drops
+			// Recall@10 from ~0.89 to ~0.60 — the 32× compression has a
+			// recall cost that may exceed the speed benefit. Operators can
+			// keep the codes on disk but disable the runtime path by setting
+			// COSIFT_DISABLE_PQ=true.
+			if os.Getenv("COSIFT_DISABLE_PQ") == "true" {
+				log.Printf("pebble-serve: PQ disabled via COSIFT_DISABLE_PQ — using raw vectors for search")
+			} else if cb, cbOK, _ := index.LoadPQCodebook(ctx, ps); cbOK {
+				codes := make([][]uint16, g.Len())
+				loaded := 0
+				if err := ps.IteratePQCodes(ctx, func(nodeID uint64, blob []byte) bool {
+					if int(nodeID) >= len(codes) {
+						return true
+					}
+					// codebook-aware decode handles both byte-packed
+					// (new, K≤256) and uint16 LE (legacy) blob shapes.
+					code, err := cb.DecodeCodeBlob(blob)
+					if err != nil || len(code) != cb.M {
+						return true
+					}
+					codes[int(nodeID)] = code
+					loaded++
+					return true
+				}); err != nil {
+					log.Printf("pebble-serve: PQ codes iterate failed: %v — falling back to raw vectors", err)
+				} else {
+					g.UsePQ(cb, codes)
+					log.Printf("pebble-serve: PQ search enabled (codebook: dim=%d M=%d K=%d, codes=%d/%d)",
+						cb.Dim, cb.M, cb.K, loaded, g.Len())
+				}
+			}
+		}
+	}
+	if hasVectors {
+		if vectorNodes > 0 {
+			suffix := "(graph not loaded into memory; set COSIFT_LOAD_HNSW=true to load)"
+			if hnswGraph != nil {
+				suffix = "(graph loaded)"
+			}
+			log.Printf("pebble-serve: HNSW index present: %d nodes, dim=%d %s", vectorNodes, vectorDim, suffix)
+		} else {
+			log.Printf("pebble-serve: HNSW vector entries present (no meta blob — partial persist?)")
+		}
+	}
+
+	// configurable HyDE + paraphrase cache caps (defaults 256).
+	hydeCap := 256
+	if v := os.Getenv("COSIFT_HYDE_CACHE_SIZE"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			hydeCap = n
+			log.Printf("pebble-serve: HyDE cache size override = %d", n)
+		} else {
+			// surface unparseable env vars as warnings at startup
+			// instead of silently keeping defaults. Catches typos like
+			// COSIFT_HYDE_CACHE_SIZE="512m" or negative values.
+			log.Printf("pebble-serve: WARN COSIFT_HYDE_CACHE_SIZE=%q is not a positive integer — using default %d", v, hydeCap)
+		}
+	}
+	paraCap := 256
+	if v := os.Getenv("COSIFT_PARA_CACHE_SIZE"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			paraCap = n
+			log.Printf("pebble-serve: paraphrase cache size override = %d", n)
+		} else {
+			log.Printf("pebble-serve: WARN COSIFT_PARA_CACHE_SIZE=%q is not a positive integer — using default %d", v, paraCap)
+		}
+	}
+	idx := index.NewPebbleBM25(ps)
+	// Wikipedia / kernel.org / arxiv float
+	// above spam directories in the long tail. Optional Tranco /
+	// Majestic CSVs at COSIFT_TRANCO_CSV / COSIFT_MAJESTIC_CSV improve
+	// the score; with no CSVs the embedded whitelist + TLD heuristics
+	// still produce useful signals.
+	scorer := authority.New()
+	if v := os.Getenv("COSIFT_AUTHORITY_ALPHA"); v != "" {
+		if a, err := strconv.ParseFloat(v, 64); err == nil && a >= 0 {
+			scorer = scorer.WithAlpha(a)
+		}
+	}
+	if path := os.Getenv("COSIFT_TRANCO_CSV"); path != "" {
+		if f, err := os.Open(path); err == nil {
+			n, _ := scorer.LoadTranco(f)
+			_ = f.Close()
+			log.Printf("pebble-serve: authority Tranco loaded (%d entries from %s)", n, path)
+		} else {
+			log.Printf("pebble-serve: WARN COSIFT_TRANCO_CSV=%q: %v", path, err)
+		}
+	}
+	if path := os.Getenv("COSIFT_MAJESTIC_CSV"); path != "" {
+		if f, err := os.Open(path); err == nil {
+			n, _ := scorer.LoadMajestic(f)
+			_ = f.Close()
+			log.Printf("pebble-serve: authority Majestic loaded (%d entries from %s)", n, path)
+		} else {
+			log.Printf("pebble-serve: WARN COSIFT_MAJESTIC_CSV=%q: %v", path, err)
+		}
+	}
+	idx = idx.WithAuthority(scorer)
+	log.Printf("pebble-serve: authority scoring enabled (alpha=%.2f, trusted=%d, tranco=%d, majestic=%d)",
+		scorer.Alpha(), scorer.Stats().TrustedHosts, scorer.Stats().TrancoEntries, scorer.Stats().MajesticEntries)
+	// COSIFT_BM25_K1 / COSIFT_BM25_B override per instance.
+	// Shared with runQuery via applyBM25EnvOverrides so any PebbleBM25 built
+	// from CLI or server honors the same env.
+	o := applyBM25EnvOverrides(idx)
+	if o.k1Set {
+		log.Printf("pebble-serve: BM25 k1 override = %.2f", o.k1Val)
+	}
+	if o.bSet {
+		log.Printf("pebble-serve: BM25 b override = %.2f", o.bVal)
+	}
+	if o.k1Bad != "" {
+		log.Printf("pebble-serve: WARN COSIFT_BM25_K1=%q is not a positive float — using default %.2f", o.k1Bad, idx.K1())
+	}
+	if o.bBad != "" {
+		log.Printf("pebble-serve: WARN COSIFT_BM25_B=%q is not a positive float — using default %.2f", o.bBad, idx.B())
+	}
+	srv := &pebbleHTTP{
+		store:        ps,
+		idx:          idx,
+		hydeCache:    make(map[string]string, hydeCap),
+		hydeCacheCap: hydeCap,
+		paraCache:    make(map[string][]string, paraCap),
+		paraCacheCap: paraCap,
+		hasVectors:   hasVectors,
+		vectorDim:    vectorDim,
+		vectorNodes:  vectorNodes,
+		hnsw:         hnswGraph,
+		started:      time.Now(),
+		authority:    scorer,
+		// capture doc count at startup so /stats can compute
+		// per-minute crawl rate without long-term counters.
+		startupDocs: vectorNodes, // placeholder; overwritten below
+	}
+	// Read actual doc count at startup for crawl-rate baseline. Uses
+	// CorpusStats (the atomic-mirror indexed_docs counter) — NOT
+	// Stats.Documents which scans the raw 'd' family. The two diverge
+	// in two ways:
+	//
+	//   - Stats.Documents may include partially-upserted rows that the
+	//     indexed_docs counter hasn't seen yet, leaving startupDocs >
+	//     indexedDocs and freezing docs_added_since_start at 0 forever.
+	//   - On a cold corpus, Stats does a 12s scan that returns the
+	//     count AT END-OF-SCAN, by which time the crawler has already
+	//     added 50+ more docs, pushing startupDocs above the post-boot
+	//     indexed_docs atomic.
+	//
+	// CorpusStats reads the atomic directly (or bootstraps it from the
+	// indexed_docs meta key on first call), giving an exact match with
+	// the indexedDocs value the rate calc uses below.
+	if _, count, err := ps.CorpusStats(ctx); err == nil && count > 0 {
+		srv.startupDocs = int(count)
+	} else {
+		srv.startupDocs = 0
+	}
+	// stamp cluster config onto srv early so /search's
+	// gateway-mode check fires even on nodes that don't run a crawler.
+	if err := cfg.Cluster.Validate(); err != nil {
+		log.Printf("pebble-serve: cluster config invalid (%v) — running single-node", err)
+	} else {
+		srv.cluster = cfg.Cluster
+		if cfg.Cluster.IsClustered() {
+			role := "leaf"
+			if cfg.Cluster.GatewayMode {
+				role = "gateway+leaf"
+			}
+			log.Printf("pebble-serve: cluster mode (role=%s, shard=%d/%d, peers=%d)",
+				role, cfg.Cluster.MyShardID, cfg.Cluster.NumShards, len(cfg.Cluster.Peers))
+		}
+	}
+	// Uses the same OpenAI-compatible chat
+	// client the SQLite-side server uses; works against OpenAI, Together,
+	// Azure, llama.cpp, vLLM, Ollama, anything speaking /v1/chat/completions.
+	// anonymous auth when cfg.Chat.URL is set (self-hosted, no key
+	// needed). Required only for hosted defaults (empty URL = api.openai.com).
+	// Shared between answer + rerank pools so an
+	// /answer burst can't also exhaust the rerank pool's goroutines.
+	srv.chatGate = chatgate.New(
+		envIntDefault("COSIFT_LLM_GATE_RERANK", 8),
+		envIntDefault("COSIFT_LLM_GATE_ANSWER", 4),
+	)
+	// /answer response cache. Default TTL 60s + 1024-entry cap is a
+	// reasonable starting point for a workload with a few hundred
+	// recurring queries; raise via COSIFT_ANSWER_CACHE_TTL_SEC for
+	// stable corpora, disable with =0 if every query is unique.
+	srv.answerCache = answercache.New(
+		time.Duration(envIntDefault("COSIFT_ANSWER_CACHE_TTL_SEC", 60))*time.Second,
+		envIntDefault("COSIFT_ANSWER_CACHE_CAP", 1024),
+	)
+	srv.researchCache = answercache.New(
+		time.Duration(envIntDefault("COSIFT_RESEARCH_CACHE_TTL_SEC", 600))*time.Second,
+		envIntDefault("COSIFT_RESEARCH_CACHE_CAP", 256),
+	)
+	// Query log (observability). COSIFT_QUERY_LOG=/path enables JSONL append
+	// of every query-endpoint request. Disabled if unset.
+	if qp := os.Getenv("COSIFT_QUERY_LOG"); qp != "" {
+		if f, err := os.OpenFile(qp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
+			srv.qlogFile = f
+			log.Printf("pebble-serve: query log enabled → %s", qp)
+		} else {
+			log.Printf("pebble-serve: query log open failed (%s): %v", qp, err)
+		}
+	}
+	// Feedback rate limiter — always on (stricter than global). Per-client via
+	// XFF. Override COSIFT_FEEDBACK_RPM / _BURST.
+	srv.fbRL = &rateLimiter{
+		rpm:       float64(envIntDefault("COSIFT_FEEDBACK_RPM", 20)),
+		burst:     float64(envIntDefault("COSIFT_FEEDBACK_BURST", 5)),
+		whitelist: map[string]bool{},
+	}
+	// Feedback log. COSIFT_FEEDBACK_LOG=/path, or defaults beside the query log.
+	if fp := feedbackLogPath(); fp != "" {
+		if f, err := os.OpenFile(fp, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644); err == nil {
+			srv.fbFile = f
+			log.Printf("pebble-serve: feedback log enabled → %s", fp)
+		} else {
+			log.Printf("pebble-serve: feedback log open failed (%s): %v", fp, err)
+		}
+	}
+	// Tries the vLLM /metrics endpoint at the chat origin (works for
+	// self-hosted vLLM, no-op against OpenAI). Threshold default 8 — that
+	// matches the answer-pool cap so when the chat backend is already
+	// saturated we stop trying to add more LLM work.
+	if cfg.Chat.URL != "" {
+		probeURL := chatgate.VLLMMetricsURLFrom(cfg.Chat.URL)
+		threshold := envIntDefault("COSIFT_LLM_DEGRADE_QUEUE", 8)
+		interval := envDurationMsDefault("COSIFT_LLM_PROBE_MS", 2*time.Second)
+		srv.llmProbe = chatgate.NewLoadProbe(probeURL, threshold, interval)
+		go srv.llmProbe.Run(ctx)
+		log.Printf("pebble-serve: vLLM load probe started (url=%s, threshold=%d, interval=%s)", probeURL, threshold, interval)
+	}
+	// Defaults match the
+	// June-3 baseline measurements; ops can override per env. Violation
+	// log defaults under cfg.DataDir so it co-locates with the rest of
+	// the operational state.
+	slaLogPath := os.Getenv("COSIFT_SLA_LOG_PATH")
+	if slaLogPath == "" && cfg.DataDir != "" {
+		slaLogPath = filepath.Join(cfg.DataDir, "sla-violations.jsonl")
+	}
+	slaTargets := []sla.Target{
+		{Endpoint: "/search", P95: envDurationMsDefault("COSIFT_SLA_SEARCH_P95_MS", 1500*time.Millisecond), P99: envDurationMsDefault("COSIFT_SLA_SEARCH_P99_MS", 4*time.Second), MaxErrorRate: 0.02},
+		{Endpoint: "/answer", P95: envDurationMsDefault("COSIFT_SLA_ANSWER_P95_MS", 8*time.Second), P99: envDurationMsDefault("COSIFT_SLA_ANSWER_P99_MS", 20*time.Second), MaxErrorRate: 0.05},
+		{Endpoint: "/research", P95: envDurationMsDefault("COSIFT_SLA_RESEARCH_P95_MS", 30*time.Second), P99: envDurationMsDefault("COSIFT_SLA_RESEARCH_P99_MS", 60*time.Second), MaxErrorRate: 0.05},
+		{Endpoint: "/healthz", P95: 50 * time.Millisecond, P99: 200 * time.Millisecond, MaxErrorRate: 0.01},
+		{Endpoint: "/stats", P95: 200 * time.Millisecond, P99: time.Second, MaxErrorRate: 0.01},
+	}
+	slaWindow := envDurationMsDefault("COSIFT_SLA_WINDOW_MS", 5*time.Minute)
+	slaEvalInterval := envDurationMsDefault("COSIFT_SLA_EVAL_MS", 30*time.Second)
+	if m, err := sla.New(slaTargets, slaWindow, slaLogPath); err == nil {
+		srv.sla = m
+		go srv.sla.Run(ctx.Done(), slaEvalInterval)
+		log.Printf("pebble-serve: SLA monitor started (window=%s, eval=%s, log=%s)", slaWindow, slaEvalInterval, slaLogPath)
+	} else {
+		log.Printf("pebble-serve: SLA monitor disabled: %v", err)
+	}
+	// Holds the unwrapped OpenAIChatClient so the rerank
+	// wrapper below can sit directly on top of the inner client (single
+	// gate acquisition per call) instead of stacking on srv.chatSafe.
+	var rawChatForRerank embed.ChatClient
+	if cfg.Chat.Model != "" {
+		apiKey := resolveAPIKey("chat")
+		rawChat := embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Chat.Model)
+		rawChatForRerank = rawChat
+		srv.chatSafe = chatgate.NewSafeChat(rawChat, chatgate.Options{
+			Gate:          srv.chatGate,
+			Kind:          chatgate.KindAnswer,
+			StageDeadline: envDurationMsDefault("COSIFT_LLM_DEADLINE_ANSWER_MS", 30*time.Second),
+			MaxRetries:    envIntDefault("COSIFT_LLM_RETRIES", 1),
+		})
+		srv.chat = srv.chatSafe
+		auth := "anonymous"
+		if apiKey != "" {
+			auth = "bearer-token"
+		}
+		st := srv.chatGate.Stats()
+		log.Printf("pebble-serve: /answer enabled (chat model=%s, auth=%s, gate=answer:%d/rerank:%d)",
+			cfg.Chat.Model, auth, st.AnswerCap, st.RerankCap)
+	}
+	// Same anonymous-when-URL
+	// semantics as chat above.
+	if cfg.Embeddings.Model != "" {
+		apiKey := resolveAPIKey("embed")
+		// when cfg.Embeddings.URLs is set, build one client per
+		// URL and wrap them in a RoundRobinEmbedder so cosift fans embed
+		// requests across multiple backends. Falls back to single-URL
+		// behavior when URLs is empty.
+		urls := cfg.Embeddings.URLs
+		if len(urls) == 0 {
+			urls = []string{cfg.Embeddings.URL}
+		}
+		clients := make([]embed.Embedder, 0, len(urls))
+		for _, u := range urls {
+			clients = append(clients, embed.NewOpenAIClient(apiKey, u, cfg.Embeddings.Model, cfg.Embeddings.Dim))
+		}
+		var base embed.Embedder = embed.NewRoundRobinEmbedder(clients)
+		// Both search and
+		// crawler embed paths share the cache layer — same text returns
+		// instantly on re-fetch / re-query, no ollama call.
+		cacheNote := ""
+		if cfg.Embeddings.CacheDir != "" {
+			base = embed.NewCachedEmbedder(base, cfg.Embeddings.CacheDir)
+			cacheNote = fmt.Sprintf(", cache=%s", cfg.Embeddings.CacheDir)
+		}
+		srv.embedder = base
+		auth := "anonymous"
+		if apiKey != "" {
+			auth = "bearer-token"
+		}
+		log.Printf("pebble-serve: embedder configured (model=%s, dim=%d, auth=%s, backends=%d%s)",
+			cfg.Embeddings.Model, cfg.Embeddings.Dim, auth, len(clients), cacheNote)
+	}
+	// wire rerank.Reranker when cfg.Rerank is configured. Two paths
+	// (matching the SQLite-side): cfg.Rerank.URL → HTTPReranker (Cohere/Voyage/
+	// Jina/TEI wire shape); otherwise cfg.Chat.Model present → LLMReranker
+	// (RankGPT-style listwise via chat). /search?rerank=true gates the wrapper.
+	if cfg.Rerank.URL != "" {
+		apiKey := cfg.Rerank.APIKey
+		if apiKey == "" {
+			apiKey = os.Getenv("COHERE_API_KEY")
+			if apiKey == "" {
+				apiKey = os.Getenv("VOYAGE_API_KEY")
+			}
+		}
+		srv.reranker = rerank.NewHTTPReranker(cfg.Rerank.URL, apiKey, cfg.Rerank.Model)
+		log.Printf("pebble-serve: rerank enabled (http: %s, model=%s)", cfg.Rerank.URL, cfg.Rerank.Model)
+	} else if cfg.Rerank.Enabled && srv.chat != nil {
+		// when cfg.Rerank.Model is set and differs from cfg.Chat.Model,
+		// build a separate chat client for rerank pointing at the same /v1 URL
+		// but with the alternate model. Lets operators dedicate a small/fast
+		// model (e.g. qwen3.5:0.8b) to rerank so it doesn't queue behind chat
+		// generations on the same model. Falls back to the main chat client
+		// when Rerank.Model is empty or equal to Chat.Model.
+		var rerankInner embed.ChatClient = rawChatForRerank
+		if cfg.Rerank.Model != "" && cfg.Rerank.Model != cfg.Chat.Model {
+			apiKey := resolveAPIKey("chat")
+			rerankInner = embed.NewOpenAIChat(apiKey, cfg.Chat.URL, cfg.Rerank.Model)
+			log.Printf("pebble-serve: rerank using dedicated chat (model=%s, url=%s)", cfg.Rerank.Model, cfg.Chat.URL)
+		}
+		srv.rerankSafe = chatgate.NewSafeChat(rerankInner, chatgate.Options{
+			Gate:          srv.chatGate,
+			Kind:          chatgate.KindRerank,
+			StageDeadline: envDurationMsDefault("COSIFT_LLM_DEADLINE_RERANK_MS", 5*time.Second),
+			MaxRetries:    envIntDefault("COSIFT_LLM_RETRIES", 1),
+		})
+		srv.reranker = rerank.NewLLMReranker(srv.rerankSafe)
+		log.Printf("pebble-serve: rerank enabled (llm: %s, gated)", srv.rerankSafe.Model())
+	}
+	srv.rerankCandK = cfg.Rerank.CandidateK
+	if srv.rerankCandK <= 0 {
+		srv.rerankCandK = 20
+	}
+	srv.hostBoosts = cfg.Defaults.HostBoosts
+
+	mux := http.NewServeMux()
+	// Built once from env;
+	// nil when disabled (COSIFT_RATELIMIT_RPM unset or 0). Wraps every route
+	// below — including /healthz so monitoring hits are budgeted too;
+	// operators wanting unlimited probes should set
+	// COSIFT_RATELIMIT_WHITELIST to include their monitoring source.
+	srv.rl = newRateLimiterFromEnv()
+	if srv.rl != nil {
+		log.Printf("pebble-serve: rate limit active (rpm=%.0f burst=%.0f whitelist=%v)", srv.rl.rpm, srv.rl.burst, srv.rl.whitelistList())
+	}
+	wrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(h)) }
+	// qwrap adds query logging (innermost, so it sees the real status+bytes) for
+	// the user-facing query endpoints — the observability substrate we lacked.
+	qwrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(srv.qlog(h))) }
+	// landing page at / and OpenAPI 3.1 spec at /openapi.json.
+	// Both embedded into the binary at build time — operators get a single
+	// self-contained executable, no separate static-asset deployment.
+	mux.HandleFunc("GET /", wrap(srv.handleLanding))
+	// Streams /answer or /research SSE
+	// into a multi-turn conversation view with citation rendering.
+	mux.HandleFunc("GET /chat", wrap(srv.handleChat))
+	mux.HandleFunc("GET /openapi.json", wrap(srv.handleOpenAPI))
+	// Swagger UI bundled into the binary. /docs renders the
+	// interactive spec; /docs/swagger-ui.css and /docs/swagger-ui-bundle.js
+	// serve the dist assets locally so the page works air-gapped (no CDN).
+	mux.HandleFunc("GET /docs", wrap(srv.handleSwaggerUI))
+	mux.HandleFunc("GET /docs/{file...}", wrap(srv.handleSwaggerAsset))
+	mux.HandleFunc("GET /healthz", wrap(srv.handleHealthz))
+	mux.HandleFunc("GET /find", qwrap(srv.handleFind))
+	mux.HandleFunc("GET /stats", wrap(srv.handleStats))
+	mux.HandleFunc("GET /domains", wrap(srv.handleDomains))
+	// frontier queue visibility — counts by status + top-N
+	// hosts in queue. Distinct from /domains which is over INDEXED docs.
+	mux.HandleFunc("GET /queue", wrap(srv.handleQueue))
+	// Single-node deployments still expose
+	// this; it's just unused. Authenticated by cfg.Cluster.PeerAuthToken
+	// (Bearer); when token is empty, requests from any source are accepted.
+	mux.HandleFunc("POST /admin/crawl-enqueue", wrap(srv.handleCrawlEnqueue))
+	mux.HandleFunc("POST /admin/allow-domain", wrap(srv.handleAllowDomain))
+	mux.HandleFunc("POST /admin/frontier-purge-host", wrap(srv.handleFrontierPurgeHost))
+	mux.HandleFunc("POST /admin/frontier-clear", wrap(srv.handleFrontierClear))
+	mux.HandleFunc("POST /admin/frontier-demote-host", wrap(srv.handleFrontierDemoteHost))
+	mux.HandleFunc("POST /admin/frontier-purge-stale-inflight", wrap(srv.handleFrontierPurgeStaleInFlight))
+	mux.HandleFunc("POST /admin/rss-import", wrap(srv.handleRSSImport))
+	mux.HandleFunc("POST /admin/crawl-now", wrap(srv.handleCrawlNow))
+	mux.HandleFunc("POST /admin/wet-import", wrap(srv.handleWETImport))
+	mux.HandleFunc("POST /admin/wet-import-bulk", wrap(srv.handleWETImportBulk))
+	mux.HandleFunc("POST /admin/site-pack", wrap(srv.handleSitePack))
+	mux.HandleFunc("POST /admin/site-submit", wrap(srv.handleSiteSubmit))
+	mux.HandleFunc("POST /admin/embed-backfill", wrap(srv.handleEmbedBackfill))
+	mux.HandleFunc("POST /admin/host-backfill", wrap(srv.handleHostBackfill))
+	mux.HandleFunc("GET /admin/eval-quick", wrap(srv.handleEvalQuick))
+	mux.HandleFunc("POST /admin/hnsw-compact", wrap(srv.handleHNSWCompact))
+	mux.HandleFunc("GET /query", qwrap(srv.handleQuery))
+	mux.HandleFunc("POST /query", qwrap(srv.handleQuery))
+	// import a sitemap.xml (or sitemap-index) and push every
+	// listed URL into the live frontier.
+	mux.HandleFunc("POST /admin/sitemap-import", wrap(srv.handleSitemapImport))
+	mux.HandleFunc("POST /admin/recrawl-sitemap", wrap(srv.handleRecrawlSitemap))
+	// PQ training admin endpoint. Same auth as crawl-enqueue
+	// (Bearer cfg.Cluster.PeerAuthToken). Runs synchronously — for the
+	// 224K-vec corpus we have today it takes ~minutes; operator-only.
+	mux.HandleFunc("POST /admin/pq-train", wrap(srv.handlePQTrain))
+	// backfill-only — re-encode every node that doesn't have a
+	// code yet against the existing codebook. No retrain. Fast.
+	mux.HandleFunc("POST /admin/pq-encode", wrap(srv.handlePQEncode))
+	// Creates a hard-linked, consistent
+	// snapshot dir that's safe to tar without racing background compactions.
+	mux.HandleFunc("POST /admin/checkpoint", wrap(srv.handleCheckpoint))
+	mux.HandleFunc("GET /search", qwrap(srv.handleSearch))
+	mux.HandleFunc("POST /search", qwrap(srv.handleSearchPOST))
+	mux.HandleFunc("GET /contents", wrap(srv.handleContents))
+	mux.HandleFunc("POST /contents", wrap(srv.handleContentsBatch))
+	mux.HandleFunc("GET /verify", wrap(srv.handleVerify))
+	mux.HandleFunc("GET /metrics", wrap(srv.handleMetrics))
+	mux.HandleFunc("GET /admin/query-log", wrap(srv.handleQueryLog))
+	mux.HandleFunc("POST /feedback", wrap(srv.handleFeedback))
+	mux.HandleFunc("GET /admin/feedback", wrap(srv.handleFeedbackList))
+	mux.HandleFunc("GET /sla", wrap(srv.handleSLA))
+	mux.HandleFunc("GET /admin/domains-audit", wrap(srv.handleDomainsAudit))
+	mux.HandleFunc("GET /find_similar", qwrap(srv.handleFindSimilar))
+	mux.HandleFunc("POST /find_similar", qwrap(srv.handleFindSimilarPOST))
+	mux.HandleFunc("GET /answer", qwrap(srv.handleAnswer))
+	mux.HandleFunc("POST /answer", qwrap(srv.handleAnswerPOST))
+	mux.HandleFunc("GET /research", qwrap(srv.handleResearch))
+	mux.HandleFunc("POST /research", qwrap(srv.handleResearchPOST))
+
+	httpSrv := &http.Server{
+		Addr:              *addr,
+		Handler:           mux,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       120 * time.Second,
+		MaxHeaderBytes:    1 << 20, // 1 MB
+	}
+
+	log.Printf("pebble-serve: listening on %s (PebbleStore at %s)", *addr, *dir)
+	// Production state observed on GH200: after a restart series that
+	// healed HNSW zombies, the meta counters showed 0 while the 'l'
+	// family had 10.87M entries — degraded BM25 length normalization.
+	// Off the hot path so HNSW load + first request aren't blocked.
+	go func() {
+		// Brief settle so an active IndexDocument can populate counters
+		// the cheap way before we kick the O(N) scan.
+		time.Sleep(10 * time.Second)
+		sumLen, count, recomputed, err := ps.BootstrapCorpusStats(ctx)
+		if err != nil {
+			log.Printf("pebble-serve: corpus stats bootstrap failed: %v", err)
+			return
+		}
+		if recomputed {
+			log.Printf("pebble-serve: corpus stats bootstrapped (indexed_docs=%d, sum_doc_len=%d)", count, sumLen)
+		}
+	}()
+	// Without this the
+	// subdomain-density penalty in authority.Score never fires — we
+	// saw 6.68M .cfd/.sbs hosts on GH200 sitting at score 0.20 instead
+	// of dropping to "block." Single-pass iteration is ~18s at 9M hosts;
+	// runs off the hot path so HNSW load isn't blocked. Re-runs every
+	// 6h to track ongoing crawl growth without operator intervention.
+	go func() {
+		// Initial settle so the rest of startup completes first.
+		time.Sleep(15 * time.Second)
+		refresh := func() {
+			counts := map[string]int{}
+			err := ps.IterateDomains(ctx, func(host string, _ int) bool {
+				// Use the Scorer's eTLD+1 logic so the bucket keys we
+				// produce here match what Score() looks up — without this
+				// the publicsuffix-aware Scorer keys on "bbc.co.uk" while
+				// the bootstrap keys on "co.uk" and the lookup misses.
+				e := authority.ETLD1(host)
+				if e == "" {
+					return true
+				}
+				counts[e]++
+				return true
+			})
+			if err != nil {
+				log.Printf("pebble-serve: subdomain-count refresh: %v", err)
+				return
+			}
+			srv.authority.SetSubdomainCounts(counts)
+			log.Printf("pebble-serve: authority subdomain counts refreshed (%d eTLD+1 buckets)", len(counts))
+		}
+		refresh()
+		// Re-scan periodically to absorb ongoing crawl growth.
+		t := time.NewTicker(6 * time.Hour)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				refresh()
+			}
+		}
+	}()
+	// Only
+	// listens on loopback so it can never be exposed publicly through the
+	// reverse proxy. Set COSIFT_PPROF_ADDR=127.0.0.1:6060 to enable.
+	if pprofAddr := os.Getenv("COSIFT_PPROF_ADDR"); pprofAddr != "" {
+		// optional mutex / block sampling so the
+		// dense-search-latency investigation has data. Off by default
+		// because each sample is a couple-µs overhead per contended
+		// lock event. Set rate ≥1 to enable; 1000 means "sample 1 in
+		// 1000 lock waits" which is plenty for diagnosis.
+		if v := os.Getenv("COSIFT_MUTEX_PROFILE_FRACTION"); v != "" {
+			if n, err := strconv.Atoi(v); err == nil && n > 0 {
+				runtime.SetMutexProfileFraction(n)
+				log.Printf("pebble-serve: mutex profile fraction = %d", n)
+			}
+		}
+		if v := os.Getenv("COSIFT_BLOCK_PROFILE_RATE"); v != "" {
+			if n, err := strconv.Atoi(v); err == nil && n > 0 {
+				runtime.SetBlockProfileRate(n)
+				log.Printf("pebble-serve: block profile rate = %d", n)
+			}
+		}
+		pprofMux := http.NewServeMux()
+		pprofMux.HandleFunc("/debug/pprof/", pprof.Index)
+		pprofMux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+		pprofMux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+		pprofMux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+		pprofMux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+		go func() {
+			log.Printf("pebble-serve: pprof listening on %s", pprofAddr)
+			// Bare ListenAndServe uses zero-value Server with no timeouts —
+			// a slow-reader on the pprof port can pin goroutines indefinitely.
+			// WriteTimeout is generous because CPU profile and trace endpoints
+			// stream for 30s+ by design.
+			srv := &http.Server{
+				Addr:              pprofAddr,
+				Handler:           pprofMux,
+				ReadHeaderTimeout: 10 * time.Second,
+				ReadTimeout:       30 * time.Second,
+				WriteTimeout:      5 * time.Minute,
+				IdleTimeout:       120 * time.Second,
+				MaxHeaderBytes:    1 << 20,
+			}
+			if err := srv.ListenAndServe(); err != nil {
+				log.Printf("pebble-serve: pprof exited: %v", err)
+			}
+		}()
+	}
+	go func() {
+		<-ctx.Done()
+		log.Printf("pebble-serve: shutting down")
+		shutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = httpSrv.Shutdown(shutCtx)
+	}()
+
+	// Reuses ps + srv.hnsw + srv.embedder. The
+	// crawler.Crawler uses concurrency from cfg.Crawler.MaxConcurrent. Vectors
+	// land into the SAME HNSW pointer that /search reads from, so freshly
+	// crawled content is searchable as soon as AddPassage returns.
+	// Checkpoint goroutine persists the graph every crawlCheckpoint.
+	// collect a WaitGroup of crawler goroutines so the final
+	// HNSW persist runs BEFORE ps.Close() — fixes a 'pebble: closed' panic.
+	var crawlWG sync.WaitGroup
+	if *crawlSeeds != "" {
+		if err := srv.startInProcessCrawl(ctx, ps, *crawlSeeds, *crawlCheckpoint, cfg, &crawlWG); err != nil {
+			log.Printf("pebble-serve: in-process crawler not started: %v", err)
+		}
+	}
+
+	servErr := httpSrv.ListenAndServe()
+	// wait for crawler + checkpoint goroutines to finish their
+	// final persist before the deferred ps.Close() runs. Otherwise Persist
+	// can race ps.Close() and panic.
+	crawlWG.Wait()
+	if servErr != nil && servErr != http.ErrServerClosed {
+		return servErr
+	}
+	return nil
+}
+
+// startInProcessCrawl wires the crawler-inside-serve flow. Bumps
+// srv.hnsw to a fresh empty graph if none was loaded (so dense retrieval is
+// live as soon as the first passage lands), then runs the crawler in a
+// goroutine for the server's lifetime.
+func (s *pebbleHTTP) startInProcessCrawl(ctx context.Context, ps *store.PebbleStore, seedsFile string, ckpEvery time.Duration, cfg *config.Config, wg *sync.WaitGroup) error {
+	if s.embedder == nil {
+		return errors.New("crawl requires embedder configuration (cfg.Embeddings.Model)")
+	}
+	buf, err := os.ReadFile(seedsFile)
+	if err != nil {
+		return fmt.Errorf("read seeds file: %w", err)
+	}
+	var seeds []string
+	for _, line := range strings.Split(string(buf), "\n") {
+		t := strings.TrimSpace(line)
+		if t == "" || strings.HasPrefix(t, "#") {
+			continue
+		}
+		seeds = append(seeds, t)
+	}
+	if len(seeds) == 0 {
+		return errors.New("seeds file empty after parsing")
+	}
+
+	// Ensure HNSW is non-nil so the bridge can call AddPassage. /search reads
+	// the same pointer, so growth is immediately searchable.
+	if s.hnsw == nil {
+		s.hnsw = index.NewHNSW(s.embedder.Dim())
+		log.Printf("in-serve crawler: created fresh HNSW (dim=%d)", s.embedder.Dim())
+	}
+
+	c := crawler.NewWithBackend(cfg.Crawler, ps, index.NewPebbleBM25(ps))
+	// crawler embedder is wrapped in a semaphore-throttled
+	// wrapper so the bulk crawl can never queue enough requests at
+	// ollama to starve interactive /search?retriever=dense calls.
+	// Default cap = 8 (well under OLLAMA_NUM_PARALLEL=32); operator
+	// override via COSIFT_CRAWL_EMBED_CONCURRENCY.
+	crawlEmbedCap := 8
+	if v := os.Getenv("COSIFT_CRAWL_EMBED_CONCURRENCY"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			crawlEmbedCap = n
+		}
+	}
+	// Coalesces many
+	// per-doc embed calls into one larger inner.Embed per ~20 ms window
+	// (up to maxBatch=128 texts). Search bypasses the batcher (uses
+	// s.embedder directly) so interactive latency stays sub-100 ms.
+	// Operator overrides:
+	//   COSIFT_EMBED_BATCH=128       — texts per inner call
+	//   COSIFT_EMBED_BATCH_WAIT_MS=20 — drain timer in ms
+	batchMax := 128
+	if v := os.Getenv("COSIFT_EMBED_BATCH"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			batchMax = n
+		}
+	}
+	batchWait := 20 * time.Millisecond
+	if v := os.Getenv("COSIFT_EMBED_BATCH_WAIT_MS"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			batchWait = time.Duration(n) * time.Millisecond
+		}
+	}
+	batchedEmbedder := embed.NewBatchingEmbedder(s.embedder, batchMax, batchWait)
+	crawlEmbedder := embed.NewThrottledEmbedder(batchedEmbedder, crawlEmbedCap)
+	log.Printf("pebble-serve: crawler embed = throttle(%d) → batch(max=%d, wait=%s) → round-robin → backends; search bypasses batcher",
+		crawlEmbedCap, batchMax, batchWait)
+	c = c.WithEmbedder(crawlEmbedder)
+	c = c.WithPassageWriter(&hnswPassageWriter{ps: ps, hnsw: s.hnsw})
+	// Single-node config
+	// (NumShards <= 1) makes route fn a no-op (every URL ownsLocally).
+	// s.cluster was stamped at server-init time so search-only nodes also
+	// see it; we just need the router here.
+	if cfg.Cluster.IsClustered() {
+		c = c.WithRouter(
+			func(url string) (bool, string) {
+				if cfg.Cluster.OwnsURL(url) {
+					return true, ""
+				}
+				return false, cfg.Cluster.PeerForURL(url)
+			},
+			s.forwardURLToPeer,
+		)
+		log.Printf("in-serve crawler: cluster mode (shard=%d/%d, peers=%d)",
+			cfg.Cluster.MyShardID, cfg.Cluster.NumShards, len(cfg.Cluster.Peers))
+	}
+	// Expose Seed so /admin/crawl-enqueue can hand off forwarded URLs.
+	s.crawlSeed = c.Seed
+	// expose SeedSitemap so /admin/sitemap-import can push
+	// sitemap-discovered URLs into the live frontier.
+	s.crawlSeedSitemap = c.SeedSitemap
+	// expose SeedSitemapLane so /admin/site-submit can push a whole site's
+	// URLs into a chosen priority lane (default: submitted/priority).
+	s.crawlSeedSitemapLane = c.SeedSitemapLane
+	// expose Recrawl so /admin/recrawl-sitemap can reset done/errored URLs.
+	s.crawlRecrawl = c.Recrawl
+	s.crawlSeedRSS = c.SeedRSS
+	s.crawlFetchNow = c.FetchAndIndexNow
+	s.crawlSeedWET = c.SeedWET
+	s.crawlAllowDomain = c.AddAllowedDomain
+	for _, u := range seeds {
+		// Only seed locally-owned URLs in cluster mode; the rest get forwarded.
+		if cfg.Cluster.IsClustered() && !cfg.Cluster.OwnsURL(u) {
+			if err := s.forwardURLToPeer(ctx, u, cfg.Cluster.PeerForURL(u)); err != nil {
+				log.Printf("in-serve crawler: forward initial seed %s: %v", u, err)
+			}
+			continue
+		}
+		_ = c.Seed(u)
+	}
+	log.Printf("in-serve crawler: %d seeds queued (concurrency=%d, depth=%d, checkpoint=%s)",
+		len(seeds), cfg.Crawler.MaxConcurrent, cfg.Crawler.MaxDepth, ckpEvery)
+	s.crawlActive = true
+
+	// Checkpoint goroutine: incremental persist via PersistFrom — each
+	// tick only writes nodes [lastN, n). Shutdown does a full persist
+	// from 0 so any backlinks added to older nodes get refreshed.
+	// Seeding lastN from the loaded graph means the first checkpoint
+	// after restart only writes nodes added during this run; the prior
+	// N are already on disk.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		t := time.NewTicker(ckpEvery)
+		defer t.Stop()
+		lastN := s.hnsw.Len()
+		if lastN > 0 {
+			log.Printf("in-serve crawler: checkpoint baseline = %d nodes (loaded from disk)", lastN)
+		}
+		for {
+			select {
+			case <-ctx.Done():
+				n := s.hnsw.Len()
+				if n > 0 {
+					t0 := time.Now()
+					log.Printf("in-serve crawler: final HNSW persist at shutdown (%d nodes, full)", n)
+					if err := s.hnsw.Persist(context.Background(), ps); err != nil {
+						log.Printf("in-serve crawler: final HNSW persist failed: %v", err)
+					} else {
+						log.Printf("in-serve crawler: final HNSW persist complete in %s", time.Since(t0))
+					}
+				}
+				return
+			case <-t.C:
+				n := s.hnsw.Len()
+				if n == 0 || n == lastN {
+					continue
+				}
+				// graph can shrink (e.g., /admin/hnsw-compact rewrites
+				// indices and writes a smaller meta). When that happens, lastN
+				// from before the compaction is stale and > n; PersistFrom(lastN)
+				// would be a no-op forever, stranding any new AddPassages until
+				// shutdown. The compact handler does its own full Persist so disk
+				// is already in sync; we just need to resync lastN here.
+				if n < lastN {
+					lastN = n
+					continue
+				}
+				t0 := time.Now()
+				if err := s.hnsw.PersistFrom(context.Background(), ps, lastN); err != nil {
+					log.Printf("in-serve crawler: HNSW persist (incremental from %d) failed: %v", lastN, err)
+					continue
+				}
+				// alongside HNSW node writes, persist any newly-
+				// encoded PQ codes for nodes [lastN, n). Skipped silently
+				// when no codebook is loaded.
+				pqWritten := 0
+				if s.hnsw.HasPQ() {
+					if w, err := s.hnsw.PersistPQCodesFrom(context.Background(), ps, lastN); err != nil {
+						log.Printf("in-serve crawler: PQ codes persist failed: %v", err)
+					} else {
+						pqWritten = w
+					}
+				}
+				if pqWritten > 0 {
+					log.Printf("in-serve crawler: HNSW checkpoint at %d nodes (+%d incremental, +%d PQ codes, took %s)",
+						n, n-lastN, pqWritten, time.Since(t0))
+				} else {
+					log.Printf("in-serve crawler: HNSW checkpoint at %d nodes (+%d incremental, took %s)",
+						n, n-lastN, time.Since(t0))
+				}
+				lastN = n
+			}
+		}
+	}()
+
+	// Crawler goroutine — restarts automatically when new items appear in the
+	// frontier after a drain. This ensures that site-submit / recrawl-sitemap
+	// URLs submitted while the crawler is idle are picked up without a service
+	// restart. Poll every 5s after drain; resume as soon as queued > 0.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for {
+			log.Printf("in-serve crawler: starting")
+			if err := c.Run(ctx); err != nil {
+				log.Printf("in-serve crawler: exited with error: %v", err)
+				return
+			}
+			log.Printf("in-serve crawler: frontier drained, waiting for new work…")
+			// Poll until the parent context is cancelled or new items appear.
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-time.After(5 * time.Second):
+				}
+				fs, err := s.store.GetFrontierStats(ctx)
+				if err != nil {
+					continue
+				}
+				if fs.Queued > 0 {
+					log.Printf("in-serve crawler: %d new frontier items, restarting", fs.Queued)
+					break
+				}
+			}
+			if ctx.Err() != nil {
+				return
+			}
+		}
+	}()
+	return nil
+}
+
+// pebbleHTTP holds the read-side handles. Stays small on purpose — the
+// SQLite-side Server struct accumulated a lot of config knobs over many iters;
+// the Pebble surface starts minimal and grows feature-by-feature.
+type pebbleHTTP struct {
+	store       *store.PebbleStore
+	idx         *index.PebbleBM25
+	chat        embed.ChatClient // nil when cfg.Chat.Model is unset; /answer returns 501
+	reranker    rerank.Reranker  // nil when no rerank is configured; ?rerank=true is a no-op then
+	rerankCandK int              // candidates pulled for rerank; default 20
+
+	// Bounded LLM concurrency + circuit breaker. chatGate is shared
+	// between the answer and rerank pools so a burst on one side can't
+	// also pin the goroutines of the other (the auto-sitemap-style leak
+	// that took the box down). chatSafe wraps the answer-class client
+	// (used for /answer, planner, HyDE, paraphrase) with KindAnswer;
+	// rerankSafe wraps the per-passage scoring client with KindRerank.
+	// Nil = uninitialized (tests / mocks).
+	chatGate   *chatgate.Gate
+	chatSafe   *chatgate.SafeChat
+	rerankSafe *chatgate.SafeChat
+
+	// TTL'd response cache + singleflight for /answer. A popular query
+	// during a load spike costs one hybrid + rerank + LLM call; the
+	// next 100 callers hit the cache in microseconds OR join the
+	// in-flight call (sub-second). Disabled when ttl=0.
+	answerCache *answercache.Cache
+
+	// /research SSE stream cache. Captures and replays the full SSE byte
+	// stream so repeat research queries skip retrieval + LLM entirely.
+	researchCache *answercache.Cache
+
+	// Query log: appends one JSON line per query-endpoint request so we have
+	// real observability into what users ask, what returns empty, and latency.
+	// nil file = disabled (COSIFT_QUERY_LOG unset). See querylog.go.
+	qlogFile *os.File
+	qlogMu   sync.Mutex
+
+	// Feedback log: appends one JSON line per /feedback rating, correlated to a
+	// query by qid. The real usefulness signal (penalize/reward). See feedback.go.
+	fbFile *os.File
+	fbMu   sync.Mutex
+	// fbRL rate-limits /feedback per real client (XFF) — always on, stricter than
+	// the global limiter, since feedback is public/unauthed and abusable.
+	fbRL *rateLimiter
+
+	// Per-site docID boost map cache. key = canonical site string (e.g.
+	// "pilotprotocol.network"). Populated lazily on first site= query;
+	// subsequent calls are sub-microsecond map lookups.
+	siteBoostCache sync.Map // map[string]map[int64]float64
+
+	// Per-site page-title cache for planner context. key = canonical site
+	// string (same scheme as siteBoostCache). value = []string (<=10 titles).
+	// Populated lazily on first site= research query.
+	siteTitleCache sync.Map // map[string][]string
+
+	// Polls vLLM /metrics. When num_requests_waiting exceeds
+	// COSIFT_LLM_DEGRADE_QUEUE, optional LLM stages (rerank, HyDE,
+	// paraphrase) are silently skipped — graceful degradation rather
+	// than queue-then-timeout.
+	llmProbe *chatgate.LoadProbe
+
+	// Per-host authority Scorer; multiplies BM25 / hybrid scores by
+	// (1 + alpha * Score(host)). Wikipedia / kernel.org / arxiv float
+	// over the spam directories in the long tail of the crawl.
+	authority *authority.Scorer
+
+	// Per-endpoint latency + error-rate tracking against
+	// operator-configured targets. Violations are appended to disk
+	// (COSIFT_SLA_LOG_PATH) and surfaced on /sla.
+	sla *sla.Monitor
+
+	// hostBoosts is the operator-configured host-suffix →
+	// multiplier map, applied to fused retrieval scores by /query.
+	// Empty / nil = no boosts (fast path).
+	hostBoosts map[string]float64
+
+	// Nil = disabled.
+	rl *rateLimiter
+
+	// Empty cluster cfg = single-node, no-ops below.
+	cluster config.Cluster
+	// crawlSeed is set after startInProcessCrawl runs so /admin/crawl-enqueue
+	// can hand off forwarded URLs into the in-process frontier. Nil when no
+	// in-serve crawler is wired.
+	crawlSeed func(url string) error
+	// crawlSeedSitemap wraps Crawler.SeedSitemap so the /admin/
+	// sitemap-import endpoint can push sitemap URLs into the live frontier.
+	crawlSeedSitemap func(ctx context.Context, url string) (int, error)
+	// crawlSeedSitemapLane is like crawlSeedSitemap but lets the caller pick
+	// the frontier lane — used by /admin/site-submit to land a site's URLs
+	// in the high-priority submitted lane.
+	crawlSeedSitemapLane func(ctx context.Context, url string, lane byte) (int, error)
+	crawlSeedRSS         func(ctx context.Context, url string) (int, error)
+	crawlFetchNow        func(ctx context.Context, url string) error
+	crawlSeedWET         func(ctx context.Context, url string, dedupeFresh, lexicalOnly bool) (int, error)
+	// crawlAllowDomain promotes a domain into the crawler's runtime dynamic
+	// allowlist (used by /admin/allow-domain for organic HN/Reddit growth).
+	crawlAllowDomain func(domain string) error
+	crawlRecrawl     func(ctx context.Context, url string) error
+
+	// doc count at startup so /stats can report crawl rate
+	// without persistent counter tables. docs_added = current - startup,
+	// rate = docs_added / uptime.
+	startupDocs int
+	// crawlActive = true when in-serve crawler is running.
+	crawlActive bool
+
+	// /research?expand=true issues a
+	// chat call PER sub-query, so a sticky workload (repeated queries, slow
+	// sub-query rephrasings from the planner) hits the chat provider many
+	// times for the same passage. Cap at 256 entries; on overflow drop one
+	// arbitrary entry (Go map iteration order is randomized, good enough).
+	hydeMu       sync.RWMutex
+	hydeCache    map[string]string
+	hydeCacheCap int // env-configurable via COSIFT_HYDE_CACHE_SIZE
+
+	// PQStatus's lock contended
+	// hard with the crawler's AddPassage writers — observed /stats
+	// latency varied 0.2 s to 5.5 s. 5 s TTL keeps the cache effective
+	// for the landing page (polls every ~30 s) without serving very
+	// stale numbers.
+	//
+	// After TTL, return stale body
+	// immediately and refresh async; only the first-ever call pays the
+	// cold-cache cost. statsRefreshing is a single-flight guard so we
+	// don't fan out N background refreshes when a burst arrives stale.
+	statsBodyMu     sync.Mutex
+	statsBodyBlob   []byte
+	statsBodyAt     time.Time
+	statsRefreshing atomic.Bool
+
+	// /research?expand=paraphrase fans
+	// out 3 paraphrases × N sub-queries — same hot path as HyDE but each
+	// miss is 3x larger by output volume. Keyed on q only (fixed n=3 today).
+	paraMu       sync.RWMutex
+	paraCache    map[string][]string
+	paraCacheCap int // env-configurable via COSIFT_PARA_CACHE_SIZE
+	paraHits     atomic.Int64
+	paraMisses   atomic.Int64
+
+	// atomic counters surfaced on /metrics so operators can size the
+	// HyDE cache against a real workload — if misses dominate, raise the cap
+	// or move to an L2 store; if hits dominate at a tight working set, the
+	// cap is sufficient and you can mostly forget about it.
+	hydeHits   atomic.Int64
+	hydeMisses atomic.Int64
+
+	// snapshot at startup of whether persisted HNSW vectors exist
+	// in the 'v' family. Cheap peek (first-hit short-circuit). Surfaced on
+	// /stats so operators know whether the store is ready for the future
+	// ?retriever=dense path without needing to grep pebble-info.
+	hasVectors bool
+	// when an HNSW meta blob is persisted (the normal case),
+	// surface dim + node count too. Cheap 20-byte read at startup.
+	vectorDim   int
+	vectorNodes int
+	// Loaded
+	// only when COSIFT_LOAD_HNSW=true at startup (gigabytes RAM at scale).
+	// Nil = graph not loaded; /search?retriever=dense returns a warning.
+	hnsw *index.HNSW
+	// Required by
+	// /search?retriever=dense alongside s.hnsw. Built at startup when
+	// cfg.Embeddings.Model is set. Nil → ?retriever=dense warns + falls back.
+	embedder embed.Embedder
+
+	// Rerank failures fall back
+	// to BM25 order silently — that's the right reliability move, but without
+	// a counter operators can't tell whether their LLM/HTTP reranker is
+	// healthy or quietly broken.
+	rerankAttempts atomic.Int64
+	rerankFailures atomic.Int64
+
+	// chat call attempt + failure counters across HyDE expansion,
+	// /answer synth (sync + SSE), and /research plan + synth (sync + SSE).
+	// A spike in failures (provider 429s, network blips) is the clearest
+	// early signal that synth endpoints are degraded.
+	chatAttempts atomic.Int64
+	chatFailures atomic.Int64
+
+	// count responses that carried at least one warning.
+	// Operators alerting on this catch 'a deploy started sending malformed
+	// requests' without having to parse response bodies.
+	warningsEmitted atomic.Int64
+
+	// /metrics divides this by
+	// chatAttempts to give mean chat latency, separated from the
+	// per-endpoint duration. Diagnoses 'where did the seconds go' on a
+	// slow /research stream: chat-side or retrieval-side?
+	chatDurationNanos atomic.Int64
+
+	// per-endpoint request counters + duration sums via a
+	// counting middleware wrapping every mux entry. sync.Map keeps the hot
+	// path lock-free; /metrics reads via Range. Path is the label so a
+	// misrouted call (404) doesn't get counted under an existing endpoint.
+	// rate(sum)/rate(count) over the duration sum gives mean latency in PromQL.
+	requestCounts sync.Map // map[string]*endpointMetrics
+
+	started time.Time
+}
+
+type endpointMetrics struct {
+	count    atomic.Int64
+	sumNanos atomic.Int64
+}
+
+// count is the request-counting middleware. Bumps a per-path
+// {count, sumNanos} struct, lazily created on first request to a path. Hot
+// path is sync.Map.Load + two atomic Adds — no contention even under high
+// RPS. Duration is sampled after the handler returns so streaming endpoints
+// account for their full open connection time.
+// envIntDefault reads name as an int; falls back to def when unset or
+// unparseable. Used by gate / deadline knobs so operators can tune via
+// env without a config-file roundtrip.
+func envIntDefault(name string, def int) int {
+	if v := os.Getenv(name); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return n
+		}
+	}
+	return def
+}
+
+// envDurationMsDefault reads name as a millisecond integer; returns def
+// on missing/invalid. Chose ms over Go's "2s" parse to keep operator
+// muscle memory consistent with the other COSIFT_*_MS knobs.
+func envDurationMsDefault(name string, def time.Duration) time.Duration {
+	if v := os.Getenv(name); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return time.Duration(n) * time.Millisecond
+		}
+	}
+	return def
+}
+
+// rateLimiter is a per-IP token-bucket limiter. Active when
+// COSIFT_RATELIMIT_RPM > 0; nil = disabled. Whitelisted IPs bypass entirely.
+type rateLimiter struct {
+	rpm       float64
+	burst     float64
+	whitelist map[string]bool
+	buckets   sync.Map // string IP → *rateLimitBucket
+}
+
+type rateLimitBucket struct {
+	mu     sync.Mutex
+	tokens float64
+	last   time.Time
+}
+
+// newRateLimiterFromEnv reads COSIFT_RATELIMIT_RPM / _BURST / _WHITELIST.
+// Returns nil when RPM is unset or non-positive — limiting is off by default
+// so the no-config self-host story stays simple.
+func newRateLimiterFromEnv() *rateLimiter {
+	rpmStr := os.Getenv("COSIFT_RATELIMIT_RPM")
+	if rpmStr == "" {
+		return nil
+	}
+	rpm, err := strconv.ParseFloat(rpmStr, 64)
+	if err != nil || rpm <= 0 {
+		return nil
+	}
+	burst := 10.0
+	if v := os.Getenv("COSIFT_RATELIMIT_BURST"); v != "" {
+		if b, err := strconv.ParseFloat(v, 64); err == nil && b > 0 {
+			burst = b
+		}
+	}
+	wl := map[string]bool{}
+	for _, ip := range strings.Split(os.Getenv("COSIFT_RATELIMIT_WHITELIST"), ",") {
+		ip = strings.TrimSpace(ip)
+		if ip != "" {
+			wl[ip] = true
+		}
+	}
+	return &rateLimiter{rpm: rpm, burst: burst, whitelist: wl}
+}
+
+// whitelistList returns the whitelisted IPs as a slice (for logging only).
+func (rl *rateLimiter) whitelistList() []string {
+	if rl == nil {
+		return nil
+	}
+	out := make([]string, 0, len(rl.whitelist))
+	for ip := range rl.whitelist {
+		out = append(out, ip)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// allow returns whether the request from ip may proceed. Side-effects: drains
+// one token from the IP's bucket on success.
+func (rl *rateLimiter) allow(ip string) bool {
+	if rl == nil {
+		return true
+	}
+	if rl.whitelist[ip] {
+		return true
+	}
+	bv, _ := rl.buckets.LoadOrStore(ip, &rateLimitBucket{tokens: rl.burst, last: time.Now()})
+	b := bv.(*rateLimitBucket)
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	now := time.Now()
+	elapsed := now.Sub(b.last).Seconds()
+	b.tokens += elapsed * rl.rpm / 60.0
+	if b.tokens > rl.burst {
+		b.tokens = rl.burst
+	}
+	b.last = now
+	if b.tokens < 1 {
+		return false
+	}
+	b.tokens--
+	return true
+}
+
+// stripPort drops ":port" from a "host:port" or "[v6]:port" RemoteAddr. Falls
+// back to the input on parse failure (so we still get SOME per-client key).
+func stripPort(remoteAddr string) string {
+	host, _, err := net.SplitHostPort(remoteAddr)
+	if err != nil {
+		return remoteAddr
+	}
+	return host
+}
+
+// rateLimit is the HTTP middleware that gates each request through the per-IP
+// limiter. Returns 429 with a JSON problem doc + Retry-After hint when the
+// bucket is empty. No-op when s.rl is nil.
+//
+// X-Forwarded-For is honored ONLY when the request came from a configured
+// trusted proxy; otherwise clients could spoof their IP by setting the header.
+// For self-host with cosift directly on the public network, leave
+// cfg.Server.TrustedProxies empty (default) and the RemoteAddr is used.
+func (s *pebbleHTTP) rateLimit(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ip := stripPort(r.RemoteAddr)
+		if !s.rl.allow(ip) {
+			w.Header().Set("Retry-After", "60")
+			writeProblem(w, http.StatusTooManyRequests, "rate limit exceeded for ip="+ip)
+			return
+		}
+		h(w, r)
+	}
+}
+
+func (s *pebbleHTTP) count(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		key := r.URL.Path
+		v, ok := s.requestCounts.Load(key)
+		if !ok {
+			v, _ = s.requestCounts.LoadOrStore(key, &endpointMetrics{})
+		}
+		m := v.(*endpointMetrics)
+		m.count.Add(1)
+		start := time.Now()
+		// Wrap the writer so the SLA monitor knows whether the call
+		// succeeded; default status to 200 because handlers that just
+		// w.Write() never call WriteHeader explicitly.
+		sw := &statusCapturingWriter{ResponseWriter: w, status: 200}
+		h(sw, r)
+		dur := time.Since(start)
+		m.sumNanos.Add(dur.Nanoseconds())
+		if s.sla != nil {
+			s.sla.Observe(key, dur, sw.status < 500)
+		}
+	}
+}
+
+// statusCapturingWriter lets the count middleware record the response
+// status for the SLA observer. The middleware treats 5xx as failures
+// for SLA purposes; 4xx are client errors and don't count against us.
+type statusCapturingWriter struct {
+	http.ResponseWriter
+	status      int
+	wroteHeader bool
+	bytes       int64 // response body bytes — used by the query logger as an empty-result proxy
+}
+
+func (s *statusCapturingWriter) WriteHeader(code int) {
+	if !s.wroteHeader {
+		s.status = code
+		s.wroteHeader = true
+	}
+	s.ResponseWriter.WriteHeader(code)
+}
+
+func (s *statusCapturingWriter) Write(p []byte) (int, error) {
+	if !s.wroteHeader {
+		s.wroteHeader = true
+	}
+	n, err := s.ResponseWriter.Write(p)
+	s.bytes += int64(n)
+	return n, err
+}
+
+// Flush passes through to support SSE / streaming handlers.
+func (s *statusCapturingWriter) Flush() {
+	if f, ok := s.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}
+
+//go:embed assets/landing.html
+var landingHTML []byte
+
+//go:embed assets/chat.html
+var chatHTML []byte
+
+//go:embed assets/openapi.json
+var openapiJSON []byte
+
+//go:embed assets/swagger/index.html
+var swaggerIndexHTML []byte
+
+//go:embed assets/swagger/swagger-ui.css
+var swaggerUICSS []byte
+
+//go:embed assets/swagger/swagger-ui-bundle.js
+var swaggerUIJS []byte
+
+// handleLanding serves the self-host dashboard. Only matches exact
+// "/" — Go 1.22's ServeMux routes sub-paths to the longest match, so this
+// won't accidentally swallow /search etc.
+func (s *pebbleHTTP) handleLanding(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path != "/" {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=60")
+	w.Write(landingHTML)
+}
+
+// handleChat serves the multi-turn chat UI. JS calls /answer
+// or /research with stream=true and renders SSE events incrementally.
+func (s *pebbleHTTP) handleChat(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=60")
+	_, _ = w.Write(chatHTML)
+}
+
+func (s *pebbleHTTP) handleOpenAPI(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "public, max-age=3600")
+	w.Write(openapiJSON)
+}
+
+func (s *pebbleHTTP) handleSwaggerUI(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=300")
+	w.Write(swaggerIndexHTML)
+}
+
+func (s *pebbleHTTP) handleSwaggerAsset(w http.ResponseWriter, r *http.Request) {
+	file := r.PathValue("file")
+	switch file {
+	case "swagger-ui.css":
+		w.Header().Set("Content-Type", "text/css")
+		w.Header().Set("Cache-Control", "public, max-age=86400")
+		w.Write(swaggerUICSS)
+	case "swagger-ui-bundle.js":
+		w.Header().Set("Content-Type", "application/javascript")
+		w.Header().Set("Cache-Control", "public, max-age=86400")
+		w.Write(swaggerUIJS)
+	default:
+		http.NotFound(w, r)
+	}
+}
diff --git a/cmd/cosift/serve_stats.go b/cmd/cosift/serve_stats.go
new file mode 100644
index 0000000..b3b3e4b
--- /dev/null
+++ b/cmd/cosift/serve_stats.go
@@ -0,0 +1,615 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/pilot-protocol/cosift/internal/embed"
+	"github.com/pilot-protocol/cosift/internal/store"
+)
+
+func (s *pebbleHTTP) handleHealthz(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]any{"status": "ok"})
+}
+
+// handleDomains returns indexed hosts by doc count.
+//
+// Query params:
+//   - top:    legacy alias for limit (capped at 500). Preserved for the
+//     landing page contract.
+//   - q:      substring filter (case-insensitive) on the host name.
+//   - offset: pagination offset (default 0).
+//   - limit:  page size (default 50, capped at 500).
+//
+// Response:
+//
+//	{"total": N, "offset": M, "limit": L, "domains": [...]}
+func (s *pebbleHTTP) handleDomains(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query().Get("q")
+	offset := 0
+	if v := r.URL.Query().Get("offset"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n >= 0 {
+			offset = n
+		}
+	}
+	limit := 50
+	if v := r.URL.Query().Get("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
+			limit = n
+		}
+	}
+	// Legacy 'top' alias from When set, behaves like limit + no
+	// search/offset; lands as the first page.
+	if v := r.URL.Query().Get("top"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
+			limit = n
+			offset = 0
+		}
+	}
+	domains, total, err := s.store.ListDomains(r.Context(), q, offset, limit)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"total":   total,
+		"offset":  offset,
+		"limit":   limit,
+		"q":       q,
+		"domains": domains,
+	})
+}
+
+// handleQueue surfaces frontier queue depth + top-N hosts currently queued
+// for crawl. Fills the gap left by /domains, which only shows
+// already-indexed hosts.
+func (s *pebbleHTTP) handleQueue(w http.ResponseWriter, r *http.Request) {
+	topN := 25
+	if v := r.URL.Query().Get("top"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= 500 {
+			topN = n
+		}
+	}
+	fs, err := s.store.GetFrontierStats(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	hosts, err := s.store.TopQueuedHosts(r.Context(), topN)
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	body := map[string]any{
+		"queued":    fs.Queued,
+		"in_flight": fs.InFlight,
+		"done":      fs.Done,
+		"errored":   fs.Errored,
+		"top_hosts": hosts,
+	}
+	// Lane breakdown: PebbleStore-only (SQLite Store has no lanes). When the
+	// store is a PebbleStore, surface the per-lane queued/in_flight counts so
+	// operators can see whether the weighted RR is actually draining RSS
+	// (lane 1) ahead of bulk (lane 3).
+	if ps, ok := any(s.store).(*store.PebbleStore); ok {
+		if ls, lerr := ps.GetLaneStats(r.Context()); lerr == nil {
+			laneNames := [4]string{"submitted", "refresh", "discovered", "bulk"}
+			lanesOut := make([]map[string]any, 0, 4)
+			for i, n := range laneNames {
+				lanesOut = append(lanesOut, map[string]any{
+					"lane":      i,
+					"name":      n,
+					"queued":    ls.Lanes[i].Queued,
+					"in_flight": ls.Lanes[i].InFlight,
+				})
+			}
+			body["lanes"] = lanesOut
+			body["legacy_queued"] = ls.LegacyQueued
+			body["legacy_in_flight"] = ls.LegacyInFlight
+		}
+	}
+	writeJSON(w, http.StatusOK, body)
+}
+
+// handleDomainsAudit streams the entire 'h' family as JSONL, one
+// {host, count, authority, etld1, tld} record per line. Single pass
+// over the index — at 9M hosts on the GH200 this is ~30 seconds of
+// streaming, vs the 18000 full scans that brute-paginating /domains
+// would force. Read-only; safe to run live.
+//
+// Query params:
+//
+//	min_count=N — emit only hosts with count >= N (default 1)
+//	limit=N     — cap the number of emitted rows (default unlimited)
+//	below=F     — emit only hosts with authority score < F (filter
+//	              for the blocklist proposal stream; default 1.0)
+//	above=F     — emit only hosts with score >= F (filter for the
+//	              authority-list inspection; default 0.0)
+func (s *pebbleHTTP) handleDomainsAudit(w http.ResponseWriter, r *http.Request) {
+	minCount := 1
+	if v := r.URL.Query().Get("min_count"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			minCount = n
+		}
+	}
+	limit := -1
+	if v := r.URL.Query().Get("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	below := 1.0
+	if v := r.URL.Query().Get("below"); v != "" {
+		if f, err := strconv.ParseFloat(v, 64); err == nil {
+			below = f
+		}
+	}
+	above := 0.0
+	if v := r.URL.Query().Get("above"); v != "" {
+		if f, err := strconv.ParseFloat(v, 64); err == nil {
+			above = f
+		}
+	}
+	w.Header().Set("Content-Type", "application/x-ndjson")
+	w.Header().Set("Cache-Control", "no-store")
+	enc := json.NewEncoder(w)
+	emitted := 0
+	flusher, _ := w.(http.Flusher)
+	flushEvery := 256
+	err := s.store.IterateDomains(r.Context(), func(host string, count int) bool {
+		if count < minCount {
+			return true
+		}
+		var score float64 = 0.5
+		if s.authority != nil {
+			score = s.authority.Score(host)
+		}
+		if score >= below || score < above {
+			return true
+		}
+		rec := map[string]any{
+			"host":      host,
+			"count":     count,
+			"authority": score,
+			"recommend": classify(score),
+		}
+		if err := enc.Encode(rec); err != nil {
+			return false
+		}
+		emitted++
+		if limit > 0 && emitted >= limit {
+			return false
+		}
+		if flusher != nil && emitted%flushEvery == 0 {
+			flusher.Flush()
+		}
+		return true
+	})
+	if err != nil {
+		// Best-effort: log and stop; we may have already flushed
+		// partial output, so don't try to writeProblem.
+		log.Printf("handleDomainsAudit: %v", err)
+	}
+	if flusher != nil {
+		flusher.Flush()
+	}
+}
+
+// handleSLA returns the current SLA evaluation snapshot. Read-only.
+// Surfaces per-endpoint p50/p95/p99 + error rate, configured targets,
+// and the most recent violations. Operators consume this in dashboards
+// + on-call paging.
+func (s *pebbleHTTP) handleSLA(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	if s.sla == nil {
+		_, _ = w.Write([]byte(`{"enabled":false}`))
+		return
+	}
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	_ = enc.Encode(s.sla.Snapshot())
+}
+
+func (s *pebbleHTTP) handleStats(w http.ResponseWriter, r *http.Request) {
+	// stale-while-revalidate cache.
+	//   - Fresh hit (< TTL): return cached, X-Cache: HIT.
+	//   - Stale (have cache, past TTL but under maxStale): return cached,
+	//     X-Cache: STALE, kick a background refresh (single-flight).
+	//   - Very stale (past maxStale): fall through to synchronous compute
+	//     — protects against the case where a refresh goroutine
+	//     hangs under HNSW lock contention and the cache shows ancient
+	//     values (we saw a startup-time vec=654 served for ~15 min).
+	//   - Cold (no cache): compute synchronously, X-Cache: MISS.
+	const statsBodyTTL = 5 * time.Second
+	const statsBodyMaxStale = 60 * time.Second
+	s.statsBodyMu.Lock()
+	body := s.statsBodyBlob
+	age := time.Since(s.statsBodyAt)
+	cached := body != nil && !s.statsBodyAt.IsZero()
+	s.statsBodyMu.Unlock()
+
+	if cached && age < statsBodyTTL {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("X-Cache", "HIT")
+		_, _ = w.Write(body)
+		return
+	}
+	if cached && age < statsBodyMaxStale {
+		if s.statsRefreshing.CompareAndSwap(false, true) {
+			go func() {
+				defer s.statsRefreshing.Store(false)
+				ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+				defer cancel()
+				if newBody, err := s.buildStatsBody(ctx); err == nil {
+					s.statsBodyMu.Lock()
+					s.statsBodyBlob = newBody
+					s.statsBodyAt = time.Now()
+					s.statsBodyMu.Unlock()
+				}
+			}()
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("X-Cache", "STALE")
+		_, _ = w.Write(body)
+		return
+	}
+
+	// Cold path: compute synchronously and populate the cache.
+	newBody, err := s.buildStatsBody(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	s.statsBodyMu.Lock()
+	s.statsBodyBlob = newBody
+	s.statsBodyAt = time.Now()
+	s.statsBodyMu.Unlock()
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("X-Cache", "MISS")
+	_, _ = w.Write(newBody)
+}
+
+// buildStatsBody collects every signal /stats surfaces and marshals it.
+// Heavy paths: PebbleStore.Stats (d-family scan, partially counter-cached
+// since), HNSW.PQStatus (O(N) under h.mu read lock that
+// contends with crawler writers). Called by handleStats both
+// synchronously (cold) and from a background goroutine (SWR refresh).
+func (s *pebbleHTTP) buildStatsBody(ctx context.Context) ([]byte, error) {
+	// /stats was observed taking 31s under load
+	// when the SWR cache exceeded maxStale: store.Stats() iterates the
+	// entire 'd' family (10.87M entries) every cold compute. The
+	// CorpusStats counter is an O(1) atomic read mirror of the persisted
+	// indexed_docs meta — equivalent doc count for any operator-facing
+	// purpose, microseconds instead of seconds. Terms isn't populated in
+	// the Pebble path (always 0) so dropping the scan loses nothing.
+	sumLen, indexedDocs, err := s.store.CorpusStats(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var avg float64
+	if indexedDocs > 0 {
+		avg = float64(sumLen) / float64(indexedDocs)
+	}
+	// surface config knobs that affect retrieval/synth quality so
+	// operators can verify env overrides took effect from one endpoint.
+	out := map[string]any{
+		"documents":    indexedDocs,
+		"terms":        int64(0),
+		"indexed_docs": indexedDocs,
+		"sum_doc_len":  sumLen,
+		"avg_doc_len":  avg,
+		"uptime":       time.Since(s.started).String(),
+		"backend":      "pebble",
+		"bm25_k1":      s.idx.K1(),
+		"bm25_b":       s.idx.B(),
+	}
+	if s.reranker != nil {
+		out["reranker"] = s.reranker.Name()
+		out["rerank_candidate_k"] = s.rerankCandK
+	}
+	if s.chat != nil {
+		out["chat_model"] = s.chat.Model()
+		// surface the cache caps so operators can verify
+		// COSIFT_HYDE_CACHE_SIZE / _PARA_CACHE_SIZE overrides took effect.
+		out["hyde_cache_size"] = s.hydeCacheCap
+		out["paraphrase_cache_size"] = s.paraCacheCap
+	}
+	// Bounded LLM concurrency + circuit-breaker state. Surfaced so
+	// operators can see whether the gate is shedding load (rejected > 0)
+	// or holding requests (in_flight = cap) and whether the breaker has
+	// tripped (state != "closed").
+	if s.chatGate != nil {
+		out["llm_gate"] = s.chatGate.Stats()
+	}
+	if s.chatSafe != nil {
+		out["llm_answer_circuit"] = s.chatSafe.CircuitState()
+	}
+	if s.rerankSafe != nil {
+		out["llm_rerank_circuit"] = s.rerankSafe.CircuitState()
+	}
+	if s.answerCache != nil {
+		out["answer_cache"] = s.answerCache.Stats()
+	}
+	if s.llmProbe != nil {
+		out["llm_load"] = s.llmProbe.Stats()
+	}
+	if s.sla != nil {
+		out["sla"] = s.sla.Snapshot()
+	}
+	if s.authority != nil {
+		out["authority"] = s.authority.Stats()
+	}
+	// embed cache hit/miss counters so operators can see how
+	// often re-fetches are skipping ollama. The cache wraps the round-
+	// robin embedder when cfg.Embeddings.CacheDir is set; type-assert
+	// down to extract the counters.
+	if ce, ok := s.embedder.(*embed.CachedEmbedder); ok {
+		hits := ce.Hits()
+		misses := ce.Misses()
+		total := hits + misses
+		hitRate := 0.0
+		if total > 0 {
+			hitRate = 100 * float64(hits) / float64(total)
+		}
+		out["embed_cache"] = map[string]any{
+			"hits":         hits,
+			"misses":       misses,
+			"hit_rate_pct": hitRate,
+		}
+	}
+	// signal whether the store has HNSW vectors persisted, and
+	// (when meta is available) surface dim + node count.
+	// when the graph is loaded in memory, report s.hnsw.Len()
+	// instead of the startup-cached vectorNodes count — otherwise /stats
+	// shows the corpus frozen in time while the in-serve crawler keeps
+	// growing the graph.
+	// "% of the indexed web" novelty stat. The web is too big to
+	// give a meaningful number, but Common Crawl's monthly snapshot is
+	// ~3.5 B unique pages — a recognizable reference point. Operators can
+	// override with COSIFT_WEB_DENOMINATOR if they want a different scale
+	// (e.g. their own intranet, a TLD slice, etc.).
+	webDenom := int64(3_500_000_000)
+	if v := os.Getenv("COSIFT_WEB_DENOMINATOR"); v != "" {
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
+			webDenom = n
+		}
+	}
+	out["web_pct"] = 100.0 * float64(indexedDocs) / float64(webDenom)
+	out["web_denominator"] = webDenom
+	out["has_vectors"] = s.hasVectors
+	switch {
+	case s.hnsw != nil:
+		out["vector_nodes"] = s.hnsw.Len()
+		out["vector_dim"] = s.vectorDim
+	case s.vectorNodes > 0:
+		out["vector_nodes"] = s.vectorNodes
+		out["vector_dim"] = s.vectorDim
+	}
+	// whether the graph is loaded into memory for dense retrieval.
+	out["hnsw_loaded"] = s.hnsw != nil
+	// PQ status — operator-facing visibility into compression
+	// state. Only present when the graph is loaded; nil otherwise.
+	if s.hnsw != nil {
+		pq := s.hnsw.PQStatus()
+		// coverage is over VALID nodes (vec != nil), not raw total —
+		// zombie slots from pre partial persists inflate the total
+		// without being searchable. NodesTotal still surfaced for context.
+		denom := pq.NodesValid
+		if denom == 0 {
+			denom = pq.NodesTotal // avoid div-by-zero on a fresh load
+		}
+		coverage := 0.0
+		if denom > 0 {
+			coverage = 100 * float64(pq.NodesWithCode) / float64(denom)
+		}
+		zombies := pq.NodesTotal - pq.NodesValid
+		pqInfo := map[string]any{
+			"enabled":         pq.Enabled,
+			"nodes_with_code": pq.NodesWithCode,
+			"nodes_valid":     pq.NodesValid,
+			"nodes_total":     pq.NodesTotal,
+			"zombie_nodes":    zombies,
+			"coverage_pct":    coverage,
+		}
+		if pq.Enabled {
+			pqInfo["dim"] = pq.Dim
+			pqInfo["m"] = pq.M
+			pqInfo["k"] = pq.K
+		}
+		out["pq"] = pqInfo
+	}
+	// Clients can read
+	// this once instead of probing ?retriever=dense + parsing the warning.
+	// bm25 always — index is always available. dense/hybrid require a
+	// loaded graph; the embedder lets dense/hybrid handle text-mode and
+	// new queries. /find_similar URL-mode dense works without embedder, but
+	// that's an endpoint-specific carve-out — keep this list general.
+	retrievers := []string{"bm25", "bm25-mlt"}
+	if s.hnsw != nil && s.embedder != nil {
+		retrievers = append(retrievers, "dense", "hybrid")
+	} else if s.hnsw != nil {
+		// Graph but no embedder — only URL-mode /find_similar can use dense.
+		retrievers = append(retrievers, "dense:find_similar_url_only")
+	}
+	out["retrievers"] = retrievers
+	// crawl-rate surface for the in-serve crawler.
+	// Computes docs added since process start and per-minute rate.
+	if s.crawlActive {
+		uptimeMin := time.Since(s.started).Minutes()
+		added := int(indexedDocs) - s.startupDocs
+		if added < 0 {
+			added = 0
+		}
+		rate := 0.0
+		if uptimeMin > 0 {
+			rate = float64(added) / uptimeMin
+		}
+		out["crawl_active"] = true
+		out["docs_added_since_start"] = added
+		out["docs_per_minute"] = rate
+	}
+	return json.Marshal(out)
+}
+
+// Prometheus-format scrape endpoint. Hand-written plain text
+// (no client_golang dep) — exposition format is simple enough that
+// pulling in a dep just to print four gauges isn't justified.
+// Quantities chosen to be O(1) reads (CorpusStats counters + uptime);
+// frontier scans deliberately excluded so scrape latency stays flat
+// regardless of corpus size.
+func (s *pebbleHTTP) handleMetrics(w http.ResponseWriter, r *http.Request) {
+	sumLen, count, err := s.store.CorpusStats(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	var avg float64
+	if count > 0 {
+		avg = float64(sumLen) / float64(count)
+	}
+	uptime := time.Since(s.started).Seconds()
+	w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	fmt.Fprintf(w, "# HELP cosift_indexed_docs Number of documents passed through IndexDocument.\n")
+	fmt.Fprintf(w, "# TYPE cosift_indexed_docs gauge\n")
+	fmt.Fprintf(w, "cosift_indexed_docs %d\n", count)
+	fmt.Fprintf(w, "# HELP cosift_sum_doc_len_total Sum of indexed document lengths in tokens.\n")
+	fmt.Fprintf(w, "# TYPE cosift_sum_doc_len_total counter\n")
+	fmt.Fprintf(w, "cosift_sum_doc_len_total %d\n", sumLen)
+	fmt.Fprintf(w, "# HELP cosift_avg_doc_len Average document length in tokens (derived).\n")
+	fmt.Fprintf(w, "# TYPE cosift_avg_doc_len gauge\n")
+	fmt.Fprintf(w, "cosift_avg_doc_len %.2f\n", avg)
+	fmt.Fprintf(w, "# HELP cosift_uptime_seconds Seconds since pebble-serve started.\n")
+	fmt.Fprintf(w, "# TYPE cosift_uptime_seconds counter\n")
+	fmt.Fprintf(w, "cosift_uptime_seconds %.0f\n", uptime)
+	// crawl_active gauges whether
+	// the crawler goroutine is running; docs_added is monotonic
+	// since process start; docs_per_minute is the rolling rate.
+	crawlActiveGauge := 0
+	if s.crawlActive {
+		crawlActiveGauge = 1
+	}
+	fmt.Fprintf(w, "# HELP cosift_crawl_active 1 if in-serve crawler is running, 0 otherwise.\n")
+	fmt.Fprintf(w, "# TYPE cosift_crawl_active gauge\n")
+	fmt.Fprintf(w, "cosift_crawl_active %d\n", crawlActiveGauge)
+	if s.crawlActive {
+		added := count - int64(s.startupDocs)
+		if added < 0 {
+			added = 0
+		}
+		fmt.Fprintf(w, "# HELP cosift_crawl_docs_added_total Documents added by the in-serve crawler since process start.\n")
+		fmt.Fprintf(w, "# TYPE cosift_crawl_docs_added_total counter\n")
+		fmt.Fprintf(w, "cosift_crawl_docs_added_total %d\n", added)
+		rate := 0.0
+		if uptime > 0 {
+			rate = float64(added) / (uptime / 60)
+		}
+		fmt.Fprintf(w, "# HELP cosift_crawl_docs_per_minute Recent crawl rate (docs added per minute, averaged since process start).\n")
+		fmt.Fprintf(w, "# TYPE cosift_crawl_docs_per_minute gauge\n")
+		fmt.Fprintf(w, "cosift_crawl_docs_per_minute %.2f\n", rate)
+	}
+	// HyDE cache effectiveness. Hits/misses both monotonic so
+	// Prometheus rate() over these gives cache pressure under load.
+	fmt.Fprintf(w, "# HELP cosift_hyde_cache_hits_total HyDE cache hits (expandQuery served from memory).\n")
+	fmt.Fprintf(w, "# TYPE cosift_hyde_cache_hits_total counter\n")
+	fmt.Fprintf(w, "cosift_hyde_cache_hits_total %d\n", s.hydeHits.Load())
+	fmt.Fprintf(w, "# HELP cosift_hyde_cache_misses_total HyDE cache misses (expandQuery called the LLM).\n")
+	fmt.Fprintf(w, "# TYPE cosift_hyde_cache_misses_total counter\n")
+	fmt.Fprintf(w, "cosift_hyde_cache_misses_total %d\n", s.hydeMisses.Load())
+	fmt.Fprintf(w, "# HELP cosift_paraphrase_cache_hits_total Paraphrase cache hits (paraphraseQuery served from memory).\n")
+	fmt.Fprintf(w, "# TYPE cosift_paraphrase_cache_hits_total counter\n")
+	fmt.Fprintf(w, "cosift_paraphrase_cache_hits_total %d\n", s.paraHits.Load())
+	fmt.Fprintf(w, "# HELP cosift_paraphrase_cache_misses_total Paraphrase cache misses (paraphraseQuery called the LLM).\n")
+	fmt.Fprintf(w, "# TYPE cosift_paraphrase_cache_misses_total counter\n")
+	fmt.Fprintf(w, "cosift_paraphrase_cache_misses_total %d\n", s.paraMisses.Load())
+	fmt.Fprintf(w, "# HELP cosift_rerank_attempts_total Rerank calls invoked (any endpoint with ?rerank=true).\n")
+	fmt.Fprintf(w, "# TYPE cosift_rerank_attempts_total counter\n")
+	fmt.Fprintf(w, "cosift_rerank_attempts_total %d\n", s.rerankAttempts.Load())
+	fmt.Fprintf(w, "# HELP cosift_rerank_failures_total Rerank calls that returned an error (silently fell back to BM25 order).\n")
+	fmt.Fprintf(w, "# TYPE cosift_rerank_failures_total counter\n")
+	fmt.Fprintf(w, "cosift_rerank_failures_total %d\n", s.rerankFailures.Load())
+	fmt.Fprintf(w, "# HELP cosift_chat_attempts_total Chat-client calls invoked (HyDE, /answer synth, /research plan + synth).\n")
+	fmt.Fprintf(w, "# TYPE cosift_chat_attempts_total counter\n")
+	fmt.Fprintf(w, "cosift_chat_attempts_total %d\n", s.chatAttempts.Load())
+	fmt.Fprintf(w, "# HELP cosift_chat_failures_total Chat-client calls that returned an error.\n")
+	fmt.Fprintf(w, "# TYPE cosift_chat_failures_total counter\n")
+	fmt.Fprintf(w, "cosift_chat_failures_total %d\n", s.chatFailures.Load())
+	fmt.Fprintf(w, "# HELP cosift_chat_duration_seconds_sum Cumulative wall-clock spent inside chat-client calls.\n")
+	fmt.Fprintf(w, "# TYPE cosift_chat_duration_seconds_sum counter\n")
+	fmt.Fprintf(w, "cosift_chat_duration_seconds_sum %.6f\n", float64(s.chatDurationNanos.Load())/1e9)
+	fmt.Fprintf(w, "# HELP cosift_warnings_emitted_total Responses that carried at least one warning (misconfigured request).\n")
+	fmt.Fprintf(w, "# TYPE cosift_warnings_emitted_total counter\n")
+	fmt.Fprintf(w, "cosift_warnings_emitted_total %d\n", s.warningsEmitted.Load())
+	// HNSW vector index shape. Live count when graph is
+	// loaded; startup-cached otherwise.
+	vectorNodesLive := s.vectorNodes
+	if s.hnsw != nil {
+		vectorNodesLive = s.hnsw.Len()
+	}
+	if vectorNodesLive > 0 {
+		fmt.Fprintf(w, "# HELP cosift_vector_nodes Number of HNSW vector nodes in memory (or persisted when not loaded).\n")
+		fmt.Fprintf(w, "# TYPE cosift_vector_nodes gauge\n")
+		fmt.Fprintf(w, "cosift_vector_nodes %d\n", vectorNodesLive)
+		fmt.Fprintf(w, "# HELP cosift_vector_dim Embedding dimension of the persisted HNSW index.\n")
+		fmt.Fprintf(w, "# TYPE cosift_vector_dim gauge\n")
+		fmt.Fprintf(w, "cosift_vector_dim %d\n", s.vectorDim)
+	}
+	// PromQL
+	// rate(cosift_request_duration_seconds_sum) / rate(cosift_requests_total)
+	// gives mean latency in any window. Labels = path; misrouted calls (404)
+	// don't share a label with any handled path.
+	fmt.Fprintf(w, "# HELP cosift_requests_total HTTP requests served, by endpoint.\n")
+	fmt.Fprintf(w, "# TYPE cosift_requests_total counter\n")
+	fmt.Fprintf(w, "# HELP cosift_request_duration_seconds_sum Cumulative request duration, by endpoint.\n")
+	fmt.Fprintf(w, "# TYPE cosift_request_duration_seconds_sum counter\n")
+	s.requestCounts.Range(func(k, v any) bool {
+		path := k.(string)
+		m := v.(*endpointMetrics)
+		fmt.Fprintf(w, "cosift_requests_total{endpoint=%q} %d\n", path, m.count.Load())
+		fmt.Fprintf(w, "cosift_request_duration_seconds_sum{endpoint=%q} %.6f\n", path, float64(m.sumNanos.Load())/1e9)
+		return true
+	})
+}
+
+// HTTP form of `cosift verify`. Same comparison (running
+// counters vs authoritative 'l' family scan) on the already-open store, so
+// monitoring can poll without contending for the single-writer lock or
+// shelling into the container. 503 on drift makes this composable with
+// Kubernetes liveness / load-balancer health checks.
+func (s *pebbleHTTP) handleVerify(w http.ResponseWriter, r *http.Request) {
+	counterSum, counterCount, err := s.store.CorpusStats(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	scanSum, scanCount, err := s.store.SumDocLengths(r.Context())
+	if err != nil {
+		writeProblem(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	driftCount := counterCount - scanCount
+	driftSum := counterSum - scanSum
+	ok := driftCount == 0 && driftSum == 0
+	body := map[string]any{
+		"ok":                   ok,
+		"indexed_docs_counter": counterCount,
+		"indexed_docs_scan":    scanCount,
+		"indexed_docs_drift":   driftCount,
+		"sum_doc_len_counter":  counterSum,
+		"sum_doc_len_scan":     scanSum,
+		"sum_doc_len_drift":    driftSum,
+	}
+	status := http.StatusOK
+	if !ok {
+		status = http.StatusServiceUnavailable
+	}
+	writeJSON(w, status, body)
+}

From e3bb6a7e0f55946f4839253437a3f2cae097bb8b Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:31:45 +0300
Subject: [PATCH 08/11] ci: add gofmt formatting gate

Fail CI if any file isn't gofmt-clean, so the pristine tree can't regress.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 01e4a58..eb6b504 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,14 @@ jobs:
           go-version: '1.25'
           cache: true
 
+      - name: gofmt (formatting gate)
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "These files are not gofmt-clean:"; echo "$unformatted"
+            echo "Run: gofmt -w ."; exit 1
+          fi
+
       - name: go vet
         run: go vet ./...
 

From d527465beae8ca2348c864921b19232c99e4d836 Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Tue, 30 Jun 2026 17:36:26 +0300
Subject: [PATCH 09/11] =?UTF-8?q?docs:=20add=20ENV.md=20=E2=80=94=20full?=
 =?UTF-8?q?=20COSIFT=5F*=20configuration=20reference?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/ENV.md | 246 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 246 insertions(+)
 create mode 100644 docs/ENV.md

diff --git a/docs/ENV.md b/docs/ENV.md
new file mode 100644
index 0000000..17d4cf8
--- /dev/null
+++ b/docs/ENV.md
@@ -0,0 +1,246 @@
+# cosift — Environment Variable Reference
+
+This is the complete, code-verified reference for every runtime environment
+variable the cosift engine reads. Defaults and effects below were read directly
+from source (file:line cited in each row), not inferred.
+
+**How to read this doc:**
+
+- **Two configuration surfaces.** Env vars (this doc) are the *operator-tuning*
+  surface — set them in the systemd unit / shell / container env. They sit
+  *on top of* a second, separate surface: the JSON config file
+  (`cosift.json`, typically `/home/ubuntu/cosift.json` in prod) parsed by
+  `internal/config/config.go`. Things like the listen address, data dir,
+  embeddings/chat URLs + models, rerank config, cluster topology, proxies,
+  and the admin/peer-auth tokens live in `cosift.json`. This doc does **not**
+  fully document `cosift.json`; it only notes where an env var overrides or
+  interacts with a config field. The two should not be confused.
+- **Helper semantics** (matters for what counts as a valid override):
+  - `envIntDefault` (server, `serve_setup.go:1140`) — int; **must be `> 0`**, else falls back to the default. Empty/zero/negative/garbage → default.
+  - `envDurationMsDefault` (server, `serve_setup.go:1152`) — integer **milliseconds**; must be `> 0`, else default. (Note: ms, not Go `"2s"` syntax.)
+  - `envInt` (Pebble, `store/pebble.go:250`) — int; must be `> 0`, else default.
+  - `envIntCrawler` (crawler, `crawler.go:635`) — int; must be `>= 0` (zero is a *valid* value here), else default.
+  - `envFloatCrawler` (crawler, `crawler.go:964`) — float; must be `>= 0`, else default.
+  - `firstEnv` (`main.go:381`) / `resolveAPIKey` (`main.go:355`) — return the first non-empty value among a list of names.
+  - Inline `os.Getenv` checks vary; each row states the exact behavior.
+- **Booleans are string-literal compares**, not generic parsing. Where a var is
+  documented as `bool`, the code compares against an exact string (e.g.
+  `== "1"`, `== "true"`, `== "false"`). Any other value behaves as "unset".
+  The "default" column states the effective behavior when unset.
+
+---
+
+## SECRETS — read this first
+
+cosift has **no env var that holds the server's admin password.** Be precise
+about what each "token/key" var actually does:
+
+| Var | What it really is | Secret? |
+|---|---|---|
+| `COSIFT_ADMIN_TOKEN` | **CLIENT-side** Bearer for the `cosift admin …` subcommands (`cmd_admin.go`) — the value the *CLI* sends to a remote box's `/admin/*`. It is **NOT** the server's auth gate. | Yes (client credential) |
+| `COSIFT_EMBED_API_KEY` / `COSIFT_CHAT_API_KEY` | Provider API keys for the embed / chat slots (`resolveAPIKey`). Fall back to `OPENAI_API_KEY` → `OPENAI`. | Yes |
+| `OPENAI_API_KEY` / `OPENAI` | OpenAI(-compatible) key; `OPENAI` is the accepted short form. | Yes |
+| `COHERE_API_KEY` / `VOYAGE_API_KEY` | Rerank provider keys (HTTP reranker, when `cfg.Rerank.URL` is set and `cfg.Rerank.APIKey` is empty). | Yes |
+
+**Server admin auth is NOT an env var.** The production `pebble-serve` admin
+gate is `cluster.peer_auth_token` in `cosift.json` (and the legacy `serve`
+path uses `server.admin_token`). See the **secret-ownership matrix in
+[docs/HANDOVER.md §1](HANDOVER.md)** for the authoritative ownership classes,
+rotation policy, and the current-state caveats (e.g. `peer_auth_token` empty in
+prod = admin gate skipped).
+
+**Production uses LOCAL models.** In prod, the embeddings and chat URLs in
+`cosift.json` point at `127.0.0.1` (self-hosted vLLM / Ollama / TEI). Local
+OpenAI-compatible endpoints accept anonymous requests, so
+`OPENAI_API_KEY` / `OPENAI` / `COHERE_API_KEY` / `VOYAGE_API_KEY` /
+`COSIFT_EMBED_API_KEY` / `COSIFT_CHAT_API_KEY` are **unset and unused in
+production.** They exist only for operators who self-host against a keyed
+OpenAI-compatible provider.
+
+**Raw-query persistence is DISABLED in prod for confidentiality.**
+`COSIFT_QUERY_LOG` and `COSIFT_FEEDBACK_LOG` enable on-box append of raw
+queries / feedback to JSONL. Per **[docs/HANDOVER.md §2](HANDOVER.md)** these
+are removed/unset at handover so no raw query text is persisted on the box. Do
+not re-enable them without the confidentiality decision in that section.
+
+---
+
+## Server & Network
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `PORT` | int (string) | unset → no override | 12-factor port. When set, server binds `0.0.0.0:$PORT` (overrides `cosift.json` `server.addr`). For Cloud Run / Fly / Heroku / Render. | `internal/config/config.go:499` |
+| `COSIFT_LISTEN` | string | unset → use `cosift.json` `server.addr` | Full listen address escape hatch (e.g. `127.0.0.1:8080`). Overrides `PORT`. | `internal/config/config.go:502` |
+| `COSIFT_DATA_DIR` | string | unset → `cosift.json` `data_dir` (or built-in default) | Overrides the data directory (Pebble store + operational state). | `internal/config/config.go:505` |
+
+> `cosift.json` is auto-augmented by a best-effort load of `./.env` at startup
+> (`config.go:475`, `LoadDotEnv`), which sets any `KEY=VALUE` lines into the
+> process env *only if not already set*.
+
+---
+
+## Auth & Secrets
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_ADMIN_TOKEN` | string (SECRET, client-side) | unset → no Bearer sent | Token the `cosift admin …` CLI subcommands send as the admin Bearer to a remote box. **Not** a server gate. | `cmd/cosift/cmd_admin.go:96,135,332,415,537`; `cmd_maintenance.go:618` |
+| `COSIFT_EMBED_API_KEY` | string (SECRET) | unset → fall back to `OPENAI_API_KEY` → `OPENAI` → anonymous | API key for the **embed** slot. | `cmd/cosift/main.go:359` (`resolveAPIKey("embed")`) |
+| `COSIFT_CHAT_API_KEY` | string (SECRET) | unset → fall back to `OPENAI_API_KEY` → `OPENAI` → anonymous | API key for the **chat** slot. | `cmd/cosift/main.go:361` (`resolveAPIKey("chat")`) |
+| `OPENAI_API_KEY` | string (SECRET) | unset → try `OPENAI` → anonymous | OpenAI(-compatible) key; common fallback for both embed and chat slots, and read directly by `index` / `eval` / `serve` subcommands. | `main.go:368`; `cmd_index.go:155,612`; `cmd_eval.go:272,335,356,375,1316`; `cmd_serve.go:136`; `cmd_maintenance.go:562,609,610` |
+| `OPENAI` | string (SECRET) | unset → anonymous | Accepted short form of `OPENAI_API_KEY`. Checked only after `OPENAI_API_KEY` is empty. | `main.go:368`; same call sites as `OPENAI_API_KEY` |
+| `COHERE_API_KEY` | string (SECRET) | unset → try `VOYAGE_API_KEY` → anonymous | API key for the HTTP reranker when `cfg.Rerank.URL` is set and `cfg.Rerank.APIKey` is empty (checked first). | `serve_setup.go:431`; `cmd_serve.go:179` (via `firstEnv`) |
+| `VOYAGE_API_KEY` | string (SECRET) | unset → anonymous | HTTP reranker key, checked only after `COHERE_API_KEY` is empty. | `serve_setup.go:433`; `cmd_serve.go:179` (via `firstEnv`) |
+
+---
+
+## Logging / Observability / Retention
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_QUERY_LOG` | string (path) | unset → query logging disabled (no-op) | Path to JSONL file; when set, every query-endpoint request is appended. Also gates the feedback log default location and the `/admin/query-log` tail endpoint. **Disabled in prod — see HANDOVER §2.** | `serve_setup.go:308`; `querylog.go:96`; `feedback.go:37,147` |
+| `COSIFT_FEEDBACK_LOG` | string (path) | unset → falls back to `feedback-log.jsonl` beside `COSIFT_QUERY_LOG`; if that's also unset → disabled | Path for the feedback JSONL log. **Disabled in prod — see HANDOVER §2.** | `feedback.go:34`; `serve_setup.go` (via `feedbackLogPath()`) |
+| `COSIFT_SLA_LOG_PATH` | string (path) | unset → `<DataDir>/sla-violations.jsonl` (if DataDir set) | Where SLA-violation records are written. | `serve_setup.go:348` |
+| `COSIFT_SLA_SEARCH_P95_MS` | duration (ms) | `1500` (1.5s) | P95 SLA target for `/search`. | `serve_setup.go:353` |
+| `COSIFT_SLA_SEARCH_P99_MS` | duration (ms) | `4000` (4s) | P99 SLA target for `/search`. | `serve_setup.go:353` |
+| `COSIFT_SLA_ANSWER_P95_MS` | duration (ms) | `8000` (8s) | P95 SLA target for `/answer`. | `serve_setup.go:354` |
+| `COSIFT_SLA_ANSWER_P99_MS` | duration (ms) | `20000` (20s) | P99 SLA target for `/answer`. | `serve_setup.go:354` |
+| `COSIFT_SLA_RESEARCH_P95_MS` | duration (ms) | `30000` (30s) | P95 SLA target for `/research`. | `serve_setup.go:355` |
+| `COSIFT_SLA_RESEARCH_P99_MS` | duration (ms) | `60000` (60s) | P99 SLA target for `/research`. | `serve_setup.go:355` |
+| `COSIFT_SLA_WINDOW_MS` | duration (ms) | `300000` (5min) | Rolling window over which SLA percentiles are computed. | `serve_setup.go:359` |
+| `COSIFT_SLA_EVAL_MS` | duration (ms) | `30000` (30s) | How often the SLA monitor re-evaluates targets. | `serve_setup.go:360` |
+| `COSIFT_WEB_DENOMINATOR` | int (int64) | `3500000000` (3.5B, Common Crawl est.) | Denominator for the `/stats` "% of indexed web" novelty figure; must be `> 0`. | `serve_stats.go:380` |
+| `COSIFT_DEBUG_UPSERT` | bool (`"1"`) | unset → off | When `"1"`, prints `upsert-new: id=… url=…` to stderr for each newly-inserted document. Debug only. | `store/pebble.go:298,1413` |
+
+> Note: `/healthz` (P95 50ms / P99 200ms) and `/stats` (P95 200ms / P99 1s) SLA
+> targets are **hardcoded** (`serve_setup.go:356-357`) and not env-tunable.
+
+---
+
+## Rate Limiting
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_RATELIMIT_RPM` | float | unset / `<= 0` → **global limiter disabled** | Per-IP token-bucket refill rate (requests/min). Enabling this turns on the global rate limiter. | `serve_setup.go:1180` |
+| `COSIFT_RATELIMIT_BURST` | float | `10` (only when RPM set) | Token-bucket burst capacity for the global limiter; must be `> 0`. | `serve_setup.go:1189` |
+| `COSIFT_RATELIMIT_WHITELIST` | csv | empty → no whitelist | Comma-separated IPs that bypass the global limiter entirely. | `serve_setup.go:1195` |
+| `COSIFT_FEEDBACK_RPM` | int | `20` | Per-client RPM for the **always-on** `/feedback` limiter (stricter than global); must be `> 0`. | `serve_setup.go:319` |
+| `COSIFT_FEEDBACK_BURST` | int | `5` | Burst capacity for the `/feedback` limiter; must be `> 0`. | `serve_setup.go:320` |
+
+---
+
+## Retrieval & Ranking (BM25, decay, authority, expansion, caches)
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_BM25_K1` | float | `1.2` (PebbleBM25 default) | BM25 term-frequency saturation `k1`; applied only if parseable and `> 0`. | `serve_search.go:1350` |
+| `COSIFT_BM25_B` | float | `0.75` (PebbleBM25 default) | BM25 length-normalization `b`; applied only if parseable and `> 0`. | `serve_search.go:1358` |
+| `COSIFT_BM25_MIN_IDF` | float | `0.5` | IDF floor below which a query term is dropped as a stopword. `0` disables pruning. Must be `>= 0`. | `internal/index/pebble_bm25.go:33` |
+| `COSIFT_BM25_DISABLE_MAXSCORE` | bool (non-empty disables) | unset → MaxScore optimization **enabled** | Any non-empty value disables the WAND/MaxScore early-termination optimization for benchmark-grade lossless ranking. | `internal/index/pebble_bm25.go:204` |
+| `COSIFT_DEFAULT_DECAY_DAYS` | float | `180` (6-month half-life) | Default recency half-life (days) applied when a request has no explicit `?decay=`. `0` disables decay globally. Must be `>= 0`; explicit `?decay=N` still wins. | `serve_search.go:1592` |
+| `COSIFT_AUTHORITY_ALPHA` | float | scorer's built-in default (`authority.New()`) | Authority-score blend weight; applied only if parseable and `>= 0`. | `serve_setup.go:188` |
+| `COSIFT_TRANCO_CSV` | string (path) | unset → embedded whitelist + TLD heuristics only | Path to a Tranco rankings CSV to enrich authority scoring. | `serve_setup.go:193` |
+| `COSIFT_MAJESTIC_CSV` | string (path) | unset → embedded whitelist + TLD heuristics only | Path to a Majestic Million CSV to enrich authority scoring. | `serve_setup.go:202` |
+| `COSIFT_DISABLE_ENTITY_EXPAND` | bool (non-empty disables) | unset → entity expansion **enabled** | When unset, query is expanded with canonical-attribute rewrites (`qexpand.RewriteEntity`). Any non-empty value disables it. | `serve_search.go:2064` |
+| `COSIFT_HYDE_CACHE_SIZE` | int | `256` | Capacity of the HyDE hypothetical-document cache; must be `> 0` (warns on bad value). | `serve_setup.go:161` |
+| `COSIFT_PARA_CACHE_SIZE` | int | `256` | Capacity of the paraphrase cache; must be `> 0` (warns on bad value). | `serve_setup.go:173` |
+| `COSIFT_ANSWER_CACHE_TTL_SEC` | int (seconds) | `60` | `/answer` response-cache TTL; must be `> 0` (use `0`/unset semantics via the answer-cache impl to effectively disable). | `serve_setup.go:299` |
+| `COSIFT_ANSWER_CACHE_CAP` | int | `1024` | `/answer` response-cache entry cap; must be `> 0`. | `serve_setup.go:300` |
+| `COSIFT_RESEARCH_CACHE_TTL_SEC` | int (seconds) | `600` (10min) | `/research` response-cache TTL; must be `> 0`. | `serve_setup.go:303` |
+| `COSIFT_RESEARCH_CACHE_CAP` | int | `256` | `/research` response-cache entry cap; must be `> 0`. | `serve_setup.go:304` |
+| `COSIFT_HOST_PARTITION` | bool (`"1"`) | unset → off | **Write path:** when `"1"`, host-partitioned postings are written on index (~2x posting write-amplification). | `store/pebble.go:3570` |
+| `COSIFT_HOST_PARTITION_READ` | bool (`"1"`) | unset → off | **Read path:** when `"1"`, `site=` queries route to the `'P'`-family host partition (`SearchInHost`); off → the 50× host-boost path is used. | `serve_search.go:1976` |
+
+---
+
+## HNSW & Embeddings
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_LOAD_HNSW` | bool (`"true"`) | unset → graph **not** loaded into RAM (cheap meta only) | When `"true"`, loads the full HNSW vector graph into memory at startup (gigabytes at scale). Opt-in. | `serve_setup.go:90` |
+| `COSIFT_HNSW_EF_SEARCH` | int | `50` (NewHNSW default) | HNSW `efSearch` override (raising to ~200 restored Recall@10); applied only when the graph is loaded and value `> 0`. | `serve_setup.go:104` |
+| `COSIFT_DISABLE_PQ` | bool (`"true"`) | unset → PQ used if codebook present | When `"true"`, disables the runtime Product-Quantization search path even if PQ codes exist on disk (uses raw vectors). | `serve_setup.go:119` |
+| `COSIFT_HNSW_CHECKPOINT_SEC` | int (seconds) | `60` | Interval at which the in-crawl HNSW graph is checkpointed (`cosift crawl`). Override applied only if value `>= 5`. | `cmd/cosift/cmd_crawl.go:168` |
+| `COSIFT_CRAWL_EMBED_CONCURRENCY` | int | `8` | Max concurrent embed calls from the in-serve crawler (throttle to protect interactive `/search`); must be `> 0`. | `serve_setup.go:742` |
+| `COSIFT_EMBED_BATCH` | int | `128` | Max texts coalesced per inner embed call (batching embedder); must be `> 0`. | `serve_setup.go:755` |
+| `COSIFT_EMBED_BATCH_WAIT_MS` | duration (ms) | `20` | Batching-embedder drain timer; must be `> 0`. | `serve_setup.go:761` |
+
+---
+
+## LLM (gates, deadlines, retries, degrade)
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_LLM_GATE_RERANK` | int | `8` | Concurrent-call cap for the rerank pool in the shared chat gate; must be `> 0`. | `serve_setup.go:291` |
+| `COSIFT_LLM_GATE_ANSWER` | int | `4` | Concurrent-call cap for the answer pool in the shared chat gate; must be `> 0`. | `serve_setup.go:292` |
+| `COSIFT_LLM_DEADLINE_ANSWER_MS` | duration (ms) | `30000` (30s) | Per-stage deadline for the `/answer` chat call; must be `> 0`. | `serve_setup.go:379` |
+| `COSIFT_LLM_DEADLINE_RERANK_MS` | duration (ms) | `5000` (5s) | Per-stage deadline for the LLM rerank call; must be `> 0`. | `serve_setup.go:454` |
+| `COSIFT_LLM_RETRIES` | int | `1` | Max retries for gated chat calls (both answer and rerank); must be `> 0`. | `serve_setup.go:380,455` |
+| `COSIFT_LLM_DEGRADE_QUEUE` | int | `8` | vLLM queue-depth threshold above which the server sheds LLM work (degrade mode). Only active when `cfg.Chat.URL` is set. Must be `> 0`. | `serve_setup.go:338` |
+| `COSIFT_LLM_PROBE_MS` | duration (ms) | `2000` (2s) | Interval for the vLLM `/metrics` load probe. Only active when `cfg.Chat.URL` is set; must be `> 0`. | `serve_setup.go:339` |
+| `COSIFT_CHAT_MAX_TOKENS` | int | `2048` | Max-tokens cap on chat generation (prevents runaway/thinking loops); must be `> 0`. | `internal/embed/chat.go:95` |
+| `COSIFT_THINKING` | bool (`"1"`) | unset → thinking **disabled** for Qwen3 models | When `"1"`, re-enables the model's "thinking" mode (only affects Qwen3* chat templates via vLLM). | `internal/embed/chat.go:112` |
+
+---
+
+## Crawler & Content
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_FETCH_HEADER_TIMEOUT_MS` | duration (ms) | `6000` (6s) | HTTP response-header timeout per fetch; must be `> 0`. | `internal/crawler/crawler.go:254` |
+| `COSIFT_FETCH_TIMEOUT_MS` | duration (ms) | `12000` (12s) | Overall per-fetch HTTP timeout; must be `> 0`. | `internal/crawler/crawler.go:310` |
+| `COSIFT_MAX_CONNS_PER_HOST` | int | `128` | `MaxConnsPerHost` / `MaxIdleConnsPerHost` for the crawler transport; must be `> 0`. | `internal/crawler/crawler.go:266` |
+| `COSIFT_AUTO_SITEMAP_CONCURRENCY` | int | `16` | Cap on concurrent background auto-sitemap discoveries; must be `> 0`. | `internal/crawler/crawler.go:332` |
+| `COSIFT_DYNAMIC_DOMAINS_FILE` | string (path) | unset → none | Path to a file of dynamic (JS-rendered) domains loaded at crawler init. | `internal/crawler/crawler.go:342` |
+| `COSIFT_DIRECT_HOSTS` | csv | unset → built-in `defaultDirectHosts` list | Comma-separated hosts that bypass the remote fetcher and fetch directly. Setting it **replaces** the default list. | `internal/crawler/remote_fetcher.go:70` |
+| `COSIFT_CRAWL_PDF` | bool (`"false"` disables) | unset → PDF parsing **enabled** (sandboxed) | Set to `"false"` to disable sandboxed PDF parsing. Any other value leaves it on. | `internal/crawler/crawler.go:1155` |
+| `COSIFT_REFETCH_AFTER_HOURS` | int (hours) | `0` → disabled (every revisit issues a conditional GET) | Skip re-fetching a healthy URL fetched within this window. Also defines the "fresh" window for prefer-new (defaults to 24h there) and the WET fresh window. Must be `> 0`. | `crawler.go:1107,1492`; `wet.go:94` |
+| `COSIFT_PREFER_NEW_URLS` | bool (`"1"`) | unset → off | When `"1"`, the frontier prefers never-seen URLs over recently-fetched ones (one `GetDocByURL` per candidate). | `internal/crawler/crawler.go:1488` |
+| `COSIFT_ZOMBIE_RECLAIM` | bool (`"1"`) | unset → off | When `"1"`, marks a re-crawled URL's prior chunk generation invalid in the HNSW graph before adding fresh vectors. | `crawler.go:666,1320`; `wet.go:309` |
+| `COSIFT_EMBED_DECOUPLE_WORKERS` | int | `0` → decoupled embed pipeline **off** | Number of dedicated embed-worker goroutines that drain the crawl embed queue (decouples crawl from embed/HNSW-write latency). `0` keeps the synchronous path. Must be `>= 0`. | `internal/crawler/crawler.go:586` |
+| `COSIFT_EMBED_DECOUPLE_BUFFER` | int | `4096` | Buffer size of the decoupled embed queue (only when workers `> 0`). Must be `>= 0`. | `internal/crawler/crawler.go:588` |
+| `COSIFT_HOSTSWEEP_DISABLED` | bool (`"1"`) | unset → sweeper **enabled** | When `"1"`, disables the self-cleaning host sweeper entirely. | `internal/crawler/crawler.go:868` |
+| `COSIFT_HOSTSWEEP_INTERVAL_SEC` | int (seconds) | `600` (10min) | Host-sweeper run interval; floored at 30s. Must be `>= 0`. | `internal/crawler/crawler.go:871` |
+| `COSIFT_HOSTSWEEP_MIN_ATTEMPTS` | int | `100` | Min fetch attempts before a host is eligible for purge/demote. Must be `>= 0`. | `internal/crawler/crawler.go:875` |
+| `COSIFT_HOSTSWEEP_DEAD_RATE` | float | `0.20` | Success-rate threshold below which a host is purged. Must be `>= 0`. | `internal/crawler/crawler.go:876` |
+| `COSIFT_HOSTSWEEP_WEAK_RATE` | float | `0.50` | Success-rate threshold below which a host is demoted (between dead and weak). Must be `>= 0`. | `internal/crawler/crawler.go:877` |
+| `COSIFT_WET_BATCH_SIZE` | int | `32` | Records per batch when ingesting Common Crawl WET archives; must be `> 0`. | `internal/crawler/wet.go:101` |
+| `COSIFT_WET_WORKERS` | int | `8` | Worker goroutines for WET ingest; must be `> 0`. | `internal/crawler/wet.go:107` |
+
+> Not an env var: `cosift.json` `crawler.auto_sitemap` (a config field) controls
+> whether auto-sitemap discovery runs at all. A stale code comment references
+> "`COSIFT_AUTO_SITEMAP=false`", but no such env var is read — only
+> `COSIFT_AUTO_SITEMAP_CONCURRENCY` (above) exists.
+
+---
+
+## Pebble Store
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_PEBBLE_CACHE_MB` | int (MB) | `128` | Pebble block-cache size in MB; must be `> 0`. | `internal/store/pebble.go:153` |
+| `COSIFT_PEBBLE_MEMTABLE_MB` | int (MB) | `32` | Pebble memtable size in MB; must be `> 0`. | `internal/store/pebble.go:154` |
+| `COSIFT_PEBBLE_MEMTABLES` | int | `2` | Memtable count; `MemTableStopWritesThreshold = value + 2`. Must be `> 0`. | `internal/store/pebble.go:155` |
+| `COSIFT_PEBBLE_SYNC` | bool (`"false"` disables) | unset → `Sync` (fsync each commit) | Set to `"false"` to use `NoSync` writes (skips per-commit fsync — faster crawls, drops durability vs OS crash; WAL still written so process-crash durability holds). | `internal/store/pebble.go:176` |
+
+---
+
+## Profiling
+
+All profiling knobs are no-ops unless `COSIFT_PPROF_ADDR` is set.
+
+| Variable | Type | Default | Effect | Where read |
+|---|---|---|---|---|
+| `COSIFT_PPROF_ADDR` | string (addr) | unset → pprof server off | When set (e.g. `127.0.0.1:6060`), starts a loopback pprof HTTP server. | `serve_setup.go:627` |
+| `COSIFT_MUTEX_PROFILE_FRACTION` | int | unset → off (`0`) | `runtime.SetMutexProfileFraction(n)` — sample 1-in-`n` lock waits. Only applied when pprof is on and `n > 0`. | `serve_setup.go:633` |
+| `COSIFT_BLOCK_PROFILE_RATE` | int | unset → off (`0`) | `runtime.SetBlockProfileRate(n)`. Only applied when pprof is on and `n > 0`. | `serve_setup.go:639` |
+| `COSIFT_CHECKPOINT_DIR` | string (path) | unset → `/tmp` | Base directory for `/admin/checkpoint` Pebble checkpoints (a `cosift-ckpt-<nanos>` subdir is created under it). | `cmd/cosift/serve_admin.go:100` |
+
+---
+
+## Excluded (test-only, not real config)
+
+These appear **only** in `*_test.go` files (verified: no non-test references)
+and are not runtime configuration:
+`COSIFT_DOTENV_BARE`, `COSIFT_DOTENV_SINGLE`, `COSIFT_DOTENV_DOUBLE`,
+`COSIFT_DOTENV_EXISTS`, `COSIFT_DOTENV_TEST_KEY_1`,
+`COSIFT_FIRSTENV_A`, `COSIFT_FIRSTENV_B`, `COSIFT_FIRSTENV_C`.

From b215334790595522077bffcb506c6fdeeabbf67d Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Wed, 1 Jul 2026 16:57:57 +0300
Subject: [PATCH 10/11] fix: wire peer_auth_token into cosift-compact.sh +
 correct stale auto-sitemap comment

- cosift-compact.sh now reads cluster.peer_auth_token from cosift.json and sends it on /admin/hnsw-compact, so it keeps working once the admin token is set (all other harvesters already read the token dynamically via token())
- fix crawler.go comment: maybeAutoSitemap is gated by the crawler.auto_sitemap config field, not a (nonexistent) COSIFT_AUTO_SITEMAP env var

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 deploy/harvesters/cosift-compact.sh | 5 ++++-
 internal/crawler/crawler.go         | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/deploy/harvesters/cosift-compact.sh b/deploy/harvesters/cosift-compact.sh
index a693ae4..b87a569 100755
--- a/deploy/harvesters/cosift-compact.sh
+++ b/deploy/harvesters/cosift-compact.sh
@@ -4,6 +4,9 @@
 set -e
 TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 THRESHOLD_PCT=30
+# /admin/hnsw-compact is gated by cluster.peer_auth_token — read it from the
+# same config the server uses so this keeps working once the token is set.
+TOKEN=$(python3 -c "import json; print(json.load(open('/home/ubuntu/cosift.json')).get('cluster',{}).get('peer_auth_token',''))" 2>/dev/null || echo "")
 STATS=$(curl -s --max-time 30 http://127.0.0.1:7777/stats)
 if [ -z "$STATS" ]; then
   echo "${TS} stats fetch failed" | sudo tee -a /var/log/cosift-compact.log >/dev/null
@@ -22,5 +25,5 @@ if [ "$PCT" -lt "$THRESHOLD_PCT" ]; then
   echo "${TS} below threshold, skipping compact" | sudo tee -a /var/log/cosift-compact.log >/dev/null
   exit 0
 fi
-RESULT=$(curl -s --max-time 1800 -X POST http://127.0.0.1:7777/admin/hnsw-compact)
+RESULT=$(curl -s --max-time 1800 -X POST ${TOKEN:+-H "Authorization: Bearer $TOKEN"} http://127.0.0.1:7777/admin/hnsw-compact)
 echo "${TS} compact result: ${RESULT}" | sudo tee -a /var/log/cosift-compact.log >/dev/null
diff --git a/internal/crawler/crawler.go b/internal/crawler/crawler.go
index 5f4315e..c9709ec 100644
--- a/internal/crawler/crawler.go
+++ b/internal/crawler/crawler.go
@@ -347,7 +347,7 @@ func newBare(cfg config.Crawler) *Crawler {
 
 // maybeAutoSitemap kicks off a background sitemap discovery the first
 // time we see a host. Subsequent URLs from the same host return
-// immediately. Disabled when COSIFT_AUTO_SITEMAP=false.
+// immediately. Gated by the crawler.auto_sitemap config field (cosift.json).
 func (c *Crawler) maybeAutoSitemap(ctx context.Context, u *url.URL) {
 	if u == nil || u.Host == "" {
 		return

From 91eee3b57dd931f9e4583fa0699bff580c871d9a Mon Sep 17 00:00:00 2001
From: Teodor Calin <teodor@vulturelabs.io>
Date: Wed, 1 Jul 2026 17:19:03 +0300
Subject: [PATCH 11/11] fix(security): enforce admin auth at the mux level via
 requireAdmin middleware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The /admin/* handlers each inlined the peer-token check, and handleDomainsAudit was missing it — so GET /admin/domains-audit answered without a token (publicly blocked by Caddy, but a real gap). Add an awrap = count+rateLimit+requireAdmin wrapper and route all 24 /admin/* registrations through it, so the token gate is enforced at the mux level regardless of any per-handler check. Verified: /admin/query-log and /admin/crawl-now already 401 without a token; this closes domains-audit and any future miss.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 cmd/cosift/serve_setup.go | 70 +++++++++++++++++++++++++--------------
 1 file changed, 46 insertions(+), 24 deletions(-)

diff --git a/cmd/cosift/serve_setup.go b/cmd/cosift/serve_setup.go
index cf29525..25369a1 100644
--- a/cmd/cosift/serve_setup.go
+++ b/cmd/cosift/serve_setup.go
@@ -477,6 +477,10 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	// qwrap adds query logging (innermost, so it sees the real status+bytes) for
 	// the user-facing query endpoints — the observability substrate we lacked.
 	qwrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(srv.qlog(h))) }
+	// awrap = wrap + admin auth. All /admin/* routes go through this so the
+	// peer-token gate is enforced at the mux level (belt-and-suspenders with any
+	// per-handler check), closing gaps where a handler forgets to inline it.
+	awrap := func(h http.HandlerFunc) http.HandlerFunc { return srv.count(srv.rateLimit(srv.requireAdmin(h))) }
 	// landing page at / and OpenAPI 3.1 spec at /openapi.json.
 	// Both embedded into the binary at build time — operators get a single
 	// self-contained executable, no separate static-asset deployment.
@@ -500,49 +504,49 @@ func runPebbleServe(ctx context.Context, cfg *config.Config, args []string) erro
 	// Single-node deployments still expose
 	// this; it's just unused. Authenticated by cfg.Cluster.PeerAuthToken
 	// (Bearer); when token is empty, requests from any source are accepted.
-	mux.HandleFunc("POST /admin/crawl-enqueue", wrap(srv.handleCrawlEnqueue))
-	mux.HandleFunc("POST /admin/allow-domain", wrap(srv.handleAllowDomain))
-	mux.HandleFunc("POST /admin/frontier-purge-host", wrap(srv.handleFrontierPurgeHost))
-	mux.HandleFunc("POST /admin/frontier-clear", wrap(srv.handleFrontierClear))
-	mux.HandleFunc("POST /admin/frontier-demote-host", wrap(srv.handleFrontierDemoteHost))
-	mux.HandleFunc("POST /admin/frontier-purge-stale-inflight", wrap(srv.handleFrontierPurgeStaleInFlight))
-	mux.HandleFunc("POST /admin/rss-import", wrap(srv.handleRSSImport))
-	mux.HandleFunc("POST /admin/crawl-now", wrap(srv.handleCrawlNow))
-	mux.HandleFunc("POST /admin/wet-import", wrap(srv.handleWETImport))
-	mux.HandleFunc("POST /admin/wet-import-bulk", wrap(srv.handleWETImportBulk))
-	mux.HandleFunc("POST /admin/site-pack", wrap(srv.handleSitePack))
-	mux.HandleFunc("POST /admin/site-submit", wrap(srv.handleSiteSubmit))
-	mux.HandleFunc("POST /admin/embed-backfill", wrap(srv.handleEmbedBackfill))
-	mux.HandleFunc("POST /admin/host-backfill", wrap(srv.handleHostBackfill))
-	mux.HandleFunc("GET /admin/eval-quick", wrap(srv.handleEvalQuick))
-	mux.HandleFunc("POST /admin/hnsw-compact", wrap(srv.handleHNSWCompact))
+	mux.HandleFunc("POST /admin/crawl-enqueue", awrap(srv.handleCrawlEnqueue))
+	mux.HandleFunc("POST /admin/allow-domain", awrap(srv.handleAllowDomain))
+	mux.HandleFunc("POST /admin/frontier-purge-host", awrap(srv.handleFrontierPurgeHost))
+	mux.HandleFunc("POST /admin/frontier-clear", awrap(srv.handleFrontierClear))
+	mux.HandleFunc("POST /admin/frontier-demote-host", awrap(srv.handleFrontierDemoteHost))
+	mux.HandleFunc("POST /admin/frontier-purge-stale-inflight", awrap(srv.handleFrontierPurgeStaleInFlight))
+	mux.HandleFunc("POST /admin/rss-import", awrap(srv.handleRSSImport))
+	mux.HandleFunc("POST /admin/crawl-now", awrap(srv.handleCrawlNow))
+	mux.HandleFunc("POST /admin/wet-import", awrap(srv.handleWETImport))
+	mux.HandleFunc("POST /admin/wet-import-bulk", awrap(srv.handleWETImportBulk))
+	mux.HandleFunc("POST /admin/site-pack", awrap(srv.handleSitePack))
+	mux.HandleFunc("POST /admin/site-submit", awrap(srv.handleSiteSubmit))
+	mux.HandleFunc("POST /admin/embed-backfill", awrap(srv.handleEmbedBackfill))
+	mux.HandleFunc("POST /admin/host-backfill", awrap(srv.handleHostBackfill))
+	mux.HandleFunc("GET /admin/eval-quick", awrap(srv.handleEvalQuick))
+	mux.HandleFunc("POST /admin/hnsw-compact", awrap(srv.handleHNSWCompact))
 	mux.HandleFunc("GET /query", qwrap(srv.handleQuery))
 	mux.HandleFunc("POST /query", qwrap(srv.handleQuery))
 	// import a sitemap.xml (or sitemap-index) and push every
 	// listed URL into the live frontier.
-	mux.HandleFunc("POST /admin/sitemap-import", wrap(srv.handleSitemapImport))
-	mux.HandleFunc("POST /admin/recrawl-sitemap", wrap(srv.handleRecrawlSitemap))
+	mux.HandleFunc("POST /admin/sitemap-import", awrap(srv.handleSitemapImport))
+	mux.HandleFunc("POST /admin/recrawl-sitemap", awrap(srv.handleRecrawlSitemap))
 	// PQ training admin endpoint. Same auth as crawl-enqueue
 	// (Bearer cfg.Cluster.PeerAuthToken). Runs synchronously — for the
 	// 224K-vec corpus we have today it takes ~minutes; operator-only.
-	mux.HandleFunc("POST /admin/pq-train", wrap(srv.handlePQTrain))
+	mux.HandleFunc("POST /admin/pq-train", awrap(srv.handlePQTrain))
 	// backfill-only — re-encode every node that doesn't have a
 	// code yet against the existing codebook. No retrain. Fast.
-	mux.HandleFunc("POST /admin/pq-encode", wrap(srv.handlePQEncode))
+	mux.HandleFunc("POST /admin/pq-encode", awrap(srv.handlePQEncode))
 	// Creates a hard-linked, consistent
 	// snapshot dir that's safe to tar without racing background compactions.
-	mux.HandleFunc("POST /admin/checkpoint", wrap(srv.handleCheckpoint))
+	mux.HandleFunc("POST /admin/checkpoint", awrap(srv.handleCheckpoint))
 	mux.HandleFunc("GET /search", qwrap(srv.handleSearch))
 	mux.HandleFunc("POST /search", qwrap(srv.handleSearchPOST))
 	mux.HandleFunc("GET /contents", wrap(srv.handleContents))
 	mux.HandleFunc("POST /contents", wrap(srv.handleContentsBatch))
 	mux.HandleFunc("GET /verify", wrap(srv.handleVerify))
 	mux.HandleFunc("GET /metrics", wrap(srv.handleMetrics))
-	mux.HandleFunc("GET /admin/query-log", wrap(srv.handleQueryLog))
+	mux.HandleFunc("GET /admin/query-log", awrap(srv.handleQueryLog))
 	mux.HandleFunc("POST /feedback", wrap(srv.handleFeedback))
-	mux.HandleFunc("GET /admin/feedback", wrap(srv.handleFeedbackList))
+	mux.HandleFunc("GET /admin/feedback", awrap(srv.handleFeedbackList))
 	mux.HandleFunc("GET /sla", wrap(srv.handleSLA))
-	mux.HandleFunc("GET /admin/domains-audit", wrap(srv.handleDomainsAudit))
+	mux.HandleFunc("GET /admin/domains-audit", awrap(srv.handleDomainsAudit))
 	mux.HandleFunc("GET /find_similar", qwrap(srv.handleFindSimilar))
 	mux.HandleFunc("POST /find_similar", qwrap(srv.handleFindSimilarPOST))
 	mux.HandleFunc("GET /answer", qwrap(srv.handleAnswer))
@@ -1255,6 +1259,24 @@ func stripPort(remoteAddr string) string {
 // limiter. Returns 429 with a JSON problem doc + Retry-After hint when the
 // bucket is empty. No-op when s.rl is nil.
 //
+// requireAdmin gates a handler on the peer auth token (cfg.Cluster.PeerAuthToken,
+// sent as "Authorization: Bearer <token>"). When the token is empty — the
+// single-node default — the check is skipped and any caller is accepted. Applied
+// at the mux level via awrap to every /admin/* route so no admin handler can ship
+// without auth, even if it forgets the per-handler check.
+func (s *pebbleHTTP) requireAdmin(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if want := s.cluster.PeerAuthToken; want != "" {
+			got := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer ")
+			if got != want {
+				writeProblem(w, http.StatusUnauthorized, "missing or invalid peer token")
+				return
+			}
+		}
+		h(w, r)
+	}
+}
+
 // X-Forwarded-For is honored ONLY when the request came from a configured
 // trusted proxy; otherwise clients could spoof their IP by setting the header.
 // For self-host with cosift directly on the public network, leave