From 7e5511b33d020636db028625efbb1e7987e7698b Mon Sep 17 00:00:00 2001
From: luvs01 <luvs01@hanmail.net>
Date: Mon, 14 Sep 2026 13:47:26 +0900
Subject: [PATCH 01/11] fix(gui): keep failed reauth cancellation retryable

---
 .../codex-account-pool-main-card.tsx          |  3 ++
 gui/src/components/use-main-device-reauth.ts  | 25 +++++++---
 gui/tests/main-device-reauth.test.tsx         | 48 +++++++++++++++++++
 3 files changed, 69 insertions(+), 7 deletions(-)

diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index e1439c1439..0f7e7f2d8f 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -218,6 +218,9 @@ export function CodexAccountPoolMainCard({
                   <strong>{t("codexAuth.mainReauthCode")}: {mainReauth.state.deviceCode}</strong>
                 )}
                 <span className="faint">{t("codexAuth.mainReauthPending")}</span>
+                {mainReauth.state.cancelFailed && (
+                  <span className="badge badge-amber">{t("codexAuth.mainReauthFailed")}</span>
+                )}
                 <button
                   type="button"
                   className="btn btn-ghost btn-sm codex-auth-action-btn"
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index 9914908c9e..efe2ded339 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -31,8 +31,8 @@ export type MainDeviceReauthFailureCode =
 export type MainDeviceReauthState =
   | { phase: "idle" }
   | { phase: "starting" }
-  | { phase: "pending"; flowId: string; verificationUrl: string; deviceCode: string }
-  | { phase: "committing"; flowId: string; verificationUrl: string; deviceCode: string }
+  | { phase: "pending"; flowId: string; verificationUrl: string; deviceCode: string; cancelFailed?: boolean }
+  | { phase: "committing"; flowId: string; verificationUrl: string; deviceCode: string; cancelFailed?: boolean }
   | { phase: "succeeded" }
   | { phase: "cancelled" }
   | { phase: "failed"; code: MainDeviceReauthFailureCode };
@@ -84,16 +84,27 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
   const cancel = useCallback(async () => {
     const flowId = flowRef.current;
     stopPolling();
-    flowRef.current = null;
     if (!flowId) {
       setState({ phase: "idle" });
       return;
     }
     try {
-      await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
-    } catch { /* best-effort: the flow expires on its own */ }
-    setState({ phase: "cancelled" });
-  }, [apiBase, stopPolling]);
+      const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
+      if (!res.ok) throw new Error();
+      const dto = await res.json().catch(() => ({})) as FlowDto;
+      if (dto.status !== "cancelled" && dto.status !== "succeeded") {
+        throw new Error();
+      }
+      flowRef.current = null;
+      setState({ phase: dto.status });
+      if (dto.status === "succeeded") onCompleted();
+    } catch {
+      // Keep ownership of the flow so the operator can retry cancellation.
+      setState(current => current.phase === "pending" || current.phase === "committing"
+        ? { ...current, cancelFailed: true }
+        : current);
+    }
+  }, [apiBase, onCompleted, stopPolling]);
 
   const start = useCallback(async () => {
     stopPolling();
diff --git a/gui/tests/main-device-reauth.test.tsx b/gui/tests/main-device-reauth.test.tsx
index ab883686c4..e1fef839eb 100644
--- a/gui/tests/main-device-reauth.test.tsx
+++ b/gui/tests/main-device-reauth.test.tsx
@@ -167,3 +167,51 @@ test("the hook POSTs an empty body to the dedicated route and polls to success",
   expect(captured!.state.phase).toBe("cancelled");
   expect(requests.some(r => r.method === "DELETE")).toBe(true);
 });
+
+test("a rejected cancellation retains the flow and can be retried", async () => {
+  let deleteAttempts = 0;
+  let completed = 0;
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.endsWith("/api/codex-auth/main/reauth-device") && init?.method === "POST") {
+        return Response.json({ flowId: "f1", status: "pending" });
+      }
+      if (init?.method === "DELETE") {
+        deleteAttempts += 1;
+        return deleteAttempts === 1
+          ? Response.json({ code: "unauthorized" }, { status: 401 })
+          : Response.json({ flowId: "f1", status: "succeeded" });
+      }
+      return Response.json({ flowId: "f1", status: "pending", verificationUrl: DEVICE_URL, deviceCode: DEVICE_CODE });
+    },
+  });
+  let captured: ReturnType<typeof useMainDeviceReauth> | null = null;
+  const Probe = () => {
+    const value = useMainDeviceReauth("", () => { completed += 1; });
+    useEffect(() => { captured = value; });
+    return null;
+  };
+  const { createRoot } = await import("react-dom/client");
+  const { createElement } = await import("react");
+  await act(async () => {
+    root = createRoot(host);
+    root.render(createElement(Probe));
+  });
+  await act(async () => {
+    void captured!.start();
+    const deadline = Date.now() + 2000;
+    while (captured!.state.phase !== "pending" && Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, 5));
+    }
+  });
+
+  await act(async () => { await captured!.cancel(); });
+  expect(captured!.state).toMatchObject({ phase: "pending", flowId: "f1", cancelFailed: true });
+
+  await act(async () => { await captured!.cancel(); });
+  expect(deleteAttempts).toBe(2);
+  expect(captured!.state.phase).toBe("succeeded");
+  expect(completed).toBe(1);
+});

From 46747b31ec6ff97ccf9e1cb194ab636a2b937297 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:11:39 +0900
Subject: [PATCH 02/11] fix(gui): settle failed reauth cancellation responses

---
 .../content/docs/guides/codex-integration.md  |  2 +
 gui/src/components/use-main-device-reauth.ts  |  6 ++-
 gui/tests/main-device-reauth.test.tsx         | 52 +++++++++++++++++++
 structure/gui-and-management-api.md           |  2 +-
 4 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index edfca8ca6b..51b12f33de 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -807,6 +807,8 @@ Background revalidation is separate and off by default. It requires Token Guardi
 
 ### Why an account stopped serving requests
 
+When cancelling main-account device reauthentication, a failed cancellation request keeps the flow available for another cancellation attempt. If the server reports that the flow has already failed, the card instead shows that terminal failure and releases the old flow; it does not keep retrying cancellation or report a successful login.
+
 When an account leaves pool selection, the reason travels with the decision instead of being recomputed for display, so a surface can never report an account healthy while routing is dropping it. `GET /api/codex-auth/accounts` carries `reauthReason` next to `needsReauth` on each account: `missing_credential` for a credential that was never stored, `refresh_failed` for a credential refresh that keeps failing, and `quota_unauthorized` when the usage lookup itself was rejected.
 
 A main-account refresh that does not complete still answers `503` with `Retry-After`, because a retry may still succeed. The message now adds that a failure which persists means the main account needs reauthentication, rather than only asking for another attempt.
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index efe2ded339..84b85e9825 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -92,11 +92,13 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
       if (!res.ok) throw new Error();
       const dto = await res.json().catch(() => ({})) as FlowDto;
-      if (dto.status !== "cancelled" && dto.status !== "succeeded") {
+      if (dto.status !== "cancelled" && dto.status !== "succeeded" && dto.status !== "failed") {
         throw new Error();
       }
       flowRef.current = null;
-      setState({ phase: dto.status });
+      setState(dto.status === "failed"
+        ? { phase: "failed", code: failureCode(dto.code) }
+        : { phase: dto.status });
       if (dto.status === "succeeded") onCompleted();
     } catch {
       // Keep ownership of the flow so the operator can retry cancellation.
diff --git a/gui/tests/main-device-reauth.test.tsx b/gui/tests/main-device-reauth.test.tsx
index e1fef839eb..3711680258 100644
--- a/gui/tests/main-device-reauth.test.tsx
+++ b/gui/tests/main-device-reauth.test.tsx
@@ -215,3 +215,55 @@ test("a rejected cancellation retains the flow and can be retried", async () =>
   expect(captured!.state.phase).toBe("succeeded");
   expect(completed).toBe(1);
 });
+
+test.each([
+  ["identity_mismatch", "identity_mismatch"],
+  ["unknown_failure", "request_failed"],
+])("a failed cancellation terminal clears the flow and normalizes %s", async (code, expectedCode) => {
+  let deleteAttempts = 0;
+  let completed = 0;
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.endsWith("/api/codex-auth/main/reauth-device") && init?.method === "POST") {
+        return Response.json({ flowId: "f1", status: "pending" });
+      }
+      if (init?.method === "DELETE") {
+        deleteAttempts += 1;
+        return Response.json({ flowId: "f1", status: "failed", code });
+      }
+      return Response.json({ flowId: "f1", status: "pending", verificationUrl: DEVICE_URL, deviceCode: DEVICE_CODE });
+    },
+  });
+  let captured: ReturnType<typeof useMainDeviceReauth> | null = null;
+  const Probe = () => {
+    const value = useMainDeviceReauth("", () => { completed += 1; });
+    useEffect(() => { captured = value; });
+    return null;
+  };
+  const { createRoot } = await import("react-dom/client");
+  const { createElement } = await import("react");
+  await act(async () => {
+    root = createRoot(host);
+    root.render(createElement(Probe));
+  });
+  await act(async () => {
+    void captured!.start();
+    const deadline = Date.now() + 2000;
+    while (captured!.state.phase !== "pending" && Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, 5));
+    }
+  });
+  expect(captured!.state.phase).toBe("pending");
+
+  await act(async () => { await captured!.cancel(); });
+  expect(captured!.state).toEqual({ phase: "failed", code: expectedCode });
+  expect(completed).toBe(0);
+  expect(deleteAttempts).toBe(1);
+
+  // A terminal failure releases ownership instead of retaining a stale retry.
+  await act(async () => { await captured!.cancel(); });
+  expect(captured!.state.phase).toBe("idle");
+  expect(deleteAttempts).toBe(1);
+});
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 0496735405..9c4f2ac6e6 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -336,7 +336,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unknown or nonterminal cancellation replies remain retryable. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default

From 1999336bf2ffe5a2e0f504a9af2b585fd665122e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 15:31:08 +0900
Subject: [PATCH 03/11] docs: link reauth cancellation from GUI source owners

---
 structure/design-methodology.md | 2 ++
 structure/overview.md           | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 81975c08e4..20c10d3700 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -52,3 +52,5 @@ The pairing panel names the hub, offers an origin-specific command to run on tha
 Cline uses the existing file-integration page, tabs, status badge and rollback dialogs. Its localized semantics identify both files and the required stop/restart boundary before users mutate them.
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
+
+Native-main reauthentication cancellation follows the [GUI state contract](gui-and-management-api.md#dashboard-surfaces): failed requests remain retryable, while confirmed failed flows release ownership and show the existing normalized failure state.
diff --git a/structure/overview.md b/structure/overview.md
index 0151115adc..38b19427dd 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -147,3 +147,5 @@ Translated Chat request construction uses the [inline-image budget](transports/s
 The [explicit model-capability contract](config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
 Provider-scoped approval reviewer settings are projected by the [catalog owner](catalog.md#provider-scoped-approval-reviewer); this surface retains its existing routing, transport and account-selection behavior.
+
+Native-main reauthentication cancellation follows the [GUI state contract](gui-and-management-api.md#dashboard-surfaces): failed requests remain retryable, while confirmed failed flows release ownership and show the existing normalized failure state.

From 1d3e082b007b435c72dad2b86dbc9d3e9705003e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 16:01:43 +0900
Subject: [PATCH 04/11] fix(gui): announce reauth cancellation failures

---
 .../src/content/docs/guides/codex-integration.md  |  2 +-
 .../components/codex-account-pool-main-card.tsx   |  2 +-
 gui/tests/main-device-reauth.test.tsx             | 15 +++++++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index 51b12f33de..e909998b6d 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -807,7 +807,7 @@ Background revalidation is separate and off by default. It requires Token Guardi
 
 ### Why an account stopped serving requests
 
-When cancelling main-account device reauthentication, a failed cancellation request keeps the flow available for another cancellation attempt. If the server reports that the flow has already failed, the card instead shows that terminal failure and releases the old flow; it does not keep retrying cancellation or report a successful login.
+When cancelling main-account device reauthentication, a failed cancellation request keeps the flow available for another cancellation attempt. An HTTP-success response with an unknown or nonterminal status also retains the flow and allows retrying cancellation. If the server reports that the flow has already failed, the card instead shows that terminal failure and releases the old flow; it does not keep retrying cancellation or report a successful login.
 
 When an account leaves pool selection, the reason travels with the decision instead of being recomputed for display, so a surface can never report an account healthy while routing is dropping it. `GET /api/codex-auth/accounts` carries `reauthReason` next to `needsReauth` on each account: `missing_credential` for a credential that was never stored, `refresh_failed` for a credential refresh that keeps failing, and `quota_unauthorized` when the usage lookup itself was rejected.
 
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index 0f7e7f2d8f..327b53001f 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -219,7 +219,7 @@ export function CodexAccountPoolMainCard({
                 )}
                 <span className="faint">{t("codexAuth.mainReauthPending")}</span>
                 {mainReauth.state.cancelFailed && (
-                  <span className="badge badge-amber">{t("codexAuth.mainReauthFailed")}</span>
+                  <span role="status" className="badge badge-amber">{t("codexAuth.mainReauthFailed")}</span>
                 )}
                 <button
                   type="button"
diff --git a/gui/tests/main-device-reauth.test.tsx b/gui/tests/main-device-reauth.test.tsx
index 3711680258..3c0247880d 100644
--- a/gui/tests/main-device-reauth.test.tsx
+++ b/gui/tests/main-device-reauth.test.tsx
@@ -113,6 +113,21 @@ test("a pending flow shows the URL and human code and cancel owns the flow", asy
   expect(calls.cancels).toBe(1);
 });
 
+test("a retryable cancellation failure is announced without removing cancellation", async () => {
+  const calls = { starts: 0, cancels: 0 };
+  await mount(calls, {
+    phase: "pending", flowId: "f1", verificationUrl: DEVICE_URL,
+    deviceCode: DEVICE_CODE, cancelFailed: true,
+  });
+  const notice = host.querySelector('.codex-main-reauth-pending [role="status"]');
+  expect(notice?.textContent).toBe("codexAuth.mainReauthFailed");
+  const cancel = Array.from(host.querySelectorAll("button.codex-auth-action-btn"))
+    .find(button => button.textContent?.includes("codexAuth.mainReauthCancel"));
+  expect(cancel).toBeDefined();
+  await act(async () => { (cancel as HTMLButtonElement).click(); });
+  expect(calls.cancels).toBe(1);
+});
+
 test("the hook POSTs an empty body to the dedicated route and polls to success", async () => {
   Object.defineProperty(globalThis, "fetch", {
     configurable: true,

From 5d4f5c76ea2d955691c7067c34a121fb3dead16a Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 16:53:25 +0900
Subject: [PATCH 05/11] fix(gui): release expired main reauth flows

---
 .../content/docs/fr/guides/codex-integration.md |  4 ++++
 .../content/docs/guides/codex-integration.md    |  2 +-
 .../content/docs/ja/guides/codex-integration.md |  4 ++++
 .../content/docs/ko/guides/codex-integration.md |  4 ++++
 .../content/docs/ru/guides/codex-integration.md |  4 ++++
 .../content/docs/tr/guides/codex-integration.md |  4 ++++
 .../docs/zh-cn/guides/codex-integration.md      |  4 ++++
 .../docs/zh-tw/guides/codex-integration.md      |  4 ++++
 gui/src/components/use-main-device-reauth.ts    |  9 ++++++++-
 gui/tests/main-device-reauth.test.tsx           | 17 +++++++++++------
 structure/design-methodology.md                 |  2 ++
 structure/gui-and-management-api.md             |  2 +-
 structure/overview.md                           |  2 ++
 13 files changed, 53 insertions(+), 9 deletions(-)

diff --git a/docs-site/src/content/docs/fr/guides/codex-integration.md b/docs-site/src/content/docs/fr/guides/codex-integration.md
index 9a603b910a..1b9e006b43 100644
--- a/docs-site/src/content/docs/fr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/fr/guides/codex-integration.md
@@ -422,3 +422,7 @@ Codex. Seule l'exécution explicite de `ocx stop` ou `ocx service stop` restaure
 Une transition de fournisseur peut renvoyer `history_paginated_requires_native_writer` si le stockage concerné prend en charge la pagination, même pour ses lignes legacy. Cette raison ne refuse plus la configuration Codex, le profil de référence ni le catalogue de modèles. `ocx sync` et `ocx start` écrivent toujours ces fichiers et définissent `model_catalog_json`, afin que le sélecteur de modèles Codex continue d’afficher tous les modèles routés par OpenCodex. Seule cette raison interrompt le réétiquetage de l’historique des conversations, car Codex attribue les numéros d’historique paginé dans son propre processus d’écriture et aucune nouvelle tentative n’y change rien. Toute autre raison de contrôle préalable de l’historique — une base d’état illisible, un historique dont l’identité a changé, ou un contrôle préalable qui n’a pas pu s’exécuter — refuse encore toute la transition et l’annule, car ces cas peuvent réussir plus tard. Dans cet état, OpenCodex ne modifie jamais les fichiers d’historique paginé ni les lignes de conversation. Les conversations existantes conservent le fournisseur déjà associé et ne sont pas migrées ; les nouvelles conversations passent par le proxy. Lorsque le réétiquetage est interrompu, une table `[model_providers.opencodex]` déjà présente dans le répertoire d’accueil est conservée plutôt que retirée, y compris sous la forme root-override (loopback), afin que les conversations dont les lignes sont étiquetées `opencodex` gardent un identifiant de fournisseur qui existe encore. Le CLI affiche `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`. `ocx restore` et la suppression de la configuration Codex refusent toujours sur `history_paginated_requires_native_writer`. Retirer la définition `[model_providers.opencodex]` alors que des lignes de conversation la référencent encore rendrait ces conversations irrésolubles, et le chemin de restauration n’a aucun moyen de conserver une table de fournisseur de compatibilité. Un répertoire d’accueil déjà paginé ne peut pas actuellement être désinstallé par le produit ; c’est un travail ouvert connu, et non le comportement voulu.
 
 Ne réécrivez pas un historique paginé actif ni une ligne de conversation pour forcer une migration. Fermez la conversation avant toute récupération et signalez l’erreur exacte et les versions sans publier de données privées. Une sauvegarde ou le succès d’un script ne prouve pas le rétablissement de l’affichage : vérifiez la conversation après réouverture de Codex.
+
+## Annulation de la réauthentification du compte principal
+
+Lors de l’annulation de la réauthentification du compte principal par code d’appareil, une réponse HTTP 404 avec le code `unknown_flow` libère le flux expiré pour permettre une nouvelle connexion par code d’appareil, sans indiquer une connexion réussie ni une annulation confirmée.
diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index e909998b6d..315edad459 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -807,7 +807,7 @@ Background revalidation is separate and off by default. It requires Token Guardi
 
 ### Why an account stopped serving requests
 
-When cancelling main-account device reauthentication, a failed cancellation request keeps the flow available for another cancellation attempt. An HTTP-success response with an unknown or nonterminal status also retains the flow and allows retrying cancellation. If the server reports that the flow has already failed, the card instead shows that terminal failure and releases the old flow; it does not keep retrying cancellation or report a successful login.
+When cancelling main-account device reauthentication, transient request failures and replies with unknown or nonterminal status values keep cancellation retryable. A DELETE response with HTTP 404 and code `unknown_flow` instead releases the expired flow so device re-login can be started again; it reports neither successful login nor confirmed cancellation. If the server reports a terminal `failed` state, the card displays that failure and also releases the old flow.
 
 When an account leaves pool selection, the reason travels with the decision instead of being recomputed for display, so a surface can never report an account healthy while routing is dropping it. `GET /api/codex-auth/accounts` carries `reauthReason` next to `needsReauth` on each account: `missing_credential` for a credential that was never stored, `refresh_failed` for a credential refresh that keeps failing, and `quota_unauthorized` when the usage lookup itself was rejected.
 
diff --git a/docs-site/src/content/docs/ja/guides/codex-integration.md b/docs-site/src/content/docs/ja/guides/codex-integration.md
index cc44ec28c3..64ab09f31a 100644
--- a/docs-site/src/content/docs/ja/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ja/guides/codex-integration.md
@@ -284,3 +284,7 @@ opencodex が管理対象 [バックグラウンドサービス](/reference/cli/
 対象の履歴ストアがページ分割をサポートする場合、プロバイダー変更は `history_paginated_requires_native_writer` を返すことがあります。この理由では、Codex の設定、参照プロファイル、モデルカタログは拒否されません。`ocx sync` と `ocx start` はこれらのファイルを書き込み、`model_catalog_json` を設定するため、Codex のモデル選択には OpenCodex 経由のモデルがすべて表示され続けます。会話履歴の再ラベル付けを控えるのはこの理由だけの場合です。ページ分割された履歴の番号は Codex 自身の書き込み処理が割り当て、再試行しても変わりません。読み取れない状態データベース、識別子が変わった履歴、実行できなかった事前検査など、それ以外の履歴事前検査の理由では、後から成功する可能性があるため、遷移全体を拒否してロールバックします。この状態では OpenCodex はページ分割された履歴ファイルやスレッド行を変更しません。既存の会話はすでに付いているプロバイダーのまま移行されず、新しい会話は通常どおりプロキシ経由でルーティングされます。再ラベル付けを控えるとき、ホームに既にある `[model_providers.opencodex]` テーブルは廃止せず残します。ルート上書き（loopback）形式でも同じで、行が `opencodex` と付いている会話は、まだ存在するプロバイダー id を保てます。移行可能なストアの legacy 行も対象です。CLI は `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)` と表示します。`ocx restore` と Codex 設定の削除は、いまも `history_paginated_requires_native_writer` で拒否されます。スレッド行がまだ参照しているのに `[model_providers.opencodex]` 定義を外すと、それらの会話は解決できなくなり、復元経路には互換プロバイダー表を残す手段がありません。すでにページ分割されているホームは、現状では製品からアンインストールできません。意図した動作ではなく、既知の未解決作業です。
 
 会話を移行しようとして使用中のページ分割履歴やスレッド行を書き換えないでください。復元前に対象の会話を閉じ、個人の履歴を公開せず正確なエラーとバージョンを報告してください。バックアップやスクリプトの成功だけでは表示の復元は証明されません。再度開いた Codex で確認してください。
+
+## メインアカウントの再認証のキャンセル
+
+メインアカウントのデバイスコードによる再認証をキャンセルする際、HTTP 404 と `unknown_flow` コードが返された場合は期限切れのフローを解放して再ログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。
diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md
index 7e353c50f9..75f4054669 100644
--- a/docs-site/src/content/docs/ko/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ko/guides/codex-integration.md
@@ -381,3 +381,7 @@ opencodex가 managed [background service](/reference/cli/#ocx-service)로 실행
 영향받는 기록 저장소가 페이지 분할을 지원하면 프로바이더 전환이 `history_paginated_requires_native_writer`를 반환할 수 있습니다. 이 이유로는 Codex 설정, 참조 프로필, 모델 카탈로그를 더 이상 거부하지 않습니다. `ocx sync`와 `ocx start`는 해당 파일과 `model_catalog_json`을 계속 쓰므로 Codex 모델 선택기에는 OpenCodex가 라우팅하는 모델이 모두 그대로 보입니다. 대화 기록의 프로바이더 재지정을 건너뛰는 것은 이 이유뿐이며, 페이지 분할 순번은 Codex 자체의 네이티브 기록 작성자가 할당하고 재시도해도 달라지지 않기 때문입니다. 읽을 수 없는 상태 데이터베이스, 식별자가 바뀐 대화 원본, 실행하지 못한 사전 검사처럼 다른 기록 사전 검사 이유는 나중에 성공할 수 있으므로 전환 전체를 거부하고 되돌립니다. 이 상태에서 OpenCodex는 페이지 분할 대화 원본이나 스레드 행을 수정하지 않습니다. 기존 대화는 이미 붙어 있는 프로바이더를 유지하고 이전되지 않으며, 새 대화는 평소처럼 프록시를 통해 라우팅됩니다. 재지정을 건너뛸 때 홈에 이미 있던 `[model_providers.opencodex]` 테이블은 폐기하지 않고 유지합니다. root-override(loopback) 형식에서도 같아서, 행이 `opencodex`로 표시된 대화는 아직 존재하는 프로바이더 id를 유지합니다. 변환 가능한 저장소의 `legacy` 행도 포함됩니다. CLI는 `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`를 출력합니다. `ocx restore`와 Codex 설정 제거는 여전히 `history_paginated_requires_native_writer`로 거부됩니다. 스레드 행이 아직 참조하는데 `[model_providers.opencodex]` 정의를 걷어내면 그 대화를 해석할 수 없고, 복원 경로에는 호환 프로바이더 테이블을 남겨 둘 방법이 없습니다. 이미 페이지 분할된 홈은 지금은 제품으로 제거할 수 없습니다. 의도한 동작이 아니라 알려진 미해결 작업입니다.
 
 대화를 강제로 이전하려고 실행 중인 페이지 분할 대화 원본이나 스레드 행을 고치지 마세요. 복구 전에 해당 대화를 닫은 뒤, 개인 대화 내용을 올리지 말고 정확한 오류와 버전을 보고하세요. 백업이나 스크립트 성공만으로 표시 복구가 증명되지는 않으므로 Codex를 다시 열어 확인하세요.
+
+## 메인 계정 재인증 취소
+
+메인 계정의 기기 코드 재인증을 취소할 때 HTTP 404와 `unknown_flow` 코드가 반환되면 만료된 흐름을 해제하여 기기 코드 재로그인을 다시 시작할 수 있게 하며, 로그인 성공이나 취소 확정으로 표시하지 않습니다.
diff --git a/docs-site/src/content/docs/ru/guides/codex-integration.md b/docs-site/src/content/docs/ru/guides/codex-integration.md
index 1cca5f59fd..8638c47ac5 100644
--- a/docs-site/src/content/docs/ru/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ru/guides/codex-integration.md
@@ -416,3 +416,7 @@ ocx restore back # point plain Codex at the running proxy again
 Если затронутое хранилище поддерживает постраничную историю, смена провайдера может вернуть `history_paginated_requires_native_writer`, в том числе для строк legacy. По этой причине больше не отклоняются конфигурация Codex, опорный профиль и каталог моделей. `ocx sync` и `ocx start` по-прежнему записывают эти файлы и задают `model_catalog_json`, поэтому выбор модели Codex продолжает показывать все модели, маршрутизируемые через OpenCodex. Переразметку истории разговоров останавливает только эта причина: порядковые номера постраничной истории выделяет собственный процесс записи Codex, и повторная попытка этого не меняет. Любая другая причина предварительной проверки истории — нечитаемая база состояния, история со сменившейся идентификацией или проверка, которую не удалось запустить, — по-прежнему отклоняет весь переход и откатывает его, потому что такие случаи могут пройти позже. В этом состоянии OpenCodex не изменяет постраничные файлы истории и строки тредов. Существующие разговоры сохраняют уже назначенного провайдера и не мигрируют; новые разговоры идут через прокси как обычно. Когда переразметка останавливается, таблица `[model_providers.opencodex]`, уже бывшая в домашнем каталоге, сохраняется, а не снимается, в том числе в форме root-override (loopback), чтобы разговоры со строками, помеченными `opencodex`, сохраняли существующий идентификатор провайдера. CLI выводит `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`. `ocx restore` и удаление конфигурации Codex по-прежнему отказывают по `history_paginated_requires_native_writer`. Удаление определения `[model_providers.opencodex]`, пока строки тредов на него ссылаются, сделало бы эти разговоры неразрешимыми, а путь восстановления не умеет оставлять таблицу совместимости провайдера. Домашний каталог, уже переведённый на постраничную историю, сейчас нельзя удалить средствами продукта; это известная открытая задача, а не задуманное поведение.
 
 Не переписывайте активную постраничную историю или строку треда, чтобы самостоятельно перенести разговоры. Закройте разговор перед восстановлением и сообщите точную ошибку и версии без публикации личной истории. Наличие резервной копии или успешный скрипт не доказывает восстановление отображения: проверьте разговор после повторного открытия Codex.
+
+## Отмена повторной аутентификации основного аккаунта
+
+При отмене повторной аутентификации основного аккаунта по коду устройства ответ HTTP 404 с кодом `unknown_flow` освобождает истёкший процесс, позволяя начать вход по коду устройства заново, но не сообщает об успешном входе или подтверждённой отмене.
diff --git a/docs-site/src/content/docs/tr/guides/codex-integration.md b/docs-site/src/content/docs/tr/guides/codex-integration.md
index 436c995bdb..1a0e013bf1 100644
--- a/docs-site/src/content/docs/tr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/tr/guides/codex-integration.md
@@ -473,3 +473,7 @@ service stop` yerel Codex'i geri yükler.
 Etkilenen geçmiş deposu sayfalamayı destekliyorsa sağlayıcı değişimi `history_paginated_requires_native_writer` döndürebilir; legacy satırlar da buna dahildir. Bu neden artık Codex yapılandırmasını, başvuru profilini veya model kataloğunu reddetmez. `ocx sync` ve `ocx start` bu dosyaları yazmaya ve `model_catalog_json` yolunu ayarlamaya devam eder; böylece Codex model seçicisi OpenCodex üzerinden yönlendirilen her modeli göstermeyi sürdürür. Konuşma geçmişinin yeniden etiketlenmesini durduran yalnızca bu nedendir, çünkü sayfalanmış geçmiş sıra numaralarını Codex’in kendi yerel yazıcısı atar ve yeniden denemek bunu değiştirmez. Okunamayan bir durum veritabanı, kimliği değişmiş bir geçmiş veya çalıştırılamayan bir ön kontrol gibi diğer geçmiş ön kontrol nedenleri, daha sonra başarılı olabilecekleri için hâlâ tüm değişimi reddeder ve geri alır. Bu durumda OpenCodex sayfalanmış geçmiş dosyalarını veya iş parçacığı satırlarını değiştirmez. Mevcut konuşmalar zaten etiketlendikleri sağlayıcıda kalır ve taşınmaz; yeni konuşmalar proxy üzerinden normal şekilde yönlendirilir. Yeniden etiketleme durduğunda, ev dizininde zaten bulunan bir `[model_providers.opencodex]` tablosu kaldırılmaz, kök-override (loopback) biçimde bile tutulur; böylece satırları `opencodex` olarak etiketlenmiş konuşmalar hâlâ var olan bir sağlayıcı kimliğini korur. CLI şunu yazdırır: `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`. `ocx restore` ve Codex yapılandırmasının kaldırılması `history_paginated_requires_native_writer` nedeniyle hâlâ reddedilir. İş parçacığı satırları hâlâ ona başvuruyken `[model_providers.opencodex]` tanımını kaldırmak o konuşmaları çözülemez yapar ve geri yükleme yolu uyumluluk sağlayıcı tablosunu tutamaz. Zaten sayfalanmış bir ev dizini şu anda ürün üzerinden kaldırılamaz; bu amaçlanan davranış değil, bilinen açık iştir.
 
 Konuşmaları kendiniz taşımak için etkin sayfalanmış geçmişi veya iş parçacığı satırını yeniden yazmayın. Kurtarmadan önce konuşmayı kapatın ve özel geçmişi yayımlamadan tam hatayı ve sürümleri bildirin. Yedek veya başarılı betik görüntünün düzeldiğini kanıtlamaz; Codex’i yeniden açıp konuşmayı kontrol edin.
+
+## Ana hesabın yeniden kimlik doğrulamasını iptal etme
+
+Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken `unknown_flow` koduyla HTTP 404 yanıtı alınırsa süresi dolmuş akış serbest bırakılarak cihaz koduyla yeniden giriş başlatılabilir, ancak girişin başarılı olduğu veya iptalin onaylandığı bildirilmez.
diff --git a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
index dfdac6d98a..cd77d024ce 100644
--- a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
@@ -359,3 +359,7 @@ ocx restore back # point plain Codex at the running proxy again
 如果受影响的历史存储支持分页，提供商切换可能返回 `history_paginated_requires_native_writer`。该原因不再拒绝写入 Codex 配置、参考配置档和模型目录。`ocx sync` 与 `ocx start` 仍会写入这些文件并设置 `model_catalog_json`，因此 Codex 模型选择器会继续显示所有经 OpenCodex 路由的模型。只有这一条原因会让会话历史的重新标记停手，因为分页历史序号由 Codex 自己的写入器分配，重试也不会改变。无法读取的状态数据库、身份已变的历史文件、未能运行的预检等其他历史预检原因仍会拒绝整个切换并回滚，因为那些情况以后可能成功。在此状态下，OpenCodex 不会修改分页历史文件或线程行。现有会话保留已标记的提供商，不会被迁移；新会话仍正常经代理路由。重新标记停手时，主目录里已有的 `[model_providers.opencodex]` 表会保留而不是撤下，即便是 root-override（loopback）形式也一样，这样行上标记为 `opencodex` 的会话仍能对应到还存在的提供商 id。可迁移存储中的 legacy 记录也适用。CLI 会打印 `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`。`ocx restore` 和移除 Codex 配置仍会因 `history_paginated_requires_native_writer` 被拒绝。线程行仍在引用时撤掉 `[model_providers.opencodex]` 定义会使这些会话无法解析，而恢复路径没有办法留下兼容提供商表。已经分页的主目录目前无法通过产品卸载；这是已知的未完成工作，而非预期行为。
 
 不要改写正在使用的分页历史文件或线程行来自行迁移这些会话。恢复前关闭相关会话，并只报告准确的错误和版本，不要公开私人历史。备份或脚本成功并不能证明显示已恢复；重新打开 Codex 后检查会话。
+
+## 取消主账号重新认证
+
+取消主账号的设备代码重新认证时，如果收到 HTTP 404 且错误代码为 `unknown_flow`，系统会释放已过期的流程，以便重新开始设备代码登录，但不会显示登录成功或已确认取消。
diff --git a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
index 284034b54b..00cee3d321 100644
--- a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
@@ -366,3 +366,7 @@ ocx restore back # 讓普通 Codex 再次指向仍在執行的 proxy
 如果受影響的歷史儲存區支援分頁，提供者切換可能傳回 `history_paginated_requires_native_writer`。此原因不再拒絕寫入 Codex 設定、參考設定檔與模型目錄。`ocx sync` 與 `ocx start` 仍會寫入這些檔案並設定 `model_catalog_json`，因此 Codex 模型選擇器會繼續顯示所有經 OpenCodex 路由的模型。只有這一條原因會讓對話歷史的重新標記停手，因為分頁歷史序號由 Codex 自己的寫入器分配，重試也不會改變。無法讀取的狀態資料庫、身分已變的歷史檔案、未能執行的預檢等其他歷史預檢原因仍會拒絕整個切換並回復，因為那些情況以後可能成功。在此狀態下，OpenCodex 不會修改分頁歷史檔案或執行緒列。既有對話保留已標記的提供者，不會被遷移；新對話仍正常經代理路由。重新標記停手時，家目錄裡既有的 `[model_providers.opencodex]` 表會保留而不是撤下，即便是 root-override（loopback）形式也一樣，這樣列上標記為 `opencodex` 的對話仍能對應到還存在的提供者 id。可遷移儲存區中的 legacy 記錄也適用。CLI 會印出 `Codex resume history: left to Codex's native writer (history_paginated_requires_native_writer)`。`ocx restore` 與移除 Codex 設定仍會因 `history_paginated_requires_native_writer` 被拒絕。執行緒列仍在參照時撤掉 `[model_providers.opencodex]` 定義會使這些對話無法解析，而復原路徑沒有辦法留下相容提供者表。已經分頁的家目錄目前無法透過產品解除安裝；這是已知的未完成工作，而非預期行為。
 
 請勿改寫使用中的分頁歷史檔案或執行緒列來自行遷移這些對話。復原前關閉相關對話，只回報確切錯誤與版本，不要公開私人歷史。備份或指令碼成功不能證明顯示已復原；重新開啟 Codex 後確認對話。
+
+## 取消主帳號重新驗證
+
+取消主帳號的裝置代碼重新驗證時，如果收到 HTTP 404 且錯誤代碼為 `unknown_flow`，系統會釋放已過期的流程，以便重新開始裝置代碼登入，但不會顯示登入成功或已確認取消。
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index 84b85e9825..1f134d3a2e 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -90,8 +90,15 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     }
     try {
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
-      if (!res.ok) throw new Error();
       const dto = await res.json().catch(() => ({})) as FlowDto;
+      if (res.status === 404 && dto.code === "unknown_flow") {
+        // The service may have expired its terminal receipt after a lost DELETE response.
+        // Release the stale ID without claiming cancellation or successful authentication.
+        flowRef.current = null;
+        setState({ phase: "failed", code: "request_failed" });
+        return;
+      }
+      if (!res.ok) throw new Error();
       if (dto.status !== "cancelled" && dto.status !== "succeeded" && dto.status !== "failed") {
         throw new Error();
       }
diff --git a/gui/tests/main-device-reauth.test.tsx b/gui/tests/main-device-reauth.test.tsx
index 3c0247880d..3a6be99ff0 100644
--- a/gui/tests/main-device-reauth.test.tsx
+++ b/gui/tests/main-device-reauth.test.tsx
@@ -183,7 +183,11 @@ test("the hook POSTs an empty body to the dedicated route and polls to success",
   expect(requests.some(r => r.method === "DELETE")).toBe(true);
 });
 
-test("a rejected cancellation retains the flow and can be retried", async () => {
+test.each([
+  [401, "unauthorized"],
+  [404, "route_not_found"],
+  [500, "unknown_flow"],
+])("a rejected cancellation (%s, %s) retains the flow and can be retried", async (status, code) => {
   let deleteAttempts = 0;
   let completed = 0;
   Object.defineProperty(globalThis, "fetch", {
@@ -196,7 +200,7 @@ test("a rejected cancellation retains the flow and can be retried", async () =>
       if (init?.method === "DELETE") {
         deleteAttempts += 1;
         return deleteAttempts === 1
-          ? Response.json({ code: "unauthorized" }, { status: 401 })
+          ? Response.json({ code }, { status })
           : Response.json({ flowId: "f1", status: "succeeded" });
       }
       return Response.json({ flowId: "f1", status: "pending", verificationUrl: DEVICE_URL, deviceCode: DEVICE_CODE });
@@ -232,9 +236,10 @@ test("a rejected cancellation retains the flow and can be retried", async () =>
 });
 
 test.each([
-  ["identity_mismatch", "identity_mismatch"],
-  ["unknown_failure", "request_failed"],
-])("a failed cancellation terminal clears the flow and normalizes %s", async (code, expectedCode) => {
+  ["identity_mismatch", "identity_mismatch", 200],
+  ["unknown_failure", "request_failed", 200],
+  ["unknown_flow", "request_failed", 404],
+])("a failed cancellation terminal clears the flow and normalizes %s", async (code, expectedCode, status) => {
   let deleteAttempts = 0;
   let completed = 0;
   Object.defineProperty(globalThis, "fetch", {
@@ -246,7 +251,7 @@ test.each([
       }
       if (init?.method === "DELETE") {
         deleteAttempts += 1;
-        return Response.json({ flowId: "f1", status: "failed", code });
+        return Response.json(status === 404 ? { code } : { flowId: "f1", status: "failed", code }, { status });
       }
       return Response.json({ flowId: "f1", status: "pending", verificationUrl: DEVICE_URL, deviceCode: DEVICE_CODE });
     },
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 20c10d3700..1dff97ee46 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -14,6 +14,8 @@ This is a design-first rule for contributors, not a runtime feature: opencodex i
 plumbing, not a product-creation tool, so surface coherence is enforced by review rather than by an
 interview engine. The rule stands on its own; it does not depend on an external document.
 
+Native-main device cancellation follows the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+
 ## Existing surfaces and their design direction
 
 The surfaces below are examples chosen to show the design direction, not an inventory; the current
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 9c4f2ac6e6..e95026aa92 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -336,7 +336,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unknown or nonterminal cancellation replies remain retryable. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
diff --git a/structure/overview.md b/structure/overview.md
index 38b19427dd..c184778a10 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -5,6 +5,8 @@ is scoped to canonical ChatGPT Responses forwarding; other source-area behavior
 
 Shared parsing and streaming follow the [request-copy](transports/byte-accounting.md#request-copy-accounting) and [stream-buffer accounting](transports/byte-accounting.md#stream-buffer-accounting) contracts.
 
+Native-main device cancellation follows the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+
 ## Product boundary
 
 opencodex is a local proxy for Codex. It does not patch Codex binaries. It changes local Codex

From 39278680c480e6ca9ee67f3aa6478b5eae460616 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 17:19:05 +0900
Subject: [PATCH 06/11] fix(gui): fence device reauth responses across flows

---
 .../docs/fr/guides/codex-integration.md       |   2 +-
 .../content/docs/guides/codex-integration.md  |   2 +-
 .../docs/ja/guides/codex-integration.md       |   2 +-
 .../docs/ko/guides/codex-integration.md       |   2 +-
 .../docs/ru/guides/codex-integration.md       |   2 +-
 .../docs/tr/guides/codex-integration.md       |   2 +-
 .../docs/zh-cn/guides/codex-integration.md    |   2 +-
 .../docs/zh-tw/guides/codex-integration.md    |   2 +-
 .../codex-account-pool-main-card.tsx          |   2 +-
 gui/src/components/use-main-device-reauth.ts  |  26 +-
 .../main-device-reauth-ownership.test.tsx     | 242 ++++++++++++++++++
 gui/tests/main-device-reauth.test.tsx         |   4 +-
 structure/design-methodology.md               |   2 +-
 structure/gui-and-management-api.md           |   2 +-
 structure/overview.md                         |   2 +-
 15 files changed, 271 insertions(+), 25 deletions(-)
 create mode 100644 gui/tests/main-device-reauth-ownership.test.tsx

diff --git a/docs-site/src/content/docs/fr/guides/codex-integration.md b/docs-site/src/content/docs/fr/guides/codex-integration.md
index 1b9e006b43..36bd77bc61 100644
--- a/docs-site/src/content/docs/fr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/fr/guides/codex-integration.md
@@ -425,4 +425,4 @@ Ne réécrivez pas un historique paginé actif ni une ligne de conversation pour
 
 ## Annulation de la réauthentification du compte principal
 
-Lors de l’annulation de la réauthentification du compte principal par code d’appareil, une réponse HTTP 404 avec le code `unknown_flow` libère le flux expiré pour permettre une nouvelle connexion par code d’appareil, sans indiquer une connexion réussie ni une annulation confirmée.
+Lors de l’annulation de la réauthentification du compte principal par code d’appareil, une réponse HTTP 404 avec le code `unknown_flow` libère le flux expiré pour permettre une nouvelle connexion par code d’appareil, sans indiquer une connexion réussie ni une annulation confirmée. Après confirmation de l’annulation, une nouvelle connexion par code d’appareil est possible. Les réponses tardives de démarrage, de suivi ou d’annulation d’un ancien flux ne modifient pas le nouveau flux et ne signalent pas de nouvelle connexion réussie.
diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index 315edad459..166c1d81da 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -807,7 +807,7 @@ Background revalidation is separate and off by default. It requires Token Guardi
 
 ### Why an account stopped serving requests
 
-When cancelling main-account device reauthentication, transient request failures and replies with unknown or nonterminal status values keep cancellation retryable. A DELETE response with HTTP 404 and code `unknown_flow` instead releases the expired flow so device re-login can be started again; it reports neither successful login nor confirmed cancellation. If the server reports a terminal `failed` state, the card displays that failure and also releases the old flow.
+When cancelling main-account device reauthentication, transient request failures and replies with unknown or nonterminal status values keep cancellation retryable. A DELETE response with HTTP 404 and code `unknown_flow` instead releases the expired flow so device re-login can be started again; it reports neither successful login nor confirmed cancellation. If the server reports a terminal `failed` state, the card displays that failure and also releases the old flow. After confirmed cancellation, device re-login is available again. Delayed start, status, or cancellation responses for an earlier flow do not alter the new flow or report a new login success.
 
 When an account leaves pool selection, the reason travels with the decision instead of being recomputed for display, so a surface can never report an account healthy while routing is dropping it. `GET /api/codex-auth/accounts` carries `reauthReason` next to `needsReauth` on each account: `missing_credential` for a credential that was never stored, `refresh_failed` for a credential refresh that keeps failing, and `quota_unauthorized` when the usage lookup itself was rejected.
 
diff --git a/docs-site/src/content/docs/ja/guides/codex-integration.md b/docs-site/src/content/docs/ja/guides/codex-integration.md
index 64ab09f31a..a9e4df9096 100644
--- a/docs-site/src/content/docs/ja/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ja/guides/codex-integration.md
@@ -287,4 +287,4 @@ opencodex が管理対象 [バックグラウンドサービス](/reference/cli/
 
 ## メインアカウントの再認証のキャンセル
 
-メインアカウントのデバイスコードによる再認証をキャンセルする際、HTTP 404 と `unknown_flow` コードが返された場合は期限切れのフローを解放して再ログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。
+メインアカウントのデバイスコードによる再認証をキャンセルする際、HTTP 404 と `unknown_flow` コードが返された場合は期限切れのフローを解放して再ログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。 キャンセルが確認されると、デバイスコードによる再ログインを開始できます。以前のフローに対する開始・状態確認・キャンセルの遅延応答は、新しいフローを変更せず、ログイン成功も通知しません。
diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md
index 75f4054669..8318d82511 100644
--- a/docs-site/src/content/docs/ko/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ko/guides/codex-integration.md
@@ -384,4 +384,4 @@ opencodex가 managed [background service](/reference/cli/#ocx-service)로 실행
 
 ## 메인 계정 재인증 취소
 
-메인 계정의 기기 코드 재인증을 취소할 때 HTTP 404와 `unknown_flow` 코드가 반환되면 만료된 흐름을 해제하여 기기 코드 재로그인을 다시 시작할 수 있게 하며, 로그인 성공이나 취소 확정으로 표시하지 않습니다.
+메인 계정의 기기 코드 재인증을 취소할 때 HTTP 404와 `unknown_flow` 코드가 반환되면 만료된 흐름을 해제하여 기기 코드 재로그인을 다시 시작할 수 있게 하며, 로그인 성공이나 취소 확정으로 표시하지 않습니다. 취소가 확인된 뒤에도 기기 코드 재로그인을 다시 시작할 수 있습니다. 이전 흐름의 시작·상태 조회·취소 응답이 늦게 도착해도 새 흐름을 변경하거나 로그인 성공을 알리지 않습니다.
diff --git a/docs-site/src/content/docs/ru/guides/codex-integration.md b/docs-site/src/content/docs/ru/guides/codex-integration.md
index 8638c47ac5..14359bd222 100644
--- a/docs-site/src/content/docs/ru/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ru/guides/codex-integration.md
@@ -419,4 +419,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## Отмена повторной аутентификации основного аккаунта
 
-При отмене повторной аутентификации основного аккаунта по коду устройства ответ HTTP 404 с кодом `unknown_flow` освобождает истёкший процесс, позволяя начать вход по коду устройства заново, но не сообщает об успешном входе или подтверждённой отмене.
+При отмене повторной аутентификации основного аккаунта по коду устройства ответ HTTP 404 с кодом `unknown_flow` освобождает истёкший процесс, позволяя начать вход по коду устройства заново, но не сообщает об успешном входе или подтверждённой отмене. После подтверждённой отмены можно снова начать вход по коду устройства. Запоздалые ответы на запуск, проверку состояния или отмену прежнего процесса не изменяют новый процесс и не сообщают об успешном входе.
diff --git a/docs-site/src/content/docs/tr/guides/codex-integration.md b/docs-site/src/content/docs/tr/guides/codex-integration.md
index 1a0e013bf1..358ed09bbf 100644
--- a/docs-site/src/content/docs/tr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/tr/guides/codex-integration.md
@@ -476,4 +476,4 @@ Konuşmaları kendiniz taşımak için etkin sayfalanmış geçmişi veya iş pa
 
 ## Ana hesabın yeniden kimlik doğrulamasını iptal etme
 
-Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken `unknown_flow` koduyla HTTP 404 yanıtı alınırsa süresi dolmuş akış serbest bırakılarak cihaz koduyla yeniden giriş başlatılabilir, ancak girişin başarılı olduğu veya iptalin onaylandığı bildirilmez.
+Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken `unknown_flow` koduyla HTTP 404 yanıtı alınırsa süresi dolmuş akış serbest bırakılarak cihaz koduyla yeniden giriş başlatılabilir, ancak girişin başarılı olduğu veya iptalin onaylandığı bildirilmez. İptal onaylandıktan sonra cihaz koduyla yeniden giriş başlatılabilir. Önceki akışın başlatma, durum veya iptal yanıtları gecikse bile yeni akışı değiştirmez ve başarılı giriş bildirmez.
diff --git a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
index cd77d024ce..b40d6fbb7e 100644
--- a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
@@ -362,4 +362,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## 取消主账号重新认证
 
-取消主账号的设备代码重新认证时，如果收到 HTTP 404 且错误代码为 `unknown_flow`，系统会释放已过期的流程，以便重新开始设备代码登录，但不会显示登录成功或已确认取消。
+取消主账号的设备代码重新认证时，如果收到 HTTP 404 且错误代码为 `unknown_flow`，系统会释放已过期的流程，以便重新开始设备代码登录，但不会显示登录成功或已确认取消。 确认取消后也可以重新开始设备代码登录。旧流程的启动、状态查询或取消响应即使延迟到达，也不会更改新流程或报告登录成功。
diff --git a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
index 00cee3d321..ad3482ca8e 100644
--- a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
@@ -369,4 +369,4 @@ ocx restore back # 讓普通 Codex 再次指向仍在執行的 proxy
 
 ## 取消主帳號重新驗證
 
-取消主帳號的裝置代碼重新驗證時，如果收到 HTTP 404 且錯誤代碼為 `unknown_flow`，系統會釋放已過期的流程，以便重新開始裝置代碼登入，但不會顯示登入成功或已確認取消。
+取消主帳號的裝置代碼重新驗證時，如果收到 HTTP 404 且錯誤代碼為 `unknown_flow`，系統會釋放已過期的流程，以便重新開始裝置代碼登入，但不會顯示登入成功或已確認取消。 確認取消後也可以重新開始裝置代碼登入。舊流程的啟動、狀態查詢或取消回應即使延遲到達，也不會更改新流程或回報登入成功。
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index 327b53001f..25af1eb49f 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -192,7 +192,7 @@ export function CodexAccountPoolMainCard({
       {showReauth
         ? <div className="card-sub faint">
             <p role="status">{t("codexAuth.mainTokenExpired")}</p>
-            {mainReauth && (mainReauth.state.phase === "idle" || mainReauth.state.phase === "failed") && (
+            {mainReauth && (mainReauth.state.phase === "idle" || mainReauth.state.phase === "failed" || mainReauth.state.phase === "cancelled") && (
               <>
                 <button
                   type="button"
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index 1f134d3a2e..d5c21df342 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -91,6 +91,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     try {
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
       const dto = await res.json().catch(() => ({})) as FlowDto;
+      if (unmountedRef.current || flowRef.current !== flowId) return;
       if (res.status === 404 && dto.code === "unknown_flow") {
         // The service may have expired its terminal receipt after a lost DELETE response.
         // Release the stale ID without claiming cancellation or successful authentication.
@@ -108,8 +109,9 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
         : { phase: dto.status });
       if (dto.status === "succeeded") onCompleted();
     } catch {
+      if (unmountedRef.current || flowRef.current !== flowId) return;
       // Keep ownership of the flow so the operator can retry cancellation.
-      setState(current => current.phase === "pending" || current.phase === "committing"
+      setState(current => (current.phase === "pending" || current.phase === "committing") && current.flowId === flowId
         ? { ...current, cancelFailed: true }
         : current);
     }
@@ -120,24 +122,25 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     flowRef.current = null;
     const ctrl = new AbortController();
     abortRef.current = ctrl;
+    const isCurrent = () => !ctrl.signal.aborted && !unmountedRef.current && abortRef.current === ctrl;
     setState({ phase: "starting" });
     let flowId: string;
     try {
       // Empty body by contract: the route rejects any request keys with 400.
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device`, { method: "POST", signal: ctrl.signal });
+      const dto = await res.json().catch(() => ({})) as FlowDto;
+      if (!isCurrent()) return;
       if (!res.ok) {
-        const failed = await res.json().catch(() => ({})) as FlowDto;
-        setState({ phase: "failed", code: failureCode(failed.code) });
+        setState({ phase: "failed", code: failureCode(dto.code) });
         return;
       }
-      const dto = await res.json().catch(() => ({})) as FlowDto;
       if (typeof dto.flowId !== "string" || !dto.flowId) {
         setState({ phase: "failed", code: "request_failed" });
         return;
       }
       flowId = dto.flowId;
     } catch {
-      if (!ctrl.signal.aborted) setState({ phase: "failed", code: "request_failed" });
+      if (isCurrent()) setState({ phase: "failed", code: "request_failed" });
       return;
     }
     flowRef.current = flowId;
@@ -145,19 +148,19 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     let lastCode = "";
     // Poll immediately: the start response predates the usercode reply, so the
     // URL and human code only arrive through status reads.
-    while (!ctrl.signal.aborted) {
-      if (ctrl.signal.aborted || unmountedRef.current || flowRef.current !== flowId) return;
+    while (isCurrent()) {
+      if (flowRef.current !== flowId) return;
       try {
         const res = await fetch(
           `${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`,
           { signal: AbortSignal.any([ctrl.signal, AbortSignal.timeout(POLL_TICK_TIMEOUT_MS)]) },
         );
+        const dto = await res.json().catch(() => ({})) as FlowDto;
+        if (!isCurrent() || flowRef.current !== flowId) return;
         if (!res.ok) {
-          const failed = await res.json().catch(() => ({})) as FlowDto;
-          setState({ phase: "failed", code: failureCode(failed.code) });
+          setState({ phase: "failed", code: failureCode(dto.code) });
           return;
         }
-        const dto = await res.json().catch(() => ({})) as FlowDto;
         lastUrl = allowedVerificationUrl(dto.verificationUrl) || lastUrl;
         lastCode = humanCode(dto.deviceCode) || lastCode;
         if (dto.status === "pending" || dto.status === "committing") {
@@ -182,7 +185,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
           return;
         }
       } catch {
-        if (ctrl.signal.aborted || unmountedRef.current) return;
+        if (!isCurrent() || flowRef.current !== flowId) return;
         // A tick failure is transient: the service flow keeps its own deadline.
       }
       await new Promise(resolve => setTimeout(resolve, POLL_INTERVAL_MS));
@@ -190,6 +193,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
   }, [apiBase, onCompleted, stopPolling]);
 
   useEffect(() => {
+    unmountedRef.current = false;
     return () => {
       unmountedRef.current = true;
       stopPolling();
diff --git a/gui/tests/main-device-reauth-ownership.test.tsx b/gui/tests/main-device-reauth-ownership.test.tsx
new file mode 100644
index 0000000000..3dfe8a2933
--- /dev/null
+++ b/gui/tests/main-device-reauth-ownership.test.tsx
@@ -0,0 +1,242 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act, createElement, StrictMode, useEffect } from "react";
+import type { Root } from "react-dom/client";
+import { useMainDeviceReauth } from "../src/components/use-main-device-reauth";
+
+type Hook = ReturnType<typeof useMainDeviceReauth>;
+type Dto = Record<string, unknown>;
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason: unknown) => void;
+  const promise = new Promise<T>((yes, no) => { resolve = yes; reject = no; });
+  return { promise, resolve, reject };
+}
+
+function request(method: string, url: string) {
+  const response = deferred<Response>();
+  const body = deferred<Dto>();
+  let headersSent = false;
+  return {
+    method, url, response, body, claimed: false,
+    headers(status = 200) {
+      if (headersSent) return;
+      headersSent = true;
+      response.resolve({
+        ok: status >= 200 && status < 300,
+        status,
+        json: () => body.promise,
+      } as Response);
+    },
+    reply(dto: Dto, status = 200) {
+      this.headers(status);
+      body.resolve(dto);
+    },
+    drain() {
+      // Abort is deliberately ignored by this fake: already-delivered bodies can
+      // finish late. Drain both boundaries so teardown leaves no task waiting.
+      this.reply({});
+    },
+  };
+}
+type Request = ReturnType<typeof request>;
+
+const globalKeys = ["window", "document", "navigator", "IS_REACT_ACT_ENVIRONMENT", "fetch", "setTimeout"] as const;
+let descriptors: Map<string, PropertyDescriptor | undefined>;
+let win: Window;
+let host: HTMLElement;
+let root: Root | null;
+let hook: Hook;
+let completed: number;
+let setups: number;
+let cleanups: number;
+let requests: Request[];
+let tasks: Promise<void>[];
+let sleepers: Array<() => void>;
+
+beforeEach(() => {
+  descriptors = new Map(globalKeys.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]));
+  win = new Window({ url: "http://localhost/" });
+  host = win.document.createElement("div") as unknown as HTMLElement;
+  win.document.body.appendChild(host);
+  root = null;
+  completed = 0;
+  setups = 0;
+  cleanups = 0;
+  requests = [];
+  tasks = [];
+  sleepers = [];
+  const realSetTimeout = globalThis.setTimeout;
+  Object.defineProperties(globalThis, {
+    window: { configurable: true, value: win },
+    document: { configurable: true, value: win.document },
+    navigator: { configurable: true, value: win.navigator },
+    IS_REACT_ACT_ENVIRONMENT: { configurable: true, value: true },
+    fetch: {
+      configurable: true,
+      value: (input: RequestInfo | URL, init?: RequestInit) => {
+        const pending = request(init?.method ?? "GET", String(input));
+        requests.push(pending);
+        return pending.response.promise;
+      },
+    },
+    setTimeout: {
+      configurable: true,
+      value: ((callback: (...args: unknown[]) => void, delay?: number, ...args: unknown[]) => {
+        if (delay === 2_000) {
+          sleepers.push(() => callback(...args));
+          return 0;
+        }
+        return realSetTimeout(callback, delay, ...args);
+      }) as typeof setTimeout,
+    },
+  });
+});
+
+afterEach(async () => {
+  await act(async () => {
+    root?.unmount();
+    root = null;
+    for (const pending of requests) pending.drain();
+    for (const wake of sleepers.splice(0)) wake();
+  });
+  await act(async () => {
+    for (const wake of sleepers.splice(0)) wake();
+    await Promise.allSettled(tasks);
+  });
+  host.remove();
+  for (const [key, descriptor] of descriptors) {
+    if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+    else Reflect.deleteProperty(globalThis, key);
+  }
+});
+
+async function mount(strict = false) {
+  const { createRoot } = await import("react-dom/client");
+  function Probe() {
+    const value = useMainDeviceReauth("", () => { completed += 1; });
+    useEffect(() => { hook = value; });
+    useEffect(() => {
+      setups += 1;
+      return () => { cleanups += 1; };
+    }, []);
+    return null;
+  }
+  await act(async () => {
+    root = createRoot(host);
+    const child = createElement(Probe);
+    root.render(strict ? createElement(StrictMode, null, child) : child);
+  });
+}
+
+async function invoke(action: () => Promise<void>) {
+  await act(async () => { tasks.push(action()); });
+}
+
+function take(method: string, flowId?: string): Request {
+  const pending = requests.find(candidate =>
+    !candidate.claimed && candidate.method === method &&
+    (flowId === undefined || new URL(candidate.url, "http://localhost").searchParams.get("flowId") === flowId));
+  expect(pending).toBeDefined();
+  pending!.claimed = true;
+  return pending!;
+}
+
+async function reply(pending: Request, dto: Dto, status = 200) {
+  await act(async () => { pending.reply(dto, status); });
+}
+
+async function beginFlow(flowId: string) {
+  await invoke(() => hook.start());
+  await reply(take("POST"), { flowId });
+  await reply(take("GET", flowId), {
+    flowId, status: "pending", verificationUrl: "https://auth.openai.com/codex/device",
+    deviceCode: "ABCD-1234",
+  });
+  expect(hook.state).toMatchObject({ phase: "pending", flowId });
+}
+
+for (const late of ["succeeded", "failed", "unknown_flow", "network"] as const) {
+  test(`late DELETE ${late} for A cannot disturb restarted flow B`, async () => {
+    await mount();
+    await beginFlow("A");
+    await invoke(() => hook.cancel());
+    const first = take("DELETE", "A");
+    await invoke(() => hook.cancel());
+    const delayed = take("DELETE", "A");
+    await reply(first, { status: "failed", code: "publication_failed" });
+    await beginFlow("B");
+    const before = hook.state;
+    await act(async () => {
+      if (late === "network") delayed.response.reject(new Error("late network failure"));
+      else if (late === "unknown_flow") delayed.reply({ code: "unknown_flow" }, 404);
+      else delayed.reply({ status: late, code: "publication_failed" });
+    });
+    expect(hook.state).toEqual(before);
+    expect(completed).toBe(0);
+    // State alone can look unchanged even when the private flowRef was lost.
+    await invoke(() => hook.cancel());
+    await reply(take("DELETE", "B"), { status: "cancelled" });
+    expect(hook.state.phase).toBe("cancelled");
+  });
+}
+
+for (const boundary of ["headers", "json"] as const) {
+  test(`late GET ${boundary} for A cannot settle restarted flow B`, async () => {
+    await mount();
+    await invoke(() => hook.start());
+    await reply(take("POST"), { flowId: "A" });
+    const delayed = take("GET", "A");
+    if (boundary === "json") await act(async () => { delayed.headers(); });
+    await invoke(() => hook.cancel());
+    await reply(take("DELETE", "A"), { status: "cancelled" });
+    await beginFlow("B");
+    const before = hook.state;
+    await reply(delayed, { flowId: "A", status: "succeeded" });
+    expect(hook.state).toEqual(before);
+    expect(completed).toBe(0);
+    await invoke(() => hook.cancel());
+    await reply(take("DELETE", "B"), { status: "cancelled" });
+  });
+}
+
+for (const outcome of ["success", "http_failure"] as const) {
+  test(`late POST JSON ${outcome} cannot replace a newer start`, async () => {
+    await mount();
+    await invoke(() => hook.start());
+    const delayed = take("POST");
+    await act(async () => { delayed.headers(outcome === "success" ? 200 : 409); });
+    await beginFlow("B");
+    const before = hook.state;
+    await act(async () => {
+      delayed.body.resolve(outcome === "success" ? { flowId: "A" } : { code: "flow_in_progress" });
+    });
+    expect(hook.state).toEqual(before);
+    expect(completed).toBe(0);
+    expect(requests.filter(pending => pending.method === "GET" && pending.url.includes("flowId=A"))).toHaveLength(0);
+    await invoke(() => hook.cancel());
+    await reply(take("DELETE", "B"), { status: "cancelled" });
+  });
+}
+
+test("a DELETE body delivered after unmount cannot invoke completion", async () => {
+  await mount();
+  await beginFlow("A");
+  await invoke(() => hook.cancel());
+  const delayed = take("DELETE", "A");
+  await act(async () => { delayed.headers(); });
+  await act(async () => { root!.unmount(); root = null; });
+  await reply(delayed, { status: "succeeded" });
+  expect(completed).toBe(0);
+});
+
+test("StrictMode setup-cleanup-setup still permits start and polling", async () => {
+  await mount(true);
+  expect(setups).toBe(2);
+  expect(cleanups).toBe(1);
+  await beginFlow("A");
+  await invoke(() => hook.cancel());
+  await reply(take("DELETE", "A"), { status: "cancelled" });
+  expect(hook.state.phase).toBe("cancelled");
+});
diff --git a/gui/tests/main-device-reauth.test.tsx b/gui/tests/main-device-reauth.test.tsx
index 3a6be99ff0..26584699e8 100644
--- a/gui/tests/main-device-reauth.test.tsx
+++ b/gui/tests/main-device-reauth.test.tsx
@@ -86,9 +86,9 @@ async function mount(ui: Parameters<typeof cardProps>[1], state: MainDeviceReaut
   });
 }
 
-test("expired main card shows the device Re-login CTA and starts the flow", async () => {
+test.each(["idle", "cancelled"] as const)("expired main card in %s state shows the device Re-login CTA and starts the flow", async (phase) => {
   const calls = { starts: 0, cancels: 0 };
-  await mount(calls, { phase: "idle" });
+  await mount(calls, { phase });
   // The pause control ships the same class and renders first, so select the CTA by its
   // label the way the cancel test below already does.
   const actions = Array.from(host.querySelectorAll("button.codex-auth-action-btn"));
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 1dff97ee46..2ad212e1a8 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -14,7 +14,7 @@ This is a design-first rule for contributors, not a runtime feature: opencodex i
 plumbing, not a product-creation tool, so surface coherence is enforced by review rather than by an
 interview engine. The rule stands on its own; it does not depend on an external document.
 
-Native-main device cancellation follows the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
 
 ## Existing surfaces and their design direction
 
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index e95026aa92..2094344ba2 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -336,7 +336,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
diff --git a/structure/overview.md b/structure/overview.md
index c184778a10..d740d51d1c 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -5,7 +5,7 @@ is scoped to canonical ChatGPT Responses forwarding; other source-area behavior
 
 Shared parsing and streaming follow the [request-copy](transports/byte-accounting.md#request-copy-accounting) and [stream-buffer accounting](transports/byte-accounting.md#stream-buffer-accounting) contracts.
 
-Native-main device cancellation follows the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
 
 ## Product boundary
 

From 00c8d0c68350c315c0609636071f2c0cc634f24a Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 14 Sep 2026 17:45:47 +0900
Subject: [PATCH 07/11] fix(gui): retain polling after retryable cancellation

---
 .../docs/fr/guides/codex-integration.md       |  2 +-
 .../content/docs/guides/codex-integration.md  |  6 ++--
 .../docs/ja/guides/codex-integration.md       |  2 +-
 .../docs/ko/guides/codex-integration.md       |  2 +-
 .../docs/ru/guides/codex-integration.md       |  2 +-
 .../docs/tr/guides/codex-integration.md       |  2 +-
 .../docs/zh-cn/guides/codex-integration.md    |  2 +-
 .../docs/zh-tw/guides/codex-integration.md    |  2 +-
 gui/src/components/use-main-device-reauth.ts  | 14 +++++---
 .../main-device-reauth-ownership.test.tsx     | 35 +++++++++++++++++++
 structure/design-methodology.md               |  2 +-
 structure/gui-and-management-api.md           |  2 +-
 structure/overview.md                         |  2 +-
 13 files changed, 59 insertions(+), 16 deletions(-)

diff --git a/docs-site/src/content/docs/fr/guides/codex-integration.md b/docs-site/src/content/docs/fr/guides/codex-integration.md
index 36bd77bc61..2a916cd66c 100644
--- a/docs-site/src/content/docs/fr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/fr/guides/codex-integration.md
@@ -425,4 +425,4 @@ Ne réécrivez pas un historique paginé actif ni une ligne de conversation pour
 
 ## Annulation de la réauthentification du compte principal
 
-Lors de l’annulation de la réauthentification du compte principal par code d’appareil, une réponse HTTP 404 avec le code `unknown_flow` libère le flux expiré pour permettre une nouvelle connexion par code d’appareil, sans indiquer une connexion réussie ni une annulation confirmée. Après confirmation de l’annulation, une nouvelle connexion par code d’appareil est possible. Les réponses tardives de démarrage, de suivi ou d’annulation d’un ancien flux ne modifient pas le nouveau flux et ne signalent pas de nouvelle connexion réussie.
+Lors de l’annulation de la réauthentification du compte principal par code d’appareil, un échec temporaire de DELETE, une erreur réseau ou une réponse dont le statut est inconnu ou non terminal conserve le flux actif et l’indication d’échec de l’annulation afin de permettre une nouvelle tentative ; l’interrogation périodique du statut continue pour détecter une connexion qui aboutit entre-temps. Une réponse terminale `failed` libère le flux et affiche la raison d’échec normalisée ; seul le statut `succeeded` signale une connexion réussie. Une réponse confirmant `cancelled` libère le flux et permet de lancer une nouvelle connexion par code d’appareil. Une réponse HTTP 404 définitive avec le code `unknown_flow` libère également l’identifiant du flux expiré pour permettre une nouvelle connexion par code d’appareil, sans signaler une connexion réussie ni une annulation confirmée. Les réponses POST, GET ou DELETE tardives d’un ancien flux ne peuvent ni modifier le nouveau flux ni signaler une connexion réussie pour celui-ci.
diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index 166c1d81da..e71c0774a7 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -805,9 +805,11 @@ If the new OAuth credential's authenticated usage lookup confirms an exhausted 5
 
 Background revalidation is separate and off by default. It requires Token Guardian, the `openai` provider's `proactive` refresh policy, and `tokenGuardian.codexWarmupEnabled`. It skips accounts awaiting deferred registration validation.
 
-### Why an account stopped serving requests
+### Cancelling main-account device reauthentication
+
+When cancelling main-account device reauthentication, a temporary DELETE or network failure, or a response with an unknown or nonterminal status, keeps the active flow and the cancellation-failure indication so cancellation can be retried; status polling continues so a login that completes can still be detected. A terminal `failed` response releases the flow and displays the normalized failure reason; only `succeeded` reports login success. A confirmed `cancelled` response releases the flow so a new device login can be started. A definitive HTTP 404 response with code `unknown_flow` also releases the expired flow ID so a new device login can be started, but does not report a successful login or confirmed cancellation. Late POST, GET, or DELETE responses from an earlier flow cannot change the new flow or report login success for it.
 
-When cancelling main-account device reauthentication, transient request failures and replies with unknown or nonterminal status values keep cancellation retryable. A DELETE response with HTTP 404 and code `unknown_flow` instead releases the expired flow so device re-login can be started again; it reports neither successful login nor confirmed cancellation. If the server reports a terminal `failed` state, the card displays that failure and also releases the old flow. After confirmed cancellation, device re-login is available again. Delayed start, status, or cancellation responses for an earlier flow do not alter the new flow or report a new login success.
+### Why an account stopped serving requests
 
 When an account leaves pool selection, the reason travels with the decision instead of being recomputed for display, so a surface can never report an account healthy while routing is dropping it. `GET /api/codex-auth/accounts` carries `reauthReason` next to `needsReauth` on each account: `missing_credential` for a credential that was never stored, `refresh_failed` for a credential refresh that keeps failing, and `quota_unauthorized` when the usage lookup itself was rejected.
 
diff --git a/docs-site/src/content/docs/ja/guides/codex-integration.md b/docs-site/src/content/docs/ja/guides/codex-integration.md
index a9e4df9096..062de769c8 100644
--- a/docs-site/src/content/docs/ja/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ja/guides/codex-integration.md
@@ -287,4 +287,4 @@ opencodex が管理対象 [バックグラウンドサービス](/reference/cli/
 
 ## メインアカウントの再認証のキャンセル
 
-メインアカウントのデバイスコードによる再認証をキャンセルする際、HTTP 404 と `unknown_flow` コードが返された場合は期限切れのフローを解放して再ログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。 キャンセルが確認されると、デバイスコードによる再ログインを開始できます。以前のフローに対する開始・状態確認・キャンセルの遅延応答は、新しいフローを変更せず、ログイン成功も通知しません。
+メインアカウントのデバイスコードによる再認証をキャンセルする際、DELETE リクエストの一時的な失敗、ネットワークエラー、または不明もしくは非終端のステータスを持つ応答が発生した場合は、実行中のフローとキャンセル失敗の表示を維持し、キャンセルを再試行できるようにします。その間もステータスのポーリングは続き、ログインが完了した場合に検出できます。終端ステータス `failed` の応答ではフローを解放し、正規化された失敗理由を表示します。ログイン成功として扱うのは `succeeded` の場合だけです。`cancelled` が確認された応答ではフローを解放し、新しいデバイスコードログインを開始できるようにします。HTTP 404 と `unknown_flow` コードによる確定的な応答でも、期限切れのフロー ID を解放して新しいデバイスコードログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。以前のフローから遅れて届いた POST、GET、DELETE の応答が、新しいフローを変更したり、そのログインを成功と報告したりすることはありません。
diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md
index 8318d82511..415823360e 100644
--- a/docs-site/src/content/docs/ko/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ko/guides/codex-integration.md
@@ -384,4 +384,4 @@ opencodex가 managed [background service](/reference/cli/#ocx-service)로 실행
 
 ## 메인 계정 재인증 취소
 
-메인 계정의 기기 코드 재인증을 취소할 때 HTTP 404와 `unknown_flow` 코드가 반환되면 만료된 흐름을 해제하여 기기 코드 재로그인을 다시 시작할 수 있게 하며, 로그인 성공이나 취소 확정으로 표시하지 않습니다. 취소가 확인된 뒤에도 기기 코드 재로그인을 다시 시작할 수 있습니다. 이전 흐름의 시작·상태 조회·취소 응답이 늦게 도착해도 새 흐름을 변경하거나 로그인 성공을 알리지 않습니다.
+메인 계정의 기기 코드 재인증을 취소할 때 DELETE 요청의 일시적 실패, 네트워크 오류, 알 수 없거나 아직 종료되지 않은 상태의 응답이 발생하면 진행 중인 흐름과 취소 실패 표시를 유지하여 취소를 다시 시도할 수 있게 합니다. 이때도 상태 조회를 계속하므로 로그인이 완료되면 이를 확인할 수 있습니다. 종료 상태인 `failed` 응답은 흐름을 해제하고 정규화된 실패 사유를 표시하며, `succeeded` 응답만 로그인 성공을 알립니다. `cancelled`로 확인된 응답은 흐름을 해제하여 새 기기 코드 로그인을 시작할 수 있게 합니다. HTTP 404와 `unknown_flow` 코드가 명확하게 반환된 경우에도 만료된 흐름 ID를 해제하여 새 기기 코드 로그인을 시작할 수 있게 하지만, 로그인 성공이나 취소 확정으로 표시하지 않습니다. 이전 흐름에서 늦게 도착한 POST·GET·DELETE 응답은 새 흐름을 변경하거나 새 흐름의 로그인이 성공했다고 알릴 수 없습니다.
diff --git a/docs-site/src/content/docs/ru/guides/codex-integration.md b/docs-site/src/content/docs/ru/guides/codex-integration.md
index 14359bd222..e419c441d5 100644
--- a/docs-site/src/content/docs/ru/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ru/guides/codex-integration.md
@@ -419,4 +419,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## Отмена повторной аутентификации основного аккаунта
 
-При отмене повторной аутентификации основного аккаунта по коду устройства ответ HTTP 404 с кодом `unknown_flow` освобождает истёкший процесс, позволяя начать вход по коду устройства заново, но не сообщает об успешном входе или подтверждённой отмене. После подтверждённой отмены можно снова начать вход по коду устройства. Запоздалые ответы на запуск, проверку состояния или отмену прежнего процесса не изменяют новый процесс и не сообщают об успешном входе.
+При отмене повторной аутентификации основного аккаунта по коду устройства временный сбой DELETE, сетевая ошибка или ответ с неизвестным либо нетерминальным статусом сохраняет активный процесс и индикацию ошибки отмены, чтобы отмену можно было повторить; опрос статуса продолжается, позволяя обнаружить завершившийся вход. Терминальный ответ `failed` освобождает процесс и показывает нормализованную причину ошибки; только `succeeded` сообщает об успешном входе. Подтверждённый ответ `cancelled` освобождает процесс, позволяя начать новый вход по коду устройства. Однозначный ответ HTTP 404 с кодом `unknown_flow` также освобождает идентификатор истёкшего процесса и позволяет начать новый вход по коду устройства, но не сообщает об успешном входе или подтверждённой отмене. Запоздавшие ответы POST, GET или DELETE от предыдущего процесса не могут изменить новый процесс или сообщить об успешном входе в нём.
diff --git a/docs-site/src/content/docs/tr/guides/codex-integration.md b/docs-site/src/content/docs/tr/guides/codex-integration.md
index 358ed09bbf..11271e573d 100644
--- a/docs-site/src/content/docs/tr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/tr/guides/codex-integration.md
@@ -476,4 +476,4 @@ Konuşmaları kendiniz taşımak için etkin sayfalanmış geçmişi veya iş pa
 
 ## Ana hesabın yeniden kimlik doğrulamasını iptal etme
 
-Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken `unknown_flow` koduyla HTTP 404 yanıtı alınırsa süresi dolmuş akış serbest bırakılarak cihaz koduyla yeniden giriş başlatılabilir, ancak girişin başarılı olduğu veya iptalin onaylandığı bildirilmez. İptal onaylandıktan sonra cihaz koduyla yeniden giriş başlatılabilir. Önceki akışın başlatma, durum veya iptal yanıtları gecikse bile yeni akışı değiştirmez ve başarılı giriş bildirmez.
+Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken geçici bir DELETE hatası, ağ hatası ya da bilinmeyen veya sonlanmamış bir durum içeren yanıt alınırsa etkin akış ve iptal hatası göstergesi korunur; böylece iptal yeniden denenebilir ve tamamlanan bir girişin algılanabilmesi için durum sorgulaması devam eder. Son durum olan `failed` yanıtı akışı serbest bırakır ve normalleştirilmiş hata nedenini gösterir; başarılı girişi yalnızca `succeeded` bildirir. Onaylanmış `cancelled` yanıtı akışı serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar. `unknown_flow` koduyla gelen kesin bir HTTP 404 yanıtı da süresi dolmuş akış kimliğini serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar, ancak girişin başarılı olduğunu veya iptalin onaylandığını bildirmez. Önceki bir akıştan geç gelen POST, GET veya DELETE yanıtları yeni akışı değiştiremez veya yeni akış için başarılı giriş bildiremez.
diff --git a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
index b40d6fbb7e..f11e4d489d 100644
--- a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
@@ -362,4 +362,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## 取消主账号重新认证
 
-取消主账号的设备代码重新认证时，如果收到 HTTP 404 且错误代码为 `unknown_flow`，系统会释放已过期的流程，以便重新开始设备代码登录，但不会显示登录成功或已确认取消。 确认取消后也可以重新开始设备代码登录。旧流程的启动、状态查询或取消响应即使延迟到达，也不会更改新流程或报告登录成功。
+取消主账号的设备代码重新认证时，如果 DELETE 请求暂时失败、发生网络错误，或响应状态未知或尚未结束，系统会保留当前流程和取消失败提示，以便重试取消；状态轮询仍会继续，因此仍能检测到登录完成。终止状态为 `failed` 的响应会释放流程并显示规范化的失败原因，只有 `succeeded` 才表示登录成功。确认状态为 `cancelled` 的响应会释放流程，以便开始新的设备代码登录。明确返回 HTTP 404 且代码为 `unknown_flow` 的响应也会释放已过期的流程 ID，以便开始新的设备代码登录，但不会显示登录成功或已确认取消。先前流程中延迟到达的 POST、GET 或 DELETE 响应不能改变新流程，也不能将新流程报告为登录成功。
diff --git a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
index ad3482ca8e..1fa336d0c7 100644
--- a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
@@ -369,4 +369,4 @@ ocx restore back # 讓普通 Codex 再次指向仍在執行的 proxy
 
 ## 取消主帳號重新驗證
 
-取消主帳號的裝置代碼重新驗證時，如果收到 HTTP 404 且錯誤代碼為 `unknown_flow`，系統會釋放已過期的流程，以便重新開始裝置代碼登入，但不會顯示登入成功或已確認取消。 確認取消後也可以重新開始裝置代碼登入。舊流程的啟動、狀態查詢或取消回應即使延遲到達，也不會更改新流程或回報登入成功。
+取消主帳號的裝置代碼重新驗證時，如果 DELETE 請求暫時失敗、發生網路錯誤，或回應狀態未知或尚未結束，系統會保留目前的流程和取消失敗提示，以便重試取消；狀態輪詢仍會繼續，因此仍能偵測到登入完成。終止狀態為 `failed` 的回應會釋放流程並顯示正規化的失敗原因，只有 `succeeded` 才表示登入成功。確認狀態為 `cancelled` 的回應會釋放流程，以便開始新的裝置代碼登入。明確回傳 HTTP 404 且代碼為 `unknown_flow` 的回應也會釋放已過期的流程 ID，以便開始新的裝置代碼登入，但不會顯示登入成功或已確認取消。先前流程中延遲抵達的 POST、GET 或 DELETE 回應不能改變新流程，也不能將新流程回報為登入成功。
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index d5c21df342..40485261a4 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -83,8 +83,8 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
 
   const cancel = useCallback(async () => {
     const flowId = flowRef.current;
-    stopPolling();
     if (!flowId) {
+      stopPolling();
       setState({ phase: "idle" });
       return;
     }
@@ -95,6 +95,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
       if (res.status === 404 && dto.code === "unknown_flow") {
         // The service may have expired its terminal receipt after a lost DELETE response.
         // Release the stale ID without claiming cancellation or successful authentication.
+        stopPolling();
         flowRef.current = null;
         setState({ phase: "failed", code: "request_failed" });
         return;
@@ -103,6 +104,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
       if (dto.status !== "cancelled" && dto.status !== "succeeded" && dto.status !== "failed") {
         throw new Error();
       }
+      stopPolling();
       flowRef.current = null;
       setState(dto.status === "failed"
         ? { phase: "failed", code: failureCode(dto.code) }
@@ -110,7 +112,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
       if (dto.status === "succeeded") onCompleted();
     } catch {
       if (unmountedRef.current || flowRef.current !== flowId) return;
-      // Keep ownership of the flow so the operator can retry cancellation.
+      // Retain ownership and polling so retries and device-login completion remain observable.
       setState(current => (current.phase === "pending" || current.phase === "committing") && current.flowId === flowId
         ? { ...current, cancelFailed: true }
         : current);
@@ -164,12 +166,16 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
         lastUrl = allowedVerificationUrl(dto.verificationUrl) || lastUrl;
         lastCode = humanCode(dto.deviceCode) || lastCode;
         if (dto.status === "pending" || dto.status === "committing") {
-          setState({
+          const pendingState: MainDeviceReauthState = {
             phase: dto.status,
             flowId,
             verificationUrl: lastUrl,
             deviceCode: lastCode,
-          });
+          };
+          setState(current => (current.phase === "pending" || current.phase === "committing")
+            && current.flowId === flowId && current.cancelFailed
+            ? { ...pendingState, cancelFailed: true }
+            : pendingState);
         } else if (dto.status === "succeeded") {
           flowRef.current = null;
           setState({ phase: "succeeded" });
diff --git a/gui/tests/main-device-reauth-ownership.test.tsx b/gui/tests/main-device-reauth-ownership.test.tsx
index 3dfe8a2933..29e4d95bea 100644
--- a/gui/tests/main-device-reauth-ownership.test.tsx
+++ b/gui/tests/main-device-reauth-ownership.test.tsx
@@ -240,3 +240,38 @@ test("StrictMode setup-cleanup-setup still permits start and polling", async ()
   await reply(take("DELETE", "A"), { status: "cancelled" });
   expect(hook.state.phase).toBe("cancelled");
 });
+
+for (const failure of ["network", "http", "nonterminal"] as const) {
+  test(`polling observes completion after retryable cancellation ${failure}`, async () => {
+    await mount();
+    await beginFlow("A");
+    await invoke(() => hook.cancel());
+    const cancellation = take("DELETE", "A");
+    await act(async () => {
+      if (failure === "network") cancellation.response.reject(new Error("transient cancellation failure"));
+      else if (failure === "http") cancellation.reply({ code: "unavailable" }, 503);
+      else cancellation.reply({ status: "pending" });
+    });
+    expect(hook.state).toMatchObject({ phase: "pending", flowId: "A", cancelFailed: true });
+    await act(async () => { for (const wake of sleepers.splice(0)) wake(); });
+    await reply(take("GET", "A"), { status: "pending" });
+    expect(hook.state).toMatchObject({ phase: "pending", flowId: "A", cancelFailed: true });
+    await act(async () => { for (const wake of sleepers.splice(0)) wake(); });
+    await reply(take("GET", "A"), { status: "succeeded" });
+    expect(hook.state.phase).toBe("succeeded");
+    expect(completed).toBe(1);
+  });
+}
+
+test("two successful cancellation replies complete the same flow only once", async () => {
+  await mount();
+  await beginFlow("A");
+  await invoke(() => hook.cancel());
+  const first = take("DELETE", "A");
+  await invoke(() => hook.cancel());
+  const second = take("DELETE", "A");
+  await reply(first, { status: "succeeded" });
+  await reply(second, { status: "succeeded" });
+  expect(hook.state.phase).toBe("succeeded");
+  expect(completed).toBe(1);
+});
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 2ad212e1a8..6005e78ace 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -14,7 +14,7 @@ This is a design-first rule for contributors, not a runtime feature: opencodex i
 plumbing, not a product-creation tool, so surface coherence is enforced by review rather than by an
 interview engine. The rule stands on its own; it does not depend on an external document.
 
-Native-main device cancellation and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
 
 ## Existing surfaces and their design direction
 
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 2094344ba2..c9d0b2319c 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -336,7 +336,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership after a failed cancellation request. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership and keeps polling while cancellation is pending or retryable. The cancellation-failure indication survives pending status updates until the flow settles. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
diff --git a/structure/overview.md b/structure/overview.md
index d740d51d1c..33357fd637 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -5,7 +5,7 @@ is scoped to canonical ChatGPT Responses forwarding; other source-area behavior
 
 Shared parsing and streaming follow the [request-copy](transports/byte-accounting.md#request-copy-accounting) and [stream-buffer accounting](transports/byte-accounting.md#stream-buffer-accounting) contracts.
 
-Native-main device cancellation and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
 
 ## Product boundary
 

From e72192b25008dc80ae1f8398d11c6f976033e96d Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 15 Sep 2026 09:38:25 +0900
Subject: [PATCH 08/11] fix(gui): retain cancel retry across polling HTTP races

---
 .../docs/fr/guides/codex-integration.md       |  2 +-
 .../content/docs/guides/codex-integration.md  |  2 +-
 .../docs/ja/guides/codex-integration.md       |  2 +-
 .../docs/ko/guides/codex-integration.md       |  2 +-
 .../docs/ru/guides/codex-integration.md       |  2 +-
 .../docs/tr/guides/codex-integration.md       |  2 +-
 .../docs/zh-cn/guides/codex-integration.md    |  2 +-
 .../docs/zh-tw/guides/codex-integration.md    |  2 +-
 gui/src/components/use-main-device-reauth.ts  | 26 ++++--
 .../main-device-reauth-ownership.test.tsx     | 88 ++++++++++++++++++-
 structure/design-methodology.md               |  2 +-
 structure/gui-and-management-api.md           |  2 +-
 structure/overview.md                         |  2 +-
 13 files changed, 117 insertions(+), 19 deletions(-)

diff --git a/docs-site/src/content/docs/fr/guides/codex-integration.md b/docs-site/src/content/docs/fr/guides/codex-integration.md
index 2a916cd66c..76eeaba2b0 100644
--- a/docs-site/src/content/docs/fr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/fr/guides/codex-integration.md
@@ -425,4 +425,4 @@ Ne réécrivez pas un historique paginé actif ni une ligne de conversation pour
 
 ## Annulation de la réauthentification du compte principal
 
-Lors de l’annulation de la réauthentification du compte principal par code d’appareil, un échec temporaire de DELETE, une erreur réseau ou une réponse dont le statut est inconnu ou non terminal conserve le flux actif et l’indication d’échec de l’annulation afin de permettre une nouvelle tentative ; l’interrogation périodique du statut continue pour détecter une connexion qui aboutit entre-temps. Une réponse terminale `failed` libère le flux et affiche la raison d’échec normalisée ; seul le statut `succeeded` signale une connexion réussie. Une réponse confirmant `cancelled` libère le flux et permet de lancer une nouvelle connexion par code d’appareil. Une réponse HTTP 404 définitive avec le code `unknown_flow` libère également l’identifiant du flux expiré pour permettre une nouvelle connexion par code d’appareil, sans signaler une connexion réussie ni une annulation confirmée. Les réponses POST, GET ou DELETE tardives d’un ancien flux ne peuvent ni modifier le nouveau flux ni signaler une connexion réussie pour celui-ci.
+Lors de l’annulation de la réauthentification du compte principal par code d’appareil, un échec temporaire de DELETE, une erreur réseau ou une réponse dont le statut est inconnu ou non terminal conserve le flux actif et l’indication d’échec de l’annulation afin de permettre une nouvelle tentative. L’interrogation périodique du statut continue normalement pour détecter une connexion qui aboutit entre-temps. Si un échec d’annulation permettant une nouvelle tentative coïncide avec une réponse GET de statut HTTP hors 2xx alors que le flux est `pending` ou `committing`, l’ordre d’arrivée des réponses ne change rien : l’annulation peut être retentée sur le même flux, avec le dernier code d’appareil, la dernière URL de vérification et la dernière phase fournis par le serveur. L’échec HTTP de GET arrête toujours l’interrogation périodique, mais l’annulation reste possible sans lancer un second POST de connexion. Une réponse terminale `failed` libère le flux et affiche la raison d’échec normalisée ; seul le statut `succeeded` signale une connexion réussie. Une réponse confirmant `cancelled` libère le flux et permet de lancer une nouvelle connexion par code d’appareil. Une réponse HTTP 404 définitive avec le code `unknown_flow` libère également l’identifiant du flux expiré pour permettre une nouvelle connexion par code d’appareil, sans signaler une connexion réussie ni une annulation confirmée. Les réponses POST, GET ou DELETE tardives d’un ancien flux ne peuvent ni modifier le nouveau flux ni signaler une connexion réussie pour celui-ci.
diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index e71c0774a7..a75971859a 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -807,7 +807,7 @@ Background revalidation is separate and off by default. It requires Token Guardi
 
 ### Cancelling main-account device reauthentication
 
-When cancelling main-account device reauthentication, a temporary DELETE or network failure, or a response with an unknown or nonterminal status, keeps the active flow and the cancellation-failure indication so cancellation can be retried; status polling continues so a login that completes can still be detected. A terminal `failed` response releases the flow and displays the normalized failure reason; only `succeeded` reports login success. A confirmed `cancelled` response releases the flow so a new device login can be started. A definitive HTTP 404 response with code `unknown_flow` also releases the expired flow ID so a new device login can be started, but does not report a successful login or confirmed cancellation. Late POST, GET, or DELETE responses from an earlier flow cannot change the new flow or report login success for it.
+When cancelling main-account device reauthentication, a temporary DELETE or network failure, or a response with an unknown or nonterminal status, keeps the active flow and the cancellation-failure indication so cancellation can be retried. Status polling normally continues so a login that completes can still be detected. If a retryable cancellation failure overlaps a non-2xx GET status response while the flow is `pending` or `committing`, either response order preserves cancellation retry on that same flow, with its last server-provided device code, verification URL, and phase. The GET HTTP failure still stops polling, but cancellation can be retried without starting a second login POST. A terminal `failed` response releases the flow and displays the normalized failure reason; only `succeeded` reports login success. A confirmed `cancelled` response releases the flow so a new device login can be started. A definitive HTTP 404 response with code `unknown_flow` also releases the expired flow ID so a new device login can be started, but does not report a successful login or confirmed cancellation. Late POST, GET, or DELETE responses from an earlier flow cannot change the new flow or report login success for it.
 
 ### Why an account stopped serving requests
 
diff --git a/docs-site/src/content/docs/ja/guides/codex-integration.md b/docs-site/src/content/docs/ja/guides/codex-integration.md
index 062de769c8..a2f7c3b718 100644
--- a/docs-site/src/content/docs/ja/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ja/guides/codex-integration.md
@@ -287,4 +287,4 @@ opencodex が管理対象 [バックグラウンドサービス](/reference/cli/
 
 ## メインアカウントの再認証のキャンセル
 
-メインアカウントのデバイスコードによる再認証をキャンセルする際、DELETE リクエストの一時的な失敗、ネットワークエラー、または不明もしくは非終端のステータスを持つ応答が発生した場合は、実行中のフローとキャンセル失敗の表示を維持し、キャンセルを再試行できるようにします。その間もステータスのポーリングは続き、ログインが完了した場合に検出できます。終端ステータス `failed` の応答ではフローを解放し、正規化された失敗理由を表示します。ログイン成功として扱うのは `succeeded` の場合だけです。`cancelled` が確認された応答ではフローを解放し、新しいデバイスコードログインを開始できるようにします。HTTP 404 と `unknown_flow` コードによる確定的な応答でも、期限切れのフロー ID を解放して新しいデバイスコードログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。以前のフローから遅れて届いた POST、GET、DELETE の応答が、新しいフローを変更したり、そのログインを成功と報告したりすることはありません。
+メインアカウントのデバイスコードによる再認証をキャンセルする際、DELETE リクエストの一時的な失敗、ネットワークエラー、または不明もしくは非終端のステータスを持つ応答が発生した場合は、実行中のフローとキャンセル失敗の表示を維持し、キャンセルを再試行できるようにします。通常はステータスのポーリングも続き、ログインが完了した場合に検出できます。フローが `pending` または `committing` のときに、再試行可能なキャンセル失敗と GET ステータス取得の 2xx 以外の HTTP 応答が重なった場合は、応答の到着順にかかわらず、サーバーから最後に取得したデバイスコード、確認 URL、フェーズを保持または復元し、同じフローのキャンセルを再試行できます。GET の HTTP 失敗でポーリングは停止しますが、2 回目のログイン POST を送らずにキャンセルを再試行できます。終端ステータス `failed` の応答ではフローを解放し、正規化された失敗理由を表示します。ログイン成功として扱うのは `succeeded` の場合だけです。`cancelled` が確認された応答ではフローを解放し、新しいデバイスコードログインを開始できるようにします。HTTP 404 と `unknown_flow` コードによる確定的な応答でも、期限切れのフロー ID を解放して新しいデバイスコードログインを開始できるようにしますが、ログイン成功やキャンセル確定とは表示しません。以前のフローから遅れて届いた POST、GET、DELETE の応答が、新しいフローを変更したり、そのログインを成功と報告したりすることはありません。
diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md
index 415823360e..a11fd65b54 100644
--- a/docs-site/src/content/docs/ko/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ko/guides/codex-integration.md
@@ -384,4 +384,4 @@ opencodex가 managed [background service](/reference/cli/#ocx-service)로 실행
 
 ## 메인 계정 재인증 취소
 
-메인 계정의 기기 코드 재인증을 취소할 때 DELETE 요청의 일시적 실패, 네트워크 오류, 알 수 없거나 아직 종료되지 않은 상태의 응답이 발생하면 진행 중인 흐름과 취소 실패 표시를 유지하여 취소를 다시 시도할 수 있게 합니다. 이때도 상태 조회를 계속하므로 로그인이 완료되면 이를 확인할 수 있습니다. 종료 상태인 `failed` 응답은 흐름을 해제하고 정규화된 실패 사유를 표시하며, `succeeded` 응답만 로그인 성공을 알립니다. `cancelled`로 확인된 응답은 흐름을 해제하여 새 기기 코드 로그인을 시작할 수 있게 합니다. HTTP 404와 `unknown_flow` 코드가 명확하게 반환된 경우에도 만료된 흐름 ID를 해제하여 새 기기 코드 로그인을 시작할 수 있게 하지만, 로그인 성공이나 취소 확정으로 표시하지 않습니다. 이전 흐름에서 늦게 도착한 POST·GET·DELETE 응답은 새 흐름을 변경하거나 새 흐름의 로그인이 성공했다고 알릴 수 없습니다.
+메인 계정의 기기 코드 재인증을 취소할 때 DELETE 요청의 일시적 실패, 네트워크 오류, 알 수 없거나 아직 종료되지 않은 상태의 응답이 발생하면 진행 중인 흐름과 취소 실패 표시를 유지하여 취소를 다시 시도할 수 있게 합니다. 일반적으로는 상태 조회도 계속하므로 로그인이 완료되면 이를 확인할 수 있습니다. 흐름이 `pending` 또는 `committing`일 때 재시도 가능한 취소 실패와 GET 상태 조회의 2xx 이외 HTTP 응답이 겹치면, 응답 도착 순서와 관계없이 서버가 마지막으로 제공한 기기 코드·확인 URL·진행 단계를 유지하거나 복원하여 같은 흐름의 취소를 다시 시도할 수 있게 합니다. GET의 HTTP 실패는 상태 조회를 종료하지만, 두 번째 로그인 POST를 보내지 않고 취소를 다시 시도할 수 있습니다. 종료 상태인 `failed` 응답은 흐름을 해제하고 정규화된 실패 사유를 표시하며, `succeeded` 응답만 로그인 성공을 알립니다. `cancelled`로 확인된 응답은 흐름을 해제하여 새 기기 코드 로그인을 시작할 수 있게 합니다. HTTP 404와 `unknown_flow` 코드가 명확하게 반환된 경우에도 만료된 흐름 ID를 해제하여 새 기기 코드 로그인을 시작할 수 있게 하지만, 로그인 성공이나 취소 확정으로 표시하지 않습니다. 이전 흐름에서 늦게 도착한 POST·GET·DELETE 응답은 새 흐름을 변경하거나 새 흐름의 로그인이 성공했다고 알릴 수 없습니다.
diff --git a/docs-site/src/content/docs/ru/guides/codex-integration.md b/docs-site/src/content/docs/ru/guides/codex-integration.md
index e419c441d5..a6ce26af17 100644
--- a/docs-site/src/content/docs/ru/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ru/guides/codex-integration.md
@@ -419,4 +419,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## Отмена повторной аутентификации основного аккаунта
 
-При отмене повторной аутентификации основного аккаунта по коду устройства временный сбой DELETE, сетевая ошибка или ответ с неизвестным либо нетерминальным статусом сохраняет активный процесс и индикацию ошибки отмены, чтобы отмену можно было повторить; опрос статуса продолжается, позволяя обнаружить завершившийся вход. Терминальный ответ `failed` освобождает процесс и показывает нормализованную причину ошибки; только `succeeded` сообщает об успешном входе. Подтверждённый ответ `cancelled` освобождает процесс, позволяя начать новый вход по коду устройства. Однозначный ответ HTTP 404 с кодом `unknown_flow` также освобождает идентификатор истёкшего процесса и позволяет начать новый вход по коду устройства, но не сообщает об успешном входе или подтверждённой отмене. Запоздавшие ответы POST, GET или DELETE от предыдущего процесса не могут изменить новый процесс или сообщить об успешном входе в нём.
+При отмене повторной аутентификации основного аккаунта по коду устройства временный сбой DELETE, сетевая ошибка или ответ с неизвестным либо нетерминальным статусом сохраняет активный процесс и индикацию ошибки отмены, чтобы отмену можно было повторить. Обычно опрос статуса продолжается, позволяя обнаружить завершившийся вход. Если при состоянии `pending` или `committing` ошибка отмены, допускающая повторную попытку, совпадает с HTTP-ответом GET вне диапазона 2xx, порядок получения ответов не влияет на возможность повторить отмену того же процесса: сохраняются или восстанавливаются последние полученные от сервера код устройства, URL подтверждения и состояние. HTTP-ошибка GET по-прежнему останавливает опрос, но отмену можно повторить без второго POST для запуска входа. Терминальный ответ `failed` освобождает процесс и показывает нормализованную причину ошибки; только `succeeded` сообщает об успешном входе. Подтверждённый ответ `cancelled` освобождает процесс, позволяя начать новый вход по коду устройства. Однозначный ответ HTTP 404 с кодом `unknown_flow` также освобождает идентификатор истёкшего процесса и позволяет начать новый вход по коду устройства, но не сообщает об успешном входе или подтверждённой отмене. Запоздавшие ответы POST, GET или DELETE от предыдущего процесса не могут изменить новый процесс или сообщить об успешном входе в нём.
diff --git a/docs-site/src/content/docs/tr/guides/codex-integration.md b/docs-site/src/content/docs/tr/guides/codex-integration.md
index 11271e573d..33f8d3d309 100644
--- a/docs-site/src/content/docs/tr/guides/codex-integration.md
+++ b/docs-site/src/content/docs/tr/guides/codex-integration.md
@@ -476,4 +476,4 @@ Konuşmaları kendiniz taşımak için etkin sayfalanmış geçmişi veya iş pa
 
 ## Ana hesabın yeniden kimlik doğrulamasını iptal etme
 
-Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken geçici bir DELETE hatası, ağ hatası ya da bilinmeyen veya sonlanmamış bir durum içeren yanıt alınırsa etkin akış ve iptal hatası göstergesi korunur; böylece iptal yeniden denenebilir ve tamamlanan bir girişin algılanabilmesi için durum sorgulaması devam eder. Son durum olan `failed` yanıtı akışı serbest bırakır ve normalleştirilmiş hata nedenini gösterir; başarılı girişi yalnızca `succeeded` bildirir. Onaylanmış `cancelled` yanıtı akışı serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar. `unknown_flow` koduyla gelen kesin bir HTTP 404 yanıtı da süresi dolmuş akış kimliğini serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar, ancak girişin başarılı olduğunu veya iptalin onaylandığını bildirmez. Önceki bir akıştan geç gelen POST, GET veya DELETE yanıtları yeni akışı değiştiremez veya yeni akış için başarılı giriş bildiremez.
+Ana hesabın cihaz koduyla yeniden kimlik doğrulaması iptal edilirken geçici bir DELETE hatası, ağ hatası ya da bilinmeyen veya sonlanmamış bir durum içeren yanıt alınırsa etkin akış ve iptal hatası göstergesi korunur; böylece iptal yeniden denenebilir. Tamamlanan bir girişin algılanabilmesi için durum sorgulaması normalde devam eder. Akış `pending` veya `committing` durumundayken yeniden denenebilir bir iptal hatası ile GET durum sorgusunun 2xx dışı HTTP yanıtı çakışırsa yanıtların geliş sırasından bağımsız olarak aynı akışın iptali yeniden denenebilir; sunucudan alınan son cihaz kodu, doğrulama URL’si ve aşama korunur veya geri yüklenir. GET HTTP hatası durum sorgulamasını yine durdurur, ancak ikinci bir giriş POST isteği başlatılmadan iptal yeniden denenebilir. Son durum olan `failed` yanıtı akışı serbest bırakır ve normalleştirilmiş hata nedenini gösterir; başarılı girişi yalnızca `succeeded` bildirir. Onaylanmış `cancelled` yanıtı akışı serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar. `unknown_flow` koduyla gelen kesin bir HTTP 404 yanıtı da süresi dolmuş akış kimliğini serbest bırakarak cihaz koduyla yeni bir giriş başlatılmasını sağlar, ancak girişin başarılı olduğunu veya iptalin onaylandığını bildirmez. Önceki bir akıştan geç gelen POST, GET veya DELETE yanıtları yeni akışı değiştiremez veya yeni akış için başarılı giriş bildiremez.
diff --git a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
index f11e4d489d..713670a93f 100644
--- a/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-cn/guides/codex-integration.md
@@ -362,4 +362,4 @@ ocx restore back # point plain Codex at the running proxy again
 
 ## 取消主账号重新认证
 
-取消主账号的设备代码重新认证时，如果 DELETE 请求暂时失败、发生网络错误，或响应状态未知或尚未结束，系统会保留当前流程和取消失败提示，以便重试取消；状态轮询仍会继续，因此仍能检测到登录完成。终止状态为 `failed` 的响应会释放流程并显示规范化的失败原因，只有 `succeeded` 才表示登录成功。确认状态为 `cancelled` 的响应会释放流程，以便开始新的设备代码登录。明确返回 HTTP 404 且代码为 `unknown_flow` 的响应也会释放已过期的流程 ID，以便开始新的设备代码登录，但不会显示登录成功或已确认取消。先前流程中延迟到达的 POST、GET 或 DELETE 响应不能改变新流程，也不能将新流程报告为登录成功。
+取消主账号的设备代码重新认证时，如果 DELETE 请求暂时失败、发生网络错误，或响应状态未知或尚未结束，系统会保留当前流程和取消失败提示，以便重试取消。通常状态轮询会继续，因此仍能检测到登录完成。如果流程处于 `pending` 或 `committing` 状态时，可重试的取消失败与 GET 状态查询的非 2xx HTTP 响应同时发生，无论响应到达顺序如何，系统都会保留或恢复服务器最后提供的设备代码、验证 URL 和阶段，使同一流程仍可重试取消。GET 的 HTTP 失败仍会停止轮询，但无需发送第二次登录 POST 即可重试取消。终止状态为 `failed` 的响应会释放流程并显示规范化的失败原因，只有 `succeeded` 才表示登录成功。确认状态为 `cancelled` 的响应会释放流程，以便开始新的设备代码登录。明确返回 HTTP 404 且代码为 `unknown_flow` 的响应也会释放已过期的流程 ID，以便开始新的设备代码登录，但不会显示登录成功或已确认取消。先前流程中延迟到达的 POST、GET 或 DELETE 响应不能改变新流程，也不能将新流程报告为登录成功。
diff --git a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
index 1fa336d0c7..76d181d1bf 100644
--- a/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
+++ b/docs-site/src/content/docs/zh-tw/guides/codex-integration.md
@@ -369,4 +369,4 @@ ocx restore back # 讓普通 Codex 再次指向仍在執行的 proxy
 
 ## 取消主帳號重新驗證
 
-取消主帳號的裝置代碼重新驗證時，如果 DELETE 請求暫時失敗、發生網路錯誤，或回應狀態未知或尚未結束，系統會保留目前的流程和取消失敗提示，以便重試取消；狀態輪詢仍會繼續，因此仍能偵測到登入完成。終止狀態為 `failed` 的回應會釋放流程並顯示正規化的失敗原因，只有 `succeeded` 才表示登入成功。確認狀態為 `cancelled` 的回應會釋放流程，以便開始新的裝置代碼登入。明確回傳 HTTP 404 且代碼為 `unknown_flow` 的回應也會釋放已過期的流程 ID，以便開始新的裝置代碼登入，但不會顯示登入成功或已確認取消。先前流程中延遲抵達的 POST、GET 或 DELETE 回應不能改變新流程，也不能將新流程回報為登入成功。
+取消主帳號的裝置代碼重新驗證時，如果 DELETE 請求暫時失敗、發生網路錯誤，或回應狀態未知或尚未結束，系統會保留目前的流程和取消失敗提示，以便重試取消。通常狀態輪詢會繼續，因此仍能偵測到登入完成。如果流程處於 `pending` 或 `committing` 狀態時，可重試的取消失敗與 GET 狀態查詢的非 2xx HTTP 回應同時發生，無論回應抵達順序如何，系統都會保留或還原伺服器最後提供的裝置代碼、驗證 URL 和階段，讓同一流程仍可重試取消。GET 的 HTTP 失敗仍會停止輪詢，但無須傳送第二次登入 POST 即可重試取消。終止狀態為 `failed` 的回應會釋放流程並顯示正規化的失敗原因，只有 `succeeded` 才表示登入成功。確認狀態為 `cancelled` 的回應會釋放流程，以便開始新的裝置代碼登入。明確回傳 HTTP 404 且代碼為 `unknown_flow` 的回應也會釋放已過期的流程 ID，以便開始新的裝置代碼登入，但不會顯示登入成功或已確認取消。先前流程中延遲抵達的 POST、GET 或 DELETE 回應不能改變新流程，也不能將新流程回報為登入成功。
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index 40485261a4..275f777a3d 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -37,6 +37,8 @@ export type MainDeviceReauthState =
   | { phase: "cancelled" }
   | { phase: "failed"; code: MainDeviceReauthFailureCode };
 
+type CancellableState = Extract<MainDeviceReauthState, { phase: "pending" | "committing" }>;
+
 type FlowDto = {
   flowId?: unknown;
   status?: unknown;
@@ -73,6 +75,7 @@ function humanCode(value: unknown): string {
 export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
   const [state, setState] = useState<MainDeviceReauthState>({ phase: "idle" });
   const flowRef = useRef<string | null>(null);
+  const lastCancellableStateRef = useRef<CancellableState | null>(null);
   const abortRef = useRef<AbortController | null>(null);
   const unmountedRef = useRef(false);
 
@@ -113,15 +116,22 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     } catch {
       if (unmountedRef.current || flowRef.current !== flowId) return;
       // Retain ownership and polling so retries and device-login completion remain observable.
-      setState(current => (current.phase === "pending" || current.phase === "committing") && current.flowId === flowId
-        ? { ...current, cancelFailed: true }
-        : current);
+      setState(current => {
+        if (unmountedRef.current || flowRef.current !== flowId) return current;
+        // A concurrent polling HTTP error can hide the still-owned flow behind
+        // failed. Restore its last device details and phase so Cancel stays usable.
+        const active = current.phase === "pending" || current.phase === "committing"
+          ? current
+          : lastCancellableStateRef.current;
+        return active?.flowId === flowId ? { ...active, cancelFailed: true } : current;
+      });
     }
   }, [apiBase, onCompleted, stopPolling]);
 
   const start = useCallback(async () => {
     stopPolling();
     flowRef.current = null;
+    lastCancellableStateRef.current = null;
     const ctrl = new AbortController();
     abortRef.current = ctrl;
     const isCurrent = () => !ctrl.signal.aborted && !unmountedRef.current && abortRef.current === ctrl;
@@ -160,18 +170,24 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
         const dto = await res.json().catch(() => ({})) as FlowDto;
         if (!isCurrent() || flowRef.current !== flowId) return;
         if (!res.ok) {
-          setState({ phase: "failed", code: failureCode(dto.code) });
+          // A failed cancellation still owns the server flow. A racing HTTP
+          // polling failure must not replace its retry control with Re-login.
+          setState(current => (current.phase === "pending" || current.phase === "committing")
+            && current.flowId === flowId && current.cancelFailed
+            ? current
+            : { phase: "failed", code: failureCode(dto.code) });
           return;
         }
         lastUrl = allowedVerificationUrl(dto.verificationUrl) || lastUrl;
         lastCode = humanCode(dto.deviceCode) || lastCode;
         if (dto.status === "pending" || dto.status === "committing") {
-          const pendingState: MainDeviceReauthState = {
+          const pendingState: CancellableState = {
             phase: dto.status,
             flowId,
             verificationUrl: lastUrl,
             deviceCode: lastCode,
           };
+          lastCancellableStateRef.current = pendingState;
           setState(current => (current.phase === "pending" || current.phase === "committing")
             && current.flowId === flowId && current.cancelFailed
             ? { ...pendingState, cancelFailed: true }
diff --git a/gui/tests/main-device-reauth-ownership.test.tsx b/gui/tests/main-device-reauth-ownership.test.tsx
index 29e4d95bea..40135499a2 100644
--- a/gui/tests/main-device-reauth-ownership.test.tsx
+++ b/gui/tests/main-device-reauth-ownership.test.tsx
@@ -2,6 +2,9 @@ import { afterEach, beforeEach, expect, test } from "bun:test";
 import { Window } from "happy-dom";
 import { act, createElement, StrictMode, useEffect } from "react";
 import type { Root } from "react-dom/client";
+import { LanguageProvider } from "../src/i18n/provider";
+import { CodexAccountPoolMainCard } from "../src/components/codex-account-pool-main-card";
+import type { CodexAccountEntry } from "../src/components/codex-account-pool-types";
 import { useMainDeviceReauth } from "../src/components/use-main-device-reauth";
 
 type Hook = ReturnType<typeof useMainDeviceReauth>;
@@ -42,7 +45,7 @@ function request(method: string, url: string) {
 }
 type Request = ReturnType<typeof request>;
 
-const globalKeys = ["window", "document", "navigator", "IS_REACT_ACT_ENVIRONMENT", "fetch", "setTimeout"] as const;
+const globalKeys = ["window", "document", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT", "fetch", "setTimeout"] as const;
 let descriptors: Map<string, PropertyDescriptor | undefined>;
 let win: Window;
 let host: HTMLElement;
@@ -72,6 +75,7 @@ beforeEach(() => {
     window: { configurable: true, value: win },
     document: { configurable: true, value: win.document },
     navigator: { configurable: true, value: win.navigator },
+    localStorage: { configurable: true, value: win.localStorage },
     IS_REACT_ACT_ENVIRONMENT: { configurable: true, value: true },
     fetch: {
       configurable: true,
@@ -112,7 +116,7 @@ afterEach(async () => {
   }
 });
 
-async function mount(strict = false) {
+async function mount(strict = false, showCard = false) {
   const { createRoot } = await import("react-dom/client");
   function Probe() {
     const value = useMainDeviceReauth("", () => { completed += 1; });
@@ -121,7 +125,31 @@ async function mount(strict = false) {
       setups += 1;
       return () => { cleanups += 1; };
     }, []);
-    return null;
+    if (!showCard) return null;
+    return createElement(LanguageProvider, null, createElement(CodexAccountPoolMainCard, {
+      t: key => key,
+      main: { id: "__main__", isMain: true, needsReauth: true } as CodexAccountEntry,
+      isMainActive: false,
+      accountModeState: null,
+      threshold: 80,
+      switchActionLabel: "Switch",
+      onSwitch: () => {},
+      onTogglePause: () => {},
+      pauseUpdatingId: null,
+      pauseBusy: false,
+      onPriorityChange: () => {},
+      priorityUpdatingId: null,
+      switchingId: null,
+      onOpenReset: () => {},
+      mainReauth: {
+        ...value,
+        cancel: () => {
+          const task = value.cancel();
+          tasks.push(task);
+          return task;
+        },
+      },
+    }));
   }
   await act(async () => {
     root = createRoot(host);
@@ -275,3 +303,57 @@ test("two successful cancellation replies complete the same flow only once", asy
   expect(hook.state.phase).toBe("succeeded");
   expect(completed).toBe(1);
 });
+
+for (const phase of ["pending", "committing"] as const) {
+  for (const failure of ["network", "http", "nonterminal"] as const) {
+    test.each(["poll-first", "cancel-first"] as const)(`raced polling HTTP error keeps ${phase} cancellation ${failure} retryable in the card (%s)`, async order => {
+      await mount(false, true);
+      await beginFlow("A");
+      if (phase === "committing") {
+        await act(async () => { for (const wake of sleepers.splice(0)) wake(); });
+        await reply(take("GET", "A"), { status: "committing" });
+      }
+      await act(async () => { for (const wake of sleepers.splice(0)) wake(); });
+      const poll = take("GET", "A");
+      const cancelButton = () => Array.from(host.querySelectorAll<HTMLButtonElement>("button"))
+        .find(button => button.textContent === "codexAuth.mainReauthCancel");
+      expect(cancelButton()).toBeDefined();
+      await act(async () => { cancelButton()!.click(); });
+      const cancellation = take("DELETE", "A");
+
+      const failCancellation = () => act(async () => {
+        if (failure === "network") cancellation.response.reject(new Error("transient cancellation failure"));
+        else if (failure === "http") cancellation.reply({ code: "unavailable" }, 503);
+        else cancellation.reply({ status: "pending" });
+      });
+      // Neither arrival order may hide a still-owned flow's cancellation retry.
+      if (order === "poll-first") {
+        await reply(poll, { code: "unavailable" }, 503);
+        await failCancellation();
+      } else {
+        await failCancellation();
+        await reply(poll, { code: "unavailable" }, 503);
+      }
+      expect(hook.state).toEqual({
+        phase, flowId: "A", verificationUrl: "https://auth.openai.com/codex/device",
+        deviceCode: "ABCD-1234", cancelFailed: true,
+      });
+      expect(host.querySelector('.codex-main-reauth-pending [role="status"]')?.textContent)
+        .toBe("codexAuth.mainReauthFailed");
+      expect(host.textContent).toContain("ABCD-1234");
+      expect(host.textContent).toContain("https://auth.openai.com/codex/device");
+      expect(host.textContent).not.toContain("codexAuth.mainReauthDevice");
+      expect(cancelButton()?.disabled).toBe(false);
+
+      // Retry through the actual card control, without restarting the flow.
+      await act(async () => { cancelButton()!.click(); });
+      await reply(take("DELETE", "A"), { status: "cancelled" });
+      expect(hook.state.phase).toBe("cancelled");
+      expect(cancelButton()).toBeUndefined();
+      expect(host.textContent).toContain("codexAuth.mainReauthDevice");
+      expect(requests.filter(pending => pending.method === "POST")).toHaveLength(1);
+      expect(requests.filter(pending => pending.method === "DELETE")).toHaveLength(2);
+      expect(completed).toBe(0);
+    });
+  }
+}
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 6005e78ace..0221f688e4 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -55,4 +55,4 @@ Cline uses the existing file-integration page, tabs, status badge and rollback d
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Native-main reauthentication cancellation follows the [GUI state contract](gui-and-management-api.md#dashboard-surfaces): failed requests remain retryable, while confirmed failed flows release ownership and show the existing normalized failure state.
+Native-main reauthentication separates polling lifetime from flow ownership: a non-2xx GET stops polling, while a concurrent retryable DELETE failure preserves or restores the last pending/committing device state for Cancel retry without a second login POST. Trusted terminal results release ownership.
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index c9d0b2319c..94cece8c72 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -336,7 +336,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership and keeps polling while cancellation is pending or retryable. The cancellation-failure indication survives pending status updates until the flow settles. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership while cancellation is pending or retryable; polling normally continues. If a retryable DELETE failure races with a non-2xx GET while the flow is pending or committing, either response order preserves same-flow Cancel retry and restores the last server-provided device code, verification URL, and phase when needed. The GET HTTP failure still stops polling without starting a second login POST. The cancellation-failure indication survives pending status updates until a trusted terminal result releases ownership. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
diff --git a/structure/overview.md b/structure/overview.md
index 33357fd637..2cd78e30b5 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -150,4 +150,4 @@ The [explicit model-capability contract](config.md#explicit-per-model-capability
 
 Provider-scoped approval reviewer settings are projected by the [catalog owner](catalog.md#provider-scoped-approval-reviewer); this surface retains its existing routing, transport and account-selection behavior.
 
-Native-main reauthentication cancellation follows the [GUI state contract](gui-and-management-api.md#dashboard-surfaces): failed requests remain retryable, while confirmed failed flows release ownership and show the existing normalized failure state.
+Native-main reauthentication retains the same flow and its Cancel retry after a retryable DELETE failure races with a GET HTTP failure in either order; a trusted terminal result releases ownership.

From b9564316aae6d749a9c5554bfc80e916a9fa0f15 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 15 Sep 2026 09:56:46 +0900
Subject: [PATCH 09/11] fix(gui): keep cancellation available before DELETE
 settles

Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
---
 gui/src/components/use-main-device-reauth.ts  | 19 +++++++++++++------
 .../main-device-reauth-ownership.test.tsx     |  8 ++++++++
 structure/design-methodology.md               |  2 +-
 structure/gui-and-management-api.md           |  2 +-
 structure/overview.md                         |  2 +-
 5 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index 275f777a3d..a0ea046741 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -75,6 +75,7 @@ function humanCode(value: unknown): string {
 export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
   const [state, setState] = useState<MainDeviceReauthState>({ phase: "idle" });
   const flowRef = useRef<string | null>(null);
+  const cancellationRequestedFlowRef = useRef<string | null>(null);
   const lastCancellableStateRef = useRef<CancellableState | null>(null);
   const abortRef = useRef<AbortController | null>(null);
   const unmountedRef = useRef(false);
@@ -91,6 +92,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
       setState({ phase: "idle" });
       return;
     }
+    cancellationRequestedFlowRef.current = flowId;
     try {
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
       const dto = await res.json().catch(() => ({})) as FlowDto;
@@ -131,6 +133,7 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
   const start = useCallback(async () => {
     stopPolling();
     flowRef.current = null;
+    cancellationRequestedFlowRef.current = null;
     lastCancellableStateRef.current = null;
     const ctrl = new AbortController();
     abortRef.current = ctrl;
@@ -170,12 +173,16 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
         const dto = await res.json().catch(() => ({})) as FlowDto;
         if (!isCurrent() || flowRef.current !== flowId) return;
         if (!res.ok) {
-          // A failed cancellation still owns the server flow. A racing HTTP
-          // polling failure must not replace its retry control with Re-login.
-          setState(current => (current.phase === "pending" || current.phase === "committing")
-            && current.flowId === flowId && current.cancelFailed
-            ? current
-            : { phase: "failed", code: failureCode(dto.code) });
+          // Ownership continues from the Cancel click, including while DELETE
+          // is unresolved. Never offer a replacement POST during that window.
+          const cancellationRequested = cancellationRequestedFlowRef.current === flowId;
+          setState(current => {
+            if (!isCurrent() || flowRef.current !== flowId) return current;
+            return (current.phase === "pending" || current.phase === "committing")
+              && current.flowId === flowId && (cancellationRequested || current.cancelFailed)
+              ? current
+              : { phase: "failed", code: failureCode(dto.code) };
+          });
           return;
         }
         lastUrl = allowedVerificationUrl(dto.verificationUrl) || lastUrl;
diff --git a/gui/tests/main-device-reauth-ownership.test.tsx b/gui/tests/main-device-reauth-ownership.test.tsx
index 40135499a2..63bf7bbb0a 100644
--- a/gui/tests/main-device-reauth-ownership.test.tsx
+++ b/gui/tests/main-device-reauth-ownership.test.tsx
@@ -329,6 +329,14 @@ for (const phase of ["pending", "committing"] as const) {
       // Neither arrival order may hide a still-owned flow's cancellation retry.
       if (order === "poll-first") {
         await reply(poll, { code: "unavailable" }, 503);
+        // DELETE is still unresolved: do not offer a replacement POST in this window.
+        expect(hook.state).toEqual({
+          phase, flowId: "A", verificationUrl: "https://auth.openai.com/codex/device",
+          deviceCode: "ABCD-1234",
+        });
+        expect(cancelButton()?.disabled).toBe(false);
+        expect(host.textContent).not.toContain("codexAuth.mainReauthDevice");
+        expect(requests.filter(pending => pending.method === "POST")).toHaveLength(1);
         await failCancellation();
       } else {
         await failCancellation();
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 0221f688e4..78dd82b7a1 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -55,4 +55,4 @@ Cline uses the existing file-integration page, tabs, status badge and rollback d
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Native-main reauthentication separates polling lifetime from flow ownership: a non-2xx GET stops polling, while a concurrent retryable DELETE failure preserves or restores the last pending/committing device state for Cancel retry without a second login POST. Trusted terminal results release ownership.
+Native-main reauthentication separates polling lifetime from flow ownership: a non-2xx GET stops polling, while cancellation requested for the same flow preserves the pending/committing device state even before DELETE settles. A retryable DELETE failure preserves or restores Cancel retry without a second login POST. Trusted terminal results release ownership.
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index bf23e701b0..20f1044b1d 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -340,7 +340,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). The catalog browses four tabs — Accounts, Free, Local, Paid — where Local is a catalog-only bucket peeled out of `bucketPresets` after `presetTier` has classified; the workspace `providerTier` stays three-way, so the rail, the free-paid sort and the Free count still treat a local runtime as free. Search sits above the tabs and reaches every tab at once: while a query is live the list renders all four groups with headings and the strip becomes jump chips with counts rather than a tablist, because moving the selected tab would change the row kind under the user (a preset-select button becomes a login row). ArrowDown from the search input focuses the first enabled result action; if none is available, focus stays in the input. The tab strip wraps within narrow modals. Every nonempty note has a full-text button so narrow rows never hide content permanently; the native note dialog closes during teardown and restores focus to its trigger. Provider notes clamp to two lines and open in full in a stacked native `<dialog>` owned by `AddProviderModal`, which also owns the search text so its `window` Escape handler can unwind popup, then query, then dialog. |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership while cancellation is pending or retryable; polling normally continues. If a retryable DELETE failure races with a non-2xx GET while the flow is pending or committing, either response order preserves same-flow Cancel retry and restores the last server-provided device code, verification URL, and phase when needed. The GET HTTP failure still stops polling without starting a second login POST. The cancellation-failure indication survives pending status updates until a trusted terminal result releases ownership. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership from the Cancel click, while DELETE is unresolved and after retryable failure; polling normally continues. A concurrent GET HTTP error cannot expose a replacement login POST before DELETE settles. If a retryable DELETE failure races with a non-2xx GET while the flow is pending or committing, either response order preserves same-flow Cancel retry and restores the last server-provided device code, verification URL, and phase when needed. The GET HTTP failure still stops polling without starting a second login POST. The cancellation-failure indication survives pending status updates until a trusted terminal result releases ownership. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
diff --git a/structure/overview.md b/structure/overview.md
index 2cd78e30b5..90ac6224ea 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -150,4 +150,4 @@ The [explicit model-capability contract](config.md#explicit-per-model-capability
 
 Provider-scoped approval reviewer settings are projected by the [catalog owner](catalog.md#provider-scoped-approval-reviewer); this surface retains its existing routing, transport and account-selection behavior.
 
-Native-main reauthentication retains the same flow and its Cancel retry after a retryable DELETE failure races with a GET HTTP failure in either order; a trusted terminal result releases ownership.
+Native-main reauthentication retains the same flow and its Cancel control from the cancellation click, including an unresolved DELETE racing with a GET HTTP failure; retryable failure keeps cancellation available, and a trusted terminal result releases ownership.

From 322bd640678537b1cac5f8d747265d58fbd39b18 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Wed, 16 Sep 2026 01:33:39 +0900
Subject: [PATCH 10/11] fix(gui): make reauth ownership explicit to React
 Doctor

Capture the accepted flow identity as a const for polling and queued state updaters. Keep intentional API error-body reads at three narrowly documented React Doctor exception sites; HTTP status and flow ownership still gate all successful outcomes.

Add POST, GET and DELETE regressions where non-2xx responses contain success-shaped JSON. Focused GUI validation passes 40 tests and 461 assertions, lint, TypeScript and production build. React Doctor 0.9.11 against the exact CI base goes from one compiler error plus three response-body warnings to a complete clean scan with those three local exceptions. Structure, privacy and file-size checks pass.

Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
---
 gui/.react-doctor-ignores.md                  | 10 ++++++++
 gui/src/components/use-main-device-reauth.ts  | 12 ++++++++--
 .../main-device-reauth-ownership.test.tsx     | 24 +++++++++++++++++++
 structure/design-methodology.md               |  2 +-
 structure/gui-and-management-api.md           |  5 ++++
 structure/overview.md                         |  2 +-
 6 files changed, 51 insertions(+), 4 deletions(-)

diff --git a/gui/.react-doctor-ignores.md b/gui/.react-doctor-ignores.md
index 8dc3301953..f5770a0f6b 100644
--- a/gui/.react-doctor-ignores.md
+++ b/gui/.react-doctor-ignores.md
@@ -17,3 +17,13 @@ Re-enable a rule when the matching architecture debt is paid down.
 | `rerender-state-only-in-handlers` | Dirty/modal id state is used for control flow outside JSX text. |
 | `prefer-use-effect-event` | Optional React 19 polish; deferred to avoid mixed patterns mid-cleanup. |
 | `js-combine-iterations` | Readability preferred over micro one-pass rewrites on small lists. |
+
+## Local response-body exceptions
+
+`use-main-device-reauth.ts` suppresses `no-fetch-response-used-without-status-check`
+only at its three POST/GET/DELETE fetch sites. This API returns failure codes in JSON,
+and DELETE needs the HTTP 404 `unknown_flow` body to distinguish an expired flow.
+Each path checks HTTP status and flow ownership before interpreting the DTO as a
+successful result. Parsing first also allows a late body to be discarded after the
+ownership check. `main-device-reauth-ownership.test.tsx` covers non-2xx success-shaped
+bodies, delayed replies, once-only completion, and cancellation retry ownership.
diff --git a/gui/src/components/use-main-device-reauth.ts b/gui/src/components/use-main-device-reauth.ts
index a0ea046741..ecaf3eb0ac 100644
--- a/gui/src/components/use-main-device-reauth.ts
+++ b/gui/src/components/use-main-device-reauth.ts
@@ -94,6 +94,8 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     }
     cancellationRequestedFlowRef.current = flowId;
     try {
+      // Error JSON identifies an expired flow; status is checked before applying its DTO.
+      // react-doctor-disable-next-line react-doctor/no-fetch-response-used-without-status-check
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`, { method: "DELETE" });
       const dto = await res.json().catch(() => ({})) as FlowDto;
       if (unmountedRef.current || flowRef.current !== flowId) return;
@@ -139,9 +141,11 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     abortRef.current = ctrl;
     const isCurrent = () => !ctrl.signal.aborted && !unmountedRef.current && abortRef.current === ctrl;
     setState({ phase: "starting" });
-    let flowId: string;
+    let startedFlowId: string;
     try {
       // Empty body by contract: the route rejects any request keys with 400.
+      // Error JSON supplies the normalized failure code; !res.ok never starts a flow.
+      // react-doctor-disable-next-line react-doctor/no-fetch-response-used-without-status-check
       const res = await fetch(`${apiBase}/api/codex-auth/main/reauth-device`, { method: "POST", signal: ctrl.signal });
       const dto = await res.json().catch(() => ({})) as FlowDto;
       if (!isCurrent()) return;
@@ -153,11 +157,13 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
         setState({ phase: "failed", code: "request_failed" });
         return;
       }
-      flowId = dto.flowId;
+      startedFlowId = dto.flowId;
     } catch {
       if (isCurrent()) setState({ phase: "failed", code: "request_failed" });
       return;
     }
+    // Polling and queued updaters capture the accepted identity, not the mutable parse slot.
+    const flowId = startedFlowId;
     flowRef.current = flowId;
     let lastUrl = "";
     let lastCode = "";
@@ -166,6 +172,8 @@ export function useMainDeviceReauth(apiBase: string, onCompleted: () => void) {
     while (isCurrent()) {
       if (flowRef.current !== flowId) return;
       try {
+        // Non-2xx JSON is consumed for its failure code, never as a successful status.
+        // react-doctor-disable-next-line react-doctor/no-fetch-response-used-without-status-check
         const res = await fetch(
           `${apiBase}/api/codex-auth/main/reauth-device?flowId=${encodeURIComponent(flowId)}`,
           { signal: AbortSignal.any([ctrl.signal, AbortSignal.timeout(POLL_TICK_TIMEOUT_MS)]) },
diff --git a/gui/tests/main-device-reauth-ownership.test.tsx b/gui/tests/main-device-reauth-ownership.test.tsx
index 63bf7bbb0a..93a9637ee6 100644
--- a/gui/tests/main-device-reauth-ownership.test.tsx
+++ b/gui/tests/main-device-reauth-ownership.test.tsx
@@ -185,6 +185,30 @@ async function beginFlow(flowId: string) {
   expect(hook.state).toMatchObject({ phase: "pending", flowId });
 }
 
+for (const method of ["POST", "GET", "DELETE"] as const) {
+  test(`non-2xx ${method} success-shaped JSON remains an HTTP failure`, async () => {
+    await mount();
+    if (method === "POST") {
+      await invoke(() => hook.start());
+      await reply(take("POST"), { flowId: "A", status: "succeeded", code: "flow_in_progress" }, 409);
+      expect(hook.state).toEqual({ phase: "failed", code: "flow_in_progress" });
+      expect(requests.filter(pending => pending.method === "GET")).toHaveLength(0);
+    } else {
+      await beginFlow("A");
+      if (method === "GET") {
+        await act(async () => { for (const wake of sleepers.splice(0)) wake(); });
+        await reply(take("GET", "A"), { status: "succeeded", code: "publication_failed" }, 503);
+        expect(hook.state).toEqual({ phase: "failed", code: "publication_failed" });
+      } else {
+        await invoke(() => hook.cancel());
+        await reply(take("DELETE", "A"), { status: "succeeded" }, 503);
+        expect(hook.state).toMatchObject({ phase: "pending", flowId: "A", cancelFailed: true });
+      }
+    }
+    expect(completed).toBe(0);
+  });
+}
+
 for (const late of ["succeeded", "failed", "unknown_flow", "network"] as const) {
   test(`late DELETE ${late} for A cannot disturb restarted flow B`, async () => {
     await mount();
diff --git a/structure/design-methodology.md b/structure/design-methodology.md
index 78dd82b7a1..5d5baac970 100644
--- a/structure/design-methodology.md
+++ b/structure/design-methodology.md
@@ -14,7 +14,7 @@ This is a design-first rule for contributors, not a runtime feature: opencodex i
 plumbing, not a product-creation tool, so surface coherence is enforced by review rather than by an
 interview engine. The rule stands on its own; it does not depend on an external document.
 
-Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces), including status-gated error DTO handling.
 
 ## Existing surfaces and their design direction
 
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 20f1044b1d..3b393de0d4 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -343,6 +343,11 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/codex-set-multiauth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. The main card's native-main device reauth (#3898) is owned by `gui/src/components/use-main-device-reauth.ts`: the dedicated `/api/codex-auth/main/reauth-device` namespace only — never the pool login route — with flowId-owned polling, an allowlisted verification URL, and no token fields accepted from payloads. The main-device reauth hook retains flow ownership from the Cancel click, while DELETE is unresolved and after retryable failure; polling normally continues. A concurrent GET HTTP error cannot expose a replacement login POST before DELETE settles. If a retryable DELETE failure races with a non-2xx GET while the flow is pending or committing, either response order preserves same-flow Cancel retry and restores the last server-provided device code, verification URL, and phase when needed. The GET HTTP failure still stops polling without starting a second login POST. The cancellation-failure indication survives pending status updates until a trusted terminal result releases ownership. A successful DELETE with a terminal `failed` DTO releases it and uses the same closed failure-code mapping as polling; only `succeeded` notifies login completion. Unrecognized or nonterminal DTO status values remain retryable. A DELETE response with HTTP 404 and code `unknown_flow` releases the expired flow and shows the existing generic failure state so device re-login is available again; it claims neither login success nor confirmed cancellation. Confirmed cancellation also makes device re-login available. Start, polling and cancellation completions verify their controller or flow ownership after asynchronous response reads; replaced flows and unmounted hooks cannot update a newer flow or notify completion. Effect setup restores mounted state after the StrictMode development cleanup cycle. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
+The native-main reauth poller captures an immutable accepted flow id for queued callbacks.
+Its POST, GET and DELETE JSON reads retain API error codes, but non-2xx responses never
+become successful flow DTOs. The three local React Doctor response-body exceptions preserve
+that tested contract without disabling the rule for other calls.
+
 Rail selection is component-local state today, so a reload returns to the workspace's default
 selection rather than the previously selected row. An OAuth ToS warning is shown before a login that
 requires acceptance (`gui/src/components/OAuthTosWarningModal.tsx`).
diff --git a/structure/overview.md b/structure/overview.md
index 90ac6224ea..a8051df779 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -5,7 +5,7 @@ is scoped to canonical ChatGPT Responses forwarding; other source-area behavior
 
 Shared parsing and streaming follow the [request-copy](transports/byte-accounting.md#request-copy-accounting) and [stream-buffer accounting](transports/byte-accounting.md#stream-buffer-accounting) contracts.
 
-Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces).
+Native-main device cancellation, polling and restart follow the [flow-ownership contract](gui-and-management-api.md#dashboard-surfaces), including status-gated error DTO handling.
 
 ## Product boundary
 

From 31279010d2e180dd030a952eb1c31444b18e900e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Thu, 17 Sep 2026 06:31:01 +0900
Subject: [PATCH 11/11] docs(gui): add the reauth cancellation screenshot for
 review

---
 .../main-reauth-cancel-retryable.png            | Bin 0 -> 80786 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 assets/pr-screenshots/main-reauth-cancel-retryable.png

diff --git a/assets/pr-screenshots/main-reauth-cancel-retryable.png b/assets/pr-screenshots/main-reauth-cancel-retryable.png
new file mode 100644
index 0000000000000000000000000000000000000000..306725d8424b12cdb7efbce1ba9caff8bd98ae99
GIT binary patch
literal 80786
zcmeFZWmH^E(=JSekU)Uo!GpU5!e9f0;O_1o9D)T;(BLkEySux)ySp>MAcMmUANT#_
zIqUrY&N}P-c=xYb%&P9atE;-JuDY5ad08=3WCCOa1O!wGabZOS1jGykgjb*5zI^_R
zW|pES0>TFb31LCypDD+ysOnntsWk8y_1D7Wixf19RX@Vg%Iqe;OkvLkFjb)>)AHI|
zRbicN;4ctkE;swOUe|ERfGM4<_In2@<z#rz-<ZxtPTX~uEdEL-KIVE59_ujb#y;-C
zc2cGP-W+XYO&(TCKqtyY3wdf2-vYyQB|aLrrPD;b+5)dRjPvcUxqIELI0)ZJ8oz#i
zxqqHd39B;ykq{7m5WOV&D@Q^<Z2T2}r34}%{grosuett;pZ3W*Ui_80(O;nb6$f13
z+Wi&3jtTvG^;iBu@;^f({GT@nc{Fd2;kiqjlJ0$}z|XTzBpl>MZ8*YJyZdQt!e7&`
z(AlgsoHq{dIzORYjqj&>^8?^=Pqz^i)z#InqnnO&gF+dtmA@Dr&Cvh|=-=b4ll@g3
z9-o*vyF(E&<A2ms9`OANl;Y{Aw3r=QmGN%d1__{eM<*mCq^Gz0Y?n1d$p0$21h2y&
zE_(JWEv^nWHq4Ln;Wu8_HkQkmH3?sHs0cPPvObOjVP?-mgm}L4zvoOB{Hqv`Prq}%
zo1mu{6;8-$Bj4_I-izlA<2*TSePRb=y(E+R+>xmaFTUZ0Crhdb!?fk)KgCI^m8kzO
z{rd8@`=O(&s%`s)lkj|(N1A--6NY|C1C5?^d~_A+(bKgVF*<+2!0>R)pz+O``{}BS
zQ4!wX*}ri__8QuId3k;M5GhIJeJLgf-@-FW_Y6?r{w~GPp`i6JbKY)2haG}~f>L<!
zhR5cwo^U3?uyXNTad{hNsrva0Dc{{;emdOkM=+zi6m5q>>s3(wx|=Vu*s9CAr($93
zU#+h%5fKq*+JArDKz~{_N?_50UzO7gUeqb~Z7fv4msfRCXV5W&{E+QF{8bR&4Pj|J
zyYrYqUw*n22n~Z_Y4pYSoZ(9Dw!7W5!*Q;B)fq({{|4JHnj#Dtj@&|0c+*uo|80g3
zqfrRyMn-s#`-yk;^ZK>4w5SxTV*DL?Bg{gQ9Tgl$eB!O7t}Y&5+)L`a-GS~cuX44D
z!=Sq2{RDGab;A2^sFU>=R<55uwXSDV5DN))8*6CpkPxBs-|EBCZD^!B%s*!lR)?db
zam>!lJXXNAoc`GapP$H(f;Suwl0DwvZ(|-#+tV4PLRS8rCS%$h3WegC9E2^R!?)*M
z9!DON*B|$$p6)f~owoIWd6fSd0HM*WHyB6H>y8TNkd}6Uln5vnpWb`iS!o*fL+eCo
z27TV$1qeKiGQtXKho0YXOYuK;kDx7z#F)eJZv3Ico|44>4)jZ#&2{8cE`E3>M}NkJ
z&wV{4!ZKn1dv*x^Mh07IFe?r=_G^!)AFgY;@!`VuA&cldJX}(`&g0S2R;&d3-chy-
z72zF*Nx*CCLhO8+e}_~DmWAY-@6)hbS|fkvbxm8`6Tur)*3~7M?P=RjbBF)bV$$%!
zW$!p&l_4zjK5e~OD;Uprci$G{GL^eYBhyf>D815_g7t0H_7b|dq(2N&zYG~NNc$U6
zA>X%F-Ijh&Ck&qaxVwB|ntUo7$*6CpP*|iLj;f8JLD^n!G0WM0_b`L5Y(;l(>*%*l
zlWd44R<}(Ut3v2p=h+a`p}5hM;@X1w@7wBY43CfJ!)Gl><6&#3u3isXRVj>`=;1})
zS`yzhNR67dSJ4gcUyY_g#+*G~#YZ2S|98u0a~kKnS#g@zd5&<=su4!bU)whvRFnq4
zd?VRg^Rvl`%F4nwA~P7&sBbYXoiDbHWaK=wV86cXyttwm?@2{+&MKxmp6E~6t3BEl
z${cTA(ET>gQYT<^tNAkw{ps*?Cf4v+6Lk~XEHDeLT$moVRG)ski4<;J?mWuF&wu^?
zhBv5<T)z|DYhX0Bd=liahQosKt~yY7N1iLf5Z=XpN-c0p)_Qrv+htpz4dIKm8~*o$
zE41aU-^p%6UR>3uf47jEz;sBlL9XK|c%wgUF1Dj5;1w{<?~$lES{XrswD=ZPjlT56
z#EX+umu1&&Z+pO4p_B!nqQ?$|b{c<&rA)rw7ijc4Ur6_Qu(VGy&lD~durl>JEe%^R
zz8Av6#m1I@g2PWO2iU5=mlpufI$rtVzo6PuvbJVAJjq3efFRS=%XK(@Pg^{zPQPJ=
zbKj3oPQvPCi&l=k_QKc`Y(+i2racSm?<Uv6yAuMg#okkb*_>Pg=W=xFp9YLF?M?GX
zXY>}>_5f{-=NG?|?rk8qA2?akxgQVQ98Pm@NVG&0vkZ~f%WWY5Ik6`LH}JP3H0x8)
z?NKKE_fhs$CC+V+-0juweg2hlh7S!JR}tQ~-#smNe5M`utPVYmjHL9|Wp!TM$o*^A
z4{^k`)~M(In3l*)vzY?@pyp2c=kBD|n|}=ZYj@+mU*^cNc{N4OrYWD<kyBuac)5lm
zVcCTgt(NTBzAmkEtM-kyS_Pn9Pf~c^!$oZK!<j#%dub14KU^5#^D{9_dcLO7MQn6w
z5A|Jqn@1zePUZ-tZxm^rr_(?b13$(LI*5nEZr0`EK_V!21G|pDwjs?F&5?;v&bpFQ
z>o#H7cksav>t%e41;z6)sS$Jr7pp}s(5E&7x9u|!<*Uv_bb)giDj?G+NEcY))w=A-
zKBl+Q+PuDC^e~J{r}lZ#o=euzw>oX<K1_)e68gPIu1?@w7>elPQ(m&%#G#Dp%JLJo
zZ8kT5O|3cMnd!QnJ*`n@sxiR(uWPA?YoA<Y()xJ7Ab8idiqdjvHs19Qm{*HChtpW@
z*A5g|du8Eqy|sZi^Yq#}{b=c#=@m(uJk<66OPmaxtrM%GHG_FH<LT{oo1sBAnIJ6-
zw2!_rJ+)fv$GT!H_HcDihS^(ft>p_-ru?wH2}JM2pV{2xI*2i?{cGRN4`nJyr-@5-
zW_*}B5#0~>NB6pAPEga2l@G2RU8WsU8{E*p+$hQ{UNtx0I4l)2%$HIf8W1j7WxH!=
zw2%-<v(oW&2-=jbE>*PMVG@rtOgJsovM+$skHK&II4vxlrjfSFf6Uf(j|R#xB}l-R
z!g!NztX69bblQ##`+uL-`z<{|!sF4`R%&GA{cM&-J-FK!8qCJSou)I%2g}Nvj~?}G
z#PL5*w%Yxa8V+Yy2G`b(x`V?Aor05N@*_OkxmT(;zYRBI@kShUttSGn-*bMC($jwE
zf)i_TmN_P_@!4fGZw$C+x(&H^9+4hzh;jzk6Y*bsJ83#Z(P0YIl<pj#4nd&mWIx63
zyTA8nn(qV2fBc^7JdArHd2J?g@Smhrotb*g+MxN&lDn0o4sh(f=_}MKGWx(NeDh1~
zm>Y^xCsI4xa1mvApV_#0oI!F|<;|>KZ*F;@!CZ@5^m|67+POZ+?Sdd_gS<u9izV|F
z5kqZqolO|@)@2GiMc2e=SpJOeYA&EuQ|N#rM!j!Ns<Vtzi!juZbWNN?V=z}YueRCX
zNYyko#`XixS4HEMrmN4<h*m-mFD^G4tg(@~gRnLdzsR-Y2is|b50X{}v3G;Y(CRAW
z&%<QG!-Ww8gDGoT8mls#$EihV12PxfcDif*n1sGe<6|w>#l5B2Z)y9iM`=EdSIARc
zNIQ#+T-Q2bQMP*4Rp+$15Nv3++!zO`<@MPP*5<cP0%oD8rZ1wS+0zHMIK!>Oop_f?
zEN=&`1b=rR4)$`QC3d0wki`%Y16VJfh1RttgfTYoqSdya4URFkedwY&bwstcM!n><
zH5=({)zEU!u@-E$`ZqD?zy$D`n=YgF?eSrt`es>+UH5BvF<nstFRKliW``QETYIj8
zripc0si#Fu#eE-ZkB|$H3a5?Tcoq}?*mI2>8(D0J2i!SNH<i}*297G(x9gXz^N@y3
zavamza05le^r#DCqY<mD-0c{bK4lwLa&_uqYZ1;>3xM3^*nNwnlccRS^R@{oK|cN0
z$LSF^uMb1}?)VX6Vto3|3t@wSE1h(XgpDk!BWpXgXgb{(&p}^nF&%#=Xq`W@DQKsy
zLkyknEm=9&ow+4K+$=ymMI5|i9xJxgBA3G`t^=GVp56(IVM<&ZQ=I-A`TC$nA_8`!
zT}fTyvltd<*f#amQrK0XmOG2Ij;XW`D;2)Tr&K1~w_5Uc`XZ6dkfxCPo3;lC#qdZL
zA{S=H@MoOOw}8jRxBWYZy4RiXC1T!!+c)W|=f_ur(38L<3li7FG&N%>F;fvvi>Y|>
z()b+9IS%{#1@v^+t!4CL(nwrRy+8FMJtAZMT6L6YhiAGI25nsFuL#4EvnamS)<QAD
zQShk6aZNt|_kGoy0SnEY_S{gU3Q|raF(@qnQ14i+naoM;jl-|<_}j&g+)ePh{uTot
z_;PGQ5yg%bNpG^EdjKve#-+V4hqO&7U7n4t!+L=Klf>(5n==fz=pcz%$Jq>bc_2xn
zAL%kj<YG&HWg@lUcudye&CA&`sYf`<vmI+fVo-u>KNDvntNs9A@5K84Yd{3Xw3n-*
z*OLdioM<U+vTSVTrpb|ga}J(j&Ne32>fEU<g<MYe9xD^UhD;BR3p1k<Y7LVFVm&@H
z)9%+IxTSzGhCAwM*Owsmn$KL(^b4Bp{)q?kEF*c>M%BkhN=wA3O*?wcUhszqo5PK^
z+ZsjPlIN{!cjxgeE`;1PFUI3ev(#q0X%S@=&oIx^zR@*+)|EwEyKLA`poRNCNo$DZ
zYPjjPf!n}07hBj8^vIHsz=Cr^&f-u)K97@_yGrHu7AMaI-MeKIadk)|;c)eol!sjg
zk-oq=y8H6HrwR2aSk>Q6d7^df(B&;Nhk)z*NRR(w0gor_?$^f|oKn_Kip|d_J96EV
zI|^S#hI#+J81qzhbHf;^d-k?s^a;ci@BLU-mq%S&eDkZLgYSW$G<%Z}w=A#mvC^Xg
znu+Js6UAa#k;8|qYwEpSq>nYPg-c3ie^l$l(vVk;mzdCn0*#r#0w3w>085!ItU3L4
zVCx2&UgKM8wAm3c&YiyQ)7k)0LD(&b>qU5$VVxa&^p*Qo>nA$R{8T+Qn|hkDg!$6$
zgS3Aat)fBI`iRS{%r$ElbJojV4{Y7o0}7ngaTo5eqByDpd`BnESQ6R`U%DdhMCYul
zp-oCYypz_n<gA;!c3Vd&wOdW=zB*+)tyxK7tNjv4V_CpK;u@+eI=`a0+$*hc*fz7I
zJzk?Wf4Y!)AkIoCdIBNd*AhahstH^sH*@}Z?9W-->WEqB<V@N&L#%1D3x7kLWcHG=
zR!zB!WVw=JE3V)QmF}D43I^vqApJo^Ya}BrWXD5HjO&lVal;HAFS11}xwZZ6{%~t6
z7Ko)Gd>KYpw>*8^<9}zvVmY73JJ0s-XMUY4S+d)Skz;ZCLO5R@=g@bpMW-i~huB(M
zWit+PV5&XxWf)8-FSq8NZ*{=R=f=t0sI1ciWdo8~^pd^VZ`FU!8lCDS>5<kp-9v7!
zDa}RjpDw!NnR*#~gY@*)4fyfcO?I02gc8PUXKWec%Xf~y!>7Ja?L|^8`TABB);XJq
z{dAPyP7A=+iOl0Jm$zQ{I2l1>_%?Xi#+lz>DU1gKq?zAF|4=p7;B>M%VO*5Jt0~Lb
zUe96Z7Q3j?B^}x2E?8wgj5|db`XqhhoWkD{RK2m&%mh^$DEmUt?J9;O@55K{=dP>g
z7;ZOkaNlp+(j2K{n8+RTq3~Z^NPQ1^&YE|s{zSa1y?j|<CkzC*uDoekyCLV-s5RJk
zPd^UTv_ij{eU0JgleLo^rm=o^ibMm~#<x9~a^ii0;PFZz&+shsOE+Ru)*8Fp$%kDK
zL#q>P3fJi=olU^-Pah|fol*rZ2e3-N1!Smy-CHXQ(x0()t~!#NKLzyaNZ04Pdfp}+
zuH9d8^p7<so{m1(1xal>j|a^$UAT-3b!LGn)f@3bnY#tXK>MHks+H$wDA1V75}jfE
zh8f2V(Dl2(;oYRiTlrD9JTX;gkrsmKhrUXE+0ilPolA-T__8#PajAFDRT=K};^Pu3
zp<e{*%f)I(cRM>#Te4c-x?D#0BY>5<gpW{=><vWS{k}sJ5v2RFy5Im{L)qGSr#;F<
zxJ!Id%MiqH&Pb2lJ66|CeAI1^RDXCDztz2hh(>gq(Pq0$4@ZfXv8|g+N0SW~&Nq^>
zmpXQ?4fO8v#3|9Ajt}d>P70p$%yZoa?VXW67s9q{BVfB6QCUtbL;e<pHSz?kdUv6~
zW?RB0)BhZ_(X70#YhMOy*mdya^c)*U&7?a64xW$Qk64ZhOq(P`%HKEqQIu+iOFiC1
zE?#zRhNbA)HnAXO6W$%UoT|&=h8gaoKwD{OryaWz2Yz`BhcCS@w<ulq-Wv(u>S5q$
zT|W9yr{8I0ozQf&`wnkJZ`}hTJyWbdDY4J^xHl2#UIkPa>#U;)tX)CRTfKbIqx{#J
zj@ta58ELaCQ>&}Q!8QX&?#(V)PkmdOQ!mgID<lQAdQb0K4b9g5agBt1f!-(a-TQg`
zcf)*IA%k0smoZYU%^}c6($bkZmqhO?7lFdn$OEZj0Bi>@VVroa3LpSRAK}-58=FN<
zAPyFlUg~o<bBeNn^t6}1?M_9Z7H?6)x(gU{<JVSsuLjecP*@4*h)aWpXoq??YG(g)
z-h|k|ckey8XX!PY*BTz|PO0ikPbyVj<Id|mqoKy1rD6AKGwtYnmmdb}7LQ`^Sfpi@
zP99K`9fPSZZMsV=w;p?kIR}TF2sul%dIb!s=ZRzRMrZH}ZEYsXWQa~TTlKjj3Z$og
z<a@~08fHq!$#FT=o4fyKYM1zN{)f=}`ddQunB5(;_x}Y*8O?^-J1T4R6#fgYY`pmY
zhok;8&M)o%foq@frvFR$H4XWvm6Z9T{0mt|rV$Fe=9R)me$MSHB>9wRtt5~imf%uV
zs?+iPA9ecCwM_LtPF;#vz}gL3tk|Cj2n|C2f|I!2ddJH`Foq~`afm%^oKw&BwA<T`
zzs9v&$oQ@a@T2M>+dGZH?WYV`BPwJ;`)N05UklzZ!1x$GDh+azg=K4H!SBITb~p5_
z9Q6z_uQhJT8*9Qfa7}oRe2yM=Wjy2d_@jwYD#v(7t=rx*zP_IE$(FV;3u=Eggo^Mr
z{B|pZrNDcg8_ujD3%MjADvK)fsutKawAe1A$9eIhCGQ$yKtpCaZZQfKrTa}aHZ?sb
zAj?-+GeYP6SQEfll^d6oi`@8HYSBmc^<G)%mA5h5a;sN+`k!7*|G8UbnY$$363fom
z!=8-P50!aMof)5oU)zu%Am|&co|hMJS({eV>?%6A`5*+cD&}fSr_7}0YX=d=YJbwp
z{<J+KlWQ23!r1n@5cKm&j1QnO+Xm}1ai~ronc^`;h{8Q4x9fF0{@LyeHSXGnJ_Izc
zlR)O@I8W*IWFXi^d0y3V@J{B>AM1(-E`B9H*MsWnE^fbs6jmRLqM*%<Q2mIo4^FGa
zVVYz8S-q}uH2LOfURSdO0x(Rz-$WHl3y-28feK;W^6+$mgwajt-9^jmk5Wg8FN8HB
zLptKx=GRFal?48T(1XDM%X#@+?=kmYkGg!b1p|I3i*M~xE`c+Fl^FC*WGwU-Tts^q
z56*GHjOY!n&q0dl)PJ)v5Mo96XOTFstV9vWGoVbeq{B^BZbwI4{$HDF&au3VzloTh
zM73AAT7&g*K$A7H*W22K1@v*%R_P|g^gV>~3X6ZVuA1wpVxX-65fD1QburRc?wM*k
zC$DZN&~tz}G#ZhWBGRpJ^ApZAjO>nt^AwA*Uz&aVP({pNJp767_@;beWQ-f6sWd`N
z{yDaN3;W2V9fFhJe1{mb>Gf{)<NDM`;QiKt<Gb~b8YPT3KVw|hBI$g}EneSng!%CA
zJ1w3Zl28eXunpIKw)vqL*AO}tc|ZJ8Hm<9Rd9{dAjlMxb4pb(6LGv&lB<*J@&`y-x
z3^1v5y@+)i?LxJPl2viIx(c1HK8gj-ej#0b%fMJhFIU3^Zyty6wr|&E#3csVic4Nv
zN~VbP4CSK-W?(s9kMFfOxVG7RpS7G?cD&DjjwOWGT;$q>+>>)g&PaO#7<eiGNYUik
z0R-b%oq@T~+uo%ywz_Yd&vg8eK%}awZ=b*ss>811DHe|A77Sin(AxvFPWQP&xlAW_
z=;W$W^_M7dM$7Hjp(dO%v9m1v<KeEXbN8*X#RWBo{Tw-`!uy~0slL;bIs<00@%lV8
zRPVMj2}F9#sICN7OH&WrnjK;#(9Me3l{~FaR%S&73Q#UIW$RKuI=|U-5!F&_{euND
zwruy?)FUto=U0>1mUB6hINKO|8d|KZL0%u3sKj$4it6`<8+|LE?zpR)zntsz+JBtO
zR>XRY+r$Unw{{NH1ny#-3ad$-y?qV!)01^SdBvwgs<8t9^SI*~`x<9(r}ne<iEbFN
z{%O+TmD>HPL<GL|7{`<=d6v~5O7LiNQfLv-%Ury++A~#02tc|&d{NcsiONIgf_Ilj
zk7%M3ph6ch1_D65rkhtsWbPi(a#95fUDmuV#F)C<5?|pxa@`9{GoA`814#ZnmwNKt
zb8Gmn6$S5YEEv^<zo3A!D2qKH@~9xvjV#&^8dBULnD;y%c&ko&9>(j&^S`W#e2OVD
zCH<H!HWF=H#<2fz@p63CY^3pxY|FImmAx!UT-g0<hOsd!j(5~;WQs@1Ir6%?Ggwbd
zIAjUN1}G?90trS8tYTF^x+&8J<usE1ae`kN&F}o=>lw=(r(H@7O(Zl-oJ>HP%;aAE
z`pc7Zl^|ukx^$~--nk)$n;%((#{_&YDiyUf)b#Y!3RQw%rA=O|t<?*AuXA2a2Kh3<
z!nqqYr4)t>Ca`M1o0)-SpbKM3NjedV<87YZsh(<G>q+?FEXe0SkCS}^T9v;__Xnct
z1d$Ztm6hi!7r*XzpW}`t#MtwS-D@t1@%gPKVCITu8`g8q-4EG=$HXX=)RgDv=hf8Y
z-49(Z+hOsC1UE-BKg5;~t|P_2<!3bc455}cHal=#=~tpKbi*(Myv=j!o&cVgR7>Ez
zeO*s`TTc-T_MG=uB2BdB997E8lEr5@7EY32Z<1v0ta*Q<p+UHJ7eSOb^fk;is*Do8
zB&_(3>hTSTQk($ix6@U-SB~e*FhnybdQFZ#fB8Y1lKXUmS4>kDwCV+3h*NO#D<mIr
ziRho}Rrd)t9$G3W_%cDPkYbem8KzPe79nqjp-?E8&d7mvO3FPHi;7XrIg6t#``V+f
z8fK*1W-h)Je7G=KCs@SP4Po?r6B+apGO1*C;($@S?^J{x>x8dHB{nWdZ`Lv;Unef?
zC}<<#W=PJafxnBMo~m{@<2YF>BV00W>2Q1S^iX1iK{dy3fWkU{;V;ISNR*8pFI}2j
zov^n5tAEAwvh=5!WyCOGPEv$(kJ1rUG2vk5JgLP^h|cp3YebJ}Ur!=PvT#Kn#F`6I
z=9u>j8zTjY4m*5Q5N!6&JuS`7KR9@!WL@w|Eeo3)X<1fdyM(JbVWwf>HlQvgoUD>Y
zY5m~qBN3*f#MtdUvCvm$y+g}PhKh!QEU(j$a{hVcQWJ8}C7wAI7&|-lZiT}0Fm>xW
z58KN`5)(g|)ssbfPf=KX(>lv`Q0H9t*m{vmgSA#I|GHD?xnuqxUH~V8^^60zy@Zj&
z=%Yh`-N<%h!ngEzLXvz44o~T}4oxvR>85KR65mB|9$tMQ$;&Fau2*xv&+%Ky4t?=-
zmlc4E>fG?_46}-5<-3-sHqV;NOWp%9`moOryU^PZ`sA*03e=q6p4z)4K#q&swwZ{z
z79l=gS8!9p4L(<WA-j-us;WS$7|ZEgbuldqC&2*@??bZ~{kJ1jW;~})1^d^h?X&z4
ziV(VN7^dh~^OS?bta`nrOU*NT%e!kBc-FRc>h$st>Nqq>`%7yVO>R=rjA)7yuHkzZ
zBC{k5$=sF0oMq?xv$@5FK*fBS3V=?xWz$5q5h#<p)7L6umQhvU%1}w=ppooBc!eFH
zUoOFe_<KfP#~fcnNhcfKlU-Tlaoa2q{6)etF@t<CA5g~3lyGy?eE2r-a~8T7Yg^{*
zQFLCwB0VR^n{DUQo<BOok17)&8USo$+SAnp3gzg8e+o$Ac^F760Nxh=>Y}4Ps*;a;
z^opv3?@oLnRIVGTKw4axww?EP;f;CRY=#n~CWUIfLL0`(dZ&YxNSiKQc&S+Hi;P15
zEif(2{U0xEH02pHX4%)rFU(?{a;sSelK{QG!7j=QNa*U|Wxq-cZK2mW=ujuO((fKA
zL3ZECWj}S^in^L_AqZ2ej2`Cn<5Ed-w117rSVbqf{Nw))R4wML9ik3!Pnc0>rx0?~
z7b!J@s%aJ_-0-eea*zGve3$pcBG1mp?lg6mSK?(O5JM(xuyU1j0efY=P10_0%1;qd
z5oi6AwN>e#EC6`9p+6d$n5gD0b;M1~`gTxh_RBnuf<Ob(xGd#8^VNh;+lvfd+XEDC
z%j0}Ql9}4J!hq%aD*1JF9qfm<5pEu8bvL;uDezVQH?N=-%lj8O;@smWC57fC8EJW3
z<JX}herry+33IbOhj$tmGw^}3JxhxsDG*Y$Z#U4i;qB`SNkWP&gc)neCk^nLoc7Yd
zD1}=us$-Uw(cGWiKRH=+TVFpE+EnwK$i2?<Pf4QyrhUk5*DGtIm?X3!mTDm*%bm0_
zAc4oL+S`VxseLTieLN@W?2FUgR63A4=yw1NKdNdQsgf#y!z|uieX{Q&fv0#1%kcFL
z+kIcp%GX^}>pjFNWn<0l+Lv&>RF;D*l|>xL=@hJMOXjZ|R8qn6BFP7<0cB+cSrJB#
zq~Y=&+1d%R7DK+H?=#KPxDIJVoJKk5WleVrhlc0<a53b${AWzt^8Xkc$32kKU@*<h
z;~zrUQUbR@yXdE>ER&O@Kdt8Ogsf8SJ}5*@e&s81kxlGw<@0Gx{${NMKhAq`AM(RO
zt^r9(v#mL3jIF)Vo2zMC>QhF6%~INh3Zjk*h*Fjm4bYa!$Rf3*DAQcz$|pS{MZJx;
z{-Nq22&FEnFjyPKULp)&M3P&bl>?knvE-PZW{y0FWjcsX*}US7{-vE(DLX-yLoS3^
z@A19p!042SaKHZWQttdYJ0g2)$7<Rac(9Brp`ju@omEkj()I#5v43mLRbK9G1UrST
zu;W@rV*de$sLl}xr$~jZsl0;kVjF1hxGYDOefo}%nNvcv!&!NmP_ma&pKq2OFvEU8
zW@zoH^XLv<s84Vr;D8C_ugWUM#NlVpx%=DPigI=@3gb+(@HCvLaSda*#wmzQkxhS}
zj;T7e5`CajWw#B9r8S8bX3?{IOCLs(rx2Nd2YUSW8Rp(`O4E{~al7Dkn<5@CZw37z
z5v3{D-r8;ct|Fpf`p}1z%2Zbn<a7A)#2L8_mYRHizvu(GqH;%-mXF%eB1Dlwb@U7l
zwe#C1ObS(`xE#TH&`~J-yy@Uf=C33_cg`pBwzkR7Rg7UH1sON${e{@T7?R%RmM|M5
z)=WZNFO@|ta0`dI&PA!Kz8<qGA`t{|R~bqBpu!Ec_{CeNqM<mr&+TT1sBm)foPFz2
zvq}%v7u~f2$JO2oHm5h~k84FrS>!zbRGKcZhwKZ`@DrM#;_g1;Oo-IJZcIdoQzruT
zZvlDuJkV`$|5=<0t4$mn(X*kFP|g5u2es|9*FX~R8Y6g#@VG@#nCgw^PP(?VnO2l-
z$%F7EYRJ0CIy&q8QO*h9b=xOIgXKx!s=9?WA?fL{!JDG;ea>HWLb;I`#eqLpW+au?
z*G2PJMja8~a*d^NVZdn6Jzd6Ya_0TwvFPG}>z&~eCbMNaD#n{Rje3f!*E&312^mub
zd79p;`TgeUWXNL!wa!iI;>JLp)}H?2GsK6@2P-V*A`d?j5zE4Z08J&~k#Kndk89|c
zrj7hQ(I2--%>WJn7mvl~<;GW^*zQs*sNd2>KUx}P)=A4)0U%oRRvx|<KpIQ3%EG9E
z*<yA%p{!HIFgvHLS`_*e9}D(%B|m*j<saW_`S?iCtCvAL5gAGN9{wSaTKx<Lf$0#5
zGF3eKSc^e!m)n1rXzO{242_c6R1{KJrUWw$7|wN}!s%tMvf_gEx`Bb7D=yRvw{K?8
z_OaH*^NZ+Wm3R7u_V#{q`1>DwRp>L!6)2WnJ8LWYo}=c9;-3Z3gku(m^!SpryBhoO
zlwYU^RY+A;9NhrP8cQaygWm8d(@x4>7Txux9CJ%W?a^*_$^H{uuU~|JdLrWW(5*^t
zPjqL05<jvpPW~gD^;N%R-#9M(A(*zg?^nO6?8KlR<LHoy)`4?yfqSGqgHu1<oN6vR
z&ub`==$ZQ)hhx67b#o5hZRStG4M9<o(>96gx-V}+XasW=Gz}QJm(6Qa!9>#m_t$!d
zyn+!<G}CH@16^4Un_9#+$zkuxCv?sVG4o7G^=`OQlmLb^fg}njr#|U24$ex;LDiRE
z5XdXFa|<WFbBGv9x$ur>THfJEyr`|LSdpKyt{xNP@;OJfZloW4<AccD)GeE2E`GL}
zC{|&Qi(yx^li-A+6vy>#6;u@|0CY+7^0%~GFsom9hqGj~wif-}$#Gac9~U)(mytP3
z;k7$w?)mkcHmzMGB?muGQ8xLZyvm_Tw{P0rTO`7Dc|u7g9l%t%g`!*R=CAR?6tbdN
zEeWF=DmD^O%UQyVzK1W@!#e*0DXjmOtCi2eZD6;*PPD&nyZ>&LX|*7L{{SBXX7_u;
z0>ZaE$wX3ODx{a$c7CQlePVjv<b1}9VQ^5-c!FWtSFRFO)16Y!;51*p@Xay)?##P-
zWgp8K$YbFzu^aObb*Z2rh|=6Ib;j!l*tVx<U&3t*^9b_V^03Nbi%Dd^Yy_G2WpBdI
z(DuF?jI}MS20h?AhA{v8zP_OBlkK@NUja4+xu{pnAz^7-nFVfUGS^eFUs)psZ|XS@
z7MX94W4@cegWV=Q6OTNEQ**RBe40%y%nx0rVyGZn(tC$h=ejT2$>|CJVANclIs1E@
zH%;rn@>|h@4k{@bYBLfND!JRjXuUZmX_c(eiYQdjx53Azj=SzvR~)PXecf5bpu_rl
z;an>k>aYOFU5}$3W@T$~@E0GKBr%PF9CSSP#c}=iWUm)tUfYZx*J-6@Cn;l!RE4d-
zuZS*8O9Y!tFT!$=n2kGG3OjEDgbP(fh=~OpAbW(H9~>oQq4!Lz2{;_Q#nv;Mq#h3%
zA)47AT#o@XI0w<O000<c{khm$eq;1(Z_eB?I<ez*Q!D4Z>{@AD2Y*wswMYVj;zD<`
z@lP&YTzU0OwW7-}+qvkCd1qSH>lfvMi}bueBpBm-3wJjyN_Z(7tgD2kjXv<S<wNPp
zlu-Qp&i#saBq-MQXR9oNujBjh0~hxwepvg9f?bwQnA@dw6rQ$<AHohV_wj-uf#W%|
zvf8*}`f!O$0&pWWFHmeLqM*8e%6m?t9ahP1amL5*hb>`Ho0eAW6C4vBs#MB+dYhOm
zm!7O|VO3|jC?S+%H&~sk>nFB}t(=UPLqF+*g*O~$HO<U$*A3+nZ0{1$!9T9UH_TST
zfb`_hp`m_B5<JZ_UbHlG(QM-JZL_;H7MQsorEmu0p<u1ke$D}BM@py|>8)g`BLygq
zhcg@B#1J=pNAZ+EZB194tzlSdBPgX^2&CW;OxUR@Uw?@L8U}2>`!j2TL%&tEoVo_|
zuWLG-oll!1Yk96C>M>ptg>EEzzkqhAUxv-rZj#;SiRa9Ut@{jhP3M&W0Q~e3O|6q)
zko)pvHISxC9PjBw-R;2rvxZ4(X2ryWyu@m3!+7cj{+1mm;J_WEjGl<4*)7{(zyT_w
z(g`P)i{ug$HHuHBkovF=!xUCGueosvyQjoKZLT|YgHKr2BwSmwsGWJt@*5p1)6bw*
zgxGA@_hFb2xLlqQ&3M|VzWF%%EB)|$=?pg3=4+gPES*~H6K?lYtiM1ynvh<}BwDgO
z^P#^PN%~qi#Mo|+ZUzjBV(XWAN0|5xIX|OBE3!z~C5kjdYfrdz{*AyOrMI6h%|fAa
zfiuT6ZVIVbY#0g;BVaz3{R3~uL5k(hP7repm8(82*Fd(z0JZ~W{d?A!v!Sb8kTA~T
zpjYDCKoh?q5e4%hFC2Uoj{DwHFtTY=T-#Vw1J&75kMIGVPvojuAX0ANStu%T4|cDA
zYt9>_qA&sF;=B}>e~)U|QGLcY0Q;1~&?ZaK+G2(0y3|PR!34B9G^sbl>J>r<n?C{)
z!%rieit8G5dr0~Iv8OfcGWGWl2Pf%tg+>cFM&p)*DYMW`<JiQBt6doUe9R>v3$oDa
z?0yZ|ytC=|stVx^O7%(IWQM~MjlOsEHl8Gdcm_iczXk);ipAZOXOlr%FnC>zQj|-X
z1M@@No!q5LuJo(2_ONN<08P`4)NS8KQK^R3TS&quA4v*!<dpUH?>f5AMoYQ&3i0(q
z7r}wQnr?7d9t&S|MQ5cq<q>A5$TN-m^X`U=NhxK#B|e5G;1-*XOhi$?)JzLKJm~!M
zJs+a0t2ua*D}<DDO5xSIoz~IYo5b-&8J$;UU#30?YSw}lHN@nk(o>f&pt32)$%&gK
zX=?w(OtnHBF#h+Sf{xnEYZAAguO&pB8jb|1?<g*LI%RV)Gm-)Uq)~-4oBIn^+7tZF
zb9>>$`ZH5ksy7v`HSH&*G1tb0@AeYS&V+@-UBxtc4+pJ!b2(Z}r6od94{l40gf6vA
zmCvZJLa?6K6Ei8nZ)g*u77ij0{?wW@A5m9NYKtnG;CI}X6`hunfV}Ed|HDY>lD;{6
zpH%mcl*Pix?OWovQeSYwL`em@$ewfM*`xaBM2!1z^!8464e>es`pWu7?2m=}baq|5
zgN@cW!#G+22l8jWjnv+~cdWKq$1<+@;_HcF^<lgZyn*!B><*J6WeVk!#c@66gw>%6
zH#JmY<&d#CsX~uBhum_9L<=N5m2o*kJZV<qn9o4cMt85}!fb(q1olQ&Jdd#WF@I{I
zdkN+*UpO>%55F`AMv#8LU~&F07Vw2(R<l)?>U^=kZ)9dEH;#n_ISeneu$ZCJSrZ1?
zux#1H9@u4TcR%dqx`n72N;-SE_b<-9ScGgaAitC}!e9>@`uR{T>)gm1R3xoeM5o(2
z;mQ5%7$c?*Gcn(tJ<$4ZxiWo;Tbeee>u<KVUufM-8eJD%0Ou3+TB|dGP`51R>EKb*
z^@H<QveqC$Ar8jFC5%XHIx4h$mf3p5zwzC*<PdxoYCEyodkv6n{YKTl<awrn<vt=5
z=lCsm-8RzHac>gXT0eDnow3Zf@Izl(g70<=1r_yc&x_KsOm+FqX8;JKMirHa{76I;
zS8<3&olHVo7{rV4W&Kg%b-o_{5l`V-tqx5XbTxMVoijZSrw%tI&Wfz`@h#Ez_W9Zx
z=4AHQiFfGZa<N~P!zX$9_A50~y-f3O_*2gd+Byfl-na)Ga;v)baI%$Hd>Nf)nL`S9
zPKJfU<4IF+hE**5e~xWCHUOpfKLpLmV=}gXbM~&SZ2RFyKM$W!7s<RJiyx-4aWNjM
z@|Hk-*T;$JQabtBY`WuiVquy`)&>7R8@Ihw%P(!!?*~EpD=;zdFMVm;-+I`>+DfFW
z_nfa7UL*W6L3<JIYMJJ7C~vQ4HXk`^&EC8?E?gB2?$c4B*L5&e<b>|YGORY&IdV?Z
zZ<pD}-m^5wHr6ev$Bs&Q7M;l77+zu#nK&8s5QpcL=~`NI@;)rfEbWIu>nE#*@^}oh
z=5U7)-Fg~QWjK04wO>%Knsrse9n%gzH>b`SfCT_?m`);2pwQ+8NCMR}4(*HPeZVE}
zuDD(!#qo3JK=HV@)1e(xQCSriH8tycj)!Zn2${p|XM$)^r<N`Ef;Gwr3!X6m{U&55
z0?>ZB(-q$L9M0bi(}b&Eg|S7TWjAfm<P=*nIyi>Ad4z9zxrG^SQSKgIIq%cYoGfX1
zK6hohPrsmFCxWt-7H8D6i9C-!MW`lJJf}Q!Nc%+@UW)Mv=N>C#l>IY{o^#;MSX6q!
zW`f~d^BgiB7zayh$+3k12l&!I|4SycII}X3YmAv%Km~cYNxC@tzEJH*+)OKi8;BDk
zo>#iuTnywfyW5RuD=O*d0p}xcM_Ri#G}0aOV5CS=)nQ@rPS6J3T&vo5hm2Y%={@O#
zF(}A?FxE^PnuvHR6?i6rHjD-QyzcT+#xqLrRXGA`Jm!mwD%;Z96q3is2aSW4zT$j?
z5Tbu`PN$ov3BO6?%lsijQ)+J(Rt|MfoowZ*^7z+Jj0vo}n#x#M4r?@noQy*cx-rn6
zUFCh*`neSFNqg=~#ioMZh_U$IWG6{w-TAK0M=NXu1l+af1~jgj=vblNQ}F#wW*`Z<
z)cA8t@y8O3El!b|X+-jqp-tbB{gTcM7N);6y-q{_N05zKNnG1(3}Slxn5&L+zFLto
zT~&%PwJ#HYkSHA%&4_`8-XlqV3~dOu1`jey_`Fx|)7}V9G6lRWk2Z|mh^8RlGJ0rl
zzu07@tW$UYKuiZ_dXI0kO89`v?W87w2W%EAQKYZZ(kLL`{UJ|9zj}qt7>%NP)O{$S
zy~ZZ-O63B`eE&M~wzx$u?wh5<y$W3e$KKccHT9uK&~tMK+9QBu`oz;Ik{)86D<iPC
zi0Zo<g;?<AaImHbak95>-_V)CmHR`*!=~ZrQIm5s^J>uBCQ7s2`_z)2{DEBt?<com
z?(`;juZ|{Wl3qM3U&ot!IaJ<9Va3TuO<^<o=RV%|bkA%2E8BBU66)c1FNr!j*FHr>
z_oYK*xs!+(5tVe1!Xw7wAdlzM_9W%uHD2ZJa4$TBA3gu}>@Ksp8;;*KQL;d;mU-=t
zH|PRe?spTmTGAYHPY0HLNmeuw5LTR@Tl2rwlo5U;3>)5Hk;n9fDe6K$mm>_sV!lLZ
zG}s%GchQPiq$&46n?xNTb|!@0hfzY7IZ0UfZf%>UN1p4Ew>}#GsAs9uWtn|BCJjmx
z>9youoIA}6{Ow*uWXtzzC-~cVER&qp(}ffV3a=yDSJgu0OJNRGrJYA9zf?e>JMe1{
z6^FT8_cPu46M~x^!Vas9j_=%(d7jzKfm(oQ8G2X>OLQCuARF{LQp!=Teb9_c?iZDa
zMTxg#&Tfi(#V(T2#aXPbSHdXdT4^#Y3*6fLxr_Gs<8YtvXa!1V&nn6obKFPmy*KrH
zsDyjPEbbwXyOPDz)x`CIEm~hfFJ2(*&^~)`Z=2V&!}!6Qv1@ctsxv#g5W5po^nfx>
zgqm%cqRBG~_gn<?vkp9u{Lj-tY~qT>7X0~tE{grn&AEU4;r|vD<NtBmOWL2W0efXK
z8df9%7{kgIaapVp9he;ZSNDZaLAg^cCCtszBcnfIFTk;6@nd)wKhsyatJG^xpP6=w
z3q{Eavg>=<I67lK$^C<7+#1YkDWSzQ7Gh=Ub7Ek??0&Ad(eHcYkT);FLr0`rylXsH
z@a}61AYrh8Z!e{yi`#b(G6Dza^?=IR16x(Y{?E*Z{J6+}_RBe%2SyarJn8&5I>AHv
zp}iq0scZ#H=ZfuL@ex1!sBmVdw1tT==yF%H{jZ5fiu3VnDa07}DV&<Y4lPo%m<^s=
z>bHt^);l|N?34VptsWdNHq>!npq=&%rYY#{m>GgZOX;SH=8Z9Lo|{KGwlcjUIJ0l!
z2KKQmZ6EGlI}t*-;?wHj_Vfp~ASL*%IjY8ceB~3WNVfqTsg39D7Qy9@iSw&1j#?LV
z-omfJX0>~+*|7+IOd$w?>!uvZe3R)(Vo2{i%`{eP#tS4FhCY9mOcxc-y?UrW8pyJP
zd1~EMBroBarCFGZ4eI38ui>9rfORd^b4q-2X%sRe%M~K+!O^+u6f_|eF-5Jng-E*b
z9o**UEMy+iEl=4b$t4!+UPjD(e@4H|q9_4>u(KFMWiBwvNS!w@Rug_GRAi=>eO}YJ
zKQ>=;b}xg2n;^5I)(3dy(?A}5f+{y67!%XZ?tWMo@7JHJ(i6h;Iz38SpE}^)He+(}
zU-o0C_bJv8Uc8l1rd1_OUZ;g3;hvU`h8A6C<&)fMJUUD%Hu&Z2RdIXp>!l^^#D*%h
ze(I&*gks|22aitGP(}>@XnrvXgn^4Wyxg!cUw$y)M&v3W_=FmGo1@rG5SCf;@0qs$
zYtUw;jQr(YYY2(5{LFC))Z3WM!YC{lVTJAj8SiQ<#b8!<XGW+@{bj=QrNaha#(Kg?
zAW+(;A^z@Dw&hSwRi|LYxDcPXQZL-~ndV|@?-rz7s8Eif?f;i+vVV8d2x0(KJILnE
zVV94E=t%j1h~_>LIOG38aL`RyP5bEyRPA_wm!3akIkzKH!l|L_%GV~XI>v6&;w)39
zY=@OHS2<dsp98O|Fv4aeqnz!clf)dXY3bL}n}Tg<(Te*xUNCooh`>LKlh2!o7Ds3{
z>BRHVF4UPEkh3m0_K12sm{q7rtHlotBtS%7%~-Ov9iw@SUTpqAax%K<s3I?uz>Xuy
zJ>Z(M94)();+rcv2@Huiu(Fnnr?ce#uY5_BTX4@!PFsc=xgcJaA1CXfirg5%f<(a2
zldNCS14m~js)dLoy*-2y&o^)=$)O>Lr?3w{a{R0We3!p@iLs8ds}F6HSMZxXpfOs5
zC@E9#n||TR@ZT&;QO=VsvxXqcP~wVtJ6iAboRd_WwRsnbtIpkO`-Yz&?t*#0p+}9J
zy(fW@@FgL+B<h2gt@%tj^IeJ?3aaeY!l<{XK07o0Z|suAq@1j~T7BDSP+?o$wP0X+
zb3C~9A<R;or{(&0T3H06jrZ4s`##O~dGk0GewTuP#BkzMGc0B7w{i?oU&<RaL`qWE
zA9QJ;N?i4rW!h6vtB0Rom7Adba{Vo@tX-cL>(0OaB<^x%vVG=^EcVH;rmpS1Aui{<
zjm8VzX^C$eD<eyefSR~!Y`5JpL6<QAQipfALo0bMOZWRy;yyJKydLCPz~Fz0CR|42
z##LJO&R=@H&gikvO)E2sgx$@I(S~ZAWWsiX{|sY7J@cpsshc!?I2fpL?5T>E9LoO9
zz9D<tyGmU%Vg?Bz#Ja#lzdxsD%1BC-zXxe0c946hoW@T8CDabr1DMowt9M(|pDkrv
z)qR?CO1wCnKUP@g&FdYyh(VagSI_^FZyK~p<0F+7aoQ_@Te~V=Q(Q{<O@2Lb_f3WZ
zciHg<deVz1UL%bS6<M-5lRi}3<WZDW#?a=O-u`O-UKfA*L^FyI?ZLf!Q6qbUVCDQ3
z`iQNlz8CvZ2{kQ=^a-?LxEGR?JKth&-%yW&xt|SZx0UKu9H9iGC&WrsLW~vG4YUm?
zyvI0Fis!4XCR?<F_^^!9ji&%ZWc)^0aLrc?-}3T`RaXBO3s5YSv?<cr@L$J}K7HSJ
z({NTcuF>);r0E65&-2kwWImFD!IA?Izk(XNv9E<#r_<KH6YsbiyerizV{euh+fMy+
zO?&z7468oE4cAG)dO^YiyUaSAjK2GYZjMj&0NbCmTj&m0o=@v%`!6O*t;}z6>rJ%}
z-C<$VPxIbVB{Kv7Le%xxs3XYuYWTT9!q9Cg(g6ogKm4$o#nuzQLFC}<&yKFW7re+e
z)_ecx#=qTj8`lZIG<npXt-5m244iIv(!OuhQK;O^Y$<SDjUEKT1PI&Q>a}5`<-<^t
zDci|O^Jfs>bGIF~W$~3#>4|WAJ9(~{5?-9%C{T}<3>|u}ho||}B6Lb*P6~e%{k1f7
zf7Lg1@ldGq<Kb~SW;@eU^0-=x6n0UhS0b+shTI7_VD2{A7N`!kRTlbG*9Sp^2aB{A
z7Fv)^RrqP1{rpj{yovu3DrZ)Xxl8KB0Nz{vv1cnL&`!l*xscTu@l=Kw(it`gePV^A
zXyxkana(h@H`&9QY_9_x9`|KU{P|a;(U=)jt&65sXfpIE?Vq`a{j2Sc-mX%@Cp-5=
zVr^~Uym6;1aDI3)L3ekt>W56;s;#tNC*F@YP_=hDHnGU&9oy$fkFwQDl|fnq2d=bw
z55*AzxkK51G+0{4)mGJ3+Z)}UT!!X%pzBO~;!y(@*r)6y51qyGkp~3Bs_%G^Ou)AB
z1Vio4oK9zX`2w8jPc-e<%_|QWdk=bh>nEH}=}9fFEII`w(YtqL_b-1RN)+pn+RIZ=
zl`UPz1g`PJyn%XaqeSiA^@oIxVV5fzL*X1%k{6@2*VPAXxKAE&3dGV@{MqpK=_eP6
zR}&>7^bjndwKr1?KhHl!Yl6m75zGoHZk?|*T<z{}qiL9M-v|<<cmGHSvI4kVyIr>V
zeK(KpFeDlPk1nLLYaim^5BWl~Df<xlWzSO26`?rGy<Z;tmUs1!vPa|n0wy*f!|`i{
zelCe~6k`1It4t-*Tt<Pz)WR5@Z(Dfpb?4($7?_ipJ-v?ZSBnI8jN@*m0!d}=-`-t_
zdI>L`q<gSF9wtOjCDD-T;;=+Lv2hzi_xg=z2u>(QID(&YnMu~J=)yrkShi0tM`2o+
zPP?RhHn*=zMFBU9`RQKZv$9NpJD*08s}+aJx%la?{DEQp-1eJ1=;h%I%@txR=DU^;
zRBgW{s@=v;x0Ai^qPB-O{D(7CSBTHJM!KIK=wbZ@OJo_87rY*2?cPV_%ni0dyC%s`
zp1W?Ps#Mn=U^^ad$_q&>k&RqXKZsogCzJ*n;$Hz1-xfb_S`@EAc|7CsF;DMQB*rti
z;_hbnd6A4thPNI%#_&>75G;8s-!}XO?z#b1!%$=E>sf4v_3qd2^!1G%-|;|3-G&}c
zMw|ir9?$<MVW$0*$UA|NX1EYZtm8EGRDRDz<DZ&&`YJ0YlQ}Eo7tDA$Bl&~tt^>>L
z>+GQ2fc`?{MRVd)9t{zJH2IG=?WXS$(NITMIx=@*+n4pdR97qzX0!2ZQAM*;_hOR?
z>l3Rx_gyJDQQgG<jXPw&3(BmMWk{{-OK>?_w6t+;oSeA1U-lh?L!yE`ce}n3DGE8|
zni$JC$uyvnE>S(*E@tweMl>{(wljPxURZ8P<*j!Hw-{E@V;if?x8goE3bn))57kC*
z8m!-Lh^I0ex-e0g(r?joD$`Fba<uE^lzO|Wu?E|++N2xc0d6jrog~BzHx*c;Jrmw-
z4KpOCm%npPVV#*-6zdb-?bJhr{4w*GpeX<DX77Gr!N=}+>`x-r!Nba*jm{#4ljCek
zA}Q;dbG^v>*-#D1d(^moYqOH{5m_Y1GH=^4ZeuSaYAGseE_+q=X5$<SoZuqTyK3F-
zYj~yfd?Va{s*}I}Iuv!m5)-1lRa9D3#tgkfby6wP4+yl#;T;w9@RO=W%hNtN%gAxu
zFO~~Tv#Pk;;dg0Cm8UwslYf_tZ_c-1jk@qAuyuD+Oc01Z44(So>fOG~4FGe90!5nu
z{NJc_b7qhHPGryC<2z+htp(kz8zOtK0YlRJEo61PrudX-8vS~DZ<?|u3kMrGHY&8q
zk|tgq;zRvn24W@4r_I^jgUDA5M)op(NaoBHVp=KBpCvJ`Ow&?F`LH-eu@%UzZAOgD
zRI<2%dp%V;kC`}?oAXjIn+z#sI3h}^Sx62^&URe!w<?m9(r55)B`MFo#U8(*E(POP
zMqtq3VnVr6sGfZv=n-FiiA-g}t7kz=otay7a?Ons0k3{!9(^23c?^~Tg7g?~PXaS2
zs7iMFRuR)~i8|kp=>sEB%I{N7cq_iQu(aW)sr^iNsT(JsKOfxJ|7s5dWm5QZGx4Jl
z<Y`z+jYdYM=;6eF%t`$vgnBrzbbq5IyTAFFe;}^W$f@1?Oqhao&mgL6tSWc6#^Qhp
zi$mU?YxHXm)_rC-B)DOR!u@3vLxCzX4#ZbZTO>eUjH|e>pUP`KZ|(gma)+4_&$!mt
zd}gz@v>>3ToCy!r2+}X2aj~8kbKGH>v1QKXo#0{w@H4!9jXf(9rIs{uLEk%6NJ&_H
zkg#E$y@wC!@4W4Mypvfd8>GKE2|mbHFDPf9T0Rd$Qx`V`9b26>=M<DR2JlkZrxmrN
zRI?fIlG80eOgWED=X~?c^n?F@?0scemCx5Mii)Cuw314*Dd`4j>F$)2?k)xCl5UW0
zkS<}<-Cdh**mT2Yp9lT@-uM50IOo&3uJh&0CoXvQFnc{SYt5{6&wYc3H(q#m;gFFO
zd<mwC5H6%a6Gg0Wel-q3^8#Q)l;`}Mu`*Vu68+BXqmFIX2gJ=du++Z*C-H#3pYihW
zQ`fN>N{P>|?WH!2fz_MGpau;9rLj|@@YAo*S4r~NR0ce#$0rj1tIZD4K5M0FzCGlG
zkG6;=AtlqgqD~VPq96M($yR-u5~bbQj;Q!w+T@0dwK(Poi+L}Xt8bmoa;?0}B*_vG
z-+*`A^~MCbzs{U8{e(AGHz6Vp<}3HD3^qizO536iR_2)#cssTFlyBKXX7{BxIflby
zSr5c$fpe)88B+UVlK2f>jB6r3{!_bfCG=5?*g~Z{iupB1Q<*g%;HoM;&SMGEVN!C7
zTU+awt`eS4nE8Ekx=4|5S5aw^!6AojDXRLCkCr6zi$GakMkEAU79K+CIyGEj6W@pJ
zYTr+PKBmh<2oNsVkn8Ux!LUIk@?L3SjP|7e9pf6>?1TFjlvyO3p&_E3#7plUB|Q*|
zHo6oSqr8&|S5niEQ9b+WO51=<N5d=%`K<G{@@9J)Qlx*tque<m4YHjt`w==gDCZm`
zwQ+f4eC3gm&E!T82|WQ#_Py}bVJj?vk4A)U@rMRkcVIM_7fG_5X{)wy#;zB~^$t}m
zVaMX3w3SYZJCn&0K$KMgIF$e|z4JC=&AUISs3;0Ln(hybtwwbIo*e^P<%RlVy=P|`
z_gh5x5kyBc#;YF^eO$?hpaWx*=0o^;&i#jA-to`0a)hBn`FebvF(3RwO;ZP+3KBo(
zp!Lgn*1#mTXy|8M&eG--Al5qMGqJH%lTzTPt%_XD<<<`%s*HSYDk|!POLAB1!h>uu
z7Z^oqe+4^`lcAVu?<%Zlrep1rpjUr8F2y7*<&2_!U+t2C#t{*HqpuYdmDYj@X)#pb
zeVVQKNqpV&DmZw@gh*yQh))u)-Tj0k*i?Jud+(ioE12bkM&3u#Y5_PGDG;?j<@6O<
zi}bBsLk*qoymU%cbx{?pArTgNfSh<HvSdvx#NFzsS@iE<W9QgTm*zM3==AqG&-oL=
z=neyY+i~kt&Vt0&@%Q-9J*`d~x1$m5?UVDDl7>6anw1Kb%DoLh;q915F8SQwd)#ng
zx#`I-4xbU2$fg9|M+Y=h8V!Z>G)QzM{5LeIJ%F)b(-w@G8uw>0zxCUQ&Ec)F-Rjw9
zH8_$mN&nRuwq#so4gisuw%-%Ev86uQ88kGRJyfuK#VStcONhQDvO%KxgUrmat?_#?
zQTy}6*y=At#xjVBg;Yb%JN>J_VqMDQxoM;u;sk9sNl^#2%U_|QgsKzL58ru_Ck0UN
z;Z&je9}iK!56F?z%%xz%ug#)$4-tXrn>{%|)%+zQVbo9y-U;fBf6A>WhT)(cX*OBm
zl^5VOW%bh<lE|E^RYI>sH5p}ZHUHgjo0ZIiV$yWn?PJnr4!w%Txwz`InwdHAWnyE*
z{ZBC+{TVIo5?q#6!G`K9HbR^5gy<V+1I7!EZ{6T;y+7TajTfk8Ni-Gzi0ZjLDq&+&
zktH~E=6E)biYgxCwx$??PeKuZPPIv8yyX+O@K}o$BSzE<z!pRE($}aX^rnXN+Jv{3
z+aTX;kL#|CSAMq@VLj&vc($al)tuAT#h%|H92MNUM(gZuM~E}elrADtIJ<ZkbLyvv
z8n8ne|II6Gh+m8!9ofagSoW?gFh~3VHfv4EPnT!4I#_;*>6JIRAKLhpD$Hpv1v25}
z^VU&^EUt(J8?Pkylf{k|@x>1Zqd3*O5y(VW0EBd{^*Pe*GAWZ+a<%qLGFPAY-l1n9
zerhSJ3W-o4qwvYqH3+TUhoF5wzPf&d&M7LX`bgl}q3|^Ke*Qj5kU~k>L;<VFqw#s(
zoo1)#r?pwA6cqcvu;TC~8Z4)-lZ%(>;%c<8HPmJfKIN#p<CF8gw95?_nsF4#V2FH$
zdb^LqJz5YL;-y0|$|SV3Gm*Js8_+4j61<E+z*NoFM4`k+@A!5iPY^O*)}+BYGCpbT
z)L7!1I@L;FUsGzT>bgteNKt*|M0jLq)gDX5O?d?5*@U~YY>=sf1W}jp*6vlSTd$o`
zvhu<sE+i-XyHZ&@)lCoS`<_}pV!(MEK4ICYmc!vQTdzJmW7!uofxARY_Fa|wwZaQ!
zWw+U*pC){5tzGOB{$qwne%<O;wui~fPOU8Eet5C_G3{%%oQYqxKQtFYuE({xNYswz
zy}YC9%7i1$HWPRl?bX&JniD)?*q)8MD$z<a`kt{WN=kyG)2dBzP3~z_jp-@}PJ$^f
zu(pWs9NrcnVBs$X1}+&JOdHSi_)BF-)qSGi?$1-B?O;U4$*$-0F3dJMeM2v-zE(~-
zG3od@xe>VHR1<Mqpy_ktnPO_%{j5j7fzI*6`-}h)Ybt0(__(#~NUE5@8vbKv${i<b
zBmtA%SI>W!<|ll7c1lz(VNv56m>)wZrj(T-_Ri=T9yTMQO<*vKX)gDvq;}W2cwyn(
zxx(Z^bwP$AuR}`v0<2H7IX+!>v4FR-WU&-6ZNNu2sKW8_@Nc)=I{k_#F~Z*h7-Tb+
znq|SB2YqTw)D5u~_&oQ)wL60|rZj$<F)!yH>(G8DD42ICmvDMgX<wOEJ|9P2K;NwX
z>3NyLyL=1~2<4>JtJbnjhNaNPBa7CxOo&L#>5s+LWejY{UL&tpU`gBz@~&3poX2?`
zd2FZHb=+Ha8JpZ#_8C%>w%I-PG_vPTU6C{o{5Ka+fRmEQVSD7~JK;@95rt~0x5K|@
zC>pbvuJ2?mz|>E(sF@*S`+Y<a_w|J-88v9D!@9D<e1CphxKzrc4RBuVog}lotAYfi
zZ%>=^hK(gTwA3#mR@!2!m(w^bY!~yYE5&3R+}<M+=qSQDxNX}@?L=+}P1br1vA)eK
zB4J{<sclD&7VNSy$)uM4UNe}Wi<8pLNrH1PLBwky^Ff!1T+D)HG-m)ph;!U3`90eW
z)%R}nNvwcpct*0Wrl=nzn7|W8C43tt^tr19)@-UwWeaEt`@J|rE=9FFUnwg`R5NK)
zT9`}IdL`n27-dQ7YXmS@qfAP8LFGJOoJ+;0iBUAkXJ^uOJ+*vKk0Tg9k*Qt0O4LdV
zDK^=?Fp>xku~r$P;gR_EOXAZog3u)9X<+J2XIlrm#4GB}AM3Vpn(Ma|b<(ewf4%xp
z8Rxe&Jq7@#+D9vQUNK-1^i%2)y$NYX*1;#rqyc{_lJ%6V7u6M<mMiLw(I>F1?HuBH
zbfhU7&8PcWEJnpFSX{*@M)h~OP}o==2Lp_SiK#g<Ogs54{?FlL0K!C}4)RT<13*rU
zMP1V3R^d3SZwk)v8nRNkdo8`E{@T37eCWO605-Ln@5as8ey5^-IVO9LQqn%;xW}hG
zOhkLzWS{;K)aSwS=pJe_k)u1ww1?XX_FffRuhSaa!$n26TU|5ZG1ot%A0P24nus1b
z`lU+vH7ps<Nt~_)j;+~$Q2bn%oARv+>5VjvxO|0H`iasr6z+EEv05so#a&CTWpTQr
zSgMzlM?e{YdyJU3dHIQW^|SZnjK1xZbSBTzUZFsK6o}OSq-*IE?1}7~x@f{toDKrm
zRB*$&eAF8NCj)Kt$pc)zoesJJ@^@uHr)O^{+FAz~-ho)R6?6RmaWQP_Q;)*yX-Fx<
zQ+}pz2UbS}=(thQmKhuG;2nCHP!-<0LNAn9nXaH;tMgKCp`7lzn*5M(d8^XRaZ(B8
zro?&ys5Lhywz|lc)&<RJdj2aTI}jC3lqz4ELp90f=h$(k&g%hlPFH=Z9f+R9-6`lw
zG}*pS=6hBE9=3d5-8a4lRmX{2XCLQ5gSUZiRBq?w+#^^&%9^UCvV2GpZ~dWSNuR^q
zGCDqHvXyq!gh_eplWL8#{sx=hD%+aXv)!_UbRjjZGP&Vd0(a3spF6?brI1|4bCnmv
z%Rzyl6+%;}p_z@T^xRs>DQPCRirYTUP}i0gVhQig@JnjlcAkt%R9pJ?Y5zsnoO!%u
za8xld|K}&fI2T=ujEsDus+$SDKduhKn}ZAF4(@CChN`e99=UE^y&Fc39_6I|ewfH5
z1S~25cK4|8+VE5!>gssak*jA#4>d5cv|2<A4Nm0iB+B!oh$a*1&*szK;l^P+fBPcf
z>DCfcXu8?GrnDRn6VLLoBKg2$z{T0V@2hhIfp)~h3fLr^X=<;<bJorewhhR$AI@;h
zq?C)hNr9ovy5-D5xP8jAuI%C?iOl$&{<H&~Bw?hnvlmUdH8uD0r#6?PHIW^&t!vMX
zSByQ&iz+|%GBhWW34fw~?Sg8AD9^Vy^O_gLhV38$@mc+6<?+UizagkeBZlQO+-bHP
zz6?Jlqc3o`inqF#k*#jpk=N|!tS#A!H9?wi3)3kflbKI23T>dIHT7V%JJ@^^xim$!
zEn_PaGKl$;eWEVjgr<08Wa5i!&iFnNpVvsSlKHt?Y=;RkKJ$DEpXo+OfSC{OEURqu
z*&3x{nT&QWcJg5J=o(VW9FwnqLu<|@#XD*R34$RhqEAPIG^PbQi-!)1D9~w7Bjv*S
zpn}O{=hJkda6&VO6t7?Cu=~^zZOotoVF0K^Rghp$blgbG=2pi^Qf4t%nxrd%o}yw@
zyqE1Z?UbrCGSrpj>SmpD3KggYs_!jt8lfXyoez*Fmv7;tW^0RG1*%*nUgnprCejwJ
zDW@|9`dIHUK`<}hm`f{aY$pBl*MGrWdedDT>BmcGpZ!P*B}O<o9^g%9r0T94i+Q+L
z>LHn0H2ls(P!7kV!1@8Xnj1XLx2M6uhNxn@?iVhJs%jd_W7DQ69B!!hUji53=YD*B
zoplbdzTI`7_V0VdQnv>95x#{05U!5&{lu+<FT1-E#Y*)~Xw9%<KkDgLeY*JmJ1f4#
z_!Um-`+G_r#h0xP&|_Co*{VJ~K|hh@2UpW+$u=IT$xDd>0I~)OVh$0q@S0Ru_=tWv
z67w3DfrjnFt|z(i^Yv^*;~QS>jxVUef3%~2x&9_Dp8B~;0(51G&l1L@tq>YP6P23;
zSHZ-N7(jK&{EcNSP$sNi|Jq24R~3JcMl9d(rX&@~+i+E@xYMq_1A0N;8<9;OIla<&
zGAd@A*X>~=m76OOBq8XB+$|+Eah+T!m8{6izbV<1$jlAQ+@4MnU((pc3y}<!kU<O5
zjpO9TyKucO_Pr3@)HR42*{s4zi1o7<=t{`nQ-yq)TV7qf8dn6L1X{lasx~1WOHXP$
zgWXSXO@7UQXKDj(R7oO#_&K*Txh$?w);`v?dvbsyd7xSXcMgNQP8*CO8c2eVA&2>Q
z>GyN4=e4S-;ofY?@Y$8Kg*wgBlG1zj!bv|G5|zLC<M`!ytE6skNiv%2OKJWq18IR2
zhtA@!k(WQ36&P;!r{jjbxjoOv#Vcodu6LA|O57*mn-QTm0ogQxuU#j68+rP#)~lAb
zobH&b*%uqZ&8A|f-USVgJH!;8$Cw`u|D?r1?=QX0PyGY*?|T@^KCMiHhbWex#Uhx=
zmM(hq91$ve1;+-IxGmpMrK$?UTwq;+*9g~#c*&5x-Nl70*nYaVslA5`aT0!Q;HO+z
z^j0%`#upvmW1DYyncQT#e@7N(zNOe@Z?YC;)~rc!I%6@kgWs%IUuRn@++^C_3|;Dx
zH4s~kNnR!<Ib}M`K*8SS$%C@1T3_)DIF;QrXGh&pF5M0<sW%C>SV1T$<KFL`#j}?-
zoSwJRbze(;RL4}KA}M^*NIJ10p+0(bcTk8#a>DgFLm&R5u%&x&<+iz8XXh<DxAnr2
z++?IgiT5NseBFJ}`}bzW&e&FMU2<^kxl5uLbc7vzz#8G{MtVf9NXEmi8p~_H4EDHe
z7I!;EUm6xA3?&^k!(3PNdE9mR>sOm&A{Fs<M1&_V{~+XZU-go)lU(BNXLk2JFK9Z?
zEllh#YqTC$w{4ZO_|DKKS4J*cmG`J~<{Iu!YO_|jr2}&Y+v-}>kTsQlIKXW5_qyMS
zpP*Y|ueE^VY;o||oU#)q7NnB?%~*@L$Q8Q>(qG@t?#NQ^7_6Y1hc-<5L}SH%1hUq1
z!2xVMnX#V6l^p!=6nY{he?>ZzO_qDz=1L~l!s(MGv$oa9(Hu^B9c1nThIJs8<B~*$
z?e>z5o7U7>4^;G?E&Nt(+Tmx1U(YSc#eOi$dMrT_(M~xj7q*%_r0czVw;;gqapOQ4
zPG>7`q<BgU-!l}decr@!%4bhe>~n1BRsOn$*p#@SgPgsWe!XaF54)(j?q)ds7VBp4
z=IU6uS?ohJ^BcMqTl559Q`IdOb{ugghRIHL-_ziq3h%ZFl4>c2hxXCYVXefl+1gBN
z(5i_ekj4Wt)|da8v37>gsHY@e<a)tqc9#N(+yZHh?3r~U#t$-ywrLC%3PuEaH-GEI
zj~~Pr#8fC%rete{byAK}8Ldi9weN@buaHUP2wn{xsk`?5*2nmv67C{xO}Ou@5IOmP
zZP2Rxq5aY`<5T1Za{K9A3!(yroIq^@il@F@X+-hkG|FAD-8Mo}w`RhKXdTBkyBNFL
zP2<uT0{KLoL+1Cl?|;kv>OBioeyQ+7(PDnDVjPJfjEj&z%Lki>CV;2%R5`c8OU(r;
zQ>R8*&`Zr0waH2Cq^!=ZIKJ1QpXDUcL@`87!aa?>LTxvTNeDTMjuG%gPLoJ{9CfsJ
ztT^ahBpxC*hs2|<gIuWx?0&TanM%@9l)4&UcWWj&i%WT4%}g+d(5~nBA0{%p1J10Y
zQ*b%5&+rzwBPoW|Ia$VM9h19&Tt=EOD()CrWS@y2GN1PPA{i(PsxTz=jz?E%R|H;4
z*LItvdy2v|@4^Cl?R*fB)_wlgMMET<0i?yi?gQV`ue*WJ>gF+1<tcD^8Nnes!qG1t
zM1p?PSExP8%m%y^Zes@(AYt|gFi%{nd0cdAYCEdJSRLjl3c{zyk5JVrjI~rf^mkHn
z@=E4+DfKP2tAih&ZK(i2wi~hT$!5XmiwIv0UoU^nF*E+X2PHzft*py;V{p#Je|S!f
zO$9&Qd;Ajuf`Y(T#JIw*Qrfw(H$lQi`Gpfy2Ll=24-WwlIPQlIBnn+C1cd(n2EnB+
z`JbN<);a#AsYUp|&rFW~tvK=24W<+qoa5)Zevu4ZIYbPpb^S`Kw!rmdwu?xXBu-+S
zH?8$l<C!_aiX0knZ{wZn`<6)F()+k9Um}IEt8s{%-EAT_nv+IvrX`>Ie;{uBW_5YG
zAuH~UJ&w;SXkB=W0L*ux{Ew<%Th)QAv}GXho4@^;0Cek;p@50KQ``*A|KMb#YjB5c
z`^~K%t$rkbu)|kj0Lor!o49y08sRm;DsZ55!n*IP(TT@-xh8y@s&~8)cl2&4(*0!!
zC9W)G{vWEZAJ5%v*75#9q0}n^86dFyCYmtVKK%<AlQwN0gJ_-G&ieE5`s&V;*gwX`
zcz8)EzXb*8aKD9Y)ooPQBG~@?!!7*Lqo1~gk$tUVexC@e_P{f8{45ZS?!B_vgt@|k
z$nc<6d1C5f2MuPGk=Jh`-7#=KR;$&#{UQxp$au0oe?=_q`%UBD^hmKRZIls03Q*@0
z6ee!*sKd3p$mzoA?0C#OwwQ*{oTf^iK6XvoCmWtuMf8oS&gv_vxOaPUK1w-FLdOd2
zV6Fk}<cb*{SBWNL>5D??-KH1xt=#QV#7NELbge_koSG+HRy2c-Cse49hxzYhvNM!V
zL1#RYB|nk7Rk9z5P=0eUP>4`ZN80i}m`IHzPWr3C19e7b_kP-82whY@`=J?AVH>;s
zw5Uv#2(3VeNNiZ68Ozwrq$?feyv!@^_WoeQxdyWrLFUGVWhI^?D_f<tZiilLcqD;E
zhtGL`@%GPMHyt`M@pnqe{Sf<&sZE!fmG<#uFej4swwJj2)vbQl6q*-p!51&f#^BTX
z4VcMIg-zkVxq$gD#M2ik_F?DeXJK<5DYQ7feR%2SBes-6Z_Hst&Rhvfw}jPK9xB+A
zP37PLOE+N3cu}rd&|9h4kR?A7-1b+9E000q99m?$iai84QP50+u1rH$s?p9IJPmDc
zNuvn0Ri145{ouk<Jt0Ik&Z)SW+ya<5um19gpx5_gaeZ)Q_`~kONXSjJ(3;tTe@o6g
zToZvLoWl*U0?~6tj>f)2FUu*bG!N8d7yiR6(qJ=JfK}rxN-waXrf5)4lF8e5%5hYv
za_ltK;-%X&8&$?R-4f({Q__s!9BXTQ9H{%ERL<R<jmcetZJK>(xT@{+u6^^BvQ<)b
z+z^}9qpVZ+!_t$<QE~KGHdvkiS?czB95D#WoouF`=ei<~;-^#>bpr$e8HXl9o)vqU
zHV@gOx6==v<7<xL|G-78*DQP*1dv{Hx}JACVVX)=0!>~`@@03sUCNirm)50=@YEC5
z>oXG78y)YpGk8wiYZ}S3o5OtU+B^E;Gi$<lFDq3g3m2-)7mUnPHyXEf0UF7|^;Vvf
z&dqV&{fAZe9(RhHIw$wmmWxNPoo7|==NU?$2{WC88Tpz`n<Q4jH;K3Qd%rl#296xx
zM-wdCgu}*7YE>3)m~28CUSLZeU~i49cxK&k>w+V0ZcXC(ZZ?!jaCC{e&PUe=-DCHf
zGu%GKZ8h$`e3DC9;`N8_>2rljNu5Q**>%aDbJ6{gCfaxYbDf)`Eb(1|qj>fcQZ{|~
zy6=iCI3{L_=lTeAGyUJ#0K+-({27W{bQ(T;%Gy+qWd%3JkeJskVI=ecIzo7lefh)!
zz6MSQORVo&dubQ^c*aBI-Ezpnjh#$_x*gkG>&0{hf4rI*+yK8K-UESM(+{Vk4;Tt=
zJ<i!DCHw>nU{meEcTc*7mmlV#5;wlJ_0t$@I9<7d`HTgNhoWd{Bfm3uSAaH%bW5%4
z1hvUN+w<xa|660CvTEFttmioNR8}@z%u88K=XrsUZO%f*?fSR!)?WN({L8nmbR&4Y
zrv2du?Y;P!W8UzyTC9wTqkL4U#oJEg&YXiZI5TC2`3z{5olV&T_CL`epy1D(r?pw>
zO8}(WVnqd<kjhASYkSE6(OuNHUyCd&YuK^ZZn`O0%k4TkD#TvF8k3akteB9yuWq!~
z0`u|0>aXwkudA0fM6q3nkaQ+Ni$jZIPg3Y+J6@NYDJoaM(1=Fa;U}cs@vVXuax@31
zE(Dt^aL?F#gATk^C7=HjO5sILz~yy-bS1n}7c~vvai~P0jKKgjalY3)i*I%MWu1sg
zyxwt*JuCNgYH5>NvM<3`Y@;iTA&)R?GvA;+4-dK6rq+;27C!7>wkS>f#dT5WhK}p$
zinq^j9T5PpY{9tb#MPC9H{0K717z?4L<9gQ2y{&eQA<k!zItGH;WVzdaFF_@yvP@<
zvB=N29j?{(X?Ne#y82Z^Nh+Opna7U!QxnHj74NgQ4({W7%>m;~HfaVLdQ%VA+O(!3
zT7XmpSUc_`vrD`R<z*?}fkK}b;7N>U%gWl9b5@?eb9huL)nF4L(#jd#4HlQk!!uu-
zC>EMXpoXRnW=vKn9JH!|6ld>jx_DN|m~zJU9OedeGM__+-7Qf;?80W+HbsTIyG-dz
za;iDV^yqWh^PGAW_@p;p&zBBe)EW7<BUM?N>UbwQ65euM2u6_V5xz+u#TRsU8JrL&
zb~8G+zYQyzg+kq=ukXLr*hc79JEz+^*06OHh2~TOv8EPgh~H%S7dsK5S-)aih%)g9
zJ8`bjHb5zCmS0*GT3k>%8X%#xoqT^>DddPJ^cm0feKu-mr%8ZHd|dzSEo7)%z6_u%
z>8?IT-)$r*(ZP+xOPg$+TEhOJyl=TU<jPS7nwIbn@LcmHb!-Uq18@(!y>$z61)rLk
zrO;mdr7<C5|A)pT1$Lga!x62ULLNGSPGrhEXX%JW#Gm2i8ZWbKyR1643N8LwNp9Ur
zidP=;ePEW9JA-VM@V-ZiPU&nS<hIa<`fsT}%BJmUn)hSA2sKT(e!llB<qYE)1#9SD
z?Os;gh3lP2tn|tO&9gBZKlMuYqluoi)6M`@RxGuZ|A2s)fSSp<*4&;0ZuQqXt*@y*
z6ey^FKWLoCYVb1<cid<dZ5;?SO=;-IjGYprjm#@FEv3oyvO!BrT`q4JbW>lD4w1wc
za!xE}WktcpC_MgPOg^i6Hqn1u$dNjw{ER}KFM<ZY7c@HhcC}o+X(gf<6O{zSgctLj
zgK~g5BO<X5>AhJh#hLh@^7kG|U2k{M_W3nHQV``CRnf#?xyAF5j^&L6Kq91-c4Wdl
z^`b#t*)V@ul!-+-M@fdGyQ^t-?#E9iis$Jk5dQrv0}g4{g@Ya7lDC=JINzSy$$%<v
zy?G<wDr=x1%$UnNuw6eyJxMnAWr5J~(L%-~w$x50DZzquz$*R*mz9}|YQV>j@{lUt
z-ATmQ@?fIdE;cURM_(SOUv_q5xP^julgyP;w1yO8<B=|htnhyBMWxK?9$<`}K%^Zo
zV4L?V=A%U$_5=zcm6b0QqA*Q-B02pFu9_TP36m+>C?@4msn~kqy4**~qlX06dLy4Z
zir&1t6-A;QeHqVF&403y!pb_Cb2g4Rzx<2cj#yDuNC2Dubq|eYXrR>*!)W5vpYTV%
zJ%nbX^|o@%dFTX`1!~1$UK2XA%*rkXZ9cte8?(E4#-T@4d8DI#mP?+aoU{$j4=%7l
zcqoDwV@hVZ>Gog^n18g&qj}j2n%LbI;fQ?I|0LG6Zxy3Dso~mL>bs_IICX=xN;b{=
zpg~u}@AVOvw~BmO(n4t*ZafHnp+het`U&qlw)BaVf;%JYDTcDfJK2&e%HInZNxdd|
zI>sYv%?<Kzx6mkw8ZD^86xcM*_xK#1Jk5>?6C+Bbe^^z{0mzalW*CGk&%4=K7ABtO
zqmswkHk=oiei%z$tulE5z7n-D5zY}6%3RdCKxZDmDhr;~&E0#R+BG9bklr>dG%!Rj
zB`%ZtqL+F?M2X}5heb#I4%Y5lP3j?jMj^{m`q2^S{a5?GSUdI1@sX!K9MFqpq#f1v
zY-|}7<4{n&honQ-`GYo#-iwA)U3pt(Sz2<S7%VFKE38PVKp)<<;LgSKC?cStoc2|j
zOt#XAi{m$Kwq*|YRpB#OS%4Lc*%IZOP#Cf*6^;p`x<ZM@)Zy7k1O|%3%Wi<?>UF(_
zcD`I8`PM?si<hJ3g6Wt!GWZa^#76zM1bA;MxwO)*8P7b3K;oc^<(ayt@q&tEcxQ6b
zK>e|3li#T#M>O)_HRC8ghEmrPaqVVpnFev1lQ75hKr5FUZHLB$AkQ3^0=<K|iJ9f?
z{7#E4RL`D$l|r&^!v<i-hXyAEO~e%h4R(1-`h{7`LG7i5&AuxI)Y(g6#i_<!%ygxa
zW=)5-CVc#b8WUe4Q_rjvD3@x3j>bG0B&Cc+nYTl+_qX~TsqZp8(>5%2=8Tg~hQusT
zE-Etia9^;xI^uQ!BIZ3p%D`w*S~}I83Zck49mb1IdF7UmxGJvxIscs6utS1w|AHw%
zRF4%)ZY9$>+B#^c>LFAi(26*Fd^HGf;vVRi<cTZv4)@%Q-@oAB?NR`3jQX<InS#g7
zoVv6>lIes#(qWd06VxSnOK>qu=ai|4jthG&mub{hJzgNvzJ?kS@&&8)5r?4}UG3-w
zz}c5)ACu-HKqg;!9?MmoOQq-5*e!|^`5%-MI-%(R<wUtc5G_DCap-DS%+mLU|98K0
zivcsG3#S0Bv<B+der^rsz!}zmQf=J+`r%Bde_SYJ`(h@e%}z+Xc94sB1&~;%+9+Jc
zm@Ud_C}irr`sHrO^JYblTZii0Xl#NTbKEb`fPSJyTEWFi^}Ed@NhT4J=qLy5-83)g
zWFdg?_Ntt>B;2n;b?U8llwRPJt#G=3@qEXo%K<SOnY#L|3dc8cF4$kcj0HJ<6wbp~
z8DeiAWG(J1%LcnAiy+KO+o040mN;;0GGXYa`%8*(!-9v3YG2*|uA-WPqPECC$9Ir7
z7k7Tk!K@jM@<Svye^%Yne8(9TNFIxn$OrN`B}bcSev-h)Kc5Y@&Q|QYTG4H;=Jsxo
z6ng^jUt}-^q@CH}nxM+5ZVFKAI8xCIaA&i}IH`B<I2UeD6YH<y&lcwtf|@K`MtE7a
znWm_Gj>AZV{9=ZO$f)1)pfY0P)oGVZJf-O^Q0enkQm)?1DXceF6v}hk<_M_2jji=y
z;2(C%@9nxa@ei};!IB_)i6kUohpkzB6*m`3lhT5b>h<?f7kqHX$YD5;yv3Ic)yO3G
zsa^Xo9t-?3DU~<nTmfO-N6~gqA-gu*sfOacEb2gY^ShkwSAYrvY3_LhY2gDGL?3EP
z>s!4T7irkqJ_}ML=_TDG`uXpa?^NQI^8@>>oZU{b0J=U^U3ZQ6>LdRaCW=qHCna)y
ziI($YZ+j;HuvCl!EETUirGU-s@$>ojsXCIZR|KSMN^7&+e4?G~hBu(eyQNAsN$l8X
zAfvNTk?+uX;ov?+$H&O=p&fKHhSx?WW_XdM&DxK`pHlbss({oMclAL-$Hw;L+7jDu
z6}HhT?e9Mio8LX=u%N8D9>E+|NCwj7wZbME4|xiNxJ+*TmW(m;ZPfaM<uEIP){N(f
zo8QW}(HBZl&_-()NJ{u7luQClNzaNdM)!i=E?9*%e{c4!N|JhkpZ;Daq+qW@{5|4&
zj_k*ZRf9Z*3=LALJu@!?c{dMK<81E--UikdDsG)TshnQ@iFY){qHZ#rcOpP_pytqh
zhjlJv%lU2PR07&R-YQ6CSU6jBIF~WFAbsbsbOI}SA6+3}6{AMztccX&dpkGRW@us+
z>)LKhD=O<QbHq%O!x9D2F^WR|Br~afc(T7S1}z4G_ynh6uqnRgvxHe5pu$RvJM$fI
zLY3_n3N(a4sb9$l74_5letyo2(AU}T0p^Oa#aAMhxO@~I9c_DnB?AF5uktncA2Yoy
z2{;oe>^BtPct{4sRT+Jdwm4oBz2O^TUzp-*Yhq9SQy;_;`s~We>#5T+H_qn}*7y-9
zWO_yyE@<&C6{zVd_pwmj&fjoU(f|aPi=2FKVBuATZp@g-+Yi;vS-b@M*|Gs|;DS^2
zc|=k`V?<3Dnc2pZr@9llNS#vnONQia4@3%hT5QCV#&QA1hzP(H*uUI?hZoobsnwqQ
z#e;;*E%|{5?9g&e<2p@zy=RTfr1-al@x$W8)qaUxenN6@F{>(n_t$#=K26QY&kdcn
zl3jd`!6@698b^HqK!;^t88IOQ03jfvg-{>y$sbOL&VmGSX{Hj?Na`Y5Y<cwXZ+vcw
zzct#%3J0aEINUUD_80tfoL3E(I$lxwrL|(BQ=f%bIgLRuI&xUMSh|CxvNT?RdOfH?
zJEpk>A7q_r*sTO(tEL;TQ{I=J5po*`_wX_qnD`&OYLX$jx?3xMC0w;phEjd0hIp1;
zIJv<nHp$4+f+904mCDl^vz|FPSvV4KCt=A3B3Qzp%O|S9Ef~G8iEH*t7=OqkzLPw-
zQ&-CGF6?RwQ!I1PfK46v4ku0EJ#|!M$0acR{D+wUWAY+b%#scWt!b)hgnIEu+;nVc
zj{Lw;WdVQGV`O47R;{4A-q)8cP>3eF-^j~(-ScxsM#1QbMBXf~$K6l$f~nneP|z?R
zn{jSjyh^i6KE)N4Iu;iyTV+@br8)5@$@3GhykxVX<^!4{g+XbllEvSe+brH5(Xk)U
z2b4fom5I%eX?q;w?yWb(5rle5@};rq+*?j5TrM42##EY~VGs=+`N)BlW!uBFSXj7N
z1~mqn+aH1fQC`ta2OZpgmYWKu!6b_&S<;`OFXq)-H#Gm7j3P2Ws!P?GlE^~%e^xz%
zbw+iOKLy8N1dNM~kpWvMa*KfN=iNuYs<*I$xJ}J-C*MEjo}f~En*V!kQupKO*`mbO
zysy=zUjH{na!q6y{ma-vVS<reyx=UwPYjF?^+*RL8J+seovNGrk+DLR#}XAJ9MB%M
zY4P(?XhR1?O65=ej^{{|8|}WQWB+~fQ~i3aRVPXYQ+orL5USYE4I~P3<xkZTpbo=_
zVj!d^G=f=-A?!55y$-sZFWf8sGQ+;nv=QW_4u(#Q5})<gizN1j<_4NtU&qW9D{(ZF
zYkcB8(|YOe{^84m(hsd^|N9mJ$l;DNn3mDeDZSclfvqwbCPy|sb!bM5wrF4GdXgj5
z`G@Ux2;(mcL*Z`@^F4EOVuvfC{;@r?xg0zmJC>VX)eNucqQ1x>OkU&KaV{xXcd2@2
zX+Hf+FdIY3+-0W2S#g00&-q7$qOh<@%<kI)%VZ??{O5?&V=iH!3;<3{PE)=NAYs@i
z_7Sq)?|;miK#RigG^~_6HawMCnorFlim<FpC$j!JROuPEkydIl&+}~}d0@z^JHu2j
zIlehT9cduTmsj6%t-rB?WrhmQL}6p{H11G-7ktDt*_CPdK1C2x+BDg{oy{?uEoYQn
zQBW?*c{9~|hDgx1E2rh-6i9d<tz&s7uE|`CdR*Jd-Yjq^H7LnI(>Ny^#<eB+K6Ml&
zjJ4BN;SDJ74+TQSF9EY1Wtw|(bzS8t1H$uLf_9-AD3@o2<Cv?>s!PNyW*;IK5}xza
z6&H9q@i(qmn%8CWN#xKFk^Qe9&oHwA1_qjmdBLOWyzG0Cro_HO8!Mz~+_JLJ;);Us
zg#7*IM$dRfw}*0*R<|GjXqYfAXgj7IeY~4d*ib$OvAl@qVO^pIs8|s6cIx+ZdRL_|
z*w6QL<>7p1BSPy=NkF!pSB6p^WTbEUdBGp@U)%_BdO-=X*whNNoM8PB*-Y_Yma4>#
zlGLSM=dPp?&t6tr#`~&*n59+X2LEy-NHIfZ=MR7UC%wRGy7jhPgay)n(+m6#sCm1r
z-u3;EHvNQm?VJNjzdPF?ND+H7C`dtl=7xO-Zntj|+?DfD&Mp^vF&*dXc$BorHFKCv
z)C+g0)!B9~7<AWifPJcC*gtUVD6}97t}4PVi{f#%?Awe4DI@FbpqM-w-Y@_UVEI3J
zv1)t&S*9ax<oIRm-IJ#d#j)YdJw8n&g66WRXG%G2?%3g~K|_KMJC?6GTb0AW#T>f(
zu69FCb>m0jIp)U2=dm(H758DD8<Li9hPV@*muFfPQC-jb89Lu~E=w#$)^2HXA$Vvp
zH{DBsHUC`i%VVTrpl#6mD%7>NLB`hd&Hf>((TY3>5deyH0|NtCI5_tQ&fvzq(#9Sp
z=Rv!QO8XfB2>GF~!`el~{I)BxVN{&~i`(xr&8-zzqDKlzZ}%AMcTD+;UPFMM5Wb2C
zu~rp$TQAfJ0Ge&dA{)B*8=&*U63yD@uk+gJ$`)=<ta#h-YZE0zhRgL>MTT?*W(uA(
zbR!A_G<>Q<?_=LiW5-Xs8?ASY$`qvsRy$I$JaqdjaK@i)ep^Qcrv#~cvS>OucuL{A
zS-%sxVxWYL51t#@Lh=J|kC@PubBoC0y7e_T(&NFyidl#ks6k$-30I!-lj%Q|CuZ$0
zPCIg69y--S_dK5jR3B8!wEqe-mAY>K&OPB}Kr={cUCr2H9YINf5;Ji_jg2Wjkzhy~
z76x}0v8x&x#NpJPJ~iBBDw&Wa0|_bTh<;<%pvNqdtRf<g%<tsEi8HOz*tID-#(RiM
zw2T=<1aLvX8u*51M;XMd6YwBmlKR8u+lQ>lLo@Up-ns>7_`NP_wac0>o~g^=SiTC^
zh3$GP!iR>2{^~X&AoN5fvs){`?|0MT?CQoibS<_A3zXnn$l>PZ=FGA7!)6X>?}S$T
zFS?1-|9&Gcci7F$41c7Y#f!gxMquh_rnEgCV`#owefdYk(O3Uw9kYUVYx7|R0!{5X
zGc)sdR}&vven1rSYT1_$v<Ei)SBbQzWiXk&;DU8><beB}zxSjv;ZgYBbl%e8o#rl5
z*|g-}J`mm^@})=ITngXbD%mFk9kEH%N|MxDFGok@C<IAS01}jcwKIY7E&v_!5)E5>
zyEmOI@oiq-K6J{<@tjcSCiA=u?tk;y%?)q7;Gd4OSEfodr^|HnyuRG-fz{JSQ7X0{
zq4wP#!l74J4B(sHBJ=6ef3;0t_pBYuF^22j+pWTe;1RT{fDY>OCyyI1_wDN!?CtF>
zTK=_)OJ>rTlJ6YU3BJV-XHZJ;{qyWkty7nzi~TIGqg&X10@Xi5_<=DQXuKqTE$e-+
z%L9hdsduR?L^DuGew~Lgzz-{jLnHW303lmINkA2ld3{)44-KQy3wARw@anw%GTHkB
z&z*h6Z@O3nq)z>E1;+5gzQe@^$Gy$LWTnvmRMUMOWX7S}=oDrK%;#^o-VWQ|_b}6n
zeYy+;q|f>U@T=2weq)cbH20G`FE}7En;IW4_V>RbyfZX5-mC?~psKo_8`n^4=lz>g
zS-!XLKKA_4I|-5p!If`=YP@0RWs3YE!kMu&st*d$|BP18_4cHnAulfv@f*VVX&Ggn
z6D%)xnBN&)kG6z}fHr;j637ArQx;zX+V1M=pc+0qJF8i1RiakDde9i(k)Qw1C~8r#
zN9%0Y{HOPF?sGJ{$Hy1bfh4mZE}BC6>*wmhyc}&RB^vdOJHyUArzR`1`ESGo1ipPD
z(?IvJ<@(#jvdl>%pf_6d8dN2~dy?n%9A3TFl-@KyC)&yJT=+p=W~wiC%=^~5h{!YB
zY+SS*kXQY862?V8%<?<G4B(4%T=w!`dFZ|lq(pj5pcNaNJmswkU-m@<VcGd<$-qK>
zJnSKWwjlnWYRN$D+zD7KL+QjMKP1AR{!3|sp#OP5=I`?e|6lO>!4Us%6~NO1*HO#W
z?otn9;=T6Jh&+x2`~>Oa`9H!A0h#ANrEy@0&cT4Lw8w#6Jp?WYJH6gYj|hX0^WU%a
z?C;Zl%RXpOB_Wl>#~z$%I1dW*M;7XI{>MGHoG`Pnc-*&*B%;A_u}|K;9*#n_Db}dA
za~@AWblDtkOJCpE*x1@CTdo6Q=D#0GU3CUrvnm0*^<qkL^2>i`EgLVC{IzM&Gmd<!
zE@oM{I?#pw(#MSZL6d(R>{layWLJ;tjd-Q(wXQJyi85UPEu#yUzI8u@hu(bu*rV{u
zhAI}m3k!$mDgcDuxL8=9a>f9m=6^rG0R_aUPu!aJT?m{S*LDcuy*qc_Pu|cR^x{V6
zWLvb~fMM$0z`Q>>IWc6K1y+muB_v_@AK(8~4#lusEhRmj`1zA;g<fLVXf*h$bH*h7
zvl8mu7_!a86rbZ=nFey_YFnEisNq}q9{>knT>1Pirb)B=-J&vK8Wo;%F<Gyhojh<_
z3Q7MW2C|KkwdX3dcJXJM{3XOWT?zE>EBWzJK;Y52^}E+s?cSF&8~yR#us!hyzsShJ
zRt$G?R;4`m6(-4eOz^K0Rk#Miqz51IdHV%F49&m*E*w`*&iLC;;ks-QR^}}NdxsN(
z{%0QojA=Q@OjuFcbT<HO1uFxTzu)!GtRivblOF5bE&=b4iGjg-vQYWou3fT{#-x1R
zjKpr2fGtqehS_oVGRILnv68Z<GoU<ux#SJkc7})m{XVph&&$>JFK@jMFSkE+kBod!
zkHe`)0?f*%2G5&+foY==y4_X0<|`!4%F4=b0d`6K`!R%dl0t#OW{hKEy!-Y0+e6C!
zF_Oza|7P1^?(XhR<gJ^*g)jW-oRFUxzR3=*KLdMBIYO>*BdGt0R38u2%k?{f=prt{
zg^YXxR&*-=Hy40}G#tHQ!su>Ote&-?a*K7|e!fVEHtfDWBfNU(apyS{g$DmnDdaS2
zm;~?iT)DGLSNQAn-o;B1F@G}kH~2EhnE(6deaY?G+y>{|wmvXTrSeFmfGGB839Oao
zT#!R5zo38N8;&{@6%VN-!^8(vHg(tW*@{VjB~V0oYJxg<{*DtTVsF)S?z(qCBUx}j
zCe5VAbyS2Y76?zQ<%jiKY5a>Sl7M{oD;p2zanao+K&_sA_jG4*@d`bBcD%{t6Are8
zIq$RrxZK6^xC;W=@~Q}G$+Szz`@6bYNRnJ?)0~#ijO-c#*|D#)n~j)cFK5)13PJG(
zh^oRky@w?l=Y!VweCLSRn!)$@gezCQxe4u&(5q)glm4le#0O-*u<Gbdh|2!HeYL5R
z)6)X)>bU?T@TGg&(tR8)Wyq9o*6xx@l-yKz!hy@BZ^He@%Dl!(!X*Gc;D+~)PS;l{
z2oN*@ee`Ky#~ew^9D=ia<thC_{LS*ab*aOh{O18hMWh^L+kLSwnmdwG@2=FwF_%>M
z-=VmEg!M4nZhcGLHbdq<W6X1f-dxFTpVHUFkDP}<hu<{g=&ZGSyGd<#R8*D*l?t&&
z<hRpAN`Nn*lwMcgNN0<*E5joqc-vtznPtz_j(myj?6=GvHdCBCC57Ae-=lM44P_;O
zj|Lih(Y!t}z+mA=_@H=qH1dVN3Wv0~N}4|7b?zTwP|Bn^%&HE8ykwse)WSzI4s+<&
z(-G+_RcOSyD)#$pJpyck?XeQ(?uko-0n?K8Y1bS~>PmYd(v#D#hCM#K)!;W_X}y*$
z)#bU!Te{asG1j1x-$P4ITyi%jWlOvt`Tj@g9t^+512&s;G$1sdBZSYQAA_!xG&LpN
z+;@E4b8pY~Yb>9xfa_$Owe`FUS@GNfarBaC5PM^~>)OCZvV8iI10Xf&RaLuol#>BN
zM+|C^f<Q7@O{by!Cu(0(W=)yTace^B!>p}-d;H98PUhz880<Ge<!@MAaNlX_R*8(s
zPiVW`OKuz-AN5X1YZz$|ns=wTcgsiCIF-7b80661ak)IIN4wlZenJn(Jrnb3EaBBJ
zv!rrrx-HGjj7`@ns<yxs|JYU7NX$}G=r>?m?(W2?gC0aKOFm2;*R!}k+iyM2x_jI4
zn>j1?t?1-~f|roN2&Zl~XwSw4BtXdWIbdJyGDl~vgLxb?W80+w@J=(&#sQy4#_g|~
z>$ZB*$gp=r#-!t{mIn~|${JT8pBx5VD}JqUH;S1zhRLS5^xfI~jlv`iIo@#CWwep;
z=wkvqPQvB7+k+l@vdz0Nx;^(~26_G@t_H1nCx5&eC66_X)Al|>O*R>dK<k7>4iAdn
zj~_PMWj(xorMJ~GanXu(51p1mPjQ_O57;ke?(Ky7l%<>q!Z9Js#d$SeYZC$7q<F{C
zP+6W)kJi*>n!Oq;6lI~smpbsP#PjN=ARGtXFN;^(4sk{5I46Lh3DDw5Roy+Qg5T+a
zZ~b7&SmV)o^GncXVNW*Ko3oBI*h0_u`XU1(Tj&a`8d-I^yxnA*vN$&`yw@`0Vz5t|
z!NHl?vSO$Abc;cY!yr@h%Vt~>VwWDKEp&>#ae7oTg<oY!f|YN2s^+(PziAe=Ln|@G
z;+ODGs;!2H<?I?7ZkYSs4r1oG)q0XPtvWZZmDe_k?(LM^*bTf8$e9*p=_2A_laitn
z?BD>Fa<SXzXfE#d@5!<Z2?<jw7}e%SvUx3Av30XB5;MI+suT28%?)KE7f^_p(}0|P
zyDHMEhT5EdR_r&50z0jRZ}MugTdKt$Hq6*A-_m7VfE%+meA(G8F|jg|otSlp7}ySG
zD-9qH`JXEG_71q<@%Rd&QVt9Ri(?gQuVURSEl<<j)<jcRH`jLzmaI`PE$T*24myTN
z8;;m1fCY}Cv5q_4{L8z0DvX8@P@5&#rsp`($xl1cIl4jOt{V+or3;AoE!SvuBdFS+
zfuneIdPee59GIPc<;{HQ2i3L|SkE*HAQd8wQ80D%o4<#|xR4-c%^CVT4H@gO5|mrr
zt7SQB`O|xpQQl>2_n|u<OL<GyQjhEeuP;_?-1%b7`{^&IEa&jt;v`G_%-%Up7DFsE
z(|-F?)IDd2T$0>I=$3%ymT0c=+^4cU%~PG7VZ!o|XsZ5PH1*nTkSwnJT;Uf@@6@xk
zxd3(rX%)MIcvGm=Ohc^t);j)o)E`)HYppy(4Ij;qcp>m|SmFB#%B()&pcovt_9r2T
z=W3vEW)gADEb^tJRq`;1&LWj>%^-O}XI)C052+MK5B^M5Lv(FJ_qqS|phK5%jU{<o
z4`-S60Iv8PkhUMP07+E)_*gPjC7HAT{$;7nQIk0{>tvPV4h>(fBZ-$yrij?~nKZfZ
z6-w!QUzX~fYycUm>BjS7(v*8=BVczNhM0TglcFd*8Y!*G#*<ZYXhiz*AY2H_;8DRG
z!tnj5ms?v%Qxg$3H2>D##(HXs$W(KLUh~gF`1O5ICTZ5mx7<}$xc%ps`AC>;oUSDA
z3p7}<nq)N-y$FM?=c<F4YFV#C<lC`#-q41}y8^o`iD@!y6#4|H%(n@1by=UAAyro9
zmdBq@l@=J@?9~p5891PD2Wz6rj*iBQgK`YN(asYQgs}DGtI^6F;dV~>pYO|VE{+fU
z1VvL|YS!&sJrmDeF6X`7%EA}m%Cc=nYgx};w$(86K6&qKgA5Tp2*IvocP$Z`w)u_;
z(JPq)pqX;>)b=i~2~<_P?;IFuoPXo8@`(v>n6<hK*foco?#{*aD0UQ<403O}^NmId
zNAb?~aR2$jYR2>dT?1<MQL0FH>ml0kI`Jka1K7&c;!DN&w~Dw@;-cuEOhTTv;b0M{
zp|6)V9%SA(0a=h9rphmm!k=v0NdXtaQM}pO7+o9UJ%53nx=}&Rt$E5k?w%(ew;8!f
zVnn%H*t27i>Z4&vRXLxE$aj()rBnDW+D+1~F4}jIvO5QHSLv8-BTtXx=z@f}e&aeM
zFbr+Ah_2;sKbNzFdVF7N^Lr5`qCW7?cqyhzQ7)`(w1(~;?RO8hj`9SD4bnl1r#8cS
zb^T<qy_X3y0(E}C=)8oVMSNwhns`hw(5lL^|DggrhK@RYJ>GitY<!PO1oxHOv$O!>
zA7$ELKTt!iWIQCXldZyd>i7|_Y2<GXEOrM<P-EqI%D0czdl+CiAkNDKU0wIlx0Djg
z_lZqu;N{$S_s4(;A$cEbBRyH%cES+z%A!N1l4dEg%g?ozB2zWh@l|9ftwA!We8lWk
znQHxfglvxXW7t+zUFhZS&d<_3BSnhBP9>Uq9nwBhJfx4Zk!z-`-&5S2zpN~P&CuT7
z#5jrh(qB)Pro->EG`Z>+_)21M%>mcN$;t1rkr|k{L#ErTQZ!#@bs>1^mtd-^WtH|`
zV(}$L{2tQ^nsxY}5w@&q)Mm}PBoI}MKs3P@cQ<qX{&Og2(Hd?TF+0*?;TG6@UVb}}
zc4BK6fm*vMBe%=jfFUWxZ^(tI>mNLM%B|WPGL<ukupP?mZwP%P2hqH52hw=Cw+9t8
zQzs7iPZE5f@I^s1+AnkE_mLrI`}C!!-HY3GF@}wevrm01^FO4Qlx-ZeaB<Cj&Nb1R
z%}mQ*s<hwZ+I>;Ax4PpqSECfB7x;?>ksw=dK75YQWZTw|p{k~WxMXSchsQ+kESl4>
z82d@co+kW&vh_1VUArp1PmmDn=_pG5@sWE;hP)iV7lq8%to#JJg-}CSnhV3H;3?Cs
z_|SQ1(CLQb-iL<2Su5I7<$125MDw&S^}^M<3-NB6^tPLy9jA%VKg{<ul%UMDBjsQG
zsLyip6gz4UqoWJnG<M^Qo|+3Qscu@l6r|Cr-Lio-4sg@4=Sk5GuJq!Wg^3Ym#gDSq
zPB<|tDm5@vvrRKYC(pT^sJJi&{N)?nyRWB4d}yI7H9d)hMD8onmJF%FW~q<>2FHLn
z&3dpvz-A(XBosULSGUuCpbNQ~r%>=~Lg$Xb>cK6qQ5@#{EfUV9QFK)OH{A5+o#8%s
zIiEBM?yv2v4}~{hmaaK@2SYDdxNSc-&-c$&?+jJH`t!DbuokfqT(6Hy5)O8qn{T9)
z!&LgFqf7;?ON!_1H?<_8H_H+y8++!OLym_F9i}oOR4&C()y@3D&Hm}lrB{47I_ER)
z@tf0PC8f=`O}ye7@?GG&Uq+J0eR`|Y)6NOQol<Y>t%gT7?CH+&LpEqQxs$*wNmZPN
zK^MzEEecDtXVHlWC+hOvi{NIP4$&y#vx%Oq1-<cEtw~OmO>oKz=N|4oze4<8%xtCY
z&cTwnyAd8YK6q#umOy0W6!!r$`$*@9#axBo*|RnN@g~ANH0xDbj%%y_JFE(tur8a$
z(MK_QXdwOO4~&ic1WXP0$M}czhVgHVhscCMe*$G(y^rI3_?abl)Y0MI1)8ftZkXpj
zZ`oy2psb4J%=IEAcNWgPkSD9alZ>BK*Tx1@&iA*iLHw#+_zez_A@FUdOw{A*p&B$r
z`lsS_vw%2rmPhy9evamDEpm`{Vgvtk(KBQ1Ei~Q};i4b!sc?SO*P4^OIZsaAzZpMo
zl(xkkhnngT-veY2UY>*Hr}Ufd4`+c~Yh3=DgX~{VU)Dfp-*3^@ZODD$1ih6dNQ+Rm
z;JItNGo&@2wtGg;O6Zd7*|uU=Pr=WpRGGFD8LN$6)^*lwOPinwz{@y2|K^ox6`!i_
z5!*Hu`FXN|o!XzR82Em?poI_-q>O5Qf`(gC_b)b};HyL}%Vmx?aZjc3{ZbLgjc=g^
zHH6`dTifud+V_jP26#XvRwZ~skVVQXp*Gz&HVdtmT)%U!J~)3vMB>XooUaLn`xuTV
zmz?MMMw5>2%qT2iG-^Xv(rt8~(#%vDkuv(_W;&*uF1qA${xA04`mL=kdiSkSpcE*@
ziaQi{_u^jM-Q68Rafjj##oawvad&rj2u^??H|^g0d(ORo!F`@{)-NO^A#05_=3=ff
z$NPRB`=K|&Y3#LJxWzHkqXEgtw(*SvyFI6C6PuvrpbGWBsaZt|y{lxGVLFwb@14ff
zwz<MmtRezdyCe6#(^isdf`vuLcH8ViJ9VJWdTqqkX6Ht-Kc5B~?mQ5Eepuz6ixbIR
zxbN~hgCAnaU?68AT(8Mx>nznczRlvS&E>d|lsUWQ3ZPXxS6j{pdAN7MT+Op*aiiW)
zsX0w?B6M(GZ)VaU&&gMv4(QW@{mt3EUok5G8%?|<If5cn)<!2+*WetS%ZD{k#z9AQ
zQ=-!kf3z}%36%>^K;^=sYj*FKNy2g6mfiE_V!3CB@i~JUHz@8};S99p1rnpKzrown
zeOi^XU?+W;Dv{y8@7;9_ZY&#(et26em&CuQPU<9BV?oWUHU^5El-k3bZ}{HqB-53!
z@?R~$sJnzi;)Q`qsyN>jEbCoky80$UR8q_`hbhc~k;9txpR0LJnol#Iu55kSTm?Ib
zZ^d)a+S1bs-M80yzU?!X`bWi%XY`vhA!J_R8tdDKonC~vX(b4tn>@n+zHOP|IF-Za
z;!>u@VYLtOSmi=);l#OrM}+xC<R}fN&JwlX(~bVi7ztHe-3n!vV!4{x)HJH>s`U~S
z{R`cGXYBrO%UR8D-{SuL^{ZFIi<ckmXilNd+y8EE0zcmV`_KXZ&3|wEzox=}V)FmX
zfXE38G;vnW%k5^UX(WqnxHKy|dP5EDk$-WJHL@_nQ~1?E$<zxsDAh`-Z9>(bjsx<^
z-7Grg$-hEbT6V!|_HymXG(rEPw_VwO$g*v}Tnm2L@G^sHSqCnit#^#TVlO<Z*XOC<
z9B@{uo1ceK#~UA`ebnyo(o&di(jUYcg`aL_r8YpydKNaS<nT4;A`a$wwKPL6b1?JZ
z;j{;;QEyUi41)~U)MYOeHMo;v7_pR<vClrR@i?!3;6e@c{-+y$<&c*{iv;SA?=#dp
z^9S7U=8c=o>1wy^w~@@*)cr_>H&TCeZ%|Q|g89GZ#YR%ptWxL>@QF1rZEz#nSjR5|
zMh%`%0DhEkvJd4K#i^I9u4?msl+&St+(ZU4&i;aeiSU2f&0WB4XgBH7h>6@#{@(Sw
z*GT$#lFi8+#oThupV_}Q3$%+0_7$f|LIqvwUhoRc7thfiRy8HwkjUXZ6aJKZ=aE;$
zv<o5|Q1a>p0Cs;cV0<5p=-R=%Qdw@hrre&oLfI$%WJ3MquWi6!r5dyQnjIOsvRVbY
zeifVpyjLdKcXizF#K$2z0;=NFr$>u~UuDY5PXFUA{6OaMhEuP;`aY7$M=!Kh2alhX
zF0Fh2YS$f}A#slJZAc9vrZ2U3We4v;0pJs+^31IDTt&9zOFB60-b!w~s@v;mCIFBG
zLMlc!BvEn_(ox#6=NKWmJ*7fd$G5wJCNsiO)LCZ?<|5mtT5f4=^?Wy{pT#_NEe?`8
zn+jYy|HZVfO!pnl89`w#&KA_q9_o0z$6hPi;q4O&_)Sv*RLsGF(yXKvRd+pFrh#R|
zxPM{WfdT4D2BV`*Cu}YK^nb)?H4f+n`234Bvh<s^eH(M3()lWs@5UGijkvv3k^~hN
z&UB$dHAklUf@E%CgRefllyk#?Rccw+D+F>Vi5JM&p3mrZ-8*^sxt*~_O&xSWe%4B)
z_)d2g4rGZ9<2`m<vpmf!38m&HS{knG<WbpU<rCc`!K70K8fycUC7@o%ahXioDLZnv
zm8dCj^8f%R8?-&Z;A)5RCN&UehB%{S@8}q-&~%>Cy~Lakh@zsVrJQM|`RJOp>I&$$
z7NllGUH=(>Fdxqm9+DtOfFww9aFR9ZzJKYpIsw(m{Re%7vlDJ&bI2+0KS3JtA*L&_
zT2ap3oLnVYs8;z$*Fk9-+3z`$dCwYVWE?rpda&1G0(^+V#k)rPPdOHOwP!z)GpLwp
z#NAmZL6xez-M&9;llrw(*DDk6O0Vq3Gebq*d^*}vd_8nba7=1KiSNX!gpw}ezNYN5
zSBNz%WE=`425NFoLb)Jc<M78+ObZ^CmYPc=0pBrq>eH>b8BacroJBNLc%V?M49)@I
zyE|C=aJ?)3dXvX(bY{FH)Eb(jx2I$q(qD5BN54Gw2j~>~URhTjmis@A-It5yliyKy
zGrL`T`p1|f50k8gRwQnq!0o|zq~9*VdI0%qnx0VZ2O(eKsbU8$4V#wQu(^M)u}&XX
zUbn>IGcToE=3NO3FMg7kNpoezQg(lw`e|Vb;c5x8;u}laHI9T}J1KzZE_szd3;{ou
zD&S`@TdzD7xVEIEUEbq~bNeWqwLa}cYXo^S!qVN@Uxy~Et@$)q^L)}yy32MbYh%9D
zlgC<_QL6|s!(bATP`O{p#%ALGEh0}?ljwj!cI`~)Vg$9%$+FIpGj9zSfWl$<7(}C!
z$=0=0$H2QVnJweVj)>`Qh3iM#={!_8H}ERy8B!LXrM-lpj*jBlt*u2A&ze-<=mxtm
zFamt&`c?FzjCO-0c;d2ZSpJef1zl0$vTf9L4hzmSdWT|bhK`1q>a~O)qdFUM%MF=}
z+pYK)MP17hR6)DK><g?OZw&GqYAV{>E1>F4Sf1R|%2wOZ=XTqpTvS-i2RuiI`ox?>
z`D_Y{$+5ASw7u#KR@N5${7i315I3YEpo5ipMr73x>NgP?(`fKob3BH`+8-&0rnsoW
zu-11hc$+qzo?_c2>bkxz+5@hQo=h@QwAaQK+QzaylMyXmP*GG-Sy@@}>vrnwzz0G*
z%?g??-i>OQJSB<=kQH=>Nx;!@bltZ*>NLPq34)M)e3=rrezATykgA)N8E<>oT6+j1
zHW9}<3U`v9vM?%cNKo0No;ix2dEsGm6s|<*kB@tL31B6T*@J($BG#68tPjomEP02>
zB=M7l>do<y&yzT$C~39+Gg(`fl58WmS=?bQ+cl~#ovGz%rkXnU2u@KX`3yh0JiHnT
zSdXulmpA{#ox{;DYWPs9g+q`%Mx3MI&!=udzQ*qmPl-cpVp~F8ln!@iWeVwU^_u?K
zgFaoIYwfS38MLbY@R1M|W+k_9Y-yiZW&BtP3MFQ$kc`UoR~mE6&$fyQIq+KnT=xhY
z)i4ba@Nrj86(8nUriG|w&F`I0zJS&Hi6zUtyD;=JcM+m(7&t`<Xi_w!Ora*iucMnG
z2bvdSbNETtWeH(6BN7MLd32M-+pO+4K?)Ba_3%SSBSIOO6BL@Wne-)@i!CbPaWeRs
zA`|x+a{OFgB-b^?pv5J`f~D`U6~dGbNDUb^ed_iu^u_koP(mapo{)iDLHnfd9VaQ2
zrgd?{9rQ!1eQN%js-C^P$kQ68u6IST#;`EcA^nu(45cXdRkPT`6n8Il4mTo%9QAXe
zv?Cqq%m3F`mb}$8+ve3$(Z0i0Y~Nn${r<<z<bFr`Kt5V_9@$lDCyo9VSrrk!uB!-S
zj~#RwdK+ZkcSczOuw`$znLUK2VCh>Ma@}gG9Ue~w$MqVEFWpJJA!dh%t`pHp*oL>m
z`xltXY=K!~*y3*?O+&nH7CRT-#RTQ<!5;6gW}NBInC)y7O@o%8-Yi_vI&0;os`5HE
zEECi&x31Aj0dqK7bVmZ;$4}RNO1)RaFchKm+K3-h9Fx-`wjFhc^&8uBm#2`~(shsg
z^+Ob#%zf5oGmk(yNmk|JNRC39o-ZJdF_zhQ$>wQ^#?$M~@>+Z3eAzTTYhcj4Q?^(?
zlaQky>>_@tdKuuTx1eOgQRp_b$<*q%PMp(+H^te&DW;kNpeVtENm1Bc|2WdDdF&j6
zph&EowU)L9-PxJzGzyZTFhLX)I9obTCWBb3Y-91U?{qB`rG@LR^cS<7)k8`l<Pr+|
zvGjWq{K)Ej8^b8?ey;lZ4-3~go9h0F*!pQW+nlY)Dn%c;rnzvv0^!Vs{Jz_DpOuRh
ztMNT<BDF9okeorDFGb-n-vSmLLn#1>7YF<&^BhN=(g$_MI++wi^z&}a8fSUk9s?eB
zwdHvgte&)AtM{($ok|ew9baoq-f^IAP6($9K+EWtQ$4Rkq)Sq#C8B91<1GNb_<}72
zJO?NUs7$8OCrudDR=0G;)h41r2fxEK`u8g9l<3b~frgIhWYB~=yx|UmCY;Gp-j$5{
z(+YrGD5R_Dm~|HdyVS=Em|gQ0#n-1^KG*Xobb~gdxgT_PreZNNRz4@rIdbWJiv8aN
zXyVt}N7*pmZv|Y}CNLf57UX()iY&bq5gTodv)ikIUvE+HZ|*9r&ZL$(pIQ(Q-|y)+
zj_*puIAkuXD^9Bk^2*p}o?@lIw;j{am6wK2U)AmuKgDQ|&d(?%F(H$}2D^{gp}_4V
zu!#!4E?SO%uAOPiYO0G#6T1$>IS^j#D?=GZkq}Yr@g-DPHSr$Ggp)?#<P~${A(Hgz
z(DD|`VPD`%bQAg}nY-G>^GI91wT4ky!SH?few)`XlDe&{a3X0UdfzJXzPzcgj4x*f
zXZG`v;8p<dBPS#z)gvNlbD~{DuC28)Y?@lbSWhx=Jnr(KICG_5n_w~v_`Rb!Ubds#
zK<Yt;NF>%2no9B_1pNnmxY>82&2$+v@vv!F-^O|Dr{w-otc?so6>F97w8X#cJ`|67
z$)OAmP=Q5ci8cOM-L4vQAonv56RdIT=H&99FO*#cFZ|;e>+7L*md+6D=?O)`1}*^~
z7iHdFWA4sm+94;_dAXuy7y}$%?40_O{?W|smVSULVI<P|aQ_;+Cf4Prx+q_HBqt|H
z_tCc#8G%tTtw<Enn=!Uxv90@fBuzym+>1)*ED8#>2`4Ev|3a2sNnbbf7-swu5*G>j
zU~@mAG}*t#$u?#?eVDZct>}FFw4wLM__Yxywx%SxKt$i1)B7zNLv(N3)vwG?_@<(3
zAqTC3jM0-&Czd&8YNb*mCtZEdoqqSNgNCecqU)$0S~jr}KTeAp*yF<_etVRdS{0d2
z2=y#I0Pnyv)wcA<EEW$wvMm{T<WM8oa`1=M^GKVZ+EA(jT_?NcO1nf7sNgOvPpDwB
zfWmlvG2&LL%w!FNQhtauRHuF8lM*(sbS@!1J=1-l!2|fmx}2Lt?RoXnIcLnr%EdjR
zSmOFjfM@XZXFUS>!f6<O$&pq+CYWiMrBgI72siuoO)bpovD7Vg@-N~+QL|c%|7rn^
zY#52y2M=gif8}ym`Jx9Y6t^uo3Wi<#Cw~!~+n!;cES%x5qEvo!qSFv#?L_~~KyL5q
z4K-3DFQTUomzuF~@1fSRIx7gUwIwqmU}UzwElK7jDskAGedTIZT9X$$?s&cNA!lhB
zI{R*y)=Q4HRlf3c&#e67=fdyYnb}B~G$RguNrT^K1pU2r4P5XqDTknWTRNiV6Gz6^
zRMi|z(Y@|Y9(VXFG?~y7rMK8cO%<_`ppIqx(Q&V$Zxh~)XQoYkrk;Jl-9JR~<HG=d
zbMjaN@wyr~^Z*B=BfOnJuVP+e+4IC(@IzNat~;=LW{Hh&ZL#~KlJ2<eE5#s5A`%tk
zi>Bg)g7%I`+2*vv51;JPdF_cG<nSLrndTDE<fc%da&Py?iyJD@ZYde)l5p(E1D>`x
z1<*tJ%QE%PWwO!Jd_rjHF_x!J)jtQ^oIFCKRW}iCyTOa(T1xkDywHx+NyPeskYv1U
zz}?Bdxl^ZHWaQ2{tE;tzm7UX!L4zZ#fYBwlzRV{D();<oZ`LWP3sx(QN`C;=ZnAUV
z3=~P^OI1xXgM`=fu{V!|EisiiU}mAvdAQEGqMZN>PY)h^lSbx20zp>hyAPPFmYo8s
zfC9|8|IA=P=YLO85A+oE^syP2<Z$Tb`G4zH*=pMh<<q`O|LJGbhJ*}hI+L!tKrGoD
zr)ZCnRaX33JP;i`GJ0Y00b%h;uT!N=K40tfv?=fXHjZQ@(*~j(E}05uC@e4FYT%u-
z&TjQ*{Ujs(`7`%#4(d>80-{IJ_neFa<*RVcMaM+qQTeXGj6VYn?hUTsGpEa4s}Z{o
zBiQ6QW^P-B9VJxQ_qW^lAQc`MUEU?~b@XWZuec7i)P&)NiBmLrFyXe!QIuj?xumHR
z+#YAd2KeLNf~VHMdOkFJRFZ^(RfdkXcOXnTKgry>E;WaSX$$UI&H}`n(~c=uKm23a
zf=Y#$KoM|vBi9NW4ysOe%Z4JE^eA6D$eyFns;3B<HwR-4hCglZk4(?>(EOFKL9?V{
z_M}BvPa?=AQ)vE@I`)l)p?-6A-m*zXwB5UHoFxb4Sj2Y-T28?kEYm+XS{S4CwrPkr
zlm_XKF$$>c1AxrNL_TgHo~IA<8&%^r)u>c;{jF_elSc=M)v~nM_^xVN!nts_Hj>+?
z<;~wW2qi4MoRq{wrm{<>hJ#>vuTYTK+Oyf>3xHO6y0dxLU%OvtO>+t<Q8vc*fuxLh
znA|u20Gi+1-*$Lc@jpbrzFK%Ud4U{^&_asP20$1#9yRf|@|s{?nKgw&)L~+tTM|Mp
z&`?lL?K_21;{-II7rb{_s*oq<&@B319$!1P@{s{e2pTV}CvJC!caYGPZSlMLqSbrF
z*U_M9LMv`&)YZbW*MEDP`XLVy^cU{h$>^<(Nu^Wn!-UZp_(IPI;q(_@d?L?CT6-z%
zI@~_1U?bc_Mxu%>_y4tO%gH2$)xyBx?G=*08B0CMr}Wh$^at76PSk3jFH%fSeSWxL
zg~W5+g>XqU{(x~Eotc_C%cGE5=}j4#Hr{S~0}xU8Zasq|*;2NBP5sfS!(Hbh^1H88
zVyg5Q507N#xguFdnPzf{aGE{|4pU(4y|eFCaLW}H`OnVQlKjupwzi>?i?Y(#h^tqj
zha02@p6ux6@6K4FYko=)(3#X^bpqI*-e5oVsWY_8Czj+&kSmvmEKM{;Ru#sf4Hwix
zB#^ZR{B-{S;X@Tl!??Hrdn=>tf4Q-HH=25M)D|u(%SGM%cek||^`b<V3)Zq!6J(Uu
zRx>2+(6nzv?1RSJRx(2|YN2Cv;Y3=@GKFUE!)R115i5&|B6uuQ5ENi9ZL4V!*#HBu
zR~m3B@~pP0%|cV|cx2)w&h)IhI&&|i<LJ}}vX3~xJn=S8rx<WzF<<+S>!b2uENyMH
z==#CYL^31Qj*9IpeTbYnt6SCvqyTfCdsV?W(}&~qXsgIs5~UeUG*Q1F;|^G79A#YG
zqUs3bO{4Q)%HjYJL(`cJPcJyi*e(lRUR4-$3OuYr4ehlHM)oW|_Rg6FtNEI^Ao0yu
zQ>iw%=q@OpoL*cx2Zn+!k$SN}Tjer%-`Nik7!G7wux9QNEhJtEl~BaRHe>N$lNqd;
z9|P4nIluSbJQxHN-K2?~%+O<yx62!d&x#SnmGreYiBuzf%+JKr9sp5r+f8CT#A18!
z=a-nP)_JpP$X6kYS@_Wnn(KDJU@#?FccFeN9i~$1F>d5;bN^uNJY8DJTQ1}Vy^pXV
zdB^dklkw%vADJRfsb#m&wM>k7X>>bGLSUhcy0w*;627x%?kqF7A=lJh)+mPVdAa&}
z0&Gw-#3ck(b7jW@DebekJDGbnnGh$zOvU&N6m>xvcHI_C+EPGV?o2}asE9rqcCkdl
zb_iKW)s)%U8TO3?6}F4@`pskZyczxJvQEXueTjG9A5Jxn9_H%r?Ff<~7SO>aXAxwj
z>?1?!YyRm;jbcjjE@;^S8fk7-7`)B%s3`dqQg)?+A<_gLA#k)S)B!gXV{l_c@sD`X
zI4bQk8$%$Pte|=$p>imQm|viABvhjk5fCf!4A&-GrC9v^)S`fvgFosk4yKcuRRyIf
zq05g+&iR2sRBdvp%irJaev0k?q}(I5!O|n&OgNTe4yCGzdtyLA8iq><&zXvUqGBqs
zxDMBxMIUjZ_Rb)&m)fWg4V_SYN7OQoge-}?iG{-zLK%kODS?QjgyU1BBExz1_h0qH
zyscoMl}X-ye7CMrTdh8%Jt^68@{e?rH5_yCJrs5O;Wd)Vc^{SDsX4*cithL#Wa;6M
z`|a-DQ8Hhy!|Wr8LvP%ORuITBBYXL31N&(^<LslzYPIL-?a6BQ)oRp}5vJ>BZW!)v
z?MDb>|HO}Q$7ObA=UA+1Uo`6qm6+?I5_aashbL=_LgF*6f4pE1N+na?Yx&?5a(}EJ
z`OV!Admou-=Xvpm8J{3(g2vI|GYM>k294wN2?O>CKaA=Tw!nVBAp@`W3SUoY#3{r?
zRC<&O1r=nkQNWP}HExpoctNS~EiCW1#&`ohF6y@7wdaS+%c+@Mdkm-@Z0`H^&4xJ?
z5M$OKxu+JCQtMY|!CYG#m6^!L-MG7-!Li8B*sac6`De_S=2E%SyhV}swG=w#y*`JF
z4Lh=%_m{pDJ8<^PkR%geMYiT6RxIuwuU>5W^;f*f{ktgtxE!Q^W#+T2NpU);fI7nX
z$7B}w>W`u_ZZS;C(rq+3_6yDg6m1c7&^S`GA#;RD0X?6jEcEaR-K&+j%pz!l9;}rF
z*0%g>*b#K_i{2t+yqxstz+;=;zJdc~7qM~v)=x<@RVf!JT%QunsIVjX0Dp<+rSrCb
zCSp@*7grgr2vA*&uinR~Pya8a<abLn1CQU_PzP4MHQ~jyOWBxqMjTrl*IQR4<rCAr
zoN%pNom^Gw&}lXktXz<}6t?baMtPFLz16;??mojT5?x7VRu5gW9v8Wx8=nLCu|W~)
z06=f*pig&)O`Cxr6LcM?WoBkk*E(hHf=s|~rczSx0kuY|jgCwyu9u?L<w3)y|E8#_
zYH(Wju-ZBA)=l{ns?G#Yh1;L6R`$f7+}%dimcOl8?Nmj37vD#0f}L=2YnpN5p#NDp
zrCmv})gv3?08NJE(Y+#yNvLUQ)P?;wSZ+7x&X<?P7J|Ei5+2(}Sn(fds0`vYsTHG^
zaI&>R!0CtvS?&csL+9N|pb*|L^KPS}n43wMf2pyks=VDh5mlG6iU_CM*ZpHO&czxo
zg-r~G7ug)AOGkOkh}?q{8*yI+QHccJAhMX>XL#Di?)lg}CqR4BI@|;$Y(c#HD~>Pe
zXS`tCy<33Ygsu7dLry(V>x99LwNy31)F<6+$mw(LBy-ghV@pMuf)q~T$mC`cMsXfn
z3&m{XbV=+X-pz^@`d(C9fT@@NAzed-y&JPkRI~SXG_ctlpGQ1+=HVuxrfiI72{Na=
z*m%Q{!Al#BrF7ld$icz#D(23atTZuCnRA*7c!Eq86Yw6uh9utX1RFd0F@6S(4~pWx
zlz(5K%XqSut6p0pjIrNBS&6!$L?yeo@lz$h)nKb{{|jye_%<;F3&u~v%?yz9E=MwA
zux{L#ak<T^V16~}rl{R_5a7Y}ko*_LUBff;WeLK@a@W{^)7DUtNN|?)bp|`XXTN3{
zm#)DvL`hX0x2WUL$VXpBNSVKUer-cdr1ODD{%fABsnL)F6vh3ahaHOIrqmxVc<$8c
z_9oL`HJ*ZUgT0=jG`FX}8s{gb!1XQG-$=Z5-GhrAsE6ugtv8MSqPWeWC~o*bSN@Bc
z*s+GyHjKjFgB?E9!Ej5Qd8JbK(G&^Wy+~`50$1xpjRs|m_P*B-6jic;6%7Snlad~k
zmb1YIBdEB_)_+jk4ef%aYsPi1r$=+V8qD@Mw3QYm6su0woeFxQ5t^$?jifD!Ccc1C
z3}v6?F{IpS8&IxKlaeGWdcE=GdGDM}tV;vvsM_5h;=7lZZ5|2SKP*?Q#)KXBBFif)
zp*mWXa<l|7a+LUwVy)H3u({z#<1EuYhwi?K=xe8o*_zv<0F9lQ;X+RY>7E1&`@~ns
z0YeD_;2YUZq;W&T>!kj<`Q9@5Zzp*?wQHcw50Z0brQY_QNu!qRw@zOc+Z1PK)C#fP
z^hu&sR6UfL%5(V`RAHVZly&;9?77p@K@GQ0CaP+yzu+~d)#!!^5ho8TJq_Y4z!hz8
zUF6IpQ43mCSm$U%<9c@rhpxlumW3p04WxL@El(MO3Jg#Noo|lk;>D6^IxZ(wlbn-b
zTkDu^HB^F9(+;&M-Y6FLxEO4`$0maU+%;+}glY>~YD+0@LQqi1Fh=Txl_w|Atg=if
z7#5NBb=oQSnZH^l24hR9w3~!4O)O4w>Rq^Xe^4(e&P!l`npry4jL#isEOSRx=(U-|
z&NTtYrf<J%I?+erLT7JpE)bhllFrrUlQ0`oMtfFl2_L=(kd#X~V9cN0v1a;ETB_P_
z%F97n+<m^8NTC(>)7T%`KD>H$&u*A`eK|6~`M6JVeP&tNmMG23*SM_T=&@^&pr!IN
zP9VUx=d?x>?;1W-fi7<Mj8U{<nejx==4QvYFrTln+rkx!b~TQQ8^Nd=B$+MQi47o=
zzS?qLJQY^X8=2G@;MTbhdl`+{#?X8$D=3O23Cg%WOsy-qpVV-7o7Zdf-uMloBe{yG
zer~==@B@|_QDx4O$(P1A^QxI8I4qb&4mq`%s|>ah++<&qR@g4)`Ofhq`E$M|eWp57
zGzN+}?gcC8S)N46wpGXPZgaC*+4u6p?%^%_^8Qx~c;-Th;>6UHOalzn;=E6a;lX7|
z8NB_TrWQHBtyi1Sik}zr^u2!1Sv##v%9Yq$JJ!+RNmgZBG5+#Gmw(w|BG-JON>t46
zYWQ;l>_T=$n>QPMj0y`s>SPKue3z$x*7SYo?=KaYG6;Xa)^EZgRam*ZT#C;f>{McC
zg;bxuZJ(OuZ=)aEo_)qcu9sUmd-Fp8_sq*hGa7TW)11Cs>T<UY(1P67WM3&G-*Onr
zQMnI&*+VlLp%Gfoh_mr{&v731;fEckv<f|ugZj$XT}oughaXyGWUmN6lJt8nYjQ{6
zi_DUQ*!-|lqdhrhpK7vQZ(14I=tz-ehOT!0#2CqWL#Q=GMuozhtFP*FO+#ffojFHG
z!TfP0%%Sz>BOw}0g?_l&eAQtn@DVBF?N3DuR%ZFgW^RXPvM!ml8NLIG*ezg0p+0mX
zD*hG<<%Uac03?j9m>8MN94NquRUk(}q1;J-q1=R|WMJO$KTvK;5tV5>OP^suQ@P=2
zPxNfcwpOI@*~5G&lzYk9@-LKI`olX8!U(O>=}GdM_fO(5{&<^f6SK3{bsXOub;Nfh
zwUuS8%XLEC?_a%oNA)L8?Eq%S@p#;&^;ye0&B&9Fqt_aw38mDaB5j@WvEDL1=#r|J
z-cNbx59s!TdgvP02+h#$pQo>WY(VWq|9$NDzsSjO|Et4-&<zR+|7ZI@;LV}`>b3-^
zwzs!2>9nANPeVh)Yg5pfR1#f`xn5rc7PIMCI;$lHxKW%mmD`o>Ddo2k)KB-H2$2fE
z#nP!v3Sxt5lTs?oa7`o7A9hX_YYnQ^h+`(iVG-RwCBON!@ozXe%!IqQFSJ_SVjySG
zziU!!Qr*=4@mh!p(e5=;#rg+UE-uON-hPLcRmZ)N7|DE=HNlOVZ~wKy5Z^rkmTdOF
z;jsK9iV@$d8gLTX<{*}Ly1FMGKE83_pSX+}G^!5o%oCjar*Y=@yXbyL&<bZ)5L*TC
zsKoth4<#fR;bG!e-~H8oa|In#VHT)Fl^-a&;qX7bHeZtHv>lqYa&vQ;O-6p%BQAZ<
zBDeiz6q=|ERcu9m2qeaHXvP&`zh^k0{^y_=NNhMVWU*J1SuN*sM8fkFC{qs}Cu?%Z
zM2902@oBrEN=yT;=s}NW=yl=mCm2@U+t%VJ<e)N^@l4({%Y0OE0!*A7V-7Yp(c!p6
zDqo3!f17|VjlD*E2Kl)_U~O!IT%Us%dTpTaD>uW3?<47~{!h$`q?tsiypAd$9DBa3
zvyl|$YuHfX8okapZ`6OaSZ#I%*72A-`9I4D;X?zdr||C%{50Hto~#Zh*=`R{>g$IW
zz(@}Hf*2Qhe>iS<VpYy;GL}x6$!saxDJ^f4IttB&LfH)B5Stw|)mWB3Xj9z;iOJLk
zI{KeO`H|kt!pC-G9|@F;)V?MLzP=YYMlaW{i@G1nFag3CH#bNnnL&4e_K!AgfL0^3
zPN~^mbJE$;;lEvZTeo<~?Q^?@wcm6`{Cc3HdJ>_oeNrPy=IiP8;WYHiYfVNqn(T;t
zwQ}>h9QUL<*5!s%1fKsL!ar%*fc73ITX3(Fwd&?3fnrQYgbYkf4i{S@HY0G-$+5`U
zHTk;{uf-@{|Jy&MuCF6ypM?vK{QP6scdjiQ6o=JXv322gu&z*yMk2fuEl!$4CheDx
z=pOh_h70VOEjzH}HjoJ*X=7h8%d>Svzo?3eiuU#QLq`Rt?HbRUdts^M#H)pcFSL$t
z?gL)IO0$C2R5QIC#45Q#^ub`Br=4lfAb0^fvT`SA%m%f9JKR3+{X@Hyez#LN2fegV
zWrJ|uT}D&yJMNF63{Xg;QoHdrrnx6c5yyoNCj91|u)Gkr2sgd}m>=QUxjQeB?KqrA
zHnjmfM#PO^R7K^5zE4SF25~QZe_MmjVU7|{Ch&%@#e70m6Hh_8TGTmEYqipdGo|kh
zp=vS!cVBiqaY&KQ{bH;4;^IQR)&w05?Nf;JX2doPv&MP){Sb_!#H|_UbjZ}71G?vQ
z-1{_u{Ej1FY;v}yzF%ZV87H$u@$)7QBhsR|jgx)9T?3N(qp+gFH#!8v<vuoMqTWdQ
z%30Kn^rQ9Kd2uIdl|%%$nbW)kI_V9)VMD|(SfI7#?e8k(Md}VP>*nu<VtjMq$^GY{
zozI1S_-fej(Y@MlZEFhaJ%<$<kuE#eo~CYHtuWub#HsMq-RrP6M@-SQ^E9n^k_JLE
z*f5y^rXbmVT||S~bX3Bg*?#klV~L;>Nj5kwY2}LT37pxu+R+rb)6?pHWftL|$nysG
zo_X{QuFY}wlXjbEaR2d5DB0&?1yy%3ncdhx#q+}f^rb0@S$uq~lg3F1r}v6lWc~U9
z5w<s@FJ;$iTWQ<4tRa6z;F6f7!i`UINvsM`!uZJS6#IJG$GaqJt&l8kWS_yw8AMRU
zkrE~OF-ADM%~099-lODnF(!L;dFj0tfS9sGyRp51VX;Q2CF_Ktnt!mAKub4Q`fQ#O
zQ~L4=rF+aeLj}ZZX6&q}C`06!ZST}^H$+4S%q{mZQ7)L&$ja@=Eg#kcOP^57$gGxN
zThFwASl04F8I01h%yACN-*WTWUjqqR77cxhQOd6@uH02NE#qxL(tw*>0RkoQ?r|C~
zM%iIkE&xI_t1TW@!s-{REp?BT%LVK{&q$7XDNiNV>oV?olhaE$-V|`0TR`Al%&?t?
zqw`B_q>Xse8q{iYuNI<Y;h>(c>g8_N3>J5QUNSE|8I1^~Me0n(QfY}KOhq=|;JTZe
z>sGZvjvQ%Qpk2l;Ocx#ZVK|ofZjThmD=P8fQJ=nvN~Iy#jb!m>2>_(CUImXYJxN+7
zSsR$(cl2-HT%WG4&F2@HS?F-~cEJgqF1JKn>*i`^4pXE@fiQJAccNT%d9NSh@DkA)
z?-p&J=gUvMWmBnJ)bKjGL)}BnEfPz&0n2)~KXZ10JZHr{#_uMLr~(5P+Jtky!?OYf
zV^x8J`CpY{1+f_vFsKH09FR|K^o8DUKI#<O+lF5V*guh2QWt(l#_RWO^Ud?H*47S6
z%`+A6;O5Y2UdVW^RHREjhxBu6E=Bkb_-)O>HXpqAzkdTpY|Jtu-7^qf@HPfncmrSl
z+_yx*-AP-~wTBu-e{r$0VfHkfSHIcFbv{Zq^Yc8o!E`|stz0^*Mn18|;`qsRDIC(X
z&EwD`p(O$;DRK*Gt~?7#`II)Ik*^~5*vI8|H-Iued&xcJL6zMqEBN00t-8H-k8=Or
zu#Bz7PUGYG=0Ittbbh*&tQMhTLeg&C-T~yN4r%DtSg`86bR_5le3<Q})*f$c*FvD<
z7Z3le@cl8Zc$%N^u8C3ASGsP!;T5Se0e*ARFM*E45?!6Fj{tu5)*`j^ZHhM2wWnZB
z9G8#5u2x*fj|Zn&D_6IU>})Tl`_t^SgwvR`)*5?tJLdP{!fr{#^aWDY_-9_(`N7TR
zKhczD=I4(-AoTROS~R)ZdL~Woo-DU7&Ni8s13vU}eA^~~c#{O|(CFXlbGI!<I_jQQ
zEgV=^ajg5(JiOJsz26#tZGFH_5oLQlwf9Y4#=IS@(8c7ZwghRgD!yWROZll&Qst0*
zu`6|Nf2j3&5dV8{gH@wwofV1uXs}0_v3+V&Qg}D|99gIHieQ1je%jZ5?&SppBr-}H
zt9I^Sc%IqSsVU=qKmoYip?T!Yp{a=u4Y1!i$4fR|rW9Al30VDH^7b?IY6@~qrjg~Z
z9m`a8DQPI9Mdt5QRKg;^tUFZ)lgQ1Gh1-9{EER^$ct&NzAp)N3CXZm;>PGK|_!o5#
zk6BkU5uqnQ%^-;?-Q6rx<}sc1I1h$+@a3)U#2~Aqaz4Y<i34=QkS}x<9>cqed&UuW
zz3eG;XZR9(Q_1UR=)d)Rb)8n-2`A=h1n$rK8+{_BGbc0sk2_qqXo%+d-TQ07^u%#H
z>8It<fJuv&oo#zifri#|f{&L_*5qCX$9GpfFacci9#CwpquwZ|qdPC&dffH}<cai9
z`Hbl^uaz*zZvK?cTBz4Ia;Klq<Gjvs1p?c&?puSfIZP!+pGraMF5O=J!If<f7U1*V
zaDw{B?qzUCBQQkTv~HwL=d3pz6J=u{?ohsLj<@_|v>=D-F-WS_PU0rDaHy$JWpCB`
zsW+z4E-9hizP{f3HyM3t7MJ-@W{r(=8~8`4nZ?n}1%RK$hzQ!Dw6dPTl&U4HT-@Rp
zwjD-@@o>;ENVU3yiYe`3AJk}N{;sK{x>{wpy?&p2ZM~ti`(T!ZO)mT3y|RKj6(f>^
zgi3;{EObO#KiMJ&v7;#;JK%EZs?`G5>dL#nu~4U`l_ac0ajxB;u-U|Awm$_W*hA{f
zjv85x4EPhP#(NMmV1+1=w8{M~Z_>an$wL%6so00M%XlSB#3G9&eIC5iLV<iN2Zsx@
z=ywUVrmCjKQ`y-w;mSr6q9+)zlYz7*yapG{Z$~|OWW#%<;`Jjn(oWw!L4Y}RXA$Ph
zYU!fecMh3zt!u@Y+H$pbmoa{n9@$tpH?h}v*7ph>L=W95R~^8Eib!<VcpZ@n;l9R{
zgZDRs%l)z|9S2-Y@CHK2J&gw?AN{HOquRi*x504~NB{xJsc<GO9Yaj9&(2%t_sPHI
zqFQWmy>G?@oP_N6En(O1T+Y3`=e0`-8c&~fx*=d!*{g&1`orn(Ihrnmy^^7YqL}9j
zzCA1%d2h$`ehHX|`beSZdL)lgZSA>BVYzlM5~R}JBVvbo(Q;|FqmFU!6@!`<Xb0&m
zT0s*bg|@k%#A+&wPR#eB_~Lnql?q|+1Z^8Y2K$?Psnj+B?ABP0(641$^#x3mLo)Ak
zb@QmBAyJi{6C0!@OHAsIN}OeL?=+=Vx0tpD62dk_6){EL_*P!Z*yvagj9>59n7y@>
zR^TO0+R&`4Q#Y<*2tQ^C+&tdqqi~318)V>yF0IN8+K0!SMM-8<TV2p|J)3_yJcDbn
zN@;(;iMQAjxLaONsrp|nz%p|x(_t8+&-@o83J2)nAwwRVBp$C}t!^yi-ldP}XGq}Q
z%T!-c(4bPO@-wq%`x}Fyuajdb#;{Va@o<t@^uez-+u<MwpmQ<bpbC9b%-Y=d-{SJK
zYO3N6*802tqg16z<(UigfzG8=A8Ahlqd3YhAax-JsCUAF#@IFQ08|wz;`aL5)=-M2
z$u-Q`22r>7lE6aG(yTF3LnpfOD5@OdfslV{ecDboyS5fD-jgd&GKVO=Jf^mcRiPZW
zHOm9uL;Ptz5mj6M%)^-eG74&OddM7ym9%z33G3wjx%;YY=^{wNattMjBHS0%%cdpJ
zhT;D94T8i@szD@=s%gN4WH^h6q{Pv1@UTHclW>VbIn`keUuCyRHRC=K;5hO*Gd|Nt
znJ2cJR(5LTL$uTRB2hED3uD|XF|BRWmyHGQ@ij0(^Y&sr=h+6sizSY2Yf#%Tb0YxF
ztVph+cbBOqT0&6pP*+;g$$vqI11-cxiv+SK#E!-s=mARRo~G{G>X^`Ceq5Azh%4Kv
z?DDa{A7(?>kV1vw=v!<oH5nb+v=qWz^EhH8fy99*UN})!H%4eRZbZ*Y+}61axgWAG
zy4O!3KUbXQ*=>O4>Y)xcBg7+C<ekmZbR0oz>)_jErwdO|GxgY1w(aCD-^a2>6ZO#=
zoV`AqhlAh_&koP^$@}5NRVT$(vP=EFkrYz3=by;agugdI$NDy_!uhNT@Sxhdde*Q`
zx<b>9pXSB~L<#!+Le?hGo?p3R@%^!e%qnokA@kU*jB~Z23v{;I+}8c&7NbR6XYOvG
zBsLTVFGJ4u)E<47zp;G;>;ALzNRBybe`_*cwXDsw?|SkwzDH5ylY~xv_FQ#B3QoZ8
z(c;5*WU!%~%Ue)*$r9}-m!hVn+q1BP_7jjb#y>Es%J!1G8(%;|$(UNDa*MS$sCa!~
zB<3@JJENZ7esc(rWinB*AM}>o^p2!*!5((e8_P5&MIc+)g!Q~7gemMXlf&fq8~7~D
zF?EvejFu%2+RSr}oKjm08dcGinBCl4d+G#eIjdG-jO6JtjP1M0Bl*Pz=fkp#%a`tw
zVDS?5_JU%Q9M4yyqLw|Mt&;p$onyLjWpTyxZ^!1eQFlo`L=~de2Y){M6_7Ayy)+H1
z9mkhnwM1>}mvpssW6Ejx@|D!%Q!i4FM+szcRD0|@-cE_d$qF$~7@a%zXU^GqJgdd9
zuwxuU2=)L*-wKjwmN`%6>q6sSrnd6d)BdcJ+Po`I+|c^D|FA~{uXUfVkO(}%docnH
ze8+Vi$Mx6R+XbvB=BU*5tj<Y>P2EaSt_@BLO#~^fikF|(^eA(K3VvxK@cKD6<8EHO
z(fQW)en-;zZl7$IYmyLklQ5A8b+VRh4C!_xMx`ulP~W%xB1$OwZ1+Rw6gP*0PRe;#
zU#o?~9ZU6cS)MeWblAlJyaycGyqVV-E}u2O3E9K<SSuIu-`P|jynhRKKR=E75O83)
zNRmP0`v4+A1fENp+__&>CciyC(*XR+x}!h7-rP?^cI1EWbGp!S@19y#YU^$_{lU10
zY5`tmr|&iiaKCvtfw7OV+6>xEElM)cdfU>_;lAVaIQFFzQ3OFQ>0Whov?EMw&T_Hk
zILUj{9bLQadX2!Vk>=>KvuyWB6VPf7lad^nKhSuyIrOeSBWd*eow+N>nY~<X^;2p!
zY02HU_1crC`-<-DMV++}HS?<LrY@R?+qvLj+*N+aea{ZV#jPUo#jSWMHz`41KeUAn
z5i*+to7$w-w=n1$4f2FM!VzUz9dn<bcC?Z76Gbh~ua@n0eW(R%XNunWDZ92QSg<x5
z>$bQ%tjSeBo3LxnSIG0Ncths>=BuF+-{Ov!=T>808~b7n)ENI^-G<@`4awu95p{bF
zFRiy}mR9>ghG5IHDt@i?R>LPmo_0GEGq9m0fhBt;B4A=|?b|?lvM*OuyT^VcKVz(I
z-NzTx(O?<pbxY)kGeJz-Ovml3wlm&OZS~9q?QSowfT`06wX@jzQ`nb_h7AvENY|Y3
zlIuhV8Y^waX{ppD-tLB<B%Ixj9O&pe-Wa=Ky5o>}spp9Z<H%`5(Y<5TiRTg%Ak{xD
z*Lb@SQqq*u&|V^)`-#yO6KrLB7@=|LwqKjJYz|S#nNpr*XPHqwRQk-{*1Px!r1Y@N
z+<eQ;-r%(8^&v89YT%ITFvr?D2ql)$)+fw)C@(&MyKVBj&CiICtrt-YdvYgSi$(D?
zN}H5|vXb_O95piZ$s3&I##1=Cy6t(|7BeTIoUf(UdQh)&QXPnZ>$p9iy59Z|TDoX%
z9YXf#Lb@7eU<){*Q1cc$LnlWswilfXatpp)P}nEY#}ct~;)PsSylxa$mX-o0FA~=d
zYG*{nADh0vSY8v##UXBnuI~*ekSIoI>K;TW3f~udk3Emg9FDtBGF4a3XB8-itO<vs
zb!w1ac+x;xK7vB5CdkZ|hDt1&ai>2v+N`3SE&PK0teEM7l7?C_#tm_)#|diDU6FMB
zI$eboUz0yK3+%_HP==?%W9|~5MqT|Rk<wLJ{;Sj#XL<Qy%b9z_rF2vZYyqQqVM%SK
zk<19EbHLY2_p7YLXpG*aTR@t<SkeDUmi$4Zc)a33p@8UhgCUw&Ug_Qq6%2Ex{LHH)
zTwrtJL70^XFAb2f`WGz#j99SXDiZB91n6Fvn;JZ(aY#wgL2gSU9=~s)9CR1r)kY7a
z(OC+`$1gUM_?2<ci0oJh*Z-3YZGEB_4_NT4jOTh{%%tWgX;@ftkZ-?D)<Vh6mo@|4
z#-?OQMn4OOy-Ceda`^ph*u+w~t&RJ$YF)2f-aNYM%6-P!ihA{(g@-xU)28KeOPmZI
ziOKkh<J<j*=4?mrA=nrE{$S6n<;$gD{6XhlXt9;HJ<2=Q%+qv!E##_W{`|_?cH$t&
z=`dsc<zhPe>6{yVrR=riqV43_U|b$Gm-^NO7yHWzL!?beg-&bT))+T+SY>Wf^t9NT
z+jG|KlA)^ek~!mJx+wdjf=OC<coKQ~#%%Rj{=Au!VZ|1?hTlvEyEZ$xD-;>|c0oen
zwvGNNLX>?EL)mLTIGXoq`)s{A9`P0PprIKF+X0`8-h4rlxdYmXZOUrTNuloZ)K6_#
zxJ+(Rxjr%apJiyzz4Ny7H9m=RHl>h$+Lh5Di2wQrJ*DXDQH^ue@D9LLjs$l0)!jbZ
ztuX7$vhKY`1@L}UJ+IBX+9c)^tb~k`s^gmfb{FLAG3sga!4tGOjj(!ql(DWhEW*A=
zU19ol;X;58FrzU4Xp=7Nb2-+X0DMnQ&ZwIWCkyqe$n8&c5y8I_bA1}eu|*VRUr?@<
z(#3twV04>zyzc#-I)K|7$%+W}GK8-UsBO8&ac;Q;yb=6CvR?6skBf90gDj6hj<8Ri
zVn34Jv-@jUlqdSKsZ~T-CL4Aj!3Z6!Qd4Vc>o&jqn~-4B&?{bbtuqS5*yJhaypwEO
z(TR`gJ<+Ofd|rGleik0>y70Is<WKT2^zkgj+Qe|mnaXmGUlG+SzO2}X{PF&rnJilt
zDPi=2pa;TB7h0h&RFx}eJUa9{1hO|qSIYO3cN$ReDbKhxORb*tJKQd7y-KOv=su-M
z4X2)1L=eZ7+Ypsysq|A|z4ODyRjFRKCoC8|XE{wfY-G&RY0M_cLd_PS11RKv8BFAh
z9=03MNOH33P+VPJj9LyW+1p5e$I42*`o!G;6_WEVyIQc7haPpsMK6ibc=HxdXC3Dl
z15ayF>BPgJ&Q`R@JHdN^qV*E^NA?M}kGeTQGn$K=zN6N(9V)yitO_K&KU+oWN3&($
zYGo8!Z=S|@9=PpKFMDXk;MMtwU^Y&{tTTp4OZuskyg>-=SQRYwCacXo(LQ}b9|35n
zX;d5>IWVC_rH1g~`rZY}>c%QhUPuUe-EL=>Hd(-Dxf=LyV=?9dg9<z}I9Cgz=3GG8
z?X`u@(R@nVWu7j`LCB!$k|0qYydXLgv;BpyeIZ0FRc}{)j#EnzQeu7~wrDOTpNJ_x
zNH=+CX0izDUOsXj>&dpZaW8$lPdFZ`Icl}HXj=cgDx73Fltg-jz&=_2El=Y!|L;vO
zFn3+pC<xXh`g3zSn`{cYTg1~`0_v*J!i2-dv2RQz-k2T?VM#K8G~JK5KK)&e8d9l$
zJZVJJ0E-1B=cfLHxsn4c1^X-5tIuK5rOgi+sD-qm?D93}yewU2X3j?~AmHF>c@sMe
zf|R<tOz+zM^I_Fh&!+!es^=^`TdCzj8N#hp6L4#@3V>aVd(6$_deMjv5mY{Syx%KG
zg76f=B5SG!u$g*YAzr~SHC{u~-o}+Au0pEzj;uA;I5%UJcw&uml-aa>L7!7S*@K;v
z?3`_1(6uS#S1u=_Ro~GQfPt`p=M@~2{ms)BmNXSH=fJ8H&u;q4yUlK}MXYNK!&6Y3
z&3fI##d}0BJZ(=)nMwzjIVPMcm>zlhOxtyz1liHC?W?7Vt;*Bog%1|bDXm5$oyRk#
zhCm@Y`nu2K+6HY{BRC(?c2YCG`+a3QQ}`yY+v%sEw#KI)DQN4H-?36E-(^9{cy00P
zder$=?$l)0vvj|UBlvL&i>+Mqe8vvlPB(X5?`VJQrJzVj{CSt^4h*(=Tq`-g;)V%?
z#J!aR)K%_3s_%tJv2YA5zAQNuZPS7!fFo8HTM%2oPUd)4yY*ddh%du-grEH>iEHbp
z8zfo1ccbn%XLR%y>o2vd`(mQz8R?~#R4<!L$NMo6TBIvult0PCiUJ}7m^}9$yGrZ8
zG}`trTgN#;%O9gaSmZ5?!qc>x6}Zn~MilbeqwdI2a(wVk`mKjJt!p*(9vk-%UGKZD
z?GCqx%neI&%%Du*4GyiS!|iF}>iBvC*U`zN1eja+A~LIWvOV*3&E8}kY-6SO{_*ah
zzR|jr0B#K`|GV%U?J%TQmIC=e__I19HE&Xob-hkUo_qmhPBB>wl~Z5aC#M#%PO4GV
zR?h&JE09uM4be-u%A%d+gmr%shK+WmOqPJsj~~_W9p8V|sphNk<hfE|a*Vb*JVfB-
z-F<)meU?q+dX9F2eGY@sy9`mDLd<*-NTCu`UiYge)>_{kcQBKaEGgPKC~i8)rN<Ht
z=HUT*ubO4r=A&27jYA?OiRp?Wv~h%faP)O)G=EUhqFyMZ>bo~MHQ^y-tr_NFH-E%1
z4{aQ=R=&<)+J9CbM_KhKWoX-;4Eau@1(}f+2Bw^Bv+d4!*D{SNZ-n`%qCMI4^uEZO
zXF6*+r{3k%w8DKVtUwPngM^wA`5hGV(~{DVT~tS80ACHPXwGal;Pkvj7O70=o0<!5
z`;1a{HOWa+Mq|uv29qTq7ovOknZl)62cO?GcB*fn@Mh#ETwN8-`-+bHt}qL7)Jbm+
zs0@cxXeN*3zgj@sup1iQI7<&YTV}R!7m1tR!a8Qed67lhd_3k*QP(9a&XIp3dS-jY
zvw&+_w$NMDN+y=clCnGm>LjH~^OA_GR}iK3=ik4PoHk)go7I(j5pKY<Ne+VW;ho|&
z+h7la9UB3$c>%eFI^v4V+no$kg(~O9{(}ZG4Uaq@pQ^Ha<5_s@iNvVL$t6FL61vHE
z-}p1zGq@qqEn=c8{fM4AD=YZe*8Y(%aaCCDa92PbFa0b?9A*_TxtJ3Gss7!0$kBC;
zEKjR4ou%Asky?b>??-_PfhUJSA&HP2!d4L*Wh@15W0<^ld7sGh^<l2SS$T7RJZ!2o
zWwiO5K7j%2^cTdKBU|`&l*^$HsbvU#$jnD?OnKdsv9y)#_mNeEwfKer=Wq82JM4^f
zZLbs7&I+Xp!)$(Ta0--!B&Ve6G{%i@Zn5I&GifQI*wa|rPEOCHe_`oCIwWg542F_Y
zB^A^=Gb>id^t#OTD27b<RvFw*K6N=M-tTG>;B#JXYRYSKf6IDt(B0YZaNl0v_Qu~;
zkj0@eje?aWoTo#oe=+}|cQzM^L<bbShdN(aov7=AJK<y5`}y3qN_ktr_Oy1NadCI}
zbq=_28a~M^RO&v#EWarf_3qbLe_344C8f?a^;v$IqF*?8zuT<0GIzCuaC@z?$>+L<
za2xFz&#idRv-X=}gy2m0a|Z`|OxEN@EkO(a!W<ZRY0T$IF|k>k3a|+B-m0hX!U&_$
zEWlkm<B+b2|5Y)T%;>)pKgu!k+#=lX`eo9X9`D}!xTH#uWiOG(?uC6J3jl6GHcZO$
zk%Nf6H1pkE4*9j<`~2|Cvv@o=vx`Bn<-I`#ZQVvDzIYurOq5`*)B(KDPvc#)3^7xD
z#-qln!15R?_1o?bJmKly*5H<R?@ou#IydDgx<D5b#|}oMq_;>F!lgw1CI*cfhvOr#
zqHi7Fswk<Wtj5w$RE<~T&JD2V^u`|Og~xh(VJ!Owba<69TOdpl(9p~cwWQNEtQHwx
zs@4e$j>vj~$7GeSf5B5$JN_n5B?(OFS5z7@%|sx$+VPhuUXB|+bnfnz4y96^igiIL
z<XucV^Mx%FnPsdGC>nO2YUhidX83aB#ZO;P-+gVWT-To>@TQHsvO=Ch&A_NCY4E*u
zdT-qgg5+>Gmla#bq#kjMp>dCrN5xqG&Uf{%rd(#db#+^+z?slUbu|s_<pL#o`53<1
zX^->+gcNBd3ofg~fj=6pAhy}}u?0c4*baIIUx$jY``;yTS!t2>8q|FvH!@^Z_amz)
z(W#KFJ_=1T-gy`b2}~FnNR}q~DuS3{aRT9fpe8pqsX!50UK7Cmrlh4>N{%%#S4qX@
zXz1?|ak~7inlw~+>!xOuE`~IG|0I-=J_na`(}+$<(nJXs;VIjUQZ=c*cVuzQApqy8
z`~P9@t)Jp*wm06qkU;Q2f?IHRcM{x#I|O%^!3iO_JA(#yclY4#GB|?`KDgb<d(OG_
z{TFW4{dson>Ds%y_v*Et=d+w5@v&$o-sfTZ*pmVbKT5k-%H%5#eAb+TW>80mtsEL7
zmg0nw<0e+`?N8FGFJQEc4l>o`e7ROw+Y3a%&SfSYQ0MZYPE%(wuUw@;?`+g`dqrMf
zv};O;GLp`P6{<4Nr;aZqH>Bg1*wC>dhY$4$$%Ly?Uk%z_>8^xxX2Gb5ag5Wyr7+Xw
zJH&cZ;)ki6x`-Rn#IvPF?BAgGwo6_ZcA=GT+jd!<u}sv77`V7N21kDsSl@3I3GH$n
z=jkdk5Zs3#R`dnOgq>mZz1HeJCa7O6oAJLIt=>}-hRvFg11DdvJGYdUvcdk>EN9j#
zSlmVwrfYXoIe|Q{Cl!!1$u?o+o6*!VZ}B$Un#DCQ$g_s-*z-;Qn~dEEC4hr#hC-v&
zhC`z-L5s3;?RA&`YjL<g0BI+|+i(T<Vt9BV3sG0>73J86>~XYJ14-A>gyxaB5JQ+J
z%@TF<$>H?)5tbC4hr*b?qQ{2LBIZKD2e|tFq_nFx4)-%WguCwsg+aHqJ9WyJ!yLYd
zHVMfmEVYq~1_Tj?ntx04+}zy4!dbIUk|pvX)y<B7E|AdF->xh0c_kt+<pwV_8vw+_
zUkeEBf8P@JVMerXjHAJ`zrGA=(llFm+@3To``ZxMN5~(o#XB&Pf%^I_1!e7bID(~v
zokbpy#9J@niRcS5QuU$cG*)?xtYOmOekA``+b1#8;G%6A{KWJ`JrT&u9`_&~vsT?m
zk#iQ1P+ecZFNsY@=^22=8Pzsb7uL92!sLkyv#m9nr8A4=&3Wv@Q0%Q{zV9E$;(Et-
zfYsOsFd^FkJ{~K6#TLA=7g3hrJ6_{Y=Peier=EL9xx7}}D>?nXBiJsQcoth3i=F+4
zlj_s_%YNc2QPf5jB<`6=t?h{9Tz)AG>ffn4__Ke{IE7)CsQGx2IH5e+JpxW6*XtuZ
z&p#ov;v9@{_G4jgZEh2Wkv50eeb%17P!dBf5$mC-oJyx+<Kp|qf*+8ArT6g)^Mbdg
zRq-9^L#tQgyAb|poqnT9`fjo+OY2G;HW#=cU&}))Qt2~HBj@l^go>I>;&NUu=lS{r
zf+pLr=%KJ}lHx6wMx1#rYLeSPZZ;}q&8O;|WMrrf>BXt#A*XjQ!UB_x?E=)^)`CKl
z9X}iF4AD?sGkt5QQnM7MIDppe<fdG`@#SLsIQ0J4ye*9mcFkZUE5UAEy4M3bMq2sA
zEH3q*A~R-rSR5OldQ}vxaBbDbWE`#=5@nSmy$4Jr2QcdE=SQo;r?$8s?)ACwgD-o|
zZWIl!Kmswg{)6TMPb^B;GF1#6ZUe;FB}G2UIAszcN{<wSKMItE_N^Y8<a_odWwF$`
z=G4nH_l=JfWZF^E%8x=~=n(Aki#geY6HfQzu($|39|KS33yb}<IU)?3FOCD6C?RJJ
zb!d+2)4`{@&A6eRFDC=ur-Id!;?XAp?&e9tw=AVkhX;sjNEgX7{yx5RS6)LWEAckX
zc;S!F8(D2`*jMZWXB$Gp1@7999UEOhg{2d@h}X`md0*w{x6}xml!FteRKxH@n1mgt
z+oyIXu6Fy1L==X)^3Dzux$&!kPT8v|3s}zJ3SSIiue6N%uGfF2*NOCO<BpD-5Z6^k
z+)<}RfPQ`Jh5ED5aa@wUg_4fFn{_FN$GbZD5pJdwEa>Kt=MR%p9|HHhwq?uufnU^E
zZH`corlIZf^Tb*3WPJU2*vn=y+lSn)LqZ;^J4MU5(+0T|Nl9MjjOSnSKiO^|0dJ&U
z^zQ#b4~y(rYKay|ScAN^Uz=^aJ#TF(`n0xb@0T)gAe;7!L4Ap$q&Mwa*EM(|dg7mm
zLE&n^qiBkn>T)yxL_TTUQc+X*%1ko=YfUig!DIYwc0-%nzMr`w7EExlpke8@LLOG)
ztC<}k&(`_<$LC>R6CIx2`%2#y#uZWUz;-_!Qgm!8q>+D+tt>w&+QNo8mZJ(}8@VB!
z<#D9{%|Lt2o=r)d7w#hJu8&jl?^-B`3)U(PtA0C6M{A|?)reMcTYqnIw*n)DVJ|T=
z2S1I2DtR<<r1;`<fAGye@eH}!!Qj?QxDGB>lQN!(&%A<RC>{!KeC+K-RChRG`OP(S
z%LlwjgV@MAS}ixgT3E_hyl}<_WuSk$h38ziB;Gr#QiV<FX_@q+J9@2RJHarzV^U;m
zsMYUm_nDQl+Vl!P^7&+hE-bv@KJ#m=q;#|ov}$qBS)e~R*-jsSgyt_=$-2pL4OnmV
z_<J4WwfLAOHQ~I1HNhs{{#H}ZqLakFHyu^Pg?6uHat_J~_4n-o2PW}^jf~rTrD-8N
z$8ZVL8F%L!{x@5~huh(2l?HLpYn+n}H9aAZJJ$_DZw3;>o`(7M;Os6d^XQ+tP}TEf
zsq(pGI+t_LU-%rBeQ~=JYi1{-UH&ePyumC)I5!!73V|9NHDkGEfN_vTtLTH$jO+{7
z!|LkmL%_iBdTDBthw#?P*rruwkhaexT22p3Wt+a|cw>xJ-J{kkQf)Z5P8aVm@%PfM
zCv(~lqLhYRaxX`n36v;XgdM^7OHV$nHg_u`ub`?I;Pc@UVoWXkPs+n?XRuP??ZylA
zR;V&zjFO<PQd>}NO#ESR(vb501LJB7&&EgY%F%7Y&YOamTi=Y^T7@5fxL_(qJKG2s
zs66z6u(D_x?V)elh_EGU(uTgVsng~7`RpwMy#8erfi=)XvoAVEdI3DCv>dlvewBb~
zOwSh^g5*Wkn?$-9d&qgo+!jF`@p&sV*)tR^w=B6B2_xW7DtUElw}}bpC}lA*mguqt
zWDsVHMdPZp_#SsTmZ5KO6N}-Rfpo44O3dSWYPL<3oOO~8QkV=OF{yRne=F69QW=^_
zQ6P(ZOU5NI8B|EAIGuH5Z*^G9k%wD}<W2P_uBnHomJCdiDXFCVA;8ebPQ}{LJ|bBP
z48JVBGEKkKJrV_zVhv;=BkjsN9S0v^e%qPSOg`ntSP6-w7>k^5-zM}4XRhEBSGA51
z7t(8rES{#?VIIF;Hf{!04y}LsnBZaBm`DAUX{NSN%4R3}nCC)v=HgUS$LcPMc7!0k
zF3mt7g>s;bV3|i{uEA{p-p+QZXSV5aaULIn=Lajw*q))ZFXs)7mosg{?ZsE)O}$5R
zcN7VFfY7ECizBwsN$68w(W&5hzeiJuoK^j_&KXe^8kNebI&cJOoRx1vb2|XgH|D(&
zKqyH$B>Jqvgw7&2%aZMFcMccF{5*lt2bSeBeQxzirhGW_yM3<!yw^<UCZ78=?5lXi
zreo|9ajMrro>2NZxmx?`v98mHa_y&z{~7;thj820#x1*3v`L76<MP$>etcwzY$Aik
zhLz`G=EsoNL(Hpf<Dez8x{TldI9b6OZ3$rS5PGti{27x=sXgp>(!7VwJ>Q|{o}NcS
z#k-+*vs*5dpEez1ocr)I*W5SH8maUKAp;RzS#9X(6sMwo$fjE+E)(JY6!huDP9wks
zJ6$H{JkP!7XNuR0nboal9A68U<rJ3a@5=^DfYqv-0zLjgGr42ywMiG@IkRaV>q?qG
zN|v!Z750PhWvZFy%<ZfFute$F(%Su>ol&?xv-VYm+V_rQNWol0*_1~;M0(;*ud5v~
zgB_k(93ovT{ke!zoeF{R>PHd4RXg+K(6@4tP!i*|P3qKMinP^UMPcmL>~Ez@`{C|#
z$yGxVj!zHEq_ECL7lV^8{3$l$OoRgeI6Q$Pn`8g*WqFq7qyqI^9sOAVnI!ltEf*J2
z(8-CMYAX>bghx9zmu`d_6V3ii!G*bojR`c)VL*3G2D(QUwR<ugthKSRlp%#i<!3V#
z&$S#y*%P@g%LEkDbz>RcBjev#%ON|cd3cs4VY`<^+@>EjTTQ*`gTD?#5Q{Pwqm;u8
zq)adyUwYy;V?R3kHt^pARB-jZtU?Pbm{CYN>zPO#=oeI@!xYLAd+3jvP__F~oE=Sq
zSo7)CzwGw9cIn6<%b!y|lWZ;hFBcGtUIwCxVDN}JIar$?aAhX<+ZWXx{4k7|J<mxb
z%u~}xKv2ipBZqrg3+p45BWl<sh?na`vIa^Yc)J<qq)P83A{S1We(cOKA^S_!Hv~>9
zzn*taT}&6>x|_ePO`grr`Ki^0btz0rRXgpnSe;oTthvM(o})iFL_F1qH*~|=-O<6L
zxc4V%Kd2){l1F;FiNsL9FhfNNu3dxTqo1yhGUN4%9e0stXY;l|jGbSzWYY2jT+u%^
zYomi~r~E!{-2X(ssR{qX$L;W>$kuV+#d?>%p08{WvKKlk0=Q7Xmgu*tTNWZ8m=WlD
zg@VtH3gtWkxd~iupx59kpM(lR8UV(#@SN}O^HR=MgI(zW#@GT(fJasATUE!mVywNh
zSAL&cFAB<D%}1j!>e>BY0IGhZv<9lFig(n5X6eP1&cr-EoogVHlr@*hYX}BuLwnlg
zk&n?vv^$ud`}JkwHp`%J%yl!GR-!e%S!^EwIy02+480QD(KgdVaZXGXZ)V4hD4Huc
z4reF+Ds{B72l;(;;jjVxXQj2-3fbB-3UUA7)a;a|m!#teI)(<c`R*^-mp8aqw*=?=
zBkGTB@b+XLW*-@a3vN0DT|>iQ!u=bHyB#2{973G1$jLg5|05l~Q7fCbQ&|m*<+2~`
zrE-Ruti%xz0wH|D<g4btt2g4<=5{+<2ic`*iEzZz8WrXrM~8{0qSv^@&_fGK0+A9_
z9%pD*Jba>GgamG(0@Tc@)*Z<$`)(vhjnsGO9PeqK2OR`WLpzJJkB-fvC*L~InbFD=
zm`IA}K%U{*qzoWTqGY(jT!5=Iw!B|a)G&|g?T>&{DG4+6QmMBk5zOP9{kFdg`R5Lt
zZ*2W*R{7)PT4?~n9d5^s#66k0<)x@WWC%C6A@1{`IWC{?6u%bRBYYi&^!jFod>#Bb
zxndK3m7CDX&Z>*-<lZ2eT?#r4{T^tu{pi=mwa>O0w>5#w(^!9MjfNfU(7gI#&Aiu2
ztB<MNsvMb{*Dlj8n1}~nGWhnF1P|wR%x>-#0^fRvfbp%afNtB*XR%(X7JX-_;+#`r
z+lXTJG1HMMBGf-WDGRuKm`lfKv7n&>3#0A7Vfr9kJ~i<6@q0eII;~W6qPV<o)h60A
zli@`=5i6}{Q5Zrq;b-NYfNP3$ZVnPdfCD!ho;juR!(>=zU`<L)AHvP0a_OW5V;U7h
zo6PtVA)Yj+@L6~It9{!y*Tth???s^ru+uC>nN2;P+%ML#p=Bnh;o5wEa^~Rly+-xm
zQ-)1A9O6p*1K{;klT_+?*bx?7HR$z?b8+JBH=)Q@fzyJ)O)<gi7<?DHh_~+j+s^ia
zQTJCZ0AWZp#tY{KC<oB>8O~{2X@AMT>SZGn@a$h!Z`hT2pBHB?aN=-To7r)9WYe5o
zFZXh>lS({ty*I48OkG^&vd=El>9_?q42%b7&sB@~%&6RU04Bv>AI91+{OjoME@-kH
zi|UW7Vwy{{oXl@mhH7DjuF?wurYaJJ&d{2@7GH}Yv+g85O_&x%^M!%_7yedPO(Vc1
z1++YSS?(|%XjE77KosKM2r)yjOh~K@e=Mx8xQ!L#VcVnZs9GDonP%1zX4CNf;%O(L
zDVJ?geUd~KBdCSHZnS9E@Zd3#K=4IRr{uU6uLBEo84m5r{PtZC0qkjg*ZqCWA=U5H
zF9pQ^HSyw9TE9??8lW|tc?6p8aqU4zL5YH%t=ZGr=%{14N4R8oL-2jFzv^oj;{676
zg_jCYxBh}<jWqhtN+!p5S_JLiOZ1<9YO_i`5JPinvYMPoJ-iJ436$s)8|&zx*y{nz
zDP4EgR`g+6RR8EV>(6d$YiNkz{*K6ail#LG?ox5b)|Z%Db8<qc6`Yi#ECbVhtRO5S
zYiWM0D`HVSk;}8(VLkE7$rSEB;b`q=K{UL#&=H5%cULkzM!ycOK2-EwI7KhBS8rfX
zL~|LeT+a=&t+r#N&d<{^NFT-Rj#uaRb+ZcboEqh<i^zU2gj2L1zHlPM_U^+{#ZBdc
zkc3fN((})GGId-@HGTVDqSdM2J)`|RBXX)|8FLaT<^;J+<=Tt9?Z9-AKo2{8CXw|?
zG|9tTg#B+^O%1N}OSxKFs+udH5jCxCo+byMTB*F`hz|DzD&B`;aZS?F^dswzc9w6Z
zjU7rNd>=X-^W#_cO24>U%u0_ok^(u+_ROqHHtg9_QE^fVo#cu!tLSEBA|+1`Yrkq{
z?fB()=G^EDahspivyvQ}j~M6Dszf6b=9ZVS5WmM!w@6VZ^$uWb5`uoy9m9<vG*lE;
z`!h6ktP4O>MAhD|JKMO)iw?cF-&4=|h+#+(OuX7=$;3*e!uA;EK};RN(X5#_p~&gu
zV)LrO9NnV^9NhK^DM3NIZV#8uWo}JdQq+BnED9^G=Vb@66LX-3Jf9mC235_7y9RvE
z_RVYr_90wB`MeCgXXQP%D!rxy1Hf+ten$?aJFDTp%mJPils9x6XG09VRd3Jx*Q!nf
zvR~s5`(XtvT`qk0&2w}}?&1k4=dX|?h^+&DE~BhU(3(4V$h@c&C@jRCJDx#BLc?c`
z&wO`-)*3~MZ<SDW9h0oS7Mm+Sx5Gndm3rtiXxFyUCGk9tz&A_nlFfB%NNZm@0U1v`
zehIG(q+YpQ2fU2CKjuof{OQDVjautuWQFV*f*k8cZV0_dgaz*~+-Sr;rd1mzF|}oS
z`<ma3-|AiYqtE^x4BD9MxE~N(Nykk{c$D`xk?MKseK8E|VO_=zV7(3<elYCXgQI3Y
zIVoL>Nk|Kx?eg5xnid<m$DKrf&h@`_kg|I7vk<boWs*FwsBcIMRFG8iaU8=L3*h_U
zaf|-E(0}a!Z1Qj#-VXD_FBx$^)ZZiRT30%Y4}RUMQaaFh-m9%*-#Zilvu3GPE)7Nf
z8ELbf<>2Vim4rF7K81<<b#1_Kq@_GPKOMSmR#sufqkVFxPT$G+oZx*!9sfl%`EenE
z`p1^REN|~Sa?g{A_!uwJ<^UAiDIEtN@5PYYR|<jaV_2oB{Z&BZkXl>&=1!^eLg(u2
zAlzT&e!MOKVE9*6=Xd0-r0?^PXSmkzxqfK5iO@dtYK4%+_Yr}4&avm>r7XtRW0qxs
zCBooPn<nblZeeG1bhJUMYgn?Nf%0&+73Svm)4{ZK5KH^aj_XZ>JyGm`UC=s^wI3Hy
zNn5d>HK!fP9lHK&1yh!XXx|P9*#cWiG`T_6R(uEbuC_1JWKjlXMNLL)zAXvsmG;A%
zhdMC7@s(G+O|44DPXsSZlS6GK?S>T|&UVLpotxndjjE4m=nqUMx`y={DG|g7Rp!^F
z=OGTZ!!mjHCfKk7f7{ItB0Am)^NwVoo~ninAvJWmG^Z`av&=xJMldz0w=Mhb5EN%6
z%Z+F|Gi=hL5pD7P(Zn6bXie5yzPyo(P*X`4+Fq#rUEkVVHx6lXv-PP>u`^}E{~WGM
zD2uq7Cp9jwC;1d){_8!dK+f;llIi-E@dKFheR>Ex|F2&hNCnd-Z>x8Ysz2W0+A(Ge
z@S=#_{UFHE;IzYjElwZ*Mk^&|{rn)St;W4X^)t#SZO@I14;5OF>Y=4;2-{hQx$63m
z4Rd0>GnKEYtecLYUJY|5TzHXCl-g8tYTPYW04qGtWw^sReJgb4L!M}td*<=LiGHJ~
zS;6@IP$uK_{M@f~rDg~H3Wn<PjgNe_CDKmEtz1SF#<a&8n!umLXuY_}vIQhDG>VFv
zq!`?wXGJ-~lmZs$=sDh(FT-h48UPYJ$1v9hx0Yy!4^G2rZt6WRnA2vMB;7I+x?Q<T
zOC)&Vc@=g1pja`uXn1c#iW%|Q)Zyw%OrJpv$iA`Ov_O({xV6co;z%2*-3>>In*Z9F
zBknwxkCc?rHcp6=DrdVYQ5~H*Ui255*?^ta+)%RPM4rP>h#35KubozPHRZXGquIbf
z$x)=3;^G5qLXK1^`W2O%QUD}s-=G%coG`>EUFC&l#%Ebswrr(_VCdc7*{p@xDXgum
zUDC;WO+-~gnIv*2a0NCbcDi}CO}OA!h|}vwWwI0QsjtLtDu1*u1g%04(TVt+9)?r{
zHCYNJv?%koYI_2G!Lws-j}GympHm?A+jFaZfk`_8Q&o;Q6;CHCZJ-7hF~7lNhEU2b
zV>FkPw^U%ylCa{AT&8|r%mVv3_+6R3e}BD$t^jC!C!6@i<8~`XEF!xl!ju;(Igd74
z>C~>IJC)aI@~HSWct?ojsPY2$b>mo0zKN|4nDyLO)Rr!c<|nLr>wI0&)58x_4QXw7
z{Q!=;LVp^q{tnRpuHDCV)+B}g>%QpKuYs<0aeCPotO+mnjh6I<H;V4N%R%dERhu7S
z!l2U1W0oz3PqT;I#Z#1dT7Z(@^evR78Odz&#ZS(1X5quFw*qO$;EU@C#iDrR_q1Hw
z{f&n!v%#Zv|LjxANl%lqW!{VN>2!ElFB7x2J-Os4Qh!PIKXdbMVZvH5cp^?MVA~=U
zj?ZJ%dfn@lKlkf|3^RHY&&KjP(Y?1s-wv8>NKy-+!tR@ElR%i$V8!BDYSlMAM}8J|
zc;~g^#{&wA;S6WD$JMU3i>xLqIAQA+7a6&`Gm@9#XD$||^ijskt*G0nD2%2Jf0M`O
zE9}KdnrNjAh=4IaNWbG4KB1eosw+za*}OODIECaH6j$VOUX2Fgq3)?iA`Y8(Qxcq4
z(=Gp=^@op1GH-f}^MkmGx^`bMlg-FS*YZS7E-rN|N@g(18V{v}`Z4!FBfiz>GhJ)G
zn)ul$q8I<ls(=?lDtA4Mm|%&le*gsPMWiO@%`VMO&s%U~Xu~U9#6SFD2Qv?t93LCc
z*w>4%RpId1T22iEfdsVFtz_}X1l&THH!A=mP_TkL(g$3-)cPh4s_*Xi!0nY-TbzGX
z<N3aWBvGOq4tA7CM(dpyoPag6V^f^E9Y>{wOq1ndC#AZ-9c)X#g~IV{bHX!gFCP_U
zHS01dmPLA~E^=#F?K-PVn3{x2Ry0l-tA)Z1v$9X4g_Rm#C(~?qiuf;E8xlwmis`M3
z*3qheT3nR+Wn{_VHQTyk4DQSjdRZcxrsTHus8+#AM{`Fa0DTya(ByO&mO*?%D%|~u
z;bK)`jQlwkt2J-wp;MA3rpa~5-t1Vog3G;1Tvb^Yr;c~FEa34kWP!uHFYjPRR*Y!u
zNs5qQL~W)x7SR5YQr{iEEu9>9PK|3?jJ}ivcR^@nY#~4Foz)k659=uAQ{Mb{Femu{
zr5F|sHpW6ppRkUWN|W_?TGHM<zE@85X_$h%m89PYiLcEJ-c0>(A7ff{O(osiPrj?M
zWQE%6SpHS^T81CbAfMc2qQtw@YP@EzkXTADK4HHzk8ihkf*gmg6a;+X%ePk8<xc|a
zOgR|;FBc%>^QxdZyR!|g=>)8M6iq@BKXHiZKSiZ&<Pm~8Hq1IF^sd)EkIzE}b1S{@
z6Bf%KCyc>fJA&?%UpEA*o^3~i_ixN<@x%PC!GoQ3iF|*QQh`Zq(@`yp>T9pAjyMVO
z#TtU07mrPh$ykl=OPbKrl^$Vw-^;$iGj*Eh!W)5Odu7%|HD)d{QWC#o!<WP9K>+?8
z>MWxpheeqA*cgcNJr$buDK^3m%L^WalZDO`ysmkZ<X7i&`c&;=9v};OB;QedIywU+
z&tiwuEN}xZa<xB#ptu`P5Ykc&5Eo1H0L*1ls&{>}A*@3vOgWUh0yy>C^scpOHp_Q$
zi(%AtOLwIHrR8%K+!S$bm^qC76DGrXU{a4MS24V$iqC{8(N+DsyazZ~p7yp`g5G^J
zpUkKt5a75#mu;`rZ#dA2XVa0h(pP}$Rsw}!u3WklRX9-fgGdaXq0N*;3`JhE(}~R=
ziVDCxudibrCj}G9Y29U27QlnxTrdq{$c9aalvHiqW}~5xYxQ0hl}j$qhF`2C4_rij
zaKT0S)ko%5Hp9j96&8}z)a}Onmc1-dWDz!!@y<~kCJUXFUuaC2L+SWe`FwaldiXwn
z;jgcqH!F<j%cyL#9v(y*DdH9JQsZFEiRzskZkOVss>ze;6%c!p4$%4od8-%hl}58l
zMWWI?-8V}DV(v0cMY+$VZ&H0~CGt=ULDTop1rp8bRnA8R0cC8uk10f|-OOz;@P%SI
z71`{uh&AzC|5?Jxsh^Qa3eP<J!S{F%+p&Fj0mu`Mf{G+xw|ac2b2KN{-?f*%u4DE5
zT_gSc&IF*=i7et-5RpA+dM)JRNe!|cS8}%=CW^@&<ww)Qu5E2+PvVwnTz)XBecZKn
zD=j^AA#F;v>}^Q<>Zcwi^if;?SEYbR(vOtyMtWdVdHPDYi<PpRs#JFo5P!GOQ1T}p
z`w=HW_UjwqRiczE1`3ceP`}>?1djhy@`;as(i5$X`}HUkk{sgald?v*Fm}6yh~9oN
zfvNLNVq^Wm(X3Ek!pA^|!6j|8Tjy|i0FsP-rCZ^<;le`fYSVdj_sqYYiPzG7%t^Z5
z)HLZHAk9Fsl0h!%Om!a9{ER!3H3l7VHNW*29BTi@;iCOmdbT0|%MwZs6p~oYFv-KU
zFiYc(+og}AT;4VRYs}v`OOY+m)OW)kZa}dh%El8B^m2be<2kHUVs+mS;*b(~0x3K9
z!R#Mo`+?pFjs9C+AO)UJR9cTg9F2LT1R`WeDZ^%PlbHhh7aro|(=coPQ2rf+qws1n
zo`r>Kc9_#sf-0j~RPr_P{FreJU0wzkdo)qbw7v7|A~D<ex|;Z`R&mtouxtkHh2o0!
z0z-?#h)QMV3muJ5wM+M(ObRN_7>fe-JutFov@Lb=FtV8-DFZcg9?_<@3^U;GF?Cj#
z;W@#z0TMl;xkXdqs(dJ&IXAQibiFFO$KOiGvYm~U#5O*b;;U*A=x<L!^);f;kPLF<
zp5&^8E8wDt&}z#yuvi<24&UZ#vh!K_w)#!CP-EsttV916^+?b?n#a^gZk!p6M^<(0
z+?>GVy&>rQMQx?}=OG#1`o1o8nYQm@4VY(a?K~5Rz}p{BM8n&xQ6sDIr;a7GZGSva
zv1@z6do)!m)PtOXT^rU8cSYgV^{zeyA6ZMG(zOmeA@(EC?INM0LeE08r84pToLZFq
zx4K&C)p9;M#U6Ix*q-xr@GZ<(Z9bOz#o784ZVzqrw3Tdtoep>S>Lx<go`GJbQ8XIM
z<8X#bXX4jiZ#*X&JQ1r~Gf2Fmt%3ao(yo{-uc=|c*P(+O3y@(Tev=>LS#q*qp^IKC
z=6t9Br(-qBJFqK3Q|MAnxUf32l*oMb-Pg+K4W5NP^TG4DvbTOVHg&A3y2EA{9EV}4
zBTpmTCSb-DFQPWuxkD8W_l3*Vj}STRzp8?4AEybZ?ya`_=J-#9lf~%^KjfTij=cyq
z7-j+}<b88+P&~NvrB9&B5@{9>k;$$-JKo{FW49S4gLVtG(U6*chdJ6mLpAwH=x^9n
zJZ?V{CJHnG@bdPDoV3U6Rd{{vfk_eSxq%b2@Q(=g&tG=$l<jBJMf?YcQIT88am9cJ
zieta&q!d#zP8*UdL-9sN_7Cp)I3gC-wjDqP)U$!o<e9<$pi61aN(HAX4H)WQ&T&}7
zsY+j_sD8E7+u0pX*q_W!k)~`RwEIMU=Oe7s`wNKbAsiqm_AeTvw!YeDTy@Xh#vgF@
zV|aHHAv>0~fgmYHo@T|nt8NZjMgiu@@-p3U>%o_NVou+C%Takh&*OW$#fb1OliZXG
zt;z3h=F9$83h9aJufp&PekShycLX5XRu>Qkbk_W42}S@3FWiWr*M#l+#@}h&Fbye~
zQ#p>)W{x|T>!IMTG?Db~IkI>?uD}iPe9mGv7!_gV$-PA{0*9#=TENF6EPQHgutot}
z%t_L}769uxp&#RH-1rIl=Hw#`l4Ybh2l!J$q`77Rm5-xu8Zh4ck}hPfQr&m@Oz_Wl
zuz)iD&53|zJ@2@bVs&;H*q}noYqSCYD$q2*pOjPw2z5GHO*-6M<DWEAtl9SDwy1b2
z4-muB4M|?D*G}0~anbiuEcZpqv<}lFr(L=--|5rou&yATJup~^aJGZ1Yhq(xRSTE^
zj?e9Aj*eg_Rmi(hE$xqDK%_#S_J5l3IPc8d-4#FX7F@8wvA!Ei<+Evoq~Tk+_cyy9
z#?Kz+pE&*(yTRxD06j#(Wgbi8vVrY5e58N43J&=qkRLw(i~cYTZKSjq#hDNt^h-rH
z9~&y?o@s2#ASPKlzRu!v2^M9ZiqD7D9O0Q(hhyyJb$N0B#h92fpO5+A7(54$hAnjS
zUEvmF@KIsbXpLQiezQfZ7Afk(j@Y7wFd&6emY|GW{EN@^yr#)P)G!Q1@fXq|s?m%$
zSibCn)V;^5Dj4F+LDhGFAVnU>s0S0pMB>9hC;!=PX<~(S?CYVh3MkXCO=XMusa^&S
zHTHkG8Oym*_!sJ$5mh>(Q@F&`A1gerz>~>fFjeSsodt_dz2!o=HjLI$pLBZRF_jc3
zqN8Eol%BkLch~$Es1XJP(2#nK{vFMm-9P2a@xWX@6N8vn7`S7ILuW($UF{nBKYdZ5
zht4gMQc|!jn+Fyy%&TjTr}M;!s=($x#z3HD#`_(6J?8(Sd3I6l?83q0*?hX}?iWum
zb_mH2v5D#AEBT8IZ5QzPr%7s0(Zw#ut*=#!a=H-M$Y8^HVNKz(m>{ZO6+4*rh4C*?
z7*C~(w#Z7<=;Nf{>rwyj&Ukj7&QX&v5Xnv_O3I%n7$OCTfO*9u>a`?Hz*)-X0%p7z
zTXunQRd%y~aj~<1%_D??a}02vGyd?J!+0(c1NpFrVTE=1n+%oUG)IE%4*@YT40i<M
z+$m2@Nx~p90i!Tx<ljf}!w1Oa&5S_$Zj1i=bh2QSz2oyI=GynwmW~#uYb~5u;yc1`
z3*Wru{d?`3H=lF(7$5pzR1P#37zd}4qL0@mtv!S*@I<W7O((}cLY$mn<+sSkRN4QR
zwlinxO#&a?s}^i!{9odc==uMCeDkK~KbyzjTffElZ&znn@GJPg|9kWQU;O`}r=cYN
z8GWO~C}Cia3adpYPXi}(SZ$xs$@|$AAZrRI4f%xCkq5s=8#i3|mF;28p2gkTUZFyW
zk?|*Un^nt>ll})ad{h74Y{(e+RFRH_E?W^%NYj)2ir|dn&CmyX(x7+$MB`D2RXKpT
z4v=1&ivMET-kFATG}_s6eEdr~(-Hc|VEe?9LpS=e6qd%P8{PvSSTC>aw88<7N?wG#
zqr{tx&F;UlFGqTA^rdhB?#(h}rKDQlX5PtfwSLZLAL>E!XXi*C$W+O2F*Q&TjzWJB
z-3uGCX`gi78tLfQ$E^0gG}l>|c)#R|;)n`3gVfBt$!K&}H+w?npPT-pS4Sm*-H>D*
zH%KwPC)65nHNEGE@6O4(25MV*gg|w+bc%iJB_%5vHQi4Ou^(Jpn;u20rnfG<e2v58
zD=W+Ol?(JkEqLB&>xnu=f8vC6(xJ5>e*T{Jju#cAFUfHgsIH^kqC#vDmJ{%$Fx%9s
z?;(i_GrQ}>G(^JSdGjGn5Al?!%iiwHW#%eQzg!U;$JMp#e1xp2@dc<(^|m(NQcA3I
zSPdDe#yd<rC%pLqeD)z-KFk^MCp&w+x9;kXQPPL*GpFS!{fa-Qxuq~uvD^pL@l1xD
z?rb&HP07y@D6|uCKVysIkt}YhgyrA5Psr?h3{D3HW4)EHdJ~e9Ey?pqLV`Jce91w-
zL}QR~%e^(#-?X-PHmlG0%0tkYXBggplX+$Ts!(T6*!I>VbXDoIT$nrOZuU(llkQRb
z*yzGmHuwrQrVAHDICkTunwIgg$l%Y5^W1aEPI*_n<?#A;-cgNN(VZhSQ#g}AhQ01=
z`IJ}5&t-o{_BFOT9?ATcYAj%Cg3pThjJI{_8{9-avLlSQ-qP5)Qd2QbB+|R(R)osF
zoA!Tb4{xc5&6cJ=kay+|TDI1@00so+J2GLA897ad<|;~$1X|{A%q0d_k(IBp`kGM(
z2=Xr42LI>%{9wz3``a=>r<{ec5f{@XSD5IcWsNSdL-^JyV)&GrJxN0~_33Gwkk6iN
z#n(B?9qH;Tz-X_OE9n<v(`W+p*13S3oCyYm7EG+y(qFHa65UTw&t5fZxHRzm9t3Xi
z{$DPD)g35XM2Bja{Fw1pj(!neM)UKIs;e_`=RmBY)4OCU8C-?DBbwx=52HS~A*DFk
z^?Q^w!%ea56xsy=gDJDc{fCMAIKzrpdObz5g}^%`is0yH_lK(XQY-RSHX|d?>)zop
zv5~Lio>6<sU*P4=L8jqjm(7jNHet<{iax@8`@8KBLuRGJBB4PZxR$OTg_=4(8bh}$
z$<tr57m|G_>_ehn$p&3;cOQE{@R-Q}R7z!&9UEGNgeae_3;CpdCuEAM#X_9sTIkL_
z$Mo&C$ElWd3fsuJbC!wr*J`LV4jY1;6uX~f!}oh)Pql^UtprCR97^j%a=OhpqyBxw
z`E<$&a1x%%Qe(RG(Gx{L%p&c|tO|_l4`611ScQpAI#AqCJ{RFpc)rWUJA@4qWEa<7
zei5f`bUU~<5<zHSP?qk|qN_9gB)=9QY8*rp{a*t-ojIo=n-h$@gXHh2r=r$o@2g-m
z_aGT8pbNNO>LuyzH)Q_vS6_6iE4Zc2WUxM^#c`q1y6RPIa{Euh?6Fd#Gqc!O_i@2Z
zXnyD?Y=v=#!=qgG_|Lxhrj$L=io!2Qpoz-H^`Xe)qjZANq@IK<x5)%1->g*SO?c8l
zh|Rx8b*Kd^(bdI-1q>7m6XzNAtvD}>UwUA}$LygBkXUm>z>twTQv86%AQpx&jwjKh
zhYt+Z@LxSGn(*%QGsJ9vRlJ`#Kgy@qt?^PHA@lT&785W$WcTik4l4cgivmg`657Ja
zKH!|q{g5tJ^=i4;Ul}=}ujTw7Ydt%8ymd0nMxq>XUqHs!R8nULFhx^O<PvT!HQkn2
zn@i$ltg%Ye|1+$3tEUXkpRcgVm8D)%^b!#69oi)05UB4CZ%y3qZ3hPoo{kkZ_V-o&
zY?Nf|!8u9ex9eYB_u)w2?pAV}me1q2Aai&GC>>7-w}}WIHmJnQRyw?O_WehpsNO?S
zvYR7Fn+Tf2MOpPK9FkL)=kmF|cVM;6w!*xuBx8el=qiXzqck(IG@c4pdJz)Zr9u=u
z-S_--(=VJX$;?Ps>2GSc_jS8Y63kdD@SQg3fBb?wa4JVnD_1}pVdtQCb8{O_UK=fU
z`emt9Rw)Gt*2>7VXoxh8Da@gd#*Dk~T(FErTBokHjY{3~LNK-V@9g8TxgkPoA$ob~
zL4*<7td8WoqVZmy4PQM}po<$i*YgtM?VIfvuOveE%M#ZcQ?Ktbnh0Ocmk;iW{WDnW
zYUK81z+>9yd(Kg>7&x~X+H3m(F(qF?JaWzO!Q8yrtGBQ1J6K7T&YlW;n!CG^S1v_%
z)ss1uNEOfRCHubV06k`a+jH&Nu6z)f!B8c%YJNkzx6Wyl+Fp<vo730ubw(X}o9*km
z8AB5$?pz2s3&_LWFR{O?eb8xHa+%q=%@(r0IVx+=R49-19C&(tddWAWTwK$08LTCo
zS2-J=%*alEjNGmrVWDbijYK_JyKw+t?WicsH=Pzg*}y1ZkC0g<k%kr&2K&}zq333A
zLr*Wwjs5*+&Iq1$Emd_tG$yp7LD=c_yNA<T6w?LUuEP@^e}BndYArCJrTyh9n;>(9
ze39_=$-)1UdCEs3FFvBfLNG7SB8C98;=rsgT01WNlXx7*^f%G`==P^n7uO8?1BQa6
zJ%7HdCm@H#q@TUdD~17xDWL53r*^ihKlJ_%2;52vZx(r&gqO17^@KiUgl2yCJ*((c
zk}4>014!-Cvgg?1$JunYJ{8)CZLD7Pb^)cra!Wm*?ILCv5&TALBv}1kb^=as$BPC^
zw`-3a{H%H;s`}jgpyhVmym3at*JRqAUkjcFrq}yJQg;?vp03U^cCaLtFS{yQm5Ws6
z^s-kV+=xhWQhI{|*{_4}jnhsmtoiCSDtQ@)faOSEfBxYob}x(~!O*JAodc4mHGgMD
z<Fne}o7bb;>=*`Xf|NQlyv(-m${jCbB3+M%_oB|$(9)VKnoOEZ((HEd@m`RNM**3(
zd7I&r)gvj8fL<NsNYOSZ7@a^P(x5-5!K}|}V|-Rr+>ih7!hF>;^1Rwu7m-O#D3Tq{
zWNdfO({Ev{tu1KS$piX5Is__ywZBV$q>gSGo`jD94OcC-TxsvpQ3|hPCo+>MV;^4|
zF47JjYHvZTR;5U_k}wekH^!)i&Q<j|?=>x6%vh}+Q>b5n`hm<k3y_!R2g3>c+m&%r
zRKJn+LK-<M#ebJEu~Jn%ImVy6wlD|eI{t%Yw1U#t1tBH7Rlpb*e*(y?iRF<!0c-L8
z>gJ1!smfAh<OJ~W#C~Jc1b6qS_d}KZj_;p5*`iX@3l=9n5h2QWb#xWbWRa7B+3iKw
z>7#$AO)Ak__lx0I?t4y@m*YK6?+hqdM()fyY}C!q2YU4-y}i^Y_ZVLD{rcp~l8a;a
zsqXKVnn=*K#e@fQ27mzZr$n-~X8%WvTT>6*0rOb~WqJ|oGhT24ySit<)95Jul0wn+
zxeRdpH|OM0jSK_uYJYcc;MSe$_~VG$UxMeuEyJoIENSO@*uyrnG5X7ni)w90Q@g}q
z+6+MOs31=0^SP{C`&C|n^-g<P5cAx-kn*maZrdc<O^LxbLy<5eMiA3ySJS`~Q9v5B
zc`7s?r*s19AQm!KcrHX_n9amUR?uVREQ5KpU(_y`>y&e~YjR5X@gTdc7|p05<!(8@
zBB71!RjDw2A5X=+OUmBmWtwcE;SU%Ruxq>LQk;kTv=d&^3sIxqxG!-2T~GT0fAGo7
z)RmXEnO#yzS9PNzsr=V!&i24Z@8gD~xMO#;8;=O<bW&8|GQ30IiwpGh#id3eb_&>(
zUSHU`L?vRc$nf})WhIGqdhqt=+3xJ`-aI$GuQt{it&ad(J01b=#<MwFojwHr1}Xw}
z%bQjC!7%Q-MDu=LQyS-_5xXYcNc&vWtQ-(dI?YrzEgBTMv9fREye4?z19V`^*VH3P
zX(}$IgF*`8%eTFvdA)CLHZZjkrF=IFOx3r=#_F^A+W+H1|Mm8xzD>i!+%Rc1V)STe
zrlfIJnK*L>^fUAHv3OwMOQ<S>&CvIJHa`hZt9X;N<Y#7g*@0?%o}_wov};|ifY(Ad
z@-PLF^pfha_>opGo31ZvBzG(uvhp*GZH)1mFD<<=#@|XcyGMFoCgXp+^I>MQD;I1;
zI09EOUkk|Fcd0N0-7UBqs7Oe#=b#Vn<_TMJbFp4F`zTC8iY~gNRq9G>74jT)!{|@3
z&A8*Pr7ql;wf^uH+r_z*r#Xv;-vM9Q`Pwmu`rdJN%*aN;7Kp$BQq@CMWd+lf2g7mM
ze1I>ZeAujC@v6>8-+t`}ue+0<J_dN(TgnCZ>b26Iyh6Klh{F?nhuGYp!I_zP-BXmC
z(jE7jtIZqzUtq}e_X)`dfUPahBa@Kt>1DB%?lVb>_+mBLl2E|uL-(7-zsCM7d!__^
zOorLEVo~lk_s2c#<0Zd&GOHxD5nJaOk+MM<otew+^rLbmT2`(x%Gusfr|z$>bj%nU
zw?R-V4x!Uju&l=M$yqL%Vs5Ej_`#IkZ-;WG+$iz79?Y8N4HjlQd6Cv0!|8AZ42=-C
zJr&I(D{d<rH*(^I%4cpbVtPB&bv8%jV-0obL!>^K3*Oyck1b9Q|3#w4IgJ15^{8#J
zd`=2V%`nBnV#a^8B%hqBKI3xwP@R?fE-7i?f?Y*Rd!$_r(uA>3NnusvPHIdbgxnf4
zZ?qhrRApz(z02i(ow+Sc&zvIw>%RgHyA>E0<0hwv5z9}g9%G#-@7M@$Q$w3BT-xh`
z_?{U`7lQUvVY5(IZ-8Mz>V}c2yo||gJ7>%-?eUkU?@)Zo$uD|U$+h62xue~|Z=21O
z64&FH0t)4oCCswbj-`Rk`K|H<`-wdRJZgJpGAjK^LNF4yLc3Z&I4@t&u}ASr{Og@r
zW4mB8`%4mUMeQi{GUc<&z+aQI`tas(?~Y^KoEfIY;2@?4kFLScV?#~G{@?JacFE+T
z<TohLz+Gc1l&b%z73@{`JyYm0MEU`^N474(5p|SNv9>tfAJmc2p|cMcLm1GmCpybe
zq2^J@x*C|J^lag*(rK+g+lnbYObkH~OwL)Nh<;@rS_~qKTRY7cWv97@#)c4mi2q_V
zYawtO)WLzbG%(G_KwD*cb_LO}8Kd5V(y8>1;{NNoHc0VIlX9l2Yb*ZTWvIRS2@@pU
zmhWN45m@Jykx$jbGryeu?R$7C$v@GeK4N(+=)U>ob9<kAjW}74nM%t;g;hUU&beMQ
zhj3k*cxo%~E3DKHjG<C#)}FoLJL&m2;S{*s*N&-0oPd6f1uiLoSuH7Z=RQs2RQfyK
zPWXkyobM6loP0lh#-5ahvJAu*qdUvCa2iM^20@bgL@w6#xbbB|8a9Tqj!R8$*pyR_
zQ~UYR0`(%gL^XSD`55Dk2y(B*8uGRBa%fyuza1n`bB|>VN63aF8FFrSWD<K)v|k}?
z8KNHIYTB|)V^sv-)3|0%lndt<St7aM*Tc^DoCRz}gaEy8S(`gSj$Q8$E^PuwiI|}d
z2cz+>(A|+N+ESaj<wCLxK!Q1Ulx&8^vRMMeV@5#pts)L{2nYQaL4Xg@`guw#M}i%R
zhbh_OKvwI|Xw)0_^u%QK6!F*6-}M<ShgXDX(<v&#0+At05$62!eEYSaF2M<eWjS98
zRvFx>{DLI7jZfy@Qx@%VKK3FhJXJh5CCq2~u}vuO4$BbAg*`!`>e`8a7*2Yl*9Qai
ziS{d#JAAJP+M4^<ESMP0NjfEk$46Dn0m@`Bv!^muykCQS=6K`;>=P&V6L!E7&goWT
zV=_=i>gQ3@N!lPL5Yo=2i-$J1|9K(HWg-JQEdf<)hD<Cs@O^J?_*2npaO*;=OH$=a
z;bi7MFeq{ho;ICqv~cj#F&9pc8|Y(Q>oSx$Fg8F4pm?iIFU?}gdM)jZ8isf*Qk|-O
z!C3+SBuo<sqb3f1QTk4&h>yiKi8Vq`VdYo@&ptXY;e<7@W^oM+d;Fw;>>`u!9|wzP
z__yIXy5raZrB4J30V)M?B(6Ha^5U@GJc?>m{GI!gqWfs%^p$f`ejyHQyZOy?vV3f9
zp`(Z3%h5JrQ+p!?lar|%=JbjpH<KzDjaJ)9%B&X2O>50bCePS9p5QewwPoz)+Ou~<
zWow%d8V{uG#H95uk*s5V<fMFHM$5C3{%WPR?K;AoZW?0hR~ag#o!_vtqwL7Fc1$eO
zam~s%1`DZx3C0*Htv_qEb4tQ_PVl?|mM-`Dm5D)r9w8)j;K-yue0(&{+EOjOI3;TL
z$3ys1V^N|cEWfoAHK^&v9)9mDztY@Ar+ax};E!>K*pR!B;OYnP5Ab}1eFpUL;z#Ed
zjRR)>-=2bLcPpmZB+hB@k~cxbZ4n&G#Tv0BUg-mBrSk4}<&mekz2Ypu1Z(`v@v(^`
zt2w;Rl8KjJaH<2Y?;YQ66ZWq+*qLZTS*%PwLlaH$w$2|?5f@>ux76RNnd0uA!Hx<;
zgZjwr?sd~7fPa){R9(Le`%c=H2+!5DjUKqBd9REKwPCkD6rR__!ep)snUHn@^02QJ
z6;ns`5?HE_m7R&t=(F)=k~1L1nU9D4Cs8Vfj3<XzS_&E}xzy<3f1=a|(GApdF|W~9
z<k5505fC<GZCs!1yE|Y=nDk6>O04_mKw|Gwxn2W@U0qZ@Cgz*@PuwShM`8=eHVY2Z
z?}DqEFd!h|DXMuj?#fCz5Q{SXzG}A>QU70AYt<mvzZTN8kr`7fq{I#_#$gEpEFW0m
z>RpLScO6!pN0NTyewR-s!`;c9hpFCA{lUx<LdFcef4ARjvk<^L1wR3x#4NcGzS=$`
zcXBpAeZt<6T_Wn<K3v-9j4VeGkQ6F-Br+;g|A=i*jtm1FPirPw)=Rvc+7SagKgI2%
zh;5&M+hvt*4#`9i_dc~{-g>+6E{TBw$``w}`9GJ(UbThB)hztJ2GE%hyoGuE&`M;B
zqFam3`Q>pexG|$e`?Z@M_PFqarFm@;1;Q8+X9tSNldHY;{<@{uvON+?$`%Ec75er&
zyaiI-D{6eNP_h(aoP`Dy-J0rMmw`x03%?Z5!9!4-&oxA*l$j@YJ~GVQDxSs0CCj1+
zkKEZh#`Vpi#fgMcYOr29pUn^nuxsEQL&NI@XYDxBm#3pi)ZA?$)z=Mf8p7CKazU^~
zRoD!7%ZBWBM<2fsvi9Ns`ok)x{_79hNZEE{@tfS5<qJ(xPYTasE;1XEtv~walgH?(
zL`0%aoBmN|vu&6?-JD9Xq4hw)!sBIhqlFxVj`z_tjhwE=yBR)pFd+U>@O&w=r4{n_
zqUyH{ibiQhKHW5X@dR*0msla~Za6ju#nN7mVf>T1-_%u!(im+TOjzu72p<uQ*jHH2
zNkoo63d<7&_^2HY!%_stzsJOkEKGmdT#hCQO0|ON`r3*;oK;km|L;5486gd%xbu^B
zn@zLCSU4095GDdDm!@j2hJxb9N1Z9e1bBoy<6f5e67N?7+u3}pft_0J@x&LsRQ39g
zJ}%gg&Ko)Q438xxHeH#7eD#Xy`{x#w?D63lzASSlb^V^6(<A5wUrbSG6x+ts=%Gl}
z^Xy+4#~j3VLakHYA`<K&Y)V`FP`2Mi(>61y2nV)zRJg#B*s!!-#P+sVR)5z>e-%ax
z6?4Akfkl=zZK0F9c{}u1h}@>Zh_LNW%|bo;c2L2dt5r<RhU}|}@ebiY(jHyq&j5PU
znv4+{g4|#1HZnjs;UwP7+R>w@lo%HY9RcCW?$ypQQ$)e!2{956$V7&odv8JI?_p&3
zeq%Gk*4R;+V|&(d7iaLLvQz?<AN$@5T-x!>Hn10h@i2Ft-Q3oO(1PDbjwm-K>&Jq6
zvA2g~r=o=6*)}}pYh)4J_GL`7JM~sy4U3Pi<iHmETt4xiK%umG8=fd&D`q<eu9#_(
zy*FpJZhSf5SsPXTh*NtxwP2Am_Awfr4f%RtY})4ZbYg(@%Gj+SnUEmk7&;I&T?F&V
zc&4mIQsP)%EP1z?C`J^DLGt~OeXX=W+l4AQG*UMif^5;W9KwhKLro@2r%E<Ilszq1
z5`(y+n&?x>hFATF<xw|`hrT%RwR!`~BGoi273-y4eTNXW`2?)B&pS3en%VMFFGNi+
zAWPHVX8A*LHCT5n>oCz(MWP%+Wf`tZI`bB6fR!;5lt$T%ij?p8g#^M^zXP_tlQ`*}
zbj(u5?^#Iq!=dgzdVhUG{qKFZjQUwA`hvH<@$Hjg__$jzGYf2~Xioi{ku^{7+aVKk
zEmgd}X6N}yo+%tC6#$gE%^(VyobIyNKRx|qa=Mon?F?^<<^3u;2IMuQ;2KPNM6s-t
zi?Beh6FKnA_zimryViEhfgblAto<n|y7e-!Nq<Jou^*Hf2D2c6TVzUc4eR=MnCXEK
zIePANKHjpTZjO1r=7=A3+p-vrk*GHuMT_EfM3&cr6hv5!uZg4fQG))siHo%#@z5GO
zW(eId-E}LT?1|=*%#d51<8qIp)rgDW&O(<%Dkx0?2tB+tkF&Oh#_os~c4Ycm1_ca#
zYE}uHLSwX+r#*jy#>63YXl+)!wwQk{80&)dfVv@R>Q$#}NaRv<o4*v{mAsUS4(<gv
z0#8zSc2*%1iI-SDl74<7<RoprdShE2_5yR?r<dz_@(74!U47R*FO2y&W^Y^<+fvPo
zL_J$x?t={E?ll~BTa+A&@o$qDQ#=b8E(v{FM&`3O8~mX{=@}%dJs>|OryF)6(0kTw
zsqWJ#WPZ~JMK?Y*m@wgnvQrGqJaUtC5T~pu_fZbcF1F^02(k#<+@6X>LuWt8XmqqE
z^06%O>+n<D1bbU5S^U=2BKUVTQ7?P)Y5olb7&iH3r)yVkc8`Nqx85DO5UtdBdavFj
ze}_<zdT!PTxHv6`b+`R|7$<J)<vFZ#Z**rfQkuV9kr!Z~X>O!W0Q2!BTiv3Z`2Go~
zT)@52N?=S*;V-Q+zpbh(;}ZNOdAz`|>g`d<gZppd9o$|Ii}fD^h25TM$Q$Ez6ezaB
zc<b{h%9anVyp2L5UKM4F;`c6~A1MBx_P#TysqNjHV}S!6L{K_P7p3<mMWlD7gcd-W
z5USEU3P|tOAP^A<5K1Vagd#{MGy&;VdI#y9yD8rPJMYZ<?VUSwXU_gcvXcF<vesT}
zJ<qR@3I+LewYeE(&2v8t`MWq3pwbxa@$ldb1~~oGx#ilu$<7??s2HNfUm}(p$nb;%
z*d~0}zomq)bwCElp~+0Q8p`AH@cQ}`4!$*%FJ>xIVle%`t<tyx;qGRA`3VVrDvB-h
z)DL?XOWngmhS;!UKk%D`QkLiSXW6!pOq@2VZansERoD$-uZlGwfbGU<=6Xps+(|?#
zyOg1QF>sl_dH(bgyJMMjh4j9aeznN{*PObmk97J2vX+UGe|rWL7<}%W+?uhC2i(}Q
zhzKJyvpn9fMZ9#t*=JOSsu=USW0#4)$!fQNIHW%PyA~zKSUSvuN4!8w-&Qz2D^l<w
z<=JfR04R6HMwX5AJ`4~X=81F!VDDcijb`C$?<m4Mmh`9-ux&jfzJGVbCJWCrKqDLr
zoqkO859k%8LYqT?VW$H&XrIUzUstn0Dd2V%#Iw(uPsT&=R8pF<#4_k7XhCM;uTfQD
zl=$|_I%ZH^g`2Vg>jovEPe<n3A_hP5;cK3bx+fbrj5ae>4SO|*SI}RWt7S1&D)k8l
z-ElOdFfQ70+~ML0UUC~RzvB0xJ6HM2?M_|^=)u!oJXBj5)WQ@CM_X*@X_;lAo%T>7
zZ>B6QXsV>92jlZ}V?c~5xvSi&&fZ<bOKS&GD;BoSwVMi&eLO>D!$Y)MBssIj$Oa;^
zd_y%21JI}Li-p!RRKKYc&t$ZACQ8IrEEG1!%krekf6%tLqN1<9vZG~8-ql8#F2%vV
zn)@CX(uC((p9#4F_lQF3o}HIh5j3H+#C$YT=@*ms#~15PTfx|~vobUbq(4>_SSD<*
zmW#MuL!AP3Dv?Fh+V}w~+8~4^b()BlojGRI8X8z-?`rfC`*9}cwas0^6wleSr!@)*
z<$aQ2;8~g;Ats#iZHWCPQ3FxW%x0uwq-;drX6{i<EgtntUxOQx@BnEIcgsrAuHTx5
zE`!IU>ohp6_LAGE$Xx3u#SgGf^_V-`t=>q`-?Xbaoiq<VX}04SG$8hgwldctIQh*W
z<n{^;WQlQw?3Udo=NXB1i<evNp4e3k@L8ZdIFe6y7JWun*%PJo)az4GW`^J9RxCHN
ze9B-VUcI)*cInZFyN6IbeVet;<&U>ZhLB8PJ9oTqJB&q;%|#u+O?Is|(%XG&w#ka6
zwjfoq)ts6OO*7~j-ziPDP8vN*Y?zDeZ5KZ-S=#P1SM_%PX~Em8>DIgeu{{HYpXm<g
z9gL<rttn6bY!ff}v<ma-GL7{PH3*QlA3t}W4K##NYnP}Qb};^syf1gBUUXZreckTN
zX!k(&d_S8>gg6+FVbe`XW_pgkA&g=4%vXBhpN;d{?Xztr{q3D{&qIXZ=sPv0rPDyb
z{Ow?IWLcUk_nX4>;^|c1D|gb<_-9()e5?DR?B1Sra{ENl2?OIbj(^EBO6agwO4zO)
z&b0OUl(i?0H+En!KoyFuB_36c$a&?}?D%tQX+g<Zwgt*nljOZKo|(2n0y~NV4Yvq2
zE`tUVayUlLPjXHjC}R!Wty6X)c%DMOxxCvFNHZJJ!^}FTx4E7929BE-gl_Y;f15n<
zTM>sJhEDJ!{RFkcJ{s>OOSo(r`m9tL>Nm2uOk3F@egv&0M5?ClS0sZUQe>{28xnY(
zuiP=uObMt!JL$0Ql`NpggqH*|lg#$TE4JDle4kF~2lp{oDaEFoqUp~5ikXOrv>Ujw
z#%4IEpyF-)&RwQv)e^jLIwRG%S~%~aSdbbf!Z4X~5^~CXn`<|zJ0ewlDLGv=={GP}
z5}#~T$QhiJD~o^AdM2Qf>iUNNS1I3;bgYk4gckN4MGR`|cXwV{$utMsos<QWJB;GT
ziELKLCX4i7`*#rPTABS?@10G7nwyTlhH_oQ#>W1hJ-Csi4{1UoMASc>O280jhP!i=
zno4Y<J`>Wh68C@UZxYXgUmnQs%fcc96J08+XtYQJtdRD*o~HYesi!|Zyx#T|!G2H5
z2eas$U{aBNk{ziSiMvFT-P<gyQpbYp>=B=f>SUYnDQ%hH;=0zb5+*nIU?bZvkG`#O
z&}}CR(!Y~RL@Mb)f!S4$P?B@Ur%oMKn#oJ$g~($<7rw`ZRt4qEjiDWOHnhrW72vTK
z=w@;o5t~2gW~<<+gR#50m(F?IIvvpO0@KdJ`FAP!wJ<X$!htzt@19wMkl_3nbD`~!
z?ltEj<wrRnMpY9c(j&G+zfKF^TZOo&`<i3Mn9vUH7z_OtHs0S!^-@)WuWnbI9FRyB
zUsXi=uyFQ0!*YH*mn&t09(UPcj-m`mrXL!2h)A-tH$f6aK38Z6(fp#sY)Ev>`3ngW
zt$(%dy@#=#Ms6V+m*Vx`v~`W5={g_6O!*ATQ-nqzv-OCiY`AW8F*L0MwfZ7L&FGlP
zqP8qw?ySgU@OwH?((H&r3|zp;DMAms1KOoFveOr*ioIRxBPreKGTEr8WxFSN_wqnr
zjKHvb6cSvF9Xy}f1@K<5ZfC#H48evY6?{GLD|F<(4#l&lrwR#)eUc}RW>7!Vg=CRQ
zTtQ*j#K;WYrFD_2>Epv-n$a22?W$~zTxD%FsHuZ-ip~UtiH*biSU@%@UIh0KF2IFQ
zz0MrwC39}DHJ52BECHY~>)-wrF~x|BHHC4g-X69Qod}sXr*oITi8ZVLWsakJQ{OV}
z)8pX>@0ZA@D(YLNF3?whlL<|XPK+4sJV88?a0DQKQy9NX=$;b6wId%y*=;>Q>=u9+
zdwTN{srBix!n%i;c?swS7FM0cMQi^HKqVJ#QacYnVD^VqN38hu=>S?p3V{|W(N;--
z#3+CI%Gvtl;(izJnz`TQ7LL983y6T~8s-O}%>F-{-=zk<-#nBVGZ3dGf+{K5cesq1
z7FOX#=b)16SwYltU*+gnTHPo<S|`ORKC-$F&s_JGpvvyXuoXikF-tpX3`<Orjmc+d
zYc9WtW)=h5q52r0u<_eX`Sb#v3qr^TR4~L$Hzy7*x0!KjuGG!3C(6fUQ2@4#z{P0<
z9P_VGK&bG!D-_UsnEJSlwWA~=H@{#0)VWqc*&om8sxPJ#1n_TAamT-Sv1&l~DtoKH
z*y;ZO^2{pyT3mDK^?6X*X=Qn9^0yh$@^dvU<J(v0x=*_B1{UUPOPX}5D3Kz9QPD@!
zd$BA*?Q_Ow(e22fLH8{~oR~@?mMhb}x}V&l*yO|})(t4P8ZD3m)t@Lr0(3OAuTU&1
z!kTigp@Q4N75a}-Ddoh-g8?JX!c1@o01_^2o8EdORtmggRH|K~BiY-pFl!mE3vI5Z
z5n`uyhLnXhGS`$v844e0_)fhbLd#T{(oUXa=FtGamvCNFgO2KN$p&0ZPZsj7yZ(6+
zT=IRx6}w^f!QBABsS-NuCNV1ssOe&Z)7J4~0N2J9D?Ivvx7Ek-1E(b2Qi<5n)vj)m
zCY?kC<(3iXwY0#IAs8LM6T)X<?`}HFNxNBiWF9lFhfY1<jOFZj*WZq|OYMU+!J21g
z`zo%You-NIw%v~%lrve1(Pv{&5nP3mBE^?2Ia?_+X})1$(QcHyNH<!e#8X*4To@o=
zxy&`d^$d1f)tyX@&l2g*9adQGO!t4_Ws$Ic(ZKkG8YdF3p6I>+j5i7pI~dRxP0O(%
zVkcEacr}(&Jbr2(6M8)`qJkmgeho9LfCcB57WoW>aVdD!L8rqRIXF<7t4=y_LIp^f
z)U;1C0`>SU?)adCwTm4kx@r_$B*hr3kSSI>*ihX~8zaXEc2kfn@|{WPwoRv`0pJ9{
zCYjFJWaE90SfN!3a_R6GHO39pV#{~jJ`KPT+F66S!A@UX>Za}SS4RrQb}SnIh5?7S
z*IKetcmTaM-ZhZzv7%~j_$ILuf%3~Dl@h6GKIlIrSwIdoH~n3ouIOL{F&8=n6UVBf
zOiu3ZwNfCV%Bk<3Y1hhWQKq-&LXLUFn)q8zH3Ac8FT@(~5U0{w%sK1G%TjsENZ>&8
z65W+QzG^lfr{g3G9kUYtSy~>+zXlPqoaGh!65V3xg}@`4T6Euom>_sLgNMds?$gFt
zVVK*0suAcBl@-`<L=E`{#n@A4YIOu-gjW9aXWG(fNJu79_Of)UOTPH#_4qb}%`Ez&
ze9F>4CVNpJJqoI{XbQl|y{SC6h0$#()UWhED}Qs!!}q;qC+W!i>!WGCeH3@NDBxqN
z`jZ&D)&pl$;o(?K))Bca<?_e~cVv0-H{FL8dkKky8pZfN$7!}!%AB-m{XM&U;<_!O
zPRKOXj{I>X%K4*spK2>mE96glIaX+7L$m%;aydVR1GOV~C13qcpf8zSXIDwSkW$tf
zZVVK6i`f=7`#}SFjs!r}Qa+s$%}yPWX;p4$P*mVHN927oWGm;EX|{;~KC7I<=TuyO
zeT-JYAgiYlpw7UU<H<`F5}c`IAmIysW3tTq!~V@z%9!ckml}l(mx9*>2~1s_kzR3c
zxLVl$GufKo#6a>bn&3E+;R*`+Ip(R29^i-{vIYWuocG(}f91<wROigL-7;!J-RKGs
zHi$buAHF=F)Yg+KH{!n~p!O0dHf8IyJ*`f!43ZBrYb7idR@0aSlb%fkYU?+!f9{p@
z*{A6Y%|;p7xQ<EW6<8IRgQix8#ie@9*G9TUV2L1J>AZwi1&ktIOcqnt-2K^o7OT$(
zG6G~G%pdwqfA_H_fC6Q?NkAICysqJ=k7M}6Ag|kX)JDj{Y_F<`kc#iGRf^pWj-S*R
zN2qt{48FX4jJ{`8+QyRYK&9Dd#vQgm2>2G`lIRF+I`P*hhBr2&9m()Xj$B@uNjq+w
z-3Zt1+WB4n_yp0t#$<h`XJuEWKt)4W9XhO$MekSBftO*{&)8GT{DjS%;){1W?P=N3
zJ3lDoCo@p~VGtE!heb^zl2GunxmUR0)hB7jMGVI18@Ss(wE{T$_tmmKuq<Sg-BGNO
zYGQ?mst~m~QZus657~E>1pq52aGBmL$(EWP$s<%)rc`9B!WM1b15TMQA84^7^ZU1<
zi48{PfpnW>BQ7$5_|<m>aCr@wWVAOQ3heGY;{IfFcd+rF{6~qQWv`h)vT+|RW5^@@
zQZSO4pq8@;{HH@;??fyAv%rjorPs|r;w*U~w~6Jt+L@HfVx1d7H}J!0KdrG>Ir;nV
z&c4%zQpwHP$9Ql-rZB^HqqPp^j%Q%!c@7+9CEqlezG2yuP@&4?l7h6$sIi8hzo#$t
zjX6#oR`bd>aY^i1;@w9<J)Bt_ca^O$u>zzuV(^B*Ni(j>X%3p`+oOf+X~3+&=Pc0+
z%3u!vhLB2U+j6m6DQxtXXI2$PNMm*w?9NIgqEI)e#0rS1#?c>K-0k(n4rz0<pH57^
zDO<JSS@g9FqS_d1>xiTq)XJ4VyNwyP5};grM|w}5;pw-}_SAFmPdv!~#OFs1t#t3a
z-w#xtE^_69ftR`RSspF9M(ZaM7fE(T`9T|Fc=_x31q;{0A`#xZe!pIheXN;49cxR$
znU?S}#zF}p_Z+r;4?H2YS<$eqw%8k9CNuYx1JE`zvEvk_V;h`077Wh;*r2d|<)9~S
zT*>qR{@C+Ea!-LKF^ndcxq;->%3RFV*)k;;>-vj`V!`zrT0!Exp@S{j+9)$b2gsL1
zWUM&4xZvBDpz@w-Jzml$3=$m*<VktQGmIz03W8I9lw((|GGk8U$=%gv&60Ds2aCD!
z8}sOjNTucez*IZu_Wz2vVy57?)-hC<dmQ+ptr~X*HQIO14D*WfGw!PV@1gcr#7=O3
zysmA?9j)FuM|b?wQNBX)rPh=&RyO-merbyjly0#H;ipA_pclmn>I+J(p<pV?h+$bP
z>&P7{lOvZk7~`0;t2^I`V;=HWl?u%UJ1KTvd$cLX0?OAx&-Y}d8j1X#!pP%SJOFgP
z4nCl(o{h^9Aupm(DGxZJI`wc~mv>n-xEw?8Z{3@cn{!<V<#5)cr!b-iIp0%4t2Ld9
zb87p04N?5=^xe{Zb3=9G^(aftt8lgQeu^Wh#%l4Y;-vbocg0%L9zN{p^JdOvhOQmr
zjJo*CJ{g0Hc9$`IrsEYB^#*iTHg^v4Qu6hcYO#Q98&S+RMwg$QOItgo>x(Y2o4d{%
zVzY87so;23gQC7{*BaZH=v%}LqCn=hLqp&~hNU5zkQvtC?#Zy^;<lPj^}xZM?<eZ`
z<DQs_;qgEU_SNi-5)Jzvo!tGS->T$L&wDJtH(qmDgKiqg<q!;=`akF&BP9Dr0))_V
z98N(U9^_@^>8?>y7*u$&@z7`eKT>Dkrx}{U^@e^i$Il5jefLutod{Q@Y-esKN#!OB
zBdL-FYcP}#(^Uqs=0UQTCkJMBuyK6v-RF4rz+WmYN;oC;CpuUu67<waCZAUa%qsxw
zOP%<ZRQ!pQ1}mF?b=tf^qP=D!E7AQ&U{DgSIQd0hiQ7*F5od4gOgMV>FmTq&ufcx4
z%yTOTfZCY79gJKBpS{Rf=Jv{QZmZAm5+VXcp&n@P^Cj_@lc#u%3Q%YQHZRBo_dM{s
zRs_FDyftT3-0>5preqcTU9{*2d0kG6E2rk!TQ{iMf_JT8T07;XPGoD%sdr7L)T6;#
zwYJJ`*{{m}=+UnH!>W<tG?)!__WCuhDpHyOKvI!S5b`fRHzu_fEdgyM8{@h0&Ro$8
zH&b>%4C3Q48&6ld)qbR|{#nq^2Lqx-@}&R<xMvQx15O)biJ;ILbQ^hOIkTHBDk3Ul
z&MDAT8g7N?ht}G?`eIlmKQcb>ZE_V)kFB#gsd=j|jsk-~e4VI4`FDt7%a-brGl>o-
zs-FG8lJJ9=R5gi5*J7m?Ar&(!N)Lmp?!<bDzPc^12#A1?X!?wH-A(VaT~GHJQiVLs
z&Ss0vI<ejIiu-IlZz$O`hmYSpz#i!7=EeAx@^S)1-Q<~<S1%3QGCAm$U7Q>=@L(hS
z8#cOTul-Oe2h?VE`?v33-w4YAiA~H5`*WYA;u1qGj2ZX4>fL8~z{xk>VvP%8L;_+l
zBM)F)WTx7a3hpH9%p5c;zn^qRzM5O`@*K<EMdF|<CL~}yghqEh$+z@If!6Uqhc?<!
z3l;(u-890`qlJMi%WS56nk6F_7{DNIW?R(Akt>U|SMLzYzIvQSp}WP7!_I1E+ZEd!
z0q5=K%neo4qheDm`lo%z)BmXT*3P6k^F(L4$^u73;Cj8K)Q#0*MrrD3>Q5f9*_)|&
z>$RoBr#yofro|O$b?T3t{qfKW3YTrM;8+D|US}t6+@0VutQJzk<P4w4$jJNebCl6i
zjK=dNYs-<T(oKM+*T@`$)T`33R5#@>KUf!6$A?18?4#_5vB^c<wlrS#?4riZJCmfb
z;M_K+%qi&3){f`BnZ`^wwD)79f@aOaJDomW2dF?sNtx~g6LAVr;z?wydxvR?<70Cv
zBJ;af|DZ+1(0FlqnO~P`Y?fx{M|5j^B_e4=w}yz1?DEF&h}Q%W9Id<#!#AkFcI34_
z#q)=^T0^vRkb3DzK-T}_Qvck&K;O4T9N*55-4adj^VP?&;_Zj4_pqKvTo{m_dCk_I
zOTnS-BvXQ}n>B#{PEQ@tW3{UV1FJRorR4Fr3qcHIzWBDF3QWj^^W?)V6UFPVh+<q9
z4JHtG`a-&ig@tD#FD0RIbc%LZxQa?+-(w>hA|$|Z)%v+uSXkJ-y%b#TQ*akni=LfR
z?^kLw!t1YUtp{8)A;(GlsAv0UI8bkP^Y=3y&=O?%X~@}>a}|(lxV%ii&;0&T>$2{i
z!e8FD!()=Fp~6m`vxAV_s9}kfpR+$q7IL_Da>vTpm~IMXPh8nq;?X>x;Rh&ia9I1W
zpC9M1OowOQXB<0$CFb46!j~4_Ku+PGu*gUlKtDYDakT9NP3^(AAHGTTa|L;B`F1n%
z+W-4Him1nl?b0SxJ|{CjR&34{;JNM8Q-EQ-6}9V+UvG~*#n`8=eqbytksdg&&C6#g
zT^r|9fxI0OmrcK@pux%nB62>P?lohdu21_|QA9RU4jUOK8`LL1oQ`;*&2KtW>1oy9
z_Z>C`cZ=nscRvFhMIa8q9-Hw`976y)8F1lVBp?ttuRw0x<gQVU$HFn=hC;&9E0+@h
zYwJ)_j$X1Bz-0bUuSk8xUjW#WJ!K`68<U%}>gT^#yi7+vzxeBJeY4=%iXVY(E|Av;
zgv?h`gdE`7tdFnnb&nSyBLcL}q9U%rrM`XS;dhUXhjh<d!`#$_pvD@A73Vc;{gX_N
z9+)&;&&lDod3UPv^+)05Jv}`@Umu-%A8o@T?;;N;m0>>XG<8Y3qJn~tA{RQ#g#orB
zvX6~86k0$<$_^%@riKAN@*PlhV~s2BDb{;=NqP!^1L;yVzGF8cEaowAy2Ua|Jy{s-
z{es4Vd2i}(ox;~=BXH`m^O}tSu{5p-U?7G_ebtd5%ev%`Vqq0901nL*cfO|KAGN~H
z?j5aJ)gH{{KGTJS`905g`fzHh1IBSoeV%?aU<cwjmYD-s-PgTV=V%X55%+xtk0(3=
z?|$3&5lwZtHBAU?Kf#*)#gw)1^U&IZJDF-}8c!A{|8~3jzw6>>fqsBJqf%KQ-9ZA+
zuGNM}@AI?cnp<jw+Lw&wi*__5&8vS#%fDR2f612ri^!J$(q;dhu>Vfje<$q!6m!1%
qoEi)3{9G?6fe%<Xu`jlpH?eZ*EW!*{<ey)xrSj4$QUxzw`~DaB*Brk9

literal 0
HcmV?d00001