new DR and spec for cluster monitoring, docs updated

2026-07-29 04:39:12 +03:00 · 2026-06-26 19:47:17 +02:00
parent df726f5993
commit aab2b8512d
53 changed files with 5505 additions and 737 deletions
--- a/specs/20100611_3_url_shortener.pdf
+++ b/specs/20100611_3_url_shortener.pdf
@@ -305,7 +305,7 @@ endobj
 endobj
 51 0 obj
 <<
-/Author (Android Cast project) /CreationDate (D:20260623115607+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260623115607+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+/Author (Android Cast project) /CreationDate (D:20260626184405+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260626184405+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
  /Subject (\(unspecified\)) /Title (URL shortener service \204 specification) /Trapped /False
 >>
 endobj
@@ -647,7 +647,7 @@ xref
 trailer
 <<
 /ID 
-[<dfb56bfa7fa29c8df90718f7ff48e788><dfb56bfa7fa29c8df90718f7ff48e788>]
+[<d518e6310f2e40f7990db3642e85692e><d518e6310f2e40f7990db3642e85692e>]
 % ReportLab generated PDF document -- digest (opensource)

 /Info 51 0 R
--- a/specs/20100612_1_scaling.pdf
+++ b/specs/20100612_1_scaling.pdf
@@ -425,7 +425,7 @@ endobj
 endobj
 67 0 obj
 <<
-/Author (Android Cast project) /CreationDate (D:20260623115607+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260623115607+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+/Author (Android Cast project) /CreationDate (D:20260626184405+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260626184405+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
  /Subject (\(unspecified\)) /Title (Platform scaling and multi-environment architecture \204 specification) /Trapped /False
 >>
 endobj
@@ -862,7 +862,7 @@ xref
 trailer
 <<
 /ID 
-[<c407e2764e1e7d4d181ff71ff66c0bf4><c407e2764e1e7d4d181ff71ff66c0bf4>]
+[<b59883af3aa2b268402730441ad3ae56><b59883af3aa2b268402730441ad3ae56>]
 % ReportLab generated PDF document -- digest (opensource)

 /Info 67 0 R
--- a/specs/20260618_repos_reorganizing.pdf
+++ b/specs/20260618_repos_reorganizing.pdf
@@ -530,7 +530,7 @@ endobj
 endobj
 87 0 obj
 <<
-/Author (Android Cast project) /CreationDate (D:20260623115607+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260623115607+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+/Author (Android Cast project) /CreationDate (D:20260626184406+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260626184406+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
  /Subject (\(unspecified\)) /Title (Repository and microservice reorganization \204 specification) /Trapped /False
 >>
 endobj
@@ -1109,7 +1109,7 @@ xref
 trailer
 <<
 /ID 
-[<a464cb1b9faafc78e6e7faee8af46142><a464cb1b9faafc78e6e7faee8af46142>]
+[<3c211d31a9645697899591c5f06bcc1b><3c211d31a9645697899591c5f06bcc1b>]
 % ReportLab generated PDF document -- digest (opensource)

 /Info 87 0 R
--- a/specs/20260626_cluster_monitoring.md
+++ b/specs/20260626_cluster_monitoring.md
@@ -0,0 +1,830 @@
+# Infrastructure health monitoring — specification
+
+<!-- doc-meta:start -->
+| Field | Value |
+|---|---|
+| Author | Anton Afanasyeu |
+| Revision | R0 |
+| Creation date | 2026-06-26 |
+| Last modification date | 2026-06-26 |
+| Co-authored | Cursor Agent (project assistant) |
+| Severity | high |
+| State | accepted |
+| Document type | spec |
+| Supersedes | — |
+| Design review | [docs/DRs/20260626_cluster_monitoring.md](../DRs/20260626_cluster_monitoring.md) (frozen R0) |
+<!-- doc-meta:end -->
+
+---
+
+**Document type:** SPEC  
+**Source draft:** [docs/drafts/20260626_cluster_monitoring.txt](../drafts/20260626_cluster_monitoring.txt)  
+**Design review:** [docs/DRs/20260626_cluster_monitoring.md](../DRs/20260626_cluster_monitoring.md) (frozen)  
+**PDF:** [20260626_cluster_monitoring.pdf](20260626_cluster_monitoring.pdf) · Regenerate: `bash ac-docs/build-pdf.sh`  
+**Status:** **Accepted** — implement per §7 deployment plan  
+**Scope:** Passive infrastructure monitoring and alerting for XEN cluster cast01–cast04; Track A only
+
+**Related:** [INFRA.md](../INFRA.md) · [DRs/20260626_cluster_monitoring.md](../DRs/20260626_cluster_monitoring.md) · [specs/20100612_1_scaling.md](20100612_1_scaling.md) · [20260620_postgres_timescale_db_platform.md](../20260620_postgres_timescale_db_platform.md)
+
+**Track B (future):** [drafts/20260626_cluster_orchestration.txt](../drafts/20260626_cluster_orchestration.txt)
+
+**Documentation index:** [README.md](../README.md)
+
+---
+
+## Table of contents
+
+<!-- toc -->
+- [1. Purpose](#1-purpose)
+- [2. Scope](#2-scope)
+- [3. Requirements](#3-requirements)
+  - [3.1 Must](#31-must)
+  - [3.2 Should](#32-should)
+  - [3.3 Non-goals](#33-non-goals)
+- [4. Monitoring domains](#4-monitoring-domains)
+  - [4.1 Hardware metrics](#41-hardware-metrics)
+  - [4.2 Software and service metrics](#42-software-and-service-metrics)
+  - [4.3 External availability](#43-external-availability)
+  - [4.4 Provider-layer fault escalation](#44-provider-layer-fault-escalation)
+- [5. Topology — cast04 as dedicated monitoring node](#5-topology--cast04-as-dedicated-monitoring-node)
+- [6. Component catalog](#6-component-catalog)
+  - [6.1 Alpine apk packages (cast04)](#61-alpine-apk-packages-cast04)
+  - [6.2 Alpine apk packages (cast01–cast03)](#62-alpine-apk-packages-cast0103)
+  - [6.3 Docker-based (cast04)](#63-docker-based-cast04)
+  - [6.4 External SaaS (no install)](#64-external-saas-no-install)
+- [7. Deployment plan](#7-deployment-plan)
+  - [7.1 Phase 0 — cast04 provisioning](#71-phase-0--cast04-provisioning)
+  - [7.2 Phase 1 — Prometheus + node_exporter](#72-phase-1--prometheus--node_exporter)
+  - [7.3 Phase 2 — Service probes and MariaDB exporter](#73-phase-2--service-probes-and-mariadb-exporter)
+  - [7.4 Phase 3 — Alertmanager](#74-phase-3--alertmanager)
+  - [7.5 Phase 4 — Grafana dashboards](#75-phase-4--grafana-dashboards)
+  - [7.6 Phase 5 — Uptime Kuma + UptimeRobot](#76-phase-5--uptime-kuma--uptimerobot)
+  - [7.7 ac-deploy integration](#77-ac-deploy-integration)
+- [8. Alert routing](#8-alert-routing)
+  - [8.1 Alert severity levels](#81-alert-severity-levels)
+  - [8.2 Routing rules](#82-routing-rules)
+  - [8.3 Alertmanager SMTP config (skeleton)](#83-alertmanager-smtp-config-skeleton)
+  - [8.4 Telegram receiver config (skeleton)](#84-telegram-receiver-config-skeleton)
+  - [8.5 Alert rule catalog](#85-alert-rule-catalog)
+- [9. Grafana dashboard catalog](#9-grafana-dashboard-catalog)
+- [10. Pre-requisite accounts](#10-pre-requisite-accounts)
+- [11. TimescaleDB relationship](#11-timescaledb-relationship)
+- [12. Verification and acceptance](#12-verification-and-acceptance)
+- [13. Risks and mitigations](#13-risks-and-mitigations)
+- [14. Related documents](#14-related-documents)
+- [15. Changelog](#15-changelog)
+<!-- /toc -->
+
+---
+
+## 1. Purpose
+
+Define the **normative** implementation of passive infrastructure monitoring and alerting for the AndroidCast XEN-based VM cluster. The system must:
+
+- Record hardware and software health metrics from all cluster nodes continuously
+- Alert operators promptly when measured values exceed defined thresholds
+- Provide visual dashboards for trend analysis and incident investigation
+- Detect external (provider-layer) unavailability via an independent probe
+
+This SPEC covers **Track A only** (observe, record, alert). Automated cluster remediation is Track B and is explicitly out of scope — see [drafts/20260626_cluster_orchestration.txt](../drafts/20260626_cluster_orchestration.txt).
+
+---
+
+## 2. Scope
+
+| In scope | Out of scope |
+|----------|--------------|
+| Hardware metrics: CPU, RAM, disk, NIC per node | Automated node provisioning / deprovisioning |
+| Software metrics: process health, HTTP probes, MariaDB | Log aggregation (Grafana Loki — planned R1) |
+| Alert routing: email + Telegram | Auto-scaling or auto-failover reactions |
+| External uptime probe (UptimeRobot) | Changes to FE nginx or router software |
+| Grafana dashboards (infra layer) | Business / application metrics (→ TimescaleDB) |
+| cast04 as dedicated monitoring VM | Kubernetes / service mesh |
+| ac-deploy integration (monitoring role) | SaaS external aggregator for metric data |
+| Pre-requisite account setup guide | iOS / mobile performance profiling |
+
+**Alpha constraint:** Monitoring stack MAY be deployed incrementally per §7 phases. Each phase MUST leave prior phases operational.
+
+---
+
+## 3. Requirements
+
+### 3.1 Must
+
+| ID | Requirement |
+|----|-------------|
+| R-MON-1 | cast04 dedicated monitoring VM provisioned as Alpine LTS paravirt XEN guest |
+| R-MON-2 | node_exporter running on cast01, cast02, cast03, cast04 |
+| R-MON-3 | Prometheus scraping all node_exporters on 15s interval |
+| R-MON-4 | blackbox_exporter probing all critical HTTP endpoints (§4.2) from cast04 |
+| R-MON-5 | mysqld_exporter running on MariaDB primary node |
+| R-MON-6 | Alertmanager routing CRITICAL alerts to email within 2 min of threshold breach |
+| R-MON-7 | Grafana serving dashboards on cast04 (internal access via SSH tunnel at R0) |
+| R-MON-8 | UptimeRobot external HTTP probe active for `apps.f0xx.org` |
+| R-MON-9 | All software installed via Alpine apk or Docker (no source compilation) |
+| R-MON-10 | No new software installed on FE VM or router |
+| R-MON-11 | Metric data retained locally on cast04 for minimum 90 days |
+| R-MON-12 | Alert for CPU steal time > 10% sustained 5 min (Xen overcommit indicator → notify Anton) |
+| R-MON-13 | Alert for disk write latency > 100ms sustained 5 min on MariaDB node |
+| R-MON-14 | Alert for MariaDB replication lag > 30s |
+| R-MON-15 | Hardware guarantee baseline alerts (§4.1 table) — notify when measured < guaranteed |
+
+### 3.2 Should
+
+| ID | Requirement |
+|----|-------------|
+| R-MON-S1 | Alertmanager Telegram receiver configured alongside email |
+| R-MON-S2 | Uptime Kuma status page deployed on cast04 (Docker) |
+| R-MON-S3 | Grafana provisioned with community dashboard for node_exporter (ID 1860) |
+| R-MON-S4 | Grafana provisioned with community dashboard for MariaDB |
+| R-MON-S5 | Prometheus metric retention configurable via `--storage.tsdb.retention.time` |
+| R-MON-S6 | Alertmanager grouping configured to suppress alert storms (group_wait 30s, group_interval 5m) |
+| R-MON-S7 | ac-deploy `monitoring/` role added to cluster0 scripts for reproducible deployment |
+
+### 3.3 Non-goals
+
+- Automated node scale-out or scale-in (Track B)
+- DDoS automatic mitigation (Track B)
+- Storage automatic failover (Track B)
+- Centralized log search (Grafana Loki — R1)
+- Business metrics dashboards (TimescaleDB + Grafana — separate track)
+- Monitoring of router or FE internal metrics (config-only access; UptimeRobot covers external availability)
+
+---
+
+## 4. Monitoring domains
+
+### 4.1 Hardware metrics
+
+Collected by **node_exporter** on every VM (cast01–cast04). Alert thresholds are guidelines — tune after collecting baseline.
+
+| Metric | Prometheus metric name | WARNING threshold | CRITICAL threshold | Xen note |
+|--------|----------------------|-------------------|--------------------|-----------|
+| CPU utilization | `rate(node_cpu_seconds_total{mode!="idle"}[5m])` | > 80% (5 min) | > 95% (5 min) | |
+| **CPU steal time** | `rate(node_cpu_seconds_total{mode="steal"}[5m])` | > 5% (5 min) | > 10% (5 min) | Xen overcommit → notify Anton |
+| Load average 1m | `node_load1 / node_cpu_count` | > 1.5 | > 3.0 | |
+| RAM used % | `1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes` | > 80% | > 90% | |
+| Swap used % | `node_memory_SwapFree_bytes / node_memory_SwapTotal_bytes` | > 50% | > 80% | |
+| Disk used % | `1 - node_filesystem_avail_bytes / node_filesystem_size_bytes` | > 75% | > 90% | |
+| Disk write latency | `rate(node_disk_write_time_seconds_total[5m]) / rate(node_disk_writes_completed_total[5m])` | > 50ms | > 100ms | Critical on MariaDB node |
+| Disk IOPS | `rate(node_disk_io_time_seconds_total[5m])` | > 80% | > 95% | |
+| NIC ingress bytes/s | `rate(node_network_receive_bytes_total[5m])` | > 150 Mbit/s | > 190 Mbit/s | Guaranteed: 200 Mbit/s |
+| NIC egress bytes/s | `rate(node_network_transmit_bytes_total[5m])` | > 150 Mbit/s | > 190 Mbit/s | Guaranteed: 200 Mbit/s |
+| NIC packet drops | `rate(node_network_receive_drop_total[5m])` | > 0.1% | > 1% | |
+| NIC errors | `rate(node_network_receive_errs_total[5m])` | > 0 | > 10/min | |
+
+**Hardware guarantee baseline check:** If `node_memory_MemTotal_bytes` < 7.5 GB, or CPU core count < 8, or disk total < 30 GB → CRITICAL alert (guaranteed resources not provided → notify Anton).
+
+### 4.2 Software and service metrics
+
+#### Process / systemd health (node_exporter `systemd` collector or blackbox TCP probe)
+
+| Service | Check | Alert trigger |
+|---------|-------|---------------|
+| nginx | TCP :80 probe | Connection refused → CRITICAL |
+| php-fpm | TCP socket probe | No response → CRITICAL |
+| MariaDB | TCP :3306 probe | Connection refused → CRITICAL |
+| sshd | TCP :22 probe | Connection refused → WARNING |
+| Per-microservice HTTP endpoint | HTTP GET /health or / | Non-2xx or timeout > 5s → WARNING; > 30s → CRITICAL |
+
+#### MariaDB metrics (mysqld_exporter)
+
+| Metric | Prometheus metric | WARNING | CRITICAL |
+|--------|------------------|---------|---------|
+| Replication lag | `mysql_slave_status_seconds_behind_master` | > 10s | > 30s |
+| Open connections | `mysql_global_status_threads_connected` | > 80% of max | > 95% of max |
+| Slow queries/s | `rate(mysql_global_status_slow_queries[5m])` | > 1/s | > 5/s |
+| InnoDB buffer pool hit | `mysql_global_status_innodb_buffer_pool_reads / mysql_global_status_innodb_buffer_pool_read_requests` | < 95% | < 90% |
+| Aborted connections | `rate(mysql_global_status_aborted_connects[5m])` | > 1/min | > 10/min |
+
+#### nginx metrics (via node_exporter nginx stub or blackbox HTTP probe)
+
+| Metric | Source | WARNING | CRITICAL |
+|--------|--------|---------|---------|
+| 5xx response rate | blackbox HTTP probe returning 5xx | Any 5xx returned | > 10% of requests |
+| Response time | blackbox `probe_duration_seconds` | > 2s | > 10s |
+
+#### php-fpm metrics (via php-fpm status endpoint + blackbox or custom exporter)
+
+| Metric | WARNING | CRITICAL |
+|--------|---------|---------|
+| Active workers % of max | > 70% | > 90% |
+| Queue length | > 5 | > 20 |
+
+### 4.3 External availability
+
+**Tool:** UptimeRobot free tier — no installation; checks from UptimeRobot's global nodes.
+
+| Monitor | URL | Check interval | Alert on |
+|---------|-----|---------------|---------|
+| Frontend TLS | `https://apps.f0xx.org` | 5 min | Non-2xx or timeout |
+| API health | `https://apps.f0xx.org/app/androidcast_project/` | 5 min | Non-2xx or timeout |
+
+**Internal cross-check:** blackbox_exporter on cast04 also probes the FE endpoint from inside the cluster. If UptimeRobot fires but blackbox does NOT → provider/uplink fault (Anton's layer). If both fire → likely cluster-side issue.
+
+### 4.4 Provider-layer fault escalation
+
+When monitoring detects that the root cause is in Anton's infrastructure layer:
+
+| Symptom | Likely cause | Action |
+|---------|-------------|--------|
+| CPU steal > 10% sustained | Xen host overcommit | Email Anton; await response |
+| Disk write latency persistent despite low I/O | Xen host disk contention | Email Anton |
+| NIC saturation below 200 Mbit guarantee | Uplink / Xen host NIC | Email Anton |
+| UptimeRobot alert + cast04 unreachable | Xen host or uplink down | Email Anton; check intra-network |
+| Entire cluster unreachable | Router / uplink / payment | Email Anton; check calendar |
+
+These events are **alert-only** at R0. No automated remediation.
+
+---
+
+## 5. Topology — cast04 as dedicated monitoring node
+
+```text
+10.7.0.0/8 internal network
+                                    ┌────────────────────────────────────────┐
+                                    │ cast04 — monitoring VM (Alpine LTS)    │
+                                    │                                        │
+  cast01 ──[ :9100 node_exporter ]──┤                                        │
+  cast02 ──[ :9100 node_exporter ]──┤──► Prometheus :9090                    │
+  cast03 ──[ :9100 node_exporter ]──┤       ├── scrape all :9100             │
+  cast04 ──[ :9100 node_exporter ]──┘       ├── scrape :9104 (mysqld)        │
+  MariaDB node ─[ :9104 mysqld_exp ]         └── evaluate alert rules        │
+                                                      │                      │
+                                                      ▼                      │
+                                             Alertmanager :9093              │
+                                              ├── email (SMTP relay)         │
+                                              └── Telegram bot API           │
+                                                                             │
+                                    blackbox_exporter :9115                  │
+                                      └── HTTP/TCP probes → cast01–03,       │
+                                          FE endpoint, per-service /health   │
+                                                                             │
+                                    Grafana :3000                            │
+                                      ├── datasource: Prometheus             │
+                                      └── datasource: TimescaleDB (future)  │
+                                                                             │
+                                    Uptime Kuma :3001 (Docker)               │
+                                      └── per-service status page            │
+                                    └───────────────────────────────────────┘
+
+External (no install):
+  UptimeRobot ──► HTTP probe ──► apps.f0xx.org (from internet)
+```
+
+**cast04 minimum provisioning request (to Anton):**
+
+```
+VM name:    cast04
+VM type:    paravirt XEN guest
+OS:         Alpine Linux latest LTS (64-bit)
+CPU:        2 vCPU
+RAM:        2 GB
+Disk:       32 GB (non-shared)
+Network:    Internal 10.7.0.0/8 + internet egress (for Alertmanager SMTP / Telegram API calls)
+```
+
+---
+
+## 6. Component catalog
+
+### 6.1 Alpine apk packages (cast04)
+
+```bash
+apk update && apk upgrade
+apk add prometheus alertmanager grafana \
+        prometheus-node-exporter \
+        prometheus-blackbox-exporter \
+        docker docker-cli docker-compose
+```
+
+| Package | Alpine repo | Version policy |
+|---------|------------|---------------|
+| `prometheus` | community/edge | latest stable in repo |
+| `alertmanager` | community/edge | latest stable |
+| `grafana` | community/edge | latest stable |
+| `prometheus-node-exporter` | community | latest stable |
+| `prometheus-blackbox-exporter` | community | latest stable |
+| `docker` | community | for Uptime Kuma container |
+
+If a package is only in Alpine **edge** repo, add the edge community URL to `/etc/apk/repositories` and pin via `/etc/apk/world`.
+
+### 6.2 Alpine apk packages (cast01–cast03)
+
+Install only the node exporter on each workload node:
+
+```bash
+apk add prometheus-node-exporter
+rc-update add node-exporter default
+rc-service node-exporter start
+```
+
+On the MariaDB primary node, additionally:
+
+```bash
+apk add prometheus-mysqld-exporter
+# Create limited MariaDB user for exporter:
+mysql -e "CREATE USER 'prom_exporter'@'localhost' IDENTIFIED BY '<password>';"
+mysql -e "GRANT PROCESS, REPLICATION CLIENT, SELECT ON *.* TO 'prom_exporter'@'localhost';"
+# Configure /etc/prometheus-mysqld-exporter/mysqld_exporter.env
+# DATA_SOURCE_NAME='prom_exporter:<password>@(localhost:3306)/'
+rc-update add mysqld-exporter default
+rc-service mysqld-exporter start
+```
+
+### 6.3 Docker-based (cast04)
+
+```bash
+rc-update add docker default
+rc-service docker start
+
+# Uptime Kuma
+docker run -d --restart=always \
+  --name uptime-kuma \
+  -p 3001:3001 \
+  -v uptime-kuma:/app/data \
+  louislam/uptime-kuma:latest
+```
+
+### 6.4 External SaaS (no install)
+
+| Service | URL | Action |
+|---------|-----|--------|
+| UptimeRobot | https://uptimerobot.com | Create free account; add HTTP monitor for `https://apps.f0xx.org`; configure email alert |
+
+---
+
+## 7. Deployment plan
+
+Deploy phases in order. Each phase MUST be verified before starting the next.
+
+### 7.1 Phase 0 — cast04 provisioning
+
+**Goal:** cast04 VM exists and is reachable from cast01–cast03 on internal network.
+
+| Action | Detail |
+|--------|--------|
+| Request VM | Ask Anton for cast04 — spec per §5 table |
+| Base install | Alpine latest LTS; configure apk repos (community + edge) |
+| SSH access | Add developer SSH key; test login |
+| Network | Confirm cast04 can reach cast01–03 IPs on internal network |
+| NTP | `apk add chrony && rc-service chronyd start` |
+
+**Verify:** `ssh cast04 ping cast01` succeeds; `apk update` succeeds.
+
+### 7.2 Phase 1 — Prometheus + node_exporter
+
+**Goal:** Prometheus scraping hardware metrics from all nodes.
+
+```bash
+# On cast04:
+apk add prometheus prometheus-node-exporter
+
+# /etc/prometheus/prometheus.yml
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: 'node'
+    static_configs:
+      - targets:
+          - 'cast01:9100'
+          - 'cast02:9100'
+          - 'cast03:9100'
+          - 'cast04:9100'
+
+rc-update add prometheus default
+rc-update add node-exporter default
+rc-service prometheus start
+rc-service node-exporter start
+```
+
+On cast01–cast03: install and start `prometheus-node-exporter` (§6.2).
+
+**Verify:** `curl http://cast04:9090/api/v1/targets` shows all 4 nodes in state `up`.
+
+### 7.3 Phase 2 — Service probes and MariaDB exporter
+
+**Goal:** HTTP/TCP probes and MariaDB metrics flowing.
+
+Add to `prometheus.yml`:
+
+```yaml
+  - job_name: 'blackbox_http'
+    metrics_path: /probe
+    params:
+      module: [http_2xx]
+    static_configs:
+      - targets:
+          - https://apps.f0xx.org
+          - http://cast01:80      # nginx on workload nodes
+          # add per-microservice /health endpoints as they exist
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: cast04:9115   # blackbox_exporter
+
+  - job_name: 'blackbox_tcp'
+    metrics_path: /probe
+    params:
+      module: [tcp_connect]
+    static_configs:
+      - targets:
+          - cast01:3306   # MariaDB
+          - cast02:3306   # replica
+          - cast01:22
+          - cast02:22
+          - cast03:22
+    relabel_configs:
+      - source_labels: [__address__]
+        target_label: __param_target
+      - source_labels: [__param_target]
+        target_label: instance
+      - target_label: __address__
+        replacement: cast04:9115
+
+  - job_name: 'mariadb'
+    static_configs:
+      - targets: ['<mariadb-primary-node>:9104']
+```
+
+Start services:
+
+```bash
+rc-service blackbox-exporter start
+rc-service mysqld-exporter start   # on MariaDB node
+```
+
+**Verify:** `curl "http://cast04:9115/probe?target=https://apps.f0xx.org&module=http_2xx"` returns `probe_success 1`.
+
+### 7.4 Phase 3 — Alertmanager
+
+**Goal:** Alerts route to email and (optionally) Telegram on threshold breach.
+
+See §8 for full Alertmanager config skeletons. Deploy skeleton, then fill in SMTP credentials and Telegram token.
+
+```bash
+apk add alertmanager
+# Edit /etc/alertmanager/alertmanager.yml (see §8.3 + §8.4)
+rc-update add alertmanager default
+rc-service alertmanager start
+```
+
+Add `alerting:` and `rule_files:` blocks to `prometheus.yml` (see §8.5 for rule file examples).
+
+**Verify:** `amtool --alertmanager.url=http://cast04:9093 alert` returns empty (no active alerts); send a test alert and confirm email receipt.
+
+### 7.5 Phase 4 — Grafana dashboards
+
+**Goal:** Visual dashboards accessible for all metrics collected in phases 1–3.
+
+```bash
+apk add grafana
+rc-update add grafana default
+rc-service grafana start
+# Access: http://cast04:3000 (via SSH tunnel: ssh -L 3000:cast04:3000 cast04)
+```
+
+In Grafana UI:
+1. Add Prometheus datasource: `http://localhost:9090`
+2. Import community dashboard **1860** ("Node Exporter Full") — covers §4.1 metrics
+3. Import community dashboard **7362** or **13106** (MariaDB / mysqld_exporter)
+4. Create custom panel for blackbox probe results (status per service endpoint)
+5. Create overview panel showing hardware guarantee baseline vs measured values
+
+**Verify:** All four dashboards render data; node_exporter CPU steal panel shows non-zero (or zero — both valid).
+
+### 7.6 Phase 5 — Uptime Kuma + UptimeRobot
+
+**Goal:** Service status page + external probe active.
+
+```bash
+# Uptime Kuma on cast04 (Docker):
+rc-service docker start
+docker run -d --restart=always --name uptime-kuma \
+  -p 3001:3001 -v uptime-kuma:/app/data louislam/uptime-kuma:latest
+# Access: http://cast04:3001 (via SSH tunnel)
+```
+
+Configure monitors in Uptime Kuma UI:
+- Add HTTP monitors for each microservice `/health` endpoint
+- Add TCP monitors for MariaDB :3306, nginx :80
+- Configure notification to same email as Alertmanager
+
+**UptimeRobot:**
+- Register free account at https://uptimerobot.com
+- Add HTTP(s) monitor: `https://apps.f0xx.org`, 5-minute interval
+- Add email alert notification (same ops email as Alertmanager)
+
+**Verify:** Uptime Kuma dashboard shows all green; UptimeRobot sends test notification successfully.
+
+### 7.7 ac-deploy integration
+
+Add a `monitoring/` role to cluster0 deploy scripts in `ac-deploy/sim/cluster0/`:
+
+```
+ac-deploy/sim/cluster0/
+  monitoring/
+    deploy-monitoring.sh      # installs cast04 components
+    prometheus.yml.j2         # Jinja2/envsubst template with node IPs
+    alertmanager.yml.j2       # template with SMTP/Telegram creds from env
+    alert-rules/
+      hardware.yml             # §4.1 rules
+      services.yml             # §4.2 rules
+    grafana/
+      datasources.yml          # auto-provision Prometheus datasource
+      dashboards/              # provisioned dashboard JSONs
+```
+
+Credentials (SMTP password, Telegram token) MUST be passed via environment variables or a secrets file outside git — never committed.
+
+**Verify:** `bash deploy-monitoring.sh` on a fresh cast04 produces a running stack within 10 minutes.
+
+---
+
+## 8. Alert routing
+
+### 8.1 Alert severity levels
+
+| Level | Meaning | Response |
+|-------|---------|---------|
+| `critical` | Service down or hardware limit exceeded | Alert immediately; wake operator if outside hours |
+| `warning` | Approaching threshold; degraded | Alert during business hours; batch in digest |
+| `info` | Notable event; no action required | Log only; no alert |
+
+### 8.2 Routing rules
+
+```
+critical → email (immediately) + Telegram (immediately)
+warning  → email (grouped, 5 min window)
+info     → no alert (recorded in Prometheus only)
+```
+
+### 8.3 Alertmanager SMTP config (skeleton)
+
+```yaml
+# /etc/alertmanager/alertmanager.yml
+global:
+  smtp_smarthost: 'smtp.gmail.com:587'      # or Mailgun: smtp.mailgun.org:587
+  smtp_from: 'alerts@your-domain.com'
+  smtp_auth_username: 'your-gmail@gmail.com'
+  smtp_auth_password: '<APP_PASSWORD>'       # from env / secrets file
+  smtp_require_tls: true
+
+route:
+  group_by: ['alertname', 'instance']
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+  receiver: 'ops-email'
+  routes:
+    - match:
+        severity: critical
+      receiver: 'ops-critical'
+      group_wait: 10s
+      repeat_interval: 1h
+
+receivers:
+  - name: 'ops-email'
+    email_configs:
+      - to: 'ops@your-domain.com'
+        send_resolved: true
+
+  - name: 'ops-critical'
+    email_configs:
+      - to: 'ops@your-domain.com'
+        send_resolved: true
+    telegram_configs:
+      - bot_token: '<TELEGRAM_BOT_TOKEN>'    # from env / secrets file
+        chat_id: <TELEGRAM_CHAT_ID>
+        send_resolved: true
+
+inhibit_rules:
+  - source_match:
+      severity: 'critical'
+    target_match:
+      severity: 'warning'
+    equal: ['instance']
+```
+
+**Note:** Replace `<APP_PASSWORD>` and `<TELEGRAM_BOT_TOKEN>` with values from environment — never commit credentials to git.
+
+### 8.4 Telegram receiver config (skeleton)
+
+Obtain Telegram credentials:
+1. Open Telegram, message `@BotFather`
+2. `/newbot` → follow prompts → save `TOKEN`
+3. Add the bot to your ops group or DM it, then: `curl https://api.telegram.org/bot<TOKEN>/getUpdates` → find `chat.id`
+4. Set `TELEGRAM_BOT_TOKEN=<TOKEN>` and `TELEGRAM_CHAT_ID=<CHAT_ID>` in the secrets file used by deploy script
+
+### 8.5 Alert rule catalog
+
+Create `/etc/prometheus/rules/hardware.yml`:
+
+```yaml
+groups:
+  - name: hardware
+    rules:
+      - alert: CpuHighUtilization
+        expr: 100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 95
+        for: 5m
+        labels:
+          severity: critical
+        annotations:
+          summary: "CPU critical on {{ $labels.instance }}"
+          description: "CPU utilization {{ $value | humanize }}% > 95%"
+
+      - alert: XenCpuStealHigh
+        expr: avg by(instance) (rate(node_cpu_seconds_total{mode="steal"}[5m])) * 100 > 10
+        for: 5m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Xen CPU steal critical on {{ $labels.instance }} — notify Anton"
+          description: "CPU steal {{ $value | humanize }}% > 10% — hypervisor overcommit"
+
+      - alert: RamCritical
+        expr: (1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100 > 90
+        for: 5m
+        labels:
+          severity: critical
+        annotations:
+          summary: "RAM critical on {{ $labels.instance }}"
+
+      - alert: DiskCritical
+        expr: (1 - node_filesystem_avail_bytes{fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes) * 100 > 90
+        for: 5m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Disk critical on {{ $labels.instance }} mount {{ $labels.mountpoint }}"
+
+      - alert: DiskWriteLatencyHigh
+        expr: >
+          rate(node_disk_write_time_seconds_total[5m])
+          / rate(node_disk_writes_completed_total[5m]) * 1000 > 100
+        for: 5m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Disk write latency critical on {{ $labels.instance }} — possible HW fault; notify Anton"
+
+      - alert: HardwareGuaranteeRamBreach
+        expr: node_memory_MemTotal_bytes < 7.5 * 1024 * 1024 * 1024
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "RAM below guaranteed 8 GB on {{ $labels.instance }} — notify Anton"
+```
+
+Create `/etc/prometheus/rules/services.yml`:
+
+```yaml
+groups:
+  - name: services
+    rules:
+      - alert: ServiceDown
+        expr: probe_success == 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "Service unreachable: {{ $labels.instance }}"
+
+      - alert: ServiceSlowResponse
+        expr: probe_duration_seconds > 10
+        for: 2m
+        labels:
+          severity: warning
+        annotations:
+          summary: "Slow response from {{ $labels.instance }}: {{ $value | humanize }}s"
+
+      - alert: MariaDbReplicationLag
+        expr: mysql_slave_status_seconds_behind_master > 30
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: "MariaDB replication lag {{ $value | humanize }}s on {{ $labels.instance }}"
+
+      - alert: MariaDbDown
+        expr: mysql_up == 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: "MariaDB exporter cannot reach database on {{ $labels.instance }}"
+```
+
+Add to `prometheus.yml`:
+
+```yaml
+rule_files:
+  - "/etc/prometheus/rules/*.yml"
+
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets: ['cast04:9093']
+```
+
+---
+
+## 9. Grafana dashboard catalog
+
+| Dashboard | Grafana ID | Source | Covers |
+|-----------|-----------|--------|--------|
+| Node Exporter Full | 1860 | community | CPU, RAM, disk, NIC, load — all §4.1 metrics |
+| MariaDB Overview | 7362 | community | Connections, queries, replication lag, InnoDB |
+| Blackbox Exporter | 7587 | community | HTTP probe success/latency per target |
+| Custom: Hardware Guarantee | — | create | Measured vs Anton's guaranteed values |
+| Custom: Service Health Overview | — | create | All service probes in one panel grid |
+
+**Provisioning via ac-deploy:** export dashboard JSON from Grafana UI after customization and store in `ac-deploy/sim/cluster0/monitoring/grafana/dashboards/`. Add datasource YAML to `grafana/datasources/prometheus.yml`.
+
+---
+
+## 10. Pre-requisite accounts
+
+The following must be created by the project owner before Phase 3 deploy:
+
+| Account | Service | Purpose | Notes |
+|---------|---------|---------|-------|
+| Gmail app password | Gmail Settings → Security → App passwords | Alertmanager SMTP relay | App password, not account password. Alternatively: Mailgun free (10k/month) |
+| Telegram bot | @BotFather in Telegram | Alertmanager Telegram receiver | `/newbot` → TOKEN; `getUpdates` → CHAT_ID |
+| UptimeRobot free | https://uptimerobot.com | External HTTP probe | Add monitor for `https://apps.f0xx.org` |
+
+**Important:** ImprovMX and addy.io provide inbound email routing (MX records) — they are not outbound SMTP relay services and cannot be used with Alertmanager. Use Gmail app password or a dedicated transactional email service (Mailgun, SendGrid) for outbound alerts.
+
+---
+
+## 11. TimescaleDB relationship
+
+This SPEC implements infra-layer monitoring. Business and application metrics are a separate concern handled by the TimescaleDB platform plan ([20260620_postgres_timescale_db_platform.md](../20260620_postgres_timescale_db_platform.md)).
+
+| Layer | Store | Examples | Retention |
+|-------|-------|----------|-----------|
+| Infrastructure | Prometheus TSDB on cast04 | CPU steal, disk latency, service probe | 90 days |
+| Business / application | TimescaleDB (PostgreSQL) | Crash rate, session count, graph analytics | Long-term (configurable) |
+
+Grafana on cast04 can query both stores simultaneously. No ETL or data duplication is required between them. The TimescaleDB datasource is added to Grafana as a second datasource in a future step — it does not affect R0 monitoring deployment.
+
+---
+
+## 12. Verification and acceptance
+
+All phases must pass their gate before the next phase begins.
+
+| Phase | Acceptance criteria |
+|-------|---------------------|
+| 0 | cast04 reachable from cast01–03; `apk update` succeeds |
+| 1 | `curl http://cast04:9090/api/v1/targets` shows all 4 nodes state=up |
+| 2 | Blackbox probe for `https://apps.f0xx.org` returns `probe_success 1`; mysqld_exporter metrics visible in Prometheus |
+| 3 | Test alert fires and email is received within 2 minutes; Telegram notification received (if configured) |
+| 4 | Grafana dashboard 1860 renders data for all nodes; MariaDB dashboard shows replication status |
+| 5 | Uptime Kuma shows all services green; UptimeRobot sends test notification |
+| ac-deploy | Fresh cast04 reproduced by running `deploy-monitoring.sh` within 10 minutes |
+
+**Ongoing regression:** After any cluster change (new microservice, new VM, nginx config change), add corresponding blackbox probe target and Grafana panel within 48 hours.
+
+---
+
+## 13. Risks and mitigations
+
+| Risk | Mitigation |
+|------|------------|
+| cast04 itself fails — monitoring blind | UptimeRobot external probe continues; Alertmanager writes state to disk and resumes after VM restart |
+| XEN host failure takes cast04 offline | UptimeRobot fires from external — operator is alerted even without cast04 |
+| Alpine edge package breaks Prometheus | Pin version in `/etc/apk/world`; test upgrades on cast04 before rolling to workload nodes |
+| SMTP rate limit during incident storm | Alertmanager `group_interval: 5m` + `repeat_interval: 4h` limit volume; Telegram is parallel channel |
+| Prometheus disk overflow | 32 GB cast04 disk; estimated < 5 GB for 3 nodes at 15s scrape over 90 days; monitor cast04 disk in Grafana |
+| Credentials leaked in git | Secrets must be in environment variables or a secrets file excluded from git (`.gitignore`); never in `prometheus.yml` or `alertmanager.yml` committed to repo |
+| FE/router metrics unavailable | FE nginx stub_status available via config if Anton allows; not mandatory — blackbox HTTP probe sufficient at R0 |
+
+---
+
+## 14. Related documents
+
+| Document | Role |
+|----------|------|
+| [DRs/20260626_cluster_monitoring.md](../DRs/20260626_cluster_monitoring.md) | Frozen design review (source of this SPEC) |
+| [drafts/20260626_cluster_orchestration.txt](../drafts/20260626_cluster_orchestration.txt) | Track B — auto-remediation placeholder |
+| [INFRA.md](../INFRA.md) | FE/BE topology, hosts, ports |
+| [specs/20100612_1_scaling.md](20100612_1_scaling.md) | VM roles and cluster layout |
+| [specs/20260618_repos_reorganizing.md](20260618_repos_reorganizing.md) | Microservice split (each new MS needs a blackbox probe) |
+| [20260620_postgres_timescale_db_platform.md](../20260620_postgres_timescale_db_platform.md) | Business metrics store (complements Prometheus) |
+| [GRAFANA_vs_others_graphvis_pivot.md](../GRAFANA_vs_others_graphvis_pivot.md) | Earlier Grafana evaluation for application analytics |
+| [orchestration/sim/cluster0/ARCHITECTURE.md](../../orchestration/sim/cluster0/ARCHITECTURE.md) | Lab cluster node layout |
+
+---
+
+## 15. Changelog
+
+| Rev | Date | Change |
+|-----|------|--------|
+| R0 | 2026-06-26 | SPEC converted from draft + DR R0; all decisions locked; deployment plan §7; alert rules §8 |
--- a/specs/20260626_cluster_monitoring.pdf
+++ b/specs/20260626_cluster_monitoring.pdf
@@ -0,0 +1,778 @@
+%PDF-1.4
+%“Œ‹ž ReportLab Generated PDF document (opensource)
+1 0 obj
+<<
+/F1 2 0 R /F2 3 0 R /F3 42 0 R /F4 43 0 R /F5 44 0 R /F6 45 0 R
+>>
+endobj
+2 0 obj
+<<
+/BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font
+>>
+endobj
+3 0 obj
+<<
+/BaseFont /Helvetica-Bold /Encoding /WinAnsiEncoding /Name /F2 /Subtype /Type1 /Type /Font
+>>
+endobj
+4 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 762.0394 84.37304 773.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+5 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 751.0394 77.26104 762.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+6 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 740.0394 104.373 751.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+7 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 729.6019 88.44754 739.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+8 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 719.6019 95.54254 729.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+9 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 709.6019 106.3725 719.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+10 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 699.0394 124.381 710.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+11 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 688.6019 130.95 698.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+12 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 678.6019 168.4725 688.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+13 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 668.6019 136.38 678.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+14 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 658.6019 170.9775 668.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+15 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 648.0394 230.669 659.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+16 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 637.0394 123.949 648.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+17 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 626.6019 170.5725 636.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+18 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 616.6019 196.8375 626.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+19 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 606.6019 148.05 616.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+20 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 596.6019 156.81 606.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+21 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 586.0394 114.605 597.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+22 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 575.6019 175.575 585.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+23 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 565.6019 208.725 575.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+24 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 555.6019 236.8425 565.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+25 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 545.6019 156.3975 555.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+26 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 535.6019 179.7525 545.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+27 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 525.6019 209.1225 535.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+28 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 515.6019 141.81 525.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+29 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 505.0394 97.70904 516.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+30 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 494.6019 136.7925 504.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+31 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 484.6019 116.3775 494.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+32 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 474.6019 197.235 484.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+33 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 464.6019 189.7275 474.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+34 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 59.68504 454.6019 128.4675 464.6019 ] /Subtype /Link /Type /Annot
+>>
+endobj
+35 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 444.0394 151.525 455.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+36 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 433.0394 138.613 444.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+37 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 422.0394 149.717 433.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+38 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 411.0394 157.301 422.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+39 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 400.0394 134.605 411.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+40 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 389.0394 127.949 400.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+41 0 obj
+<<
+/Border [ 0 0 0 ] /Contents () /Dest [ 46 0 R /Fit ] /Rect [ 45.68504 378.0394 97.71704 389.0394 ] /Subtype /Link /Type /Annot
+>>
+endobj
+42 0 obj
+<<
+/BaseFont /Helvetica-Oblique /Encoding /WinAnsiEncoding /Name /F3 /Subtype /Type1 /Type /Font
+>>
+endobj
+43 0 obj
+<<
+/BaseFont /Courier /Encoding /WinAnsiEncoding /Name /F4 /Subtype /Type1 /Type /Font
+>>
+endobj
+44 0 obj
+<<
+/BaseFont /Symbol /Name /F5 /Subtype /Type1 /Type /Font
+>>
+endobj
+45 0 obj
+<<
+/BaseFont /ZapfDingbats /Name /F6 /Subtype /Type1 /Type /Font
+>>
+endobj
+46 0 obj
+<<
+/Contents 100 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+47 0 obj
+<<
+/Annots [ 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 
+  14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 
+  24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 
+  34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R ] /Contents 101 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 
+  /Trans <<
+
+>> /Type /Page
+>>
+endobj
+48 0 obj
+<<
+/Contents 102 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+49 0 obj
+<<
+/Contents 103 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+50 0 obj
+<<
+/Contents 104 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+51 0 obj
+<<
+/Contents 105 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+52 0 obj
+<<
+/Contents 106 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+53 0 obj
+<<
+/Contents 107 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+54 0 obj
+<<
+/Contents 108 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+55 0 obj
+<<
+/Contents 109 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+56 0 obj
+<<
+/Contents 110 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+57 0 obj
+<<
+/Contents 111 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 99 0 R /Resources <<
+/Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ]
+>> /Rotate 0 /Trans <<
+
+>> 
+  /Type /Page
+>>
+endobj
+58 0 obj
+<<
+/Outlines 60 0 R /PageMode /UseNone /Pages 99 0 R /Type /Catalog
+>>
+endobj
+59 0 obj
+<<
+/Author (Android Cast project) /CreationDate (D:20260626184407+02'00') /Creator (\(unspecified\)) /Keywords () /ModDate (D:20260626184407+02'00') /Producer (ReportLab PDF Library - \(opensource\)) 
+  /Subject (\(unspecified\)) /Title (Infrastructure health monitoring \204 specification) /Trapped /False
+>>
+endobj
+60 0 obj
+<<
+/Count 43 /First 61 0 R /Last 98 0 R /Type /Outlines
+>>
+endobj
+61 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 62 0 R /Parent 60 0 R /Title (1. Purpose)
+>>
+endobj
+62 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 63 0 R /Parent 60 0 R /Prev 61 0 R /Title (2. Scope)
+>>
+endobj
+63 0 obj
+<<
+/Count 3 /Dest [ 46 0 R /Fit ] /First 64 0 R /Last 66 0 R /Next 67 0 R /Parent 60 0 R 
+  /Prev 62 0 R /Title (3. Requirements)
+>>
+endobj
+64 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 65 0 R /Parent 63 0 R /Title (3.1 Must)
+>>
+endobj
+65 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 66 0 R /Parent 63 0 R /Prev 64 0 R /Title (3.2 Should)
+>>
+endobj
+66 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 63 0 R /Prev 65 0 R /Title (3.3 Non-goals)
+>>
+endobj
+67 0 obj
+<<
+/Count 4 /Dest [ 46 0 R /Fit ] /First 68 0 R /Last 71 0 R /Next 72 0 R /Parent 60 0 R 
+  /Prev 63 0 R /Title (4. Monitoring domains)
+>>
+endobj
+68 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 69 0 R /Parent 67 0 R /Title (4.1 Hardware metrics)
+>>
+endobj
+69 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 70 0 R /Parent 67 0 R /Prev 68 0 R /Title (4.2 Software and service metrics)
+>>
+endobj
+70 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 71 0 R /Parent 67 0 R /Prev 69 0 R /Title (4.3 External availability)
+>>
+endobj
+71 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 67 0 R /Prev 70 0 R /Title (4.4 Provider-layer fault escalation)
+>>
+endobj
+72 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 73 0 R /Parent 60 0 R /Prev 67 0 R /Title (5. Topology \204 cast04 as dedicated monitoring node)
+>>
+endobj
+73 0 obj
+<<
+/Count 4 /Dest [ 46 0 R /Fit ] /First 74 0 R /Last 77 0 R /Next 78 0 R /Parent 60 0 R 
+  /Prev 72 0 R /Title (6. Component catalog)
+>>
+endobj
+74 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 75 0 R /Parent 73 0 R /Title (6.1 Alpine apk packages \(cast04\))
+>>
+endobj
+75 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 76 0 R /Parent 73 0 R /Prev 74 0 R /Title (6.2 Alpine apk packages \(cast01\205cast03\))
+>>
+endobj
+76 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 77 0 R /Parent 73 0 R /Prev 75 0 R /Title (6.3 Docker-based \(cast04\))
+>>
+endobj
+77 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 73 0 R /Prev 76 0 R /Title (6.4 External SaaS \(no install\))
+>>
+endobj
+78 0 obj
+<<
+/Count 7 /Dest [ 46 0 R /Fit ] /First 79 0 R /Last 85 0 R /Next 86 0 R /Parent 60 0 R 
+  /Prev 73 0 R /Title (7. Deployment plan)
+>>
+endobj
+79 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 80 0 R /Parent 78 0 R /Title (7.1 Phase 0 \204 cast04 provisioning)
+>>
+endobj
+80 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 81 0 R /Parent 78 0 R /Prev 79 0 R /Title (7.2 Phase 1 \204 Prometheus + node_exporter)
+>>
+endobj
+81 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 82 0 R /Parent 78 0 R /Prev 80 0 R /Title (7.3 Phase 2 \204 Service probes and MariaDB exporter)
+>>
+endobj
+82 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 83 0 R /Parent 78 0 R /Prev 81 0 R /Title (7.4 Phase 3 \204 Alertmanager)
+>>
+endobj
+83 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 84 0 R /Parent 78 0 R /Prev 82 0 R /Title (7.5 Phase 4 \204 Grafana dashboards)
+>>
+endobj
+84 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 85 0 R /Parent 78 0 R /Prev 83 0 R /Title (7.6 Phase 5 \204 Uptime Kuma + UptimeRobot)
+>>
+endobj
+85 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 78 0 R /Prev 84 0 R /Title (7.7 ac-deploy integration)
+>>
+endobj
+86 0 obj
+<<
+/Count 5 /Dest [ 46 0 R /Fit ] /First 87 0 R /Last 91 0 R /Next 92 0 R /Parent 60 0 R 
+  /Prev 78 0 R /Title (8. Alert routing)
+>>
+endobj
+87 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 88 0 R /Parent 86 0 R /Title (8.1 Alert severity levels)
+>>
+endobj
+88 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 89 0 R /Parent 86 0 R /Prev 87 0 R /Title (8.2 Routing rules)
+>>
+endobj
+89 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 90 0 R /Parent 86 0 R /Prev 88 0 R /Title (8.3 Alertmanager SMTP config \(skeleton\))
+>>
+endobj
+90 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 91 0 R /Parent 86 0 R /Prev 89 0 R /Title (8.4 Telegram receiver config \(skeleton\))
+>>
+endobj
+91 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 86 0 R /Prev 90 0 R /Title (8.5 Alert rule catalog)
+>>
+endobj
+92 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 93 0 R /Parent 60 0 R /Prev 86 0 R /Title (9. Grafana dashboard catalog)
+>>
+endobj
+93 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 94 0 R /Parent 60 0 R /Prev 92 0 R /Title (10. Pre-requisite accounts)
+>>
+endobj
+94 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 95 0 R /Parent 60 0 R /Prev 93 0 R /Title (11. TimescaleDB relationship)
+>>
+endobj
+95 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 96 0 R /Parent 60 0 R /Prev 94 0 R /Title (12. Verification and acceptance)
+>>
+endobj
+96 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 97 0 R /Parent 60 0 R /Prev 95 0 R /Title (13. Risks and mitigations)
+>>
+endobj
+97 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Next 98 0 R /Parent 60 0 R /Prev 96 0 R /Title (14. Related documents)
+>>
+endobj
+98 0 obj
+<<
+/Dest [ 46 0 R /Fit ] /Parent 60 0 R /Prev 97 0 R /Title (15. Changelog)
+>>
+endobj
+99 0 obj
+<<
+/Count 12 /Kids [ 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 
+  56 0 R 57 0 R ] /Type /Pages
+>>
+endobj
+100 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1000
+>>
+stream
+Gat=+gMWc?&:Ml+b[Xj+Nbs/pa)3Q2?1hWqTREh>+`J'o"L;E5Fh`BBg4[Wr";"0:f]UJHnVfUB^ucj&J%,[Wk/6PJ!28=(JM>$XIt@oTnn1;'AhoC"b:s)J-,P\_%*f8+lr&U#J/h?mklR$<HAk+tRM\e?1aBio)A<ej[jEN2#$d*8k>[gg5D#pXaYF6ESJ@hN1'MG.D"JXSBbK_gMj"mg:b!XGWA%Yu@A)X;\H`'Cr#;"]WJpC\F.H2^#i_+qNeo+h[-ql)%cX,WM06a)#hp.kI3gOq4l!jn_ol&CAm6L-Y?n@BdQ=gVM5VptXn<";2%*gOa?=hhmp(^f_?;gA*hpRUBkl!amdeA:g?UGJj&:"q8][QQ5G4Mfb]FOT^<Gr'+dSI?`>Dp)RF`;kLi2(TH7?@8C=<,TfAN4G,f/TCG'_V)EL+`6Q'qRfX%d[o7gUQ!@3W]Frsgr@C,+>f[`UX9ESMT>8_r<AU"=#0_j:tbM,"_o>m<l^J#M@S9cIaA"KFaO=8Ot\D/pZ>8!)a`Z$:45mP7f1a:JNd]t1*U&%=eY'iQZ\<-0P_"pa/0m,)EqNfIaE:Ci1alK*O9*r0mrPSpWMeE[D:,0SFDDHA=8jojFMl'i#;"F2'O3_4AE8HrXCO;;T7Z<2T]G%EZ-3aSpM`3R4a=m01k17U<06abA`$d-7&m/DDO(0eD.qIA,Eol(#A2=&srL<$dUW@V,5b'WJ'K@t*[eeR,ZnPskI9$H8,O4AT<p^ZDHdP.<Lch!R\8?ecH2;AnV<nV9=E2%2[MKG8_IoTr]cBH6Ce,8&LaJG&>e+:$9oC&P.LA,3,\?/pFqm_2G3J?]#\FCKh-J#&a+gOgTI>Cs8[^3%G3AhLfU1b!iRj_O8]EZHX0X:_A'ga_gU-c'gJlN)SJT,A8R^*D/_W5>n=PWH*&>A9.*s^R98._+-4q<ZbKLc.2H`O(8OSERjC?`_YMPT:C5WRhW\E1cV'nMd0CEn=:ndgYM*_c~>endstream
+endobj
+101 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1359
+>>
+stream
+Gatn'>Ar7S'Z],&.F)G7+foq;AT)G7DSVRSMnM7W#\]('3D6)=;+^BHG9f1CgLLL/&4U+T<q?:TSATECOPl$lhoc5^r<hD1U-KTt2F%EXYkeGcY0K5'dDMMAOu/M^J1Sl7_@(pELED^*B3]I"]L\5;#EhYZ#RYHrLB!HdQ(\Mc)Ur."%E:kko9EM2)XIZ#gNq]PrXGt.L"/top0[T@8O#pUU!I@s$Mj=IFAf">(5(phY6/<(&PJE%=I-B'&`n9h;,6%QIiaQt9q\'1l.T):,P"\q)_X.6lR)Z>=$uEYP\FrF#0WPXl7,%\M65%]:YT2lXf;J^SeeLi>VA-C&@f$Jn^a+O$^GRnBgW0sdg;$P5bQk];m*]5:.(ei1M$j2/!A+r$4HsInIpUk/*OCQ1Z^&RBl"t'+2<'f>#g3d;l3T2;]G`JJ0JKu#Zs'5B.E:$CA"5?Ct):.d!_m.jc+*ZTL9\KE[?:%m;-XK%rfEg#,UTJ8uNd\?("T9>s\&rgT@RZEbW[-/ARLc#MX@/`Cu/.?6O%`!';4ZR+kM$=mtY$Zl%3H*]d<heQ2E`F$A@Ek"PghNQoD%0i<%*3aM7u\g00SLJ(k>1!J7L`umF^<3h;h,G#O`;Q1tjZkb>e@m&:-7(J*gd2@L.h:;4-C_!,=<PXHXg$/(J%$G$]06ZOq]^slfhi4V7a!?=N4b,#A9uRTAFJcoKM+(pPLE:o9;U;KEdTM?c%"OPHiV3G6c#Cin=[S[\n^rhdmRfL70&OPQPTi#^3)K16nm/AgDcDXo+U!S@`fUKG1#r2se-9?S;Z1KMYu_6F#:,3:PocUZ%/"i-9r$\AThuY>o2!t]D$0WI8Ro)<TZW1-8e@A_]\^68Y!=<r<f5&A*&lgBi.FpY-r(RCAqta`\0F>Dn$Ku=%;NN]l0CbZ)hl-$C^4oHX[<Z*fEhDeK+,r(eRG'/2eIuEXP`>IHeX8h16KRG'<jfK%+>EN0"!uh]b4&Z7[&mAN,B#A*ee",%T5TaB=nmC3/t@q8I/?qIGr2Z6uP3]N+H^YT^@D?n[:[sk7,Y<j05;`:c^bc4T3QI!?at@]b"`XrkZ7Q)+PYLR*%@V7!DtFA\a,>MeME#3pqo"^Rok/`d"h\N=nMHM@IH&;2B4-<DN^(A]l69FiC\#ZRF*hn6r6KXU[B44A,s/d8B`$)e;8*_[VDK'3_1GIXHX"p6\T7A90LDIt;i;41J2g!\@boP-X_gXG7jd]\B@SQo*@K;=qGiU8g+'](Opk4k=XU>^h8dU[PVV_=&)h[\4WZ`Mq//bDE[_=kAjM:JW`3BpQVsmkaoD9,?16bhM2sSk3rl15o;MTib3]:X=71i%7e!SIh=i#C5hs0)~>endstream
+endobj
+102 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 3595
+>>
+stream
+GatU6>Ar7U(4OT53%kY!Z\^/0=*GGgUe*W7DUPDe4.$0["LLSOR`^dc8PZq5ILiEY'3gc-Ul@a*4u])!-POksLT'+e)W8LIhL-Y7-qkFB9[/7T*SaE9I\)\mUhOPOC[!0*@p>_>l/:aM^?n)A>+/A2pj%UY8^33/(/3=FFSU6</1J)lUTT'a&k4gbQ`k\!6+0M_qfA/(V$'_p7PK+t]iOSrJ!8</4!9&`eIi?-?kVY>j5:<RaPQF\@kW8.[aKA!Vm^JAqoK6;1umS0*CiC2M]c2<fh9m`9\]IK47P.07NhIQi6V;^]QriZEp^b\Zk2d-GVhMN+g,CJDUjN3O)K^<OtH2?0Vc&YO*o%o/m--N6V.8H;$?#4>ljOLQ*U!D#lREoR$On$k[GI.RspO*/5P0%;m+=(UFX[N8]L_\a(CPs&?M(W.lU86^pd"X!M:`J]IhtK=k#eF_tXBopYn@+ot]!4fPh+jKj\UAE\GT>LZW&r76[r;MbG`=Z%,&W^Hd'qi8J<jJf<A.0Cp8>(!QOU<tIm\[YI>**n#i]7hg:1+ZbJ[7]"F<5!E:%?^L31-RRob1uY#g8T`c8oSG],*Xc0W.U>Li1&WPXdqgIXqNM/!/l2'dJ,Y*[RA#nspphI2lf</k/1g`cL3,%$D0Gn:.i_)bZ1(d6Djt<(*;.K\p=Ro#PkSPtYd$gaL1MDiJD%+enG9;Ee<SHS;n6eH8i1e6"WEp*&C_O=A><Dp;V-#BB9CqibJ*%S_Hd9VLMXq:7s]j_Ml,7ufClAB>T"=:"XM"G9/=/;Hk?V_21@s5gEgGqm_^.@<T%RF`Dc":s'AbRdA9%%2=A6J@3t2R<c+[*l*e.,1FR[U<j4@1BLWu0W4c=.Y[YJ!AuLnm,`NV.>-'[kZPBQe-3>h(/37Rr19;-Z'`0ur09/lr4O2D>ahfBBlXiqUq+;PD0G1&Fa!-3?j[ugt$dU=ETsQAig[S^i_ApPT0-80!Y8kC!Mns(6`M&ptOB$LRe\2P<h?6#t9p"Kg"<WQZ4@WhYKpN&t*@G=T2@WPqr#kS"4B@Xgg0f"-9BClJA[TP'YM/Z(BAC\W@!K./''?!cOBu1HCs0fa*:eo&=:hc`&-gf'[:1O@MMbCF2,Qe=`:G#NDE2laJ9Ss(FG7/d4XI\rL8+j`MX3:PX'Nb9nN>oB__85#PHKC4`9lnrK<%+mf<Q=F%PBFGpd(#IOCsi[eNHLM9#A@OV!#^B-5/ftbB)&]UqF.QW-8HtqA;u9&%[*A6X(n:%h-\/<!1ZY*0e=+YtHW%WSZX.kq4hE"#OMH&`\K*=EJ?ll$ecSlC`6/N=p!D-/L7dQGmc5;uTa/;"-V\1e#cEf<=;6`oJOV'PBC2gH%qC$dWe'`qUrfg_ij'cZRW8;^*gIDaN??L^%&?5+FN-VBTZ;'ZMV2I#\PH5NjTHTGi.R8]8BPU?NDF2A$hXLQrbs4kPoUgJ:f]/.:<]\:44%!KU=V(Z5P_NskaRq-(3*ZLAmdI(0;R#*KrkV;Du.KBt)Ea\ei+`^0S.\GB%APH*]qWZs$TVeOfd>em9%oV"hDkloiu&[7`8a%\6mP.MRCW?o"67H).;rB"Ue/<Olfrs4M;.L.P.b9'<r"DiVU%(<q9/-KR+2"5kMCTM[JGF7r_0*PQ%fCoE6Gib:RQibnQ0Y(L4?Wl):P*m]BE4B%*TW@5DkBU93pcO[K:N<LMl0iB_(sh6D_m$PS_\lgb=L?#</;rKI/O[c)HBC6]K;5_Phq=^(8VXOP]Vj;*bsn^qLU*m>Y39i-+7^,X9amY<^_5<H'[Bs+d^)g(QWWVcc)>4*rCZC(Qr^QXc%f&LVs[AAMh)sPMTNi(;IWV5`gT-[NuM^ke,SKMF?aS"V0QT-(3hV)F<EhN7BE1f,fHL_)/N)))89ZCBrNK>OS?<ciQN[.9q"P_b%Kr'ZKj0V!'N)I?'dR9kC_]ZK)a'"5\)jqH!["N5G%Es:LKRqI4EfUT#'"bhVgN8H%=)\-p\L^Gq,XAJoH4-qD\ERlV)B!@p0"A^HVXGL7S?ch)_^.hF9+bR&DUM]qOo-Xg\eKNZ9/e>L3!Y/upSj03^NJW]%)^Ci/+1g;)"=[=PAn"8g'g#-Os8lj6l8\>hH+e_7fg[D9eB]LKFtl+"5kWG0&E2#VT2ShQ"rN=Fo%,\5mGCmG;1_cp2NZ=4FiOAcY/i>Zb%^59idPLJ(\eUIUX;%^BEc,68@@mZ]l)Vc(lVEEDeQ?fN?!VbJ!;[>D<8G<KGd#'V*;Lm0@_B&fFWLK>6Fq6rJL-t8/!s^AEK1?fQKgn3:#fC`pnT%:_]+qZWHt/K^JU<nDO,e:aTpQ\1`]7f&*IW+/(pcBiTKRU\0s\2K8su2)-rQW&P@o(BFnSRCa$q`:5#0cf:Tt%sa6cRm;e-s<SM><o]6bpJ,BOt)W%#qh`c:&635/n'\#bWc^sqYuipBLV2a-HjE3cVDE:W3cNPRd2j5p6k0:/Ji8p&iW]?#O"]?C@/Ai&T/%X+RK1F-L\2k<4N"PX'R[_t^#[T_h+,H%5gU^uCf7sirWqr+pD,lbeiP#s,#0osg@O0**cf^5DXV<+aT^7&=7l@XYA6:%B%K#;:eL_r5-(!ffL4i%d(4<t>D8+BPn9WV2Nj'opCY$QT?(c<`64)D:$Q$5;7Ej,Ac6YoHYnOmq]EaZ'"oL+e7>DEAK_BV:%;+EY,a[X8!kj2P;3N7H%kku.k`:10\kWbU2HCOmBrOjggi]sg*=u3GN`l7!Y20b34'XN-7Ap-Z+hMYBQ&'c\Aa[Lp[_"HaNl0%B5]AgAO_C>m4kW-^b!VY3N%b+FnqFOS5ZZ?H)FAB*\M37,r0ECKnA+gh6!_:`ONk2\bOt&bc$8/:^=\iIXo!-MOnd.)D"C=UhLh6(SG6/J3$q=,%rS8OkPJ&2u,WW"K,WWIGEXV>NL@kc7"GshN0Hk*&='oEF8WmfrrT-J+72HRu4u&5@4j`<,UouIVe^&C@*6Bm_alfIERq9iUaUa6Kh8J.\3G;jg_@NRu<dF3r#spL<Fl'?L@Y>E.#FIW@p6QU?rk)$@FRP:"ZMCHX`t"r9_73%8<0)KC3:6SI5/KKBA*U=B(jg!_DSfEt9gKJpEsr$hO)I*GjNap26cC*@PGK?@Pn-;q!Q7VGXrkAFRW/a0"]bR1B:ck(MGnAc\#$D#D"K*qS@me^rH'&:rF->;QEpnUIXl2JB>J$b=&F.Zh2T6qIqc>4XdHBf)b'_,-6H=*Z]IGFr-hZ,D3a5TFo'+$XYP@$I!6Bo%V:"ZATT$4d8S^jI)-bt4_.48f[.6XrmYCFHLt?^YfkWo+."u_4]l\aa=dsU.PDU?8C^TNaOj`af>ZdSdTbhB?Y[Wb^BO5TL>KZ5ZLu7I-18)A8CDrhCiaP[(>C/]EMN5nfn)TU%MUI\obQ4HE94C^dWZg=\ZB4=B8;gYem%hXp*uF%QFVnhRgh"WfX/+9D.1Z#]_$s1G_ahZiT0FB]WTY4cTC91)LIr8W3k6Nd`)bHD-/Bbmb5#]9!0f3+I)4*bqO8&0U-B6c%-PT9F?t`S;2%==E@/&*#i5!2HYf&Ro,4Z/8;At0Oc%)Rji)d(*Tgn@q<A:GZEJUm/M[!Km`~>endstream
+endobj
+103 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 3242
+>>
+stream
+Gatm>D/\LD&cV3*_&a.q0?qW`oq"&Fr/u-WSt1eQBa\I0KrjC='hdOU06V_/rd0FMMNZOoM:*-YSP9PRjR@FS*"Igf%R4(n+2eGU0@8qgN%dPU%DnuSU;]XprSlni'>1M_]:*VF$e^gNIs<:s"0&00`39ZG)4mrl0%(_tGU>oEp*AVA9HBPJJ7)i]3As]+dH55kaa^<O`9F:s$&']er*?_Ik-/G<2sLsKVV1JD(#/Eb]r'K5W21<Ep/M\I&`a4Va;]d@pun!Iki,Oo"A>\e8R-'#\:WE,ja4B0"YIIN\pf=)=s#JTB'].9[<M8p,"u]EPPd[q;[94*O#>QjkSCY=S_s?a428fC2N:de(==t"rP[UA'J3ud\#CGO7KEsjiCgtL9t2cQ\jh.eP&1u;.AF'h7RorN_pFC"2A-04a".1(Q\R:as"%V$A\"EL);9YTBME[_HNhl#Jc\0[FV??>QRmBUl107`I@`XM4Cd#+(\d16\3p'll>HYfZqK(nR"['lMdF9u&\s=b+pmjB[.^iH#Nhq"ZsbCUfUAu,D`a9I!:dA">\;Wroj6BiGG=KeYjLInO#HsV:IG0Q]Z3:\RV8?OCnS=GSfO1*<Dmhe3LY@g=\SEW$Clh-Bc+Y>beX=6S?r+3ks%QM4bnJDJC>$@WFe&\B/rV9lWTm^+#MYMisVSo&r`dtfH-Ue@ZG&Fb=QPL<p[\6g[n3#6Wp\KV)6B2:I/R1m>`tF\#@#enO)QIB83"+;lWuS#qUX?5=/E+97,I+/:/_^;4*HmV!s"^l+<&(?K3%^i&jY@G#%dpIG5W3)3DdDYKPT+U*9]_Fd*&D\B?\53)U+LBO(`an4?AUfhoe]a"@)lr;5SDF,=C1(`iUi]/n=joHJpb\./Xd0gbV$e.T,Ql]$d].Rt3CTW9MnU(fn(eJ(;HMBJR,MP+(.+DPX^TMu4?<b_o5<!gcL2eLkR"?m7qPY(s"?:b39PUod'rHLRFe'`'aJo/Z=Cs?t(_jStZ!Q\8@31uQFQiOV">EXmeO+1ikbKpZ>bED[eq,)="^NEm#XHJ!SXUp;A8D,L@Uaq$ASUZ04ZG_cUcAJ.2ILb/oHP;JR(@dn03<E6IKeS(c]L`"Z$(^gle9Xs&gR*L_K=\^+pW,!X#(AK@o5O"'a#e#]QKN_]o\>d.]J5c_6t#@am+u6,i]:F-.2UnJ;EkLQ"'-#gU5\q_n-Hq1[c3A7.7?f1C[V``NQH1SFF)5j/53S>06bL=hXgOIY^iiNE9Qj4r>AVQ'I1icc;0"7.-GZM1g8Z5dM]][4rU[8\E/;I@DMIFh]oBF-*S=gL+I!!-9#R/oSWPh!%\)$b'<W?4g5na6"!!5k\p?ar\H7GIg@9TIFJZ\1s\/L81XjEo$/hEONNRPEmor6>1:tY&3!8s]SWIH7lhW5>c*8'hZ<Ee*tF_93?7J7oM!Nrlu<PHKqALTmdYlt&Il81HB=UN.4`YH@CFsO9,Ts7:dFF`rTf35bYK;t3,+`BOQCfuM4b+8NtBf'Z3[DQNS5.e!/ihk9*XQJ!cDG1Mkc^X$D6Yi580<hUW-Al%hEa1Ff^i&0]D4QPXR:=Aobi*C2!ggo"&#42%t1#K#5m(Bar]r].t)&e;*=V@AX7L9_;qG`:Obm5h</O9[!fQp5D;V2OT.=maXCdj"WYO2ApQ\QM47._jYaC@Z`+>hk%@k^ZW*0B4gR'VY'NLZb+uXgT,Xc+$V>:i;SOB:[.!#mWrl$EV<8')t4$"n-9W<q%$1BI*3$J8j,+F3%?Afeg]qEdncp`@CQ+b+u9B`f_m0X^$N[RG/?V"Aa.Km?*VO#Cs$c*BA"bI\KCbkKD\O&]aNF(I4'_ur+s@PmFd7@G:M)!>(#ZJpc%:!?btT-6"HGVFAXi,8fsY$dRR"Nf0'Ng!*<)FYsT"@K``e-1qf<7)HNUt-hh2VIeQTrAHJruj^Y/mBuXpfVf[KTQrBbpoIeA5S.52s4>u;h\1k*q,HFsY8M%KEVC93#0+r//j_UP8H-anCIeC\?h1"B/o@FO(;fSnUYl_c6?4L%8cm"jM<WkQoF=N94Hja'(R8Z+R;!/^F#[XV\)(CCu7C/]P$?RHb>:2\KnVPf&)cU>Z>CSMh%iInZHQDlh1bWq/0o]?4]"4U*RDc'e7n%Omn<u_OIEH=t@C+(-]*YD^Ki!1/<]M*DrV\FOP;IVLRVQ#JZNJeKq==D!J#A=-dD*-%*.&>thV![Kf(mN:SlMmraK&Bm.cG&8Qu,J&a!mJS(a<rFFr-2;C&'A$0>m-J*CmgCC9e4;\NVr\7'ftIKB&5M8gHIO?uDdEY+LE?W@F4a'TAH"a&9`oMIr\B8]mNkK?FU?o_"3Zng+`dMBW=aP2LI";Jc"Y9uH@Z\^o-h8p"2h59B1Y"0m:Pos5?iL^TknX,u>SXpk$SGSebtY#k:UO3j[<ZH:3-\"_pCr/rn(U`/QI\g7q8@"&.J'a>4YZ_Y/K($hge)U+`6-*DamFK[qX1>YM@&h7EW,)Q192?=&Y:k]>?KS?J69i'4(of/G0$!*Bc^n^.6H[UI^A1R(IK`aJ$:.#?H5`dpT?paH$Q9MG!g*MQ!.&@$4&5&YEHH&l!SY`*NLG80O\OLU;#Mrhn25'!7].3a.:NB(Zhnl0"GD0:eCsO&Hd#m\!qn7b/47]`g!g3s%QYh&uMdM/ZDV+:Qs,e=coT(-8Gi2&4_]&LIJTG>a#>[0Hl]gcNQne*gA?+PF]he7tQ-j)\dl"5bq57ood4:VmlQ&k$ka-$n=f3]A'gV)_hGh^lpPHM)AaLni'Vb=.C9`4+LHRXJ)8CMUB^1XmpdJHZR0aRm*n/UR]-#KY(%I3pL56YBaD/DHiC,1>DG(+$.FMF]Ap@0:NbQ8++cQ^ar0FH6Jt`tDXiE?4.,XZ!X]E):58%_G"<qt=Y;N@e4Vr;-nW$=YRp&UCN9]MdL\E<P:SB>hZ\r*V&=/6T^M>9<XHIhf9i+igjbE/ejPb,^W8pJ+%(VsaD6HO@K*o%k=#dkY2qn#ajR=3qhR[X+h*kX:UYq7=:Z!4"J7!4)+0Q]\iXXEkNOF=*%ZKK6r#>WQJmT5q%([2\<KOcN1Hu<kiC;ahTgS3.#CZ(kUR?jSMbnP=<_".h<dm&mG-2Fq5cdKYRdn%5q%T+/ZCB3FRJ0/phn=Der:[jR\mQS59]`Yb62,2Z$f(YjNA?qdLV`MI':NE?$rf@e?/P#UHT]R0?g]cUAFTn=L?B`^I)aeRK:A9JT#^4ghrs-N\KI-&~>endstream
+endobj
+104 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 3841
+>>
+stream
+Gb!;gqet4K')k%D"bFSN]Xs!$pS0l&ONk5I*;W2>p\'-70PHl7e]=I88pU@/2q3JC>eR']gH3$L99U8(B1U>B%;?9NnCFmpr>e5>0@9X)L,9o&2FoV='.r(8=,Whl7p=<gZkV9&<"h9pX&t*h_K/N_%r+FsY#oAB6^l.^he!L,/l9gLnMQd6%:86\VESDsbn5;1$/)H.QJaIMU8qEbf47J@pG>W9N.+6SY94#FjAKSYlf-Ycp'gaR%#LV'(r;hEM#EeX]gn"0F0q"mMHp+M4g=^8O67b#X"i;1U)KJS**'$K8PrdLYRI<ESuk%+;B/@(9F^VYMVp5@!F'f+Y3@i*edN6+[.sknnorL"1#&-FR5bj#IMNIIg7V^"SKQOg#3G,rXU,[ORUhULc^hjaaMH(SOCRI>/,aiL/,5VG!^-J[m#o;rJPS<iUKP%"3iY,)o]_\:2k>O0ePe;'F!_/V#t^Y[,S$u\8USlN>md3mh6sVK&cHJ;I\Z3O\f\AF]O8HA?FXaa9SP,Ghn^b$,$:66NF5@q;F]7!P.'Z#Y&qi&Mn8UF3k[LWS=Q7amFD_LWiT+qmJ_@:h[LN(?8OShU](]o`nFD+O7s?)an@Q#jN3Bq33q8N_f:5,pjLe^ntNJDBc*j5es>l4quu[j2eA7`CqCasVnCg/T!5bd[&/3UO1",B-Pu6thS8;0VP_K#FACiU?/WbfjT,VbF0R\p,[0YN&1,5+QL?Qoi6<bX!sPV(:bj,$mM7bcSV)<nKMkPY9"h.MZ$q2KjX7m)cnn&'+cB(#q+Gt^:g'd['?pK+_;DFdMQ8h9V4kfQM`4-+&ar=S[B&3jPX9J[<N,TZe]-3UeZRJt>mu7g=p:/5$34>=$7M/S!4-DT:b!sq9%>Da<*$f?W`;;5YL"gFT13'E;%U=ThNg6q=,TCBrUF9m#lJOdd#Ff3RpC@C!9d2*TQB8X86qnP'!g[#^"Cl_NW@f');t)A"8`k:"Yq0NW@cSuBeb.;@Glb\<R]b^PWF>D22E?&fJ]4MjoiMD*Aa2MF22P8(kW;:)"h1sZ0m$7EtfGG1IX.)2OG"ZP-SP'FS;FJ\mh`6U]Cl.!LQob$<1kom#LIJ4Ef<\(0+!e\01Z&n8T3Y6[V&61TK3]7ii<H-dFfq<p,X"pm*I6Js2EN)=_DdE5[\e=(E7<lfATYLH]6%D6>CEqY^]3!n)"[3ud.g.?]ZSaiLf!h==uM,30-IdOe`!`U2cF4`7e?kmE3B?]o8"Y].dS/INjq2s(c;.>K?^3*6%bd1+ggD?_OP1I]#j%Eh8%1ip;<koKVdOuOS#5/KC)03W5c:5fj,e`roEeUSFY6As1@mRp@.'2C$t.^a/?L+'\j7Bk;i(g5;Fp+2(Li.=t?foR'<.1OZ_k^h-XHNqQE2feEkd!`="Xd6L=9<Q;JQIVG%']D("U0Ra]-X%JqJ:GAj/EsU3n8i<Vna?/W?S'*DSg7G*&NkW_S?+]o>KcDqqK"2RS82#?PG=J<->c2c%!Ouo-@egIN#f4Eo-B?YCF"NK7kpj?@67Jh$fW#8?DU`YLBHde'bnh@\&#<()T-=:,$Q/M9:D8EV2R'mKh=X:pN#`nH;UX+%F`O,PS'q$:tBhG.LZ5gWJ9$HW%>hae=sc97[<(SCOGD*^o2P0Oge^i\nW3pAEecPk8:)Vf(9s?>h8C)L,jr)4dPc.dY[e)Udnb^,u*Ek;[Teaa@dT!F6#bSRcYI8E6Yu/YHlT(=+;bH.)SKKQ^1&@]d@G5"d*1n>aJlSaUdneH9h9[H&"P%?$OY^Jcp/)4pXNQ"SI]$5s/F43h/iR,YS/:BuKT'2Y5I>S]2NZ0$*8_O>S?6lD$?&;j#i)n_7g>3N\Eh:9-V*=VG:'U9J?,$arB0H`Rt4m@i)LaBb6pV)X43G=Gcb[M6Dg0J1]ga*S&r[er%=Qf7uFrE;WnLq8&X'"UFC=\_o)C\eN/>R8Q+-h2@aPG&tod49Dpip+2pV^W3ZS5MpO*fQ$:^dMAuj3rM+Br2R%::CA^dJ/I7$k9(+WcP'EW>MOo"I<Yh,.O7Np93!^UO5a,8l/'QlXW(d$;JTf9KR,2MC[te[XVEWos5l]h"EDT[;Z(&0m\JDknQ:4%AD)%N8Cli+gCo]Wi5@BhfT%p-J.P<h[RmF%1^VN(73(sg]KV.p_S&pR#6H$h8@5Pi=OsP*/&POKL,1Ul0kWZf2g,hI_WM%VB9,J>>Q6P34sD-C!U5;"^TLYD.:@Z'sP1u?$ChOTceqX'8@C[H&6ot-&FoD#VNOJrm"?3ouO'S;[0"V@CW^B$q-TYb@6HEdsa1@RJG[;CDtH26_bcth1laIZHA+)FO>M^UEU)o@^A.00F;-ihVrJW<KQVl^PkVm;bH)&RJd#Df.hs[7;F;V5!%f[Oq$1nae$25cgcJ1P`:!=YL'fV^eAuCINTCEQ04>Ir;Dn>Vp3AUT+s:rT-G6.C49J%b^,;EF\IFqO'/ak9)"VG8b^c$mmu5t4%N]I-jP`ml(&VZH=OO"f,iB_F5NdYdKtKlPYP2e;nA^71ZTJZ0H`5;Zu0fT=e``@3l)Yh]Ot(RmJ.2DG+?P!milbni2U$3N=__WcoDRRbqhcs-!Pt-^T+eN(60P7#A]LQq-hFl`YEU(Bh%h>L8S*eJdrG6ZSdH*pE(1$V5kpfD;:Xr<cP6ZU$Hrpm_^0Y5oZ>K$..4d.%q5<K+L7d$C[prC2>[hVK<LV2^Ec!LNf8J2de0_h1.jP:\V4KkDd;n-GSl=NUf%J:,,;VI%4]A&K3Whii)gB,!%L]Ir7i2FuapUU2.+_#sUfZGN0t?Gtc&j5#)tS#ttP&>!Ig$0he9#oog*6Sn\46&>3_;D_#B(!1G\Pd-N1]c-hAu?Y^ut#l(gi-CT.c*gqkhV/alD_eu*n&\#=47DCG*%A+XcDTBpf359#.N!F<&lS!5R3:,o*-NmWRCo;QQRDFW.K>(T6FVe@&$iL<2hNfq4W4+&Gl#,*o:S>9/0AXmR*RMTLe\4HH%L7hMM!2Z]VDN>g,@EIo/e/N.(B=g9+4-Ut/-(#`-is%Mc`61L3h(U9[\pb>_ObPGM4[*(hAoQ4<PGZ*;>Utj@kr!tpiUb;(f#ru!43s*?4^Gi]+t,.3lNh.@?(%^OF5ZPnfU"a_N(;5'4i%/fM4Vq=@XVr,CdIo+=E.XK)I9-Kd08=hfH2g@oQj$28'q`n`7;sXCf3md4mhF8A^Rh:RQrb"j88/W)(]pd[aYDeUUEWV#famNurP@k9gOjWQI^K&`=G??JLi5):*Jr#2=,eZ5oj8mF9),%CTbJCr^:p*NQb@d[=$^RUiADXZ[Qe$nrpN".j6E=sl,S>[-`U#1C8^?#0gt<cSRhL`p"XK7ZJ8Z9@377cD6.?NTG<Tdo7h75tJ7K_\'?R-_mTaL:1BX?^i$7J0olHXrEp)RLP/l[$YkGe$!j90irsV]ia&aKqilP@G/8fDI*UW*=oH4EW]dZ'd,4S]LhQ*g7%m@Gi9n*+D[`g&h"OAY-ic\P:(dB&FCo;&+6Ajs`Jh:_,I_)&i#p*+Lq(8#'G1o1eTnfm0XB=m:U`+Z8<[q].&ci>t60HFp]"qH6kio4U5V-*Luo#-H?omHT'g00B\/:@l3OQVR#LO?r-W4K.[feUCTj_G`Vj#mY&>85I>k`V^SA$"1BLd,G??@/_5dJ88PMT:G"Iatscr5@``KOkW/c(Ksd&HUD.pI*jr,Ef7gL_H$]lj"r#tqOj^uSm_<jObtLc1Q#eBDEAisCKM@"[kdqT.nNOLN!N\50&J8+!TAb-Tit0rWb0WCgQCK_Rc`8dn?Y_hAK]H#lloq>6WBAF.urT!8@K:+e(b@:bq.d>Rbg;Kkifd]D$17~>endstream
+endobj
+105 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 2695
+>>
+stream
+Gb!S-BlE%SmCRiOnUS>u\$<$^X__2uLNi&BLS(\2Zp9.NCl]UMk_^WuPCHr"/k]NoP+:[.W,gN8E_$\^)'2.1`#k0??ap(P((@qj+;.d,+GuhBFU]RrpY6u2VP4EdTo'1j3Y=d5<,c14&!N*Wr6V9[ba&n\d[li!L[-!Z,R"i*&O?TD74(QUIpIWA=nJE:o*MMUOG6f4iH\`6fHkDiLTNr/_VC42HnoRd[?m!J\Z;CDXlE^2k71c[c2H7DZe)u'@huqL8Vm6?0^inJ^KK,uBO+@U#lQcAo(d#8m6OXX)?L9b`?KSh,YaM!5BLW;q)ST>/Hao(i_p+b3/C]3@P8Q,*uT4\`t)a1]_^O)r*)]ne>$t0Mk]un1[ja/9,c:#hh2A\#*[DX=o??!dJp_LQL1tk5ok,k!>#.Z-JjFBiR@h#1Yi9j/f"AjEDqW:\D/Tan\dc.g^e&Th+Hd'*lTs*<sn/[IC,ZT@^^XKGUNDZY8A$;lCdE*+)DISjZ!dCcB:buJ>ns64qF%$*9l^-hK^R[Jk0"#YHNO"Y5(Q&rJL_tEEW5/.2NOOP$dqF,aon?3mi4JZ6)@i"=Z]_Y";Ne4@PCB<1!lHquo]Z6lH56gU#^qb?+IJ8%.m>hAS`S]O=Zr,0)m;Ha3%)oU1NI?QN&ojCt)O.:u9ap$3'3eA]<.T2aCYTEpG4JeSnAkncF?iLclL=ECGL[(G!oiIL)d@!`<bD/]"Q%ZU;LY,rSE:f@R>]4?p#jlF.C-c$0#$dePDV?Ha=;#mcckUD;.*0N:V2i&MhaHe.3[k.OHLFMZDb8_=8U'm\<%Lr2Ci?*S1*fD612L^JQZS6PWDQPVsRbaW0%_$^+cN3RCFeTX8,pFF)FDH:s20FI`VHf1TW<L01:-qXa,peE&O#n='Y9:;9oJHY%I5gXYk/A`&mSeVklrC&Pl51G=mgp`,BVlhMAk@$te)1PGAatF'jB>9+C.Dc\"].mf&>6.0bArSHF"'!J#"o.brs\,tNOWMQMstq4\`>h-O7oqsrH4FA4?Sj'\FeHL)0l.D%>ptW0Q*Im+2hM5@4h?n/0):sb"WeZ-I5Ua<A6k9m5c"(Eh\L1]cnp0r4+22L*WfT#dUFd\cIDc8u=qbSirTUEl+[r&P7TUOn$5=eRp/LIkh_.Zj0#ja=4@jR8),Z7_5UA"C9f%9lpuqSM&nBU72k4''RHR0E"`Gb$^#1@n.S#&cu\)^QWaEea=?MC4`CBjq4DqI2]E,Y9bi[VEbh(1#9tOb!I0,+RgCun[??/9SW9Ml;a]%%_)820/;>OZt?GJU/&k\EVm9cc]6n;CjEfKL#T[baMK7c<HEq(Htoks*nXaU<'K3.Fju<J]6)Pn6UaKMFG!(c8)7^rIC!*\Oa`X#\oVPc(<JOb;cQ1jZ^t@jg97Dd'm1n\<^diLO&s^>&\_CBXnWp;VXDB,HW!osV--J"\+rRukt7G3"QeLX_Y7Ms_/nKprf2KCo`RY1'pZT&kO_she'mc2<on5j#okrZ9)rGs]i]P3DXg=9qoN5<<W_2-#@Q7c!oPI3@'Wc6i$\h<6<+*F-jS\/"Min7JD!d+J>3fD<&q?>(V1Ft6Hc*hRYZTS5mI=b[UR$==Ha7p=gBI_,XZh5>Hm:53]F]KX_Gd*TQqgcFp,PB]^`4rj\K#8,-1J8`R/!gl6cW11at3LGQ<a)Kt"qtoGXt#07"Ong\$=Q?4=(q)=k>#*W)PTU0Y@[_m0FlH*M)NHn9c<jj$8f\HnD(:8lQBRjq5q<!=WIp>h^uVB1t%V6FiIgP,"$?,gT..Q&-r5*'#H'OI0!1:h]5hB[&f\kKmk=td04(,E;3^X<YBW7;5sIuNcMMa:CeEqF+g\R[5%ET/`khKZ+GU-?H(ZGM%UP70b.1fD)`E&C+>d+Kgk?=Jd2)VXiK!nV;$1jhsW9X]cuA)Vr=HY[$r8`'mG?g/?m=MfKESt4u([Rf8mJAG$Je'Y]`K)=57$7C45EHu`uf+Z23;!65eiY*/9NGblgfCA&30)c#%IgTj'U#.I%Eq8=i4_2<%cYkD&9^aT(Ze6d$8!E9/jgd7_]7nGo0p4SOg$!a(B`YsD/:7ZfmL]7.O/a/d/F\`Gm@q%0,tV/AeMNLo=-?N\+<5CNaH56Y%-BBUb>+TT@OMEC[_ANfmGb-HoCbnl1,FlH%MP?@&8jTI/7C4<=b?6Xl?oLJ;70I^)"=CSCm*RanAKC3.Qd][9p4=t<$3jU=_AR%Jg%m-Wa\!f`f;&(%a2@rDV/KD@RpPAPP+<bU)F3P&U%6K\;?SM3nq3*W&9%\s!!,\\2X&p'W&(,,aV_G39]'7P3&hUQ<EKDc)Gf/d[64TB@5PWShKlTIWR)2C=@g8jR&e%W"p+<BC_+'*(4GWCib9"NIZjklN3m)5i`p/4:0Q=rdG_?I^H1CL?H`hiGZC(96/B)pLUMrnIuT)!6^dK;o)_]b4Sl!&Z.NpGY,6If,Jg9k#0se[`<ZskZqa0DOs`PJ>6.V:4]mhbUJ[:.qOr=%TXLe]`"*b#-P'b#[1'Sl>LGD&s=N8*^Nj?\9c)9N\8*^$QT2kjnCcd6[*b&hWlIRhm2R8VPW&jGf7B9nVRR8'c%-1iYch.(2iPQ(<dZ/Yg?_0(k1X1LpAk;nZ0n[j^t^dO!TRS.tm+)m!`hJJj^MUd'BF>,d]$oJhEMsjplu8Llj6]YJCb\NX@#pr<IFH(K^~>endstream
+endobj
+106 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 2095
+>>
+stream
+Gb"/'D0+/q&H88.Yldp6kZHE,hCMUZ#uI98BFXM$KeOQN3nkj)6RO8T^[L#NZ=R1EAL;e?S4#R.hVR\WF3h!W5fF7rs4n7EjTGd+#S7?,3=oKD@IbK=S6UHV+GH\1.-AlQFg-Tg;)MRuGpp[hA8>tZ(bc8I%)qSL)[a$`0pcnqdKT7oKtqrtE/*Bl8hG!&StXOWNUM8_a,qGqT#0P-9V.+&5N8T_"k-A.Af#.>Jh!q6'>o57hSr;EP&#l0V6F%4nbE9k[EgW=:?6uP+_?\GFCkQ+GoDIK)F;D<q+ZK$!^Fh0)E@gd/A$tl>G]l"F,5Yt#%$\SqhdG1R\>;,fqrKn6*Ui5lNDXLLi=9hd1'<RKUU78)L;PXB4t1j$5M$';Gj5M*U;6cP!Mmtea+B^Mn5hQin\)o&rRGT#t9.?6k)g?cWn#Y2$Aa6h\r`<r8*^.+gtQ5L2'[B<V&^3^Lino#;s]TklPD_Tbr*2"\EjQ:[It9nI2+;3h5fD?h%@1MDBkX4AO'u+V-%uQjX3nEMQeCAE$FmH@Qr.c<^:C?j/dSR1n*Afaum5p90(dNu/!p-IVX;Er@!531B`&(#mP2D@qUpbi,G^`aQB7r+lJM!qR2ok38!fl0qqBY-6`6j1:3@dnu]TrQ=`I@s9J[`EnD/DV=/4aI%U)iO9m1%?R%(>j\/RnkKF1^?J^.Dpkl.T^,!+)-8d7q=h'IDrT\b)g6C`PAuA;C+;ZhR%7;%4h%r%63;*9mZkCXj(JNjj:]-ROLfkcdQ?>tKua?Y&S]hS_Vb._m6V[g9/d.+YFjZX?jXJ!CIkt1>T<od/Hon^^:JMmh<@orRa#4@WX*QC$F%TN"?7k7=B[0U*0gRF<<W)$$F!9)"?=O-PhPpC#iE(C_RGSC%>6aK'P\6%p<<r1WE=kkfcA(FQMU3t6'"m%$RkX,?Z*Itm!9"Df-g)';?c[eoD3P0TN0tpS$bt)Da\bW)RM*?0"i5VH9%.TLbZ>//6fCp8*5b>O%n:gM,QO**B_a9m>a;&93:Y<];[#r]Q@'?hEekG8a<oMn*7.889_[V9WoT%QZ:0P9SQ<.0lQES:(+*6S8I?2Jq<&uP\JsZ5dL!(pU)Z%lISr_rd'JFSs:IW1#sL`W?f>B'HuN-MO<A9Pp;`jAeh:GfZ:*;Y?LD4[s0fjS</`g;RgjP&V=Dhb]fO'MP!'j$gE7S#D-3*R0.qL'32_.U-VRiBI>\0I1<00N16H7qG)9Om];!lo@=WM2Q'-UV"'>]4XRAtll/#3r'heIMMf_gXV@X:\mc?\VbRr*T;[77K4g`Pfpp/s,O&^/PE'+]E\q]\U5:]AHLnMeOYcZIUd']oh,PB/1<Yj.?r-nn[FG;``o)jc$N(qVm4uE=P!/H-5;5Iq/?l_a<Do=@-#?k($bHd*CBZZGS=?^+BUl@*nb.U!qTeDnd%-tTC3G>22j/VKR>_B7=5tXB[N$=+pIO.H;F\mU83)45ka\uh*R`(W$u53k::ipD*I,3I$VbK=(H!P2"cdpkMq:l.h0n-1OuH+*CcR)u9^eQ>K'S0sPT7^".R;HiKZ,BGYJ37@d0l-X&"&P+>a_YY[1]Bq<mC1\P0m+NmluO4T3p0Dh\SG)&3Dl[o*-.pF#%BB5P3bg/pVWEA584<JONlX@j+7UEPUDdjKF"*%&GLoAh7U+QH-&UAQ,SI0kJf_Y*n9jh/rMd^nj.L\ag$';jmW!I^askWqn1)P,9Ij[Hu2aLTS/n#4YP-TuB>6AL#i.:4.j2RGFU?Yr-6JB]_K46IDIYRu"W."+mnqS>N9_%(7:RG$V].'j:-6kEoOIO'+Lje`tT_nTfr:@n7$I:3s5glWiDlj_oj(IZjR&FX(+\haKo3?Z&5Kldgka'MC5rCU[mhKqeM?gPN3c'_S@TB"`!5N"mVY4&dNLfWE`4.bQC2WRAePLV9OLXf@*pr]TacMXhH)]pBaiaRH1Q>#_cs>PjUH<V/WW1RlET[I+XCQrD]\3J:_G=2/)3ngA(Y(M2]V<*qOpfd_u+6\dF,;u+ed3RhCY*-P&6V%[=+:quF)=3I#?@M\F5.nMNRMD2Jo5d<["A1/,DZX<cdmO\PXrrGkIW]'~>endstream
+endobj
+107 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 3336
+>>
+stream
+Gatm>>BAQ-&q801fP0JAPr>@]-Y6'qg9esn:6OYW8tRr(JLF&u9G.a7b4bZ(B9tQ>Zt.'Lm)1dg&D199qsB*C^r1/lqAH+0Ik5"$g&fHP`<ImFE+/8Xr`VG]p<78`\t7l9T'8QQ>)):c?$m-;nNj3[.l9@jUgSoKo^&spF1SWU`_@ki0F;^[M]J!$**Cp<!5Bno:asT?Q5;2^nJ)hSd(Y"ipT_F1_!mBQD)Zg2oXisC*:EbpYiMn>K2erW-h[HO$;i8_8cVXiS,ga`YagMS`?Je`EkB91Gf$on90m*]Fp43oOfVtkE#.gL%EZ;VB=1d=UFLB6[CT$a3Cdkq5mSE,^nsegJ__F]fd>R-]L!L$aJ8idniRMnh49l\1='>Aj-+HeQQHtZ&/BT;1DR5a<r-tH.WNE`*L.VB;s@X*"\76DVA*BEY_&EBd0a%t?1;WK<+),ur!M)&%I=?A-:KaCo/4E!)GboAhlnk5rMbqrq`*TQGuCn6%<OY2O_FrL'p(o*-eP;)2\R7LT/FXGmjNMb5?t1>?R90OD=>9'%V.E*-klR`:QWa]ZWE!>XsCi-oLrSIPiL/Xd^W#8nRKb!Ck7:,'=;E`64!mG_pTP!>/&?LJiW;dG2+WIdkEr:218S3hrgd7n06`EhGJ6.[T!Qq^i\9p@\YK;hf_WRB<taZUb^c4\N+kK(lT7^\13D1U:]UR((HB4@$-?@%;J`,F-%@PJUufYeT\&mWI1g=)kna*`8b*F2DRk=dtY`3V[TE>SR04)DU"_j$FW7V@EmkN-!7F<%j.&Yf\-V^A'f^7=gFhN"BmS?;T:6(&qUGs'G,se*(dMDP4/`;JnQP[AL(BVN:1Gqb]gs"p)ca`gY.H2\7XKapb^7&;m[C]GC@@sdQGW*^>g);1Z?`$ibd7Tiq(n\%>3A@-dAFNbVF\cm@p?mKRdN0PXWO:`ZEn0-1VaCG![[!9iFDE9LZUl$>:CJ2U)F%D'[Q:b[U5:%]-:X%E9brkaQelnY_FWc/GiF=p9Q"CQ,nj@4kB%?R5?XO;32TL=IJQ6RU?2]$[(hkS-"j4k9r<ENH]\RJpLB5Hl>DJ,TI)88mV!AGq3@<`m(\=@[;t4<;DD!O"2Z64]#IWC.(RbBQo^aXU`HeOnTs#.>7:p6Fj+Ooh%\$5&Y(Ui6/DffL!iVR5CnS_fbs;I6PjQOpE_q/mo:VMNh@ggPtNF3P&fM@taq;]'UXaF$RLES*oP%[/1cA$BT;aYaXj+c#B0Kl2SB4Wt3"7A%U.1a/\tkgnpYTdOq!J6*PZOmk@$r]sP@F0b'1GTeJZ/ti3%>\,52NjO_r>3U]q4F][^SLE_];:;L(s,:*.b2GQrb2Cn6lB=Jq1^%gjq,&eI?8g_XnVW/2$H6r1VAU8XJp!W@kSVIJ3r-KO+SJ.U)UlfJc9,fY(1d^!2<J6/Ho1gA9<QsM`#BR]1RFATVcRErjg'4M@%)^XRarATJEad4nSH59Hq#fB7$OrM=?>aY-]E)MLI/%SL'BBhajB=u0n!^^4PIna<@&El.AR#J=!7*E#1LVY<lB-uTG)?r.'1''B)e\B"BEhIpAt`4:(Ul(.RPA=UI)>C3/YMX*I=d?N<._<Uk\)!n::<E3o%,M-i2iQ8Fe[cS2lVo^P$DBB/acFC1IRPn+Ve:,`*#ORL'^IieUIR:R..i1cO4jq8bIJlhUBJZU]'/(eP$0pt'`Di"P"fP":""E$CoFPSr%5$7KVPR'kJY=HGoTVB$RA+`H(!#3?]UO[U2(*).qT6KAYkCs8@f6PS8e`*\*T:#h3/4,@s"%[LdA@(Y<3<mmYW:K9Le!/>5#^-jT7@n\7aEA9I;C?=nT"8[[oa=HT?:3G>-+d/DjUM*XSbIU:eW$oih%&@dkX[Xj_k2n+0FFnsl^n%XoXqr*7<b3P1`kI"RS<7qu3c#5I#-=3fc0hqZ6rJ.FUSK/r1SKq57R`iJ.\r#-*N`?u)5jh7\adNT6t(k+n>Mg,K\!-^q&ZO#E'H6II2<fUVh\\Jm\'E&NnRu4OX(S)p'm9H\]B#mjC!gQ;p4rN6i6NrhSn/LB$Y_1QfSPdWHak1q>f,%VP'0k_V:"-Ee>F]@);$$a/No:le8/a5K*n__I*r2hd(7pbqqH1*kGO*G(T_Fo<+7XSf9iD"Ef"\1&K%%9kRod_P'XF/b^5eWPfM<]8n8KnBothc>%400S>Kuh*P5u*6@3sjaTM;LQXYZoF2W:4IOFHJS32r$'.mEHEHYtV!<]t9Zh-JXC%"ai#$i*I(ihcVWBXgWjJ/@J]EJc;Hs@j)U)PhBR?b])4hND"'rJ&U5Djj(brLZ<F(PoHscR4dkiE/e)3[LpGttF.$brp$l5VMUQ0VtH'"_O)g_8+\gSWi\jR\"I4Pd^WcldFUT;OGONf<ilI[Vp<4*1m\YhH"4(^E[A.-R);qQ8/#eKG.+uJT[>.s/d0f>a]rDT1K*0<MZj*Ep]-VeNI"TM"f=8./WR#^9Zjk@Cb%5Y@3cN1qOqdpCk&U=$)[0Z%853A'AF2PG&+/Y?V'g$5\_'S?XRGrt7.;5?"MGYtg_YA?H&C,];?+bOAPj3ss>m&<Vn%;A:Y["flFkb]]>$tZ^m<^VH8c)YXF.7_@J&9&E36U`BKO`::bI)pL/H(Du$t5<[f'Y1VrcQpg:8"kggYWWB$&(C,L8D9.[eacHFq'&hN9IG1CaCeK)Xs5P,I=Np[\Or#[rq)^UV1GeMURfn@gpK$m5\FX/'=PGk'AFL]P72M$W0!E=JoHM5uTns\u>#0=QtdF[Id;3*8)%LGTtQ'%J)Rm1I`T@UHW,0b,4Kfp`<J4N&/]1TsEB4XI+lgP`i30mC<0O1unOgmL^thfg\)?6ChZml?j;'+u(3;A;XQV<@\NR<l)P9EM3Q[a6rb0Cb[OT)JQhO?/omfGPM4(1F'7/f<\l_qpV$I(dG0-7SaQ5MH:*h<Wct6^,`]?*p3--*+&of6#Qb,g&\kO%H,!E!4fd%J62DojZ2u_d8&Ld\!)HlZSEp<G8JNnhksqdjdLqaj/c/sJ7\Q4KI6n6)a;g2J!_g[:'/:X[G?o>N'ke4D>rW+LR5I4GF@,lV!/IB-U%1@`:VYKXu[Kd#dC!QGl!_19UKj\H*Kl-*9MA]P(.BTEoee.J+O5Q^YgFBO"g=2h[9+8%e?Yt-fint"bo#J?0@f'WeUmV!0&f4YYG)TRJIRUb=VR;)m+jSH]UT29_/p"g*U:Z^0dgs0q#'>MbI9IWY_c+1YjanFH"_W47g>IkI*.Hg9,G$/[MeK3?tZ0W-q,K7j^.rf<PH"`kN#j9N<4Z%DU"mH7F0"D$8-H"PY^pb6fbB-6^Seh\g54ci+G/r7@M~>endstream
+endobj
+108 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1845
+>>
+stream
+Gb!#\s)6UN'`Yjr`Oju,ctNrB'#&(\`nKj(\o-oC9KQr^O\#t+9B+HEkcq;b\)26>+G@P9C-!r38?neZT0JtBc'V>J5;W:\I"7OcW4at&CqsEeB%(G1hu_1/Hae?6.bV1f<l_4!U"O-!p#Bp'fBjS`#s.4c-V@81M?pLhO2](K%lKg!9oeP*@DTb"9q'GWs,NeJ\#9@!?\S2UE5)Vmi_cE1M`Hj:Oir0i!lNuGjU_Wg@.7\U9d2I&,=t<hI#?*Vq$Dq*0B1=FMaAWL*>^=\HIfjBZEO*`2t&E'cV>sO4MQJ+"_]TB)G'-!W[*Ok8+Z!K]oADP[dmr>P_bV,Z&mn+U:nd>$'']4B\n@PaXOX^Q)@GeJQ*n6B]\9/oGqA?LY0_.)&=VMB#O"dj_#nD%4P/Bg#dBnetHnL"eM9?nq_%VZ7*[MbH0(k7tBAUe+H$*8;`k'_Xfb^@LhpK,.ZMF;O*bSp8$j)8J<D\".@V\R+"d\X?M6c/IG8[&.dG(&&rE0o-ZU$`KR.1]PrEfi1_;am`h\7hul&=MBVaZXGLL&p#ndTJ,<OsY&)'Adm-FDi;DU4pZqetqrQqT*aJ\ir\fUq1'*P#c;[_tVQ=m1^?uNu5L*$<)bLl>fn_(]6lsU8/J/hTg4b!eo$U,bqML(8<Sq&/7mt.E8WL@98A!r<Je5rGq,_S(C`;]Lg"*^?=J4J,)QCO>H4Fd;):YbRpB>0WL/+FP=Cb[8^?(9CUN:]C=bUW0HGlM=N]3XPO$AQ;=0jn@)*,eh+G%.9nYV4\;/sY+'JOt\.[T#0":oku-l=i\D$VuLJ:?lAKc,TU35^P"dJmXlPd(F/0lg<C)fhJ`\]t8cDGl$daE;U@9B0NM\KD1m(foa2S5VNe*gX%j\@&.-G"Xi3/;dknd"9a3j[`g-Y>!%\d4;JEUK-#nbe3P7#$cn)[J*VhWK^r!iAiPtEqP<g.2=-[19Cs%he>s*aDY>lkT)"L]R-L4XW3_GL=KHD>u&5'HQKqS&=kPor:L=)P0>hW=iJ0o<3R<f1f)-roN`7EJ"<ccI-A]Q=<`o3$=(C")dqs1QGHOlZdFV_#?.HcfrNXoaG`Pn0Y!M"(?dA<4<N,()Wo4eThDUip^oWmc0V1jL;DY`j+pFnj1VL-^^X9_$uVlJkI^9:SLF)`Dd?L,\4%G#!DRUC_ufYF/r\rN@T)B1OBC"!<<B+BI2c!oEh`edh6DPa^>KPk4?b4!WRZI1Q_+WOq_mH77[6p$0hW+H8Cld<TJe+5`<&bn\aSWF/<_pN=DV,)juO02?su"*Y]?k"fP"o\7P)7ro\_Qb?F.cGSRNZ;658Ir7c-W6$&*8elaU\3-*mo(a0<-g8;;mZ-kOI.2;g*pSM7@sT6T9dD"Nh0HQS$8mk`Rjq[Xc"s5WS[f0%FfnU1IECL]lQ-[4lI*fl8Y[rI^3<s?Cd$.'Z?_I<t:mh:6Zp.qmK/[YQhi;OdH96N3/LPCS>r;mul9qhgc8G,A$>[op:K*#Cg)YkXd?aQP[(k[I;^*8mBV?%<PUF>Xh>?`M%/2^>kc#\M<RJ!22)2&#IWj0Ad3(j'3Y1Rt/r;aI1Ei^S`GOT1p%hd^IH&/q!-F"\64D3)Im\KEBpnuks88&uD9c_WM0q\;Ibj@@=n'CJ17n+Q=q`U66]GKZ4#+EnL1.,LEB;6"Geb92J&V=XhIP)/)Y%_p:N;>H[(a]gMO/52.Iee1pq;GG)e`;!d^AkD;2R?($mls%@)O3'$iU[=.7%)/A+QNr$9*"u5GG#b>;Z^UG,8DeKhru`CBK&Ylh1GPdWHu`sg,3'uO+Nd'BH9$jp2RPD%BPA_fnlb=[>R_HNO<V2mlt5nM-U~>endstream
+endobj
+109 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 2519
+>>
+stream
+Gb!#]BlD`q&H2$(0aLt$%4mCK][[,Rd5i`9e?r9j79p0LC*bUn+`g4(9&'C&=]2%D=X6GF72mIKW*R]mcC=.%$)mVdZ@C[1i*lujmg'I3_^Q.&d:)ec^)`e-Srh2lh,$f":j"HD7o;-6a7i=m^Q&%GM?B.iHudD>G+rU'j4O`2,c),?1rXuRJ4`Xgr9k>9WT"W75;>h+_eBr^ph8ZD&#3.k-%(r%!?VX97c?aoOsjc<Y=A$9_\Z[qn3%1e<<`"*M\%*l$5Pfq$`a?e'bFAFi>_U_6lI+]!(QJ=H_6;.0*VZg$bk]#DERt95<P;.:H#I37/_rYKngtM6,6qDnDXe7LWk!BR./I.QU2i&iV26gZeQ,2$Uqp!Qc#GF_?6VM/0Z7MZ-VD%cS/q0T6psDe=3W"4A;L=7A72b]*HRCEAE'r/=rqFbcar51/'[BA&1UXR6,n-/cW=G#A'J:GS%j[d1$V@d^u:E)LW*&JV>dN+&dU^j05`/J*$".o,BqXd0aL)YpUBXf,&:q53Q$@R3)qeNN$"qZ"29&hI)cZh/%>k9cfb$%T2?NgFQ-;R6X3@_<E7tKX$[X+Z%?*bGTc[\G\i9"[&4E<:o5#kFsVS]_#G]P]bo&?J*=\*UK<UTUD2AV4#@N5;eFhjIaCg]%Fis#9aKM!"(6#TZ[hLO(K9Cp\?=@d424(=7jHKMb33.?iaVa%5iG2T>fgP#`sdDehPD/5tqbG-LsXO4\#)b(CSa9)dP3jj3501ct5`:Y]&asI"PuVoYT;=E/i)gG]O^h@T:r=-?n+*q'h(`@%IQRoKLA#dHIkT(45C_I)d$e@OM\3bFY/l4"XQm7t2e3[_uiGlVgZ(W%jokiFEWVOmj4DW;X&?r;.Y'TCW+i=WS87cYB"O?NlL1B1"H::.uK(a#koCKU,*4"ObP$Ke+`__@eb=(kq@[WG;a-6PU>kW7lEffgIPQ)`kH\o>q,uBYPR(42E^G5;c&sN\14@;cEL'.3D9t]mAOf(PeL2.r"Ql^h&(O-)LHep)V.*S+1_6iZ?07oirI@_l5RV&-+ja=?PW#(r3=.>teX++#p9q^&4uI9r]XA1MK"@<)n%*R'dm3D3l1_pIAl\5Y?+!C%bd8gJQliAlCfK#,[cK,95\s??$U9B!n;#2NI:F!+MoB]o$Q'c-S`'*)j7]:b75[3g$@qR3amtlmS)p'7*'aFF`U+PUV*>4Y!Gt6*'T?8g[AirQi_mQ?28d*PmL'%(VhS.Mn/nFJb!5d6*$eI6rfJ4Kt,5Y@dLMUOON)a^Y:MJ>j;*67g)FJ=\"!#_k9>[Gn/T'iQu^Ac-t@`\+G0Xm$T*'U$@HLq\hPJr;e>e^nBCW^jp'O&/BI$K!"TJT$Gbs'=pem>,l96>TS;LSDCcA@4]A@`N6h_^8*po*VfOrUTZ[1I,i"#*MQM_7MXmBAc9rP*6urp!r:/eLb&MJ0d;NgjK1'&=I^n6Pc6fLSYu)q5PI.mQ)mMh<b2bQeMN`_s%Y-'SbDfL7'iB9QBdbpn,]2=5nkmh&3lA!Tr[A!?9k]HG0cZ\KAi=a"iA&_<J,@12O!3SF1DZJ>68<_0J0`hWET#2KZ94>i[HEIQG^YNWr=YhXt-?WCWakH^=irAPP<Jh6k@.d#LkF\ScSaEC?-J3^[u+R7LgOJYgHVDI/4CbteX?`eBjr)1=+m"j)8=R@h\b<4:'jO$r0g!iN*WSuS`RfIAY0'p9Ek05c@39G69;8@e5HL"qGdm$27`nr8MMhrEVg-]1VMh&rs%H$=[g<+K"S[)$neP`J#`B1lu^6/D??X_b(TW=^Cgip%.?(/$X^<`\^h=MSpcZ@G`i!fjXQ"ahf-BKJhnblSfH7uoL1I+XlXWKW*g>V@2-l^G!>BZg#=Tih?"N[tfR(dr-^\-/S&fW`\HZsA,Rp\F2n*%a=)/Iq"e/3O3]m7jhT7I.c2Xkb]+$8_PXreG^nohdFls7?NJ1aDg!JpO'[9+_q7O>9:-6+sRhDTR""YqNb_n+s#rmnrr_g4\pf?2[nY^0dlUrB90TO@3C2-AZK:L0r5EhB!g->=le/d;L<%8irFgLa7,5HHJhc/N7c^Ukg#G`k3,Z`tVrS39&sfBpdD:do*;X.2HZ8S6'EEVm&1"&LjWq3KgkmpS3u^MuYR5Cqt>,R_X.WkV-.4hW*Aod4.Q.a7:.$_sL^ck@d\OU*e`5BN6imGdH7%S$a_]`eU]J<9m5dc>uP1]2!RtRg.L$H+JpJ:#eYfNp&X^7DFbD-iO$hnjtpl\*JQi5-W!-qjA"rkc!ftmQ<+'F3bMF=!igQ@dK*]L07Q=b4k[sS'!83DJu(!(?H61*3DEr[pqsA&"Zj?qr%GX-gmB!m"g5,Gq`)+WN*aU-@bVgPdDec`M2d1.gWD:/@iN]2rU>m9=J_R)KQB!=<p,PDNW/P^WM#V!2K#,0=nkVVs)B8MV^D^BKNPY7N0;S]m6X)Rth?!GG\1f*<Y2PrQf=AB%7u7Dt:.7UHrb`?Gm%nB2+2Q2%9+;oJ(c<r!b$'!MjHG?2~>endstream
+endobj
+110 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 4025
+>>
+stream
+Gau0F>B?9)(4Q"]3024`NG'pW`4K#b-[+X8A3@:U2%Qj1[@nm$!Lbhf>Pma\1j<KK`L2r@Z%9W\lh?rf!\422m!gA_\6QlJRK1`C[0C(g#-:#*e`u5M#q9%1/4J*G#trac5AUG6ARFP[fURWIa=tC`D+,]'!mWV3"G?AC-]5T6Q^.Z-^Pbk>Y+q2Lc&,5QKe9WRBeNM`K<FAfC%`\"m]]2X%q*T[ZPE)b7aM,VH1D/?J&CP!3TqR[;\)RC;R(2YY8I;SQTVgUad*8&67?J.3g6FVb!KCHAg\BY'1kGV]"tqWD$f>YDo]fD)0KGg(b2O^/%!rtL_)RF2So=FaJUPT"LEBpSk?OnX-l9DCc5@=YF1;l]DOgnIfJg#o6ImZC6I8)-!qj_-7o/!iSXT]Z$Q3,rUK9u/P_Q&QRMA*G0=mkYSN0,gWf@N[Rh+NDs-^KRnLi5'Sh`'SEWsX4XWpVe;'YtWuHk6Y2_UDX_#RUaJ#kD\1RnHoF`cac,E>8QWp=a'J!tlq,uZce$5'Cn_`4OMPVm6PJH/GgCGZh#u=\`;'F"*OUl[2U'`LCIJ$Eb<nm)nl8?$6DN>C0nH#9Q%g6BSVKOt+ohb>11cnd(r*2BaT68&m74^Z)&&m]r%eO1sb/,o6'VVKTb9^:`[<+@S8_)`qDn=F;;,M5!l85a!Wr")u\4C;#]WHS*b'al:#ep3.(XUM4lFM>]j3iU(T$&hG4n9<EZ[d?c#bEAL\:OMp2TN&?KcApaJU:*q!li8D:lP)k\eMTrqqZZeHPF]%H\e*BGn,b=GoRaFG.!a`d[7T7j<\#D7R73l`!eh?Z_LA`7-"%KVZjFm$8-B_#NL^MM4e9NS]'R:$hDg`'?\kbj!G42iJrW[#N<5'BXHZCR8cp!.n>#b<e4j3[XMIM$[Ya"n+8/*/+k-ZRgL?-JJH1]fYPP>^W_?X[hE\nBR!g@-)p(pNZ5Nc</N>GA[^<=1#1Si]`TpDHkrq?M,E_W6-iAER"u*18&ZutRDrRSi`q>=&7<R%<s\n#K]g:A"],n]6j5%E*$.-XR:(s?IFQa+?5cFOUClo-Pu5N>)86ARBpu&q=)$qe`8bAQ=T"8F]cPtLLU*B^TJhjHY(SeCo\iD-MJ?k:WIppXfEDt24kloSO1B'l(_g0a@=AnIWlE;VOk'VoN5^UcTJc>X8#a;_gbsT=4#DcR.Ak6udg*U5VU>h3iUf!Uls#dKEMKo_%/qKfkqCJIi^BS;P4hH545f@_i95PmQH$/?6[qF8FDs_"(fjFh(QS\-dP9LgRkG=#N;BI1HLY'%04^c_5:rXImD\*NaRoGb._'TX@j%tj:K:Md2hThF!/8\=G<`^]6egE=+7J*G:tKf+U$Z\_7Ui?i30o]\_2O_N!`Fqi>A4JOXhRXcJ.HF3qOTqBE-$a628C5B6<JT(<7".-FmaN;1rM*(J8Y-=J,s^>=gdRMP)WoL)9c1lfSpcLceXtnpj<c3/dU1N_UabL'%81-K;lrMK:m!:N&m\(fEU52-MEU<D_Vf2(5O.-K%*;,a`na$HNcTS<9QgYd?+8L8kWreJ5AV;DlG*0(1>5tA"a#.!FhZ'=<P5q4;Ej;Jt3LG9!lX4>T8YY\:J8R2S)GR:19^9Qn-'SP[dZG!LMhu-1n#!200D?<?(];!G1?`]nAWqYb5]5MP]KMW4RVkW#A>uK:2jk1?#?._.@l7EEIm7G)jVnH>Z)KFF>9%8j.AIrkeCQg/<kH&>X</Tl-hV:V]Go\jqLrMe,F3AC!j((>j#BYQmR_:e\?W`mP'q(br-Y0LcJWX3CV_,C2QobM!O#'faOF"p\Hc?86=Vk\Q7U]b$AE]c<aS<S^4-O!na:+8MY:GAr4j$,iUB7W(W_`B%:=9-(8d]rU.ip!llr81GI![PA0+)Y%#Q?O6q9KrUc3jfu+k6DL`GAqdV03a/&JLmZp)L:#(uRZ&[m%9ANrPT$)lp`M(TDs-^s$?'e3<p)=1juY=oW7\?87B%utngBCd(m,5cgMY7EAoWD8q+l=,*U@+f;tmF(n(h"l(X=X]l?n$@cZs4WX$%Hdpito%+Uc+?TnSa7lJC3u&",:_Ua??Fc6:i\hgG0L4j,%2V"=gphg)ISD%P0-9d=uF\K'YI/U?X!nm#:\EUAWl<m$:XYkCI^;p).))8aH%k'8rn[t\kH$e'dJk:`k01P>gPP-$e%cb)-":mJRSi#E?!3E7CNQs"pumZ^;"Lg5W2O.6OnLpb%4/9I;9F!r@E:V'Hd8E]K!@Rtos=UCkkRX:T520+o;enZ5RR@O(?(i!C2LYpO12M+G!I71Zc_K0B3!5p90`&D@.SS%DQ1/7&(jWJV$h4"sfY0dum:h:K&$?#.i<B$%pTgZBq@4,F*=einOD\&U<mR<CS&/#`GoNgfX!kSYpP)lC5>MZNQ^bl@[^p*V@+0/1`Mo<`Xl4[kB8EqL'XYj>U9ShjM+7SO&,dNmcQCBqX"*I78<9/<p\VRsB<J.8`#JZ$5/o=*4=b`21KGTCL(MfF>BXe;f8&g(/,J"1?ZM5KH-SuZ1nA5?)6,*0d'E1J8n6CY"UAb%[;p"S!V80&SA9DqPa*.='O[>gdiDt%S65JjQESn!.Mf`o3?!fNB"Wd%kO4L^-eR0kndhTCciidWn$G==3jH][0VF6C*UdIgi\JSpN1:9g<*Q0'FR$.E*OmV8g^e=86j-n50lK!^SV8\h7hl]2=&WD7kdg,kOg!o?`OkErElq1hXT(.u2q.j(WpknYu9;A0Nk^0!bL)fn'W/g':4G1!2r&YE#(fCu?;%hlqY#IMT()^a]#,;I-EK@239BX6\P6MXpB&W+&:\"ZYS)`*m,R%/F$LY*ucPW#\_+L-;$<9F-ihV8jq0J#e)oJWORGFO_Eo`b<cUrYSrcl?aQ"U$#i$RQ@&;':OR)N'serb17S,ntTp1!pe4"q97*ghl-,Jp[GMM"E0b8<E5:m@EEF_83Y,\O-O&kb^@e^IADFbBL"LU]>p>)%g:C!I=rWS5u"',SC[Jo4..M2WI3#/]^rq6[)i$1=RCX*YGY>fSDSJ:i:C3Ha(=[mR7JR%pjN<:b0UC%f7Wa>.Ft\Yg6)T$+trX5o;NRBer(Z@2Aj8CISM`4-CAN?5_DNGh>c[pTDqf^iI*>nGOARPajX0CW_b_obGmgdd^6R@c<NGrY3g#S\QJ5et_klG_hi;<'bkM^odlB^PDh@Hj(OEe8BF[XP_;btCfU%VU2qOBmb=2jj0:,^juV;a;"ToG@TL5pM[I%;`G4K63.tZb58G(fe.4!O6r]AP>iBmuUet,?]o'_abfh7H7&\ms)Wr_$o(>W25-IbG@r0*;kgWJgEj:q_9UPY]/b3*m4%<lm+H;oVMGBr.H5/^%Qi4:!X)cjZ/!QSS^%"V'G%aYZYN^o5e$*R+J3]s5k<;n1MIXGgIn>bXgClrh5=d/0N@&XdKtgno2hUoSb%[5X@p"I?Ak3Zb=)AbPOSbl;APK*G.8[`ZK31H$r[HLc@sJ+7f72<&;D:UF!D=eo23JneB&57mn#W#='[f=(]"#M9iKg=)j5r.NQIlHL3_aZjS@EN4tAJ/mDRX5)pl%<Pp'"[kWu_q9;_1=E@s"k/=&]I-ii^[B!)Hl`AX>%nW*>L:sYp[b4i8WP=Vk(7R?WHkA@_p?t"p_[S(`Z]?nPU=rV"WQ`XQAgd%]ThDrO8[H$-K<3AJZh^tJGEK6u;Q&8T9nr'[N?F.*Dj0/G8n11YMoWI`A2p;I3dL'rrZV]/B1LZd)#O:jSej?<((Wi.jIoF_$V%@pl*F\(r]e?cR-??_TYbjnHbt/0*/a>F,irUPhNBdb>gdd-*$cOdk/,dq+;#JO<KcMWWgu?L8mo_pbFH5l1uW)!"jHZ1_KCM4SSbq+p>)D1:HtBd]09TZ?AqhC.l-AN($=_9qg>_7c+%51$M*QGqeE9G/+f:aiRJdIs([KNPc44Trm:!'Ts[diejrd-4Jhd!K44jm/l7i<Onmu*GO<a[E=t>L*o.C?WEG*j'+6Wq0aY+jM\%\'mrJm;/K)IJrrJ*jJ3*~>endstream
+endobj
+111 0 obj
+<<
+/Filter [ /ASCII85Decode /FlateDecode ] /Length 1141
+>>
+stream
+GatU2>B?8n'Roe[30.s$,"ht?9V9b_agTZ?>0"6NR:0WfD-B2(_JZ]pILk'X`9SAq_(drtkJFdn4(^bJ@a0+e"2(8Ck`u800V&;eM$qeY0V/c'%bOf\"GAh["5e+gT?p$5#-BPb(_ino4E.uqE5i&d0aEYhq:boV"n_s6p?u31Nup-'iR\BCi>6X_q8K6:<+qILWbcJ12^RG_.>S)_[Kp.HeeT#Qnn/29D*PD(MX?3u7]BcX@ZcX]Q50jk-Z<Dh*N!c@(uOh/Nl)l4";S*Hp\-ffSLFrP80H2Y[Sd;bq4q*Bd;W2$p=cl5^*a:4UIoCn>FU<tdXNmoYCG@)1cF&;ZVG!6[`m/,*f!A-9.8:C\:;;`8hbUZAMX6>e%_S5HDVb@SB.9,IG\Lt2l@7">qM#@;3g:Dm];;/=]B"=RVS*o<.k1thlgj"-u0u-Pt>Hn[aI.VO2G)_AYsKJ<#31dNUTiJm)e&QGk[/G2n?Z9rc0$]D5>RoZ-gG0Ek+q^<2OG:?'KI2Y[_CQ'PI6eaLNiIW3siMZ:]6?=DEpDc9f1+&^Hst/Bk)bpPl@N]Mu<p9o+p+o?m8RdF%XJk0K+;n]g^0anW0-pC7+)cJ$0@kX6FUd@]psqg\h)G<H0-pW;6AGjqc-643OC^b^5N#;%OYcWd)sl-&7sI>f)"oo\>t!(o<Q\\/*<Zia.i!;P4J8CSX[V%(4c\>a->C9=^gKl;=WG<I,OO1MjG)"E%:f0)*p^]P31a)M]K*WGYAlPQ[La.(%&]&eo6LL$BXa?0M_93EfFVADbCA@H`9)a).a1uODW!-+Hu#K6@]kdGi_FjI6jekn_A:Sh3Br5@lAS-u3[GGfVYejkp7SflO\i@E]4OHhkUZ=ujsMr!dhGLMsCc^4Ygi3_sPT$[)jl0l%:9ik;!EH/]`Vhp3NnG_p"HipW+f#grAJN7Tc8<Aubp]E]R?p`b%bd(O8@A;c2,%4ZrFSnKPmiYJ=VP!,o"h5leGiZ$rf1+u.2)D<0-VOsQs,5q,=EK?$V))YjiP\dc0IM&!i%aLp);>5:F#MjTm963kF/[`U^P5s$$QnI^i<gbskj3PNpb$'jJGoB:X9MDRLtE2QVn!jH*"Q0Pg`mkMJQI&ALgrTbfmZe<)#Oa[grgl~>endstream
+endobj
+xref
+0 112
+0000000000 65535 f 
+0000000061 00000 n 
+0000000146 00000 n 
+0000000253 00000 n 
+0000000365 00000 n 
+0000000513 00000 n 
+0000000661 00000 n 
+0000000808 00000 n 
+0000000956 00000 n 
+0000001104 00000 n 
+0000001252 00000 n 
+0000001400 00000 n 
+0000001547 00000 n 
+0000001696 00000 n 
+0000001843 00000 n 
+0000001992 00000 n 
+0000002140 00000 n 
+0000002288 00000 n 
+0000002437 00000 n 
+0000002586 00000 n 
+0000002733 00000 n 
+0000002880 00000 n 
+0000003028 00000 n 
+0000003176 00000 n 
+0000003324 00000 n 
+0000003473 00000 n 
+0000003622 00000 n 
+0000003771 00000 n 
+0000003920 00000 n 
+0000004067 00000 n 
+0000004216 00000 n 
+0000004365 00000 n 
+0000004514 00000 n 
+0000004662 00000 n 
+0000004811 00000 n 
+0000004960 00000 n 
+0000005108 00000 n 
+0000005256 00000 n 
+0000005404 00000 n 
+0000005552 00000 n 
+0000005700 00000 n 
+0000005848 00000 n 
+0000005997 00000 n 
+0000006113 00000 n 
+0000006219 00000 n 
+0000006297 00000 n 
+0000006381 00000 n 
+0000006588 00000 n 
+0000007076 00000 n 
+0000007283 00000 n 
+0000007490 00000 n 
+0000007697 00000 n 
+0000007904 00000 n 
+0000008111 00000 n 
+0000008318 00000 n 
+0000008525 00000 n 
+0000008732 00000 n 
+0000008939 00000 n 
+0000009146 00000 n 
+0000009233 00000 n 
+0000009559 00000 n 
+0000009634 00000 n 
+0000009726 00000 n 
+0000009829 00000 n 
+0000009978 00000 n 
+0000010068 00000 n 
+0000010173 00000 n 
+0000010268 00000 n 
+0000010423 00000 n 
+0000010525 00000 n 
+0000010652 00000 n 
+0000010772 00000 n 
+0000010889 00000 n 
+0000011036 00000 n 
+0000011190 00000 n 
+0000011306 00000 n 
+0000011445 00000 n 
+0000011567 00000 n 
+0000011681 00000 n 
+0000011833 00000 n 
+0000011951 00000 n 
+0000012089 00000 n 
+0000012236 00000 n 
+0000012360 00000 n 
+0000012490 00000 n 
+0000012627 00000 n 
+0000012734 00000 n 
+0000012884 00000 n 
+0000012991 00000 n 
+0000013103 00000 n 
+0000013239 00000 n 
+0000013375 00000 n 
+0000013479 00000 n 
+0000013602 00000 n 
+0000013723 00000 n 
+0000013846 00000 n 
+0000013972 00000 n 
+0000014092 00000 n 
+0000014208 00000 n 
+0000014303 00000 n 
+0000014445 00000 n 
+0000015538 00000 n 
+0000016990 00000 n 
+0000020678 00000 n 
+0000024013 00000 n 
+0000027947 00000 n 
+0000030735 00000 n 
+0000032923 00000 n 
+0000036352 00000 n 
+0000038290 00000 n 
+0000040902 00000 n 
+0000045020 00000 n 
+trailer
+<<
+/ID 
+[<f6ba50be391dc4d05b8430d9019777f8><f6ba50be391dc4d05b8430d9019777f8>]
+% ReportLab generated PDF document -- digest (opensource)
+
+/Info 59 0 R
+/Root 58 0 R
+/Size 112
+>>
+startxref
+46254
+%%EOF